Subject: Re: Reproducable panic: Digital Unix 4.0B, mrouted.

From: Takashi Ichihara <[email-masked]>
Date: Thu, 26 Jun 1997 18:37:42 JST

Christopher Samuel <[email-masked]> writes:
>Organization: IT Vulnerabilities Group, DERA Malvern, UK
>Date: Fri, 13 Jun 1997 15:13:53 +0100
>Message-Id: <[email-masked]>
>Sender: [email-masked]
>Precedence: bulk
>
>Current situation:
>
>DEC Alpha 500/266, DU 4.0B (with current patch cluster), either shipped
>mrouted or mrouted-3.9-beta2 configured with at least one tunnel.
>OSF1 cray.eris.dera.gov.uk V4.0 564 alpha
>
>Can be reproduced using genvmunix, as well as reconfig'd kernels.
>
>Tools such as mtrace and mrinfo work fine, however as soon as sdr is
>started up on its network it panics with a "kernel memory fault".
>
>Traceback is:
>
>>  0 boot(0x0, 0xfffffc0003eed340, 0x2100000021, 0x6700000021, 0x8)
>     ["../../../../src/kernel/arch/alpha/machdep.c":2484, 0xfffffc0000492dcc]
>   1 panic(s = 0xfffffc0000610190 = "kernel memory fault")
>     ["../../../../src/kernel/bsd/subr_prf.c":791, 0xfffffc000027ac6c]
>   2 trap()
>     ["../../../../src/kernel/arch/alpha/trap.c":1520, 0xfffffc000049ac68]
>   3 _XentMM(0x0, 0xfffffc000029fb30, 0xfffffc000063c110, 0x0,
>     0xfffffc00025a2100)
>     ["../../../../src/kernel/arch/alpha/locore.s":1424, 0xfffffc000048ed34]
>   4 lock_holder(l = (nil))
>     ["../../../../src/kernel/kern/lock.c":1715, 0xfffffc000029fb2c]
>   5 socket_send(s = 0xfffffc0000f12780, mm = 0xfffffc00025a2100,
>     src = 0xfffffc00005fd840)
>     ["../../../../src/kernel/netinet/ip_mroute.c":1204, 0xfffffc000039e850]
>   6 ip_mforward(ip = 0xfffffc000063c110, ifp = 0xfffffc000065f1a8,
>     m = 0xfffffc00025a2100)
>     ["../../../../src/kernel/netinet/ip_mroute.c":1446, 0xfffffc000039ede8]
>   7 ipintr(0xfffffc000039b228, 0xfffffc0000644260, 0xfffffc0000661370,
>     0xfffffc0000643c90, 0xfffffc000069b188)
>     ["../../../../src/kernel/netinet/ip_input.c":797
>     , 0xfffffc000039ba38]
>   8 netisr_thread() ["../../../../src/kernel/net/netisr.c":841,
>     0xfffffc00002b6570]
>
>I suspect that mrouted is tickling a bug in 4.0B that's more general
>than multicasting as I've seen other panic's from unrelated code before
>I started playing with multicast, but this is the first crash-on-demand
>panic I've had.
>
>It goes without saying that I'm going to report this to Digital directly
>as well.
>
>cheers,
>Chris
>-- 
> Christopher Samuel,   IT Vulnerabilities Group,   [email-masked]
> N-115, Defence Research Agency, St Andrews Road, Great Malvern, England, UK
> DISCLAIMER: I write only for myself, not for DRA.    Phone: +44 1684 894644
> +MIME+                           +QMAIL+                              +PGP+

   Hi friend

   I have updated the OS of my alpha workstation (DEC-3600) from 
OSF/1 V3.2A to digital UNIX V4.0B [Rev. 564].  The previous 
mrouted (3.8) was running  successfully under the OSF/1 V3.2A with 
patched kernel which I picked up from chocolate.pa.dec.com. 

   However when I invoked /usr/sbin/mrouted at the Digital UNIX 
V4.0B [Rev. 564], the system suddenly crashed with kernel memory
fault

>Digital UNIX V4.0B  (Rev. 564); Wed Jun 25 14:59:12 JST 1997
>physical memory = 128.00 megabytes.
>available memory = 116.67 megabytes.
>using 483 buffers containing 3.77 megabytes of memory
> :
>trap: invalid memory read access from kernel mode
>
>    faulting virtual address:     0x0000000000000010
>    pc of faulting instruction:   0xfffffc00002a01f0
>    ra contents at time of fault: 0xfffffc000040ed34
>    sp contents at time of fault: 0xffffffff89c5b8e8
>
>panic (cpu 0): kernel memory fault

  The binary image of the mrouted came from Digital UNIX V4.0B
[Rev. 564] distribution CD ROM from DEC. The size, creation date
and MD5 checksum of the mrouted are as follows. 

  % ls -l /usr/sbin/mrouted
  -rwxr-xr-x   1 bin      bin       106496 Nov 16  1996 mrouted

  % md5 mrouted
  MD5 (mrouted) = 2831d6470470ddcccfba6e518f8e7c1d

   The question is how to run the "mrouted" under Digital UNIX
V4.0B without crash.   Did anyone succeed ?

  I also submitted my crash dump to DEC Japan via DEC field 
service  yesterday.

   Takashi Ichihara
   Radiation lab/Accelerator Research Facility
   RIKEN (The Institute of Physical and Chemical Research)

---

From: Christopher Samuel <[email-masked]>
Date: Thu, 26 Jun 1997 16:10:58 +0100

In message <[email-masked]>, 

> V4.0B without crash.   Did anyone succeed ?

I've received the following patch details from DEC (many thanks Ajay).
You'll have to contact your support people in order to obtain it,
but the details are:

# NEW PatchID: 200.00 
# PATCH ID: OSF400-186     SUBSET(s): OSFBIN400 OSFBINOBJECT400
# 
# SUPERSEDED PATCHES:             OSF400-021 (21.00),  OSF400-012 (12.00),
#                                 OSF400-096 (96.00),  OSF400-108 (108.00),
#                                 OSF400-145 (145.00), OSF400-181 (195.00),
#                                 OSF400-182 (196.00) 

I've only just got the details myself, so I've not tried it yet.

Chris

---

From: Christopher Samuel <[email-masked]>
Date: Thu, 26 Jun 1997 17:38:38 +0100

In message <[email-masked]>, 

> I've received the following patch details from DEC (many thanks Ajay).
[munch]

More news:

It would appear that this patch has been incorporated into the latest
jumbo patch containing all published fixes from Digital which I'm now
pulling. It's at:

  ftp://ftp.service.digital.com/public/osf/v4.0b/duv40bas00004-19970609.tar

Be warned though, it's about 34Mb in size!

cheers,
Chris