Re: [PATCH] audit: avoid dropping live tree ref on fsnotify rule autoremove

On 2026-08-11 22:01, Jérémy Jean wrote:
> audit_del_rule() is used for both netlink deletion templates and internal
> fsnotify autoremove.  The former passes a parsed template which owns a
> temporary tree reference; the latter passes the installed entry itself.
> 
> The unconditional audit_put_tree() at the end of audit_del_rule() assumes
> the template case.  For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
> autoremove event therefore drops the installed rule's live tree reference.
> Repeating this across rules sharing the same tree can free the tree while
> another rule still references it, and a later autoremove dereferences the
> freed pathname while comparing rules.
> 
> Move the temporary-tree put to audit_rule_change(), the caller that owns
> deletion templates.  Keep it in the AUDIT_DEL_RULE cleanup so both
> successful deletion and -ENOENT still release the parser-owned tree.
> 
> Fixes: 34d99af52ad4 ("audit: implement audit by executable")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <[email protected]>

Thanks for finding this!

Reviewed-by: Richard Guy Briggs <[email protected]>

> ---
>  kernel/auditfilter.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> index 7f791afe5791..666c2091b9e4 100644
> --- a/kernel/auditfilter.c
> +++ b/kernel/auditfilter.c
> @@ -1023,7 +1023,6 @@ static inline int audit_add_rule(struct audit_entry *entry)
>  int audit_del_rule(struct audit_entry *entry)
>  {
>  	struct audit_entry  *e;
> -	struct audit_tree *tree = entry->rule.tree;
>  	struct list_head *list;
>  	int ret = 0;
>  #ifdef CONFIG_AUDITSYSCALL
> @@ -1071,9 +1070,6 @@ int audit_del_rule(struct audit_entry *entry)
>  out:
>  	mutex_unlock(&audit_filter_mutex);
>  
> -	if (tree)
> -		audit_put_tree(tree);	/* that's the temporary one */
> -
>  	return ret;
>  }
>  
> @@ -1158,6 +1154,8 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)
>  	}
>  
>  	if (err || type == AUDIT_DEL_RULE) {
> +		if (type == AUDIT_DEL_RULE && entry->rule.tree)
> +			audit_put_tree(entry->rule.tree); /* that's the template one */
>  		if (entry->rule.exe)
>  			audit_remove_mark(entry->rule.exe);
>  		audit_free_rule(entry);
> -- 
> 2.47.3
> 
> 

- RGB

--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570