Kernel panic at ns_dname() in presence of CyProtectDrv module

Solution Verified - Updated -

Issue

  • Kernel panic with logs:
[2804874.777387] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
[2804874.777634] PGD 0 P4D 0 
[2804874.777838] Oops: 0000 [#1] SMP NOPTI
[2804874.778055] CPU: 2 PID: 59805 Comm: oneagentextensi Kdump: loaded Tainted: P           OE    --------- -  - 4.18.0-477.55.1.el8_8.x86_64 #1
[2804874.778389] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[2804874.778715] RIP: 0010:ns_dname+0xd/0x20
[2804874.778982] Code: 00 00 48 89 f8 48 8b 7f 08 48 8b 00 48 8b 40 18 e9 08 dc a5 00 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 4f 30 48 8b 47 78 <4c> 8b 49 40 4c 8b 00 48 c7 c1 e3 6c b1 b8 e9 30 e8 ff ff 0f 1f 44
[2804874.779472] RSP: 0018:ffffbc07047ffe00 EFLAGS: 00010206
[2804874.779553] RAX: ffffffffb8828340 RBX: ffff9865ae32e210 RCX: 0000000000000000
[2804874.779643] RDX: 00000000000000f0 RSI: ffff9864ec0043b8 RDI: ffff98678da14f00
[2804874.779732] RBP: ffffbc07047ffe38 R08: 0000000000001000 R09: ffffffffb7b7fc00
[2804874.779822] R10: ffff98678da14f00 R11: 0000000000000001 R12: ffff9864ca9511f0
[2804874.780640] R13: ffff986410fa02f0 R14: ffff9864c1df5520 R15: ffff98678da14f00
[2804874.781366] FS:  00007f6c82ffd700(0000) GS:ffff9867ddd00000(0000) knlGS:0000000000000000
[2804874.782050] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[2804874.782729] CR2: 0000000000000040 CR3: 00000001667ec004 CR4: 00000000007706e0
[2804874.783446] PKRU: 55555554
[2804874.784128] Call Trace:
[2804874.784818]  d_path+0x51/0x140
[2804874.785483]  FileUtil_GetPath_bypath+0x51/0x140 [CyProtectDrv]
[2804874.786151]  hook_security_file_free+0x7a/0xb0 [CyProtectDrv]
[2804874.786826]  security_file_free+0x22/0x60
[2804874.787501]  __fput+0x12c/0x250
[2804874.788155]  task_work_run+0x8a/0xb0
[2804874.788807]  exit_to_usermode_loop+0xef/0x100
[2804874.789458]  do_syscall_64+0x19c/0x1b0
[2804874.790104]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[2804874.790746] RIP: 0033:0x7f6c8a94146f
[2804874.791388] Code: 00 0f 05 48 3d 00 f0 ff ff 77 40 c3 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 e8 5c 3d f0 ff 89 df 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2b 89 d7 89 44 24 0c e8 9e 3d f0 ff 8b 44 24
[2804874.792716] RSP: 002b:00007f6c82ffc420 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[2804874.793396] RAX: 0000000000000000 RBX: 000000000000001e RCX: 00007f6c8a94146f
[2804874.794067] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001e
[2804874.794734] RBP: 00007f6c82ffc480 R08: 0000000000000000 R09: 0000000000000000
[2804874.795391] R10: 00007f6c82ffc4c0 R11: 0000000000000293 R12: 000000000000001e
[2804874.796047] R13: 00007f6c8b5217d0 R14: 00007f6c82ffd488 R15: 00007f6c82ffca78
[2804874.796693] Modules linked in: mptcp_diag xsk_diag vsock_diag raw_diag af_packet_diag netlink_diag udp_diag tcp_diag inet_diag CyProtectDrv(POE) CyProtectDrvOpen(OE) nf_tables libcrc32c nfnetlink nfsv3 nfs_acl nfs fscache unix_diag lockd grace sunrpc vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock intel_rapl_msr intel_rapl_common intel_uncore_frequency_common nfit libnvdimm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl vmw_balloon joydev pcspkr vmw_vmci i2c_piix4 binfmt_misc ext4 mbcache jbd2 sr_mod cdrom sd_mod t10_pi sg ata_generic vmwgfx drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata crc32c_intel serio_raw vmxnet3 vmw_pvscsi dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: CyProtectDrvOpen]
[2804874.800944] Red Hat flags: eBPF/event
[2804874.801658] CR2: 0000000000000040

Environment

  • Red Hat Enterprise Linux 8
  • 3rd party security module [CyProtectDrv], 3.2.1100.2341

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content