From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (unknown [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id C98351381FA for ; Thu, 15 May 2014 13:49:15 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 14CB1E0B28; Thu, 15 May 2014 13:49:14 +0000 (UTC) Received: from r00tworld.com (r00tworld.com [212.85.137.150]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3D10CE0B0B for ; Thu, 15 May 2014 13:49:13 +0000 (UTC) Received: from localhost (localhost.localdomain [127.0.0.1]) by r00tworld.com (8.13.1/8.13.1) with ESMTP id s4FDnAKX003283 for ; Thu, 15 May 2014 15:49:10 +0200 Received: from r00tworld.com ([127.0.0.1]) by localhost (r00tworld.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 29321-08 for ; Thu, 15 May 2014 15:49:05 +0200 (CEST) Received: from [192.168.111.1] (x.r00tworld.com [212.85.137.150]) by r00tworld.com (8.13.1/8.13.1) with ESMTP id s4FDn0v2003266 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 15 May 2014 15:49:01 +0200 From: "PaX Team" To: gentoo-hardened@lists.gentoo.org Date: Thu, 15 May 2014 15:48:50 +0200 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-type: Multipart/Mixed; boundary=Message-Boundary-28229 Subject: Re: [gentoo-hardened] Weird coincidental PAX crashes Message-ID: <5374C5C2.9717.8ADE7DC@pageexec.gmail.com> Priority: normal X-mailer: Pegasus Mail for Windows (4.70) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.12 (r00tworld.com [212.85.137.150]); Thu, 15 May 2014 15:49:02 +0200 (CEST) X-Virus-Scanned: r00tworld Anti-Virus System X-Archives-Salt: 01a6495b-5735-4dfe-9c46-f5b2166341d7 X-Archives-Hash: ccf2a844df194940ccf1d9c30c0b02b1 --Message-Boundary-28229 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body On 9 May 2014 at 11:15, Michael Orlitzky wrote: > > [Fri May 9 11:00:42 2014] PAX: refcount overflow detected in: syslog-ng:21823, uid/euid: 0/0 this is the key message, the REFCOUNT feature triggered as it detected an overflow somewhere. > > [Fri May 9 11:00:42 2014] CPU: 2 PID: 21823 Comm: syslog-ng Not tainted 3.11.7-hardened-r1 #1 as a sidenote, this is a very old kernel and it's quite possible that it's a false positive that we fixed since. > > [Fri May 9 11:00:42 2014] Call Trace: > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff81052750 > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff81036e10 > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff810371e8 > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff810449cc > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff8100241f > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff81002a89 > > [Fri May 9 11:00:42 2014] [] ? 