Red Hat Bugzilla – Bug 76336
shutdown/halt fails
Last modified: 2007-04-18 12:47:47 EDT
Description of Problem: shutdown -r; halt; init 0; init 6 all fail with the following message... The system is going down for reboot NOW! /dev/null RK_Init: idt=0xc037d000, sct[]=0xc0302c30, FUCK: Can't find kmalloc()! How Reproducible: RH 7.1 was running on the same system w/o any problems 8.0 does not allow shutdown I've stopped pretty much all services one by one without any success...
can you post an "lsmod" output so that I can get an overview from the drivers in use ? (shutdown failures are often driver-specific bugs in shutdown-notification handlers that drivers can register)
]# lsmod Module Size Used by Not tainted autofs 13348 0 (autoclean) (unused) eepro100 22264 1 appletalk 26468 0 (autoclean) ipx 22404 0 (autoclean) ipt_REJECT 3736 6 (autoclean) iptable_filter 2412 1 (autoclean) ip_tables 14936 2 [ipt_REJECT iptable_filter] mousedev 5524 0 (unused) keybdev 2976 0 (unused) hid 22244 0 (unused) input 5888 0 [mousedev keybdev hid] usb-uhci 26188 0 (unused) usbcore 77024 1 [hid usb-uhci] ext3 70368 5 jbd 52212 5 [ext3] aic7xxx 137140 6 sd_mod 13552 12 scsi_mod 107144 2 [aic7xxx sd_mod]
ok weird I searched all code (with grep :) and did not find the message you see in the kernel... which is to say "weird".
I'm not sure how relevant this is: I clean installed the system on 10/18/2002 (Friday ~10 pm) from a boxed RH 8.0 I purchased earlier from CompUSA. Before I got a chance to configure mail settings on it (uptime ~3.5 hrs) I got a "Warning: could not send message for past 4 hours" from the sendmail queue. When I examined the queued message, I realized that the message contained the following sections: - system info - inet info - uptime info - CPU info - passwd and shadow files - df and free info what was interesting is that there was no associated /var/log/maillog record and it was addressed to: Date: Sat, 19 Oct 2002 00:34:49 -0400 From: root <root@mercury.cygnetsys.com> To: drebdc@another.com Subject: 168.100.191.66 [] - b/s {As a resolution I simply deleted the message from /var/spool/mqueue; hoping to work on it later} The reason I brought this to your attention: Could the boxed RH 8.0 be tampered with? Could the shutdown problem be a side-effect of tampering?
This is not a Red Hat bug at all. Your system has been compromised and hackers have installed a rootkit on it which contains trojanned kernel modules. For details: http://www.soohrt.org/stuff/linux/suckit/