Re: [Devil-Linux-discuss] Warning: kernel 3.2.35-36 grsec and vsftpd kernel panic

[Bruce S. <bw...@re...>]

You can try the DL Server version to confirm it's grsec.

 - BS



On Fri, Jan 18, 2013 at 9:13 AM, Andrzej Odyniec <an...@ma...>wrote:

> Dears,
>
> be carefull if you use vsftpd on DL compiled with grsec. Do not upgrade to
> last version (1.6.3, kernel 3.2.35). Probably problem is in grsec. In
> moment
> of first ftp transmission efect is following:
>
> > BUG: unable to handle kernel NULL pointer dereference at 00000020
> > IP: [<c013f967>] dup_mm+0x247/0x4e0
> > *pdpt = 0000000004bfe001 *pde = 0000000000000000
> > Oops: 0000 [#1] SMP
> > Modules linked in: tun xt_connbytes act_mirred ip6table_filter ifb
> act_police ...
> >
> > Pid: 3683, comm: vsftpd Tainted: G           O 3.2.35-grsec #1
>        /DQ67SW
> > EIP: 0060:[<c013f967>] EFLAGS: 00210286 CPU: 1
> > EAX: f38fa5c0 EBX: eaaf52a0 ECX: e48e1a80 EDX: 00000000
> > ESI: f505932c EDI: e48e1adc EBP: f37e30c0 ESP: c517becc
> >  DS: 0068 ES: 0068 FS: 00d8 GS: 00e0 SS: 0068
> > Process vsftpd (pid: 3683, ti=f36fc2b0 task=f36fc030 task.ti=f36fc2b0)
> > Stack:
> >  00200202 f3bc5900 e48e1a80 00000000 00000000 f3bc5938 f37e30f8 f37e30c0
> >  f37e30c4 00000000 f36fc030 f36fc030 ea52d420 fffffff4 ea59e688 01200011
> >  c014070a 00000000 c517bf5c bf395060 c517bfb4 ea52d6a4 ea52d54c 00000000
> > Call Trace:
> >  [<c014070a>] ? copy_process+0xb0a/0xdd0
> >  [<c0140a62>] ? do_fork+0x92/0x270
> >  [<c04b6938>] ? sys_socketcall+0x148/0x350
> >  [<c01125c0>] ? sys_clone+0x30/0x40
> >  [<c0590085>] ? ptregs_clone+0x15/0x20
> >  [<c058f2cc>] ? syscall_call+0x7/0xb
> > Code: 46 50 81 66 1c ff df ff ff c7 46 10 00 00 00 00 85 c0 c7 46 0c 00
> 00 00 00 c7 46 58 00 00 00 00 74 4b 8b 50 0c 8b b0 84 00 00 00 <8b> 52 20
> f0 ff 40 1c 8b 7c 24 08 f6 47 1d 08 74 07 f0 ff 8a b8
> > EIP: [<c013f967>] dup_mm+0x247/0x4e0 SS:ESP 0068:c517becc
> > CR2: 0000000000000020
> > ---[ end trace e5446380ef6aad88 ]---
> > 0ef6aad88 ]---
>
> and kernel stops.
>
> Problem is known here:
> http://forums.grsecurity.net/viewtopic.php?t=3230&p=12453 and issue is
> present
> in 3.2.36 too. From today is accessible new patch 3.2.37 so probably grsec
> author works on new grsec patch.
>
> Best Regards
>
> Andrzej Odyniec
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
> _______________________________________________
> Devil-linux-discuss mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss
>