lkml.org 
[lkml]   [1996]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectNULL deref in _do_select, v1.3.81
    Date

    Got the following NULL deref while starting Net-Scrape v2 on v1.3.81.
    (Kernel is a.out, X11 is a.out, gcc is v2.5.8, using i486. CSLIP was
    enabled, and active, wd ether was enabled and inactive. For what it is
    worth, Net-Scrape would have been the first program to try and put a
    packet out over the modem.)

    Unable to handle kernel NULL pointer dereference at virtual address c0000000
    current->tss.cr3 = 003ef000, Cr3 = 003ef000
    *pde = 00102067
    *pte = 00000027
    Oops: 0000
    CPU: 0
    EIP: 0010:[<00135a00>]
    EFLAGS: 00013246
    eax: 00000000 ebx: 003e4ef4 ecx: 00000008 edx: 00003293
    esi: 007d0414 edi: 003e4ef4 ebp: 00000008 esp: 003e4e78
    ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
    Process X (pid: 58, process nr: 20, stackpage=003e4000)
    Stack: 00000000 00000080 bffff924 0014ed40 00000007 00000080 00000004 00135c12
    00263000 0014ed40 00000020 00135dc7 00000080 003e4f54 003e4f14 003e4ed4
    003e4f74 003e4f34 003e4ef4 0014ed40 00000080 bffff8f8 bffff8f0 00000000
    Call Trace: [<0014ed40>] [<00135c12>] [<0014ed40>] [<00135dc7>] [<0014ed40>] [<0014854a>] [<00110dc3>]
    [<0014ed40>] [<0010b129>] [<00158bc0>]
    Code: 00 00 00 00 8b 44 24 20 89 44 24 28 8d 4c 24 24 89 4c 24 10

    001357f8 t _free_wait
    00135868 t _check
    001358f8 t _do_select <----- Boom.
    00135be8 t ___get_fd_set
    00135c48 t ___set_fd_set
    00135c88 T _sys_select
    00135ec4 t _fifo_open

    Translated Call trace is: _ip_build_header, ___get_fd_set,
    _ip_build_header, _sys_select, _ip_build_header, _unix_recvmsg,
    _old_select, _ip_build_header, _system_call, _udp_ioctl

    I don't have g++ installed to build ksymoops, but real hackers use gdb
    anyways, so here it is. :-)

    (gdb) l *0x135a00
    0x135a00 is in do_select (select.c:120).
    115 return -ENOMEM;
    116 FD_ZERO(res_in);
    117 FD_ZERO(res_out);
    118 FD_ZERO(res_ex);
    119 count = 0;
    120 wait_table.nr = 0; <---- Boom.
    121 wait_table.entry = entry;
    122 wait = &wait_table;
    123 repeat:
    124 current->state = TASK_INTERRUPTIBLE;
    (gdb)


    Regards,
    Paul.


    \
     
     \ /
      Last update: 2005-03-22 13:36    [W:0.022 / U:1.736 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site