Takashi Ichihara wrote:
> Hi, all
>
> We have been using SL4.6/4.7 (i386 and X86_64) on several nodes
> and have experienced kernel panic frequently during the system
> rebooting or system shutdown or even by /etc/init.d/ip_tables restart
> since last summer in 2008.
>
> This is a known bug and still unresolved as reported at the
> upstream vender's bugzilla.
> https://bugzilla.redhat.com/show_bug.cgi?id=456664
>
> With several investigation, this Kernel panic related to [ip_conntrack]
> occurs in the the following condition in our environment.
>
> 1) Kernel is
> kernel-smp-2.6.9-78.1EL (SMP or hugemem) (Aug. 2008) to
> kernel-smp-2.6.9-78.13EL (SMP or hugemem) (latest kernel)
>
> 2) ip-tables is enabled and in /etc/sysconfig/iptables-config
> IPTABLES_MODULES="ip_conntrack_ftp"
> is included.
>
> In this situation, during the rebooting or /etc/init.d/iptables stop
> or /etc/init.d/iptables restart operations,
>
> kernel panic relating with [ip_conntrack] accrues. This kernel bug
> is still unresolved.
>
> However, there is a workaround to avoid this problem. It is
> described in the comment 31 in
> https://bugzilla.redhat.com/show_bug.cgi?id=456664
>
>> We have discovered that when the following is in the iptables-config:
>>
>> IPTABLES_MODULES="ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_REJECT
> iptable_mangle"
>> and on the 2.6.9-78.0.1 ( or .5) RHEL4 version kernel, the kernel
>> panic does not occur when iptables is stopped.
>
> We have tested this workaround in several nodes of SL4.6/7 (both
> i386 and X86_64) with the kernel 2.6.9-78.0.13.ELsmp.
>
> After updating the /etc/sysconfig/iptables-config to include
> IPTABLES_MODULES="ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_REJECT
> iptable_mangle",
> the first rebooting failed with kernel panic because this update was not
> reflected. But in the second rebooting and also
> /etc/init.d/ip_tables stop or /etc/init.d/ip_tables restart command,
> the kernel panic does not occur. So I think this is the current best
> workaround against this kernel panic of kernel-smp-2.6.9-78.* (1-13)
> relating to [ip_conntrack] or [ip_tables].
>
> PS: This problem does not occure at SL 5.2 (kernel 2.6.18-*)
>
> Best Regards,
> Takashi Ichihara (RIKEN)
>
Hi,
Just for your information, a new kernel just came out right now for SL4,
2.6.9-78.0.17.EL
As part of the things it's fixed is
* when the iptables module was unloaded, it was assumed the correct entry
for removal had been found if "wrapper->ops->pf" matched the value passed
in by "reg->pf". If several ops ranges were registered against the same
protocol family, however, (which was likely if you had both ip_conntrack
and ip_contrack_* loaded) this assumption could lead to NULL list pointers
and cause a kernel panic. With this update, "wrapper->ops" is matched to
pointer values "reg", which ensures the correct entry is removed and
results in no NULL list pointers. (BZ#477147)
Looking at bugzilla 477147, it says
"This bug has been copied from bug #456664"
So, hopefully this new kernel will fix the problem.
The new kernel should go into the errata tomorrow if all goes well.
Troy
--
__________________________________________________
Troy Dawson [log in to unmask] (630)840-6468
Fermilab ComputingDivision/LCSI/CSI LMSS Group
__________________________________________________
|
