From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Lin Ming <mlin@ss.pku.edu.cn>,
Julian Anastasov <ja@ssi.bg>, Simon Horman <horms@verge.net.au>,
Pablo Neira Ayuso <pablo@netfilter.org>,
David Miller <davem@davemloft.net>
Subject: [ 24/37] ipvs: fix oops on NAT reply in br_nf context
Date: Thu, 18 Oct 2012 20:16:47 -0700 [thread overview]
Message-ID: <20121019031306.738219149@linuxfoundation.org> (raw)
In-Reply-To: <20121019031302.789593147@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ming <mlin@ss.pku.edu.cn>
commit 9e33ce453f8ac8452649802bee1f410319408f4b upstream.
IPVS should not reset skb->nf_bridge in FORWARD hook
by calling nf_reset for NAT replies. It triggers oops in
br_nf_forward_finish.
[ 579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[ 579.781669] IP: [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.781792] PGD 218f9067 PUD 0
[ 579.781865] Oops: 0000 [#1] SMP
[ 579.781945] CPU 0
[ 579.781983] Modules linked in:
[ 579.782047]
[ 579.782080]
[ 579.782114] Pid: 4644, comm: qemu Tainted: G W 3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard /30E8
[ 579.782300] RIP: 0010:[<ffffffff817b1ca5>] [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.782455] RSP: 0018:ffff88007b003a98 EFLAGS: 00010287
[ 579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a
[ 579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00
[ 579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90
[ 579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02
[ 579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000
[ 579.783177] FS: 0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70
[ 579.783306] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b
[ 579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0
[ 579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)
[ 579.783919] Stack:
[ 579.783959] ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00
[ 579.784110] ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7
[ 579.784260] ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0
[ 579.784477] Call Trace:
[ 579.784523] <IRQ>
[ 579.784562]
[ 579.784603] [<ffffffff817b26c7>] br_nf_forward_ip+0x275/0x2c8
[ 579.784707] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.784797] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.784906] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.784995] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.785175] [<ffffffff8187fa95>] ? _raw_write_unlock_bh+0x19/0x1b
[ 579.785179] [<ffffffff817ac417>] __br_forward+0x97/0xa2
[ 579.785179] [<ffffffff817ad366>] br_handle_frame_finish+0x1a6/0x257
[ 579.785179] [<ffffffff817b2386>] br_nf_pre_routing_finish+0x26d/0x2cb
[ 579.785179] [<ffffffff817b2cf0>] br_nf_pre_routing+0x55d/0x5c1
[ 579.785179] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81551525>] ? sky2_poll+0xb35/0xb54
[ 579.785179] [<ffffffff817ad62a>] br_handle_frame+0x213/0x229
[ 579.785179] [<ffffffff817ad417>] ? br_handle_frame_finish+0x257/0x257
[ 579.785179] [<ffffffff816e3b47>] __netif_receive_skb+0x2b4/0x3f1
[ 579.785179] [<ffffffff816e69fc>] process_backlog+0x99/0x1e2
[ 579.785179] [<ffffffff816e6800>] net_rx_action+0xdf/0x242
[ 579.785179] [<ffffffff8107e8a8>] __do_softirq+0xc1/0x1e0
[ 579.785179] [<ffffffff8135a5ba>] ? trace_hardirqs_off_thunk+0x3a/0x6c
[ 579.785179] [<ffffffff8188812c>] call_softirq+0x1c/0x30
The steps to reproduce as follow,
1. On Host1, setup brige br0(192.168.1.106)
2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd
3. Start IPVS service on Host1
ipvsadm -A -t 192.168.1.106:80 -s rr
ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m
4. Run apache benchmark on Host2(192.168.1.101)
ab -n 1000 http://192.168.1.106/
ip_vs_reply4
ip_vs_out
handle_response
ip_vs_notrack
nf_reset()
{
skb->nf_bridge = NULL;
}
Actually, IPVS wants in this case just to replace nfct
with untracked version. So replace the nf_reset(skb) call
in ip_vs_notrack() with a nf_conntrack_put(skb->nfct) call.
