On 07/09/2018 04:43 AM, Florian Westphal wrote:
> Eric Dumazet reports:
> Here is a reproducer of an annoying bug detected by syzkaller on our
> production kernel
> [..]
> ./b78305423 enable_conntrack
> Then :
> sleep 60
> dmesg | tail -10
> [ 171.599093] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
> [ 181.631024] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
> [ 191.687076] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
> [ 201.703037] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
> [ 211.711072] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
> [ 221.959070] unregister_netdevice: waiting for lo to become free. Usage
> count = 2
>
> Reproducer sends ipv6 fragment that hits nfct defrag via LOCAL_OUT hook.
> skb gets queued until frag timer expiry -- 1 minute.
>
> Normally nf_conntrack_reasm gets called during prerouting, so skb has
> no dst yet which might explain why this wasn't spotted earlier.
>
> Reported-by: Eric Dumazet <[email protected]>
> Reported-by: John Sperbeck <[email protected]>
> Signed-off-by: Florian Westphal <[email protected]>
Tested-by: Eric Dumazet <[email protected]>
Reported-by: syzbot <[email protected]>
Thanks !
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
