Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #80361 > unrolled thread

Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables "Timo Sigurdsson" <public_timo.s@silentcreek.de> - 2023-09-10 11:00 +0200
    Processed: Re: Bug#1051592: linux: Regression - upgrade to  6.1.52-1 breaks nftables "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-09-10 12:30 +0200
    Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables Salvatore Bonaccorso <carnil@debian.org> - 2023-09-10 12:30 +0200
    Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables Salvatore Bonaccorso <carnil@debian.org> - 2023-09-11 16:20 +0200
      Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables Salvatore Bonaccorso <carnil@debian.org> - 2023-09-11 16:30 +0200
    Processed: Re: Bug#1051592: linux: Regression - upgrade to  6.1.52-1 breaks nftables "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-09-11 16:40 +0200
    Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables Salvatore Bonaccorso <carnil@debian.org> - 2023-09-11 23:00 +0200

#80361 — Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables

Package: linux
Version: 6.1.52-1
Severity: grave

Dear Maintainers,

linux-image-6.1.0-12-amd64 causes a serious regression in nftables. After upgrading one of my machines, nftables fails to start - leaving the system without an active firewall.

Doing
`nft -cf /etc/nftables.conf'
throws many "Operation not supported" errors on rulesets that have been in place for months wihtout issues.

Just to give two simple examples from the log when nftables fails to start:
/etc/nftables.conf:99:4-44: Error: Could not process rule: Operation not supported
                        tcp option maxseg size 1-500 counter drop
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:308:4-27: Error: Could not process rule: Operation not supported
                        tcp dport sip-tls accept
                        ^^^^^^^^^^^^^^^^^^^^^^^^

Downgrading to linux-image-6.1.0-11-amd64 resolves the issue.

Notes: I'm running a local rebuild of linux-image-amd64 with a few additional symbols enabled. But since these symbols are totally unrelated to the netfilter subsystem and there are no changes to the source itself, I'm certain, this affects the original Debian build as well. Whether it only affects certain architectures or rulesets, I can't say, though.

I'm cc'ing debian-security@debian.org because the update came via the stable-security channel.


Thanks and regards,

Timo

[toc] | [next] | [standalone]

#80362 — Processed: Re: Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables

Processing control commands:

> tags -1 + moreinfo
Bug #1051592 [linux] linux: Regression - upgrade to 6.1.52-1 breaks nftables
Added tag(s) moreinfo.

-- 
1051592: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051592
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#80363

Control: tags -1 + moreinfo

Hi

On Sun, Sep 10, 2023 at 10:38:45AM +0200, Timo Sigurdsson wrote:
> Package: linux
> Version: 6.1.52-1
> Severity: grave
> 
> Dear Maintainers,
> 
> linux-image-6.1.0-12-amd64 causes a serious regression in nftables.
> After upgrading one of my machines, nftables fails to start -
> leaving the system without an active firewall.
> 
> Doing
> `nft -cf /etc/nftables.conf'
> throws many "Operation not supported" errors on rulesets that have been in place for months wihtout issues.
> 
> Just to give two simple examples from the log when nftables fails to start:
> /etc/nftables.conf:99:4-44: Error: Could not process rule: Operation not supported
>                         tcp option maxseg size 1-500 counter drop
>                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> /etc/nftables.conf:308:4-27: Error: Could not process rule: Operation not supported
>                         tcp dport sip-tls accept
>                         ^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Downgrading to linux-image-6.1.0-11-amd64 resolves the issue.
> 
> Notes: I'm running a local rebuild of linux-image-amd64 with a few
> additional symbols enabled. But since these symbols are totally
> unrelated to the netfilter subsystem and there are no changes to the
> source itself, I'm certain, this affects the original Debian build
> as well. Whether it only affects certain architectures or rulesets,
> I can't say, though.
> 
> I'm cc'ing debian-security@debian.org because the update came via
> the stable-security channel.

This is defintively not 'grave' but I keep it for the time beeing at
RC level and might be adjusted later.

Would it be possible to provide a minimal set of rules triggering the
issue? Can you reproduce the issue with the official build?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#80394

Control: tags -1 - moreinfo unreproducible

Hi Timo,

On Mon, Sep 11, 2023 at 03:15:18AM +0200, Timo Sigurdsson wrote:
> Hi,
> 
> Salvatore Bonaccorso schrieb am 10.09.2023 12:21 (GMT +02:00):
> 
> > Would it be possible to provide a minimal set of rules triggering the
> > issue? Can you reproduce the issue with the official build?
> 
> So, I did some more testing on a different machine running the official build. My findings so far are:
> 1) Yes, I can reproduce the issue with the official build.
> 2) The issue depends on the ruleset. The minimal ruleset I have on that machine, doesn't trigger the issue, but when I copy over the ruleset from the machine I first observed this on, then I can reproduce it.
> 
> I'm attaching a somewhat stripped down version of my original, rather complex ruleset. It's by no means a "minimal" reproducer, cause I haven't had the time yet to further reduce it in order to see what actually triggers it. But you should be able to observe that this ruleset loads just fine on linux 6.1.38-4, but doesn't anymore on 6.1.52-1.

