4.9 kernel panic in netlink unicast because audit replace passing audit sock as NULL

[Paul Moore]

On Fri, Oct 12, 2018 at 3:33 AM Kassey Li <kasseyli at outlook.com> wrote:
> hi, Paul:
>
> it is hard to running on upstream kernel on my hardware.
> I checked the kernel log that we can see  that we are trying to send the sock to task 20802, but it was killed already.
> is there any suggest that we can pick up some patches to backport to 4.9 to try ?

There have been numerous patches which could be applicable to your
problem, starting in v4.10 through v4.15.  Since this is an old kernel
from an upstream community perspective I would suggest reaching out to
your Linux distribution's support channels to see if they can help
you.  If that is not an option, you can see all of the audit patches
from the audit team in the audit kernel repo broken down by release at
the following location:

* git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
* https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git

... patches for Linux vX.Y can be found in branches stable-X.Y.

-- 
paul moore
www.paul-moore.com