On Tue, May 12, 2026 at 4:35 PM Paul Moore <[email protected]> wrote: > > On May 11, 2026 Ricardo Robaina <[email protected]> wrote: > > > > When auditd is bottlenecked (e.g., by slow disk I/O), kauditd blocks on > > the netlink socket. If the wait timeout fully expires (timeo == 0), > > netlink mistakenly interprets the zeroed timeout as a non-blocking > > request. It then triggers netlink_overrun that drops the event, > > completely bypassing the audit subsystem's internal retry queue, and > > falsely returns ENOBUFS to user-space, resulting in the following error: > > > > auditd[]: Error receiving audit netlink packet (No buffer space available) > > > > Convert the `nonblock` argument in netlink_unicast() into a `flags` > > bitmask and introduce NETLINK_UNICAST_TIMED. When a caller specifies > > this flag and exhausts its timeout budget, netlink intercepts the > > zeroed timeo state. Instead of defaulting to an overrun condition, it > > safely frees the skb and returns -EAGAIN, allowing the audit subsystem > > to gracefully enqueue the pending event into its internal backlog. > > > > Suggested-by: Steve Grubb <[email protected]> > > Signed-off-by: Ricardo Robaina <[email protected]> > > --- > > include/linux/netlink.h | 5 ++++- > > kernel/audit.c | 8 ++++---- > > net/netlink/af_netlink.c | 17 +++++++++++++++-- > > 3 files changed, 23 insertions(+), 7 deletions(-) > > > > diff --git a/include/linux/netlink.h b/include/linux/netlink.h > > index 882e9c1b6c1d..1888c8ee416a 100644 > > --- a/include/linux/netlink.h > > +++ b/include/linux/netlink.h > > @@ -226,7 +226,10 @@ void netlink_ack(struct sk_buff *in_skb, struct > > nlmsghdr *nlh, int err, > > int netlink_has_listeners(struct sock *sk, unsigned int group); > > bool netlink_strict_get_check(struct sk_buff *skb); > > > > -int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, > > int nonblock); > > +/* Internal flags for netlink_unicast (do not overlap with MSG_* flags) */ > > +#define NETLINK_UNICAST_TIMED 0x80000 > > + > > +int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, > > int flags); > > int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid, > > __u32 group, gfp_t allocation); > > ... > > > diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c > > index 2aeb0680807d..acaa96695981 100644 > > --- a/net/netlink/af_netlink.c > > +++ b/net/netlink/af_netlink.c > > @@ -1325,14 +1325,17 @@ static int netlink_unicast_kernel(struct sock *sk, > > struct sk_buff *skb, > > } > > > > int netlink_unicast(struct sock *ssk, struct sk_buff *skb, > > - u32 portid, int nonblock) > > + u32 portid, int flags) > > { > > struct sock *sk; > > int err; > > long timeo; > > + int nonblock; > > > > skb = netlink_trim(skb, gfp_any()); > > > > + /* Extract blocking mode: strip internal flags, preserve MSG_DONTWAIT > > */ > > + nonblock = flags & ~NETLINK_UNICAST_TIMED; > > timeo = sock_sndtimeo(ssk, nonblock); > > retry: > > sk = netlink_getsockbyportid(ssk, portid); > > @@ -1351,8 +1354,18 @@ int netlink_unicast(struct sock *ssk, struct sk_buff > > *skb, > > } > > > > err = netlink_attachskb(sk, skb, &timeo, ssk); > > - if (err == 1) > > + if (err == 1) { > > + /* timeo may have been zeroed by schedule_timeout inside > > + * netlink_attachskb. If the caller is a timed-blocking sender > > + * (not genuinely nonblocking), don't re-enter with timeo=0 as > > + * that would misfire netlink_overrun on the next iteration. > > + */ > > + if (!timeo && (flags & NETLINK_UNICAST_TIMED)) { > > + kfree_skb(skb); > > + return -EAGAIN; > > + } > > Is the new flag needed, couldn't you just check to see if a non-blocking > operation was requested and do the same? > > if (timeo == 0 && !nonblock) { > kfree_skb(skb); > return -EAGAIN; > } >
Hi Paul, Thanks for reviewing this patch. You're definitely right, it seems I overengineered the fix. I'm just doing some final testing, and I'll post the V2 shortly. > > goto retry; > > + } > > if (err) > > return err; > > > > -- > > 2.53.0 > > -- > paul-moore.com >
