* netfilter: xt_hashlimit: fix proc entry leak in netns destroy path
@ 2013-11-27 6:42 Sergey Popovich
2013-12-05 18:45 ` Pablo Neira Ayuso
2013-12-06 8:57 ` Sergey Popovich
0 siblings, 2 replies; 4+ messages in thread
From: Sergey Popovich @ 2013-11-27 6:42 UTC (permalink / raw)
To: netfilter-devel
commit 32263dd1b43378b4f7d7796ed713f77e95f27e8a
Author: Vitaly E. Lavrov <>
Date: Mon Dec 24 14:42:17 2012 +0100
netfilter: xt_hashlimit: fix namespace destroy path
Takes into account fact, that hashlimit_net_exit() called right before
hashlimit_mt_destroy() and fixes destroy path for netns.
However using xt_hashlimit for IPv4 and IPv6 together produces following
output
on netconsole from one of our servers on netns destroy:
Pid: 9499, comm: kworker/u:0 Tainted: G WC O 3.2.0-5-netctl-amd64-
core2
Call Trace:
[<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c
[<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a
[<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e
[<ffffffff810ebbaa>] ? kfree+0x5b/0x6c
[<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit]
[<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44
[<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180
[<ffffffff810369fc>] ? should_resched+0x5/0x23
[<ffffffff8105b8f9>] ? process_one_work+0x161/0x269
[<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48
[<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145
[<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b
[<ffffffff8105fa01>] ? kthread+0x76/0x7e
[<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10
[<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139
[<ffffffff813581f0>] ? gs_change+0x13/0x13
---[ end trace d8c3cc0ad163ef79 ]---
------------[ cut here ]------------
WARNING: at
/usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849
remove_proc_entry+0x217/0x22e()
Hardware name:
remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking
at least 'IN-REJECT'
This is due to lack of removal net/ip6t_hashlimit/* entries in
hashlimit_proc_net_exit().
Found and tested with custom build 3.2.x and backported commits
32263dd1b (netfilter: xt_hashlimit: fix namespace destroy path) and
commit 665e205c1 (netfilter: xt_recent: fix namespace destroy path),
which seems not currently in linux-stable (at least for 3.2.x series).
Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
---
net/netfilter/xt_hashlimit.c | 25 +++++++++++--------------
1 file changed, 11 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c..a3910fc 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
add_timer(&ht->timer);
}
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
{
struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
struct proc_dir_entry *parent;
- del_timer_sync(&hinfo->timer);
-
if (hinfo->family == NFPROTO_IPV4)
parent = hashlimit_net->ipt_hashlimit;
else
parent = hashlimit_net->ip6t_hashlimit;
- if(parent != NULL)
+ if (parent != NULL)
remove_proc_entry(hinfo->name, parent);
+}
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+ del_timer_sync(&hinfo->timer);
+ htable_remove_proc_entry(hinfo);
htable_selective_cleanup(hinfo, select_all);
kfree(hinfo->name);
vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net
*net)
static void __net_exit hashlimit_proc_net_exit(struct net *net)
{
struct xt_hashlimit_htable *hinfo;
- struct proc_dir_entry *pde;
struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
- /* recent_net_exit() is called before recent_mt_destroy(). Make sure
- * that the parent xt_recent proc entry is is empty before trying to
- * remove it.
+ /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
+ * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
+ * entries is empty before trying to remove it.
*/
mutex_lock(&hashlimit_mutex);
- pde = hashlimit_net->ipt_hashlimit;
- if (pde == NULL)
- pde = hashlimit_net->ip6t_hashlimit;
-
hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
- remove_proc_entry(hinfo->name, pde);
-
+ htable_remove_proc_entry(hinfo);
hashlimit_net->ipt_hashlimit = NULL;
hashlimit_net->ip6t_hashlimit = NULL;
mutex_unlock(&hashlimit_mutex);
--
1.8.3.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: netfilter: xt_hashlimit: fix proc entry leak in netns destroy path
2013-11-27 6:42 netfilter: xt_hashlimit: fix proc entry leak in netns destroy path Sergey Popovich
@ 2013-12-05 18:45 ` Pablo Neira Ayuso
2013-12-06 8:57 ` Sergey Popovich
1 sibling, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2013-12-05 18:45 UTC (permalink / raw)
To: Sergey Popovich; +Cc: netfilter-devel
On Wed, Nov 27, 2013 at 08:42:09AM +0200, Sergey Popovich wrote:
> commit 32263dd1b43378b4f7d7796ed713f77e95f27e8a
> Author: Vitaly E. Lavrov <>
> Date: Mon Dec 24 14:42:17 2012 +0100
>
> netfilter: xt_hashlimit: fix namespace destroy path
>
> Takes into account fact, that hashlimit_net_exit() called right before
> hashlimit_mt_destroy() and fixes destroy path for netns.
>
> However using xt_hashlimit for IPv4 and IPv6 together produces following
> output
> on netconsole from one of our servers on netns destroy:
>
> Pid: 9499, comm: kworker/u:0 Tainted: G WC O 3.2.0-5-netctl-amd64-
> core2
> Call Trace:
> [<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c
> [<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a
> [<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e
> [<ffffffff810ebbaa>] ? kfree+0x5b/0x6c
> [<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit]
> [<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44
> [<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180
> [<ffffffff810369fc>] ? should_resched+0x5/0x23
> [<ffffffff8105b8f9>] ? process_one_work+0x161/0x269
> [<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48
> [<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145
> [<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b
> [<ffffffff8105fa01>] ? kthread+0x76/0x7e
> [<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10
> [<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139
> [<ffffffff813581f0>] ? gs_change+0x13/0x13
> ---[ end trace d8c3cc0ad163ef79 ]---
> ------------[ cut here ]------------
> WARNING: at
> /usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849
> remove_proc_entry+0x217/0x22e()
> Hardware name:
> remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking
> at least 'IN-REJECT'
>
> This is due to lack of removal net/ip6t_hashlimit/* entries in
> hashlimit_proc_net_exit().
>
> Found and tested with custom build 3.2.x and backported commits
> 32263dd1b (netfilter: xt_hashlimit: fix namespace destroy path) and
> commit 665e205c1 (netfilter: xt_recent: fix namespace destroy path),
> which seems not currently in linux-stable (at least for 3.2.x series).
Thanks for your fix, but this does not apply.
patch -p1 < netfilter-xt_hashlimit-fix-proc-entry-leak-in-netns-destroy-path.patch
patching file net/netfilter/xt_hashlimit.c
patch: **** malformed patch at line 103: *net)
Could you resend me a patch via git-format-patch that applies cleanly
via git-am?
Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* netfilter: xt_hashlimit: fix proc entry leak in netns destroy path
2013-11-27 6:42 netfilter: xt_hashlimit: fix proc entry leak in netns destroy path Sergey Popovich
2013-12-05 18:45 ` Pablo Neira Ayuso
@ 2013-12-06 8:57 ` Sergey Popovich
2013-12-07 22:35 ` Pablo Neira Ayuso
1 sibling, 1 reply; 4+ messages in thread
From: Sergey Popovich @ 2013-12-06 8:57 UTC (permalink / raw)
To: netfilter-devel
commit 32263dd1b43378b4f7d7796ed713f77e95f27e8a
Author: Vitaly E. Lavrov <>
Date: Mon Dec 24 14:42:17 2012 +0100
netfilter: xt_hashlimit: fix namespace destroy path
Takes into account fact, that hashlimit_net_exit() called right before
hashlimit_mt_destroy() and fixes destroy path for netns.
However using xt_hashlimit for IPv4 and IPv6 together produces following
output on netconsole from one of our servers on netns destroy:
Pid: 9499, comm: kworker/u:0 Tainted: G WC O 3.2.0-5-netctl-amd64-core2
Call Trace:
[<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c
[<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a
[<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e
[<ffffffff810ebbaa>] ? kfree+0x5b/0x6c
[<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit]
[<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44
[<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180
[<ffffffff810369fc>] ? should_resched+0x5/0x23
[<ffffffff8105b8f9>] ? process_one_work+0x161/0x269
[<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48
[<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145
[<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b
[<ffffffff8105fa01>] ? kthread+0x76/0x7e
[<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10
[<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139
[<ffffffff813581f0>] ? gs_change+0x13/0x13
---[ end trace d8c3cc0ad163ef79 ]---
------------[ cut here ]------------
WARNING: at /usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849
remove_proc_entry+0x217/0x22e()
Hardware name:
remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking at least 'IN-REJECT'
This is due to lack of removal net/ip6t_hashlimit/* entries in
hashlimit_proc_net_exit().
