From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chuck Ebbert Subject: Re: Null pointer dereference in nf_nat_move_storage(), kernel 2.6.23.1 Date: Wed, 14 Nov 2007 18:25:15 -0500 Message-ID: <473B83DB.5040303@redhat.com> References: <473B3874.2020104@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Patrick McHardy , Netdev To: netfilter-devel@vger.kernel.org Return-path: Received: from mx1.redhat.com ([66.187.233.31]:34087 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754800AbXKNXZS (ORCPT ); Wed, 14 Nov 2007 18:25:18 -0500 In-Reply-To: <473B3874.2020104@redhat.com> Sender: netfilter-devel-owner@vger.kernel.org List-Id: netfilter-devel.vger.kernel.org On 11/14/2007 01:03 PM, Chuck Ebbert wrote: [adding proper address for netfilter; oops has been debugged down to file and line number bewlow] > https://bugzilla.redhat.com/show_bug.cgi?id=259501#c14 > > BUG: unable to handle kernel NULL pointer dereference at virtual address 0000064 > printing eip: f8ae1087 > *pde = 39644067 > Oops: 0000 [#1] > SMP > CPU: 1 > EIP: 0060:[] Not tainted VLI > EFLAGS: 00010202 (2.6.23.1-21.fc7 #1) > EIP is at nf_nat_move_storage+0x23/0x69 [nf_nat] > eax: 00000004 ebx: d73a1bc4 ecx: f8ae1064 edx: d73a1bc0 > esi: d73a1bc0 edi: 00000000 ebp: dfcb6b40 esp: c0786c74 > ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068 > Process swapper (pid: 0, ti=c0786000 task=f7d02c20 task.ti=c18fd000) > Stack:d657fd80 00000001 00000000 f8b61643 00000000 0000004c 00000028 00000000 > 00000000 f8b81260 dfcb6b40 f8c0af20 f8b5f7a5 f8b5dd73 c0786cd8 f8ae4180 > 130aa8c0 f8ae19dd dfcb6b40 f34b6000 dfcb6b40 00000000 00000001 c0786d14 > Call Trace: > [] __nf_ct_ext_add+0x12f/0x1c4 [nf_conntrack] > [] nf_ct_helper_ext_add+0x9/0x15 [nf_conntrack] > [] nf_conntrack_alter_reply+0x73/0x96 [nf_conntrack] > [] nf_nat_setup_info+0x3f3/0x54e [nf_nat] > [] ipt_dnat_target+0x0/0x14c [iptable_nat] > [] ipt_dnat_target+0x144/0x14c [iptable_nat] > [] tcp_packet+0xa1c/0xa4b [nf_conntrack] > [] skb_checksum+0x4f/0x29a > [] ipt_dnat_target+0x0/0x14c [iptable_nat] > [] ipt_do_table+0x3f0/0x482 [ip_tables] > [] nf_conntrack_alloc+0x16d/0x1c5 [nf_conntrack] > [] tcp_new+0xd1/0x1a4 [nf_conntrack] > [] ipt_do_table+0x425/0x482 [ip_tables] > [] nf_nat_rule_find+0x21/0x5c [iptable_nat] > [] nf_nat_fn+0x165/0x189 [iptable_nat] > [] nf_nat_in+0x29/0x9c [iptable_nat] > [] ip_rcv_finish+0x0/0x291 > [] nf_iterate+0x38/0x6a > [] ip_rcv_finish+0x0/0x291 > [] nf_hook_slow+0x4d/0xb5 > [] ip_rcv_finish+0x0/0x291 > [] ip_rcv+0x20b/0x4ba > [] ip_rcv_finish+0x0/0x291 > [] ktime_get_real+0xf/0x2b > [] netif_receive_skb+0x2e1/0x346 > [] __wake_up+0x32/0x43 > [] e100_poll+0x166/0x2b5 [e100] > [] __slab_free+0x5c/0x216 > [] net_rx_action+0x9a/0x196 > [] __do_softirq+0x66/0xd3 > [] do_softirq+0x6c/0xce > [] tick_do_update_jiffies64+0x93/0xa8 > [] handle_fasteoi_irq+0x0/0xa6 > [] irq_exit+0x38/0x6b > [] do_IRQ+0x9f/0xb9 > [] default_idle+0x0/0x55 > [] common_interrupt+0x23/0x28 > [] default_idle+0x0/0x55 > [] save_v86_state+0x19/0x12b > [] native_safe_halt+0x2/0x3 > [] default_idle+0x39/0x55 > [] cpu_idle+0xab/0xcc > ======================= > Code: 64 0f fe ff ff 31 c0 c3 57 56 89 d6 53 8b 90 ec 00 00 00 85 d2 74 0f 8a 42 > 01 84 c0 74 08 0f b6 c0 8d 1c 02 eb 02 31 db 8b 7e 18 47 64 80 01 00 00 74 > 39 b8 40 41 ae f8 e8 fd b7 b3 c7 8b 16 > > > > nf_nat_move_storage(): > /usr/src/debug/kernel-2.6.23/linux-2.6.23.i686/net/ipv4/netfilter/nf_nat_core.c:612 > 87: f7 47 64 80 01 00 00 testl $0x180,0x64(%edi) > 8e: 74 39 je c9 > > line 612: > if (!(ct->status & IPS_NAT_DONE_MASK)) > return; > > ct is NULL > >