search

Douane / douane-dkms

Kernel module used by Douane firewall
23 stars 15 forks source link

Kernel panic in Ubuntu 14.04 #3

Closed hotice closed 5 years ago

hotice commented 10 years ago

douane-dkms causes Kernel panics in Ubuntu 14.04 64bit. This seems to occur randomly, while browsing some websites in Firefox for instance (so not on boot).

I'm using the Ubuntu Linux 3.13.0-24-generic Kernel.

zedtux commented 10 years ago

I just realized that I have forgotten to do dkms build so I have installed again the module from your package @hotice.

So I did the following:

sudo rmmod douane
sudo dkms uninstall -m douane -v 0.8.3
sudo dkms remove -m douane -v 0.8.3 --all
cd /usr/src/douane-0.8.3/
sudo mv douane.c douane.c.orig
sudo wget https://raw.githubusercontent.com/Douane/douane-dkms/903c26a621d84308675e4ec249bee46f2d04eb42/douane.c
sudo dkms build -m douane -v 0.8.3
sudo dkms install -m douane -v 0.8.3
sudo modprobe douane

Then in order to ensure that there's no kernel panic, I've opened 2 terminals with the following commands:

The last command will show if a kernel bug occur somewhere. @hotice can you please try and let me know ?

zedtux commented 10 years ago

Now since half an hour, with Birdie, firefox, apt-get and no kernel bug/panic. :)

hotice commented 10 years ago

Is the fix now in git here or do I still have to replace that file manually?

zedtux commented 10 years ago

I'm waiting your validation before to revert the code in master. In the other hand I have created a tag 0.8.2 which is the 'fixed' version if you validate.

hotice commented 10 years ago

@zedtux Hmmm your commands are wrong. You move douane.c to douane.c.orig twice. And then you move douane.c.1 to douane.c but douane.c.1 doesn't exist. Please fix them.

zedtux commented 10 years ago

Mmmm sorry my bad... I have updated my commands.

hotice commented 10 years ago

Well, opening GitHub in Chromium didn't result in any kernel panics. So far so good.

pavlinux commented 10 years ago

This is in no way associated with latest fixes :)

hotice commented 10 years ago

Well, there were no more kernel panics / desktop freezes. So whatever caused it doesn't happen any more with that commit.

zedtux commented 10 years ago

Great news ! So could you please build a package with the 0.8.2 tag ? (Maybe you should create a new PPA ... sorry for this. (The 0.8.2 version is frozen so there will be no more commit for this tag).

zedtux commented 10 years ago

Sorry, can we consider to close this issue ?

hotice commented 10 years ago

Yes, I'll create a new PPA. Closing this.

pavlinux commented 10 years ago

@hotice You have a computer, sorry, zoo: Virtualbox, samba, Apparmor, systemd...
So, I think panics still appear

zedtux commented 10 years ago

@pavlinux are you using your fork on your machine ?

If yes, which are the services you're using ?

hotice commented 10 years ago

@pavlinux I maintain a blog (www.webupd8.org) and hundreds of PPA packages and I test a lot of things for both so I have to have lot of things installed.

hotice commented 10 years ago

And besides VirtualBox, you mentioned standard stuff that's installed by default in Ubuntu... samba, apparmor, systemd (well, Ubuntu didn't switch to it yet but there are parts of it implemented already).

pavlinux commented 10 years ago

@zedtux Debian 7, kernels: 3.2.57, 3.14.2, Not constantly running services, only system: alsa, cron, dbus, syslog, udev, acpid. No SeLinux, apparmor, grsecirity, etc. ... I do not have paranoid delusions of persecution :)
When testing applications, then work: MySQL, Samba, DHCP, Bind, tftp, Postgres, Vmware, stunnel, openvpn, qemu,... NTP, XBT torrrent tracker, torrent client

hotice commented 10 years ago

@zedtux I built a new PPA and I'm not using the packages from there. So far so good. Here's the PPA: https://launchpad.net/~nilarimogard/+archive/test2/ - can you please use it too and see if everything is ok? (douane-dkms is no longer built with debugging enabled; I built douane-dkms-dbg for that but don't install it for now, I have to change some dependencies for some other packages to get it to install properly).

