audit: Send netlink ACK before setting connection in auditd_set
authorChris Riches <chris.riches@nutanix.com>
Wed, 18 Oct 2023 09:23:51 +0000 (09:23 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Feb 2024 20:14:14 +0000 (20:14 +0000)
commit129db2ded6e6048b557388b88b3f382a64150dc7
treed2ea10591ffafbf90d97d21dbfb3aa745e2a860e
parent3023b44a304ef23e2c81b09bce498a692fa5985d
audit: Send netlink ACK before setting connection in auditd_set

[ Upstream commit 022732e3d846e197539712e51ecada90ded0572a ]

When auditd_set sets the auditd_conn pointer, audit messages can
immediately be put on the socket by other kernel threads. If the backlog
is large or the rate is high, this can immediately fill the socket
buffer. If the audit daemon requested an ACK for this operation, a full
socket buffer causes the ACK to get dropped, also setting ENOBUFS on the
socket.

To avoid this race and ensure ACKs get through, fast-track the ACK in
this specific case to ensure it is sent before auditd_conn is set.

Signed-off-by: Chris Riches <chris.riches@nutanix.com>
[PM: fix some tab vs space damage]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/audit.c