Unable to handle kernel NULL pointer dereference at virtual address 分析

现象

[  136.847780] br-lan: received packet on eth0.1 with own address as source address (addr:00:02:e7:f5:02:02, vlan:0)
[  138.026055] Unable to handle kernel NULL pointer dereference at virtual address 00000010
[  138.034175] pgd = c0003000
[  138.036888] [00000010] *pgd=80000040004003, *pmd=00000000
[  138.042311] Internal error: Oops: 207 [#1] PREEMPT SMP ARM
[  138.047790] Modules linked in: pppoe ppp_async l2tp_ppp pptp pppox ppp_mppe ppp_generic iptable_nat ipt_REJECT ipt_MASQUERADE xt_time xt_tcpudp xt_state xt_recent xt_policy xt_nat xt_multiport xt_mark xt_mac xt_limit xt_helper xt_esp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_FLOWOFFLOAD slhc openvswitch nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv6 nf_nat_masquerade_ipv4 nf_conntrack_ipv6 nf_nat_ipv6 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack libcrc32c iptable_mangle iptable_filter ipt_ah ip_tables crc_ccitt rtc_sunxi ledtrig_heartbeat ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables x_tables
[  138.118356]  ip_gre gre l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel ipcomp6 xfrm6_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_beet esp6 ah6 ipcomp xfrm4_tunnel tunnel6 tun mpls_gso mpls_iptunnel mpls_router af_key xfrm_user xfrm_ipcomp algif_skcipher algif_hash af_alg ecb deflate zlib_deflate crypto_acompress
[  138.147315] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.14.63 #0
[  138.153312] Hardware name: Allwinner sun8i Family
[  138.158012] task: cf844440 task.stack: cf86c000
[  138.162548] PC is at br_forward+0x4/0x74
[  138.166467] LR is at br_dev_xmit+0x264/0x290
[  138.170733] pc : [<c07725a8>]    lr : [<c07702f0>]    psr: a0000113
[  138.176990] sp : cf86db6c  ip : 00000202  fp : 00000000
[  138.182207] r10: 00000027  r9 : c0c04a54  r8 : cf2f2540
[  138.187425] r7 : cf2f2000  r6 : cc95dd80  r5 : 00000000  r4 : 00000000
[  138.193942] r3 : 00000001  r2 : 00000000  r1 : cc95dd80  r0 : 00000000

分析

根据PC is at br_forward+0x4/0x74 可知道出错在 br_forward 函数中。

/* 位于 linux-4.14.63\net\bridge\br_forward.c */
void br_forward(const struct net_bridge_port *to,struct sk_buff *skb, bool local_rcv, bool local_orig)
{if (to->flags & BR_ISOLATE_MODE && !local_orig)to = NULL;if (to && should_deliver(to, skb)) {if (local_rcv)deliver_clone(to, skb, local_orig);else__br_forward(to, skb, local_orig);return;}if (!local_rcv)kfree_skb(skb);
}

已知在arm 中 r0~rx 寄存器一般用来给函数传参，再结合log:

[ 138.193942] r3 : 00000001 r2 : 00000000 r1 : cc95dd80 r0 : 00000000

可知：br_forward ( r0 ,r1, r2 , r3) 即为 br_forward ( 0 ,cc95dd80, 0 , 1) 。

显然第一个参数 *to 是 0 ，是个空指针。

而代码中 to-> flags 对空指针进行了引用，flags 相对于 to 的偏移正好是 16 （0x10）, to->flags 就等于 0+0x10 = 0x10

访问 0x10 触发了 Unable to handle kernel NULL pointer dereference at virtual address 00000010

解决办法

在代码中加入空指针判断

void br_forward(const struct net_bridge_port *to,struct sk_buff *skb, bool local_rcv, bool local_orig)
{+  if(unlikely(!to))
+      goto out;
+      if (to->flags & BR_ISOLATE_MODE && !local_orig)to = NULL;if (to && should_deliver(to, skb)) {if (local_rcv)deliver_clone(to, skb, local_orig);else__br_forward(to, skb, local_orig);return;}
+out:if (!local_rcv)kfree_skb(skb);
}

Unable to handle kernel NULL pointer dereference at virtual address 分析相关推荐

Unable to handle kernel NULL pointer dereference at virtual address 0000000d[ 435.859000] pgd = c9
由于本人刚学驱动新手,不会太多反向操作.看了很多博主也没有解决. 经过我一个下午尝试,把代码缩减缩减在缩减之后,我发现了先看下面的代码,有问题的代码(扫一眼就行了,估计没人看的出来) #includ ...
Unable to handle kernel NULL pointer dereference at virtual address
1:从sd卡出错log里可以看出来pc指针以及出错位置 PC is at dw_mci_pre_dma_transfer.isra.19+0x7c/0x158 pc : [<8032e130&g ...
Unable to handle kernel NULL pointer dereference at virtual address 00000000问题的解决
Unable to handle kernel NULL pointer dereference at virtual address 00000000问题的解决参考文章: (1)Unable to ...
Nvidia AGX Xavier 升级到 JetPack 4.6版本反复打开camera导致内核出错 Unable to handle kernel NULL pointer
这里写自定义目录标题现象日志显示分析过程解决思路代码修改现象在原来 JetPack4.4 运行稳定的camera驱动,由于算法功能需要,升级到最新的JetPack4.6. 刚开始自测,功 ...
Unable to handle kernel paging request at virtual address 的解决办法
原文地址为: Unable to handle kernel paging request at virtual address 的解决办法今天想正式开始编写各底层硬件的驱动程序,首先是双口RAM的 ...
新手玩转Linux Kernel漏洞之Null Pointer Dereference
新手玩转Linux Kernel漏洞之Null Pointer Dereference 前言这是我内核漏洞的入门篇, 不是很复杂, 希望能给徘徊在门外的小伙伴一点启发. 漏洞描述 A NULL po ...
【RK3399 Android系统】，启动时出现”Unable to handle kernel paging request at virtual address 490000004c“的解决思路
从Firefly官网下载的安卓系统源码,编译后,修改了部分驱动,启动的时候偶尔会出现"Unable to handle kernel paging request at virtual ad ...
ncnn报null pointer dereference异常
错误描述基于c++使用ncnn封装了深度学习模型,并将c++项目打包成为了一个so库给Android调用,在打包成为so库之前,在Windows系统以及Ubuntu系统利用电脑的camera测试过都 ...
Android UVCCamera问题——Cause: null pointer dereference
记录遇到的问题. 采用的开源库链接:https://github.com/saki4510t/UVCCamera 使用该库预览的时候,如果拔掉uvc设备,会造成异常闪退. signal 11 (SIG ...

Unable to handle kernel NULL pointer dereference at virtual address 分析

Unable to handle kernel NULL pointer dereference at virtual address 分析相关推荐

最新文章

热门文章