test_map in ubuntu_bpf failed with "Allowed update sockmap '0:3' not in ESTABLISHED"

[Po-Hsu Lin]

[Impact]
test_maps bpf selftests is failing on bionic.

[Regression potential]
Kernel is not changed, but test may give a false pass with this change.

[Test case]
The fixed test has been run on the kernel in -proposed, and passes.
After building it, just run ./test_maps from tools/testing/selftests/bpf/.

--------------------------------------

This is at lease a test case regression with the proposed kernel:
selftests: test_maps
========================================
Allowed update sockmap '0:3' not in ESTABLISHED
not ok 1..3 selftests: test_maps [FAIL]

But with older kernel:
selftests: test_maps
========================================
test_maps: OK
ok 1..3 selftests: test_maps [PASS]

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: linux-image-4.15.0-58-generic 4.15.0-58.64
ProcVersionSignature: User Name 4.15.0-58.64-generic 4.15.18
Uname: Linux 4.15.0-58-generic x86_64
AlsaDevices:
 total 0
 crw-rw---- 1 root audio 116, 1 Aug 13 03:42 seq
 crw-rw---- 1 root audio 116, 33 Aug 13 03:42 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay': 'aplay'
ApportVersion: 2.20.9-0ubuntu7.7
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord': 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
Date: Tue Aug 13 03:52:52 2019
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig': 'iwconfig'
MachineType: Intel Corporation S1200RP
PciMultimedia:

ProcFB: 0 mgadrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-58-generic root=UUID=b0d2ae4e-12dd-423e-acea-272ee8b2a893 ro
RelatedPackageVersions:
 linux-restricted-modules-4.15.0-58-generic N/A
 linux-backports-modules-4.15.0-58-generic N/A
 linux-firmware 1.173.10
RfKill: Error: [Errno 2] No such file or directory: 'rfkill': 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/01/2015
dmi.bios.vendor: Intel Corp.
dmi.bios.version: S1200RP.86B.03.02.0003.070120151022
dmi.board.asset.tag: ....................
dmi.board.name: S1200RP
dmi.board.vendor: Intel Corporation
dmi.board.version: G62254-407
dmi.chassis.asset.tag: ....................
dmi.chassis.type: 17
dmi.chassis.vendor: ..............................
dmi.chassis.version: ..................
dmi.modalias: dmi:bvnIntelCorp.:bvrS1200RP.86B.03.02.0003.070120151022:bd07/01/2015:svnIntelCorporation:pnS1200RP:pvr....................:rvnIntelCorporation:rnS1200RP:rvrG62254-407:cvn..............................:ct17:cvr..................:
dmi.product.family: To be filled by O.E.M.
dmi.product.name: S1200RP
dmi.product.version: ....................
dmi.sys.vendor: Intel Corporation

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This change was made by a bot.

[Po-Hsu Lin (cypressyew)]

It's
 Allowed update sockmap '0:8' not in ESTABLISHED

in this cycle.

[Po-Hsu Lin (cypressyew)]

Found on 4.15.0-1037.41-oracle

[Po-Hsu Lin (cypressyew)]

Still visible 4.15.0-1059.65 - oracle

[Francis Ginther (fginther)]

Still seen with linux-oracle 4.15.0-1065.73.

[Marcelo Cerri (mhcerri)]

Still happening with linux-azure-4.15 4.15.0-1112.125

[Marcelo Cerri (mhcerri)]

Also seen in bionic linux-azure-fips 4.15.0-2024.27 for sru-20210315

[Marcelo Cerri (mhcerri)]

Also seen in bionic linux-gcp-fips 4.15.0-2007.8 for sru-20210315

[Ian May (ian-may)]

bionic/linux-azure-fips: 4.15.0-2026.29

[Ian May (ian-may)]

bionic/linux-azure-4.15: 4.15.0-1114.127

[Ian May (ian-may)]

bionic/linux-gcp-fips: 4.15.0-2009.10

[Kleber Sacilotto de Souza (kleber-souza)]

Found with bionic/linux-aws-fips 4.15.0-2044.46.

[Ian May (ian-may)]

bionic/linux-oracle: 4.15.0-1071.79

[Ian May (ian-may)]

bionic/linux-aws: 4.15.0-1103.110

[Ian May (ian-may)]

Found on bionic/linux-azure-fips: 4.15.0-2027.30

[Thadeu Lima de Souza Cascardo (cascardo)]

The problem on 4.15 kernels is due to the backport of:

5028027844cf bpf: test_maps, only support ESTABLISHED socks

that only touches the test, without the respective fixes in the kernel.

