kernel-packages team mailing list archive

Thread
Date
[Bug 892928] Re: wireshark crashes with null pointer dereference in kernel

To: kernel-packages@xxxxxxxxxxxxxxxxxxx
From: "Christopher M. Penalver" <christopher.m.penalver@xxxxxxxxx>
Date: Sun, 18 Aug 2013 19:24:28 -0000
Reply-to: Bug 892928 <892928@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Spencer Kathol, this bug was reported a while ago and there hasn't been
any activity in it recently. We were wondering if this is still an
issue? If so, could you please test for this with the latest development
release of Ubuntu? ISO images are available from
http://cdimage.ubuntu.com/daily-live/current/ .

If it remains an issue, could you please run the following command in
the development release from a Terminal
(Applications->Accessories->Terminal), as it will automatically gather
and attach updated debug information to this report:

apport-collect -p linux <replace-with-bug-number>

Also, could you please test the latest upstream kernel available following https://wiki.ubuntu.com/KernelMainlineBuilds ? It will allow additional upstream developers to examine the issue. Please do not test the daily folder, but the one all the way at the bottom. Once you've tested the upstream kernel, please comment on which kernel version specifically you tested. If this bug is fixed in the mainline kernel, please add the following tags:
kernel-fixed-upstream
kernel-fixed-upstream-VERSION-NUMBER

where VERSION-NUMBER is the version number of the kernel you tested. For example:
kernel-fixed-upstream-v3.11-rc5

This can be done by clicking on the yellow circle with a black pencil icon next to the word Tags located at the bottom of the bug description. As well, please remove the tag:
needs-upstream-testing

If the mainline kernel does not fix this bug, please add the following tags:
kernel-bug-exists-upstream
kernel-bug-exists-upstream-VERSION-NUMBER

As well, please remove the tag:
needs-upstream-testing

Once testing of the upstream kernel is complete, please mark this bug's
Status as Confirmed. Please let us know your results. Thank you for your
understanding.

** Changed in: linux (Ubuntu)
       Status: Confirmed => Incomplete

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/892928

Title:
  wireshark crashes with null pointer dereference in kernel

Status in “linux” package in Ubuntu:
  Incomplete
Status in “wireshark” package in Ubuntu:
  Invalid

Bug description:
  I followed the following steps to get wireshark running in non-root mode:
   * Create wireshark group
   * Set permissions of dumpcap so only users in the wireshark group can run it
   * setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
   * Add my user to wireshark group
   * restart
   * open wireshark through the unity dash, and start capturing on my wireless network interface

  Traffic started appearing in wireshark, I applied a filter, and made a
  query using firefox that I expected to be caught by the filter.  At
  this point the whole system crashed.

