Skip to content

Instantly share code, notes, and snippets.

@rzezeski
Created March 13, 2015 04:42
Show Gist options
  • Save rzezeski/a7801188ebfcd358f324 to your computer and use it in GitHub Desktop.
Save rzezeski/a7801188ebfcd358f324 to your computer and use it in GitHub Desktop.
truss of rsyslogd stack smash
# /native/usr/bin/truss -p $(pgrep rsyslogd)
/3: pollsys(0x7FFFFEEDE9F0, 1, 0x00000000, 0x00000000) (sleeping...)
/1: pollsys(0x7FFFFF38EA00, 0, 0x7FFFFF38EB00, 0x00000000) (sleeping...)
/3: pollsys(0x7FFFFEEDE9F0, 1, 0x00000000, 0x00000000) = 1
/3: uucopy(0x7FFFFEEDEB40, 0x7FFFEC0008C0, 1) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000017, 0x00000001, 0x00000000, 0x00000000) Err#1 EPERM
/3: brand(130, 0x7FFFFEEDECA0, 0x0000002F, 0x00000023, 0x00000000, 0x00000000) Err#35 ENOMSG
/3: Incurred fault #6, FLTBOUNDS %pc = 0xFFFFFFFFFF600000
/3: siginfo: SIGSEGV SEGV_MAPERR addr=0xFFFFFFFFFF600000
/3: Received signal #11, SIGSEGV [default]
/3: siginfo: SIGSEGV SEGV_MAPERR addr=0xFFFFFFFFFF600000
/3: uucopy(0x7FFFFEEDEBA0, 0x7FFFFB5FE3F0, 16) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000060, 0x00000000, 0x00000000, 0x7FFFFB5FE4B0) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000002, 0x00000001, 0x00000000, 0x00000000) = 0
/2: Incurred fault #6, FLTBOUNDS %pc = 0xFFFFFFFFFF600000
/2: siginfo: SIGSEGV SEGV_MAPERR addr=0xFFFFFFFFFF600000
*** stack smashing detected ***: /sbin/rsyslogd terminated
/2: Received signal #11, SIGSEGV [default]
/2: siginfo: SIGSEGV SEGV_MAPERR addr=0xFFFFFFFFFF600000
/2: uucopy(0x7FFFFEF5EBA0, 0x7FFFFC3FF680, 16) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x0000003B, 0x00000000, 0x00000001) = 0
/2: brand(130, 0x7FFFFEF5ECA0, 0x00000060, 0x00000000, 0x00000000, 0x00000000) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000009, 0x7FFFFEE40000, 0x00000000, 0x00000022) = 0
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7ffffd702527]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000036, 0x00000000, 0x7FFFFD603C48) Err#54 EBADRQC
/lib64/libc.so.6(__fortify_fail+0x0)[0x7ffffd7024f0]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000035, 0x00000000, 0x7FFFFD603C48) Err#53 ENOANO
/lib64/rsyslog/imuxsock.so(+0xf9cc)[0x7ffffca0f9cc]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000034, 0x00000000, 0x7FFFFCA00FA8) Err#52 EXFULL
/lib64/rsyslog/imuxsock.so(+0xfbe9)[0x7ffffca0fbe9]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000034, 0x00000000, 0x7FFFFCA00FA8) Err#52 EXFULL
/sbin/rsyslogd(+0x3c8fa)[0x7fffff23c8fa]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000029, 0x00000000, 0x7FFFFF2010D0) Err#41 ELNRNG
/lib64/libpthread.so.0(+0x79d1)[0x7ffffe6079d1]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x00000030, 0x00000000, 0x7FFFFE600F00) Err#48 ENOTSUP
/lib64/libc.so.6(clone+0x6d)[0x7ffffd6e88fd]
/3: brand(130, 0x7FFFFEEDECA0, 0x00000014, 0x0000002D, 0x00000000, 0x7FFFFD603C48) Err#45 EDEADLK
======= Memory map: ========
