kernel OOPS

Hi List,
I have the following setup:
	debian (unstable)
	kernel 2.4.21 (from kernel.org, not debain kernel)
	ebtables-brnf_vs_2.4.21.diff
	snort_inline-2.0.0-1.tar.gz

When I run snort_inline in NAT mode everything works fine. When I run
snort_inline in bridge mode I get an OOPS error in /var/log/kern.log
the following is the the kernel OOPS text run through ksymoops:
===============================================================
ids:~# ksymoops < oops.txt
ksymoops 2.4.8 on i686 2.4.21.  Options used
     -V (default)
     -k /proc/ksyms (default)
     -l /proc/modules (default)
     -o /lib/modules/2.4.21/ (default)
     -m /boot/System.map-2.4.21 (default)

Warning: You did not tell me where to find symbol information.  I will
assume that the log matches the kernel and modules that are running
right now and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc.  ksymoops -h explains the options.

Error (regular_file): read_system_map stat /boot/System.map-2.4.21 failed
Jul 21 18:05:52 ids kernel: Unable to handle kernel NULL pointer dereference
 at virtual address 00000008
Jul 21 18:05:52 ids kernel: c029b208
Jul 21 18:05:52 ids kernel: *pde = 00000000
Jul 21 18:05:52 ids kernel: Oops: 0000
Jul 21 18:05:52 ids kernel: CPU:    0
Jul 21 18:05:52 ids kernel: EIP:    0010:[<c029b208>]    Not tainted
Using defaults from ksymoops -t elf32-i386 -a i386
Jul 21 18:05:52 ids kernel: EFLAGS: 00010246
Jul 21 18:05:52 ids kernel: eax: 00000000   ebx: 00000002   ecx: df3fdac0
edx: c1590000
Jul 21 18:05:52 ids kernel: esi: 00000001   edi: ce8b2ca0   ebp: 00000002
esp: d5e41cd0
Jul 21 18:05:52 ids kernel: ds: 0018   es: 0018   ss: 0018
Jul 21 18:05:52 ids kernel: Process snort_inline (pid: 5415, stackpage=d5e41
000)
Jul 21 18:05:52 ids kernel: Stack: df3fdac0 d5e41d08 00000002 c682980c c6829
80c d5e41cf0 e0b4f370 80000000
Jul 21 18:05:52 ids kernel:        c040fd70 ce8b2da0 00000001 c6c31ab0 00000
012 e0b52085 df3fdac0 ce8b2ca0
Jul 21 18:05:52 ids kernel:        00000001 ce8b2da0 e0b52a41 ce8b2da0 00000
001 0000000c df3fd340 00000001
Jul 21 18:05:52 ids kernel: Call Trace:    [<e0b4f370>] [<e0b52085>] [<e0b52
a41>] [<e0b52b8c>] [<e0b53318>]
Jul 21 18:05:52 ids kernel:   [<e0b53830>] [<e0b52c99>] [<c029e7ca>] [<c029e
085>] [<c029e53d>] [<c028b755>]
Jul 21 18:05:52 ids kernel:   [<c028ce3b>] [<e0b4c130>] [<e0b4c130>] [<c029a
f98>] [<e0b4c130>] [<e0b506c0>]
Jul 21 18:05:52 ids kernel:   [<e0b4c3fe>] [<e0b4c130>] [<c0293755>] [<c0293
93d>] [<c0293a95>] [<c028d312>]
Jul 21 18:05:52 ids kernel:   [<c01076ef>]
Jul 21 18:05:52 ids kernel: Code: 8b 50 08 85 d2 74 11 f0 ff 8a f0 00 00 00
0f 94 c0 84 c0 75


>>EIP; c029b208 <nf_reinject+138/270>   <=====

>>ecx; df3fdac0 <___strtok+1efddab8/206f2058>
>>edx; c1590000 <___strtok+116fff8/206f2058>
>>edi; ce8b2ca0 <___strtok+e492c98/206f2058>
>>esp; d5e41cd0 <___strtok+15a21cc8/206f2058>

Trace; e0b4f370 <[ip_conntrack_ftp].data.end+1511/4201>
Trace; e0b52085 <[bridge]br_init+5/50>
Trace; e0b52a41 <[bridge]br_fdb_get+151/190>
Trace; e0b52b8c <[bridge]br_fdb_get_entries+ec/230>
Trace; e0b53318 <[bridge]br_forward_finish+8/60>
Trace; e0b53830 <[bridge]__br_del_if+60/a0>
Trace; e0b52c99 <[bridge]br_fdb_get_entries+1f9/230>
Trace; c029e7ca <netlink_set_err+4aa/4c0>
Trace; c029e085 <netlink_unicast+265/2d0>
Trace; c029e53d <netlink_set_err+21d/4c0>
Trace; c028b755 <sock_sendmsg+75/c0>
Trace; c028ce3b <sock_create+ceb/11e0>
Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
Trace; c029af98 <nf_hook_slow+a8/1e0>
Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
Trace; e0b506c0 <[ip_conntrack_ftp].data.end+2861/4201>
Trace; e0b4c3fe <[ip_queue].data.end+a87/16e9>
Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
Trace; c0293755 <netif_receive_skb+c5/4c0>
Trace; c029393d <netif_receive_skb+2ad/4c0>
Trace; c0293a95 <netif_receive_skb+405/4c0>
Trace; c028d312 <sock_create+11c2/11e0>
Trace; c01076ef <__read_lock_failed+140b/17fc>

Code;  c029b208 <nf_reinject+138/270>
00000000 <_EIP>:
Code;  c029b208 <nf_reinject+138/270>   <=====
   0:   8b 50 08                  mov    0x8(%eax),%edx   <=====
Code;  c029b20b <nf_reinject+13b/270>
   3:   85 d2                     test   %edx,%edx
Code;  c029b20d <nf_reinject+13d/270>
   5:   74 11                     je     18 <_EIP+0x18>
Code;  c029b20f <nf_reinject+13f/270>
   7:   f0 ff 8a f0 00 00 00      lock decl 0xf0(%edx)
Code;  c029b216 <nf_reinject+146/270>
   e:   0f 94 c0                  sete   %al
Code;  c029b219 <nf_reinject+149/270>
  11:   84 c0                     test   %al,%al
Code;  c029b21b <nf_reinject+14b/270>
  13:   75 00                     jne    15 <_EIP+0x15>


1 warning and 1 error issued.  Results may not be reliable.
===============================================================

Any advise?

-- 
- Josh

    94 F8 9F 3E 9A DB 6E FC  F8 17 F1 B4 C7 51 CB AA   ~. .~   Tk Open Systems
  =}------------------------------------------------ooO--U--Ooo------------{=
     - [email protected] - tel: +972.58.520.636, http://www.tkos.co.il




-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0