Kernel panic in dsx_push_sync() function of dsa_filter module.

Issue

• Kernel panic in dsx_push_sync() function of dsa_filter module.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffffa0273ccc>] dsx_push_sync+0xfc/0x2d0 [dsa_filter]
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 2 
Modules linked in: iptable_nat nf_nat nls_utf8 fuse gsch(U) redirfs(U) autofs4 nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q garp stp llc cachefiles fscache(T
) dsa_filter(P)(U) ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 vsock(U) uinput microcode ppdev vmware_balloon parport_pc parport sg i2c_piix4 i2c_core vmci(U) shpchp ext4 jbd2 mbcache
 sd_mod crc_t10dif sr_mod cdrom vmxnet3 vmw_pvscsi pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 0, comm: swapper Tainted: P           ---------------  T 2.6.32-431.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffffa0273ccc>]  [<ffffffffa0273ccc>] dsx_push_sync+0xfc/0x2d0 [dsa_filter]
RSP: 0018:ffff8800283034c0  EFLAGS: 00010246
RAX: ffff880238c78010 RBX: ffff880028303670 RCX: 0000000000000000
RDX: 0000000000000032 RSI: ffff88022dbf384c RDI: ffff880028303670
RBP: ffff880028303520 R08: 0000000000000246 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000032
R13: ffff88022dbf384c R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff880028300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 000000023849b000 CR4: 00000000000407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff88023ce92000, task ffff88023ce66040)
Stack:
 ffff880238c78648 ffff880028303670 ffff880028303510 ffffffffa027bc51
<d> 0040900334000045 ffff880238c78010 ffff880028303670 ffff880238c78010
<d> ffff880028303670 ffffc9000b309e10 ffff880238c78010 ffff880238c78011

