Lin Ming
9e33ce453f
ipvs: fix oops on NAT reply in br_nf context ...
IPVS should not reset skb->nf_bridge in FORWARD hook
by calling nf_reset for NAT replies. It triggers oops in
br_nf_forward_finish.
[ 579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[ 579.781669] IP: [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.781792] PGD 218f9067 PUD 0
[ 579.781865] Oops: 0000 [#1 ] SMP
[ 579.781945] CPU 0
[ 579.781983] Modules linked in:
[ 579.782047]
[ 579.782080]
[ 579.782114] Pid: 4644, comm: qemu Tainted: G W 3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard /30E8
[ 579.782300] RIP: 0010:[<ffffffff817b1ca5>] [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
[ 579.782455] RSP: 0018:ffff88007b003a98 EFLAGS: 00010287
[ 579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a
[ 579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00
[ 579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90
[ 579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02
[ 579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000
[ 579.783177] FS: 0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70
[ 579.783306] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b
[ 579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0
[ 579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)
[ 579.783919] Stack:
[ 579.783959] ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00
[ 579.784110] ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7
[ 579.784260] ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0
[ 579.784477] Call Trace:
[ 579.784523] <IRQ>
[ 579.784562]
[ 579.784603] [<ffffffff817b26c7>] br_nf_forward_ip+0x275/0x2c8
[ 579.784707] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.784797] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.784906] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.784995] [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
[ 579.785175] [<ffffffff8187fa95>] ? _raw_write_unlock_bh+0x19/0x1b
[ 579.785179] [<ffffffff817ac417>] __br_forward+0x97/0xa2
[ 579.785179] [<ffffffff817ad366>] br_handle_frame_finish+0x1a6/0x257
[ 579.785179] [<ffffffff817b2386>] br_nf_pre_routing_finish+0x26d/0x2cb
[ 579.785179] [<ffffffff817b2cf0>] br_nf_pre_routing+0x55d/0x5c1
[ 579.785179] [<ffffffff81704b58>] nf_iterate+0x47/0x7d
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
[ 579.785179] [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
[ 579.785179] [<ffffffff81551525>] ? sky2_poll+0xb35/0xb54
[ 579.785179] [<ffffffff817ad62a>] br_handle_frame+0x213/0x229
[ 579.785179] [<ffffffff817ad417>] ? br_handle_frame_finish+0x257/0x257
[ 579.785179] [<ffffffff816e3b47>] __netif_receive_skb+0x2b4/0x3f1
[ 579.785179] [<ffffffff816e69fc>] process_backlog+0x99/0x1e2
[ 579.785179] [<ffffffff816e6800>] net_rx_action+0xdf/0x242
[ 579.785179] [<ffffffff8107e8a8>] __do_softirq+0xc1/0x1e0
[ 579.785179] [<ffffffff8135a5ba>] ? trace_hardirqs_off_thunk+0x3a/0x6c
[ 579.785179] [<ffffffff8188812c>] call_softirq+0x1c/0x30
The steps to reproduce as follow,
1. On Host1, setup brige br0(192.168.1.106)
2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd
3. Start IPVS service on Host1
ipvsadm -A -t 192.168.1.106:80 -s rr
ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m
4. Run apache benchmark on Host2(192.168.1.101)
ab -n 1000 http://192.168.1.106/
ip_vs_reply4
ip_vs_out
handle_response
ip_vs_notrack
nf_reset()
{
skb->nf_bridge = NULL;
}
Actually, IPVS wants in this case just to replace nfct
with untracked version. So replace the nf_reset(skb) call
in ip_vs_notrack() with a nf_conntrack_put(skb->nfct) call.
