package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32

PATCH New Thomas De Schampheleire 3 participants 4 messages May 18, 2021 – Jun 7, 2021

lore

Share & tools

lore

Thomas De Schampheleire

author

2021-05-18 07:46 UTC #0 lore raw

PATCH 1/1 package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32

From: Thomas De Schampheleire <[email protected]>

ebtables 2.0.11 no longer works correctly when userland is 32-bit and the kernel is 64-bit. This used to work correctly in version 2.0.10-4.

Problem is twofold:
- ebtables itself was broken and needs to be patched
- buildroot needs to pass the correct flag again to indicate when we are in this situation

Signed-off-by Thomas De Schampheleire <[email protected]>

---
 ...estore-KERNEL_64_USERSPACE_32-checks.patch | 104 ++++++++++++++++++
 ...-option-enable-kernel-64-userland-32.patch |  50 +++++++++
 package/ebtables/ebtables.mk                  |   6 +
 3 files changed, 160 insertions(+)
 create mode 100644 package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch
 create mode 100644 package/ebtables/0003-configure.ac-add-option-enable-kernel-64-userland-32.patch

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +104 -0

new file mode 100644
index 0000000000..61e5b63b12
@@ -0,0 +1,104 @@
+From 7297a8ef3cab3b0faf1426622ee902a2144e2e89 Mon Sep 17 00:00:00 2001
+From: Thomas De Schampheleire <[email protected]>
+Date: Wed, 24 Mar 2021 11:27:14 +0100
+Subject: [PATCH] ebtables.h: restore KERNEL_64_USERSPACE_32 checks
+
+Commit e6359eedfbf497e52d52451072aea4713ed80a88 replaced the file ebtables.h
+but removed the usage of KERNEL_64_USERSPACE_32. This breaks boards where
+such flag is relevant, with following messages:
+
+[ 6364.971346] kernel msg: ebtables bug: please report to author: Standard target size too big
+
+Unable to update the kernel. Two possible causes:
+1. Multiple ebtables programs were executing simultaneously. The ebtables
+   userspace tool doesn't by default support multiple ebtables programs running
+   concurrently. The ebtables option --concurrent or a tool like flock can be
+   used to support concurrent scripts that update the ebtables kernel tables.
+2. The kernel doesn't support a certain ebtables extension, consider
+   recompiling your kernel or insmod the extension.
+
+Analysis shows that the structure 'ebt_replace' passed from userspace
+ebtables to the kernel, is too small, i.e 80 bytes instead of 120 in case of
+64-bit kernel.
+
+Note that the ebtables build system seems to assume that 'sparc64' is the
+only case where KERNEL_64_USERSPACE_32 is relevant, but this is not true.
+This situation can happen on many architectures, especially in embedded
+systems. For example, an Aarch64 processor with kernel in 64-bit but
+userland build for 32-bit Arm. Or a 64-bit MIPS Octeon III processor, with
+userland running in the 'n32' ABI.
+
+Signed-off-by: Thomas De Schampheleire <[email protected]>
+---
+ include/linux/netfilter_bridge/ebtables.h | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
+index 5be75f2..3c2b61e 100644
+--- a/include/linux/netfilter_bridge/ebtables.h
++++ b/include/linux/netfilter_bridge/ebtables.h
+@@ -49,12 +49,21 @@ struct ebt_replace {
+ 	/* total size of the entries */
+ 	unsigned int entries_size;
+ 	/* start of the chains */
++#ifdef KERNEL_64_USERSPACE_32
++	uint64_t hook_entry[NF_BR_NUMHOOKS];
++#else
+ 	struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
++#endif
+ 	/* nr of counters userspace expects back */
+ 	unsigned int num_counters;
+ 	/* where the kernel will put the old counters */
++#ifdef KERNEL_64_USERSPACE_32
++	uint64_t counters;
++	uint64_t entries;
++#else
+ 	struct ebt_counter *counters;
+ 	char *entries;
++#endif
+ };
+ 
+ struct ebt_replace_kernel {
+@@ -129,6 +138,9 @@ struct ebt_entry_match {
+ 	} u;
+ 	/* size of data */
+ 	unsigned int match_size;
++#ifdef KERNEL_64_USERSPACE_32
++	unsigned int pad;
++#endif
+ 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
+ };
+ 
+@@ -142,6 +154,9 @@ struct ebt_entry_watcher {
+ 	} u;
+ 	/* size of data */
+ 	unsigned int watcher_size;
++#ifdef KERNEL_64_USERSPACE_32
++	unsigned int pad;
++#endif
+ 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
+ };
+ 
+@@ -155,6 +170,9 @@ struct ebt_entry_target {
+ 	} u;
+ 	/* size of data */
+ 	unsigned int target_size;
++#ifdef KERNEL_64_USERSPACE_32
++	unsigned int pad;
++#endif
+ 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
+ };
+ 
+@@ -162,6 +180,9 @@ struct ebt_entry_target {
+ struct ebt_standard_target {
+ 	struct ebt_entry_target target;
+ 	int verdict;
++#ifdef KERNEL_64_USERSPACE_32
++	unsigned int pad;
++#endif
+ };
+ 
+ /* one entry */
+-- 
+2.26.2
+

package/ebtables/0003-configure.ac-add-option-enable-kernel-64-userland-32.patch new file +50 -0

