* Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160
@ 2015-09-13 11:34 Sander Eikelenboom
2015-09-13 18:06 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Sander Eikelenboom @ 2015-09-13 11:34 UTC (permalink / raw)
To: netdev, netfilter; +Cc: Pablo Neira Ayuso
Using a linux-4.3-rc1 kernel i encountered the splat below:
addr2line gives:
/usr/src/new/linux-linus/include/linux/netfilter/x_tables.h:350
which is:
/*
* This helper is performance critical and must be inlined
*/
static inline unsigned long ifname_compare_aligned(const char *_a,
const char *_b,
const char *_mask)
{
const unsigned long *a = (const unsigned long *)_a;
const unsigned long *b = (const unsigned long *)_b;
const unsigned long *mask = (const unsigned long *)_mask;
unsigned long ret;
ret = (a[0] ^ b[0]) & mask[0];
if (IFNAMSIZ > sizeof(unsigned long))
HERE --> ret |= (a[1] ^ b[1]) & mask[1];
if (IFNAMSIZ > 2 * sizeof(unsigned long))
ret |= (a[2] ^ b[2]) & mask[2];
if (IFNAMSIZ > 3 * sizeof(unsigned long))
ret |= (a[3] ^ b[3]) & mask[3];
BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
return ret;
}
--
Sander
[ 290.200642] BUG: unable to handle kernel paging request at
000000000484195d
[ 290.211702] IP: [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
[ 290.222716] PGD 591ea067 PUD 5772a067 PMD 0
[ 290.233389] Oops: 0000 [#1] SMP
[ 290.244017] Modules linked in:
[ 290.254338] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
4.3.0-rc1-20150913-linus-doflr+ #1
[ 290.264862] Hardware name: MSI MS-7640/890FXA-GD70 (MS-7640) , BIOS
V1.8B1 09/13/2010
[ 290.275319] task: ffffffff8221a580 ti: ffffffff82200000 task.ti:
ffffffff82200000
[ 290.285909] RIP: e030:[<ffffffff819bc3e6>] [<ffffffff819bc3e6>]
physdev_mt+0xd6/0x160
[ 290.296374] RSP: e02b:ffff88005f6037b0 EFLAGS: 00010206
[ 290.306758] RAX: 00302e3531666976 RBX: ffff880000414d00 RCX:
0000000000000000
[ 290.310800] xen_bridge: port 13(vif13.0) entered forwarding state
[ 290.327013] RDX: ffffc90003c0c4f0 RSI: ffff88003bfba000 RDI:
0000000000000002
[ 290.337148] RBP: ffff88005f6037b0 R08: 0000000004841955 R09:
ffff880057bf2501
[ 290.347361] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff880004b4a24e
[ 290.357395] R13: ffff8800044bc000 R14: ffffc90003c0c460 R15:
ffffc90003c0c4d0
[ 290.367437] FS: 00007ff6d0ed3700(0000) GS:ffff88005f600000(0000)
knlGS:0000000000000000
[ 290.377264] CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 290.386939] CR2: 000000000484195d CR3: 0000000048ba6000 CR4:
0000000000000660
[ 290.396564] Stack:
[ 290.406066] ffff88005f603848 ffffffff81a4e6c0 ffffc90003c09008
000000008110df32
[ 290.415683] ffff8800559ddc00 ffff880004d50000 ffffc90003c09040
0000000000000001
[ 290.425294] ffffffff822f7c40 ffffc90003c0c4f0 ffff8800044bc000
ffff880004d50000
[ 290.434788] Call Trace:
[ 290.444034] <IRQ>
[ 290.444088] [<ffffffff81a4e6c0>] ipt_do_table+0x210/0x390
[ 290.461951] [<ffffffff81a510ae>] iptable_filter_hook+0x2e/0x70
[ 290.470756] [<ffffffff8199279c>] nf_iterate+0x4c/0x80
[ 290.479587] [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
[ 290.488341] [<ffffffff81a06779>] ip_forward+0x369/0x3c0
[ 290.496927] [<ffffffff81a06380>] ? ip_frag_mem+0x40/0x40
[ 290.505365] [<ffffffff81a04961>] ip_rcv_finish+0x101/0x330
[ 290.513480] [<ffffffff81a05001>] ip_rcv+0x291/0x390
[ 290.521562] [<ffffffff81a04860>] ?
