tcp_fastopen_backup_key.sh from net in ubuntu_kernel_selftests failed on Eoan LPAR

Bug #1869134 reported by Po-Hsu Lin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-kernel-tests
Fix Released
High
Colin Ian King
linux (Ubuntu)
Fix Released
High
Colin Ian King
Focal
Fix Released
Medium
Colin Ian King
Groovy
Fix Released
High
Colin Ian King

Bug Description

== SRU Justification Focal, Groovy ==

Running the tcp_fastopen_backup_key.sh from net in ubuntu_kernel_selftests fails on big endian systems. This is a regression that occurred because of commit 438ac88009bc ("net: fastopen: robustness and endianness fixes for SipHash").

The test rotates TFO keys for ipv4/ipv6. It demonstrate how the primary and backup TFO keys can be rotated while minimizing the number of client cookies that are rejected. Due to an endianess issue, big endian systems were getting endian reversed values, so the values being from /proc/sys/net/ipv4/tcp_fastopen_key were reversed.

/proc/sys/net/ipv4/tcp_fastopen_key

== Fix ==

Upstream (linux-next) fix:

commit f19008e676366c44e9241af57f331b6c6edf9552
Author: Jason Baron <email address hidden>
Date: Mon Aug 10 13:38:39 2020 -0400

    tcp: correct read of TFO keys on big endian systems

== Test case ==

Run the kernel self tests tcp_fastopen_backup_key.sh. Currently this generally fails on the last few test cases. With the fix the test passes.

== Regression Potential ==

This fix touches the reading of the tcp fast open key proc interface /proc/sys/net/ipv4/tcp_fastopen_key and the getsockopt TCP_FASTOPEN_KEY interface so there is a potential for a regression when accessing data from these read-only interfaces.

There is some data copying to keys using unaligned puts and memcpy() so there is a potential that we may have data bounds errors causing memory corruption.

----

Issue found on Eoan (5.3.0-42.34, 5.3.0-43.36) with all s390x instances:
  - LPAR s2lp4
  - zVM kernel03
  - zKVM s2lp6g003

 # selftests: net: tcp_fastopen_backup_key.sh
 # PASS
 # PASS
 # PASS
 # PASS
 # PASS
 # PASS
 # PASS
 # PASS
 # PASS
 # FAIL: TcpExtTCPFastOpenPassiveFail non-zero
 not ok 30 selftests: net: tcp_fastopen_backup_key.sh # exit=1

CVE References

Po-Hsu Lin (cypressyew)
tags: added: sru-20200316
tags: added: 5.3 eoan s390x ubuntu-kernel-selftests
description: updated
Po-Hsu Lin (cypressyew)
tags: added: 5.4 focal sru-20200629
Changed in ubuntu-kernel-tests:
importance: Undecided → High
assignee: nobody → Colin Ian King (colin-king)
status: New → In Progress
Revision history for this message
Colin Ian King (colin-king) wrote :

I've tested this on kernels from 5.3 through to 5.8-rc6 with the same result. The TcpExtTCPFastOpenPassiveFail is non-zero on these and only on s390x. Tried it on a LPAR and also emulated with QEMU and some issue. I've reported this upstream.

description: updated
Changed in linux (Ubuntu Focal):
importance: Undecided → High
assignee: nobody → Colin Ian King (colin-king)
Changed in linux (Ubuntu Groovy):
importance: Undecided → High
assignee: nobody → Colin Ian King (colin-king)
Changed in linux (Ubuntu Focal):
status: New → In Progress
Changed in linux (Ubuntu Groovy):
status: New → In Progress
description: updated
Stefan Bader (smb)
Changed in linux (Ubuntu Focal):
importance: High → Medium
Ian May (ian-may)
Changed in linux (Ubuntu Focal):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Revision history for this message
Colin Ian King (colin-king) wrote :

tested on focal with -proposed 5.4.0-46-generic (Aug 28), tests now pass:

