NULL pointer in proc_pid_stat -- oops.
From: Andrew Reiter
Date: Wed Mar 24 2004 - 16:18:05 EST
Hi,
We've recently been seeing some crashes in the system (2.6.3 SMP,
HIGHMEM64G) that have the basic error message of "kernel: Unable to
handle kernel NULL pointer." I have seen this on a couple of different
kernel configurations, but all crashes occurred on SMP machines with SMP
configured. The process is 'ps' and the EIP is at proc_pid_stat +
141decimal (0x8d). After disassembling array.o (from fs/proc/array.c),
I see the following (full disassem out put attached):
0x000004d4 <proc_pid_stat+124>: test %ecx,%ecx
0x000004d6 <proc_pid_stat+126>: je 0x510 <proc_pid_stat+184>
0x000004d8 <proc_pid_stat+128>: mov 0x98(%ecx),%eax
0x000004de <proc_pid_stat+134>: mov %eax,0x20(%esp,1)
0x000004e2 <proc_pid_stat+138>: mov 0x4(%ecx),%edx
0x000004e5 <proc_pid_stat+141>: movswl 0x64(%edx),%eax
0x000004e9 <proc_pid_stat+145>: movswl 0x66(%edx),%edx
0x000004ed <proc_pid_stat+149>: shl $0x14,%eax
0x000004f0 <proc_pid_stat+152>: or %edx,%eax
0x000004f2 <proc_pid_stat+154>: add 0x8(%ecx),%eax
And from the oops trace output (that is attached), we can see that %edx
is 0x0; so we can easily see here why we're crashing at least. After
examining the C source, I see that we're dying in the call to
task_name() (inline) from proc_pid_stat().
This has occurred a couple of times, mostly after a lot of threads
running and various uptimes of the machine (1 week for first crash we
saw), but I am unable to create a test that reliably causes this crash.
Please let me know how I can help out with figuring out the issue. Like
I mentioned above, attached is the oops dump (from var log messages) and
the disassembly output of proc_pid_stat (from gdb fs/proc/array.o,
disassem proc_pid_stat). If possible, I would like to be CC'd to this
as I am not on the mailing list.
Thanks, ahead of time, for any help.
Cheers,
Andrew
Dump of assembler code for function proc_pid_stat:
0x00000458 <proc_pid_stat+0>: push %ebp
0x00000459 <proc_pid_stat+1>: push %edi
0x0000045a <proc_pid_stat+2>: push %esi
0x0000045b <proc_pid_stat+3>: mov %eax,%esi
0x0000045d <proc_pid_stat+5>: push %ebx
0x0000045e <proc_pid_stat+6>: sub $0x50,%esp
0x00000461 <proc_pid_stat+9>: mov %edx,0x3c(%esp,1)
0x00000465 <proc_pid_stat+13>: mov $0x0,%edx
0x0000046a <proc_pid_stat+18>: movl $0xffffffff,0x20(%esp,1)
0x00000472 <proc_pid_stat+26>: movl $0x0,0x1c(%esp,1)
0x0000047a <proc_pid_stat+34>: movl $0x0,0x10(%esp,1)
0x00000482 <proc_pid_stat+42>: mov (%eax),%eax
0x00000484 <proc_pid_stat+44>: and $0xf,%eax
0x00000487 <proc_pid_stat+47>: je 0x490 <proc_pid_stat+56>
0x00000489 <proc_pid_stat+49>: add $0x4,%edx
0x0000048c <proc_pid_stat+52>: shr %eax
0x0000048e <proc_pid_stat+54>: jne 0x489 <proc_pid_stat+49>
