use after free in detach_pid (recurring!)

From: Zwane Mwaikambo (zwane@arm.linux.org.uk)
Date: Wed Aug 06 2003 - 06:21:09 EST

Hi Manfred, ok i think we have a winner here. 2.6.0-test2-mm4 wont even
make it to runlevel 3 (i've rebooted it 5times now). How would you like to
handle this?

Unable to handle kernel paging request at virtual address 6b6b6b6b
 printing eip:
c0137d17
*pde = 00000000
Oops: 0000 [#1]
PREEMPT SMP
CPU: 2
EIP: 0060:[<c0137d17>] Not tainted VLI
EFLAGS: 00010046
EIP is at detach_pid+0x17/0x140
eax: cbbb4d20 ebx: cbbb4e2c ecx: 6b6b6b6b edx: 6b6b6b6b
esi: cbbb4d70 edi: 00000000 ebp: 00000000 esp: ca51df10
ds: 007b es: 007b ss: 0068
Process S90crond (pid: 881, threadinfo=ca51c000 task=ca534060)
Stack: cbbb4d20 00000000 00000000 c0126a01 cbbb4d20 c0126b43 cbbb4d20 cbbb4d20
       cbbb52f4 cbbb4d20 00000374 bfffeea4 c012886c cbbb4d20 cbbb4dd0 cbbb4d20
       ca534060 00000001 c0128c15 cbbb4d20 bfffeea4 00000000 ca51c000 00000001
Call Trace:
 [<c0126a01>] __unhash_process+0x41/0xc0
 [<c0126b43>] release_task+0xc3/0x250
 [<c012886c>] wait_task_zombie+0x1ec/0x200
 [<c0128c15>] sys_wait4+0x165/0x280
 [<c01201c0>] default_wake_function+0x0/0x20
 [<c01201c0>] default_wake_function+0x0/0x20
 [<c04e4897>] syscall_call+0x7/0xb

Code: 51 08 52 e8 6c ae fe ff 58 5b 5e c3 90 8d b4 26 00 00 00 00 57 56 53
89 d3 8d 14 9b 8d 34 d
 <6>note: S90crond[881] exited with preempt_count 2 

-- 
function.linuxpower.ca
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Thu Aug 07 2003 - 22:00:33 EST