Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S263155AbTIVUhx (ORCPT ); Mon, 22 Sep 2003 16:37:53 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S263197AbTIVUhx (ORCPT ); Mon, 22 Sep 2003 16:37:53 -0400 Received: from ece-237-233.ece.gatech.edu ([130.207.237.233]:10112 "EHLO cc335-gr01") by vger.kernel.org with ESMTP id S263155AbTIVUh3 (ORCPT ); Mon, 22 Sep 2003 16:37:29 -0400 Date: Mon, 22 Sep 2003 16:37:43 -0400 From: Dheeraj To: linux-kernel@vger.kernel.org Subject: Multiple Oops'es and Hard locked machine Message-ID: <20030922203742.GA630@bharati> Reply-To: dheeraj@ece.gatech.edu Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Organization: Just Home User-Agent: Mutt/1.5.4i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 24368 Lines: 561 1. When I load a simplest netfilter hook into the kernel as an external module, and insmod-rmmod-insmod operation results in an Oops and a hard-lock; I can only power recycle there upon. 2. I am trying to add a simple netfilter hook as given below: ~~~~~~~~~~~~~~~ stealer.c~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /* my petty attempts at programming */ #include #include #include #include #include #include #include static unsigned int preproc_hook (unsigned int hook, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *) ) { printk("%s\n", in->name); return NF_ACCEPT; } static struct nf_hook_ops preproc_hook_ops = { .hook = preproc_hook, .owner = THIS_MODULE, .pf = PF_INET, .hooknum = NF_IP_LOCAL_IN, .priority = NF_IP_PRI_FILTER + 1 }; static int stealer_init(void) { printk("In the init code of stealer\n"); return nf_register_hook(&preproc_hook_ops); } static void stealer_cleanup(void) { printk("In the cleanup code of stealer \n"); return; } module_init(stealer_init); module_exit(stealer_cleanup); MODULE_LICENSE("Dual BSD/GPL"); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scenario 1: ========= when i build stealer.ko and insmod stealer.ko rmmod stealer.ko insmod stealer.ko the following Oops results Oops: 0000 [#1] PREEMPT CPU: 0 EIP: 0060:[] Tainted: GF VLI EFLAGS: 00010246 EIP is at nf_register_hook+0x58/0xa9 eax: c04876c8 ebx: 00000000 ecx: 00000000 edx: f88cb448 esi: 00000001 edi: 00000000 ebp: f88cb448 esp: f7653f84 ds: 007b es: 007b ss: 0068 Process insmod (pid: 298, threadinfo=f7652000 task=f767a080) Stack: c04876c8 c03b7cf0 f88cb480 f7652000 c03b7cd8 f88cb03b f88cb448 c013a126 c0473568 00000001 f88cb480 4014c008 080486bd bffffdd4 f7652000 c0349463 4014c008 00026565 0804b050 080486bd bffffdd4 bffffd88 00000080 0000007b Call Trace: [] stealer_init+0x1b/0x1f [stealer] [] sys_init_module+0xfa/0x20b [] syscall_call+0x7/0xb Code: 89 f8 8b 14 dd 40 76 48 c0 3c 02 8b 0a 74 04 0f 18 01 90 8d 04 dd 40 76 48 c0 39 c2 74 21 8b 75 18 89 04 24 3b 72 18 7c 16 89 fb <8b> 01 89 ca 80 fb 02 89 c1 74 04 0f 18 00 90 3b 14 24 75 e5 8b <0>Kernel panic: Fatal exception in interrupt In interrupt handler - not syncing ===>>>>> the relevant code is the 'list_for_each' macro in nf_register_hook function Scenario 2: ========== If I insmod the same module and them rmmod it, then initiate any network traffic a simple ping from another box the following Oops results cc335-gr01:~# ttyS1: LSR safety check engaged! ttyS1: LSR safety check engaged! stealer: no version for "struct_module" found: kernel tainted. In the init code of stealer eth0 eth0 eth0 eth0 eth0 eth0 eth0 eth0 eth0 eth0 In the cleanup code of stealer Unable to handle kernel paging request at virtual address f88cb448 printing eip: c02dc21a *pde = 01afb067 Oops: 0000 [#1] PREEMPT CPU: 0 EIP: 0060:[] Tainted: GF VLI EFLAGS: 00010293 EIP is at nf_iterate+0x24/0xb7 eax: f88cb448 ebx: c0439e94 ecx: 00000002 edx: f78d3e80 esi: 80000000 edi: c04876c8 ebp: c02e4589 esp: c0439e48 ds: 007b es: 007b ss: 0068 Process swapper (pid: 0, threadinfo=c0438000 task=c03b39c0) Stack: 00000920 00000020 000000aa f7964ff0 f798daa0 f78d2020 00000001 00000000 00000002 c02dc612 c04876c8 c0439eb4 00000001 c1b00800 00000000 c0439e94 c02e4589 80000000 00000000 f88cb448 f78d202 Call Trace: [] nf_hook_slow+0x84/0x146 [] ip_local_deliver_finish+0x0/0x153 [] ip_local_deliver+0x1a9/0x1c7 [] ip_local_deliver_finish+0x0/0x153 [] ip_rcv+0x30d/0x469 [] packet_rcv_spkt+0x18d/0x22a [] netif_receive_skb+0x196/0x215 [] process_backlog+0x75/0x11b [] net_rx_action+0x75/0x12e [] do_softirq+0x92/0x94 [] do_IRQ+0x102/0x135 [] _stext+0x0/0x5d [] common_interrupt+0x18/0x20 [] _stext+0x0/0x5d [] try_to_free_low+0xa4/0x13f [] default_idle+0x23/0x26 [] cpu_idle+0x2c/0x35 [] start_kernel+0x187/0x1b5 [] unknown_bootoption+0x0/0xfd Code: fe ff ff 83 c4 18 c3 55 57 56 53 83 ec 14 8b 5c 24 3c 8b 7c 24 28 8b 6c 24 40 8b 03 8b 74 24 44 8b 00 89 03 80 3d 81 4e 3b c0 02 <8b> 10 74 04 0f 18 02 90 39 f8 74 1e 8b 03 3b 70 18 7e 26 8b 00 <0>Kernel panic: Fatal exception in interrupt In interrupt handler - not syncing ==>>> the relevant code in the nf_iterate procedure is at list_for_each_continue_rcu(*i, head) ================================================================ 3. Networking, Modules, kernel 4. cc335-gr01:~# cat /proc/version Linux version 2.6.0-test5-mm2 (root@cc335-gr01) (gcc version 3.3.2 20030908 (Debian prerelease)) #3 Mon Sep 22 14:33:36 EDT 2003 cc335-gr01:~# 5. (gdb) disassemble nf_iterate Dump of assembler code for function nf_iterate: 0xc02dc1f6 : push %ebp 0xc02dc1f7 : push %edi 0xc02dc1f8 : push %esi 0xc02dc1f9 : push %ebx 0xc02dc1fa : sub $0x14,%esp 0xc02dc1fd : mov 0x3c(%esp,1),%ebx 0xc02dc201 : mov 0x28(%esp,1),%edi 0xc02dc205 : mov 0x40(%esp,1),%ebp 0xc02dc209 : mov (%ebx),%eax 0xc02dc20b : mov 0x44(%esp,1),%esi 0xc02dc20f : mov (%eax),%eax 0xc02dc211 : mov %eax,(%ebx) 0xc02dc213 : cmpb $0x2,0xc03b4e81 0xc02dc21a : mov (%eax),%edx 0xc02dc21c : je 0xc02dc222 0xc02dc21e : lea 0x0(%esi,1),%esi 0xc02dc222 : cmp %edi,%eax 0xc02dc224 : je 0xc02dc244 0xc02dc226 : mov (%ebx),%eax 0xc02dc228 : cmp 0x18(%eax),%esi 0xc02dc22b : jle 0xc02dc253 0xc02dc22d : mov (%eax),%eax 0xc02dc22f : mov %eax,(%ebx) 0xc02dc231 : cmpb $0x2,0xc03b4e81 0xc02dc238 : mov (%eax),%edx 0xc02dc23a : je 0xc02dc240 0xc02dc23c : lea 0x0(%esi,1),%esi 0xc02dc240 : cmp %edi,%eax 0xc02dc242 : jne 0xc02dc226 0xc02dc244 : mov $0x1,%edx 0xc02dc249 : add $0x14,%esp 0xc02dc24c : mov %edx,%eax 0xc02dc24e : pop %ebx 0xc02dc24f : pop %esi 0xc02dc250 : pop %edi 0xc02dc251 : pop %ebp 0xc02dc252 : ret 0xc02dc253 : mov 0x38(%esp,1),%edx 0xc02dc257 : mov %ebp,0x10(%esp,1) 0xc02dc25b : mov %edx,0xc(%esp,1) 0xc02dc25f : mov 0x34(%esp,1),%edx 0xc02dc263 : mov %edx,0x8(%esp,1) 0xc02dc267 : mov 0x2c(%esp,1),%edx 0xc02dc26b : mov %edx,0x4(%esp,1) 0xc02dc26f : mov 0x30(%esp,1),%edx 0xc02dc273 : mov %edx,(%esp,1) 0xc02dc276 : call *0x8(%eax) 0xc02dc279 : mov $0x2,%edx 0xc02dc27e : cmp $0x2,%eax 0xc02dc281 : je,pn 0xc02dc249 0xc02dc284 : cmp $0x2,%eax 0xc02dc287 : ja 0xc02dc294 0xc02dc289 : xor %edx,%edx ---Type to continue, or q to quit--- 0xc02dc28b : test %eax,%eax 0xc02dc28d : je,pn 0xc02dc249 0xc02dc290 : mov (%ebx),%eax 0xc02dc292 : jmp 0xc02dc22d 0xc02dc294 : cmp $0x3,%eax 0xc02dc297 : mov $0x3,%edx 0xc02dc29c : je,pn 0xc02dc249 0xc02dc29f : cmp $0x4,%eax 0xc02dc2a2 : jne 0xc02dc290 0xc02dc2a4 : mov (%ebx),%eax 0xc02dc2a6 : mov 0x4(%eax),%eax 0xc02dc2a9 : mov %eax,(%ebx) 0xc02dc2ab : jmp 0xc02dc22d End of assembler dump. (gdb) disassemble nf_register_hook Dump of assembler code for function nf_register_hook: 0xc02dbddc : push %ebp 0xc02dbddd : mov $0xffffe000,%eax 0xc02dbde2 : and %esp,%eax 0xc02dbde4 : push %edi 0xc02dbde5 : push %esi 0xc02dbde6 : push %ebx 0xc02dbde7 : sub $0x4,%esp 0xc02dbdea : mov 0x18(%esp,1),%ebp 0xc02dbdee : addl $0x100,0x14(%eax) 0xc02dbdf5 : addl $0x1,0x14(%eax) 0xc02dbdf9 : movzbl 0xc03b4e81,%edi 0xc02dbe00 : mov 0x10(%ebp),%edx 0xc02dbe03 : mov 0x14(%ebp),%eax 0xc02dbe06 : lea (%eax,%edx,8),%ebx 0xc02dbe09 : mov %edi,%eax 0xc02dbe0b : mov 0xc0487640(,%ebx,8),%edx 0xc02dbe12 : cmp $0x2,%al 0xc02dbe14 : mov (%edx),%ecx 0xc02dbe16 : je 0xc02dbe1c 0xc02dbe18 : lea 0x0(%esi,1),%esi 0xc02dbe1c : lea 0xc0487640(,%ebx,8),%eax 0xc02dbe23 : cmp %eax,%edx 0xc02dbe25 : je 0xc02dbe48 0xc02dbe27 : mov 0x18(%ebp),%esi 0xc02dbe2a : mov %eax,(%esp,1) 0xc02dbe2d : cmp 0x18(%edx),%esi 0xc02dbe30 : jl 0xc02dbe48 0xc02dbe32 : mov %edi,%ebx 0xc02dbe34 : mov (%ecx),%eax 0xc02dbe36 : mov %ecx,%edx 0xc02dbe38 : cmp $0x2,%bl 0xc02dbe3b : mov %eax,%ecx 0xc02dbe3d : je 0xc02dbe43 0xc02dbe3f : lea 0x0(%esi,1),%esi 0xc02dbe43 : cmp (%esp,1),%edx 0xc02dbe46 : jne 0xc02dbe2d 0xc02dbe48 : mov 0x4(%edx),%eax 0xc02dbe4b : mov (%eax),%edx 0xc02dbe4d : mov %eax,0x4(%ebp) 0xc02dbe50 : mov %edx,0x0(%ebp) 0xc02dbe53 : mov %ebp,(%eax) 0xc02dbe55 : mov %ebp,0x4(%edx) 0xc02dbe58 : mov $0xffffe000,%eax 0xc02dbe5d : and %esp,%eax 0xc02dbe5f : subl $0x1,0x14(%eax) 0xc02dbe63 : mov 0x8(%eax),%eax 0xc02dbe66 : test $0x8,%al 0xc02dbe68 : jne 0xc02dbe7e 0xc02dbe6a : call 0xc012855c 0xc02dbe6f : call 0xc02d4727 0xc02dbe74 : add $0x4,%esp 0xc02dbe77 : pop %ebx 0xc02dbe78 : xor %eax,%eax ---Type to continue, or q to quit--- 0xc02dbe7a : pop %esi 0xc02dbe7b : pop %edi 0xc02dbe7c : pop %ebp 0xc02dbe7d : ret 0xc02dbe7e : call 0xc012144f 0xc02dbe83 : jmp 0xc02dbe6a End of assembler dump. (gdb) ================ 6. See section 2 above 7. 