grsecurity forums

by **zakalwe** » Mon Jul 10, 2006 9:57 am

oops during system start. Pax and grsecurity enabled.

Code: Select all: determinist ~ # ksymoops -K -v /usr/src/linux/vmlinux < ./oops.txt ksymoops 2.4.11 on i686 2.6.16.2-grsec. Options used -v /usr/src/linux/vmlinux (specified) -K (specified) -l /proc/modules (default) -o /lib/modules/2.6.16.2-grsec/ (default) -m /usr/src/linux/System.map (default) No modules in ksyms, skipping objects No ksyms, skipping lsmod Jul 10 13:50:53 determinist CPU: 0 Jul 10 13:50:53 determinist EIP: 0060:[<0027b02f>] Not tainted VLI Using defaults from ksymoops -t elf32-i386 -a i386 Jul 10 13:50:53 determinist EFLAGS: 00010202 (2.6.17.4-grsec #4) Jul 10 13:50:53 determinist eax: 1029d264 ebx: 00000000 ecx: 00000001 edx: 5acc9940 Jul 10 13:50:53 determinist esi: 5acc9954 edi: dfb3ae30 ebp: df89dbcc esp: df89db8c Jul 10 13:50:53 determinist ds: 007b es: 0068 ss: 0068 Jul 10 13:50:53 determinist Stack: 00000000 5acc9950 00000044 001dc656 5acc9950 dfb3ae2c 00000044 00000000 Jul 10 13:50:53 determinist df89dbbc 00000000 00000000 00000000 00000000 df961ea0 df89de8c dfb3ae2c Jul 10 13:50:53 determinist df89dbf8 0021a9ab dfb3ae2c df89de8c 00000000 00000044 df89dbe8 00000000 Jul 10 13:50:53 determinist Call Trace: Jul 10 13:50:53 determinist <0000599f> die+0xef/0x200 <00005b37> do_trap+0x87/0xd0 Jul 10 13:50:53 determinist <000060dd> do_stack_segment+0x7d/0x90 <00004fbf> error_code+0x5f/0x70 Jul 10 13:50:53 determinist <0021a9ab> ip_generic_getfrag+0x4b/0xc0 <0021b112> ip_append_data+0x6f2/0xa10 Jul 10 13:50:53 determinist <002363c1> udp_sendmsg+0x341/0x690 <0023d776> inet_sendmsg+0x46/0x50 Jul 10 13:50:53 determinist <001d508f> sock_sendmsg+0xbf/0xf0 <001d6708> sys_sendto+0x108/0x140 Jul 10 13:50:53 determinist <001d712f> sys_socketcall+0x18f/0x240 <00003ef7> syscall_call+0x7/0xb Jul 10 13:50:53 determinist Code: ff ba f2 ff ff ff e9 f3 be f5 ff 8b 5c 24 20 36 c7 03 f2 ff ff ff 8b 7c 24 14 8b 4c 24 18 31 c0 f3 aa e9 7c dd ff ff 8b 5c 24 24 <36> c7 03 f2 ff ff ff e9 6c dd ff ff 00 00 00 00 00 b2 1f 00 00 >>EIP; 0027b02f <iret_exc+77d/789> <===== >>eax; 1029d264 <phys_startup_32+fe9c264/bfd00000> >>edx; 5acc9940 <phys_startup_32+5a8c8940/bfd00000> >>esi; 5acc9954 <phys_startup_32+5a8c8954/bfd00000> >>edi; dfb3ae30 <pg0+1ee80e30/3f055000> >>ebp; df89dbcc <pg0+1ebe3bcc/3f055000> >>esp; df89db8c <pg0+1ebe3b8c/3f055000> Trace; 0000599f <die+ef/200> Trace; 000060dd <do_stack_segment+7d/90> Trace; 0021a9ab <ip_generic_getfrag+4b/c0> Trace; 002363c1 <udp_sendmsg+341/690> Trace; 001d508f <sock_sendmsg+bf/f0> Trace; 001d712f <sys_socketcall+18f/240> This architecture has variable length instructions, decoding before eip is unreliable, take these instructions with a pinch of salt. Code; 0027b004 <iret_exc+752/789> 00000000 <_EIP>: Code; 0027b004 <iret_exc+752/789> 0: ff (bad) Code; 0027b005 <iret_exc+753/789> 1: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0027b00a <iret_exc+758/789> 6: e9 f3 be f5 ff jmp fff5befe <_EIP+0xfff5befe> Code; 0027b00f <iret_exc+75d/789> b: 8b 5c 24 20 mov 0x20(%esp),%ebx Code; 0027b013 <iret_exc+761/789> f: 36 c7 03 f2 ff ff ff movl $0xfffffff2,%ss:(%ebx) Code; 0027b01a <iret_exc+768/789> 16: 8b 7c 24 14 mov 0x14(%esp),%edi Code; 0027b01e <iret_exc+76c/789> 1a: 8b 4c 24 18 mov 0x18(%esp),%ecx Code; 0027b022 <iret_exc+770/789> 1e: 31 c0 xor %eax,%eax Code; 0027b024 <iret_exc+772/789> 20: f3 aa repz stos %al,%es:(%edi) Code; 0027b026 <iret_exc+774/789> 22: e9 7c dd ff ff jmp ffffdda3 <_EIP+0xffffdda3> Code; 0027b02b <iret_exc+779/789> 27: 8b 5c 24 24 mov 0x24(%esp),%ebx This decode from eip onwards should be reliable Code; 0027b02f <iret_exc+77d/789> 00000000 <_EIP>: Code; 0027b02f <iret_exc+77d/789> <===== 0: 36 c7 03 f2 ff ff ff movl $0xfffffff2,%ss:(%ebx) <===== Code; 0027b036 <iret_exc+784/789> 7: e9 6c dd ff ff jmp ffffdd78 <_EIP+0xffffdd78> Code; 0027b03b <_etext+0/185fc5> c: 00 00 add %al,(%eax) Code; 0027b03d <_etext+2/185fc5> e: 00 00 add %al,(%eax) Code; 0027b03f <_etext+4/185fc5> 10: 00 .byte 0x0 Code; 0027b040 <_etext+5/185fc5> 11: b2 1f mov $0x1f,%dl Jul 10 13:50:53 determinist EIP: [<0027b02f>] iret_exc+0x77d/0x789 SS:ESP 0068:df89db8c

by **zakalwe** » Mon Jul 10, 2006 10:49 am

Disabling "Prevent invalid userland pointer dereference" in pax options has seemed to fix this.

I think it happened after (or during) the loading of the iptables rules from my firewall script.

by **PaX Team** » Mon Jul 10, 2006 1:20 pm

zakalwe wrote:oops during system start. Pax and grsecurity enabled.
Code: Select all
determinist ~ # ksymoops -K -v /usr/src/linux/vmlinux < ./oops.txt ksymoops 2.4.11 on i686 2.6.16.2-grsec.

try the new patch for 2.6.17.4.

by **zakalwe** » Mon Jul 10, 2006 1:35 pm

I'm running the ksymoops on an oops generated by grsecurity-2.1.9-2.6.17.4-200607091322.patch.

Sorry should have made that clear

by **PaX Team** » Mon Jul 10, 2006 2:46 pm

zakalwe wrote:I'm running the ksymoops on an oops generated by grsecurity-2.1.9-2.6.17.4-200607091322.patch.

Sorry should have made that clear

i hopefully fixed in the latest PaX patch, you can interdiff test7 and test8 and apply that to grsec if you want to test it before spender updates grsec.

by **zakalwe** » Mon Jul 10, 2006 4:16 pm

tried the new pax patch and it crashed again. It locked up hard with another oops shortly after this one. Didn't get to capture it, but will try if necessary.