zedtux commented 10 years ago

OK I will install them this evening when I will be home and let you know.

hotice commented 10 years ago

I had another kernel panic so it's not fixed. I didn't have debugging enabled unfortunately...

zedtux commented 10 years ago

:-(

Then can you please install your -dgb package (and I will do the same) ?

hotice commented 10 years ago

I installed it now. But now all I can do is wait, it happened after a few hours the last time...

hotice commented 10 years ago

Hmmm my douane-dkms-dbg package doesn't work. Here's a douane-dkms deb with debugging enabled: https://dl.dropboxusercontent.com/u/1113424/douane-dkms_0.8.2-1%7Ewebupd8%7Etrusty0_amd64.deb

zedtux commented 10 years ago

Of course ... Then we will see.

zedtux commented 10 years ago

OK So I have installed your package @hotice. Let's see.

Do you have news on your side ? Can't you try to grep in your kern.log file ?

zedtux commented 10 years ago

Here is my modinfo:

modinfo douane
filename:       /lib/modules/3.13.0-24-generic/updates/dkms/douane.ko
license:        GPL
version:        0.8.2
author:         Guillaume Hain <zedtux@zedroot.org>
description:    Douane
srcversion:     A8F1BF0FD4C46D373F924F5
depends:        
vermagic:       3.13.0-24-generic SMP mod_unload modversions

Can you please post yours ?

zedtux commented 10 years ago

Just few remarks for your packaging:

Edit: Sorry ... I have double checked for the license, and the license is wrong in the tag ... I'm going to change it.

Edit 2: I can't update the license in the tag. Can you checkout a specific branch in LP ? If yes, then I could create a branch per versions instead of a tag.

zedtux commented 10 years ago

It is now about hours I'm using the package from your link and no kernel panic/bug/freeze. I have running since the hours Spotify (so a lot of activities non-stop) and I'm using Firefox. I'm going now to also open Birdie... but I'm not sure to have any freezes...

zedtux commented 10 years ago

Finally, some hours later I got a kernel panic, but unfortunately it wasn't saved in the kern.log file ... :-(

pavlinux commented 10 years ago

Test my fork https://github.com/pavlinux/douane-dkms

zedtux commented 10 years ago

Yes, I'm going to do it now.

zedtux commented 10 years ago

I got 2 freezes in less than 15 minutes (with Spotify, Firefox opened with jolicould.com and birdie) where I don't see any kernel panic in the logs (while with the other version we see a kernel panic).

So the compute freezes and you can't do anything else than a reset.

zedtux commented 10 years ago

I'm now checking the kernel module with the KEDR framework. I'm copying a file of 4.7GB from my NAS to my localhost.

Without the daemon enable, I have the following output (and no freeze):

May  3 14:12:34 zUbuntu kernel: [15256.929009] douane:1162:exit_module: Kernel module removed!
May  3 14:12:34 zUbuntu kernel: [15256.929130] [leak_check] Target module: "douane", init area at ffffffffa0005000, core area at ffffffffa04e4000
May  3 14:12:34 zUbuntu kernel: [15256.929144] [leak_check] Totals:
May  3 14:12:34 zUbuntu kernel: [15256.929148] [leak_check] Allocations: 1786674
May  3 14:12:34 zUbuntu kernel: [15256.929151] [leak_check] Possible leaks: 0
May  3 14:12:34 zUbuntu kernel: [15256.929154] [leak_check] Unallocated frees: 0
May  3 14:12:34 zUbuntu kernel: [15256.929156] [leak_check] ======== end of LeakCheck report ========

With the daemon enable (and no freeze):

May  3 14:25:56 zUbuntu kernel: [16059.298246] douane:1162:exit_module: Kernel module removed!
May  3 14:25:56 zUbuntu kernel: [16059.298384] [leak_check] Target module: "douane", init area at ffffffffa0005000, core area at ffffffffa04ea000
May  3 14:25:56 zUbuntu kernel: [16059.298398] [leak_check] Totals:
May  3 14:25:56 zUbuntu kernel: [16059.298402] [leak_check] Allocations: 1789431
May  3 14:25:56 zUbuntu kernel: [16059.298406] [leak_check] Possible leaks: 0
May  3 14:25:56 zUbuntu kernel: [16059.298409] [leak_check] Unallocated frees: 0
May  3 14:25:56 zUbuntu kernel: [16059.298411] [leak_check] ======== end of LeakCheck report ========

So it looks like there's no memory leaks in the kernel module for now. In the other hand I saw that the daemon process was using 50% of a core of my CPU during the copy, and the memory increased a lot, so we have to fix this also.

zedtux commented 10 years ago

@pavlinux in the case you would like to use KEDR framework while working on the LKM here is a blog article from my blog which explain how I make it working: http://blog.zedroot.org/debug-your-linux-kernel-module/.

pavlinux commented 10 years ago

For exapmle, leaks before this commit https://github.com/Douane/douane-dkms/commit/881dbec26d145ae24de66008f76a92e146a30c94 difficult catching. Without intentional attack probability occurrence empty TCP or UDP header, with the already established IP connection, about a little less than zero. :)

pavlinux commented 10 years ago

About leaks in push() function:

  1. nlmsg_put() - this function creates and fills the header future NETLINK packet. That returned NULL should really try.
  2. After netlink_unicast() do not need to release the memory!
  3. After https://github.com/Douane/douane-dkms/blob/master/douane.c#L443 сorrect call nlmsg_cancel(skb, nlh), then kfree_skb(skb)
zedtux commented 10 years ago

Thank you @pavlinux for the details.

I have installed now everything in order to debug the kernel module. I'm going to work on it in order to make the douane crashing and find the issue. (I invite you to do the same when patching the kernel module).

hotice commented 10 years ago

I had another panic but the kernel log is pretty large (about 120mb). If you still need this, I can post it here...

As for the packaging, what package has the wrong license? I don't use Launchpad recipes to build the packages, I upload them myself... And about the daemon, indeed it should be stopped when it's uninstalled, but it shouldn't be started when it's installed since it's started by the Configurator... I'll fix the packaging after this bug is fixed...

pavlinux commented 10 years ago

@hotice How does this relate douane? In previous logs you falls avahi and apparmor, nmdb and apparmor, ... And turn off the flag -DEBUG in module. There's nothing useful.

hotice commented 10 years ago

Well, if I stop the Douane daemon and uninstall douane-dkms, I don't get any kernel panics so... Besides, zedtux was able to reproduce it too.

pavlinux commented 10 years ago

@hotice You can work, one day, without apparmor? Apparmor uses a subsystem "audit", which also uses the Netlink. I think they are in conflict.

hotice commented 10 years ago

Ubuntu uses Apparmor by default but I'll disable it and see if this still occurs. Completely removing apparmor is not possible because many Ubuntu packages depend on it...

hotice commented 10 years ago

No kernel panics so far but my laptop froze twice. The last time, I was using Firefox and downloading 2 torrents using Transmission.

Because this is also my work laptop and I don't have another computer, I can't continue testing this... I simply can't work with my laptop freezing and gettting kernel panics all day long so I had to completely remove douane for now.

zedtux commented 10 years ago

Ok, on my side, I'm going to check the kernel panic/freezes thanks to kdump... I'll let you know when I have some news.

@hotice sorry for this ...

hotice commented 10 years ago

@zedtux I don't have to take @pavlinux 's crap so I will stop posting comments here or report any other bug. If you fix this, you have my email...

hotice commented 10 years ago

By the way, the file was so large because Douane with debugging enabled spammed the hell out of the log files.

zedtux commented 10 years ago

@hotice ok ok, no problem. For me the same, with the debug enabled, I had a kern.log file with a size of 7.5Go !

As soon as I have some news, I'll come back to you guys.

zedtux commented 10 years ago

@pavlinux if you're interested, here is my blog article about kdump: http://blog.zedroot.org/linux-kernel-debuging-using-kdump-and-crash/.

pavlinux commented 10 years ago

@zedtux Why kdump, why crash, why KEDR, you have the source code. :) There you can see everything.

zedtux commented 10 years ago

@pavlinux well I see what you mean :) But when my computer freeze, if I can't see the issue, it's then harder to fix it, isn't it ?