Bug #1812875 “ip6_gre: fix tunnel list corruption for x-netns” : Bugs : linux package : Ubuntu

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2019-01-22: Missing required logs.

#1

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1812875

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Revision history for this message

Seth Forshee (sforshee) wrote on 2019-01-23:

#2

Thanks for the report. To consider the commit for SRU we require that it fixes a specific bug seen by users. Can you please describe the issue you are seeing which is fixed by that commit? If you can provide instructions to help us reproduce the issue, that would be especially helpful. Thanks!

Revision history for this message

Nicolas Dichtel (nicolas-dichtel) wrote on 2019-01-30:

#3

This issue is a kernel panic ...
We reproduce it on ubuntu-18.04 with a third party software

Seth Forshee (sforshee) on 2019-01-30

Changed in linux (Ubuntu):
status:	Incomplete → Fix Committed

Seth Forshee (sforshee) on 2019-01-30

description:

updated

Revision history for this message

Seth Forshee (sforshee) wrote on 2019-01-30:

#4

https://lists.ubuntu.com/archives/kernel-team/2019-January/098175.html

Changed in linux (Ubuntu):
assignee:	nobody → Seth Forshee (sforshee)
importance:	Undecided → Medium
Changed in linux (Ubuntu Bionic):
assignee:	nobody → Seth Forshee (sforshee)
importance:	Undecided → Medium
status:	New → In Progress
Changed in linux (Ubuntu Cosmic):
assignee:	nobody → Seth Forshee (sforshee)
importance:	Undecided → Medium
status:	New → In Progress

Khaled El Mously (kmously) on 2019-02-01

Changed in linux (Ubuntu Bionic):
status:	In Progress → Fix Committed
Changed in linux (Ubuntu Cosmic):
status:	In Progress → Fix Committed

Revision history for this message

Brad Figg (brad-figg) wrote on 2019-02-11:

#5

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-cosmic' to 'verification-done-cosmic'. If the problem still exists, change the tag 'verification-needed-cosmic' to 'verification-failed-cosmic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-cosmic

Revision history for this message

Nicolas Dichtel (nicolas-dichtel) wrote on 2019-02-11:

#6

I reported this bug on behalf of a colleague. He is off this week and will not be able to test this patch before next week.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2019-02-15:

#7

Download full text (12.4 KiB)

This bug was fixed in the package linux - 4.19.0-13.14

---------------
linux (4.19.0-13.14) disco; urgency=medium

* linux: 4.19.0-13.14 -proposed tracker (LP: #1815103)

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] autoreconstruct -- base tag is always primary mainline version

* [Packaging] Allow overlay of config annotations (LP: #1752072)
- [Packaging] config-check: Add an include directive

  * Disco update: 4.19.20 upstream stable release (LP: #1815090)
    - Fix "net: ipv4: do not handle duplicate fragments as overlapping"
    - drm/msm/gpu: fix building without debugfs
    - ipv6: Consider sk_bound_dev_if when binding a socket to an address
    - ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation
    - ipvlan, l3mdev: fix broken l3s mode wrt local routes
    - l2tp: copy 4 more bytes to linear part if necessary
    - l2tp: fix reading optional fields of L2TPv3
    - net: ip_gre: always reports o_key to userspace
    - net: ip_gre: use erspan key field for tunnel lookup
    - net/mlx4_core: Add masking for a few queries on HCA caps
    - netrom: switch to sock timer API
    - net/rose: fix NULL ax25_cb kernel panic
    - net: set default network namespace in init_dummy_netdev()
    - ravb: expand rx descriptor data to accommodate hw checksum
    - sctp: improve the events for sctp stream reset
    - tun: move the call to tun_set_real_num_queues
    - ucc_geth: Reset BQL queue when stopping device
    - net: ip6_gre: always reports o_key to userspace
    - sctp: improve the events for sctp stream adding
    - net/mlx5e: Allow MAC invalidation while spoofchk is ON
    - ip6mr: Fix notifiers call on mroute_clean_tables()
    - Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"
    - sctp: set chunk transport correctly when it's a new asoc
    - sctp: set flow sport from saddr only when it's 0
    - virtio_net: Don't enable NAPI when interface is down
    - virtio_net: Don't call free_old_xmit_skbs for xdp_frames
    - virtio_net: Fix not restoring real_num_rx_queues
    - virtio_net: Fix out of bounds access of sq
    - virtio_net: Don't process redirected XDP frames when XDP is disabled
    - virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs
    - virtio_net: Differentiate sk_buff and xdp_frame on freeing
    - CIFS: Do not count -ENODATA as failure for query directory
    - CIFS: Fix trace command logging for SMB2 reads and writes
    - CIFS: Do not consider -ENODATA as stat failure for reads
    - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
    - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions()
    - selftests/seccomp: Enhance per-arch ptrace syscall skip tests
    - NFS: Fix up return value on fatal errors in nfs_page_async_flush()
    - ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
    - arm64: kaslr: ensure randomized quantities are clean also when kaslr is off
    - arm64: Do not issue IPIs for user executable ptes
    - arm64: hyp-stub: Forbid kprobing of the hyp-stub
    - arm64: hibernate: Clean the __hyp_text to PoC after resume
    - gpio: altera...

