Skip to contentSkip to conversation

2.5.74 - BUG in kfree during sys_close from netstat

DISCUSSION Andrey Borzenkov 2 participants 3 messages Jul 8, 2003

lore
Share & tools
lore

Andrey Borzenkov

author
#0 lore raw

Mandrake 9.1, kernel 2.5.74. Started kmail, started kppp, connected, attempted to send or receive - nothing happened. Run netstat -an - and got

------------[ cut here ]------------
kernel BUG at mm/slab.c:1537!
invalid operand: 0000 [#2]
CPU:    0
EIP:    0060:[<c014c530>]    Tainted: P
EFLAGS: 00010002

EIP is at kfree+0x2e0/0x2f0
eax: 0000002c ebx: 00040000 ecx: cf1fe670 edx: 00000001
esi: c02b9ee0 edi: 00000100 ebp: c6443f34 esp: c6443f14
ds: 007b es: 007b ss: 0068
Process netstat (pid: 10138, threadinfo=c6442000 task=c2e2ad40)

Stack: c6443f28 c02752fe cdcc0908 00000001 00000206 cdcc0908 c34438d4 c245537c
       c6443f4c c01881b8 00000100 c34438d4 c34438d4 cffdf8e4 c6443f70 c0165089
       c245537c c34438d4 c245537c c996fa98 c34438d4 c69ee724 00000000 c6443f98
Call Trace:
 [<c02752fe>] raw_seq_start+0x4e/0x60
 [<c01881b8>] seq_release_private+0x18/0x32
 [<c0165089>] __fput+0x129/0x130
 [<c0163703>] filp_close+0xc3/0x110
 [<c01637e2>] sys_close+0x92/0x120
 [<c010b527>] syscall_call+0x7/0xb

Code: 0f 0b 01 06 d1 93 2b c0 e9 44 fd ff ff 8d 76 00 55 89 e5 57

this happened more than once; previous stack (I do not know actually what triggered it - I did not run netstat for sure) looked like:

PPP BSD Compression module registered
PPP Deflate Compression module registered
kfree_debugcheck: out of range ptr 100h.

------------[ cut here ]------------
kernel BUG at mm/slab.c:1537!
invalid operand: 0000 [#1]
CPU:    0
EIP:    0060:[<c014c530>]    Tainted: P
EFLAGS: 00010002

EIP is at kfree+0x2e0/0x2f0
eax: 0000002c ebx: 00040000 ecx: cf1fe670 edx: 00000001
esi: c02b9ee0 edi: 00000100 ebp: c7789f34 esp: c7789f14
ds: 007b es: 007b ss: 0068
Process netstat (pid: 8509, threadinfo=c7788000 task=c2c4d2f0)

Stack: c7789f28 c02752fe c32d1dc8 00000001 00000206 c32d1dc8 c462c414 c245537c
       c7789f4c c01881b8 00000100 c462c414 c462c414 cffdf8e4 c7789f70 c0165089
       c245537c c462c414 c245537c c996fa98 c462c414 c2c3b8d4 00000000 c7789f98
Call Trace:
 [<c02752fe>] raw_seq_start+0x4e/0x60
 [<c01881b8>] seq_release_private+0x18/0x32
 [<c0165089>] __fput+0x129/0x130
 [<c0163703>] filp_close+0xc3/0x110
 [<c01637e2>] sys_close+0x92/0x120
 [<c010b527>] syscall_call+0x7/0xb

Code: 0f 0b 01 06 d1 93 2b c0 e9 44 fd ff ff 8d 76 00 55 89 e5 57
 <3>kfree_debugcheck: out of range ptr 100h.

Just tried and when connection is done while kmail is not started it works. I am not sure what kmail does - except that it actually is the only application to actively use IP here most of the time.

-andrey

author
#2 lore raw
In reply to Andrey Borzenkov
Quoted 4 lines · Andrey Borzenkov

Just tried and when connection is done while kmail is not started it works. I am not sure what kmail does - except that it actually is the only application to actively use IP here most of the time.

forget it - with or without kmail, with or without connection established netstat bugs out every time:

pts/1}% ifconfig -a
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:177 errors:0 dropped:0 overruns:0 frame:0 TX packets:177 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0
RX bytes:12238 (11.9 Kb) TX bytes:12238 (11.9 Kb)

{pts/1}% netstat -an
Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:32768         0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:6000            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:631             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN
udp        0      0 0.0.0.0:514             0.0.0.0:*
udp        0      0 0.0.0.0:10000           0.0.0.0:*
udp        0      0 127.0.0.1:53            0.0.0.0:*
udp        0      0 224.0.0.251:5353        0.0.0.0:*
udp        0      0 127.0.0.1:5353          0.0.0.0:*
udp        0      0 0.0.0.0:111             0.0.0.0:*
udp        0      0 0.0.0.0:631             0.0.0.0:*

zsh: segmentation fault netstat -an

dmesg ->

------------[ cut here ]------------
kernel BUG at mm/slab.c:1537!
invalid operand: 0000 [#6]
CPU:    0
EIP:    0060:[<c014c530>]    Tainted: P
EFLAGS: 00010002

EIP is at kfree+0x2e0/0x2f0
eax: 0000002c ebx: 00040000 ecx: cf1fe670 edx: 00000001
esi: c02b9ee0 edi: 00000100 ebp: ced77f34 esp: ced77f14
ds: 007b es: 007b ss: 0068
Process netstat (pid: 10529, threadinfo=ced76000 task=c1b100e0)

Stack: ced77f28 c02752fe cacdcad0 00000001 00000206 cacdcad0 cfab5a04 c245537c
       ced77f4c c01881b8 00000100 cfab5a04 cfab5a04 cffdf8e4 ced77f70 c0165089
       c245537c cfab5a04 c245537c c996fa98 cfab5a04 c61c2c54 00000000 ced77f98
Call Trace:
 [<c02752fe>] raw_seq_start+0x4e/0x60
 [<c01881b8>] seq_release_private+0x18/0x32
 [<c0165089>] __fput+0x129/0x130
 [<c0163703>] filp_close+0xc3/0x110
 [<c01637e2>] sys_close+0x92/0x120
 [<c010b527>] syscall_call+0x7/0xb

Code: 0f 0b 01 06 d1 93 2b c0 e9 44 fd ff ff 8d 76 00 55 89 e5 57