ip_local_deliver_finish+0x120/0x120
[ 290.529509] [<ffffffff819619f0>]
__netif_receive_skb_core+0x2a0/0x960
[ 290.537381] [<ffffffff8199ea19>] ? tcp_error+0xa9/0x1e0
[ 290.545287] [<ffffffff810cbdf6>] ? __local_bh_enable_ip+0x26/0x90
[ 290.553065] [<ffffffff81963fa1>] __netif_receive_skb+0x11/0x70
[ 290.560671] [<ffffffff8196401e>]
netif_receive_skb_internal+0x1e/0x80
[ 290.568025] [<ffffffff81992834>] ? nf_hook_slow+0x64/0xc0
[ 290.575341] [<ffffffff8196408c>] netif_receive_skb_sk+0xc/0x10
[ 290.582655] [<ffffffff81a62caa>] br_handle_frame_finish+0x17a/0x4b0
[ 290.589910] [<ffffffff81a4ba1a>] ? nf_nat_ipv4_fn+0x19a/0x1e0
[ 290.597120] [<ffffffff81a51370>] ? iptable_nat_ipv4_fn+0x20/0x20
[ 290.604316] [<ffffffff81964080>] ?
netif_receive_skb_internal+0x80/0x80
[ 290.611375] [<ffffffff81a6d0f6>]
br_nf_pre_routing_finish+0x166/0x340
[ 290.618246] [<ffffffff81a62b30>] ? br_handle_local_finish+0x50/0x50
[ 290.624925] [<ffffffff81a6d65b>] br_nf_pre_routing+0x29b/0x370
[ 290.631446] [<ffffffff81a6cf90>] ? br_nf_forward_ip+0x3d0/0x3d0
[ 290.637991] [<ffffffff8199279c>] nf_iterate+0x4c/0x80
[ 290.644328] [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
[ 290.650380] [<ffffffff81a63179>] br_handle_frame+0x199/0x280
[ 290.656432] [<ffffffff81a62b30>] ? br_handle_local_finish+0x50/0x50
[ 290.662593] [<ffffffff81a62fe0>] ?
br_handle_frame_finish+0x4b0/0x4b0
[ 290.668626] [<ffffffff8196187b>]
__netif_receive_skb_core+0x12b/0x960
[ 290.674643] [<ffffffff810fd401>] ?
__raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[ 290.680797] [<ffffffff8195cf31>] ? __skb_flow_dissect+0x5f1/0x8f0
[ 290.686902] [<ffffffff81963fa1>] __netif_receive_skb+0x11/0x70
[ 290.693046] [<ffffffff8196401e>]
netif_receive_skb_internal+0x1e/0x80
[ 290.699031] [<ffffffff8196408c>] netif_receive_skb_sk+0xc/0x10
[ 290.704880] [<ffffffff81732dfa>] xenvif_tx_action+0x69a/0x830
[ 290.710609] [<ffffffff81963fa1>] ? __netif_receive_skb+0x11/0x70
[ 290.716365] [<ffffffff81735349>] xenvif_poll+0x29/0x70
[ 290.722241] [<ffffffff81965357>] net_rx_action+0x1f7/0x300
[ 290.727940] [<ffffffff810cbbf3>] __do_softirq+0x103/0x210
[ 290.733564] [<ffffffff810cbefb>] irq_exit+0x4b/0xa0
[ 290.739094] [<ffffffff814d5b40>] xen_evtchn_do_upcall+0x30/0x40
[ 290.744626] [<ffffffff81ad78fe>]
xen_do_hypervisor_callback+0x1e/0x40
[ 290.750062] <EOI>
[ 290.750114] [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
[ 290.760785] [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
[ 290.766024] [<ffffffff81009240>] ? xen_safe_halt+0x10/0x20
[ 290.771254] [<ffffffff810198a3>] ? default_idle+0x13/0x20
[ 290.776525] [<ffffffff81019dda>] ? arch_cpu_idle+0xa/0x10
[ 290.781750] [<ffffffff810fae2e>] ? default_idle_call+0x2e/0x50
[ 290.786833] [<ffffffff810fb0c2>] ? cpu_startup_entry+0x272/0x2e0
[ 290.791911] [<ffffffff81acea77>] ? rest_init+0x77/0x80
[ 290.796864] [<ffffffff82314f43>] ? start_kernel+0x438/0x445
[ 290.801857] [<ffffffff823144ef>] ?
