This bug was fixed in the package linux - 5.4.0-124.140
---------------
linux (5.4.0-124.140) focal; urgency=medium
* CVE-2022-2586
- SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
- SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another
chain
* CVE-2022-2588
- SAUCE: net_sched: cls_route: remove from list when handle is 0
* CVE-2022-34918
- netfilter: nf_tables: stricter validation of element data
linux (5.4.0-123.139) focal; urgency=medium
* focal/linux: 5.4.0-123.139 -proposed tracker (LP: #1981284)
* Packaging resync (LP: #1786013)
- debian/dkms-versions -- update from kernel-versions (main/2022.07.11)
* Hairpin traffic does not work with centralized NAT gw (LP: #1967856)
- net: openvswitch: fix misuse of the cached connection on tuple changes
* [UBUNTU 20.04] Include patches to avoid self-detected stall with Secure
Execution (LP: #1979296)
- KVM: s390: pv: add macros for UVC CC values
- KVM: s390: pv: avoid stalls when making pages secure
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
* Focal update: v5.4.195 upstream stable release (LP: #1980407)
- batman-adv: Don't skb_split skbuffs with frag_list
- hwmon: (tmp401) Add OF device ID table
- mac80211: Reset MBSSID parameters upon connection
- net: Fix features skip in for_each_netdev_feature()
- ipv4: drop dst in multicast routing path
- drm/nouveau: Fix a potential theorical leak in
nouveau_get_backlight_name()
- netlink: do not reset transport header in netlink_recvmsg()
- mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
- dim: initialize all struct fields
- hwmon: (ltq-cputemp) restrict it to SOC_XWAY
- s390/ctcm: fix variable dereferenced before check
- s390/ctcm: fix potential memory leak
- s390/lcs: fix variable dereferenced before check
- net/sched: act_pedit: really ensure the skb is writable
- net/smc: non blocking recvmsg() return -EAGAIN when no data and
signal_pending
- net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
- gfs2: Fix filesystem block deallocation for short writes
- hwmon: (f71882fg) Fix negative temperature
- ASoC: max98090: Reject invalid values in custom control put()
- ASoC: max98090: Generate notifications on changes for custom control
- ASoC: ops: Validate input values in snd_soc_put_volsw_range()
- s390: disable -Warray-bounds
- net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
- tcp: resalt the secret every 10 seconds
- tty: n_gsm: fix mux activation issues in gsm_config()
- usb: cdc-wdm: fix reading stuck on device close
- usb: typec: tcpci: Don't skip cleanup in .remove() on error
- USB: serial: pl2303: add device id for HP LM930 Display
- USB: serial: qcserial: add support for Sierra Wireless EM7590
- USB: serial: option: add Fibocom L610 modem
- USB: serial: option: add Fibocom MA510 modem
- slimbus: qcom: Fix IRQ check in qcom_slim_probe
- serial: 8250_mtk: Fix UART_EFR register address
- serial: 8250_mtk: Fix register address for XON/XOFF character
- drm/nouveau/tegra: Stop using iommu_present()
- i40e: i40e_main: fix a missing check on list iterator
- cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
- drm/vmwgfx: Initialize drm_mode_fb_cmd2
- MIPS: fix build with gcc-12
- net: phy: Fix race condition on link status change
- arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
- ping: fix address binding wrt vrf
- tty/serial: digicolor: fix possible null-ptr-deref in
digicolor_uart_probe()
- Linux 5.4.195
* Focal update: v5.4.194 upstream stable release (LP: #1980399)
- MIPS: Use address-of operator on section symbols
- block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
- drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version,
environment} types
- drm/i915: Cast remain to unsigned long in eb_relocate_vma
- nfp: bpf: silence bitwise vs. logical OR warning
- can: grcan: grcan_probe(): fix broken system id check for errata
workaround
needs
- can: grcan: only use the NAPI poll budget for RX
- arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
- [Config] updateconfigs for ARCH_HAS_HOLES_MEMORYMODEL
- KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
- x86/asm: Allow to pass macros to __ASM_FORM()
- x86: xen: kvm: Gather the definition of emulate prefixes
- x86: xen: insn: Decode Xen and KVM emulate-prefix signature
- x86: kprobes: Prohibit probing on instruction which has emulate prefix
- KVM: x86/svm: Account for family 17h event renumberings in
amd_pmc_perf_hw_id
- Bluetooth: Fix the creation of hdev->name
- mm: fix missing cache flush for all tail pages of compound page
- mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
- mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
__mcopy_atomic()
- Linux 5.4.194
* Focal update: v5.4.193 upstream stable release (LP: #1979566)
- MIPS: Fix CP0 counter erratum detection for R4k CPUs
- parisc: Merge model and model name into one line in /proc/cpuinfo
- ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
- gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
- Revert "SUNRPC: attempt AF_LOCAL connect on setup"
- firewire: fix potential uaf in outbound_phy_packet_callback()
- firewire: remove check of list iterator against head past the loop body
- firewire: core: extend card->lock in fw_core_handle_bus_reset
- ACPICA: Always create namespace nodes using acpi_ns_create_node()
- genirq: Synchronize interrupt thread startup
- ASoC: da7219: Fix change notifications for tone generator frequency
- ASoC: wm8958: Fix change notifications for DSP controls
- ASoC: meson: Fix event generation for G12A tohdmi mux
- s390/dasd: fix data corruption for ESE devices
- s390/dasd: prevent double format of tracks for ESE devices
- s390/dasd: Fix read for ESE with blksize < 4k
- s390/dasd: Fix read inconsistency for ESE DASD devices
- can: grcan: grcan_close(): fix deadlock
- can: grcan: use ofdev->dev when allocating DMA memory
- nfc: replace improper check device_is_registered() in netlink related
functions
- NFC: netlink: fix sleep in atomic bug when firmware download timeout
- hwmon: (adt7470) Fix warning on module removal
- ASoC: dmaengine: Restore NULL prepare_slave_config() callback
- RDMA/siw: Fix a condition race issue in MPA request processing
- net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
- net: stmmac: dwmac-sun8i: add missing of_node_put() in
sun8i_dwmac_register_mdio_mux()
- net: emaclite: Add error handling for of_address_to_resource()
- selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is
operational
- bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
- smsc911x: allow using IRQ0
- btrfs: always log symlinks in full mode
- net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
- drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
- NFSv4: Don't invalidate inode attributes on delegation return
- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
- x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
- KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is
advertised
- net: ipv6: ensure we call ipv6_mc_down() at most once
- block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
- mm: fix unexpected zeroed page mapping with zram swap
- ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
- ALSA: pcm: Fix races among concurrent read/write and buffer changes
- ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
- ALSA: pcm: Fix races among concurrent prealloc proc writes
- ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
- tcp: make sure treq->af_specific is initialized
- dm: fix mempool NULL pointer race when completing IO
- dm: interlock pending dm_io and dm_wait_for_bios_completion
- PCI: aardvark: Clear all MSIs at setup
- PCI: aardvark: Fix reading MSI interrupt number
- mmc: rtsx: add 74 Clocks in power on flow
- Linux 5.4.193
* CVE-2022-1679
- SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
* CVE-2022-28893
- SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
- SUNRPC: Don't leak sockets in xs_local_connect()
* CVE-2022-1734
- nfc: nfcmrvl: main: reorder destructive operations in
nfcmrvl_nci_unregister_dev to avoid bugs
* CVE-2022-1652
- floppy: use a statically allocated error counter
-- Thadeu Lima de Souza Cascardo <casca...@canonical.com> Wed, 03 Aug
2022 22:48:34 -0300
** Changed in: linux (Ubuntu Focal)
Status: Fix Committed => Fix Released
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-1734
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-2586
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-2588
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1967856
Title:
Hairpin traffic does not work with centralized NAT gw
Status in linux package in Ubuntu:
Invalid
Status in openvswitch package in Ubuntu:
Invalid
Status in ovn package in Ubuntu:
Invalid
Status in linux source package in Focal:
Fix Released
Status in openvswitch source package in Focal:
Invalid
Status in ovn source package in Focal:
Invalid
Status in linux source package in Impish:
Won't Fix
Status in openvswitch source package in Impish:
New
Status in ovn source package in Impish:
New
Status in linux source package in Jammy:
Fix Released
Status in openvswitch source package in Jammy:
Invalid
Status in ovn source package in Jammy:
Invalid
Status in linux source package in Kinetic:
Invalid
Status in openvswitch source package in Kinetic:
Invalid
Status in ovn source package in Kinetic:
Invalid
Bug description:
[Impact]
Users of Open vSwitch on Focal will not be able to upgrade to v2.16.0 or
newer until this long standing kernel bug has been fixed.
Users of Open vSwitch on Jammy will be affected by this bug and
have no user space fix available. This bug currently blocks the
OpenStack Engineering team's charm product gate.
[Test Plan]
Execute the OVN system testsuite utilizing the kernel data path with the test
synthesis patch in comment #7 applied.
In addition to that validating that the OpenStack charm test gate is
unblocked would be valuable.
[Regression Potential]
The regression potential can be considered as low because:
- The calls added in the openvswitch kernel datapath code would
prior to Open vSwitch 2.16.0 have been initiated from the
userspace code and by chance concealed this bug.
- After an optimization done in 2.16.0 the kernel bug was
revealed and these calls now must be made from the kernel
datapath to retain functionality in use in the wild.
[Original Bug Description]
If you have two hvs where hv1 is the gateway chassis and you have an instance
running on hv2.
On instance on hv2 hairpin traffic works for the first session, but
not for the next:
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=1.07 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.078/1.078/1.078/0.000 ms
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-conntrack
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7334,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7334,type=0,code=0),zone=7
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7334,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7334,type=0,code=0),zone=7
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-conntrack
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7334,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7334,type=0,code=0),zone=7
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7334,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7334,type=0,code=0),zone=7
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7335,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7335,type=0,code=0),zone=7
We made an attempt at using OVN built with [0], but that did
unfortunately not help.
If we however revert [1] it works again:
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=1.31 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.318/1.318/1.318/0.000 ms
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-conntrack
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=0,code=0),zone=7
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=0,code=0),zone=7
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=0,code=0),zone=1
$ ping -c1 10.78.95.89
PING 10.78.95.89 (10.78.95.89) 56(84) bytes of data.
64 bytes from 10.78.95.89: icmp_seq=1 ttl=62 time=0.307 ms
--- 10.78.95.89 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.307/0.307/0.307/0.000 ms
$ sudo ovs-appctl -t ovs-vswitchd dpctl/dump-conntrack
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7337,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7337,type=0,code=0),zone=7
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7337,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7337,type=0,code=0),zone=1
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7337,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7337,type=0,code=0),zone=7
icmp,orig=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=8,code=0),reply=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=0,code=0),zone=7
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=0,code=0),zone=7
icmp,orig=(src=10.78.95.89,dst=192.168.0.211,id=7336,type=8,code=0),reply=(src=192.168.0.211,dst=10.78.95.89,id=7336,type=0,code=0),zone=1
0:
https://patchwork.ozlabs.org/project/ovn/patch/20220401175516.2139179-1-mmich...@redhat.com/
1:
https://github.com/ovn-org/ovn/commit/4deac4509abbedd6ffaecf27eed01ddefccea40a
---
ProblemType: Bug
AlsaDevices:
total 0
crw-rw---- 1 root audio 116, 1 Jun 9 11:35 seq
crw-rw---- 1 root audio 116, 33 Jun 9 11:35 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
CasperMD5CheckResult: unknown
DistroRelease: Ubuntu 22.04
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
Lsusb:
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Lsusb-t:
/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/8p, 5000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/8p, 480M
MachineType: QEMU Standard PC (Q35 + ICH9, 2009)
Package: linux (not installed)
PciMultimedia:
ProcEnviron:
TERM=xterm-256color
PATH=(custom, no user)
LANG=C.UTF-8
SHELL=/bin/bash
ProcFB: 0 virtio_gpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.15.0-37-generic
root=UUID=63713e6b-8e8d-4f97-ac5a-883317b24711 ro console=tty1 console=ttyS0
ProcVersionSignature: Ubuntu 5.15.0-37.39-generic 5.15.35
RelatedPackageVersions:
linux-restricted-modules-5.15.0-37-generic N/A
linux-backports-modules-5.15.0-37-generic N/A
linux-firmware 20220329.git681281e4-0ubuntu1
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
Tags: jammy uec-images
Uname: Linux 5.15.0-37-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
_MarkForUpload: True
dmi.bios.date: 02/06/2015
dmi.bios.release: 0.0
dmi.bios.vendor: EFI Development Kit II / OVMF
dmi.bios.version: 0.0.0
dmi.board.name: LXD
dmi.board.vendor: Canonical Ltd.
dmi.board.version: pc-q35-7.0
dmi.chassis.type: 1
dmi.chassis.vendor: QEMU
dmi.chassis.version: pc-q35-7.0
dmi.modalias:
dmi:bvnEFIDevelopmentKitII/OVMF:bvr0.0.0:bd02/06/2015:br0.0:svnQEMU:pnStandardPC(Q35+ICH9,2009):pvrpc-q35-7.0:rvnCanonicalLtd.:rnLXD:rvrpc-q35-7.0:cvnQEMU:ct1:cvrpc-q35-7.0:sku:
dmi.product.name: Standard PC (Q35 + ICH9, 2009)
dmi.product.version: pc-q35-7.0
dmi.sys.vendor: QEMU
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1967856/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
