Re: kernel OOPS

On Tue, 22 Jul 2003, Andriy T. Yanko wrote:

> Hi.
> I already post my OOPS message.
> And this bug is look seem as my and it maybe in ip_queue  kerbel modulet:

Hi Andriy,
I saw your post. Unfortunetly my ksymoops reading skills are a little
rusty. I was not sure that the problems were related. In any case did
you make any progress with this problem?

>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
>
>
>
>
> On Tue, 22 Jul 2003 13:26:05 +0300 (IDT)
> josh <[email protected]> wrote:
>
> > Hi List,
> > I have the following setup:
> > 	debian (unstable)
> > 	kernel 2.4.21 (from kernel.org, not debain kernel)
> > 	ebtables-brnf_vs_2.4.21.diff
> > 	snort_inline-2.0.0-1.tar.gz
> >
> > When I run snort_inline in NAT mode everything works fine. When I run
> > snort_inline in bridge mode I get an OOPS error in /var/log/kern.log
> > the following is the the kernel OOPS text run through ksymoops:
> > ===============================================================
> > ids:~# ksymoops < oops.txt
> > ksymoops 2.4.8 on i686 2.4.21.  Options used
> >      -V (default)
> >      -k /proc/ksyms (default)
> >      -l /proc/modules (default)
> >      -o /lib/modules/2.4.21/ (default)
> >      -m /boot/System.map-2.4.21 (default)
> >
> > Warning: You did not tell me where to find symbol information.  I will
> > assume that the log matches the kernel and modules that are running
> > right now and I'll use the default options above for symbol resolution.
> > If the current kernel and/or modules do not match the log, you can get
> > more accurate output by telling me the kernel version and where to find
> > map, modules, ksyms etc.  ksymoops -h explains the options.
> >
> > Error (regular_file): read_system_map stat /boot/System.map-2.4.21 failed
> > Jul 21 18:05:52 ids kernel: Unable to handle kernel NULL pointer dereference
> >  at virtual address 00000008
> > Jul 21 18:05:52 ids kernel: c029b208
> > Jul 21 18:05:52 ids kernel: *pde = 00000000
> > Jul 21 18:05:52 ids kernel: Oops: 0000
> > Jul 21 18:05:52 ids kernel: CPU:    0
> > Jul 21 18:05:52 ids kernel: EIP:    0010:[<c029b208>]    Not tainted
> > Using defaults from ksymoops -t elf32-i386 -a i386
> > Jul 21 18:05:52 ids kernel: EFLAGS: 00010246
> > Jul 21 18:05:52 ids kernel: eax: 00000000   ebx: 00000002   ecx: df3fdac0
> > edx: c1590000
> > Jul 21 18:05:52 ids kernel: esi: 00000001   edi: ce8b2ca0   ebp: 00000002
> > esp: d5e41cd0
> > Jul 21 18:05:52 ids kernel: ds: 0018   es: 0018   ss: 0018
> > Jul 21 18:05:52 ids kernel: Process snort_inline (pid: 5415, stackpage=d5e41
> > 000)
> > Jul 21 18:05:52 ids kernel: Stack: df3fdac0 d5e41d08 00000002 c682980c c6829
> > 80c d5e41cf0 e0b4f370 80000000
> > Jul 21 18:05:52 ids kernel:        c040fd70 ce8b2da0 00000001 c6c31ab0 00000
> > 012 e0b52085 df3fdac0 ce8b2ca0
> > Jul 21 18:05:52 ids kernel:        00000001 ce8b2da0 e0b52a41 ce8b2da0 00000
> > 001 0000000c df3fd340 00000001
> > Jul 21 18:05:52 ids kernel: Call Trace:    [<e0b4f370>] [<e0b52085>] [<e0b52
> > a41>] [<e0b52b8c>] [<e0b53318>]
> > Jul 21 18:05:52 ids kernel:   [<e0b53830>] [<e0b52c99>] [<c029e7ca>] [<c029e