0x00000490 <proc_pid_stat+56>: mov (%edx),%eax
0x00000492 <proc_pid_stat+58>: movzbl (%eax),%eax
0x00000495 <proc_pid_stat+61>: movl $0x0,0x30(%esp,1)
0x0000049d <proc_pid_stat+69>: movl $0x0,0x34(%esp,1)
0x000004a5 <proc_pid_stat+77>: movl $0x0,0x38(%esp,1)
0x000004ad <proc_pid_stat+85>: mov %al,0x1b(%esp,1)
0x000004b1 <proc_pid_stat+89>: lock decb 0x604(%esi)
0x000004b8 <proc_pid_stat+96>: js 0x91c <.text.lock.array+68>
0x000004be <proc_pid_stat+102>: mov 0x68(%esi),%edi
0x000004c1 <proc_pid_stat+105>: test %edi,%edi
0x000004c3 <proc_pid_stat+107>: je 0x4ce <proc_pid_stat+118>
0x000004c5 <proc_pid_stat+109>: mov %edi,%eax
0x000004c7 <proc_pid_stat+111>: call 0x4c8 <proc_pid_stat+112>
0x000004cc <proc_pid_stat+116>: mov %eax,%edi
0x000004ce <proc_pid_stat+118>: mov 0x324(%esi),%ecx
0x000004d4 <proc_pid_stat+124>: test %ecx,%ecx
0x000004d6 <proc_pid_stat+126>: je 0x510 <proc_pid_stat+184>
0x000004d8 <proc_pid_stat+128>: mov 0x98(%ecx),%eax
0x000004de <proc_pid_stat+134>: mov %eax,0x20(%esp,1)
0x000004e2 <proc_pid_stat+138>: mov 0x4(%ecx),%edx
0x000004e5 <proc_pid_stat+141>: movswl 0x64(%edx),%eax
0x000004e9 <proc_pid_stat+145>: movswl 0x66(%edx),%edx
0x000004ed <proc_pid_stat+149>: shl $0x14,%eax
0x000004f0 <proc_pid_stat+152>: or %edx,%eax
0x000004f2 <proc_pid_stat+154>: add 0x8(%ecx),%eax
0x000004f5 <proc_pid_stat+157>: mov %eax,%edx
0x000004f7 <proc_pid_stat+159>: movzbl %al,%ecx
0x000004fa <proc_pid_stat+162>: shr $0x14,%edx
0x000004fd <proc_pid_stat+165>: and $0xfff00,%eax
0x00000502 <proc_pid_stat+170>: shl $0x8,%edx
0x00000505 <proc_pid_stat+173>: or %edx,%ecx
0x00000507 <proc_pid_stat+175>: shl $0xc,%eax
0x0000050a <proc_pid_stat+178>: or %eax,%ecx
0x0000050c <proc_pid_stat+180>: mov %ecx,0x1c(%esp,1)
0x00000510 <proc_pid_stat+184>: mov $0x1,%al
0x00000512 <proc_pid_stat+186>: xchg %al,0x604(%esi)
0x00000518 <proc_pid_stat+192>: test %edi,%edi
0x0000051a <proc_pid_stat+194>: je 0x55b <proc_pid_stat+259>
0x0000051c <proc_pid_stat+196>: lea 0x28(%edi),%ebx
0x0000051f <proc_pid_stat+199>: mov %ebx,%eax
0x00000521 <proc_pid_stat+201>: lock incl (%eax)
0x00000524 <proc_pid_stat+204>: js 0x92c <.text.lock.array+84>
0x0000052a <proc_pid_stat+210>: mov %edi,%eax
0x0000052c <proc_pid_stat+212>: call 0x52d <proc_pid_stat+213>
0x00000531 <proc_pid_stat+217>: mov %eax,0x38(%esp,1)
0x00000535 <proc_pid_stat+221>: mov 0x4(%esi),%eax
0x00000538 <proc_pid_stat+224>: mov 0x1fec(%eax),%edx
0x0000053e <proc_pid_stat+230>: mov %edx,0x34(%esp,1)
0x00000542 <proc_pid_stat+234>: mov 0x1ff8(%eax),%eax
0x00000548 <proc_pid_stat+240>: or $0xffffffff,%edx
0x0000054b <proc_pid_stat+243>: mov %eax,0x30(%esp,1)
0x0000054f <proc_pid_stat+247>: mov %ebx,%eax
0x00000551 <proc_pid_stat+249>: lock xadd %edx,(%eax)
