Bug #1566221 “linux: Enforce signed module loading when UEFI sec...” : Bugs : linux package : Ubuntu

Tim Gardner (timg-tpi) on 2016-04-05

Changed in linux (Ubuntu Xenial):
assignee:	nobody → Tim Gardner (timg-tpi)
status:	New → In Progress

Tim Gardner (timg-tpi) on 2016-04-05

description:

updated

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-04-08:

#1

Download full text (7.9 KiB)

This bug was fixed in the package linux - 4.4.0-18.34

---------------
linux (4.4.0-18.34) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
- LP: #1566868

  * [i915_bpo] Fix RC6 on SKL GT3 & GT4 (LP: #1564759)
    - SAUCE: i915_bpo: drm/i915/skl: Fix rc6 based gpu/system hang
    - SAUCE: i915_bpo: drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs

* CONFIG_ARCH_ROCKCHIP not enabled in armhf generic kernel (LP: #1566283)
- [Config] CONFIG_ARCH_ROCKCHIP=y

  * [Feature] Memory Bandwidth Monitoring (LP: #1397880)
    - perf/x86/cqm: Fix CQM handling of grouping events into a cache_group
    - perf/x86/cqm: Fix CQM memory leak and notifier leak
    - x86/cpufeature: Carve out X86_FEATURE_*
    - Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    - x86/topology: Create logical package id
    - perf/x86/mbm: Add Intel Memory B/W Monitoring enumeration and init
    - perf/x86/mbm: Add memory bandwidth monitoring event management
    - perf/x86/mbm: Implement RMID recycling
    - perf/x86/mbm: Add support for MBM counter overflow handling

  * User namespace mount updates (LP: #1566505)
    - SAUCE: quota: Require that qids passed to dqget() be valid and map into s_user_ns
    - SAUCE: fs: Allow superblock owner to change ownership of inodes with unmappable ids
    - SAUCE: fuse: Don't initialize user_id or group_id in mount options
    - SAUCE: cgroup: Use a new super block when mounting in a cgroup namespace
    - SAUCE: fs: fix a posible leak of allocated superblock

  * [arm64] kernel BUG at /build/linux-StrpB2/linux-4.4.0/fs/ext4/inode.c:2394!
    (LP: #1566518)
    - arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
    - arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission

  * [Feature]USB core and xHCI tasks for USB 3.1 SuperSpeedPlus (SSP) support
    for Alpine Ridge on SKL (LP: #1519623)
    - usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
    - usb: set USB 3.1 roothub device speed to USB_SPEED_SUPER_PLUS
    - usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices
    - usb: add device descriptor for usb 3.1 root hub
    - usb: Support USB 3.1 extended port status request
    - xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices.
    - xhci: set roothub speed to USB_SPEED_SUPER_PLUS for USB3.1 capable controllers
    - xhci: USB 3.1 add default Speed Attributes to SuperSpeedPlus device capability
    - xhci: set slot context speed field to SuperSpeedPlus for USB 3.1 SSP devices
    - usb: Add USB3.1 SuperSpeedPlus Isoc Endpoint Companion descriptor
    - usb: Parse the new USB 3.1 SuperSpeedPlus Isoc endpoint companion descriptor
    - usb: Add USB 3.1 Precision time measurement capability descriptor support
    - xhci: refactor and cleanup endpoint initialization.
    - xhci: Add SuperSpeedPlus high bandwidth isoc support to xhci endpoints
    - xhci: cleanup isoc tranfers queuing code
    - xhci: Support extended burst isoc TRB structure used by xhci 1.1 for USB 3.1
    - SAUCE: (noup) usb: fix regression in SuperSpeed endpoint descriptor parsing

* wrong/missing permissions for device f...

This bug was fixed in the package linux - 4.4.0-18.34

---------------
linux (4.4.0-18.34) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
    - LP: #1566868

* [i915_bpo] Fix RC6 on SKL GT3 & GT4 (LP: #1564759)
    - SAUCE: i915_bpo: drm/i915/skl: Fix rc6 based gpu/system hang
    - SAUCE: i915_bpo: drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs

* CONFIG_ARCH_ROCKCHIP not enabled in armhf generic kernel (LP: #1566283)
    - [Config] CONFIG_ARCH_ROCKCHIP=y

* [Feature] Memory Bandwidth Monitoring (LP: #1397880)
    - perf/x86/cqm: Fix CQM handling of grouping events into a cache_group
    - perf/x86/cqm: Fix CQM memory leak and notifier leak
    - x86/cpufeature: Carve out X86_FEATURE_*
    - Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    - x86/topology: Create logical package id
    - perf/x86/mbm: Add Intel Memory B/W Monitoring enumeration and init
    - perf/x86/mbm: Add memory bandwidth monitoring event management
    - perf/x86/mbm: Implement RMID recycling
    - perf/x86/mbm: Add support for MBM counter overflow handling

* User namespace mount updates (LP: #1566505)
    - SAUCE: quota: Require that qids passed to dqget() be valid and map into s_user_ns
    - SAUCE: fs: Allow superblock owner to change ownership of inodes with unmappable ids
    - SAUCE: fuse: Don't initialize user_id or group_id in mount options
    - SAUCE: cgroup: Use a new super block when mounting in a cgroup namespace
    - SAUCE: fs: fix a posible leak of allocated superblock

* [arm64] kernel BUG at /build/linux-StrpB2/linux-4.4.0/fs/ext4/inode.c:2394!
    (LP: #1566518)
    - arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
    - arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission

