Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 18 Sep 2000 13:15:17 -0700
From:      Alfred Perlstein <bright@wintelcom.net>
To:        Fred Souza <cseg@kronus.com.br>
Cc:        Bosko Milekic <bmilekic@dsuper.net>, security@FreeBSD.ORG
Subject:   Re: Panic when receiving packets with invalid versions
Message-ID:  <20000918131517.I15156@fw.wintelcom.net>
In-Reply-To: <20000918171214.A269@torment.secfreak.com>; from cseg@kronus.com.br on Mon, Sep 18, 2000 at 05:12:14PM -0300
References:  <20000918115643.A470@torment.secfreak.com> <Pine.BSF.4.21.0009181259210.18305-100000@jehovah.technokratis.com> <20000918171214.A269@torment.secfreak.com>

next in thread | previous in thread | raw e-mail | index | archive | help
* Fred Souza <cseg@kronus.com.br> [000918 13:09] wrote:
> > 	Can you please send a complete traceback, as well as other (more
> >   useful) debugging information? -- See the Handbook for more information.
> >  	Looks like a NULL pointer dereference.
> 
>   Hi.  Thank you for the time, in advance.  I've read the Handbook as you
>   told me to, followed its steps (I ended up having to rebuild the kernel)
>   and generated the dump files, but I don't have enough knowledge to do
>   much from it.
> 
>   I just did exactly how it looked like in the Handbook, and it's almost the
>   same I posted before.  Anyways, here goes what I got from it.
> 
>   -----
> torment:ttyp1:/usr/src/sys/compile/TORMENT# gdb -k kernel.debug /var/crash/vmcore.0 
> GNU gdb 4.18
> Copyright 1998 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-unknown-freebsd"...
> IdlePTD 3293184
> initial pcb at 2aa060
> panicstr: page fault
> panic messages:
> ---
> Fatal trap 12: page fault while in kernel mode
> fault virtual address	= 0x0
> fault code		= supervisor read, page not present
> instruction pointer	= 0x8:0xc0190b43
> stack pointer	        = 0x10:0xc644dcc0
> frame pointer	        = 0x10:0xc644dcec
> code segment		= base 0x0, limit 0xfffff, type 0x1b
> 			= DPL 0, pres 1, def32 1, gran 1
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current process		= 246 (isic)
> interrupt mask		= 
> trap number		= 12
> panic: page fault
> 
> syncing disks... 27 27 13 2 
> done
> Uptime: 2m39s
> 
> dumping to dev #ad/0x40001, offset 139264
> dump ata0: resetting devices .. done
> 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 
> ---
> #0  0xc0133214 in boot ()
> (kgdb) where
> #0  0xc0133214 in boot ()
> #1  0xc0133598 in poweroff_wait ()
> #2  0xc0236e0d in trap_fatal ()
> #3  0xc0236ae5 in trap_pfault ()
> #4  0xc023669f in trap ()
> #5  0xc0190b43 in ip_natout ()
> #6  0xc018e012 in fr_check ()
> #7  0xc0183fd4 in ip_output ()
> #8  0xc018590b in rip_output ()
> #9  0xc0185d4f in rip_send ()
> #10 0xc014f44b in sosend ()
> #11 0xc0152a19 in sendit ()
> #12 0xc0152b0d in sendto ()
> #13 0xc02370b9 in syscall2 ()
> #14 0xc02294b5 in Xint0x80_syscall ()
> #15 0x8049235 in ?? ()
> #16 0x8048ad1 in ?? ()
> (kgdb) up 10
> #10 0xc014f44b in sosend ()
> (kgdb) up
> #11 0xc0152a19 in sendit ()
> (kgdb) up
> #12 0xc0152b0d in sendto ()
> (kgdb) up
> #13 0xc02370b9 in syscall2 ()
> (kgdb) up
> #14 0xc02294b5 in Xint0x80_syscall ()
> (kgdb) up
> #15 0x8049235 in ?? ()
> (kgdb) up
> #16 0x8048ad1 in ?? ()
> (kgdb) up
> Initial frame selected; you cannot go up.
> (kgdb) list
> 1	/*-
> 2	 * Copyright (c) 2000 FreeBSD Inc.
> 3	 * All rights reserved.
> 4	 *
> 5	 * Redistribution and use in source and binary forms, with or without
> 6	 * modification, are permitted provided that the following conditions
> 7	 * are met:
> 8	 * 1. Redistributions of source code must retain the above copyright
> 9	 *    notice, this list of conditions and the following disclaimer.
> 10	 * 2. Redistributions in binary form must reproduce the above copyright
> (kgdb) quit
> torment:ttyp1:/usr/src/sys/compile/TORMENT# exit
> exit
>   -----
> 
>   Is it helpful by any chances?  If anybody knows what I should be looking for
>   exactly, please tell me and I'll look for it.

So close! :)

You don't want to do 'up 10' you want to go 'up' until you hit the
frame above 'trap' which is 'ip_natout', that's where you want to
do your 'list' and 'print' of some of the variables that appear.

you may also want to printout several variables by prefixing * to
them to get the structure contents.

This looks like it may be a bug in ipfilter.

-Alfred


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000918131517.I15156>