• Liping Zhang's avatar
    netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize · fefa9267
    Liping Zhang authored
    If nf_conntrack_htable_size was adjusted by the user during the ct
    dump operation, we may invoke nf_ct_put twice for the same ct, i.e.
    the "last" ct. This will cause the ct will be freed but still linked
    in hash buckets.
    It's very easy to reproduce the problem by the following commands:
      # while : ; do
      echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
      # while : ; do
      conntrack -L
      # iperf -s &
      # iperf -c -P 60 -t 36000
    After a while, the system will hang like this:
      NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184]
      NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382]
    So at last if we find cb->args[1] is equal to "last", this means hash
    resize happened, then we can set cb->args[1] to 0 to fix the above
    Fixes: d205dc40 ("[NETFILTER]: ctnetlink: fix deadlock in table dumping")
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
nf_conntrack_netlink.c 83.8 KB