13:37:03 DEBUG| [stdout] # selftests: net: tcp_fastopen_backup_key.sh
13:37:04 DEBUG| [stdout] # PASS
13:37:04 DEBUG| [stdout] # PASS
13:37:04 DEBUG| [stdout] # PASS
13:37:05 DEBUG| [stdout] # PASS
13:37:05 DEBUG| [stdout] # PASS
13:37:05 DEBUG| [stdout] # PASS
13:37:06 DEBUG| [stdout] # PASS
13:37:06 DEBUG| [stdout] # PASS
13:37:06 DEBUG| [stdout] # PASS
13:37:07 DEBUG| [stdout] # PASS
13:37:07 DEBUG| [stdout] # PASS
13:37:07 DEBUG| [stdout] # PASS
13:37:07 DEBUG| [stdout] # PASS
13:37:08 DEBUG| [stdout] # PASS
13:37:08 DEBUG| [stdout] # PASS
13:37:08 DEBUG| [stdout] # PASS
13:37:08 DEBUG| [stdout] # all tests done
13:37:08 DEBUG| [stdout] ok 30 selftests: net: tcp_fastopen_backup_key.sh

tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Colin Ian King (colin-king) wrote :

Fix applied to Groovy, will be in Ubuntu-5.8.0-17.18

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (57.9 KiB)

This bug was fixed in the package linux - 5.8.0-18.19

---------------
linux (5.8.0-18.19) groovy; urgency=medium

  * groovy/linux: 5.8.0-18.19 -proposed tracker (LP: #1893047)

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * Groovy update: v5.8.4 upstream stable release (LP: #1893048)
    - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
    - drm/panel-simple: Fix inverted V/H SYNC for Frida FRD350H54004 panel
    - drm/ast: Remove unused code paths for AST 1180
    - drm/ast: Initialize DRAM type before posting GPU
    - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
    - ALSA: hda: avoid reset of sdo_limit
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion
    - can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in
      j1939_tp_txtimer()
    - can: j1939: socket: j1939_sk_bind(): make sure ml_priv is allocated
    - spi: Prevent adding devices below an unregistering controller
    - io_uring: find and cancel head link async work on files exit
    - mm/vunmap: add cond_resched() in vunmap_pmd_range
    - romfs: fix uninitialized memory leak in romfs_dev_read()
    - kernel/relay.c: fix memleak on destroy relay channel
    - uprobes: __replace_page() avoid BUG in munlock_vma_page()
    - squashfs: avoid bio_alloc() failure with 1Mbyte blocks
    - mm: include CMA pages in lowmem_reserve at boot
    - mm, page_alloc: fix core hung in free_pcppages_bulk()
    - ASoC: amd: renoir: restore two more registers during resume
    - RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request
    - opp: Enable resources again if they were disabled earlier
    - opp: Put opp table in dev_pm_opp_set_rate() for empty tables
    - opp: Put opp table in dev_pm_opp_set_rate() if _set_opp_bw() fails
    - ext4: do not block RWF_NOWAIT dio write on unallocated space
    - ext4: fix checking of directory entry validity for inline directories
    - jbd2: add the missing unlock_buffer() in the error path of
      jbd2_write_superblock()
    - scsi: zfcp: Fix use-after-free in request timeout handlers
    - selftests: kvm: Use a shorter encoding to clear RAX
    - s390/pci: fix zpci_bus_link_virtfn()
    - s390/pci: re-introduce zpci_remove_device()
    - s390/pci: fix PF/VF linking on hot plug
    - s390/pci: ignore stale configuration request event
    - mm/memory.c: skip spurious TLB flush for retried page fault
    - drm: amdgpu: Use the correct size when allocating memory
    - drm/amdgpu/display: use GFP_ATOMIC in dcn20_validate_bandwidth_internal
    - drm/amd/display: Fix incorrect backlight register offset for DCN
    - drm/amd/display: Fix EDID parsing after resume from suspend
    - drm/amd/display: Blank stream before destroying HDCP session
    - drm/amd/display: Fix DFPstate hang due to view port changed
    - drm/amd/display: fix pow() crashing when given base 0
    - drm/i915/pmu: Prefer drm_WARN_ON over WARN_ON
    - drm/i915: Provide the perf pmu.module
    - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
    - scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
  ...

