lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 102/310] netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Liping Zhang <zlpnobody@gmail.com>


    [ Upstream commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1 ]

    If nf_conntrack_htable_size was adjusted by the user during the ct
    dump operation, we may invoke nf_ct_put twice for the same ct, i.e.
    the "last" ct. This will cause the ct will be freed but still linked
    in hash buckets.

    It's very easy to reproduce the problem by the following commands:
    # while : ; do
    echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
    done
    # while : ; do
    conntrack -L
    done
    # iperf -s 127.0.0.1 &
    # iperf -c 127.0.0.1 -P 60 -t 36000

    After a while, the system will hang like this:
    NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184]
    NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382]
    ...

    So at last if we find cb->args[1] is equal to "last", this means hash
    resize happened, then we can set cb->args[1] to 0 to fix the above
    issue.

    Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping")
    Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_conntrack_netlink.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/net/netfilter/nf_conntrack_netlink.c
    +++ b/net/netfilter/nf_conntrack_netlink.c
    @@ -890,8 +890,13 @@ restart:
    }
    out:
    local_bh_enable();
    - if (last)
    + if (last) {
    + /* nf ct hash resize happened, now clear the leftover. */
    + if ((struct nf_conn *)cb->args[1] == last)
    + cb->args[1] = 0;
    +
    nf_ct_put(last);
    + }

    while (i) {
    i--;

    \
     
     \ /
      Last update: 2018-04-11 21:55    [W:4.218 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site