From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: Kernel oops+crash on repeated auditd restarts Date: Wed, 25 Jan 2012 14:20:03 -0500 Message-ID: <1327519203.4131.25.camel@localhost> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Valentin Avram Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2012-01-25 at 18:45 +0200, Valentin Avram wrote: > Did anybody ever experience kernel oopses and even kernel crashes > (after a while), by just restarting repeatedly the auditd daemon? No, but I'll try to remember to take a look. We did have a BUG() that was recently fixed when using -w rules (as I recall). But I've never seen this particular NULL pointer bug. We did recently fix a race in fsnotify mark destruction that could be this, but those symptoms weren't exactly the same. I'm both the upstream Audit and fsnotify maintainer so I'm grumbley at Gentoo for never letting me know isn't working. Where else did you report this? I'm wondering where all the information failure is happening. Can you send me any and all info you have? I'll see if I can reproduce a problem here (but I'm a Fedora guy)