grsec-unoff (RAP) related Call Traces, 171117-1426 oops

(No. 0)  171114-1000-manu  171117-1426-oops  171118-0933-rsys  171118-1030-none  171122-1348-rsys  171123-1254  171123-1530  171124-0102-none  180101-1917-rsync 

EDIT: In the meantime, this Call Trace is also in this comment of: (RAP) related Call Trace(s)

First the one manually copied from the usual black frozen screen with white foreground of the text.

NOTE: If I had known that later I would have found it in the logs, I wouldn't bother. But you never known if they will on not be there to be found in the log... Besides, the log does not say some details that I found on the screen! The lines at the start, the attempt to create these DOCUMENTS MUSIC ... directories...

( Pls. do not think the blame to be on Devuan devs. They really reverse these stupid kind of changes gotten from upstream, but the work is huge. )

Typoes quite possible, not correcting them though, readers have the equivalent excerpt from the kern.log below; these M$ Windoze-like missing directory creating at the top, weren't in the kern.log though...).


                             /bin/sh: 1: exec: /usr/lib/at-spi2-core/at-spi-bus-launcher: not found
                                                                                                   /home/mr/Templates was removed, reassigning TEMPLATES to homedir
                                                         [ similar text ] DOCUMENTS to homedir
                                                         [ similar text ] MUSIC to homedir
                                                         [ similar text ] PICTURES to homedir 
                                                         [ similar text ] VIDEOS to homedir 

NOTE: the above four lines were also haphazardly placed on the screen. And the "similar text" means e.g. the DOCUMENTS line was

                                                    /home/mr/Documents was removed, reassigning DOCUMENTS to homedir

and so the remaining two lines.

                                                                                                        xterm: cannot load font "-Misc-Fixed-bold-0-*-*-13-120-75-75-C-70-ISO10646-1"
                                   xterm: cannot load font "-Misc-Fixed-bold-0-*-*-13-120-75-75-C-140-ISO10646-1"
[ 3456.809436] BUG: unable to handle kernel NULL pointer dereference at 00000000000003e8
[ 3456.812435] IP: [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.813998] PGD 200276000 [ 3456.814014]
[ 3456.815581] Oops: 0000 [#1] SMP
[ 3456.817139] CPU: 0 PID: 27965 Comm: tshark Not tainted 4.9.61-unofficial+grsec171114-20 #1
[ 3456.818740] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./970 Extreme4, BIOS P2.60 11/11/2013 
[ 3456.820359] task: ffff8802cefdf2c0 task.stack: ffffc9000722c000
[ 3456.822002] RIP: 0010:[]  [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.823635] RSP: 0018:ffffc9000722fc48  EFLAGS: 00010246
[ 3456.825251] RAX: 0000000000000000 RBX: ffff8802e67aa540 RCX: 0000000000000000
[ 3456.826876] RDX: 0000000000000000 RSI: 00000000000003e8 RDI: 00000000ffffffff
[ 3456.828524] RBP: ffffc9000722fc98 R08: 00000000ffffffc3 R09: 0000000000000000
[ 3456.830139] R10: ffffffff814958b0 R11: 0000000000000000 R12: ffff8802d8d150c0
[ 3456.831752] R13: ffff8803207b8000 R14: 0000000000000000 R15: 0000000000000000
[ 3456.833367] FS:  000003ee36ee5ec0(0000) GS:ffff88032fc00000(0000) knlGS:0000000000000000
[ 3456.835029] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3456.836664] CR2: 00000000000003e8 CR3: 0000000002c22000 CR4: 00000000000006f0
[ 3456.838325] Stack:
[ 3456.839980]  ffffc9000722fc90 000000008128a28f 0000000000000000 0000000000000000
[ 3456.841722]  793a2e3f24dcd213 ffff8803207b8000 ffff88020e9286a8 ffff880320401400
[ 3456.843457]  ffff8803207b8000 000000000000001b ffffc9000722fce0 ffffffff812f7fb8
[ 3456.845211] Call Trace:
[ 3456.846958]  [] prepare_binprm+0xc8/0x240
[ 3456.848669]  [] do_execveat_common.isra.53+0x677/0xd20
[ 3456.850345]  [] ? __check_object_size+0x178/0x31a
[ 3456.852008]  [] ? strncpy_from_user+0x6f/0x1e0
[ 3456.853646]  [] ? getname_flags+0x85/0x260
[ 3456.855263]  [] rap_sys_execve+0x6b/0xa0
[ 3456.856861]  [] do_syscall_64+0x8d/0x180
[ 3456.858481]  [] entry_SYSCALL64_slow_path+0x32/0x32
[ 3456.860066]  Code: 48 8b b4 24 48 03 00 00 eb 0b a5 65 b7 e6 ff ff ff ff cc cc cc e8 e4 a8 45 00 8b 94 24 54 03 00 00 39 c2 0f 84 b7 08 00 00 4c 8b  24 e8 02 00 00 4d 89 65 50 48 8b bc 24 30 02 00 00 eb 0b 00
[ 3456.863587] RIP  [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.865253]  RSP 
[ 3456.866931] CR2: 00000000000003d8


