[grsec] oops: grsec bug or breakin attempt?

Marc Schiffbauer marc at schiffbauer.net
Sat Mar 8 12:07:38 EST 2008


Hi all,

on one of my servers had two strange oopses last night after 144 days of
uptime.

Any hints somebody of what might have been going on there? 

The first oops (03:20) happened when the backup was running
(includes a sshfs fuse mount)

I never had any oops or something with this (yes exploitable and
must-be-updated ASAP) kernel.

TIA
-Marc
-- 
8AAC 5F46 83B4 DB70 8317  3723 296C 6CCA 35A6 4134
-------------- next part --------------
ksymoops 2.4.9 on i686 2.6.17.7-grsec.  Options used
     -V (default)
     -k /proc/ksyms (default)
     -l /proc/modules (default)
     -o /lib/modules/2.6.17.7-grsec/ (default)
     -m /boot/System.map-2.6.17.7-grsec (specified)

Error (regular_file): read_ksyms stat /proc/ksyms failed
No modules in ksyms, skipping objects
No ksyms, skipping lsmod
Mar  8 03:20:10 pluto kernel: CPU:    0
Mar  8 03:20:10 pluto kernel: EIP:    0060:[max_sane_readahead+2/74]    Not tainted VLI
Mar  8 03:20:10 pluto kernel: EFLAGS: 00010206   (2.6.17.7-grsec #1) 
Mar  8 03:20:10 pluto kernel: eax: 35376231   ebx: e97403b4   ecx: 64323866   edx: d23d8bb4
Mar  8 03:20:10 pluto kernel: esi: 000147f5   edi: 00000000   ebp: ed18f8c0   esp: e5319e30
Mar  8 03:20:10 pluto kernel: ds: 0068   es: 0068   ss: 0068
Mar  8 03:20:10 pluto kernel: Stack: 35376231 00000004 e5319e48 c0c05fa0 f0b83b74 00000000 e97403b4 ed18f8c0 
Mar  8 03:20:10 pluto kernel:        00035017 e97403b4 ed18f8c0 00000000 000147f5 00000000 00000003 00000001 
Mar  8 03:20:10 pluto kernel:        e9740318 ed18f904 f0b83b74 e5319eac 00000000 d9d7c570 00040f17 d9d7c570 
Mar  8 03:20:10 pluto kernel: Call Trace:
Mar  8 03:20:10 pluto kernel:  <00035017>   <000147f5> 
Mar  8 03:20:10 pluto kernel:  <00040f17>   <00001000> 
Mar  8 03:20:10 pluto kernel:  <0004127c>   <00012cc3> 
Mar  8 03:20:10 pluto kernel:  <00030002>   <00012a6b> 
Mar  8 03:20:10 pluto kernel:  <00004d3f>   <00010246> 
Mar  8 03:20:10 pluto kernel: Code: 1c fe ff ff b8 ff ff ff ff 8b 5c 24 10 8b 74 24 14 8b 7c 24 18 8b 6c 24 1c 83 c4 20 c3 c7 44 24 04 04 00 00 00 8b 42 10 89 04 24 <ff> 52 0c eb a8 83 ec 1c 8b 44 24 34 89 5c 24 10 89 74 24 14 85 
Using defaults from ksymoops -t elf32-i386 -a i386


>>eax; 35376231 <phys_startup_32+34f75231/bfd00000>
>>ebx; e97403b4 <pg0+28ab93b4/3f087000>
>>ecx; 64323866 <phys_startup_32+63f22866/bfd00000>
>>edx; d23d8bb4 <pg0+11751bb4/3f087000>
>>esi; 000147f5 <aes_enc_blk+951/b88>
>>ebp; ed18f8c0 <pg0+2c5088c0/3f087000>
>>esp; e5319e30 <pg0+24692e30/3f087000>

Trace; 000147f5 <aes_enc_blk+951/b88>
Trace; 00040f17 <sys_mincore+e2/16a>
Trace; 00001000 <_stext+0/0>
Trace; 0004127c <do_mlock+80/112>
Trace; 00012cc3 <do_page_fault+2f4/8e7>
Trace; 00012a6b <do_page_fault+9c/8e7>
Trace; 00004d3f <error_code+5f/70>
Trace; 00010246 <ioapic_resume+104/15f>

Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
00000000 <_EIP>:
Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
   0:   1c fe                     sbb    $0xfe,%al
Code;  ffffffd7 <__kernel_rt_sigreturn+1b97/????>
   2:   ff                        (bad)  
Code;  ffffffd8 <__kernel_rt_sigreturn+1b98/????>
   3:   ff                        (bad)  
Code;  ffffffd9 <__kernel_rt_sigreturn+1b99/????>
   4:   b8 ff ff ff ff            mov    $0xffffffff,%eax
Code;  ffffffde <__kernel_rt_sigreturn+1b9e/????>
   9:   8b 5c 24 10               mov    0x10(%esp),%ebx
Code;  ffffffe2 <__kernel_rt_sigreturn+1ba2/????>
   d:   8b 74 24 14               mov    0x14(%esp),%esi
Code;  ffffffe6 <__kernel_rt_sigreturn+1ba6/????>
  11:   8b 7c 24 18               mov    0x18(%esp),%edi
Code;  ffffffea <__kernel_rt_sigreturn+1baa/????>
  15:   8b 6c 24 1c               mov    0x1c(%esp),%ebp
Code;  ffffffee <__kernel_rt_sigreturn+1bae/????>
  19:   83 c4 20                  add    $0x20,%esp
Code;  fffffff1 <__kernel_rt_sigreturn+1bb1/????>
  1c:   c3                        ret    
Code;  fffffff2 <__kernel_rt_sigreturn+1bb2/????>
  1d:   c7 44 24 04 04 00 00      movl   $0x4,0x4(%esp)
Code;  fffffff9 <__kernel_rt_sigreturn+1bb9/????>
  24:   00 
Code;  fffffffa <__kernel_rt_sigreturn+1bba/????>
  25:   8b 42 10                  mov    0x10(%edx),%eax
Code;  fffffffd <__kernel_rt_sigreturn+1bbd/????>
  28:   89 04 24                  mov    %eax,(%esp)
Code;  00000000 Before first symbol
  2b:   ff 52 0c                  call   *0xc(%edx)
Code;  00000003 Before first symbol
  2e:   eb a8                     jmp    ffffffd8 <_EIP+0xffffffd8>
Code;  00000005 Before first symbol
  30:   83 ec 1c                  sub    $0x1c,%esp
Code;  00000008 Before first symbol
  33:   8b 44 24 34               mov    0x34(%esp),%eax
Code;  0000000c Before first symbol
  37:   89 5c 24 10               mov    %ebx,0x10(%esp)
Code;  00000010 Before first symbol
  3b:   89 74 24 14               mov    %esi,0x14(%esp)
Code;  00000014 Before first symbol
  3f:   85                        .byte 0x85

Mar  8 03:20:10 pluto kernel: EIP: [max_sane_readahead+2/74]  SS:ESP 0068:e5319e30
Mar  8 03:44:27 pluto kernel: CPU:    0
Mar  8 03:44:27 pluto kernel: EIP:    0060:[_text+2/4096]    Not tainted VLI
Mar  8 03:44:27 pluto kernel: EFLAGS: 00000202   (2.6.17.7-grsec #1) 
Mar  8 03:44:27 pluto kernel: eax: 00000405   ebx: e97403b4   ecx: 00000001   edx: d23d8bb4
Mar  8 03:44:27 pluto kernel: esi: 0001c8ae   edi: 00000000   ebp: e3409c00   esp: f4a03e14
Mar  8 03:44:27 pluto kernel: ds: 0068   es: 0068   ss: 0068
Mar  8 03:44:27 pluto kernel: Stack: 0003a74f 00000405 00000004 f4a03e30 c0c05fa0 de422b74 00000000 e97403b4 
Mar  8 03:44:27 pluto kernel:        e3409c00 00035017 e97403b4 e3409c00 00000000 0001c8ae 00000000 00000003 
Mar  8 03:44:27 pluto kernel:        00000001 e9740318 e3409c44 de422b74 f4a03e94 00000000 d8b02628 00040f17 
Mar  8 03:44:27 pluto kernel: Call Trace:
Mar  8 03:44:27 pluto kernel:  <0003a74f>   <00035017> 
Mar  8 03:44:27 pluto kernel:  <0001c8ae>   <00040f17> 
Mar  8 03:44:27 pluto kernel:  <0003d351>   <0004127c> 
Mar  8 03:44:27 pluto kernel:  <00012cc3>   <00030002> 
Mar  8 03:44:27 pluto kernel:  <00042dd7>   <00012a6b> 
Mar  8 03:44:27 pluto kernel:  <00004d3f>   <00010246> 
Mar  8 03:44:27 pluto kernel:  <00003c8f>  
Mar  8 03:44:27 pluto kernel: Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 


