[PATCH] audit: grab a reference to context->pwd when it's cached

[Jeff Layton]

On Thu, 4 Oct 2012 11:48:23 -0700
Peter Moody <pmoody at google.com> wrote:

> On Wed, Sep 26, 2012 at 6:50 AM, Alexander Viro <aviro at redhat.com> wrote:
> > On Tue, Sep 25, 2012 at 10:03:23AM -0700, Peter Moody wrote:
> >> Hey folks,
> >>
> >> following up on old patches, are there any comments on this? Did you
> >> get around to finding a better way to fix this bug, Al?
> >
> > Alas, I've found none ;-/  Looks like we'll have to go with this one,
> > at least until somebody comes up with better solution.
> 
> Not surprisingly, this patch doesn't actually fix the issue (or at
> least doesn't do it correctly).
> 
> I hadn't noticed that get_fs_pwd() actually calls path_get() on
> &context->pwd so the additional path_get() is useless and the
> reference doesn't ever actually get freed if audit_putname is called
> while we're in a syscall.
> 
> Al, Eric, Jeff; do any of you guys have an understanding of what the
> initial bug actually is since this clearly doesn't fix it?
> 
> Cheers,
> peter
> 

Hrm...so yeah. The chdir call should have pinned the dentry. I think
you'll need to track down where the oops actually occurred.

One way to determine that is to do something like this, but you'll need
to replace the kmod in the instructions with your vmlinux:

    https://wiki.samba.org/index.php/LinuxCIFS_troubleshooting#Oopses

-- 
Jeff Layton <jlayton at redhat.com>