again: conntrack & 2.6.14-git11

again: conntrack & 2.6.14-git11

[Deti Fliegl]

Hi there,

as far as I've seen all fixes for nf_netlink/conntrack are contained in 
2.6.14-git11. I tried calling conntrack within an endless loop while my 
stresstest was running. After app. 30 minutes the kernel crashed. Did I 
miss an important patch from this list? How can I help?

Deti
--
<4>Badness in __kfree_skb at net/core/skbuff.c:334
<4>
<4>Call Trace:<ffffffff802a3747>{__kfree_skb+167} 
<ffffffff802bbf17>{netlink_recvmsg+279}
<4>       <ffffffff8029d25b>{sock_recvmsg+315} 
<ffffffff80320583>{thread_return+0}
<4>       <ffffffff8015f2f3>{buffered_rmqueue+675} 
<ffffffff8012e245>{activate_task+149}
<4>       <ffffffff8012e69b>{try_to_wake_up+1083} 
<ffffffff80149210>{autoremove_wake_function+0}
<4>       <ffffffff8029eabb>{sys_recvmsg+395} 
<ffffffff8018c5d7>{pipe_writev+1319}
<4>       <ffffffff80320583>{thread_return+0} 
<ffffffff8017f4c8>{vfs_write+344}
<4>       <ffffffff8017f603>{sys_write+83} 
<ffffffff8010dc4e>{system_call+126}

Re: again: conntrack & 2.6.14-git11

[Pablo Neira]

[-- Attachment #1: Type: text/plain, Size: 465 bytes --]

Deti Fliegl wrote:
> as far as I've seen all fixes for nf_netlink/conntrack are contained in
> 2.6.14-git11. I tried calling conntrack within an endless loop while my
> stresstest was running. After app. 30 minutes the kernel crashed. Did I
> miss an important patch from this list? How can I help?

I don't see the patch that is supposed to fix the problem in that git
snapshot. Please, make sure that the patch attached is applied to your
kernel tree.

-- 
Pablo

[-- Attachment #2: 02-ctnl-refcnt.patch --]
[-- Type: text/plain, Size: 1343 bytes --]

[NETFILTER] refcount leak of proto when ctnetlink dumping tuple

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>

---
commit 3a4486b6419a1f25324bb4280d51f5c77b1117f7
tree 88b1831d06e21417baca01d1632131d96e3be611
parent 61a002f080c6473da94f28314502ff0f15fe3625
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Fri, 04 Nov 2005 14:35:27 +0900
committer Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Fri, 04 Nov 2005 14:35:27 +0900

 net/ipv4/netfilter/ip_conntrack_netlink.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -58,14 +58,17 @@ ctnetlink_dump_tuples_proto(struct sk_bu
 			    const struct ip_conntrack_tuple *tuple)
 {
 	struct ip_conntrack_protocol *proto;
+	int ret = 0;
 
 	NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
 
 	proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
-	if (proto && proto->tuple_to_nfattr)
-		return proto->tuple_to_nfattr(skb, tuple);
+	if (likely(proto && proto->tuple_to_nfattr)) {
+		ret = proto->tuple_to_nfattr(skb, tuple);
+		ip_conntrack_proto_put(proto);
+	}
 
-	return 0;
+	return ret;
 
 nfattr_failure:
 	return -1;

Re: again: conntrack & 2.6.14-git11

[Deti Fliegl]

Pablo Neira wrote:
> I don't see the patch that is supposed to fix the problem in that git
> snapshot. Please, make sure that the patch attached is applied to your
> kernel tree.
Had a defective harddisk on my testsystem and was not able to test 
yesterday. Now I tried git13 which incorporates this patch but still got 
an oops. Not sure, if this is related to netlink/conntrack.

wget[4709]: segfault at 00002aab1313321d rip 00002aaaab21ba6f rsp 
00007fffffb61510 error 4
ACCEPT IN=mgmt OUT= MAC=00:04:23:b7:70:7c:00:d0:03:49:58:00:08:00 
SRC=10.156.10.105 DST=XX LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=2630 
PROTO=ICMP TYPE=0 CODE=0
  ID=55676 SEQ=1
Badness in __kfree_skb at net/core/skbuff.c:334

Call Trace:<ffffffff80271ab7>{__kfree_skb+165} 
<ffffffff80287fb5>{netlink_recvmsg+259}
        <ffffffff8026c14d>{sock_recvmsg+284} 
<ffffffff802e20eb>{thread_return+0}
        <ffffffff80151ca7>{file_read_actor+0} 
<ffffffff80143021>{autoremove_wake_function+0}
        <ffffffff8026d648>{sys_recvmsg+357} 
<ffffffff80143021>{autoremove_wake_function+0}
        <ffffffff8017c6d6>{pipe_writev+1293} 
<ffffffff80170cbe>{vfs_write+326}
        <ffffffff80170db2>{sys_write+69} <ffffffff8010d94e>{system_call+126}

Badness in __kfree_skb at net/core/skbuff.c:334

Call Trace:<ffffffff80271ab7>{__kfree_skb+165} 
<ffffffff80287fb5>{netlink_recvmsg+259}
        <ffffffff8026c14d>{sock_recvmsg+284} 
<ffffffff802e20eb>{thread_return+0}
        <ffffffff80151ca7>{file_read_actor+0} 
<ffffffff80143021>{autoremove_wake_function+0}
        <ffffffff8026d648>{sys_recvmsg+357} 
<ffffffff8017c6d6>{pipe_writev+1293}
        <ffffffff80170cbe>{vfs_write+326} <ffffffff80170db2>{sys_write+69}
        <ffffffff8010d94e>{system_call+126}
scheduling while atomic: conntrack/0xffffff00/15404

Call Trace:<ffffffff802e12af>{schedule+126} 
<ffffffff80170cbe>{vfs_write+326}
        <ffffffff80170db2>{sys_write+69} 
<ffffffff8010d9b8>{sysret_careful+13}

Further tried the refcount patch with 2.6.14 (no git version) without 
success (oops).