grsecurity forums

Posted: **Mon Oct 11, 2010 7:46 am**

Hello,

Got a refcount overflow this night. Any ideas why could it happen?

Kernel: Gentoo 2.6.34-hardened-r6

Log:

Code: Select all: Oct 11 06:48:44 kirServ kernel: [798218.028912] PAX: From 87.98.164.164: refcount overflow detected in: named:6452, uid/euid: 40/40 Oct 11 06:48:44 kirServ kernel: [798218.028916] CPU 0 Oct 11 06:48:44 kirServ kernel: [798218.028918] Modules linked in: ath5k skge mac80211 ath button cfg80211 Oct 11 06:48:44 kirServ kernel: [798218.028925] Oct 11 06:48:44 kirServ kernel: [798218.028928] Pid: 6452, comm: named Not tainted 2.6.34-hardened-r6kirServ #4 P5B/System Product Name Oct 11 06:48:44 kirServ kernel: [798218.028931] RIP: 0010:[<ffffffff813dabc7>] [<ffffffff813dabc7>] Oct 11 06:48:44 kirServ kernel: [798218.028935] RSP: 0018:ffff88007ea95a38 EFLAGS: 00000a96 Oct 11 06:48:44 kirServ kernel: [798218.028937] RAX: 0000000000000001 RBX: ffff88005c741e00 RCX: ffff880048235a74 Oct 11 06:48:44 kirServ kernel: [798218.028940] RDX: 000000007fffffff RSI: ffff88005c741e00 RDI: ffff880074d58010 Oct 11 06:48:44 kirServ kernel: [798218.028942] RBP: ffff88007ea95a58 R08: ffff88007d4f40d0 R09: 00000000000000c0 Oct 11 06:48:44 kirServ kernel: [798218.028945] R10: 0000026135f810c2 R11: 000000000100007f R12: 0000000000000000 Oct 11 06:48:44 kirServ kernel: [798218.028947] R13: ffff880074d58010 R14: ffff88005c741e00 R15: 0000000000000000 Oct 11 06:48:44 kirServ kernel: [798218.028950] FS: 0000026135f84710(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000 Oct 11 06:48:44 kirServ kernel: [798218.028953] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 11 06:48:44 kirServ kernel: [798218.028955] CR2: ffffffffff600400 CR3: 0000000001817000 CR4: 00000000000006f0 Oct 11 06:48:44 kirServ kernel: [798218.028958] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Oct 11 06:48:44 kirServ kernel: [798218.028960] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Oct 11 06:48:44 kirServ kernel: [798218.028963] Process named (pid: 6452, threadinfo ffff88007ea94000, task ffff88007ece1a00) Oct 11 06:48:44 kirServ kernel: [798218.028965] Stack: Oct 11 06:48:44 kirServ kernel: [798218.028974] ffff88007ea95ae8 ffff88005c723b00 ffff880074d58010 ffff88007d4f4000 Oct 11 06:48:44 kirServ kernel: [798218.028977] <0> ffff88007ea95a98 ffffffff813e381e 40ff0000813e2970 ffff88005c723b00 Oct 11 06:48:44 kirServ kernel: [798218.028982] <0> ffff880074d58024 000000000000006b ffff88007d4f4000 000000000100007f Oct 11 06:48:44 kirServ kernel: [798218.028986] Call Trace: Oct 11 06:48:44 kirServ kernel: [798218.028995] [<ffffffff813e381e>] Oct 11 06:48:44 kirServ kernel: [798218.028998] [<ffffffff81405caf>] Oct 11 06:48:44 kirServ kernel: [798218.029000] [<ffffffff81406ca9>] Oct 11 06:48:44 kirServ kernel: [798218.029002] [<ffffffff811887d7>] ? Oct 11 06:48:44 kirServ kernel: [798218.029004] [<ffffffff8140e4a5>] Oct 11 06:48:44 kirServ kernel: [798218.029007] [<ffffffff8138ce8c>] Oct 11 06:48:44 kirServ kernel: [798218.029009] [<ffffffff810c327b>] ? Oct 11 06:48:44 kirServ kernel: [798218.029011] [<ffffffff8138ae45>] ? Oct 11 06:48:44 kirServ kernel: [798218.029013] [<ffffffff813993a5>] ? Oct 11 06:48:44 kirServ kernel: [798218.029015] [<ffffffff8138d84d>] Oct 11 06:48:44 kirServ kernel: [798218.029018] [<ffffffff810cf9eb>] ? Oct 11 06:48:44 kirServ kernel: [798218.029020] [<ffffffff81002f0b>] Oct 11 06:48:44 kirServ kernel: [798218.029022] Code: d4 48 85 f6 0f 84 95 00 00 00 48 8b 96 40 01 00 00 48 85 d2 74 36 41 8d 44 24 01 48 8d 4a 34 89 c2 f0 0f c1 11 71 04 89 11 cd 04 <01> c2 66 29 c2 66 c1 c2 08 66 41 89 55 04 48 8b 5d e8 4c 8b 65 Oct 11 06:48:44 kirServ kernel: [798218.029201] Call Trace: Oct 11 06:48:44 kirServ kernel: [798218.029203] [<ffffffff813e381e>] Oct 11 06:48:44 kirServ kernel: [798218.029206] [<ffffffff81405caf>] Oct 11 06:48:44 kirServ kernel: [798218.029208] [<ffffffff81406ca9>] Oct 11 06:48:44 kirServ kernel: [798218.029210] [<ffffffff811887d7>] ? Oct 11 06:48:44 kirServ kernel: [798218.029212] [<ffffffff8140e4a5>] Oct 11 06:48:44 kirServ kernel: [798218.029214] [<ffffffff8138ce8c>] Oct 11 06:48:44 kirServ kernel: [798218.029217] [<ffffffff810c327b>] ? Oct 11 06:48:44 kirServ kernel: [798218.029219] [<ffffffff8138ae45>] ? Oct 11 06:48:44 kirServ kernel: [798218.029221] [<ffffffff813993a5>] ? Oct 11 06:48:44 kirServ kernel: [798218.029223] [<ffffffff8138d84d>] Oct 11 06:48:44 kirServ kernel: [798218.029225] [<ffffffff810cf9eb>] ? Oct 11 06:48:44 kirServ kernel: [798218.029228] [<ffffffff81002f0b>] Oct 11 06:48:49 kirServ kernel: [798223.040078] PAX: refcount overflow detected in: deluged:20601, uid/euid: 0/0 Oct 11 06:48:49 kirServ kernel: [798223.040082] CPU 0 Oct 11 06:48:49 kirServ kernel: [798223.040083] Modules linked in: ath5k skge mac80211 ath button cfg80211 Oct 11 06:48:49 kirServ kernel: [798223.040092] Oct 11 06:48:49 kirServ kernel: [798223.040095] Pid: 20601, comm: deluged Not tainted 2.6.34-hardened-r6kirServ #4 P5B/System Product Name Oct 11 06:48:49 kirServ kernel: [798223.040098] RIP: 0010:[<ffffffff813dabc7>] [<ffffffff813dabc7>] Oct 11 06:48:49 kirServ kernel: [798223.040103] RSP: 0018:ffff880001c03b08 EFLAGS: 00000a96 Oct 11 06:48:49 kirServ kernel: [798223.040106] RAX: 0000000000000001 RBX: ffff88005c741e00 RCX: ffff880048235a74 Oct 11 06:48:49 kirServ kernel: [798223.040109] RDX: 000000007fffffff RSI: ffff88005c741e00 RDI: ffff880074cd6c10 Oct 11 06:48:49 kirServ kernel: [798223.040111] RBP: ffff880001c03b28 R08: 0000000000000000 R09: 0000000000000080 Oct 11 06:48:49 kirServ kernel: [798223.040114] R10: 0000000000000008 R11: 35001aa90100007f R12: 0000000000000000 Oct 11 06:48:49 kirServ kernel: [798223.040117] R13: ffff880074cd6c10 R14: ffff88005c741e00 R15: 0000000000000000 Oct 11 06:48:49 kirServ kernel: [798223.040121] FS: 00000365a4ef5710(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000 Oct 11 06:48:49 kirServ kernel: [798223.040124] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 11 06:48:49 kirServ kernel: [798223.040127] CR2: ffffffffff600400 CR3: 0000000001817000 CR4: 00000000000006f0 Oct 11 06:48:49 kirServ kernel: [798223.040130] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Oct 11 06:48:49 kirServ kernel: [798223.040133] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Oct 11 06:48:49 kirServ kernel: [798223.040136] Process deluged (pid: 20601, threadinfo ffff8800483dc000, task ffff88007b3c5480) Oct 11 06:48:49 kirServ kernel: [798223.040138] Stack: Oct 11 06:48:49 kirServ kernel: [798223.040147] ffff88007de58e00 ffff88007de58e00 ffff880074cd6c10 ffff88007f9182c0 Oct 11 06:48:49 kirServ kernel: [798223.040151] <0> ffff880001c03b68 ffffffff813e381e 40ff00007de58e00 ffff88007de58e00 Oct 11 06:48:49 kirServ kernel: [798223.040156] <0> ffff880074cd6c24 ffff880001c03bf8 ffff88007f9182c0 0000000000000003 Oct 11 06:48:49 kirServ kernel: [798223.040161] Call Trace: Oct 11 06:48:49 kirServ kernel: [798223.040169] <IRQ> Oct 11 06:48:49 kirServ kernel: [798223.040188] [<ffffffff813e381e>] Oct 11 06:48:49 kirServ kernel: [798223.040191] [<ffffffff8140ab32>] Oct 11 06:48:49 kirServ kernel: [798223.040193] [<ffffffff8140b08c>] Oct 11 06:48:49 kirServ kernel: [798223.040196] [<ffffffff813ffac0>] ? Oct 11 06:48:49 kirServ kernel: [798223.040198] [<ffffffff81428dc8>] ? Oct 11 06:48:49 kirServ kernel: [798223.040201] [<ffffffff814254fd>] ? Oct 11 06:48:49 kirServ kernel: [798223.040204] [<ffffffff81408506>] Oct 11 06:48:49 kirServ kernel: [798223.040207] [<ffffffff813defa0>] ? Oct 11 06:48:49 kirServ kernel: [798223.040209] [<ffffffff813c4e14>] ? Oct 11 06:48:49 kirServ kernel: [798223.040212] [<ffffffff814087b5>] Oct 11 06:48:49 kirServ kernel: [798223.040214] [<ffffffff813df089>] Oct 11 06:48:49 kirServ kernel: [798223.040216] [<ffffffff813df218>] Oct 11 06:48:49 kirServ kernel: [798223.040219] [<ffffffff813de9b6>] Oct 11 06:48:49 kirServ kernel: [798223.040221] [<ffffffff813dedda>] Oct 11 06:48:49 kirServ kernel: [798223.040224] [<ffffffff8139f073>] Oct 11 06:48:49 kirServ kernel: [798223.040226] [<ffffffff8104cc19>] ? Oct 11 06:48:49 kirServ kernel: [798223.040230] [<ffffffff8139f265>] Oct 11 06:48:49 kirServ kernel: [798223.040234] [<ffffffff8139f481>] Oct 11 06:48:49 kirServ kernel: [798223.040238] [<ffffffff81045f1f>] Oct 11 06:48:49 kirServ kernel: [798223.040242] [<ffffffff81003dcc>] Oct 11 06:48:49 kirServ kernel: [798223.040245] <EOI> Oct 11 06:48:49 kirServ kernel: [798223.040256] [<ffffffff81005ec5>] ? Oct 11 06:48:49 kirServ kernel: [798223.040260] [<ffffffff81045de1>] Oct 11 06:48:49 kirServ kernel: [798223.040264] [<ffffffff813a0403>] Oct 11 06:48:49 kirServ kernel: [798223.040268] [<ffffffff813e4573>] Oct 11 06:48:49 kirServ kernel: [798223.040272] [<ffffffff813e4750>] Oct 11 06:48:49 kirServ kernel: [798223.040286] [<ffffffff813e3480>] Oct 11 06:48:49 kirServ kernel: [798223.040290] [<ffffffff813e377b>] Oct 11 06:48:49 kirServ kernel: [798223.040293] [<ffffffff81405caf>] Oct 11 06:48:49 kirServ kernel: [798223.040297] [<ffffffff81406ca9>] Oct 11 06:48:49 kirServ kernel: [798223.040301] [<ffffffff81482791>] ? Oct 11 06:48:49 kirServ kernel: [798223.040305] [<ffffffff8140e4a5>] Oct 11 06:48:49 kirServ kernel: [798223.040308] [<ffffffff8138ce8c>] Oct 11 06:48:49 kirServ kernel: [798223.040312] [<ffffffff813dcf6a>] ? Oct 11 06:48:49 kirServ kernel: [798223.040316] [<ffffffff813ddace>] ? Oct 11 06:48:49 kirServ kernel: [798223.040319] [<ffffffff81403280>] ? Oct 11 06:48:49 kirServ kernel: [798223.040323] [<ffffffff8138cffa>] Oct 11 06:48:49 kirServ kernel: [798223.040326] [<ffffffff8140e529>] ? Oct 11 06:48:49 kirServ kernel: [798223.040329] [<ffffffff81063903>] ? Oct 11 06:48:49 kirServ kernel: [798223.040333] [<ffffffff81002f0b>] Oct 11 06:48:49 kirServ kernel: [798223.040336] Code: d4 48 85 f6 0f 84 95 00 00 00 48 8b 96 40 01 00 00 48 85 d2 74 36 41 8d 44 24 01 48 8d 4a 34 89 c2 f0 0f c1 11 71 04 89 11 cd 04 <01> c2 66 29 c2 66 c1 c2 08 66 41 89 55 04 48 8b 5d e8 4c 8b 65 Oct 11 06:48:49 kirServ kernel: [798223.040745] Call Trace: Oct 11 06:48:49 kirServ kernel: [798223.040746] <IRQ> [<ffffffff813e381e>] Oct 11 06:48:49 kirServ kernel: [798223.040750] [<ffffffff8140ab32>] Oct 11 06:48:49 kirServ kernel: [798223.040752] [<ffffffff8140b08c>] Oct 11 06:48:49 kirServ kernel: [798223.040754] [<ffffffff813ffac0>] ? Oct 11 06:48:49 kirServ kernel: [798223.040756] [<ffffffff81428dc8>] ? Oct 11 06:48:49 kirServ kernel: [798223.040758] [<ffffffff814254fd>] ? Oct 11 06:48:49 kirServ kernel: [798223.040761] [<ffffffff81408506>] Oct 11 06:48:49 kirServ kernel: [798223.040763] [<ffffffff813defa0>] ? Oct 11 06:48:49 kirServ kernel: [798223.040765] [<ffffffff813c4e14>] ? Oct 11 06:48:49 kirServ kernel: [798223.040767] [<ffffffff814087b5>] Oct 11 06:48:49 kirServ kernel: [798223.040769] [<ffffffff813df089>] Oct 11 06:48:49 kirServ kernel: [798223.040771] [<ffffffff813df218>] Oct 11 06:48:49 kirServ kernel: [798223.040773] [<ffffffff813de9b6>] Oct 11 06:48:49 kirServ kernel: [798223.040775] [<ffffffff813dedda>] Oct 11 06:48:49 kirServ kernel: [798223.040777] [<ffffffff8139f073>] Oct 11 06:48:49 kirServ kernel: [798223.040779] [<ffffffff8104cc19>] ? Oct 11 06:48:49 kirServ kernel: [798223.040782] [<ffffffff8139f265>] Oct 11 06:48:49 