linux-kernel - Re: Soft lockup on shutdown in nf_ct_iterate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45E1DD88.6080206@trash.net>
Date:	Sun, 25 Feb 2007 20:03:36 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Martin Josefsson <gandalf@...g.westbo.se>
CC:	Chuck Ebbert <cebbert@...hat.com>,
	netfilter-devel@...ts.netfilter.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: Soft lockup on shutdown in nf_ct_iterate_cleanup()

Martin Josefsson wrote:
> What about this case:
> 
> 1. Conntrack entry is created and placed on the unconfirmed list
> 2. The event cache bumps the refcount of the conntrack entry
> 3. module removal of ip_conntrack unregisters all hooks
> 4. packet is dropped by an iptables rule
> 5. packet is freed but we still have a refcount on the conntrack entry
> 
> Now there's no way to get that refcount to decrease as that only happens
> when the event cache receives another packet or the current packet makes
> it through the stack as you wrote above. And neither of this will happen
> since we unregistered the hooks providing the packets and dropped the
> packet.

The event cache is flushed on conntrack module unload after the hooks
have been unregistered, which should release all references.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/