This bug was fixed in the package linux - 4.19.0-13.14

---------------
linux (4.19.0-13.14) disco; urgency=medium

* linux: 4.19.0-13.14 -proposed tracker (LP: #1815103)

* linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] autoreconstruct -- base tag is always primary mainline version

* [Packaging] Allow overlay of config annotations (LP: #1752072)
    - [Packaging] config-check: Add an include directive

* Disco update: 4.19.20 upstream stable release (LP: #1815090)
    - Fix "net: ipv4: do not handle duplicate fragments as overlapping"
    - drm/msm/gpu: fix building without debugfs
    - ipv6: Consider sk_bound_dev_if when binding a socket to an address
    - ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation
    - ipvlan, l3mdev: fix broken l3s mode wrt local routes
    - l2tp: copy 4 more bytes to linear part if necessary
    - l2tp: fix reading optional fields of L2TPv3
    - net: ip_gre: always reports o_key to userspace
    - net: ip_gre: use erspan key field for tunnel lookup
    - net/mlx4_core: Add masking for a few queries on HCA caps
    - netrom: switch to sock timer API
    - net/rose: fix NULL ax25_cb kernel panic
    - net: set default network namespace in init_dummy_netdev()
    - ravb: expand rx descriptor data to accommodate hw checksum
    - sctp: improve the events for sctp stream reset
    - tun: move the call to tun_set_real_num_queues
    - ucc_geth: Reset BQL queue when stopping device
    - net: ip6_gre: always reports o_key to userspace
    - sctp: improve the events for sctp stream adding
    - net/mlx5e: Allow MAC invalidation while spoofchk is ON
    - ip6mr: Fix notifiers call on mroute_clean_tables()
    - Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"
    - sctp: set chunk transport correctly when it's a new asoc
    - sctp: set flow sport from saddr only when it's 0
    - virtio_net: Don't enable NAPI when interface is down
    - virtio_net: Don't call free_old_xmit_skbs for xdp_frames
    - virtio_net: Fix not restoring real_num_rx_queues
    - virtio_net: Fix out of bounds access of sq
    - virtio_net: Don't process redirected XDP frames when XDP is disabled
    - virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs
    - virtio_net: Differentiate sk_buff and xdp_frame on freeing
    - CIFS: Do not count -ENODATA as failure for query directory
    - CIFS: Fix trace command logging for SMB2 reads and writes
    - CIFS: Do not consider -ENODATA as stat failure for reads
    - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
    - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions()
    - selftests/seccomp: Enhance per-arch ptrace syscall skip tests
    - NFS: Fix up return value on fatal errors in nfs_page_async_flush()
    - ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
    - arm64: kaslr: ensure randomized quantities are clean also when kaslr is off
    - arm64: Do not issue IPIs for user executable ptes
    - arm64: hyp-stub: Forbid kprobing of the hyp-stub
    - arm64: hibernate: Clean the __hyp_text to PoC after resume
    - gpio: altera-a10sr: Set proper output level for direction_output
    - gpiolib: fix line event timestamps for nested irqs
    - gpio: pcf857x: Fix interrupts on multiple instances
    - gpio: sprd: Fix the incorrect data register
    - gpio: sprd: Fix incorrect irq type setting for the async EIC
    - gfs2: Revert "Fix loop in gfs2_rbm_find"
    - mmc: bcm2835: Fix DMA channel leak on probe error
    - mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay
    - ALSA: usb-audio: Add Opus #3 to quirks for native DSD support
    - ALSA: hda/realtek - Fixed hp_pin no value
    - IB/hfi1: Remove overly conservative VM_EXEC flag check
    - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
    - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
    - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
    - Btrfs: fix deadlock when allocating tree block during leaf/node split
    - btrfs: On error always free subvol_name in btrfs_mount
    - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
    - mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
    - oom, oom_reaper: do not enqueue same task twice
    - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages
    - mm, oom: fix use-after-free in oom_kill_process
    - mm: hwpoison: use do_send_sig_info() instead of force_sig()
    - mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
    - of: Convert to using %pOFn instead of device_node.name
    - of: overlay: add tests to validate kfrees from overlay removal
    - of: overlay: add missing of_node_get() in __of_attach_node_sysfs
    - of: overlay: use prop add changeset entry for property in new nodes
    - of: overlay: do not duplicate properties from overlay for new nodes
    - md/raid5: fix 'out of memory' during raid cache recovery
    - cifs: Always resolve hostname before reconnecting
    - Linux 4.19.20

