linux-kernel - linux-next: kernel panic in ipv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <567A0DCD.3060001@oracle.com>
Date:	Wed, 23 Dec 2015 10:58:21 +0800
From:	Junxiao Bi <junxiao.bi@...cle.com>
To:	netdev@...r.kernel.org
Cc:	davem@...emloft.net, linux-next@...r.kernel.org,
	Linux Kernel mailing list <linux-kernel@...r.kernel.org>
Subject: linux-next: kernel panic in ipv6_defrag

Hi,

The following panic happened when I run ocfs2-test on linux-next. Kernel
config is attached.

==================================

[64910.905501] BUG: unable to handle kernel NULL pointer dereference at
          (null)
[64910.906466] IP: [<ffffffff8183cc8d>] nf_ct_frag6_gather+0x7ad/0x9c0
[64910.906466] PGD 7bf0e067 PUD 7bf26067 PMD 0
[64910.906466] Oops: 0000 [#1] SMP
[64910.906466] Modules linked in: ocfs2(O) ocfs2_dlmfs(O)
ocfs2_stack_o2cb(O) ocfs2_dlm(O) ocfs2_nodemanager(O) ocfs2_stackglue(O)
iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi xen_kbdfront
xen_netfront xen_fbfront xen_blkfront [last unloaded: ocfs2_stackglue]
[64910.906466] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O
4.4.0-rc5-next-20151217 #1
[64910.906466] Hardware name: Xen HVM domU, BIOS 4.3.1OVM 05/14/2014
[64910.906466] task: ffffffff81e12500 ti: ffffffff81e00000 task.ti:
ffffffff81e00000
[64910.906466] RIP: 0010:[<ffffffff8183cc8d>]  [<ffffffff8183cc8d>]
nf_ct_frag6_gather+0x7ad/0x9c0
[64910.906466] RSP: 0018:ffff88007d203888  EFLAGS: 00010286
[64910.906466] RAX: ffff88007bb26000 RBX: ffff88007bb27b00 RCX:
0000000000000000
[64910.906466] RDX: 0000000000000000 RSI: ffff88007bb27b00 RDI:
ffff88007bb26000
[64910.906466] RBP: ffff88007d2038f8 R08: ffff88007d21a7c0 R09:
ffff88007bb26000
[64910.906466] R10: 000000000000000e R11: 00000000d744fcc9 R12:
ffff88007aa881d0
[64910.906466] R13: ffff88007bb27500 R14: ffff88007bb27b28 R15:
00000000000005ad
[64910.906466] FS:  0000000000000000(0000) GS:ffff88007d200000(0000)
knlGS:0000000000000000
[64910.906466] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[64910.906466] CR2: 0000000000000000 CR3: 000000007bf0b000 CR4:
00000000000406f0
[64910.906466] Stack:
[64910.906466]  0000000000000000 ffff88007a488000 000000e500601fe0
ffffffff81ed0000
[64910.906466]  0000000167157ded ffff880037bddfd6 ffff880037bddfe6
ffffff0100000003
[64910.906466]  ffffea0000de1da0 ffff88007d2039b8 ffff88007bb27b00
ffffffff81ed4f38
[64910.906466] Call Trace:
[64910.906466]  <IRQ>
[64910.906466]  [<ffffffff8183c12a>] ipv6_defrag+0x5a/0x80
[64910.906466]  [<ffffffff8176fb3d>] nf_iterate+0x6d/0x90
[64910.906466]  [<ffffffff8176fc88>] nf_hook_slow+0x38/0xc0
[64910.906466]  [<ffffffff8180642c>] ipv6_rcv+0x40c/0x4e0
