Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Kernel NULL pointer dereference in target_put() during target deletion

Open
  • Is something wrong?
#2,190 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
c, linux
Domain
backend, operating-systems

Research direction

Start by reading target_put() and table_del_target(), then trace how deletion reaches them through proc_control_read_write() and how target output initialization is handled. The report has no deterministic reproducer, so first investigate the incomplete or failed initialization path described in the issue. Done means deleting a target on that path no longer causes a NULL pointer dereference.

Written by the indexing model from the issue text.

Description

bug
rtpengine version the issue has been seen with

26.3.0.0+0~mr26.3.0.0-1.el10

Used distribution and its version

Oracle Linux Server 10.1, x86_64

Linux kernel version used

6.12.0-206.104.4.4.el10uek.x86_64

CPU architecture issue was seen on (see uname -m)

x86_64

Expected behaviour you didn't see

Deleting a kernel forwarding target should safely release its resources without causing a kernel Oops, including when output initialization is incomplete or has failed.

Unexpected behaviour you saw

The VM experienced a kernel NULL pointer dereference inside target_put() in nft_rtpengine.

The call trace shows that this occurred in task context, while a thread named poller was writing to the module's proc control interface. The path goes through proc_control_read_write() and table_del_target(), rather than the incoming packet-processing path.

Kdump captured a vmcore. The VM subsequently rebooted.

Steps to reproduce the problem

We do not yet have a deterministic reproducer or an identified triggering call/packet.

Additional program output to the terminal or logs illustrating the issue
BUG: kernel NULL pointer dereference, address: 000000000000008c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: Oops: 0002 [#1] PREEMPT SMP PTI

CPU: 2 UID: 986 PID: 69974 Comm: poller Kdump: loaded
Tainted: G           OE
6.12.0-206.104.4.4.el10uek.x86_64 #2

RIP: 0010:target_put.part.0+0xbe/0x110 [nft_rtpengine]

Code: 50 0d 00 00 48 8b bc 28 00 07 00 00 e8 eb 38 7b d8
48 8b 83 50 0d 00 00 48 8b bc 28 f8 06 00 00 44 89 e8
48 8d 97 8c 00 00 00 <f0> 0f c1 87 8c 00 00 00
83 f8 01 75 83 e8 70 e1 78 d8 eb 84 e8 39

RAX: 00000000ffffffff
RDX: 000000000000008c
RDI: 0000000000000000
CR2: 000000000000008c

Call Trace:
 <TASK>
 table_del_target+0x1ac/0x230 [nft_rtpengine]
 proc_control_read_write+0x5d0/0x767 [nft_rtpengine]
 proc_reg_write+0x5a/0xb0
 vfs_write+0x109/0x450
 ksys_write+0xc1/0xf0
 do_syscall_64+0x90/0x1c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>
Anything else?

No response

Dominant language
Perl
Stars
992
Forks
459
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sipwise/rtpengine

All issues in sipwise/rtpengine

Similar issues

More Perl issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.