kirServ kernel: [798223.040784] [<ffffffff8139f481>] Oct 11 06:48:49 kirServ kernel: [798223.040786] [<ffffffff81045f1f>] Oct 11 06:48:49 kirServ kernel: [798223.040788] [<ffffffff81003dcc>] Oct 11 06:48:49 kirServ kernel: [798223.040789] <EOI> [<ffffffff81005ec5>] ? Oct 11 06:48:49 kirServ kernel: [798223.040793] [<ffffffff81045de1>] Oct 11 06:48:49 kirServ kernel: [798223.040795] [<ffffffff813a0403>] Oct 11 06:48:49 kirServ kernel: [798223.040797] [<ffffffff813e4573>] Oct 11 06:48:49 kirServ kernel: [798223.040799] [<ffffffff813e4750>] Oct 11 06:48:49 kirServ kernel: [798223.040801] [<ffffffff813e3480>] Oct 11 06:48:49 kirServ kernel: [798223.040803] [<ffffffff813e377b>] Oct 11 06:48:49 kirServ kernel: [798223.040805] [<ffffffff81405caf>] Oct 11 06:48:49 kirServ kernel: [798223.040807] [<ffffffff81406ca9>] Oct 11 06:48:49 kirServ kernel: [798223.040809] [<ffffffff81482791>] ? Oct 11 06:48:49 kirServ kernel: [798223.040812] [<ffffffff8140e4a5>] Oct 11 06:48:49 kirServ kernel: [798223.040814] [<ffffffff8138ce8c>] Oct 11 06:48:49 kirServ kernel: [798223.040816] [<ffffffff813dcf6a>] ? Oct 11 06:48:49 kirServ kernel: [798223.040818] [<ffffffff813ddace>] ? Oct 11 06:48:49 kirServ kernel: [798223.040820] [<ffffffff81403280>] ? Oct 11 06:48:49 kirServ kernel: [798223.040822] [<ffffffff8138cffa>] Oct 11 06:48:49 kirServ kernel: [798223.040825] [<ffffffff8140e529>] ? Oct 11 06:48:49 kirServ kernel: [798223.040827] [<ffffffff81063903>] ? Oct 11 06:48:49 kirServ kernel: [798223.040829] [<ffffffff81002f0b>] Oct 11 07:00:01 kirServ kernel: [798895.108073] PAX: refcount overflow detected in: sg.py:12208, uid/euid: 1000/1000 Oct 11 07:00:01 kirServ kernel: [798895.108077] CPU 1 Oct 11 07:00:01 kirServ kernel: [798895.108079] Modules linked in: ath5k skge mac80211 ath button cfg80211 Oct 11 07:00:01 kirServ kernel: [798895.108086] Oct 11 07:00:01 kirServ kernel: [798895.108090] Pid: 12208, comm: sg.py Not tainted 2.6.34-hardened-r6kirServ #4 P5B/System Product Name Oct 11 07:00:01 kirServ kernel: [798895.108092] RIP: 0010:[<ffffffff813dabc7>] [<ffffffff813dabc7>] Oct 11 07:00:01 kirServ kernel: [798895.108096] RSP: 0018:ffff880001c83b08 EFLAGS: 00000a96 Oct 11 07:00:01 kirServ kernel: [798895.108099] RAX: 0000000000000001 RBX: ffff88004821f080 RCX: ffff880048235a74 Oct 11 07:00:01 kirServ kernel: [798895.108101] RDX: 000000007fffffff RSI: 0000000000000001 RDI: ffffffff813dab73 Oct 11 07:00:01 kirServ kernel: [798895.108104] RBP: ffff880001c83b28 R08: 0000000000000000 R09: 00000000000000c0 Oct 11 07:00:01 kirServ kernel: [798895.108106] R10: 0000000000000008 R11: 35000dee0100007f R12: 0000000000000000 Oct 11 07:00:01 kirServ kernel: [798895.108109] R13: ffff880062de7810 R14: ffff88004821f080 R15: 0000000000000000 Oct 11 07:00:01 kirServ kernel: [798895.108112] FS: 000002c65573a700(0000) GS:ffff880001c80000(0000) knlGS:0000000000000000 Oct 11 07:00:01 kirServ kernel: [798895.108115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 11 07:00:01 kirServ kernel: [798895.108117] CR2: 000002c654cb6820 CR3: 0000000001818000 CR4: 00000000000006f0 Oct 11 07:00:01 kirServ kernel: [798895.108120] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Oct 11 07:00:01 kirServ kernel: [798895.108122] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Oct 11 07:00:01 kirServ kernel: [798895.108125] Process sg.py (pid: 12208, threadinfo ffff88007ef82000, task ffff88006fdfb400) Oct 11 07:00:01 kirServ kernel: [798895.108127] Stack: Oct 11 07:00:01 kirServ kernel: [798895.108210] ffff88007e065b00 ffff88007e065b00 ffff880062de7810 ffff88007f918580 Oct 11 07:00:01 kirServ kernel: [798895.108214] <0> ffff880001c83b68 ffffffff813e381e 40ff00007e065b00 ffff88007e065b00 Oct 11 07:00:01 kirServ kernel: [798895.108218] <0> ffff880062de7824 