From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751455AbdGQOys (ORCPT ); Mon, 17 Jul 2017 10:54:48 -0400 Received: from mail-wr0-f178.google.com ([209.85.128.178]:34663 "EHLO mail-wr0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751280AbdGQOyr (ORCPT ); Mon, 17 Jul 2017 10:54:47 -0400 Subject: Re: 4.12 nf_conntrack_expect crash From: Jiri Slaby To: Pablo Neira Ayuso , fgao@48lvckh6395k16k5.yundunddos.com Cc: kadlec@blackhole.kfki.hu, Florian Westphal , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, Linux kernel mailing list References: <2194e012-5a89-54f0-db46-ff9ce6aa3953@suse.cz> Message-ID: <12e1fdf4-2936-d2a7-e537-1038fbf5b7a3@suse.cz> Date: Mon, 17 Jul 2017 16:54:43 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <2194e012-5a89-54f0-db46-ff9ce6aa3953@suse.cz> Content-Type: text/plain; charset=iso-8859-2 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 07/17/2017, 04:49 PM, Jiri Slaby wrote: > Hi, > > on my system, I see a crash in del_timer invoked in nf_conntrack_expect. > See the attached picture. > > I somehow suspect this commit: > > commit ec0e3f01114ad327112432a4da8840eb22fed577 > Author: Gao Feng > Date: Mon Mar 27 10:31:26 2017 +0800 > > netfilter: nf_ct_expect: Add nf_ct_remove_expect() > > > I am going to play with it (debug, try to revert, etc.) if you have no > better idea... This? --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) h = nf_ct_expect_dst_hash(net, &expect->tuple); hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { if (expect_matches(i, expect)) { - if (nf_ct_remove_expect(expect)) + if (nf_ct_remove_expect(i)) break; } else if (expect_clash(i, expect)) { ret = -EBUSY; > > thanks, > -- js suse labs