Thanks for providing it, this helps debugging the issue.

> I also started looking into what commit could have introduced this. My first guess "netfilter: nft_dynset: disallow object maps" (23185c6aed1f) is wrong. Even with this one reverted, the issue occurs. I'll try another build with "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID" (0ebc1064e487) reverted tomorrow evening...

Thanks, as soon we have the introducing commit we can go to the next
step and check upstream. I cannot trigger the problem with 6.4.13-1 or
6.5.2.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#80395

Control: tags -1 + confirmed upstream

Hi,

On Mon, Sep 11, 2023 at 04:08:07PM +0200, Salvatore Bonaccorso wrote:
> Control: tags -1 - moreinfo unreproducible
> 
> Hi Timo,
> 
> On Mon, Sep 11, 2023 at 03:15:18AM +0200, Timo Sigurdsson wrote:
> > Hi,
> > 
> > Salvatore Bonaccorso schrieb am 10.09.2023 12:21 (GMT +02:00):
> > 
> > > Would it be possible to provide a minimal set of rules triggering the
> > > issue? Can you reproduce the issue with the official build?
> > 
> > So, I did some more testing on a different machine running the official build. My findings so far are:
> > 1) Yes, I can reproduce the issue with the official build.
> > 2) The issue depends on the ruleset. The minimal ruleset I have on that machine, doesn't trigger the issue, but when I copy over the ruleset from the machine I first observed this on, then I can reproduce it.
> > 
> > I'm attaching a somewhat stripped down version of my original, rather complex ruleset. It's by no means a "minimal" reproducer, cause I haven't had the time yet to further reduce it in order to see what actually triggers it. But you should be able to observe that this ruleset loads just fine on linux 6.1.38-4, but doesn't anymore on 6.1.52-1.
> 
> Thanks for providing it, this helps debugging the issue.
> 
> > I also started looking into what commit could have introduced this. My first guess "netfilter: nft_dynset: disallow object maps" (23185c6aed1f) is wrong. Even with this one reverted, the issue occurs. I'll try another build with "netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID" (0ebc1064e487) reverted tomorrow evening...
> 
> Thanks, as soon we have the introducing commit we can go to the next
> step and check upstream. I cannot trigger the problem with 6.4.13-1 or
> 6.5.2.

The issue seems to be present already in 6.1.49-rc1, which I had still
from local pareparations for the rebases. So the bisection needs to go
to the upstream versions between 6.1.38 and 6.1.49 at least.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#80396 — Processed: Re: Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables

Processing control commands:

> found -1 5.10.191-1
Bug #1051592 [linux] linux: Regression - upgrade to 6.1.52-1 breaks nftables
There is no source info for the package 'linux' at version '5.10.191-1' with architecture ''
Unable to make a source version for version '5.10.191-1'
Marked as found in versions 5.10.191-1.

-- 
1051592: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051592
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#80403

