Bug 708600

Summary: [abrt] kernel: kernel BUG at security/selinux/avc.c:162!: TAINTED Die
Product: [Fedora] Fedora Reporter: Todor <yodor1>
Component: kernelAssignee: Eric Paris <eparis>
Status: CLOSED CANTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 15CC: frank.mehnert, gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, sdsmall
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:71c5680cdf6afd954ef8d87c9a656a85f2859b5f
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-07 17:33:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Todor 2011-05-28 09:19:12 UTC 
abrt version: 2.0.1
architecture:   x86_64
cmdline:        ro root=UUID=cdc70634-caa3-482a-ad99-813652f18a11 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=us rhgb quiet
component:      kernel
kernel:         2.6.38.6-27.fc15.x86_64
kernel_tainted: 128
os_release:     Fedora release 15 (Lovelock)
package:        kernel
reason:         kernel BUG at security/selinux/avc.c:162!
reported_to:    kerneloops: URL=http://submit.kerneloops.org/submitoops.php
time:           Sat May 28 12:08:38 2011

backtrace:
:kernel BUG at security/selinux/avc.c:162!
:invalid opcode: 0000 [#1] SMP 
:last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
:CPU 0 
:Modules linked in: fuse vboxnetadp vboxnetflt 8021q vboxdrv garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_netbios_ns ip6table_filter ip6_tables rfcomm sco bnep l2cap sbs sbshc max6650 coretemp usblp btusb snd_usb_audio snd_hda_codec_idt bluetooth snd_usbmidi_lib snd_hda_intel snd_hda_codec uvcvideo rfkill snd_hwdep snd_rawmidi snd_seq videodev appleir v4l2_compat_ioctl32 snd_seq_device snd_pcm snd_timer iTCO_wdt microcode iTCO_vendor_support snd tpm_infineon i2c_i801 applesmc soundcore sky2 snd_page_alloc input_polldev ipv6 firewire_ohci firewire_core crc_itu_t usb_storage i915 drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: scsi_wait_scan]
:Pid: 8494, comm: updatedb Not tainted 2.6.38.6-27.fc15.x86_64 #1 Apple Computer, Inc. Macmini1,1/Mac-F4208EC8
:RIP: 0010:[<ffffffff811e992b>]  [<ffffffff811e992b>] avc_audit_post_callback+0xcb/0x104
:RSP: 0018:ffff8800513e7b48  EFLAGS: 00010202
:RAX: ffff88007de165a8 RBX: ffff88007911d380 RCX: ffff880046ea0c00
:RDX: 0000000000000000 RSI: 000000000000002a RDI: 0000000000000282
:RBP: ffff8800513e7b78 R08: ffff88006cc8e000 R09: 0000000000000008
:R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000e04
:R13: 00000000be0e08bf R14: 0000000000000138 R15: ffff8800513e7da8
:FS:  00007fe830457720(0000) GS:ffff88007de00000(0000) knlGS:0000000000000000
:CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
:CR2: 00000000071a9000 CR3: 0000000057cef000 CR4: 00000000000006f0
:DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
:DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
:Process updatedb (pid: 8494, threadinfo ffff8800513e6000, task ffff880033730000)
:Stack:
: ffff880046ea0d80 000000218109cdae ffff88007911d380 ffff8800513e7da8
: ffff880054526150 0000000000000138 ffff8800513e7bc8 ffffffff8120007b
: 0000000000000e04 0000000000000138 ffff8800513e7be8 0000000000000010
:Call Trace:
: [<ffffffff8120007b>] common_lsm_audit+0x464/0x47d
: [<ffffffff811e9ca6>] avc_audit+0xb7/0xd5
: [<ffffffff8147588c>] ? _raw_spin_unlock_irqrestore+0x17/0x19
: [<ffffffff811e9fbf>] ? avc_has_perm_noaudit+0x211/0x389
: [<ffffffff81133542>] ? __d_lookup+0x47/0xe2
: [<ffffffff811ea188>] avc_has_perm+0x51/0x63
: [<ffffffff8112b215>] ? do_lookup+0x1d9/0x287
: [<ffffffff811eb251>] inode_has_perm+0x76/0x8c
: [<ffffffff811119ad>] ? kmem_cache_free+0x79/0xb6
: [<ffffffff811eb62c>] dentry_has_perm+0x59/0x6f
: [<ffffffff811e975d>] ? avc_audit_pre_callback+0x0/0x103
: [<ffffffff811e9860>] ? avc_audit_post_callback+0x0/0x104
: [<ffffffff811eb6c2>] selinux_inode_getattr+0x2c/0x2e
: [<ffffffff811e80ce>] security_inode_getattr+0x22/0x24
: [<ffffffff811250f3>] vfs_getattr+0x25/0x63
: [<ffffffff8112517e>] vfs_fstatat+0x4d/0x63
: [<ffffffff811251b2>] vfs_lstat+0x1e/0x20
: [<ffffffff81125301>] sys_newlstat+0x1a/0x33
: [<ffffffff81129f89>] ? path_put+0x1f/0x23
: [<ffffffff8109fa08>] ? audit_syscall_entry+0x145/0x171
: [<ffffffff81009bc2>] system_call_fastpath+0x16/0x1b
:Code: c6 1e eb ff eb 1e 48 8b 55 d0 48 89 df 48 c7 c6 c3 32 7c 81 31 c0 e8 af 1e eb ff 48 8b 7d d0 e8 42 84 f2 ff 66 41 83 fc 31 76 02 <0f> 0b 45 0f b7 e4 48 89 df 48 c7 c6 35 57 7c 81 41 ff cc 31 c0 
:RIP  [<ffffffff811e992b>] avc_audit_post_callback+0xcb/0x104
: RSP <ffff8800513e7b48>

