Here's the relevant spot from System.map:
vmlinux:00123e88 T sys_chmod
vmlinux:00123f38 T sys_fchown <<-- In there (not that it matters)
vmlinux:00124088 T sys_chown
vmlinux:001242e8 T get_unused_fd
vmlinux:00124358 T put_unused_fd
As far as I can see, the stackpointer got totally corrupted. In several
different processes (cron, trying to fork, and telnetd, just forked from
inetd). The stacktrace is pretty meaningless, therefore.
As you can see below (assembly included), it jumps in the *middle*
of an instruction, the ESP has gone haywire, the EBP seems to be correct.
414:open.c **** if (((inode->i_mode & (S_ISGID | S_IXGRP)) == (S
_ISGID | S_IXGRP))) {
2332 .stabd 68,0,414
2333 08f9 668B4308 movw 8(%ebx),%ax
2334 08fd 66250804 andw $1032,%ax
2335 0901 663D0804 cmpw $1032,%ax
2336 0905 750A jne L1365
415:open.c **** newattrs.ia_mode &= ~S_ISGID;
2337 .stabd 68,0,415
2338 0907 668165E8 andw $64511,-24(%ebp)
^^
^^<<<<<<<<<<<<<--------------- EIP = HERE
2338 FFFB
^LGAS LISTING open.s page 54
416:open.c **** newattrs.ia_valid |= ATTR_MODE;
2339 .stabd 68,0,416
2340 090d 804DE401 orb $1,-28(%ebp)
2341 L1365:
417:open.c **** }
418:open.c **** inode->i_dirt = 1;
2342 .stabd 68,0,418
2343 0911 C6437D01 movb $1,125(%ebx)
419:open.c **** if (inode->i_sb && inode->i_sb->dq_op) {
Jul 19 11:46:00 gatekeeper kernel: stack segment: 0000
Jul 19 11:46:00 gatekeeper kernel: CPU: 0
Jul 19 11:46:00 gatekeeper kernel: EIP: 0010:[<00124000>]
Jul 19 11:46:00 gatekeeper kernel: EFLAGS: 00010292
Jul 19 11:46:00 gatekeeper kernel: eax: 00123c18 ebx: 00ca2414 ecx: 00000000 edx: ffff0ff0
Jul 19 11:46:00 gatekeeper kernel: esi: 0000006e edi: 00010fe0 ebp: bffff960 esp: 00e21fb8
Jul 19 11:46:00 gatekeeper kernel: ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Jul 19 11:46:00 gatekeeper kernel: Process cron (pid: 4118, process nr: 25, stackpage=00e21000)
Jul 19 11:46:00 gatekeeper kernel: Stack: 0010a972 00010f85 00000000 0000ffac 0000006e 00010fe0 bffff960 ffffffda
Jul 19 11:46:00 gatekeeper kernel: 0000002b 0000002b 0000002b 0000002b 0000000c 6000a0b6 00100023 00000246
Jul 19 11:46:00 gatekeeper kernel: bffff95c 0009002b
Jul 19 11:46:00 gatekeeper kernel: Call Trace: [<0010a972>]
Jul 19 11:46:00 gatekeeper kernel: Code: 81 65 e8 ff fb 80 4d e4 01 c6 43 7d 01 8b 43 40 85 c0 74 54
Jul 19 11:47:00 gatekeeper kernel: stack segment: 0000
Jul 19 11:47:00 gatekeeper kernel: CPU: 0
Jul 19 11:47:00 gatekeeper kernel: EIP: 0010:[<00124000>]
Jul 19 11:47:00 gatekeeper kernel: EFLAGS: 00010282
Jul 19 11:47:00 gatekeeper kernel: eax: 00123c18 ebx: 00fe0810 ecx: ffffffff edx: ffff0ff0
Jul 19 11:47:00 gatekeeper kernel: esi: 0000006e edi: 00010fe0 ebp: bffff960 esp: 00968fb8
