* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c [not found] <20131115183422.GA9417@pomac.netswarm.net> @ 2013-11-15 22:29 ` Bjorn Helgaas 2013-11-15 22:44 ` David Miller 0 siblings, 1 reply; 6+ messages in thread From: Bjorn Helgaas @ 2013-11-15 22:29 UTC (permalink / raw) To: Ian Kumlien Cc: linux-kernel@vger.kernel.org, Eric Dumazet, netdev, David S. Miller, Alexander Aring [+cc David, Eric, Alex, netdev] Alex reported a similar issue at http://marc.info/?l=linux-netdev&m=138355719901790&w=4 On Fri, Nov 15, 2013 at 11:34 AM, Ian Kumlien <pomac@vapor.com> wrote: > Hi, > > After a lot of wondering i finally tracked down the bug that was hitting > me since 3.12-rc7. Since this is a firewall I haven't actually noticed > it all the time. But when i saw that it rebooted too often, i enabled > netconsole and this is the output: > > BUG: unable to handle kernel NULL pointer dereference at 0000000c > IP: [<c18196db>] _decode_session6+0x8b/0x370 > *pde = 00000000 > Oops: 0000 [#1] SMP > Modules linked in: netconsole tun > CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0 #55 > Hardware name: MICRO-STAR INTERNATIONAL CO., LTD MS-9632/MS-9632, BIOS 6.00 PG 05/16/2007 > task: c1b64880 ti: f600a000 task.ti: c1b5a000 > EIP: 0060:[<c18196db>] EFLAGS: 00210202 CPU: 0 > EIP is at _decode_session6+0x8b/0x370 > EAX: 00000000 EBX: f2c42c00 ECX: 00000001 EDX: e351a0a2 > ESI: 00000000 EDI: f600be70 EBP: f600be34 ESP: f600bdfc > DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 > CR0: 8005003b CR2: 0000000c CR3: 235e8000 CR4: 000007d0 > Stack: > f600be30 00282c00 00000001 c1bb24e0 f63f8000 c1baa780 f2c42c00 c17d653f > f2c42c00 c1807178 00000001 00000000 e3791f00 e3791f00 00000000 00000000 > 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > Call Trace: > [<c17d653f>] ? __xfrm_decode_session+0x1f/0x30 > [<c1807178>] ? icmpv6_route_lookup+0xa8/0x170 > [<c1807693>] ? icmp6_send+0x453/0x6e0 > [<c177dd7c>] ? ip_local_deliver_finish+0x7c/0x1f0 > [<c177dd00>] ? ip_rcv_finish+0x310/0x310 > [<c177db03>] ? ip_rcv_finish+0x113/0x310 > [<c1807240>] ? icmpv6_route_lookup+0x170/0x170 > [<c182dc64>] ? icmpv6_send+0x24/0x30 > [<c180df2f>] ? ip6_expire_frag_queue+0x16f/0x180 > [<c1823390>] ? nf_ct_net_init+0x60/0x60 > [<c1075efc>] ? call_timer_fn.isra.27+0x1c/0x80 > [<c155ff1b>] ? e1000e_poll+0x13b/0x2e0 > [<c1823390>] ? nf_ct_net_init+0x60/0x60 > [<c1076094>] ? run_timer_softirq+0x134/0x1d0 > [<c1071255>] ? __do_softirq+0xa5/0x160 > [<c10711b0>] ? remote_softirq_cpu_notify+0xa0/0xa0 > <IRQ> > [<c1071416>] ? irq_exit+0x66/0x90 > [<c105dff5>] ? smp_apic_timer_interrupt+0x35/0x50 > [<c187196d>] ? apic_timer_interrupt+0x2d/0x34 > [<c103d8d2>] ? default_idle+0x2/0x10 > [<c103df26>] ? arch_cpu_idle+0x16/0x20 > [<c10a1ed9>] ? cpu_startup_entry+0x49/0x130 > [<c1bc4948>] ? start_kernel+0x29e/0x2a3 > [<c1bc44ef>] ? repair_env_string+0x4d/0x4d > Code: 00 00 f3 ab 74 08 66 c7 07 00 00 83 c7 02 83 e6 01 74 03 c6 07 00 8b 83 90 00 00 00 8b 4c 24 08 89 45 08 8b 43 48 83 e0 fe 85 c9 <8b> 40 0c 8b 80 88 00 00 00 89 45 00 0f 84 1b 01 00 00 8b 42 08 > EIP: [<c18196db>] _decode_session6+0x8b/0x370 SS:ESP 0068:f600bdfc > CR2: 000000000000000c > ---[ end trace 0cbf7fb6e6aa1f45 ]--- > Kernel panic - not syncing: Fatal exception in interrupt > --- > > Any clue besides just disabling ipv6? ;) > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c 2013-11-15 22:29 ` [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c Bjorn Helgaas @ 2013-11-15 22:44 ` David Miller 2013-11-15 23:39 ` Ian Kumlien 0 siblings, 1 reply; 6+ messages in thread From: David Miller @ 2013-11-15 22:44 UTC (permalink / raw) To: bhelgaas; +Cc: pomac, linux-kernel, edumazet, netdev, alex.aring From: Bjorn Helgaas <bhelgaas@google.com> Date: Fri, 15 Nov 2013 15:29:53 -0700 > [+cc David, Eric, Alex, netdev] > > Alex reported a similar issue at > http://marc.info/?l=linux-netdev&m=138355719901790&w=4 Fixed by: commit 84502b5ef9849a9694673b15c31bd3ac693010ae Author: Steffen Klassert <steffen.klassert@secunet.com> Date: Wed Oct 30 11:16:28 2013 +0100 xfrm: Fix null pointer dereference when decoding sessions On some codepaths the skb does not have a dst entry when xfrm_decode_session() is called. So check for a valid skb_dst() before dereferencing the device interface index. We use 0 as the device index if there is no valid skb_dst(), or at reverse decoding we use skb_iif as device interface index. Bug was introduced with git commit bafd4bd4dc ("xfrm: Decode sessions with output interface."). Reported-by: Meelis Roos <mroos@linux.ee> Tested-by: Meelis Roos <mroos@linux.ee> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c index 4764ee4..e1a6393 100644 --- a/net/ipv4/xfrm4_policy.c +++ b/net/ipv4/xfrm4_policy.c @@ -104,10 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) const struct iphdr *iph = ip_hdr(skb); u8 *xprth = skb_network_header(skb) + iph->ihl * 4; struct flowi4 *fl4 = &fl->u.ip4; + int oif = 0; + + if (skb_dst(skb)) + oif = skb_dst(skb)->dev->ifindex; memset(fl4, 0, sizeof(struct flowi4)); fl4->flowi4_mark = skb->mark; - fl4->flowi4_oif = skb_dst(skb)->dev->ifindex; + fl4->flowi4_oif = reverse ? skb->skb_iif : oif; if (!ip_is_fragment(iph)) { switch (iph->protocol) { diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c index dd503a3..5f8e128 100644 --- a/net/ipv6/xfrm6_policy.c +++ b/net/ipv6/xfrm6_policy.c @@ -135,10 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) struct ipv6_opt_hdr *exthdr; const unsigned char *nh = skb_network_header(skb); u8 nexthdr = nh[IP6CB(skb)->nhoff]; + int oif = 0; + + if (skb_dst(skb)) + oif = skb_dst(skb)->dev->ifindex; memset(fl6, 0, sizeof(struct flowi6)); fl6->flowi6_mark = skb->mark; - fl6->flowi6_oif = skb_dst(skb)->dev->ifindex; + fl6->flowi6_oif = reverse ? skb->skb_iif : oif; fl6->daddr = reverse ? hdr->saddr : hdr->daddr; fl6->saddr = reverse ? hdr->daddr : hdr->saddr; ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c 2013-11-15 22:44 ` David Miller @ 2013-11-15 23:39 ` Ian Kumlien 2013-11-15 23:57 ` David Miller 0 siblings, 1 reply; 6+ messages in thread From: Ian Kumlien @ 2013-11-15 23:39 UTC (permalink / raw) To: David Miller; +Cc: bhelgaas, pomac, linux-kernel, edumazet, netdev, alex.aring On Fri, Nov 15, 2013 at 05:44:26PM -0500, David Miller wrote: > From: Bjorn Helgaas <bhelgaas@google.com> > Date: Fri, 15 Nov 2013 15:29:53 -0700 > > > [+cc David, Eric, Alex, netdev] > > > > Alex reported a similar issue at > > http://marc.info/?l=linux-netdev&m=138355719901790&w=4 > > Fixed by: > > commit 84502b5ef9849a9694673b15c31bd3ac693010ae > Author: Steffen Klassert <steffen.klassert@secunet.com> > Date: Wed Oct 30 11:16:28 2013 +0100 Cherry-picked, compiled and preparing for reboot - thanks! Shouldn't this be queued up in stable sometime soonish? (Sorry for the change of email address, i had forgot to switch the configurations in mutt) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c 2013-11-15 23:39 ` Ian Kumlien @ 2013-11-15 23:57 ` David Miller 2013-11-18 9:22 ` Steffen Klassert 0 siblings, 1 reply; 6+ messages in thread From: David Miller @ 2013-11-15 23:57 UTC (permalink / raw) To: pomac Cc: bhelgaas, pomac, linux-kernel, edumazet, netdev, alex.aring, steffen.klassert From: Ian Kumlien <pomac@demius.net> Date: Sat, 16 Nov 2013 00:39:19 +0100 > On Fri, Nov 15, 2013 at 05:44:26PM -0500, David Miller wrote: >> From: Bjorn Helgaas <bhelgaas@google.com> >> Date: Fri, 15 Nov 2013 15:29:53 -0700 >> >> > [+cc David, Eric, Alex, netdev] >> > >> > Alex reported a similar issue at >> > http://marc.info/?l=linux-netdev&m=138355719901790&w=4 >> >> Fixed by: >> >> commit 84502b5ef9849a9694673b15c31bd3ac693010ae >> Author: Steffen Klassert <steffen.klassert@secunet.com> >> Date: Wed Oct 30 11:16:28 2013 +0100 > > Cherry-picked, compiled and preparing for reboot - thanks! > > Shouldn't this be queued up in stable sometime soonish? > > (Sorry for the change of email address, i had forgot to switch the > configurations in mutt) Steffen is in charge of IPSEC -stable submissions, please ask him :-) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c 2013-11-15 23:57 ` David Miller @ 