Call Trace:
 <IRQ> 
 [<ffffffffa027bc51>] ? dsx_modinsertX+0x91/0x1d0 [dsa_filter]
 [<ffffffffa0274866>] dsx_process+0x526/0xdd0 [dsa_filter]
 [<ffffffffa0249c5d>] ssl_dsx_process+0x2cd/0x2e0 [dsa_filter]
 [<ffffffffa0249f50>] dsx_process_payload_packet_gen+0x100/0x3b0 [dsa_filter]
 [<ffffffffa0250fad>] ? stateful_udp_new_incoming+0x8d/0x320 [dsa_filter]
 [<ffffffffa024a213>] dsx_process_payload_packet+0x13/0x20 [dsa_filter]
 [<ffffffffa02563de>] stateful_udp_conn_update+0xae/0x320 [dsa_filter]
 [<ffffffffa025156f>] stateful_udp_filter+0x3f/0xe0 [dsa_filter]
 [<ffffffffa0251655>] stateful_process+0x45/0x50 [dsa_filter]
 [<ffffffffa023c890>] core_pkt_filter+0x3c0/0xbd0 [dsa_filter]
 [<ffffffffa023d5b7>] core_pkt_hook+0x517/0x8b0 [dsa_filter]
 [<ffffffffa0290c07>] lin_nf_packet_wrapper+0x207/0x3c0 [dsa_filter]
 [<ffffffffa0291990>] ? lin_pkt_get_frame_header+0x0/0x5c0 [dsa_filter]
 [<ffffffffa02915f0>] ? lin_pkt_get_length+0x0/0x20 [dsa_filter]
 [<ffffffffa0291850>] ? lin_pkt_read_start+0x0/0x140 [dsa_filter]
 [<ffffffffa02916b0>] ? lin_pkt_read+0x0/0x1a0 [dsa_filter]
 [<ffffffffa0291660>] ? lin_pkt_read_end+0x0/0x50 [dsa_filter]
 [<ffffffffa0291610>] ? lin_pkt_get_valid_checksum+0x0/0x50 [dsa_filter]
 [<ffffffff814938a0>] ? ip_rcv_finish+0x0/0x440
 [<ffffffffa0290f4b>] lin_nf_packet_wrapper_all+0x18b/0x1f0 [dsa_filter]
 [<ffffffff814938a0>] ? ip_rcv_finish+0x0/0x440
 [<ffffffffa0291031>] lin_nf_packet_wrapper_inet+0x21/0x30 [dsa_filter]
 [<ffffffff814893a9>] nf_iterate+0x69/0xb0
 [<ffffffff814938a0>] ? ip_rcv_finish+0x0/0x440
 [<ffffffff81489566>] nf_hook_slow+0x76/0x120
 [<ffffffff814938a0>] ? ip_rcv_finish+0x0/0x440
 [<ffffffff81493f44>] ip_rcv+0x264/0x350
 [<ffffffff8145b54b>] __netif_receive_skb+0x4ab/0x750
 [<ffffffff8145f1b8>] netif_receive_skb+0x58/0x60
 [<ffffffffa0055a7b>] vmxnet3_rq_rx_complete+0x3ab/0x8e0 [vmxnet3]
 [<ffffffff810f8e94>] ? rb_reserve_next_event+0xb4/0x370
 [<ffffffff812987b0>] ? swiotlb_map_page+0x0/0x100
 [<ffffffffa0056203>] vmxnet3_poll_rx_only+0x43/0xc0 [vmxnet3]
 [<ffffffff81460b43>] net_rx_action+0x103/0x2f0
 [<ffffffff8107a8e1>] __do_softirq+0xc1/0x1e0
 [<ffffffff810e6f56>] ? handle_IRQ_event+0xf6/0x170
 [<ffffffff8100c30c>] call_softirq+0x1c/0x30
 [<ffffffff8100fa75>] do_softirq+0x65/0xa0
 [<ffffffff8107a795>] irq_exit+0x85/0x90
 [<ffffffff81530fe5>] do_IRQ+0x75/0xf0
 [<ffffffff8100b9d3>] ret_from_intr+0x0/0x11
 <EOI> 
 [<ffffffff8103eacb>] ? native_safe_halt+0xb/0x10
 [<ffffffff811126c6>] ? ftrace_raw_event_power_start+0x16/0x20
 [<ffffffff810167bd>] default_idle+0x4d/0xb0
 [<ffffffff81009fc6>] cpu_idle+0xb6/0x110
 [<ffffffff81520e13>] start_secondary+0x2ac/0x2ef
Code: b0 30 0c 00 00 7e 24 48 c7 c7 d7 1a 2a a0 44 89 55 c0 44 89 5d c8 e8 14 68 fc ff 85 c0 44 8b 55 c0 44 8b 5d c8 0f 85 74 01 00 00 <49> 83 7e 08 00 0f 84 88 00 00 00 49 8b 56 10 0f b7 82 da 00 00 
RIP  [<ffffffffa0273ccc>] dsx_push_sync+0xfc/0x2d0 [dsa_filter]
 RSP <ffff8800283034c0>
CR2: 0000000000000008
(END) 

• Another backtrace of the panic task in RHEL7:

