lkml.org 
[lkml]   [1996]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectNULL deref in _do_select, v1.3.81
Date

Got the following NULL deref while starting Net-Scrape v2 on v1.3.81.
(Kernel is a.out, X11 is a.out, gcc is v2.5.8, using i486. CSLIP was
enabled, and active, wd ether was enabled and inactive. For what it is
worth, Net-Scrape would have been the first program to try and put a
packet out over the modem.)

Unable to handle kernel NULL pointer dereference at virtual address c0000000
current->tss.cr3 = 003ef000, Cr3 = 003ef000
*pde = 00102067
*pte = 00000027
Oops: 0000
CPU: 0
EIP: 0010:[<00135a00>]
EFLAGS: 00013246
eax: 00000000 ebx: 003e4ef4 ecx: 00000008 edx: 00003293
esi: 007d0414 edi: 003e4ef4 ebp: 00000008 esp: 003e4e78
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process X (pid: 58, process nr: 20, stackpage=003e4000)
Stack: 00000000 00000080 bffff924 0014ed40 00000007 00000080 00000004 00135c12
00263000 0014ed40 00000020 00135dc7 00000080 003e4f54 003e4f14 003e4ed4
003e4f74 003e4f34 003e4ef4 0014ed40 00000080 bffff8f8 bffff8f0 00000000
Call Trace: [<0014ed40>] [<00135c12>] [<0014ed40>] [<00135dc7>] [<0014ed40>] [<0014854a>] [<00110dc3>]
[<0014ed40>] [<0010b129>] [<00158bc0>]
Code: 00 00 00 00 8b 44 24 20 89 44 24 28 8d 4c 24 24 89 4c 24 10

001357f8 t _free_wait
00135868 t _check
001358f8 t _do_select <----- Boom.
00135be8 t ___get_fd_set
00135c48 t ___set_fd_set
00135c88 T _sys_select
00135ec4 t _fifo_open

Translated Call trace is: _ip_build_header, ___get_fd_set,
_ip_build_header, _sys_select, _ip_build_header, _unix_recvmsg,
_old_select, _ip_build_header, _system_call, _udp_ioctl

I don't have g++ installed to build ksymoops, but real hackers use gdb
anyways, so here it is. :-)

(gdb) l *0x135a00
0x135a00 is in do_select (select.c:120).
115 return -ENOMEM;
116 FD_ZERO(res_in);
117 FD_ZERO(res_out);
118 FD_ZERO(res_ex);
119 count = 0;
120 wait_table.nr = 0; <---- Boom.
121 wait_table.entry = entry;
122 wait = &wait_table;
123 repeat:
124 current->state = TASK_INTERRUPTIBLE;
(gdb)


Regards,
Paul.


\
 
 \ /
  Last update: 2005-03-22 13:36    [W:0.069 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site