segfault while reading /proc/<pid>/stat

From: Andrey E. Lerman (lae@uniyar.ac.ru)
Date: Thu Mar 23 2000 - 19:09:57 EST


I got a problem. I logged into my server and found what w, ps,
top and others are all segfault immediately after start. Well,
here is the details:
This host is running Linux 2.2.14. I did a strace on a
problematic utilities and it always ends like this:
....
stat("/proc/19672", {st_mode=0, st_size=0, ...}) = 0
open("/proc/19672/stat", O_RDONLY) = 7
read(7, <unfinished ...>
+++ killed by SIGSEGV +++

I did cd /proc/19672; ls -l -- segfault, cat stat -- segfault.
No good. Well, kill -9 19672 -- nothing, kill -9 again, it
still there. I'm able to list /proc/19672/fd, using that
information I found what 19672 is wget, started recursive to
www.linux.org.ru. That site has a message board and I found a
huge directory structure in /tmp. With some effort (I had to
chroot to the middle of the path) I removed that directory.
But I can't kill the process and even see its status. Other
sysadmins suggested to reboot the damned thing, but I think
this is incorrect. Others suggested to remount /proc, I tried
umount - busy, mount -o remount /proc doesn't change the
situation. I can only guess what somehow very long path have
damaged process information in kernel. In that case this does
indicate a serious problem in linux kernel. The fact is what
absolutely unprivileged user have damaged the linux system enough
so me is wishing to reboot it.

It is still up and functional except for some commands. Load
average is 2.00, where 1 is mersenne primes client.

I'll provide as much information as I can.

PS: I'm not subscribed to linux-kernel, please Cc: all replies
to me.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Mar 23 2000 - 21:00:39 EST