> > 085>] [<c029e53d>] [<c028b755>]
> > Jul 21 18:05:52 ids kernel:   [<c028ce3b>] [<e0b4c130>] [<e0b4c130>] [<c029a
> > f98>] [<e0b4c130>] [<e0b506c0>]
> > Jul 21 18:05:52 ids kernel:   [<e0b4c3fe>] [<e0b4c130>] [<c0293755>] [<c0293
> > 93d>] [<c0293a95>] [<c028d312>]
> > Jul 21 18:05:52 ids kernel:   [<c01076ef>]
> > Jul 21 18:05:52 ids kernel: Code: 8b 50 08 85 d2 74 11 f0 ff 8a f0 00 00 00
> > 0f 94 c0 84 c0 75
> >
> >
> > >>EIP; c029b208 <nf_reinject+138/270>   <=====
> >
> > >>ecx; df3fdac0 <___strtok+1efddab8/206f2058>
> > >>edx; c1590000 <___strtok+116fff8/206f2058>
> > >>edi; ce8b2ca0 <___strtok+e492c98/206f2058>
> > >>esp; d5e41cd0 <___strtok+15a21cc8/206f2058>
> >
> > Trace; e0b4f370 <[ip_conntrack_ftp].data.end+1511/4201>
> > Trace; e0b52085 <[bridge]br_init+5/50>
> > Trace; e0b52a41 <[bridge]br_fdb_get+151/190>
> > Trace; e0b52b8c <[bridge]br_fdb_get_entries+ec/230>
> > Trace; e0b53318 <[bridge]br_forward_finish+8/60>
> > Trace; e0b53830 <[bridge]__br_del_if+60/a0>
> > Trace; e0b52c99 <[bridge]br_fdb_get_entries+1f9/230>
> > Trace; c029e7ca <netlink_set_err+4aa/4c0>
> > Trace; c029e085 <netlink_unicast+265/2d0>
> > Trace; c029e53d <netlink_set_err+21d/4c0>
> > Trace; c028b755 <sock_sendmsg+75/c0>
> > Trace; c028ce3b <sock_create+ceb/11e0>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
> > Trace; c029af98 <nf_hook_slow+a8/1e0>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
> > Trace; e0b506c0 <[ip_conntrack_ftp].data.end+2861/4201>
> > Trace; e0b4c3fe <[ip_queue].data.end+a87/16e9>
> > Trace; e0b4c130 <[ip_queue].data.end+7b9/16e9>
> > Trace; c0293755 <netif_receive_skb+c5/4c0>
> > Trace; c029393d <netif_receive_skb+2ad/4c0>
> > Trace; c0293a95 <netif_receive_skb+405/4c0>
> > Trace; c028d312 <sock_create+11c2/11e0>
> > Trace; c01076ef <__read_lock_failed+140b/17fc>
> >
> > Code;  c029b208 <nf_reinject+138/270>
> > 00000000 <_EIP>:
> > Code;  c029b208 <nf_reinject+138/270>   <=====
> >    0:   8b 50 08                  mov    0x8(%eax),%edx   <=====
> > Code;  c029b20b <nf_reinject+13b/270>
> >    3:   85 d2                     test   %edx,%edx
> > Code;  c029b20d <nf_reinject+13d/270>
> >    5:   74 11                     je     18 <_EIP+0x18>
> > Code;  c029b20f <nf_reinject+13f/270>
> >    7:   f0 ff 8a f0 00 00 00      lock decl 0xf0(%edx)
> > Code;  c029b216 <nf_reinject+146/270>
> >    e:   0f 94 c0                  sete   %al
> > Code;  c029b219 <nf_reinject+149/270>
> >   11:   84 c0                     test   %al,%al
> > Code;  c029b21b <nf_reinject+14b/270>
> >   13:   75 00                     jne    15 <_EIP+0x15>
> >
> >
> > 1 warning and 1 error issued.  Results may not be reliable.
> > ===============================================================
> >
> > Any advise?
> >
>
>

-- 
- Josh

    94 F8 9F 3E 9A DB 6E FC  F8 17 F1 B4 C7 51 CB AA   ~. .~   Tk Open Systems
  =}------------------------------------------------ooO--U--Ooo------------{=
     - [email protected] - tel: +972.58.520.636, http://www.tkos.co.il




-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0