* CONFIG_TEST_BPF is disabled (LP: #1813955)
    - [Config]: Reenable TEST_BPF

* CVE-2018-16880
    - vhost: fix OOB in get_rx_bufs()

* Disco update: v4.19.19 upstream stable release (LP: #1814170)
    - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs
    - net: bridge: Fix ethernet header pointer before check skb forwardable
    - net: Fix usage of pskb_trim_rcsum
    - net: phy: marvell: Errata for mv88e6390 internal PHYs
    - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error
      handling
    - net/sched: act_tunnel_key: fix memory leak in case of action replace
    - net_sched: refetch skb protocol for each filter
    - openvswitch: Avoid OOB read when parsing flow nlattrs
    - vhost: log dirty page correctly
    - mlxsw: pci: Increase PCI SW reset timeout
    - net: ipv4: Fix memory leak in network namespace dismantle
    - mlxsw: spectrum_fid: Update dummy FID index
    - mlxsw: pci: Ring CQ's doorbell before RDQ's
    - net/sched: cls_flower: allocate mask dynamically in fl_change()
    - udp: with udp_segment release on error path
    - erspan: build the header with the right proto according to erspan_ver
    - net: phy: marvell: Fix deadlock from wrong locking
    - ip6_gre: update version related info when changing link
    - tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state
    - mei: me: mark LBG devices as having dma support
    - mei: me: add denverton innovation engine device IDs
    - USB: leds: fix regression in usbport led trigger
    - USB: serial: simple: add Motorola Tetra TPG2200 device id
    - USB: serial: pl2303: add new PID to support PL2303TB
    - ceph: clear inode pointer when snap realm gets dropped by its inode
    - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
    - ASoC: rt5514-spi: Fix potential NULL pointer dereference
    - ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode
    - clk: socfpga: stratix10: fix rate calculation for pll clocks
    - clk: socfpga: stratix10: fix naming convention for the fixed-clocks
    - inotify: Fix fd refcount leak in inotify_add_watch().
    - ALSA: hda/realtek - Fix typo for ALC225 model
    - ARCv2: lib: memeset: fix doing prefetchw outside of buffer
    - ARC: adjust memblock_reserve of kernel memory
    - ARC: perf: map generic branches to correct hardware condition
    - s390/mm: always force a load of the primary ASCE on context switch
    - s390/early: improve machine detection
    - s390/smp: fix CPU hotplug deadlock with CPU rescan
    - misc: ibmvsm: Fix potential NULL pointer dereference
    - char/mwave: fix potential Spectre v1 vulnerability
    - mmc: dw_mmc-bluefield: : Fix the license information
    - mmc: meson-gx: Free irq in release() callback
    - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
    - tty: Handle problem if line discipline does not have receive_buf
    - uart: Fix crash in uart_write and uart_put_char
    - tty/n_hdlc: fix __might_sleep warning
    - hv_balloon: avoid touching uninitialized struct page during tail onlining
    - Drivers: hv: vmbus: Check for ring when getting debug info
    - vgacon: unconfuse vc_origin when using soft scrollback
    - CIFS: Fix possible hang during async MTU reads and writes
    - CIFS: Fix credits calculations for reads with errors
    - CIFS: Fix credit calculation for encrypted reads with errors
    - CIFS: Do not reconnect TCP session in add_credits()
    - smb3: add credits we receive from oplock/break PDUs
    - Input: xpad - add support for SteelSeries Stratus Duo
    - Input: input_event - provide override for sparc64
    - Input: uinput - fix undefined behavior in uinput_validate_absinfo()
    - acpi/nfit: Block function zero DSMs
    - acpi/nfit: Fix command-supported detection
    - scsi: ufs: Use explicit access size in ufshcd_dump_regs
    - dm thin: fix passdown_double_checking_shared_status()
    - dm crypt: fix parsing of extended IV arguments
    - drm/amdgpu: Add APTX quirk for Lenovo laptop
    - KVM: x86: Fix single-step debugging
    - KVM: x86: Fix PV IPIs for 32-bit KVM host
    - KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error
    - kvm: x86/vmx: Use kzalloc for cached_vmcs12
    - KVM/nVMX: Do not validate that posted_intr_desc_addr is page aligned
    - x86/pkeys: Properly copy pkey state at fork()
    - x86/selftests/pkeys: Fork() to check for state being preserved
    - x86/kaslr: Fix incorrect i8254 outb() parameters
    - x86/entry/64/compat: Fix stack switching for XEN PV
    - net: sun: cassini: Cleanup license conflict
    - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
    - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by
      removing it
    - can: bcm: check timer values before ktime conversion
    - can: flexcan: fix NULL pointer exception during bringup
    - vt: make vt_console_print() compatible with the unicode screen buffer
    - vt: always call notifier with the console lock held
    - vt: invoke notifier on screen size change
    - drm/meson: Fix atomic mode switching regression
    - bpf: improve verifier branch analysis
    - bpf: add per-insn complexity limit
    - bpf: move {prev_,}insn_idx into verifier env
    - bpf: move tmp variable into ax register in interpreter
    - bpf: enable access to ax register also from verifier rewrite
    - bpf: restrict map value pointer arithmetic for unprivileged
    - bpf: restrict stack pointer arithmetic for unprivileged
    - bpf: restrict unknown scalars of mixed signed bounds for unprivileged
    - bpf: fix check_map_access smin_value test when pointer contains offset
    - bpf: prevent out of bounds speculation on pointer arithmetic
    - bpf: fix sanitation of alu op with pointer / scalar type from different
      paths
    - bpf: fix inner map masking to prevent oob under speculation
    - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
    - nvmet-rdma: Add unlikely for response allocated check
    - nvmet-rdma: fix null dereference under heavy load
    - Revert "mm, memory_hotplug: initialize struct pages for the full memory
      section"
    - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
    - ide: fix a typo in the settings proc file name
    - Input: input_event - fix the CONFIG_SPARC64 mixup
    - Linux 4.19.19