event_log:
:2011-05-28-12:13:35> Submitting oops report to http://submit.kerneloops.org/submitoops.php
:2011-05-28-12:13:37  Kernel oops report was uploaded
:2011-05-28-12:13:37> Empty login or password, please check your configuration
:2011-05-28-12:13:37* (exited with 1)
:2011-05-28-12:14:50> Logging into Bugzilla at https://bugzilla.redhat.com
:2011-05-28-12:14:52  Can't login. Server said: RPC failed at server.  The username or password you entered is not valid.
:2011-05-28-12:14:52* (exited with 1)
:2011-05-28-12:15:21> Logging into Bugzilla at https://bugzilla.redhat.com
:2011-05-28-12:15:23  Can't login. Server said: RPC failed at server.  The username or password you entered is not valid.
:2011-05-28-12:15:23* (exited with 1)
Comment 1 Chuck Ebbert 2011-06-15 21:00:56 UTC 
kernel BUG at security/selinux/avc.c:162!

        BUG_ON(tclass >= ARRAY_SIZE(secclass_map));
Comment 2 Stephen Smalley 2011-06-16 12:10:02 UTC 
Filesystem type?  Sounds like we have a filesystem that isn't correctly initializing its inodes and thus we have garbage in inode->i_security.
Comment 3 Chuck Ebbert 2011-06-27 06:11:27 UTC 
tclass was 0xe04 and the valid range for tclass is 0 through 0x31

I'm not sure if we'll be able to find out what kind of filesystem it was. Todor, can you post the output of the "mount" command?
Comment 4 Dave Jones 2011-10-06 19:21:30 UTC 
note the vbox modules are loaded. these have been known to corrupt kernel memory.

unless this can be reproduced without them having been loaded, I'd close this as a problem in vbox.
Comment 5 Todor 2011-10-07 06:08:57 UTC 
Not sure if vbox is problem here, as at that time I was not using vbox. If I remember correctly I was transfering some files under usb ethernet emulation (usb0 was running) and the issue was reproduceable. I'm sorry I can not access this machine under fedora now so I can not help further. If you dont see anything wrong close this bug on your decision.
Regards,
Comment 6 Dave Jones 2011-10-07 17:33:31 UTC 
even having the modules loaded seems to be enough to cause problems, even if it wasn't in use at the time of the crash.

if it does happen again without vbox having been loaded, feel free to reopen or file a new bug.

thanks.
Comment 7 Frank Mehnert 2011-10-12 08:57:44 UTC 
Chuck, which version of VirtualBox are you using?