Oops cause by null pointer in br_nf_pre_routing_finish

Hi,
I was wondering if anyone has fased this problem or have an explanation.
I am using kernel 2.4.20 patched with ebtables 2.0.6 and iptables 1.2.9
The system seem to be pretty stable. However once every few days it reboots.
From debuging with prints I located the problem in br_nf_pre_routing_finish.
For some odd reason the skb->nf_bridge is NULL when getting to this 
function. Since there is no protection from this case the system crashes 
when trying to use fields in skb->nf_bridge (Ex. mask).
Is this a bug? (see Oops below)
I also could print some packet fields when the problem happened. It was 
allways the same packet(see below).

Thanks
Maya

protocol = udp
source address : ip = 212.179.112.29  port = 3013
dest address : ip = 172.16.32.186  port = 2002
packet length 1601
Tos = 0 ;
Id = 9310 /669
Fragg of = 0
TTL = 117



ops: 0000
CPU:    0
EIP:    0010:[<60bf7087>]    Tainted: P
EFLAGS: 00010202
eax: 5f68ca60   ebx: 5f68ca60   ecx: 403a3d08   edx: 00000001
esi: 00000000   edi: 5a7ce030   ebp: 5ce3280c   esp: 5b4a5dc8
ds: 0018   es: 0018   ss: 0018
Process stat_server (pid: 1420, stackpage=5b4a5000)
Stack: 00000000 5b4a5e60 00000000 00000003 5b4c473c 00000002 5b4a5e40 
80000000
       40449c20 60bf7070 4026e906 00000000 5b4a5e60 5ce3280c 00000000 
60bf7070
       00000000 00000000 00000000 60bf7070 4026ed5f 5f68ca60 5b4a5e60 
00000000
Call Trace:    [<60bf7070>] [<4026e906>] [<60bf7070>] [<60bf7070>] 
[<4026ed5f>]
  [<60bf7070>] [<60bf4210>] [<60bf756c>] [<60bf7070>] [<4026e906>] 
[<60bf4210>]
  [<60bf4210>] [<4026ecf8>] [<60bf4210>] [<60bfa0c0>] [<60bf4509>] 
[<60bf4210>]
  [<40267505>] [<402676d2>] [<40267827>] [<4011fa39>] [<40109399>] 
[<4010bed8>]

Code: 8b 46 10 a9 01 00 00 00 74 0d c6 43 6a 03 8b 46 10 83 f0 01
<0>Kernel panic: Aiee, killing interrupt handler!
In interrupt handler - not syncing
CPU:    0
EIP:    0010:[<60bf7087>]    Tainted: P
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010202
eax: 5ce7a3c0   ebx: 5ce7a3c0   ecx: 403a3d08   edx: 00000001
esi: 00000000   edi: 5fbd2030   ebp: 5f30080c   esp: 40353da4
ds: 0018   es: 0018   ss: 0018
Process swapper (pid: 0, stackpage=40353000)
Stack: 00000000 40353e3c 00000000 00000003 5b4c45fc 00000002 40353e1c 
80000000
       40449c20 60bf7070 4026e906 00000000 40353e3c 5f30080c 00000000 
60bf7070
       00000000 00000000 00000000 60bf7070 4026ed5f 5ce7a3c0 40353e3c 
00000000
Call Trace:    [<60bf7070>] [<4026e906>] [<60bf7070>] [<60bf7070>] 
[<4026ed5f>]
  [<60bf7070>] [<60bf4210>] [<60bf756c>] [<60bf7070>] [<4026e906>] 
[<60bf4210>]
  [<60bf4210>] [<4026ecf8>] [<60bf4210>] [<60bfa0c0>] [<60bf4509>] 
[<60bf4210>]
  [<40267505>] [<402676d2>] [<40267827>] [<4011fa39>] [<40109399>] 
[<401053e0>]
  [<4010bed8>] [<401053e0>] [<4010540c>] [<401054a2>] [<40105000>]
Code: 8b 46 10 a9 01 00 00 00 74 0d c6 43 6a 03 8b 46 10 83 f0 01

