Debian Bug report logs -
#1076456
iptables-netflow-dkms: No more builds on Debian 11 Bullseye since kernel linux-image-5.10.0-31-amd64 (5.10.221-1) due to "unexport find_module" kernel backport from 5.12
Subject: iptables-netflow-dkms: No more builds on Debian 11 Bullseye since
kernel linux-image-5.10.0-31-amd64 (5.10.221-1) due to "unexport
find_module" kernel backport from 5.12
Date: Tue, 16 Jul 2024 20:15:19 +0200
Package: iptables-netflow-dkms
Version: 2.5.1-2
Severity: grave
Tags: patch bullseye
Since linux-image-5.10.0-31-amd64/5.10.221-1, ipt_NETFLOW.ko no more
builds on Debian 11 Bullseye:
Citing from /var/lib/dkms/ipt-netflow/2.5.1/build/make.log:
DKMS make.log for ipt-netflow-2.5.1 for kernel 5.10.0-31-amd64 (x86_64)
Tue Jul 16 16:17:06 UTC 2024
./gen_compat_def > compat_def.h
Test symbol xt_family linux/netfilter_ipv4/ip_tables.h
Test struct timeval linux/ktime.h
Test struct proc_ops linux/proc_fs.h
Test symbol synchronize_sched linux/rcupdate.h
Compiling for kernel 5.10.221
make -C /lib/modules/5.10.0-31-amd64/build M=/var/lib/dkms/ipt-netflow/2.5.1/build modules CONFIG_DEBUG_INFO
make[1]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
make[1]: Entering directory '/usr/src/linux-headers-5.10.0-31-amd64'
CC [M] /var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.o
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c: In function 'nf_seq_show':
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:755:39: warning: format '%lu' expects argument of type ' 3 has type 's64' {aka 'long long int'} [-Wformat=]
755 | seq_printf(seq, " Flows selected %lu, discarded %lu.",
| ~~^
| |
| long unsigned int
| %llu
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:755:54: warning: format '%lu' expects argument of type ' 4 has type 's64' {aka 'long long int'} [-Wformat=]
755 | seq_printf(seq, " Flows selected %lu, discarded %lu.",
| ~~^
| |
| long unsigned int
| %llu
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:759:39: warning: format '%lu' expects argument of type ' 3 has type 's64' {aka 'long long int'} [-Wformat=]
759 | seq_printf(seq, " Flows selected %lu.", atomic64_read(&flows_selected));
| ~~^
| |
| long unsigned int
| %llu
MODPOST /var/lib/dkms/ipt-netflow/2.5.1/build/Module.symvers
ERROR: modpost: "find_module" [/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.ko] undefined!
make[3]: *** [/usr/src/linux-headers-5.10.0-31-common/scripts/Makefile.modpost:123: /var/lib/dkms/ipt-netfloror 1
make[3]: *** Deleting file '/var/lib/dkms/ipt-netflow/2.5.1/build/Module.symvers'
make[2]: *** [/usr/src/linux-headers-5.10.0-31-common/Makefile:1783: modules] Error 2
make[1]: *** [/usr/src/linux-headers-5.10.0-31-common/Makefile:192: __sub-make] Error 2
make[1]: Leaving directory '/usr/src/linux-headers-5.10.0-31-amd64'
make: *** [Makefile:25: ipt_NETFLOW.ko] Error 2
This happens, because upstream kernel 5.10.220 backported this change
from kernel 5.12:
- module: unexport find_module and module_mutex
Backporting upstream commit
https://github.com/aabc/ipt-netflow/commit/5aae3791922bd3df878605b15e83ea48a4bd096c
with updated version constraint fixes the issue:
Index: iptables-netflow-2.5.1/compat.h
===================================================================
--- iptables-netflow-2.5.1.orig/compat.h
+++ iptables-netflow-2.5.1/compat.h
@@ -749,4 +749,29 @@ unsigned long long strtoul(const char *c
return result;
}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,12,0) || LINUX_VERSION_CODE >= KERNEL_VERSION(5,10,220)
+/*
+ * find_module() is unexported in v5.12:
+ * 089049f6c9956 ("module: unexport find_module and module_mutex")
+ * and module_mutex is replaced with RCU in
+ * a006050575745 ("module: use RCU to synchronize find_module")
+ */
+#include <linux/rcupdate.h>
+struct module *find_module(const char *name)
+{
+ struct module *mod;
+
+ rcu_read_lock_sched();
+ /* Yes this is crazy, but should work. */
+ list_for_each_entry_rcu(mod, &THIS_MODULE->list, list) {
+ if (!strcmp(mod->name, name)) {
+ rcu_read_unlock_sched();
+ return mod;
+ }
+ }
+ rcu_read_unlock_sched();
+ return NULL;
+}
+#endif
+
#endif /* COMPAT_NETFLOW_H */
I intend to do a bullseye-proposed-stable upload for that.
