segfault while trying to load module br_netfilter

segfault while trying to load module br_netfilter

[Benjamin Doppler]

Hello!
I have cross-compiled a kernel (5.6.2) for ARM with the module
br_netfilter included. When I load the module using modprobe
br_netfilter on my ARM machine I get a segfault resulting in text on the
screen and in dmesg.

Output of gdb shows this:
(gdb) file br_netfilter.ko
(gdb) list *brnf_init_net+0x90
0x388 is in brnf_init_net (net/bridge/br_netfilter_hooks.c:1110).

Line 1110 of net/bridge/br_netfilter_hooks.c is:
br_netfilter_sysctl_default(brnet);

Kernel information
Kernel version (from /proc/version):
Host machine:
Linux version 5.4.0-rc5-custom (temrix@msi-pc) (gcc version 8.3.0
(Debian 8.3.0-6)) #2 SMP Tue Oct 29 22:45:09 CET 2019

ARM machine:
Linux version 5.6.2 (temrix@msi-pc) (gcc version 9.2.1 20191025 (GNU
Toolchain for the A-profile Architecture 9.2-2019.12 (arm-9.10))) #1 SMP
Fri Apr 3 21:05:22 CEST 2020

Cross-compile toolchain: gcc-arm-9.2-2019.12-x86_64-arm-none-linux-gnueabihf

Kernel .config file:
see attachments

Most recent kernel version I tried which did not have the bug:
5.4.0-rc5_armhf

Output of dmesg:
     resolved (see Documentation/admin-guide/bug-hunting.rst)
[  538.272076] bridge: filtering via arp/ip/ip6tables is no longer
available by default. Update your scripts to load br_netfilter if you
need this.
[  538.289383] 8<--- cut here ---
[  538.292447] Unable to handle kernel NULL pointer dereference at
virtual address 00000008
[  538.300638] pgd = c483f76c
[  538.303357] [00000008] *pgd=00000000
[  538.307021] Internal error: Oops: 805 [#1] SMP ARM
[  538.311804] Modules linked in: br_netfilter(+) bridge stp llc
iptable_filter overlay uas usb_storage ip_tables x_tables
[  538.322595] CPU: 0 PID: 6089 Comm: modprobe Not tainted 5.6.2 #1
[  538.328590] Hardware name: Allwinner A83t board
[  538.333138] PC is at brnf_init_net+0x90/0xe4 [br_netfilter]
[  538.338715] LR is at ops_init+0x38/0xf0
[  538.342544] pc : [<bf07e388>]    lr : [<c06264f8>]    psr: 60010013
[  538.348801] sp : ea105d58  ip : ec056500  fp : 00000000
[  538.354018] r10: bf082140  r9 : ec056ac0  r8 : c0b6b100
[  538.359236] r7 : c0b6b100  r6 : 00000000  r5 : bf082000  r4 : 00000000
[  538.365753] r3 : 00000001  r2 : bf082000  r1 : bf081114  r0 : c0b6b100
[  538.372272] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM 
Segment none
[  538.379399] Control: 10c5387d  Table: 6a26806a  DAC: 00000051
[  538.385139] Process modprobe (pid: 6089, stack limit = 0x9f8e5438)
[  538.391311] Stack: (0xea105d58 to 0xea106000)
[  538.395664]
5d40:                                                       ec0564c0
bf08210c
[  538.403830] 5d60: c0b6b100 0000000a ee984000 c06264f8 bf08210c
c0b6b100 0000000a ea105d94
[  538.411998] 5d80: c0b6b058 ec056ac0 bf082140 c06268a0 00000000
ea105d94 ea105d94 c0b04e48
[  538.420165] 5da0: c0b6b040 bf08210c ffffe000 00000000 bf082188
c06269c4 c0b75e40 bf085000
[  538.428333] 5dc0: ffffe000 bf08500c c0b75e40 c01026d0 ee815c00
ec08db00 edc042c0 ef42b3d4
[  538.436500] 5de0: ee803e00 ec08db80 ef42b3d4 8040003e ec08db80
c0210a10 bf082188 c0b04e48