* [Feature]USB core and xHCI tasks for USB 3.1 SuperSpeedPlus (SSP) support
    for Alpine Ridge on SKL (LP: #1519623)
    - usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
    - usb: set USB 3.1 roothub device speed to USB_SPEED_SUPER_PLUS
    - usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices
    - usb: add device descriptor for usb 3.1 root hub
    - usb: Support USB 3.1 extended port status request
    - xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices.
    - xhci: set roothub speed to USB_SPEED_SUPER_PLUS for USB3.1 capable controllers
    - xhci: USB 3.1 add default Speed Attributes to SuperSpeedPlus device capability
    - xhci: set slot context speed field to SuperSpeedPlus for USB 3.1 SSP devices
    - usb: Add USB3.1 SuperSpeedPlus Isoc Endpoint Companion descriptor
    - usb: Parse the new USB 3.1 SuperSpeedPlus Isoc endpoint companion descriptor
    - usb: Add USB 3.1 Precision time measurement capability descriptor support
    - xhci: refactor and cleanup endpoint initialization.
    - xhci: Add SuperSpeedPlus high bandwidth isoc support to xhci endpoints
    - xhci: cleanup isoc tranfers queuing code
    - xhci: Support extended burst isoc TRB structure used by xhci 1.1 for USB 3.1
    - SAUCE: (noup) usb: fix regression in SuperSpeed endpoint descriptor parsing

* wrong/missing permissions for device file /dev/prandom (prng.ko)
    (LP: #1558275)
    - s390/crypto: provide correct file mode at device register.

* The Front MIC jack can't work on a HP desktop machine (LP: #1564712)
    - ALSA: hda - fix front mic problem for a HP desktop

* HP Notebook Probook 440 G3  HDA Intel PCH horrible sounds while booting
    (LP: #1556228)
    - ALSA: hda - Apply reboot D3 fix for CX20724 codec, too

* please provide mmc-modules udeb (LP: #1565765)
    - [Config] Add mmc block drivers to d-i

* linux: Enforce signed module loading when UEFI secure boot (LP: #1566221)
    - Add secure_modules() call
    - PCI: Lock down BAR access when module security is enabled
    - x86: Lock down IO port access when module security is enabled
    - ACPI: Limit access to custom_method
    - asus-wmi: Restrict debugfs interface when module loading is restricted
    - Restrict /dev/mem and /dev/kmem when module loading is restricted
    - acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted
    - kexec: Disable at runtime if the kernel enforces module loading restrictions
    - x86: Restrict MSR access when module loading is restricted
    - [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=n
    - Add option to automatically enforce module signatures when in Secure Boot mode
    - efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - efi: Add EFI_SECURE_BOOT bit
    - hibernate: Disable in a signed modules environment

* [Hyper-V] Additional PCI passthrough commits (LP: #1565967)
    - PCI: Add fwnode_handle to x86 pci_sysdata
    - PCI: Look up IRQ domain by fwnode_handle
    - [Config] CONFIG_PCI_HYPERV=m
    - PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs

* [Bug]Lenovo Yoga 260 and Carbon X1 4th gen freeze on HWP enable
    (LP: #1559923)
    - ACPI / processor: Request native thermal interrupt handling via _OSC

* Sync kernel zfs 0.6.5.6 - align with zfsutils-linux and spl packages
    (LP: #1564591)
    - SAUCE: (noup) Update spl to 0.6.5.6-0ubuntu1, zfs to 0.6.5.6-0ubuntu3

* [Ubuntu 16.04.1] RELEASE and ACQUIRE atomics on Power (LP: #1556096)
    - atomics: Allow architectures to define their own __atomic_op_* helpers
    - powerpc: atomic: Implement atomic{, 64}_*_return_* variants
    - powerpc: atomic: Implement acquire/release/relaxed variants for xchg
    - powerpc: atomic: Implement acquire/release/relaxed variants for cmpxchg

* fix for do_tools_cpupower when cross-compiling (LP: #1564206)
    - [Debian] cpupower uses non-standard CROSS

* ISST:LTE: Regression: roselp2 Oops in kernel during setup io (LP: #1546439)
    - SAUCE: block: partition: initialize percpuref before sending out KOBJ_ADD

* Unable to migrate container (LP: #1563921)
    - SAUCE: cgroup mount: ignore nsroot=

* [Hyper-V] patch inclusion in 16.04 for NIC hot add/remove (LP: #1563688)
    - hv_netvsc: Move subchannel waiting to rndis_filter_device_remove()

* /proc/$pid/maps performance regression (LP: #1547231)
    - proc: revert /proc/<pid>/maps [stack:TID] annotation

* TPM2.0 trusted keys fixes (LP: #1398274)
    - tpm: remove unneeded include of actbl2.h
    - tpm: fix checks for policy digest existence in tpm2_seal_trusted()
    - tpm_crb: Use the common ACPI definition of struct acpi_tpm2
    - tpm_tis: Disable interrupt auto probing on a per-device basis
    - tpm_tis: Do not fall back to a hardcoded address for TPM2
    - tpm_tis: Use devm_ioremap_resource
    - tpm_tis: Clean up the force=1 module parameter
    - tpm_crb: Drop le32_to_cpu(ioread32(..))
    - tpm_crb: Use devm_ioremap_resource
    - tpm: fix the rollback in tpm_chip_register()
    - tpm: fix the cleanup of struct tpm_chip
    - tpm: fix: set continueSession attribute for the unseal operation
    - tpm: fix: return rc when devm_add_action() fails
    - tpm_eventlog.c: fix binary_bios_measurements
    - tpm_crb/tis: fix: use dev_name() for /proc/iomem
    - tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()
    - tpm_tis: fix build warning with tpm_tis_resume

* [Feature]intel_idle driver support for Knights Landing (LP: #1461365)
    - intel_idle: Support for Intel Xeon Phi Processor x200 Product Family

* cxlflash: Backport upstream cxlflash commits and submitting a noup patch to
    Xenial (LP: #1563485)
    - cxlflash: Fix to avoid unnecessary scan with internal LUNs
    - cxlflash: Increase cmd_per_lun for better throughput
    - SAUCE: (noup) cxlflash: Move to exponential back-off when cmd_room is not available

* Miscellaneous Ubuntu changes
    - [Config] do_zfs_powerpc64-smp  = true
    - [Debian] fix linux_tools when cross-compiling
    - [Config] do_zfs_powerpc64-smp use default value
    - SAUCE: apparmor: Fix FTBFS due to bad include path
    - SAUCE: i915_bpo: Disable preliminary hw support

-- Tim Gardner <tim.gardner@canonical.com>  Tue, 29 Mar 2016 15:31:33 -0600

Changed in linux (Ubuntu Xenial):
status:	In Progress → Fix Released

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-04-12:

#2

CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y

Changed in linux (Ubuntu Xenial):
status:	Fix Released → In Progress

Revision history for this message

Harm van Bakel (hvbakel) wrote on 2016-04-19:

#3

I'm not sure if this is the right venue for discussion, but ever since this change was implemented in 4.4.0-18 I have been unable to load the VirtualBox vboxdrv kernel module built through dkms (fails with 'required key not available'). I understand this is probably the intended behavior but because of a glitch in the bios or ssd firmware of my laptop the secureboot mechanism is the only way I can start Ubuntu and this has left me without an option to load custom-built modules. Is there any mechanism to sign a kernel module through dkms? How is signing of e.g. the nvidia module handled?