Changed in linux (Ubuntu Groovy):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (42.6 KiB)

This bug was fixed in the package linux - 5.4.0-48.52

---------------
linux (5.4.0-48.52) focal; urgency=medium

  * focal/linux: 5.4.0-48.52 -proposed tracker (LP: #1894654)

  * mm/slub kernel oops on focal kernel 5.4.0-45 (LP: #1895109)
    - SAUCE: Revert "mm/slub: fix a memory leak in sysfs_slab_add()"

  * Packaging resync (LP: #1786013)
    - update dkms package versions
    - update dkms package versions

  * Introduce the new NVIDIA 450-server and the 450 UDA series (LP: #1887674)
    - [packaging] add signed modules for nvidia 450 and 450-server

  * [UBUNTU 20.04] zPCI attach/detach issues with PF/VF linking support
    (LP: #1892849)
    - s390/pci: fix zpci_bus_link_virtfn()
    - s390/pci: re-introduce zpci_remove_device()
    - s390/pci: fix PF/VF linking on hot plug

  * [UBUNTU 20.04] kernel: s390/cpum_cf,perf: changeDFLT_CCERROR counter name
    (LP: #1891454)
    - s390/cpum_cf, perf: change DFLT_CCERROR counter name

  * [UBUNTU 20.04] zPCI: Enabling of a reserved PCI function regression
    introduced by multi-function support (LP: #1891437)
    - s390/pci: fix enabling a reserved PCI function

  * CVE-2020-12888
    - vfio/type1: Support faulting PFNMAP vmas
    - vfio-pci: Fault mmaps to enable vma tracking
    - vfio-pci: Invalidate mmaps and block MMIO access on disabled memory

  * [Hyper-V] VSS and File Copy daemons intermittently fails to start
    (LP: #1891224)
    - [Packaging] Bind hv_vss_daemon startup to hv_vss device
    - [Packaging] bind hv_fcopy_daemon startup to hv_fcopy device

  * alsa/hdmi: support nvidia mst hdmi/dp audio (LP: #1867704)
    - ALSA: hda - Rename snd_hda_pin_sense to snd_hda_jack_pin_sense
    - ALSA: hda - Add DP-MST jack support
    - ALSA: hda - Add DP-MST support for non-acomp codecs
    - ALSA: hda - Add DP-MST support for NVIDIA codecs
    - ALSA: hda: hdmi - fix regression in connect list handling
    - ALSA: hda: hdmi - fix kernel oops caused by invalid PCM idx
    - ALSA: hda: hdmi - preserve non-MST PCM routing for Intel platforms
    - ALSA: hda: hdmi - Keep old slot assignment behavior for Intel platforms
    - ALSA: hda - Fix DP-MST support for NVIDIA codecs

  * Focal update: v5.4.60 upstream stable release (LP: #1892899)
    - smb3: warn on confusing error scenario with sec=krb5
    - genirq/affinity: Make affinity setting if activated opt-in
    - genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
    - PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
    - PCI: Add device even if driver attach failed
    - PCI: qcom: Define some PARF params needed for ipq8064 SoC
    - PCI: qcom: Add support for tx term offset for rev 2.1.0
    - btrfs: allow use of global block reserve for balance item deletion
    - btrfs: free anon block device right after subvolume deletion
    - btrfs: don't allocate anonymous block device for user invisible roots
    - btrfs: ref-verify: fix memory leak in add_block_entry
    - btrfs: stop incremening log_batch for the log root tree when syncing log
    - btrfs: remove no longer needed use of log_writers for the log root tree
    - btrfs: don't traverse into the seed devices in show_devname
    - btrfs: open device...

Changed in linux (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Didn't see this issue anymore, closing this bug.
Thanks for the fix.

Changed in ubuntu-kernel-tests:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.