LinuxQuestions.org - Kernel OOPS "Unable to handle kernel NULL pointer dereference"

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - Kernel OOPS "Unable to handle kernel NULL pointer dereference" (https://www.linuxquestions.org/questions/linux-general-1/kernel-oops-unable-to-handle-kernel-null-pointer-dereference-197581/)

Kernel OOPS "Unable to handle kernel NULL pointer dereference"

OK... This one is quite unusual.

I wrote a simple mmap() routine so I could map some memory between the kernel and userland (I am doing some Netfilter hooks).

The module works fine. It compiles and loads great. Once it has been loaded, everything still works.

However, after I unload the module and run some other task (anything, ls, vi, gcc, doesn't matter), I get a nasty message "Unable to handle kernel NULL pointer dereference" and it locks up.

I ran memtest86 and it appears to be fine. If you want the source code for the module, I'll post it.

I don't think your module is fine if it's causing that problem. If this error occurs after the module is unloaded, you probably want to check your __exit routine to make sure that it's not screwing up any data structures in kernel space. Just out of curiousity, why can't you use the kernel routines copy_to_user and copy_from_user to pass data back and forth? Particularly if you don't have a lot of data to copy, that would probably be a lot safer.

I heard that copy_from_user was slow. I'm looking at a structure every time a packet comes in to see if whoever sent it has logged into the system.

Here's the code, just in case I've forgotten to clean something up...
(It's really C, but I used php to give it the pretty colors)

PHP Code:




static int __init start(void) 
  { 
  int i; 
  struct page *page; 
  struct net_device *brif; 
  brif = dev_get_by_name("br0"); 
  memmove(&mymac[0], &(brif[0].dev_addr[0]), 6); 
  myip = inet_select_addr(brif, 0, RT_SCOPE_LINK); 
  if (register_chrdev(34, "filter", &mmapfilter_fops) < 0) 
    { 
    printk("register_chrdev bombed!\n"); 
    return 1; 
    } 
  bc = kmalloc(BC_BUF_SIZE, GFP_KERNEL|GFP_DMA); 
  if (bc == (struct bridge_conn *)-1) 
    return 1; 
  for (i=0;i<MAX_BC;i++) 
    { 
    bc[i].status=0; 
    bc[i].ipaddr=0; 
    } 
  for (page= virt_to_page(bc); page<virt_to_page(bc+BC_BUF_SIZE); page++) 
    set_bit(PG_reserved, &((page)->flags)); 
  nfho.hook = hook_func; 
  nfho.hooknum = NF_IP_PRE_ROUTING; 
  nfho.pf = PF_INET; 
  nfho.priority = NF_IP_PRI_FIRST; 
  nf_register_hook(&nfho); 
  printk("Loaded netf, packet filter installed\n"); 
  return 0; 
  } 
static void __exit end(void) 
  { 
  spinlock_t exit_lock = SPIN_LOCK_UNLOCKED; 
  unsigned long flags; 
  struct page *page; 
  spin_lock_irqsave(&exit_lock, flags); 
  unregister_chrdev(34, "filter"); 
  for (page= virt_to_page(bc); page<virt_to_page(bc+BC_BUF_SIZE); page++) 
    clear_bit(PG_reserved, &((page)->flags)); 
  kfree(bc); 
  spin_unlock_irqrestore(&exit_lock, flags); 
  nf_unregister_hook(&nfho); 
  printk("netf/packet filter removed\n"); 
  } 
static int mmapfilter_open (struct inode *inode, struct file *filp) 
  { 
  unsigned int dev = MINOR(inode->i_rdev); 
  if (dev > 1) 
    return -ENODEV; 
  return 0; 
  } 
static int mmapfilter_release (struct inode *inode, struct file *filp) 
  { 
  return 0; 
  } 
static int mmapfilter_mmap (struct file *filp, struct vm_area_struct *vma) 
  { 
  //unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; 
  unsigned long page, pos = (unsigned long)bc; 
  unsigned long start = vma->vm_start, size = vma->vm_end-vma->vm_start; 
  vma->vm_flags |= (VM_IO | VM_RESERVED | VM_SHM); 
  if (size>BC_BUF_SIZE) 
    return -EINVAL; 
  while (size > 0) 
    { 
    page = virt_to_phys((void *)pos); 
    if (remap_page_range(vma, start, page, PAGE_SIZE, vma->vm_page_prot)) 
      return -EAGAIN; 
    start += PAGE_SIZE; 
    pos += PAGE_SIZE; 
    size -= PAGE_SIZE; 
    } 
  return 0; 
  }

Another thing I've found...

On kmalloc(), if I don't put in GFP_DMA, it gives me random Segmentation faults with a lot of registers & whatnot (I don't know what those are called...) but it doesn't crash. It also works normally when unloaded.