audit: use ktime_get_coarse_real_ts64() for timestamps

Commit c72051d5778a ("audit: use ktime_get_coarse_ts64() for time
access") converted audit's use of current_kernel_time64() to the
new ktime_get_coarse_ts64() function.  Unfortunately this resulted
in incorrect timestamps, e.g. events stamped with the year 1969
despite it being 2018.  This patch corrects this by using
ktime_get_coarse_real_ts64() just like the current_kernel_time64()
wrapper.

Fixes: c72051d5778a ("audit: use ktime_get_coarse_ts64() for time access")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index e17bc697d11c..2a8058764aa6 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1721,7 +1721,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
                                    struct timespec64 *t, unsigned int *serial)
 {
         if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
-                ktime_get_coarse_ts64(t);
+                ktime_get_coarse_real_ts64(t);
                 *serial = audit_serial();
         }
 }