[PATCH 0/2] audit: drop BUG_ON() calls

[PATCH 0/2] audit: drop BUG_ON() calls

[Ricardo Robaina]

This series drops two BUG_ON() calls from audit_add_to_parent()
and audit_signal_info_syscall(), replacing them with alternatives
that avoid panicking the kernel for conditions that are either
debug-only assertions or defensive invariant checks.

Ricardo Robaina (2):
  audit: drop BUG_ON() from audit_add_to_parent()
  audit: drop BUG_ON() from audit_signal_info_syscall()

 kernel/audit_watch.c | 2 +-
 kernel/auditsc.c     | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/2] audit: drop BUG_ON() from audit_add_to_parent()

[Ricardo Robaina]

The BUG_ON(!mutex_is_locked(&audit_filter_mutex)) check in
audit_add_to_parent() will panic the kernel if the mutex is not held,
which is too severe for this situation.

Replace it with lockdep_assert_held(), instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 kernel/audit_watch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 06dd0ebe73e2..4ac8a91e9ba8 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -372,7 +372,7 @@ static void audit_add_to_parent(struct audit_krule *krule,
 	struct audit_watch *w, *watch = krule->watch;
 	int watch_found = 0;
 
-	BUG_ON(!mutex_is_locked(&audit_filter_mutex));
+	lockdep_assert_held(&audit_filter_mutex);
 
 	list_for_each_entry(w, &parent->watches, wlist) {
 		if (strcmp(watch->path, w->path))
-- 
2.53.0

[PATCH 2/2] audit: drop BUG_ON() from audit_signal_info_syscall()

[Ricardo Robaina]

The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in
audit_signal_info_syscall() will panic the kernel if the signal target
pid array overflows, which is too severe for this situation.

Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 kernel/auditsc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6610e667c728..2b9ce0b52511 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t)
 		axp->d.next = ctx->aux_pids;
 		ctx->aux_pids = (void *)axp;
 	}
-	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
+	if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS))
+		return -EINVAL;
 
 	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
 	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
-- 
2.53.0

Re: [PATCH 1/2] audit: drop BUG_ON() from audit_add_to_parent()

[Paul Moore]

On Jul 28, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> 
> The BUG_ON(!mutex_is_locked(&audit_filter_mutex)) check in
> audit_add_to_parent() will panic the kernel if the mutex is not held,
> which is too severe for this situation.
> 
> Replace it with lockdep_assert_held(), instead.
> 
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
>  kernel/audit_watch.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Merged into audit/dev, thanks.

--
paul-moore.com

Re: [PATCH 2/2] audit: drop BUG_ON() from audit_signal_info_syscall()

[Paul Moore]

On Jul 28, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> 
> The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in
> audit_signal_info_syscall() will panic the kernel if the signal target
> pid array overflows, which is too severe for this situation.
> 
> Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead.
> 
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
>  kernel/auditsc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 6610e667c728..2b9ce0b52511 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t)
>  		axp->d.next = ctx->aux_pids;
>  		ctx->aux_pids = (void *)axp;
>  	}
> -	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
> +	if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS))
> +		return -EINVAL;

Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly
ratelimited, but given that I don't recall ever seeing this BUG_ON()
trigger I think this is fine.  We can always change the WARN_ON_ONCE()
later if needed, getting rid of the BUG_ON() is the big win.

Merged into audit/dev, thanks.

>  	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
>  	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> -- 
> 2.53.0

--
paul-moore.com

Re: [PATCH 1/2] audit: drop BUG_ON() from audit_add_to_parent()

[Ricardo Robaina]

On Tue, Jul 28, 2026 at 3:53 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Jul 28, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > The BUG_ON(!mutex_is_locked(&audit_filter_mutex)) check in
> > audit_add_to_parent() will panic the kernel if the mutex is not held,
> > which is too severe for this situation.
> >
> > Replace it with lockdep_assert_held(), instead.
> >
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> >  kernel/audit_watch.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> Merged into audit/dev, thanks.
>
> --
> paul-moore.com
>

Thanks, Paul!

Re: [PATCH 2/2] audit: drop BUG_ON() from audit_signal_info_syscall()

[Ricardo Robaina]

On Tue, Jul 28, 2026 at 3:53 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Jul 28, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in
> > audit_signal_info_syscall() will panic the kernel if the signal target
> > pid array overflows, which is too severe for this situation.
> >
> > Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead.
> >
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> >  kernel/auditsc.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 6610e667c728..2b9ce0b52511 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t)
> >               axp->d.next = ctx->aux_pids;
> >               ctx->aux_pids = (void *)axp;
> >       }
> > -     BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
> > +     if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS))
> > +             return -EINVAL;
>
> Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly
> ratelimited, but given that I don't recall ever seeing this BUG_ON()
> trigger I think this is fine.  We can always change the WARN_ON_ONCE()
> later if needed, getting rid of the BUG_ON() is the big win.
>
> Merged into audit/dev, thanks.

Makes sense. Thanks, Paul!

>
> >       axp->target_pid[axp->pid_count] = task_tgid_nr(t);
> >       axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> > --
> > 2.53.0
>
> --
> paul-moore.com
>