Bug #1981658 “BUG: kernel NULL pointer dereference, address: 000...” : Bugs : linux-hwe-5.4 package : Ubuntu

Haw Loeung (hloeung) on 2022-07-14

description:	updated
description:	updated

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2022-07-14: Missing required logs.

#1

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1981658

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete
Changed in linux (Ubuntu Bionic):
status:	New → Incomplete

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: CRDA.txt

#2

CRDA.txt Edit (468 bytes, text/plain)

apport information

tags:	added: apport-collected bionic
description:	updated

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: CurrentDmesg.txt

#3

CurrentDmesg.txt Edit (153.3 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: Lspci.txt

#4

Lspci.txt Edit (78.9 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: Lsusb.txt

#5

Lsusb.txt Edit (687 bytes, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: ProcCpuinfo.txt

#6

ProcCpuinfo.txt Edit (93.3 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: ProcCpuinfoMinimal.txt

#7

ProcCpuinfoMinimal.txt Edit (1.5 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: ProcInterrupts.txt

#8

ProcInterrupts.txt Edit (288.5 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: ProcModules.txt

#9

ProcModules.txt Edit (4.1 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: UdevDb.txt

#10

UdevDb.txt Edit (542.2 KiB, text/plain)

apport information

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-14: WifiSyslog.txt

#11

WifiSyslog.txt Edit (185.2 KiB, text/plain)

apport information

Changed in linux (Ubuntu):
status:	Incomplete → Confirmed
Changed in linux (Ubuntu Bionic):
status:	Incomplete → Confirmed
Changed in linux-hwe-5.4 (Ubuntu):
status:	New → Confirmed
Changed in linux-hwe-5.4 (Ubuntu Bionic):
status:	New → Confirmed

Revision history for this message

Jason Ashdown (jsonuk) wrote on 2022-07-15:

#12

Also want to confirm that I am seeing the same kernel panic in the last couple of days with v5.4.0-122.

Revision history for this message

Jon Wilkes (plujon) wrote on 2022-07-18:

#13

I've hit this (or a very similar problem) on 2 different digital ocean droplets running 20.04 LTS . Unfortunately, what I could see of the console contained only the end of the panic report, but I've transcribed it by hand below (I have screenshots if the missing numbers are wanted). The RIP was exactly the same on both 20.04.4 LTS machines I have but slightly different than the one posted by the original filer of this bug:

RIP: 0010:tcp_create_openreq_child+0x2fd/0x410

Here's what I got from the console:

    psmouse net_failover failover virtio_blk virtio_scsi floppy
    [ 6216.896076] CR2: 0000000000000008
    [ 6216.896830] ---[ end trace 13e3ec3bb3cc9e33 ]---
    [ 6216.897743] RIP: 0010:tcp_create_openreq_child+0x2fd/0x410
    [ 6216.896830] Code: 08 00 00 8b 83 18 01 00 00 48 89 de 4c 89 ef 49 c7 84 24 80
     08 00 00 00 00 00 00 41 89 84 24 c4 05 00 00 48 8b 83 f8 00 00 00 <48> 8b 40 08
     e8 9a d0 46 00 48 85 c0 41 0f b7 84 24 68 05 00 00 74
    [ 6216.902357] RSP: 0018:ffffa6de400b88888 EFLAGS: 00010246
    [ 6216.903497] RAX: ...
    [ 6216.... ] RDX: ...
    [ 6216.... ] RBP: ...
    [ 6216.... ] R10: ...
    [ 6216.... ] R13: ...
    [ 6216.... ] FS: ...
    [ 6216.... ] FS: ...
    [ 6216.... ] CS: ...
    [ 6216.... ] CR2: ...
    [ 6216.... ] DR0: ...
    [ 6216.... ] DR3: ...
    [ 6216.919380] Kernel panic - not syncing: Fatal exception in interrupt
     ]---

$ uname -sr
Linux 5.4.0-122-generic

Both droplets were using linux-image-virtual, and to avoid this problem, I reverted to 5.4.0-121 via grub-set-default.

