Bug 770709

Created attachment 549825 [details]
Kernel stack trace

Description of problem:
With the following sysctl options enabled:
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
Bridged network traffic will be filtered by iptables.  One of the iptables rules may be a REJECT rule, which causes an ICMP message to be produced (e.g. port unreachable).  Triggering the REJECT rule will often cause the kernel to panic after stack corruption.  I am seeing this problem when running KVM virtual machines in bridged network mode with the host machine running iptables to filter traffic to the virtual machines.

Version-Release number of selected component (if applicable):
This is a Scientific Linux 6.1 machine, but as this issue will affect Red Hat machines equally I am filing it in this Bugzilla.
2.6.32-220.2.1.el6.x86_64
2.6.32-131.21.1.el6.x86_64
2.6.32-131.17.1.el6.x86_64
2.6.32-131.6.1.el6.x86_64

How reproducible:
Frequently breaks, but not always.

Steps to Reproduce:
1. Configure KVM with a virtual machine running on a bridged network.
2. Enable the following sysctl options:
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
3. Configure an iptables rule with "-j REJECT --reject-with icmp-port-unreachable" on the host machine to filter some of the bridged traffic.
4. Send some traffic from a remote host to the virtual machine that will trigger the host's REJECT rule.
  
Actual results:
Kernel stack corruption and kernel panic.

Expected results:
ICMP port unreachable packet should be transmitted to the remote machine.

Additional info:
This appears to be a similar bug to: http://www.spinics.net/lists/netdev/msg139436.html
The stack trace I have attached to this report indicates that iptable_filter is calling icmp_send during the bridge processing and this is blowing up.