audit.79 kernel

Rob Myers rob.myers at gtri.gatech.edu
Tue Jul 19 11:34:30 UTC 2005


On Sat, 2005-07-16 at 15:59 +0100, David Woodhouse wrote:
> * Sat Jul 16 2005 David Woodhouse <dwmw2 at redhat.com> audit.79
> - Defer serial number generation until it's needed to avoid contention
> 

triggered an oops last night on audit.79 i686 smp with several scripts
running at the same time.  one was toggling audit enable while others
were creating, deleting, and testing watches at the same time.

Jul 18 23:22:02 localhost kernel: ------------[ cut here ]------------
Jul 18 23:22:02 localhost kernel: kernel BUG at kernel/auditfs.c:219!
Jul 18 23:22:02 localhost kernel: invalid operand: 0000 [#1]
Jul 18 23:22:02 localhost kernel: SMP 
Jul 18 23:22:02 localhost kernel: Modules linked in: i2c_dev i2c_core ipt_REJECT ipt_state ip_conntrack iptable_filter ip_tables dm_mod button battery ac joydev uhci_hcd ehci_hcd hw_random snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore sk98lin floppy ext3 jbd i2o_block i2o_core sd_mod scsi_mod
Jul 18 23:22:02 localhost kernel: CPU:    1
Jul 18 23:22:02 localhost kernel: EIP:    0060:[<c013cef5>]    Not tainted VLI
Jul 18 23:22:02 localhost kernel: EFLAGS: 00010206   (2.6.9-11.EL.audit.79smp) 
Jul 18 23:22:02 localhost kernel: EIP is at audit_watch_put+0x4b/0x62
Jul 18 23:22:02 localhost kernel: eax: 00000004   ebx: f6dda244   ecx: 6bfff080   edx: f2c54438
Jul 18 23:22:02 localhost kernel: esi: f490f2dc   edi: e1149bcc   ebp: f3277564   esp: e51bcf34
Jul 18 23:22:02 localhost kernel: ds: 007b   es: 007b   ss: 0068
Jul 18 23:22:02 localhost kernel: Process rm (pid: 5327, threadinfo=e51bc000 task=f4cdb0b0)
Jul 18 23:22:02 localhost kernel: Stack: 00000000 c013db9c f3277564 f490f2dc f529a000 f3277564 c016e560 f3277564 
Jul 18 23:22:02 localhost kernel:        c016f59e 00000000 c0166b48 f7dcae64 f7f4f9c0 af26065d 00000012 f529a005 
Jul 18 23:22:02 localhost kernel:        00000010 00000000 00000000 f7b5643c 0000000a 40000003 f4cdb0b0 f4cdb0b0 
Jul 18 23:22:02 localhost kernel: Call Trace:
Jul 18 23:22:02 localhost kernel:  [<c013db9c>] audit_inode_free+0x13e/0x15c
Jul 18 23:22:02 localhost kernel:  [<c016e560>] destroy_inode+0x1b/0x4c
Jul 18 23:22:02 localhost kernel:  [<c016f59e>] iput+0x5f/0x61
Jul 18 23:22:02 localhost kernel:  [<c0166b48>] sys_unlink+0xd7/0x132
Jul 18 23:22:02 localhost kernel:  [<c0109fee>] do_syscall_trace+0xc0/0xca
Jul 18 23:22:02 localhost kernel:  [<c02ca823>] syscall_call+0x7/0xb
Jul 18 23:22:02 localhost kernel: Code: 00 8b 43 2c e8 2d 95 00 00 83 7b 08 00 74 08 0f 0b d9 00 ff d9 2d c0 83 7b 10 00 74 08 0f 0b da 00 ff d9 2d c0 83 7b 18 00 74 08 <0f> 0b db 00 ff d9 2d c0 89 da 5b a1 ec a1 42 c0 e9 42 94 00 00 
Jul 18 23:22:02 localhost kernel:  <0>Fatal exception: panic in 5 seconds

rob.




More information about the Linux-audit mailing list