* kernel panic TPROXY , vanilla 4.7.1 @ 2016-08-17 14:31 Denys Fedoryshchenko 2016-08-17 15:42 ` Eric Dumazet 0 siblings, 1 reply; 7+ messages in thread From: Denys Fedoryshchenko @ 2016-08-17 14:31 UTC (permalink / raw) To: Linux Kernel Network Developers Hi! Tried to run squid on latest kernel, and hit a panic Sometimes it just shows warning in dmesg (but doesnt work properly) [ 75.701666] IPv4: Attempt to release TCP socket in state 10 ffff88102d430780 [ 83.866974] squid (2700) used greatest stack depth: 12912 bytes left [ 87.506644] IPv4: Attempt to release TCP socket in state 10 ffff880078a48780 [ 114.704295] IPv4: Attempt to release TCP socket in state 10 ffff881029f8ad00 I cannot catch yet oops/panic message, netconsole not working. After triggering warning message 3 times, i am unable to run squid anymore (without reboot), and in netstat it doesnt show port running. firewall is: *mangle -A PREROUTING -p tcp -m socket -j DIVERT -A PREROUTING -p tcp -m tcp --dport 80 -i eno1 -j TPROXY --on-port 3129 --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1 -A DIVERT -j MARK --set-xmark 0x1/0xffffffff -A DIVERT -j ACCEPT routing ip rule add fwmark 1 lookup 100 ip route add local default dev eno1 table 100 squid config is default with tproxy option http_port 3129 tproxy ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kernel panic TPROXY , vanilla 4.7.1 2016-08-17 14:31 kernel panic TPROXY , vanilla 4.7.1 Denys Fedoryshchenko @ 2016-08-17 15:42 ` Eric Dumazet 2016-08-17 16:04 ` Eric Dumazet 0 siblings, 1 reply; 7+ messages in thread From: Eric Dumazet @ 2016-08-17 15:42 UTC (permalink / raw) To: Denys Fedoryshchenko; +Cc: Linux Kernel Network Developers On Wed, 2016-08-17 at 17:31 +0300, Denys Fedoryshchenko wrote: > Hi! > > Tried to run squid on latest kernel, and hit a panic > Sometimes it just shows warning in dmesg (but doesnt work properly) > [ 75.701666] IPv4: Attempt to release TCP socket in state 10 > ffff88102d430780 > [ 83.866974] squid (2700) used greatest stack depth: 12912 bytes left > [ 87.506644] IPv4: Attempt to release TCP socket in state 10 > ffff880078a48780 > [ 114.704295] IPv4: Attempt to release TCP socket in state 10 > ffff881029f8ad00 > > I cannot catch yet oops/panic message, netconsole not working. > > After triggering warning message 3 times, i am unable to run squid > anymore (without reboot), and in netstat it doesnt show port running. > > firewall is: > *mangle > -A PREROUTING -p tcp -m socket -j DIVERT > -A PREROUTING -p tcp -m tcp --dport 80 -i eno1 -j TPROXY --on-port 3129 > --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1 > -A DIVERT -j MARK --set-xmark 0x1/0xffffffff > -A DIVERT -j ACCEPT > > routing > ip rule add fwmark 1 lookup 100 > ip route add local default dev eno1 table 100 > > > squid config is default with tproxy option > http_port 3129 tproxy > Hmppff... sorry for this, I will send a fix. Thanks for the report ! ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kernel panic TPROXY , vanilla 4.7.1 2016-08-17 15:42 ` Eric Dumazet @ 2016-08-17 16:04 ` Eric Dumazet 2016-08-17 16:44 ` Denys Fedoryshchenko 0 siblings, 1 reply; 7+ messages in thread From: Eric Dumazet @ 2016-08-17 16:04 UTC (permalink / raw) To: Denys Fedoryshchenko; +Cc: Linux Kernel Network Developers, netfilter-devel On Wed, 2016-08-17 at 08:42 -0700, Eric Dumazet wrote: > On Wed, 2016-08-17 at 17:31 +0300, Denys Fedoryshchenko wrote: > > Hi! > > > > Tried to run squid on latest kernel, and hit a panic > > Sometimes it just shows warning in dmesg (but doesnt work properly) > > [ 75.701666] IPv4: Attempt to release TCP socket in state 10 > > ffff88102d430780 > > [ 83.866974] squid (2700) used greatest stack depth: 12912 bytes left > > [ 87.506644] IPv4: Attempt to release TCP socket in state 10 > > ffff880078a48780 > > [ 114.704295] IPv4: Attempt to release TCP socket in state 10 > > ffff881029f8ad00 > > > > I cannot catch yet oops/panic message, netconsole not working. > > > > After triggering warning message 3 times, i am unable to run squid > > anymore (without reboot), and in netstat it doesnt show port running. > > > > firewall is: > > *mangle > > -A PREROUTING -p tcp -m socket -j DIVERT > > -A PREROUTING -p tcp -m tcp --dport 80 -i eno1 -j TPROXY --on-port 3129 > > --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1 > > -A DIVERT -j MARK --set-xmark 0x1/0xffffffff > > -A DIVERT -j ACCEPT > > > > routing > > ip rule add fwmark 1 lookup 100 > > ip route add local default dev eno1 table 100 > > > > > > squid config is default with tproxy option > > http_port 3129 tproxy > > > > Hmppff... sorry for this, I will send a fix. > > Thanks for the report ! > Could you try the following ? Thanks ! net/netfilter/xt_TPROXY.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 7f4414d26a66..663c4c3c9072 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp, daddr, dport, in->ifindex); + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) + sk = NULL; /* NOTE: we return listeners even if bound to * 0.0.0.0, those are filtered out in * xt_socket, since xt_TPROXY needs 0 bound @@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp, daddr, ntohs(dport), in->ifindex); + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) + sk = NULL; /* NOTE: we return listeners even if bound to * 0.0.0.0, those are filtered out in * xt_socket, since xt_TPROXY needs 0 bound ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: kernel panic TPROXY , vanilla 4.7.1 2016-08-17 16:04 ` Eric Dumazet @ 2016-08-17 16:44 ` Denys Fedoryshchenko 2016-08-17 16:48 ` Eric Dumazet 2016-08-17 16:56 ` [PATCH net] netfilter: tproxy: properly refcount tcp listeners Eric Dumazet 0 siblings, 2 replies; 7+ messages in thread From: Denys Fedoryshchenko @ 2016-08-17 16:44 UTC (permalink / raw) To: Eric Dumazet; +Cc: Linux Kernel Network Developers, netfilter-devel On 2016-08-17 19:04, Eric Dumazet wrote: > On Wed, 2016-08-17 at 08:42 -0700, Eric Dumazet wrote: >> On Wed, 2016-08-17 at 17:31 +0300, Denys Fedoryshchenko wrote: >> > Hi! >> > >> > Tried to run squid on latest kernel, and hit a panic >> > Sometimes it just shows warning in dmesg (but doesnt work properly) >> > [ 75.701666] IPv4: Attempt to release TCP socket in state 10 >> > ffff88102d430780 >> > [ 83.866974] squid (2700) used greatest stack depth: 12912 bytes left >> > [ 87.506644] IPv4: Attempt to release TCP socket in state 10 >> > ffff880078a48780 >> > [ 114.704295] IPv4: Attempt to release TCP socket in state 10 >> > ffff881029f8ad00 >> > >> > I cannot catch yet oops/panic message, netconsole not working. >> > >> > After triggering warning message 3 times, i am unable to run squid >> > anymore (without reboot), and in netstat it doesnt show port running. >> > >> > firewall is: >> > *mangle >> > -A PREROUTING -p tcp -m socket -j DIVERT >> > -A PREROUTING -p tcp -m tcp --dport 80 -i eno1 -j TPROXY --on-port 3129 >> > --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1 >> > -A DIVERT -j MARK --set-xmark 0x1/0xffffffff >> > -A DIVERT -j ACCEPT >> > >> > routing >> > ip rule add fwmark 1 lookup 100 >> > ip route add local default dev eno1 table 100 >> > >> > >> > squid config is default with tproxy option >> > http_port 3129 tproxy >> > >> >> Hmppff... sorry for this, I will send a fix. >> >> Thanks for the report ! >> > > > Could you try the following ? > > Thanks ! > > net/netfilter/xt_TPROXY.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c > index 7f4414d26a66..663c4c3c9072 100644 > --- a/net/netfilter/xt_TPROXY.c > +++ b/net/netfilter/xt_TPROXY.c > @@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct > sk_buff *skb, void *hp, > daddr, dport, > in->ifindex); > > + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) > + sk = NULL; > /* NOTE: we return listeners even if bound to > * 0.0.0.0, those are filtered out in > * xt_socket, since xt_TPROXY needs 0 bound > @@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct > sk_buff *skb, int thoff, void *hp, > daddr, ntohs(dport), > in->ifindex); > > + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) > + sk = NULL; > /* NOTE: we return listeners even if bound to > * 0.0.0.0, those are filtered out in > * xt_socket, since xt_TPROXY needs 0 bound Yes, everything fine after patch! Thanks a lot ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kernel panic TPROXY , vanilla 4.7.1 2016-08-17 16:44 ` Denys Fedoryshchenko @ 2016-08-17 16:48 ` Eric Dumazet 2016-08-17 16:56 ` [PATCH net] netfilter: tproxy: properly refcount tcp listeners Eric Dumazet 1 sibling, 0 replies; 7+ messages in thread From: Eric Dumazet @ 2016-08-17 16:48 UTC (permalink / raw) To: Denys Fedoryshchenko; +Cc: Linux Kernel Network Developers, netfilter-devel On Wed, 2016-08-17 at 19:44 +0300, Denys Fedoryshchenko wrote: > Yes, everything fine after patch! > Thanks a lot Perfect, thanks for testing, I am sending the official patch. ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net] netfilter: tproxy: properly refcount tcp listeners 2016-08-17 16:44 ` Denys Fedoryshchenko 2016-08-17 16:48 ` Eric Dumazet @ 2016-08-17 16:56 ` Eric Dumazet 2016-08-17 22:51 ` Pablo Neira Ayuso 1 sibling, 1 reply; 7+ messages in thread From: Eric Dumazet @ 2016-08-17 16:56 UTC (permalink / raw) To: Denys Fedoryshchenko, Pablo Neira Ayuso, David Miller Cc: Linux Kernel Network Developers, netfilter-devel From: Eric Dumazet <edumazet@google.com> inet_lookup_listener() and inet6_lookup_listener() no longer take a reference on the found listener. This minimal patch adds back the refcounting, but we might do this differently in net-next later. Fixes: 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") Reported-and-tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> --- Note: bug added in 4.7, stable candidate. net/netfilter/xt_TPROXY.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 7f4414d26a66..663c4c3c9072 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp, daddr, dport, in->ifindex); + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) + sk = NULL; /* NOTE: we return listeners even if bound to * 0.0.0.0, those are filtered out in * xt_socket, since xt_TPROXY needs 0 bound @@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp, daddr, ntohs(dport), in->ifindex); + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) + sk = NULL; /* NOTE: we return listeners even if bound to * 0.0.0.0, those are filtered out in * xt_socket, since xt_TPROXY needs 0 bound ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net] netfilter: tproxy: properly refcount tcp listeners 2016-08-17 16:56 ` [PATCH net] netfilter: tproxy: properly refcount tcp listeners Eric Dumazet @ 2016-08-17 22:51 ` Pablo Neira Ayuso 0 siblings, 0 replies; 7+ messages in thread From: Pablo Neira Ayuso @ 2016-08-17 22:51 UTC (permalink / raw) To: Eric Dumazet Cc: Denys Fedoryshchenko, David Miller, Linux Kernel Network Developers, netfilter-devel On Wed, Aug 17, 2016 at 09:56:46AM -0700, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > inet_lookup_listener() and inet6_lookup_listener() no longer > take a reference on the found listener. > > This minimal patch adds back the refcounting, but we might do > this differently in net-next later. Applied, thanks Eric! ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-08-17 22:51 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2016-08-17 14:31 kernel panic TPROXY , vanilla 4.7.1 Denys Fedoryshchenko 2016-08-17 15:42 ` Eric Dumazet 2016-08-17 16:04 ` Eric Dumazet 2016-08-17 16:44 ` Denys Fedoryshchenko 2016-08-17 16:48 ` Eric Dumazet 2016-08-17 16:56 ` [PATCH net] netfilter: tproxy: properly refcount tcp listeners Eric Dumazet 2016-08-17 22:51 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).