[Bug 765] Netfilter crash on bridged/TAP device in br_nf_pre_routing_finish_bridge on 2.6.38 & 3.0 kernels

[bugzilla-daemon at bugzilla.netfilter.org]

http://bugzilla.netfilter.org/show_bug.cgi?id=765

--- Comment #5 from Juerg Haefliger <juergh at gmail.com> 2012-06-25 07:56:14 CEST ---
Created attachment 386
  --> http://bugzilla.netfilter.org/attachment.cgi?id=386
[PATCH] tun: reserves space for network in skb

We're seeing a similar crash using an Ubuntu 2.6.38-8-server kernel:

[120550.767696] BUG: unable to handle kernel paging request at ffff8817daa4fffe 
[120550.841825] IP: [<ffffffffa032a5e0>]
br_nf_pre_routing_finish_bridge+0x60/0xd0 [bridge] 
[120550.987644] PGD 1a04063 PUD 17ddaa3063 PMD 17dd881063 PTE 80000017daa4f161 
[120550.987648] Oops: 0003 [#1] SMP 
[120550.987650] last sysfs file: /sys/devices/virtual/dmi/id/chassis_asset_tag 
[120550.987652] CPU 20 
[120550.987653] Modules linked in: xt_comment act_police cls_u32 sch_ingress
cls_fw sch_htb ebt_arp ebt_ip ipmi_devintf ipmi_si ipmi_msghandle 
r xt_recent xt_multiport ebtable_nat ebtables ipt_MASQUERADE iptable_nat
xt_CHECKSUM iptable_mangle bridge kvm_intel kvm 8021q garp nbd stp ib 
_iser rdma_cm ipt_REJECT ib_cm ipt_LOG iw_cm ib_sa ib_mad ib_core xt_limit
ib_addr xt_tcpudp ipt_addrtype iscsi_tcp libiscsi_tcp libiscsi xt_s 
tate scsi_transport_iscsi vesafb ip6table_filter ip6_tables nf_nat_irc
nf_conntrack_irc nf_nat_ftp nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_ 
conntrack_ftp nf_conntrack iptable_filter ip_tables x_tables ghes lp hed
parport i7core_edac serio_raw edac_core xfs exportfs usbhid igb ahci 
hid libahci dca hpsa 
[120550.987682] 
[120550.987685] Pid: 14394, comm: kvm Tainted: G M 2.6.38-8-server #42-Ubuntu
HP SE2170s /SE2170s 
[120550.987688] RIP: 0010:[<ffffffffa032a5e0>] [<ffffffffa032a5e0>]
br_nf_pre_routing_finish_bridge+0x60/0xd0 [bridge] 
[120550.987694] RSP: 0018:ffff88183fd03c28 EFLAGS: 00010246 
[120550.987695] RAX: ffff8817db260c00 RBX: ffff8817de661300 RCX:
ffff8816b692a200 
[120550.987697] RDX: 0000000000000000 RSI: ffff8817db260c58 RDI:
ffff8817de661300 
[120550.987698] RBP: ffff88183fd03c28 R08: ffff8817daa5000e R09:
2f1e403e16020000 
[120550.987700] R10: ffffffff81cfeed0 R11: 00000000b95a9a27 R12:
0000000000000000 
[120550.987701] R13: ffff8817daa5000e R14: ffff880bdbc62000 R15:
ffff880b6446a000 
[120550.987703] FS: 00007ffa6c764700(0000) GS:ffff88183fd00000(0000)
knlGS:0000000000000000 
[120550.987705] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b 
[120550.987706] CR2: ffff8817daa4fffe CR3: 0000000a948b3000 CR4:
00000000000026e0 
[120550.987707] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000 
[120550.987709] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400 
[120550.987711] Process kvm (pid: 14394, threadinfo ffff8816c0726000, task
ffff8817c172db80) 
[120550.987712] Stack: 
[120550.987713] ffff88183fd03cc8 ffffffffa032ba20 ffff880b00000001
0000000000000000 
[120550.987715] ffff88183fd03cc8 ffffffff8150f833 ffffffffa032b700
ffff880b80000000 
[120550.987717] ffffc90021111000 ffffc900210a2a80 0000000200000001
ffffffff81ac7ba0 
[120550.987719] Call Trace: 
[120550.987720] <IRQ> 
[120550.987724] [<ffffffffa032ba20>] br_nf_pre_routing_finish+0x320/0x360
[bridge] 
[120550.987729] [<ffffffff8150f833>] ? nf_hook_slow+0xb3/0x120 
[120550.987733] [<ffffffffa032b700>] ? br_nf_pre_routing_finish+0x0/0x360
[bridge] 
[120550.987737] [<ffffffffa032bfc6>] br_nf_pre_routing+0x376/0x390 [bridge] 
[120550.987739] [<ffffffff8150f764>] nf_iterate+0x84/0xa0 
[120550.987742] [<ffffffffa0325670>] ? br_handle_frame_finish+0x0/0x260
[bridge] 
[120550.987744] [<ffffffff8150f833>] nf_hook_slow+0xb3/0x120 
[120550.987748] [<ffffffffa0325670>] ? br_handle_frame_finish+0x0/0x260
[bridge] 
[120550.987751] [<ffffffffa0325a65>] br_handle_frame+0x195/0x230 [bridge] 
[120550.987757] [<ffffffff814e24f0>] ? ing_filter.clone.57+0xb0/0x100 
[120550.987760] [<ffffffffa03258d0>] ? br_handle_frame+0x0/0x230 [bridge] 
[120550.987762] [<ffffffff814e27ff>] __netif_receive_skb+0x1bf/0x580 
[120550.987765] [<ffffffff814e301b>] process_backlog+0xab/0x1a0 
[120550.987770] [<ffffffff810137e9>] ? read_tsc+0x9/0x20 
[120550.987772] [<ffffffff814e3f88>] net_rx_action+0x128/0x270 
[120550.987776] [<ffffffff8106d398>] __do_softirq+0xa8/0x1c0 
[120550.987778] [<ffffffff8100cedc>] call_softirq+0x1c/0x30 
[120550.987780] <EOI>

-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.