Skip to contentSkip to conversation

New: NULL pointer dereference in ip_fragment

Bugme-new Andrew Morton 1 participant 1 message Apr 26, 2011 1 message not in the archive

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]/

Andrew Morton

author
#1 lore raw

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 3 lines · On Sat, 23 Apr 2011 07:51:56 GMT [email protected] wrote:

https://bugzilla.kernel.org/show_bug.cgi?id=33842

Summary: NULL pointer dereference in ip_fragment

oops in ip_defragment(). Kernel is 2.6.39-rc4. There are some screenshots attached to the report.

Quoted 38 lines
           Product: Networking
           Version: 2.5
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Other
        AssignedTo: [email protected]
        ReportedBy: [email protected]
        Regression: No

The host is using the ath9k driver. eth0+wlan0 are bridged. Shortly after I start using the wireless network with my macbook, the bug triggers. No idea if it's wireless related, because there's also a rtl8169_rx_interrupt entry in the stacktrace.

This is a transcript, since I don't (have/know of) any way to get the backtrace out of a crashed box.

IP: ip_fragment+0x52/0x840

Call Trace:
  <IRQ>
  br_parse_ip_options
  br_flood_deliver
  br_parse_ip_options
  br_nf_dev_queue_xmit
  br_nf_post_routing
  nf_iterate

then also:
lots of br_flood_deliver
lots of br_*_finish
one ? rtl8169_interrupt
one ? ath9k_ioread32