linux-kernel - [regression] nf_iterate(), BUG: unable to handle kernel NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080724115625.GA23994@elte.hu>
Date:	Thu, 24 Jul 2008 13:56:25 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	David Miller <davem@...emloft.net>
Cc:	herbert@...dor.apana.org.au, w@....eu, davidn@...idnewall.com,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	stefanr@...6.in-berlin.de, rjw@...k.pl, ilpo.jarvinen@...sinki.fi,
	Dave Jones <davej@...hat.com>
Subject: [regression] nf_iterate(), BUG: unable to handle kernel NULL
	pointer dereference


here's a new type of crash a -tip testbox triggered today:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
IP: [<0000000000000000>] 0x0
PGD 0 
Oops: 0010 [1] PREEMPT 
CPU 0 
Pid: 5331, comm: ssh Not tainted 2.6.26 #21613
RIP: 0010:[<0000000000000000>]  [<0000000000000000>] 0x0
RSP: 0018:ffff88003b959a70  EFLAGS: 00010217
RAX: ffff88003b9ba91c RBX: ffff88003b9baac0 RCX: 0000000000000002
RDX: ffff88003b9baac0 RSI: 0000000000000014 RDI: ffff88003b9ba3d8
RBP: ffff88003b959a98 R08: ffff88003e434130 R09: ffff88003b9598b8
R10: 0000000000002000 R11: 00000000d85507ac R12: ffff88003b9ba3d8
R13: 0000000000000002 R14: ffff88003e06a020 R15: 0000000000000000
FS:  00007fb2b7806780(0000) GS:ffffffff80c1c180(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 000000003b9e8000 CR4: 00000000000006a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ssh (pid: 5331, threadinfo ffff88003b958000, task ffff88003b99a000)
Stack:  ffffffff80777f25 ffff88003b959a98 ffffffff80c24170 ffff88003b959b28
 0000000000000004 ffff88003b959ae8 ffffffff80733107 ffff88003b959ab8
 ffff88003b9ba3d8 ffffffff80c1ed60 0000000000000004 ffff88003b9ba3d8
Call Trace:
 [<ffffffff80777f25>] ? ipv4_confirm+0x8d/0x122
 [<ffffffff80733107>] nf_iterate+0x43/0xa5
 [<ffffffff8074bbb2>] ? ip_finish_output+0x0/0x62
 [<ffffffff807331cd>] nf_hook_slow+0x64/0xcb
 [<ffffffff8074bbb2>] ? ip_finish_output+0x0/0x62
 [<ffffffff8074b63b>] nf_hook_thresh+0x1e/0x20
 [<ffffffff8074bd44>] ip_output+0xb3/0xc9
 [<ffffffff8074a27e>] dst_output+0xb/0xd
 [<ffffffff8074b6ef>] ip_local_out+0x1e/0x22
 [<ffffffff8074c75c>] ip_queue_xmit+0x2a6/0x321
 [<ffffffff80241961>] ? sub_preempt_count+0x2d/0x40
 [<ffffffff8028f239>] ? slob_alloc+0x11b/0x248
 [<ffffffff8075b85a>] tcp_transmit_skb+0x5ec/0x61b
 [<ffffffff807122b6>] ? kmalloc+0xc/0xe
 [<ffffffff8075d7ae>] tcp_connect+0x2a4/0x344
 [<ffffffff80760cf1>] tcp_v4_connect+0x3cd/0x425
 [<ffffffff8076bc7d>] inet_stream_connect+0x9a/0x24d
 [<ffffffff80292988>] ? fget_light+0x38/0x85
 [<ffffffff8070c60c>] sys_connect+0x68/0x8b
 [<ffffffff8025dfab>] ? up_read+0x9/0xb
 [<ffffffff8023727c>] ? do_page_fault+0x55f/0x92f
 [<ffffffff8022479a>] system_call_fastpath+0x16/0x1b

with this config:

  http://redhat.com/~mingo/misc/config-Thu_Jul_24_13_23_34_CEST_2008.bad

i'll try a bisection.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/