Revision history for this message

lilideng (lilideng) wrote on 2022-07-19:

#14

Download full text (7.1 KiB)

we also see this issue on azure ubuntu 1804, kernel version is 5.4.0-1086-azure

[ 823.785727] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 823.791661] #PF: supervisor read access in kernel mode
[ 823.791661] #PF: error_code(0x0000) - not-present page
[ 823.798898] PGD 0 P4D 0
[ 823.798898] Oops: 0000 [#1] SMP PTI
[ 823.798898] CPU: 21 PID: 0 Comm: swapper/21 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu
[ 823.798898] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 12/07/2018
[ 823.798898] RIP: 0010:tcp_create_openreq_child+0x2e1/0x3e0
[ 823.798898] Code: 08 00 00 41 8b 84 24 18 01 00 00 48 c7 83 80 08 00 00 00 00 00 00 4c 89 e6 4c 89 ef 89 83 c4 05 00 00 49 8b 84 24 f8 00 00 00 <48> 8b 40 08 e8 b6 81 4b 00 48 85 c0 0f b7 83 68 05 00 00 74 0a 83
[ 823.798898] RSP: 0018:ffffbcee00510950 EFLAGS: 00010246
[ 823.798898] RAX: 0000000000000000 RBX: ffff9e64f0c53d40 RCX: 0000000000000007
[ 823.798898] RDX: 0000000000000020 RSI: ffff9e6cd950fb60 RDI: ffff9e6ccf8d3480
[ 823.798898] RBP: ffffbcee00510970 R08: 0000000000000000 R09: ffff9e6d19007800
[ 823.798898] R10: 0000000000000514 R11: ffffbcee00510a37 R12: ffff9e6cd950fb60
[ 823.798898] R13: ffff9e6ccf8d3480 R14: ffff9e6cd7c1e200 R15: ffff9e6d1305e600
[ 823.798898] FS: 0000000000000000(0000) GS:ffff9e6d1f940000(0000) knlGS:0000000000000000
[ 823.798898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 823.798898] CR2: 0000000000000008 CR3: 000000105216e004 CR4: 00000000003706e0
[ 823.798898] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 823.798898] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 823.798898] Call Trace:
[ 823.798898] <IRQ>
[ 823.798898] tcp_v4_syn_recv_sock+0x5a/0x3d0
[ 823.798898] tcp_get_cookie_sock+0x48/0x140
[ 823.798898] cookie_v4_check+0x561/0x660
[ 823.798898] tcp_v4_do_rcv+0x1a0/0x1d0
[ 823.956063] tcp_v4_rcv+0xa86/0xad0
[ 823.956063] ip_protocol_deliver_rcu+0x31/0x1b0
[ 823.956063] ip_local_deliver_finish+0x48/0x50
[ 823.956063] ip_local_deliver+0x7e/0xe0
[ 823.956063] ? ip_protocol_deliver_rcu+0x1b0/0x1b0
[ 823.956063] ip_sublist_rcv_finish+0x42/0x60
[ 823.956063] ip_sublist_rcv+0x239/0x270
[ 823.956063] ? ip_rcv_finish_core.isra.18+0x3b0/0x3b0
[ 823.956063] ip_list_rcv+0x10d/0x130
[ 823.956063] __netif_receive_skb_list_core+0x23e/0x260
[ 823.956063] netif_receive_skb_list_internal+0x17a/0x290
[ 823.956063] gro_normal_list.part.132+0x1e/0x40
[ 823.956063] napi_complete_done+0x94/0x110
[ 823.956063] mlx5e_napi_poll+0x178/0x630 [mlx5_core]
[ 823.956063] net_rx_action+0x134/0x3c0
[ 823.956063] __do_softirq+0xde/0x2ce
[ 823.956063] irq_exit+0xd7/0xe0
[ 823.956063] hyperv_vector_handler+0x63/0x70
[ 823.956063] hyperv_callback_vector+0xf/0x20
[ 823.956063] </IRQ>
[ 823.956063] RIP: 0010:default_idle+0x2b/0x150
[ 823.956063] Code: 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 65 44 8b 25 58 85 1c 4e 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 79 99 5b 00 fb f4 <65> 44 8b 25 3d 85 1c 4e 0f 1f 44 00 00 5b 41 5c 41 5d 41 5e 5d c3
[ 823.956063] RSP: 0018:ffffbcee0011be78 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff0c
[...

