On Mon, Nov 27, 2017 at 05:46:28PM +0100, Tomas Charvat wrote: > Gentoo-sources has no change vs vanilla in ipsec. However here is result > from Vanila 4.14.2 with OFFLOAD=N > > [ 2338.440735] BUG: unable to handle kernel NULL pointer dereference at > 0000000000000018 > [ 2338.440830] IP: xfrm_output_resume+0x211/0x460 > [ 2338.440897] PGD 0 P4D 0 > [ 2338.440960] Oops: 0000 [#1] SMP > [ 2338.441025] CPU: 0 PID: 31977 Comm: stunnel Not tainted 4.14.2 #2 > [ 2338.441098] Hardware name: Supermicro H8DGU/H8DGU, BIOS 3.5c > 03/18/2016 > [ 2338.441174] task: ffff98c4dc0ee4c0 task.stack: ffffb41460d84000 > [ 2338.441248] RIP: 0010:xfrm_output_resume+0x211/0x460 > [ 2338.441343] RSP: 0018:ffffb41460d87900 EFLAGS: 00010246 > [ 2338.441413] RAX: 0000000000000000 RBX: ffff98c54090e2e0 RCX: > 0000000000000000 > [ 2338.441489] RDX: 000000000000001b RSI: 0000000000000000 RDI: > 0000000000000000 > [ 2338.441565] RBP: ffffb41460d87960 R08: ffffb41460d87780 R09: > ffff98c54b94ec50 > [ 2338.441640] R10: ffff98c4d6bd38cc R11: 0000000000000000 R12: > ffffffff8cb0f740 > [ 2338.441716] R13: ffff98c54b94e400 R14: ffff98c54b94e43c R15: > ffffb41460d87b28 > [ 2338.441792] FS: 00007ec52f91c700(0000) GS:ffff98c54fc00000(0000) > knlGS:0000000000000000 > [ 2338.441871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 2338.441942] CR2: 0000000000000018 CR3: 000000100a5e6000 CR4: > 00000000000406f0 > [ 2338.442018] Call Trace: > [ 2338.442083] ? skb_checksum+0x3f/0x60 > [ 2338.442227] ? reqsk_fastopen_remove+0x160/0x160 > [ 2338.442374] ? skb_panic+0x70/0x70 > [ 2338.442546] xfrm_output+0x6a/0x110 > [ 2338.442689] xfrm6_output_finish+0x38/0x40 > [ 2338.442834] __xfrm6_output+0x57/0x1e0 > [ 2338.442978] xfrm6_output+0x9e/0x110 > [ 2338.443121] ? xfrm6_local_rxpmtu+0x90/0x90 > [ 2338.443267] ip6_xmit+0x297/0x550 > [ 2338.443409] ? ip6_dst_check+0xd7/0xf0 > [ 2338.443555] ? __ip6_append_data.isra.42+0xc00/0xc00 > [ 2338.443705] inet6_csk_xmit+0xaa/0x100 > [ 2338.443880] tcp_transmit_skb+0x57f/0xa00 > [ 2338.444038] tcp_write_xmit+0x1cd/0xf90 > [ 2338.444183] __tcp_push_pending_frames+0x3f/0xb0 > [ 2338.444330] tcp_push+0xf6/0x120 > [ 2338.444471] tcp_sendmsg_locked+0x672/0xe30 > [ 2338.444617] tcp_sendmsg+0x3a/0x60 > [ 2338.444760] inet_sendmsg+0x3b/0xb0 > [ 2338.444904] sock_sendmsg+0x48/0x60 > [ 2338.445070] sock_write_iter+0x8d/0x100 > [ 2338.445216] __vfs_write+0x154/0x1b0 > [ 2338.445359] vfs_write+0xcd/0x1c0 > [ 2338.445501] SyS_write+0x62/0xd0 > [ 2338.445643] entry_SYSCALL_64_fastpath+0x13/0x94 > [ 2338.445789] RIP: 0033:0x7ec52eb3336d > [ 2338.445930] RSP: 002b:00007ec52f91bd40 EFLAGS: 00000293 ORIG_RAX: > 0000000000000001 > [ 2338.446189] RAX: ffffffffffffffda RBX: 00007ec520011010 RCX: > 00007ec52eb3336d > [ 2338.446341] RDX: 000000000000001c RSI: 000056f01370b5a0 RDI: > 0000000000000003 > [ 2338.446495] RBP: 0000000000000000 R08: 0000000000000000 R09: > 0000000000000000 > [ 2338.446647] R10: 0000000000000000 R11: 0000000000000293 R12: > 000056f011c8010c > [ 2338.446800] R13: 00007ec520010fc0 R14: 000056f013706da0 R15: > 0000000000000047 > [ 2338.446952] Code: f6 0f 8f b9 fe ff ff 31 f6 85 d2 0f 8f af fe ff ff > e9 bb fe ff ff 85 f6 89 f0 0f 85 d6 fe ff ff 48 8b 7b 58 48 89 f8 48 83 > e0 fe <4c> 8b 70 18 4d 85 f6 0f 84 a3 01 00 00 41 8b 86 80 00 00 00 85
When I look at this code, I'd say it tries to dereference dst->child and dst is a NULL pointer. Unfortunately I don't see how this can happen. I need to find a way to reproduce this. Can you show me your policy and SA database, i.e. 'ip x s' and 'ip x p'? Also, please show /proc/crypto