[64910.906466]  [<ffffffff81805f80>] ? ip6_forward+0x800/0x800
[64910.906466]  [<ffffffff8178d5b0>] ? inet_add_protocol+0x40/0x40
[64910.906466]  [<ffffffff8173effa>] __netif_receive_skb_core+0x6ba/0x990
[64910.906466]  [<ffffffff818416ae>] ? ipv6_gro_receive+0x22e/0x300
[64910.906466]  [<ffffffff8173f2ed>] __netif_receive_skb+0x1d/0x70
[64910.906466]  [<ffffffff8173f4fe>] netif_receive_skb_internal+0x1e/0x80
[64910.906466]  [<ffffffff817405ee>] napi_gro_receive+0x10e/0x190
[64910.906466]  [<ffffffffa00145f4>] xennet_poll+0xa44/0xc90 [xen_netfront]
[64910.906466]  [<ffffffff810c3e06>] ? mod_timer+0xf6/0x1b0
[64910.906466]  [<ffffffff817a9f19>] ? tcp_schedule_loss_probe+0xe9/0x140
[64910.906466]  [<ffffffff817abb2b>] ? tcp_write_xmit+0x2cb/0xf10
[64910.906466]  [<ffffffff8173ffa3>] net_rx_action+0x193/0x430
[64910.906466]  [<ffffffff810b2d1d>] ? handle_irq_event_percpu+0x9d/0x1a0
[64910.906466]  [<ffffffff8172a753>] ? skb_release_all+0x23/0x30
[64910.906466]  [<ffffffff813474dd>] ? radix_tree_lookup+0xd/0x10
[64910.906466]  [<ffffffff810b2e66>] ? handle_irq_event+0x46/0x70
[64910.906466]  [<ffffffff810b6b50>] ? handle_edge_irq+0x70/0x120
[64910.906466]  [<ffffffff8106e040>] __do_softirq+0xd0/0x280
[64910.906466]  [<ffffffff8106e2e5>] irq_exit+0xa5/0xb0
[64910.906466]  [<ffffffff813e28f5>] xen_evtchn_do_upcall+0x35/0x50
[64910.906466]  [<ffffffff8191d532>] xen_hvm_callback_vector+0x82/0x90
[64910.906466]  <EOI>
[64910.906466]  [<ffffffff81058e26>] ? native_safe_halt+0x6/0x10
[64910.906466]  [<ffffffff8101fe8d>] default_idle+0x1d/0xb0
[64910.906466]  [<ffffffff8101f7ea>] arch_cpu_idle+0xa/0x10
[64910.906466]  [<ffffffff810a1b49>] default_idle_call+0x29/0x40
[64910.906466]  [<ffffffff810a1e92>] cpu_startup_entry+0x282/0x300
[64910.906466]  [<ffffffff819104b7>] rest_init+0x77/0x80
[64910.906466]  [<ffffffff81f4cc81>] ? set_init_arg+0x5e/0x5e
[64910.906466]  [<ffffffff81f4c117>] ? early_idt_handler_array+0x117/0x120
[64910.906466]  [<ffffffff81f4c603>] x86_64_start_reservations+0x2a/0x2c
[64910.906466]  [<ffffffff81f4c7a1>] x86_64_start_kernel+0x19c/0x1ab
[64910.906466] Code: ff 4c 39 eb 74 4f be 20 00 08 02 48 89 df e8 5b fe
ee ff 48 85 c0 0f 84 57 fd ff ff 48 8b 13 48 89 10 49 8b 55 00 49 39 d5
74 10 <48> 8b 0a 48 39 cb 74 05 48 89 ca eb ee 48 89 02 48 89 df 4c 89
[64910.906466] RIP  [<ffffffff8183cc8d>] nf_ct_frag6_gather+0x7ad/0x9c0
[64910.906466]  RSP <ffff88007d203888>
[64910.906466] CR2: 0000000000000000
[64910.906466] ---[ end trace 3aabdbc6e69174f9 ]---
[64910.906466] Kernel panic - not syncing: Fatal exception in interrupt
[64910.906466] Kernel Offset: disabled

Thanks,
Junxiao.

View attachment "config" of type "text/plain" (108188 bytes)