we also see this issue on azure ubuntu 1804, kernel version is 5.4.0-1086-azure

[  823.785727] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  823.791661] #PF: supervisor read access in kernel mode
[  823.791661] #PF: error_code(0x0000) - not-present page
[  823.798898] PGD 0 P4D 0
[  823.798898] Oops: 0000 [#1] SMP PTI
[  823.798898] CPU: 21 PID: 0 Comm: swapper/21 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu
[  823.798898] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
[  823.798898] RIP: 0010:tcp_create_openreq_child+0x2e1/0x3e0
[  823.798898] Code: 08 00 00 41 8b 84 24 18 01 00 00 48 c7 83 80 08 00 00 00 00 00 00 4c 89 e6 4c 89 ef 89 83 c4 05 00 00 49 8b 84 24 f8 00 00 00 <48> 8b 40 08 e8 b6 81 4b 00 48 85 c0 0f b7 83 68 05 00 00 74 0a 83
[  823.798898] RSP: 0018:ffffbcee00510950 EFLAGS: 00010246
[  823.798898] RAX: 0000000000000000 RBX: ffff9e64f0c53d40 RCX: 0000000000000007
[  823.798898] RDX: 0000000000000020 RSI: ffff9e6cd950fb60 RDI: ffff9e6ccf8d3480
[  823.798898] RBP: ffffbcee00510970 R08: 0000000000000000 R09: ffff9e6d19007800
[  823.798898] R10: 0000000000000514 R11: ffffbcee00510a37 R12: ffff9e6cd950fb60
[  823.798898] R13: ffff9e6ccf8d3480 R14: ffff9e6cd7c1e200 R15: ffff9e6d1305e600
[  823.798898] FS:  0000000000000000(0000) GS:ffff9e6d1f940000(0000) knlGS:0000000000000000
[  823.798898] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  823.798898] CR2: 0000000000000008 CR3: 000000105216e004 CR4: 00000000003706e0
[  823.798898] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  823.798898] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  823.798898] Call Trace:
[  823.798898]  <IRQ>
[  823.798898]  tcp_v4_syn_recv_sock+0x5a/0x3d0
[  823.798898]  tcp_get_cookie_sock+0x48/0x140
[  823.798898]  cookie_v4_check+0x561/0x660
[  823.798898]  tcp_v4_do_rcv+0x1a0/0x1d0
[  823.956063]  tcp_v4_rcv+0xa86/0xad0
[  823.956063]  ip_protocol_deliver_rcu+0x31/0x1b0
[  823.956063]  ip_local_deliver_finish+0x48/0x50
[  823.956063]  ip_local_deliver+0x7e/0xe0
[  823.956063]  ? ip_protocol_deliver_rcu+0x1b0/0x1b0
[  823.956063]  ip_sublist_rcv_finish+0x42/0x60
[  823.956063]  ip_sublist_rcv+0x239/0x270
[  823.956063]  ? ip_rcv_finish_core.isra.18+0x3b0/0x3b0
[  823.956063]  ip_list_rcv+0x10d/0x130
[  823.956063]  __netif_receive_skb_list_core+0x23e/0x260
[  823.956063]  netif_receive_skb_list_internal+0x17a/0x290
[  823.956063]  gro_normal_list.part.132+0x1e/0x40
[  823.956063]  napi_complete_done+0x94/0x110
[  823.956063]  mlx5e_napi_poll+0x178/0x630 [mlx5_core]
[  823.956063]  net_rx_action+0x134/0x3c0
[  823.956063]  __do_softirq+0xde/0x2ce
[  823.956063]  irq_exit+0xd7/0xe0
[  823.956063]  hyperv_vector_handler+0x63/0x70
[  823.956063]  hyperv_callback_vector+0xf/0x20
[  823.956063]  </IRQ>
[  823.956063] RIP: 0010:default_idle+0x2b/0x150
[  823.956063] Code: 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 65 44 8b 25 58 85 1c 4e 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 79 99 5b 00 fb f4 <65> 44 8b 25 3d 85 1c 4e 0f 1f 44 00 00 5b 41 5c 41 5d 41 5e 5d c3
[  823.956063] RSP: 0018:ffffbcee0011be78 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff0c
[  823.956063] RAX: ffffffffb1e4cde0 RBX: 0000000000000015 RCX: 0000000000000001
[  823.956063] RDX: 0000000000000015 RSI: ffffbcee0011be58 RDI: 0000000000000000
[  823.956063] RBP: ffffbcee0011be98 R08: 0000000000000006 R09: 00fca75c93534208
[  823.956063] R10: ffffbcee0011be38 R11: 000000000013b454 R12: 0000000000000015
[  823.956063] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000fffffff0
[  823.956063]  ? __sched_text_end+0x2/0x2
[  824.148152]  arch_cpu_idle+0x15/0x20
[  824.148152]  default_idle_call+0x26/0x30
[  824.148152]  do_idle+0x1d7/0x2a0
[  824.148152]  cpu_startup_entry+0x1d/0x20
[  824.148152]  start_secondary+0x159/0x1b0
[  824.148152]  secondary_startup_64+0xa4/0xb0
[  824.148152] Modules linked in: tcp_diag inet_diag nfnetlink_queue ipt_REJECT nf_reject_ipv4 xt_mark xt_comment xt_NFQUEUE iptable_mangle xt_MASQUERADE nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter nf_nat br_netfilter bridge stp llc aufs overlay xt_tcpudp xt_owner xt_conntrack nf_conntrack nf_defrag_ipv6 iptable_security nf_defrag_ipv4 bpfilter mlx5_ib ib_uverbs mlx5_core tls mlxfw udf crc_itu_t nls_iso8859_1 isst_if_mbox_msr isst_if_common kvm_intel kvm hv_balloon rapl serio_raw joydev sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel hid_generic aesni_intel crypto_simd hid_hyperv cryptd pata_acpi hid glue_helper hyperv_fb hv_netvsc hyperv_keyboard hv_utils
[  824.148152] CR2: 0000000000000008
[  824.148151] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  824.148152] ---[ end trace 90f422af831c3aca ]---
[  824.148152] RIP: 0010:tcp_create_openreq_child+0x2e1/0x3e0
[  824.148151] #PF: supervisor read access in kernel mode
[  824.148152] Code: 08 00 00 41 8b 84 24 18 01 00 00 48 c7 83 80 08 00 00 00 00 00 00 4c 89 e6 4c 89 ef 89 83 c4 05 00 00 49 8b 84 24 f8 00 00 00 <48> 8b 40 08 e8 b6 81 4b 00 48 85 c0 0f b7 83 68 05 00 00 74 0a 83
[  824.148151] #PF: error_code(0x0000) - not-present page
[  824.148152] RSP: 0018:ffffbcee00510950 EFLAGS: 00010246
[  824.148151] PGD 80000010535ac067 P4D 80000010535ac067 PUD 10535ad067 PMD 0
[  824.148152] RAX: 0000000000000000 RBX: ffff9e64f0c53d40 RCX: 0000000000000007
[  824.276120] Oops: 0000 [#2] SMP PTI
[  824.276121] RDX: 0000000000000020 RSI: ffff9e6cd950fb60 RDI: ffff9e6ccf8d3480
[  824.276120] CPU: 17 PID: 20218 Comm: nginx Tainted: G      D           5.4.0-1086-azure #91~18.04.1-Ubuntu
[  824.276121] RBP: ffffbcee00510970 R08: 0000000000000000 R09: ffff9e6d19007800
[  824.276120] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
[  824.276121] R10: 0000000000000514 R11: ffffbcee00510a37 R12: ffff9e6cd950fb60
[  824.276120] RIP: 0010:tcp_create_openreq_child+0x2e1/0x3e0
[  824.276121] R13: ffff9e6ccf8d3480 R14: ffff9e6cd7c1e200 R15: ffff9e6d1305e600
[  824.276120] Code: 08 00 00 41 8b 84 24 18 01 00 00 48 c7 83 80 08 00 00 00 00 00 00 4c 89 e6 4c 89 ef 89 83 c4 05 00 00 49 8b 84 24 f8 00 00 00 <48> 8b 40 08 e8 b6 81 4b 00 48 85 c0 0f b7 83 68 05 00 00 74 0a 83
[  824.276121] FS:  0000000000000000(0000) GS:ffff9e6d1f940000(0000) knlGS:0000000000000000
[  824.276120] RSP: 0018:ffffbcee00460940 EFLAGS: 00010246
[  824.276121] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  824.276120] RAX: 0000000000000000 RBX: ffff9e6ce337a300 RCX: 0000000000000007
[  824.276121] CR2: 0000000000000008 CR3: 000000105216e004 CR4: 00000000003706e0
[  824.276120] RDX: 0000000000000020 RSI: ffff9e6ce6030ab0 RDI: ffff9e6ccf8d3480
[  824.276121] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  824.276120] RBP: ffffbcee00460960 R08: 0000000000000000 R09: ffff9e6d19007800
[  824.276121] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  824.276120] R10: ffffbcee00460868 R11: ffffbcee00460a27 R12: ffff9e6ce6030ab0

