From patchwork Sun Sep 2 22:53:05 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 181270 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6D11F2C0087 for ; Mon, 3 Sep 2012 08:53:15 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754864Ab2IBWxN (ORCPT ); Sun, 2 Sep 2012 18:53:13 -0400 Received: from mail-wi0-f172.google.com ([209.85.212.172]:46628 "EHLO mail-wi0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754788Ab2IBWxM (ORCPT ); Sun, 2 Sep 2012 18:53:12 -0400 Received: by wicr5 with SMTP id r5so3495278wic.1 for ; Sun, 02 Sep 2012 15:53:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; bh=HXWa9hlh4tpiqDLtb4+VSDUFz4cy+6IdC+GUUjKYEww=; b=xox31FBMMOd9upLQy63fijKhe4B+f6b/S3+h42gJ8+4HuqHMRvvJFy9j8wLkMTdNuP KR5YQcIhheU2UrOfMPVxzjBDkgaxmZRfWYYKRiWiaYDcC1PDvAtCNe2p5v2ipkJMUPib GZDPtH1ST0BV/i8/JKVTYDRxHRK294hSTIU3hN6xkVHb1xMlnu45ayL6gZjmfHT4KOni MBnLsPvoPeNljw7izSqIFsd/T9yu8XHRR3xtDepYhuOYkBJvkxg8nJm4e4bNFlz4DKLo rpS8zADopo/GvQ7qDQU7di4gon3y1ShEk/z9MASJT3+AG0QZuA/l66jhsmU0d5qfirGO 4s0A== Received: by 10.216.234.100 with SMTP id r78mr8333027weq.107.1346626390351; Sun, 02 Sep 2012 15:53:10 -0700 (PDT) Received: from [192.168.1.37] (149.237.66.86.rev.sfr.net. [86.66.237.149]) by mx.google.com with ESMTPS id fb20sm23098925wid.1.2012.09.02.15.53.07 (version=SSLv3 cipher=OTHER); Sun, 02 Sep 2012 15:53:09 -0700 (PDT) Subject: Re: (ipt_log_packet, sb_add) 3.6.0-rc2 kernel panic - not syncing; Fatal exception in interrupt From: Eric Dumazet To: Florian Westphal Cc: Sami Farin , netdev@vger.kernel.org, e1000-devel@lists.sourceforge.net In-Reply-To: <20120902132834.GB7456@breakpoint.cc> References: <20120821134921.behn76vzvhczf3gc@m.safari.iki.fi> <20120902122008.jgdhwowbuke6by7h@m.safari.iki.fi> <20120902132834.GB7456@breakpoint.cc> Date: Mon, 03 Sep 2012 00:53:05 +0200 Message-ID: <1346626385.2563.44.camel@edumazet-glaptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet On Sun, 2012-09-02 at 15:28 +0200, Florian Westphal wrote: > Sami Farin wrote: > > I get this panic every 1-2 days. > > Also with 7a611e69b26069a511d9d5251c6a28af6c521121 (commit before 3.6.0-rc4). > > Could you please post iptables-save output? > My guess is you're using NFLOG in INPUT? > > If so, I bet its caused by the tcp early demux stuff. > Does that crash go away with ip_early_demux sysctl off? > > My guess is its assigning skb->sk with TIMEWAIT sockets, which > would explain the crash. Yes thats probably the reason. First I thought changing demux to not do the lookup of TIMEWAIT slot in __inet_lookup_established(), then it sounds not optimal to redo the full lookup for ESTABLISHED sockets later in TCP stack. So it seems we should fix xt_LOG instead Thanks Florian ! [PATCH] xt_LOG: take care of timewait sockets Sami Farin reported crashes in xt_LOG because it assumes skb->sk is a full blown socket. But with TCP early demux, we can have skb->sk pointing to a timewait socket. Diagnosed-by: Florian Westphal Reported-by: Sami Farin Signed-off-by: Eric Dumazet --- net/netfilter/xt_LOG.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c index ff5f75f..2a4f969 100644 --- a/net/netfilter/xt_LOG.c +++ b/net/netfilter/xt_LOG.c @@ -145,6 +145,19 @@ static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb, return 0; } +static void dump_sk_uid_gid(struct sbuff *m, struct sock *sk) +{ + if (!sk || sk->sk_state == TCP_TIME_WAIT) + return; + + read_lock_bh(&sk->sk_callback_lock); + if (sk->sk_socket && sk->sk_socket->file) + sb_add(m, "UID=%u GID=%u ", + sk->sk_socket->file->f_cred->fsuid, + sk->sk_socket->file->f_cred->fsgid); + read_unlock_bh(&sk->sk_callback_lock); +} + /* One level of recursion won't kill us */ static void dump_ipv4_packet(struct sbuff *m, const struct nf_loginfo *info, @@ -361,14 +374,8 @@ static void dump_ipv4_packet(struct sbuff *m, } /* Max length: 15 "UID=4294967295 " */ - if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) { - read_lock_bh(&skb->sk->sk_callback_lock); - if (skb->sk->sk_socket && skb->sk->sk_socket->file) - sb_add(m, "UID=%u GID=%u ", - skb->sk->sk_socket->file->f_cred->fsuid, - skb->sk->sk_socket->file->f_cred->fsgid); - read_unlock_bh(&skb->sk->sk_callback_lock); - } + if ((logflags & XT_LOG_UID) && !iphoff) + dump_sk_uid_gid(m, skb->sk); /* Max length: 16 "MARK=0xFFFFFFFF " */ if (!iphoff && skb->mark) @@ -717,14 +724,8 @@ static void dump_ipv6_packet(struct sbuff *m, } /* Max length: 15 "UID=4294967295 " */ - if ((logflags & XT_LOG_UID) && recurse && skb->sk) { - read_lock_bh(&skb->sk->sk_callback_lock); - if (skb->sk->sk_socket && skb->sk->sk_socket->file) - sb_add(m, "UID=%u GID=%u ", - skb->sk->sk_socket->file->f_cred->fsuid, - skb->sk->sk_socket->file->f_cred->fsgid); - read_unlock_bh(&skb->sk->sk_callback_lock); - } + if ((logflags & XT_LOG_UID) && recurse) + dump_sk_uid_gid(m, skb->sk); /* Max length: 16 "MARK=0xFFFFFFFF " */ if (!recurse && skb->mark)