[Click] Weird click kernelcrash related to handlers

Douglas S. J. De Couto decouto at lcs.mit.edu
Tue Mar 2 14:26:12 EST 2004


When I load the following two configurations into kernel click, one
after the other, I get a kernel crash in register_handler()
(linuxmodule/proc_click.cc)

conf #1:

 FromDevice(eth2) -> Idle


conf #2:

  src :: InfiniteSource(DATASIZE 148, ACTIVE false)
   -> IncrementSeqNo
   -> EtherEncap(0x7ff1, 00:40:96:34:91:06, 00:40:96:42:20:81) // src, dst
   -> tr :: TimeRange  
   -> c1 :: Counter
   -> ToDevice(eth2);



I was unable to simplify conf #2, if I left out any of the elements,
the crash went away.

The crash occurs because register_handler() tries to register a
handler with a bad name string.  That is, h->name() returns a String
with a length of 5, but all of whose chars are 0.  This causes the
call to create_proc_entry() to return 0 (since the C-string name is an
empty string), and register_handler then derefs the null pointer.

I can't figure out why the handler name is wacko.  It always seems to
be a 5 character name, all 5 chars are 0, and it happens in sequence
when the `ports' handler should be registered.

Anyway, I made a hack to not actually crash and just bail out of
register_handler() when a bogus name string is encountered, avoiding
the crash, but raising questions.

I believe the following facts are true:

- reboot, load conf 1 (cat conf1 > /proc/click/config), load conf2,
  get crash/bogus name

- reboot, load conf 1, load conf 2, get bogus name, load conf 2
  (again), no bug & all is OK

- reboot, load conf 1, echo Idle > /proc/click/config, load conf2, no
  bug & all is OK

help!

-- 
Douglas S. J. De Couto    decouto at csail.mit.edu



More information about the click mailing list