[PVE-User] Using ip6tables in VE --> kernel oops with PVE 1.9 latest

[lst_hoe02 at kwsoft.de]

Zitat von Martin Maurer <martin at proxmox.com>:

> See http://bugzilla.openvz.org/show_bug.cgi?id=2095

Next one:
I tried to use one of our VE without ip6tables e.g. IPv4 only. It  
starts fine, but on "vzctl stop <VPS-ID>" i got the following kernel  
panic

BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: [<ffffffffa032026e>] recent_mt_destroy+0x19e/0x1d0 [xt_recent]
PGD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/kernel/mm/ksm/run
CPU 3
Modules linked in: netconsole configfs vhost_net macvtap macvlan tun  
kvm_intel kvm vzethdev vznetdev simfs vzrst nf_nat nf_conntrack_ipv4  
nf_defrag_ipv4 vzcpt nfs lockd fscache nfs_acl auth_rpcgss sunrpc  
vzdquota vzmon vzdev xt_state xt_conntrack nf_conntrack_ipv6  
nf_defrag_ipv6 ip6t_REJECT ip6table_mangle ip6table_filter ip6_tables  
xt_recent nf_conntrack_ftp nf_conntrack xt_length xt_hl xt_tcpmss  
xt_TCPMSS iptable_mangle iptable_filter xt_multiport xt_limit xt_dscp  
ipt_REJECT ip_tables vzevent ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad  
ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi  
scsi_transport_iscsi bridge stp llc snd_hda_codec_hdmi  
snd_hda_codec_conexant snd_hda_intel snd_hda_codec tpm_infineon  
i2c_i801 snd_hwdep parport_pc snd_pcm snd_timer parport i2c_core  
tpm_tis tpm tpm_bios snd soundcore snd_page_alloc pcspkr ext3 jbd  
mbcache dm_mirror dm_region_hash dm_log dm_snapshot sg ahci e1000e  
[last unloaded: scsi_wait_scan]

Modules linked in: netconsole configfs vhost_net macvtap macvlan tun  
kvm_intel kvm vzethdev vznetdev simfs vzrst nf_nat nf_conntrack_ipv4  
nf_defrag_ipv4 vzcpt nfs lockd fscache nfs_acl auth_rpcgss sunrpc  
vzdquota vzmon vzdev xt_state xt_conntrack nf_conntrack_ipv6  
nf_defrag_ipv6 ip6t_REJECT ip6table_mangle ip6table_filter ip6_tables  
xt_recent nf_conntrack_ftp nf_conntrack xt_length xt_hl xt_tcpmss  
xt_TCPMSS iptable_mangle iptable_filter xt_multiport xt_limit xt_dscp  
ipt_REJECT ip_tables vzevent ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad  
ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi  
scsi_transport_iscsi bridge stp llc snd_hda_codec_hdmi  
snd_hda_codec_conexant snd_hda_intel snd_hda_codec tpm_infineon  
i2c_i801 snd_hwdep parport_pc snd_pcm snd_timer parport i2c_core  
tpm_tis tpm tpm_bios snd soundcore snd_page_alloc pcspkr ext3 jbd  
mbcache dm_mirror dm_region_hash dm_log dm_snapshot sg ahci e1000e  
[last unloaded: scsi_wait_scan]
Pid: 25, comm: netns Not tainted 2.6.32-6-pve #1 042stab039_10 D3076-S1
RIP: 0010:[<ffffffffa032026e>]  [<ffffffffa032026e>]  
recent_mt_destroy+0x19e/0x1d0 [xt_recent]
RSP: 0018:ffff88043c0a5d00  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff880432545320 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffff880432a648e0 RDI: ffffffffa0321446
RBP: ffff88043c0a5d30 R08: 00000000000001fe R09: 00000000000001fe
R10: ffff880432980e90 R11: 0000000000000009 R12: ffff880432a64000
R13: ffff880432a648e0 R14: 0000000000000080 R15: ffff880433721000
FS:  0000000000000000(0000) GS:ffff88002c380000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000038 CR3: 0000000001a85000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process netns (pid: 25, veid=0, threadinfo ffff88043c0a4000, task  
ffff88043c0a2ea0)
Stack:
  ffffc900152c4130 0000000000000070 ffffc900152c47f0 ffffc900152c4780
<0> ffffc900152c3000 ffffffffa02d1680 ffff88043c0a5d60 ffffffffa02ae2d5
<0> ffffffffa03216e0 ffffc900152c4810 ffffc900152c4602 ffffc900152c3000
Call Trace:
  [<ffffffffa02ae2d5>] cleanup_match+0x45/0x60 [ip_tables]
  [<ffffffffa02ae3e4>] cleanup_entry+0x64/0xc0 [ip_tables]
  [<ffffffffa02b0ede>] ipt_unregister_table+0x5e/0x90 [ip_tables]
  [<ffffffff81435500>] ? cleanup_net+0x0/0xe0
  [<ffffffffa02d102c>] iptable_filter_net_exit+0x2c/0x40 [iptable_filter]
  [<ffffffff8143558e>] cleanup_net+0x8e/0xe0
  [<ffffffff8108d1ae>] worker_thread+0x1be/0x2b0
  [<ffffffff81093450>] ? autoremove_wake_function+0x0/0x40
  [<ffffffff8108cff0>] ? worker_thread+0x0/0x2b0
  [<ffffffff81092e26>] kthread+0x96/0xb0
  [<ffffffff8100c38a>] child_rip+0xa/0x20
  [<ffffffff81092d90>] ? kthread+0x0/0xb0
  [<ffffffff8100c380>] ? child_rip+0x0/0x20
Code: 03 75 ea 41 83 c6 01 44 3b 35 d7 17 00 00 72 bd 4c 89 e7 e8 85  
5b e5 e0 e9 15 ff ff ff 49 8b 87 70 03 00 00 48 c7 c7 46 14 32 a0 <48>  
8b 70 38 e8 09 38 ed e0 49 8b bf 20 02 00 00 e8 5d 5b e5 e0
RIP  [<ffffffffa032026e>] recent_mt_destroy+0x19e/0x1d0 [xt_recent]
  RSP <ffff88043c0a5d00>
CR2: 0000000000000038
---[ end trace fe80467be5d9307b ]---
Kernel panic - not syncing: Fatal exception
Pid: 25, comm: netns Tainted: G      D    ----------------   2.6.32-6-pve #1
Call Trace:
  [<ffffffff814f23d6>] ? panic+0xa5/0x189
  [<ffffffff810c489e>] ? crash_kexec+0x7e/0x110
  [<ffffffff810990fa>] ? up+0x3a/0x50
  [<ffffffff8100be4e>] ? apic_timer_interrupt+0xe/0x20

Looks like one should not use ip(6)tables inside the VEs at all????

Regards

Andreas