netdev - Re: BUG: 4.14.11 unable to handle kernel NULL pointer dereference in xfrm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 5 Jan 2018 23:40:55 +0100
From:   Tobias Hommel <netdev-list@...oetigt.de>
To:     Holger Hoffstätte 
        <holger@...lied-asynchrony.com>
Cc:     netdev@...r.kernel.org
Subject: Re: BUG: 4.14.11 unable to handle kernel NULL pointer dereference in
 xfrm_lookup

On Fri, Jan 05, 2018 at 09:51:16PM +0000, Holger Hoffstätte wrote:
> On Fri, 05 Jan 2018 22:13:23 +0100, Tobias Hommel wrote:
> 
> > Hi,
> > 
> > I'm running into a NULL pointer dereference after updating from Linux 4.1.6 to
> > 4.14.11 (see kernel log below). I tried 4.14.3 initially which did not work
> > either.
> > Anyone has an idea what is happening here?
> 
> Try 4.14.12 because of:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.14.y&id=2d01ac8cc12b973668bf898b03bf9ffb12d83b83

Using tunnel mode here, not transport mode. Anyway, I tried it, the same
problem:
[  275.655170] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
[  275.663230] IP: xfrm_lookup+0x2a/0x7d0
[  275.666986] PGD 0 P4D 0 
[  275.669579] Oops: 0000 [#1] SMP PTI
[  275.673097] Modules linked in:
[  275.676182] CPU: 6 PID: 0 Comm: swapper/6 Not tainted 4.14.12 #1
[  275.682215] Hardware name: To be filled by O.E.M. CAR-2051/CAR, BIOS 1.01 07/11/2016
[  275.690013] task: ffff9b43fb0ed080 task.stack: ffffb0af00090000
[  275.695960] RIP: 0010:xfrm_lookup+0x2a/0x7d0
[  275.700256] RSP: 0018:ffff9b43ffd83bd0 EFLAGS: 00010246
[  275.705528] RAX: 0000000000000000 RBX: ffffffff8e074080 RCX: 0000000000000000
[  275.712710] RDX: ffff9b43ffd83c48 RSI: 0000000000000000 RDI: ffffffff8e074080
[  275.719895] RBP: ffffffff8e074080 R08: 0000000000000002 R09: 0000000000000000
[  275.727071] R10: 0000000000000020 R11: 0000000000000020 R12: ffff9b43ffd83c48
[  275.734248] R13: 0000000000000000 R14: 0000000000000002 R15: ffff9b43fb240078
[  275.741415] FS:  0000000000000000(0000) GS:ffff9b43ffd80000(0000) knlGS:0000000000000000
[  275.749527] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  275.755307] CR2: 0000000000000020 CR3: 000000013e00a000 CR4: 00000000001006e0
[  275.762474] Call Trace:
[  275.764939]  <IRQ>     
[  275.766986]  __xfrm_route_forward+0xa4/0x110
[  275.771282]  ip_forward+0x3da/0x450
[  275.774803]  ? ip_rcv_finish+0x61/0x390
[  275.778666]  ip_rcv+0x2b5/0x380
[  275.781840]  ? inet_del_offload+0x30/0x30
[  275.785860]  __netif_receive_skb_core+0x751/0xb00
[  275.790593]  ? tcp_gro_receive+0x24d/0x310
[  275.794716]  ? netif_receive_skb_internal+0x47/0xf0
[  275.799620]  netif_receive_skb_internal+0x47/0xf0
[  275.804381]  napi_gro_flush+0x50/0x70
[  275.808071]  napi_complete_done+0x90/0xd0
[  275.812111]  igb_poll+0x8fd/0xe80
[  275.815458]  net_rx_action+0x1fc/0x310
[  275.819227]  __do_softirq+0xd5/0x1cf
[  275.822834]  irq_exit+0xa3/0xb0
[  275.826003]  do_IRQ+0x45/0xc0
[  275.829004]  common_interrupt+0x95/0x95
[  275.832868]  </IRQ>    
[  275.835002] RIP: 0010:cpuidle_enter_state+0x120/0x200
[  275.840076] RSP: 0018:ffffb0af00093eb8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff7d
[  275.847685] RAX: ffff9b43ffd9ea80 RBX: 0000000000000002 RCX: 000000402e53956c
[  275.854844] RDX: 0000000000000000 RSI: 00000000355556ca RDI: 0000000000000000
[  275.862039] RBP: ffff9b43ffda71e8 R08: 0000000000000003 R09: 0000000000000018
[  275.869222] R10: 00000000ffffffff R11: 0000000000000102 R12: 000000402e53956c
[  275.876398] R13: 000000402e4e8838 R14: 0000000000000002 R15: 0000000000000000
[  275.883568]  ? cpuidle_enter_state+0x11c/0x200
[  275.888023]  do_idle+0xd6/0x170
[  275.891177]  cpu_startup_entry+0x67/0x70
[  275.895129]  start_secondary+0x167/0x190
[  275.899080]  secondary_startup_64+0xa5/0xb0
[  275.903291] Code: 00 41 57 41 56 45 89 c6 41 55 41 54 49 89 f5 55 53 49 89 d4 48 89 fb 48 83 ec 40 65 48 8b 04 25 28 00 00 00 48 89 44 24 38 31 c0 <48> 8b 46 20 48 85 c9 44 0f b7 38 c7 44 
[  275.922273] RIP: xfrm_lookup+0x2a/0x7d0 RSP: ffff9b43ffd83bd0
[  275.928070] CR2: 0000000000000020
[  275.931417] ---[ end trace 453df6e200be3ed0 ]---
[  275.936061] Kernel panic - not syncing: Fatal exception in interrupt
[  275.942566] Kernel Offset: 0xc000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  275.953309] Rebooting in 10 seconds..

> 
> -h
>