On Mon, Jun 22, 2020 at 10:10:10AM -0700, David Wilder wrote: > A crash happened on ppc64le when running ltp network tests triggered by "rmmod iptable_mangle". > > See previous discussion in this thread: https://lists.openwall.net/netdev/2020/06/03/161 . > > In the crash I found in iptable_mangle_hook() that state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference. net->ipv4.iptable_mangle is set to NULL in iptable_mangle_net_exit() and called when ip_mangle modules is unloaded. A rmmod task was found running in the crash dump. A 2nd crash showed the same problem when running "rmmod iptable_filter" (net->ipv4.iptable_filter=NULL). > > To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will un-register the underlying hook and exit would do the table freeing. The netns core does an unconditional synchronize_rcu after the pre_exit hooks insuring no packets are in flight that have picked up the pointer before completing the un-register. > > These patches include changes for both iptables and ip6tables. > > We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a loop for 72 hours. Series applied, thanks.