Acknowledgement sent
to Andreas Beckmann <[email protected]>:
Extra info received and forwarded to list. Copy sent to Axel Beckert <[email protected]>.
(Thu, 13 Feb 2025 11:21:02 GMT) (full text, mbox, link).
Subject: Re: iptables-netflow-dkms: No more builds on Debian 11 Bullseye since kernel linux-image-5.10.0-31-amd64 (5.10.221-1) due to "unexport find_module" kernel backport from 5.12
Date: Thu, 13 Feb 2025 12:17:46 +0100
Followup-For: Bug #1076456
Control: found -1 2.6-4
That is an incorrect constraint:
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,12,0) || LINUX_VERSION_CODE >= KERNEL_VERSION(5,10,220)
you probably want
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,12,0)) || \
((LINUX_VERSION_CODE >= KERNEL_VERSION(5,10,220)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5,11,0))
This bug also affects the version in bookworm, because on distupgrades
from bullseye to bookworm kernels+headers from both releases will be installed
Andreas
Acknowledgement sent
to Andreas Beckmann <[email protected]>:
Extra info received and forwarded to list. Copy sent to Axel Beckert <[email protected]>.
(Sun, 02 Mar 2025 00:09:01 GMT) (full text, mbox, link).
Subject: Re: iptables-netflow-dkms: No more builds on Debian 11 Bullseye since kernel linux-image-5.10.0-31-amd64 (5.10.221-1) due to "unexport find_module" kernel backport from 5.12
Date: Sun, 02 Mar 2025 01:07:12 +0100
Followup-For: Bug #1076456
A patch for this issue as well as patches for supporting up to Linux
v6.13 are available in
https://salsa.debian.org/debian/iptables-netflow/-/merge_requests/4
I have only tested that the module builds again for all the kernels in
oldstable, stable, testing, sid, experimental. No usage of the module on
newer kernels has been tried.
I intend to NMU this in a few days with short delay to get the fixes
into sid, which is a prerequisite to cherry-picking some of them for the
next bookworm point release.
Andreas
Reply sent
to Andreas Beckmann <[email protected]>:
You have taken responsibility.
(Fri, 07 Mar 2025 14:27:02 GMT) (full text, mbox, link).
Notification sent
to Axel Beckert <[email protected]>:
Bug acknowledged by developer.
(Fri, 07 Mar 2025 14:27:02 GMT) (full text, mbox, link).
Source: iptables-netflow
Source-Version: 2.6-7.1
Done: Andreas Beckmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
iptables-netflow, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Beckmann <[email protected]> (supplier of updated iptables-netflow package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 07 Mar 2025 14:32:07 +0100
Source: iptables-netflow
Architecture: source
Version: 2.6-7.1
Distribution: unstable
Urgency: medium
Maintainer: Axel Beckert <[email protected]>
Changed-By: Andreas Beckmann <[email protected]>
Closes: 9664831076456108137710886781089498
Changes:
iptables-netflow (2.6-7.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Use debhelper-compat (= 13) substitution instead of dh-exec.
* Remove useless pushd/popd from dkms.conf. (Closes: #966483)
* Dump the generated compat_def.h.
