On Tue, 2015-11-24 at 16:49 +0100, Arturo Borrero Gonzalez wrote: > Source: linux > Version: 4.2.6-1 > Severity: normal > > Dear Maintainer, > > thanks for your work in the linux kernel. > > I'm experimenting reports like this: > > [mar nov 24 16:38:16 2015] ------------[ cut here ]------------ > [mar nov 24 16:38:16 2015] WARNING: CPU: 1 PID: 22224 at > /build/linux-CrHvZ_/linux-4.2.6/net/netlink/af_netlink.c:946 > netlink_sock_destruct+0x103/0x140() > [mar nov 24 16:38:16 2015] Modules linked in: nft_nat nft_chain_nat_ipv4 > nf_nat_ipv4 nf_nat nft_log fuse uas usb_storage nft_counter nf_conntrack_ipv6 > nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_meta > nft_hash nft_rbtree nfnetlink_log nf_tables_inet nf_tables_ipv6 > nf_tables_ipv4 nf_tables nfnetlink nouveau snd_hda_codec_idt > snd_hda_codec_generic mxm_wmi wmi video ttm drm_kms_helper drm iTCO_wdt > i2c_algo_bit iTCO_vendor_support coretemp kvm_intel lpc_ich kvm snd_hda_intel > mfd_core i2c_i801 snd_hda_codec evdev snd_hda_core pcspkr psmouse serio_raw > snd_hwdep snd_pcm sg rng_core tpm_tis tpm 8250_fintek shpchp button snd_timer > snd soundcore acpi_cpufreq processor thermal_sys parport_pc ppdev lp parport > autofs4 ext4 crc16 mbcache jbd2 dm_mod sr_mod cdrom sd_mod ata_generic floppy > ata_piix e100 > [mar nov 24 16:38:16 2015] mii libata scsi_mod ehci_pci uhci_hcd ehci_hcd > usbcore usb_common > [mar nov 24 16:38:16 2015] CPU: 1 PID: 22224 Comm: bash Tainted: G W > 4.2.0-1-amd64 #1 Debian 4.2.6-1 [...] > I can reproduce the issue: > > % sudo ip netns add test > % sudo ip netns exec test nft -f test.nft > % sudo ip netns del test > > Find attached the test.nft file.
I can also reproduce this warning with Linux 4.3. I was also able to
simplify your sample quite a lot and still reproduce it:
--- BEGIN ---
flush ruleset
table ip nat {
chain postrouting {
ip saddr 192.168.5.0/24 snat 1.1.1.1
}
}
table inet inet-filter {
chain input {
ct state new accept
}
chain forward {
type filter hook forward priority 0; policy drop;
ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp
dport 22 counter accept
ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp
dport 22 counter accept
ip saddr {1.1.1.1, 2.2.2.2} ip daddr {2.3.4.5, 2.3.4.6} tcp
dport 22 counter accept
counter accept
}
}
--- END ---
I'm cc'ing this to the netfilter developers so they can investigate
this.
Ben.
--
Ben Hutchings
Unix is many things to many people,
but it's never been everything to anybody.
signature.asc
Description: This is a digitally signed message part