x86_64_start_reservations+0x2a/0x2c
[ 290.806726] [<ffffffff82317fef>] ? xen_start_kernel+0x555/0x561
[ 290.811611] Code: 0f 94 c6 31 c0 83 e1 01 83 f1 01 40 38 ce 75 8a 83
e7 02 b8 01 00 00 00 74 80 4d 85 c0 0f 84 8e 00 00 00 48 8b 4a 28 48 8b
42 20 <49> 33 48 08 49 33 00 48 23 4a 38 48 23 42 30 5d 48 09 c1 0f b6
[ 290.822337] RIP [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
[ 290.827562] RSP <ffff88005f6037b0>
[ 290.832752] CR2: 000000000484195d
[ 290.837934] ---[ end trace 82d08e819d389b33 ]---
[ 290.843177] Kernel panic - not syncing: Fatal exception in interrupt
[ 290.848508] Kernel Offset: disabled
(XEN) [2015-09-13 11:22:50.171] Hardware Dom0 crashed: rebooting machine
in 5 seconds.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160
2015-09-13 11:34 Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160 Sander Eikelenboom
@ 2015-09-13 18:06 ` Florian Westphal
2015-09-14 7:50 ` Sander Eikelenboom
0 siblings, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2015-09-13 18:06 UTC (permalink / raw)
To: Sander Eikelenboom; +Cc: netdev, netfilter, Pablo Neira Ayuso
Sander Eikelenboom <linux@eikelenboom.it> wrote:
> Using a linux-4.3-rc1 kernel i encountered the splat below:
Thanks for reporting this bug.
> [ 290.200642] BUG: unable to handle kernel paging request at
> 000000000484195d
> [ 290.211702] IP: [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
[..]
> [ 290.444088] [<ffffffff81a4e6c0>] ipt_do_table+0x210/0x390
> [ 290.461951] [<ffffffff81a510ae>] iptable_filter_hook+0x2e/0x70
> [ 290.470756] [<ffffffff8199279c>] nf_iterate+0x4c/0x80
> [ 290.479587] [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
> [ 290.488341] [<ffffffff81a06779>] ip_forward+0x369/0x3c0
> [ 290.496927] [<ffffffff81a06380>] ? ip_frag_mem+0x40/0x40
> [ 290.505365] [<ffffffff81a04961>] ip_rcv_finish+0x101/0x330
> [ 290.513480] [<ffffffff81a05001>] ip_rcv+0x291/0x390
> [ 290.521562] [<ffffffff81a04860>] ?
Aye, ip forwarding of bridged packets with call-iptables=1 is broken.
Please, could you try this patch? It fixes this bug for me.
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -355,6 +355,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)
struct iphdr *iph = ip_hdr(skb);
struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
struct rtable *rt;
+ bool daddr_changed;
int err;
nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
@@ -363,8 +364,15 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)
skb->pkt_type = PACKET_OTHERHOST;
nf_bridge->pkt_otherhost = false;
}
+
+ /* set physoutdev to NULL, its set by the bridge forward hook but
+ * frame might be routed instead of bridged.
