Re: panic on rmmod of nf_conntrack_irc

[Patrick McHardy]

Mariusz Kozlowski wrote:

        Recent kernels (i.e. 2.6.30-rc1) will panic while doing rmmod of 
nf_conntrack_irc.

(gdb) l *(nf_conntrack_helper_unregister+0x158)
0x4f8 is in nf_conntrack_helper_unregister 
(/home/mako/linux/lkt/sources/linux-2.6/include/net/netfilter/nf_conntrack.h:133).
128     };
129     
130     static inline struct nf_conn *
131     nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
132     {
133             return container_of(hash, struct nf_conn,
134                                 tuplehash[hash->tuple.dst.dir]);
135     }
136     
137     static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct)


I bisected it down to

    netfilter: nf_conntrack: use SLAB_DESTROY_BY_RCU and get rid of call_rcu()

Thanks for the report. Does this patch fix it?


diff --git a/net/netfilter/nf_conntrack_helper.c 
b/net/netfilter/nf_conntrack_helper.c
index 30b8e90..0fa5a42 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -176,7 +176,7 @@ static void __nf_conntrack_helper_unregister(struct 
nf_conntrack_helper *me,
        }
 
        /* Get rid of expecteds, set helpers to NULL. */
-       hlist_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
+       hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                unhelp(h, me);
        for (i = 0; i < nf_conntrack_htable_size; i++) {
                hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)