Re: [BUG] audit/powerpc: WARNING at kernel/auditsc.c:1995 (__audit_syscall_entry) during BPF kselftests (test_progs)

Hi Venkat,

On 9/17/26 3:01 PM, Venkat Rao Bagalkote wrote:

Hi all,

IBM CI has reported a kernel warning triggered in __audit_syscall_entry() on a PowerPC 64 (ppc64le, POWER9 pSeries guest) system while running the BPF kselftest suite (test_progs).

Environment:


Kernel version: 7.3.0-rc3-g238650ef6c7c (PREEMPT)
Architecture: ppc64le (POWER9 - IBM,8375-42A pSeries / phyp)
Workload: BPF selftests (tools/testing/selftests/bpf/test_progs)


Problem Description:


During syscall entry processing (system_call_exception -> syscall_enter_audit -> __audit_syscall_entry), the kernel hit WARN_ON(context->context != AUDIT_CTX_UNUSED) at kernel/auditsc.c:1995, indicating that the task's audit context was not reset to AUDIT_CTX_UNUSED prior to entering the new syscall.

Hm, based on the trace feels somewhat unrelated to bpf, but were you able to bisect in
case it can be reliably reproduced? Which tree is this, linux-next or bpf/bpf-next?

Trace:


[ 1371.387510] ------------[ cut here ]------------
[ 1371.387528] WARNING: kernel/auditsc.c:1995 at __audit_syscall_entry+0x50/0x1b0, CPU#17: test_progs/49616
[ 1371.387539] Modules linked in: dm_verity(E) dm_bufio(E) reed_solomon(E) livepatch_sample(EK) tun(E) vrf(E) 8021q(E) garp(E) mrp(E) stp(E) llc(E) veth(E) bonding(E) tls(E) rfkill(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) hvcs(E) hvcserver(E) pseries_rng(E) vmx_crypto(E) sg(E) drm(E) fuse(E) drm_panel_orientation_quirks(E) xfs(E) sr_mod(E) nvme_tcp(E) sd_mod(E) cdrom(E) nvme_fabrics(E) nvme_core(E) ibmvscsi(E) ibmveth(E) scsi_transport_srp(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) [last unloaded: bpf_test_modorder_x(OE)]
[ 1371.387607] CPU: 17 UID: 0 PID: 49616 Comm: test_progs Tainted: G        OE K     7.3.0-rc3-g238650ef6c7c #1 PREEMPT
[ 1371.387616] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE, [K]=LIVEPATCH
[ 1371.387620] Hardware name: IBM,8375-42A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW950.80 (VL950_131) hv:phyp pSeries
[ 1371.387626] NIP:  c0000000003e70d0 LR: c000000000352080 CTR: c00000000000cf00
[ 1371.387631] REGS: c00000000beafaa0 TRAP: 0700   Tainted: G      OE K     (7.3.0-rc3-g238650ef6c7c)
[ 1371.387637] MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 48002824  XER: 20040084
[ 1371.387650] CFAR: c00000000035207c IRQMASK: 0
                GPR00: c000000000034958 c00000000beafd40 c0000000020eb200 c0000000345f4800
                GPR04: 00007fffe2a31184 0000000000000081 000000007fffffff 0000000000000000
                GPR08: 0000000000000000 0000000000000001 0000000000000001 00000000000000dd
                GPR12: 0000000000000000 c00000002e99b300 0000000000000000 0000000000000000
                GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
                GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
                GPR24: 0000000000000000 0000000000000000 0000000000000000 c0000000345f4800
                GPR28: 0000000000000000 00000000000000dd 00000000000000dd c000000138e0c000
[ 1371.387710] NIP [c0000000003e70d0] __audit_syscall_entry+0x50/0x1b0
[ 1371.387715] LR [c000000000352080] syscall_enter_audit+0x90/0xd0
[ 1371.387722] Call Trace:
[ 1371.387725] [c00000000beafd40] [c000000000937050] selinux_task_getpgid+0x80/0xa0 (unreliable)
[ 1371.387735] [c00000000beafda0] [c00000000beafde0] 0xc00000000beafde0
[ 1371.387741] [c00000000beafe00] [c000000000034958] system_call_exception+0x448/0x480
[ 1371.387749] [c00000000beafe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
[ 1371.387757] ---- interrupt: 3000 at 0x7fffab74cbf0


Please let me know if additional logs, config, or repro details are needed.

Regards,

Venkat.