使用nftables添加过多的规则时，内核将出现softlockup

【标题描述】使用nftables添加过多的规则时，内核将出现softlockup
【环境信息】
硬件信息：
1）	问题和硬件设备无关
软件信息：
1）	openeuler-22.03-lts，20.03环境也可以复现此问题
2）	5.10.0-60.18.0.50.oe2203.x86_64，arm环境也可以复现此问题
3）	kernel-5.10.0-60.18.0.50.oe2203.x86_64
【问题复现步骤】
具体操作步骤
复现步骤1：
```
sysctl -w kernel.softlockup_panic=1
table='loop-test'
nft add table inet $table
for((i=1;i<16;i++));do nft add chain inet $table test$i;done
for((i=1;i<16;i++));do for((j=1;j<16;j++));do nft add rule inet $table test$j jump test$i;done;done
```
反复执行第二个for循环增加nftables规则
```
for((i=1;i<16;i++));do for((j=1;j<16;j++));do nft add rule inet $table test$j jump test$i;done;done
```
使用
```
nft list ruleset | wc -l
```
可以统计规则数量，当规则数量达到600+条时将会触发softlockup

复现步骤1：
```
sysctl -w kernel.softlockup_panic=1
yum install -y firewalld
for((i=1;i<16;i++));do systemctl restart dbus;done
```
反复执行for循环增加nftables规则
```
for((i=1;i<16;i++));do systemctl restart dbus;done
```
使用
```
nft list ruleset | wc -l
```
可以统计规则数量，当规则数量达到1400+条时将会触发softlockup

当nftables规则添加过多时必现
【预期结果】
系统不出现softlockup
【实际结果】
出现提示BUG：softlockup的提示信息，系统复位
【附件信息】
复现步骤1的vmcore调用栈：
```
[5375378.796383] Call trace:
[5375378.796397]  dump_backtrace+0x0/0x198
[5375378.796401]  show_stack+0x24/0x30
[5375378.796408]  dump_stack+0xb0/0x100
[5375378.796414]  panic+0x12c/0x4a8
[5375378.796420]  watchdog_timer_fn+0x43c/0x440
[5375378.796426]  __hrtimer_run_queues+0x118/0x378
[5375378.796429]  hrtimer_interrupt+0xfc/0x2f8
[5375378.796435]  arch_timer_handler_virt+0x38/0x58
[5375378.796438]  handle_percpu_devid_irq+0x90/0x248
[5375378.796442]  generic_handle_irq+0x3c/0x58
[5375378.796444]  __handle_domain_irq+0x68/0xc0
[5375378.796448]  gic_handle_irq+0x90/0x320
[5375378.796450]  el1_irq+0xcc/0x180
[5375378.796470]  nf_tables_check_loops+0x9c/0x250 [nf_tables]
[5375378.796477]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796484]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796490]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796497]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796503]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796510]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796516]  nf_tables_check_loops+0x1f4/0x250 [nf_tables]
[5375378.796523]  nft_validate_register_store+0xb4/0xd0 [nf_tables]
[5375378.796530]  nft_immediate_init+0x94/0xf0 [nf_tables]
[5375378.796537]  nf_tables_newrule+0x4ec/0x7a8 [nf_tables]
[5375378.796543]  nfnetlink_rcv_batch+0x54c/0x630 [nfnetlink]
[5375378.796546]  nfnetlink_rcv+0x170/0x1a8 [nfnetlink]
[5375378.796552]  netlink_unicast+0x290/0x330
[5375378.796554]  netlink_sendmsg+0x310/0x378
[5375378.796559]  sock_sendmsg+0x4c/0x70
[5375378.796561]  ____sys_sendmsg+0x264/0x2a8
[5375378.796564]  ___sys_sendmsg+0x90/0xd0
[5375378.796566]  __sys_sendmsg+0x78/0xd0
[5375378.796569]  __arm64_sys_sendmsg+0x2c/0x38
[5375378.796574]  el0_svc_common+0x80/0x200
[5375378.796576]  el0_svc_handler+0x78/0xe0
[5375378.796578]  el0_svc+0x10/0x260
[5375378.796582] kernel fault(0x5) notification starting on CPU 1
[5375378.796584] kernel fault(0x5) notification finished on CPU 1
[5375378.796588] SMP: stopping secondary CPUs
[5375378.796638] Kernel Offset: disabled
[5375378.796641] CPU features: 0x10,a0006008
[5375378.796643] Memory Limit: none
[5375378.800246] Starting crashdump kernel...
[5375378.800256] Bye!
```