0x00000555 <proc_pid_stat+253>: js 0x93a <.text.lock.array+98>
0x0000055b <proc_pid_stat+259>: movl $0x0,0x2c(%esp,1)
0x00000563 <proc_pid_stat+267>: mov $0xffffe000,%eax
0x00000568 <proc_pid_stat+272>: mov 0x1f8(%esi),%edx
0x0000056e <proc_pid_stat+278>: and %esp,%eax
0x00000570 <proc_pid_stat+280>: mov (%eax),%eax
0x00000572 <proc_pid_stat+282>: cmp %edx,0x1f8(%eax)
0x00000578 <proc_pid_stat+288>: je 0x590 <proc_pid_stat+312>
0x0000057a <proc_pid_stat+290>: cmp %edx,0x1fc(%eax)
0x00000580 <proc_pid_stat+296>: je 0x590 <proc_pid_stat+312>
0x00000582 <proc_pid_stat+298>: mov $0x17,%eax
0x00000587 <proc_pid_stat+303>: call 0x588 <proc_pid_stat+304>
0x0000058c <proc_pid_stat+308>: test %eax,%eax
0x0000058e <proc_pid_stat+310>: je 0x59b <proc_pid_stat+323>
0x00000590 <proc_pid_stat+312>: mov %esi,%eax
0x00000592 <proc_pid_stat+314>: call 0x593 <proc_pid_stat+315>
0x00000597 <proc_pid_stat+319>: mov %eax,0x2c(%esp,1)
0x0000059b <proc_pid_stat+323>: movl $0x0,0x4c(%esp,1)
0x000005a3 <proc_pid_stat+331>: mov $0x0,%ebx
0x000005a8 <proc_pid_stat+336>: mov %ebx,%eax
0x000005aa <proc_pid_stat+338>: movl $0x0,0x48(%esp,1)
0x000005b2 <proc_pid_stat+346>: movl $0x0,0x44(%esp,1)
0x000005ba <proc_pid_stat+354>: movl $0x0,0x40(%esp,1)
0x000005c2 <proc_pid_stat+362>: lock subl $0x1,(%eax)
0x000005c6 <proc_pid_stat+366>: js 0x94e <.text.lock.array+118>
0x000005cc <proc_pid_stat+372>: cmpl $0x0,0x5c0(%esi)
0x000005d3 <proc_pid_stat+379>: je 0x613 <proc_pid_stat+443>
0x000005d5 <proc_pid_stat+381>: cli
0x000005d6 <proc_pid_stat+382>: mov 0x5c0(%esi),%eax
0x000005dc <proc_pid_stat+388>: lock decb 0x504(%eax)
0x000005e3 <proc_pid_stat+395>: js 0x958 <.text.lock.array+128>
0x000005e9 <proc_pid_stat+401>: mov 0x5bc(%esi),%eax
0x000005ef <proc_pid_stat+407>: lea 0x48(%esp,1),%edx
0x000005f3 <proc_pid_stat+411>: lea 0x40(%esp,1),%ecx
0x000005f7 <proc_pid_stat+415>: mov (%eax),%eax
0x000005f9 <proc_pid_stat+417>: mov %eax,0x10(%esp,1)
0x000005fd <proc_pid_stat+421>: mov %esi,%eax
0x000005ff <proc_pid_stat+423>: call 0xae <collect_sigign_sigcatch>
0x00000604 <proc_pid_stat+428>: mov 0x5c0(%esi),%edx
0x0000060a <proc_pid_stat+434>: mov $0x1,%al
0x0000060c <proc_pid_stat+436>: xchg %al,0x504(%edx)
0x00000612 <proc_pid_stat+442>: sti
0x00000613 <proc_pid_stat+443>: lock incl 0x0
0x0000061a <proc_pid_stat+450>: mov %esi,%eax
0x0000061c <proc_pid_stat+452>: call 0x61d <proc_pid_stat+453>
0x00000621 <proc_pid_stat+457>: mov %eax,0x28(%esp,1)
0x00000625 <proc_pid_stat+461>: mov %esi,%eax
0x00000627 <proc_pid_stat+463>: call 0x628 <proc_pid_stat+464>
0x0000062c <proc_pid_stat+468>: mov %eax,0x24(%esp,1)
0x00000630 <proc_pid_stat+472>: mov %ebx,%eax
0x00000632 <proc_pid_stat+474>: lock subl $0x1,(%eax)
0x00000636 <proc_pid_stat+478>: js 0x968 <.text.lock.array+144>