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-04-19:

#4

linux 4.4.0-21.37 supports MOKSBState wherein you can disable secure boot in order to allow DKMS drivers. It should be released from -proposed within a day or so. If you aren't prompted to change your secure boot setting, then you can run 'sudo mokutil --disable-validation' before rebooting.

Revision history for this message

Harm van Bakel (hvbakel) wrote on 2016-04-19:

#5

Thanks, I just gave this a shot after installing 4.4.0-21-generic #37 from -proposed but after running 'sudo mokutil --disable-validation' and rebooting I still have the same 'Required key not available' error when I 'sudo modprobe vboxdrv'.

Revision history for this message

Harm van Bakel (hvbakel) wrote on 2016-04-19:

#6

Ok, scratch that. I had an external monitor connected and didn't realize a configure dialog appeared on reboot. After disabling validation the vboxdrv module now loads as expected.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-04-19:

#7

Download full text (3.5 KiB)

This bug was fixed in the package linux - 4.4.0-21.37

---------------
linux (4.4.0-21.37) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
- LP: #1571791

  * linux: MokSBState is ignored (LP: #1571691)
    - SAUCE: (noup) MODSIGN: Import certificates from UEFI Secure Boot
    - SAUCE: (noup) efi: Disable secure boot if shim is in insecure mode
    - SAUCE: (noup) Display MOKSBState when disabled

linux (4.4.0-20.36) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
- LP: #1571069

  * sysfs mount failure during stateful lxd snapshots (LP: #1570906)
    - SAUCE: kernfs: Do not match superblock in another user namespace when
      mounting

  * Kernel Panic in Ubuntu 16.04 netboot installer (LP: #1570441)
    - x86/topology: Fix logical package mapping
    - x86/topology: Fix Intel HT disable
    - x86/topology: Use total_cpus not nr_cpu_ids for logical packages
    - xen/apic: Provide Xen-specific version of cpu_present_to_apicid APIC op
    - x86/topology: Fix AMD core count

  * [regression]: Failed to call clock_adjtime(): Invalid argument
    (LP: #1566465)
    - ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO

linux (4.4.0-19.35) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
- LP: #1570348

* CVE-2016-2847 (LP: #1554260)
- pipe: limit the per-user amount of pages allocated in pipes

* xenial kernel crash on HP BL460c G7 (qla24xx problem?) (LP: #1554003)
- SAUCE: (noup) qla2xxx: Add irq affinity notification V2

* arm64: guest hangs when ntpd is running (LP: #1549494)
- SAUCE: (noup) KVM: arm/arm64: Handle forward time correction gracefully

* linux: Enforce signed module loading when UEFI secure boot (LP: #1566221)
- [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y

  * s390/cpumf: Fix lpp detection (LP: #1555344)
    - s390/facilities: use stfl mnemonic instead of insn magic
    - s390/facilities: always use lowcore's stfle field for storing facility bits
    - s390/cpumf: Fix lpp detection

* s390x kernel image needs weightwatchers (LP: #1536245)
- [Config] s390x: Use compressed kernel bzImage

  * Surelock GA2 SP1: surelock02p05: Not seeing sgX devices for LUNs after
    upgrading to Ubuntu 16.04 (LP: #1567581)
    - Revert "UBUNTU: SAUCE: (noup) powerpc/pci: Assign fixed PHB number based on
      device-tree properties"

  * Backport upstream bugfixes to ubuntu-16.04 (LP: #1555765)
    - cpufreq: powernv: Define per_cpu chip pointer to optimize hot-path
    - Revert "cpufreq: postfix policy directory with the first CPU in related_cpus"
    - cpufreq: powernv: Add sysfs attributes to show throttle stats

* systemd-modules-load.service: Failing due to missing module 'ib_iser' (LP: #1566468)
- [Config] Add ib_iser to generic inclusion list

  * thunderx nic performance improvements (LP: #1567093)
    - net: thunderx: Set recevie buffer page usage count in bulk
    - net: thunderx: Adjust nicvf structure to reduce cache misses

  * fixes for thunderx nic in multiqueue mode (LP: #1567091)
    - net: thunderx: Fix for multiqset not configured upon interface toggle
    - net: thunderx: Fix for HW TSO not enabled for secondary qsets
    - net: thund...

This bug was fixed in the package linux - 4.4.0-21.37

---------------
linux (4.4.0-21.37) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
    - LP: #1571791

* linux: MokSBState is ignored (LP: #1571691)
    - SAUCE: (noup) MODSIGN: Import certificates from UEFI Secure Boot
    - SAUCE: (noup) efi: Disable secure boot if shim is in insecure mode
    - SAUCE: (noup) Display MOKSBState when disabled

linux (4.4.0-20.36) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
    - LP: #1571069

* sysfs mount failure during stateful lxd snapshots (LP: #1570906)
    - SAUCE: kernfs: Do not match superblock in another user namespace when
      mounting

* Kernel Panic in Ubuntu 16.04 netboot installer (LP: #1570441)
    - x86/topology: Fix logical package mapping
    - x86/topology: Fix Intel HT disable
    - x86/topology: Use total_cpus not nr_cpu_ids for logical packages
    - xen/apic: Provide Xen-specific version of cpu_present_to_apicid APIC op
    - x86/topology: Fix AMD core count

