[Devel] [PATCH RHEL7 COMMIT] ms/netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.21.1.vz7.50.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.21.1.vz7.50.11
------>
commit 9c53498bcac0d5430bc599d3ca5ad96eddf7e9f4
Author: Liping Zhang <zlpnobody at gmail.com>
Date:   Fri Jun 15 19:06:36 2018 +0300

    ms/netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
    
    If nf_conntrack_htable_size was adjusted by the user during the ct
    dump operation, we may invoke nf_ct_put twice for the same ct, i.e.
    the "last" ct. This will cause the ct will be freed but still linked
    in hash buckets.
    
    It's very easy to reproduce the problem by the following commands:
      # while : ; do
      echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
      done
      # while : ; do
      conntrack -L
      done
      # iperf -s 127.0.0.1 &
      # iperf -c 127.0.0.1 -P 60 -t 36000
    
    After a while, the system will hang like this:
      NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184]
      NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382]
      ...
    
    So at last if we find cb->args[1] is equal to "last", this means hash
    resize happened, then we can set cb->args[1] to 0 to fix the above
    issue.
    
    Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping")
    Signed-off-by: Liping Zhang <zlpnobody at gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    (cherry picked from commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 net/netfilter/nf_conntrack_netlink.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b04cc90ace21..7a022804e16e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -865,8 +865,13 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 	}
 out:
 	local_bh_enable();
-	if (last)
+	if (last) {
+		/* nf ct hash resize happened, now clear the leftover. */
+		if ((struct nf_conn *)cb->args[1] == last)
+			cb->args[1] = 0;
+
 		nf_ct_put(last);
+	}
 
 	return skb->len;
 }