From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18328C43381 for ; Fri, 15 Feb 2019 14:12:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D9D4521A4C for ; Fri, 15 Feb 2019 14:12:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="W8kFYiMu" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2406145AbfBOOMW (ORCPT ); Fri, 15 Feb 2019 09:12:22 -0500 Received: from mail-wr1-f68.google.com ([209.85.221.68]:38831 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2406110AbfBOOMV (ORCPT ); Fri, 15 Feb 2019 09:12:21 -0500 Received: by mail-wr1-f68.google.com with SMTP id v13so10490326wrw.5 for ; Fri, 15 Feb 2019 06:12:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=abgr2UnIN8RD9XIV6tdrlAtvZ2hOsCk4Be5gfs9WS+g=; b=W8kFYiMu38wzIZlms4b5gnq1X6polCfNhJuKoRQViTiPE/wdbzRby65GuPX3+6RRdT gnqU5IbaNYPVozlbFgpc2G3KtnHcU/CT9phyX0VjdwXsoqnOEVfw+NAuwgpcJU17NFh6 Tbys1mX0s5aTBG21FtznRoBWyzGkXfi4LJOEU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=abgr2UnIN8RD9XIV6tdrlAtvZ2hOsCk4Be5gfs9WS+g=; b=Gafe5iYZvltaCoM+3utbtXtlJgfdYhIVKGKz1PYUEfh29X1QvdeCHXh1NwghFaujEH 69EMBNhmUlhLeKSrVPlojA3O/RPCVRZXAJPEgmrlR1mHTLMw5/i+r4C3iumKMeZ5akkG zElrfVCa7eO/Eo2oujUueBrZMqY8ffgZI8ZDNLyO/tAzJV/ol365T4Xx75wFM4HSIOLT NJ7sukAuRN/R6ny+a0opvXi0EhhBmtJYUePgkxXnM4TSOvKc1XSv8yxFjKyavDnSfrKC jf7vJMdB1Am4XzYiyRwv/gujTCOGOR5zRYKGXllOTJwivZT4YeVm8cs/gc3CID4gpqt4 pvUg== X-Gm-Message-State: AHQUAuaigwa3XFo5+KjhbdLiDFCOxvltIukOCQJUvvnLhKHxu8Da3dDO Fj5BGYEnr7ToedpM5wA8ePt5GaStDeQS7w== X-Google-Smtp-Source: AHgI3IY+dv+FDeRsKMQfvGWSEZM1vvpI7EZK6N6Z3BqdWf3O4rJcQeFn+Cblz7cmPzqgON+ZyXGkJw== X-Received: by 2002:a5d:68c2:: with SMTP id p2mr6245473wrw.23.1550239939782; Fri, 15 Feb 2019 06:12:19 -0800 (PST) Received: from [192.168.51.243] ([93.152.141.58]) by smtp.gmail.com with ESMTPSA id f134sm7408463wme.31.2019.02.15.06.12.18 (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Fri, 15 Feb 2019 06:12:19 -0800 (PST) Subject: Re: Bug in br_handle_frame To: Tomas Paukrt , "netdev@vger.kernel.org" Cc: "roopa@cumulusnetworks.com" References: <2c692688-ea77-1e80-6607-6577b157873a@advantech-bb.cz> From: Nikolay Aleksandrov Message-ID: <6b5d5550-07b3-61d7-c3ad-ec31f17fa862@cumulusnetworks.com> Date: Fri, 15 Feb 2019 16:12:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: <2c692688-ea77-1e80-6607-6577b157873a@advantech-bb.cz> Content-Type: text/plain; charset=iso-8859-2 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 15/02/2019 16:03, Tomas Paukrt wrote: > Hi, > > I have recently discovered that kernel 3.12.10 is occasionally crashing > due to NULL pointer dereference in function br_handle_frame when we > reconfigure the bridge, because function br_port_get_rcu returns NULL. > > It is very hard for us to replicate this issue, because it happens about > once per month in our testing environment, but I have created the > attached patch. Can you please check it? The latest kernel seems to be > affected too. > > Best regards > > Tomas > Hi, That should not be possible, br_port_get_rcu() is a wrapper for dev->rx_handler_data which in turn should always be present in case rx_handler is called as can be seen in netdev_rx_handler_unregister(). Could you please share details about the crash and possibly a trace ? Do you have any custom patches applied ? Thanks, Nik