Hi Timo,

On Mon, Sep 11, 2023 at 10:31:56PM +0200, Timo Sigurdsson wrote:
> Hi Salvatore,
> 
> Salvatore Bonaccorso schrieb am 11.09.2023 22:20 (GMT +02:00):
> 
> > Bisected the issue:
> > 
> > $ git bisect log
> > git bisect start
> > # status: waiting for both good and bad commits
> > # good: [61fd484b2cf6bc8022e8e5ea6f693a9991740ac2] Linux 6.1.38
> > git bisect good 61fd484b2cf6bc8022e8e5ea6f693a9991740ac2
> > # status: waiting for bad commit, 1 good commit known
> > # bad: [1321ab403b38366a4cfb283145bb2c005becb1e5] Linux 6.1.45
> > git bisect bad 1321ab403b38366a4cfb283145bb2c005becb1e5
> > # good: [95d49f79e94d4fa8105c880a266789609f3e791a] ext4: only update
> > i_reserved_data_blocks on successful block allocation
> > git bisect good 95d49f79e94d4fa8105c880a266789609f3e791a
> > # good: [f8b61a2c29fc70f64daad698cf09c1f79a0e39f9] drm/amd/display: Set minimum
> > requirement for using PSR-SU on Rembrandt
> > git bisect good f8b61a2c29fc70f64daad698cf09c1f79a0e39f9
> > # bad: [bd2decac7345134ea0bd3f4b978478ef53367cd8] mptcp: ensure subflow is
> > unhashed before cleaning the backlog
> > git bisect bad bd2decac7345134ea0bd3f4b978478ef53367cd8
> > # bad: [fe3409cd013cfd10d3e6787b49f33a5dda39cffd] RDMA/irdma: Fix op_type
> > reporting in CQEs
> > git bisect bad fe3409cd013cfd10d3e6787b49f33a5dda39cffd
> > # good: [85c38ac62c1372cc1ab05426315aad61025d33ef] atheros: fix return value
> > check in atl1_tso()
> > git bisect good 85c38ac62c1372cc1ab05426315aad61025d33ef
> > # bad: [539cf23cb48835c69cc3d22edff28b92bd82bb18] tipc: stop tipc crypto on
> > failure in tipc_node_create
> > git bisect bad 539cf23cb48835c69cc3d22edff28b92bd82bb18
> > # good: [1ecdbf2467ae4bc4df00c5cfab427cb1aaa5e3e1] x86/traps: Fix
> > load_unaligned_zeropad() handling for shared TDX memory
> > git bisect good 1ecdbf2467ae4bc4df00c5cfab427cb1aaa5e3e1
> > # bad: [7218974aba07ff60c646d5a512b02b871402b03e] mm: suppress mm fault logging
> > if fatal signal already pending
> > git bisect bad 7218974aba07ff60c646d5a512b02b871402b03e
> > # good: [89a4d1a89751a0fbd520e64091873e19cc0979e8] netfilter: nft_set_rbtree:
> > fix overlap expiration walk
> > git bisect good 89a4d1a89751a0fbd520e64091873e19cc0979e8
> > # bad: [268cb07ef3ee17b5454a7c4b23376802c5b00c79] netfilter: nf_tables:
> > disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
> > git bisect bad 268cb07ef3ee17b5454a7c4b23376802c5b00c79
> > # good: [4237462a073e24f71c700f3e5929f07b6ee1bcaa] netfilter: nf_tables: skip
> > immediate deactivate in _PREPARE_ERROR
> > git bisect good 4237462a073e24f71c700f3e5929f07b6ee1bcaa
> > # first bad commit: [268cb07ef3ee17b5454a7c4b23376802c5b00c79] netfilter:
> > nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
> > 
> > $ git bisect visualize
> > commit 268cb07ef3ee17b5454a7c4b23376802c5b00c79
> > Author: Pablo Neira Ayuso <pablo@netfilter.org>
> > Date:   Sun Jul 23 16:41:48 2023 +0200
> > 
> >     netfilter: nf_tables: disallow rule addition to bound chain via
> >     NFTA_RULE_CHAIN_ID
> >     
> >     [ Upstream commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 ]
> >     
> >     Bail out with EOPNOTSUPP when adding rule to bound chain via
> >     NFTA_RULE_CHAIN_ID. The following warning splat is shown when
> >     adding a rule to a deleted bound chain:
> >     
> >      WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013
> >      nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
> >      CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
> >      RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
> >     
> >     Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
> >     Reported-by: Kevin Rich <kevinrich1337@gmail.com>
> >     Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> >     Signed-off-by: Florian Westphal <fw@strlen.de>
> >     Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> Hehe, yes, I was just about to write you the same. My test build
> with this one reverted lets me load the ruleset again.
> 
> Would you like to take this upstream? I was just about to file a
> report in netfilter's bugzilla, but since you also worked on it as
> well, I don't mean to interfere...
> 
> I'll try to further reduce my test ruleset to see what actually
> triggers this.

I'm fine if you report it upstream, as you have the best position for
making further tests further stripped down rulesets. But instread of
bugzilla I think it's best to directly mail Pablo Neira Ayuso
<pablo@netfilter.org>, the people in the Signed-off-by, additionally
the stable list (stable@vger.kernel.org) and the regressions
mailinglist (regressions@lists.linux.dev, cf.
https://www.kernel.org/doc/html/latest/process/handling-regressions.html).

It should be noted:

0ebc1064e487 ("netfilter: nf_tables: disallow rule addition to bound
chain via NFTA_RULE_CHAIN_ID") in 6.5-rc4 was backported to several
stable series, namely in 5.10.190, 5.15.124, 6.1.43, 6.4.8.

While I can reproduce the issue in 5.10.191-1 and 6.1.52-1, I cannot
in 6.4.13-1 or 6.5.2-1 (not yet released in Debian).

Possibly for the older series there is a prerequisite commit missing
which is present in the series where the issue is not triggered.

Can you report it upstream, but keep this bug as well in the loop (or
me directly as well)?

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web