>>ebx; e97403b4 <pg0+28ab93b4/3f087000>
>>edx; d23d8bb4 <pg0+11751bb4/3f087000>
>>esi; 0001c8ae <exit_fs+55/ad>
>>ebp; e3409c00 <pg0+22782c00/3f087000>
>>esp; f4a03e14 <pg0+33d7ce14/3f087000>

Trace; 0003a74f <max_sane_readahead+5/4a>
Trace; 00035017 <filemap_populate+88/14a>
Trace; 0001c8ae <exit_fs+55/ad>
Trace; 00040f17 <sys_mincore+e2/16a>
Trace; 0003d351 <zap_pte+91/b7>
Trace; 0004127c <do_mlock+80/112>
Trace; 00012cc3 <do_page_fault+2f4/8e7>
Trace; 00030002 <handle_futex_death+2e/82>
Trace; 00042dd7 <__do_mmap_pgoff+841/a2f>
Trace; 00012a6b <do_page_fault+9c/8e7>
Trace; 00004d3f <error_code+5f/70>
Trace; 00010246 <ioapic_resume+104/15f>
Trace; 00003c8f <restore_all+0/18>

Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
00000000 <_EIP>:
Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
   0:   cc                        int3   
Code;  ffffffd6 <__kernel_rt_sigreturn+1b96/????>
   1:   cc                        int3   
Code;  ffffffd7 <__kernel_rt_sigreturn+1b97/????>
   2:   cc                        int3   
Code;  ffffffd8 <__kernel_rt_sigreturn+1b98/????>
   3:   cc                        int3   
Code;  ffffffd9 <__kernel_rt_sigreturn+1b99/????>
   4:   cc                        int3   
Code;  ffffffda <__kernel_rt_sigreturn+1b9a/????>
   5:   cc                        int3   
Code;  ffffffdb <__kernel_rt_sigreturn+1b9b/????>
   6:   cc                        int3   
Code;  ffffffdc <__kernel_rt_sigreturn+1b9c/????>
   7:   cc                        int3   
Code;  ffffffdd <__kernel_rt_sigreturn+1b9d/????>
   8:   cc                        int3   
Code;  ffffffde <__kernel_rt_sigreturn+1b9e/????>
   9:   cc                        int3   
Code;  ffffffdf <__kernel_rt_sigreturn+1b9f/????>
   a:   cc                        int3   
Code;  ffffffe0 <__kernel_rt_sigreturn+1ba0/????>
   b:   cc                        int3   
Code;  ffffffe1 <__kernel_rt_sigreturn+1ba1/????>
   c:   cc                        int3   
Code;  ffffffe2 <__kernel_rt_sigreturn+1ba2/????>
   d:   cc                        int3   
Code;  ffffffe3 <__kernel_rt_sigreturn+1ba3/????>
   e:   cc                        int3   
Code;  ffffffe4 <__kernel_rt_sigreturn+1ba4/????>
   f:   cc                        int3   
Code;  ffffffe5 <__kernel_rt_sigreturn+1ba5/????>
  10:   cc                        int3   
Code;  ffffffe6 <__kernel_rt_sigreturn+1ba6/????>
  11:   cc                        int3   
Code;  ffffffe7 <__kernel_rt_sigreturn+1ba7/????>
  12:   cc                        int3   
Code;  ffffffe8 <__kernel_rt_sigreturn+1ba8/????>
  13:   cc                        int3   
Code;  ffffffe9 <__kernel_rt_sigreturn+1ba9/????>
  14:   cc                        int3   
Code;  ffffffea <__kernel_rt_sigreturn+1baa/????>
  15:   cc                        int3   
Code;  ffffffeb <__kernel_rt_sigreturn+1bab/????>
  16:   cc                        int3   
Code;  ffffffec <__kernel_rt_sigreturn+1bac/????>
  17:   cc                        int3   
Code;  ffffffed <__kernel_rt_sigreturn+1bad/????>
  18:   cc                        int3   
Code;  ffffffee <__kernel_rt_sigreturn+1bae/????>
  19:   cc                        int3   
Code;  ffffffef <__kernel_rt_sigreturn+1baf/????>
  1a:   cc                        int3   
Code;  fffffff0 <__kernel_rt_sigreturn+1bb0/????>
  1b:   cc                        int3   
Code;  fffffff1 <__kernel_rt_sigreturn+1bb1/????>
  1c:   cc                        int3   
Code;  fffffff2 <__kernel_rt_sigreturn+1bb2/????>
  1d:   cc                        int3   
Code;  fffffff3 <__kernel_rt_sigreturn+1bb3/????>
  1e:   cc                        int3   
Code;  fffffff4 <__kernel_rt_sigreturn+1bb4/????>
  1f:   cc                        int3   
Code;  fffffff5 <__kernel_rt_sigreturn+1bb5/????>
  20:   cc                        int3   
