SMP/ebtables crash under load.

Hi.

I've been setting up a firewall using ebtables and was getting a crash 
under heavy load. I was seeing a "kernel panic: Aiee, killing interrupt 
handler" in ebt_do_table().

I think I tracked the problem down to a race condition between 
ebt_do_table() and do_replace() (my firewall was doing dynamic outgoing 
SNAT). The following is a patch for ebtables.c that cured the problem.

--- ebtables.c.new	Fri Mar 11 17:12:39 2005
+++ ebtables.c	Fri Mar 11 17:13:04 2005
@@ -175,9 +175,10 @@
  	struct ebt_chainstack *cs;
  	struct ebt_entries *chaininfo;
  	char *base;
-	struct ebt_table_info *private = table->private;
+	struct ebt_table_info *private;

  	read_lock_bh(&table->lock);
+	private = table->private;
  	cb_base = COUNTER_BASE(private->counters, private->nentries,
  	   cpu_number_map(smp_processor_id()));
  	if (private->chainstack)

It's possible for the "table->private" value to change after being read 
and before the read lock being taken - "private" then points to memory 
that do_replace() frees.

The patch is against a 2.4.28 kernel but I noticed the bug is in the 2.6 
series too.

Steve



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click