[PATCH v2] audit: don't use the caller's root when it has no fs

[PATCH v2] audit: don't use the caller's root when it has no fs

[Nguyen Ngoc Thang]

audit_log_d_path() calls d_path(), which resolves the path relative to
current->fs->root. do_exit() runs exit_fs() before exit_task_work(), so
a deferred __fput() runs with current->fs == NULL and d_path() oopses:

  ima_file_free() -> ima_update_xattr() -> ima_calc_file_hash()
    -> dentry_open() -> smack_file_open() -> smack_log()
    -> common_lsm_audit() -> audit_log_d_path() -> d_path()
    -> read_seqbegin(&current->fs->seq)

Without an fs there is no root to be relative to, so log the absolute
path with d_absolute_path() instead.

Reported-by: syzbot+975ace299d6ba2eb1cea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=975ace299d6ba2eb1cea
Fixes: 4a9d4b024a31 ("switch fput to task_work_add")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Changes in v2 (Al Viro's review of v1, which patched d_path() itself):
- d_path() is meant to be relative to the caller's root, which is
  meaningless here, so leave it alone and fix the caller instead.
- audit_log_d_path() uses d_absolute_path() when current->fs is NULL.

Reproduced in QEMU (x86_64, KASAN, Smack+IMA+audit) with the syzbot C
reproducer: without the patch the first exiting child hits a null-ptr-deref
in d_path(); with it the reproducer runs to completion with no KASAN/Oops,
and the audit record still carries path="...".

Al, does this match what you had in mind? A final fput() in some unrelated
task still logs a path relative to that task's root; this patch does not
change that.

 kernel/audit.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 9412af9144bc..32085674d0be 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2218,7 +2218,11 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
 		audit_log_format(ab, "\"<no_memory>\"");
 		return;
 	}
-	p = d_path(path, pathname, PATH_MAX+11);
+	/* No fs after exit_fs(), so there is no root to be relative to */
+	if (current->fs)
+		p = d_path(path, pathname, PATH_MAX+11);
+	else
+		p = d_absolute_path(path, pathname, PATH_MAX+11);
 	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
 		/* FIXME: can we save some information here? */
 		audit_log_format(ab, "\"<too_long>\"");
-- 
2.43.0