Jon Masters wrote: > On Tue, 2010-02-02 at 11:46 -0500, Jon Masters wrote: >> On Tue, 2010-02-02 at 06:35 -0500, Jon Masters wrote: >> >>> I think there's something more fundamental going on here. >> What happens is the conntrack code attempts to free >> nf_conntrack_untracked back into the SL[U]B cache from which it >> allocates other ct's. There's just one problem...that's a static struct >> not from the cache. So, this is why we end up with the SLAB being >> corrupted and the address immediately following the >> nf_conntrack_untracked being corrupted. >> >> I shoved some debug comments into the destroy code to see if we were >> trying to free nf_conntrack_untracked, and bingo. I have shoved a panic >> in there now, will send you a backtrace. > > So we attach after starting a VM due to icmpv6_error setting the ct in > some incoming skb to the "untracked" catchall one. Then we panic when I > force a panic if attempting to free the nf_conntrack_untracked static > struct with this backtrace: > > #5 0xffffffff81455884 in panic ( > fmt=0xffffffff81ec51e0 "JCM: nf_conntrack_destroy: trying to destroy > nf_conntrack_untracked!\n") > at kernel/panic.c:73 > #6 0xffffffff813d266c in nf_conntrack_destroy (nfct=<value optimized > out>) at net/netfilter/core.c:244 > #7 0xffffffff813abd97 in nf_conntrack_put (skb=0xffff880223b8b700) at > include/linux/skbuff.h:1924 > #8 skb_release_head_state (skb=0xffff880223b8b700) at > net/core/skbuff.c:402 > #9 0xffffffff813abaf9 in skb_release_all (skb=0xffff880223b8b700) at > net/core/skbuff.c:420 > #10 __kfree_skb (skb=0xffff880223b8b700) at net/core/skbuff.c:435 > #11 0xffffffff813abbfe in kfree_skb (skb=0xffff880223b8b700) at > net/core/skbuff.c:456 > > Could you please add (or recommend for me to test) some logic to catch > attempts to free the nf_conntrack_untracked and prevent it? Also, maybe > in the init_net code you could remove the re-initialization of the > untracked conntrack each time a namespace is created? Ah nice catch, that seems to be the problem. When the untracked conntrack is already attached to an skb and thus has refcnt > 1 and we re-initalize the refcnt, it will get freed. The question is whether the ct_net pointer of the untracked conntrack is actually required. If so, we need one instance per namespace, otherwise we can just move initialization and cleanup to the init_net init/cleanup functions. Alexey, do you happen to know this? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
