Re: [PATCH] audit: Update audit_alloc_mark() and audit_dupe_exe() CONFIG_AUDITSYSCALL=n stubs

[Ricardo Robaina]

On Wed, May 27, 2026 at 2:52 PM Nathan Chancellor <nathan@xxxxxxxxxx> wrote:
>
> Commit 84470b80b7b0 ("audit: fix recursive locking deadlock in
> audit_dupe_exe()") added a ctx parameter to audit_alloc_mark() and
> audit_dupe_exe() but did not update the macro stubs used when
> CONFIG_AUDITSYSCALL is not enabled, resulting in a build error for this
> configuration:
>
>   kernel/auditfilter.c: In function 'audit_data_to_entry':
>   kernel/auditfilter.c:592:85: error: macro 'audit_alloc_mark' passed 4 arguments, but takes just 3
>     592 |                         audit_mark = audit_alloc_mark(&entry->rule, str, f_val, NULL);
>         |                                                                                     ^
>   In file included from kernel/auditfilter.c:23:
>   kernel/audit.h:327:9: note: macro 'audit_alloc_mark' defined here
>     327 | #define audit_alloc_mark(k, p, l) (ERR_PTR(-EINVAL))
>         |         ^~~~~~~~~~~~~~~~
>   kernel/auditfilter.c:592:38: error: 'audit_alloc_mark' undeclared (first use in this function)
>     592 |                         audit_mark = audit_alloc_mark(&entry->rule, str, f_val, NULL);
>         |                                      ^~~~~~~~~~~~~~~~
>   kernel/auditfilter.c:592:38: note: 'audit_alloc_mark' is a function-like macro and might be used incorrectly
>   kernel/auditfilter.c:592:38: note: each undeclared identifier is reported only once for each function it appears in
>   kernel/auditfilter.c: In function 'audit_dupe_rule':
>   kernel/auditfilter.c:879:59: error: macro 'audit_dupe_exe' passed 3 arguments, but takes just 2
>     879 |                         err = audit_dupe_exe(new, old, ctx);
>         |                                                           ^
>   kernel/audit.h:333:9: note: macro 'audit_dupe_exe' defined here
>     333 | #define audit_dupe_exe(n, o) (-EINVAL)
>         |         ^~~~~~~~~~~~~~
>   kernel/auditfilter.c:879:31: error: 'audit_dupe_exe' undeclared (first use in this function)
>     879 |                         err = audit_dupe_exe(new, old, ctx);
>         |                               ^~~~~~~~~~~~~~
>   kernel/auditfilter.c:879:31: note: 'audit_dupe_exe' is a function-like macro and might be used incorrectly
>
> Update the macros with the correct number of parameters to resolve the
> build error.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 84470b80b7b0 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
> Signed-off-by: Nathan Chancellor <nathan@xxxxxxxxxx>
> ---
>  kernel/audit.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/audit.h b/kernel/audit.h
> index f1a77aef4533..92d5e723d570 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -324,13 +324,13 @@ extern struct list_head *audit_killed_trees(void);
>  #define audit_watch_path(w) ""
>  #define audit_watch_compare(w, i, d) 0
>
> -#define audit_alloc_mark(k, p, l) (ERR_PTR(-EINVAL))
> +#define audit_alloc_mark(k, p, l, c) (ERR_PTR(-EINVAL))
>  #define audit_mark_path(m) ""
>  #define audit_remove_mark(m) do { } while (0)
>  #define audit_remove_mark_rule(k) do { } while (0)
>  #define audit_mark_compare(m, i, d) 0
>  #define audit_exe_compare(t, m) (-EINVAL)
> -#define audit_dupe_exe(n, o) (-EINVAL)
> +#define audit_dupe_exe(n, o, c) (-EINVAL)
>
>  #define audit_remove_tree_rule(rule) BUG()
>  #define audit_add_tree_rule(rule) -EINVAL
>
> ---
> base-commit: 82bc8394b1aa74aedb9827da7730cfa6639716fd
> change-id: 20260527-audit-update-macro-stubs-6e4d8e8a826e
>
> Best regards,
> --
> Cheers,
> Nathan
>

Hi Nathan,

Good catch, I did miss that! Looks good to me, thanks for fixing it.

Acked-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>

-Ricardo