<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
hi, Paul:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
it is hard to running on upstream kernel on my hardware. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I checked the kernel log that we can see that we are trying to send the sock to task 20802, but it was killed already. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
is there any suggest that we can pick up some patches to backport to 4.9 to try ?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
[16222.577350] [2018:10:09 23:06:41]init: Service 'logd' (pid 20802) killed by signal 11 <br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
[16237.397867] [2018:10:09 23:06:55]audit: netlink_unicast sending to audit_pid=20802 returned error: -111 <br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>-000|netlink_unicast(<br>
</span>
<div> | [X20] ssk = 0x0,<br>
</div>
<div> | [X21] skb = 0xFFFFFFC0989D5600,<br>
</div>
<div> | [X24] portid = 20802,<br>
</div>
<span> | [X19] nonblock = 0)</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;"><font color="#0078D7">Kassey Li </font>
<br>
<br>
</p>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Paul Moore <paul@paul-moore.com><br>
<b>Sent:</b> October 12, 2018 12:15 PM<br>
<b>To:</b> Kassey Li; Linux-audit@redhat.com<br>
<b>Subject:</b> Re: 4.9 kernel panic in netlink unicast because audit replace passing audit sock as NULL</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On October 11, 2018 10:44:01 PM Kassey Li <kasseyli@outlook.com> wrote:<br>
> hi, Paul:<br>
> we got one kernel panic on 4.9 kernel<br>
><br>
> [16237.397896] [2018:10:09 23:06:55]audit: audit_pid=20802 reset<br>
> [16238.098916] [2018:10:09 23:06:57]Unable to handle kernel NULL pointer dereference at virtual address 00000280<br>
><br>
> audit_sock is set to NULL in kauditd_send_skb, but later we are access it again in audit_replace caused this panic.<br>
> is there patch for such SW issue on 4.9 kernel ?<br>
><br>
> static int audit_replace(pid_t pid)<br>
> {<br>
> struct sk_buff *skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0,<br>
> &pid, sizeof(pid));<br>
><br>
> if (!skb)<br>
> return -ENOMEM;<br>
> return netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);<br>
> }<br>
<br>
Hi.<br>
<br>
Have you been able to reproduce this problem on a recent kernel? Unfortunately there have been some major changes to that area of the code since v4.9 and it is very likely that we have fixed this issue in the current upstream kernel.<br>
<br>
--<br>
paul moore<br>
<a href="http://www.paul-moore.com">www.paul-moore.com</a><br>
<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>