Found and tested with custom build 3.2.x and backported commits
32263dd1b (netfilter: xt_hashlimit: fix namespace destroy path) and
commit 665e205c1 (netfilter: xt_recent: fix namespace destroy path),
which seems not currently in linux-stable (at least for 3.2.x series).
v2: Fix malformed patch format due to MUA line wrapping.
Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
---
net/netfilter/xt_hashlimit.c | 25 +++++++++++--------------
1 file changed, 11 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c..a3910fc 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
add_timer(&ht->timer);
}
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
{
struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
struct proc_dir_entry *parent;
- del_timer_sync(&hinfo->timer);
-
if (hinfo->family == NFPROTO_IPV4)
parent = hashlimit_net->ipt_hashlimit;
else
parent = hashlimit_net->ip6t_hashlimit;
- if(parent != NULL)
+ if (parent != NULL)
remove_proc_entry(hinfo->name, parent);
+}
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+ del_timer_sync(&hinfo->timer);
+ htable_remove_proc_entry(hinfo);
htable_selective_cleanup(hinfo, select_all);
kfree(hinfo->name);
vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
static void __net_exit hashlimit_proc_net_exit(struct net *net)
{
struct xt_hashlimit_htable *hinfo;
- struct proc_dir_entry *pde;
struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
- /* recent_net_exit() is called before recent_mt_destroy(). Make sure
- * that the parent xt_recent proc entry is is empty before trying to
- * remove it.
+ /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
+ * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
+ * entries is empty before trying to remove it.
*/
mutex_lock(&hashlimit_mutex);
- pde = hashlimit_net->ipt_hashlimit;
- if (pde == NULL)
- pde = hashlimit_net->ip6t_hashlimit;
-
hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
- remove_proc_entry(hinfo->name, pde);
-
+ htable_remove_proc_entry(hinfo);
hashlimit_net->ipt_hashlimit = NULL;
hashlimit_net->ip6t_hashlimit = NULL;
mutex_unlock(&hashlimit_mutex);
--
1.8.3.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: netfilter: xt_hashlimit: fix proc entry leak in netns destroy path
2013-12-06 8:57 ` Sergey Popovich
@ 2013-12-07 22:35 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2013-12-07 22:35 UTC (permalink / raw)
To: Sergey Popovich; +Cc: netfilter-devel
On Fri, Dec 06, 2013 at 10:57:19AM +0200, Sergey Popovich wrote:
> commit 32263dd1b43378b4f7d7796ed713f77e95f27e8a
> Author: Vitaly E. Lavrov <>
> Date: Mon Dec 24 14:42:17 2012 +0100
>
> netfilter: xt_hashlimit: fix namespace destroy path
>
> Takes into account fact, that hashlimit_net_exit() called right before
> hashlimit_mt_destroy() and fixes destroy path for netns.
>
> However using xt_hashlimit for IPv4 and IPv6 together produces following
> output on netconsole from one of our servers on netns destroy:
>
> Pid: 9499, comm: kworker/u:0 Tainted: G WC O 3.2.0-5-netctl-amd64-core2
> Call Trace:
> [<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c
> [<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a
> [<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e
> [<ffffffff810ebbaa>] ? kfree+0x5b/0x6c
> [<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit]
> [<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44
> [<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180
> [<ffffffff810369fc>] ? should_resched+0x5/0x23
> [<ffffffff8105b8f9>] ? process_one_work+0x161/0x269
> [<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48
> [<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145
> [<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b
> [<ffffffff8105fa01>] ? kthread+0x76/0x7e
> [<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10
> [<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139
> [<ffffffff813581f0>] ? gs_change+0x13/0x13
> ---[ end trace d8c3cc0ad163ef79 ]---
> ------------[ cut here ]------------
> WARNING: at /usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849
> remove_proc_entry+0x217/0x22e()
> Hardware name:
> remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking at least 'IN-REJECT'
>
> This is due to lack of removal net/ip6t_hashlimit/* entries in
> hashlimit_proc_net_exit().
Applied, thanks Sergey.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-12-07 22:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-27 6:42 netfilter: xt_hashlimit: fix proc entry leak in netns destroy path Sergey Popovich
2013-12-05 18:45 ` Pablo Neira Ayuso
2013-12-06 8:57 ` Sergey Popovich
2013-12-07 22:35 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).