Revision history for this message

Andrea Righi (arighi) wrote on 2022-07-19:

#15

I think this might be fixed by `55573f3a3f352 tcp: make sure treq->af_specific is initialized` that is currently applied to 5.4.0-123.139 in focal-proposed.

It'd be great if someone that is able to reproduce the problem could try to install this new kernel from -proposed and verify if it's still happening.

Revision history for this message

lilideng (lilideng) wrote on 2022-07-19:

#16

We didn't have repro steps; customers encounter this in some rate. So we can't verify the commit.

Revision history for this message

c (squirrelsc) wrote on 2022-07-19:

#17

@arighi Is this fix in latest proposal of Azure kernel as well? We have customers met the same issue. We can ask customer to try the fix.

Revision history for this message

Andrea Righi (arighi) wrote on 2022-07-19:

#18

@squirrelsc the next Azure kernel in Focal that will have this fix is going to be 5.4.0-1087.92, but I don't see it in proposed yet. If it helps I can upload to a ppa an "unofficial" Azure kernel with the fix.

Revision history for this message

Andrea Righi (arighi) wrote on 2022-07-19:

#19

...or if it's easier, I've just uploaded some debs here:
https://kernel.ubuntu.com/~arighi/lp-1981658/

This kernel (5.4.0-1087.92+arighi) is probably going to be the Azure kernel in proposed and it includes the fix that I mentioned above.

Revision history for this message

c (squirrelsc) wrote on 2022-07-19:

#20

Thank you, Andrea. We're trying to repro it, but it's not so far. Can you create a proposed kernel, which includes this fix? Once we can reproduce it, will let you know asap. But we can prepare the proposal kernel in the meantime.

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2022-07-19:

#21

linux-azure 5.4.0-1087.92 with commit 55573f3a3f352 ("tcp: make sure treq->af_specific is initialized") is building in https://launchpad.net/~canonical-kernel-team/+archive/ubuntu/ppa/

Revision history for this message

c (squirrelsc) wrote on 2022-07-19:

#22

Thank you Tim, when this kernel can be released?

Revision history for this message

Haw Loeung (hloeung) wrote on 2022-07-20:

#23

It seems the latest in -proposed has fixed it for us.

| [hloeung@banjo ~]$ uname -a
| Linux banjo 5.4.0-123-generic #139~18.04.1-Ubuntu SMP Wed Jul 13 21:12:05 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
| [hloeung@banjo ~]$ uptime
| 01:06:47 up 44 min, 2 users, load average: 11.01, 11.21, 9.54

Where previously, it would kernel panic not too long after booting up.

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2022-07-20:

#24

@squirrelsc - Kernels with this fix are due for release Aug 1, 2022.

Revision history for this message

timeless (timeless) wrote on 2022-07-20:

#25

Fwiw I deployed this for our server yesterday and it's been up 21 hours, whereas before it didn't really survive for more than ~6 hours on 122...

Revision history for this message

halfgaar (wiebe-halfgaar) wrote on 2022-08-02:

#26

What's the status on the update? We're getting crashes on Ubuntu 18.04, Amazon kernel 5.4.0-1081-aws.

Revision history for this message

halfgaar (wiebe-halfgaar) wrote on 2022-08-02:

#27

The latest in bionic-proposed is 5.4.0-1082.89~18.04.1, but I can't find references to it being fixed there? The following page doesn't mention it:

https://www.ubuntuupdates.org/package/core/bionic/main/proposed/linux-aws-5.4

There is mention of another null dereference, but it's not this one.

Revision history for this message

Bodo Petermann (bpetermann) wrote on 2022-08-02:

#28

The changelog on ubuntuupdates is cut short.
See https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1082.89 instead. The fix is mentioned there (tcp: make sure treq->af_specific is initialized)

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2022-08-02:

#29

Due to Retbleed mitigation testing, the SRU cycle has been extended by one week. The new release date is Aug 8, 2022.

Tim Gardner (timg-tpi) on 2022-08-02

Changed in linux (Ubuntu Bionic):
status:	Confirmed → In Progress

Revision history for this message

Michael Scanlan (coinmover) wrote on 2022-08-04 (last edit on 2022-08-04):

#30

Just saw this, it's effecting 25,000 users and crashed my server. Can't get anything running now. Exact same error/problem. Using Digital Ocean as VPS provider. -121 was fine, was intoed in -122.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2022-08-09:

#31

Download full text (12.7 KiB)

This bug was fixed in the package linux - 4.15.0-191.202

---------------
linux (4.15.0-191.202) bionic; urgency=medium

  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain

* CVE-2022-2588
- SAUCE: net_sched: cls_route: remove from list when handle is 0

* CVE-2022-34918
- netfilter: nf_tables: stricter validation of element data

  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

linux (4.15.0-190.201) bionic; urgency=medium

* bionic/linux: 4.15.0-190.201 -proposed tracker (LP: #1981321)

