From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.180 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792500631; b=HSvQjv5dRP7H9OqtLh673vsAE/bbKcIIV3Hk+kPh4TsgOl35hgP3WJNF8yWp1PpJLBji MWBp5zS65rscZNAEXPR2Sf1LhAEyIZja+drVq2DajeodwgjKieiqlH94aUEPaFhdmJEMd ZmRXEOYhQxdp1Epmk8dovSA1Zugc7pW2eNf8TSnbYXkifVhozbo64SM69c52JXr2DaX6O qnzjQycBCiAtmjM8WQQAtsqWnlEfb/arkvh/7Hk+DJ6m/JwxfF8/038gHB2mnUih2/8qn cYrI6g271nF+KYjIZhJiJIm/Xy6vqfYibtYkzAgJzQqSZG6jOFvNh1keaIfqtngrMfA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792500631; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=MXdHjYF/iFD/DCy7EzXB6+0TlqrWF/Nncm8XHDPT76g=; b=nLlQy3xV1jpBMv8PXZZtzbinJ5rmh3ZPnBnJpiNqpfkPRsZ8SRuk40QlOdhOw5S3R1sC 3RjFVHFzivyqJNLyVyoMesWW4ObOz0ekl2up+R7RmkFLbC+uB7McVRChsV/ScUpPNKPM5 5lB8n1jasknyGnKT+HRtvkcnrgD2FEXmO44Mw5u3W8nFTJW12ZJ6Ry9aQcLY+5PC05cva y0k3I9wKEY2qKyC78k3Ps2y0IrXBdAQx5u0F2eVK+R0s8BRvMwgvHoAPq8hl8tBVZZYYC 8r4wirEmNDf2enroTsn03NRV6H8oKeGhUuEw8w4hCaBpz/UJDP9kZM9tnWICEB7RRiw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=IHCblJZf; arc=none smtp.remote-ip=209.85.214.180 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66858606A31C for ; Tue, 20 Oct 2026 12:50:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 66858606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=IHCblJZf Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2e608cd460eso17444405ad.3 for ; Tue, 20 Oct 2026 05:50:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792500631; x=1793105431; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=MXdHjYF/iFD/DCy7EzXB6+0TlqrWF/Nncm8XHDPT76g=; b=IHCblJZf3H7599IBWylg66gU0BdWkqOQqEm/SXRhQR1bUZoFbQktsi2LBaQRTQeR5m Hj+fW8zZoHJTNJj1PHYnEdUekhAcSKhL4rDIWZoe6EhAUiL5hKfkgkvhMNTkQXlu1Sgh Hf1lJR03QSEY4hAbCLfviHGJyrGpC4KByDFUnEAK1gJTpwW8CJn0Z66von5N0T2Mi7p0 gwJK3UlGsFIPvB9DcM8nmC+TVpt7Yjf8Z+kBI5up04AXWwmWL+AFkfCre8ORKyhUzAtP jXXPUAbKE+Wna1Irkj7ES7OKkZ85qTx0YcsS2fuocZmn2xpypw3PyoU55nQuhoEDbm8l dTMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792500631; x=1793105431; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MXdHjYF/iFD/DCy7EzXB6+0TlqrWF/Nncm8XHDPT76g=; b=b+Th74k7wcnrhUVhyeOwbsGhF+O+QztjtK6xkU1KQbVEImvtNrgeuOO2h+/CTOF5SE 8IFJD+lQBXJkG94PlI5s54tdlaSOQ27e5l/GyR7FvGLjyQMvtWKvpwE+pDRzzjY1Mf/X nbqBAi59D+RdRlH2gRNo5ghe+ShzmNmn4vK1yq26Nkbp41UpzpyilF7oHzcoVrrDuOl6 XLEPDMdEwxGU5mL2SxKj8mapD4IJ/dJgCsZ5HN0STBfwat1N1DusOG9hiuHc/Pw1uVTu zWCNTqUn/BjsU9sLDFN+XlG3B3XYJJp03imiFLNxOT2R2fdBo1Ja/LdXN7PZ90r+iEqH 2ZVg== X-Forwarded-Encrypted: i=1; AKwUvBz07sCTGWlrove40gYJd2zfWxIknvdPFGSnTj9tM9MPIOscJ0VakKcZRzA8uo1a7BuI06HvNPGQVf3fvms=@vger.kernel.org X-Gm-Message-State: AFq9FYLs6y/NFcVbbEnbq4oJ0+c9L3gVxj58An0MMEZE2XWKI9zhHdXc p4CUrROAG06+ZfyFEsA1o3foj5AfwKjM+UjZA3NTTapQdC9t15XbAeMJ X-Gm-Gg: AYBFou3SbLPFurhfinxxwtpGSnxiBvo9G6JHZ67lOgVPL2Wwz4H6mCKSsY684stXyyW q1z566j04BZ1M5Venrr0KJ7eIBjnHKxTAuaI0KMWeyEwHfWEEcM2v2+ff7HKC7Rruf+5TQXfupC DCyWr0ApUeP3A1F45610eONPEqNufmv2pCWPxnMJSY0FpWIBkNWXj9Iy/h8NdzkPcKar8HROczA VvxPMUOrSgphbI88nXLE08EybFRo9vVqA2c7kF205g4Se/9pWB1k/cPTsWb1u2IYims2Ox+pqd9 8JPaJb9nVijfptgmxLBSJLwj8AQKJ8Z4T/hxREzqRJcubiboIWq8AXX+cokyaNwMbftZba6cC9Y