50 lines not on this page · raw message

package/ebtables/ebtables.mk +6 -0

index 54932334c2..2f9dd5ac4b 100644
@@ -11,6 +11,12 @@ EBTABLES_LICENSE_FILES = COPYING
 EBTABLES_CPE_ID_VENDOR = netfilter
 EBTABLES_SELINUX_MODULES = iptables
 
+# for 0003-configure.ac-add-option-enable-kernel-64-userland-32.patch
+EBTABLES_AUTORECONF = YES
+ifeq ($(BR2_KERNEL_64_USERLAND_32),y)
+EBTABLES_CONF_OPTS += --enable-kernel-64-userland-32
+endif
+
 ifeq ($(BR2_PACKAGE_EBTABLES_UTILS_SAVE),y)
 define EBTABLES_INSTALL_TARGET_UTILS_SAVE
 	$(INSTALL) -m 0755 -D $(@D)/ebtables-save.sh $(TARGET_DIR)/usr/sbin/ebtables-legacy-save

Signature · 1 line

2.26.3

Thomas De Schampheleire

author

2021-05-18 18:21 UTC #1 lore raw

PATCH 1/1 package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32

Hello,

El mar, 18 may 2021 a las 9:46, Thomas De Schampheleire (<[email protected]>) escribi?:

Quoted 11 lines

From: Thomas De Schampheleire <[email protected]>
ebtables 2.0.11 no longer works correctly when userland is 32-bit and the kernel is 64-bit. This used to work correctly in version 2.0.10-4.
Problem is twofold:
- ebtables itself was broken and needs to be patched
- buildroot needs to pass the correct flag again to indicate when we are in this situation

Quoted 8 lines

Signed-off-by Thomas De Schampheleire <[email protected]>

---
 ...estore-KERNEL_64_USERSPACE_32-checks.patch | 104 ++++++++++++++++++
 ...-option-enable-kernel-64-userland-32.patch |  50 +++++++++
 package/ebtables/ebtables.mk                  |   6 +
 3 files changed, 160 insertions(+)
 create mode 100644 package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch
 create mode 100644 package/ebtables/0003-configure.ac-add-option-enable-kernel-64-userland-32.patch

Both patches have been submitted upstream:

https://marc.info/?l=netfilter-devel&m=162136187029914&w=2
https://marc.info/?l=netfilter-devel&m=162136187029916&w=2

Best regards,
Thomas

Arnout Vandecappelle

Applied

2021-05-21 09:04 UTC #2 lore raw

PATCH 1/1 package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32

In reply to Thomas De Schampheleire

Quoted 11 lines · Thomas De Schampheleire

From: Thomas De Schampheleire <[email protected]>
ebtables 2.0.11 no longer works correctly when userland is 32-bit and the kernel is 64-bit. This used to work correctly in version 2.0.10-4.
Problem is twofold:
- ebtables itself was broken and needs to be patched
- buildroot needs to pass the correct flag again to indicate when we are in this situation
Signed-off-by Thomas De Schampheleire <[email protected]>

Applied to master, thanks.

Quoted 35 lines

---
 ...estore-KERNEL_64_USERSPACE_32-checks.patch | 104 ++++++++++++++++++
 ...-option-enable-kernel-64-userland-32.patch |  50 +++++++++
 package/ebtables/ebtables.mk                  |   6 +
 3 files changed, 160 insertions(+)
 create mode 100644 package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch
 create mode 100644 package/ebtables/0003-configure.ac-add-option-enable-kernel-64-userland-32.patch

