Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #963545

Bug#931574: nftables: kernel BUG at lib/list_debug.c:53

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: nftables
Version: 0.9.0-2
Severity: important

Dear Maintainer

I performed a test upgrade of a cloud VM running Debian Stretch
to buster. After the upgrade the VM does not boot any longer if
the `nftables.service` is enabled and the 4.19 kernel is used,
because a kernel assertion is violated.

The old 4.9 kernel from stretch works fine. I was able to disable the
`nftables.service` there. Afterwards the 4.19 kernel boots fine.
If I manually start the `nftables.service` the process will
segfault and the same kernel assertion will be logged. I was able
to reduce my nftables.conf to the attached one, it still triggers
the assertion.

It looks like (one of) the two `flow table` lines are at fault,
but I am not able to confirm this for sure, because the assertion
is not 100% reliably triggered.

If I try to load the ruleset after the assertion is triggered once
the `nft` process will hang in uninterruptable sleep (state `D`), I
assume, because the reponsible kernel thread died.

Note that the kernel stack has an `apparmor` frame, but the only
apparmor package installed is `libapparmor1`.

Because it might possibly be relevant (out of tree kernel module):
The cloud VM is running with root on ZFS with the buster DKMS
packages.

I am attaching:

lsmod                  : The output of lsmod.
journalctl_-b_-t_kernel: The log of the assertion.
strace                 : The end of the output of `strace`, right
                         before the segfault.

dpkg -l |egrep 'nftables|zfs-|linux-image|apparmor':

ii  libapparmor1:amd64              2.13.2-10                    amd64        changehat AppArmor library
ii  libnftables0:amd64              0.9.0-2                      amd64        Netfilter nftables high level userspace API library
ii  libnftnl11:amd64                1.1.2-2                      amd64        Netfilter nftables userspace API library
ii  libnftnl4:amd64                 1.0.7-1                      amd64        Netfilter nftables userspace API library
ii  linux-image-4.19.0-5-amd64      4.19.37-5                    amd64        Linux 4.19 for 64-bit PCs (signed)
ii  linux-image-4.9.0-8-amd64       4.9.144-3.1                  amd64        Linux 4.9 for 64-bit PCs
ii  linux-image-4.9.0-9-amd64       4.9.168-1+deb9u3             amd64        Linux 4.9 for 64-bit PCs
ii  linux-image-amd64               4.19+105                     amd64        Linux for 64-bit PCs (meta-package)
ii  nftables                        0.9.0-2                      amd64        Program to control packet filtering rules by Netfilter project
ii  zfs-dkms                        0.7.12-2+deb10u1             all          OpenZFS filesystem kernel modules for Linux
ii  zfs-initramfs                   0.7.12-2+deb10u1             all          OpenZFS root filesystem capabilities for Linux - initramfs
ii  zfs-zed                         0.7.12-2+deb10u1             amd64        OpenZFS Event Daemon

-- System Information:
Debian Release: 10.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-5-amd64 (SMP w/2 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_DIE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages nftables depends on:
ii  dpkg          1.19.7
ii  libc6         2.28-10
ii  libgmp10      2:6.1.2+dfsg-4
ii  libjansson4   2.12-1
ii  libnftables0  0.9.0-2
ii  libreadline7  7.0-5

nftables recommends no packages.

nftables suggests no packages.

-- Configuration Files:
/etc/nftables.conf changed:
flush ruleset
table inet filter {
	chain input {
		type filter hook input priority 0;
		# accept any localhost traffic
		iif lo accept
		# accept traffic originated from us
		ct state established,related accept
		# Drop invalid
		ct state invalid drop
		tcp dport { 22 } ct state new flow table ssh-limit4 { ip saddr limit rate 10/minute } accept
		tcp dport { 22 } ct state new flow table ssh-limit6 { ip6 saddr limit rate 10/minute } accept
	}
}


-- no debconf information

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#931574: nftables: kernel BUG at lib/list_debug.c:53 Tim Duesterhus <public+debian.org@bastelstu.be> - 2019-07-07 21:40 +0200

csiph-web