* CVE-2022-1679
- SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

  * Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879)
    - MIPS: Use address-of operator on section symbols
    - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
    - can: grcan: grcan_probe(): fix broken system id check for errata workaround
      needs
    - can: grcan: only use the NAPI poll budget for RX
    - Bluetooth: Fix the creation of hdev->name
    - mmc: rtsx: add 74 Clocks in power on flow
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
    - ALSA: pcm: Fix races among concurrent prealloc proc writes
    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
    - VFS: Fix memory leak caused by concurrently mounting fs with subtype
    - batman-adv: Don't skb_split skbuffs with frag_list
    - net: Fix features skip in for_each_netdev_feature()
    - ipv4: drop dst in multicast routing path
    - netlink: do not reset transport header in netlink_recvmsg()
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - hwmon: (ltq-cputemp) restrict it to SOC_XWAY
    - s390/ctcm: fix variable dereferenced before check
    - s390/ctcm: fix potential memory leak
    - s390/lcs: fix variable dereferenced before check
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - hwmon: (f71882fg) Fix negative temperature
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - tcp: resalt the secret every 10 seconds
    - usb: cdc-wdm: fix reading stuck on device close
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
...

This bug was fixed in the package linux - 4.15.0-191.202

---------------
linux (4.15.0-191.202) bionic; urgency=medium

* CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain

* CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0

* CVE-2022-34918
    - netfilter: nf_tables: stricter validation of element data

* BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

linux (4.15.0-190.201) bionic; urgency=medium

* bionic/linux: 4.15.0-190.201 -proposed tracker (LP: #1981321)

* CVE-2022-1679
    - SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

* Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879)
    - MIPS: Use address-of operator on section symbols
    - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
    - can: grcan: grcan_probe(): fix broken system id check for errata workaround
      needs
    - can: grcan: only use the NAPI poll budget for RX
    - Bluetooth: Fix the creation of hdev->name
    - mmc: rtsx: add 74 Clocks in power on flow
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
    - ALSA: pcm: Fix races among concurrent prealloc proc writes
    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
    - VFS: Fix memory leak caused by concurrently mounting fs with subtype
    - batman-adv: Don't skb_split skbuffs with frag_list
    - net: Fix features skip in for_each_netdev_feature()
    - ipv4: drop dst in multicast routing path
    - netlink: do not reset transport header in netlink_recvmsg()
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - hwmon: (ltq-cputemp) restrict it to SOC_XWAY
    - s390/ctcm: fix variable dereferenced before check
    - s390/ctcm: fix potential memory leak
    - s390/lcs: fix variable dereferenced before check
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - hwmon: (f71882fg) Fix negative temperature
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - tcp: resalt the secret every 10 seconds
    - usb: cdc-wdm: fix reading stuck on device close
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
    - drm/vmwgfx: Initialize drm_mode_fb_cmd2
    - ping: fix address binding wrt vrf
    - tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
    - net/sched: act_pedit: really ensure the skb is writable
    - um: Cleanup syscall_handler_t definition/cast, fix warning
    - Input: add bounds checking to input_set_capability()
    - Input: stmfts - fix reference leak in stmfts_input_open
    - MIPS: lantiq: check the return value of kzalloc()
    - drbd: remove usage of list iterator variable after loop
    - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
    - ALSA: wavefront: Proper check of get_user() error
    - perf: Fix sys_perf_event_open() race against self
    - drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
    - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
    - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
    - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
    - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
    - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
    - clk: at91: generated: consider range when calculating best rate
    - net/qla3xxx: Fix a test in ql_reset_work()
    - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
    - ARM: 9196/1: spectre-bhb: enable for Cortex-A15
    - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
    - igb: skip phy status check where unavailable
    - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
    - gpio: gpio-vf610: do not touch other bits when set the target bit
    - gpio: mvebu/pwm: Refuse requests with inverted polarity
    - perf bench numa: Address compiler error on s390
    - scsi: qla2xxx: Fix missed DMA unmap for aborted commands
    - mac80211: fix rx reordering with non explicit / psmp ack policy
    - ethernet: tulip: fix missing pci_disable_device() on error in
      tulip_init_one()
    - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
    - net: atlantic: verify hw_head_ lies within TX buffer ring
    - swiotlb: fix info leak with DMA_FROM_DEVICE
    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
    - net: macb: Increment rx bd head after allocating skb and buffer
    - net/sched: act_pedit: sanitize shift argument before usage
    - afs: Fix afs_getattr() to refetch file status if callback break occurred
    - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
    - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
    - tcp: change source port randomizarion at connect() time
    - secure_seq: use the 64 bits of the siphash for port offset calculation
    - ACPI: sysfs: Make sparse happy about address space in use
    - Revert "UBUNTU: SAUCE: ACPI: sysfs: copy ACPI data using io memory copying"
    - ACPI: sysfs: Fix BERT error region memory mapping
    - net: af_key: check encryption module availability consistency
    - net: ftgmac100: Disable hardware checksum on AST2600
    - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI
      controllers
    - assoc_array: Fix BUG_ON during garbage collect
    - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
    - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
    - exec: Force single empty string when argv is empty
    - netfilter: conntrack: re-fetch conntrack after insertion
    - zsmalloc: fix races between asynchronous zspage free and page migration
    - dm integrity: fix error code in dm_integrity_ctr()
    - dm crypt: make printing of the key constant-time
    - dm stats: add cond_resched when looping over entries
    - dm verity: set DM_TARGET_IMMUTABLE feature flag
    - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
    - docs: submitting-patches: Fix crossref to 'The canonical patch format'
    - NFSD: Fix possible sleep during nfsd4_release_lockowner()
    - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes

* Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355)
    - floppy: disable FDRAWCMD by default
    - [Config] updateconfigs for BLK_DEV_FD_RAWCMD
    - hamradio: defer 6pack kfree after unregister_netdev
    - hamradio: remove needs_free_netdev to avoid UAF
    - lightnvm: disable the subsystem
    - [Config] updateconfigs for NVM, NVM_PBLK
    - usb: mtu3: fix USB 3.0 dual-role-switch from device to host
    - USB: quirks: add a Realtek card reader
    - USB: quirks: add STRING quirk for VCOM device
    - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
    - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
    - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
    - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
    - xhci: stop polling roothubs after shutdown
    - iio: dac: ad5592r: Fix the missing return value.
    - iio: dac: ad5446: Fix read_raw not returning set value
    - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
    - usb: misc: fix improper handling of refcount in uss720_probe()
    - usb: gadget: uvc: Fix crash when encoding data for usb request
    - usb: gadget: configfs: clear deactivation flag in
      configfs_composite_unbind()
    - serial: 8250: Also set sticky MCR bits in console restoration
    - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
    - hex2bin: make the function hex_to_bin constant-time
    - hex2bin: fix access beyond string end
    - USB: Fix xhci event ring dequeue pointer ERDP update issue
    - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
    - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
    - phy: samsung: exynos5250-sata: fix missing device put in probe error paths
    - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
    - ARM: dts: Fix mmc order for omap3-gta04
    - ipvs: correctly print the memory size of ip_vs_conn_tab
    - mtd: rawnand: Fix return value check of wait_for_completion_timeout
    - sctp: check asoc strreset_chunk in sctp_generate_reconf_event
    - pinctrl: pistachio: fix use of irq_of_parse_and_map()
    - ip_gre: Make o_seqno start from 0 in native mode
    - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
    - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
    - clk: sunxi: sun9i-mmc: check return value after calling
      platform_get_resource()
    - net: bcmgenet: hide status block before TX timestamping
    - bnx2x: fix napi API usage sequence
    - ASoC: wm8731: Disable the regulator when probing fails
    - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
    - cifs: destage any unwritten data to the server before calling
      copychunk_write
    - drivers: net: hippi: Fix deadlock in rr_close()
    - x86/cpu: Load microcode during restore_processor_state()
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
    - tty: n_gsm: fix malformed counter for out of frame data
    - tty: n_gsm: fix insufficient txframe size
    - tty: n_gsm: fix missing explicit ldisc flush
    - tty: n_gsm: fix wrong command retry handling
    - tty: n_gsm: fix wrong command frame length field encoding
    - tty: n_gsm: fix incorrect UA handling
    - MIPS: Fix CP0 counter erratum detection for R4k CPUs
    - parisc: Merge model and model name into one line in /proc/cpuinfo
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
    - firewire: fix potential uaf in outbound_phy_packet_callback()
    - firewire: remove check of list iterator against head past the loop body
    - firewire: core: extend card->lock in fw_core_handle_bus_reset
    - ASoC: wm8958: Fix change notifications for DSP controls
    - can: grcan: grcan_close(): fix deadlock
    - can: grcan: use ofdev->dev when allocating DMA memory
    - nfc: replace improper check device_is_registered() in netlink related
      functions
    - NFC: netlink: fix sleep in atomic bug when firmware download timeout
    - hwmon: (adt7470) Fix warning on module removal
    - ASoC: dmaengine: Restore NULL prepare_slave_config() callback
    - net: emaclite: Add error handling for of_address_to_resource()
    - smsc911x: allow using IRQ0
    - btrfs: always log symlinks in full mode
    - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
    - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
    - net: ipv6: ensure we call ipv6_mc_down() at most once
    - dm: fix mempool NULL pointer race when completing IO
    - dm: interlock pending dm_io and dm_wait_for_bios_completion
    - PCI: aardvark: Clear all MSIs at setup
    - PCI: aardvark: Fix reading MSI interrupt number
    - tcp: md5: incorrect tcp_header_len for incoming connections
    - net: hns3: add validity check for message data length
    - genirq: Synchronize interrupt thread startup
    - net: stmmac: dwmac-sun8i: add missing of_node_put() in
      sun8i_dwmac_register_mdio_mux()
    - mm: fix unexpected zeroed page mapping with zram swap

