On Aug 11, 2026 =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <[email protected]> wrote: > > audit_del_rule() is used for both netlink deletion templates and internal > fsnotify autoremove. The former passes a parsed template which owns a > temporary tree reference; the latter passes the installed entry itself. > > The unconditional audit_put_tree() at the end of audit_del_rule() assumes > the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify > autoremove event therefore drops the installed rule's live tree reference. > Repeating this across rules sharing the same tree can free the tree while > another rule still references it, and a later autoremove dereferences the > freed pathname while comparing rules. > > Move the temporary-tree put to audit_rule_change(), the caller that owns > deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both > successful deletion and -ENOENT still release the parser-owned tree. > > Fixes: 34d99af52ad4 ("audit: implement audit by executable") > Assisted-by: Codex:gpt-5 > Signed-off-by: Jérémy Jean <[email protected]> > Reviewed-by: Ricardo Robaina <[email protected]> > Tested-by: Ricardo Robaina <[email protected]> > --- > kernel/auditfilter.c | 6 ++---- > 1 file changed, 2 insertions(+), 4 deletions(-)
Thanks for finding this and submitting a fix! This looks good to me too, so I'm going to merge this, but instead of the normal audit/stable-7.2 branch, I'm going to merge this into the audit/dev branch since we are likely only a few days away from a v7.2 release and I think it would be good to get some additional testing. I am going to tag this commit with a stable tag so it will/should get backported once it lands in Linus' tree. -- paul-moore.com
