Re: Kernel OOPS using auditd Debian 3.2 on a /sys file audit

Re: Kernel OOPS using auditd Debian 3.2 on a /sys file audit

[Javier Domingo]

I didn't get any reply, is this mailing list still valid, or should I
ask elsewhere? (this is a ping message)

Javier Domingo


2013/5/2 Javier Domingo <javierdo1@gmail.com>:
> Hi,
>
> I am currently having problems with the cpu scaling (something is
> touching the /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq),
> and I decided to use inotify to seek if something was being changed or
> not.
>
> This gave no problems to me, but something is writing just before me,
> and I can't know from the inotifywait cmd who. Then, I found auditdl,
> so I put this command onto it:
>
> # auditctl -w /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq
>
> And just after this, this totally blocking OOPS was triggered:
> [ 5072.685483] BUG: unable to handle kernel NULL pointer dereference
> at 0000000000000038
> [ 5072.714302] IP: [<ffffffff8114f06c>] sysfs_dentry_revalidate+0x9/0xa2
> [ 5072.741249] PGD 12eca4067 PUD 12ec62067 PMD 0
> [ 5072.768102] Oops: 0000 [#1] SMP
>
> I tried to make sysrq, but didn't work. I have repeated several times
> this and it always crashes. I am attaching the photo of the second
> time because it is much longer than the second one.
>
> Hope this helps on something!
>
> Javier Domingo

Re: Kernel OOPS using auditd Debian 3.2 on a /sys file audit

[Jan Kara]

On Tue 14-05-13 20:36:59, Javier Domingo wrote:
> I didn't get any reply, is this mailing list still valid, or should I
> ask elsewhere? (this is a ping message)
  This is a high traffic list so your message is likely to just go
unnoticed. It is good to find maintainers of the subsystem (MAINTAINERS
file in kernel sources) and CC them as well - in this case these are
Al Viro <viro@zeniv.linux.org.uk> and Eric Paris <eparis@redhat.com>.

  Also searching in the archives shows that the first message likely didn't
even get it into the list (too large attachment?). Finally, kernel 3.2 is
rather old which reduces the enthusiasm of people here to look into the
problem (although you still might be lucky). So you might have better luck
with reporting this in Debian bug tracking system...

								Honza
> 2013/5/2 Javier Domingo <javierdo1@gmail.com>:
> > Hi,
> >
> > I am currently having problems with the cpu scaling (something is
> > touching the /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq),
> > and I decided to use inotify to seek if something was being changed or
> > not.
> >
> > This gave no problems to me, but something is writing just before me,
> > and I can't know from the inotifywait cmd who. Then, I found auditdl,
> > so I put this command onto it:
> >
> > # auditctl -w /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq
> >
> > And just after this, this totally blocking OOPS was triggered:
> > [ 5072.685483] BUG: unable to handle kernel NULL pointer dereference
> > at 0000000000000038
> > [ 5072.714302] IP: [<ffffffff8114f06c>] sysfs_dentry_revalidate+0x9/0xa2
> > [ 5072.741249] PGD 12eca4067 PUD 12ec62067 PMD 0
> > [ 5072.768102] Oops: 0000 [#1] SMP
> >
> > I tried to make sysrq, but didn't work. I have repeated several times
> > this and it always crashes. I am attaching the photo of the second
> > time because it is much longer than the second one.
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR