netdev - Re: Net: [DSA]: dsa-loop kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 May 2020 15:10:35 +0200
From:   Andrew Lunn <andrew@...n.ch>
To:     Allen <allen.pais@...cle.com>
Cc:     netdev@...r.kernel.org, Vivien Didelot <vivien.didelot@...il.com>,
        Florian Fainelli <f.fainelli@...il.com>
Subject: Re: Net: [DSA]: dsa-loop kernel panic

On Thu, Apr 30, 2020 at 11:54:15AM +0530, Allen wrote:
> Hi,
> 
> $ rmmod dsa-loop
> [   50.688935] Unable to handle kernel read from unreadable memory at
> virtual address 0000000000000040

> [   50.718185] pstate: 60400005 (nZCv daif +PAN -UAO)
> [   50.719274] pc : __dev_set_rx_mode+0x48/0xa0

ffff8000113adb60 <__dev_set_rx_mode>:

Function starts at ffff8000113adb60, the instruction with problems is
ffff8000113adb60+48.

{
ffff8000113adb60:       a9bd7bfd        stp     x29, x30, [sp,#-48]!
ffff8000113adb64:       910003fd        mov     x29, sp
ffff8000113adb68:       a90153f3        stp     x19, x20, [sp,#16]
ffff8000113adb6c:       f90013f5        str     x21, [sp,#32]
ffff8000113adb70:       aa0003f3        mov     x19, x0
ffff8000113adb74:       aa1e03e0        mov     x0, x30
ffff8000113adb78:       94000000        bl      0 <_mcount>
                        ffff8000113adb78: R_AARCH64_CALL26      _mcount
        if (!(dev->flags&IFF_UP))
ffff8000113adb7c:       b9422a60        ldr     w0, [x19,#552]
        const struct net_device_ops *ops = dev->netdev_ops;
ffff8000113adb80:       f940fa74        ldr     x20, [x19,#496]
        if (!(dev->flags&IFF_UP))
ffff8000113adb84:       360001a0        tbz     w0, #0, ffff8000113adbb8
<__dev_set_rx_mode+0x58>
ffff8000113adb88:       f9402260        ldr     x0, [x19,#64]
        if (!netif_device_present(dev))
ffff8000113adb8c:       36080160        tbz     w0, #1, ffff8000113adbb8
<__dev_set_rx_mode+0x58>
        if (!(dev->priv_flags & IFF_UNICAST_FLT)) {
ffff8000113adb90:       b9422e60        ldr     w0, [x19,#556]
ffff8000113adb94:       376000a0        tbnz    w0, #12, ffff8000113adba8
<__dev_set_rx_mode+0x48>
                if (!netdev_uc_empty(dev) && !dev->uc_promisc) {
ffff8000113adb98:       b9429275        ldr     w21, [x19,#656]
ffff8000113adb9c:       35000175        cbnz    w21, ffff8000113adbc8
<__dev_set_rx_mode+0x68>
                } else if (netdev_uc_empty(dev) && dev->uc_promisc) {
ffff8000113adba0:       3949f660        ldrb    w0, [x19,#637]
ffff8000113adba4:       35000220        cbnz    w0, ffff8000113adbe8 <__dev_set_rx_mode+0x88>
        if (ops->ndo_set_rx_mode)
ffff8000113adba8:       f9402281        ldr     x1, [x20,#64]

Which suggests ops is NULL. The #64 also matches with

> [   50.688935] Unable to handle kernel read from unreadable memory at
> virtual address 0000000000000040

How did dev->netdev_ops become NULL?

Odd

	Andrew