+ */
+ daddr_changed = br_nf_ipv4_daddr_was_changed(skb, nf_bridge);
+ nf_bridge->physoutdev = NULL;
nf_bridge->in_prerouting = 0;
- if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
+
+ if (daddr_changed) {
if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
struct in_device *in_dev = __in_dev_get_rcu(dev);
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 77383bf..772222b 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -167,6 +167,7 @@ static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
struct rtable *rt;
struct net_device *dev = skb->dev;
const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
+ bool daddr_changed;
nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
@@ -174,8 +175,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
skb->pkt_type = PACKET_OTHERHOST;
nf_bridge->pkt_otherhost = false;
}
+
+ daddr_changed = br_nf_ipv6_daddr_was_changed(skb, nf_bridge);
+ nf_bridge->physoutdev = NULL;
nf_bridge->in_prerouting = 0;
- if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
+
+ if (daddr_changed) {
skb_dst_drop(skb);
v6ops->route_input(skb);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160
2015-09-13 18:06 ` Florian Westphal
@ 2015-09-14 7:50 ` Sander Eikelenboom
2015-09-14 14:45 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Sander Eikelenboom @ 2015-09-14 7:50 UTC (permalink / raw)
To: Florian Westphal; +Cc: netdev, netfilter, Pablo Neira Ayuso
On 2015-09-13 20:06, Florian Westphal wrote:
> Sander Eikelenboom <linux@eikelenboom.it> wrote:
>> Using a linux-4.3-rc1 kernel i encountered the splat below:
>
> Thanks for reporting this bug.
>
>> [ 290.200642] BUG: unable to handle kernel paging request at
>> 000000000484195d
>> [ 290.211702] IP: [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
> [..]
>
>> [ 290.444088] [<ffffffff81a4e6c0>] ipt_do_table+0x210/0x390
>> [ 290.461951] [<ffffffff81a510ae>] iptable_filter_hook+0x2e/0x70
>> [ 290.470756] [<ffffffff8199279c>] nf_iterate+0x4c/0x80
>> [ 290.479587] [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
>> [ 290.488341] [<ffffffff81a06779>] ip_forward+0x369/0x3c0
>> [ 290.496927] [<ffffffff81a06380>] ? ip_frag_mem+0x40/0x40
>> [ 290.505365] [<ffffffff81a04961>] ip_rcv_finish+0x101/0x330
>> [ 290.513480] [<ffffffff81a05001>] ip_rcv+0x291/0x390
>> [ 290.521562] [<ffffffff81a04860>] ?
>
> Aye, ip forwarding of bridged packets with call-iptables=1 is broken.
>
> Please, could you try this patch? It fixes this bug for me.
Hi Florian,
Works for me too, thx for the fix !
--
Sander
> diff --git a/net/bridge/br_netfilter_hooks.c
> b/net/bridge/br_netfilter_hooks.c
> --- a/net/bridge/br_netfilter_hooks.c
> +++ b/net/bridge/br_netfilter_hooks.c
> @@ -355,6 +355,7 @@ static int br_nf_pre_routing_finish(struct sock
> *sk, struct sk_buff *skb)
> struct iphdr *iph = ip_hdr(skb);
> struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
> struct rtable *rt;
> + bool daddr_changed;
> int err;
>
> nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
> @@ -363,8 +364,15 @@ static int br_nf_pre_routing_finish(struct sock
> *sk, struct sk_buff *skb)
> skb->pkt_type = PACKET_OTHERHOST;
> nf_bridge->pkt_otherhost = false;
> }
> +
> + /* set physoutdev to NULL, its set by the bridge forward hook but
> + * frame might be routed instead of bridged.