Signed-off-by: Lin Ming <mlin@ss.pku.edu.cn>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ip_vs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1361,7 +1361,7 @@ static inline void ip_vs_notrack(struct
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
if (!ct || !nf_ct_is_untracked(ct)) {
- nf_reset(skb);
+ nf_conntrack_put(skb->nfct);
skb->nfct = &nf_ct_untracked_get()->ct_general;
skb->nfctinfo = IP_CT_NEW;
nf_conntrack_get(skb->nfct);
next prev parent reply other threads:[~2012-10-19 3:22 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-19 3:16 [ 00/37] 3.0.47-stable review Greg Kroah-Hartman
2012-10-19 3:16 ` [ 01/37] ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels Greg Kroah-Hartman
2012-10-19 3:16 ` [ 02/37] lockd: use rpc clients cl_nodename for id encoding Greg Kroah-Hartman
2012-10-19 23:15 ` Ben Hutchings
2012-10-21 16:26 ` Greg Kroah-Hartman
2012-10-22 17:02 ` Myklebust, Trond
2012-10-23 1:36 ` Ben Hutchings
2012-10-24 15:44 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 03/37] ACPI: EC: Make the GPE storm threshold a module parameter Greg Kroah-Hartman
2012-10-19 3:16 ` [ 04/37] ACPI: EC: Add a quirk for CLEVO M720T/M730T laptop Greg Kroah-Hartman
2012-10-19 3:16 ` [ 05/37] mips,kgdb: fix recursive page fault with CONFIG_KPROBES Greg Kroah-Hartman
2012-10-19 3:16 ` [ 06/37] tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking Greg Kroah-Hartman
2012-10-19 3:16 ` [ 07/37] ARM: 7541/1: Add ARM ERRATA 775420 workaround Greg Kroah-Hartman
2012-10-19 3:16 ` [ 08/37] firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel) Greg Kroah-Hartman
2012-10-19 3:16 ` [ 09/37] SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT Greg Kroah-Hartman
2012-10-19 3:16 ` [ 10/37] xen/bootup: allow {read|write}_cr8 pvops call Greg Kroah-Hartman
2012-10-19 3:16 ` [ 11/37] xen/bootup: allow read_tscp call for Xen PV guests Greg Kroah-Hartman
2012-10-19 3:16 ` [ 12/37] block: fix request_queue->flags initialization Greg Kroah-Hartman
2012-10-19 23:16 ` Ben Hutchings
2012-10-21 16:25 ` Greg Kroah-Hartman
2012-10-21 18:56 ` Tejun Heo
2012-10-22 15:36 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 13/37] autofs4 - fix reset pending flag on mount fail Greg Kroah-Hartman
2012-10-19 3:16 ` [ 14/37] module: taint kernel when lve module is loaded Greg Kroah-Hartman
2012-10-19 3:16 ` [ 15/37] video/udlfb: fix line counting in fb_write Greg Kroah-Hartman
2012-10-19 3:16 ` [ 16/37] viafb: dont touch clock state on OLPC XO-1.5 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 17/37] timers: Fix endless looping between cascade() and internal_add_timer() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 18/37] pktgen: fix crash when generating IPv6 packets Greg Kroah-Hartman
2012-10-19 3:16 ` [ 19/37] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 20/37] ipvs: fix oops in ip_vs_dst_event on rmmod Greg Kroah-Hartman
2012-10-19 3:16 ` [ 21/37] netfilter: nf_conntrack: fix racy timer handling with reliable events Greg Kroah-Hartman
2012-10-19 3:16 ` [ 22/37] netfilter: nf_ct_ipv4: packets with wrong ihl are invalid Greg Kroah-Hartman
2012-10-19 3:16 ` [ 23/37] netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation Greg Kroah-Hartman
2012-10-19 3:16 ` Greg Kroah-Hartman [this message]
2012-10-19 3:16 ` [ 25/37] netfilter: nf_nat_sip: fix via header translation with multiple parameters Greg Kroah-Hartman
2012-10-19 3:16 ` [ 26/37] netfilter: nf_ct_expect: fix possible access to uninitialized timer Greg Kroah-Hartman
2012-10-19 3:16 ` [ 27/37] netfilter: limit, hashlimit: avoid duplicated inline Greg Kroah-Hartman
2012-10-19 3:16 ` [ 28/37] netfilter: xt_limit: have r->cost != 0 case work Greg Kroah-Hartman
2012-10-19 3:16 ` [ 29/37] Add CDC-ACM support for the CX93010-2x UCMxx USB Modem Greg Kroah-Hartman
2012-10-19 3:16 ` [ 30/37] drm/radeon: Dont destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 31/37] jbd: Fix assertion failure in commit code due to lacking transaction credits Greg Kroah-Hartman
2012-10-19 3:16 ` [ 32/37] x86, random: Architectural inlines to get random integers with RDRAND Greg Kroah-Hartman
2012-10-19 3:16 ` [ 33/37] x86, random: Verify RDRAND functionality and allow it to be disabled Greg Kroah-Hartman
2012-10-19 3:16 ` [ 34/37] tpm: Propagate error from tpm_transmit to fix a timeout hang Greg Kroah-Hartman
2012-10-19 3:16 ` [ 35/37] udf: fix retun value on error path in udf_load_logicalvol Greg Kroah-Hartman
2012-10-19 3:16 ` [ 36/37] ALSA: ac97 - Fix missing NULL check in snd_ac97_cvol_new() Greg Kroah-Hartman
2012-10-19 3:17 ` [ 37/37] ALSA: emu10k1: add chip details for E-mu 1010 PCIe card Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121019031306.738219149@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@davemloft.net \
--cc=horms@verge.net.au \
--cc=ja@ssi.bg \
--cc=linux-kernel@vger.kernel.org \
--cc=mlin@ss.pku.edu.cn \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.