Kernel oops+crash on repeated auditd restarts

[Eric Paris]

On Wed, 2012-01-25 at 18:45 +0200, Valentin Avram wrote:

> Did anybody ever experience kernel oopses and even kernel crashes
> (after a while), by just restarting repeatedly the auditd daemon?

No, but I'll try to remember to take a look.  We did have a BUG() that
was recently fixed when using -w rules (as I recall).   But I've never
seen this particular NULL pointer bug.  We did recently fix a race in
fsnotify mark destruction that could be this, but those symptoms weren't
exactly the same.

I'm both the upstream Audit and fsnotify maintainer so I'm grumbley at
Gentoo for never letting me know isn't working.  Where else did you
report this?  I'm wondering where all the information failure is
happening.

Can you send me any and all info you have?

I'll see if I can reproduce a problem here (but I'm a Fedora guy)