audit: fix potential null dereference 'context->module.name'

commit b305f7ed0f4f494ad6f3ef5667501535d5a8fa31 upstream.

The variable 'context->module.name' may be null pointer when
kmalloc return null, so it's better to check it before using
to avoid null dereference.
Another one more thing this patch does is using kstrdup instead
of (kmalloc + strcpy), and signal a lost record via audit_log_lost.

Cc: stable@vger.kernel.org # 4.11
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 479c031ec54c4027d40b5028f21d88a3505b5529..e6a93c63068b410dad63f8836b2ff8b639368b0b 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1274,8 +1274,12 @@ static void show_special(struct audit_context *context, int *call_panic)
                break;
        case AUDIT_KERN_MODULE:
                audit_log_format(ab, "name=");
-               audit_log_untrustedstring(ab, context->module.name);
-               kfree(context->module.name);
+               if (context->module.name) {
+                       audit_log_untrustedstring(ab, context->module.name);
+                       kfree(context->module.name);
+               } else
+                       audit_log_format(ab, "(null)");
+
                break;
        }
        audit_log_end(ab);
@@ -2408,8 +2412,9 @@ void __audit_log_kern_module(char *name)
 {
        struct audit_context *context = current->audit_context;
 
-       context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
-       strcpy(context->module.name, name);
+       context->module.name = kstrdup(name, GFP_KERNEL);
+       if (!context->module.name)
+               audit_log_lost("out of memory in __audit_log_kern_module");
        context->type = AUDIT_KERN_MODULE;
 }