Jul 19 11:47:00 gatekeeper kernel: ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Jul 19 11:47:00 gatekeeper kernel: Process cron (pid: 4130, process nr: 12, stackpage=00968000)
Jul 19 11:47:00 gatekeeper kernel: Stack: 0010a972 00010f85 00000000 0000ffac 0000006e 00010fe0 bffff960 ffffffda
Jul 19 11:47:00 gatekeeper kernel: 0000002b 0000002b 0000002b 0000002b 0000000c 6000a0b6 00100023 00000246
Jul 19 11:47:00 gatekeeper kernel: bffff95c 0009002b
Jul 19 11:47:00 gatekeeper kernel: Call Trace: [<0010a972>]
Jul 19 11:47:00 gatekeeper kernel: Code: 81 65 e8 ff fb 80 4d e4 01 c6 43 7d 01 8b 43 40 85 c0 74 54
It goes on and on, like this, and there's another one:
Jul 19 16:33:12 gatekeeper kernel: Process in.telnetd (pid: 7692, process nr: 10, stackpage=00af1000)
Jul 19 16:33:12 gatekeeper kernel: Stack: 0010a972 00009208 00000180 00000000 ffffffff bffffcec bffff9f8 ffffffda
Jul 19 16:33:12 gatekeeper kernel: 0000002b 600a002b 0001002b 0000002b 0000000f 6000a0e1 00100023 00000246
Jul 19 16:33:12 gatekeeper kernel: bffff9f4 0009002b
Jul 19 16:33:12 gatekeeper kernel: Call Trace: [<0010a972>]
Jul 19 16:33:12 gatekeeper kernel: Code: 81 65 e8 ff fb 80 4d e4 01 c6 43 7d 01 8b 43 40 85 c0 74 54
Jul 19 16:34:00 gatekeeper kernel: stack segment: 0000
Jul 19 16:34:00 gatekeeper kernel: CPU: 0
Jul 19 16:34:00 gatekeeper kernel: EIP: 0010:[<00124000>]
Jul 19 16:34:00 gatekeeper kernel: EFLAGS: 00010212
Jul 19 16:34:00 gatekeeper kernel: eax: 00123c18 ebx: 007d8810 ecx: ffffffff edx: ffff0ff0
Jul 19 16:34:00 gatekeeper kernel: esi: 0000006e edi: 00010fe0 ebp: bffff960 esp: 007c9fb8
Jul 19 16:34:00 gatekeeper kernel: ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
#
# Automatically generated by make menuconfig: don't edit
#
#
# Code maturity level options
#
CONFIG_EXPERIMENTAL=y
#
# Loadable module support
#
CONFIG_MODULES=y
# CONFIG_MODVERSIONS is not set
# CONFIG_KERNELD is not set
#
# General setup
#
# CONFIG_MATH_EMULATION is not set
CONFIG_NET=y
# CONFIG_MAX_16M is not set
CONFIG_PCI=y
# CONFIG_PCI_OPTIMIZE is not set
CONFIG_SYSVIPC=y
CONFIG_BINFMT_AOUT=y
CONFIG_BINFMT_ELF=y
# CONFIG_BINFMT_JAVA is not set
# CONFIG_KERNEL_ELF is not set
CONFIG_M486=y
#
# Floppy, IDE, and other block devices
#
CONFIG_BLK_DEV_FD=y
CONFIG_BLK_DEV_IDE=y
# CONFIG_BLK_DEV_HD_IDE is not set
# CONFIG_BLK_DEV_IDECD is not set
# CONFIG_BLK_DEV_IDETAPE is not set
# CONFIG_BLK_DEV_IDE_PCMCIA is not set
# CONFIG_BLK_DEV_CMD640 is not set
# CONFIG_BLK_DEV_TRITON is not set
# CONFIG_BLK_DEV_RZ1000 is not set
# CONFIG_IDE_CHIPSETS is not set
# CONFIG_BLK_DEV_LOOP is not set
# CONFIG_BLK_DEV_MD is not set
# CONFIG_BLK_DEV_RAM is not set
# CONFIG_BLK_DEV_XD is not set
#
# Networking options
#
CONFIG_FIREWALL=y
