Bug 336801 – memory leak in audit_receive_msg in AUDIT_MAKE_EQUIV:

Bug 336801 - memory leak in audit_receive_msg in AUDIT_MAKE_EQUIV:

Summary:	memory leak in audit_receive_msg in AUDIT_MAKE_EQUIV:

Status:	CLOSED DUPLICATE of bug 335731

Aliases:	None

Product:	Red Hat Enterprise Linux 5
Classification:	Red Hat
Component:	kernel (Show other bugs)
Sub Component:
Version:	5.0
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Eric Paris
QA Contact:	Martin Jenner
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2007-10-17 18:14 EDT by Eric Paris
Modified:	2007-11-30 17:07 EST (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2007-10-18 10:58:23 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Eric Paris 2007-10-17 18:14:58 EDT

Description of problem:

                ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
                if (!ab)
                        break;
                audit_log_format(ab, "auid=%u", loginuid);
                if (sid) {
                        u32 len;
                        ctx = NULL;
                        if (selinux_ctxid_to_string(sid, &ctx, &len))
                                audit_log_format(ab, " ssid=%u", sid);
                        else
                                audit_log_format(ab, " subj=%s", ctx);
                        kfree(ctx);
                }
                audit_log_format(ab, " op=make_equiv old=");
                audit_log_untrustedstring(ab, old);
                audit_log_format(ab, " new=");
                audit_log_untrustedstring(ab, new);
                audit_log_format(ab, " res=%d", !err);
                audit_log_end(ab);
                kfree(old);
                kfree(new);

If ab is null for any reason we are going to leak old and new

Comment 1 Eric Paris 2007-10-17 18:16:21 EDT

easy enough to fix.  Either drop the if (!ab) check altogether since everything
can handle null just fine, or wrap all of the audit_log_ stuff in a if(ab) so we
always call the kfrees.

Comment 2 Eric Paris 2007-10-18 10:58:23 EDT

submitted fix for this as part of patch for 335731

*** This bug has been marked as a duplicate of 335731 ***

Note You need to log in before you can comment on or make changes to this bug.