Re: Bug#806130: linux: netlink_sock_destruct() crash in netns

Re: Bug#806130: linux: netlink_sock_destruct() crash in netns

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 2594 bytes --]

On Tue, 2015-11-24 at 16:49 +0100, Arturo Borrero Gonzalez wrote:
> Source: linux
> Version: 4.2.6-1
> Severity: normal
> 
> Dear Maintainer,
> 
> thanks for your work in the linux kernel.
> 
> I'm experimenting reports like this:
> 
> [mar nov 24 16:38:16 2015] ------------[ cut here ]------------
> [mar nov 24 16:38:16 2015] WARNING: CPU: 1 PID: 22224 at /build/linux-CrHvZ_/linux-4.2.6/net/netlink/af_netlink.c:946 netlink_sock_destruct+0x103/0x140()
> [mar nov 24 16:38:16 2015] Modules linked in: nft_nat nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nft_log fuse uas usb_storage nft_counter nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_meta nft_hash nft_rbtree nfnetlink_log nf_tables_inet nf_tables_ipv6 nf_tables_ipv4 nf_tables nfnetlink nouveau snd_hda_codec_idt snd_hda_codec_generic mxm_wmi wmi video ttm drm_kms_helper drm iTCO_wdt i2c_algo_bit iTCO_vendor_support coretemp kvm_intel lpc_ich kvm snd_hda_intel mfd_core i2c_i801 snd_hda_codec evdev snd_hda_core pcspkr psmouse serio_raw snd_hwdep snd_pcm sg rng_core tpm_tis tpm 8250_fintek shpchp button snd_timer snd soundcore acpi_cpufreq processor thermal_sys parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd2 dm_mod sr_mod cdrom sd_mod ata_generic floppy ata_piix e100
> [mar nov 24 16:38:16 2015]  mii libata scsi_mod ehci_pci uhci_hcd ehci_hcd usbcore usb_common
> [mar nov 24 16:38:16 2015] CPU: 1 PID: 22224 Comm: bash Tainted: G        W       4.2.0-1-amd64 #1 Debian 4.2.6-1
[...]
> I can reproduce the issue:
> 
>  % sudo ip netns add test
>  % sudo ip netns exec test nft -f test.nft
>  % sudo ip netns del test
> 
> Find attached the test.nft file.

I can also reproduce this warning with Linux 4.3.  I was also able to
simplify your sample quite a lot and still reproduce it:

--- BEGIN ---
flush ruleset
table ip nat {
	chain postrouting {
		ip saddr 192.168.5.0/24 snat 1.1.1.1
	}
}
table inet inet-filter {
	chain input {
		ct state new accept
	}

	chain forward {
		type filter hook forward priority 0; policy drop;
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp dport 22 counter accept
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp dport 22 counter accept
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp dport 22 counter accept
		counter accept
	}
}
--- END ---

I'm cc'ing this to the netfilter developers so they can investigate
this.

Ben.

-- 
Ben Hutchings
Unix is many things to many people,
but it's never been everything to anybody.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

Re: Bug#806130: linux: netlink_sock_destruct() crash in netns

[Pablo Neira Ayuso]

On Thu, Nov 26, 2015 at 10:14:58PM +0000, Ben Hutchings wrote:
> On Tue, 2015-11-24 at 16:49 +0100, Arturo Borrero Gonzalez wrote:
> > Source: linux
> > Version: 4.2.6-1
> > Severity: normal
> > 
> > Dear Maintainer,
> > 
> > thanks for your work in the linux kernel.
> > 
> > I'm experimenting reports like this:
> > 
> > [mar nov 24 16:38:16 2015] ------------[ cut here ]------------
> > [mar nov 24 16:38:16 2015] WARNING: CPU: 1 PID: 22224 at /build/linux-CrHvZ_/linux-4.2.6/net/netlink/af_netlink.c:946 netlink_sock_destruct+0x103/0x140()
> > [mar nov 24 16:38:16 2015] Modules linked in: nft_nat nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nft_log fuse uas usb_storage nft_counter nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_meta nft_hash nft_rbtree nfnetlink_log nf_tables_inet nf_tables_ipv6 nf_tables_ipv4 nf_tables nfnetlink nouveau snd_hda_codec_idt snd_hda_codec_generic mxm_wmi wmi video ttm drm_kms_helper drm iTCO_wdt i2c_algo_bit iTCO_vendor_support coretemp kvm_intel lpc_ich kvm snd_hda_intel mfd_core i2c_i801 snd_hda_codec evdev snd_hda_core pcspkr psmouse serio_raw snd_hwdep snd_pcm sg rng_core tpm_tis tpm 8250_fintek shpchp button snd_timer snd soundcore acpi_cpufreq processor thermal_sys parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd2 dm_mod sr_mod cdrom sd_mod ata_generic floppy ata_piix e100
> > [mar nov 24 16:38:16 2015]  mii libata scsi_mod ehci_pci uhci_hcd ehci_hcd usbcore usb_common
> > [mar nov 24 16:38:16 2015] CPU: 1 PID: 22224 Comm: bash Tainted: G        W       4.2.0-1-amd64 #1 Debian 4.2.6-1
> [...]
> > I can reproduce the issue:
> > 
> >  % sudo ip netns add test
> >  % sudo ip netns exec test nft -f test.nft
> >  % sudo ip netns del test
> > 
> > Find attached the test.nft file.

