Re: [PATCH 2/2] audit: drop BUG_ON() from audit_signal_info_syscall()

On Jul 28, 2026 Ricardo Robaina <[email protected]> wrote:
> 
> The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in
> audit_signal_info_syscall() will panic the kernel if the signal target
> pid array overflows, which is too severe for this situation.
> 
> Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead.
> 
> Signed-off-by: Ricardo Robaina <[email protected]>
> ---
>  kernel/auditsc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 6610e667c728..2b9ce0b52511 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t)
>  		axp->d.next = ctx->aux_pids;
>  		ctx->aux_pids = (void *)axp;
>  	}
> -	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
> +	if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS))
> +		return -EINVAL;

Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly
ratelimited, but given that I don't recall ever seeing this BUG_ON()
trigger I think this is fine.  We can always change the WARN_ON_ONCE()
later if needed, getting rid of the BUG_ON() is the big win.

Merged into audit/dev, thanks.

>  	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
>  	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> -- 
> 2.53.0

--
paul-moore.com