Code;  fffffff6 <__kernel_rt_sigreturn+1bb6/????>
  21:   cc                        int3   
Code;  fffffff7 <__kernel_rt_sigreturn+1bb7/????>
  22:   cc                        int3   
Code;  fffffff8 <__kernel_rt_sigreturn+1bb8/????>
  23:   cc                        int3   
Code;  fffffff9 <__kernel_rt_sigreturn+1bb9/????>
  24:   cc                        int3   
Code;  fffffffa <__kernel_rt_sigreturn+1bba/????>
  25:   cc                        int3   
Code;  fffffffb <__kernel_rt_sigreturn+1bbb/????>
  26:   cc                        int3   
Code;  fffffffc <__kernel_rt_sigreturn+1bbc/????>
  27:   cc                        int3   
Code;  fffffffd <__kernel_rt_sigreturn+1bbd/????>
  28:   cc                        int3   
Code;  fffffffe <__kernel_rt_sigreturn+1bbe/????>
  29:   cc                        int3   
Code;  ffffffff <__kernel_rt_sigreturn+1bbf/????>
  2a:   cc                        int3   
Code;  00000000 Before first symbol
  2b:   cc                        int3   
Code;  00000001 Before first symbol
  2c:   cc                        int3   
Code;  00000002 Before first symbol
  2d:   cc                        int3   
Code;  00000003 Before first symbol
  2e:   cc                        int3   
Code;  00000004 Before first symbol
  2f:   cc                        int3   
Code;  00000005 Before first symbol
  30:   cc                        int3   
Code;  00000006 Before first symbol
  31:   cc                        int3   
Code;  00000007 Before first symbol
  32:   cc                        int3   
Code;  00000008 Before first symbol
  33:   cc                        int3   
Code;  00000009 Before first symbol
  34:   cc                        int3   
Code;  0000000a Before first symbol
  35:   cc                        int3   
Code;  0000000b Before first symbol
  36:   cc                        int3   
Code;  0000000c Before first symbol
  37:   cc                        int3   
Code;  0000000d Before first symbol
  38:   cc                        int3   
Code;  0000000e Before first symbol
  39:   cc                        int3   
Code;  0000000f Before first symbol
  3a:   cc                        int3   
Code;  00000010 Before first symbol
  3b:   cc                        int3   
Code;  00000011 Before first symbol
  3c:   cc                        int3   
Code;  00000012 Before first symbol
  3d:   cc                        int3   
Code;  00000013 Before first symbol
  3e:   cc                        int3   
Code;  00000014 Before first symbol
  3f:   cc                        int3   

Mar  8 03:44:27 pluto kernel: EIP: [_text+2/4096]  SS:ESP 0068:f4a03e14
Mar  8 05:40:02 pluto kernel: CPU:    0
Mar  8 05:40:02 pluto kernel: EIP:    0060:[_text+2/4096]    Not tainted VLI
Mar  8 05:40:02 pluto kernel: EFLAGS: 00000202   (2.6.17.7-grsec #1) 
Mar  8 05:40:02 pluto kernel: eax: 00000405   ebx: e97403b4   ecx: 00000001   edx: d23d8bb4
Mar  8 05:40:02 pluto kernel: esi: 000214d0   edi: 00000000   ebp: e43f4180   esp: d350de4c
Mar  8 05:40:02 pluto kernel: ds: 0068   es: 0068   ss: 0068
Mar  8 05:40:02 pluto kernel: Stack: 0003a74f 00000405 00000004 d350de68 c0c05fa0 d7b5ab74 00000000 e97403b4 
Mar  8 05:40:02 pluto kernel:        e43f4180 00035017 e97403b4 e43f4180 00000000 000214d0 e97403c8 00000003 
Mar  8 05:40:02 pluto kernel:        00000001 e9740318 e43f41c4 d7b5ab74 d350decc 00000000 eb8cb6e0 00040f17 
Mar  8 05:40:03 pluto kernel: Call Trace:
Mar  8 05:40:03 pluto kernel:  <0003a74f>   <00035017> 
Mar  8 05:40:03 pluto kernel:  <000214d0>   <00040f17> 
Mar  8 05:40:03 pluto kernel:  <0004127c>   <00012cc3> 
Mar  8 05:40:03 pluto kernel:  <00030002>   <00012a6b> 
Mar  8 05:40:03 pluto kernel:  <00004d3f>   <00010246> 
Mar  8 05:40:03 pluto kernel: Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 


