test_map in ubuntu_bpf failed with "Allowed update sockmap '0:3' not in ESTABLISHED"

Bug #1839912 reported by Po-Hsu Lin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-kernel-tests
New
Undecided
Unassigned
linux (Ubuntu)
Confirmed
Undecided
Unassigned
Bionic
Fix Released
Medium
Unassigned

Bug Description

[Impact]
test_maps bpf selftests is failing on bionic.

[Regression potential]
Kernel is not changed, but test may give a false pass with this change.

[Test case]
The fixed test has been run on the kernel in -proposed, and passes.
After building it, just run ./test_maps from tools/testing/selftests/bpf/.

--------------------------------------

This is at lease a test case regression with the proposed kernel:
selftests: test_maps
========================================
Allowed update sockmap '0:3' not in ESTABLISHED
not ok 1..3 selftests: test_maps [FAIL]

But with older kernel:
selftests: test_maps
========================================
test_maps: OK
ok 1..3 selftests: test_maps [PASS]

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: linux-image-4.15.0-58-generic 4.15.0-58.64
ProcVersionSignature: User Name 4.15.0-58.64-generic 4.15.18
Uname: Linux 4.15.0-58-generic x86_64
AlsaDevices:
 total 0
 crw-rw---- 1 root audio 116, 1 Aug 13 03:42 seq
 crw-rw---- 1 root audio 116, 33 Aug 13 03:42 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay': 'aplay'
ApportVersion: 2.20.9-0ubuntu7.7
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord': 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
Date: Tue Aug 13 03:52:52 2019
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig': 'iwconfig'
MachineType: Intel Corporation S1200RP
PciMultimedia:

ProcFB: 0 mgadrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-58-generic root=UUID=b0d2ae4e-12dd-423e-acea-272ee8b2a893 ro
RelatedPackageVersions:
 linux-restricted-modules-4.15.0-58-generic N/A
 linux-backports-modules-4.15.0-58-generic N/A
 linux-firmware 1.173.10
RfKill: Error: [Errno 2] No such file or directory: 'rfkill': 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/01/2015
dmi.bios.vendor: Intel Corp.
dmi.bios.version: S1200RP.86B.03.02.0003.070120151022
dmi.board.asset.tag: ....................
dmi.board.name: S1200RP
dmi.board.vendor: Intel Corporation
dmi.board.version: G62254-407
dmi.chassis.asset.tag: ....................
dmi.chassis.type: 17
dmi.chassis.vendor: ..............................
dmi.chassis.version: ..................
dmi.modalias: dmi:bvnIntelCorp.:bvrS1200RP.86B.03.02.0003.070120151022:bd07/01/2015:svnIntelCorporation:pnS1200RP:pvr....................:rvnIntelCorporation:rnS1200RP:rvrG62254-407:cvn..............................:ct17:cvr..................:
dmi.product.family: To be filled by O.E.M.
dmi.product.name: S1200RP
dmi.product.version: ....................
dmi.sys.vendor: Intel Corporation

Revision history for this message
Po-Hsu Lin (cypressyew) wrote :
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Po-Hsu Lin (cypressyew)
tags: added: ubuntu-bpf
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

It's
 Allowed update sockmap '0:8' not in ESTABLISHED

in this cycle.

tags: added: sru-20190812
Po-Hsu Lin (cypressyew)
tags: added: sru-20190902
Sean Feole (sfeole)
tags: added: sru20191202
tags: added: sru-20191202
removed: sru20191202
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Found on 4.15.0-1037.41-oracle

tags: added: sru-20200316
Po-Hsu Lin (cypressyew)
tags: added: sru-20200406
Po-Hsu Lin (cypressyew)
tags: added: sru-20200518
Po-Hsu Lin (cypressyew)
tags: added: sru-20200608
tags: added: sru-20200921
tags: added: azure focal
tags: removed: focal
tags: added: 4.15
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Still visible 4.15.0-1059.65 - oracle

tags: added: sru-20201109
tags: added: oracle
tags: added: sru
tags: added: sru-20210104
Revision history for this message
Francis Ginther (fginther) wrote :

Still seen with linux-oracle 4.15.0-1065.73.

tags: added: sru-20210125
tags: added: fips
tags: added: aws
tags: added: sru-20210222
Revision history for this message
Marcelo Cerri (mhcerri) wrote :

Still happening with linux-azure-4.15 4.15.0-1112.125

tags: added: sru-20210315
Revision history for this message
Marcelo Cerri (mhcerri) wrote :

Also seen in bionic linux-azure-fips 4.15.0-2024.27 for sru-20210315

Revision history for this message
Marcelo Cerri (mhcerri) wrote :

Also seen in bionic linux-gcp-fips 4.15.0-2007.8 for sru-20210315

tags: added: gcp-fips
Revision history for this message
Ian May (ian-may) wrote :

bionic/linux-azure-fips: 4.15.0-2026.29

tags: added: sru-20210412
Revision history for this message
Ian May (ian-may) wrote :

bionic/linux-azure-4.15: 4.15.0-1114.127

Revision history for this message
Ian May (ian-may) wrote :

bionic/linux-gcp-fips: 4.15.0-2009.10

Revision history for this message
Kleber Sacilotto de Souza (kleber-souza) wrote :

Found with bionic/linux-aws-fips 4.15.0-2044.46.

tags: added: aws-fips
Revision history for this message
Ian May (ian-may) wrote :

bionic/linux-oracle: 4.15.0-1071.79

Revision history for this message
Ian May (ian-may) wrote :

bionic/linux-aws: 4.15.0-1103.110

tags: added: sru-20210510
Revision history for this message
Ian May (ian-may) wrote :

Found on bionic/linux-azure-fips: 4.15.0-2027.30

Revision history for this message
Thadeu Lima de Souza Cascardo (cascardo) wrote :

The problem on 4.15 kernels is due to the backport of:

5028027844cf bpf: test_maps, only support ESTABLISHED socks

that only touches the test, without the respective fixes in the kernel.

