ipvlan module causes kernel crashes (backport fixes from upstream)

[Fabio Kung]

SRU Justification:

[Impact]

ipvlan is currently unusable as removing an interface with an IP address attached will cause a kernel crash.

[Test Case]

As reported in this bug, doing the following will result in a kernel crash:

ip netns add ns0
ip link add link eth0 ipvl0 type ipvlan mode L3
ip link set dev ipvl0 netns ns0

ip netns exec ns0 bash
ip link set dev ipvl0 up
ip -4 addr add 192.168.0.10/24 dev ipvl0
ip link del dev ipvl0

[Fix]

commit 27705f7085ce2e124fac4c280ce824962cc90bb6
Author: Jiri Benc <email address hidden>
Date: Sat Mar 28 19:13:22 2015 +0100

    ipvlan: fix addr hash list corruption

--

Kernel version 3.19, currently being used as the vivid LTS kernel, includes support for ipvlan. But at its current state it is unusable as simply removing an interface with an ip address attached will cause a kernel crash. The fix is already upstream:

https://github.com/torvalds/linux/commit/27705f7085ce2e124fac4c280ce824962cc90bb6

Reproducing this is easy (requires a recent version of iproute2, with support for ipvlan, such as the one in debian/experimental):

ip netns add ns0
ip link add link eth0 ipvl0 type ipvlan mode L3
ip link set dev ipvl0 netns ns0

ip netns exec ns0 bash
ip link set dev ipvl0 up
ip -4 addr add 192.168.0.10/24 dev ipvl0
ip link del dev ipvl0

The last line will cause a kernel crash, with a calltrace that looks like this:

https://gist.github.com/fabiokung/b360cb2f3bdf2fb36c8b

Can we get the fixes backported to the 3.19 LTS kernel from vivid? Ideally we would like to have the whole patchset backported:

https://github.com/torvalds/linux/commit/d91e9015c78af1dc1f8ac4fdcf6118dbc2401668
and
https://github.com/torvalds/linux/commit/8172ba51e257fdd353010cd7caaa37c8bc9eb44a

[Fabio Kung (fabiokung)]

Got the wrong package initially.

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1475434

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Luis Henriques (henrix)]

I've build a test kernel containing commit 27705f7085ce ("ipvlan: fix addr hash list corruption") on top of 3.19.0-23.24. Could you please test it and see if it fixes this bug? I've uploaded it here:

  http://people.canonical.com/~henrix/lp1475434/amd64/

Thanks!

[Dan Peterson (dpiddy)]

Working on giving it a go, thanks!

[Fabio Kung (fabiokung)]

We tested the test kernel and it worked as expected. We can not reproduce the kernel crashes anymore with it. Thank you!

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Fabio Kung (fabiokung)]

I tested linux-image-3.19.0-26-generic from vivid-proposed and it works as expected. I can't reproduce the kernel crashes with it.

Now, I'd love to see a version available for trusty (in trusty-proposed?) as well, as linux-generic-lts-vivid.

[Fabio Kung (fabiokung)]

I failed to mention that I also had linux-image-extra-3.19.0-26-generic and linux-headers-3.19.0-26 from vivid-proposed, but it is probably not relevant:

$ uname -r
3.19.0-26-generic

$ apt-cache policy linux-image-extra-3.19.0-26
linux-image-extra-3.19.0-26-generic:
  Installed: 3.19.0-26.27
  Candidate: 3.19.0-26.27
  Version table:
 *** 3.19.0-26.27 0
        400 http://us.archive.ubuntu.com/ubuntu/ vivid-proposed/main amd64 Packages
        100 /var/lib/dpkg/status

$ apt-cache policy linux-image-3.19.0-26
linux-image-3.19.0-26-lowlatency:
  Installed: (none)
  Candidate: 3.19.0-26.27
  Version table:
     3.19.0-26.27 0
        400 http://us.archive.ubuntu.com/ubuntu/ vivid-proposed/main amd64 Packages
linux-image-3.19.0-26-generic:
  Installed: 3.19.0-26.27
  Candidate: 3.19.0-26.27
  Version table:
 *** 3.19.0-26.27 0
        400 http://us.archive.ubuntu.com/ubuntu/ vivid-proposed/main amd64 Packages
        100 /var/lib/dpkg/status

$ apt-cache policy linux-headers-3.19.0-26
linux-headers-3.19.0-26:
  Installed: 3.19.0-26.27
  Candidate: 3.19.0-26.27
  Version table:
 *** 3.19.0-26.27 0
        400 http://us.archive.ubuntu.com/ubuntu/ vivid-proposed/main amd64 Packages
        100 /var/lib/dpkg/status

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-vivid - 3.19.0-26.28~14.04.1

---------------
linux-lts-vivid (3.19.0-26.28~14.04.1) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1483922

  [ Upstream Kernel Changes ]

  * Revert "Bluetooth: ath3k: Add support of 04ca:300d AR3012 device"

linux (3.19.0-26.27) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1479055
  * [Config] updateconfigs for 3.19.8-ckt4 stable update

  [ Chris J Arges ]

  * [Config] Add MTD_POWERNV_FLASH and OPAL_PRD
    - LP: #1464560

  [ Mika Kuoppala ]

  * SAUCE: i915_bpo: drm/i915: Fix divide by zero on watermark update
    - LP: #1473175

  [ Tim Gardner ]

  * [Config] ACORN_PARTITION=n
    - LP: #1453117
  * [Config] Add i40e[vf] to d-i
    - LP: #1476393

  [ Timo Aaltonen ]

  * SAUCE: i915_bpo: Rebase to v4.2-rc3
    - LP: #1473175
  * SAUCE: i915_bpo: Revert "mm/fault, drm/i915: Use pagefault_disabled()
    to check for disabled pagefaults"
    - LP: #1473175
  * SAUCE: i915_bpo: Revert "drm: i915: Port to new backlight interface
    selection API"
    - LP: #1473175

  [ Upstream Kernel Changes ]

  * Revert "tools/vm: fix page-flags build"
    - LP: #1473547
  * Revert "ALSA: hda - Add mute-LED mode control to Thinkpad"
    - LP: #1473547
  * Revert "drm/radeon: adjust pll when audio is not enabled"
    - LP: #1473547
  * Revert "crypto: talitos - convert to use be16_add_cpu()"
    - LP: #1479048
  * module: Call module notifier on failure after complete_formation()
    - LP: #1473547
  * gpio: gpio-kempld: Fix get_direction return value
    - LP: #1473547
  * ARM: dts: imx27: only map 4 Kbyte for fec registers
    - LP: #1473547
  * ARM: 8356/1: mm: handle non-pmd-aligned end of RAM
    - LP: #1473547
  * x86/mce: Fix MCE severity messages
    - LP: #1473547
  * mac80211: don't use napi_gro_receive() outside NAPI context
    - LP: #1473547
  * iwlwifi: mvm: Free fw_status after use to avoid memory leak
    - LP: #1473547
  * iwlwifi: mvm: clean net-detect info if device was reset during suspend
    - LP: #1473547
  * drm/plane-helper: Adapt cursor hack to transitional helpers
    - LP: #1473547
  * ARM: dts: set display clock correctly for exynos4412-trats2
    - LP: #1473547
  * hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE
    - LP: #1473547
  * mfd: da9052: Fix broken regulator probe
    - LP: #1473547
  * ALSA: hda - Fix noise on AMD radeon 290x controller
    - LP: #1473547
  * lguest: fix out-by-one error in address checking.
    - LP: #1473547
  * xfs: xfs_attr_inactive leaves inconsistent attr fork state behind
    - LP: #1473547
  * xfs: xfs_iozero can return positive errno
    - LP: #1473547
  * fs, omfs: add NULL terminator in the end up the token list
    - LP: #1473547
  * omfs: fix sign confusion for bitmap loop counter
    - LP: #1473547
  * d_walk() might skip too much
    - LP: #1473547
  * dm: fix casting bug in dm_merge_bvec()
    - LP: #1473547
  * hwmon: (nct6775) Add missing sysfs attribute initialization
    - LP: #1473547
  * hwmon: (nct6683) Add missing sysfs attribute initialization
    - LP: #1473547
  * target/pscsi: Don't leak scsi_host if hba is VI...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-26.28

