On Jul 28, 2026 Ricardo Robaina <[email protected]> wrote: > > The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in > audit_signal_info_syscall() will panic the kernel if the signal target > pid array overflows, which is too severe for this situation. > > Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead. > > Signed-off-by: Ricardo Robaina <[email protected]> > --- > kernel/auditsc.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 6610e667c728..2b9ce0b52511 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t) > axp->d.next = ctx->aux_pids; > ctx->aux_pids = (void *)axp; > } > - BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS); > + if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS)) > + return -EINVAL;
Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly ratelimited, but given that I don't recall ever seeing this BUG_ON() trigger I think this is fine. We can always change the WARN_ON_ONCE() later if needed, getting rid of the BUG_ON() is the big win. Merged into audit/dev, thanks. > axp->target_pid[axp->pid_count] = task_tgid_nr(t); > axp->target_auid[axp->pid_count] = audit_get_loginuid(t); > -- > 2.53.0 -- paul-moore.com
