[RFC PATCH 0/5] Cleanup code in and around audit_expand()

Paul Moore <[email protected]> Fri, 24 Jul 2026 15:56:18 -0400
Newsgroups org.kernel.vger.audit
Message-ID <[email protected]>
The recent audit match overflow patches caused me to take a closer look
at audit_expand() and how it is used, which unsurprisingly revealed a
number of things that we could do a bit better.  This patchset is the
result of that and aims to cleanup some of the ugliness while also
making the code a bit more robust.

Currently a RFC pending some closer self-review, but the patchset
compiles, boots, and passes the audit-testsuite and selinux-testsuite
cleanly.

--
Paul Moore (5):
      audit: only call audit_expand() once in audit_log_vformat()
      audit: convert audit_expand() to operate in multiples of
         AUDIT_BUFSIZ
      audit: move from a size_t buffer length to an int buffer length
      audit: add a missing function definition when !CONFIG_AUDIT
      audit: drop BUG_ON() from audit_log_XXX()

 include/linux/audit.h |   22 +++++-----
 kernel/audit.c        |   89 +++++++++++++++++++++---------------------
 2 files changed, 57 insertions(+), 54 deletions(-)