复现步骤2的vmcore调用栈
```
[310022.716353] Call Trace:
[310022.719673]  <IRQ>
[310022.722565]  dump_stack+0x9c/0xcf
[310022.726756]  panic+0x280/0x731
[310022.730684]  ? __warn_printk+0xf8/0xf8
[310022.735308]  ? watchdog_timer_fn.cold+0x5/0x25
[310022.740621]  watchdog_timer_fn.cold+0x16/0x25
[310022.745850]  __run_hrtimer+0xa2/0x2d0
[310022.750390]  ? watchdog_process_before_softlockup+0x1d0/0x1d0
[310022.757002]  __hrtimer_run_queues+0x12d/0x1d0
[310022.762228]  ? __run_hrtimer+0x2d0/0x2d0
[310022.767022]  ? _raw_spin_unlock_irqrestore+0x10/0x10
[310022.772857]  ? recalibrate_cpu_khz+0x10/0x10
[310022.777998]  ? ktime_get_update_offsets_now+0x155/0x1a0
[310022.784091]  hrtimer_interrupt+0x1be/0x4c0
[310022.789067]  __sysvec_apic_timer_interrupt+0x84/0x160
[310022.794987]  asm_call_irq_on_stack+0x12/0x20
[310022.800125]  </IRQ>
[310022.803103]  sysvec_apic_timer_interrupt+0x72/0x80
[310022.804241] sh (3845072): drop_caches: 3
[310022.808763]  asm_sysvec_apic_timer_interrupt+0x12/0x20
[310022.808792] RIP: 0010:nft_chain_validate+0xa6/0x1f0 [nf_tables]
[310022.808847] hugeshmctl03 (3845148): drop_caches: 3
[310022.813368] sh (3845060): drop_caches: 3
[310022.832283] LTP: starting hugeshmdt01 (hugeshmdt01 -i 5)
[310022.832359] Code: d8 41 80 7d 2b 10 0f 84 57 01 00 00 e8 53 e1 9b d8 4c 8d 73 10 4c 89 f7 4c 89 34 24 e8 c3 30 c7 d8 4c 8b 63 10 4d 39 f4 74 5f <e8> 35 e1 9b d8 49 8d 7c 24 10 e8 ab 30 c7 d8 4c 89 ef 41 0f b6 5c
[310022.863269] RSP: 0018:ffff8881faee7038 EFLAGS: 00000287
[310022.869365] RAX: 0000000000000000 RBX: ffff88821d3f84b0 RCX: ffffffffc177930b
[310022.877371] RDX: dffffc0000000000 RSI: ffff88821d3f8490 RDI: ffff88821d3f8400
[310022.885378] RBP: ffffffffc17c5680 R08: ffffffffc17793a0 R09: ffff8881faee7718
[310022.893386] R10: ffffed103f5dcee8 R11: 0000000000000001 R12: ffff88821d3f9900
[310022.901391] R13: ffff8881faee7520 R14: ffff88821d3f84b0 R15: ffffffffc179ff70
[310022.947278]  nft_immediate_validate+0x7d/0xa0 [nf_tables]
[310022.953562]  nft_chain_validate+0x1d6/0x1f0 [nf_tables]
[310022.978768]  nft_immediate_validate+0x7d/0xa0 [nf_tables]
[310022.985047]  nft_chain_validate+0x1d6/0x1f0 [nf_tables]
[310023.010263]  nft_immediate_validate+0x7d/0xa0 [nf_tables]
[310023.016541]  nft_chain_validate+0x1d6/0x1f0 [nf_tables]
[310023.060909]  nft_immediate_validate+0x7d/0xa0 [nf_tables]
[310023.067191]  nft_chain_validate+0x1d6/0x1f0 [nf_tables]
[310023.102592]  nft_immediate_validate+0x7d/0xa0 [nf_tables]
[310023.108877]  nft_chain_validate+0x1d6/0x1f0 [nf_tables]
[310023.121611]  nft_table_validate+0x108/0x180 [nf_tables]
[310023.144377]  nf_tables_validate+0x73/0xb0 [nf_tables]
[310023.150310]  nf_tables_commit+0x5b/0x1720 [nf_tables]
[310023.156231]  nfnetlink_rcv_batch+0x6f2/0xd70 [nfnetlink]
[310023.196147]  nfnetlink_rcv+0x23a/0x25e [nfnetlink]
[310023.208158]  netlink_unicast+0x247/0x340
[310023.217921]  netlink_sendmsg+0x452/0x7e0
[310023.232132]  sock_sendmsg+0xf4/0x100
[310023.236584]  ____sys_sendmsg+0x478/0x4f0
[310023.262629]  ___sys_sendmsg+0xe2/0x150
[310023.308102]  __sys_sendmsg+0xd8/0x170
[310023.317692]  do_syscall_64+0x33/0x40
[310023.322139]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[310023.328057] RIP: 0033:0x7f2afccc0067
[310023.332505] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[310023.352119] RSP: 002b:00007ffcec5cb0d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[310023.360562] RAX: ffffffffffffffda RBX: 00007ffcec5dc2d0 RCX: 00007f2afccc0067
[310023.368567] RDX: 0000000000000000 RSI: 00007ffcec5dc180 RDI: 0000000000000006
[310023.376571] RBP: 00007ffcec5dc280 R08: 0000000000000004 R09: 00007ffcec5cb0e0
[310023.384577] R10: 00007ffcec5cb0ac R11: 0000000000000246 R12: 000000000002f400
[310023.392587] R13: 0000000000400000 R14: 00007ffcec5cb0f0 R15: 0000000000000006
[310023.400596] kernel fault(0x5) notification starting on CPU 7
[310023.409296] kernel fault(0x5) notification finished on CPU 7
[310023.973036] Kernel Offset: 0x18e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[310028.436750] kexec: Bye!
```

外部参考链接：
https://blog.nexusuk.org/2020/08/

src-openEuler/kernel
关闭

内容风险标识

评论 (6)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识