Re: kernel panic trace, possible bug in the ebtables-brnf patch

On Saturday 27 November 2004 10:38, Crazy AMD K7 wrote:
> Hi everybody,
> I use RedHat v.7.3. A few days ago I have installed a new kernel
> v.2.4.27 with bridge support + iptables 1.2.11. I have applied
> two patches to the kernel - 1.patch-o-matic u32 +
> 2.ebtables-brnf-7_vs_2.4.27.diff.gz
> Also I have IDS snort Version 2.2.0 (Build 30) installed.
> Everything worked propertly except a few hours ago system caught
> "kernel panic" it happened twice.
> I am going to upgade to v.2.4.28 kernel and ebtables-brnf-8_vs_2.4.28.diff
> but I am interested what it was? Software/hardware bug?
> I have found "ip_sabotage" string in ebtables-brnf patch.
> Someone said to me that it is a kernel v.2.4.27 bug. If logging is on
> (iptables ..-j LOG) and a certain packet arrives (with syn+fin flags)
> it may result in kernel panic.
> Also I would like to notice that my previous kernel was 2.4.21 with
> bridge-nf patch(not ebtables-brnf). I use iptables chain FORWARD to
> filter packets. And there were no problems for more then a year.
> With 2.4.19 i have no problems, too.
> Can anyone help me to find a bug?

What cpu architecture do you use?
Is snort active when the oops happens?
Does it oops without the LOG entries?
I see ip_queue_xmit is called, perhaps it's some malfunctioning between 
queueing and bridge-nf.

Please apply the attached patch to your patched 2.4.28 kernel:
# cd /usr/src/kerneldir
# patch -p1 < patch.diff
And recompile the kernel.

Please report any lines in your log file starting with "TROUBLE IN 
IP_SABOTAGE_OUT", followed by a stack dump to me.

cheers,
Bart

--- linux-2.4.28-ebt-brnf/net/bridge/br_netfilter.c.old	2004-11-27 23:43:18.000000000 +0100
+++ linux-2.4.28-ebt-brnf/net/bridge/br_netfilter.c	2004-11-27 23:52:05.000000000 +0100
@@ -870,6 +870,10 @@ static unsigned int ip_sabotage_out(unsi
 {
 	struct sk_buff *skb = *pskb;
 
+if (!skb) {
+	printk("TROUBLE IN IP_SABOTAGE_OUT: skb==NULL\n");
+	goto in_trouble;
+}
 #ifdef CONFIG_SYSCTL
 	if (!skb->nf_bridge) {
 		struct vlan_ethhdr *hdr =
@@ -884,6 +888,10 @@ static unsigned int ip_sabotage_out(unsi
 	}
 #endif
 
+if (!out) {
+	printk("TROUBLE IN IP_SABOTAGE_OUT: out == NULL\n");
+	goto in_trouble;
+}
 	if ((out->hard_start_xmit == br_dev_xmit &&
 	    okfn != br_nf_forward_finish &&
 	    okfn != br_nf_local_out_finish &&
@@ -920,6 +928,9 @@ static unsigned int ip_sabotage_out(unsi
 	}
 
 	return NF_ACCEPT;
+in_trouble:
+	dump_stack();
+	return NF_DROP;
 }
 
 /* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent