{"action":"created","issue":{"url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/71","labels_url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/71/labels{/name}","comments_url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/71/comments","events_url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/71/events","html_url":"https://github.com/multipath-tcp/mptcp/issues/71","id":54818850,"number":71,"title":"tp->mptcp == NULL but tp->mpc is set","user":{"login":"cpaasch","id":116300,"avatar_url":"https://avatars.githubusercontent.com/u/116300?v=3","gravatar_id":"","url":"https://api.github.com/users/cpaasch","html_url":"https://github.com/cpaasch","followers_url":"https://api.github.com/users/cpaasch/followers","following_url":"https://api.github.com/users/cpaasch/following{/other_user}","gists_url":"https://api.github.com/users/cpaasch/gists{/gist_id}","starred_url":"https://api.github.com/users/cpaasch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpaasch/subscriptions","organizations_url":"https://api.github.com/users/cpaasch/orgs","repos_url":"https://api.github.com/users/cpaasch/repos","events_url":"https://api.github.com/users/cpaasch/events{/privacy}","received_events_url":"https://api.github.com/users/cpaasch/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/multipath-tcp/mptcp/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/multipath-tcp/mptcp/labels/Level:%20Normal","name":"Level: Normal","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-19T22:12:22Z","updated_at":"2015-08-11T22:44:40Z","closed_at":null,"body":"Happened at least once with test simple_abndiff on f9edddd40fc5c59cd7ba93f739517dd0340111df (v3.17 + MPTCP) but with the scheduling-patches (https://github.com/multipath-tcp/mptcp/pull/70). However, seems to be absolutely unrelated to the scheduling.\r\n\r\nCrash happens when accessing tp->mptcp in mptcp_reset_mopt().\r\n\r\n```\r\n[267465.961722] BUG: unable to handle kernel NULL pointer dereference at 0000000000000019\r\n[267465.968188] IP: [<ffffffff8166305c>] tcp_validate_incoming+0x35c/0x3b0\r\n[267465.974360] PGD 0\r\n[267465.977647] Oops: 0000 [#1] SMP\r\n[267465.981644] Modules linked in:\r\n[267465.987349] CPU: 3 PID: 26928 Comm: apache2 Not tainted 3.17.0.mptcp #110\r\n[267465.991906] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014\r\n[267465.991906] task: ffff88002f2e2000 ti: ffff88003b5d0000 task.ti: ffff88003b5d0000\r\n[267465.991906] RIP: 0010:[<ffffffff8166305c>]  [<ffffffff8166305c>] tcp_validate_incoming+0x35c/0x3b0\r\n[267465.991906] RSP: 0018:ffff88003b5d3c18  EFLAGS: 00010202\r\n[267465.991906] RAX: 0000000000000000 RBX: ffff88003c9cbd80 RCX: 0000000000000000\r\n[267465.991906] RDX: 0000000000000000 RSI: ffff88002f2e26f0 RDI: 0000000000000286\r\n[267465.991906] RBP: ffff88003b5d3c48 R08: 0000000000000000 R09: 0000000000000000\r\n[267465.991906] R10: 0000000000000002 R11: 0000000000000000 R12: ffff88003c160c00\r\n[267465.991906] R13: ffff88002f6b3462 R14: 0000000000000000 R15: ffff88003c160c28\r\n[267465.991906] FS:  00007fd6f10c0700(0000) GS:ffff88003fd80000(0000) knlGS:0000000000000000\r\n[267465.991906] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\r\n[267465.991906] CR2: 0000000000000019 CR3: 000000002ee47000 CR4: 00000000000006e0\r\n[267465.991906] Stack:\r\n[267465.991906]  0000000000000002 ffff88003c9cbd80 ffff88003c160c00 ffff88002f6b3462\r\n[267465.991906]  0000000000000000 ffff88002ec9e988 ffff88003b5d3c98 ffffffff816641c8\r\n[267465.991906]  ffff88003b5d3c78 ffff88003c160600 ffff88003e001700 ffff88003c160c00\r\n[267465.991906] Call Trace:\r\n[267465.991906]  [<ffffffff816641c8>] tcp_rcv_state_process+0x208/0x910\r\n[267465.991906]  [<ffffffff8166ebf3>] tcp_v4_do_rcv+0xe3/0x2a0\r\n[267465.991906]  [<ffffffff81703a10>] ? mptcp_backlog_rcv+0xa0/0xb0\r\n[267465.991906]  [<ffffffff816f12fd>] tcp_v6_do_rcv+0x1dd/0x420\r\n[267465.991906]  [<ffffffff817039bb>] mptcp_backlog_rcv+0x4b/0xb0\r\n[267465.991906]  [<ffffffff815e87a2>] release_sock+0x92/0x1f0\r\n[267465.991906]  [<ffffffff81705645>] mptcp_close+0x1f5/0x5c0\r\n[267465.991906]  [<ffffffff816576fd>] tcp_close+0x2ed/0x4a0\r\n[267465.991906]  [<ffffffff81685b4e>] inet_release+0xae/0xf0\r\n[267465.991906]  [<ffffffff81685ac9>] ? inet_release+0x29/0xf0\r\n[267465.991906]  [<ffffffff816c2d0f>] inet6_release+0x3f/0x50\r\n[267465.991906]  [<ffffffff815e1349>] sock_release+0x29/0xa0\r\n[267465.991906]  [<ffffffff815e1542>] sock_close+0x12/0x20\r\n[267465.991906]  [<ffffffff811a4678>] __fput+0xc8/0x210\r\n[267465.991906]  [<ffffffff811a486e>] ____fput+0xe/0x10\r\n[267465.991906]  [<ffffffff8108a70d>] task_work_run+0xad/0xe0\r\n[267465.991906]  [<ffffffff81014f45>] do_notify_resume+0x75/0x80\r\n[267465.991906]  [<ffffffff813770de>] ? trace_hardirqs_on_thunk+0x3a/0x3f\r\n[267465.991906]  [<ffffffff817317e2>] int_signal+0x12/0x17\r\n[267465.991906] Code: 8b cc 07 00 00 c1 e0 0a f7 f6 39 c1 0f 87 4c ff ff ff e9 12 fe ff ff f6 83 58 09 00 00 01 0f 84 9f fd ff ff 48 8b 83 60 09 00 00 <0f> b6 50 19 80 60 18 8f 83 e2 80 88 50 19 e9 85 fd ff ff 3b b3\r\n[267465.991906] RIP  [<ffffffff8166305c>] tcp_validate_incoming+0x35c/0x3b0\r\n[267465.991906]  RSP <ffff88003b5d3c18>\r\n[267465.991906] CR2: 0000000000000019\r\n[267465.991906] ---[ end trace dca7bd246b046643 ]---\r\n[267465.991906] Kernel panic - not syncing: Fatal exception in interrupt\r\n[267465.991906] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)\r\n[267465.991906] ---[ end Kernel panic - not syncing: Fatal exception in interrupt\r\n```"},"comment":{"url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/comments/130100767","html_url":"https://github.com/multipath-tcp/mptcp/issues/71#issuecomment-130100767","issue_url":"https://api.github.com/repos/multipath-tcp/mptcp/issues/71","id":130100767,"user":{"login":"cpaasch","id":116300,"avatar_url":"https://avatars.githubusercontent.com/u/116300?v=3","gravatar_id":"","url":"https://api.github.com/users/cpaasch","html_url":"https://github.com/cpaasch","followers_url":"https://api.github.com/users/cpaasch/followers","following_url":"https://api.github.com/users/cpaasch/following{/other_user}","gists_url":"https://api.github.com/users/cpaasch/gists{/gist_id}","starred_url":"https://api.github.com/users/cpaasch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpaasch/subscriptions","organizations_url":"https://api.github.com/users/cpaasch/orgs","repos_url":"https://api.github.com/users/cpaasch/repos","events_url":"https://api.github.com/users/cpaasch/events{/privacy}","received_events_url":"https://api.github.com/users/cpaasch/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T22:44:39Z","updated_at":"2015-08-11T22:44:39Z","body":"Are you sure that it happened in mptcp_handle_options() ?\r\n\r\nBecause, I am suspecting that something might go wrong when processing a RST (which would result in the socket being removed) while processing segments from the backlog queue.\r\n\r\nMaybe you still have the crash-trace?"}}