Antivir triggers kernel bug in 11.1

buugmenot · May 28, 2009, 10:52pm

Hi all,

I am using openSuse 11.1 as 64 bit version and noticed a kernel bug. I verrified this scenario on a second system.

Configuration:

System: OpenSuse 11.1
Arch: X86-64
Kernel: 2.6.27.21-0.1-default
affected kernel modules: redirfs dazuko
application: avguard (antivr 7.9.0.180)

If I load the above kernle modules “redirfs” and “dazuko” for antivirus scanning the system works fine. But at the moment I start the avguard daemon the system has problems in distinguishing files and directories. This means “cd”-command treat files as directories, typing “cd <filename>” gives no error message “not a directory”.

Afterwards, if you try listing that directory or perform a “cat .” the redir kernel module crashes with an invalid opcode exception.

Dmesg shows the following result:

kernel BUG at /usr/src/packages/BUILD/dazuko-2.3.6/obj/default/redirfs/rfs_inode.c:306!
invalid opcode: 0000 [1] SMP
last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
CPU 1
Modules linked in: dazuko(N) redirfs(N) xt_tcpudp xt_pkttype ipt_LOG xt_limit autofs4 snd_pcm_oss snd_mixer_oss snd_seq_midi snd_seq_midi_event snd_seq af_packet xt_NOTRACK ipt_REJECT xt_state iptable_raw iptable_filter nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_conntrack ip_tables ip6_tables x_tables vboxdrv(N) fuse loop dm_mod joydev snd_intel8x0 snd_ac97_codec snd_mpu401 rtc_cmos snd_mpu401_uart ppdev rtc_core ac97_bus snd_rawmidi usbhid snd_pcm i2c_nforce2 button usb_storage sr_mod rtc_lib ns558 k8temp(N) parport_pc snd_seq_device nvidia(PN) snd_timer e1000e snd snd_page_alloc gameport pcspkr hid forcedeth i2c_core parport ff_memless soundcore cdrom sg floppy ehci_hcd ohci_hcd sd_mod crc_t10dif usbcore edd reiserfs fan ide_pci_generic amd74xx ide_core ata_generic pata_amd sata_nv libata scsi_mod dock thermal processor thermal_sys hwmon
Supported: No
Pid: 4912, comm: ls Tainted: P 2.6.27.21-0.1-default #1
RIP: 0010:<ffffffffa0c4921b>] <ffffffffa0c4921b>] rfs_lookup+0xbf/0x17f [redirfs]
RSP: 0018:ffff88006e187c08 EFLAGS: 00010206
RAX: 0000000000008000 RBX: ffff88006e48b740 RCX: 0000000000000206
RDX: 0000000000000003 RSI: ffff88006e5a6150 RDI: ffff880071cd5860
RBP: ffff880067c97738 R08: 0000000000000001 R09: ffffffff805ccf26
R10: ffff88006e48b740 R11: ffffffff80331730 R12: ffff880071cd5860
R13: ffff88006e187e68 R14: ffff88006e5a6150 R15: ffff88006e187e68
FS: 00007fa2a78546f0(0000) GS:ffff88007fbcc540(0000) knlGS:00000000f7db36c0
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f35af9558f0 CR3: 000000006e10c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ls (pid: 4912, threadinfo ffff88006e186000, task ffff88006e066340)
Stack: 0000000000000206 ffffffff8049e1c2 0000004000000000 0000000000000296
ffff88006e125002 fffffffffffffff4 ffff88006e187d28 ffff88006e5a38a0
ffff88006e48b7f8 ffffffff802c33d4 fffffffffffffff4 ffff88006e5a6150
Call Trace:
<ffffffff802b8470>] real_lookup+0x7e/0x10f
<ffffffff802b8564>] do_lookup+0x63/0xb6
<ffffffff802ba541>] __link_path_walk+0x370/0xd68
<ffffffff802bb104>] path_walk+0x5e/0xb9
<ffffffff802bb2c1>] do_path_lookup+0x162/0x1b9
<ffffffff802bb370>] __path_lookup_intent_open+0x58/0x94
<ffffffff802bbef0>] do_filp_open+0x9f/0x7e1
<ffffffff802afaf5>] do_sys_open+0x48/0xc5
<ffffffff8020bfbb>] system_call_fastpath+0x16/0x1b
<00007f35af9634f7>] 0x7f35af9634f7

Code: 00 48 89 1c 24 48 89 e2 48 89 74 24 30 48 89 74 24 38 4c 89 74 24 08 4c 89 6c 24 10 49 8b 3c 24 e8 8f 1c 00 00 85 c0 74 06 eb 36 <0f> 0b eb fe 48 8b 45 18 48 85 c0 74 20 48 8b 40 08 48 85 c0 74
RIP <ffffffffa0c4921b>] rfs_lookup+0xbf/0x17f [redirfs]
RSP <ffff88006e187c08>
— end trace 01c3b74cfb69dce3 ]—

Can anybody confirm this bug? I cannot reproduce this bug on a 32 bit installation with the same configuration.

Best regards,
Paul

Chrysantine · May 28, 2009, 11:15pm

I cannot reproduce it (since I’m running i586’s in a VM) but please report the flaw via the Novell Bugzilla at https://bugzilla.novell.com and include all the information you have here.