* HP ProBook 470 G5, LED's in Hotkeys f5, f8 and f11 without function
    (LP: #1811254) // Disco update: v4.19.19 upstream stable release
    (LP: #1814170)
    - ALSA: hda - Add mute LED support for HP ProBook 470 G5

* Vsock connect fails with ENODEV for large CID (LP: #1813934)
    - vhost/vsock: fix vhost vsock cid hashing inconsistent

* Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

* SecureBoot support for arm64 (LP: #1804481)
    - Build signed kernels for arm64

* ip6_gre: fix tunnel list corruption for x-netns (LP: #1812875)
    - ip6_gre: fix tunnel list corruption for x-netns

* Miscellaneous Ubuntu changes
    - SAUCE: selftests: net: fix "from" match test in fib_rule_tests.sh
    - [Packaging] remove handoff check for uefi signing
    - [Packaging] decompress gzipped efi images in signing tarball

* Miscellaneous upstream changes
    - selftests/bpf: Test narrow loads with off > 0 in test_verifier
    - bpf: add various test cases to selftests
    - bpf: improve verifier branch analysis

-- Seth Forshee <seth.forshee@canonical.com>  Thu, 07 Feb 2019 12:12:10 -0600

Changed in linux (Ubuntu):
status:	Fix Committed → Fix Released

Revision history for this message

Brad Figg (brad-figg) wrote on 2019-02-15:

#8

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-bionic

Revision history for this message

Olivier Matz (oliviermatz) wrote on 2019-02-18:

#9

Validated with kernels:
- linux-image-4.15.0-46-generic (bionic)
- linux-image-4.18.0-16-generic (cosmic)

tags:

added: verification-done-bionic verification-done-cosmic
removed: verification-needed-bionic verification-needed-cosmic