* [regression]: Failed to call clock_adjtime(): Invalid argument
    (LP: #1566465)
    - ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO

linux (4.4.0-19.35) xenial; urgency=low

[ Tim Gardner ]

* Release Tracking Bug
    - LP: #1570348

* CVE-2016-2847 (LP: #1554260)
    - pipe: limit the per-user amount of pages allocated in pipes

* xenial kernel crash on HP BL460c G7 (qla24xx problem?) (LP: #1554003)
    - SAUCE: (noup) qla2xxx: Add irq affinity notification V2

* arm64: guest hangs when ntpd is running (LP: #1549494)
    - SAUCE: (noup) KVM: arm/arm64: Handle forward time correction gracefully

* linux: Enforce signed module loading when UEFI secure boot (LP: #1566221)
    - [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y

* s390/cpumf: Fix lpp detection (LP: #1555344)
    - s390/facilities: use stfl mnemonic instead of insn magic
    - s390/facilities: always use lowcore's stfle field for storing facility bits
    - s390/cpumf: Fix lpp detection

* s390x kernel image needs weightwatchers (LP: #1536245)
    - [Config] s390x: Use compressed kernel bzImage

* Surelock GA2 SP1: surelock02p05: Not seeing sgX devices for LUNs after
    upgrading to Ubuntu 16.04 (LP: #1567581)
    - Revert "UBUNTU: SAUCE: (noup) powerpc/pci: Assign fixed PHB number based on
      device-tree properties"

* Backport upstream bugfixes to ubuntu-16.04 (LP: #1555765)
    - cpufreq: powernv: Define per_cpu chip pointer to optimize hot-path
    - Revert "cpufreq: postfix policy directory with the first CPU in related_cpus"
    - cpufreq: powernv: Add sysfs attributes to show throttle stats

* systemd-modules-load.service: Failing due to missing module 'ib_iser' (LP: #1566468)
    - [Config] Add ib_iser to generic inclusion list

* thunderx nic performance improvements (LP: #1567093)
    - net: thunderx: Set recevie buffer page usage count in bulk
    - net: thunderx: Adjust nicvf structure to reduce cache misses

* fixes for thunderx nic in multiqueue mode (LP: #1567091)
    - net: thunderx: Fix for multiqset not configured upon interface toggle
    - net: thunderx: Fix for HW TSO not enabled for secondary qsets
    - net: thunderx: Fix receive packet stats

* Miscellaneous Ubuntu changes
    - [Config] updateconfigs after CONFIG_DRM_I915_BPO_PRELIMINARY_HW_SUPPORT=n

* Miscellaneous upstream changes (LP: #1564901)
    - Input: xpad - correctly handle concurrent LED and FF requests

-- Tim Gardner <tim.gardner@canonical.com>  Mon, 18 Apr 2016 07:00:22 -0600

Changed in linux (Ubuntu Xenial):
status:	In Progress → Fix Released

Tim Gardner (timg-tpi) on 2016-04-27

Changed in linux (Ubuntu Trusty):
assignee:	nobody → Tim Gardner (timg-tpi)
status:	New → In Progress
Changed in linux (Ubuntu Vivid):
assignee:	nobody → Tim Gardner (timg-tpi)
status:	New → In Progress
Changed in linux (Ubuntu Wily):
assignee:	nobody → Tim Gardner (timg-tpi)
status:	New → In Progress

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-04-28:

#8

Wily tested in QEMU/OVMF with signed kernel, with and without MokSBState enabled.

description:

updated

Tim Gardner (timg-tpi) on 2016-04-28

description:	updated
description:	updated
description:	updated

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-04-28:

#9

Vivid tested in QEMU/OVMF with signed kernel, with and without MokSBState enabled.

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-05-03:

#10

lts-utopic and trusty tested in QEMU/OVMF with signed kernel, with and without MokSBState enabled.

Revision history for this message

Andy Whitcroft (apw) wrote on 2016-05-25:

#11

For completeness the userspace changes needed for this are being tracked under Bug #1574727.

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-06-29:

#12

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-trusty
tags:	added: verification-needed-vivid

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-06-29:

#13

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-wily

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-06-29:

#14

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-wily' to 'verification-done-wily'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Tim Gardner (timg-tpi) on 2016-07-05

tags:

added: verification-done-trusty
removed: verification-needed-trusty

Tim Gardner (timg-tpi) on 2016-07-05

tags:

added: verification-done-vivid
removed: verification-needed-vivid

Tim Gardner (timg-tpi) on 2016-07-05

tags:

added: verification-done-wily
removed: verification-needed-wily

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-07-14:

#15

Download full text (17.2 KiB)

This bug was fixed in the package linux - 4.2.0-42.49

---------------
linux (4.2.0-42.49) wily; urgency=low

[ Ben Romer ]

* Release Tracking Bug
- LP: #1597053

[ Josh Boyer ]

  * SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1571691

[ Matthew Garrett ]

  * SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
- LP: #1595628

[ Tim Gardner ]

  * [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075

[ Upstream Kernel Changes ]

  * Revert "scsi: fix soft lockup in scsi_remove_target() on module
    removal"
    - LP: #1592552
  * ath10k: fix firmware assert in monitor mode
    - LP: #1592552
  * drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
    - LP: #1592552
  * ath10k: fix debugfs pktlog_filter write
    - LP: #1592552
  * drm/i915: Call intel_dp_mst_resume() before resuming displays
    - LP: #1592552
  * ARM: mvebu: fix GPIO config on the Linksys boards
    - LP: #1592552
  * ath5k: Change led pin configuration for compaq c700 laptop
    - LP: #1592552, #972604
  * xfs: disallow rw remount on fs with unknown ro-compat features
    - LP: #1592552
  * xfs: Don't wrap growfs AGFL indexes
    - LP: #1592552
  * rtlwifi: rtl8723be: Add antenna select module parameter
    - LP: #1592552
  * rtlwifi: btcoexist: Implement antenna selection
    - LP: #1592552
  * drm/gma500: Fix possible out of bounds read
    - LP: #1592552
  * Bluetooth: vhci: fix open_timeout vs. hdev race
    - LP: #1592552
  * Bluetooth: vhci: purge unhandled skbs
    - LP: #1592552
  * cpuidle: Indicate when a device has been unregistered
    - LP: #1592552
  * mfd: intel_quark_i2c_gpio: Use clkdev_create()
    - LP: #1592552
  * mfd: intel_quark_i2c_gpio: Remove clock tree on error path
    - LP: #1592552
  * [media] media: v4l2-compat-ioctl32: fix missing reserved field copy in
    put_v4l2_create32
    -...