>>EIP; 60bf7087 <[bridge]br_nf_pre_routing_finish+17/2a0>   <=====
Trace; 60bf7070 <[bridge]br_nf_pre_routing_finish+0/2a0>
Trace; 4026e906 <nf_iterate+76/b0>
Trace; 60bf7070 <[bridge]br_nf_pre_routing_finish+0/2a0>
Trace; 60bf7070 <[bridge]br_nf_pre_routing_finish+0/2a0>
Trace; 4026ed5f <nf_hook_slow+10f/1e0>
Trace; 60bf7070 <[bridge]br_nf_pre_routing_finish+0/2a0>
Trace; 60bf4210 <[bridge]br_handle_frame_finish+0/180>
Trace; 60bf756c <[bridge]br_nf_pre_routing+25c/360>
Trace; 60bf7070 <[bridge]br_nf_pre_routing_finish+0/2a0>
Trace; 4026e906 <nf_iterate+76/b0>
Trace; 60bf4210 <[bridge]br_handle_frame_finish+0/180>
Trace; 60bf4210 <[bridge]br_handle_frame_finish+0/180>
Trace; 4026ecf8 <nf_hook_slow+a8/1e0>
Trace; 60bf4210 <[bridge]br_handle_frame_finish+0/180>
Trace; 60bfa0c0 <[bridge]br_nf_ops+0/d7>
Trace; 60bf4509 <[bridge]br_handle_frame+179/1df>
Trace; 60bf4210 <[bridge]br_handle_frame_finish+0/180>
Trace; 40267505 <netif_receive_skb+c5/210>
Trace; 402676d2 <process_backlog+82/130>
Trace; 40267827 <net_rx_action+a7/160>
Trace; 4011fa39 <do_softirq+d9/e0>
Trace; 40109399 <do_IRQ+e9/f0>
Trace; 401053e0 <default_idle+0/50>
Trace; 4010bed8 <call_do_IRQ+5/d>
Trace; 401053e0 <default_idle+0/50>
Trace; 4010540c <default_idle+2c/50>
Trace; 401054a2 <cpu_idle+52/70>
Trace; 40105000 <_stext+0/0>
Code;  60bf7087 <[bridge]br_nf_pre_routing_finish+17/2a0>
00000000 <_EIP>:
Code;  60bf7087 <[bridge]br_nf_pre_routing_finish+17/2a0>   <=====
   0:   8b 46 10                  mov    0x10(%esi),%eax   <=====
Code;  60bf708a <[bridge]br_nf_pre_routing_finish+1a/2a0>
   3:   a9 01 00 00 00            test   $0x1,%eax
Code;  60bf708f <[bridge]br_nf_pre_routing_finish+1f/2a0>
   8:   74 0d                     je     17 <_EIP+0x17>
Code;  60bf7091 <[bridge]br_nf_pre_routing_finish+21/2a0>
   a:   c6 43 6a 03               movb   $0x3,0x6a(%ebx)
Code;  60bf7095 <[bridge]br_nf_pre_routing_finish+25/2a0>
   e:   8b 46 10                  mov    0x10(%esi),%eax
Code;  60bf7098 <[bridge]br_nf_pre_routing_finish+28/2a0>
  11:   83 f0 01                  xor    $0x1,%eax

<0>Kernel panic: Aiee, killing interrupt handler!

9 warnings issued.  Results may not be reliable.

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar - get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/



-------------------------------------------------------
This SF.net email is sponsored by: 2005 Windows Mobile Application Contest
Submit applications for Windows Mobile(tm)-based Pocket PCs or Smartphones
for the chance to win $25,000 and application distribution. Enter today at
http://ads.osdn.com/?ad_id=6882&alloc_id=15148&op=click