Messages in this thread | | | From | Paul Moore <> | Date | Mon, 26 Aug 2019 16:42:52 -0400 | Subject | Re: [Question] audit_names use after delete in audit_filter_inodes |
| |
On Thu, Aug 22, 2019 at 3:22 AM Chen Wandun <chenwandun@huawei.com> wrote: > On 2019/8/21 23:36, Paul Moore wrote: > > On Wed, Aug 21, 2019 at 5:31 AM Chen Wandun <chenwandun@huawei.com> wrote: > >> > >> Hi, > >> Recently, I hit a use after delete in audit_filter_inodes, > > > > ... > > > >> the call stack is below: > >> [321315.077117] CPU: 6 PID: 8944 Comm: DefSch0100 Tainted: G OE ----V------- 3.10.0-327.62.59.83.w75.x86_64 #1 > >> [321315.077117] Hardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.8.1-0-g4adadbd-20170107_142945-9_64_246_229 04/01/2014 > > > > It looks like this is a vendor kernel and not an upstream kernel, yes? > > I analysed the upstream kernel about audit, and found there is no significant change > in audit_names add/read/delete since v3.10.
The number of changes in a Linux v3.10 based distro kernel and a modern upstream are quite significant, regardless of what you might see by comparing a limited number of functions/structs. I once again suggest you contact your distribution provider for support, or move to a modern Linux kernel so that upstream can better understand your problem.
-- paul moore www.paul-moore.com
| |