This bug was fixed in the package linux - 4.2.0-42.49

---------------
linux (4.2.0-42.49) wily; urgency=low

[ Ben Romer ]

* Release Tracking Bug
    - LP: #1597053

[ Josh Boyer ]

* SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1571691

[ Matthew Garrett ]

* SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
    - LP: #1595628

[ Tim Gardner ]

* [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075

[ Upstream Kernel Changes ]

* Revert "scsi: fix soft lockup in scsi_remove_target() on module
    removal"
    - LP: #1592552
  * ath10k: fix firmware assert in monitor mode
    - LP: #1592552
  * drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
    - LP: #1592552
  * ath10k: fix debugfs pktlog_filter write
    - LP: #1592552
  * drm/i915: Call intel_dp_mst_resume() before resuming displays
    - LP: #1592552
  * ARM: mvebu: fix GPIO config on the Linksys boards
    - LP: #1592552
  * ath5k: Change led pin configuration for compaq c700 laptop
    - LP: #1592552, #972604
  * xfs: disallow rw remount on fs with unknown ro-compat features
    - LP: #1592552
  * xfs: Don't wrap growfs AGFL indexes
    - LP: #1592552
  * rtlwifi: rtl8723be: Add antenna select module parameter
    - LP: #1592552
  * rtlwifi: btcoexist: Implement antenna selection
    - LP: #1592552
  * drm/gma500: Fix possible out of bounds read
    - LP: #1592552
  * Bluetooth: vhci: fix open_timeout vs. hdev race
    - LP: #1592552
  * Bluetooth: vhci: purge unhandled skbs
    - LP: #1592552
  * cpuidle: Indicate when a device has been unregistered
    - LP: #1592552
  * mfd: intel_quark_i2c_gpio: Use clkdev_create()
    - LP: #1592552
  * mfd: intel_quark_i2c_gpio: Remove clock tree on error path
    - LP: #1592552
  * [media] media: v4l2-compat-ioctl32: fix missing reserved field copy in
    put_v4l2_create32
    - LP: #1592552
  * scsi: Add intermediate STARGET_REMOVE state to scsi_target_state
    - LP: #1592552
  * drm/i915/dsi: fix CHV dsi encoder hardware state readout on port C
    - LP: #1592552
  * usb: f_mass_storage: test whether thread is running before starting
    another
    - LP: #1592552
  * hwmon: (ads7828) Enable internal reference
    - LP: #1592552
  * ath10k: fix rx_channel during hw reconfigure
    - LP: #1592552
  * Bluetooth: vhci: Fix race at creating hci device
    - LP: #1592552
  * powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel
    - LP: #1592552
  * PM / Runtime: Fix error path in pm_runtime_force_resume()
    - LP: #1592552
  * crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks
    - LP: #1592552
  * ath9k: Add a module parameter to invert LED polarity.
    - LP: #1592552
  * ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.
    - LP: #1592552
  * pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range
    - LP: #1592552
  * btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in
    btrfs_ioctl
    - LP: #1592552
  * serial: 8250_pci: fix divide error bug if baud rate is 0
    - LP: #1592552
  * TTY: n_gsm, fix false positive WARN_ON
    - LP: #1592552
  * staging: comedi: das1800: fix possible NULL dereference
    - LP: #1592552
  * arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables
    - LP: #1592552
  * KVM: x86: fix ordering of cr0 initialization code in vmx_cpu_reset
    - LP: #1592552
  * aacraid: Relinquish CPU during timeout wait
    - LP: #1592552
  * aacraid: Fix for aac_command_thread hang
    - LP: #1592552
  * aacraid: Fix for KDUMP driver hang
    - LP: #1592552
  * ext4: fix hang when processing corrupted orphaned inode list
    - LP: #1592552
  * MIPS: ath79: make bootconsole wait for both THRE and TEMT
    - LP: #1592552
  * Drivers: hv: ring_buffer.c: fix comment style
    - LP: #1592552
  * mei: fix NULL dereferencing during FW initiated disconnection
    - LP: #1592552
  * mei: amthif: discard not read messages
    - LP: #1592552
  * tty: Abstract tty buffer work
    - LP: #1592552
  * Fix OpenSSH pty regression on close
    - LP: #1592552
  * QE-UART: add "fsl,t1040-ucc-uart" to of_device_id
    - LP: #1592552
  * thunderbolt: Fix double free of drom buffer
    - LP: #1592552
  * USB: serial: option: add support for Cinterion PH8 and AHxx
    - LP: #1592552
  * usb: misc: usbtest: format the data pattern according to max packet
    size
    - LP: #1592552
  * usb: misc: usbtest: fix pattern tests for scatterlists.
    - LP: #1592552
  * mcb: Fixed bar number assignment for the gdd
    - LP: #1592552
  * USB: serial: option: add more ZTE device ids
    - LP: #1592552
  * USB: serial: option: add even more ZTE device ids
    - LP: #1592552
  * ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA
    internal strings
    - LP: #1592552
  * drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh
    - LP: #1592552
  * USB: serial: cp210x: fix hardware flow-control disable
    - LP: #1592552
  * ext4: fix oops on corrupted filesystem
    - LP: #1592552
  * ext4: address UBSAN warning in mb_find_order_for_block()
    - LP: #1592552
  * ext4: silence UBSAN in ext4_mb_init()
    - LP: #1592552
  * arm64: Ensure pmd_present() returns false after pmd_mknotpresent()
    - LP: #1592552
  * ARM: dts: exynos: Add interrupt line to MAX8997 PMIC on
    exynos4210-trats
    - LP: #1592552
  * ath10k: fix kernel panic, move arvifs list head init before htt init
