audit.63 kernel.

[Rob Myers]

[resend without word wrap]

with 2.6.9-11.EL.audit.63smp and audit-0.9.10-1 this script causes a
repeatable oops:

#!/bin/bash -x

FILE_NAME=`mktemp /tmp/test_append.XXXXXX`

auditctl -w ${FILE_NAME} -k fk_test_append_r -p r
auditctl -w ${FILE_NAME} -k fk_test_append_w -p w
auditctl -w ${FILE_NAME} -k fk_test_append_x -p x

echo "test" >> ${FILE_NAME}

Jun 20 13:23:12 localhost kernel: ------------[ cut here ]------------
Jun 20 13:23:12 localhost kernel: kernel BUG at include/asm/spinlock.h:109!
Jun 20 13:23:12 localhost kernel: invalid operand: 0000 [#1]
Jun 20 13:23:12 localhost kernel: SMP 
Jun 20 13:23:12 localhost kernel: Modules linked in: i2c_dev i2c_core ipt_REJECT ipt_state ip_conntrack iptable_filter ip_tables dm_mod button battery ac joydev uhci_hcd ehci_hcd hw_random snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore sk98lin floppy ext3 jbd i2o_block i2o_core sd_mod scsi_mod
Jun 20 13:23:12 localhost kernel: CPU:    1
Jun 20 13:23:12 localhost kernel: EIP:    0060:[<c02c905a>]    Not tainted VLI
Jun 20 13:23:12 localhost kernel: EFLAGS: 00010202   (2.6.9-11.EL.audit.63smp) 
Jun 20 13:23:12 localhost kernel: EIP is at _spin_unlock+0x1c/0x27
Jun 20 13:23:12 localhost kernel: eax: 00000001   ebx: ca721c50   ecx: ca721c01   edx: c031dc48
Jun 20 13:23:12 localhost kernel: esi: 00000000   edi: c1744a50   ebp: cae20898   esp: cf5b2ec4
Jun 20 13:23:12 localhost kernel: ds: 007b   es: 007b   ss: 0068
Jun 20 13:23:12 localhost kernel: Process test-append.sh (pid: 5057, threadinfo=cf5b2000 task=c90ea230)
Jun 20 13:23:12 localhost kernel: Stack: c013c753 c5e53a74 0000000a cbbff918 cad06c00 cbbff90c cad06c00 0000000a 
Jun 20 13:23:12 localhost kernel:        cf5b2f58 c013d931 cad06c00 cad06c00 0000000a c0163db8 cad06c00 00008442 
Jun 20 13:23:12 localhost kernel:        cf5b2f58 0000000a c0165521 c43019e8 ffffffeb cea320fc ceafe9e8 cf5b2f58 
Jun 20 13:23:12 localhost kernel: Call Trace:
Jun 20 13:23:12 localhost kernel:  [<c013c753>] auditfs_attach_wdata+0x122/0x1e8
Jun 20 13:23:12 localhost kernel:  [<c013d931>] audit_notify_watch+0x47/0x56
Jun 20 13:23:12 localhost kernel:  [<c0163db8>] permission+0xf/0x4f
Jun 20 13:23:12 localhost kernel:  [<c0165521>] may_open+0x53/0x21a
Jun 20 13:23:12 localhost kernel:  [<c0165995>] open_namei+0x2ad/0x5b5
Jun 20 13:23:12 localhost kernel:  [<c0158042>] filp_open+0x23/0x3c
Jun 20 13:23:12 localhost kernel:  [<c02c8a6b>] __cond_resched+0x14/0x39
Jun 20 13:23:12 localhost kernel:  [<c01bb402>] direct_strncpy_from_user+0x3e/0x5d
Jun 20 13:23:12 localhost kernel:  [<c0158354>] sys_open+0x31/0x7d
Jun 20 13:23:12 localhost kernel:  [<c02ca463>] syscall_call+0x7/0xb
Jun 20 13:23:12 localhost kernel: Code: b9 2d c0 f0 83 28 01 79 05 e8 5b ee ff ff c3 81 78 04 ad 4e ad de 89 c2 b1 01 74 08 0f 0b 6c 00 c3 b9 2d c0 0f b6 02 84 c0 7e 08 <0f> 0b 6d 00 c3 b9 2d c0 86 0a c3 f0 81 00 00 00 00 01 c3 f0 ff 
Jun 20 13:23:12 localhost kernel:  <0>Fatal exception: panic in 5 seconds