ffff880001c83bf8 ffff88007f918580 0000000000000003 Oct 11 07:00:01 kirServ kernel: [798895.108223] Call Trace: Oct 11 07:00:01 kirServ kernel: [798895.108301] <IRQ> Oct 11 07:00:01 kirServ kernel: [798895.108379] [<ffffffff813e381e>] Oct 11 07:00:01 kirServ kernel: [798895.108381] [<ffffffff8140ab32>] Oct 11 07:00:01 kirServ kernel: [798895.108384] [<ffffffff8140b08c>] Oct 11 07:00:01 kirServ kernel: [798895.108386] [<ffffffff8103a1c0>] ? Oct 11 07:00:01 kirServ kernel: [798895.108388] [<ffffffff81059c81>] ? Oct 11 07:00:01 kirServ kernel: [798895.108390] [<ffffffff814254fd>] ? Oct 11 07:00:01 kirServ kernel: [798895.108393] [<ffffffff81408506>] Oct 11 07:00:01 kirServ kernel: [798895.108395] [<ffffffff813defa0>] ? Oct 11 07:00:01 kirServ kernel: [798895.108397] [<ffffffff813c4e14>] ? Oct 11 07:00:01 kirServ kernel: [798895.108399] [<ffffffff814087b5>] Oct 11 07:00:01 kirServ kernel: [798895.108402] [<ffffffff813df089>] Oct 11 07:00:01 kirServ kernel: [798895.108404] [<ffffffff813df218>] Oct 11 07:00:01 kirServ kernel: [798895.108406] [<ffffffff813de9b6>] Oct 11 07:00:01 kirServ kernel: [798895.108408] [<ffffffff813dedda>] Oct 11 07:00:01 kirServ kernel: [798895.108410] [<ffffffff8139f073>] Oct 11 07:00:01 kirServ kernel: [798895.108412] [<ffffffff8139f265>] Oct 11 07:00:01 kirServ kernel: [798895.108415] [<ffffffff8139f481>] Oct 11 07:00:01 kirServ kernel: [798895.108417] [<ffffffff81045f1f>] Oct 11 07:00:01 kirServ kernel: [798895.108419] [<ffffffff81003dcc>] Oct 11 07:00:01 kirServ kernel: [798895.108421] <EOI> Oct 11 07:00:01 kirServ kernel: [798895.108502] [<ffffffff81005ec5>] ? Oct 11 07:00:01 kirServ kernel: [798895.108505] [<ffffffff81045de1>] Oct 11 07:00:01 kirServ kernel: [798895.108507] [<ffffffff813a0403>] Oct 11 07:00:01 kirServ kernel: [798895.108509] [<ffffffff813e4573>] Oct 11 07:00:01 kirServ kernel: [798895.108511] [<ffffffff813e4750>] Oct 11 07:00:01 kirServ kernel: [798895.108513] [<ffffffff813e3480>] Oct 11 07:00:01 kirServ kernel: [798895.108515] [<ffffffff813e377b>] Oct 11 07:00:01 kirServ kernel: [798895.108517] [<ffffffff81405caf>] Oct 11 07:00:01 kirServ kernel: [798895.108520] [<ffffffff81406ca9>] Oct 11 07:00:01 kirServ kernel: [798895.108522] [<ffffffff814824b4>] ? Oct 11 07:00:01 kirServ kernel: [798895.108524] [<ffffffff81408cef>] ? Oct 11 07:00:01 kirServ kernel: [798895.108526] [<ffffffff8140e4a5>] Oct 11 07:00:01 kirServ kernel: [798895.108529] [<ffffffff8138ce8c>] Oct 11 07:00:01 kirServ kernel: [798895.108531] [<ffffffff813dcf6a>] ? Oct 11 07:00:01 kirServ kernel: [798895.108533] [<ffffffff8138cffa>] Oct 11 07:00:01 kirServ kernel: [798895.108536] [<ffffffff8140e529>] ? Oct 11 07:00:01 kirServ kernel: [798895.108538] [<ffffffff8138c6bf>] ? Oct 11 07:00:01 kirServ kernel: [798895.108540] [<ffffffff81002f0b>] Oct 11 07:00:01 kirServ kernel: [798895.108542] Code: d4 48 85 f6 0f 84 95 00 00 00 48 8b 96 40 01 00 00 48 85 d2 74 36 41 8d 44 24 01 48 8d 4a 34 89 c2 f0 0f c1 11 71 04 89 11 cd 04 <01> c2 66 29 c2 66 c1 c2 08 66 41 89 55 04 48 8b 5d e8 4c 8b 65 Oct 11 07:00:01 kirServ kernel: [798895.108957] Call Trace: Oct 11 07:00:01 kirServ kernel: [798895.108959] <IRQ> [<ffffffff813e381e>] Oct 11 07:00:01 kirServ kernel: [798895.108962] [<ffffffff8140ab32>] Oct 11 07:00:01 kirServ kernel: [798895.108965] [<ffffffff8140b08c>] Oct 11 07:00:01 kirServ kernel: [798895.108967] [<ffffffff8103a1c0>] ? Oct 11 07:00:01 kirServ kernel: [798895.108969] [<ffffffff81059c81>] ? Oct 11 07:00:01 kirServ kernel: [798895.108971] [<ffffffff814254fd>] ? Oct 11 07:00:01 kirServ kernel: [798895.108973] [<ffffffff81408506>] Oct 11 07:00:01 kirServ kernel: [798895.108975] [<ffffffff813defa0>] ? Oct 11 07:00:01 kirServ kernel: [798895.108977] [<ffffffff813c4e14>] ? Oct 