  When I brought the system back up, I checked the system logs.  Here is what I got in syslog at the time of the crash:
  Nov 20 17:47:44 bodie kernel: [  288.576153] device wlan0 entered promiscuous mode
  Nov 20 17:48:03 bodie kernel: [  307.612283] BUG: unable to handle kernel NULL pointer dereference at 0000002c
  Nov 20 17:48:03 bodie kernel: [  307.612366] IP: [<f8f05184>] ieee80211_rx_h_michael_mic_verify+0x184/0x1d0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.612452] *pdpt = 00000000373d1001 *pde = 0000000000000000
  Nov 20 17:48:03 bodie kernel: [  307.612510] Oops: 0002 [#1] SMP
  Nov 20 17:48:03 bodie kernel: [  307.612548] Modules linked in: rfcomm bnep bluetooth nfsd nfs lockd fscache auth_rpcgss nfs_acl sunrpc binfmt_misc snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd arc4 rt61pci crc_itu_t rt2x00pci rt2x00lib mac80211 soundcore i915 drm_kms_helper drm cfg80211 snd_page_alloc eeprom_93cx6 psmouse joydev serio_raw i2c_algo_bit ppdev video parport_pc lp parport usbhid hid raid10 raid456 async_raid6_recov async_pq floppy r8169 raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear
  Nov 20 17:48:03 bodie kernel: [  307.613191]
  Nov 20 17:48:03 bodie kernel: [  307.613209] Pid: 0, comm: kworker/0:1 Not tainted 3.0.0-12-generic-pae #20-Ubuntu MSI MS-7592/G41TM-E43 (MS-7592)
  Nov 20 17:48:03 bodie kernel: [  307.613306] EIP: 0060:[<f8f05184>] EFLAGS: 00010246 CPU: 3
  Nov 20 17:48:03 bodie kernel: [  307.613364] EIP is at ieee80211_rx_h_michael_mic_verify+0x184/0x1d0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.613428] EAX: 00000000 EBX: f74edec8 ECX: 00000000 EDX: 00000000
  Nov 20 17:48:03 bodie kernel: [  307.613484] ESI: 00000000 EDI: ef30d044 EBP: f74ede54 ESP: f74ede24
  Nov 20 17:48:03 bodie kernel: [  307.613539]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
  Nov 20 17:48:03 bodie kernel: [  307.613588] Process kworker/0:1 (pid: 0, ti=f74ec000 task=f74ce600 task.ti=f74e8000)
  Nov 20 17:48:03 bodie kernel: [  307.613655] Stack:
  Nov 20 17:48:03 bodie kernel: [  307.613675]  c15555fd f74ede34 00000008 00000000 00000000 ec932000 f74edec8 ef30d044
  Nov 20 17:48:03 bodie kernel: [  307.613768]  55588794 f74edec8 ec932000 00000001 f74ede6c f8f192b5 f8f18b16 f74edec8
  Nov 20 17:48:03 bodie kernel: [  307.613859]  f74edec8 ec932000 f74ede7c f8f19486 f74edec8 ec932000 f74edeac f8f1952c
  Nov 20 17:48:03 bodie kernel: [  307.613949] Call Trace:
  Nov 20 17:48:03 bodie kernel: [  307.613978]  [<c15555fd>] ? _raw_spin_lock_irqsave+0x2d/0x40
  Nov 20 17:48:03 bodie kernel: [  307.614044]  [<f8f192b5>] ieee80211_rx_handlers+0x125/0x2a0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614114]  [<f8f18b16>] ? ieee80211_rx_h_check+0xc6/0x120 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614184]  [<f8f19486>] ieee80211_invoke_rx_handlers+0x56/0xa0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614257]  [<f8f1952c>] ieee80211_prepare_and_rx_handle+0x5c/0xc0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614333]  [<f8f196fb>] __ieee80211_rx_handle_packet+0x16b/0x2d0 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614407]  [<f8f19940>] ieee80211_rx+0xe0/0x180 [mac80211]
  Nov 20 17:48:03 bodie kernel: [  307.614463]  [<f88ffa68>] rt2x00lib_rxdone+0x178/0x1f0 [rt2x00lib]
  Nov 20 17:48:03 bodie kernel: [  307.614522]  [<f88e4265>] rt2x00pci_rxdone+0x65/0x90 [rt2x00pci]
  Nov 20 17:48:03 bodie kernel: [  307.614589]  [<c1056e60>] ? local_bh_enable_ip+0x90/0x90
  Nov 20 17:48:03 bodie kernel: [  307.614639]  [<f88d7aa8>] rt61pci_rxdone_tasklet+0x18/0x80 [rt61pci]
  Nov 20 17:48:03 bodie kernel: [  307.614698]  [<c1056983>] tasklet_action+0x63/0x110
  Nov 20 17:48:03 bodie kernel: [  307.614743]  [<c1056e60>] ? local_bh_enable_ip+0x90/0x90
  Nov 20 17:48:03 bodie kernel: [  307.614792]  [<c1056ee1>] __do_softirq+0x81/0x1a0
  Nov 20 17:48:03 bodie kernel: [  307.614836]  [<c1056e60>] ? local_bh_enable_ip+0x90/0x90
  Nov 20 17:48:03 bodie kernel: [  307.616244]  <IRQ>
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1057226>] ? irq_exit+0x76/0xa0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c155cd5b>] ? do_IRQ+0x4b/0xc0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1057210>] ? irq_exit+0x60/0xa0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c155ce29>] ? smp_apic_timer_interrupt+0x59/0x88
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c155cbb0>] ? common_interrupt+0x30/0x38
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1011091>] ? mwait_idle+0x71/0x130
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1008c6a>] ? cpu_idle+0x8a/0xc0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c153a994>] ? start_secondary+0xe8/0xed
  Nov 20 17:48:03 bodie kernel: [  307.616244] Code: 01 00 b8 01 00 00 00 e9 e2 fe ff ff 8d 76 00 f6 c1 01 75 bb 83 e1 10 0f 85 d1 fe ff ff 8b 53 10 8d 04 b6 8b 4b 1c c1 e0 02 01 c2
  Nov 20 17:48:03 bodie kernel: [  307.616244] EIP: [<f8f05184>] ieee80211_rx_h_michael_mic_verify+0x184/0x1d0 [mac80211] SS:ESP 0068:f74ede24
  Nov 20 17:48:03 bodie kernel: [  307.616244] CR2: 000000000000002c
  Nov 20 17:48:03 bodie kernel: [  307.616244] BUG: scheduling while atomic: kworker/0:1/0/0x10000300
  Nov 20 17:48:03 bodie kernel: [  307.616244] Modules linked in: rfcomm bnep bluetooth nfsd nfs lockd fscache auth_rpcgss nfs_acl sunrpc binfmt_misc snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd arc4 rt61pci crc_itu_t rt2x00pci rt2x00lib mac80211 soundcore i915 drm_kms_helper drm cfg80211 snd_page_alloc eeprom_93cx6 psmouse joydev serio_raw i2c_algo_bit ppdev video parport_pc lp parport usbhid hid raid10 raid456 async_raid6_recov async_pq floppy r8169 raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear
  Nov 20 17:48:03 bodie kernel: [  307.616244] Modules linked in: rfcomm bnep bluetooth nfsd nfs lockd fscache auth_rpcgss nfs_acl sunrpc binfmt_misc snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd arc4 rt61pci crc_itu_t rt2x00pci rt2x00lib mac80211 soundcore i915 drm_kms_helper drm cfg80211 snd_page_alloc eeprom_93cx6 psmouse joydev serio_raw i2c_algo_bit ppdev video parport_pc lp parport usbhid hid raid10 raid456 async_raid6_recov async_pq floppy r8169 raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear
  Nov 20 17:48:03 bodie kernel: [  307.616244]
  Nov 20 17:48:03 bodie kernel: [  307.616244] Pid: 0, comm: kworker/0:1 Not tainted 3.0.0-12-generic-pae #20-Ubuntu MSI MS-7592/G41TM-E43 (MS-7592)
  Nov 20 17:48:03 bodie kernel: [  307.616244] EIP: 0060:[<c1011091>] EFLAGS: 00000246 CPU: 3
  Nov 20 17:48:03 bodie kernel: [  307.616244] EIP is at mwait_idle+0x71/0x130
  Nov 20 17:48:03 bodie kernel: [  307.616244] EAX: 00000000 EBX: 00000003 ECX: 00000000 EDX: 00000000
  Nov 20 17:48:03 bodie kernel: [  307.616244] ESI: c17f18b8 EDI: 6a82cada EBP: f74e9f7c ESP: f74e9f68
  Nov 20 17:48:03 bodie kernel: [  307.616244]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
  Nov 20 17:48:03 bodie kernel: [  307.616244] Process kworker/0:1 (pid: 0, ti=f74ec000 task=f74ce600 task.ti=f74e8000)
  Nov 20 17:48:03 bodie kernel: [  307.616244] Stack:
  Nov 20 17:48:03 bodie kernel: [  307.616244]  00000003 00000003 00000003 c17f18b8 6a82cada f74e9f98 c1008c6a 55588794
  Nov 20 17:48:03 bodie kernel: [  307.616244]  6a82cada 2378b39c 00000000 00000000 f74e9fac c153a994 87a8cd8f 2378b39c
  Nov 20 17:48:03 bodie kernel: [  307.616244]  03040800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  Nov 20 17:48:03 bodie kernel: [  307.616244] Call Trace:
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1008c6a>] cpu_idle+0x8a/0xc0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c153a994>] start_secondary+0xe8/0xed
  Nov 20 17:48:03 bodie kernel: [  307.616244] Code: 00 e0 ff ff 31 d2 83 c0 08 89 d1 0f 01 c8 0f ae f0 89 f6 89 e0 25 00 e0 ff ff 8b 40 08 a8 08 0f 85 a4 00 00 00 31 c0 fb 0f 01 c9
  Nov 20 17:48:03 bodie kernel: [  307.616244] Call Trace:
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c1008c6a>] cpu_idle+0x8a/0xc0
  Nov 20 17:48:03 bodie kernel: [  307.616244]  [<c153a994>] start_secondary+0xe8/0xed
  Nov 20 17:48:03 bodie kernel: [  307.756350] BUG: scheduling while atomic: kworker/0:1/0/0x10000300
  Nov 20 17:48:03 bodie kernel: [  307.759743] Modules linked in: rfcomm bnep bluetooth nfsd nfs lockd fscache auth_rpcgss nfs_acl sunrpc binfmt_misc snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd arc4 rt61pci crc_itu_t rt2x00pci rt2x00lib mac80211 soundcore i915 drm_kms_helper drm cfg80211 snd_page_alloc eeprom_93cx6 psmouse joydev serio_raw i2c_algo_bit ppdev video parport_pc lp parport usbhid hid raid10 raid456 async_raid6_recov async_pq floppy r8169 raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear
  Nov 20 17:48:03 bodie kernel: [  307.774046] Modules linked in: rfcomm bnep bluetooth nfsd nfs lockd fscache auth_rpcgss nfs_acl sunrpc binfmt_misc snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd arc4 rt61pci crc_itu_t rt2x00pci rt2x00lib mac80211 soundcore i915 drm_kms_helper drm cfg80211 snd_page_alloc eeprom_93cx6 psmouse joydev serio_raw i2c_algo_bit ppdev video parport_pc lp parport usbhid hid raid10 raid456 async_raid6_recov async_pq floppy r8169 raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear

  After some google searching, I found that a bug with a matching error message was found and fixed recently by the wireshark developers.  Here is a link to the bug:
  https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6476

  The bug was fixed in wireshark version 1.6.3, but Ubuntu released version 1.6.2.  Here are the release notes for wireshark 1.6.3, which references bug 6476, linked above.
  http://www.wireshark.org/docs/relnotes/wireshark-1.6.3.html

  ProblemType: Bug
  DistroRelease: Ubuntu 11.10
  Package: wireshark 1.6.2-1
  ProcVersionSignature: Ubuntu 3.0.0-12.20-generic-pae 3.0.4
  Uname: Linux 3.0.0-12-generic-pae i686
  ApportVersion: 1.23-0ubuntu4
  Architecture: i386
  Date: Sun Nov 20 19:38:20 2011
  ProcEnviron:
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  SourcePackage: wireshark
  UpgradeStatus: Upgraded to oneiric on 2011-10-15 (37 days ago)
  ---
  AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
  ApportVersion: 1.23-0ubuntu4
  Architecture: i386
  AudioDevicesInUse:
   USER        PID ACCESS COMMAND
   /dev/snd/controlC0:  spence     1994 F.... pulseaudio
   /dev/snd/pcmC0D0p:   spence     1994 F...m pulseaudio
  CRDA: Error: [Errno 2] No such file or directory
  Card0.Amixer.info:
   Card hw:0 'Intel'/'HDA Intel at 0xfe9f8000 irq 44'
     Mixer name	: 'Intel Eaglelake HDMI'
     Components	: 'HDA:10ec0889,14627592,00100004 HDA:80862803,80860101,00100000'
     Controls      : 41
     Simple ctrls  : 23
  DistroRelease: Ubuntu 11.10
  HibernationDevice: RESUME=UUID=ad3f9fb2-3d01-45e3-8fec-f8a87b458a0d
  MachineType: MSI MS-7592
  Package: linux (not installed)
  ProcEnviron:
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcKernelCmdLine: root=UUID=f2c5cc67-2076-48f1-bde5-f752602c4072 ro quiet splash
  ProcVersionSignature: Ubuntu 3.0.0-12.20-generic-pae 3.0.4
  RelatedPackageVersions:
   linux-restricted-modules-3.0.0-12-generic-pae N/A
   linux-backports-modules-3.0.0-12-generic-pae  N/A
   linux-firmware                                1.60
  RfKill:
   0: phy0: Wireless LAN
    Soft blocked: no
    Hard blocked: no
  Tags:  oneiric running-unity
  Uname: Linux 3.0.0-12-generic-pae i686
  UpgradeStatus: Upgraded to oneiric on 2011-10-15 (37 days ago)
  UserGroups: adm admin cdrom dialout disk floppy lpadmin netdev plugdev sambashare scanner video www-data
  WpaSupplicantLog:

  dmi.bios.date: 03/27/2009
  dmi.bios.vendor: American Megatrends Inc.
  dmi.bios.version: V4.0
  dmi.board.asset.tag: To Be Filled By O.E.M.
  dmi.board.name: G41TM-E43 (MS-7592)
  dmi.board.vendor: MSI
  dmi.board.version: 20
  dmi.chassis.asset.tag: To Be Filled By O.E.M.
  dmi.chassis.type: 3
  dmi.chassis.vendor: MSI
  dmi.chassis.version: 20
  dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrV4.0:bd03/27/2009:svnMSI:pnMS-7592:pvr20:rvnMSI:rnG41TM-E43(MS-7592):rvr20:cvnMSI:ct3:cvr20:
  dmi.product.name: MS-7592
  dmi.product.version: 20
  dmi.sys.vendor: MSI

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/892928/+subscriptions