linux-kernel - Re: [xfrm?] BUG: unable to handle kernel NULL pointer dereference at 00000004

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 7 Jun 2013 16:50:13 +0800
From:	Fan Du <fan.du@...driver.com>
To:	Fengguang Wu <fengguang.wu@...el.com>
CC:	Steffen Klassert <steffen.klassert@...unet.com>,
	<linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>
Subject: Re: [xfrm?] BUG: unable to handle kernel NULL pointer dereference
 at 00000004

Hi FengGuang

On 2013年06月06日 20:55, Fengguang Wu wrote:
> Greetings,
>
> I got the below dmesg and the first bad commit is
>
> commit 4c4d41f200db375b2d2cc6d0a1de0606c8266398
> Author: Fan Du<fan.du@...driver.com>
> Date:   Thu Jun 6 10:15:54 2013 +0800
>
>      xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter
>
>      When host ping its peer, ICMP echo request packet triggers IPsec
>      policy, then host negotiates SA secret with its peer. After IKE
>      installed SA for OUT direction, but before SA for IN direction
>      installed, host get ICMP echo reply from its peer. At the time
>      being, the SA state for IN direction could be XFRM_STATE_ACQ,
>      then the received packet will be dropped after adding
>      LINUX_MIB_XFRMINSTATEINVALID statistic.
>
>      Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
>      scenario when SA in larval state is much clearer for user than
>      LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
>      bad.
>
>      Signed-off-by: Fan Du<fan.du@...driver.com>
>      Signed-off-by: Steffen Klassert<steffen.klassert@...unet.com>
>
>
> [  157.721828] no cont in shutdown!
> [  158.779481] floppy0: FDC access conflict!
> [  159.555337] BUG: unable to handle kernel NULL pointer dereference at 00000004
> [  160.102544] IP: [<c1609ed5>] reset_interrupt+0x85/0x90
> [  160.102544] *pde = 00000000
> [  160.102544] Oops: 0000 [#1] PREEMPT SMP
> [  160.102544] CPU: 1 PID: 89 Comm: kworker/u4:1 Not tainted 3.10.0-rc2-00597-g4c4d41f #3
> [  160.102544] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
> [  160.102544] Workqueue: floppy reset_interrupt
> [  160.102544] task: c5a5ad00 ti: c5b5c000 task.ti: c5b5c000
> [  160.102544] EIP: 0060:[<c1609ed5>] EFLAGS: 00010246 CPU: 1
> [  160.102544] EIP is at reset_interrupt+0x85/0x90
> [  160.102544] EAX: 00000000 EBX: cbd56600 ECX: c5a5ad00 EDX: 000003f4
> [  160.102544] ESI: c1ed0e40 EDI: c5a23200 EBP: c5b5debc ESP: c5b5deac
> [  160.102544]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
> [  160.102544] CR0: 8005003b CR2: 00000004 CR3: 02037000 CR4: 00000690
> [  160.102544] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [  160.102544] DR6: ffff0ff0 DR7: 00000400
> [  160.102544] Stack:
> [  178.765341] pcd0: Autoprobe failed
> [  178.765373] pcd: No CD-ROM drive found
>
> Bisect log shows that
> - reverting the commit fixes the problem
> - linux-next is also impacted

I tested with newest net-next tree(at 93a306aef5eef70e524500884ccca52c5dd19e17) with my patch applied,
no misbehavior happened in boot up and cat /proc/net/xfrm_stat.

Now I will test against ipsec-next tree soon, please wait for just a while.

> git bisect start 4c4d41f200db375b2d2cc6d0a1de0606c8266398 5865fc1b6a99bc7dcf245770c2735577b8596b6e --
> git bisect good 5865fc1b6a99bc7dcf245770c2735577b8596b6e  #    30  2013-06-06 17:34:58  tg3: remove redundant pm init code
> git bisect  bad 4c4d41f200db375b2d2cc6d0a1de0606c8266398  #     0  2013-06-06 17:34:59  xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter
> git bisect good ce10982b1a07f6a25bb756b7509188ae8a5060d6  #    30  2013-06-06 20:42:08  Revert "xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter"
> git bisect  bad 4e1e7059d375482daeeda395bba2939679b1ee14  #     0  2013-06-06 20:42:13  Add linux-next specific files for 20130606
>
> Thanks,
> Fengguang

-- 
浮沉随浪只记今朝笑

--fan

View attachment "net-next.config" of type "text/plain" (43735 bytes)

View attachment "dmesg-net-next" of type "text/plain" (5990 bytes)