Your message dated Tue, 15 Jan 2019 11:57:18 +0100 with message-id <[email protected]> and subject line Re: [pkg-netfilter-team] Bug#919325: iptables -nvL consumes 100% of CPU and hogs memory with kernel 5.0-rc2 has caused the Debian Bug report #919325, regarding iptables -nvL consumes 100% of CPU and hogs memory with kernel 5.0-rc2 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 919325: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919325 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: iptables Version: 1.8.2-3 Severity: important Dear Maintainer, for now I am rating this important. If it happens for many users it may have a higher severity. It may however also be a kernel issue, as it happened after upgrading to self-compiled 5.0-rc2. I upgraded to self-compiled 5.0-rc2 today and found the machine to be slow after startup. I saw iptables consuming 100% CPU, it only responded to SIGKILL. It got restarted several times, probably by some systemd service. Then I started 'iptables -nvL' manually. And I got this: % strace -p 5748 [… tons more, in what appeared an endless loop …] recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=372, type=0xa06 /* NLMSG_??? */, flags=NLM_F_MULTI|0x800, seq=0, pid=5748}, "\x02\x00\x00\x11\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\x0c\x00\x03\x00"...}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 372 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=372, type=0xa06 /* NLMSG_??? */, flags=NLM_F_MULTI|0x800, seq=0, pid=5748}, "\x02\x00\x00\x11\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\x0c\x00\x03\x00"...}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 372 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=372, type=0xa06 /* NLMSG_??? */, flags=NLM_F_MULTI|0x800, seq=0, pid=5748}, "\x02\x00\x00\x11\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\x0c\x00\x03\x00"...}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 372 recvmsg(3, ^C{msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=372, type=0xa06 /* NLMSG_??? */, flags=NLM_F_MULTI|0x800, seq=0, pid=5748}, "\x02\x00\x00\x11\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\x0c\x00\x03\x00"...}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 372 strace: Process 5748 detached and this (output from atop): PID TID MINFLT MAJFLT VSTEXT VSLIBS VDATA VSTACK VSIZE RSIZE PSIZE VGROW RGROW SWAPSZ RUID EUID MEM CMD 1/16 11575 - 61552 0 152K 2324K 5.0G 132K 5.1G 5.1G 0K 240.4M 240.5M 0K root root 33% iptables I had it growing till 10 GiB before I stopped it by SIGKILL to prevent excessive swapping. I will attach kernel configuration. That is all I am willing to spend time on for now before going to sleep. I will however reboot with older 4.20 kernel to see whether it is kernel related. Thanks, Martin -- System Information: Debian Release: buster/sid APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'unstable'), (200, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.0.0-rc2-tp520 (SMP w/4 CPU cores; PREEMPT) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages iptables depends on: ii libc6 2.28-5 ii libip4tc0 1.8.2-3 ii libip6tc0 1.8.2-3 ii libiptc0 1.8.2-3 ii libmnl0 1.0.4-2 ii libnetfilter-conntrack3 1.0.7-1 ii libnfnetlink0 1.0.1-3+b1 ii libnftnl11 1.1.2-2 ii libxtables12 1.8.2-3 Versions of packages iptables recommends: ii nftables 0.9.0-2 Versions of packages iptables suggests: ii kmod 25-2 -- no debconf information
--- End Message ---
--- Begin Message ---Control: reassign -1 linux Control: tags -1 + upstream patch On 1/14/19 11:55 PM, Martin Steigerwald wrote: > I asked on LKML using similar subject about it. Not yet visible on > > https://lore.kernel.org/lkml/ > > Thanks, > When reassigning the bug to the kernel, I noticed there is no linux v5.0-rc2 in Debian yet. So closing this bug now, since no software in the Debian archive is affected by this. Anyway, for the record, there is an upstream patch to address this: http://patchwork.ozlabs.org/patch/1024772/ ("netfilter: nf_tables: Fix for endless loop when dumping ruleset"). Thanks for testing and reporting! :-)
--- End Message ---