crash> bt
PID: 17358    TASK: ffff9543fbfe30c0  CPU: 2    COMMAND: "java"
 #0 [ffff9544ad102ef8] machine_kexec at ffffffffa3863b34
 #1 [ffff9544ad102f58] __crash_kexec at ffffffffa391e242
 #2 [ffff9544ad103028] crash_kexec at ffffffffa391e330
 #3 [ffff9544ad103040] oops_end at ffffffffa3f6e778
 #4 [ffff9544ad103068] die at ffffffffa382f95b
 #5 [ffff9544ad103098] do_general_protection at ffffffffa3f6e072
 #6 [ffff9544ad1030d0] general_protection at ffffffffa3f6d708
    [exception RIP: dsx_push_sync+37]
    RIP: ffffffffc069ea15  RSP: ffff9544ad103180  RFLAGS: 00010202
    RAX: 00764565646f6370  RBX: ffff9544ad103330  RCX: 00000000000004d8
    RDX: 00000000000004d8  RSI: ffff954351677042  RDI: ffff9544ad103330
    RBP: ffff9544ad1031c8   R8: 0000000000000034   R9: ffff95413b85f6b0
    R10: ffff95413b85f680  R11: ffff9540b547bfd8  R12: 00000000000004d8
    R13: ffff954351677042  R14: 00000000000004d8  R15: ffffb8e382ebee28
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0000
 #7 [ffff9544ad1031d0] dsx_process at ffffffffc069f31d [dsa_filter]
 #8 [ffff9544ad103288] dsx_process_ at ffffffffc06730b4 [dsa_filter]
 #9 [ffff9544ad1032a8] ssl_dsx_process at ffffffffc0674285 [dsa_filter]
#10 [ffff9544ad1032f8] dsx_process_payload_packet_gen at ffffffffc0674459 [dsa_filter]
#11 [ffff9544ad103598] dsx_process_payload_packet at ffffffffc06748e3 [dsa_filter]
#12 [ffff9544ad1035a8] dsa_slim_input at ffffffffc06765fb [dsa_filter]
#13 [ffff9544ad103628] stateful_tcp_filter at ffffffffc067dbae [dsa_filter]
#14 [ffff9544ad1036c0] stateful_process at ffffffffc067e4b5 [dsa_filter]
#15 [ffff9544ad1036d8] core_pkt_filter at ffffffffc0664b48 [dsa_filter]
#16 [ffff9544ad103720] core_pkt_hook at ffffffffc0665ee6 [dsa_filter]
#17 [ffff9544ad1038c0] lin_nf_packet_wrapper at ffffffffc06486a5 [dsa_filter]
#18 [ffff9544ad103a00] hook_handler at ffffffffc06495a5 [dsa_filter]
#19 [ffff9544ad103a70] nf_callback_inet at ffffffffc0561049 [dsa_filter_hook]
#20 [ffff9544ad103a80] nf_iterate at ffffffffa3e7a528
#21 [ffff9544ad103ac0] nf_hook_slow at ffffffffa3e7a618
#22 [ffff9544ad103af8] ip_local_deliver at ffffffffa3e84c22
#23 [ffff9544ad103b50] ip_rcv_finish at ffffffffa3e84540
#24 [ffff9544ad103b78] ip_rcv at ffffffffa3e84ef9
#25 [ffff9544ad103be0] __netif_receive_skb_core at ffffffffa3e3b579
#26 [ffff9544ad103c50] __netif_receive_skb at ffffffffa3e3b878
#27 [ffff9544ad103c70] netif_receive_skb_internal at ffffffffa3e3b900
#28 [ffff9544ad103ca0] napi_gro_complete at ffffffffa3e3ba6f
#29 [ffff9544ad103cd0] dev_gro_receive at ffffffffa3e3c34e
#30 [ffff9544ad103d28] napi_gro_frags at ffffffffa3e3c64c
#31 [ffff9544ad103d50] ena_clean_rx_irq at ffffffffc02c0d28 [ena]
#32 [ffff9544ad103df8] ena_io_poll at ffffffffc02c1edf [ena]
#33 [ffff9544ad103e78] net_rx_action at ffffffffa3e3bf1f
#34 [ffff9544ad103ef8] __do_softirq at ffffffffa38a2155
#35 [ffff9544ad103f68] call_softirq at ffffffffa3f7a32c
#36 [ffff9544ad103f80] do_softirq at ffffffffa382e675
#37 [ffff9544ad103fa0] irq_exit at ffffffffa38a24d5
#38 [ffff9544ad103fb8] do_IRQ at ffffffffa3f7b606
--- <IRQ stack> ---
#39 [ffff9540b547bf58] ret_from_intr at ffffffffa3f6d362
    RIP: 00007efdb540b0a8  RSP: 00007efd1d835550  RFLAGS: 00000207
    RAX: 0000000000000000  RBX: 00000007b8d0eae8  RCX: 0000000003c6309a
    RDX: 00000000f18c26ac  RSI: 000000078d1723fc  RDI: 00007efdb11ff000
    RBP: 00000000f18c26b0   R8: 0000000000000000   R9: 0000000000000000
    R10: 000000078c613528  R11: 00000000c80e6830  R12: ffff9544ad1061e8
    R13: 00007efd1d8332d0  R14: 00000000000005f9  R15: 00007efd5490e9f8
    ORIG_RAX: ffffffffffffffbd  CS: 0033  SS: 002b