When auditd is congested the kernel's audit system leaks skb's. First, it takes them off the audit_buffer sklist at which point they are lost, second, it allocates a new skb with 0 length payload. Then (likely still congested), it repeats this losing the new skb. Plug the leak by making sure to requeue the skb, and avoid audit_log_move() on 0 len audit_buffer. Signed-off-by: Chris Wright <chrisw(a)osdl.org&gt; ===== kernel/audit.c 1.6 vs edited ===== --- 1.6/kernel/audit.c 2005-01-20 20:56:04 -08:00 +++ edited/kernel/audit.c 2005-01-25 14:34:32 -08:00 @@ -494,6 +494,10 @@ static void audit_log_move(struct audit_ char *start; int extra = ab->nlh ? 0 : NLMSG_SPACE(0); + /* possible resubmission */ + if (ab->len == 0) + return; + skb = skb_peek(&ab->sklist); if (!skb || skb_tailroom(skb) <= ab->len + extra) { skb = alloc_skb(2 * ab->len + extra, GFP_ATOMIC); @@ -535,6 +539,7 @@ static inline int audit_log_drain(struct } if (retval == -EAGAIN && ab->count < 5) { ++ab->count; + skb_queue_tail(&ab->sklist, skb); audit_log_end_irq(ab); return 1; }