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +21 -0

new file mode 100644
index 0000000000..61e5b63b12
@@ -0,0 +1,104 @@
+From 7297a8ef3cab3b0faf1426622ee902a2144e2e89 Mon Sep 17 00:00:00 2001
+From: Thomas De Schampheleire <[email protected]>
+Date: Wed, 24 Mar 2021 11:27:14 +0100
+Subject: [PATCH] ebtables.h: restore KERNEL_64_USERSPACE_32 checks
+
+Commit e6359eedfbf497e52d52451072aea4713ed80a88 replaced the file ebtables.h
+but removed the usage of KERNEL_64_USERSPACE_32. This breaks boards where
+such flag is relevant, with following messages:
+
+[ 6364.971346] kernel msg: ebtables bug: please report to author: Standard target size too big
+
+Unable to update the kernel. Two possible causes:
+1. Multiple ebtables programs were executing simultaneously. The ebtables
+   userspace tool doesn't by default support multiple ebtables programs running
+   concurrently. The ebtables option --concurrent or a tool like flock can be
+   used to support concurrent scripts that update the ebtables kernel tables.
+2. The kernel doesn't support a certain ebtables extension, consider
+   recompiling your kernel or insmod the extension.
+
+Analysis shows that the structure 'ebt_replace' passed from userspace
+ebtables to the kernel, is too small, i.e 80 bytes instead of 120 in case of

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch line 31

Quoted 10 lines

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +10 -0

+64-bit kernel.
+
+Note that the ebtables build system seems to assume that 'sparc64' is the
+only case where KERNEL_64_USERSPACE_32 is relevant, but this is not true.
+This situation can happen on many architectures, especially in embedded
+systems. For example, an Aarch64 processor with kernel in 64-bit but
+userland build for 32-bit Arm. Or a 64-bit MIPS Octeon III processor, with
+userland running in the 'n32' ABI.
+
+Signed-off-by: Thomas De Schampheleire <[email protected]>

I've added the patchwork reference to both patches.

[snip]

Quoted 9 lines

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +9 -0

+diff --git a/configure.ac b/configure.ac
+index c24ede3..3e89c0c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -15,10 +15,17 @@ AS_IF([test "x$LOCKFILE" = x], [LOCKFILE="/var/lib/ebtables/lock"])
+ 
+ regular_CFLAGS="-Wall -Wunused"
+ regular_CPPFLAGS=""
++

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch line 50

Quoted 10 lines

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +10 -0

+ case "$host" in
+ 	sparc64-*)
+-		regular_CPPFLAGS="$regular_CPPFLAGS -DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32";;
++		enable_kernel_64_userland_32=yes ;;
+ esac
++AC_ARG_ENABLE([kernel-64-userland-32],
++    AC_HELP_STRING([--enable-kernel-64-userland-32], [indicate that ebtables will be built as a 32-bit application but run under a 64-bit kernel])
++)
++AS_IF([test "x$enable_kernel_64_userland_32" = xyes],
++    [regular_CPPFLAGS="$regular_CPPFLAGS -DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32"]

Since the proper name is userspace, not userland, I think upstream will want
you to rename that configure option.

I don't know, however, so I've applied as-is. Whoever bumps ebtables will
notice when the patch gives a conflict.

Regards,
Arnout

Quoted 25 lines

package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch new file +7 -0

++)
+ 
+ AC_SUBST([regular_CFLAGS])
+ AC_SUBST([regular_CPPFLAGS])
+-- 
+2.26.2
+

package/ebtables/ebtables.mk +6 -0

index 54932334c2..2f9dd5ac4b 100644
@@ -11,6 +11,12 @@ EBTABLES_LICENSE_FILES = COPYING
 EBTABLES_CPE_ID_VENDOR = netfilter
 EBTABLES_SELINUX_MODULES = iptables
 
+# for 0003-configure.ac-add-option-enable-kernel-64-userland-32.patch
+EBTABLES_AUTORECONF = YES
+ifeq ($(BR2_KERNEL_64_USERLAND_32),y)
+EBTABLES_CONF_OPTS += --enable-kernel-64-userland-32
+endif
+
 ifeq ($(BR2_PACKAGE_EBTABLES_UTILS_SAVE),y)
 define EBTABLES_INSTALL_TARGET_UTILS_SAVE
 	$(INSTALL) -m 0755 -D $(@D)/ebtables-save.sh $(TARGET_DIR)/usr/sbin/ebtables-legacy-save

Peter Korsgaard

2021-06-07 21:14 UTC #3 lore raw

PATCH 1/1 package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32

In reply to Thomas De Schampheleire

Quoted 6 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Thomas" == Thomas De Schampheleire <[email protected]> writes:
From: Thomas De Schampheleire <[email protected]> ebtables 2.0.11 no longer works correctly when userland is 32-bit and the kernel is 64-bit. This used to work correctly in version 2.0.10-4.

Quoted 6 lines

Problem is twofold:
- ebtables itself was broken and needs to be patched
- buildroot needs to pass the correct flag again to indicate when we are in this situation
Signed-off-by Thomas De Schampheleire <[email protected]>

Committed to 2021.02.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard