Re: bad pmd ffff810000207808(9090909090909090).

[Willy Tarreau]

On Tue, May 06, 2008 at 09:52:58PM +0900, OGAWA Hirofumi wrote:
> Jan Engelhardt <jengelh@xxxxxxxxxx> writes:
> 
> > On Tuesday 2008-05-06 14:00, OGAWA Hirofumi wrote:
> >
> >>I've found today the following error in syslog. It seems have a strange
> >>pattern. And it also happened at a month ago.
> >>
> >>Any idea for debuging this?
> >>
> >
> > 90 is NOP on x86, perhaps something got rooted?
> 
> I see. I'm not sure, but I didn't notice this soon, maybe it worked as
> almost usual.

I got immediate same feeling as Jan here. It looks very much like someone
has tried to inject code into your system. The problem is that you don't
know if this finally succeeded. Maybe some backdoor is now installed in
your kernel. If I were you, I would isolate the machine, reboot it on CD
and check MD5s (particularly the ones of the kernel and modules) before
rebooting it.

Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/