EIP in ACLCHECK.NLM at code start +0000F3F0h

  • 3406551
  • 14-Dec-2007
  • 26-Apr-2012

Environment


Novell BorderManager 3.8 Support Pack 5

Situation

Every 2-3 hours, server abends in aclcheck:

Server xxxx halted Monday, xxxxx 2007 13.38.46,787
Abend 1 on P00: Server-5.70.05: Page Fault Processor Exception (Error code
00000000)

Registers:
CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0010 SS = 0010
EAX = 00000000 EBX = 00000000 ECX = 85B6B000 EDX = 89001E6B
ESI = 00000077 EDI = 85B6B000 EBP = 00000007 ESP = 9209F240
EIP = 8902F3F0 FLAGS = 00210046
8902F3F0 8A19 MOV BL, [ECX]=?
EIP in ACLCHECK.NLM at code start +0000F3F0h
Access Location: 0x85B6B000

The violation occurred while processing the following instruction:
8902F3F0 8A19 MOV BL, [ECX]
8902F3F2 80CB20 OR BL, 20
8902F3F5 39DE CMP ESI, EBX
8902F3F7 7517 JNZ 8902F410
8902F3F9 3B0424 CMP EAX, [ESP]
8902F3FC 750B JNZ 8902F409
8902F3FE 837C242800 CMP [ESP+28], 00000000
8902F403 7420 JZ 8902F425
8902F405 897C2404 MOV [ESP+04], EDI
8902F409 41 INC ECX



Running process: Server 32 Process
Thread Owned by NLM: SERVER.NLM
Stack pointer: 9209FF80
OS Stack limit: 92098040
Scheduling priority: 67371008
Wait state: 50500F0 Waiting for work
Stack: --00000006 (LOADER.NLM|KernelAddressSpace+6)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--854D70A0 ?
--89001E73 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4B03)
--00000007 (LOADER.NLM|KernelAddressSpace+7)
--89001E73 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4B03)
8902F379 (ACLCHECK.NLM|ExamineMatchWild+49)
--89001E6B (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4AFB)
--00000007 (LOADER.NLM|KernelAddressSpace+7)
--854D70A1 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--854D70A0 ?
--854D70A0 ?
--89001E73 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4B03)
--854D7007 ?
--89001E68 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4AF8)
8902F303 (ACLCHECK.NLM|DoMatchWild+63)
--854D7007 ?
--89001E68 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4AF8)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--854D70A0 ?
--89001E73 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4B03)
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--854D7000 ?
--000000A0 (LOADER.NLM|KernelAddressSpace+A0)
--893C7B40 (PROXYCFG.NLM|BordrQueryUnitsLeft+3DD0)
89025F38 (ACLCHECK.NLM|checkWordlistDataByNonHash_WILD+48)
--854D7000 ?
--89001E60 (CSSYSMSG.NLM|CSSM_ReturnAuxMessageInformation+4AF0)
--000000A0 (LOADER.NLM|KernelAddressSpace+A0)
--00000013 (LOADER.NLM|KernelAddressSpace+13)
--8905A460 ?
--854D7000 ?
--000000A0 (LOADER.NLM|KernelAddressSpace+A0)
--9209F354 ?
89024B70 (ACLCHECK.NLM|checkRules+370)
--854D7000 ?
--000000A0 (LOADER.NLM|KernelAddressSpace+A0)
--893C7840 (PROXYCFG.NLM|BordrQueryUnitsLeft+3AD0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--8905A460 ?
--9209F354 ?
89024734 (ACLCHECK.NLM|checkRulesByProxyTypes+30)
--8905A460 ?
--9209F354 ?
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--9209F354 ?
--8905A460 ?
8902465B (ACLCHECK.NLM|checkRuleHit+3B)
--9209F354 ?
--8905A460 ?
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--9209F354 ?
89021A85 (ACLCHECK.NLM|aclCheckRules_15+535)
--9209F354 ?
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--0000016A (LOADER.NLM|KernelAddressSpace+16A)
--9209FC5C ?
--0000016A (LOADER.NLM|KernelAddressSpace+16A)
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--9209F354 ?
--92090001 ?
89021CC6 (ACLCHECK.NLM|ACLCheckParameters+132)
--9209F354 ?
--00000001 (LOADER.NLM|KernelAddressSpace+1)
--01000000 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--50000000 ?
--D200030A ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--EDC6E896 ?
--08D83BDA ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--03530184 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--E630C6DE ?
--000000A0 (LOADER.NLM|KernelAddressSpace+A0)
--854D7000 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)

Additional Information:
The CPU encountered a problem executing code in ACLCHECK.NLM. The problem
may be in that module or in data passed to that module by a process owned by
SERVER.NLM.

P00# ?
Address in ACLCHECK.NLM at code start +0000F3F0h
Previous: -00000040 893F63B0 ACLCHECK.NLM|CheckMatchWild
Current: 00000000 893F63F0
Next: +00000040 893F6430 ACLCHECK.NLM|deregisterACLFromProxy
P00# .a
Debug entry: 14
Break caused by: Page Fault Processor Exception
Error code: 00000000 (set by processor during exception)
P00# r
Exception Processor: 00
Current Focus Processor: 00
EAX = 00000000 EBX = 00000000 ECX = 89578000 EDX = 89417E0B
ESI = 00000077 EDI = 89578000 EBP = 00000007 ESP = 94A2F240
EIP = 893F63F0 FLAGS = 00010046 (PF ZF RF)
893F63F0 8A19 MOV BL, [ECX]
P00# sw
Current EIP: 893F63F0 ACLCHECK.NLM|CheckMatchWild+40
94A2F258 893F6379 ACLCHECK.NLM|ExamineMatchWild+49
94A2F280 893F6303 ACLCHECK.NLM|DoMatchWild+63
94A2F2A8 893ECF38 ACLCHECK.NLM|checkWordlistDataByNonHash_WILD+48
94A2F2CC 893EBB70 ACLCHECK.NLM|checkRules+370
94A2F2EC 893EB734 ACLCHECK.NLM|checkRulesByProxyTypes+30
94A2F304 893EB65B ACLCHECK.NLM|checkRuleHit+3B
94A2F320 893E8A85 ACLCHECK.NLM|aclCheckRules_15+535
94A2F348 893E8CC6 ACLCHECK.NLM|ACLCheckParameters+132
94A2F454 8980BE92 PROXY.NLM|ProcessRequest+B12
94A2FD2C 897D60D7 PROXY.NLM|ProcessHTTPRequestHeaders+87
94A2FD48 897CDF01 PROXY.NLM|HTTPProxyFirstRequestData+821
94A2FF70 8980FE94 PROXY.NLM|CallrsCallBacks+54
94A2FF78 003667C2 SERVER.NLM|StartWorkToDo+23
94A2FF90 002198DC SERVER.NLM|WorkerThread+508
94A2FFA8 00226868 SERVER.NLM|TcoNewSystemThreadEntryPoint+40
(stack end)

Resolution

Fixed in aclcheck.nlm version 4.80.07 from 20-nov-07, included in bm38sp5_ir1.exe patch