netdev - Re: [crash] BUG: unable to handle kernel NULL pointer dereference at 0000000000000370

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4884E6E6.7010800@lwfinger.net>
Date:	Mon, 21 Jul 2008 14:43:34 -0500
From:	Larry Finger <Larry.Finger@...inger.net>
To:	Ingo Molnar <mingo@...e.hu>
CC:	Ian Schram <ischram@...enet.be>,
	David Miller <davem@...emloft.net>,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	wireless <linux-wireless@...r.kernel.org>, j@...fi
Subject: Re: [crash] BUG: unable to handle kernel NULL pointer dereference
 at 0000000000000370

Ingo Molnar wrote:
> * Larry Finger <Larry.Finger@...inger.net> wrote:
> 
>> Ingo Molnar wrote:
>>> * Ian Schram <ischram@...enet.be> wrote:
>>>
>>>> I was looking at this out of interest, but I'm in no way familiar 
>>>> with the code.
>>> thanks Ian for the patch, i'll test it.
>>>
>>> Note that it was whitespace damaged, find below a tidied up version of  
>>> the patch that i've applied to tip/out-of-tree.
>>>
>>> 	Ingo
>> This patch may be needed to fix error handling in the hw_sim code, but 
>> I get the crash even with that code disabled. I'm currently bisecting 
>> to find the culprit.
> 
> ok. I just reactivated CONFIG_MAC80211_HWSIM, applied Ian's fix and the 
> crash went away:
> 
>  calling  iwl4965_init+0x0/0x6c
>  iwl4965: Intel(R) Wireless WiFi Link 4965AGN driver for Linux, 1.3.27kd
>  iwl4965: Copyright(c) 2003-2008 Intel Corporation
>  initcall iwl4965_init+0x0/0x6c returned 0 after 10 msecs
>  calling  init_mac80211_hwsim+0x0/0x31c
>  mac80211_hwsim: Initializing radio 0
>  PM: Adding info for No Bus:hwsim0
>  PM: Adding info for No Bus:phy0
>  PM: Adding info for No Bus:wmaster0
>  phy0: Failed to select rate control algorithm
>  phy0: Failed to initialize rate control algorithm
>  PM: Removing info for No Bus:wmaster0
>  PM: Removing info for No Bus:phy0
>  mac80211_hwsim: ieee80211_register_hw failed (-2)
>  PM: Removing info for No Bus:hwsim0
>  initcall init_mac80211_hwsim+0x0/0x31c returned -2 after 58 msecs
>  initcall init_mac80211_hwsim+0x0/0x31c returned with error code -2
>  calling  dmfe_init_module+0x0/0xea
>  dmfe: Davicom DM9xxx net driver, version 1.36.4 (2002-01-17)
>  initcall dmfe_init_module+0x0/0xea returned 0 after 5 msecs
> 
> So at least as far as the init_mac80211_hwsim() deinit crash goes:
> 
> Tested-by: Ingo Molnar <mingo@...e.hu>

Yes, I'm chasing a distinct bug. The header for mine is

Jul 21 12:19:37 larrylap kernel: kernel BUG at net/core/dev.c:1328!
Jul 21 12:19:37 larrylap kernel: invalid opcode: 0000 [1] SMP
Jul 21 12:19:37 larrylap kernel: CPU 0
Jul 21 12:19:37 larrylap kernel: Modules linked in: af_packet rfkill_input nfs 
lockd nfs_acl sunrpc cpufreq_conservative cpu
freq_userspace cpufreq_powersave powernow_k8 fuse loop dm_mod arc4 ecb 
crypto_blkcipher b43 firmware_class rfkill mac80211 c
fg80211 snd_hda_intel snd_pcm snd_timer led_class snd k8temp input_polldev 
sr_mod soundcore button battery hwmon cdrom force
deth ac serio_raw ssb snd_page_alloc sg ehci_hcd sd_mod ohci_hcd usbcore edd fan 
thermal processor ext3 mbcache jbd pata_amd
  ahci libata scsi_mod dock
Jul 21 12:19:37 larrylap kernel: Pid: 2057, comm: b43 Not tainted 
2.6.26-Linus-git-05253-g14b395e #1
Jul 21 12:19:37 larrylap kernel: RIP: 0010:[<ffffffff8039ec4d>] 
[<ffffffff8039ec4d>] __netif_schedule+0x12/0x75
Jul 21 12:19:37 larrylap kernel: RSP: 0000:ffff8800b9ae1de0  EFLAGS: 00010246

With an invalid opcode, mine is likely due to stack corruption.

Larry
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html