Public bug reported:
on 5.15 a seccomp filter is freed at reap (release_task()), not at exit.
Each filter's JIT image is charged to net.core.bpf_jit_limit (half the
module area: 512 MiB amd64, 64 MiB arm64). Unreaped zombies from
short‑lived containerised processes keep pinning images until the limit
is hit; then bpf_jit_charge_modmem() refuses unprivileged allocations
and, because every Ubuntu kernel has CONFIG_BPF_JIT_ALWAYS_ON=y (no
interpreter fallback — verified in debian.master/config/annotations),
bpf_prog_select_runtime() returns -ENOTSUPP = 524. That's the kernel err
loading seccomp filter errno 524: unknown error 524 on the k8s node:
pods with a seccomp profile fail to start while everything else looks
healthy. I verified this chain in the jammy source
(kernel/bpf/core.c:846, :1980, include/linux/errno.h:27).
** Affects: linux (Ubuntu)
Importance: Undecided
Assignee: dongdong tao (taodd)
Status: New
** Changed in: linux (Ubuntu)
Assignee: (unassigned) => dongdong tao (taodd)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164699
Title:
seccomp filter leak in bpf_jit due to unreaped zombie process
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2164699/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