    - LP: #1592552
  * can: fix handling of unmodifiable configuration options
    - LP: #1592552
  * MIPS: Fix siginfo.h to use strict posix types
    - LP: #1592552
  * MIPS: Don't unwind to user mode with EVA
    - LP: #1592552
  * MIPS: Avoid using unwind_stack() with usermode
    - LP: #1592552
  * MIPS: Reserve nosave data for hibernation
    - LP: #1592552
  * MIPS: Loongson-3: Reserve 32MB for RS780E integrated GPU
    - LP: #1592552
  * MIPS64: R6: R2 emulation bugfix
    - LP: #1592552
  * usb: host: xhci-rcar: Avoid long wait in xhci_reset()
    - LP: #1592552
  * mfd: omap-usb-tll: Fix scheduling while atomic BUG
    - LP: #1592552
  * USB: serial: io_edgeport: fix memory leaks in attach error path
    - LP: #1592552
  * USB: serial: io_edgeport: fix memory leaks in probe error path
    - LP: #1592552
  * USB: serial: keyspan: fix use-after-free in probe error path
    - LP: #1592552
  * USB: serial: mxuport: fix use-after-free in probe error path
    - LP: #1592552
  * USB: serial: quatech2: fix use-after-free in probe error path
    - LP: #1592552
  * crypto: caam - fix caam_jr_alloc() ret code
    - LP: #1592552
  * MIPS: KVM: Fix timer IRQ race when freezing timer
    - LP: #1592552
  * MIPS: KVM: Fix timer IRQ race when writing CP0_Compare
    - LP: #1592552
  * gcov: disable tree-loop-im to reduce stack usage
    - LP: #1592552
  * irqchip/gic: Ensure ordering between read of INTACK and shared data
    - LP: #1592552
  * irqchip/gic-v3: Configure all interrupts as non-secure Group-1
    - LP: #1592552
  * arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str
    - LP: #1592552
  * kbuild: move -Wunused-const-variable to W=1 warning level
    - LP: #1592552
  * rtlwifi: Fix logic error in enter/exit power-save mode
    - LP: #1592552
  * rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in
    rtl_pci_reset_trx_ring
    - LP: #1592552
  * sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded
    systems
    - LP: #1592552
  * powerpc/eeh: Don't report error in eeh_pe_reset_and_recover()
    - LP: #1592552
  * powerpc/eeh: Restore initial state in eeh_pe_reset_and_recover()
    - LP: #1592552
  * MIPS: Handle highmem pages in __update_cache
    - LP: #1592552
  * MIPS: Sync icache & dcache in set_pte_at
    - LP: #1592552
  * SIGNAL: Move generic copy_siginfo() to signal.h
    - LP: #1592552
  * MIPS: Fix uapi include in exported asm/siginfo.h
    - LP: #1592552
  * MIPS: math-emu: Fix jalr emulation when rd == $0
    - LP: #1592552
  * MIPS: ptrace: Fix FP context restoration FCSR regression
    - LP: #1592552
  * MIPS: ptrace: Prevent writes to read-only FCSR bits
    - LP: #1592552
  * MIPS: Disable preemption during prctl(PR_SET_FP_MODE, ...)
    - LP: #1592552
  * MIPS: Force CPUs to lose FP context during mode switches
    - LP: #1592552
  * ring-buffer: Use long for nr_pages to avoid overflow failures
    - LP: #1592552
  * ring-buffer: Prevent overflow of size in ring_buffer_resize()
    - LP: #1592552
  * mmc: mmc: Fix partition switch timeout for some eMMCs
    - LP: #1592552
  * PCI: Disable all BAR sizing for devices with non-compliant BARs
    - LP: #1592552
  * MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC
    - LP: #1592552
  * drm/i915/fbdev: Fix num_connector references in
    intel_fb_initial_config()
    - LP: #1592552
  * drm/fb_helper: Fix references to dev->mode_config.num_connector
    - LP: #1592552
  * fs/cifs: correctly to anonymous authentication via NTLMSSP
    - LP: #1592552
  * fs/cifs: correctly to anonymous authentication for the LANMAN
    authentication
    - LP: #1592552
  * fs/cifs: correctly to anonymous authentication for the NTLM(v1)
    authentication
    - LP: #1592552
  * fs/cifs: correctly to anonymous authentication for the NTLM(v2)
    authentication
    - LP: #1592552
  * remove directory incorrectly tries to set delete on close on non-empty
    directories
    - LP: #1592552
  * cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter()
    - LP: #1592552
  * xfs: xfs_iflush_cluster fails to abort on error
    - LP: #1592552
  * xfs: fix inode validity check in xfs_iflush_cluster
    - LP: #1592552
  * xfs: skip stale inodes in xfs_iflush_cluster
    - LP: #1592552
  * ASoC: ak4642: Enable cache usage to fix crashes on resume
    - LP: #1592552
  * cifs: Create dedicated keyring for spnego operations
    - LP: #1592552
  * ALSA: hda - Fix headphone noise on Dell XPS 13 9360
    - LP: #1592552
  * kvm: arm64: Fix EC field in inject_abt64
    - LP: #1592552
  * Input: uinput - handle compat ioctl for UI_SET_PHYS
    - LP: #1592552
  * PM / sleep: Handle failures in device_suspend_late() consistently
    - LP: #1592552
  * mm: use phys_addr_t for reserve_bootmem_region() arguments
    - LP: #1592552
  * locking,qspinlock: Fix spin_is_locked() and spin_unlock_wait()
    - LP: #1592552
  * drm/i915: Don't leave old junk in ilk active watermarks on readout
    - LP: #1592552
  * mmc: longer timeout for long read time quirk
    - LP: #1592552
  * mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers
    - LP: #1592552
  * mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers
    - LP: #1592552
  * sunrpc: fix stripping of padded MIC tokens
    - LP: #1592552
  * wait/ptrace: assume __WALL if the child is traced
    - LP: #1592552
