From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Lin Ming <mlin@ss.pku.edu.cn>,
Julian Anastasov <ja@ssi.bg>, Simon Horman <horms@verge.net.au>,
Pablo Neira Ayuso <pablo@netfilter.org>,
David Miller <davem@davemloft.net>
Subject: [ 24/37] ipvs: fix oops on NAT reply in br_nf context
Date: Thu, 18 Oct 2012 20:16:47 -0700 [thread overview]
Message-ID: <20121019031306.738219149@linuxfoundation.org> (raw)
In-Reply-To: <20121019031302.789593147@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ming <mlin@ss.pku.edu.cn>
commit 9e33ce453f8ac8452649802bee1f410319408f4b upstream.
IPVS should not reset skb->nf_bridge in FORWARD hook
by calling nf_reset for NAT replies. It triggers oops in
br_nf_forward_finish.
[ 579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[ 579.781669] IP: [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.781792] PGD 218f9067 PUD 0
[ 579.781865] Oops: 0000 [#1] SMP
[ 579.781945] CPU 0
[ 579.781983] Modules linked in:
[ 579.782047]
[ 579.782080]
[ 579.782114] Pid: 4644, comm: qemu Tainted: G W 3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard /30E8
[ 579.782300] RIP: 0010:[<ffffffff817b1ca5>] [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.782455] RSP: 0018:ffff88007b003a98 EFLAGS: 00010287
[ 579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a
[ 579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00
[ 579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90
[ 579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02
[ 579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000
[ 579.783177] FS: 0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70
[ 579.783306] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b
[ 579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0
[ 579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)
[ 579.783919] Stack:
[ 579.783959] ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00
[ 579.784110] ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7
[ 579.784260] ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0
[ 579.784477] Call Trace:
[ 579.784523] <IRQ>
[ 579.784562]
[ 579.784603] [<ffffffff817b26c7>] br_nf_forward_ip+0x275/0x2c8
[ 579.784707] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.784797] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.784906] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.784995] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.785175] [<ffffffff8187fa95>] ? _raw_write_unlock_bh+0x19/0x1b
[ 579.785179] [<ffffffff817ac417>] __br_forward+0x97/0xa2
[ 579.785179] [<ffffffff817ad366>] br_handle_frame_finish+0x1a6/0x257
[ 579.785179] [<ffffffff817b2386>] br_nf_pre_routing_finish+0x26d/0x2cb
[ 579.785179] [<ffffffff817b2cf0>] br_nf_pre_routing+0x55d/0x5c1
[ 579.785179] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81551525>] ? sky2_poll+0xb35/0xb54
[ 579.785179] [<ffffffff817ad62a>] br_handle_frame+0x213/0x229
[ 579.785179] [<ffffffff817ad417>] ? br_handle_frame_finish+0x257/0x257
[ 579.785179] [<ffffffff816e3b47>] __netif_receive_skb+0x2b4/0x3f1
[ 579.785179] [<ffffffff816e69fc>] process_backlog+0x99/0x1e2
[ 579.785179] [<ffffffff816e6800>] net_rx_action+0xdf/0x242
[ 579.785179] [<ffffffff8107e8a8>] __do_softirq+0xc1/0x1e0
[ 579.785179] [<ffffffff8135a5ba>] ? trace_hardirqs_off_thunk+0x3a/0x6c
[ 579.785179] [<ffffffff8188812c>] call_softirq+0x1c/0x30
The steps to reproduce as follow,
1. On Host1, setup brige br0(192.168.1.106)
2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd
3. Start IPVS service on Host1
ipvsadm -A -t 192.168.1.106:80 -s rr
ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m
4. Run apache benchmark on Host2(192.168.1.101)
ab -n 1000 http://192.168.1.106/
ip_vs_reply4
ip_vs_out
handle_response
ip_vs_notrack
nf_reset()
{
skb->nf_bridge = NULL;
}
Actually, IPVS wants in this case just to replace nfct
with untracked version. So replace the nf_reset(skb) call
in ip_vs_notrack() with a nf_conntrack_put(skb->nfct) call.
