bug#109: [kernel] bug#109: iptables causes trap 27

X-PA-RISC Linux-PR-Message: report 109
X-PA-RISC Linux-PR-Package: kernel
X-Loop: daniel_frazier@hp.com
Received: via spool by 109-bugs@bugs.parisc-linux.org id=B109.98763010314962
          (code B ref 109); Wed, 18 Apr 2001 21:48:01 GMT
Date: Wed, 18 Apr 2001 22:41:44 +0100
From: Richard Hirst <rhirst@linuxcare.com>
To: Grant Grundler <grundler@puffin.external.hp.com>,
	109@bugs.parisc-linux.org
Message-ID: <20010418224144.Y11226@linuxcare.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0us
In-Reply-To: <no.id>; from kernel-admin@lists.parisc-linux.org on Wed, Apr 18, 2001 at 09:13:57PM +0000

On Wed, Apr 18, 2001 at 09:13:57PM +0000, kernel-admin@lists.parisc-linux.org wrote:
> 00000000102c4380 <lcopy_to_user>:
> 	102c4380:   87 00 20 4a     cmpib,=,n 0,r24,102c43ac <$lctu_done>
> 	102c4384:   08 1e 02 41     copy sp,r1
> 	102c4388:   f4 20 04 12     depdi 0,63,14,r1
> 	102c438c:   48 36 00 28     ldw 14(r1),r22
> 	102c4390:   00 00 c4 a1     mfsp sr3,r1
> 	102c4394:   08 16 32 40     or,<> r22,r0,r0
> 	102c4398:   08 00 02 41     copy r0,r1
> 	102c439c:   00 01 58 20     mtsp r1,sr1
> 
> 00000000102c43a0 <$lctu_loop>:
> 	102c43a0:   0f 22 10 21     ldb,ma  1(sr0,r25),r1
> 	102c43a4:   af 1f 3f ed     addib,<> -1,r24,102c43a0 <$lctu_loop>
> 	102c43a8:   0f 41 52 22     stb,ma  r1,1(sr1,r26)	*** TRAP27 ***
> 
> 00000000102c43ac <$lctu_done>:
> 	102c43ac:   e8 40 c0 00     bv r0(rp)
> 	102c43b0:   08 18 02 5c     copy r24,ret0
> 	102c43b4:   e8 1f 1f e5     b,l 102c43ac <$lctu_done>,r0
> 	102c43b8:   37 18 00 02     ldo 1(r24),r24
> 
> GR24 00000000000000ff
> GR25 000000000008f001
> GR26 000119800000e9d4
> SR1  0000000000000180 	(SR0 is the same)
> 
> Looks like we tried to copyout the counters info but went past the
> end of the page/space allocated by iptables. Not sure about this
> conclusion though...

I'd guess gr26 was screwed.  Surely the top half should be zero?

Richard