From: Chris Wright When auditd is congested the kernel's audit system leaks skb's. First, it takes them off the audit_buffer sklist at which point they are lost, second, it allocates a new skb with 0 length payload. Then (likely still congested), it repeats this losing the new skb. Plug the leak by making sure to requeue the skb, and avoid audit_log_move() on 0 len audit_buffer. Signed-off-by: Chris Wright Signed-off-by: Andrew Morton --- 25-akpm/kernel/audit.c | 5 +++++ 1 files changed, 5 insertions(+) diff -puN kernel/audit.c~fix-audit-skb-leak-on-congested-netlink-socket kernel/audit.c --- 25/kernel/audit.c~fix-audit-skb-leak-on-congested-netlink-socket 2005-01-25 22:17:31.517119968 -0800 +++ 25-akpm/kernel/audit.c 2005-01-25 22:17:31.521119360 -0800 @@ -494,6 +494,10 @@ static void audit_log_move(struct audit_ char *start; int extra = ab->nlh ? 0 : NLMSG_SPACE(0); + /* possible resubmission */ + if (ab->len == 0) + return; + skb = skb_peek(&ab->sklist); if (!skb || skb_tailroom(skb) <= ab->len + extra) { skb = alloc_skb(2 * ab->len + extra, GFP_ATOMIC); @@ -535,6 +539,7 @@ static inline int audit_log_drain(struct } if (retval == -EAGAIN && ab->count < 5) { ++ab->count; + skb_queue_tail(&ab->sklist, skb); audit_log_end_irq(ab); return 1; } _