And this showed to have been recorded in the log:

Nov 17 14:26:36 gdOv kernel: [ 3456.797283] grsec: exec of /usr/lib/x86_64-linux-gnu/wireshark/extcap/ciscodump (/usr/lib/x86_64-linux-gnu/wireshark/extcap/ciscodump --extcap-config --extcap-interface cisco ) by /usr/lib/x86_64-linux-gnu/wireshark/extcap/ciscodump[tshark:27964] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/tshark[tshark:27958] uid/euid:1000/1000 gid/egid:1000/1000
Nov 17 14:26:37 gdOv kernel: [ 3456.809214] grsec: chdir to /usr/lib/x86_64-linux-gnu/wireshark/extcap by /usr/bin/tshark[tshark:27965] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/tshark[tshark:27958] uid/euid:1000/1000 gid/egid:1000/1000
Nov 17 14:26:37 gdOv kernel: [ 3456.809422] PAX: please report this to pageexec@freemail.hu

NOTE: For easier comparison, I remove the string Nov 17 14:26:37 gdOv kernel: that all the lines below start with. E.g., the first line was actually:

Nov 17 14:26:37 gdOv kernel: [ 3456.809436] BUG: unable to handle kernel NULL pointer dereference at 00000000000003e8

All the 38 lines started with that string.

[ 3456.809436] BUG: unable to handle kernel NULL pointer dereference at 00000000000003e8
[ 3456.812435] IP: [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.813998] PGD 200276000 
[ 3456.814014] 
[ 3456.815581] Oops: 0000 [#1] SMP
[ 3456.817139] CPU: 0 PID: 27965 Comm: tshark Not tainted 4.9.61-unofficial+grsec171114-20 #1
[ 3456.818740] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./970 Extreme4, BIOS P2.60 11/11/2013
[ 3456.820359] task: ffff8802cefdf2c0 task.stack: ffffc9000722c000
[ 3456.822002] RIP: 0010:[]  [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.823635] RSP: 0018:ffffc9000722fc48  EFLAGS: 00010246
[ 3456.825251] RAX: 0000000000000000 RBX: ffff8802e67aa540 RCX: 0000000000000000
[ 3456.826876] RDX: 0000000000000000 RSI: 00000000000003e8 RDI: 00000000ffffffff
[ 3456.828524] RBP: ffffc9000722fc98 R08: 00000000ffffffc3 R09: 0000000000000000
[ 3456.830139] R10: ffffffff814958b0 R11: 0000000000000000 R12: ffff8802d8d150c0
[ 3456.831752] R13: ffff8803207b8000 R14: 0000000000000000 R15: 0000000000000000
[ 3456.833367] FS:  000003ee36ee5ec0(0000) GS:ffff88032fc00000(0000) knlGS:0000000000000000
[ 3456.835029] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3456.836664] CR2: 00000000000003e8 CR3: 0000000002c22000 CR4: 00000000000006f0
[ 3456.838325] Stack:
[ 3456.839980]  ffffc9000722fc90 000000008128a28f 0000000000000000 0000000000000000
[ 3456.841722]  793a2e3f24dcd213 ffff8803207b8000 ffff88020e9286a8 ffff880320401400
[ 3456.843457]  ffff8803207b8000 000000000000001b ffffc9000722fce0 ffffffff812f7fb8
[ 3456.845211] Call Trace:
[ 3456.846958]  [] prepare_binprm+0xc8/0x240
[ 3456.848669]  [] do_execveat_common.isra.53+0x677/0xd20
[ 3456.850345]  [] ? __check_object_size+0x178/0x31a
[ 3456.852008]  [] ? strncpy_from_user+0x6f/0x1e0
[ 3456.853646]  [] ? getname_flags+0x85/0x260
[ 3456.855263]  [] rap_sys_execve+0x6b/0xa0
[ 3456.856861]  [] do_syscall_64+0x8d/0x180
[ 3456.858481]  [] entry_SYSCALL64_slow_path+0x32/0x32
[ 3456.860066] Code: 48 8b b4 24 48 03 00 00 eb 0b a5 65 b7 e6 ff ff ff ff cc cc cc e8 e4 a8 45 00 8b 94 24 54 03 00 00 39 c2 0f 84 b7 08 00 00 4c 8b  24 e8 02 00 00 4d 89 65 50 48 8b bc 24 30 02 00 00 eb 0b 00 
[ 3456.863587] RIP  [] do_blockdev_direct_IO+0x2c9d/0x4fe0
[ 3456.865253]  RSP 
[ 3456.866931] CR2: 00000000000003e8
[ 3456.876484] ---[ end trace b254e691dff20938 ]---
[ 3456.876487] grsec: banning user with uid 1000 until system restart for suspicious kernel crash
[ 3456.895953] grsec: exec of /sbin/agetty (/sbin/getty 38400 tty6 ) by /sbin/agetty[init:27966] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

---

The verifiable files necessary for this study, if any, are listed in the main page of this section.

---