Thanks :>

Akoellh · May 28, 2009, 11:32pm

Potential Problem before reporting:

nvidia**(PN)**

You are using a Proprietary, Non supported kernel module (which will mark the kernel as “tainted”), so before reporting this bug, make sure these modules are not loaded (i.e. run your test in Runlevel 3 with nvidia not loaded or remove the nvidia-driver completely), otherwise you might get this as (one of) the first answers, because kernel debugging on a “tainted” kernel is rather useless (and it is most likely, the maintainers will refuse to do so).

buugmenot · May 29, 2009, 12:01am

Hi Akoellh,

you are right, I have forgotten to test it without third party modules which taint the kernel.

A fresh boot without these modules gives the same result:

------------ cut here ]------------
kernel BUG at /usr/src/packages/BUILD/dazuko-2.3.6/obj/default/redirfs/rfs_inode.c:306!
invalid opcode: 0000 [1] SMP
last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
CPU 1
Modules linked in: dazuko(N) redirfs(N) xt_tcpudp xt_pkttype ipt_LOG xt_limit autofs4 snd_pcm_oss snd_mixer_oss snd_seq_midi snd_seq_midi_event snd_seq af_packet xt_NOTRACK ipt_REJECT xt_state iptable_raw iptable_filter nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_conntrack ip_tables ip6_tables x_tables fuse loop dm_mod joydev snd_intel8x0 snd_ac97_codec snd_mpu401 snd_mpu401_uart ac97_bus usbhid snd_rawmidi snd_pcm snd_seq_device usb_storage button ppdev hid snd_timer snd rtc_cmos rtc_core rtc_lib ns558 gameport pcspkr e1000e snd_page_alloc i2c_nforce2 forcedeth ff_memless parport_pc parport soundcore i2c_core sr_mod cdrom sg floppy sd_mod ohci_hcd ehci_hcd crc_t10dif usbcore edd reiserfs fan ide_pci_generic amd74xx ide_core ata_generic pata_amd sata_nv libata scsi_mod dock thermal processor thermal_sys hwmon
Supported: No
Pid: 4643, comm: cat Tainted: G 2.6.27.21-0.1-default #1
RIP: 0010:<ffffffffa034421b>] <ffffffffa034421b>] rfs_lookup+0xbf/0x17f [redirfs]
RSP: 0018:ffff8800379d3c08 EFLAGS: 00010206
RAX: 0000000000008000 RBX: ffff8800730e00d0 RCX: 0000000010921000
RDX: 0000000000000003 RSI: ffff8800755f1cb0 RDI: ffff8800749b3e00
RBP: ffff8800730e1738 R08: ffff88007f8779e0 R09: 0000000000000286
R10: 000000000006ddd4 R11: 0000000000000001 R12: ffff8800749b3e00
R13: ffff8800379d3e68 R14: ffff8800755f1cb0 R15: ffff8800379d3e68
FS: 00007f5fe8def6f0(0000) GS:ffff88007fbcc540(0000) knlGS:00000000f7e436c0
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000402000 CR3: 0000000074968000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process cat (pid: 4643, threadinfo ffff8800379d2000, task ffff88007d84a240)
Stack: 0000000000000296 ffff8800379d3d28 ffff8800379d3e68 0000000000000296
ffff88007346b000 fffffffffffffff4 ffff8800379d3d28 ffff88007303cbe0
ffff8800730e0188 ffffffff802c33d4 fffffffffffffff4 ffff8800755f1cb0
Call Trace:
<ffffffff802b8470>] real_lookup+0x7e/0x10f
<ffffffff802b8564>] do_lookup+0x63/0xb6
<ffffffff802baad5>] __link_path_walk+0x904/0xd68
<ffffffff802bb104>] path_walk+0x5e/0xb9
<ffffffff802bb2c1>] do_path_lookup+0x162/0x1b9
<ffffffff802bb370>] __path_lookup_intent_open+0x58/0x94
<ffffffff802bbef0>] do_filp_open+0x9f/0x7e1
<ffffffff802afaf5>] do_sys_open+0x48/0xc5
<ffffffff8020bfbb>] system_call_fastpath+0x16/0x1b
<00007f5fe8975af0>] 0x7f5fe8975af0

Code: 00 48 89 1c 24 48 89 e2 48 89 74 24 30 48 89 74 24 38 4c 89 74 24 08 4c 89 6c 24 10 49 8b 3c 24 e8 8f 1c 00 00 85 c0 74 06 eb 36 <0f> 0b eb fe 48 8b 45 18 48 85 c0 74 20 48 8b 40 08 48 85 c0 74
RIP <ffffffffa034421b>] rfs_lookup+0xbf/0x17f [redirfs]
RSP <ffff8800379d3c08>
— end trace 0cea9b587db378b9 ]—

By the way, reporting bugs using the novell bug tracker is a mess. First of all the the registration procedure with a lot of personal data. Furthermore the bug tracker is really slow :-(.

Best regards,
Paul

user · May 29, 2009, 10:56am

Hi,
could you please try the actual redirfs trunk version? There are some fixes that could soulve your problem. You can check it out with the following command:

$ svn co http://www.redirfs.org/svn/redirfs/trunk/src/redirfs

For more info please see INSTALL file. If you want to help to solve this or you want more info, please post an e-mail to the redirfs-devel mailing list.

-FH

buugmenot · June 3, 2009, 7:33pm

Compiling the svn version of redirfs among open suse kernel sources works fine. But dazuko also needs to be recompiled because the redirfs interface seems to have been changed (unresolved symbols).

Compiling dazuko fails because of missing source files and further errors. Next week I can check this issue more detailed.

But can anybody try to reproduce the described issue on his own system?

Best regards,
Paul