* Update from upstream Git.
* Fix dkms status invocation.
* Avoid dkms recursion.
* dkms.conf: Declare BUILD_EXCLUSIVE_KERNEL_MIN="3".
* Fix module build for Linux v4.3.
* Unexporting find_module() has been backported to Linux v5.10.220.
(Closes: #1076456, #1088678)
* Fix module build for Linux v6.11. (Closes: #1081377)
* Fix module build for Linux v6.12. (Closes: #1089498)
* Work around physindev in nf_bridge_info being replaced by physinif to fix
module build for Linux v6.8, v6.7.2, v6.6.14, v6.1.75.
Checksums-Sha1:
debac79247e1a63712dca1f87889b57003bc175e 2072 iptables-netflow_2.6-7.1.dsc
a5378367542d380d30038b56b09326b0c1a47bf3 24532 iptables-netflow_2.6-7.1.debian.tar.xz
f983844090fd071e1b87c221772f05b961b50353 5537 iptables-netflow_2.6-7.1_source.buildinfo
Checksums-Sha256:
27a175fbe9c0a4b7f63e02266f8bf213c23aceec9f8f87e433eff99a5c28aad7 2072 iptables-netflow_2.6-7.1.dsc
a308af75736268c51f8a2601c33b325a7fbdcb11e40d76eeaedae1b4c8d8524e 24532 iptables-netflow_2.6-7.1.debian.tar.xz
754fc2f623fb069d33b90a75d93de6db989346c3c6e241030b4322eafc815c3d 5537 iptables-netflow_2.6-7.1_source.buildinfo
Files:
38c3007cf7d42662e00d90f46f3e5c0e 2072 kernel optional iptables-netflow_2.6-7.1.dsc
ba031506e779c6e966faf788d9951eca 24532 kernel optional iptables-netflow_2.6-7.1.debian.tar.xz
d5b223bafe5ba3a3580709b9e76e4eb8 5537 kernel optional iptables-netflow_2.6-7.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCAAuFiEE6/MKMKjZxjvaRMaUX7M/k1np7QgFAmfK9o8QHGFuYmVAZGVi
aWFuLm9yZwAKCRBfsz+TWentCLLuD/wMxKeaqPdPfbSC5HupVX9Py7EODSxSR3Q5
ZKPyq31lVwqIomBXMjNrGadYl21WbeKXKPNWzibjRenv8/8hzEyAaFhFjlIEmPJ8
6Obn5bJTbAUO0MHj6EFPJE+XYTJCp3NYwOx5c0VleGWgzvhSA6jmA7iI2In1ZpT9
/onVBbP+9lhgo9b4jbg/tdnRwAdnBP0zMJT7Qo569SfCvNjVlZqZenS5gbiEKZXe
txL/8lLhEgS0wNaDUVA0tr41MMxkhnM0Mz4sNH6SBCxyuKQ8at7KQwzQWb87pszB
ZX3hvIGeXqoEoNOkXUUckt7QWFKyXTFIECqDcD3Oolu+nVvEiwx4YsvME8+Bg9Nx
zaVRjOwkRIvpdgAz/OERVyyFYrETkAXjZCAGVhldM+mOZf+DqhPQQRnkNBQjDka6
rRI0ZPd0x6IDDUAyAj3T4dlpjSUFr/OjRaCdoODUAxzRfS+TeBmRRUJzWQ4bdEFr
OTFszSNGLcIdmqs+X9M3WIpp4ADzNSNhqO53VurM+nC8yAiTv1uLEdQwQHl3Ioen
JjEsxyqiXm84I96C/pHI9IQDr9KJcRwx0ooiqgb4CqvtGL/sdqXYQMdcr+DpD0Ac
lAGkDjJejNEa5XHdkMIsK3QaZFhIQ4obTLFiWCg77jy4UxCkefTmd7wIGnXKaEH0
JWW+QUPEfw==
=ZoC/
-----END PGP SIGNATURE-----
Source: iptables-netflow
Source-Version: 2.6-4+deb12u1
Done: Andreas Beckmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
iptables-netflow, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Beckmann <[email protected]> (supplier of updated iptables-netflow package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 07 Mar 2025 15:45:27 +0100
Source: iptables-netflow
Architecture: source
Version: 2.6-4+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Axel Beckert <[email protected]>
Changed-By: Andreas Beckmann <[email protected]>
Closes: 10764561088678
Changes:
iptables-netflow (2.6-4+deb12u1) bookworm; urgency=medium
.
