Subject: [net] BUG: unable to handle kernel NULL pointer dereference at 000000000000022f

From: Jet Chen <[email-masked]>
Date: Tue, 13 May 2014 10:52:04 +0800

Hi Marc,

0day kernel testing robot got the below dmesg and the first bad commit is

git://gitorious.org/linux-can/linux-can-next testing-c_can
commit 0a240764becbec91589bd579b591c2fcf2df2bcf
Merge: 163cd4e 367525c
Author:     Marc Kleine-Budde <[email-masked]>
AuthorDate: Mon May 12 17:38:04 2014 +0200
Commit:     Marc Kleine-Budde <[email-masked]>
CommitDate: Mon May 12 17:38:04 2014 +0200

      Merge tag 'linux-can-fixes-for-3.15-20140424' into HEAD
          linux-can-fixes-for-3.15-20140424
          Conflicts:
      	net/netlink/af_netlink.c
      	net/sched/cls_api.c
      	net/sched/sch_api.c

+------------------------------------------------------+------------+------------+
|                                                      | 163cd4e817 | 0a240764be |
+------------------------------------------------------+------------+------------+
| boot_successes                                       | 78         | 0          |
| boot_failures                                        | 2          | 20         |
| BUG:kernel_test_crashed                              | 2          |            |
| BUG:unable_to_handle_kernel_NULL_pointer_dereference | 0          | 20         |
| Oops                                                 | 0          | 20         |
| RIP:sk_ns_capable                                    | 0          | 20         |
| Kernel_panic-not_syncing:Fatal_exception             | 0          | 20         |
| backtrace:SYSC_bind                                  | 0          | 20         |
| backtrace:SyS_bind                                   | 0          | 20         |
+------------------------------------------------------+------------+------------+

[    1.277078] PM: Hibernation image not present or could not be loaded.
[    1.279648] Freeing unused kernel memory: 1720K (ffffffff81c40000 - ffffffff81dee000)
[    1.284871] random: init urandom read with 6 bits of entropy available
[    1.297495] BUG: unable to handle kernel NULL pointer dereference at 000000000000022f
[    1.298038] IP: [<ffffffff815f7b3f>] sk_ns_capable+0xf/0x40
[    1.298038] PGD 0 [    1.298038] Oops: 0000 [#1] SMP [    1.301030] Modules linked in:
[    1.301030] CPU: 0 PID: 84 Comm: mountall Not tainted 3.15.0-rc1-00466-g0a24076 #1
[    1.301982] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    1.301982] task: ffff88000bd58000 ti: ffff88000bece000 task.ti: ffff88000bece000
[    1.301982] RIP: 0010:[<ffffffff815f7b3f>]  [<ffffffff815f7b3f>] sk_ns_capable+0xf/0x40
[    1.301982] RSP: 0018:ffff88000becfe58  EFLAGS: 00010202
[    1.301982] RAX: 0000000000000002 RBX: ffff88000d132c80 RCX: 0000000000000000
[    1.301982] RDX: 0000000000000001 RSI: ffffffff81b093c0 RDI: ffffffffffffffff
[    1.301982] RBP: ffff88000becfe68 R08: ffff88000becfd98 R09: ffff88000bdfb800
[    1.301982] R10: ffff88000c7093c0 R11: ffff88000bd58000 R12: 0000000000000001
[    1.301982] R13: ffffffff81bd6b40 R14: ffff88000becfec8 R15: ffff88000d132c80
[    1.301982] FS:  00007fe255390700(0000) GS:ffff880012600000(0000) knlGS:0000000000000000
[    1.301982] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.301982] CR2: 000000000000022f CR3: 000000000be39000 CR4: 00000000000006f0
[    1.301982] Stack:
[    1.301982]  ffff88000d132c80 ffff88000bdfb800 ffff88000becfeb0 ffffffff8163ee35
[    1.301982]  ffff88000d132c80 0000000000000002 ffff88000d132c80 000000000000000c
[    1.301982]  ffff88000becfec8 00007fe25723e4b0 0000000000000000 ffff88000becff68
[    1.301982] Call Trace:
[    1.301982]  [<ffffffff8163ee35>] netlink_bind+0x1e5/0x220
[    1.301982]  [<ffffffff815f57e8>] SYSC_bind+0xb8/0xf0
[    1.301982]  [<ffffffff815fbcd8>] ? sock_setsockopt+0x1a8/0x9c0
[    1.301982]  [<ffffffff815f6926>] ? SyS_setsockopt+0xb6/0xd0
[    1.301982]  [<ffffffff815f671e>] SyS_bind+0xe/0x10
[    1.301982]  [<ffffffff81752be9>] system_call_fastpath+0x16/0x1b
[    1.301982] Code: 50 48 85 c0 74 06 ff d0 5d c3 66 90 41 ff 51 40 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 d4 53 <48> 8b 87 30 02 00 00 48 89 f3 48 8b 78 18 e8 ae 94 a7 ff 31 d2 [    1.301982] RIP  [<ffffffff815f7b3f>] sk_ns_capable+0xf/0x40
[    1.301982]  RSP <ffff88000becfe58>
[    1.301982] CR2: 000000000000022f
[    1.337456] ---[ end trace e34617f32717aa50 ]---
[    1.338240] Kernel panic - not syncing: Fatal exception

Attached dmesg for the parent commit, too, to help confirm whether it is a noise error.

git bisect start 99cbc75a89e5ab441461c44886a78eeb58335f09 163cd4e817a4444e348ca577cb74c71d245f0c72 --
git bisect  bad 0a240764becbec91589bd579b591c2fcf2df2bcf  # 00:24      0-     20  Merge tag 'linux-can-fixes-for-3.15-20140424' into HEAD
git bisect good 1da394d889b4110bda954813ef32601c06118376  # 00:34     20+      0  can: c_can: Always update error stats
git bisect good 7af28630b87d0b2eefeee8547ad52df7e0e1b1c4  # 00:44     20+      0  can: c_can: Cleanup c_can_msg_obj_put/get()
git bisect good f323d7a1d2868c00b2604dca36ad82e8ecbe4270  # 00:55     20+      0  can: c_can: use proper type for 'instance'
git bisect good a9edcdedbd3d8f3ffcd7bdcab5812707a25e554e  # 01:04     20+      0  can: sja1000_isa: add locking for indirect register access mode
git bisect good 367525c8c20a34560afe1d0c7cca52a44ccd62e9  # 01:06     20+      0  can: slcan: Fix spinlock variant
# first bad commit: [0a240764becbec91589bd579b591c2fcf2df2bcf] Merge tag 'linux-can-fixes-for-3.15-20140424' into HEAD
git bisect good 163cd4e817a4444e348ca577cb74c71d245f0c72  # 01:08     60+      2  ipv6: remove parameter rt from fib6_prune_clones()
git bisect good 367525c8c20a34560afe1d0c7cca52a44ccd62e9  # 01:11     60+      0  can: slcan: Fix spinlock variant
git bisect  bad 99cbc75a89e5ab441461c44886a78eeb58335f09  # 01:11      0-     13  C_CAN: Add 32-bit accesses
git bisect good 7e338c9991ecee9c2ac7a4cee2c2e11ecb563d02  # 01:13     60+      8  Merge branch 'for-3.15' of git://linux-nfs.org/~bfields/linux
git bisect good 93d9fcc0ec9f9447a94e440cf9d96a6edaa3a219  # 01:14     60+      0  Add linux-next specific files for 20140512

This script may reproduce the error.

-----------------------------------------------------------------------------
#!/bin/bash

kernel=$1
initrd=quantal-core-x86_64.cgz

wget --no-clobber https://github.com/fengguang/reproduce-kernel-bug/blob/master/initrd/$initrd

kvm=(
	qemu-system-x86_64 -cpu kvm64 -enable-kvm 	-kernel $kernel
	-initrd $initrd
	-smp 2
	-m 256M
	-net nic,vlan=0,macaddr=00:00:00:00:00:00,model=virtio
	-net user,vlan=0
	-net nic,vlan=1,model=e1000
	-net user,vlan=1
	-boot order=nc
	-no-reboot
	-watchdog i6300esb
	-serial stdio
	-display none
	-monitor null
)

append=(
	debug
	sched_debug
	apic=debug
	ignore_loglevel
	sysrq_always_enabled
	panic=10
	prompt_ramdisk=0
	earlyprintk=ttyS0,115200
	console=ttyS0,115200
	console=tty0
	vga=normal
	root=/dev/ram0
	rw
)

"${kvm[@]}" --append "${append[*]}"
-----------------------------------------------------------------------------

Thanks,
Jet