System crashed at `strlen` which was called from `mfe_aac_get_match_data`

Solution Verified - Updated -

Issue

  • System crashed with RIP: 0010:strlen+0xc/0x20 .
  • System was crashed with the below log:
...
[479425.192649] FileAccess module was removed successfully. Version is - 10.7.10.239
[1746066.332052] BUG: unable to handle kernel paging request at ffff9f6a4d256000
[1746066.332084] PGD 4ca03067 P4D 4ca03067 PUD 4d49b063 PMD 18224063 PTE 800000008d256063
[1746066.332122] Oops: 0000 [#1] SMP PTI
[1746066.332140] CPU: 3 PID: 697053 Comm: kworker/u256:0 Tainted: G           OE    --------- -  - 4.18.0-372.26.1.el8_6.x86_64 #1
[1746066.332170] Hardware name: VMware, Inc. VMware7,1/440BX Desktop Reference Platform, BIOS VMW71.00V.18227214.B64.2106252220 06/25/2021
[1746066.332200] RIP: 0010:strlen+0xc/0x20
[1746066.332234] Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 0f 1f 80 00 00 00 00 80 3f 00 74 10 48 89 f8 48 83 c0 01 <80> 38 00 75 f7 48 29 f8 c3 31 c0 c3 0f 1f 84 00 00 00 00 00 48 89
[1746066.332302] RSP: 0018:ffffae2182c0b7f8 EFLAGS: 00010296
[1746066.332317] RAX: ffff9f6a4d256000 RBX: ffff9f6a4d24d140 RCX: 0000000000000000
[1746066.332335] RDX: 0000000000000001 RSI: ffffae2182c0b818 RDI: ffff9f6a4d24d140
[1746066.332354] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
[1746066.332371] R10: ffff9f6ac0000200 R11: ffffed23868d3cc8 R12: ffff9f6a0d770c00
[1746066.332389] R13: 0000000000000001 R14: 0000000000000000 R15: ffff9f6a0d770c00
[1746066.332407] FS:  0000000000000000(0000) GS:ffff9f6bf42c0000(0000) knlGS:0000000000000000
[1746066.332428] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1746066.332443] CR2: ffff9f6a4d256000 CR3: 000000004b010003 CR4: 00000000007706e0
[1746066.332482] PKRU: 55555554
[1746066.332490] Call Trace:
[1746066.332533]  mfe_aac_get_match_data+0x37f/0x7c0 [mfe_aac_100710239]
[1746066.332557]  mfe_aac_evaluate_match+0xce/0x3c0 [mfe_aac_100710239]
[1746066.333239]  ? select_idle_sibling+0x23/0x6f0
[1746066.333895]  ? deactivate_slab+0x5fa/0x650
[1746066.334525]  ? _cond_resched+0x15/0x30
[1746066.335141]  ? down_read+0xe/0xa0
[1746066.335803]  ? mfe_aac_get_pp_state+0xd5/0x110 [mfe_aac_100710239]
[1746066.336407]  ? mfe_aac_is_pp_state_available+0x23/0x30 [mfe_aac_100710239]
[1746066.337012]  ? mfe_aac_evaluate_rule_list+0x11c/0x2e0 [mfe_aac_100710239]
[1746066.337614]  mfe_aac_evaluate_match_object+0x74/0xf0 [mfe_aac_100710239]
[1746066.338205]  mfe_aac_evaluate_rule+0x93/0x120 [mfe_aac_100710239]
[1746066.338798]  mfe_aac_evaluate_rule_list+0xab/0x2e0 [mfe_aac_100710239]
[1746066.339391]  ? mfe_aac_evaluate_rule+0x120/0x120 [mfe_aac_100710239]
[1746066.339993]  mfe_aac_find_match+0xbf/0x450 [mfe_aac_100710239]
[1746066.340583]  ? mfe_aac_handle_auth_events+0xac/0x330 [mfe_aac_100710239]
[1746066.341174]  ? kmem_cache_alloc_trace+0x142/0x280
[1746066.341757]  mfe_aac_handle_auth_events+0xfa/0x330 [mfe_aac_100710239]
