Bug#1051592: linux: Regression - upgrade to 6.1.52-1 breaks nftables
Hi,
On Mon, Sep 11, 2023 at 10:52:12PM +0200, Salvatore Bonaccorso wrote:
> Hi Timo,
>
> On Mon, Sep 11, 2023 at 10:31:56PM +0200, Timo Sigurdsson wrote:
> > Hi Salvatore,
> >
> > Salvatore Bonaccorso schrieb am 11.09.2023 22:20 (GMT +02:00):
> >
> > > Bisected the issue:
> > >
> > > $ git bisect log
> > > git bisect start
> > > # status: waiting for both good and bad commits
> > > # good: [61fd484b2cf6bc8022e8e5ea6f693a9991740ac2] Linux 6.1.38
> > > git bisect good 61fd484b2cf6bc8022e8e5ea6f693a9991740ac2
> > > # status: waiting for bad commit, 1 good commit known
> > > # bad: [1321ab403b38366a4cfb283145bb2c005becb1e5] Linux 6.1.45
> > > git bisect bad 1321ab403b38366a4cfb283145bb2c005becb1e5
> > > # good: [95d49f79e94d4fa8105c880a266789609f3e791a] ext4: only update
> > > i_reserved_data_blocks on successful block allocation
> > > git bisect good 95d49f79e94d4fa8105c880a266789609f3e791a
> > > # good: [f8b61a2c29fc70f64daad698cf09c1f79a0e39f9] drm/amd/display: Set minimum
> > > requirement for using PSR-SU on Rembrandt
> > > git bisect good f8b61a2c29fc70f64daad698cf09c1f79a0e39f9
> > > # bad: [bd2decac7345134ea0bd3f4b978478ef53367cd8] mptcp: ensure subflow is
> > > unhashed before cleaning the backlog
> > > git bisect bad bd2decac7345134ea0bd3f4b978478ef53367cd8
> > > # bad: [fe3409cd013cfd10d3e6787b49f33a5dda39cffd] RDMA/irdma: Fix op_type
> > > reporting in CQEs
> > > git bisect bad fe3409cd013cfd10d3e6787b49f33a5dda39cffd
> > > # good: [85c38ac62c1372cc1ab05426315aad61025d33ef] atheros: fix return value
> > > check in atl1_tso()
> > > git bisect good 85c38ac62c1372cc1ab05426315aad61025d33ef
> > > # bad: [539cf23cb48835c69cc3d22edff28b92bd82bb18] tipc: stop tipc crypto on
> > > failure in tipc_node_create
> > > git bisect bad 539cf23cb48835c69cc3d22edff28b92bd82bb18
> > > # good: [1ecdbf2467ae4bc4df00c5cfab427cb1aaa5e3e1] x86/traps: Fix
> > > load_unaligned_zeropad() handling for shared TDX memory
> > > git bisect good 1ecdbf2467ae4bc4df00c5cfab427cb1aaa5e3e1
> > > # bad: [7218974aba07ff60c646d5a512b02b871402b03e] mm: suppress mm fault logging
> > > if fatal signal already pending
> > > git bisect bad 7218974aba07ff60c646d5a512b02b871402b03e
> > > # good: [89a4d1a89751a0fbd520e64091873e19cc0979e8] netfilter: nft_set_rbtree:
> > > fix overlap expiration walk
> > > git bisect good 89a4d1a89751a0fbd520e64091873e19cc0979e8
> > > # bad: [268cb07ef3ee17b5454a7c4b23376802c5b00c79] netfilter: nf_tables:
> > > disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
> > > git bisect bad 268cb07ef3ee17b5454a7c4b23376802c5b00c79
> > > # good: [4237462a073e24f71c700f3e5929f07b6ee1bcaa] netfilter: nf_tables: skip
> > > immediate deactivate in _PREPARE_ERROR
> > > git bisect good 4237462a073e24f71c700f3e5929f07b6ee1bcaa
> > > # first bad commit: [268cb07ef3ee17b5454a7c4b23376802c5b00c79] netfilter:
> > > nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
> > >
> > > $ git bisect visualize
> > > commit 268cb07ef3ee17b5454a7c4b23376802c5b00c79
> > > Author: Pablo Neira Ayuso <pablo@netfilter.org>
> > > Date: Sun Jul 23 16:41:48 2023 +0200
> > >
> > > netfilter: nf_tables: disallow rule addition to bound chain via
> > > NFTA_RULE_CHAIN_ID
> > >
> > > [ Upstream commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 ]
> > >
> > > Bail out with EOPNOTSUPP when adding rule to bound chain via
> > > NFTA_RULE_CHAIN_ID. The following warning splat is shown when
> > > adding a rule to a deleted bound chain:
> > >
> > > WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013
> > > nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
> > > CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
> > > RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
> > >
> > > Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
> > > Reported-by: Kevin Rich <kevinrich1337@gmail.com>
> > > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > > Signed-off-by: Florian Westphal <fw@strlen.de>
> > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> >
> > Hehe, yes, I was just about to write you the same. My test build
> > with this one reverted lets me load the ruleset again.
> >
> > Would you like to take this upstream? I was just about to file a
> > report in netfilter's bugzilla, but since you also worked on it as
> > well, I don't mean to interfere...
> >
> > I'll try to further reduce my test ruleset to see what actually
> > triggers this.
>
> I'm fine if you report it upstream, as you have the best position for
> making further tests further stripped down rulesets. But instread of
> bugzilla I think it's best to directly mail Pablo Neira Ayuso
> <pablo@netfilter.org>, the people in the Signed-off-by, additionally
> the stable list (stable@vger.kernel.org) and the regressions
> mailinglist (regressions@lists.linux.dev, cf.
> https://www.kernel.org/doc/html/latest/process/handling-regressions.html).
get_maintainers.pl additionally gives:
$ ./scripts/get_maintainer.pl net/netfilter/nf_tables_api.c
Pablo Neira Ayuso <pablo@netfilter.org> (maintainer:NETFILTER)
Jozsef Kadlecsik <kadlec@netfilter.org> (maintainer:NETFILTER)
Florian Westphal <fw@strlen.de> (maintainer:NETFILTER)
"David S. Miller" <davem@davemloft.net> (maintainer:NETWORKING [GENERAL])
Eric Dumazet <edumazet@google.com> (maintainer:NETWORKING [GENERAL])
Jakub Kicinski <kuba@kernel.org> (maintainer:NETWORKING [GENERAL])
Paolo Abeni <pabeni@redhat.com> (maintainer:NETWORKING [GENERAL])
netfilter-devel@vger.kernel.org (open list:NETFILTER)
coreteam@netfilter.org (open list:NETFILTER)
netdev@vger.kernel.org (open list:NETWORKING [GENERAL])
linux-kernel@vger.kernel.org (open list)
Regards,
Salvatore
Reply to: