Re: local DDOS? Kernel panic when accessing /proc/ioports

[Martin Loschwitz <madkiss@madkiss.org>]

[-- Attachment #1: Type: text/plain, Size: 2237 bytes --]

On Fri, Aug 05, 2005 at 03:33:44PM -0700, Andrew Morton wrote:
> Martin Loschwitz <madkiss@madkiss.org> wrote:
> >
> > On Fri, Aug 05, 2005 at 03:40:26PM -0400, linux-os (Dick Johnson) wrote:
> > > 
> > > On Fri, 5 Aug 2005, Martin Loschwitz wrote:
> > > 
> > > > Hi folks,
> > > >
> > > > I just ran into the following problem: Having updated my box to 2.6.12.3,
> > > > I tried to start YaST2 and noticed a kernel panic (see below). Some quick
> > > > debugging brought the result that the kernel crashes while some user (not
> > > > even root ...) tries to access /proc/ioports. Is this a known problem and
> > > > if so, is a fix available?
> > > >
> > > > Ooops and ksymoops-output is attached.
> > > >
> > > 
> > > This can happen if a module is unloaded that doesn't free its
> > > resources! Been there, done that.
> > > 
> > 
> > "This can happen" is not an acceptable explanation, I think.
> 
> It's a very accurate one though.
> 
> The most common cause of this bug is that some buggy kernel module has been
> unloaded.  It forgot to release its I/O region.  When you later come along
> to look in /proc/ioports the kernel goes to fetch information from the
> memory which is "owned" by the module which isn't there any more.  Crash.
> 
> So if you can identify which kernel module was loaded and then unloaded,
> we'll fix it up.

uhm -- well, okay, once again: If you boot knoppix with the "debug" argument,
it will start init but throw you on a very limited shell called "ash" right
after that. At least the "cat" command is included in that shell, and lsmod 
is available as well.

I am pretty sure that until that very early moment, not a single module has
been unloaded -- infact, "rmmod" is not even called in the init script until
that moment. The only modules loaded were:

sbp2 ohci1394 usb_storage ub ehci_hcd usbcore

And that's it. So if you suspect some module to be the culprit, it must be
one of these.

-- 
  .''`.   Martin Loschwitz           Debian GNU/Linux developer
 : :'  :  madkiss@madkiss.org        madkiss@debian.org
 `. `'`   http://www.madkiss.org/    people.debian.org/~madkiss/
   `-     Use Debian GNU/Linux 3.0!  See http://www.debian.org/

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]