[1746066.342346]  mfe_aac_process_pre_events+0xf6/0x180 [mfe_aac_100710239]
[1746066.342948]  mfe_aac_fa_process_load_binary+0x84/0xb0 [mfe_aac_100710239]
[1746066.343531]  search_binary_handler+0x119/0x3a0
[1746066.344112]  do_execveat_common.isra.36+0x549/0x910
[1746066.344679]  do_execve+0x1f/0x30
[1746066.345248]  call_usermodehelper_exec_async+0xf0/0x150
[1746066.345813]  ? recalc_sigpending+0x17/0x50
[1746066.346360]  ? call_usermodehelper+0xa0/0xa0
[1746066.346884]  ret_from_fork+0x1f/0x40
[1746066.347411] Modules linked in: mfe_aac_100710239(OE) mptcp_diag xsk_diag vsock_diag raw_diag unix_diag af_packet_diag netlink_diag tcp_diag udp_diag inet_diag binfmt_misc vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vfat fat intel_rapl_msr intel_rapl_common isst_if_mbox_msr isst_if_common nfit libnvdimm crc32_pclmul rapl vmw_balloon joydev pcspkr vmw_vmci i2c_piix4 xfs libcrc32c ext4 mbcache jbd2 sr_mod cdrom ata_generic vmwgfx sd_mod t10_pi ttm sg drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix ahci libahci serio_raw libata vmxnet3 vmw_pvscsi dm_mirror dm_region_hash dm_log dm_mod crypto_user ansi_cprng cmac ccm xts ecdh_generic dh_generic des3_ede_x86_64 des_generic ghash_clmulni_intel crct10dif_pclmul crc32c_intel sha3_generic sha512_mb sha256_mb sha1_mb mcryptd fuse ipmi_devintf ipmi_msghandler [last unloaded: mfe_fileaccess_100710239]
[1746066.351934] CR2: ffff9f6a4d256000
[1746066.352583] ---[ end trace 12009d2c5c3dceca ]---
[1746066.353131] RIP: 0010:strlen+0xc/0x20
[1746066.353711] Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 0f 1f 80 00 00 00 00 80 3f 00 74 10 48 89 f8 48 83 c0 01 <80> 38 00 75 f7 48 29 f8 c3 31 c0 c3 0f 1f 84 00 00 00 00 00 48 89
[1746066.354823] RSP: 0018:ffffae2182c0b7f8 EFLAGS: 00010296
[1746066.355382] RAX: ffff9f6a4d256000 RBX: ffff9f6a4d24d140 RCX: 0000000000000000
[1746066.355955] RDX: 0000000000000001 RSI: ffffae2182c0b818 RDI: ffff9f6a4d24d140
[1746066.356525] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
[1746066.357090] R10: ffff9f6ac0000200 R11: ffffed23868d3cc8 R12: ffff9f6a0d770c00
[1746066.357657] R13: 0000000000000001 R14: 0000000000000000 R15: ffff9f6a0d770c00
[1746066.358216] FS:  0000000000000000(0000) GS:ffff9f6bf42c0000(0000) knlGS:0000000000000000
[1746066.358784] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1746066.359349] CR2: ffff9f6a4d256000 CR3: 000000004b010003 CR4: 00000000007706e0
[1746066.359950] PKRU: 55555554
[1746066.360522] Kernel panic - not syncing: Fatal exception
[1746066.361168] Kernel Offset: 0x36a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[1746066.361793] ---[ end Kernel panic - not syncing: Fatal exception ]---

Environment

  • Red Hat Enterprise Linux 8.6
    • kernel 4.18.0-372.26.1.el8_6.x86_64
    • kernel 4.18.0-372.32.1.el8_6.x86_64
  • McAfee module
    • mfe_aac_100710239 loaded
    • mfe_aac_100710368 loaded

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content