/3: brand(130, 0x7FFFFEEDECA0, 0x00000002, 0x00000002, 0x00000000, 0x7FFFFD603C48) = 0
00001000-0004d000 rw-p 00000000 00:00 0
7fffec000000-7ffff0000000 rw-p 00000000 00:00 0
7ffff4000000-7ffff8000000 rw-p 00000000 00:00 0
7ffff9c01000-7ffff9dff000 rw-p 00000000 00:00 0
7ffff9e00000-7ffffa801000 ---p 00000000 00:00 0
7ffffaa01000-7ffffabff000 rw-p 00000000 00:00 0
7ffffac00000-7ffffb601000 ---p 00000000 00:00 0
7ffffb801000-7ffffb9ff000 rw-p 00000000 00:00 0
7ffffba00000-7ffffc401000 ---p 00000000 00:00 0
7ffffc600000-7ffffc805000 r-xp 00000000 5a:10008 21097 /lib64/rsyslog/imklog.so
7ffffc805000-7ffffc807000 r--p 00005000 5a:10008 21097 /lib64/rsyslog/imklog.so
7ffffc807000-7ffffc808000 rwxp 00000000 00:00 0
7ffffca00000-7ffffcc4c000 r-xp 00000000 5a:10008 21103 /lib64/rsyslog/imuxsock.so
7ffffcc4c000-7ffffcc53000 r--p 0004c000 5a:10008 21103 /lib64/rsyslog/imuxsock.so
7ffffcc53000-7ffffcc55000 rwxp 00000000 00:00 0
7ffffce00000-7ffffd00c000 r-xp 00000000 5a:10008 18096 /lib64/libnss_files-2.12.so
7ffffd00c000-7ffffd00e000 r--p 0000c000 5a:10008 18096 /lib64/libnss_files-2.12.so
7ffffd200000-7ffffd405000 r-xp 00000000 5a:10008 21104 /lib64/rsyslog/lmnet.so
7ffffd405000-7ffffd407000 r--p 00005000 5a:10008 21104 /lib64/rsyslog/lmnet.so
7ffffd600000-7ffffd98a000 r-xp 00000000 5a:10008 18080 /lib64/libc-2.12.so
7ffffd98a000-7ffffd98f000 r--p 0018a000 5a:10008 18080 /lib64/libc-2.12.so
7ffffd98f000-7ffffd994000 rwxp 00000000 00:00 0
7ffffda00000-7ffffdc15000 r-xp 00000000 5a:10008 72 /lib64/libgcc_s-4.4.7-20120601.so.1
7ffffdc15000-7ffffdc16000 rwxp 00015000 5a:10008 72 /lib64/libgcc_s-4.4.7-20120601.so.1
7ffffde00000-7ffffe006000 r-xp 00000000 5a:10008 18108 /lib64/librt-2.12.so
7ffffe006000-7ffffe008000 r--p 00006000 5a:10008 18108 /lib64/librt-2.12.so
7ffffe200000-7ffffe402000 r-xp 00000000 5a:10008 18086 /lib64/libdl-2.12.so
7ffffe402000-7ffffe404000 r--p 00002000 5a:10008 18086 /lib64/libdl-2.12.so
7ffffe600000-7ffffe817000 r-xp 00000000 5a:10008 18104 /lib64/libpthread-2.12.so
7ffffe817000-7ffffe819000 r--p 00017000 5a:10008 18104 /lib64/libpthread-2.12.so
7ffffe819000-7ffffe81d000 rwxp 00000000 00:00 0
7ffffea00000-7ffffec14000 r-xp 00000000 5a:10008 323 /lib64/libz.so.1.2.3
7ffffec14000-7ffffec16000 r--p 00014000 5a:10008 323 /lib64/libz.so.1.2.3
7ffffee00000-7ffffee20000 r-xp 00000000 5a:10008 18073 /lib64/ld-2.12.so
7ffffee40000-7ffffee41000 rwxp 00000000 00:00 0
7ffffee4f000-7ffffee8f000 rw-p 00000000 00:00 0
7ffffee90000-7ffffee91000 rw-p 00000000 00:00 0
7ffffee9f000-7ffffeedf000 rw-p 00000000 00:00 0
7ffffeee0000-7ffffeef0000 rwxp 00000000 00:00 0
7ffffeefe000-7ffffef1e000 rw-p 00000000 00:00 0
7ffffef1f000-7ffffef5f000 rw-p 00000000 00:00 0
7ffffef60000-7ffffef61000 rwxp 00000000 00:00 0
7ffffef70000-7ffffeff5000 r-xp 00000000 52:01 2729
7fffff005000-7fffff008000 rw-p 00085000 52:01 2729
7fffff008000-7fffff010000 rw-p 00000000 00:00 0
7fffff01f000-7fffff021000 r--p 0001f000 5a:10008 18073 /lib64/ld-2.12.so
7fffff021000-7fffff022000 rw-p 00000000 00:00 0
7fffff040000-7fffff050000 rw-p 00000000 00:00 0
