path: root/kernel/audit.c
diff options
authorRichard Guy Briggs <>2014-08-21 13:40:41 -0400
committerEric Paris <>2014-09-23 16:37:54 -0400
commit54e05eddbe507d54f1df18c2680d4f614af9e133 (patch)
tree05a954d24f606dba272ca0a2e9da43e4117feaba /kernel/audit.c
parent219ca39427bf6c46c4e1473493e33bc00635e99b (diff)
audit: set nlmsg_len for multicast messages.
Report: Looking at your example code in, it seems that nlmsg_len field in the received messages is supposed to contain the length of the header + payload, but it is always set to the size of the header only, i.e. 16. The example program works, because the printf format specifies the minimum width, not "precision", so it simply prints out the payload until the first zero byte. This isn't too much of a problem, but precludes the use of recvmmsg, iiuc? (gdb) p *(struct nlmsghdr*)nlh $14 = {nlmsg_len = 16, nlmsg_type = 1100, nlmsg_flags = 0, nlmsg_seq = 0, nlmsg_pid = 9910} The only time nlmsg_len would have been updated was at audit_buffer_alloc() inside audit_log_start() and never updated after. It should arguably be done in audit_log_vformat(), but would be more efficient in audit_log_end(). Reported-by: Zbigniew Jędrzejewski-Szmek <> Signed-off-by: Richard Guy Briggs <>
Diffstat (limited to 'kernel/audit.c')
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 7aef7cbd7bcf..d20f00ff7bb5 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1949,6 +1949,7 @@ void audit_log_end(struct audit_buffer *ab)
} else {
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
+ nlh->nlmsg_len = ab->skb->len;
@@ -1960,7 +1961,7 @@ void audit_log_end(struct audit_buffer *ab)
* protocol between the kaudit kernel subsystem and the auditd
* userspace code.
- nlh->nlmsg_len = ab->skb->len - NLMSG_HDRLEN;
+ nlh->nlmsg_len -= NLMSG_HDRLEN;
if (audit_pid) {
skb_queue_tail(&audit_skb_queue, ab->skb);