Kernel panics at strlcpy() in using sysdig_probe 3rd party module.

Solution Verified - Updated -

Issue

  • Kernel crash with following logs:
    • Example 1 :- BUG: unable to handle kernel NULL pointer dereference at 00000000000001fe
    • Example 2:- BUG: unable to handle kernel paging request at 0000000000002df3

Example 1 :- BUG: unable to handle kernel NULL pointer dereference at 00000000000001fe

BUG: unable to handle kernel NULL pointer dereference at 00000000000001fe
IP: [<ffffffff812a39b5>] strlcpy+0x15/0x60
PGD 77f8f1067 PUD 3bba6f067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 1 
Modules linked in: talpa_vfshook(U) talpa_pedconnector(U) talpa_vcdevice(U) talpa_core(U) talpa_linux(U) talpa_syscallhook(U) tcp_diag inet_diag fuse gc_enforcement(U) sysdig_probe(U) autofs4 nfs fscache auth_rpcgss nfs_acl 8021q garp stp llc lockd sunrpc talpa_pedevice(U) vsock(U) iptable_nat nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack iptable_filter iptable_raw ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 uinput ppdev parport_pc parport microcode vmware_balloon sg i2c_piix4 vmci(U) shpchp ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom vmxnet3 vmw_pvscsi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: talpa_syscallhook]

Pid: 29105, comm: frmcmp_batch Not tainted 2.6.32-696.6.3.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffff812a39b5>]  [<ffffffff812a39b5>] strlcpy+0x15/0x60
....
Call Trace:
 [<ffffffffa0595f63>] val_to_ring+0x243/0x4d0 [sysdig_probe]
 [<ffffffffa05974b5>] ? f_guardig_generic+0x2a5/0x8620 [sysdig_probe]
 [<ffffffffa05988ca>] f_guardig_generic+0x16ba/0x8620 [sysdig_probe]
 [<ffffffff811f9d0a>] ? load_elf_binary+0xba/0x1b70
 [<ffffffffa0593377>] 0xffffffffa0593377
 [<ffffffff81014b39>] ? read_tsc+0x9/0x20
 [<ffffffffa0593864>] 0xffffffffa0593864
 [<ffffffffa0593b77>] 0xffffffffa0593b77
 [<ffffffff81019b80>] syscall_trace_leave+0xe0/0xf0
 [<ffffffff810095f5>] ? sys_execve+0x55/0x80
 [<ffffffff8100b386>] int_check_syscall_exit_work+0x34/0x3d
Code: c6 04 2e 00 49 8d 04 1c 5b 41 5c 41 5d 41 5e c9 c3 0f 0b eb fe 90 55 48 89 f0 48 89 e5 41 55 41 54 49 89 fc 53 31 db 48 83 ec 08 <80> 3e 00 74 15 66 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 48 
RIP  [<ffffffff812a39b5>] strlcpy+0x15/0x60
 RSP <ffff8807505abc00>
CR2: 00000000000001fe

Example 2:- BUG: unable to handle kernel paging request at 0000000000002df3

BUG: unable to handle kernel paging request at 0000000000002df3
IP: [<ffffffff812a7e65>] strlcpy+0x15/0x60
Kernel PGD 800000001d27a067 PUD 88164067 PMD 0 
User   PGD 1d27a067 PUD 88164067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 2 
Modules linked in: gc_enforcement(U) sysdig_probe(U) nfsd exportfs autofs4 nfs lockd fscache auth_rpcgss nfs_acl sunrpc ipv6 vsock(U) ext3 jbd ppdev parport_pc parport microcode e1000 vmware_balloon sg vmxnet3 vmci(U) i2c_piix4 shpchp ext4 jbd2 mbcache sd_mod crc_t10dif mptspi mptscsih mptbase scsi_transport_spi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 71930, comm: package_events_ Not tainted 2.6.32-696.30.1.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffff812a7e65>]  [<ffffffff812a7e65>] strlcpy+0x15/0x60
....
Call Trace:
 [<ffffffffa05d5f73>] val_to_ring+0x243/0x4d0 [sysdig_probe]
 [<ffffffffa05d74e5>] ? f_guardig_generic+0x2a5/0x8620 [sysdig_probe]
 [<ffffffffa05d88fa>] f_guardig_generic+0x16ba/0x8620 [sysdig_probe]
 [<ffffffffa05d337a>] 0xffffffffa05d337a
 [<ffffffff810ee760>] ? audit_filter_rules+0x340/0xd80
 [<ffffffff81013559>] ? read_tsc+0x9/0x20
 [<ffffffffa05d3864>] 0xffffffffa05d3864
 [<ffffffffa05d3b77>] 0xffffffffa05d3b77
 [<ffffffff81018c00>] syscall_trace_leave+0xd0/0xe0
 [<ffffffff810095f5>] ? sys_execve+0x55/0x80
 [<ffffffff8155e6fe>] int_check_syscall_exit_work+0x13/0x1c
Code: c6 04 2e 00 49 8d 04 1c 5b 41 5c 41 5d 41 5e c9 c3 0f 0b eb fe 90 55 48 89 f0 48 89 e5 41 55 41 54 49 89 fc 53 31 db 48 83 ec 08 <80> 3e 00 74 15 66 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 48 
RIP  [<ffffffff812a7e65>] strlcpy+0x15/0x60
 RSP <ffff88000e45bc00>
CR2: 0000000000002df3

Environment

  • Red Hat Enterprise Linux 6
  • sysdig_probe 3rd party module

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content