lkml.org 
[lkml]   [2010]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: PROBLEM with summary: Re: [PATCH] netfilter: per netns nf_conntrack_cachep
    Jon Masters wrote:
    > On Tue, 2010-02-02 at 11:46 -0500, Jon Masters wrote:
    >> On Tue, 2010-02-02 at 06:35 -0500, Jon Masters wrote:
    >>
    >>> I think there's something more fundamental going on here.
    >> What happens is the conntrack code attempts to free
    >> nf_conntrack_untracked back into the SL[U]B cache from which it
    >> allocates other ct's. There's just one problem...that's a static struct
    >> not from the cache. So, this is why we end up with the SLAB being
    >> corrupted and the address immediately following the
    >> nf_conntrack_untracked being corrupted.
    >>
    >> I shoved some debug comments into the destroy code to see if we were
    >> trying to free nf_conntrack_untracked, and bingo. I have shoved a panic
    >> in there now, will send you a backtrace.
    >
    > So we attach after starting a VM due to icmpv6_error setting the ct in
    > some incoming skb to the "untracked" catchall one. Then we panic when I
    > force a panic if attempting to free the nf_conntrack_untracked static
    > struct with this backtrace:
    >
    > #5 0xffffffff81455884 in panic (
    > fmt=0xffffffff81ec51e0 "JCM: nf_conntrack_destroy: trying to destroy
    > nf_conntrack_untracked!\n")
    > at kernel/panic.c:73
    > #6 0xffffffff813d266c in nf_conntrack_destroy (nfct=<value optimized
    > out>) at net/netfilter/core.c:244
    > #7 0xffffffff813abd97 in nf_conntrack_put (skb=0xffff880223b8b700) at
    > include/linux/skbuff.h:1924
    > #8 skb_release_head_state (skb=0xffff880223b8b700) at
    > net/core/skbuff.c:402
    > #9 0xffffffff813abaf9 in skb_release_all (skb=0xffff880223b8b700) at
    > net/core/skbuff.c:420
    > #10 __kfree_skb (skb=0xffff880223b8b700) at net/core/skbuff.c:435
    > #11 0xffffffff813abbfe in kfree_skb (skb=0xffff880223b8b700) at
    > net/core/skbuff.c:456
    >
    > Could you please add (or recommend for me to test) some logic to catch
    > attempts to free the nf_conntrack_untracked and prevent it? Also, maybe
    > in the init_net code you could remove the re-initialization of the
    > untracked conntrack each time a namespace is created?

    Ah nice catch, that seems to be the problem. When the untracked
    conntrack is already attached to an skb and thus has refcnt > 1
    and we re-initalize the refcnt, it will get freed.

    The question is whether the ct_net pointer of the untracked conntrack
    is actually required. If so, we need one instance per namespace,
    otherwise we can just move initialization and cleanup to the init_net
    init/cleanup functions. Alexey, do you happen to know this?



    \
     
     \ /
      Last update: 2010-02-02 18:07    [W:0.035 / U:88.996 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site