segfault in ksymoops

From: Jerome de Vivie
Date: Thu Sep 04 2003 - 16:23:14 EST



Jerome de Vivie wrote:
>
> I have try ksymoops v2.4.9, v2.4.8 & v2.4.7 and each time i get a
> segmentation fault. Here's the output: (the oops file is attached).
>
> I use this configuration:
> -binutils 2.13.90.0.20 20030319
> -gcc version 3.2.2
> -libc-2.2.5
>
> Could you help me ?
>
> regards,
>
> j.
>
> ~/dev/kernelspace >ksymoops -v /usr/src/linux/vmlinux < oops
> ksymoops 2.4.9 on i686 2.4.21. Options used
> -v /usr/src/linux/vmlinux (specified)
> -k /proc/ksyms (default)
> -l /proc/modules (default)
> -o /lib/modules/2.4.21/ (default)
> -m /usr/src/linux/System.map (default)
>
> invalid operand: 0000
> CPU: 0
> EIP: 0010:[<c011ec37>] Not tainted
> Using defaults from ksymoopsSegmentation fault
>
> --
> Jérôme de Vivie
>
> ------------------------------------------------------------------------
> invalid operand: 0000
> CPU: 1
> EIP: 0010:[<c011ec37>] Not tainted
> EFLAGS: 00010286
> eax: 00000026 ebx: dffface0 ecx: 00000092 edx: df113f7c
> esi: defc500b edi: 00000000 ebp: dbe2bf98 esp: dbe2bf1c
> ds: 0018 es: 0018 ss: 0018
> Process ls (pid: 727, stackpage=dbe2b000)
> Stack: c0298ce0 000000f8 c014f7d9 000000f8 ded103a0 00000000 00000008 df4dad80
> ded103a0 defc5007 00000004 01aa954b bffffb9a dbe2bf98 defc5000 00000000
> 00000008 c014f9e9 defc5000 defc5000 dbe2bf98 c014fd39 bffffb9a 00000077
> Call Trace: [<c014f7d9>] [<c014f9e9>] [<c014fd39>] [<c014be5f>] [<c0107713>]
>
> Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4 26 00 00 00 00 8d bc


Here's more details and logs from previous problem:


~/ksymoops-2.4.9 >./ksymoops ~/projet/kernelspace/oops
ksymoops 2.4.9 on i686 2.4.21. Options used
-V (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.4.21/ (default)
-m /usr/src/linux/System.map (default)

Warning: You did not tell me where to find symbol information. I will
assume that the log matches the kernel and modules that are running
right now and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc. ksymoops -h explains the options.

invalid operand: 0000
CPU: 0
EIP: 0010:[<c011ec37>] Not tainted
Using defaults from ksymoopsSegmentation fault (core dumped)
~/ksymoops-2.4.9 >gdb ./ksymoops core
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "i686-pc-linux-gnu"...
Core was generated by `./ksymoops /home/jerome/projet/kernelspace/oops'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libbfd-2.13.90.0.20.so...done.
Loaded symbols for /usr/lib/libbfd-2.13.90.0.20.so
Reading symbols from /lib/i686/libc.so.6...done.

Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0 0x42080b1b in strlen () from /lib/i686/libc.so.6
(gdb) bt full
#0 0x42080b1b in strlen () from /lib/i686/libc.so.6
No symbol table info available.
#1 0x42051e4d in vfprintf () from /lib/i686/libc.so.6
No symbol table info available.
#2 0x420551d8 in buffered_vfprintf () from /lib/i686/libc.so.6
No symbol table info available.
#3 0x42050347 in vfprintf () from /lib/i686/libc.so.6
No symbol table info available.
#4 0x4205a1dc in printf () from /lib/i686/libc.so.6
No symbol table info available.
#5 0x0804e3d1 in Oops_set_default_ta (me=0x82fd5c8 "./ksymoops",
ibfd=0x83157f8, options=0xbffff8c0) at oops.c:89
procname = "Oops_set_default_ta"
bt = 0x736b2f2e <Address 0x736b2f2e out of bounds>
bai = (const struct bfd_arch_info *) 0x4008c9a0
t = 1
a = 1
#6 0x0804f1d3 in Oops_set_eip (value=0x831fbe0 "c011ec37",
eip=0xbffff860, ss=0xbffff830,
me=0x82fd5c8 "./ksymoops", ibfd=0x83157f8, options=0xbffff8c0) at
oops.c:500
procname = "Oops_set_eip"
eip_name = "\0\0\0\0\001\0\0\0y\020"
p = 0x83212b8 "Àß\022BÀß\022B¸ß\022B¸ß\022B"
#7 0x08052fb0 in Oops_read (options=0xbffff8c0) at oops.c:2414
ret_addr = 0x0
---Type <return> to continue, or q <return> to quit---
line = 0x8321050 "EIP: 0010:[<c011ec37>] Not tainted"
string = (char **) 0x82a0690
me = 0x82fd5c8 "./ksymoops"
start = 0x831fbe0 "c011ec37"
text = 0x8321050 "EIP: 0010:[<c011ec37>] Not tainted"
i = -1073743720
size = 50
lineno = 3
lastprint = 3
print = 1
eip = 0
sparc_regdump = 0
f = (struct _IO_FILE *) 0x82a0b48
ss_format = {source = 0x8313448 "Oops log data", used = 0, alloc
= 0, symbol = 0x0, related = 0x0,
object = 0x0, mtime = 0}
ibfd = (struct _bfd *) 0x83157f8
procname = "Oops_read"
#8 0x0804c054 in main (argc=2, argv=0xbffff9a4) at ksymoops.c:778
spec_h = 0
ret = -1073743544
options = {vmlinux = 0x0, object = 0x805ae88, objects = 1, ksyms
= 0x8056926 "/proc/ksyms",
lsmod = 0x8056932 "/proc/modules", system_map = 0x805695d
"/usr/src/linux/System.map", save_system_map = 0x0,
filename = 0xbffff9ac, filecount = 0, short_lines = 1, endianess = 0,
hex = 1, one_shot = 0,
---Type <return> to continue, or q <return> to quit---
ignore_insmod_path = 0, ignore_insmod_all = 0, truncate = 0,
target = 0x736b2f2e <Address 0x736b2f2e out of bounds>, architecture =
0x4008708f "i386", adhoc_addresses = 0x0,
address_bits = 0, vli = 0}
procname = "main"
#9 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
No symbol table info available.
===============================================================================









Then, i ve try to set arch and target (even if i don't use cross
compilation):
Here's what i get:















~/ksymoops-2.4.9 >./ksymoops -t elf32-i386 -a i386
~/projet/kernelspace/oops
ksymoops 2.4.9 on i686 2.4.21. Options used
-V (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.4.21/ (default)
-m /usr/src/linux/System.map (default)
-t elf32-i386 -a i386

Warning: You did not tell me where to find symbol information. I will
assume that the log matches the kernel and modules that are running
right now and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc. ksymoops -h explains the options.

invalid operand: 0000
CPU: 0
EIP: 0010:[<c011ec37>] Not tainted
EFLAGS: 00010286
eax: 00000026 ebx: c1590f20 ecx: 00000000 edx: debf3f7c
esi: df0f500c edi: 00000000 ebp: daf6df98 esp: daf6df1c
ds: 0018 es: 0018 ss: 0018
Process ls (pid: 776, stackpage=daf6d000)
Stack: c0298ce0 000000f8 c014f7d9 000000f8 debfbde0 00000004 00000008
ded91040
debfbde0 df0f5007 00000004 01aa954b bffffb94 daf6df98 df0f5000
00000000
00000008 c014f9e9 df0f5000 df0f5000 daf6df98 c014fd39 bffffb94
00000077
Call Trace: [<c014f7d9>] [<c014f9e9>] [<c014fd39>] [<c014be5f>]
[<c0107713>]
Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4 26 00 00 00 00 8d bc
Segmentation fault (core dumped)


~/ksymoops-2.4.9 >gdb ./ksymoops core
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "i686-pc-linux-gnu"...
Core was generated by `./ksymoops -t elf32-i386 -a i386
/home/jerome/projet/kernelspace/oops'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libbfd-2.13.90.0.20.so...done.
Loaded symbols for /usr/lib/libbfd-2.13.90.0.20.so
Reading symbols from /lib/i686/libc.so.6...done.
Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0 0x082a0b48 in ?? ()
(gdb) set args -t elf32-i386 -a i386
/home/jerome/projet/kernelspace/oops
(gdb) bt full
#0 0x082a0b48 in ?? ()
No symbol table info available.
#1 0x0804e7fa in Oops_code_to_file (code=0xbffff780 "\017\v\215",
size=64, ibfd=0x83157f8, options=0xbffff8a0)
at oops.c:210
file = 0x83220b0 "/tmp/ksymoops.9J839I"
tmpdir = 0x8057680 "/tmp"
fd = 4
obfd = (struct _bfd *) 0x83220d0
bai = (const struct bfd_arch_info *) 0x4008c9a0
temp_suffix = "/ksymoops.XXXXXX"
procname = "Oops_code_to_file"
#2 0x080524fc in Oops_decode_part (code=0xbffff780 "\017\v\215",
code_size=64, eip=3222400055, adjust=0,
type=67 'C', ss=0xbffff810, string=0xbffff868, string_max=300,
ibfd=0x83157f8, options=0xbffff8a0)
at oops.c:2212
f = (struct _IO_FILE *) 0x1
file = 0x829a2f0 ""
line = 0x0
size = 0
lines = 0
procname = "Oops_decode_part"
#3 0x080527b8 in Oops_decode (code_text=0x83218b8 "0f 0b 8d 00 06 8d 29
c0 90 eb fe 8d b4 26 00 00 00 00 8d bc",
eip=3222400055, ss=0xbffff810, string=0xbffff868, string_max=300,
ibfd=0x83157f8, options=0xbffff8a0)
at oops.c:2250
code = "\017\v\215\0\006\215)À\220ëþ\215´&\0\0\0\0\215¼", '\0'
<repeats 43 times>
adjust = 0
procname = "Oops_decode"
#4 0x080533c6 in Oops_read (options=0xbffff8a0) at oops.c:2458
line = 0x8321940 "Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4
26 00 00 00 00 8d bc "
string = (char **) 0x82a0690
me = 0x82fd5c8 "./ksymoops"
start = 0x83218b8 "0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4 26 00
00 00 00 8d bc"
text = 0x8321940 "Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4
26 00 00 00 00 8d bc "
i = -1073743752
size = 90
lineno = 14
lastprint = 14
print = 1
eip = 3222400055
sparc_regdump = 0
f = (struct _IO_FILE *) 0x82a0b48
ss_format = {source = 0x8313448 "Oops log data", used = 14,
alloc = 20, symbol = 0x8321d08, related = 0x0,
object = 0x0, mtime = 0}
ibfd = (struct _bfd *) 0x83157f8
procname = "Oops_read"
#5 0x0804c054 in main (argc=6, argv=0xbffff984) at ksymoops.c:778
spec_h = 0
ret = -1073743576
options = {vmlinux = 0x0, object = 0x805ae88, objects = 1, ksyms
= 0x8056926 "/proc/ksyms",
lsmod = 0x8056932 "/proc/modules", system_map = 0x805695d
"/usr/src/linux/System.map", save_system_map = 0x0,
filename = 0xbffff99c, filecount = 0, short_lines = 1, endianess = 0,
hex = 1, one_shot = 0,
ignore_insmod_path = 0, ignore_insmod_all = 0, truncate = 0, target =
0xbffffab4 "elf32-i386",
architecture = 0xbffffac2 "i386", adhoc_addresses = 0x0, address_bits
= 32, vli = 0}
procname = "main"
#6 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
No symbol table info available.
(gdb) b oops.c:210
Breakpoint 1 at 0x804e7da: file oops.c, line 210.
(gdb) s
The program is not being run.
(gdb) r
Starting program: /home/jerome/ksymoops-2.4.9/ksymoops -t elf32-i386 -a
i386 /home/jerome/projet/kernelspace/oops
ksymoops 2.4.9 on i686 2.4.21. Options used
-V (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.4.21/ (default)
-m /usr/src/linux/System.map (default)
-t elf32-i386 -a i386