0xffffffff8137c212 unfortunately the backtrace is not usable as is due to lack of symbols. if you still have the original vmlinux around (or can reproduce it with all the debug symbols) then i can take a look and perhaps figure out where the refcount overflow was detected (and whether it was a false positive or not). > If it's not hardware (two different machines...), does this look like a > kernel bug? Should I upgrade over the weekend and pray? it's not a hardware issue (at least not directly) but a software one and regardless of it being perhaps a false positive you should be using a newer kernel that we support ;). --Message-Boundary-28229 Content-type: Application/Octet-stream; name="WPM$C81D.PM$"; type=Plain text Content-description: Mail message body Content-disposition: attachment; filename="WPM$C81D.PM$" Content-transfer-encoding: BASE64 T24gOSBNYXkgMjAxNCBhdCAxMToxNSwgTWljaGFlbCBPcmxpdHpreSB3cm90ZToNCg0KPiA+ IFtGcmkgTWF5ICA5IDExOjAwOjQyIDIwMTRdIFBBWDogcmVmY291bnQgb3ZlcmZsb3cgZGV0 ZWN0ZWQgaW46IHN5c2xvZy1uZzoyMTgyMywgdWlkL2V1aWQ6IDAvMA0KDQp0aGlzIGlzIHRo ZSBrZXkgbWVzc2FnZSwgdGhlIFJFRkNPVU5UIGZlYXR1cmUgdHJpZ2dlcmVkIGFzIGl0IGRl dGVjdGVkDQphbiBvdmVyZmxvdyBzb21ld2hlcmUuDQoNCj4gPiBbRnJpIE1heSAgOSAxMTow MDo0MiAyMDE0XSBDUFU6IDIgUElEOiAyMTgyMyBDb21tOiBzeXNsb2ctbmcgTm90IHRhaW50 ZWQgMy4xMS43LWhhcmRlbmVkLXIxICMxDQoNCmFzIGEgc2lkZW5vdGUsIHRoaXMgaXMgYSB2 ZXJ5IG9sZCBrZXJuZWwgYW5kIGl0J3MgcXVpdGUgcG9zc2libGUgdGhhdA0KaXQncyBhIGZh bHNlIHBvc2l0aXZlIHRoYXQgd2UgZml4ZWQgc2luY2UuDQoNCj4gPiBbRnJpIE1heSAgOSAx MTowMDo0MiAyMDE0XSBDYWxsIFRyYWNlOg0KPiA+IFtGcmkgTWF5ICA5IDExOjAwOjQyIDIw MTRdICBbPGZmZmZmZmZmODEwNTI3NTA+XSA/IDB4ZmZmZmZmZmY4MTA1Mjc1MA0KPiA+IFtG cmkgTWF5ICA5IDExOjAwOjQyIDIwMTRdICBbPGZmZmZmZmZmODEwMzZlMTA+XSA/IDB4ZmZm ZmZmZmY4MTAzNmUxMA0KPiA+IFtGcmkgTWF5ICA5IDExOjAwOjQyIDIwMTRdICBbPGZmZmZm ZmZmODEwMzcxZTg+XSA/IDB4ZmZmZmZmZmY4MTAzNzFlOA0KPiA+IFtGcmkgTWF5ICA5IDEx OjAwOjQyIDIwMTRdICBbPGZmZmZmZmZmODEwNDQ5Y2M+XSA/IDB4ZmZmZmZmZmY4MTA0NDlj Yw0KPiA+IFtGcmkgTWF5ICA5IDExOjAwOjQyIDIwMTRdICBbPGZmZmZmZmZmODEwMDI0MWY+ XSA/IDB4ZmZmZmZmZmY4MTAwMjQxZg0KPiA+IFtGcmkgTWF5ICA5IDExOjAwOjQyIDIwMTRd ICBbPGZmZmZmZmZmODEwMDJhODk+XSA/IDB4ZmZmZmZmZmY4MTAwMmE4OQ0KPiA+IFtGcmkg TWF5ICA5IDExOjAwOjQyIDIwMTRdICBbPGZmZmZmZmZmODEzN2MyMTI+XSA/IDB4ZmZmZmZm ZmY4MTM3YzIxMg0KDQp1bmZvcnR1bmF0ZWx5IHRoZSBiYWNrdHJhY2UgaXMgbm90IHVzYWJs ZSBhcyBpcyBkdWUgdG8gbGFjayBvZiBzeW1ib2xzLg0KaWYgeW91IHN0aWxsIGhhdmUgdGhl IG9yaWdpbmFsIHZtbGludXggYXJvdW5kIChvciBjYW4gcmVwcm9kdWNlIGl0IHdpdGgNCmFs bCB0aGUgZGVidWcgc3ltYm9scykgdGhlbiBpIGNhbiB0YWtlIGEgbG9vayBhbmQgcGVyaGFw cyBmaWd1cmUgb3V0DQp3aGVyZSB0aGUgcmVmY291bnQgb3ZlcmZsb3cgd2FzIGRldGVjdGVk IChhbmQgd2hldGhlciBpdCB3YXMgYSBmYWxzZQ0KcG9zaXRpdmUgb3Igbm90KS4NCg0KPiBJ ZiBpdCdzIG5vdCBoYXJkd2FyZSAodHdvIGRpZmZlcmVudCBtYWNoaW5lcy4uLiksIGRvZXMg dGhpcyBsb29rIGxpa2UgYQ0KPiBrZXJuZWwgYnVnPyBTaG91bGQgSSB1cGdyYWRlIG92ZXIg dGhlIHdlZWtlbmQgYW5kIHByYXk/DQoNCml0J3Mgbm90IGEgaGFyZHdhcmUgaXNzdWUgKGF0 IGxlYXN0IG5vdCBkaXJlY3RseSkgYnV0IGEgc29mdHdhcmUgb25lIGFuZA0KcmVnYXJkbGVz cyBvZiBpdCBiZWluZyBwZXJoYXBzIGEgZmFsc2UgcG9zaXRpdmUgeW91IHNob3VsZCBiZSB1 c2luZyBhIG5ld2VyDQprZXJuZWwgdGhhdCB3ZSBzdXBwb3J0IDspLg0K --Message-Boundary-28229--