0x0000063c <proc_pid_stat+484>: cmpl $0x0,0x88(%esi)
0x00000643 <proc_pid_stat+491>: je 0x657 <proc_pid_stat+511>
0x00000645 <proc_pid_stat+493>: mov 0xa0(%esi),%eax
0x0000064b <proc_pid_stat+499>: mov 0x88(%eax),%eax
0x00000651 <proc_pid_stat+505>: mov %eax,0x14(%esp,1)
0x00000655 <proc_pid_stat+509>: jmp 0x65f <proc_pid_stat+519>
0x00000657 <proc_pid_stat+511>: movl $0x0,0x14(%esp,1)
0x0000065f <proc_pid_stat+519>: lock incl 0x0
0x00000666 <proc_pid_stat+526>: mov 0x4(%esi),%eax
0x00000669 <proc_pid_stat+529>: mov $0xa,%ebx
0x0000066e <proc_pid_stat+534>: mov 0x1d8(%esi),%edx
0x00000674 <proc_pid_stat+540>: mov 0x1dc(%esi),%ecx
0x0000067a <proc_pid_stat+546>: mov 0x10(%eax),%ebp
0x0000067d <proc_pid_stat+549>: mov %edx,(%esp,1)
0x00000680 <proc_pid_stat+552>: subl $0xfffb6c20,(%esp,1)
0x00000687 <proc_pid_stat+559>: mov %ecx,0x4(%esp,1)
0x0000068b <proc_pid_stat+563>: mov (%esp,1),%eax
0x0000068e <proc_pid_stat+566>: sbbl $0x0,0x4(%esp,1)
0x00000693 <proc_pid_stat+571>: mov 0x4(%esp,1),%edx
0x00000697 <proc_pid_stat+575>: mov %eax,(%esp,1)
0x0000069a <proc_pid_stat+578>: test %edx,%edx
0x0000069c <proc_pid_stat+580>: mov %edx,%ecx
0x0000069e <proc_pid_stat+582>: je 0x6a8 <proc_pid_stat+592>
0x000006a0 <proc_pid_stat+584>: mov %edx,%eax
0x000006a2 <proc_pid_stat+586>: xor %edx,%edx
0x000006a4 <proc_pid_stat+588>: div %ebx
0x000006a6 <proc_pid_stat+590>: mov %eax,%ecx
0x000006a8 <proc_pid_stat+592>: mov (%esp,1),%eax
0x000006ab <proc_pid_stat+595>: div %ebx
0x000006ad <proc_pid_stat+597>: mov %ecx,%edx
0x000006af <proc_pid_stat+599>: mov %eax,0x8(%esp,1)
0x000006b3 <proc_pid_stat+603>: mov 0xb8(%esi),%eax
0x000006b9 <proc_pid_stat+609>: mov %edx,0xc(%esp,1)
0x000006bd <proc_pid_stat+613>: mov 0x8c(%eax),%ebx
0x000006c3 <proc_pid_stat+619>: pushl 0x40(%esi)
0x000006c6 <proc_pid_stat+622>: pushl 0x174(%esi)
0x000006cc <proc_pid_stat+628>: push %ebp
0x000006cd <proc_pid_stat+629>: pushl 0x78(%esi)
0x000006d0 <proc_pid_stat+632>: pushl 0x1f4(%esi)
0x000006d6 <proc_pid_stat+638>: pushl 0x1e8(%esi)
0x000006dc <proc_pid_stat+644>: pushl 0x44(%esp,1)
0x000006e0 <proc_pid_stat+648>: mov 0x5c(%esp,1),%eax
0x000006e4 <proc_pid_stat+652>: and $0x7fffffff,%eax
0x000006e9 <proc_pid_stat+657>: push %eax
0x000006ea <proc_pid_stat+658>: mov 0x68(%esp,1),%eax
0x000006ee <proc_pid_stat+662>: and $0x7fffffff,%eax
0x000006f3 <proc_pid_stat+667>: push %eax
0x000006f4 <proc_pid_stat+668>: mov 0x5c4(%esi),%eax
0x000006fa <proc_pid_stat+674>: and $0x7fffffff,%eax
0x000006ff <proc_pid_stat+679>: push %eax
0x00000700 <proc_pid_stat+680>: mov 0x5dc(%esi),%eax
0x00000706 <proc_pid_stat+686>: and $0x7fffffff,%eax
0x0000070b <proc_pid_stat+691>: push %eax
0x0000070c <proc_pid_stat+692>: xor %eax,%eax
0x0000070e <proc_pid_stat+694>: test %edi,%edi
