From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: Kernel oops+crash on repeated auditd restarts
Date: Mon, 23 Apr 2012 12:26:16 -0400
Message-ID: <1335198376.8224.4.camel@localhost>
References: <CACP9ZVxJpHxt8PYc=t3Z+biiJ8K9g3nEjz70R5zp0uU_PAo8kw@mail.gmail.com>
	<1327519203.4131.25.camel@localhost>
	<CACP9ZVwO=m0-JzYxd0HduPUmx909DctyTzGbnbMCtPeWD=X8FA@mail.gmail.com>
	<CACP9ZVyvvJZ8QTjQHWAdi1=MY+voeyNayqwBaVkAJJ0RZ593Kw@mail.gmail.com>
	<CACP9ZVyG=PEpj_JmvO1dNC-c-DoFnHmNZmj_R0GU29Kfa0Mp1g@mail.gmail.com>
	<CALnj_=7qyFQCcWTfTiQBaoOZvgiAUANv2iApmerh8U2ogBkOug@mail.gmail.com>
	<CALnj_=7VB1FG+mWfLHHkkkyzYWtpRFpQw_RYnx+MVe64c=F0=A@mail.gmail.com>
	<1332983643.384.8.camel@localhost>
	<CACP9ZVxv+az=q65VGRdXsfY_1Bq1+e=Q-mmZXVaO4qJ8Lt2GoA@mail.gmail.com>
	<CALnj_=7hH3KsiL1R+mh0EGcc9zWQ2s2heEOg7F0+zfTechY8xw@mail.gmail.com>
	<CALnj_=44rFZBci99ns8Y8_0ZAJ9CEQ1N+bLFfHaA_3cHAcJN1Q@mail.gmail.com>
	<1333660021.2273.0.camel@localhost>
	<CALnj_=4gFhBia-bnuQ6XhRoE6rcsLpTQDr3y1ees8bVkj3BSiQ@mail.gmail.com>
	<CALnj_=7dyV4iA_3NpR66CgC4egXmc-8vGHUTxzTyM+1szx8r7A@mail.gmail.com>
	<CALnj_=6Zg5cDKnrTch0dbBYDCnVmutTtGm1ngZdymqJqZLztHw@mail.gmail.com>
	<20120420231424.1836e56b@oc8526070481.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20120420231424.1836e56b@oc8526070481.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Marcelo Cerri <mhcerri@linux.vnet.ibm.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Fri, 2012-04-20 at 23:14 -0300, Marcelo Cerri wrote:

> The patch below increments the reference count of a mark when it is
> added to the destroy list. It seems to solve the issue and it doesn't
> seem to cause any memory leak. Please, can you make some tests in your
> environments and let me know if there is any problem with this patch.

That is almost certainly the wrong thing to do.  This test program
should show a memory leak with your patch.  If it doesn't show a memory
leak then something is screwed up in inotify as well.

#include <errno.h>
#include <unistd.h>
#include <sys/inotify.h>

int main(void)
{
	int fd;
	int rc;
	struct inotify_event event[10];

	fd = inotify_init();
	if (fd < 0)
		return errno;

	while(1) {
		rc = inotify_add_watch(fd, "/tmp", IN_CLOSE_WRITE);
		if (rc < 0)
			return errno;
	
		rc = inotify_rm_watch(fd, rc);
		if (rc)
			return errno;
	
		rc = read(fd, event, sizeof(event));
		if (rc < 0)
			return errno;
	}

	return 0;
}

The lifetime of an object is supposed to be from fsnotify_init_mark()
until it's matching reference is dropped in fsnotify_mark_destroy().  It
sounds to me like we are calling put somewhere in the audit code when we
didn't previously call a get....