[PATCH 1/2] audit: flush_hold_queue(): don't drop queued SKBs

[Luiz Capitulino <lcapitulino@redhat.com>]

From: Luiz capitulino <lcapitulino@redhat.com>

flush_hold_queue() first dequeues an SKB and then checks if
auditd exists. If auditd doesn't exist, the SKB is silently
dropped.

Avoid this by not dequeing an SKB when we detected that
auditd disappeared.

Signed-off-by: Luiz capitulino <lcapitulino@redhat.com>
---
 kernel/audit.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 91e53d0..475c1d1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -380,7 +380,7 @@ static void audit_printk_skb(struct sk_buff *skb)
 	audit_hold_skb(skb);
 }
 
-static void kauditd_send_skb(struct sk_buff *skb)
+static int kauditd_send_skb(struct sk_buff *skb)
 {
 	int err;
 	/* take a reference in case we can't send it and we want to hold it */
@@ -393,9 +393,12 @@ static void kauditd_send_skb(struct sk_buff *skb)
 		audit_pid = 0;
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
+		return err;
 	} else
 		/* drop the extra reference if sent ok */
 		consume_skb(skb);
+
+	return 0;
 }
 
 /*
@@ -416,6 +419,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
 static void flush_hold_queue(void)
 {
 	struct sk_buff *skb;
+	int err;
 
 	if (!audit_default || !audit_pid)
 		return;
@@ -424,17 +428,12 @@ static void flush_hold_queue(void)
 	if (likely(!skb))
 		return;
 
-	while (skb && audit_pid) {
-		kauditd_send_skb(skb);
+	while (skb) {
+		err = kauditd_send_skb(skb);
+		if (err)
+			break;
 		skb = skb_dequeue(&audit_skb_hold_queue);
 	}
-
-	/*
-	 * if auditd just disappeared but we
-	 * dequeued an skb we need to drop ref
-	 */
-	if (skb)
-		consume_skb(skb);
 }
 
 static int kauditd_thread(void *dummy)
-- 
1.8.1.4