Warning: You did not tell me where to find symbol information. I will
assume that the log matches the kernel and modules that are running
right now and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc. ksymoops -h explains the options.

invalid operand: 0000
CPU: 0
EIP: 0010:[<c011ec37>] Not tainted
EFLAGS: 00010286
eax: 00000026 ebx: c1590f20 ecx: 00000000 edx: debf3f7c
esi: df0f500c edi: 00000000 ebp: daf6df98 esp: daf6df1c
ds: 0018 es: 0018 ss: 0018
Process ls (pid: 776, stackpage=daf6d000)
Stack: c0298ce0 000000f8 c014f7d9 000000f8 debfbde0 00000004 00000008
ded91040
debfbde0 df0f5007 00000004 01aa954b bffffb94 daf6df98 df0f5000
00000000
00000008 c014f9e9 df0f5000 df0f5000 daf6df98 c014fd39 bffffb94
00000077
Call Trace: [<c014f7d9>] [<c014f9e9>] [<c014fd39>] [<c014be5f>]
[<c0107713>]
Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4 26 00 00 00 00 8d bc

Breakpoint 1, Oops_code_to_file (code=0xbffff770 "\017\v\215", size=64,
ibfd=0x8317e60, options=0xbffff890)
at oops.c:210
210 if (!Oops_write_bfd_data(ibfd, obfd, code, size))
(gdb) s
Oops_write_bfd_data (ibfd=0x8317e60, obfd=0x83220d0, code=0xbffff770
"\017\v\215", size=64) at oops.c:104
104 if (!(isec = bfd_get_section_by_name((bfd *)ibfd, ".text")))
{
(gdb) s
108 if (!bfd_set_start_address(obfd, 0)) {
(gdb) s
112 if (!(osec = bfd_make_section(obfd, ".text"))) {
(gdb) s
116 if (!bfd_set_section_flags(obfd, osec,
(gdb) s
121 if (!bfd_set_section_alignment(obfd, osec,
(gdb) s
126 osec->output_section = osec;
(gdb) s
127 if (!(osym = bfd_make_empty_symbol(obfd))) {
(gdb) s

Program received signal SIGSEGV, Segmentation fault.
0x082a0b48 in ?? ()
(gdb) The program is running. Exit anyway? (y or n) y
~/ksymoops-2.4.9 >
=============================================================================

I didn't go further in the search. Could you help me ?

regards,

j.


--
Jérôme de Vivieinvalid operand: 0000
CPU: 0
EIP: 0010:[<c011ec37>] Not tainted
EFLAGS: 00010286
eax: 00000026 ebx: c1590f20 ecx: 00000000 edx: debf3f7c
esi: df0f500c edi: 00000000 ebp: daf6df98 esp: daf6df1c
ds: 0018 es: 0018 ss: 0018
Process ls (pid: 776, stackpage=daf6d000)
Stack: c0298ce0 000000f8 c014f7d9 000000f8 debfbde0 00000004 00000008 ded91040
debfbde0 df0f5007 00000004 01aa954b bffffb94 daf6df98 df0f5000 00000000
00000008 c014f9e9 df0f5000 df0f5000 daf6df98 c014fd39 bffffb94 00000077
Call Trace: [<c014f7d9>] [<c014f9e9>] [<c014fd39>] [<c014be5f>] [<c0107713>]

Code: 0f 0b 8d 00 06 8d 29 c0 90 eb fe 8d b4 26 00 00 00 00 8d bc