  * xen/x86: actually allocate legacy interrupts on PV guests
    - LP: #1592552
  * xen/events: Don't move disabled irqs
    - LP: #1592552
  * UBI: Fix static volume checks when Fastmap is used
    - LP: #1592552
  * drm/amdgpu: Fix hdmi deep color support.
    - LP: #1592552
  * dma-debug: avoid spinlock recursion when disabling dma-debug
    - LP: #1592552
  * dell-rbtn: Ignore ACPI notifications if device is suspended
    - LP: #1592552
  * Input: xpad - prevent spurious input from wired Xbox 360 controllers
    - LP: #1592552
  * Input: pwm-beeper - fix - scheduling while atomic
    - LP: #1592552
  * MIPS: lib: Mark intrinsics notrace
    - LP: #1592552
  * hpfs: fix remount failure when there are no options changed
    - LP: #1592552
  * affs: fix remount failure when there are no options changed
    - LP: #1592552
  * hpfs: implement the show_options method
    - LP: #1592552
  * regmap: cache: Fix typo in cache_bypass parameter description
    - LP: #1592552
  * ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
    - LP: #1592552
  * serial: doc: Un-document non-existing uart_write_console()
    - LP: #1592552
  * iio: buffer: add missing descriptions in iio_buffer_access_funcs
    - LP: #1592552
  * iommu/vt-d: Ratelimit fault handler
    - LP: #1592552
  * iommu/vt-d: Improve fault handler error messages
    - LP: #1592552
  * power: ipaq-micro-battery: freeing the wrong variable
    - LP: #1592552
  * ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
    - LP: #1592552
  * security: drop the unused hook skb_owned_by
    - LP: #1592552
  * mfd: lp8788-irq: Uninitialized variable in irq handler
    - LP: #1592552
  * am437x-vfpe: fix typo in vpfe_get_app_input_index
    - LP: #1592552
  * am437x-vpfe: fix an uninitialized variable bug
    - LP: #1592552
  * cx23885: uninitialized variable in cx23885_av_work_handler()
    - LP: #1592552
  * ipv6, token: allow for clearing the current device token
    - LP: #1592552
  * usb: gadget: f_fs: Fix EFAULT generation for async read operations
    - LP: #1592552
  * EDAC: Increment correct counter in edac_inc_ue_error()
    - LP: #1592552
  * PCI: Supply CPU physical address (not bus address) to
    iomem_is_exclusive()
    - LP: #1592552
  * alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not
    IORESOURCE_IO
    - LP: #1592552
  * ARM: debug: remove extraneous DEBUG_HI3716_UART option
    - LP: #1592552
  * cxl: Fix DAR check & use REGION_ID instead of opencoding
    - LP: #1592552
  * taskstats: fix nl parsing in accounting/getdelays.c
    - LP: #1592552
  * char: Drop bogus dependency of DEVPORT on !M68K
    - LP: #1592552
  * driver-core: use 'dev' argument in dev_dbg_ratelimited stub
    - LP: #1592552
  * metag: Fix atomic_*_return inline asm constraints
    - LP: #1592552
  * tty: vt, return error when con_startup fails
    - LP: #1592552
  * cpufreq: Fix GOV_LIMITS handling for the userspace governor
    - LP: #1592552
  * ACPI / sysfs: fix error code in get_status()
    - LP: #1592552
  * clk: qcom: msm8916: Fix crypto clock flags
    - LP: #1592552
  * MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
    - LP: #1592552
  * NFS: Fix an LOCK/OPEN race when unlinking an open file
    - LP: #1592552
  * ata: sata_dwc_460ex: remove incorrect locking
    - LP: #1592552
  * s390/vmem: fix identity mapping
    - LP: #1592552
  * perf tools: Fix perf regs mask generation
    - LP: #1592552
  * powerpc/sstep: Fix sstep.c compile on powerpcspe
    - LP: #1592552
  * MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
    - LP: #1592552
  * MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
    - LP: #1592552
  * MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
    - LP: #1592552
  * MIPS: BMIPS: Pretty print BMIPS5200 processor name
    - LP: #1592552
  * MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
    - LP: #1592552
  * MIPS: Fix BC1{EQ,NE}Z return offset calculation
    - LP: #1592552
  * MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
    - LP: #1592552
  * IB/srp: Print "ib_srp: " prefix once
    - LP: #1592552
  * IB/IWPM: Fix a potential skb leak
    - LP: #1592552
  * i40e: fix an uninitialized variable bug
    - LP: #1592552
  * blk-mq: fix undefined behaviour in order_to_size()
    - LP: #1592552
  * x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
    - LP: #1592552
  * netlink: Fix dump skb leak/double free
    - LP: #1592552
  * MIPS: ath79: fix regression in PCI window initialization
    - LP: #1592552
  * sched/preempt: Fix preempt_count manipulations
    - LP: #1592552
  * tipc: fix nametable publication field in nl compat
    - LP: #1592552
  * sunrpc: Update RPCBIND_MAXNETIDLEN
    - LP: #1592552
  * batman-adv: fix skb deref after free
    - LP: #1592552
  * net: ehea: avoid null pointer dereference
    - LP: #1592552
  * tuntap: correctly wake up process during uninit
    - LP: #1592552
  * uapi glibc compat: fix compilation when !__USE_MISC in glibc
    - LP: #1592552
  * drivers/hwspinlock: use correct radix tree API
    - LP: #1592552
  * RDMA/cxgb3: device driver frees DMA memory with different size
    - LP: #1592552
  * Linux 4.2.8-ckt12
    - LP: #1592552
  * HID: core: prevent out-of-bound readings
    - LP: #1579190
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070