7fffff060000-7fffff1db000 r-xp 00000000 52:01 2696
7fffff1eb000-7fffff1f6000 rw-p 0017b000 52:01 2696
7fffff1f6000-7fffff1fa000 rw-p 00000000 00:00 0
7fffff200000-7fffff259000 r-xp 00000000 5a:10008 21118 /sbin/rsyslogd
7fffff270000-7fffff271000 rw-p 00000000 00:00 0
7fffff280000-7fffff281000 rwxs 00000000 00:00 0
7fffff290000-7fffff291000 rwxp 00000000 00:00 0
7fffff2a0000-7fffff2a1000 rwxp 00000000 00:00 0
7fffff2b0000-7fffff2c2000 r-xp 00000000 52:01 2747
7fffff2d2000-7fffff2d3000 rw-p 00012000 52:01 2747
7fffff2e0000-7fffff2e1000 rwxp 00000000 00:00 0
7fffff2f0000-7fffff2f1000 rwxp 00000000 00:00 0
7fffff300000-7fffff301000 rwxp 00000000 00:00 0
7fffff310000-7fffff311000 rwxp 00000000 00:00 0
7fffff320000-7fffff321000 rwxp 00000000 00:00 0
7fffff340000-7fffff341000 rwxp 00000000 00:00 0
7fffff34f000-7fffff38f000 rw-p 00000000 00:00 0
7fffff390000-7fffff391000 rw-p 00000000 00:00 0
7fffff3a0000-7fffff3a2000 r-xp 00000000 24:01 5983
7fffff3b0000-7fffff3b6000 rwxp 00000000 00:00 0
7fffff3c0000-7fffff3c1000 rwxp 00000000 00:00 0
7fffff3d0000-7fffff3d2000 r-xp 00000000 24:01 5868
7fffff3e2000-7fffff3e3000 rw-p 00002000 24:01 5868
7fffff3f0000-7fffff3f1000 rwxp 00000000 00:00 0
7fffff400000-7fffff401000 r--s 00000000 24:01 11267
7fffff410000-7fffff411000 rwxp 00000000 00:00 0
7fffff420000-7fffff421000 rw-p 00000000 00:00 0
7fffff430000-7fffff431000 rw-p 00000000 00:00 0
7fffff440000-7fffff441000 rwxp 00000000 00:00 0
7fffff450000-7fffff451000 rwxp 00000000 00:00 0
7fffff458000-7fffff460000 r--p 00058000 5a:10008 21118 /sbin/rsyslogd
7fffff460000-7fffff461000 rw-p 00000000 00:00 0
7fffff462000-7fffff4b5000 r-xp 00000000 52:01 2690
7fffff4c5000-7fffff4c7000 rwxp 00053000 52:01 2690
7fffff4c7000-7fffff4c9000 rwxp 00000000 00:00 0
7fffff4ca000-7fffff4fa000 r-xp 00000000 24:01 5921
7fffff4fa000-7fffff4fe000 rw-p 00030000 24:01 5921
7fffff4fe000-7fffff4ff000 rw-p 00000000 00:00 0
7fffffeda000-7ffffff00000 rw-p fffffffffffdb000 00:00 0
/3: brand(130, 0x7FFFFEEDECA0, 0x00000003, 0x00000000, 0x00000000, 0x7FFFFD603C48) = 0
/3: brand(130, 0x7FFFFEEDECA0, 0x0000000E, 0x00000000, 0x00000000, 0x00000008) = 0
/3: Received signal #6, SIGABRT [caught]
/3: siginfo: SIGABRT pid=4603 uid=0 code=-1
/3: lwp_sigmask(SIG_SETMASK, 0x7DBFFEFF, 0xFFFFF800, 0x000001FF, 0x00000000) = 0xFFBFFEFF [0xFFFFFFFF]
/3: getcontext(0x7FFFFEEDE5A0)
/3: uucopy(0x7FFFFEEDE900, 0x7FFFFB5FD970, 24) = 0
/3: uucopy(0x7FFFFEEDE120, 0x7FFFFB5FD758, 8) = 0
/3: uucopy(0x7FFFFEEDE0C0, 0x7FFFFB5FD5B0, 128) = 0
/3: brand(129, 0x7FFFFEEDE1E8, 0x00000000, 0x00000010, 0x00000000, 0x7FFFFEEDEE80) = 0
/3: brand(139, 0x7FFFFEEDE240, 0x7FFFFF223B20, 0x00000060, 0x00000000, 0x00000000) = 0
/3: brand(130, 0x7FFFFEEDDDF0, 0x0000000D, 0x00000000, 0x00000000, 0x00000008) = 0
/3: brand(130, 0x7FFFFEEDDDF0, 0x0000000E, 0x00000000, 0x00000000, 0x00000008) = 0
/3: Received signal #6, SIGABRT [default]
/3: siginfo: SIGABRT pid=4603 uid=0 code=-1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment