1

While rebooting our newest strorage servers, we're experiencing a kernel error (probably) caused by nftables. Please see attached call trace:

enter image description here

After configuring the server (incl nftables), everything worked fine. When we'd tried to reboot the server, it won't boot anymore. Booting using Debian's recovery mode shows the above error.

Question, is there an option/parameter that I can pass to Debian to boot without nftables?

Additional information

Linux version

  • 4.19.0-13-amd64
  • 4.19.0-13-amd64 (recovery mode)
  • 4.19.0-12-amd64
  • 4.19.0-12-amd64 (recovery mode)
0stone0
  • 113
  • 7
  • Can you show the rest of the message, which appears above what you have shown here? – Michael Hampton Dec 15 '20 at 17:23
  • Thank you for your reply @MichaelHampton. Unfortunately I don't have any additional errors that were shown above the image since the system completely freezes, I'm unable to 'scroll up'. I'll take another look tomorrow (need to get to Datacenter) to check for additional output. – 0stone0 Dec 15 '20 at 17:28

1 Answers1

3

Edit the kernel command line and try adding module_blacklist=nf_tables

Upstream in the kernel, there is some possibly relevant fixes. Like this use after free bug fixed in 4.19.72

commit 5776970fb4ecf72db4e0142c03f49b03ed024b75
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Fri Aug 9 11:01:27 2019 +0200

netfilter: nf_tables: use-after-free in failing rule with bound set

[ Upstream commit 6a0a8d10a3661a036b55af695542a714c429ab7c ]

I am uncertain if any Buster kernel has this. Try booting a newer Debian version and using the rescue mode. Bullseye is testing at the moment. However, you can test if its newer kernel is affected, and get a shell to try other things.

Consider setting up kdump and capturing these. Having the full text of the trace helps, and symbols and source even more so.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34