>>ebx; e97403b4 <pg0+28ab93b4/3f087000>
>>edx; d23d8bb4 <pg0+11751bb4/3f087000>
>>esi; 000214d0 <do_proc_doulongvec_minmax+22f/347>
>>ebp; e43f4180 <pg0+2376d180/3f087000>
>>esp; d350de4c <pg0+12886e4c/3f087000>

Trace; 0003a74f <max_sane_readahead+5/4a>
Trace; 00035017 <filemap_populate+88/14a>
Trace; 000214d0 <do_proc_doulongvec_minmax+22f/347>
Trace; 00040f17 <sys_mincore+e2/16a>
Trace; 0004127c <do_mlock+80/112>
Trace; 00012cc3 <do_page_fault+2f4/8e7>
Trace; 00012a6b <do_page_fault+9c/8e7>
Trace; 00004d3f <error_code+5f/70>
Trace; 00010246 <ioapic_resume+104/15f>

Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
00000000 <_EIP>:
Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
   0:   cc                        int3   
Code;  ffffffd6 <__kernel_rt_sigreturn+1b96/????>
   1:   cc                        int3   
Code;  ffffffd7 <__kernel_rt_sigreturn+1b97/????>
   2:   cc                        int3   
Code;  ffffffd8 <__kernel_rt_sigreturn+1b98/????>
   3:   cc                        int3   
Code;  ffffffd9 <__kernel_rt_sigreturn+1b99/????>
   4:   cc                        int3   
Code;  ffffffda <__kernel_rt_sigreturn+1b9a/????>
   5:   cc                        int3   
Code;  ffffffdb <__kernel_rt_sigreturn+1b9b/????>
   6:   cc                        int3   
Code;  ffffffdc <__kernel_rt_sigreturn+1b9c/????>
   7:   cc                        int3   
Code;  ffffffdd <__kernel_rt_sigreturn+1b9d/????>
   8:   cc                        int3   
Code;  ffffffde <__kernel_rt_sigreturn+1b9e/????>
   9:   cc                        int3   
Code;  ffffffdf <__kernel_rt_sigreturn+1b9f/????>
   a:   cc                        int3   
Code;  ffffffe0 <__kernel_rt_sigreturn+1ba0/????>
   b:   cc                        int3   
Code;  ffffffe1 <__kernel_rt_sigreturn+1ba1/????>
   c:   cc                        int3   
Code;  ffffffe2 <__kernel_rt_sigreturn+1ba2/????>
   d:   cc                        int3   
Code;  ffffffe3 <__kernel_rt_sigreturn+1ba3/????>
   e:   cc                        int3   
Code;  ffffffe4 <__kernel_rt_sigreturn+1ba4/????>
   f:   cc                        int3   
Code;  ffffffe5 <__kernel_rt_sigreturn+1ba5/????>
  10:   cc                        int3   
Code;  ffffffe6 <__kernel_rt_sigreturn+1ba6/????>
  11:   cc                        int3   
Code;  ffffffe7 <__kernel_rt_sigreturn+1ba7/????>
  12:   cc                        int3   
Code;  ffffffe8 <__kernel_rt_sigreturn+1ba8/????>
  13:   cc                        int3   
Code;  ffffffe9 <__kernel_rt_sigreturn+1ba9/????>
  14:   cc                        int3   
Code;  ffffffea <__kernel_rt_sigreturn+1baa/????>
  15:   cc                        int3   
Code;  ffffffeb <__kernel_rt_sigreturn+1bab/????>
  16:   cc                        int3   
Code;  ffffffec <__kernel_rt_sigreturn+1bac/????>
  17:   cc                        int3   
Code;  ffffffed <__kernel_rt_sigreturn+1bad/????>
  18:   cc                        int3   
Code;  ffffffee <__kernel_rt_sigreturn+1bae/????>
  19:   cc                        int3   
Code;  ffffffef <__kernel_rt_sigreturn+1baf/????>
  1a:   cc                        int3   
Code;  fffffff0 <__kernel_rt_sigreturn+1bb0/????>
  1b:   cc                        int3   
Code;  fffffff1 <__kernel_rt_sigreturn+1bb1/????>
  1c:   cc                        int3   
Code;  fffffff2 <__kernel_rt_sigreturn+1bb2/????>
  1d:   cc                        int3   
Code;  fffffff3 <__kernel_rt_sigreturn+1bb3/????>
  1e:   cc                        int3   
Code;  fffffff4 <__kernel_rt_sigreturn+1bb4/????>
  1f:   cc                        int3   
Code;  fffffff5 <__kernel_rt_sigreturn+1bb5/????>
  20:   cc                        int3   
Code;  fffffff6 <__kernel_rt_sigreturn+1bb6/????>
  21:   cc                        int3   
Code;  fffffff7 <__kernel_rt_sigreturn+1bb7/????>
  22:   cc                        int3   
Code;  fffffff8 <__kernel_rt_sigreturn+1bb8/????>
  23:   cc                        int3   
Code;  fffffff9 <__kernel_rt_sigreturn+1bb9/????>
  24:   cc                        int3   
Code;  fffffffa <__kernel_rt_sigreturn+1bba/????>
  25:   cc                        int3   
Code;  fffffffb <__kernel_rt_sigreturn+1bbb/????>
  26:   cc                        int3   
Code;  fffffffc <__kernel_rt_sigreturn+1bbc/????>
  27:   cc                        int3   
Code;  fffffffd <__kernel_rt_sigreturn+1bbd/????>
  28:   cc                        int3   
Code;  fffffffe <__kernel_rt_sigreturn+1bbe/????>
  29:   cc                        int3   
Code;  ffffffff <__kernel_rt_sigreturn+1bbf/????>
  2a:   cc                        int3   
Code;  00000000 Before first symbol
  2b:   cc                        int3   
Code;  00000001 Before first symbol
  2c:   cc                        int3   
Code;  00000002 Before first symbol
  2d:   cc                        int3   
Code;  00000003 Before first symbol
  2e:   cc                        int3   
Code;  00000004 Before first symbol
  2f:   cc                        int3   
Code;  00000005 Before first symbol
  30:   cc                        int3   
Code;  00000006 Before first symbol
  31:   cc                        int3   
Code;  00000007 Before first symbol
  32:   cc                        int3   
Code;  00000008 Before first symbol
  33:   cc                        int3   
Code;  00000009 Before first symbol
  34:   cc                        int3   
Code;  0000000a Before first symbol
  35:   cc                        int3   
Code;  0000000b Before first symbol
  36:   cc                        int3   
Code;  0000000c Before first symbol
  37:   cc                        int3   
Code;  0000000d Before first symbol
  38:   cc                        int3   
Code;  0000000e Before first symbol
  39:   cc                        int3   
Code;  0000000f Before first symbol
  3a:   cc                        int3   
Code;  00000010 Before first symbol
  3b:   cc                        int3   
Code;  00000011 Before first symbol
  3c:   cc                        int3   
Code;  00000012 Before first symbol
  3d:   cc                        int3   
Code;  00000013 Before first symbol
  3e:   cc                        int3   
Code;  00000014 Before first symbol
  3f:   cc                        int3   

