bugDazuko - Bugs: bug #18420, Syscall unhooking can cause kernel...


bug #18420: Syscall unhooking can cause kernel oopses for some processes in linux

Submitter:  Timo Metsala <timo_metsala>
Submitted:  Thu 30 Nov 2006 07:45:52 AM UTC
Status:  None Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Thu 30 Nov 2006 08:02:19 AM UTC, comment #1: 

This is correctly implemented in the FreeBSD 4/5/6 port, which uses a syscall counter to determine when it is safe to exit.

John Ogness <ogman>
Group administrator
Thu 30 Nov 2006 07:45:52 AM UTC, original submission:  

With syscall hooking in use, dazuko unload causes occasional oopses for random processes.

I'm not exactly sure why, but my best guess is a restarted syscall: a process had an active syscall which was interrupted, and pointer to dazuko code area was stored as the restart point. During this time dazuko is unloaded, and on process' resume, the memory area is not anymore valid, causing an oops for that process.

As a workaround, I managed to get over this by forcing the rmmod (or whatever process doing the module unloading) to sleep for a while after unhooking. The idea being that during this sleep the interrupted syscalls in other processes resume to dazuko code that is still in kernel memory space.

Without the workaround, I was able to reproduce this with about once / 10 unloads. With the workaround, I couldn't repro with a 1000 unloads.

I did it with following code after all unhooking:


where 2000 is an arbitrary, randomly selected number that in the system in question (SuSE Linux 10.0, 2.6.13-15-smp #1 running on a Intel(R) Xeon(TM) CPU 3.20GHz) seemed to be for approximately 4 seconds IIRC. Starting from kernel version 2.6.9 or so, there is also a function msecs_to_jiffies() which can be used to get more controlled delay.

Timo Metsala <timo_metsala>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ogman (Posted a comment)
  • -email is unavailable- added by timo_metsala (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-19 ogman Assigned toogman None
    2006-11-30 ogman Assigned toNone ogman
    2006-11-30 timo_metsala Carbon-Copy- Added timo_metsala

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code