httpd, recent kernels, NULL pointer

Jeremy Boulton (boultonj@torch.caltech.edu)
Thu, 22 Feb 1996 22:18:50 -0800 (PST)


Hi,

I have not been able to get an ELF version of NCSA HTTPd Server 1.5a to work
on my computer with 1.3.6[678]. (Those are the only ones I have tried,
because I just recently converted to ELF.) Right now, I have to use my old
aout version. My httpd error logs show the following:

[Thu Feb 22 21:10:59 1996] HTTPd: Starting as /usr/local/bin/httpd
[Thu Feb 22 21:11:52 1996] child error: child connection closed

The first time I attempt to connect (with lynx) I get an "Unable to handle
kernel NULL pointer dereference at virtual address c00000fd" error caused by
a call from the httpd process, as shown below. Each time after that, I get
"Unexpected network read error; connection aborted." from lynx. If I kill
and restart httpd, I never get the NULL pointer message again, it's only the
first time I run httpd (after a reboot). I hope the following will be
helpful. It consists of a strace of lynx with the kernel message appearing
right where it apparently happened. Following that is the kernel code for
the EIP and call trace addresses involved. Let me know if I should include
other information in the future.

Jeremy

System: 486sx/33, Slackware 3.0, modular ELF 1.3.68

read(4, "", 4096) = 0
close(4) = 0
write(1, "\rMaking HTTP conne"..., 65Making HTTP connection to torch.caltech.edu.) = 65
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4
ioctl(4, FIONBIO, [1]) = 0
connect(4, {sin_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("131.215.89.48")}, 16) = -1 EINPROGRESS (Operation now in progress)
select(256, NULL, [4], NULL, {0, 100000}) = 1 (out [4], left {0, 100000})
connect(4, {sin_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("131.215.89.48")}, 16) = 0

ioctl(4, FIONBIOUnable to handle kernel NULL pointer dereference at virtual address c00000fd
current->tss.cr3 = 00e06000, %cr3 = 00e06000
*pde = 00102067
*pte = 00000027
Oops: 0000
CPU: 0
EIP: 0010:[<0014ec37>]
EFLAGS: 00010202
eax: 0014ebf0 ebx: 00000001 ecx: 00000000 edx: 00b61714
esi: 0000000c edi: 08025440 ebp: bffeba94 esp: 00e07f7c
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process httpd (pid: 84, process nr: 17, stackpage=00e07000)
Stack: bffeba78 0000000c 001369a4 00b61714 00000000 00136f77 00000007 00000000
00f35018 08094000 03030300 03030302 06040404 05050206 40010303 0010a4f9
0000000d bffeba78 0000000d 08094000 08025440 bffeba94 ffffffda 0000002b
Call Trace: [<001369a4>] [<00136f77>] [<0010a4f9>]
Code: 8a 81 fd 00 00 00 0f b6 d0 31 f6 83 fa 01 74 12 83 fa 08 74
, [0]) = 0
Sending H"TP request.) = 45
write(4, "GET / HTTP/1.0\r\nAccept: */*\r\n"..., 173) = 173

write(1, "\rHTTP request"..., 72HTTP request sent; waiting for response.) = 72
select(256, [0], NULL, NULL, {0, 100}) = 0 (Timeout)
select(256, [4], NULL, NULL, {0, 100000}) = 1 (in [4], left {0, 100000})
read(4, 0x8f000, 1023) = -1 EPIPE (Broken pipe)
close(4) = 0

# from the EIP:

(gdb) l *0x0014ec37
0x14ec37 is in inet_shutdown (af_inet.c:1165).
1160 2->3 */
1161 if ((how & ~SHUTDOWN_MASK) || how==0) /* MAXINT->0 */
1162 return(-EINVAL);
1163 if (sock->state == SS_CONNECTING && sk->state == TCP_ESTABLISHED)
1164 sock->state = SS_CONNECTED;
1165 if (!tcp_connected(sk->state))
1166 return(-ENOTCONN);
1167 sk->shutdown |= how;
1168 if (sk->prot->shutdown)
1169 sk->prot->shutdown(sk, how);

# from the Call Trace

(gdb) l *0x001369a4
0x1369a4 is in sys_shutdown (socket.c:1070).
1065 if (fd < 0 || fd >= NR_OPEN || ((file = current->files->fd[fd])
== NULL))
1066 return(-EBADF);
1067 if (!(sock = sockfd_lookup(fd, NULL)))
1068 return(-ENOTSOCK);
1069
1070 return(sock->ops->shutdown(sock, how));
1071 }
1072
1073 /*
1074 * BSD sendmsg interface

(gdb) l *0x00136f77
0x136f77 is in sys_socketcall (socket.c:1255).
1250 get_user(args+2),
1251 get_user(args+3),
1252 (struct sockaddr *)get_user(args+4),
1253 (int *)get_user(args+5)));
1254 case SYS_SHUTDOWN:
1255 return(sys_shutdown(a0,a1));
1256 case SYS_SETSOCKOPT:
1257 return(sys_setsockopt(a0,
1258 a1,
1259 get_user(args+2),