Linux kernel crashes when logging to syslog via unix socket, if rsyslog is stopped

[blakehilliard]

Bug report

Bug description:

> uname -a
Linux hostname 6.1.124-rt16+g539895156e09 #1 SMP PREEMPT_RT Thu Feb 13 11:58:52 UTC 2025 aarch64 GNU/Linux

> cat /tmp/test.py
import logging
import logging.handlers
SYSLOG_SOCK = "/run/systemd/journal/syslog"
handler = logging.handlers.SysLogHandler(SYSLOG_SOCK)
logger = logging.getLogger()
logger.addHandler(handler)
logger.error("FIXME")

> python3 /tmp/test.py

> tail -n1 /var/log/syslog 
2025-03-13T15:37:18.047355+00:00 FIXME

> systemctl stop rsyslog syslog.socket

> strace python3 /tmp/test.py
...
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/run/systemd/journal/syslog"}, 30) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/run/systemd/journal/syslog"}, 30) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
getpid()                                = 9214
sendto(-1, "<11>FIXME\0", 10, 0, NULL, 0

^ At this point output stops, because the linux kernel crashes

I have reproduced this with both 3.10.15 and 3.12.3 versions of python.

CPython versions tested on:

3.12

Operating systems tested on:

Linux

[Shafiyullah]

The issue is a kernel bug that occurs when:

A socket exists at /run/systemd/journal/syslog
The service (rsyslog) is stopped, so connections are refused
Python's SysLogHandler tries to fall back to sending to an invalid file descriptor (-1)

This triggers a crash in the kernel's error handling path for the sendto() syscall on your aarch64 RT kernel.
Two solutions:

Report this as a kernel bug to your distro or upstream
Implement defensive code as shown in my previous example that checks socket connectivity before creating the handler

The most reliable fix would be patching the kernel, but the Python workaround will prevent the crash condition from occurring.

 import logging
 import logging.handlers
 import socket
 import os

 def setup_safe_syslog_handler(address="/run/systemd/journal/syslog"):
    """
    Set up a syslog handler with proper error handling to prevent kernel crashes.
    Returns a configured logger.
    """
    logger = logging.getLogger()
    logger.setLevel(logging.INFO)
    
    # First check if the socket exists
    if not os.path.exists(address):
        # Fall back to console logging
        console = logging.StreamHandler()
        logger.addHandler(console)
        logger.warning(f"Syslog socket {address} not found, using console logging")
        return logger
    
    # Test if socket is accepting connections before adding handler
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
    try:
        sock.connect(address)
        # Socket is working, set up syslog handler
        handler = logging.handlers.SysLogHandler(address)
        logger.addHandler(handler)
    except (socket.error, OSError) as e:
        # Socket exists but connection failed
        console = logging.StreamHandler()
        logger.addHandler(console)
        logger.warning(f"Cannot connect to syslog socket: {e}, using console logging")
    finally:
        sock.close()
    
    return logger

if __name__ == "__main__":
    logger = setup_safe_syslog_handler()
    logger.error("FIXME")

[vsajip]

I'm not able to reproduce this. With your script, I get e "Bad file descriptor" error returned:

$ systemctl stop syslog.socket rsyslog.service
$ python3.12 test.py 
--- Logging error ---
Traceback (most recent call last):
  File "/home/vinay/.local/lib/python3.12/logging/handlers.py", line 1005, in emit
    self.socket.send(msg)
OSError: [Errno 9] Bad file descriptor

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/vinay/.local/lib/python3.12/logging/handlers.py", line 873, in _connect_unixsocket
    self.socket.connect(address)
ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/vinay/.local/lib/python3.12/logging/handlers.py", line 1008, in emit
    self._connect_unixsocket(self.address)
  File "/home/vinay/.local/lib/python3.12/logging/handlers.py", line 884, in _connect_unixsocket
    self.socket.connect(address)
ConnectionRefusedError: [Errno 111] Connection refused
Call stack:
  File "/disk2/vinay/projects/scratch/logging/131190/test.py", line 7, in <module>
    logger.error("FIXME")
Message: 'FIXME'
Arguments: ()

[vsajip]

Closing, as no further feedback received.

[blakehilliard]

I'm not able to reproduce this. With your script, I get e "Bad file descriptor" error returned

What version of linux? Maybe it is fixed in newer ones than I'm using.

[vsajip]

What version of linux?

$uname -a
Linux hostname 6.8.0-60-generic #63-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 19:04:15 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

[blakehilliard]

Thanks. I just found I can reproduce it on kernel 6.1.124 but not 6.1.131.