On Mon, Jun 22, 2020 at 10:10:10AM -0700, David Wilder wrote: > A crash happened on ppc64le when running ltp network tests triggered by > "rmmod iptable_mangle". > > See previous discussion in this thread: > https://lists.openwall.net/netdev/2020/06/03/161 . > > In the crash I found in iptable_mangle_hook() that > state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference. > net->ipv4.iptable_mangle is set to NULL in iptable_mangle_net_exit() and > called when ip_mangle modules is unloaded. A rmmod task was found running in > the crash dump. A 2nd crash showed the same problem when running "rmmod > iptable_filter" (net->ipv4.iptable_filter=NULL). > > To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will > un-register the underlying hook and exit would do the table freeing. The > netns core does an unconditional synchronize_rcu after the pre_exit hooks > insuring no packets are in flight that have picked up the pointer before > completing the un-register. > > These patches include changes for both iptables and ip6tables. > > We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a loop > for 72 hours.
Series applied, thanks.
