netdev - Re: soft lockup with conntrackd / keepalived / VLAN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 06 Jul 2010 13:56:41 -0600
From:	Adam Gundy <arg@...erscience.com>
To:	netdev@...r.kernel.org
Subject: Re: soft lockup with conntrackd / keepalived / VLAN

Adam Gundy wrote:
> I've built a pair of router boxes which are using keepalived and 
> conntrackd to provide a redundant router setup. we're also using a 
> single 802.1Q VLAN on the box.
> 
> occasionally, the box will lockup for 5 minutes, during which time 
> routed traffic is extremely delayed (2 or 3 second ping times). 
> initially, there were no log messages about the lockup. we switched from 
> using an internal nvidia (forcedeth) NIC in the belief that it may have 
> been causing the problem.. however: with the new gigabit NICs, we still 
> see the hangs, but we also get this in the kernel log:

> PS: this is a Ubuntu Lucid kernel - 2.6.32. I'm working on a stock 
> kernel to see if it still happens..

the issue appears to be IPSEC. pings across an IPSEC tunnel get slower and 
slower until the 'five minute fit', then ALL pings (IPSEC or not), plus the 
machine itself are extremely slow or non-responsive.

this behavior is also visible with a stock 2.6.32.15 kernel, but not 
reproducible with 2.6.33.5.

it looks like there were some IPSEC locking changes between those two kernels, 
but I couldn't find any obvious bug reports with similar symptoms..

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html