> + */
> + daddr_changed = br_nf_ipv4_daddr_was_changed(skb, nf_bridge);
> + nf_bridge->physoutdev = NULL;
> nf_bridge->in_prerouting = 0;
> - if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
> +
> + if (daddr_changed) {
> if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
> dev))) {
> struct in_device *in_dev = __in_dev_get_rcu(dev);
>
> diff --git a/net/bridge/br_netfilter_ipv6.c
> b/net/bridge/br_netfilter_ipv6.c
> index 77383bf..772222b 100644
> --- a/net/bridge/br_netfilter_ipv6.c
> +++ b/net/bridge/br_netfilter_ipv6.c
> @@ -167,6 +167,7 @@ static int br_nf_pre_routing_finish_ipv6(struct
> sock *sk, struct sk_buff *skb)
> struct rtable *rt;
> struct net_device *dev = skb->dev;
> const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
> + bool daddr_changed;
>
> nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
>
> @@ -174,8 +175,12 @@ static int br_nf_pre_routing_finish_ipv6(struct
> sock *sk, struct sk_buff *skb)
> skb->pkt_type = PACKET_OTHERHOST;
> nf_bridge->pkt_otherhost = false;
> }
> +
> + daddr_changed = br_nf_ipv6_daddr_was_changed(skb, nf_bridge);
> + nf_bridge->physoutdev = NULL;
> nf_bridge->in_prerouting = 0;
> - if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
> +
> + if (daddr_changed) {
> skb_dst_drop(skb);
> v6ops->route_input(skb);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160
2015-09-14 7:50 ` Sander Eikelenboom
@ 2015-09-14 14:45 ` Florian Westphal
0 siblings, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2015-09-14 14:45 UTC (permalink / raw)
To: Sander Eikelenboom; +Cc: Florian Westphal, netdev, netfilter, Pablo Neira Ayuso
Sander Eikelenboom <linux@eikelenboom.it> wrote:
> On 2015-09-13 20:06, Florian Westphal wrote:
> >Sander Eikelenboom <linux@eikelenboom.it> wrote:
> >>Using a linux-4.3-rc1 kernel i encountered the splat below:
> >
> >Thanks for reporting this bug.
> >
> >>[ 290.200642] BUG: unable to handle kernel paging request at
> >>000000000484195d
> >>[ 290.211702] IP: [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
> >[..]
> >
> >>[ 290.444088] [<ffffffff81a4e6c0>] ipt_do_table+0x210/0x390
> >>[ 290.461951] [<ffffffff81a510ae>] iptable_filter_hook+0x2e/0x70
> >>[ 290.470756] [<ffffffff8199279c>] nf_iterate+0x4c/0x80
> >>[ 290.479587] [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
> >>[ 290.488341] [<ffffffff81a06779>] ip_forward+0x369/0x3c0
> >>[ 290.496927] [<ffffffff81a06380>] ? ip_frag_mem+0x40/0x40
> >>[ 290.505365] [<ffffffff81a04961>] ip_rcv_finish+0x101/0x330
> >>[ 290.513480] [<ffffffff81a05001>] ip_rcv+0x291/0x390
> >>[ 290.521562] [<ffffffff81a04860>] ?
> >
> >Aye, ip forwarding of bridged packets with call-iptables=1 is broken.
> >
> >Please, could you try this patch? It fixes this bug for me.
>
> Hi Florian,
>
> Works for me too, thx for the fix !
Sorry, I made this claim too early.
We cannot use this fix, since it will still cause kernel oops when using
-j NFQUEUE in PRE_ROUTING (We would bump refcnt on ->physoutdev, which is
garbage in this case).
Only option is to undo 72b1e5e4cac as follows:
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -183,7 +183,8 @@ struct nf_bridge_info {
/* prerouting: detect dnat in orig/reply direction */
__be32 ipv4_daddr;
struct in6_addr ipv6_daddr;
-
+ };
+ union {
/* after prerouting + nat detected: store original source
* mac since neigh resolution overwrites it, only used while
* skb is out in neigh layer.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-09-14 14:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-09-13 11:34 Netfilter: BUG: unable to handle kernel paging request, RIP: physdev_mt+0xd6/0x160 Sander Eikelenboom
2015-09-13 18:06 ` Florian Westphal
2015-09-14 7:50 ` Sander Eikelenboom
2015-09-14 14:45 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).