Re: [PATCH] netfilter: use per-cpu spinlock rather than RCU (v3)

[Patrick McHardy]

Jan Engelhardt wrote:
> On Wednesday 2009-04-15 23:07, Eric Dumazet wrote:
> > Stephen Hemminger a écrit :
> > > Looks like there is some recursive path into ip_tables that makes the
> > > per-cpu spinlock break.  I get lockup's with KVM networking.
> > >
> > > Suggestions?
> > Well, it seems original patch was not so bad after all
> >
> > http://lists.netfilter.org/pipermail/netfilter-devel/2006-January/023175.html
> >
> > So change per-cpu spinlocks to per-cpu rwlocks 
> >
> > and use read_lock() in ipt_do_table() to allow recursion...
> iptables cannot quite recurse into itself due to the comefrom stuff.

Actually it can by using the REJECT target:

> [ 2106.068550]  [<ffffffff804b0195>] ? nf_hook_slow+0x89/0x104
> [ 2106.068552]  [<ffffffff804b8ed0>] ? dst_output+0x0/0xb
> [ 2106.068555]  [<ffffffff80393925>] ? _raw_spin_unlock+0x8b/0x92
> [ 2106.068557]  [<ffffffff804ba8c7>] ? __ip_local_out+0x98/0x9a
> [ 2106.068559]  [<ffffffff804ba8d2>] ? ip_local_out+0x9/0x1f
> [ 2106.068562]  [<ffffffff804babb4>] ? ip_push_pending_frames+0x2cc/0x33e
> [ 2106.068566]  [<ffffffff804dac79>] ? icmp_send+0x559/0x588
> [ 2106.068569]  [<ffffffff8022d3a0>] ? task_rq_lock+0x46/0x79
> [ 2106.068571]  [<ffffffff8023004f>] ? enqueue_task_fair+0x23b/0x293
> [ 2106.068575]  [<ffffffffa00f5083>] ? reject_tg+0x41/0x30e [ipt_REJECT]
> [ 2106.068578]  [<ffffffffa024084f>] ? ipt_do_table+0x534/0x5f1 [ip_tables]



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/