Signed-off-by: Lin Ming <mlin@ss.pku.edu.cn>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ip_vs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1361,7 +1361,7 @@ static inline void ip_vs_notrack(struct
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
if (!ct || !nf_ct_is_untracked(ct)) {
- nf_reset(skb);
+ nf_conntrack_put(skb->nfct);
skb->nfct = &nf_ct_untracked_get()->ct_general;
skb->nfctinfo = IP_CT_NEW;
nf_conntrack_get(skb->nfct);
next prev parent reply other threads:[~2012-10-19 3:22 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-19 3:16 [ 00/37] 3.0.47-stable review Greg Kroah-Hartman
2012-10-19 3:16 ` [ 01/37] ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels Greg Kroah-Hartman
2012-10-19 3:16 ` [ 02/37] lockd: use rpc clients cl_nodename for id encoding Greg Kroah-Hartman
2012-10-19 23:15 ` Ben Hutchings
2012-10-21 16:26 ` Greg Kroah-Hartman
2012-10-22 17:02 ` Myklebust, Trond
2012-10-23 1:36 ` Ben Hutchings
2012-10-24 15:44 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 03/37] ACPI: EC: Make the GPE storm threshold a module parameter Greg Kroah-Hartman
2012-10-19 3:16 ` [ 04/37] ACPI: EC: Add a quirk for CLEVO M720T/M730T laptop Greg Kroah-Hartman
2012-10-19 3:16 ` [ 05/37] mips,kgdb: fix recursive page fault with CONFIG_KPROBES Greg Kroah-Hartman
2012-10-19 3:16 ` [ 06/37] tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking Greg Kroah-Hartman
2012-10-19 3:16 ` [ 07/37] ARM: 7541/1: Add ARM ERRATA 775420 workaround Greg Kroah-Hartman
2012-10-19 3:16 ` [ 08/37] firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel) Greg Kroah-Hartman
2012-10-19 3:16 ` [ 09/37] SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT Greg Kroah-Hartman
2012-10-19 3:16 ` [ 10/37] xen/bootup: allow {read|write}_cr8 pvops call Greg Kroah-Hartman
2012-10-19 3:16 ` [ 11/37] xen/bootup: allow read_tscp call for Xen PV guests Greg Kroah-Hartman
2012-10-19 3:16 ` [ 12/37] block: fix request_queue->flags initialization Greg Kroah-Hartman
2012-10-19 23:16 ` Ben Hutchings
2012-10-21 16:25 ` Greg Kroah-Hartman
2012-10-21 18:56 ` Tejun Heo
2012-10-22 15:36 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 13/37] autofs4 - fix reset pending flag on mount fail Greg Kroah-Hartman
2012-10-19 3:16 ` [ 14/37] module: taint kernel when lve module is loaded Greg Kroah-Hartman
2012-10-19 3:16 ` [ 15/37] video/udlfb: fix line counting in fb_write Greg Kroah-Hartman
2012-10-19 3:16 ` [ 16/37] viafb: dont touch clock state on OLPC XO-1.5 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 17/37] timers: Fix endless looping between cascade() and internal_add_timer() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 18/37] pktgen: fix crash when generating IPv6 packets Greg Kroah-Hartman
2012-10-19 3:16 ` [ 19/37] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 20/37] ipvs: fix oops in ip_vs_dst_event on rmmod Greg Kroah-Hartman
2012-10-19 3:16 ` [ 21/37] netfilter: nf_conntrack: fix racy timer handling with reliable events Greg Kroah-Hartman
2012-10-19 3:16 ` [ 22/37] netfilter: nf_ct_ipv4: packets with wrong ihl are invalid Greg Kroah-Hartman
2012-10-19 3:16 ` [ 23/37] netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation Greg Kroah-Hartman
2012-10-19 3:16 ` Greg Kroah-Hartman [this message]
2012-10-19 3:16 ` [ 25/37] netfilter: nf_nat_sip: fix via header translation with multiple parameters Greg Kroah-Hartman
2012-10-19 3:16 ` [ 26/37] netfilter: nf_ct_expect: fix possible access to uninitialized timer Greg Kroah-Hartman
2012-10-19 3:16 ` [ 27/37] netfilter: limit, hashlimit: avoid duplicated inline Greg Kroah-Hartman
2012-10-19 3:16 ` [ 28/37] netfilter: xt_limit: have r->cost != 0 case work Greg Kroah-Hartman
2012-10-19 3:16 ` [ 29/37] Add CDC-ACM support for the CX93010-2x UCMxx USB Modem Greg Kroah-Hartman
2012-10-19 3:16 ` [ 30/37] drm/radeon: Dont destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 31/37] jbd: Fix assertion failure in commit code due to lacking transaction credits Greg Kroah-Hartman
2012-10-19 3:16 ` [ 32/37] x86, random: Architectural inlines to get random integers with RDRAND Greg Kroah-Hartman
2012-10-19 3:16 ` [ 33/37] x86, random: Verify RDRAND functionality and allow it to be disabled Greg Kroah-Hartman
2012-10-19 3:16 ` [ 34/37] tpm: Propagate error from tpm_transmit to fix a timeout hang Greg Kroah-Hartman
2012-10-19 3:16 ` [ 35/37] udf: fix retun value on error path in udf_load_logicalvol Greg Kroah-Hartman
2012-10-19 3:16 ` [ 36/37] ALSA: ac97 - Fix missing NULL check in snd_ac97_cvol_new() Greg Kroah-Hartman
2012-10-19 3:17 ` [ 37/37] ALSA: emu10k1: add chip details for E-mu 1010 PCIe card Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121019031306.738219149@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@davemloft.net \
--cc=horms@verge.net.au \
--cc=ja@ssi.bg \
--cc=linux-kernel@vger.kernel.org \
--cc=mlin@ss.pku.edu.cn \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).