sk       Eth Pid    Groups   Rmem     Wmem     Dump     Locks
Drops     Inode
ffff8800cbb11000 0   0      00000000 0        0        0 2        0 19855   
ffff88011504f800 4   0      00000000 0        0        0 2        0 19877   
ffff8801153f7000 9   0      00000000 0        0        0 2        0 19876   
ffff880030c23000 10  0      00000000 0        0        0 2        0 19858   
ffff8800cbabb800 12  0      00000000 -4544    0        0 2        0 19890   

wmem is underflowing.

Could you check if this also happening in older kernel versions?

No need to test under netns, you can just run nft -f and check
/proc/net/netlink.

Let me know, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Bug#806130: linux: netlink_sock_destruct() crash in netns

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 3104 bytes --]

On Sat, 2015-11-28 at 23:47 +0100, Pablo Neira Ayuso wrote:
> On Thu, Nov 26, 2015 at 10:14:58PM +0000, Ben Hutchings wrote:
> > On Tue, 2015-11-24 at 16:49 +0100, Arturo Borrero Gonzalez wrote:
> > > Source: linux
> > > Version: 4.2.6-1
> > > Severity: normal
> > > 
> > > Dear Maintainer,
> > > 
> > > thanks for your work in the linux kernel.
> > > 
> > > I'm experimenting reports like this:
> > > 
> > > [mar nov 24 16:38:16 2015] ------------[ cut here ]------------
> > > [mar nov 24 16:38:16 2015] WARNING: CPU: 1 PID: 22224 at /build/linux-CrHvZ_/linux-4.2.6/net/netlink/af_netlink.c:946 netlink_sock_destruct+0x103/0x140()
> > > [mar nov 24 16:38:16 2015] Modules linked in: nft_nat nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nft_log fuse uas usb_storage nft_counter nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_meta nft_hash nft_rbtree nfnetlink_log nf_tables_inet nf_tables_ipv6 nf_tables_ipv4 nf_tables nfnetlink nouveau snd_hda_codec_idt snd_hda_codec_generic mxm_wmi wmi video ttm drm_kms_helper drm iTCO_wdt i2c_algo_bit iTCO_vendor_support coretemp kvm_intel lpc_ich kvm snd_hda_intel mfd_core i2c_i801 snd_hda_codec evdev snd_hda_core pcspkr psmouse serio_raw snd_hwdep snd_pcm sg rng_core tpm_tis tpm 8250_fintek shpchp button snd_timer snd soundcore acpi_cpufreq processor thermal_sys parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd2 dm_mod sr_mod cdrom sd_mod ata_generic floppy ata_piix e100
> > > [mar nov 24 16:38:16 2015]  mii libata scsi_mod ehci_pci uhci_hcd ehci_hcd usbcore usb_common
> > > [mar nov 24 16:38:16 2015] CPU: 1 PID: 22224 Comm: bash Tainted: G        W       4.2.0-1-amd64 #1 Debian 4.2.6-1
> > [...]
> > > I can reproduce the issue:
> > > 
> > >  % sudo ip netns add test
> > >  % sudo ip netns exec test nft -f test.nft
> > >  % sudo ip netns del test
> > > 
> > > Find attached the test.nft file.
> 
> sk       Eth Pid    Groups   Rmem     Wmem     Dump     Locks
> Drops     Inode
> ffff8800cbb11000 0   0      00000000 0        0        0 2        0 19855   
> ffff88011504f800 4   0      00000000 0        0        0 2        0 19877   
> ffff8801153f7000 9   0      00000000 0        0        0 2        0 19876   
> ffff880030c23000 10  0      00000000 0        0        0 2        0 19858   
> ffff8800cbabb800 12  0      00000000 -4544    0        0 2        0 19890   
> 
> wmem is underflowing.
> 
> Could you check if this also happening in older kernel versions?

Same happens on 3.18.  The current version of nft doesn't run on 3.17
or earlier.

Ben.

> No need to test under netns, you can just run nft -f and check
> /proc/net/netlink.
> 
> Let me know, thanks.
-- 
Ben Hutchings
Theory and practice are closer in theory than in practice.
                                - John Levine, moderator of comp.compilers

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]