Here is the list of Fixes for 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks"):

5028027844cf bpf: test_maps, only support ESTABLISHED socks
b05545e15e1f bpf: sockmap, fix transition through disconnect without close
5607fff30363 bpf: sockmap only allow ESTABLISHED sock state
90545cdc3f2b tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach
7ebc14d507b4 bpf: sockmap, consume_skb in close path
952fad8e3239 bpf: fix sock_map_alloc() error path

Bionic has only backported the selftests one and the icsk_ulp one.

To make the test pass, I believe at least 5607fff30363 would be necessary.

But it seems worth to also investigate the need for the other 3 (they seem worthy from a first look).

Cascardo.

[Thadeu Lima de Souza Cascardo (cascardo)]

So, while looking further, I found out that 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks") is not even present on our 4.15 kernels. Not sure why the two commits were backported. The tcp,ulp one seems fine to keep.

Even 952fad8e3239 ("bpf: fix sock_map_alloc() error path") is not necessary if we are not setting err right before, which we do with 1aa12bdf1bfb. Other patches do not even apply, they are really dependent on 1aa12bdf1bfb.

1aa12bdf1bfb, on the other hand, would be necessary, because I was able to reproduce a BPF program leak. But that requires the use of sockmap, which is restricted to root userns CAP_NET_ADMIN.

So, we need to pick 1aa12bdf1bfb and all of those fixes, or simply revert 5028027844cf ("bpf: test_maps, only support ESTABLISHED socks").

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Po-Hsu Lin (cypressyew)]

Manually tested with 4.15.0-150-generic on node glameow. This test-map test can pass without any issue.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.15.0-151.157

---------------
linux (4.15.0-151.157) bionic; urgency=medium

  * CVE-2021-33909
    - SAUCE: seq_file: Disallow extremely large seq buffer allocations

linux (4.15.0-150.155) bionic; urgency=medium

  * bionic/linux: 4.15.0-150.155 -proposed tracker (LP: #1934374)

  * lxd exec fails (LP: #1934187)
    - SAUCE: Revert "proc: Check /proc/$pid/attr/ writes against file opener"

linux (4.15.0-149.153) bionic; urgency=medium

  * bionic/linux: 4.15.0-149.153 -proposed tracker (LP: #1933434)

  * selftests: bpf: test_verifier fixes (LP: #1933385)
    - bpf: Update selftests to reflect new error states
    - bpf, selftests: Adjust few selftest result_unpriv outcomes

  * CVE-2021-33200
    - bpf: Fix mask direction swap upon off reg sign change

linux (4.15.0-148.152) bionic; urgency=medium

  * bionic/linux: 4.15.0-148.152 -proposed tracker (LP: #1932515)

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * Upstream v5.9 introduced 'module' patches that removed exported symbols
    (LP: #1932065)
    - SAUCE: Revert "modules: inherit TAINT_PROPRIETARY_MODULE"
    - SAUCE: Revert "modules: return licensing information from find_symbol"
    - SAUCE: Revert "modules: rename the licence field in struct symsearch to
      license"
    - SAUCE: Revert "modules: unexport __module_address"
    - SAUCE: Revert "modules: unexport __module_text_address"
    - SAUCE: Revert "modules: mark each_symbol_section static"
    - SAUCE: Revert "modules: mark find_symbol static"
    - SAUCE: Revert "modules: mark ref_module static"

  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service

  * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740)
    - openrisc: Fix a memory leak
    - RDMA/rxe: Clear all QP fields if creation failed
    - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword()
    - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
    - cifs: fix memory leak in smb2_copychunk_range
    - ALSA: line6: Fix racy initialization of LINE6 MIDI
    - ALSA: usb-audio: Validate MS endpoint descriptors
    - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
    - Revert "ALSA: sb8: add a check for request_region"
    - Revert "rapidio: fix a NULL pointer dereference when create_workqueue()
      fails"
    - rapidio: handle create_workqueue() failure
    - xen-pciback: reconfigure also from backend watch handler
    - dm snapshot: fix crash with transient storage and zero chunk size
    - Revert "video: hgafb: fix potential NULL pointer dereference"
    - Revert "net: stmicro: fix a missing check of clk_prepare"
    - Revert "leds: lp5523: fix a missing check of return value of lp55xx_read"
    - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
    - Revert "video: imsttfb: fix potential NULL pointer dereferences"
    - Revert "ecryptfs: replace BUG_ON with error handling code"
    - Revert "gdrom: fix a memory leak bug"
    - cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom
    - cdrom: gdrom: ini...