Signed-off-by: Lin Ming <mlin@ss.pku.edu.cn>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-07-17 12:00:46 +02:00
2012-01-05 10:51:44 -06:00
2012-06-08 21:00:40 -03:00
2012-04-13 11:37:36 -04:00
2011-03-31 11:26:23 -03:00
2012-03-07 22:52:24 -08:00
2012-07-09 10:53:19 +02:00
2012-05-08 19:35:18 +02:00
2012-05-15 17:31:22 -04:00
2012-06-17 16:29:38 -07:00
2012-06-30 22:44:35 -07:00
2010-08-20 01:42:59 -07:00
2011-07-06 02:52:16 -07:00
2012-05-19 01:08:16 -04:00
2011-04-24 10:54:56 -07:00
2012-04-15 12:44:40 -04:00
2011-01-13 21:48:25 -08:00
2012-02-15 17:48:35 -05:00
2011-11-30 18:51:03 -05:00
2012-04-23 22:14:47 -04:00
2011-08-08 14:26:29 -04:00
2012-05-16 13:08:15 -04:00
2012-06-01 14:18:29 -04:00
2010-10-07 09:43:45 +02:00
2012-05-16 15:30:26 -04:00
2012-04-15 12:44:40 -04:00
2011-10-06 15:49:51 -04:00
2012-04-05 05:08:04 -04:00
2010-11-08 13:50:08 -08:00
2012-04-15 12:44:40 -04:00
2010-06-03 03:21:52 -07:00
2012-04-15 12:44:40 -04:00
2012-04-15 12:44:40 -04:00
2011-12-01 11:41:06 -05:00
2012-04-15 12:44:40 -04:00
2012-05-27 01:11:22 -04:00
2010-10-27 11:37:32 -07:00
2011-11-29 13:17:03 -05:00
2012-02-04 19:29:48 -05:00
2011-05-12 17:46:56 -04:00
2011-03-31 11:26:23 -03:00
2012-01-30 15:22:06 -05:00
2010-08-21 23:05:39 -07:00
2012-04-15 12:44:40 -04:00
2011-11-11 12:32:50 -05:00
2012-05-16 15:16:56 -04:00
2011-11-14 00:19:42 -05:00
2012-05-15 20:14:35 -04:00
2012-04-14 15:28:55 -04:00
2011-12-11 18:25:16 -05:00
2010-07-12 20:21:46 -07:00
2012-04-27 00:03:34 -04:00
2011-10-22 01:25:23 -04:00
2012-05-18 01:40:27 -04:00
2011-07-26 16:49:47 -07:00
2012-02-13 00:46:41 -05:00
2011-12-14 13:34:55 -05:00
2012-06-06 10:45:15 -07:00
2012-06-16 01:12:19 -07:00
2012-05-19 01:08:16 -04:00
2010-10-25 13:09:45 -07:00
2012-04-15 12:44:40 -04:00
2012-07-17 12:00:46 +02:00
2012-05-15 20:14:35 -04:00
2012-04-14 14:47:05 -04:00
2012-05-19 01:08:16 -04:00
2011-04-24 10:54:56 -07:00
2011-03-31 11:26:23 -03:00
2012-05-17 18:45:20 -04:00
2011-10-31 19:32:32 -04:00
2012-04-15 12:44:40 -04:00
2012-05-15 20:14:35 -04:00
2011-07-26 16:49:47 -07:00
2012-06-09 10:31:09 +02:00
2012-05-16 15:16:44 -04:00
2010-06-03 03:21:52 -07:00
2010-04-23 13:35:55 +09:00
2012-04-12 15:56:57 -04:00
2012-04-15 12:44:40 -04:00
2012-04-23 19:24:28 -04:00
2011-05-27 13:41:33 -04:00
2011-04-24 10:54:56 -07:00
2011-08-01 17:58:33 -07:00
2012-04-02 04:33:45 -04:00
2012-02-10 15:08:57 -05:00
2010-03-30 22:02:32 +09:00
2011-05-17 14:16:58 -04:00
2010-12-21 12:43:16 -08:00
2012-04-15 12:44:40 -04:00
2011-12-11 18:25:16 -05:00
2010-09-08 13:42:22 -07:00
2012-05-19 01:08:16 -04:00
2012-04-16 23:53:11 -04:00
2011-11-21 16:20:41 -05:00
2011-09-15 14:49:43 -04:00
2011-03-27 17:59:04 -07:00
2012-06-11 00:04:47 -07:00
2012-04-13 14:21:04 -04:00
2012-06-12 15:29:21 -07:00
2011-09-28 13:29:50 -04:00
2011-10-21 05:22:42 -04:00
2012-01-09 13:08:28 -08:00
2012-05-29 16:22:28 -07:00
2012-04-10 10:04:07 -07:00
2012-05-17 14:59:59 -04:00
2012-03-04 17:54:34 -05:00
2011-08-30 17:39:01 -04:00
2012-04-28 22:21:51 -04:00
2012-03-12 17:05:21 -07:00
2012-04-15 12:44:40 -04:00
2012-05-16 15:17:08 -04:00
2012-04-15 12:44:40 -04:00
2010-04-22 16:12:36 -07:00
2012-05-15 15:04:57 -04:00
9e33ce453f