I'm trying to track down an issue for one of my users where auditd seems to be tickling another kernel bug (stack trace below) and I've run into a couple of issues when bumping AUDIT_DEBUG in kernel/audit.h 1) kernel refuses to build (I can send a patch for this if you'd like). kernel/auditsc.c: In function 'audit_free_names': kernel/auditsc.c:1008:45: error: 'i' undeclared (first use in this function) kernel/auditsc.c:1008:45: note: each undeclared identifier is reported only once for each function it appears in 2) with i declared and initialized, the kernel seems to hang in audit_free_names. The box doesn't actually freeze, but nothing is written to /var/log/kern.log and all terminals become unresponsive (but the mouse still works). So I guess I actually have two issues here; the one causing the initial BUG and the one with cranking up the audit debugging information. Anyone have any idea what's going on? Almost forgot. This stack trace is from 3.2.5 but this problem persists into at least 3.5-rc5. I can attach configs if needed. stack trace: [32581.835894] kernel BUG at fs/buffer.c:1263! [32581.835898] invalid opcode: 0000 [#1] SMP [32581.835903] last sysfs file: /sys/devices/system/cpu/sched_mc_power_savings [32581.835906] CPU 0 [32581.835910] Pid: 14899, comm: python2.6 Not tainted 2.6.38.8-gg868-ganetixenu #1 [32581.835917] RIP: e030:[<ffffffff81153853>] [<ffffffff81153853>] __find_get_block+0x1f3/0x200 [32581.835927] RSP: e02b:ffff88067cfcdc78 EFLAGS: 00010046 [32581.835931] RAX: ffff8807be6b0000 RBX: ffff8807740c50f0 RCX: 00000000007e980a [32581.835935] RDX: 0000000000001000 RSI: 00000000007e980a RDI: ffff8807b8cad380 [32581.835939] RBP: ffff88067cfcdcd8 R08: 0000000000000001 R09: ffff8807740c5018 [32581.835944] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8807740c501c [32581.835949] R13: ffff8807740c5048 R14: ffff8807fef36210 R15: 00000000007e980a [32581.835955] FS: 00007f37fd752700(0000) GS:ffff8807fff26000(0063) knlGS:0000000000000000 [32581.835960] CS: e033 DS: 002b ES: 002b CR0: 000000008005003b [32581.835965] CR2: 00000000ea515000 CR3: 000000068522b000 CR4: 0000000000002660 [32581.835970] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [32581.835975] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [32581.835979] Process python2.6 (pid: 14899, threadinfo ffff88067cfcc000, task ffff8806e772da80) [32581.835984] Stack: [32581.835986] ffff88067cfcdc98 ffffffff81654cd1 ffff88067cfcdca8 ffff8807740c5a98 [32581.835994] ffff88067cfcdd08 ffffffff811c9294 ffff8806ffffffc3 0000000000000014 [32581.836001] ffff8807740c50f0 ffff8807740c501c ffff8807740c5048 ffff8807fef36210 [32581.836009] Call Trace: [32581.836015] [<ffffffff81654cd1>] ? down_read+0x11/0x30 [32581.836021] [<ffffffff811c9294>] ? ext3_xattr_get+0xf4/0x2b0 [32581.836027] [<ffffffff811baf88>] ext3_clear_blocks+0x128/0x190 [32581.836032] [<ffffffff811bb104>] ext3_free_data+0x114/0x160 [32581.836037] [<ffffffff811bbc0a>] ext3_truncate+0x87a/0x950 [32581.836042] [<ffffffff812133f5>] ? journal_start+0xb5/0x100 [32581.836047] [<ffffffff811bc840>] ext3_evict_inode+0x180/0x1a0 [32581.836052] [<ffffffff8114065f>] evict+0x1f/0xb0 [32581.836058] [<ffffffff81006d52>] ? check_events+0x12/0x20 [32581.836063] [<ffffffff81140c14>] iput+0x1a4/0x290 [32581.836068] [<ffffffff8113ed05>] dput+0x265/0x310 [32581.836072] [<ffffffff81132435>] path_put+0x15/0x30 [32581.836078] [<ffffffff810a5d31>] audit_syscall_exit+0x171/0x260 [32581.836084] [<ffffffff8103ed9a>] sysexit_audit+0x21/0x5f [32581.836088] Code: 82 00 05 01 00 85 c0 75 de 65 48 89 1c 25 00 05 01 00 e9 87 fe ff ff 48 89 df e8 e9 fc ff ff 4c 89 f7 e9 02 ff ff ff 0f 0b eb fe <0f> 0b eb fe 0f 0b eb fe 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 [32581.836141] RIP [<ffffffff81153853>] __find_get_block+0x1f3/0x200 [32581.836146] RSP <ffff88067cfcdc78> [32581.836157] ---[ end trace 0658a2308b35c81e ]--- -- Peter Moody Google 1.650.253.7306 Security Engineer pgp:0xC3410038