7.1 cc335-gr01:/usr/src/linux-2.6.0-test5/Documentation# ../scripts/ver_linux If some fields are empty or look unusual you may have an old version. Compare to the current minimal requirements in Documentation/Changes. Linux cc335-gr01 2.6.0-test5-mm2 #3 Mon Sep 22 14:33:36 EDT 2003 i686 GNU/Linux Gnu C 3.3.2 Gnu make 3.80 util-linux 2.11z mount 2.11z e2fsprogs 1.35-WIP Linux C Library 2.3.2 Dynamic linker (ldd) 2.3.2 Procps 3.1.12 Net-tools 1.60 Console-tools 0.2.3 Sh-utils 5.0.90 Modules Loaded snd_intel8x0 snd_ac97_codec snd_mpu401_uart 7.2 cc335-gr01:/usr/src/linux-2.6.0-test5/Documentation# cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 15 model : 2 model name : Intel(R) Pentium(R) 4 CPU 3.00GHz stepping : 9 cpu MHz : 2993.260 cache size : 512 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe cid bogomips : 5914.62 7.3 cc335-gr01:/usr/src/linux-2.6.0-test5/Documentation# cat /proc/modules snd_intel8x0 31652 0 - Live 0xf88fb000 snd_ac97_codec 52484 1 snd_intel8x0, Live 0xf88ed000 snd_mpu401_uart 7808 1 snd_intel8x0, Live 0xf88cf000 snd_rawmidi 24864 1 snd_mpu401_uart, Live 0xf88d4000 7.4 00:00.0 Host bridge: Intel Corp.: Unknown device 2570 (rev 02) Subsystem: Dell Computer Corporation: Unknown device 0151 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- SERR- 00:01.0 PCI bridge: Intel Corp.: Unknown device 2571 (rev 02) (prog-if 00 [Normal decode]) Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- Status: Cap- 66Mhz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- SERR- Reset- FastB2B- 00:1d.0 USB Controller: Intel Corp.: Unknown device 24d2 (rev 02) (prog-if 00 [UHCI]) Subsystem: Dell Computer Corporation: Unknown device 0151 Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- SERR- TAbort- SERR- TAbort- SERR- TAbort- SERR- TAbort- SERR- TAbort- SERR- Reset- FastB2B- 00:1f.0 ISA bridge: Intel Corp.: Unknown device 24d0 (rev 02) Control: I/O+ Mem+ BusMaster+ SpecCycle+ MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- SERR- TAbort- SERR- Region 1: I/O ports at Region 2: I/O ports at Region 3: I/O ports at Region 4: I/O ports at ffa0 [size=16] Region 5: Memory at febffc00 (32-bit, non-prefetchable) [size=1K] 00:1f.2 IDE interface: Intel Corp.: Unknown device 24d1 (rev 02) (prog-if 8f [Master SecP SecO PriP PriO]) Subsystem: Dell Computer Corporation: Unknown device 0151 Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- Status: Cap- 66Mhz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- SERR- TAbort- SERR- TAbort- SERR- TAbort- SERR- 02:0c.0 Ethernet controller: Intel Corp. 82540EM Gigabit Ethernet Controller (rev 02) Subsystem: Dell Computer Corporation: Unknown device 0151 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B- Status: Cap+ 66Mhz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- SERR-