-- Benjamin M Romer <benjamin.romer@canonical.com>  Tue, 28 Jun 2016 14:57:26 -0400

Changed in linux (Ubuntu Wily):
status:	In Progress → Fix Released
status:	In Progress → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-07-14:

#17

This bug was fixed in the package linux - 3.19.0-65.73

---------------
linux (3.19.0-65.73) vivid; urgency=low

[ Ben Romer ]

* Release Tracking Bug
- LP: #1596631

[ Josh Boyer ]

  * SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1571691

[ Matthew Garrett ]

  * SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
- LP: #1595628

[ Tim Gardner ]

  * [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075

[ Upstream Kernel Changes ]

  * HID: core: prevent out-of-bound readings
    - LP: #1579190
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070

-- Benjamin M Romer <email address hidden> Mon, 27 Jun 2016 12:37:48 -0400

This bug was fixed in the package linux - 3.19.0-65.73

---------------
linux (3.19.0-65.73) vivid; urgency=low

[ Ben Romer ]

* Release Tracking Bug
    - LP: #1596631

[ Josh Boyer ]

* SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1571691

[ Matthew Garrett ]

* SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
    - LP: #1595628

[ Tim Gardner ]

* [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075

[ Upstream Kernel Changes ]

* HID: core: prevent out-of-bound readings
    - LP: #1579190
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070

-- Benjamin M Romer <benjamin.romer@canonical.com>  Mon, 27 Jun 2016 12:37:48 -0400

Changed in linux (Ubuntu Vivid):
status:	In Progress → Fix Released
status:	In Progress → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-07-14:

#19

This bug was fixed in the package linux - 3.13.0-92.139

---------------
linux (3.13.0-92.139) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1597060

[ Josh Boyer ]

  * SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1566221, #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1566221, #1571691

[ Matthew Garrett ]

  * SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
- LP: #1595628

[ Tim Gardner ]

  * [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1566221, #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075
  * SAUCE: UEFI: Set EFI_SECURE_BOOT bit in x86_efi_facility
    - LP: #1593075
  * [Config] CONFIG_EFI=n for arm64
    - LP: #1566221

[ Upstream Kernel Changes ]

  * powerpc/tm: Abort syscalls in active transactions
    - LP: #1572624
  * HID: core: prevent out-of-bound readings
    - LP: #1579190
  * efi: Add separate 32-bit/64-bit definitions
    - LP: #1566221
  * x86/efi: Build our own EFI services pointer table
    - LP: #1566221
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070
  * oom_kill: change oom_kill.c to use for_each_thread()
    - LP: #1592429
  * oom_kill: has_intersects_mems_allowed() needs rcu_read_lock()
    - LP: #1592429
  * oom_kill: add rcu_read_lock() into find_lock_task_mm()
    - LP: #1592429
  * virtio_balloon: return the amount of freed memory from leak_balloon()
    - LP: #1587089
  * virtio_balloon: free some memory from balloon on OOM
    - LP: #1587089
  * virtio_ballon: change stub of release_pages_by_pfn
    - LP: #1587089
  * virtio_balloon: do not change memory amount visible via /proc/meminfo
    - LP: #1587089

-- Kamal Mostafa <email address hidden> Tue, 28 Jun 2016 12:40:49 -0700

This bug was fixed in the package linux - 3.13.0-92.139

---------------
linux (3.13.0-92.139) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1597060

[ Josh Boyer ]

* SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1566221, #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1566221, #1571691

[ Matthew Garrett ]

* SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

[ Stefan Bader ]

* [Config] Add pm80xx scsi driver to d-i
    - LP: #1595628

[ Tim Gardner ]

* [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1566221, #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075
  * SAUCE: UEFI: Set EFI_SECURE_BOOT bit in x86_efi_facility
    - LP: #1593075
  * [Config] CONFIG_EFI=n for arm64
    - LP: #1566221

[ Upstream Kernel Changes ]

* powerpc/tm: Abort syscalls in active transactions
    - LP: #1572624
  * HID: core: prevent out-of-bound readings
    - LP: #1579190
  * efi: Add separate 32-bit/64-bit definitions
    - LP: #1566221
  * x86/efi: Build our own EFI services pointer table
    - LP: #1566221
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070
  * oom_kill: change oom_kill.c to use for_each_thread()
    - LP: #1592429
  * oom_kill: has_intersects_mems_allowed() needs rcu_read_lock()
    - LP: #1592429
  * oom_kill: add rcu_read_lock() into find_lock_task_mm()
    - LP: #1592429
  * virtio_balloon: return the amount of freed memory from leak_balloon()
    - LP: #1587089
  * virtio_balloon: free some memory from balloon on OOM
    - LP: #1587089
  * virtio_ballon: change stub of release_pages_by_pfn
    - LP: #1587089
  * virtio_balloon: do not change memory amount visible via /proc/meminfo
    - LP: #1587089

-- Kamal Mostafa <kamal@canonical.com>  Tue, 28 Jun 2016 12:40:49 -0700

Changed in linux (Ubuntu Trusty):
status:	In Progress → Fix Released
status:	In Progress → Fix Released

Tim Gardner (timg-tpi) on 2016-08-02

Changed in linux (Ubuntu Trusty):
status:	Fix Released → In Progress

Tim Gardner (timg-tpi) on 2016-08-02

Changed in linux (Ubuntu Trusty):
status:	In Progress → Fix Released

Seth Forshee (sforshee) on 2016-10-18

tags:

removed: verification-done-trusty

Revision history for this message

Seth Forshee (sforshee) wrote on 2016-10-18:

#21

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-trusty

Gianfranco Costamagna (costamagnagianfranco) on 2016-10-18

tags:	added: verification-done-xenial removed: verification-needed-trusty
tags:	added: verification-done-trusty

Gianfranco Costamagna (costamagnagianfranco) on 2016-10-18

tags:

added: bot-stop-nagging

Petro (petrolerouxubuntu) on 2020-01-27

Changed in linux (Ubuntu):
assignee:	Tim Gardner (timg-tpi) → Petro (petrolerouxubuntu)

Ubuntu
linux package

linux: Enforce signed module loading when UEFI secure boot

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Undecided	Petro
Trusty	Fix Released	Undecided	Tim Gardner
Vivid	Fix Released	Undecided	Tim Gardner
Wily	Fix Released	Undecided	Tim Gardner
Xenial	Fix Released	Undecided	Tim Gardner
Yakkety	Fix Released	Undecided	Tim Gardner

Ubuntulinux package

linux: Enforce signed module loading when UEFI secure boot

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package