Revision history for this message

Launchpad Janitor (janitor) wrote on 2019-03-05:

#10

Download full text (11.4 KiB)

This bug was fixed in the package linux - 4.15.0-46.49

---------------
linux (4.15.0-46.49) bionic; urgency=medium

* linux: 4.15.0-46.49 -proposed tracker (LP: #1814726)

* mprotect fails on ext4 with dax (LP: #1799237)
- x86/speculation/l1tf: Exempt zeroed PTEs from inversion

  * kernel BUG at /build/linux-vxxS7y/linux-4.15.0/mm/slub.c:296! (LP: #1812086)
    - iscsi target: fix session creation failure handling
    - scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values
      fails
    - scsi: iscsi: target: Fix conn_ops double free

  * user_copy in user from ubuntu_kernel_selftests failed on KVM kernel
    (LP: #1812198)
    - selftests: user: return Kselftest Skip code for skipped tests
    - selftests: kselftest: change KSFT_SKIP=4 instead of KSFT_PASS
    - selftests: kselftest: Remove outdated comment

  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
    - SAUCE: staging: rtlwifi: allow RTLWIFI_DEBUG_ST to be disabled
    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
    - SAUCE: Add r8822be to signature inclusion list

* kernel oops in bcache module (LP: #1793901)
- SAUCE: bcache: never writeback a discard operation

  * CVE-2018-18397
    - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
    - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    - userfaultfd: shmem: add i_size checks
    - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set

  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

* Vsock connect fails with ENODEV for large CID (LP: #1813934)
- vhost/vsock: fix vhost vsock cid hashing inconsistent

* SRU: Fix thinkpad 11e 3rd boot hang (LP: #1804604)
- ACPI / LPSS: Force LPSS quirks on boot

  * Bionic update: upstream stable patchset 2019-01-17 (LP: #1812229)
    - scsi: sd_zbc: Fix variable type and bogus comment
    - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in
      parallel.
    - x86/apm: Don't access __preempt_count with zeroed fs
    - x86/events/intel/ds: Fix bts_interrupt_threshold alignment
    - x86/MCE: Remove min interval polling limitation
    - fat: fix memory allocation failure handling of match_strdup()
    - ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk
    - ARCv2: [plat-hsdk]: Save accl reg pair by default
    - ARC: Fix CONFIG_SWAP
    - ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    - ARC: mm: allow mprotect to make stack mappings executable
    - mm: memcg: fix use after free in mem_cgroup_iter()
    - mm/huge_memory.c: fix data loss when splitting a file pmd
    - cpufreq: intel_pstate: Register when ACPI PCCH is present
    - vfio/pci: Fix potential Spectre v1
    - stop_machine: Disable preemption when waking two stopper threads
    - drm/i915: Fix hotplug irq ack on i965/g4x
    - drm/nouveau: Use drm_connector_list_iter_* for iterating connectors
    - drm/nouveau: Avoid looping through fake MST connectors
    - gen_stats: Fix netl...

This bug was fixed in the package linux - 4.15.0-46.49

---------------
linux (4.15.0-46.49) bionic; urgency=medium

* linux: 4.15.0-46.49 -proposed tracker (LP: #1814726)

* mprotect fails on ext4 with dax (LP: #1799237)
    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion

* kernel BUG at /build/linux-vxxS7y/linux-4.15.0/mm/slub.c:296! (LP: #1812086)
    - iscsi target: fix session creation failure handling
    - scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values
      fails
    - scsi: iscsi: target: Fix conn_ops double free

* user_copy in user from ubuntu_kernel_selftests failed on KVM kernel
    (LP: #1812198)
    - selftests: user: return Kselftest Skip code for skipped tests
    - selftests: kselftest: change KSFT_SKIP=4 instead of KSFT_PASS
    - selftests: kselftest: Remove outdated comment

* RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
    - SAUCE: staging: rtlwifi: allow RTLWIFI_DEBUG_ST to be disabled
    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
    - SAUCE: Add r8822be to signature inclusion list

* kernel oops in bcache module (LP: #1793901)
    - SAUCE: bcache: never writeback a discard operation

* CVE-2018-18397
    - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
    - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    - userfaultfd: shmem: add i_size checks
    - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set

* Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

* Vsock connect fails with ENODEV for large CID (LP: #1813934)
    - vhost/vsock: fix vhost vsock cid hashing inconsistent

* SRU: Fix thinkpad 11e 3rd boot hang (LP: #1804604)
    - ACPI / LPSS: Force LPSS quirks on boot

* Bionic update: upstream stable patchset 2019-01-17 (LP: #1812229)
    - scsi: sd_zbc: Fix variable type and bogus comment
    - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in
      parallel.
    - x86/apm: Don't access __preempt_count with zeroed fs
    - x86/events/intel/ds: Fix bts_interrupt_threshold alignment
    - x86/MCE: Remove min interval polling limitation
    - fat: fix memory allocation failure handling of match_strdup()
    - ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk
    - ARCv2: [plat-hsdk]: Save accl reg pair by default
    - ARC: Fix CONFIG_SWAP
    - ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    - ARC: mm: allow mprotect to make stack mappings executable
    - mm: memcg: fix use after free in mem_cgroup_iter()
    - mm/huge_memory.c: fix data loss when splitting a file pmd
    - cpufreq: intel_pstate: Register when ACPI PCCH is present
    - vfio/pci: Fix potential Spectre v1
    - stop_machine: Disable preemption when waking two stopper threads
    - drm/i915: Fix hotplug irq ack on i965/g4x
    - drm/nouveau: Use drm_connector_list_iter_* for iterating connectors
    - drm/nouveau: Avoid looping through fake MST connectors
    - gen_stats: Fix netlink stats dumping in the presence of padding
    - ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
    - ipv6: fix useless rol32 call on hash
    - ipv6: ila: select CONFIG_DST_CACHE
    - lib/rhashtable: consider param->min_size when setting initial table size
    - net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort
    - net: Don't copy pfmemalloc flag in __copy_skb_header()
    - skbuff: Unconditionally copy pfmemalloc in __skb_clone()
    - net/ipv4: Set oif in fib_compute_spec_dst
    - net: phy: fix flag masking in __set_phy_supported
    - ptp: fix missing break in switch
    - qmi_wwan: add support for Quectel EG91
    - tg3: Add higher cpu clock for 5762.
    - hv_netvsc: Fix napi reschedule while receive completion is busy
    - net/mlx4_en: Don't reuse RX page when XDP is set
    - net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite
    - ipv6: make DAD fail with enhanced DAD when nonce length differs
    - net: usb: asix: replace mii_nway_restart in resume path
    - alpha: fix osf_wait4() breakage
    - cxl_getfile(): fix double-iput() on alloc_file() failures
    - powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from stop (idle)
    - xhci: Fix perceived dead host due to runtime suspend race with event handler
    - KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
    - x86/kvmclock: set pvti_cpu0_va after enabling kvmclock
    - ALSA: hda/realtek - Yet another Clevo P950 quirk entry
    - drm/amdgpu: Reserve VM root shared fence slot for command submission (v3)
    - rhashtable: add restart routine in rhashtable_free_and_destroy()
    - sch_fq_codel: zero q->flows_cnt when fq_codel_init fails
    - sctp: introduce sctp_dst_mtu
    - sctp: fix the issue that pathmtu may be set lower than MINSEGMENT
    - net: aquantia: vlan unicast address list correct handling
    - drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open()

