sanitize audit_mq_open()

* don't bother with allocations
* don't do double copy_from_user()
* don't duplicate parts of check for audit_dummy_context()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

3 files changed, 38 insertions, 59 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 67f0cdd991ba..54978bdd2bd4 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -450,7 +450,7 @@ extern void audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
 extern int __audit_fd_pair(int fd1, int fd2);
 extern int audit_set_macxattr(const char *name);
-extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
+extern void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr);
 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
@@ -475,11 +475,10 @@ static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid
         if (unlikely(!audit_dummy_context()))
                 __audit_ipc_set_perm(qbytes, uid, gid, mode);
 }
-static inline int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
+static inline void audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
 {
         if (unlikely(!audit_dummy_context()))
-                return __audit_mq_open(oflag, mode, u_attr);
-        return 0;
+                __audit_mq_open(oflag, mode, attr);
 }
 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
 {
@@ -541,7 +540,7 @@ extern int audit_signals;
 #define audit_fd_pair(n,a) ({ 0; })
 #define audit_sockaddr(len, addr) ({ 0; })
 #define audit_set_macxattr(n) do { ; } while (0)
-#define audit_mq_open(o,m,a) ({ 0; })
+#define audit_mq_open(o,m,a) ((void)0)
 #define audit_mq_sendrecv(d,l,p,t) ((void)0)
 #define audit_mq_notify(d,n) ((void)0)
 #define audit_mq_getsetattr(d,s) ((void)0)
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 192da806c283..d448b69672b5 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -588,22 +588,18 @@ static int mq_attr_ok(struct mq_attr *attr)
  * Invoked when creating a new queue via sys_mq_open
  */
 static struct file *do_create(struct dentry *dir, struct dentry *dentry,
-                        int oflag, mode_t mode, struct mq_attr __user *u_attr)
+                        int oflag, mode_t mode, struct mq_attr *attr)
 {
         const struct cred *cred = current_cred();
-        struct mq_attr attr;
         struct file *result;
         int ret;
 
-        if (u_attr) {
-                ret = -EFAULT;
-                if (copy_from_user(&attr, u_attr, sizeof(attr)))
-                        goto out;
+        if (attr) {
                 ret = -EINVAL;
-                if (!mq_attr_ok(&attr))
+                if (!mq_attr_ok(attr))
                         goto out;
                 /* store for use during create */
-                dentry->d_fsdata = &attr;
+                dentry->d_fsdata = attr;
         }
 
         mode &= ~current->fs->umask;
@@ -660,11 +656,13 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
         struct dentry *dentry;
         struct file *filp;
         char *name;
+        struct mq_attr attr;
         int fd, error;
 
-        error = audit_mq_open(oflag, mode, u_attr);
-        if (error != 0)
-                return error;
+        if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
+                return -EFAULT;
+
+        audit_mq_open(oflag, mode, u_attr ? &attr : NULL);
 
         if (IS_ERR(name = getname(u_name)))
                 return PTR_ERR(name);
@@ -690,7 +688,8 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
                         filp = do_open(dentry, oflag);
                 } else {
                         filp = do_create(mqueue_mnt->mnt_root, dentry,
-                                                oflag, mode, u_attr);
+                                                oflag, mode,
+                                                u_attr ? &attr : NULL);
                 }
         } else {
                 error = -ENOENT;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 140c47453470..83e946f1cdde 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -124,13 +124,6 @@ struct audit_aux_data {
 /* Number of target pids per aux struct. */
 #define AUDIT_AUX_PIDS  16
 
-struct audit_aux_data_mq_open {
-        struct audit_aux_data   d;
-        int                     oflag;
-        mode_t                  mode;
-        struct mq_attr          attr;
-};
-
 struct audit_aux_data_execve {
         struct audit_aux_data   d;
         int argc;
@@ -242,6 +235,11 @@ struct audit_context {
                         unsigned int            msg_prio;
                         struct timespec         abs_timeout;
                 } mq_sendrecv;
+                struct {
+                        int                     oflag;
+                        mode_t                  mode;
+                        struct mq_attr          attr;
+                } mq_open;
         };
 
 #if AUDIT_DEBUG
@@ -1263,6 +1261,16 @@ static void show_special(struct audit_context *context, int *call_panic)
                                 return;
                 }
                 break; }
+        case AUDIT_MQ_OPEN: {
+                audit_log_format(ab,
+                        "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
+                        "mq_msgsize=%ld mq_curmsgs=%ld",
+                        context->mq_open.oflag, context->mq_open.mode,
+                        context->mq_open.attr.mq_flags,
+                        context->mq_open.attr.mq_maxmsg,
+                        context->mq_open.attr.mq_msgsize,
+                        context->mq_open.attr.mq_curmsgs);
+                break; }
         case AUDIT_MQ_SENDRECV: {
                 audit_log_format(ab,
                         "mqdes=%d msg_len=%zd msg_prio=%u "
@@ -1368,15 +1376,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                         continue; /* audit_panic has been called */
 
                 switch (aux->type) {
-                case AUDIT_MQ_OPEN: {
-                        struct audit_aux_data_mq_open *axi = (void *)aux;
-                        audit_log_format(ab,
-                                "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
-                                "mq_msgsize=%ld mq_curmsgs=%ld",
-                                axi->oflag, axi->mode, axi->attr.mq_flags,
-                                axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
-                                axi->attr.mq_curmsgs);
-                        break; }
 
                 case AUDIT_EXECVE: {
                         struct audit_aux_data_execve *axi = (void *)aux;
@@ -2135,38 +2134,20 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
  * @mode: mode bits
  * @u_attr: queue attributes
  *
- * Returns 0 for success or NULL context or < 0 on error.
  */
-int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
+void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
 {
-        struct audit_aux_data_mq_open *ax;
         struct audit_context *context = current->audit_context;
 
-        if (!audit_enabled)
-                return 0;
-
-        if (likely(!context))
-                return 0;
-
-        ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
-        if (!ax)
-                return -ENOMEM;
-
-        if (u_attr != NULL) {
-                if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
-                        kfree(ax);
-                        return -EFAULT;
-                }
-        } else
-                memset(&ax->attr, 0, sizeof(ax->attr));
+        if (attr)
+                memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
+        else
+                memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
 
-        ax->oflag = oflag;
-        ax->mode = mode;
+        context->mq_open.oflag = oflag;
+        context->mq_open.mode = mode;
 
-        ax->d.type = AUDIT_MQ_OPEN;
-        ax->d.next = context->aux;
-        context->aux = (void *)ax;
-        return 0;
+        context->type = AUDIT_MQ_OPEN;
 }
 
 /**