Kernel panic in "bmhook_telemetry_scalar_add_value()" with BUG: unable to handle kernel NULL pointer dereference

Solution Unverified - Updated -

Issue

  • Kernel panicked with the below logs in RHEL 8:
crash> log -T | less
[..]
[Wed Jul 24 20:20:33 IST 2024] BUG: unable to handle kernel NULL pointer dereference at 000000000000006f
[Wed Jul 24 20:20:33 IST 2024] RIP: 0010:bmhook_telemetry_scalar_add_value+0xa/0x40 [bmhook]
[Wed Jul 24 20:20:33 IST 2024] Call Trace:
[Wed Jul 24 20:20:33 IST 2024]  ? __die_body+0x1a/0x60
[Wed Jul 24 20:20:33 IST 2024]  ? no_context+0x1ba/0x3f0
[Wed Jul 24 20:20:33 IST 2024]  ? bmhook_free_file_object+0x47/0x60 [bmhook]
[Wed Jul 24 20:20:33 IST 2024]  ? __bad_area_nosemaphore+0x157/0x180
[Wed Jul 24 20:20:33 IST 2024]  ? kmem_cache_free+0x116/0x300
[Wed Jul 24 20:20:33 IST 2024]  ? do_page_fault+0x37/0x12d
[Wed Jul 24 20:20:33 IST 2024]  ? page_fault+0x1e/0x30
[Wed Jul 24 20:20:33 IST 2024]  ? bmhook_telemetry_scalar_add_value+0xa/0x40 [bmhook]
[Wed Jul 24 20:20:33 IST 2024]  tmbpf_telemetry_scalar_add_value+0xa/0x20 [bmhook]
[Wed Jul 24 20:20:33 IST 2024]  ? bmhook_notifier_invoke_prog+0x1f8/0x230 [bmhook]
[Wed Jul 24 20:20:33 IST 2024]  ? process_exit_handler+0x69/0x160 [bmhook]
[Wed Jul 24 20:20:33 IST 2024]  ? notifier_call_chain+0x47/0x70
[Wed Jul 24 20:20:33 IST 2024]  ? blocking_notifier_call_chain+0x42/0x60
[Wed Jul 24 20:20:33 IST 2024]  ? do_exit+0xb0/0xb10
[Wed Jul 24 20:20:33 IST 2024]  ? syscall_trace_enter+0x1ff/0x2d0
[Wed Jul 24 20:20:33 IST 2024]  ? do_group_exit+0x3a/0xa0
[Wed Jul 24 20:20:33 IST 2024]  ? __x64_sys_exit_group+0x14/0x20
[Wed Jul 24 20:20:33 IST 2024]  ? do_syscall_64+0x5b/0x1b0
[Wed Jul 24 20:20:33 IST 2024]  ? entry_SYSCALL_64_after_hwframe+0x61/0xc6
  • Kernel panicked with the below logs in RHEL 7:
crash> log | less

[..]
[  708.302611] BUG: unable to handle kernel paging request at ffffa1b286f26020
[  708.302664] RIP: 0010:[<ffffffffc07add3a>]  [<ffffffffc07add3a>] ScalarBaseEntryAddValue+0xa/0x30 [bmhook]
[  708.302700] Call Trace:
[  708.302707]  [<ffffffffc07ad208>] ? TelemetryScalarBaseEntryAddValue+0x18/0x20 [bmhook]
[  708.302713]  [<ffffffffc07861ed>] bmhook_telemetry_scalar_add_value+0x2d/0x40 [bmhook]
[  708.302718]  [<ffffffffc077d6fe>] tmbpf_telemetry_scalar_add_value+0xe/0x20 [bmhook]
[  708.302727]  [<ffffffffc078dced>] ? bmhook_prehook_handler+0x11d/0x430 [bmhook]
[  708.302734]  [<ffffffffc0282d93>] ? ext4_file_read+0x43/0x130 [ext4]
[  708.302737]  [<ffffffffc07337cc>] ? tmhook_invoke_prehooks+0x4c/0xb0 [tmhook]
[  708.302739]  [<ffffffffc0733db9>] ? tmhook_handler+0x189/0x2c0 [tmhook]
[  708.302743]  [<ffffffffb9b74ddb>] ? system_call_fastpath+0x22/0x27
[  708.302757] RIP  [<ffffffffc07add3a>] ScalarBaseEntryAddValue+0xa/0x30 [bmhook]
[  708.302762]  RSP <ffff885715a0fcc0>
[  708.302762] CR2: ffffa1b286f26020

Environment

  • Red Hat Enterprise Linux 7.6, 8.9, 8.10
  • Trend Micro Deep Security Agent
  • Out-of-tree (O) kernel module:[bmhook]

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content