Apache 1.3.9 crashes linux box (Kernel problem?)

[Ulf Stegemann]

One of our linux webservers crashed three times in three days due
to general protection error caused by httpd process.

The box is an Intel PII 300 machine with SuSE Linux 6.0 (Kernel
2.0.36). Apache is version 1.3.9 with many modules as DSO (mod_perl,
mod_php
and others in addition to most of the distributed modules).

The apache error/access logs record nothing unusual. The message
file records the following (ip addresses xed):

------- snap ---------

Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Warning: possible SYN flood from
xxx.xxx.xxx.xxx on yyy.yyy.yyy.yyy:nn.  Sending cookies.
Jan  3 09:02:30 web1 kernel: Unable to handle kernel paging request
at
virtual address d2a08288
Jan  3 09:02:30 web1 kernel: current->tss.cr3 = 017a6000, %cr3 =
017a6000
Jan  3 09:02:30 web1 kernel: *pde = 00000000
Jan  3 09:02:30 web1 kernel: Oops: 0002
Jan  3 09:02:30 web1 kernel: CPU:    0
Jan  3 09:02:30 web1 kernel: EIP:   
0010:[ip_alias:ip_alias_print_1+-106697757/44]
Jan  3 09:02:30 web1 kernel: EFLAGS: 00010286
Jan  3 09:02:30 web1 kernel: eax: 02265cac   ebx: 05d65810   ecx:
0301e20c   edx: 00000000
Jan  3 09:02:30 web1 kernel: esi: 00000114   edi: 00000000   ebp:
016d9dac   esp: 016d9d28
Jan  3 09:02:30 web1 kernel: ds: 0018   es: 0018   fs: 002b   gs:
002b  
ss: 0018
Jan  3 09:02:30 web1 kernel: Process httpd (pid: 468, process nr:
43,
stackpage=016d9000)
Jan  3 09:02:30 web1 kernel: Stack: 0013b807 05d65810 05d65810
0301e294
0013bb07 05d65810 0301e294 067ab400 
Jan  3 09:02:30 web1 kernel:        00000000 0000003c 0013bf96
0301e294
00000000 067ab498 00000040 088223a8 
Jan  3 09:02:30 web1 kernel:        0301e294 00000000 00000001
0301e294
00087b84 0014b825 02fb7e2c 05d65810 
Jan  3 09:02:30 web1 kernel: Call Trace: [sock_wfree+35/44]
[kfree_skb+183/244] [dev_kfree_skb+62/76]
[ip_alias:ip_alias_print_1+-19588/44] [tcp_data+529/540]
[tcp_rcv+2297/2468] [do_dev_queue_xmit+455/504] 
Jan  3 09:02:30 web1 kernel:        [dev_queue_xmit+26/36]
[ip_queue_xmit+353/436] [tcp_send_ack+500/572]
[tcp_send_ack+553/572]
[tcp_delack_timer+0/16] [tcp_delack_timer+10/16] [timer_bh+749/820]
[do_bottom_half+59/96] 
Jan  3 09:02:30 web1 kernel:        [handle_bottom_half+11/24]
[sock_rfree+2/32] [kfree_skb+166/244] [cleanup_rbuf+83/148]
[tcp_recvmsg+1002/1036] [inet_recvmsg+114/136] [sock_read+171/192]
[sys_read+192/232] 
Jan  3 09:02:30 web1 kernel:        [system_call+85/124] 
Jan  3 09:02:30 web1 kernel: Code: 00 14 c4 ac 02 00 00 00 00 00 00
00
00 64 b7 1d 70 03 00 00 
Jan  3 09:02:30 web1 kernel: Aiee, killing interrupt handler

------- snap ---------

After the last line shown above, the server is dead. After a reboot
apache complains about an unclean shutdown but otherwise starts and
runs normally until the next crash.

A very simular problem was descriped in the apache bug database in
April 1999, unfortunately without an answer.

There were hints that this problem is related to a 'flock' bug in 2.0.36
kernels.

If anyone has any idea, why the server crashes and how to avoid
this from happening, I'd be very grateful if he/she could tell me about
it asap.

Ulf Stegemann
zeitform Internet Dienste
<[e-mail]>