Re: [PATCH] Fix hang on netfilter module unload

[Patrick McHardy <kaber@trash.net>]

Phil Oester wrote:
>>So we are leaking conntracks for some reason that we must diagnose.
> 
> 
> No...the app is leaking skbs.  Since the skb never goes away (at least
> until closing the app), the conntrack can thus not go away.  Isn't
> it better for us to work around stupid apps like this?  Seems preferable
> to not hang the box on iptables restart/unload, eh?

I guess by leaking you mean doesn't pull them of the receive queue.
Anyhow, the reference to the conntrack is dropped before packets
are delivered to the protocols, so this can't be the reason. Do
you have a reproducable test-case ?

>>But this is cheating, of course that the module will unload if we set 
>>all refcounts to 1 we won't spin forever in the i_see_dead_people loop 
>>but we are leaking somewhere anyway.
> 
> 
> Well, again, the admin has asked to unload iptables -- should we unload,
> or lockup the box?

Unload - after fixing the leaks :) If we cover it up this way it will
never get fixed properly.

Regards
Patrick