ACK: [SRU][R][PATCH v2 0/2] New 7.0 ubuntu_kselftests_net/net:tun tests flaky (LP: #2158217)

[Alessio Faina]

On Tue, Sep 01, 2026 at 06:03:16PM +0300, Edoardo Canepa via kernel-team wrote:
> BugLink: https://bugs.launchpad.net/bugs/2158217
> 
> [Impact]
> The tun_vnet_udptnl selftests (introduced in the 7.0 cycle) are flaky
> in ubuntu_kselftests_net/net:tun, causing sporadic CI failures.  The
> send_gso_packet variants fail with zero bytes received on the inner UDP
> socket after packets are written into the TUN file descriptor:
> 
>   tun.c:947:send_gso_packet:Expected ret (0) == variant->data_size (1423)
>   tun.c:948:send_gso_packet:Expected r_num_mss (0) == variant->r_num_mss (2)
> 
> The failures are non-deterministic: different variants fail on each run
> and all tunnel types (4in4, 4in6, 6in4, 6in6) are affected.  Only the
> decap direction (TUN fd -> geneve -> socket) is impacted; the encap
> direction (socket -> geneve -> TUN fd) always succeeds.
> 
> Two independent root causes were identified:
> 
> 1. The test IPv6 addresses fall in the 2002::/16 range reserved for the
>    6to4 transition mechanism (RFC 3056).  When the sit module is loaded
>    the kernel claims this prefix, creating a competing local route that
>    prevents geneve from decapsulating IPv6-outer packets.
> 
> 2. The geneve fixture binds a UDP encap socket on port 4789 in the
>    default network namespace.  Any host network activity that also
>    touches that port or the test address ranges (VPN tunnels, container
>    overlay networks, libvirt bridges, etc.) can silently divert or drop
>    packets in the geneve decapsulation path.
> 
> This is not a kernel regression; the tests exhibit the same flakiness
> when the 7.0 test binary is run on a 6.17 kernel.
> 
> [Fix]
> Two patches:
> 
> Patch 1 (upstream cherry-pick ef01724fa235): Replaces the 2002::/16
> IPv6 test addresses with fd00:db8::/32 ULA addresses that carry no
> special kernel semantics.
> 
> Patch 2 (SAUCE): Calls unshare(CLONE_NEWNET) at program startup so the
> test runs in a pristine, isolated network namespace free of competing
> traffic.  This follows the same pattern already used by several other
> net selftests (so_incoming_cpu, tcp_port_share, icmp_rfc4884,
> ipv6_fragmentation, so_netns_cookie, ipsec, tcp_ao).
> 
> [Test]
> Built the tun test binary from the resolute kernel source tree and
> executed it repeatedly before and after the fix:
> 
> Before: 7 out of 55 runs had at least one failure (~12.7% failure rate),
> with 9 individual test failures spread across all tunnel types.
> 
> After: 0 failures across 20 consecutive runs.
> 
> [Where problems could occur]
> The unshare(CLONE_NEWNET) call requires CAP_SYS_ADMIN, which the test
> already needs to create TUN/TAP devices.  Running in an isolated
> namespace means the test cannot exercise interactions with pre-existing
> host network configuration, but that is not the purpose of these unit
> tests.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>