netdev - Re: Bug#664064: linux-image-3.3.0-rc6-amd64: 4 messages every minute in syslog from netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1331831653.3022.228.camel@deadeye>
Date:	Thu, 15 Mar 2012 17:14:13 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Reinhard Karcher <reinhard.karcher@....net>, 664064@...s.debian.org
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: Bug#664064: linux-image-3.3.0-rc6-amd64: 4 messages every
 minute in syslog from netlink

On Thu, 2012-03-15 at 13:00 +0100, Reinhard Karcher wrote:
> Package: linux-2.6
> Version: 3.3~rc6-1~experimental.1
> Severity: normal
> 
> The kernel log says all!
> I have 2 laptops showing the messages, both amd64.
> One of them runs a 32-bit system in a VM with the linux-image-3.3.0-rc6-686-pae kernel,
> that does not have this problem.
> The amd64 kernel from unstable (3.2.0-2) does not show the messages. 
> 
> Reinhard
> 
> -- Package-specific info:
> ** Version:
> Linux version 3.3.0-rc6-amd64 (Debian 3.3~rc6-1~experimental.1) (debian-kernel@...ts.debian.org) (gcc version 4.6.3 (Debian 4.6.3-1) ) #1 SMP Mon Mar 5 20:53:11 UTC 2012
> 
> ** Command line:
> BOOT_IMAGE=/boot/vmlinuz-3.3.0-rc6-amd64 root=UUID=9bb56ba6-3117-47d6-b07c-2cca477643e9 ro quiet cgroup_enable=memory
> 
> ** Not tainted
> 
> ** Kernel log:
> [46368.760279] netlink: 140 bytes leftover after parsing attributes.
[...]

The code that generates this warning (nla_parse()) has not changed
between 3.2 and 3.3-rc6, so this is probably due to a difference
elsewhere.  It seems to indicate a bug in the userland program sending
the message that is being parsed, but perhaps I misunderstand.

It would be useful if we could tell which program is sending the
message, but I think that may be difficult to do.

Ben.

-- 
Ben Hutchings
Life would be so much easier if we could look at the source code.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)