Skip to contentSkip to conversation

segfaults and sockets

DISCUSSION David Ford 2 participants 3 messages Jul 5, 2004

lore
Share & tools
lore

David Ford

author
#0 lore raw

Kernel 2.6.7, vanilla.

This pops up on dmesg when I try to run tcptraceroute. Would someone kindly explain why this is being reported in kernel messages? I'm assuming that this is a bug in tcptraceroute not being truly sensible of the fact that I use nameif to rename my interfaces.

tcptraceroute[2148]: segfault at 000012500050f6d0 rip 0000002a957f79ec rsp 0000007fbffff020 error 6

#define ENXIO 6 /* No such device or address */

write(2, "Selected device cable, address 24.250.19.246", 44Selected device cable, address 24.250.19.246) = 44
write(2, ", port 35611", 12, port 35611) = 12
write(2, " for outgoing packets\n", 22 for outgoing packets
) = 22

socket(PF_PACKET, SOCK_RAW, 768)        = 5
ioctl(5, 0x8933, 0x7fbffff420)          = 0
ioctl(5, 0x8927, 0x7fbffff420)          = 0
ioctl(5, 0x8933, 0x7fbffff420)          = 0
bind(5, {sa_family=AF_PACKET, proto=0x03, if1, pkttype=PACKET_HOST, addr(0)={0, }, 20) = 0
getsockopt(5, SOL_SOCKET, SO_ERROR, "\0\0\0\0", [216172855128227844]) = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 6
ioctl(6, 0x8915, 0x7fbffff630)          = 0
ioctl(6, 0x891b, 0x7fbffff630)          = 0
close(6)                                = 0
setsockopt(5, SOL_SOCKET, 0x1a /* SO_??? */, "\1\0\0\0\0\0\0\0\260\270x\225*\0\0\0", 16) = 0
fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR|O_LARGEFILE)
fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
recvfrom(5, 0x7fbffff62f, 1, 32, 0, 0)  = -1 EAGAIN (Resource temporarily unavailable)
fcntl(5, F_SETFL, O_RDWR)               = 0
setsockopt(5, SOL_SOCKET, 0x1a /* SO_??? */, "\27\0P\0\0\0\0\0\0\370P\0\0\0\0\0", 16) = 0
fcntl(5, F_SETFL, O_RDONLY|O_NONBLOCK)  = 0
getuid()                                = 0
setuid(0)                               = 0

write(2, "Tracing the path to slashdot.org (66.35.250.150) on TCP port 80, 30 hops max", 76Tracing the path to slashdot.org (66.35.250.150) on TCP port 80, 30 hops max) = 76
write(2, "\n", 1
) = 1
sendto(4, "E\0\0(]\364\0\0\1\6\0\0\30\372\23\366B#\372\226\213\33\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40, 0, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("66.35.250.150")}, 16) = 40
select(6, [5], NULL, NULL, {3, 0}) = 1 (in [5], left {2, 980000})
recvfrom(5, "\0\16\246c\363\202\0\6*\313,p\10\0E\300\0008UM\0\0\377\1\306\302\n\4h\1\30\372\23\366\v\0i\224\0\0\0\0E\0\0(]\364\0\0\1\6\3622\30\372\23\366B#\372\226\213\33\0P\0\0\0\0", 106, MSG_TRUNC, {sa_family=AF_PACKET, proto=0x800, if1, pkttype=PACKET_HOST, addr(6)={1, 00062acb2c70}, [20]) = 70
ioctl(5, 0x8906, 0x7fbfffeff0) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

begin:vcard
fn:David Ford
n:Ford;David
email;internet:[email protected]
title:Industrial Geek
tel;home:Ask please
tel;cell:(203) 650-3611
x-mozilla-html:TRUE
version:2.1
end:vcard

#1 lore raw

killed by SIGSEGV +++

Quoted 3 lines · On Mon, 05 Jul 2004 16:23:44 -0400 David Ford…

ioctl(5, 0x8906, 0x7fbfffeff0) = 0

killed by SIGSEGV +++ renamed from SIGSEGV (Segmentation fault) @ 0 (0) --- +0 -0

0x8906 is SIOCGSTAMP, aparently the app isn't using a large enough structure to capture the timestamp, and the kernel is thus overwriting some critical part of the stack causing it to crash.

author
#2 lore raw

Thank you, I've forwarded/reported the bug.

Quoted 6 lines · David S. Miller

On Mon, 05 Jul 2004 16:23:44 -0400
David Ford <[email protected]> wrote:

Quoted 11 lines

killed by SIGSEGV +++

Quoted 5 lines

ioctl(5, 0x8906, 0x7fbfffeff0) = 0

killed by SIGSEGV +++ renamed from SIGSEGV (Segmentation fault) @ 0 (0) --- +0 -0

0x8906 is SIOCGSTAMP, aparently the app isn't using a large enough structure to capture the timestamp, and the kernel is thus overwriting some critical part of the stack causing it to crash.

begin:vcard
fn:David Ford
n:Ford;David
email;internet:[email protected]
title:Industrial Geek
tel;home:Ask please
tel;cell:(203) 650-3611
x-mozilla-html:TRUE
version:2.1
end:vcard