Re: [PATCH nf] netfilter: conntrack: resched in nf_ct_iterate_cleanup

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Dec 11, 2015 at 03:43:13PM +0100, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
> > Ulrich reports soft lockup with following (shortened) callchain:
> > 
> > NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s!
> > __netif_receive_skb_core+0x6e4/0x774
> > process_backlog+0x94/0x160
> > net_rx_action+0x88/0x178
> > call_do_softirq+0x24/0x3c
> > do_softirq+0x54/0x6c
> > __local_bh_enable_ip+0x7c/0xbc
> > nf_ct_iterate_cleanup+0x11c/0x22c [nf_conntrack]
> > masq_inet_event+0x20/0x30 [nf_nat_masquerade_ipv6]
> > atomic_notifier_call_chain+0x1c/0x2c
> > ipv6_del_addr+0x1bc/0x220 [ipv6]
> > 
> > Problem is that nf_ct_iterate_cleanup can run for a very long time
> > since it can be interrupted by softirq processing.
> > Moreover, atomic_notifier_call_chain runs with rcu readlock held.
> 
> Ulrich just reported another softlockup even with this patch applied.
> 
> One explanation would be non-matching iter(), in this case
> get_next_corpse can take forever since it will walk the entire conntrack
> table, rendering the cond_resched moot.

Probably another reincarnation of 0838aa7fcfcd? Is Ulrich using
conntrack templates?

> A V2 patch will be coming to also add a lock break + resched to
> get_next_corpse.

BTW, the atomic chain notifier in IPv6 seems to be there to handle
this update from the packet path:

 ndisc_rcv()
 ndisc_router_discovery()
 addrconf_prefix_rcv()
 manage_tempaddrs()
 ipv6_add_addr()
 inet6addr_notifier_call_chain()

Probably we can get Hannes have a look into this, I think we can
convert this chain to blocking one through workqueue since
addrconf_prefix_rcv() returns void. The remaining call sites of
inet6addr_notifier_call_chain() that I could tracked come from paths
where I can see ASSERT_RTNL(), so user context is guaranteed.

I'm telling this become I remember that we discussed in netconf'14
Chicago that it would be good to get rid of this kind og asymmetries
between IPv4 and IPv6.