IW9dO7gC0sopWfwgZG9YVD0qNWzsxTNRA5l6Ieul0Zf5jDHfCTdiDEzWlcIII8iVdDHvCsYWvP3 lv5XUhN68JjAWXfqXCWa4nEnj43+1dHhp+vTkK/RE419z0EJpwgmlpgmWWdTMKD6UCZznxt8Piz KKIttwzy6M= X-Received: by 2002:a17:903:41cf:b0:2d9:520c:38e7 with SMTP id d9443c01a7336-2e9a68346e4mr91135645ad.1.1792500630628; Tue, 20 Oct 2026 05:50:30 -0700 (PDT) Received: from thangnn-ASUS.. ([2a09:bac5:d45b:2646::3d0:4a]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ea151a2a85sm11467305ad.71.2026.10.20.05.50.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 05:50:30 -0700 (PDT) From: Nguyen Ngoc Thang To: paul@paul-moore.com, eparis@redhat.com Cc: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, jack@suse.cz, syzbot+975ace299d6ba2eb1cea@syzkaller.appspotmail.com, Nguyen Ngoc Thang Subject: [PATCH v2] audit: don't use the caller's root when it has no fs Date: Tue, 20 Oct 2026 19:50:24 +0700 Message-ID: <20261020125024.8550-1-ngocthang2710.1999@gmail.com> X-Mailer: git-send-email 2.43.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit audit_log_d_path() calls d_path(), which resolves the path relative to current->fs->root. do_exit() runs exit_fs() before exit_task_work(), so a deferred __fput() runs with current->fs == NULL and d_path() oopses: ima_file_free() -> ima_update_xattr() -> ima_calc_file_hash() -> dentry_open() -> smack_file_open() -> smack_log() -> common_lsm_audit() -> audit_log_d_path() -> d_path() -> read_seqbegin(¤t->fs->seq) Without an fs there is no root to be relative to, so log the absolute path with d_absolute_path() instead. Reported-by: syzbot+975ace299d6ba2eb1cea@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=975ace299d6ba2eb1cea Fixes: 4a9d4b024a31 ("switch fput to task_work_add") Signed-off-by: Nguyen Ngoc Thang --- Changes in v2 (Al Viro's review of v1, which patched d_path() itself): - d_path() is meant to be relative to the caller's root, which is meaningless here, so leave it alone and fix the caller instead. - audit_log_d_path() uses d_absolute_path() when current->fs is NULL. Reproduced in QEMU (x86_64, KASAN, Smack+IMA+audit) with the syzbot C reproducer: without the patch the first exiting child hits a null-ptr-deref in d_path(); with it the reproducer runs to completion with no KASAN/Oops, and the audit record still carries path="...". Al, does this match what you had in mind? A final fput() in some unrelated task still logs a path relative to that task's root; this patch does not change that. kernel/audit.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/audit.c b/kernel/audit.c index 9412af9144bc..32085674d0be 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2218,7 +2218,11 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix, audit_log_format(ab, "\"\""); return; } - p = d_path(path, pathname, PATH_MAX+11); + /* No fs after exit_fs(), so there is no root to be relative to */ + if (current->fs) + p = d_path(path, pathname, PATH_MAX+11); + else + p = d_absolute_path(path, pathname, PATH_MAX+11); if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ /* FIXME: can we save some information here? */ audit_log_format(ab, "\"\""); -- 2.43.0