Here is the list of Fixes for 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks"):

5028027844cf bpf: test_maps, only support ESTABLISHED socks
b05545e15e1f bpf: sockmap, fix transition through disconnect without close
5607fff30363 bpf: sockmap only allow ESTABLISHED sock state
90545cdc3f2b tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach
7ebc14d507b4 bpf: sockmap, consume_skb in close path
952fad8e3239 bpf: fix sock_map_alloc() error path

Bionic has only backported the selftests one and the icsk_ulp one.

To make the test pass, I believe at least 5607fff30363 would be necessary.

But it seems worth to also investigate the need for the other 3 (they seem worthy from a first look).

Cascardo.

Revision history for this message
Thadeu Lima de Souza Cascardo (cascardo) wrote :

So, while looking further, I found out that 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks") is not even present on our 4.15 kernels. Not sure why the two commits were backported. The tcp,ulp one seems fine to keep.

Even 952fad8e3239 ("bpf: fix sock_map_alloc() error path") is not necessary if we are not setting err right before, which we do with 1aa12bdf1bfb. Other patches do not even apply, they are really dependent on 1aa12bdf1bfb.

1aa12bdf1bfb, on the other hand, would be necessary, because I was able to reproduce a BPF program leak. But that requires the use of sockmap, which is restricted to root userns CAP_NET_ADMIN.

So, we need to pick 1aa12bdf1bfb and all of those fixes, or simply revert 5028027844cf ("bpf: test_maps, only support ESTABLISHED socks").

Stefan Bader (smb)
Changed in linux (Ubuntu Bionic):
importance: Undecided → Medium
status: New → In Progress
description: updated
Stefan Bader (smb)
Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-bionic
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Manually tested with 4.15.0-150-generic on node glameow. This test-map test can pass without any issue.

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (33.0 KiB)

This bug was fixed in the package linux - 4.15.0-151.157

---------------
linux (4.15.0-151.157) bionic; urgency=medium

  * CVE-2021-33909
    - SAUCE: seq_file: Disallow extremely large seq buffer allocations

linux (4.15.0-150.155) bionic; urgency=medium

  * bionic/linux: 4.15.0-150.155 -proposed tracker (LP: #1934374)

  * lxd exec fails (LP: #1934187)
    - SAUCE: Revert "proc: Check /proc/$pid/attr/ writes against file opener"

linux (4.15.0-149.153) bionic; urgency=medium

  * bionic/linux: 4.15.0-149.153 -proposed tracker (LP: #1933434)

  * selftests: bpf: test_verifier fixes (LP: #1933385)
    - bpf: Update selftests to reflect new error states
    - bpf, selftests: Adjust few selftest result_unpriv outcomes

  * CVE-2021-33200
    - bpf: Fix mask direction swap upon off reg sign change

linux (4.15.0-148.152) bionic; urgency=medium

  * bionic/linux: 4.15.0-148.152 -proposed tracker (LP: #1932515)

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * Upstream v5.9 introduced 'module' patches that removed exported symbols
    (LP: #1932065)
    - SAUCE: Revert "modules: inherit TAINT_PROPRIETARY_MODULE"
    - SAUCE: Revert "modules: return licensing information from find_symbol"
    - SAUCE: Revert "modules: rename the licence field in struct symsearch to
      license"
    - SAUCE: Revert "modules: unexport __module_address"
    - SAUCE: Revert "modules: unexport __module_text_address"
    - SAUCE: Revert "modules: mark each_symbol_section static"
    - SAUCE: Revert "modules: mark find_symbol static"
    - SAUCE: Revert "modules: mark ref_module static"

  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service

  * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740)
    - openrisc: Fix a memory leak
    - RDMA/rxe: Clear all QP fields if creation failed
    - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword()
    - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
    - cifs: fix memory leak in smb2_copychunk_range
    - ALSA: line6: Fix racy initialization of LINE6 MIDI
    - ALSA: usb-audio: Validate MS endpoint descriptors
    - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
    - Revert "ALSA: sb8: add a check for request_region"
    - Revert "rapidio: fix a NULL pointer dereference when create_workqueue()
      fails"
    - rapidio: handle create_workqueue() failure
    - xen-pciback: reconfigure also from backend watch handler
    - dm snapshot: fix crash with transient storage and zero chunk size
    - Revert "video: hgafb: fix potential NULL pointer dereference"
    - Revert "net: stmicro: fix a missing check of clk_prepare"
    - Revert "leds: lp5523: fix a missing check of return value of lp55xx_read"
    - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
    - Revert "video: imsttfb: fix potential NULL pointer dereferences"
    - Revert "ecryptfs: replace BUG_ON with error handling code"
    - Revert "gdrom: fix a memory leak bug"
    - cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom
    - cdrom: gdrom: ini...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Po-Hsu Lin (cypressyew)
tags: removed: sru
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.