From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
To: Salam Noureddine <noureddine@arista.com>
Cc: "Eric Dumazet" <eric.dumazet@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
"Pali Rohár" <pali.rohar@gmail.com>,
"Network Development" <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"Sebastian Reichel" <sre@kernel.org>,
"linux-omap@vger.kernel.org" <linux-omap@vger.kernel.org>
Subject: Re: [OOPS] In __netif_receive_skb_core
Date: Tue, 12 Jan 2016 02:51:06 +0200 [thread overview]
Message-ID: <56944DFA.4050002@gmail.com> (raw)
In-Reply-To: <CAO7SqHA9dNUDG+pYJoQvipE_ErM4Bgo0_o9er_OLxZLDgNVJ8Q@mail.gmail.com>
On 12.01.2016 00:11, Salam Noureddine wrote:
> Would you be able to disassemble your kernel so we could tell where
> the null pointer dereference happens?
>
Sure, but wouldn't it be better to provide the object file containing
the debug symbols as well?
Otherwise, the null pointer dereference happens somewhere in:
(gdb) l *__netif_receive_skb_core+0x7c0
0x1318 is in __netif_receive_skb_core (include/linux/compiler.h:218).
213 })
214
215 static __always_inline
216 void __read_once_size(const volatile void *p, void *res, int size)
217 {
218 __READ_ONCE_SIZE;
219 }
220
221 #ifdef CONFIG_KASAN
222 /*
(gdb) l *__netif_receive_skb_core+0x7bc
0x1314 is in __netif_receive_skb_core (net/core/dev.c:3934).
3929 }
3930
3931 deliver_ptype_list_skb(skb, &pt_prev, orig_dev, type,
3932 &orig_dev->ptype_specific);
3933
3934 if (unlikely(skb->dev != orig_dev)) {
3935 deliver_ptype_list_skb(skb, &pt_prev, orig_dev, type,
3936 &skb->dev->ptype_specific);
3937 }
3938
(gdb) l *__netif_receive_skb_core+0x7c4
0x131c is in __netif_receive_skb_core (net/core/dev.c:3935).
3930
3931 deliver_ptype_list_skb(skb, &pt_prev, orig_dev, type,
3932 &orig_dev->ptype_specific);
3933
3934 if (unlikely(skb->dev != orig_dev)) {
3935 deliver_ptype_list_skb(skb, &pt_prev, orig_dev, type,
3936 &skb->dev->ptype_specific);
3937 }
3938
3939 if (pt_prev) {
0x00001300 <+1960>: cmp r10, r3
0x00001304 <+1964>: bne 0x1284 <__netif_receive_skb_core+1836>
0x00001308 <+1968>: ldr r4, [sp, #12]
0x0000130c <+1972>: ldr r3, [r4, #20]
0x00001310 <+1976>: cmp r3, r6
0x00001314 <+1980>: beq 0x13b0 <__netif_receive_skb_core+2136>
0x00001318 <+1984>: ldr r5, [r3, #92] ; 0x5c <-FAULT
r3 seems to be skb->dev
0x0000131c <+1988>: add r10, r3, #92 ; 0x5c
0x00001320 <+1992>: add r8, r4, #180 ; 0xb4
0x00001324 <+1996>: sub r5, r5, #20
0x00001328 <+2000>: b 0x13a4 <__netif_receive_skb_core+2124>
0x0000132c <+2004>: ldrh r3, [r5]
0x00001330 <+2008>: cmp r3, r7
I put some additional printks around that code, and it turned out that
skb->dev is null, so "if (unlikely(skb->dev != orig_dev))" succeeds, but
"&skb->dev->ptype_specific" oopses.
Thanks,
Ivo
next prev parent reply other threads:[~2016-01-12 0:51 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-07 17:54 [OOPS] In __netif_receive_skb_core Ivaylo Dimitrov
2016-01-10 17:48 ` Ivaylo Dimitrov
2016-01-10 20:26 ` Eric Dumazet
2016-01-11 21:03 ` Ivaylo Dimitrov
2016-01-11 22:11 ` Salam Noureddine
2016-01-12 0:51 ` Ivaylo Dimitrov [this message]
2016-01-12 1:06 ` Eric Dumazet
2016-01-12 1:19 ` Salam Noureddine
2016-01-12 2:21 ` Eric Dumazet
2016-01-12 2:25 ` Eric Dumazet
2016-01-12 7:16 ` Ivaylo Dimitrov
2016-01-12 14:19 ` Eric Dumazet
2016-01-12 16:58 ` [PATCH net] phonet: properly unshare skbs in phonet_rcv() Eric Dumazet
2016-01-12 20:47 ` David Miller
2016-01-13 12:26 ` Rémi Denis-Courmont
2016-01-13 15:07 ` Eric Dumazet
2016-01-12 18:15 ` [OOPS] In __netif_receive_skb_core Salam Noureddine
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56944DFA.4050002@gmail.com \
--to=ivo.g.dimitrov.75@gmail.com \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-omap@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=noureddine@arista.com \
--cc=pali.rohar@gmail.com \
--cc=sre@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).