Pls ignore this message if it is irrelevant to your case.
I have found the reason for this bug. Again, not a *PF_RING* bug.
In my project, I used the modutils of BusyBox to load the ring.ko module with
the customized parameters .
Version 1.12.0 of BusyBox has the following bad code:
insmod.c
/* Whew! All of the initialization is complete. Collect the final
module image and give it to the kernel. */
image = xmalloc(m_size);
obj_create_image(f, image);
ret = init_module(m_name, (struct new_module *) image);
if (ret)
bb_perror_msg("init_module: %s", m_name);
free(image);
I think that the author did not check if(image) before free(image)
This bug happens randomly from time2time so I have a long time to figure out
the reason .... Why xmalloc *sometimes* return NULL sometimes, pls see the
Loadable Kernel Module section in Linux Howto.
The typical kernel error messages when loading module by such code are:
BUG: unable to handle kernel paging requests...
or
unable to handle kernel NULL pointer dereference at 00000000
or
Trying to vfree() bad address (f74ce8c0)
For now, I will use the up2date version of BusyBox modutils or use the normal
Linux modutils package. We chose BusyBox before just because we intended to use
PF_RING in an embedded system.
I am sorry for troubling you with my old posts, Lucas.
We are looking forward to the multi-core version of PF_RING and Ntop.
---------[ Received Mail Content ]----------
Subject : [Ntop-dev] PF_RING rev 3636 can not allocate more than 4096 slots
Date : Thu, 04 Dec 2008 13:17:38 -0500 (EST)
From : "vanvu_dinh" <[email protected]>
To : <[email protected]>
p {margin-top:0px;margin-bottom:0px;}
Dear all,
I using pf_ring rev.3636, linux kernerl version 2.6.26.2 and snort. My machine
has 4 GB of RAM and Intel Xeonx quad-core.
In my previous post, I mentioned about the kernel panics error. I recompiled
Snort again with the option --enable-pthread. No more crash except one:
Trying to vfree() bad address (f700322e)
------------[ cut here ]------------
WARNING: at mm/vmalloc.c:385 ()
Modules linked in: ringExecuting daemon
Pid: 12, comm: events/1 Not tainted 2.6.26.2-default #1
[<c0118616>] s... [<c010c9a5>] [<c0103454>] Starting Cron
[<c0118ec4>] [<c011281d>] ... &nbs!
p; [<c0118ee4>] [<c0147795>] ( OK )
[<c015bcba>] [<c0124167>] [<c012481b>] [<c012489a>] Starting SSH ser
[<c0126a40>] [<c012481b>] ver daemon... [<c012697c>] [<c0126944>]
[<c0103597>] =======================
---[ end trace 322ec9c1aafa41ed ]---
Trying to vfree() bad address (f74ce8c0)
bad addr or host------------[ cut here ]------------
WARNING: at mm/vmalloc.c:385 ()
: (Temporary faModules linked in: ringilure in name re
Pid: 12, comm: events/1 Tainted: G W 2.6.26.2-default #1
solution)
INIT: [<c012489a>] [<c0126a40>] [<c012481b>] [<c012697c>] Entering runleve
[<c0126944>] l: 3 [<c0103597>] ======================= [&!
lt;c015bcd1>] [<c0124167>] [<c012481b>]
---[ end trace 322ec9c1aafa41ed ]---
I see a strange behaviour.
1> I can not allocate more slots than the default number of 4096.
2> After some time, pf-ring seems to stop working. First, Snort does not report
any more alerts though I attacks it. Second, the number of free slots are the
same.
I have feeling that the issue has been mentioned before in the post:
http://listgateway.unipi.it/pipermail/ntop-misc/2006-June/000705.html
I just want to mention that if I use pf_ring rev 3610, I did not experience
problem 2 but problem 1. I am wondering if something wrong with my VM
configuration.
1> Should I choose option HIGHMEM64G in the Linux kernel configure?
2> Should I choose another memory spliting scheme?
3> Should I choose another version of Linux kernel?
Any advice are appreciated very much
Here is my configuration settings:
CONFIG_HIGHMEM4G=y
CONFIG_VMSPLIT_3G_OPT=y
CONFIG_PAGE_OFFS!
ET=0xB0000000
CONFIG_HIGHMEM=y
CONFIG_ARCH_FLATMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SELECT_MEMORY_MODEL=y
CONFIG_SELECT_MEMORY_MODEL=y
CONFIG_FLATMEM_MANUAL=y
CONFIG_FLATMEM=y
CONFIG_FLAT_NODE_MEM_MAP=y
CONFIG_SPARSEMEM_STATIC=y
CONFIG_PAGEFLAGS_EXTENDED=y
CONFIG_SPLIT_PTLOCK_CPUS=4
CONFIG_ZONE_DMA_FLAG=1
On the machine:
more /proc/buddyinfo
Node 0, zone DMA 5 5 3 4 3 3 2 1
1 1 2
Node 0, zone Normal 33 4 2 4 !
1 2
1 1 2 1 269
Node 0, zone HighMem 2 0 1 1 0 2 0 1
1 0 34
Boot message:
Linux version 2.6.26.2-default (v...@workstation) (gcc version 4.2.4 (Ubuntu
4.2.4-1ubuntu3)) #1 SMP Thu Dec 4 11:13:16 EST 2008
BIOS-provided physical RAM map:
BIOS-e820: 0000000000000000 - 00000000000a0000 (usable)
BIOS-e820: 0000000000100000 - 00000000cfeb2000 (usable)
BIOS-e820: 00000000cfeb2000 - 00000000cfec8000 (reserved)
BIOS-e820: 00000000cfec8000 - 00000000cfee7c00 (ACPI data)
BIOS-e820: 0000000!
0cfee7c00 - 00000000d0000000 (reserved)
BIOS-e820: 00000000e0000000 - 00000000f0000000 (reserved)
BIOS-e820: 00000000fe000000 - 0000000100000000 (reserved)
BIOS-e820: 0000000100000000 - 0000000130000000 (usable)
Warning only 4GB will be used.
Use a HIGHMEM64G enabled kernel.
3200MB HIGHMEM available.
896MB LOWMEM available.
found SMP MP-table at [c00fe710] 000fe710
Zone PFN ranges:
DMA 0 -> 4096
Normal 4096 -> 229376
HighMem 229376 -> 1048576
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0 -> 1048576
DMI 2.5 present.
Intel MultiProcessor Specification v1.4
Virtual Wire compatibility mode.
!
Memory: 3368156k/4194304k available (1929k kernel code, 37260k reserve
d, 708k data, 568k init, 2489032k highmem)
virtual kernel memory layout:
fixmap : 0xfff52000 - 0xfffff000 ( 692 kB)
pkmap : 0xff800000 - 0xffc00000 (4096 kB)
vmalloc : 0xf8800000 - 0xff7fe000 ( 111 MB)
lowmem : 0xc0000000 - 0xf8000000 ( 896 MB)
.init : 0xc0399000 - 0xc0427000 ( 568 kB)
.data : 0xc02e244c - 0xc0393468 ( 708 kB)
.text : 0xc0100000 - 0xc02e244c (1929 kB)
"L’homme propose, Dieu dispose"
/Van
Mobile nr. (45)40783319
"L’homme propose, Dieu dispose"
/Van
Mobile nr. (45)40783319_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
