From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Handling -ENOBUFS Date: Wed, 5 Nov 2008 17:05:27 -0500 Message-ID: <200811051705.27282.sgrubb@redhat.com> References: <2c03f9590811050830wc551ca6g3a99c467c5e0b7@mail.gmail.com> <200811051319.00359.sgrubb@redhat.com> <2c03f9590811051256k3548a16i6ffc3060f54d11c8@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <2c03f9590811051256k3548a16i6ffc3060f54d11c8@mail.gmail.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Lucas C. Villa Real" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday 05 November 2008 15:56:30 Lucas C. Villa Real wrote: > >> Looking the code at lib/netlink.c, I saw that audit_send() doesn't > >> handle -ENOBUFS. Would it be possible to replace the condition from > >> "while (retval < 0 && errno == EINTR)" to "while (retval < 0 && (errno > >> == EINTR || errno == ENOBUFS))" to fix the problem when sending > >> packets from userspace to kernel? > > > > Have you tried that? Does it fix the problem or just hang the utility? > > So far it didn't hang. However, just in case, I added a maximum number > of retries (currently set to 64). I'm about to launch a new batch to > stress the system once again, and then I'll be able to see if it works > as expected. If it works out, send a patch to the list and I'll pull it into the next release. > >> One interesting thing which I noticed is that 'auditctl -s' doesn't > >> report that messages were lost, > > > > They weren't lost by the audit system so it doesn't know they didn't > > arrive. > > Do you think it would make sense to add an extra member to struct > sk_buff (a pointer to a callback function) and then have > skb_queue_tail() signal if it failed to send a message? That would > allow audit to keep track of such losses, as well as any other > subsystem using netlink for communicating with userspace. The network developers generally frown on anything getting added to sk_buff since that affects overall system performance. You would probably want to take this issue up with them on the net-dev mail list. I would be supportive of anything that adds reliability. But they control the code base for that part of the kernel. -Steve