2013-11-18 9:22 ` Steffen Klassert 2013-11-23 21:10 ` Kirill A. Shutemov 0 siblings, 1 reply; 6+ messages in thread From: Steffen Klassert @ 2013-11-18 9:22 UTC (permalink / raw) To: David Miller Cc: pomac, bhelgaas, pomac, linux-kernel, edumazet, netdev, alex.aring On Fri, Nov 15, 2013 at 06:57:55PM -0500, David Miller wrote: > From: Ian Kumlien <pomac@demius.net> > Date: Sat, 16 Nov 2013 00:39:19 +0100 > > > On Fri, Nov 15, 2013 at 05:44:26PM -0500, David Miller wrote: > >> From: Bjorn Helgaas <bhelgaas@google.com> > >> Date: Fri, 15 Nov 2013 15:29:53 -0700 > >> > >> > [+cc David, Eric, Alex, netdev] > >> > > >> > Alex reported a similar issue at > >> > http://marc.info/?l=linux-netdev&m=138355719901790&w=4 > >> > >> Fixed by: > >> > >> commit 84502b5ef9849a9694673b15c31bd3ac693010ae > >> Author: Steffen Klassert <steffen.klassert@secunet.com> > >> Date: Wed Oct 30 11:16:28 2013 +0100 > > > > Cherry-picked, compiled and preparing for reboot - thanks! > > > > Shouldn't this be queued up in stable sometime soonish? > > > > (Sorry for the change of email address, i had forgot to switch the > > configurations in mutt) > > Steffen is in charge of IPSEC -stable submissions, please ask him > :-) It was intended for v3.12 but the release came before it was merged into the manline. So yes, it should go to the v3.12 stable tree. I've always did stable submissions just by marking them as a candidate for stable, this did not happen here because I hoped it will make it into v3.12. It should apply cleanly to v3.12 stable, you could just pick it into you stable queue, or alternatively I can submit to stable. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c 2013-11-18 9:22 ` Steffen Klassert @ 2013-11-23 21:10 ` Kirill A. Shutemov 0 siblings, 0 replies; 6+ messages in thread From: Kirill A. Shutemov @ 2013-11-23 21:10 UTC (permalink / raw) To: Steffen Klassert Cc: David Miller, pomac, bhelgaas, pomac, linux-kernel, edumazet, netdev, alex.aring, stable On Mon, Nov 18, 2013 at 10:22:55AM +0100, Steffen Klassert wrote: > On Fri, Nov 15, 2013 at 06:57:55PM -0500, David Miller wrote: > > From: Ian Kumlien <pomac@demius.net> > > Date: Sat, 16 Nov 2013 00:39:19 +0100 > > > > > On Fri, Nov 15, 2013 at 05:44:26PM -0500, David Miller wrote: > > >> From: Bjorn Helgaas <bhelgaas@google.com> > > >> Date: Fri, 15 Nov 2013 15:29:53 -0700 > > >> > > >> > [+cc David, Eric, Alex, netdev] > > >> > > > >> > Alex reported a similar issue at > > >> > http://marc.info/?l=linux-netdev&m=138355719901790&w=4 > > >> > > >> Fixed by: > > >> > > >> commit 84502b5ef9849a9694673b15c31bd3ac693010ae > > >> Author: Steffen Klassert <steffen.klassert@secunet.com> > > >> Date: Wed Oct 30 11:16:28 2013 +0100 > > > > > > Cherry-picked, compiled and preparing for reboot - thanks! > > > > > > Shouldn't this be queued up in stable sometime soonish? > > > > > > (Sorry for the change of email address, i had forgot to switch the > > > configurations in mutt) > > > > Steffen is in charge of IPSEC -stable submissions, please ask him > > :-) > > It was intended for v3.12 but the release came before it was merged > into the manline. So yes, it should go to the v3.12 stable tree. > > I've always did stable submissions just by marking them as a > candidate for stable, this did not happen here because I hoped > it will make it into v3.12. It should apply cleanly to v3.12 > stable, you could just pick it into you stable queue, or > alternatively I can submit to stable. Any progress with getting the patch into stable? It's not in v3.12.1 and I don't see it in stable queue. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-11-23 21:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20131115183422.GA9417@pomac.netswarm.net>
2013-11-15 22:29 ` [OOPS][3.12] BUG: unable to handle kernel NULL pointer dereference at 0000000c Bjorn Helgaas
2013-11-15 22:44 ` David Miller
2013-11-15 23:39 ` Ian Kumlien
2013-11-15 23:57 ` David Miller
2013-11-18 9:22 ` Steffen Klassert
2013-11-23 21:10 ` Kirill A. Shutemov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).