* Bionic update: upstream stable patchset 2019-01-15 (LP: #1811877)
    - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations
    - x86/asm: Add _ASM_ARG* constants for argument registers to <asm/asm.h>
    - x86/paravirt: Make native_save_fl() extern inline
    - Btrfs: fix duplicate extents after fsync of file with prealloc extents
    - cpufreq / CPPC: Set platform specific transition_delay_us
    - PCI: exynos: Fix a potential init_clk_resources NULL pointer dereference
    - alx: take rtnl before calling __alx_open from resume
    - atm: Preserve value of skb->truesize when accounting to vcc
    - atm: zatm: Fix potential Spectre v1
    - ipv6: sr: fix passing wrong flags to crypto_alloc_shash()
    - ipvlan: fix IFLA_MTU ignored on NEWLINK
    - ixgbe: split XDP_TX tail and XDP_REDIRECT map flushing
    - net: dccp: avoid crash in ccid3_hc_rx_send_feedback()
    - net: dccp: switch rx_tstamp_last_feedback to monotonic clock
    - net: fix use-after-free in GRO with ESP
    - net: macb: Fix ptp time adjustment for large negative delta
    - net/mlx5e: Avoid dealing with vport representors if not being e-switch
      manager
    - net/mlx5: E-Switch, Avoid setup attempt if not being e-switch manager
    - net/mlx5: Fix command interface race in polling mode
    - net/mlx5: Fix incorrect raw command length parsing
    - net/mlx5: Fix required capability for manipulating MPFS
    - net/mlx5: Fix wrong size allocation for QoS ETC TC regitster
    - net: mvneta: fix the Rx desc DMA address in the Rx path
    - net/packet: fix use-after-free
    - net_sched: blackhole: tell upper qdisc about dropped packets
    - net: sungem: fix rx checksum support
    - net/tcp: Fix socket lookups with SO_BINDTODEVICE
    - qede: Adverstise software timestamp caps when PHC is not available.
    - qed: Fix setting of incorrect eswitch mode.
    - qed: Fix use of incorrect size in memcpy call.
    - qed: Limit msix vectors in kdump kernel to the minimum required count.
    - r8152: napi hangup fix after disconnect
    - stmmac: fix DMA channel hang in half-duplex mode
    - strparser: Remove early eaten to fix full tcp receive buffer stall
    - tcp: fix Fast Open key endianness
    - tcp: prevent bogus FRTO undos with non-SACK flows
    - vhost_net: validate sock before trying to put its fd
    - VSOCK: fix loopback on big-endian systems
    - net: cxgb3_main: fix potential Spectre v1
    - rtlwifi: Fix kernel Oops "Fw download fail!!"
    - rtlwifi: rtl8821ae: fix firmware is not ready to run
    - net: lan78xx: Fix race in tx pending skb size calculation
    - crypto: af_alg - Initialize sg_num_bytes in error code path
    - mtd: rawnand: denali_dt: set clk_x_rate to 200 MHz unconditionally
    - PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg()
    - netfilter: ebtables: reject non-bridge targets
    - reiserfs: fix buffer overflow with long warning messages
    - KEYS: DNS: fix parsing multiple options
    - tls: Stricter error checking in zerocopy sendmsg path
    - autofs: fix slab out of bounds read in getname_kernel()
    - nsh: set mac len based on inner packet
    - bdi: Fix another oops in wb_workfn()
    - rds: avoid unenecessary cong_update in loop transport
    - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.
    - string: drop __must_check from strscpy() and restore strscpy() usages in
      cgroup
    - nfsd: COPY and CLONE operations require the saved filehandle to be set
    - net/sched: act_ife: fix recursive lock and idr leak
    - net/sched: act_ife: preserve the action control in case of error
    - hinic: reset irq affinity before freeing irq
    - nfp: flower: fix mpls ether type detection
    - net: macb: initialize bp->queues[0].bp for at91rm9200
    - enic: do not overwrite error code
    - virtio_net: fix memory leak in XDP_REDIRECT
    - netfilter: ipv6: nf_defrag: drop skb dst before queueing
    - ipvs: initialize tbl->entries after allocation
    - ipvs: initialize tbl->entries in ip_vs_lblc_init_svc()
    - bpf: enforce correct alignment for instructions
    - bpf, arm32: fix to use bpf_jit_binary_lock_ro api

* Fix non-working pinctrl-intel (LP: #1811777)
    - pinctrl: intel: Implement intel_gpio_get_direction callback
    - pinctrl: intel: Do pin translation in other GPIO operations as well

* ip6_gre: fix tunnel list corruption for x-netns (LP: #1812875)
    - ip6_gre: fix tunnel list corruption for x-netns

* Userspace break as a result of missing patch backport (LP: #1813873)
    - tty: Don't hold ldisc lock in tty_reopen() if ldisc present

* kvm_stat : missing python dependency (LP: #1798776)
    - tools/kvm_stat: fix python3 issues
    - tools/kvm_stat: switch to python3

* [SRU] Fix Xorg crash with nomodeset when BIOS enable 64-bit fb addr
    (LP: #1812797)
    - vgaarb: Add support for 64-bit frame buffer address
    - vgaarb: Keep adding VGA device in queue

* Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
    - USB: Add new USB LPM helpers
    - USB: Consolidate LPM checks to avoid enabling LPM twice

