[lkml]   [2010]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    SubjectRe: ctnetlink loop
    Sorry, I finally found your email reporting this:

    > nfnetlink: avoid unbound loop on busy Netlink socket
    > I see a problem with how ctnetlink GET requests are being
    > processed in the kernel ( under high load.
    > The sympton is Netlink looping around nfnetlink_rcv_msg(), which
    > is just because netlink_unicast() came back with EAGAIN when
    > trying to write the newly created Netlink skb to the SK receive
    > buffer in ctnetlink_get_conntrack(). In this case a (possibly)
    > infinit loop is entered. Mostly infinit I think in case the
    > userland party trying to receive those messages may be stuck in
    > the sendmsg() call, being unable to read anything if being single
    > threaded.
    > I tried to reproduce several times, a few times the loop
    > disappeared and the box proceeded normally after some minutes.
    > I have no explanation for this.
    > The attached patch tries to solve it by simple not trying again
    > to netlink_unicast() the reply skb and just fail with -ENOBUFS.
    > The reasoning is that at the point a Netlink overrun is detected
    > it seems counter intuitive to insist on sending one more Netlink
    > message.

    We still need EAGAIN, and it doesn't necessarily means ENOBUFS for the
    general case in nfnetlink.

    The following patch covers the case that you're reporting.
    netfilter: ctnetlink: fix loop in ctnetlink_get_conntrack()

    From: Pablo Neira Ayuso <>

    This patch fixes a loop in ctnetlink_get_conntrack() that can be
    triggered if you use the same socket to receive events and to
    perform a GET operation. Under heavy load, netlink_unicast()
    may return -EAGAIN, this error code is reserved in nfnetlink for
    the module load-on-demand. Instead, we return -ENOBUFS which is
    the appropriate error code that has to be propagated to

    Reported-by: Holger Eitzenberger <>
    Signed-off-by: Pablo Neira Ayuso <>
    net/netfilter/nf_conntrack_netlink.c | 3 ++-
    1 files changed, 2 insertions(+), 1 deletions(-)

    diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
    index b729ace..a84fa6f 100644
    --- a/net/netfilter/nf_conntrack_netlink.c
    +++ b/net/netfilter/nf_conntrack_netlink.c
    @@ -973,7 +973,8 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
    - return err;
    + /* this avoids a loop in nfnetlink. */
    + return err == -EAGAIN ? -ENOBUFS : err;

     \ /
      Last update: 2010-12-09 12:05    [W:0.029 / U:13.536 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site