#888695 nftables: Enabled systemd service blocks boot sequence

Package:
nftables
Source:
nftables
Description:
Program to control packet filtering rules by Netfilter project
Submitter:
Paolo Rosquin
Date:
2018-11-29 13:09:04 UTC
Severity:
important
#888695#5
Date:
2018-01-28 19:12:41 UTC
From:
To:
Dear Maintainer,

When nftables is enabled at boot time, it will fail to load and stop the whole
booting process with "A start job is running for...". If I am not mistaken, it
started when I updated to kernel 4.14.

A workaround is to comment out the following lines from
/lib/systemd/system/nftables.service:

#Wants=network-pre.target
#Before=network-pre.target shutdown.target
#Conflicts=shutdown.target
#DefaultDependencies=no

Here an extract of the relevant syslog part:

Jan 28 15:27:48 kernel: [  242.652106] INFO: task (t-daemon):932 blocked for
more than 120 seconds.
Jan 28 15:27:48 kernel: [  242.652175]       Not tainted 4.14.0-3-amd64 #1
Debian 4.14.13-1
Jan 28 15:27:48 kernel: [  242.652229] "echo 0 >
/proc/sys/kernel/hung_task_timeout_secs" disables this message.
Jan 28 15:27:48 kernel: [  242.652299] (t-daemon)      D    0   932      1
0x00000004
Jan 28 15:27:48 kernel: [  242.652353] Call Trace:
Jan 28 15:27:48 kernel: [  242.652391]  ? __schedule+0x28e/0x880
Jan 28 15:27:48 kernel: [  242.652432]  schedule+0x28/0x80
Jan 28 15:27:48 kernel: [  242.652468]  schedule_preempt_disabled+0xa/0x10
Jan 28 15:27:48 kernel: [  242.652512]  __mutex_lock.isra.1+0x1a0/0x4e0
Jan 28 15:27:48 kernel: [  242.652562]  ? nft_register_afinfo+0x2e/0x70
[nf_tables]
Jan 28 15:27:48 kernel: [  242.652616]  nft_register_afinfo+0x2e/0x70
[nf_tables]
Jan 28 15:27:48 kernel: [  242.652670]  nf_tables_ipv4_init_net+0xe9/0x110
[nf_tables_ipv4]
Jan 28 15:27:48 kernel: [  242.652740]  ops_init+0x3d/0x120
Jan 28 15:27:48 kernel: [  242.652776]  ? kmem_cache_alloc+0x1c9/0x590
Jan 28 15:27:48 kernel: [  242.652818]  setup_net+0x96/0x160
Jan 28 15:27:48 kernel: [  242.652854]  copy_net_ns+0xc9/0x220
Jan 28 15:27:48 kernel: [  242.652891]  create_new_namespaces+0x11c/0x1b0
Jan 28 15:27:48 kernel: [  242.652937]  unshare_nsproxy_namespaces+0x59/0xb0
Jan 28 15:27:48 kernel: [  242.652983]  SyS_unshare+0x216/0x3d0
Jan 28 15:27:48 kernel: [  242.653023]  system_call_fast_compare_end+0xc/0x6f
Jan 28 15:27:48 kernel: [  242.653069] RIP: 0033:0x7f4c3dfeded7
Jan 28 15:27:48 kernel: [  242.653105] RSP: 002b:00007ffe485f1388 EFLAGS:
00000246
Jan 28 15:27:48 kernel: [  242.653115] INFO: task modprobe:991 blocked for more
than 120 seconds.
Jan 28 15:27:48 kernel: [  242.653221]       Not tainted 4.14.0-3-amd64 #1
Debian 4.14.13-1
Jan 28 15:27:48 kernel: [  242.653274] "echo 0 >
/proc/sys/kernel/hung_task_timeout_secs" disables this message.
Jan 28 15:27:48 kernel: [  242.653343] modprobe        D    0   991    223
0x80000000
Jan 28 15:27:48 kernel: [  242.653396] Call Trace:
Jan 28 15:27:48 kernel: [  242.653426]  ? __schedule+0x28e/0x880
Jan 28 15:27:48 kernel: [  242.653465]  schedule+0x28/0x80
Jan 28 15:27:48 kernel: [  242.653505]  schedule_preempt_disabled+0xa/0x10
Jan 28 15:27:48 kernel: [  242.653549]  __mutex_lock.isra.1+0x1a0/0x4e0
Jan 28 15:27:48 kernel: [  242.653592]  ? __kmem_cache_alias+0x1a/0x30
Jan 28 15:27:48 kernel: [  242.653635]  ? 0xffffffffc09c1000
Jan 28 15:27:48 kernel: [  242.653671]  ? register_pernet_subsys+0x15/0x40
Jan 28 15:27:48 kernel: [  242.653716]  register_pernet_subsys+0x15/0x40
Jan 28 15:27:48 kernel: [  242.653762]  nf_ct_frag6_init+0x76/0xa0
[nf_defrag_ipv6]
Jan 28 15:27:48 kernel: [  242.653815]  nf_defrag_init+0x6/0x1000
[nf_defrag_ipv6]
Jan 28 15:27:48 kernel: [  242.653868]  do_one_initcall+0x4b/0x190
Jan 28 15:27:48 kernel: [  242.656152]  ? __vunmap+0x6d/0xb0
Jan 28 15:27:48 kernel: [  242.657490]  do_init_module+0x5b/0x1f1
Jan 28 15:27:48 kernel: [  242.658018]  load_module+0x2542/0x2c00
Jan 28 15:27:48 kernel: [  242.658543]  ? SYSC_finit_module+0xe9/0x110
Jan 28 15:27:48 kernel: [  242.659068]  SYSC_finit_module+0xe9/0x110
Jan 28 15:27:48 kernel: [  242.659589]  system_call_fast_compare_end+0xc/0x6f
Jan 28 15:27:48 kernel: [  242.660114] RIP: 0033:0x7f4c1ec65e19


BR
#888695#10
Date:
2018-01-30 13:05:35 UTC
From:
To:
I have the same versions and I don't see this behavior.
Also, the same systemd .service configuration.
#888695#15
Date:
2018-02-01 08:50:31 UTC
From:
To:
No idea why it only happens to me. Anyway, I have narrowed down the
problem to one line in nftables.service:

DefaultDependencies=no

Without this everything works fine.

On Tue, Jan 30, 2018 at 2:05 PM, Arturo Borrero Gonzalez <arturo@debian.org> wrote:
#888695#20
Date:
2018-11-28 09:32:11 UTC
From:
To:
Control: tags -1 moreinfo

Could you please check if this still happens in more recent versions of
nftables?

specifically:
* nft 0.9.0
* kernel 4.18

Thanks!
#888695#27
Date:
2018-11-28 19:26:51 UTC
From:
To:
Just checked and it works fine with DefaultDependencies=no :)

Gracias!
On Wed, Nov 28, 2018 at 10:32 AM Arturo Borrero Gonzalez <arturo@debian.org> wrote:
#888695#32
Date:
2018-11-29 13:06:55 UTC
From:
To:
I'm interested in the kernel oops, that should be fixed independently of
the systemd configuration.