Messages in this thread Patch in this message | | | Date | Tue, 15 Oct 2013 13:43:45 +0900 | From | Toshiyuki Okajima <> | Subject | [BUG][PATCH] audit: audit_log_start running on auditd should not stop |
| |
The backlog cannot be consumed when audit_log_start is running on auditd even if audit_log_start calls wait_for_auditd to consume it. The situation is a deadlock because only auditd can consume the backlog. If the other process needs to send the backlog, it can be also stopped by the deadlock.
So, audit_log_start running on auditd should not stop.
You can see the deadlock with the following reproducer: # auditctl -a exit,always -S all # reboot
Signed-off-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Cc: gaofeng@cn.fujitsu.com --- kernel/audit.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c index 7b0e23a..ce1fb38 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1098,6 +1098,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int reserve; unsigned long timeout_start = jiffies; + if (audit_pid && audit_pid == current->pid) + gfp_mask &= ~__GFP_WAIT; + if (audit_initialized != AUDIT_INITIALIZED) return NULL; -- 1.5.5.6
| |