Code: Select all: ksymoops -K -v /usr/src/linux/vmlinux < ./oops.txt ksymoops 2.4.11 on i686 2.6.17.4. Options used -v /usr/src/linux/vmlinux (specified) -K (specified) -l /proc/modules (default) -o /lib/modules/2.6.17.4/ (default) -m /usr/src/linux/System.map (default) No modules in ksyms, skipping objects No ksyms, skipping lsmod Jul 10 20:32:36 determinist CPU: 0 Jul 10 20:32:36 determinist EIP: 0060:[<0027b023>] Not tainted VLI Using defaults from ksymoops -t elf32-i386 -a i386 Jul 10 20:32:36 determinist EFLAGS: 00010282 (2.6.17.4-grsec #6) Jul 10 20:32:36 determinist eax: 00278d7a ebx: 00000000 ecx: 00000000 edx: 5bcd6c40 Jul 10 20:32:36 determinist esi: 00000040 edi: dfa7d470 ebp: df7ddbcc esp: df7ddb90 Jul 10 20:32:36 determinist ds: 007b es: 0068 ss: 0068 Jul 10 20:32:36 determinist Stack: 5bcd6c00 00000044 001dc656 5bcd6c00 dfa7d42c 00000044 00000000 df7ddbbc Jul 10 20:32:36 determinist 00000000 00000000 00000000 00000000 dfa60da0 df7dde8c dfa7d42c df7ddbf8 Jul 10 20:32:36 determinist 0021a9ab dfa7d42c df7dde8c 00000000 00000044 df7ddbe8 00000000 0000004c Jul 10 20:32:36 determinist Call Trace: Jul 10 20:32:36 determinist <0000599f> die+0xef/0x200 <00005b37> do_trap+0x87/0xd0 Jul 10 20:32:36 determinist <000060dd> do_stack_segment+0x7d/0x90 <00004fbf> error_code+0x5f/0x70 Jul 10 20:32:36 determinist <0021a9ab> ip_generic_getfrag+0x4b/0xc0 <0021b112> ip_append_data+0x6f2/0xa10 Jul 10 20:32:36 determinist <002363c1> udp_sendmsg+0x341/0x690 <0023d776> inet_sendmsg+0x46/0x50 Jul 10 20:32:36 determinist <001d508f> sock_sendmsg+0xbf/0xf0 <001d6708> sys_sendto+0x108/0x140 Jul 10 20:32:36 determinist <001d712f> sys_socketcall+0x18f/0x240 <00003ef7> syscall_call+0x7/0xb Jul 10 20:32:36 determinist Code: ff 6a 00 17 e9 b3 99 f5 ff ba f2 ff ff ff e9 b3 9a f5 ff bf f2 ff ff ff e9 ce be f5 ff ba f2 ff ff ff e9 e3 be f5 ff 8b 5c 2 Error (Oops_code_values): invalid value 0x2 in Code line, must be 2, 4, 8 or 16 digits, value ignored >>EIP; 0027b023 <iret_exc+761/789> <===== >>eax; 00278d7a <csum_partial_copy_generic+c7/10d> >>edx; 5bcd6c40 <phys_startup_32+5b8d5c40/bfd00000> >>edi; dfa7d470 <pg0+1edc3470/3f055000> >>ebp; df7ddbcc <pg0+1eb23bcc/3f055000> >>esp; df7ddb90 <pg0+1eb23b90/3f055000> Trace; 0000599f <die+ef/200> Trace; 000060dd <do_stack_segment+7d/90> Trace; 0021a9ab <ip_generic_getfrag+4b/c0> Trace; 002363c1 <udp_sendmsg+341/690> Trace; 001d508f <sock_sendmsg+bf/f0> Trace; 001d712f <sys_socketcall+18f/240> Code; 0027b023 <iret_exc+761/789> 00000000 <_EIP>: Code; 0027b023 <iret_exc+761/789> <===== 0: ff 6a 00 ljmp *0x0(%edx) <===== Code; 0027b026 <iret_exc+764/789> 3: 17 pop %ss Code; 0027b027 <iret_exc+765/789> 4: e9 b3 99 f5 ff jmp fff599bc <_EIP+0xfff599bc> Code; 0027b02c <iret_exc+76a/789> 9: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0027b031 <iret_exc+76f/789> e: e9 b3 9a f5 ff jmp fff59ac6 <_EIP+0xfff59ac6> Code; 0027b036 <iret_exc+774/789> 13: bf f2 ff ff ff mov $0xfffffff2,%edi Code; 0027b03b <iret_exc+779/789> 18: e9 ce be f5 ff jmp fff5beeb <_EIP+0xfff5beeb> Code; 0027b040 <iret_exc+77e/789> 1d: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0027b045 <iret_exc+783/789> 22: e9 e3 be f5 ff jmp fff5bf0a <_EIP+0xfff5bf0a> Code; 0027b04a <iret_exc+788/789> 27: 8b 5c 00 00 mov 0x0(%eax,%eax,1),%ebx Jul 10 20:32:36 determinist EIP: [<0027b023>] iret_exc+0x761/0x789 SS:ESP 0068:df7ddb90 Warning (Oops_read): Code line not seen, dumping what data is available >>EIP; 0027b023 <iret_exc+761/789> <===== 1 warning and 1 error issued. Results may not be reliable.

by **zakalwe** » Mon Jul 10, 2006 4:23 pm

i should note that this crash is with "Prevent invalid userland pointer dereference" enabled.

by **zakalwe** » Mon Jul 10, 2006 5:06 pm

Ok, crashed in the same way with "Prevent invalid userland pointer dereference" disabled.

This is from grsecurity latest patch + the interdiff from paxtest 7/8.

Code: Select all: determinist ~ # ksymoops -K -v /usr/src/linux/vmlinux < ./oops2.txt ksymoops 2.4.11 on i686 2.6.17.4. Options used -v /usr/src/linux/vmlinux (specified) -K (specified) -l /proc/modules (default) -o /lib/modules/2.6.17.4/ (default) -m /usr/src/linux/System.map (default) No modules in ksyms, skipping objects No ksyms, skipping lsmod Jul 10 21:28:22 determinist BUG: unable to handle kernel NULL pointer dereference at virtual address 00000000 Jul 10 21:28:22 determinist 0027a993 Jul 10 21:28:22 determinist *pgd = 0 Jul 10 21:28:22 determinist Oops: 0002 [#1] Jul 10 21:28:22 determinist CPU: 0 Jul 10 21:28:22 determinist EIP: 0060:[<0027a993>] Not tainted VLI Using defaults from ksymoops -t elf32-i386 -a i386 Jul 10 21:28:22 determinist EFLAGS: 00010282 (2.6.17.4-grsec #7) Jul 10 21:28:22 determinist eax: 002786ea ebx: 00000000 ecx: 00000000 edx: 5eb97ea0 Jul 10 21:28:22 determinist esi: 00000040 edi: c16ff670 ebp: df679bc4 esp: df679b88 Jul 10 21:28:22 determinist ds: 007b es: 0068 ss: 0068 Jul 10 21:28:22 determinist Stack: 5eb97e70 00000044 001dbfc6 5eb97e70 c16ff62c 00000044 00000000 df679bb4 Jul 10 21:28:22 determinist 00000000 00000000 00000000 00000000 df53f7c0 df679e84 c16ff62c df679bf0 Jul 10 21:28:22 determinist 0021a31b c16ff62c df679e84 00000000 00000044 df679be0 00000000 0000004c Jul 10 21:28:22 determinist Call Trace: Jul 10 21:28:22 determinist <00004f2f> error_code+0x5f/0x70 <0021a31b> ip_generic_getfrag+0x4b/0xc0 Jul 10 21:28:22 determinist <0021aa82> ip_append_data+0x6f2/0xa10 <00235d31> udp_sendmsg+0x341/0x690 Jul 10 21:28:22 determinist <0023d0e6> inet_sendmsg+0x46/0x50 <001d4abf> sock_sendmsg+0xbf/0xf0 Jul 10 21:28:22 determinist <001d6078> sys_sendto+0x108/0x140 <001d6a9f> sys_socketcall+0x18f/0x240 Jul 10 21:28:22 determinist <00003e67> syscall_call+0x7/0xb Jul 10 21:28:22 determinist Code: ff 6a 00 17 e9 73 9a f5 ff ba f2 ff ff ff e9 73 9b f5 ff bf f2 ff ff ff e9 ce be f5 ff ba f2 ff ff ff e9 e3 be f5 ff 8b 5c 24 20 <36> c7 03 f2 ff ff ff 8b 7c 24 14 8b 4c 24 18 31 c0 f3 aa e9 7e >>EIP; 0027a993 <iret_exc+761/789> <===== >>eax; 002786ea <csum_partial_copy_generic+c7/10d> >>edx; 5eb97ea0 <phys_startup_32+5e796ea0/bfd00000> >>edi; c16ff670 <pg0+a45670/3f055000> >>ebp; df679bc4 <pg0+1e9bfbc4/3f055000> >>esp; df679b88 <pg0+1e9bfb88/3f055000> Trace; 00004f2f <error_code+5f/70> Trace; 0021aa82 <ip_append_data+6f2/a10> Trace; 0023d0e6 <inet_sendmsg+46/50> Trace; 001d6078 <sys_sendto+108/140> Trace; 00003e67 <syscall_call+7/b> This architecture has variable length instructions, decoding before eip is unreliable, take these instructions with a pinch of salt. Code; 0027a968 <iret_exc+736/789> 00000000 <_EIP>: Code; 0027a968 <iret_exc+736/789> 0: ff 6a 00 ljmp *0x0(%edx) Code; 0027a96b <iret_exc+739/789> 3: 17 pop %ss Code; 0027a96c <iret_exc+73a/789> 4: e9 73 9a f5 ff jmp fff59a7c <_EIP+0xfff59a7c> Code; 0027a971 <iret_exc+73f/789> 9: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0027a976 <iret_exc+744/789> e: e9 73 9b f5 ff jmp fff59b86 <_EIP+0xfff59b86> Code; 0027a97b <iret_exc+749/789> 13: bf f2 ff ff ff mov $0xfffffff2,%edi Code; 0027a980 <iret_exc+74e/789> 18: e9 ce be f5 ff jmp fff5beeb <_EIP+0xfff5beeb> Code; 0027a985 <iret_exc+753/789> 1d: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0027a98a <iret_exc+758/789> 22: e9 e3 be f5 ff jmp fff5bf0a <_EIP+0xfff5bf0a> Code; 0027a98f <iret_exc+75d/789> 27: 8b 5c 24 20 mov 0x20(%esp),%ebx This decode from eip onwards should be reliable Code; 0027a993 <iret_exc+761/789> 00000000 <_EIP>: Code; 0027a993 <iret_exc+761/789> <===== 0: 36 c7 03 f2 ff ff ff movl $0xfffffff2,%ss:(%ebx) <===== Code; 0027a99a <iret_exc+768/789> 7: 8b 7c 24 14 mov 0x14(%esp),%edi Code; 0027a99e <iret_exc+76c/789> b: 8b 4c 24 18 mov 0x18(%esp),%ecx Code; 0027a9a2 <iret_exc+770/789> f: 31 c0 xor %eax,%eax Code; 0027a9a4 <iret_exc+772/789> 11: f3 aa repz stos %al,%es:(%edi) Code; 0027a9a6 <iret_exc+774/789> 13: e9 .byte 0xe9 Code; 0027a9a7 <iret_exc+775/789> 14: 7e .byte 0x7e Jul 10 21:28:22 determinist EIP: [<0027a993>] iret_exc+0x761/0x789 SS:ESP 0068:df679b88 Warning (Oops_read): Code line not seen, dumping what data is available >>EIP; 0027a993 <iret_exc+761/789> <===== 1 warning issued. Results may not be reliable.

by **PaX Team** » Mon Jul 10, 2006 5:44 pm

zakalwe wrote:Ok, crashed in the same way with "Prevent invalid userland pointer dereference" disabled.

This is from grsecurity latest patch + the interdiff from paxtest 7/8.

i tried to figure out what happened here but i just can't put it together, the stack dump doesn't correspond to the backtrace, one indicates the UDP recvmsg side, the other the sendmsg side, that's quite mutually exclusive... did you do a make clean before recompiling the kernel? also, can you try the PaX patch itself?

by **zakalwe** » Mon Jul 10, 2006 5:48 pm

Yea, i did a make clean and make mrproper, copied the config back and ran make again each time. i'll try the latest pax by its self now from a cleanly unpacked kernel.

by **zakalwe** » Mon Jul 10, 2006 6:30 pm

Ok, more or less the same thing. Maybe ksymoops is of no use and is just misleading?

2.6.17.4 + paxtest 8

Code: Select all: determinist ~ # ksymoops -K -v /usr/src/linux-2.6.17/vmlinux -m /usr/src/linux-2.6.17/System.map < ./oops3.txt ksymoops 2.4.11 on i686 2.6.17.4. Options used -v /usr/src/linux-2.6.17/vmlinux (specified) -K (specified) -l /proc/modules (default) -o /lib/modules/2.6.17.4/ (default) -m /usr/src/linux-2.6.17/System.map (specified) No modules in ksyms, skipping objects No ksyms, skipping lsmod Jul 10 23:52:06 determinist CPU: 0 Jul 10 23:52:06 determinist EIP: 0060:[<0026dc53>] Not tainted VLI Using defaults from ksymoops -t elf32-i386 -a i386 Jul 10 23:52:06 determinist EFLAGS: 00010282 (2.6.17.4 #1) Jul 10 23:52:06 determinist eax: 0026b9aa ebx: 00000000 ecx: 00000000 edx: 5cb663c0 Jul 10 23:52:06 determinist esi: 00000040 edi: dfb9d070 ebp: df539bac esp: df539b70 Jul 10 23:52:06 determinist ds: 007b es: 0068 ss: 0068 Jul 10 23:52:06 determinist Stack: 5cb66390 00000044 001cf5b6 5cb66390 dfb9d02c 00000044 00000000 df539b9c Jul 10 23:52:06 determinist 00000000 00000000 00000000 00000000 df8ffc60 df539e6c dfb9d02c df539bd8 Jul 10 23:52:06 determinist 0020d90b dfb9d02c df539e6c 00000000 00000044 df539bc8 00000000 0000004c Jul 10 23:52:06 determinist Call Trace: Jul 10 23:52:06 determinist <0000598f> die+0xef/0x200 <00005b27> do_trap+0x87/0xd0 Jul 10 23:52:06 determinist <000060cd> do_stack_segment+0x7d/0x90 <00004faf> error_code+0x5f/0x70 Jul 10 23:52:06 determinist <0020d90b> ip_generic_getfrag+0x4b/0xc0 <0020e072> ip_append_data+0x6f2/0xa10 Jul 10 23:52:06 determinist <001c80ff> sock_sendmsg+0xbf/0xf0 <001c9668> sys_sendto+0x108/0x140 Jul 10 23:52:06 determinist <001ca08f> sys_socketcall+0x18f/0x240 <00003ee7> syscall_call+0x7/0xb Jul 10 23:52:06 determinist Code: ff 6a 00 17 e9 f3 9d f5 ff ba f2 ff ff ff e9 f3 9e f5 ff bf f2 ff ff ff e9 fe c1 f5 ff ba f2 ff ff ff e9 13 c2 f5 ff 8b 5c 2 Error (Oops_code_values): invalid value 0x2 in Code line, must be 2, 4, 8 or 16 digits, value ignored >>EIP; 0026dc53 <iret_exc+761/789> <===== >>eax; 0026b9aa <csum_partial_copy_generic+c7/10d> >>edx; 5cb663c0 <phys_startup_32+5c7653c0/bfd00000> >>edi; dfb9d070 <pg0+1ef05070/3f077000> >>ebp; df539bac <pg0+1e8a1bac/3f077000> >>esp; df539b70 <pg0+1e8a1b70/3f077000> Trace; 0000598f <die+ef/200> Trace; 000060cd <do_stack_segment+7d/90> Trace; 0020d90b <ip_generic_getfrag+4b/c0> Trace; 001c80ff <sock_sendmsg+bf/f0> Trace; 001ca08f <sys_socketcall+18f/240> Code; 0026dc53 <iret_exc+761/789> 00000000 <_EIP>: Code; 0026dc53 <iret_exc+761/789> <===== 0: ff 6a 00 ljmp *0x0(%edx) <===== Code; 0026dc56 <iret_exc+764/789> 3: 17 pop %ss Code; 0026dc57 <iret_exc+765/789> 4: e9 f3 9d f5 ff jmp fff59dfc <_EIP+0xfff59dfc> Code; 0026dc5c <iret_exc+76a/789> 9: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0026dc61 <iret_exc+76f/789> e: e9 f3 9e f5 ff jmp fff59f06 <_EIP+0xfff59f06> Code; 0026dc66 <iret_exc+774/789> 13: bf f2 ff ff ff mov $0xfffffff2,%edi Code; 0026dc6b <iret_exc+779/789> 18: e9 fe c1 f5 ff jmp fff5c21b <_EIP+0xfff5c21b> Code; 0026dc70 <iret_exc+77e/789> 1d: ba f2 ff ff ff mov $0xfffffff2,%edx Code; 0026dc75 <iret_exc+783/789> 22: e9 13 c2 f5 ff jmp fff5c23a <_EIP+0xfff5c23a> Code; 0026dc7a <iret_exc+788/789> 27: 8b 5c 00 00 mov 0x0(%eax,%eax,1),%ebx Jul 10 23:52:06 determinist EIP: [<0026dc53>] iret_exc+0x761/0x789 SS:ESP 0068:df539b70 Warning (Oops_read): Code line not seen, dumping what data is available >>EIP; 0026dc53 <iret_exc+761/789> <===== 1 warning and 1 error issued. Results may not be reliable.

by **PaX Team** » Tue Jul 11, 2006 5:31 am

zakalwe wrote:Ok, more or less the same thing. Maybe ksymoops is of no use and is just misleading?

ksymoops is ok, my brain was not, test9 should work.

by **zakalwe** » Tue Jul 11, 2006 8:14 am

yep, looks like it is working with "Prevent invalid userland pointer dereference" now.

grsecurity forums

2.6.17.4-grsec oops

2.6.17.4-grsec oops

Re: 2.6.17.4-grsec oops