2.6.13.4 kernel Oops - proc related

2.6.13.4 kernel Oops - proc related

[Jesper Juhl]

Hi everyone,

Yesterday one of my servers Oops'ed on me :-(
The server was running an old 2.6.13.4 kernel.
I got a screenshot of the Oops which is available here :
http://www.kernel.org/pub/linux/kernel/people/juhl/images/2.6.13.4-crash.png

Even though this is a rather old kernel, I wanted to report the crash
just in case it's not a known bug. If it is already known and fixed,
then just ignore this mail.

Userspace is also rather old (but the kernel was not build on this box
with that ancient compiler, it's just running here) :

# scripts/ver_linux
If some fields are empty or look unusual you may have an old version.
Compare to the current minimal requirements in Documentation/Changes.

Linux srv.mydomain.net 2.6.13.4 #1 SMP Wed Nov 16 11:13:51 CET 2005 i686 unknown

Gnu C                  2.96
Gnu make               3.79.1
binutils               2.11.93.0.2
util-linux             2.11n
mount                  2.11n
module-init-tools      3.0-pre1
e2fsprogs              1.27
reiserfsprogs          2001------------->
reiser4progs           fsck.reiser4:
quota-tools            3.06.
nfs-utils              1.0.5
Linux C Library        2.2.5
Dynamic linker (ldd)   2.2.5
Procps                 2.0.11
Net-tools              1.60
Console-tools          0.3.3
Sh-utils               2.0.11
Modules Loaded         iptable_nat


-- 
Jesper Juhl <jesper.juhl@gmail.com>
Don't top-post  http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please      http://www.expita.com/nomime.html

Re: 2.6.13.4 kernel Oops - proc related

[Alexey Dobriyan]

On Thu, Apr 12, 2007 at 10:01:07AM +0200, Jesper Juhl wrote:
> Yesterday one of my servers Oops'ed on me :-(
> The server was running an old 2.6.13.4 kernel.
> I got a screenshot of the Oops which is available here :
> http://www.kernel.org/pub/linux/kernel/people/juhl/images/2.6.13.4-crash.png
>
> Even though this is a rather old kernel, I wanted to report the crash
> just in case it's not a known bug. If it is already known and fixed,
> then just ignore this mail.

It seems task->signal->tty->driver pointer got borken. It's 0x03200005!

c0181920 <do_task_stat>:

c0181ad8:	call   c011d440 <next_thread>
c0181add:	cmp    %esi,%eax			# } while (t != task)
c0181adf:	jne    c0181ab0 <do_task_stat+0x190>
c0181ae1:	mov    0x460(%esi),%eax
c0181ae7:	add    $0x504,%eax
c0181aec:	call   c036f160 <_spin_unlock_irq>	# spin_unlock_irq(&task->sighand->siglock);
c0181af1:	mov    0x45c(%esi),%ecx
c0181af7:	test   %ecx,%ecx			# if (task->signal)
c0181af9:	je     c0181bc3 <do_task_stat+0x2a3>
c0181aff:	mov    0x88(%ecx),%ebx			# ebx = task->signal->tty
c0181b05:	test   %ebx,%ebx			# if (task->signal->tty)
c0181b07:	je     c0181b46 <do_task_stat+0x226>
c0181b09:	mov    0xb4(%ebx),%eax
c0181b0f:	mov    %eax,0x50(%esp,1)		# tty_pgrp = task->signal->tty->pgrp
c0181b13:	mov    0x4(%ebx),%eax			# eax = task->signal->tty->driver
c0181b16: ===>	mov    0x64(%eax),%edx			# task->signal->tty->driver->major
c0181b19:	mov    0x68(%eax),%ebp			# task->signal->tty->driver->minor_start
c0181b1c:	mov    0x8(%ebx),%eax			# task->signel->tty->index