CONFIG_NET_ALIAS=y
CONFIG_INET=y
CONFIG_IP_FORWARD=y
# CONFIG_IP_MULTICAST is not set
CONFIG_IP_FIREWALL=y
CONFIG_IP_FIREWALL_VERBOSE=y
CONFIG_IP_MASQUERADE=y
# CONFIG_IP_TRANSPARENT_PROXY is not set
# CONFIG_IP_ALWAYS_DEFRAG is not set
CONFIG_IP_ACCT=y
# CONFIG_IP_ROUTER is not set
# CONFIG_NET_IPIP is not set
CONFIG_IP_ALIAS=y
# CONFIG_INET_PCTCP is not set
# CONFIG_INET_RARP is not set
# CONFIG_NO_PATH_MTU_DISCOVERY is not set
CONFIG_IP_NOSR=y
# CONFIG_SKB_LARGE is not set
# CONFIG_IPX is not set
# CONFIG_ATALK is not set
# CONFIG_AX25 is not set
# CONFIG_NETLINK is not set
#
# SCSI support
#
# CONFIG_SCSI is not set
#
# Network device support
#
CONFIG_NETDEVICES=y
CONFIG_DUMMY=m
# CONFIG_EQUALIZER is not set
# CONFIG_DLCI is not set
# CONFIG_PLIP is not set
# CONFIG_PPP is not set
# CONFIG_SLIP is not set
# CONFIG_NET_RADIO is not set
CONFIG_NET_ETHERNET=y
CONFIG_NET_VENDOR_3COM=y
# CONFIG_EL1 is not set
# CONFIG_EL2 is not set
# CONFIG_ELPLUS is not set
# CONFIG_EL16 is not set
CONFIG_EL3=y
# CONFIG_VORTEX is not set
# CONFIG_LANCE is not set
# CONFIG_NET_VENDOR_SMC is not set
# CONFIG_NET_ISA is not set
# CONFIG_NET_EISA is not set
# CONFIG_NET_POCKET is not set
# CONFIG_TR is not set
# CONFIG_ARCNET is not set
#
# ISDN subsystem
#
# CONFIG_ISDN is not set
#
# CD-ROM drivers (not for SCSI or IDE/ATAPI drives)
#
# CONFIG_CD_NO_IDESCSI is not set
#
# Filesystems
#
CONFIG_QUOTA=y
# CONFIG_LOCK_MANDATORY is not set
# CONFIG_MINIX_FS is not set
# CONFIG_EXT_FS is not set
CONFIG_EXT2_FS=y
# CONFIG_XIA_FS is not set
# CONFIG_FAT_FS is not set
# CONFIG_MSDOS_FS is not set
# CONFIG_VFAT_FS is not set
# CONFIG_UMSDOS_FS is not set
CONFIG_PROC_FS=y
CONFIG_NFS_FS=y
# CONFIG_ROOT_NFS is not set
# CONFIG_SMB_FS is not set
# CONFIG_ISO9660_FS is not set
# CONFIG_HPFS_FS is not set
# CONFIG_SYSV_FS is not set
# CONFIG_AFFS_FS is not set
# CONFIG_UFS_FS is not set
#
# Character devices
#
# CONFIG_SERIAL is not set
# CONFIG_DIGI is not set
# CONFIG_CYCLADES is not set
# CONFIG_STALDRV is not set
# CONFIG_RISCOM8 is not set
# CONFIG_PRINTER is not set
# CONFIG_MOUSE is not set
# CONFIG_UMISC is not set
# CONFIG_QIC02_TAPE is not set
# CONFIG_FTAPE is not set
# CONFIG_APM is not set
CONFIG_WATCHDOG=y
CONFIG_WATCHDOG_NOWAYOUT=y
# CONFIG_WDT is not set
CONFIG_SOFT_WATCHDOG=y
CONFIG_RTC=y
#
# Sound
#
# CONFIG_SOUND is not set
#
# Kernel hacking
#
CONFIG_KDEBUG=y
# CONFIG_PROFILE is not set
--
Sincerely, srb@cuci.nl
Stephen R. van den Berg (AKA BuGless).
A truly wise man never plays leapfrog with a unicorn.