PowerEdge：Linux 在執行 PF_RING 時意外重新開機

執行時 pf_ring 對於網路數據包捕獲，伺服器意外重新啟動。無論是 Red Hat Enterprise Linux 或 Ubuntu。

已啟用 kdump 並被俘 vmcore 如下

[113309.901854] Modules linked in: i40e(OE) vxlan ip6_udp_tunnel udp_tunnel pf_ring(OE) tcp_lp binfmt_misc xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun devlink ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat iptable_mangle iptable_security iptable_raw nf_conntrack ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter sunrpc dm_mirror dm_region_hash dm_log dm_mod dell_smbios dcdbas dell_wmi_descriptor joydev vfat fat amd64_edac_mod edac_mce_amd kvm_amd kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper
[113309.901871]  ablk_helper cryptd pcspkr ipmi_ssif sg k10temp i2c_piix4 wmi ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm ahci libahci crct10dif_pclmul drm crct10dif_common crc32c_intel libata tg3 megaraid_sas ptp drm_panel_orientation_quirks pps_core fuse [last unloaded: i40e]
[113309.901882] CPU: 16 PID: 0 Comm: swapper/16 Kdump: loaded Tainted: G    B      OE  ------------   3.10.0-1160.el7.x86_64 #1
[113309.901883] Hardware name:    /0PYVT1, BIOS 2.6.6 01/13/2022
[113309.901885] Call Trace:
[113309.901886]  <IRQ>  [<ffffffffa2b81340>] dump_stack+0x19/0x1b
[113309.901890]  [<ffffffffa2b7befd>] bad_page.part.75+0xdc/0xf9
[113309.901892]  [<ffffffffa25c8625>] get_page_from_freelist+0x7a5/0xac0
[113309.901895]  [<ffffffffa2a3c6f7>] ? kfree_skbmem+0x37/0x90
[113309.901898]  [<ffffffffa25c8aa6>] __alloc_pages_nodemask+0x166/0x450
[113309.901902]  [<ffffffffc0778158>] i40e_alloc_rx_buffers+0x168/0x320 [i40e]
[113309.901907]  [<ffffffffc07788dc>] i40e_clean_rx_irq+0x5cc/0xbc0 [i40e]
[113309.901912]  [<ffffffffc077939c>] i40e_napi_poll+0x3ac/0x830 [i40e]
[113309.901915]  [<ffffffffa2a555bf>] net_rx_action+0x26f/0x390
[113309.901917]  [<ffffffffa24a4b95>] __do_softirq+0xf5/0x280
[113309.901920]  [<ffffffffa2b974ec>] call_softirq+0x1c/0x30
[113309.901922]  [<ffffffffa242f715>] do_softirq+0x65/0xa0
[113309.901924]  [<ffffffffa24a4f15>] irq_exit+0x105/0x110
[113309.901927]  [<ffffffffa2b98936>] do_IRQ+0x56/0xf0
[113309.901930]  [<ffffffffa2b8a36a>] common_interrupt+0x16a/0x16a
[113309.901932]  <EOI>  [<ffffffffa2b89000>] ? __cpuidle_text_start+0x8/0x8
[113309.901936]  [<ffffffffa2b8924b>] ? native_safe_halt+0xb/0x20
[113309.901939]  [<ffffffffa2b8901e>] default_idle+0x1e/0xc0
[113309.901942]  [<ffffffffa2437ca0>] arch_cpu_idle+0x20/0xc0
[113309.901945]  [<ffffffffa25011ea>] cpu_startup_entry+0x14a/0x1e0
[113309.901948]  [<ffffffffa245a7f7>] start_secondary+0x1f7/0x270
[113309.901951]  [<ffffffffa24000d5>] start_cpu+0x5/0x14
[113309.901953] BUG: Bad page state in process swapper/16  pfn:7ef0797
[113309.901955] page:ffffdeca3bc1e5c0 count:65533 mapcount:0 mapping:          (null) index:0x0
[113309.901957] page flags: 0x6fffff00000000()
[113309.901960] page dumped because: nonzero _count

從 vmcore 分析， i40e 已將作為網路卡驅動程式的伺服器重新開機，以及 i40e 司機被玷污了。

污點 i40e 驅動程式來自 PF_RING。更新 PF_RING 到使用新版 i40e 驅動程式 （i40e-2.14.13 及更新版本）。