Am 14.02.2011 16:50, schrieb Eric Dumazet:
> Le lundi 14 fÃvrier 2011 Ã 16:18 +0100, Jan Engelhardt a Ãcrit :
>> On Monday 2011-02-14 16:11, Eric Dumazet wrote:
>>
>>> Le lundi 14 fÃvrier 2011 Ã 16:58 +0200, Avi Kivity a Ãcrit :
>>>> We see severe memory corruption in kvm while used in conjunction with
>>>> bridge/netfilter. Enabling slab debugging points the finger at a
>>>> netfilter chain invoked from the bridge code.
>>>>
>>>> Can someone take a look?
>>>>
>>>> https://bugzilla.kernel.org/show_bug.cgi?id=27052
>>
>> Maybe looks familiar to https://lkml.org/lkml/2011/2/3/147
>
> Are you sure Jan ?
>
> IMHO it looks like in your case, a NULL ->hook() is called, from
> nf_iterate()
>
> BTW, list_for_each_continue_rcu() really should be converted to
> list_for_each_entry_continue_rcu()
>
> This is a bit ugly :
>
> list_for_each_continue_rcu(*i, head) {
> struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
>
> Also, I wonder if RCU rules are respected in nf_iterate().
> For example this line is really suspicious :
>
> *i = (*i)->prev;
Yeah, that definitely looks wrong. How about this instead?
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 1e00bf7..899b71c 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head,
/* Optimization: we don't need to hold module
reference here, since function can't sleep. --RR */
+repeat:
verdict = elem->hook(hook, skb, indev, outdev, okfn);
if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head,
#endif
if (verdict != NF_REPEAT)
return verdict;
- *i = (*i)->prev;
+ goto repeat;
}
}
return NF_ACCEPT;
