audit: use ktime_get_coarse_real_ts64() for timestamps
Commit c72051d5778a ("audit: use ktime_get_coarse_ts64() for time
access") converted audit's use of current_kernel_time64() to the
new ktime_get_coarse_ts64() function. Unfortunately this resulted
in incorrect timestamps, e.g. events stamped with the year 1969
despite it being 2018. This patch corrects this by using
ktime_get_coarse_real_ts64() just like the current_kernel_time64()
wrapper.
Fixes: c72051d5778a ("audit: use ktime_get_coarse_ts64() for time access")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index f6a0cb3..fb20746 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1543,7 +1543,7 @@
context->in_syscall = 1;
context->current_state = state;
context->ppid = 0;
- ktime_get_coarse_ts64(&context->ctime);
+ ktime_get_coarse_real_ts64(&context->ctime);
}
/**