* ptrace-tm-spd-gpr in powerpc/ptrace from ubuntu_kerenl_selftests failed on
    Bionic P8 (LP: #1813127)
    - selftests/powerpc: Fix ptrace tm failure

* [SRU] IO's are issued with incorrect Scatter Gather Buffer (LP: #1795453)
    - scsi: megaraid_sas: Use 63-bit DMA addressing

* Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
    - [Config] Enable timestamping in network PHY devices

* CVE-2018-19854
    - crypto: user - fix leaking uninitialized memory to userspace

* x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000
    (LP: #1813532)
    - x86/mm: Do not warn about PCI BIOS W+X mappings

* CVE-2019-6133
    - fork: record start_time late

* Fix not working Goodix touchpad (LP: #1811929)
    - HID: i2c-hid: Disable runtime PM on Goodix touchpad

* bluetooth controller not detected with 4.15 kernel (LP: #1810797)
    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y

* X1 Extreme: only one of the two SSDs is loaded (LP: #1811755)
    - nvme-core: rework a NQN copying operation
    - nvme: pad fake subsys NQN vid and ssvid with zeros
    - nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN

* Crash on "ip link add foo type ipip" (LP: #1811803)
    - SAUCE: fan: Fix NULL pointer dereference

-- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 06 Feb 2019 04:57:21 +0000

Changed in linux (Ubuntu Bionic):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2019-03-06:

#11

Download full text (3.3 KiB)

This bug was fixed in the package linux - 4.18.0-16.17

---------------
linux (4.18.0-16.17) cosmic; urgency=medium

* linux: 4.18.0-16.17 -proposed tracker (LP: #1814749)

* Packaging resync (LP: #1786013)
- [Packaging] update helper scripts

* CVE-2018-16880
- vhost: fix OOB in get_rx_bufs()

  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
    - SAUCE: staging: rtlwifi: allow RTLWIFI_DEBUG_ST to be disabled
    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
    - SAUCE: Add r8822be to signature inclusion list

* kernel oops in bcache module (LP: #1793901)
- SAUCE: bcache: never writeback a discard operation

  * CVE-2018-18397
    - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
    - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    - userfaultfd: shmem: add i_size checks
    - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set

  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

* Vsock connect fails with ENODEV for large CID (LP: #1813934)
- vhost/vsock: fix vhost vsock cid hashing inconsistent

* Fix non-working pinctrl-intel (LP: #1811777)
- pinctrl: intel: Do pin translation in other GPIO operations as well

* ip6_gre: fix tunnel list corruption for x-netns (LP: #1812875)
- ip6_gre: fix tunnel list corruption for x-netns

  * Backported commit breaks audio (fixed upstream) (LP: #1811566)
    - ASoC: intel: cht_bsw_max98090_ti: Add quirk for boards using pmc_plt_clk_0
    - ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook
      Clapper
    - ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook
      Gnawty

* kvm_stat : missing python dependency (LP: #1798776)
- tools/kvm_stat: switch to python3

  * [SRU] Fix Xorg crash with nomodeset when BIOS enable 64-bit fb addr
    (LP: #1812797)
    - vgaarb: Add support for 64-bit frame buffer address
    - vgaarb: Keep adding VGA device in queue

  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
    - USB: Add new USB LPM helpers
    - USB: Consolidate LPM checks to avoid enabling LPM twice

* [SRU] IO's are issued with incorrect Scatter Gather Buffer (LP: #1795453)
- scsi: megaraid_sas: Use 63-bit DMA addressing

  * x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000
    (LP: #1813532)
    - x86/mm: Do not warn about PCI BIOS W+X mappings

* CVE-2019-6133
- fork: record start_time late

* Fix not working Goodix touchpad (LP: #1811929)
- HID: i2c-hid: Disable runtime PM on Goodix touchpad

  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y

  * X1 Extreme: only one of the two SSDs is loaded (LP: #1811755)
    - nvme-core: rework a NQN copying operation
    - nvme: pad fake subsys NQN vid and ssvid with zeros
    - nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN

* Crash on "ip link add f...

Ubuntu
linux package

ip6_gre: fix tunnel list corruption for x-netns

Bug Description

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Seth Forshee
Bionic	Fix Released	Medium	Seth Forshee
Cosmic	Fix Released	Medium	Seth Forshee

Ubuntulinux package

ip6_gre: fix tunnel list corruption for x-netns

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package