Assigning to rickyz@ for triage.

The issues goes something along the lines of:

Process writes to ecryptfs file, keeps file open
Process exits
In https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-3.18/kernel/exit.c#758:
  exit_fs(tsk);  // sets current->fs to NULL
  ...
  exit_task_work(tsk);  // puts fds

When the ecryptfs fd is closed, it attempt to write the changes to the file. This triggers a code path which ends up  an selinux access check for an ecryptfs lower file. This happens to be the first time the current process's SELinux context was checked for the ecryptfs lower file, so there is no cached entry for this access check, and it goes down the slow path. This may be why this ecryptfs happens to tickle this bug.

The check ends up generating an audit message for whatever reason, and in kernel/audit.c:audit_log_d_path, d_path is called, which expects current->fs to be valid: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-3.18/fs/dcache.c#2964

Short term, this can be worked around with a crappy kernel patch to avoid calling d_path if current->fs is gone:

diff --git a/kernel/audit.c b/kernel/audit.c
index 1d4df39..308336f 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1628,6 +1628,12 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
    if (prefix)
        audit_log_format(ab, "%s", prefix);
 
+   /* The process may be exiting. */
+   if (!current->fs) {
+       audit_log_string(ab, "<unknown>");
+       return;
+   }
+
    /* We will allow 11 spaces for ' (deleted)' to be appended */
    pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
    if (!pathname) {

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b6e7e72f4cf33e6dd28a293c13fb8d35ea0d424d

commit b6e7e72f4cf33e6dd28a293c13fb8d35ea0d424d
Author: Ricky Zhou <rickyz@chromium.org>
Date: Fri Aug 19 01:20:51 2016

CHROMIUM: Handle exiting process in audit_log_d_path.

If the process is existing, current->fs may be NULL, so we cannot
resolve paths in audit messages.

BUG= chromium:639102 
TEST=Ran on cyan.

Change-Id: Id8f98071f5f85c05c1d4257ac46fe01b5386f42e
Reviewed-on: https://chromium-review.googlesource.com/372981
Commit-Ready: Ricky Zhou <rickyz@chromium.org>
Tested-by: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
(cherry picked from commit 4c2b0a35a4dc9269ed229628f2fc536c3c1ce14a)
Reviewed-on: https://chromium-review.googlesource.com/375539

[modify] https://crrev.com/b6e7e72f4cf33e6dd28a293c13fb8d35ea0d424d/kernel/audit.c

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/ceba08b31289e8e7f756f7f4cb177e1fd962ae52

commit ceba08b31289e8e7f756f7f4cb177e1fd962ae52
Author: Ricky Zhou <rickyz@chromium.org>
Date: Fri Aug 19 01:20:51 2016

CHROMIUM: Handle exiting process in audit_log_d_path.

If the process is existing, current->fs may be NULL, so we cannot
resolve paths in audit messages.

BUG= chromium:639102 
TEST=Ran on cyan.

Change-Id: Id8f98071f5f85c05c1d4257ac46fe01b5386f42e
Reviewed-on: https://chromium-review.googlesource.com/372981
Commit-Ready: Ricky Zhou <rickyz@chromium.org>
Tested-by: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
(cherry picked from commit 4c2b0a35a4dc9269ed229628f2fc536c3c1ce14a)
Reviewed-on: https://chromium-review.googlesource.com/375540
Trybot-Ready: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Ricky Zhou <rickyz@chromium.org>
Commit-Queue: Ricky Zhou <rickyz@chromium.org>

[modify] https://crrev.com/ceba08b31289e8e7f756f7f4cb177e1fd962ae52/kernel/audit.c

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/c74ff55293770ba92c34a35c12dbe8d7590f1c29

commit c74ff55293770ba92c34a35c12dbe8d7590f1c29
Author: Ricky Zhou <rickyz@chromium.org>
Date: Fri Aug 19 01:20:51 2016

CHROMIUM: Handle exiting process in audit_log_d_path.

If the process is existing, current->fs may be NULL, so we cannot
resolve paths in audit messages.

BUG= chromium:639102 
TEST=Ran on cyan.

Change-Id: Id8f98071f5f85c05c1d4257ac46fe01b5386f42e
Reviewed-on: https://chromium-review.googlesource.com/372981
Commit-Ready: Ricky Zhou <rickyz@chromium.org>
Tested-by: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
(cherry picked from commit 4c2b0a35a4dc9269ed229628f2fc536c3c1ce14a)
Reviewed-on: https://chromium-review.googlesource.com/375541
Trybot-Ready: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Ricky Zhou <rickyz@chromium.org>
Commit-Queue: Ricky Zhou <rickyz@chromium.org>

[modify] https://crrev.com/c74ff55293770ba92c34a35c12dbe8d7590f1c29/kernel/audit.c

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/348354ec4953f413f68888b1bec946dae98173c7

commit 348354ec4953f413f68888b1bec946dae98173c7
Author: Ricky Zhou <rickyz@chromium.org>
Date: Fri Aug 19 01:20:51 2016

CHROMIUM: Handle exiting process in audit_log_d_path.

If the process is existing, current->fs may be NULL, so we cannot
resolve paths in audit messages.

BUG= chromium:639102 
TEST=Ran on cyan.

Change-Id: Id8f98071f5f85c05c1d4257ac46fe01b5386f42e
Reviewed-on: https://chromium-review.googlesource.com/372981
Commit-Ready: Ricky Zhou <rickyz@chromium.org>
Tested-by: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
(cherry picked from commit 4c2b0a35a4dc9269ed229628f2fc536c3c1ce14a)
Reviewed-on: https://chromium-review.googlesource.com/375538
Reviewed-by: Ricky Zhou <rickyz@chromium.org>

[modify] https://crrev.com/348354ec4953f413f68888b1bec946dae98173c7/kernel/audit.c