[ossec-dev] [Bug 92] New: Kernel panic after upgrading from 1.2 to 1.3

[ossec-bugzilla@xxxxxxxxxxxxxxxxxxxxxxxxxxx]

http://www.ossec.net/bugs/show_bug.cgi?id=92

           Summary: Kernel panic after upgrading from 1.2 to 1.3
           Product: OSSEC
           Version: 1.3
          Platform: PC
               URL: (none)
        OS/Version: Linux
            Status: NEW
          Severity: blocker
          Priority: P1
         Component: ossec core
        AssignedTo: ossec-dev@xxxxxxxxx
        ReportedBy: risenhoover@xxxxxxxxx


I've been running OSSEC v 1.2 about about six Linux machines without incident
for almost a year.  A few weeks ago I upgraded to 1.3.  In the last ten days, I
have experienced four kernel panics on three different production machines,
causing massive outages across the board. This morning, I had another kernel
panic but this time, I got a log:  (Please note ossec-syschk ) was the process
that was running at the time.

Oct 19 11:39:53 flax kernel: Unable to handle kernel NULL pointer dereference
at virtual address 00000000
Oct 19 11:39:53 flax kernel:  printing eip:
Oct 19 11:39:53 flax kernel: c0190182
Oct 19 11:39:53 flax kernel: *pde = 359c6001
Oct 19 11:39:53 flax kernel: Oops: 0000 [#1]
Oct 19 11:39:53 flax kernel: SMP 
Oct 19 11:39:53 flax kernel: Modules linked in: parport_pc lp parport autofs4
crc32c libcrc32c iscsi_sfnet scsi_transport_iscsi i2c_dev i2c_
core lock_dlm(U) gfs(U) lock_harness(U) dlm(U) cman(U) md5 ipv6 sunrpc button
battery ac joydev ohci_hcd e1000 floppy sg dm_snapshot dm_zero
 dm_mirror ext3 jbd dm_mod ips mptscsih mptsas mptspi mptfc mptscsi mptbase
sd_mod scsi_mod
Oct 19 11:39:53 flax kernel: CPU:    3
Oct 19 11:39:53 flax kernel: EIP:    0060:[<c0190182>]    Not tainted VLI
Oct 19 11:39:53 flax kernel: EFLAGS: 00010246   (2.6.9-55.0.9.ELsmp) 
Oct 19 11:39:53 flax kernel: EIP is at sysfs_readdir+0x123/0x187
Oct 19 11:39:53 flax kernel: eax: 00000000   ebx: c7174ec0   ecx: ffffffff  
edx: 00000000
Oct 19 11:39:53 flax kernel: esi: c7174ec4   edi: 00000000   ebp: e66758c4  
esp: f5ad3f60
Oct 19 11:39:53 flax kernel: ds: 007b   es: 007b   ss: 0068
Oct 19 11:39:53 flax kernel: Process ossec-syscheckd (pid: 4750,
threadinfo=f5ad3000 task=f5f06eb0)
Oct 19 11:39:53 flax kernel: Stack: bff835ac f7e63900 c016baf5 f5ad3fa0
f4e18180 c0332640 f4e18180 f7ddb768 
Oct 19 11:39:53 flax kernel:        c016baf5 c016b771 f5ad3fa0 ffffffda
08b499e4 f4e18180 00000000 c016bdab 
Oct 19 11:39:54 flax kernel:        08b49b2c 08b49b14 00000eb8 ffffffea
00000009 08b499c8 00407ff4 f5ad3000 
Oct 19 11:39:54 flax kernel: Call Trace:
Oct 19 11:39:54 flax kernel:  [<c016baf5>] filldir64+0x0/0x11a
Oct 19 11:39:54 flax kernel:  [<c016baf5>] filldir64+0x0/0x11a
Oct 19 11:39:54 flax kernel:  [<c016b771>] vfs_readdir+0x7d/0xa5
Oct 19 11:39:54 flax kernel:  [<c016bdab>] sys_getdents64+0x80/0xba
Oct 19 11:39:54 flax kernel:  [<c02d64db>] syscall_call+0x7/0xb
Oct 19 11:39:54 flax kernel:  [<c02d007b>] unix_dgram_sendmsg+0x23c/0x45d
Oct 19 11:39:54 flax kernel: Code: 04 89 69 0c 8b 75 00 8b 44 24 04 83 c0 0c 39
c6 74 73 8d 5e fc 83 7b 14 00 74 66 89 d8 e8 07 ec ff ff 89 
c2 83 c9 ff 31 c0 89 d7 <f2> ae f7 d1 49 0f b7 43 1c c1 e8 0c 50 ff 73 20 8b 44
24 18 ff 
Oct 19 11:39:54 flax kernel:  <0>Fatal exception: panic in 5 seconds

Additionally, I have seen at least one other report of somebody experiencing a
kernel panic after upgrading from 1.2 to 1.3 

http://lists.centos.org/pipermail/centos/2007-August/085277.html

I know that ossec is not responsible for developing the kernel, but it seems
pretty clear to me that there is something going on here that needs to be
addressed.

Here's my uname -a:
[root@flax ossec]# uname -a
Linux flax 2.6.9-55.0.9.ELsmp #1 SMP Thu Sep 27 18:27:41 EDT 2007 i686 i686
i386 GNU/Linux


-- 
Configure bugmail: http://www.ossec.net/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.