11 07:00:01 kirServ kernel: [798895.108980] [<ffffffff814087b5>] Oct 11 07:00:01 kirServ kernel: [798895.108982] [<ffffffff813df089>] Oct 11 07:00:01 kirServ kernel: [798895.108984] [<ffffffff813df218>] Oct 11 07:00:01 kirServ kernel: [798895.108986] [<ffffffff813de9b6>] Oct 11 07:00:01 kirServ kernel: [798895.108988] [<ffffffff813dedda>] Oct 11 07:00:01 kirServ kernel: [798895.108990] [<ffffffff8139f073>] Oct 11 07:00:01 kirServ kernel: [798895.108992] [<ffffffff8139f265>] Oct 11 07:00:01 kirServ kernel: [798895.108994] [<ffffffff8139f481>] Oct 11 07:00:01 kirServ kernel: [798895.108996] [<ffffffff81045f1f>] Oct 11 07:00:01 kirServ kernel: [798895.108999] [<ffffffff81003dcc>] Oct 11 07:00:01 kirServ kernel: [798895.109000] <EOI> [<ffffffff81005ec5>] ? Oct 11 07:00:01 kirServ kernel: [798895.109004] [<ffffffff81045de1>] Oct 11 07:00:01 kirServ kernel: [798895.109006] [<ffffffff813a0403>] Oct 11 07:00:01 kirServ kernel: [798895.109008] [<ffffffff813e4573>] Oct 11 07:00:01 kirServ kernel: [798895.109010] [<ffffffff813e4750>] Oct 11 07:00:01 kirServ kernel: [798895.109012] [<ffffffff813e3480>] Oct 11 07:00:01 kirServ kernel: [798895.109014] [<ffffffff813e377b>] Oct 11 07:00:01 kirServ kernel: [798895.109016] [<ffffffff81405caf>] Oct 11 07:00:01 kirServ kernel: [798895.109018] [<ffffffff81406ca9>] Oct 11 07:00:01 kirServ kernel: [798895.109020] [<ffffffff814824b4>] ? Oct 11 07:00:01 kirServ kernel: [798895.109022] [<ffffffff81408cef>] ? Oct 11 07:00:01 kirServ kernel: [798895.109025] [<ffffffff8140e4a5>] Oct 11 07:00:01 kirServ kernel: [798895.109027] [<ffffffff8138ce8c>] Oct 11 07:00:01 kirServ kernel: [798895.109029] [<ffffffff813dcf6a>] ? Oct 11 07:00:01 kirServ kernel: [798895.109031] [<ffffffff8138cffa>] Oct 11 07:00:01 kirServ kernel: [798895.109033] [<ffffffff8140e529>] ? Oct 11 07:00:01 kirServ kernel: [798895.109036] [<ffffffff8138c6bf>] ? Oct 11 07:00:01 kirServ kernel: [798895.109038] [<ffffffff81002f0b>] Oct 11 07:00:17 kirServ kernel: [798910.707536] ath5k phy0: unsupported jumbo Oct 11 07:12:26 kirServ kernel: [799640.498760] ath5k phy0: unsupported jumbo Oct 11 07:22:04 kirServ kernel: [800217.522923] PAX: From 172.16.1.54: refcount overflow detected in: dhcpd:7162, uid/euid: 101/101 Oct 11 07:22:04 kirServ kernel: [800217.522927] CPU 0 Oct 11 07:22:04 kirServ kernel: [800217.522929] Modules linked in: ath5k skge mac80211 ath button cfg80211 Oct 11 07:22:04 kirServ kernel: [800217.522937] Oct 11 07:22:04 kirServ kernel: [800217.522941] Pid: 7162, comm: dhcpd Not tainted 2.6.34-hardened-r6kirServ #4 P5B/System Product Name Oct 11 07:22:04 kirServ kernel: [800217.522944] RIP: 0010:[<ffffffff813dabc7>] [<ffffffff813dabc7>] Oct 11 07:22:04 kirServ kernel: [800217.522948] RSP: 0018:ffff880001c03b08 EFLAGS: 00000a96 Oct 11 07:22:04 kirServ kernel: [800217.522951] RAX: 0000000000000001 RBX: ffff88005c740600 RCX: ffff880048235a74 Oct 11 07:22:04 kirServ kernel: [800217.522955] RDX: 000000007fffffff RSI: 0000000000000001 RDI: ffffffff813dab73 Oct 11 07:22:04 kirServ kernel: [800217.522957] RBP: ffff880001c03b28 R08: 0000000000000000 R09: 0000000000000080 Oct 11 07:22:04 kirServ kernel: [800217.522960] R10: 0000000000000008 R11: 0000000000000001 R12: 0000000000000000 Oct 11 07:22:04 kirServ kernel: [800217.522963] R13: ffff880074cd7610 R14: ffff88005c740600 R15: 0000000000000000 Oct 11 07:22:04 kirServ kernel: [800217.522967] FS: 000002ff422f2700(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000 Oct 11 07:22:04 kirServ kernel: [800217.522970] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Oct 11 07:22:04 kirServ kernel: [800217.522973] CR2: ffffffffff600400 CR3: 0000000001817000 CR4: 00000000000006f0 Oct 11 07:22:04 kirServ kernel: [800217.522976] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Oct 11 07:22:04 kirServ kernel: [800217.522978] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Oct 11 07:22:04 kirServ kernel: [800217.522982] Process dhcpd (pid: 7162, threadinfo ffff880074dc0000, task ffff88007b332d80) Oct 11 07:22:04 kirServ kernel: [800217.522984] Stack: Oct 11 07:22:04 kirServ kernel: [800217.523075] ffff88007b343500 ffff88007b343500 ffff880074cd7610 ffff88007f9182c0 Oct 11 07:22:04 kirServ kernel: [800217.523079] <0> ffff880001c03b68 ffffffff813e381e 40ff00007b343500 ffff88007b343500 Oct 11 07:22:04 kirServ kernel: [800217.523083] <0> ffff880074cd7624 ffff880001c03bf8 ffff88007f9182c0 0000000000000003 Oct 11 07:22:04 kirServ kernel: [800217.523087] Call Trace: Oct 11 07:22:04 kirServ kernel: [800217.523166] <IRQ> Oct 11 07:22:04 kirServ kernel: [800217.523245] [<ffffffff813e381e>] Oct 11 07:22:04 kirServ kernel: [800217.523248] [<ffffffff8140ab32>] Oct 11 07:22:04 kirServ kernel: [800217.523250] [<ffffffff8140b08c>] Oct 11 07:22:04 kirServ kernel: [800217.523252] [<ffffffff814254fd>] ? Oct 11 07:22:04 kirServ kernel: [800217.523255] [<ffffffff81408506>] Oct 11 07:22:04 kirServ kernel: [800217.523257] [<ffffffff813defa0>] ? Oct 11 07:22:04 kirServ kernel: [800217.523259] [<ffffffff813c4e14>] ? Oct 11 07:22:04 kirServ kernel: [800217.523262] [<ffffffff814087b5>] Oct 11 07:22:04 kirServ kernel: [800217.523264] [<ffffffff813df089>] Oct 11 07:22:04 kirServ kernel: [800217.523266] [<ffffffff813df218>] Oct 11 07:22:04 kirServ kernel: [800217.523268] [<ffffffff813de9b6>] Oct 11 07:22:04 kirServ kernel: [800217.523270] [<ffffffff813dedda>] Oct 11 07:22:04 kirServ kernel: [800217.523272] [<ffffffff8139f073>] Oct 11 07:22:04 kirServ kernel: [800217.523275] [<ffffffff8139f265>] Oct 11 07:22:04 kirServ kernel: [800217.523277] [<ffffffff8139f481>] Oct 11 07:22:04 kirServ kernel: [800217.523279] [<ffffffff81045f1f>] Oct 11 07:22:04 kirServ kernel: [800217.523281] [<ffffffff81003dcc>] Oct 11 07:22:04 kirServ kernel: [800217.523283] <EOI> Oct 11 07:22:04 kirServ kernel: [800217.523369] [<ffffffff81005ec5>] ? Oct 11 07:22:04 kirServ kernel: [800217.523372] [<ffffffff81045de1>] Oct 11 07:22:04 kirServ kernel: [800217.523374] [<ffffffff813a0403>] Oct 11 07:22:04 kirServ kernel: [800217.523376] [<ffffffff813e4573>] Oct 11 07:22:04 kirServ kernel: [800217.523378] [<ffffffff813e4750>] Oct 11 07:22:04 kirServ kernel: [800217.523380] [<ffffffff813e3480>] Oct 11 07:22:04 kirServ kernel: [800217.523383] [<ffffffff813e377b>] Oct 11 07:22:04 kirServ kernel: [800217.523385] [<ffffffff81405caf>] Oct 11 07:22:04 kirServ kernel: [800217.523387] [<ffffffff81406ca9>] Oct 11 07:22:04 kirServ kernel: [800217.523389] [<ffffffff814824b4>] ? Oct 11 07:22:04 kirServ kernel: [800217.523393] [<ffffffff81408cef>] ? Oct 11 07:22:04 kirServ kernel: [800217.523396] [<ffffffff8140e4a5>] Oct 11 07:22:04 kirServ kernel: [800217.523400] [<ffffffff8138ce8c>] Oct 11 07:22:04 kirServ kernel: [800217.523404] [<ffffffff813dcf6a>] ? Oct 11 07:22:04 kirServ kernel: [800217.523407] [<ffffffff813ddace>] ? Oct 11 07:22:04 kirServ kernel: [800217.523411] [<ffffffff81403280>] ? Oct 11 07:22:04 kirServ kernel: [800217.523414] [<ffffffff8138cffa>] Oct 11 07:22:04 kirServ kernel: [800217.523418] [<ffffffff8140e529>] ? Oct 11 07:22:04 kirServ kernel: [800217.523422] [<ffffffff8138c6bf>] ? Oct 11 07:22:04 kirServ kernel: [800217.523425] [<ffffffff81002f0b>] Oct 11 07:22:04 kirServ kernel: [800217.523428] Code: d4 48 85 f6 0f 84 95 00 00 00 48 8b 96 40 01 00 00 48 85 d2 74 36 41 8d 44 24 01 48 8d 4a 34 89 c2 f0 0f c1 11 71 04 89 11 cd 04 <01> c2 66 29 c2 66 c1 c2 08 66 41 89 55 04 48 8b 5d e8 4c 8b 65 Oct 11 07:22:04 kirServ kernel: [800217.523873] Call Trace: Oct 11 07:22:04 kirServ kernel: [800217.523874] <IRQ> [<ffffffff813e381e>] Oct 11 07:22:04 kirServ kernel: [800217.523878] [<ffffffff8140ab32>] Oct 11 07:22:04 kirServ kernel: [800217.523880] [<ffffffff8140b08c>] Oct 11 07:22:04 kirServ kernel: [800217.523882] [<ffffffff814254fd>] ? Oct 11 07:22:04 kirServ kernel: [800217.523885] [<ffffffff81408506>] Oct 11 07:22:04 kirServ kernel: [800217.523887] [<ffffffff813defa0>] ? Oct 11 07:22:04 kirServ kernel: [800217.523889] [<ffffffff813c4e14>] ? Oct 11 07:22:04 kirServ kernel: [800217.523891] [<ffffffff814087b5>] Oct 11 07:22:04 kirServ kernel: [800217.523893] [<ffffffff813df089>] Oct 11 07:22:04 kirServ kernel: [800217.523895] [<ffffffff813df218>] Oct 11 07:22:04 kirServ kernel: [800217.523897] [<ffffffff813de9b6>] Oct 11 07:22:04 kirServ kernel: [800217.523899] [<ffffffff813dedda>] Oct 11 07:22:04 kirServ kernel: [800217.523902] [<ffffffff8139f073>] Oct 11 07:22:04 kirServ kernel: [800217.523904] [<ffffffff8139f265>] Oct 11 07:22:04 kirServ kernel: [800217.523906] [<ffffffff8139f481>] Oct 11 07:22:04 kirServ kernel: [800217.523908] [<ffffffff81045f1f>] Oct 11 07:22:04 kirServ kernel: [800217.523910] [<ffffffff81003dcc>] Oct 11 07:22:04 kirServ kernel: [800217.523912] <EOI> [<ffffffff81005ec5>] ? Oct 11 07:22:04 kirServ kernel: [800217.523915] [<ffffffff81045de1>] Oct 11 07:22:04 kirServ kernel: [800217.523917] [<ffffffff813a0403>] Oct 11 07:22:04 kirServ kernel: [800217.523919] [<ffffffff813e4573>] Oct 11 07:22:04 kirServ kernel: [800217.523921] [<ffffffff813e4750>] Oct 11 07:22:04 kirServ kernel: [800217.523923] [<ffffffff813e3480>] Oct 11 07:22:04 kirServ kernel: [800217.523926] [<ffffffff813e377b>] Oct 11 07:22:04 kirServ kernel: [800217.523928] [<ffffffff81405caf>] Oct 11 07:22:04 kirServ kernel: [800217.523930] [<ffffffff81406ca9>] Oct 11 07:22:04 kirServ kernel: [800217.523932] [<ffffffff814824b4>] ? Oct 11 07:22:04 kirServ kernel: [800217.523934] [<ffffffff81408cef>] ? Oct 11 07:22:04 kirServ kernel: [800217.523936] [<ffffffff8140e4a5>] Oct 11 07:22:04 kirServ kernel: [800217.523938] [<ffffffff8138ce8c>] Oct 11 07:22:04 kirServ kernel: [800217.523940] [<ffffffff813dcf6a>] ? Oct 11 07:22:04 kirServ kernel: [800217.523943] [<ffffffff813ddace>] ? Oct 11 07:22:04 kirServ kernel: [800217.523945] [<ffffffff81403280>] ? Oct 11 07:22:04 kirServ kernel: [800217.523947] [<ffffffff8138cffa>] Oct 11 07:22:04 kirServ kernel: [800217.523949] [<ffffffff8140e529>] ? Oct 11 07:22:04 kirServ kernel: [800217.523951] [<ffffffff8138c6bf>] ? Oct 11 07:22:04 kirServ kernel: [800217.523954] [<ffffffff81002f0b>]

87.98.164.164 is a slave ns.
I switched on my laptop at 7:22 (when dhcpd crashed).

Posted: **Mon Oct 11, 2010 10:05 am**

It's possible this bug is already fixed, as you're running a kernel that's no longer supported. To make sure though we'll need your System.map and vmlinux (not vmlinuz) files.

-Brad

Posted: **Mon Oct 11, 2010 1:08 pm**

Here they are: http://kirelagin.ru/~kirrun/kern.tar.gz

Why would PAX suspect sg.py — a very small python script running every hour (by cron)?

Posted: **Tue Oct 12, 2010 8:26 am**

kirrun wrote:Why would PAX suspect sg.py — a very small python script running every hour (by cron)?

you get the refcount overflow report in whichever task's context that was active at the time. this was a false positive in IP ID generation btw, fixed in the latest test patch, thanks for the report!

Posted: **Tue Oct 12, 2010 8:29 am**

BTW, only the 2.6.35.7 patch was updated, since the 2.6.32 kernel was unaffected (the problem being introduced by a change in 2.6.34 of some fields to atomic).

-Brad

grsecurity forums

refcount overflow

refcount overflow

Re: refcount overflow

Re: refcount overflow

Re: refcount overflow

Re: refcount overflow