From owner-freebsd-i386@FreeBSD.ORG Tue Nov 27 14:40:01 2007 Return-Path: Delivered-To: freebsd-i386@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 805BF16A4DD for ; Tue, 27 Nov 2007 14:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 5F11C13C43E for ; Tue, 27 Nov 2007 14:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id lAREe1wa011361 for ; Tue, 27 Nov 2007 14:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id lAREe18F011360; Tue, 27 Nov 2007 14:40:01 GMT (envelope-from gnats) Resent-Date: Tue, 27 Nov 2007 14:40:01 GMT Resent-Message-Id: <200711271440.lAREe18F011360@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-i386@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Vasanth Rao Naik Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8957316A419 for ; Tue, 27 Nov 2007 14:33:15 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 781E313C43E for ; Tue, 27 Nov 2007 14:33:15 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id lAREX9Wu003783 for ; Tue, 27 Nov 2007 14:33:09 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id lAREX9bI003782; Tue, 27 Nov 2007 14:33:09 GMT (envelope-from nobody) Message-Id: <200711271433.lAREX9bI003782@www.freebsd.org> Date: Tue, 27 Nov 2007 14:33:09 GMT From: Vasanth Rao Naik To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: i386/118285: Segmetation fault in reloc_non_plt. X-BeenThere: freebsd-i386@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: I386-specific issues for FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Nov 2007 14:40:01 -0000 >Number: 118285 >Category: i386 >Synopsis: Segmetation fault in reloc_non_plt. >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-i386 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Nov 27 14:40:00 UTC 2007 >Closed-Date: >Last-Modified: >Originator: Vasanth Rao Naik >Release: FreeBSD 4.11 >Organization: Juniper Networks India Pvt Ltd >Environment: FreeBSD bng-build22.juniper.net 4.11-RELEASE-p13 FreeBSD 4.11-RELEASE-p13 #2: Thu Jul 12 19:06:47 IST 2007 root@bng-build22.juniper.net:/usr/src/sys/compile/bng-build22 i386 >Description: In reloc_non_plt(), find_symdef() sometimes returns invalid value in def and a null in defobjout. This causes any binary to recieve a segmentation fault and cores. The kernel code where segmentation happens is In reloc_non_plt 189 case R_386_GLOB_DAT: 190 { 191 const Elf_Sym *def; 192 const Obj_Entry *defobj; 193 194 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, 195 false, cache); 196 if (def == NULL) 197 goto done; 198 199 *where = (Elf_Addr) (defobj->relocbase + def->st_value); [vasanth] this is the point where we access defobj (NULL) and causes segmentation fault. 200 } 201 break; I have recieved a core for rcp because of this issue. This issue was also been raised by someothers in the list. http://lists.freebsd.org/pipermail/freebsd-current/2004-February/021698.html The following kernel messages were thrown when problem happened Nov 12 21:16:50 marx1 login: LOGIN_INFORMATION: User regress logged in from host 192.168.64.68 on device ttyp0 Nov 12 21:16:50 marx1 su: regress to root on /dev/ttyp0 Nov 12 21:16:51 marx1 /kernel: BAD_PAGE_FAULT: pid 3484 (df), uid 0: pc 0x88100ea0 got a read fault at 0xc75aa65, x86 fault flags = 0x4 Nov 12 21:16:51 marx1 /kernel: Trapframe Register Dump: Nov 12 21:16:51 marx1 /kernel: eax: 88143000 ecx: 0c75aa65 edx: 00000005 ebx: 8810f574 Nov 12 21:16:51 marx1 /kernel: esp: bfbfe930 ebp: bfbfe958 esi: 00000005 edi: 0c75aa55 Nov 12 21:16:51 marx1 /kernel: eip: 88100ea0 eflags: 00010206 Nov 12 21:16:51 marx1 /kernel: cs: 001f ss: 002f ds: 002f es: 002f Nov 12 21:16:51 marx1 /kernel: fs: 002f trapno: 0000000c err: 00000004 Nov 12 21:16:51 marx1 /kernel: Page table info for PC address 0x88100ea0: PDE = 0xbb94067, PTE = 28aad425 Nov 12 21:16:51 marx1 /kernel: Dumping 16 bytes starting at PC address 0x88100ea0: Nov 12 21:16:51 marx1 /kernel: 83 7f 10 00 75 08 83 c1 04 83 39 00 74 f8 ba 01 >How-To-Repeat: This problem is not always reproducible. >Fix: Please provide the Fix for this issue. >Release-Note: >Audit-Trail: >Unformatted: