linux-kernel - kernel BUG in ip_nat_helper_unregister at netfilter/ip_nat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ccbc91640609030716o221dad8as9278b2081a28c490@mail.gmail.com>
Date:	Sun, 3 Sep 2006 22:16:05 +0800
From:	"董董侃" <doublefacer007@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: kernel BUG in ip_nat_helper_unregister at netfilter/ip_nat_helper.c

Hi,
   I has found a bug that is caused by dead lock on ip_nat_ftp module
in linux kernel 2.4.27 on SMP machine.My workaround of testing is as following:
   I create a router by iptables ,FTP client and FTP server for testing.
   client machine ip: 192.168.1.3/32 ,gateway 192.168.1.10/32
   server machine ip: 192.168.2.3/32,gateway 192.168.2.10/32
   router machine with tow NICs,
       eth0:192.168.1.10/32
       eth1:192.168.2.10/32
Testing flow:
  on router:
  echo 1 > /proc/sys/net/ipv4/ip_forward
  modprobe ip_nat_ftp
  iptables -t nat -A POSTROUTING -s 192.168.1.3 -p tcp --dport 21
-o eth1 -j SNAT --to-source 192.168.2.10
  on client:
  I use a benchmark tool to create ftp sessions with the  remote
FTP server.In the session,includes ftp control connections and data
connections.The sending rate is about 500 sessions/10s.
  When the num of conntrack is up to 15000,I rmmod the ip_nat_ftp
and ip_conntrack _ftp modules by typing "modprobe -r ip_nat_ftp"
command and then the kernel is dead locked.
I think that the dead lock is caused by ip_conntrack_lock and
ip_nat_lock.When I rmmod the ip_nat_ftp module, the function flow is
as following:
ip_nat_helper_unregister->ip_ct_selective_cleanup->get_next_corpse(ip_conntrack_lock)
 ->kill_helper(ip_nat_lock)
But the kernel there is another flow is as following:
ip_nat_fn(ip_nat_lock)->ip_nat_setup_info->ip_conntrack_alter_reply(ip_conntrack_lock)

-- 
VGER BF report: U 0.502111
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/