Mar  8 05:40:03 pluto kernel: EIP: [_text+2/4096]  SS:ESP 0068:d350de4c
Mar  8 05:53:41 pluto kernel: CPU:    0
Mar  8 05:53:41 pluto kernel: EIP:    0060:[_text+2/4096]    Not tainted VLI
Mar  8 05:53:41 pluto kernel: EFLAGS: 00000202   (2.6.17.7-grsec #1) 
Mar  8 05:53:41 pluto kernel: eax: 00000405   ebx: e97403b4   ecx: 00000001   edx: d23d8bb4
Mar  8 05:53:41 pluto kernel: esi: 0002055f   edi: 00000000   ebp: db5fb0c0   esp: e0e87e54
Mar  8 05:53:41 pluto kernel: ds: 0068   es: 0068   ss: 0068
Mar  8 05:53:41 pluto kernel: Stack: 0003a74f 00000405 00000004 e0e87e70 c0c05fa0 ec200b74 00000000 e97403b4 
Mar  8 05:53:41 pluto kernel:        db5fb0c0 00035017 e97403b4 db5fb0c0 00000000 0002055f f687617c 00000003 
Mar  8 05:53:41 pluto kernel:        00000001 e9740318 db5fb104 ec200b74 e0e87ed4 00000000 f687617c 00040f17 
Mar  8 05:53:41 pluto kernel: Call Trace:
Mar  8 05:53:41 pluto kernel:  <0003a74f>   <00035017> 
Mar  8 05:53:41 pluto kernel:  <0002055f>   <00040f17> 
Mar  8 05:53:41 pluto kernel:  <0004127c>   <00012cc3> 
Mar  8 05:53:41 pluto kernel:  <00042dd7>   <00030002> 
Mar  8 05:53:41 pluto kernel:  <00012a6b>   <00004d3f> 
Mar  8 05:53:41 pluto kernel: Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 


>>ebx; e97403b4 <pg0+28ab93b4/3f087000>
>>edx; d23d8bb4 <pg0+11751bb4/3f087000>
>>esi; 0002055f <do_sysctl_strategy+c7/1bc>
>>ebp; db5fb0c0 <pg0+1a9740c0/3f087000>
>>esp; e0e87e54 <pg0+20200e54/3f087000>

Trace; 0003a74f <max_sane_readahead+5/4a>
Trace; 00035017 <filemap_populate+88/14a>
Trace; 0002055f <do_sysctl_strategy+c7/1bc>
Trace; 00040f17 <sys_mincore+e2/16a>
Trace; 0004127c <do_mlock+80/112>
Trace; 00012cc3 <do_page_fault+2f4/8e7>
Trace; 00042dd7 <__do_mmap_pgoff+841/a2f>
Trace; 00030002 <handle_futex_death+2e/82>
Trace; 00012a6b <do_page_fault+9c/8e7>
Trace; 00004d3f <error_code+5f/70>

Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
00000000 <_EIP>:
Code;  ffffffd5 <__kernel_rt_sigreturn+1b95/????>
   0:   cc                        int3   
Code;  ffffffd6 <__kernel_rt_sigreturn+1b96/????>
   1:   cc                        int3   
Code;  ffffffd7 <__kernel_rt_sigreturn+1b97/????>
   2:   cc                        int3   
Code;  ffffffd8 <__kernel_rt_sigreturn+1b98/????>
   3:   cc                        int3   
Code;  ffffffd9 <__kernel_rt_sigreturn+1b99/????>
   4:   cc                        int3   
Code;  ffffffda <__kernel_rt_sigreturn+1b9a/????>
   5:   cc                        int3   
Code;  ffffffdb <__kernel_rt_sigreturn+1b9b/????>
   6:   cc                        int3   
Code;  ffffffdc <__kernel_rt_sigreturn+1b9c/????>
   7:   cc                        int3   
Code;  ffffffdd <__kernel_rt_sigreturn+1b9d/????>
   8:   cc                        int3   
Code;  ffffffde <__kernel_rt_sigreturn+1b9e/????>
   9:   cc                        int3   
Code;  ffffffdf <__kernel_rt_sigreturn+1b9f/????>
   a:   cc                        int3   
Code;  ffffffe0 <__kernel_rt_sigreturn+1ba0/????>
   b:   cc                        int3   
Code;  ffffffe1 <__kernel_rt_sigreturn+1ba1/????>
   c:   cc                        int3   
Code;  ffffffe2 <__kernel_rt_sigreturn+1ba2/????>
   d:   cc                        int3   
Code;  ffffffe3 <__kernel_rt_sigreturn+1ba3/????>
   e:   cc                        int3   
Code;  ffffffe4 <__kernel_rt_sigreturn+1ba4/????>
   f:   cc                        int3   
Code;  ffffffe5 <__kernel_rt_sigreturn+1ba5/????>
  10:   cc                        int3   
Code;  ffffffe6 <__kernel_rt_sigreturn+1ba6/????>
  11:   cc                        int3   
Code;  ffffffe7 <__kernel_rt_sigreturn+1ba7/????>
  12:   cc                        int3   
Code;  ffffffe8 <__kernel_rt_sigreturn+1ba8/????>
  13:   cc                        int3   
Code;  ffffffe9 <__kernel_rt_sigreturn+1ba9/????>
  14:   cc                        int3   
Code;  ffffffea <__kernel_rt_sigreturn+1baa/????>
  15:   cc                        int3   
Code;  ffffffeb <__kernel_rt_sigreturn+1bab/????>
  16:   cc                        int3   
Code;  ffffffec <__kernel_rt_sigreturn+1bac/????>
  17:   cc                        int3   
Code;  ffffffed <__kernel_rt_sigreturn+1bad/????>
  18:   cc                        int3   
Code;  ffffffee <__kernel_rt_sigreturn+1bae/????>
  19:   cc                        int3   
Code;  ffffffef <__kernel_rt_sigreturn+1baf/????>
  1a:   cc                        int3   
Code;  fffffff0 <__kernel_rt_sigreturn+1bb0/????>
  1b:   cc                        int3   
Code;  fffffff1 <__kernel_rt_sigreturn+1bb1/????>
  1c:   cc                        int3   
Code;  fffffff2 <__kernel_rt_sigreturn+1bb2/????>
  1d:   cc                        int3   
Code;  fffffff3 <__kernel_rt_sigreturn+1bb3/????>
  1e:   cc                        int3   
Code;  fffffff4 <__kernel_rt_sigreturn+1bb4/????>
  1f:   cc                        int3   
Code;  fffffff5 <__kernel_rt_sigreturn+1bb5/????>
  20:   cc                        int3   
Code;  fffffff6 <__kernel_rt_sigreturn+1bb6/????>
  21:   cc                        int3   
Code;  fffffff7 <__kernel_rt_sigreturn+1bb7/????>
  22:   cc                        int3   
Code;  fffffff8 <__kernel_rt_sigreturn+1bb8/????>
  23:   cc                        int3   
Code;  fffffff9 <__kernel_rt_sigreturn+1bb9/????>
  24:   cc                        int3   
Code;  fffffffa <__kernel_rt_sigreturn+1bba/????>
  25:   cc                        int3   
Code;  fffffffb <__kernel_rt_sigreturn+1bbb/????>
  26:   cc                        int3   
Code;  fffffffc <__kernel_rt_sigreturn+1bbc/????>
  27:   cc                        int3   
Code;  fffffffd <__kernel_rt_sigreturn+1bbd/????>
  28:   cc                        int3   
Code;  fffffffe <__kernel_rt_sigreturn+1bbe/????>
  29:   cc                        int3   
Code;  ffffffff <__kernel_rt_sigreturn+1bbf/????>
  2a:   cc                        int3   
Code;  00000000 Before first symbol
  2b:   cc                        int3   
Code;  00000001 Before first symbol
  2c:   cc                        int3   
Code;  00000002 Before first symbol
  2d:   cc                        int3   
Code;  00000003 Before first symbol
  2e:   cc                        int3   
Code;  00000004 Before first symbol
  2f:   cc                        int3   
Code;  00000005 Before first symbol
  30:   cc                        int3   
Code;  00000006 Before first symbol
  31:   cc                        int3   
Code;  00000007 Before first symbol
  32:   cc                        int3   
Code;  00000008 Before first symbol
  33:   cc                        int3   
Code;  00000009 Before first symbol
  34:   cc                        int3   
Code;  0000000a Before first symbol
  35:   cc                        int3   
Code;  0000000b Before first symbol
  36:   cc                        int3   
Code;  0000000c Before first symbol
  37:   cc                        int3   
Code;  0000000d Before first symbol
  38:   cc                        int3   
Code;  0000000e Before first symbol
  39:   cc                        int3   
Code;  0000000f Before first symbol
  3a:   cc                        int3   
Code;  00000010 Before first symbol
  3b:   cc                        int3   
Code;  00000011 Before first symbol
  3c:   cc                        int3   
Code;  00000012 Before first symbol
  3d:   cc                        int3   
Code;  00000013 Before first symbol
  3e:   cc                        int3   
Code;  00000014 Before first symbol
  3f:   cc                        int3   

Mar  8 05:53:41 pluto kernel: EIP: [_text+2/4096]  SS:ESP 0068:e0e87e54

1 error issued.  Results may not be reliable.


More information about the grsecurity mailing list