Re: Kernel oops+crash on repeated auditd restarts

On Fri, 2012-04-20 at 23:14 -0300, Marcelo Cerri wrote: That is almost certainly the wrong thing to do. This test program should show a memory leak with your patch. If it doesn't show a memory leak then something is screwed up in inotify as well. #include <errno.h> #include <unistd.h> #include <sys/inotify.h> int main(void) { int fd; int rc; struct inotify_event event[10]; fd = inotify_init(); if (fd < 0) return errno; while(1) { rc = inotify_add_watch(fd, "/tmp", IN_CLOSE_WRITE); if (rc < 0) return errno; rc = inotify_rm_watch(fd, rc); if (rc) return errno; rc = read(fd, event, sizeof(event)); if (rc < 0) return errno; } return 0; } The lifetime of an object is supposed to be from fsnotify_init_mark() until it's matching reference is dropped in fsnotify_mark_destroy(). It sounds to me like we are calling put somewhere in the audit code when we didn't previously call a get....