audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
authorPaul Moore <paul@paul-moore.com>
Tue, 14 Nov 2023 22:25:48 +0000 (17:25 -0500)
committerPaul Moore <paul@paul-moore.com>
Tue, 14 Nov 2023 22:34:27 +0000 (17:34 -0500)
eBPF can end up calling into the audit code from some odd places, and
some of these places don't have @current set properly so we end up
tripping the `WARN_ON_ONCE(!current->mm)` near the top of
`audit_exe_compare()`.  While the basic `!current->mm` check is good,
the `WARN_ON_ONCE()` results in some scary console messages so let's
drop that and just do the regular `!current->mm` check to avoid
problems.

Cc: <stable@vger.kernel.org>
Fixes: 47846d51348d ("audit: don't take task_lock() in audit_exe_compare() code path")
Reported-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit_watch.c

index 91e82e34b51e328eed868e025a5873fd6f557534..7a98cd176a127d2ef1726024a34ad9674b54c28f 100644 (file)
@@ -531,7 +531,7 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
        if (tsk != current)
                return 0;
 
-       if (WARN_ON_ONCE(!current->mm))
+       if (!current->mm)
                return 0;
        exe_file = get_mm_exe_file(current->mm);
        if (!exe_file)