0x00000710 <proc_pid_stat+696>: pushl 0x60(%esp,1)
0x00000714 <proc_pid_stat+700>: pushl 0x60(%esp,1)
0x00000718 <proc_pid_stat+704>: je 0x71d <proc_pid_stat+709>
0x0000071a <proc_pid_stat+706>: mov 0x5c(%edi),%eax
0x0000071d <proc_pid_stat+709>: push %eax
0x0000071e <proc_pid_stat+710>: xor %eax,%eax
0x00000720 <proc_pid_stat+712>: test %edi,%edi
0x00000722 <proc_pid_stat+714>: je 0x727 <proc_pid_stat+719>
0x00000724 <proc_pid_stat+716>: mov 0x48(%edi),%eax
0x00000727 <proc_pid_stat+719>: push %eax
0x00000728 <proc_pid_stat+720>: xor %eax,%eax
0x0000072a <proc_pid_stat+722>: test %edi,%edi
0x0000072c <proc_pid_stat+724>: je 0x731 <proc_pid_stat+729>
0x0000072e <proc_pid_stat+726>: mov 0x44(%edi),%eax
0x00000731 <proc_pid_stat+729>: push %eax
0x00000732 <proc_pid_stat+730>: xor %eax,%eax
0x00000734 <proc_pid_stat+732>: test %edi,%edi
0x00000736 <proc_pid_stat+734>: pushl 0x2d8(%esi)
0x0000073c <proc_pid_stat+740>: je 0x741 <proc_pid_stat+745>
0x0000073e <proc_pid_stat+742>: mov 0x70(%edi),%eax
0x00000741 <proc_pid_stat+745>: push %eax
0x00000742 <proc_pid_stat+746>: mov $0xa,%ebp
0x00000747 <proc_pid_stat+751>: mov 0x178(%esi),%eax
0x0000074d <proc_pid_stat+757>: pushl 0x80(%esp,1)
0x00000754 <proc_pid_stat+764>: xor %edx,%edx
0x00000756 <proc_pid_stat+766>: div %ebp
0x00000758 <proc_pid_stat+768>: xor %edx,%edx
0x0000075a <proc_pid_stat+770>: pushl 0x58(%esp,1)
0x0000075e <proc_pid_stat+774>: pushl 0x58(%esp,1)
0x00000762 <proc_pid_stat+778>: push %eax
0x00000763 <proc_pid_stat+779>: mov 0x1c4(%esi),%eax
0x00000769 <proc_pid_stat+785>: pushl 0x68(%esp,1)
0x0000076d <proc_pid_stat+789>: div %ebp
0x0000076f <proc_pid_stat+791>: xor %edx,%edx
0x00000771 <proc_pid_stat+793>: pushl 0x80(%esp,1)
0x00000778 <proc_pid_stat+800>: pushl 0x88(%esp,1)
0x0000077f <proc_pid_stat+807>: push %eax
0x00000780 <proc_pid_stat+808>: mov 0x1c0(%esi),%eax
0x00000786 <proc_pid_stat+814>: div %ebp
0x00000788 <proc_pid_stat+816>: xor %edx,%edx
0x0000078a <proc_pid_stat+818>: push %eax
0x0000078b <proc_pid_stat+819>: mov 0x1bc(%esi),%eax
0x00000791 <proc_pid_stat+825>: div %ebp
0x00000793 <proc_pid_stat+827>: xor %edx,%edx
0x00000795 <proc_pid_stat+829>: push %eax
0x00000796 <proc_pid_stat+830>: mov 0x1b8(%esi),%eax
0x0000079c <proc_pid_stat+836>: div %ebp
0x0000079e <proc_pid_stat+838>: push %eax
0x0000079f <proc_pid_stat+839>: pushl 0x1f0(%esi)
0x000007a5 <proc_pid_stat+845>: pushl 0x1e4(%esi)
0x000007ab <proc_pid_stat+851>: pushl 0x1ec(%esi)
0x000007b1 <proc_pid_stat+857>: pushl 0x1e0(%esi)
0x000007b7 <proc_pid_stat+863>: pushl 0xc(%esi)
0x000007ba <proc_pid_stat+866>: pushl 0xa8(%esp,1)
0x000007c1 <proc_pid_stat+873>: pushl 0xa8(%esp,1)
0x000007c8 <proc_pid_stat+880>: pushl 0x94(%esi)
0x000007ce <proc_pid_stat+886>: push %ebx
