Messages in this thread | | | From | Dan Yocum <> | Subject | Re: [security] Big problem on 2.0.x? (fwd) | Date | Wed, 15 Dec 1999 17:21:57 -0600 |
| |
> > >o Very occasional NFS crashes with "evil packet..." > > > > Hmm "evil packet" is a bit too much generic in order to fix this ;)). > > I can only agree. But the mail with the bug-report wasn't very exact.
Sort of OT, but related: many times under the 2.0.36 kernel I've seen at least 2 distinct NFS problems. I'd love to have an answer since about 300-400 of our machines are running 2.0.36 kernels (not all are NFS servers, though :).
In the first one everything seems to be happy on the server:
[root@thpc16 /root]# ps aux | grep rpc root 314 0.0 0.1 1156 64 ? S Dec 3 0:00 rpc.mountd root 330 0.0 0.1 1152 76 ? S Dec 3 0:00 rpc.nfsd root 19077 0.0 0.5 836 348 p9 S 16:37 0:00 grep rpc
But, attempting to mount from a client fails with timeouts and /var/log/messages gets filled up with this:
Warning: possible SYN flood from 131.225.55.9 on 131.225.55.98:635. Sending cookies.
Attempting to stop the errant processes yields:
[root@thpc16 /root]# /etc/rc.d/init.d/nfs stop Shutting down NFS services: rpc.mountd kill: (314) - No such pid rpc.nfsd kill: (330) - No such pid
But, hey, I see pid's 314 and 330 in the above 'ps' so what's the scoop?
Restarting nfs clears the air.
The second NFS problem is that the rpc.mountd will inexplicably stop, dead. I've run an strace for a few days to see what I get. Here's the last few lines, but nothing obvious (at least to me):
sendto(1, "9\27S\361\0\0\0\0\0\0\0\2\0\1\206"..., 96, 0, {sin_family=AF_INET, sin_port=htons(723), sin_addr=inet_addr("131.225.10.38")}, 16) = 96 select(256, [1], NULL, NULL, {5, 0}) = 1 (in [1], left {4, 990000}) recvfrom(1, "9\27S\361\0\0\0\1\0\0\0\0\0\0\0\0"..., 8800, 0, {sin_family=AF_INET, sin_port=htons(32774), sin_addr=inet_addr("131.225.10.38") }, [16]) = 64 close(1) = 0 --- SIGSEGV (Segmentation fault) ---
If you want/need more, I can send it.
Cheers, Dan
___________________________________________________________________________ Dan Yocum | Phone: (630) 840-8525 Linux Research and Development | Fax: (630) 840-6345 Computing Division, OSS Dept. | email: yocum@fnal.gov .~. L Fermi National Accelerator Lab | WWW: www-oss.fnal.gov/~yocum/ /V I P.O. Box 500 | // \ N Batavia, IL 60510 | "TANSTAAFL" /( ) U ________________________________|_________________________________ ^`~'^__X_
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |