Freeing unused kernel memory (360 k). I can use keyboard but it does nothing except echoing back to screen.
It fails when executed normally, and also when executed in qemu.
How can I provide more data for testing?
I used same config as with previous 2.6.17.x + grsec only using some new options (that where not available before).
I didn't yet tested with vanilla 2.6.18.
Amd 64 2800 1 GHz RAM.
==== EDITED ====
I tried to run it in qemu as described
on http://fabrice.bellard.free.fr/qemu/qemu-doc.html#SEC29
the result is
- Code: Select all
l# qemu -snapshot -hda /dev/hda -kernel /boot/vmlinuz-2.6.18-grsec-a+gr-k8r-mem31+3rd -append "root=/dev/hda8" -s -p 2259
Could not open '/dev/kqemu' - QEMU acceleration layer not activated
Waiting gdb connection on port 2259
root@lore:/home/raf256# gdb /boot/vmlinuz-2.6.18-grsec-a+gr-k8r-mem31+3rd
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"..."/boot/vmlinuz-2.6.18-grsec-a+gr-k8r-mem31+3rd": not in executable format: File format not recognized
(gdb) target remote localhost:2259
localhost:2259: Connection refused.
(gdb) target remote localhost:2259
Remote debugging using localhost:2259
0x00008801 in ?? ()
(gdb) c
Continuing.
Program received signal SIGINT, Interrupt.
0xc01c1b12 in ?? ()
(gdb) bt
#0 0xc01c1b12 in ?? ()
(gdb) info reg
eax 0x0 0
ecx 0xc1136c20 -1055691744
edx 0xc1026fc0 -1056804928
ebx 0xc112ea00 -1055725056
esp 0xc114be70 0xc114be70
ebp 0xc137e8f8 0xc137e8f8
esi 0x46 70
edi 0xc137e8f8 -1053300488
eip 0xc01c1b12 0xc01c1b12
eflags 0x97 [ CF PF AF SF ]
cs 0x60 96
ss 0x68 104
ds 0x68 104
es 0x68 104
fs 0x0 0
gs 0x33 51
(gdb) x/10i $eip
0xc01c1b12: mov %edi,0x10(%ebx,%eax,4)
0xc01c1b16: inc %eax
0xc01c1b17: mov %eax,(%ebx)
0xc01c1b19: push %esi
0xc01c1b1a: popf
0xc01c1b1b: mov (%esp),%ebx
0xc01c1b1e: mov 0x4(%esp),%esi
0xc01c1b22: mov 0x8(%esp),%edi
0xc01c1b26: add $0xc,%esp
0xc01c1b29: ret
(gdb) set architecture i8086
The target architecture is assumed to be i8086
(gdb) quit
The program is running. Exit anyway? (y or n) y
root@lore:/home/raf256# clear
root@lore:/home/raf256# gdb /boot/vmlinuz-2.6.18-grsec-a+gr-k8r-mem31+3rd qemu
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"..."/boot/vmlinuz-2.6.18-grsec-a+gr-k8r-mem31+3rd": not in executable format: File format not recognized
/home/raf256/qemu: No such file or directory.
(gdb) target remote localhost:2259
Remote debugging using localhost:2259
0xc018c703 in ?? ()
(gdb) c
Continuing.
Program received signal SIGINT, Interrupt.
0xc018674f in ?? ()
(gdb) bt
#0 0xc018674f in ?? ()
(gdb) info reg
eax 0xc137a8f8 -1053316872
ecx 0xc112ea00 -1055725056
edx 0x20 32
ebx 0xc11495b0 -1055615568
esp 0xc114be60 0xc114be60
ebp 0xc1149a3c 0xc1149a3c
esi 0x20 32
edi 0xb 11
eip 0xc018674f 0xc018674f
eflags 0x2 [ ]
cs 0x60 96
ss 0x68 104
ds 0x68 104
es 0x68 104
fs 0x0 0
gs 0x33 51
(gdb) x/10i $eip
0xc018674f: test %eax,%eax
0xc0186751: mov %eax,%ecx
0xc0186753: je 0xc018678b
0xc0186755: mov %eax,(%ecx)
0xc0186757: mov %eax,0x4(%ecx)
0xc018675a: movl $0x0,0x8(%eax)
0xc0186761: mov 0x198(%ebx),%eax
0xc0186767: incl (%eax)
0xc0186769: mov %eax,0x8c(%ecx)
0xc018676f: mov %ecx,%eax
(gdb) c
Continuing.
Program received signal SIGINT, Interrupt.
0xc03aaed9 in ?? ()
(gdb) info reg
eax 0x4 4
ecx 0x0 0
edx 0xc114a000 -1055612928
ebx 0x82 130
esp 0xc114be28 0xc114be28
ebp 0xc137a8f8 0xc137a8f8
esi 0xc0745380 -1066118272
edi 0xc114bedc -1055605028
eip 0xc03aaed9 0xc03aaed9
eflags 0x46 [ PF ZF ]
cs 0x60 96
ss 0x68 104
ds 0x68 104
es 0x68 104
fs 0x0 0
gs 0x33 51
(gdb) x/10i $eip
0xc03aaed9: mov %ecx,%eax
0xc03aaedb: ret
0xc03aaedc: lea 0x0(%esi),%esi
0xc03aaee0: mov %esp,%eax
0xc03aaee2: and $0xffffe000,%eax
0xc03aaee7: decl 0x14(%eax)
0xc03aaeea: mov 0x8(%eax),%eax
0xc03aaeed: xor %cl,%cl
0xc03aaeef: test $0x8,%al
0xc03aaef1: je 0xc03aaed9
(gdb) c
Continuing.
Program received signal SIGINT, Interrupt.
0xc01874a3 in ?? ()
(gdb) info reg
eax 0x0 0
ecx 0xc11495b0 -1055615568
edx 0x0 0
ebx 0xb 11
esp 0xc114be60 0xc114be60
ebp 0xc114bebc 0xc114bebc
esi 0xc1149a24 -1055614428
edi 0xc11495b0 -1055615568
eip 0xc01874a3 0xc01874a3
eflags 0x82 [ SF ]
cs 0x60 96
ss 0x68 104
ds 0x68 104
es 0x68 104
fs 0x0 0
gs 0x33 51
(gdb) x/10i $eip
0xc01874a3: test %eax,%eax
0xc01874a5: mov %eax,%ebx
0xc01874a7: je 0xc01874f4
0xc01874a9: cmp $0x1f,%ebx
0xc01874ac: jle 0xc01874d0
0xc01874ae: mov 0x8(%ebp),%eax
0xc01874b1: xor %ax,%ax
0xc01874b4: cmp $0x10000,%eax
0xc01874b9: je 0xc0187510
0xc01874bb: mov %ebx,%eax
. FYI, years ago when i ported PaX to 2.6, i happened to have that buggy glibc (without knowing it at the time) and it took me quite some time to debug the problem (init would hang) to figure it's glibc to blame. this was the reason actually for the (now removed) NOVSYSCALL feature in PaX (vs. randomizing the vDSO).