Thanks Jake for confirming.
I have also independently tested and verified the fix in
linux-image-5.15.0-198-generic (5.15.0-198.208) from jammy-proposed.
Test Environment
- Host: Ubuntu 22.04 LTS (Jammy) VM (Multipass/KVM)
- Unpatched Kernel: 5.15.0-190-generic (#200-Ubuntu)
- Patched Kernel (-proposed): 5.15.0-198-generic (#208-Ubuntu)
1. Unpatched Verification (5.15.0-190-generic)
- Docker Reproduction:
- Baseline: 1.6 MiB in 803 regions
- Executed 500 exec probe iterations ('sleep 0.1 & exit 0') against a
non-reaping container (PID 1 sleep).
- While 499 zombies existed:
- BPF-JIT usage climbed to: 11.2 MiB in 1,808 regions (+1,005 regions,
+9.6 MiB leak).
2. Proposed Kernel Verification (5.15.0-198-generic #208-Ubuntu)
- Docker Reproduction:
- Baseline: 1.9 MiB in 947 regions
- Executed 500 exec probe iterations creating 500 unreaped zombies.
- While 500 zombies existed:
- BPF-JIT usage stayed flat at: 2.0 MiB in 957 regions (no leak).
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164699
Title:
seccomp filter leak in bpf_jit due to unreaped zombie process
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2164699/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
