[root@zymurgy jrb]# cat boom2.c 1. boom2.c #define MODULE #include boom() { char *f; f = 0; *f = 1; } int init_module(void) { printk("<1> init_module: Hello, world \n"); boom(); return (0); } void cleanup_module(void) { printk("<1> cleanup_module: Goodbye, world\n"); while(1) { schedule(); } } 2. inserting it # insmod boom2.o Segmentation Violation 3. noting that what is in the syslog is not helpful klogd couldn't have caught it. why? Oct 22 10:12:08 zymurgy kernel: init_module: Hello, world Oct 22 10:12:08 zymurgy kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000000 Oct 22 10:12:08 zymurgy kernel: printing eip: Oct 22 10:12:08 zymurgy kernel: d2d23070 Oct 22 10:12:08 zymurgy kernel: *pde = 00000000 Oct 22 10:12:08 zymurgy kernel: Oops: 0002 Oct 22 10:12:08 zymurgy kernel: CPU: 0 Oct 22 10:12:08 zymurgy kernel: EIP: 0010:[scsi_mod:scsi_hosts_R80308476+38247092/78506563] Oct 22 10:12:08 zymurgy kernel: EIP: 0010:[] Oct 22 10:12:08 zymurgy kernel: EFLAGS: 00010286 Oct 22 10:12:08 zymurgy kernel: eax: 00000000 ebx: d2d23000 ecx: 00000007 edx: 00000000 Oct 22 10:12:08 zymurgy kernel: esi: 00000000 edi: 00000000 ebp: c9167f18 esp: c9167f14 Oct 22 10:12:08 zymurgy kernel: ds: 0018 es: 0018 ss: 0018 Oct 22 10:12:08 zymurgy kernel: Process insmod (pid: 1650, stackpage=c9167000) Oct 22 10:12:08 zymurgy kernel: Stack: 00000000 c9167f28 d2d23093 00000000 00000000 00000060 c01182e5 00000000 Oct 22 10:12:08 zymurgy kernel: c91fd000 00000120 c9387000 00000060 ffffffea 00000005 c957a5a0 00000060 Oct 22 10:12:08 zymurgy kernel: d096f000 d2d23060 000001c0 00000000 00000000 00000000 00000000 00000000 Oct 22 10:12:08 zymurgy kernel: Call Trace: [scsi_mod:scsi_hosts_R80308476+38247127/78506528] [sys_init_module+1333/1520] [scsi_mod:scsi_hosts_R80308476+809540/115944115] [scsi_mod:scsi_hosts_R80308476+38247076/78506579] [system_call+51/56] Oct 22 10:12:08 zymurgy kernel: Call Trace: [] [] [] [] [] Oct 22 10:12:08 zymurgy kernel: Oct 22 10:12:08 zymurgy kernel: Code: c6 00 01 c9 c3 8d 76 00 55 89 e5 83 ec 08 83 ec 0c 68 c0 30 4. running ksymoops [root@zymurgy jrb]# ksymoops -o boom2.o oops.txt ksymoops 2.4.1 on i686 2.4.7-10. Options used -V (default) -k /proc/ksyms (default) -l /proc/modules (default) -o boom2.o (specified) -m /boot/System.map-2.4.7-10 (default) Error (expand_objects): cannot stat(/lib/ext3.o) for ext3 ksymoops: No such file or directory Error (expand_objects): cannot stat(/lib/jbd.o) for jbd ksymoops: No such file or directory Warning (compare_maps): mismatch on symbol partition_name , ksyms_base says c01b3570, System.map says c0155720. Ignoring ksyms_base entry Warning (compare_maps): mismatch on symbol proc_scsi , scsi_mod says d08a958c, /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o says d08a7e14. Ignoring /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o entry Warning (compare_maps): mismatch on symbol scsi_devicelist , scsi_mod says d08a95b8, /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o says d08a7e40. Ignoring /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o entry Warning (compare_maps): mismatch on symbol scsi_hostlist , scsi_mod says d08a95b4, /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o says d08a7e3c. Ignoring /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o entry Warning (compare_maps): mismatch on symbol scsi_hosts , scsi_mod says d08a95bc, /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o says d08a7e44. Ignoring /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o entry Warning (compare_maps): mismatch on symbol scsi_logging_level , scsi_mod says d08a9588, /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o says d08a7e10. Ignoring /lib/modules/2.4.7-10/kernel/drivers/scsi/scsi_mod.o entry Warning (compare_maps): mismatch on symbol output_offset , ov511 says d0890718, /lib/modules/2.4.7-10/kernel/drivers/usb/ov511.o says d088ffa0. Ignoring /lib/modules/2.4.7-10/kernel/drivers/usb/ov511.o entry Warning (compare_maps): mismatch on symbol usb_devfs_handle , usbcore says d086a9a0, /lib/modules/2.4.7-10/kernel/drivers/usb/usbcore.o says d086a4c0. Ignoring /lib/modules/2.4.7-10/kernel/drivers/usb/usbcore.o entry Warning (map_ksym_to_module): cannot match loaded module ext3 to a unique module object. Trace may not be reliable. Warning (map_ksym_to_module): cannot match loaded module jbd to a unique module object. Trace may not be reliable. Unable to handle kernel NULL pointer dereference at virtual address 00000000 d2d23070 *pde = 00000000 Oops: 0002 CPU: 0 EIP: 0010:[] Using defaults from ksymoops -t elf32-i386 -a i386 EFLAGS: 00010286 eax: 00000000 ebx: d2d23000 ecx: 00000007 edx: 00000000 esi: 00000000 edi: 00000000 ebp: c9167f18 esp: c9167f14 ds: 0018 es: 0018 ss: 0018 Process insmod (pid: 1650, stackpage=c9167000) Stack: 00000000 c9167f28 d2d23093 00000000 00000000 00000060 c01182e5 00000000 c91fd000 00000120 c9387000 00000060 ffffffea 00000005 c957a5a0 00000060 d096f000 d2d23060 000001c0 00000000 00000000 00000000 00000000 00000000 Call Trace: [] [] [] [] [] Code: c6 00 01 c9 c3 8d 76 00 55 89 e5 83 ec 08 83 ec 0c 68 c0 30 >>EIP; d2d23070 <[boom2].text.start+10/18> <===== Trace; d2d23093 <[boom2]init_module+1b/24> Trace; c01182e5 Trace; d096f000 <[agpgart].bss.end+17441/174a1> Trace; d2d23060 <[boom2]boom+0/0> Trace; c0106f0b Code; d2d23070 <[boom2].text.start+10/18> 00000000 <_EIP>: Code; d2d23070 <[boom2].text.start+10/18> <===== 0: c6 00 01 movb $0x1,(%eax) <===== Code; d2d23073 <[boom2].text.start+13/18> 3: c9 leave Code; d2d23074 <[boom2].text.start+14/18> 4: c3 ret Code; d2d23075 <[boom2].text.start+15/18> 5: 8d 76 00 lea 0x0(%esi),%esi Code; d2d23078 <[boom2]init_module+0/24> 8: 55 push %ebp Code; d2d23079 <[boom2]init_module+1/24> 9: 89 e5 mov %esp,%ebp Code; d2d2307b <[boom2]init_module+3/24> b: 83 ec 08 sub $0x8,%esp Code; d2d2307e <[boom2]init_module+6/24> e: 83 ec 0c sub $0xc,%esp Code; d2d23081 <[boom2]init_module+9/24> 11: 68 c0 30 00 00 push $0x30c0 ksymoops nailed it. 5. note gdb output: [root@zymurgy jrb]# gdb boom2.o GNU gdb Red Hat Linux 7.x (5.0rh-15) (MI_OUT) Copyright 2001 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"...(no debugging symbols found)... (gdb) x/20i 0x0 : push %ebp 0x1 : mov %esp,%ebp 0x3 : sub $0x4,%esp 0x6 : movl $0x0,0xfffffffc(%ebp) 0xd : mov 0xfffffffc(%ebp),%eax 0x10 : movb $0x1,(%eax) 0x13 : leave 0x14 : ret 0x15 : lea 0x0(%esi),%esi 0x18 : push %ebp 0x19 : mov %esp,%ebp 0x1b : sub $0x8,%esp 0x1e : sub $0xc,%esp 0x21 : push $0x0 0x26 : call 0x27 0x2b : add $0x10,%esp 0x2e : call 0x2f 0x33 : mov $0x0,%eax 0x38 : leave 0x39 : ret (gdb) q