---------------
linux (3.19.0-26.28) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1483630

  [ Upstream Kernel Changes ]

  * Revert "Bluetooth: ath3k: Add support of 04ca:300d AR3012 device"

linux (3.19.0-26.27) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1479055
  * [Config] updateconfigs for 3.19.8-ckt4 stable update

  [ Chris J Arges ]

  * [Config] Add MTD_POWERNV_FLASH and OPAL_PRD
    - LP: #1464560

  [ Mika Kuoppala ]

  * SAUCE: i915_bpo: drm/i915: Fix divide by zero on watermark update
    - LP: #1473175

  [ Tim Gardner ]

  * [Config] ACORN_PARTITION=n
    - LP: #1453117
  * [Config] Add i40e[vf] to d-i
    - LP: #1476393

  [ Timo Aaltonen ]

  * SAUCE: i915_bpo: Rebase to v4.2-rc3
    - LP: #1473175
  * SAUCE: i915_bpo: Revert "mm/fault, drm/i915: Use pagefault_disabled()
    to check for disabled pagefaults"
    - LP: #1473175
  * SAUCE: i915_bpo: Revert "drm: i915: Port to new backlight interface
    selection API"
    - LP: #1473175

  [ Upstream Kernel Changes ]

  * Revert "tools/vm: fix page-flags build"
    - LP: #1473547
  * Revert "ALSA: hda - Add mute-LED mode control to Thinkpad"
    - LP: #1473547
  * Revert "drm/radeon: adjust pll when audio is not enabled"
    - LP: #1473547
  * Revert "crypto: talitos - convert to use be16_add_cpu()"
    - LP: #1479048
  * module: Call module notifier on failure after complete_formation()
    - LP: #1473547
  * gpio: gpio-kempld: Fix get_direction return value
    - LP: #1473547
  * ARM: dts: imx27: only map 4 Kbyte for fec registers
    - LP: #1473547
  * ARM: 8356/1: mm: handle non-pmd-aligned end of RAM
    - LP: #1473547
  * x86/mce: Fix MCE severity messages
    - LP: #1473547
  * mac80211: don't use napi_gro_receive() outside NAPI context
    - LP: #1473547
  * iwlwifi: mvm: Free fw_status after use to avoid memory leak
    - LP: #1473547
  * iwlwifi: mvm: clean net-detect info if device was reset during suspend
    - LP: #1473547
  * drm/plane-helper: Adapt cursor hack to transitional helpers
    - LP: #1473547
  * ARM: dts: set display clock correctly for exynos4412-trats2
    - LP: #1473547
  * hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE
    - LP: #1473547
  * mfd: da9052: Fix broken regulator probe
    - LP: #1473547
  * ALSA: hda - Fix noise on AMD radeon 290x controller
    - LP: #1473547
  * lguest: fix out-by-one error in address checking.
    - LP: #1473547
  * xfs: xfs_attr_inactive leaves inconsistent attr fork state behind
    - LP: #1473547
  * xfs: xfs_iozero can return positive errno
    - LP: #1473547
  * fs, omfs: add NULL terminator in the end up the token list
    - LP: #1473547
  * omfs: fix sign confusion for bitmap loop counter
    - LP: #1473547
  * d_walk() might skip too much
    - LP: #1473547
  * dm: fix casting bug in dm_merge_bvec()
    - LP: #1473547
  * hwmon: (nct6775) Add missing sysfs attribute initialization
    - LP: #1473547
  * hwmon: (nct6683) Add missing sysfs attribute initialization
    - LP: #1473547
  * target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST
    - LP: #1473547
  * net...