On Fri, Jun 23, 2017 at 02:49:58PM -0700, Andrei Vagin wrote:
Hello Everyone,
Today I've met a problem, when any attempts to create a new network
namespace hang up.
I see that one of previous namespaces can't be destroyed, because a
usage count for one
of its devices isn't zero. To reproduce the problem, you need to
executed an attached program
in a separate network namespace:
[root@fc24 net]# cat run.sh
ip link set up dev lo
./tcp-bug
[root@fc24 net]# unshare -n sh run.sh
If this program is executed in a new user, pid, mnt, and net namespaces,
the kernel reports a bug:
[root@fc24 net]# unshare -Urmfpn sh run.sh
[root@fc24 net]# unshare -Urmfpn sh run.sh
^C
[ 30.592295] unregister_netdevice: waiting for lo to become free. Usage count = 1
[ 37.958180] =============================================================================
[ 37.963675] BUG kmalloc-1024 (Not tainted): Poison overwritten
[ 37.966160] -----------------------------------------------------------------------------
[ 37.969497] Disabling lock debugging due to kernel taint
[ 37.971181] INFO: 0xffff93eef8bc3760-0xffff93eef8bc3760. First byte 0x38 instead of 0x6b
[ 37.973066] INFO: Slab 0xffffe69fc1e2f000 objects=15 used=15 fp=0x (null) flags=0x1fffc000008100
[ 37.974902] INFO: Object 0xffff93eef8bc35a8 @offset=13736 fp=0xffff93eef8bc1088
[ 37.976618] Redzone ffff93eef8bc35a0: bb bb bb bb bb bb bb bb ........
[ 37.978355] Object ffff93eef8bc35a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.980239] Object ffff93eef8bc35b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.982209] Object ffff93eef8bc35c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.984072] Object ffff93eef8bc35d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.985729] Object ffff93eef8bc35e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.987273] Object ffff93eef8bc35f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.988930] Object ffff93eef8bc3608: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.990582] Object ffff93eef8bc3618: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.991921] Object ffff93eef8bc3628: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.993541] Object ffff93eef8bc3638: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.994922] Object ffff93eef8bc3648: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.996745] Object ffff93eef8bc3658: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.998135] Object ffff93eef8bc3668: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 37.999350] Object ffff93eef8bc3678: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.000656] Object ffff93eef8bc3688: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.001920] Object ffff93eef8bc3698: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.003142] Object ffff93eef8bc36a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.004549] Object ffff93eef8bc36b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.005925] Object ffff93eef8bc36c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.007296] Object ffff93eef8bc36d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 38.008852] Object ffff93eef8bc36e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
94 more lines
[root@fc24 net]# echo $?
0
[root@fc24 ~]# cat /proc/40/stack
[<ffffffffa211989e>] msleep+0x3e/0x50
[<ffffffffa2786eea>] netdev_run_todo+0x12a/0x320
[<ffffffffa279542e>] rtnl_unlock+0xe/0x10
[<ffffffffa277d56a>] default_device_exit_batch+0x14a/0x170
[<ffffffffa2772d12>] ops_exit_list.isra.6+0x52/0x60
[<ffffffffa277402e>] cleanup_net+0x1ee/0x2f0
[<ffffffffa20ac9f5>] process_one_work+0x205/0x620
[<ffffffffa20ace5e>] worker_thread+0x4e/0x3b0
[<ffffffffa20b4344>] kthread+0x114/0x150
[<ffffffffa29619fa>] ret_from_fork+0x2a/0x40
[<ffffffffffffffff>] 0xffffffffffffffff
[root@fc24 ~]# dmesg | tail
[ 97.071533] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 97.079561] systemd-journald[180]: Sent WATCHDOG=1 notification.
[ 107.319260] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 117.567180] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 127.807401] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 138.055324] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 148.303308] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 158.559118] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 168.807423] unregister_netdevice: waiting for lo to become free.
Usage count = 1
[ 179.055590] unregister_netdevice: waiting for lo to become free.
Usage count = 1
This program creates a server tcp socket, then it creates a pair of
connected tcp sockets
and then it does actions which trigger this problem. It calls
connect() with AF_UNSPEC
for one of connected sockets and then call connect() with the address
5 more quoted lines
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h> /* for sockaddr_in and inet_ntoa() */
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>
#include <signal.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#define pr_err(fmt, ...) \
printf("Error: " fmt, ##__VA_ARGS__)
#define pr_perror(fmt, ...) \
pr_err(fmt ": %s\n", ##__VA_ARGS__, strerror(errno))
#define fail(fmt, ...) \
pr_err(fmt ": %s\n", ##__VA_ARGS__, strerror(errno))
union sockaddr_inet {
struct sockaddr addr;
struct sockaddr_in v4;
struct sockaddr_in6 v6;
};
int tcp_init_server(int family, int *port)
{
union sockaddr_inet addr;
int sock;
int yes = 1, ret;
memset(&addr,0,sizeof(addr));
if (family == AF_INET) {
addr.v4.sin_family = family;
inet_pton(family, "0.0.0.0", &(addr.v4.sin_addr));
162 more quoted lines