* Non-maintainer upload.
* Dump the generated compat_def.h.
* Avoid dkms recursion.
* Unexporting find_module() has been backported to Linux v5.10.220.
(Closes: #1076456, #1088678)
Checksums-Sha1:
004de670a3e97cc515e3341091b8941e48754a94 2108 iptables-netflow_2.6-4+deb12u1.dsc
40d3a9c5625a23d9e7be411fba85380fcf3d3a83 12412 iptables-netflow_2.6-4+deb12u1.debian.tar.xz
765d5c2dea34878ba47f4303b6eccced4cb18603 5991 iptables-netflow_2.6-4+deb12u1_source.buildinfo
Checksums-Sha256:
1524e547f5b034018dfa64305b0387901c2d8eabfa6c8b00441debbaa001a2f3 2108 iptables-netflow_2.6-4+deb12u1.dsc
7e366e8b9457a8f033aac544a4d05cea30e368dd93ebee4aac8bb8b87a444637 12412 iptables-netflow_2.6-4+deb12u1.debian.tar.xz
0863ca868079099341a1aefffc488d3962acfada55e48f8bcb218a5725252307 5991 iptables-netflow_2.6-4+deb12u1_source.buildinfo
Files:
d44194a21f87aff5b10f3f220db6d7dc 2108 kernel optional iptables-netflow_2.6-4+deb12u1.dsc
2149e4d2a96d22f7cc732d5c860e2ba2 12412 kernel optional iptables-netflow_2.6-4+deb12u1.debian.tar.xz
7d712d7ddd511c1f12dca0f5301ad983 5991 kernel optional iptables-netflow_2.6-4+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCAAuFiEE6/MKMKjZxjvaRMaUX7M/k1np7QgFAmfLBz8QHGFuYmVAZGVi
aWFuLm9yZwAKCRBfsz+TWentCGRcEACFfokFyWwcLNOHPP4XDdtiNjPjgMzJfaWU
1VEY1iVV9fwER0Q1OtFjE8To7zpK+gdse6a+kAxVlZWIqSHMlwaQo1IynsJkPyfB
Cv7zImluNOgqhn/eN/SVMIxhuxOhXPCc7Nvrx88HKWsx5y/IZzRXSZi9PzoCfB7t
+Ge8Cy6v9XzdaLen5nyp4IZjjPFfnzO91VzJAvvflyrUBimG7NSAW25TiUR7MhbF
ajxRpWiZsYFtbBes1JIKSpRxD9ZHsBCzVra1nYmJTTOrPCihioxBHHT81XSoF8cn
drKt5lsCaIej5ASdX7Njn163uSrV/10iq6T6XlSnHsPEHel4pwc3lF7yL0h5QhQH
cFWqcpNjQO71A21YOMejkTR0JapuHbicZauWmvTa9buvnNhy7w7OdK4s3s9a9czo
QYBOOe3wzcKdVeHT+JrmF0MJx1ERGMLDqnzfyibYwRj2ekwBl6iurp8+B2ZTt+HA
4vJS4BE0APcXe3OgKCG9tf4hEviSL3emf0X2mRh6VEqaHm7RbWDFjOUb/9YYoJLI
ZBYiaReKiOtGrmFprS4Yrlar3fuxkyMR57bHWQd1sKRnCi61GGf3v9M9xTmn/d9G
8jmQGCyrcEee/MggTA7PNPS9hCxdkfBXaUNo45QRrOdWhA1xPTaKlXDUzsjZAQKS
9N802IWT0g==
=+wRi
-----END PGP SIGNATURE-----
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.