[  538.444667] 5e00: 00000001 ef42b3d4 ee803e00 ec08db00 c01a1354
bf082188 bf082140 c0b04e48
[  538.452835] 5e20: 00000002 bf082140 ec056880 00000002 00000002
c019f1e4 ec056a80 00000002
[  538.461002] 5e40: ea105f40 ec056a80 00000002 c01a135c bf08214c
00007fff bf082140 c019e400
[  538.469169] 5e60: bf082318 00000000 c0803038 c090733c bf08214c
bf087150 bf082254 c0907294
[  538.477337] 5e80: c09072ec ea105f38 004c7498 c023ec68 00000000
00000000 00000000 ffffe000
[  538.485503] 5ea0: 00000000 00000000 00000000 00000000 00000000
00000000 6e72656b 00006c65
[  538.493670] 5ec0: 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000
[  538.501836] 5ee0: 00000000 00000000 00000000 00000000 00000000
c0b04e48 7fffffff 00000000
[  538.510004] 5f00: 00000006 004b17e0 0000017b c0101204 ea104000
0000017b 004c7498 c01a199c
[  538.518173] 5f20: 7fffffff 00000000 00000003 000000c0 004c7498
f0bf4000 00004cbc 00000000
[  538.526341] 5f40: f0bf65bf f0bf6780 f0bf4000 00004cbc f0bf858c
f0bf83c0 f0bf7584 00005000
[  538.534507] 5f60: 00005220 000020dc 00005403 00000000 00000000
00000000 000020cc 0000002b
[  538.542674] 5f80: 0000002c 00000021 00000000 00000017 0000001d
c0b04e48 004b310c 00000000
[  538.550842] 5fa0: b0b55500 c0101000 004b310c 00000000 00000006
004b17e0 00000000 004b3318
[  538.559010] 5fc0: 004b310c 00000000 b0b55500 0000017b 004c74e8
00000000 00000000 004c7498
[  538.567176] 5fe0: be916398 be916388 004a9e41 b6ceed92 40010030
00000006 00000000 00000000
[  538.575373] [<bf07e388>] (brnf_init_net [br_netfilter]) from
[<c06264f8>] (ops_init+0x38/0xf0)
[  538.583982] [<c06264f8>] (ops_init) from [<c06268a0>]
(register_pernet_operations+0xf4/0x1f4)
[  538.592499] [<c06268a0>] (register_pernet_operations) from
[<c06269c4>] (register_pernet_subsys+0x24/0x38)
[  538.602145] [<c06269c4>] (register_pernet_subsys) from [<bf08500c>]
(br_netfilter_init+0xc/0x1000 [br_netfilter])
[  538.612403] [<bf08500c>] (br_netfilter_init [br_netfilter]) from
[<c01026d0>] (do_one_initcall+0x58/0x1c4)
[  538.622051] [<c01026d0>] (do_one_initcall) from [<c019f1e4>]
(do_init_module+0x5c/0x244)
[  538.630138] [<c019f1e4>] (do_init_module) from [<c01a135c>]
(load_module+0x1f0c/0x22ec)
[  538.638134] [<c01a135c>] (load_module) from [<c01a199c>]
(sys_finit_module+0xd0/0xe8)
[  538.645956] [<c01a199c>] (sys_finit_module) from [<c0101000>]
(ret_fast_syscall+0x0/0x54)
[  538.654120] Exception stack(0xea105fa8 to 0xea105ff0)
[  538.659166] 5fa0:                   004b310c 00000000 00000006
004b17e0 00000000 004b3318
[  538.667334] 5fc0: 004b310c 00000000 b0b55500 0000017b 004c74e8
00000000 00000000 004c7498
[  538.675499] 5fe0: be916398 be916388 004a9e41 b6ceed92
[  538.680547] Code: e58520b8 e3011114 e1a02005 e34b1f08 (e5843008)
[  538.686793] ---[ end trace c644a87d777f3f88 ]---

A small shell script or example program which triggers the problem
modprobe br_netfilter

Environment
output of the ver_linux script:
Host machine:
If some fields are empty or look unusual you may have an old version.
Compare to the current minimal requirements in Documentation/Changes.

Linux msi-pc 5.4.0-rc5-custom #2 SMP Tue Oct 29 22:45:09 CET 2019 x86_64
GNU/Linux

GNU Make                4.2.1
Binutils                2.31.1
Util-linux              2.33.1
Mount                   2.33.1
Bison                   3.3.2
Flex                    2.6.4
Linux C Library         2.28
Dynamic linker (ldd)    2.28
Procps                  3.3.15
Kbd                     2.0.4
Console-tools           2.0.4
Sh-utils                8.30
Udev                    241
Modules Loaded          acpi_pad aesni_intel ahci autofs4 binfmt_misc
button coretemp crc16 crc32c_generic crc32c_intel crc32_pclmul
crct10dif_pclmul cryptd crypto_simd drm drm_kms_helper efi_pstore
efivarfs efivars evdev ext4 fan fat fuse ghash_clmulni_intel glue_helper
gspca_main gspca_sonixj hid hid_generic i2c_i801 intel_cstate
intel_powerclamp intel_rapl_common intel_rapl_msr intel_rapl_perf
intel_uncore ipmi_devintf ipmi_msghandler ip_tables irqbypass
iTCO_vendor_support iTCO_wdt jbd2 kvm kvm_intel ledtrig_audio libahci
libata libphy lp mbcache mc mei mei_me mxm_wmi nls_ascii nls_cp437
nvidia nvidia_drm nvidia_modeset nvme nvme_core overlay parport
parport_pc pcspkr ppdev r8169 realtek scsi_mod sd_mod sg snd
snd_hda_codec snd_hda_codec_generic snd_hda_codec_hdmi
snd_hda_codec_realtek snd_hda_core snd_hda_intel snd_hwdep
snd_intel_nhlt snd_pcm snd_rawmidi snd_seq_device snd_timer
snd_usb_audio snd_usbmidi_lib soundcore thermal uas usbcore usbhid
usb_storage vfat video videobuf2_common videobuf2_memops videobuf2_v4l2
videobuf2_vmalloc videodev wmi x86_pkg_temp_thermal xhci_hcd xhci_pci
x_tables

ARM machine:
If some fields are empty or look unusual you may have an old version.
Compare to the current minimal requirements in Documentation/Changes.

Linux cubietruck-plus 5.6.2 #1 SMP Fri Apr 3 21:05:22 CEST 2020 armv7l
GNU/Linux

GNU Make                4.2.1
Binutils                2.31.1
Util-linux              2.33.1
Mount                   2.33.1
Linux C Library         2.28
Dynamic linker (ldd)    2.28
Procps                  3.3.15
Sh-utils                8.30
Udev                    241
Modules Loaded          iptable_filter ip_tables overlay uas usb_storage
x_tables

Processor information (from /proc/cpuinfo):
ARM machine:
model name    : ARMv7 Processor rev 5 (v7l)
BogoMIPS    : 57.14
Features    : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva
idivt vfpd32 lpae evtstrm
CPU implementer    : 0x41
CPU architecture: 7
CPU variant    : 0x0
CPU part    : 0xc07
CPU revision    : 5

Hardware    : Allwinner A83t board
Revision    : 0000
Serial        : 32c00001b3cbac18

Module information (from /proc/modules):
ARM machine:
br_netfilter 36864 1 - Loading 0x00000000
bridge 143360 1 br_netfilter, Live 0x00000000
stp 16384 1 bridge, Live 0x00000000
llc 16384 2 bridge,stp, Live 0x00000000
iptable_filter 16384 1 - Live 0x00000000
overlay 90112 0 - Live 0x00000000
uas 20480 0 - Live 0x00000000
usb_storage 53248 2 uas, Live 0x00000000
ip_tables 24576 1 iptable_filter, Live 0x00000000
x_tables 24576 2 iptable_filter,ip_tables, Live 0x00000000

Loaded driver and hardware information (/proc/iomem)
ARM machine:
00000000-00000000 : 1000000.clock
00000000-00000000 : sunxi-mc-smp
00000000-00000000 : 1c02000.dma-controller
00000000-00000000 : 1c0f000.mmc
00000000-00000000 : 1c10000.mmc
00000000-00000000 : 1c11000.mmc
00000000-00000000 : 1c14000.eeprom
00000000-00000000 : usb@1c19000
  00000000-00000000 : musb-hdrc.1.auto
00000000-00000000 : 1c19400.phy
00000000-00000000 : 1c1a000.usb
00000000-00000000 : 1c19400.phy
00000000-00000000 : 1c1b000.usb
00000000-00000000 : 1c19400.phy
00000000-00000000 : 1c20000.clock
00000000-00000000 : 1c20800.pinctrl
00000000-00000000 : 1c20ca0.watchdog
00000000-00000000 : serial
00000000-00000000 : serial
00000000-00000000 : 1c30000.ethernet
00000000-00000000 : interrupt-controller@1f00c00
00000000-00000000 : clock@1f01400
00000000-00000000 : sunxi-mc-smp
00000000-00000000 : 1f02c00.pinctrl
00000000-00000000 : 1f03400.rsb
00000000-00000000 : 1f04000.thermal-sensor
00000000-00000000 : System RAM
  00000000-00000000 : Kernel code
  00000000-00000000 : Kernel data