hangup01 from pty in ubuntu_ltp_stable failed on G-5.8

Bug #1925290 reported by Po-Hsu Lin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-kernel-tests
Fix Released
Undecided
Unassigned
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Groovy
Fix Released
Undecided
Unassigned

Bug Description

[Impact]
Testcase hangup01 from ubuntu_ltp_stable.pty is failing on Groovy 5.8.0-51.57.

Test case failed with:
 hangup01 1 TFAIL : hangup01.c:132: unexpected message 3
 tag=hangup01 stime=1618856629 dur=1 exit=exited stat=1

It was found that the regression was introduced by the following commits applied via stable uddates:

dd78b0c483e3 tty: implement read_iter
3b830a9c34d5 tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer

These patches were applied via bug 1921960 ("Groovy update: upstream stable patchset 2021-03-30").

[Fix]
Revert the patches mentioned above until a fix can be found.

[Test case]
Run the pty testsuite from ubuntu_ltp_stable.

[Where problems could occur]
If reverting these two patches is not enough to bring the code to the behavior of the tty driver before 5.8.0-51.57 then remaining issues could still be present on the tty code. Those issues should be caught by the ltp testcases though.

[Original Description]
Issue found on Groovy 5.8.0-51.57 with P8 node "dryden" and ARM64 node "helo-kernel" and AMD64 node "onibi"

Test case failed with:
 hangup01 1 TFAIL : hangup01.c:132: unexpected message 3
 tag=hangup01 stime=1618856629 dur=1 exit=exited stat=1

CVE References

Po-Hsu Lin (cypressyew)
tags: added: sru-20210412
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Reproduced manually with node dryden, it looks like this is a potential regression.

5.8.0-50.56 - passed
5.8.0-51.57 - failed

<<<test_start>>>
tag=hangup01 stime=1618996707
cmdline="hangup01"
contacts=""
analysis=exit
<<<test_output>>>
incrementing stop
hangup01 1 TFAIL : hangup01.c:132: unexpected message 3
<<<execution_status>>>
initiation_status="ok"
duration=1 termination_type=exited termination_id=1 corefile=no
cutime=0 cstime=0
<<<test_end>>>

Apr 21 09:18:27 dryden kernel: [ 7150.667723] LTP: starting hangup01

Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

No useful output in dmesg output after "LTP: starting hangup01"

Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Found on AMD64 node "onibi" as well, bug description updated.

summary: - hangup01 from pty in ubuntu_ltp_stable failed on G-5.8 P8/arm64
+ hangup01 from pty in ubuntu_ltp_stable failed on G-5.8
description: updated
tags: added: amd64
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1925290

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Changed in linux (Ubuntu Groovy):
status: New → Incomplete
Changed in linux (Ubuntu Groovy):
status: Incomplete → Confirmed
Revision history for this message
Kleber Sacilotto de Souza (kleber-souza) wrote :

The issue is fixed by reverting the following two patches:

commit b7bfa1af145a6aa3868894a4be82f7b2034c564a
Author: Linus Torvalds <email address hidden>
Date: Tue Jan 19 10:49:19 2021 -0800

    tty: implement read_iter

    BugLink: https://bugs.launchpad.net/bugs/1921960

    [ Upstream commit dd78b0c483e33225e0e0782b0ed887129b00f956 ]

commit 4b71b60ef2cb9f930b8056049a1d8de170be42bc
Author: Linus Torvalds <email address hidden>
Date: Mon Jan 18 13:31:30 2021 -0800

    tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer

    BugLink: https://bugs.launchpad.net/bugs/1921960

    [ Upstream commit 3b830a9c34d5897be07176ce4e6f2d75e2c8cfd7 ]

description: updated
description: updated
Revision history for this message
Kleber Sacilotto de Souza (kleber-souza) wrote :
Changed in linux (Ubuntu Groovy):
status: Confirmed → In Progress
Changed in linux (Ubuntu):
status: Incomplete → Fix Released
Changed in linux (Ubuntu Groovy):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-groovy' to 'verification-done-groovy'. If the problem still exists, change the tag 'verification-needed-groovy' to 'verification-failed-groovy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-groovy
Revision history for this message
Kleber Sacilotto de Souza (kleber-souza) wrote :

Confirmed that the testcase is now successful with groovy/linux 5.8.0-52.59.

05/03 01:41:13 DEBUG| utils:0153| [stdout] startup='Mon May 3 01:41:12 2021'
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 1 TPASS : test1
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 2 TPASS : test2
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 3 TPASS : test3
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 4 TPASS : test4
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 5 TPASS : test5
05/03 01:41:13 DEBUG| utils:0153| [stdout] ptem01 6 TPASS : test6
05/03 01:41:13 DEBUG| utils:0153| [stdout] tag=ptem01 stime=1620006072 dur=0 exit=exited stat=0 core=no cu=0 cs=0
05/03 01:41:13 DEBUG| utils:0153| [stdout] startup='Mon May 3 01:41:12 2021'
05/03 01:41:13 DEBUG| utils:0153| [stdout] hangup01 1 TPASS : child process exited with status 0
05/03 01:41:13 DEBUG| utils:0153| [stdout] tag=hangup01 stime=1620006072 dur=1 exit=exited stat=0 core=no cu=0 cs=0

tags: added: verification-done-groovy
removed: verification-needed-groovy
tags: removed: kqa-blocker
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 5.8.0-53.60

---------------
linux (5.8.0-53.60) groovy; urgency=medium

  * CVE-2021-3491
    - io_uring: fix provide_buffers sign extension
    - io_uring: fix overflows checks in provide buffers
    - SAUCE: proc: Avoid mixing integer types in mem_rw()
    - SAUCE: io_uring: truncate lengths larger than MAX_RW_COUNT on provide
      buffers

  * CVE-2021-3490
    - bpf: Fix a verifier failure with xor
    - SAUCE: bpf: verifier: fix ALU32 bounds tracking with bitwise ops

  * CVE-2021-3489
    - SAUCE: bpf: ringbuf: deny reserve of buffers larger than ringbuf
    - SAUCE: bpf: prevent writable memory-mapping of read-only ringbuf pages

 -- Stefan Bader <email address hidden> Thu, 06 May 2021 07:43:20 +0200

Changed in linux (Ubuntu Groovy):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Po-Hsu Lin (cypressyew)
Changed in ubuntu-kernel-tests:
status: New → Fix Released
tags: added: verification-done-focal
removed: verification-needed-focal
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.