From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S264300AbTICSjd (ORCPT ); Wed, 3 Sep 2003 14:39:33 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S264259AbTICSgH (ORCPT ); Wed, 3 Sep 2003 14:36:07 -0400 Received: from web10904.mail.yahoo.com ([216.136.131.40]:15201 "HELO web10904.mail.yahoo.com") by vger.kernel.org with SMTP id S264290AbTICSep (ORCPT ); Wed, 3 Sep 2003 14:34:45 -0400 Message-ID: <20030903183443.44079.qmail@web10904.mail.yahoo.com> Date: Wed, 3 Sep 2003 11:34:43 -0700 (PDT) From: Ned Ren Subject: Need advice: Strange Oops, corrupted call stack?? To: linux-kernel@vger.kernel.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Hi, We have modified the netfilter code a bit, but I feel quite suspicious of the oops dumps we are getting. There are sometimes function calls repeated several times, when I look into those functions there's no recursive calls. Also if look at crash 3, the function call shouldn't lead to get_unique_tuple from netif_rx, does this mean the stack is corrupted? I've traced the crash down to src_cmp() in net/ipv4/netfilter/ip_nat_core.c (called from find_appropriate_src()). Looks like the i->conntrack pointer is bad (it should be in edx), but the weird thing is it's 0x04000401 everytime! static inline int src_cmp(const struct ip_nat_hash *i, const struct ip_conntrack_tuple *tuple, const struct ip_nat_multi_range *mr) { return (i->conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == tuple->dst.protonum ... Could someone give me some advice on this please? Thank you very much for your time!!! Crash 1: ====================================== Unable to handle kernel paging request at virtual address 04000425 Oops: 0000 EIP:0010:[] at find_appropriate_src+0x42/a0 EFLAGS: 00010246 eax:e0810006 ebx:dcf651a4 ecx:00000001 edx:04000401 esi:d5e15b98 edi:00000000 ebp:00000b93 esp:d5e15ae0 ds:0018 es:0018 ss:0018 Process vss_ftp (pid: 5005, stackpage=d5e15000) Stack: e09847d8 d5e15b98 00000004 d5e15bf8 c01fbedc d5e15b98 e09847d8 c02b38a0 00000000 00000000 33323130 37363534 42413938 46454443 4a494847 4e4d4c4b 5251504f 00001400 00000000 00000001 00000001 00000001 5763c9df c01f1478 Call Trace: [] get_unique_tuple+0x19c/210 (0xd5e15af0) [] invert_tuple+0x38/40 (0xd5e15b3c) [] ip_nat_setup_info+0x4e/3a0 (0xd5e15b50) [] ip_nat_used_tuple+0x1e/30 (0xd5e15b68) [] dev_queue_xmit+0x18e/2a0 (0xd5e15bb8) [] invert_tuple+0x38/40 (0xd5e15bec) [] invert_tuplepr+0x1e/30 (0xd5e15bf8) [] ip_nat_setup_info+0x7c/3a0 (0xd5e15c0c) [] ipt_snat_target+0x20/30 (0xd5e15c28) [] ipt_do_table+0x285/310 (0xd5e15c44) [] ip_nat_rule_find+0x29/b0 (0xd5e15ca0) [] unix_stream_data_wait+0xc6/f0 (0xd5e15cbc) [] ip_nat_rule_find+0x9e/b0 (0xd5e15cd8) [] ip_nat_fn+0x10a/200 (0xd5e15ce4) [] ip_finish_output2+0x0/e0 (0xd5e15d18) [] nf_iterate+0x58/90 (0xd5e15d1c) [] ip_finish_output2+0x0/e0 (0xd5e15d30) [] nf_hook_slow+0x65/150 (0xd5e15d44) [] ip_finish_output2+0x0/e0 (0xd5e15d60) [] ip_output+0x5e/70 (0xd5e15d7c) [] ip_finish_output2+0x0/e0 (0xd5e15d94) [] ip_queue_xmit2+0xc5/22c (0xd5e15d9c) [] nf_hook_slow+0xa5/150 (0xd5e15db4) [] ip_queue_xmit+0x18e/2c0 (0xd5e15dd0) [] ip_queue_xmit2+0x0/22c (0xd5e15de8) [] tcp_v4_send_check+0x32/c0 (0xd5e15df8) [] tcp_transmit_skb+0x2b3/450 (0xd5e15e24) [] tcp_connect+0x22d/280 (0xd5e15e48) [] tcp_v4_connect+0x254/390 (0xd5e15e60) [] netif_receive_skb+0xef/180 (0xd5e15e80) [] page_remove_rmap+0x5f/70 (0xd5e15eb4) [] inet_stream_connect+0xf6/230 (0xd5e15ec8) [] sys_connect+0x56/80 (0xd5e15ee8) [] sys_rt_sigaction+0x6c/a0 (0xd5e15f60) [] sys_socketcall+0x8b/1b0 (0xd5e15f8c) [] do_page_fault+0x0/3f9 (0xd5e15fb0) [] error_code+0x34/40 (0xd5e15fb8) [] system_call+0x33/40 (0xd5e15fc0) Code: 66 39 42 24 74 1c 85 ff 75 07 a1 54 ee 31 c0 eb dd 31 c0 85 Crash 2 ====================================== Oops: 0000 EIP:0010:[] at find_appropriate_src+0x42/a0 EFLAGS: 00010246 eax:e0820006 ebx:d69169a4 ecx:00000001 edx:04000401 esi:c33abc1c edi:00000000 ebp:00001e9b esp:c33abb64 ds:0018 es:0018 ss:0018 Process vss_smtp_k (pid: 27037, stackpage=c33ab000) Stack: c33abcbc c33abc1c 00000004 c33abc7c c01ef70c c33abc1c c33abcbc c02a1660 0407070a 0000578b 00000000 c33a0006 00000003 c01ef5d4 c33abcec c01ef61a c33abca8 c20fb620 c02a1660 00000000 0000578b 00000000 00000000 c01e4c78 Call Trace: [] get_unique_tuple+0x19c/210 (0xc33abb74) [] get_unique_tuple+0x64/210 (0xc33abb98) [] get_unique_tuple+0xaa/210 (0xc33abba0) [] invert_tuple+0x38/40 (0xc33abbc0) [] ip_nat_setup_info+0x4e/3a0 (0xc33abbd4) [] invert_tuple+0x38/40 (0xc33abbec) [] invert_tuplepr+0x1e/30 (0xc33abbf8) [] ip_nat_setup_info+0x7c/3a0 (0xc33abc0c) [] icmp_reply_translation+0x6/1b0 (0xc33abc30) [] ipt_do_table+0x108/310 (0xc33abc40) [] ip_nat_rule_find+0x9e/b0 (0xc33abcac) [] ip_nat_rule_find+0x9e/b0 (0xc33abcd8) [] ip_nat_fn+0x10a/200 (0xc33abce4) [] ip_finish_output2+0x0/e0 (0xc33abd18) [] nf_iterate+0x58/90 (0xc33abd1c) [] ip_finish_output2+0x0/e0 (0xc33abd30) [] nf_hook_slow+0x65/150 (0xc33abd44) [] ip_finish_output2+0x0/e0 (0xc33abd60) [] ip_output+0x5e/70 (0xc33abd7c) [] ip_finish_output2+0x0/e0 (0xc33abd94) [] ip_queue_xmit2+0xc5/22c (0xc33abd9c) [] nf_hook_slow+0xa5/150 (0xc33abdb4) [] ip_queue_xmit+0x18e/2c0 (0xc33abdd0) [] ip_queue_xmit2+0x0/22c (0xc33abde8) [] tcp_v4_send_check+0x32/c0 (0xc33abdf8) [] tcp_transmit_skb+0x2b3/450 (0xc33abe24) [] tcp_connect+0x22d/280 (0xc33abe48) [] tcp_v4_connect+0x254/390 (0xc33abe60) [] kmem_cache_alloc+0xf/20 (0xc33abe78) [] tcp_bucket_create+0x17/50 (0xc33abe84) [] inet_stream_connect+0xf6/230 (0xc33abec8) [] sys_connect+0x56/80 (0xc33abee8) [] sock_map_file+0x9f/100 (0xc33abf28) [] inet_setsockopt+0x25/30 (0xc33abf40) [] sys_setsockopt+0x43/80 (0xc33abf58) [] sys_setsockopt+0x52/80 (0xc33abf6c) [] sys_socketcall+0x8b/1b0 (0xc33abf8c) [] system_call+0x33/40 (0xc33abfc0) Code: 66 39 42 24 74 1c 85 ff 75 07 a1 14 ce 30 c0 eb dd 31 c0 85 Crash 3 ============================================================== Unable to handle kernel paging request at virtual address 04000425 Oops: 0000 EIP:0010:[] at find_appropriate_src+0x42/a0 EFLAGS: 00010246 eax:e0810006 ebx:c543bf24 ecx:00000001 edx:04000401 esi:ccbebc1c edi:00000000 ebp:000005cf esp:ccbebb64 ds:0018 es:0018 ss:0018 Process vss_smtp_k (pid: 2904, stackpage=ccbeb000) Stack: ccbebcbc ccbebc1c 00000004 ccbebc7c c01fbedc ccbebc1c ccbebcbc c02b38c0 00000020 00000246 d00d7e00 c01b4eb8 00000004 c78cb010 00000001 00000004 e0933f7d df831800 00000001 00000000 00000001 0000003f df814050 c01f1478 Call Trace: [] get_unique_tuple+0x19c/210 (0xccbebb74) [] netif_rx+0x88/1c0 (0xccbebb90) [] speedo_rx+0xed/360 (0xccbebba4) [] invert_tuple+0x38/40 (0xccbebbc0) [] ip_nat_setup_info+0x4e/3b0 (0xccbebbd4) [] do_IRQ+0xb1/e0 (0xccbebc14) [] unix_stream_data_wait+0xb6/f0 (0xccbebc30) [] ipt_do_table+0x108/310 (0xccbebc40) [] ip_nat_rule_find+0x9e/b0 (0xccbebcac) [] ip_nat_rule_find+0x9e/b0 (0xccbebcd8) [] ip_nat_fn+0x10a/200 (0xccbebce4) [] ip_finish_output2+0x0/e0 (0xccbebd18) [] nf_iterate+0x58/90 (0xccbebd1c) [] ip_finish_output2+0x0/e0 (0xccbebd30) [] nf_hook_slow+0x65/150 (0xccbebd44) [] ip_finish_output2+0x0/e0 (0xccbebd60) [] ip_output+0x5e/70 (0xccbebd7c) [] ip_finish_output2+0x0/e0 (0xccbebd94) [] ip_queue_xmit2+0xc5/22c (0xccbebd9c) [] nf_hook_slow+0xa5/150 (0xccbebdb4) [] ip_queue_xmit+0x18e/2c0 (0xccbebdd0) [] ip_queue_xmit2+0x0/22c (0xccbebde8) [] tcp_v4_send_check+0x32/c0 (0xccbebdf8) [] tcp_transmit_skb+0x2b3/450 (0xccbebe24) [] tcp_connect+0x22d/280 (0xccbebe48) [] tcp_v4_connect+0x254/390 (0xccbebe60) [] kmem_cache_alloc+0xf/20 (0xccbebe78) [] tcp_bucket_create+0x17/50 (0xccbebe84) [] inet_stream_connect+0xf6/230 (0xccbebec8) [] sys_connect+0x56/80 (0xccbebee8) [] ip_rcv_finish+0x0/1f0 (0xccbebf28) [] inet_setsockopt+0x25/30 (0xccbebf40) [] sys_setsockopt+0x43/80 (0xccbebf58) [] sys_setsockopt+0x52/80 (0xccbebf6c) [] sys_socketcall+0x8b/1b0 (0xccbebf8c) [] system_call+0x33/40 (0xccbebfc0) Code: 66 39 42 24 74 1c 85 ff 75 07 a1 54 ee 31 c0 eb dd 31 c0 85 __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com