[GIT PULL] audit/audit-pr-20260814

[GIT PULL] audit/audit-pr-20260814

[Paul Moore]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2125 bytes --]

Linus,

Four audit patches for the Linux v7.3 merge window, the highlights are
below:

- Drop BUG_ON() assertions from two functions

While I don't recall any bug reports from either of these assertions in
recent memory, neither of these checks warrant the kernel panic that
could result from BUG_ON().  One of the BUG_ON() calls is converted to a
WARN_ON_ONCE() and the other to a lockdep assertion.

- Fix an audit tree reference counting problem

Fix a corner case where audit could end up unintentionally dropping
the last reference to an audit tree while the tree was still in use.

We should probably revisit the audit tree handling code in full, but
this patch works, and should be easy to backport to stable trees and
downstream kernels.

- Update the audit syscall classification tables

Add some missing syscalls to the PERM class.

Paul

--
The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482:

  Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
    tags/audit-pr-20260814

for you to fetch changes up to 783f0f0974c156aca630f4ffff248671082a098d:

  audit: avoid dropping live tree ref on fsnotify rule autoremove
    (2026-08-12 16:46:55 -0400)

----------------------------------------------------------------
audit/stable-7.3 PR 20260814
----------------------------------------------------------------

Jérémy Jean (1):
      audit: avoid dropping live tree ref on fsnotify rule autoremove

Ricardo Robaina (3):
      audit: add missing syscalls to PERM class tables
      audit: drop BUG_ON() from audit_add_to_parent()
      audit: drop BUG_ON() from audit_signal_info_syscall()

 include/asm-generic/audit_change_attr.h |    3 ++
 include/asm-generic/audit_read.h        |   31 ++++++++++++++++++++++++
 include/asm-generic/audit_write.h       |    3 ++
 kernel/audit_watch.c                    |    2 -
 kernel/auditfilter.c                    |    6 +---
 kernel/auditsc.c                        |    3 +-
 6 files changed, 42 insertions(+), 6 deletions(-)

--
paul-moore.com