[UBUNTU] kernel: Fix wrong dispatching for control domain CPRBs
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Ubuntu on IBM z Systems |
Fix Released
|
High
|
Canonical Kernel Team | ||
| linux (Ubuntu) |
Fix Released
|
Undecided
|
Skipper Bug Screeners | ||
| Bionic |
Fix Released
|
Medium
|
Unassigned | ||
| Disco |
Fix Released
|
Medium
|
Unassigned | ||
Bug Description
SRU Justification:
==================
[Impact]
* Unable to maintain control-only crypto domains
* The communication to control-only domains does not work in any way.
* And depending on the setup (lowest numerical domain is control-only) the TKE does not see the crypto card at all.
[Fix]
* 7379e652797c0b9
[Test Case]
* Configure a control-only domain to the activation profile of LPAR A
* Configure a control-and-usage domain to the activation profile of LPAR B
* Try to communicate to LPAR A with the control-only domain (e.g. trying to read or set master key)
[Regression Potential]
* The regression potential can be considered as moderate since this is purely s390x specific
* and again limited to CryptoExpress adapter cards.
* It only occurs if crypto domains are configured as control-only or better control-only in combination with control-and-usage.
* The majority of configurations is control-and-usage, since this offers more flexibility and covers more use cases.
[Other Info]
* Problem was found during tests at IBM and is a so called 'preventive fix'
* The given patch is supposed to fix this issue and became upstream accepted with kernel 5.2-rc3.
* It applies cleanly to disco master-next while cherry-picking, but needs the the backport (from comment #3) for bionic's master-next kernel 4.15.
* Once target kernel 5.2 has landed in Eoan, it will be in Eoan, too.
__________
Description: kernel: Fix wrong dispatching for control domain CPRBs
Symptom: Unable to maintain control-only crypto domains
Problem: LPARs may have control-only crypto domains assigned.
Such a domain can be controlled (for example master keys can
be set) but can't be used for regualar crypto load (usage).
A crypto domain may be assigned for control-and-usage to
only one active LPAR. But the very same domain may be
for the state of the master keys on a control-only domain
Solution: This fix introduces some code which checks if an CCA CPRB is
CPRB is send to this other domain instead. The target domain
does the right job and addresses the control domain.
Reproduction: 1. Add a control-only domain to the crypto configuration of
2. Connect the TKE the LPAR and try to visit the master key
3. Will fail without the fix, will succeed with the fix.
Component: kernel
Upstream-ID: 7379e652797c0b9
This fix is requested for 19.10 but should also be applied to 18.04 and 19.04
CVE References
| tags: | added: architecture-s39064 bugnameltc-178125 severity-high targetmilestone-inin1910 |
| Changed in ubuntu: | |
| assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
| affects: | ubuntu → linux (Ubuntu) |
| Changed in ubuntu-z-systems: | |
| importance: | Undecided → High |
| assignee: | nobody → Canonical Kernel Team (canonical-kernel-team) |
| Frank Heimes (fheimes) wrote | #1 |
| Changed in ubuntu-z-systems: | |
| status: | New → Triaged |
| Changed in ubuntu-z-systems: | |
| status: | Triaged → In Progress |
| bugproxy (bugproxy) wrote Here is a backport of the upstream patch. | #2 |
| Harald Freudenberger (freude-5) wrote | #3 |
| tags: | added: patch |
| Frank Heimes (fheimes) wrote | #4 |
| description: | updated |
| description: | updated |
| Changed in ubuntu-z-systems: | |
| status: | In Progress → Triaged |
| Changed in ubuntu-z-systems: | |
| status: | Triaged → Confirmed |
| Frank Heimes (fheimes) wrote | #5 |
| Changed in linux (Ubuntu): | |
| status: | New → In Progress |
| Changed in ubuntu-z-systems: | |
| status: | Confirmed → In Progress |
| Changed in linux (Ubuntu Bionic): | |
| importance: | Undecided → Medium |
| Changed in linux (Ubuntu Disco): | |
| importance: | Undecided → Medium |
| Changed in linux (Ubuntu Bionic): | |
| status: | New → Fix Committed |
| Changed in linux (Ubuntu Disco): | |
| status: | New → Fix Committed |
| Frank Heimes (fheimes) wrote | #6 |
| Changed in ubuntu-z-systems: | |
| status: | In Progress → Fix Committed |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #7 |
| tags: | added: verification-needed-disco |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #8 |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #9 |
| tags: | added: verification-needed-bionic |
| Frank Heimes (fheimes) wrote | #10 |
| tags: |
added: verification-done-bionic verification-done-disco removed: verification-needed-bionic verification-needed-disco |
| Launchpad Janitor (janitor) wrote | #11 |
| Changed in linux (Ubuntu Bionic): | |
| status: | Fix Committed → Fix Released |
| Frank Heimes (fheimes) wrote | #12 |
| Changed in linux (Ubuntu): | |
| status: | In Progress → Fix Released |
| Launchpad Janitor (janitor) wrote | #13 |
| Changed in linux (Ubuntu Disco): | |
| status: | Fix Committed → Fix Released |
| Changed in ubuntu-z-systems: | |
| status: | Fix Committed → Fix Released |
| bugproxy (bugproxy) wrote | #14 |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #15 |
| tags: | added: verification-needed-xenial |
| bugproxy (bugproxy) wrote | #16 |
Commit ID got upstream accepted with kernel v5.2-rc3, so will be automatically part of 19.10, when target kernel 5.2 finally lands in eoan.
Kernel SRU needed for 19.04 and 18.04.