linux-kernel - Re: Kernel OOPS using auditd Debian 3.2 on a /sys file audit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 14 May 2013 20:36:59 +0200
From:	Javier Domingo <javierdo1@...il.com>
To:	linux-kernel-mail <linux-kernel@...r.kernel.org>
Subject: Re: Kernel OOPS using auditd Debian 3.2 on a /sys file audit

I didn't get any reply, is this mailing list still valid, or should I
ask elsewhere? (this is a ping message)

Javier Domingo


2013/5/2 Javier Domingo <javierdo1@...il.com>:
> Hi,
>
> I am currently having problems with the cpu scaling (something is
> touching the /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq),
> and I decided to use inotify to seek if something was being changed or
> not.
>
> This gave no problems to me, but something is writing just before me,
> and I can't know from the inotifywait cmd who. Then, I found auditdl,
> so I put this command onto it:
>
> # auditctl -w /sys/devices/system/cpu/cpu?/cpufreq/scaling_max_freq
>
> And just after this, this totally blocking OOPS was triggered:
> [ 5072.685483] BUG: unable to handle kernel NULL pointer dereference
> at 0000000000000038
> [ 5072.714302] IP: [<ffffffff8114f06c>] sysfs_dentry_revalidate+0x9/0xa2
> [ 5072.741249] PGD 12eca4067 PUD 12ec62067 PMD 0
> [ 5072.768102] Oops: 0000 [#1] SMP
>
> I tried to make sysrq, but didn't work. I have repeated several times
> this and it always crashes. I am attaching the photo of the second
> time because it is much longer than the second one.
>
> Hope this helps on something!
>
> Javier Domingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/