0x000007cf <proc_pid_stat+887>: pushl 0xac(%esp,1)
0x000007d6 <proc_pid_stat+894>: movsbl 0xb7(%esp,1),%eax
0x000007de <proc_pid_stat+902>: push %eax
0x000007df <proc_pid_stat+903>: lea 0x30a(%esi),%eax
0x000007e5 <proc_pid_stat+909>: push %eax
0x000007e6 <proc_pid_stat+910>: pushl 0x88(%esi)
0x000007ec <proc_pid_stat+916>: push $0x131
0x000007f1 <proc_pid_stat+921>: pushl 0xe8(%esp,1)
0x000007f8 <proc_pid_stat+928>: call 0x7f9 <proc_pid_stat+929>
0x000007fd <proc_pid_stat+933>: add $0xb0,%esp
0x00000803 <proc_pid_stat+939>: mov %eax,%ebx
0x00000805 <proc_pid_stat+941>: test %edi,%edi
0x00000807 <proc_pid_stat+943>: je 0x810 <proc_pid_stat+952>
0x00000809 <proc_pid_stat+945>: mov %edi,%eax
0x0000080b <proc_pid_stat+947>: call 0x80c <proc_pid_stat+948>
0x00000810 <proc_pid_stat+952>: add $0x50,%esp
0x00000813 <proc_pid_stat+955>: mov %ebx,%eax
0x00000815 <proc_pid_stat+957>: pop %ebx
0x00000816 <proc_pid_stat+958>: pop %esi
0x00000817 <proc_pid_stat+959>: pop %edi
0x00000818 <proc_pid_stat+960>: pop %ebp
0x00000819 <proc_pid_stat+961>: ret
End of assembler dump.
Mar 17 13:59:57 hostname kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000064
Mar 17 13:59:57 hostname kernel: printing eip:
Mar 17 13:59:57 hostname kernel: c0171b61
Mar 17 13:59:57 hostname kernel: *pde = 2c54b001
Mar 17 13:59:57 hostname kernel: Oops: 0000 [#1]
Mar 17 13:59:57 hostname kernel: CPU: 0
Mar 17 13:59:57 hostname kernel: EIP: 0060:[<c0171b61>] Not tainted
Mar 17 13:59:57 hostname kernel: EFLAGS: 00010286
Mar 17 13:59:57 hostname kernel: EIP is at proc_pid_stat+0x8d/0x3c2
Mar 17 13:59:57 hostname kernel: eax: 00000000 ebx: e4b19940 ecx: cd6bf000 edx: 00000000
Mar 17 13:59:57 hostname kernel: esi: e4b19940 edi: ead90800 ebp: 000003ff esp: de091f10
Mar 17 13:59:57 hostname kernel: ds: 007b es: 007b ss: 0068
Mar 17 13:59:57 hostname kernel: Process ps (pid: 6841, threadinfo=de090000 task=eebeb940)
Mar 17 13:59:57 hostname kernel: Stack: de091f64 c02bfc00 c02bff80 00000246 00000000 c155c16c 52000000 00000000
Mar 17 13:59:57 hostname kernel: 00000000 000003ff 00000000 c013505a 00000000 00000000 00000000 df2f1000
Mar 17 13:59:57 hostname kernel: 00000000 000000d0 f6329ac0 e4b19940 e4b19940 c960e980 000003ff 000003ff
Mar 17 13:59:57 hostname kernel: Call Trace:
Mar 17 13:59:57 hostname kernel: [<c013505a>] __alloc_pages+0x8f/0x2d1
Mar 17 13:59:57 hostname kernel: [<c016f17c>] proc_info_read+0x50/0x116
Mar 17 13:59:57 hostname kernel: [<c014ab7d>] vfs_read+0xb8/0xe4
Mar 17 13:59:57 hostname kernel: [<c014ad56>] sys_read+0x2c/0x42
Mar 17 13:59:57 hostname kernel: [<c010a32f>] syscall_call+0x7/0xb
Mar 17 13:59:57 hostname kernel:
Mar 17 13:59:57 hostname kernel: Code: 0f bf 42 64 0f bf 52 66 c1 e0 14 09 d0 03 41 08 89 c2 0f b6