* unprivileged tests in test_verifier from ubuntu_bpf failed with "Failed to
    load prog 'Operation not permitted'" on B-4.15 (LP: #1980648)
    - selftests/bpf: Count tests skipped by unpriv
    - selftests/bpf: Only run tests if !bpf_disabled

* CVE-2022-1734
    - nfc: nfcmrvl: main: reorder destructive operations in
      nfcmrvl_nci_unregister_dev to avoid bugs

* CVE-2022-1652
    - floppy: use a statically allocated error counter

-- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Wed, 03 Aug 2022 22:18:18 -0300

Changed in linux (Ubuntu Bionic):
status:	In Progress → Fix Released

Revision history for this message

Rajiv Ginotra (rajivginotra) wrote on 2023-02-24 (last edit on 2023-02-24):

#32

Download full text (7.0 KiB)

Is anybody knows the steps to reproduce this issue? We are also facing the same below TB in our testbed and we are planning to take the patch mentioned in comment #15.

Even though we are using this kernel from long time and seen this issue on very few nodes.

Appreciate your help in this regard.

Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.026015] TCP: request_sock_TCP: Possible SYN flooding on port 8033. Sending cookies. Check SNMP counters.
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.027529] BUG: kernel NULL pointer dereference, address: 0000000000000008
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.035339] #PF: supervisor read access in kernel mode
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.041083] #PF: error_code(0x0000) - not-present page
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.046838] PGD 0 P4D 0
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.049670] Oops: 0000 [#1] SMP NOPTI
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.053764] CPU: 36 PID: 230 Comm: ksoftirqd/36 Not tainted 5.4.0-122-generic #138~18.04.1
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.063007] Hardware name: Cisco Systems Inc DN2-HW-APL-L/UCSC-C220-M5SX, BIOS C220M5.4.1.3i.0.0713210713 07/13/2021
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.074770] RIP: 0010:tcp_create_openreq_child+0x2e1/0x3e0
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.080907] Code: 08 00 00 41 8b 84 24 18 01 00 00 48 c7 83 80 08 00 00 00 00 00 00 4c 89 e6 4c 89 ef 89 83 c4 05 00 00 49 8b 84 24 f8 00 00 00 <48> 8b 40 08 e8 96 b8 41 00 48 85 c0 0f b7 83 68 05 00 00 74 0a 83
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.101919] RSP: 0018:ffff97b88d207a28 EFLAGS: 00010246
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.107764] RAX: 0000000000000000 RBX: ffff8abb9d1bc600 RCX: 0000000000000007
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.115745] RDX: 0000000000000020 RSI: ffff8abb3c6e1560 RDI: ffff8acdef1b9180
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.123722] RBP: ffff97b88d207a48 R08: 0000000000000000 R09: ffff8aacffc07800
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.131699] R10: 0000000000000514 R11: ffff97b88d207b0f R12: ffff8abb3c6e1560
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.139678] R13: ffff8acdef1b9180 R14: ffff8abdfc1a7500 R15: ffff8adc75529ec0
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.147655] FS: 0000000000000000(0000) GS:ffff8adcff000000(0000) knlGS:0000000000000000
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.156705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.163144] CR2: 0000000000000008 CR3: 000000594ea0a005 CR4: 00000000007606e0
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.171120] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.179099] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Feb 22 22:20:47 maglev-master-192-168-70-10 kernel: [14501.187076] PKRU: 5...

	Status	Importance	Assigned to
linux (Ubuntu)	Confirmed	Undecided	Unassigned
Bionic	Fix Released	Undecided	Unassigned
linux-hwe-5.4 (Ubuntu)	Confirmed	Undecided	Unassigned
Bionic	Confirmed	Undecided	Unassigned
linux-hwe-6.2 (Ubuntu)	New	Undecided	Unassigned
Bionic	New	Undecided	Unassigned

Ubuntu
linux-hwe-5.4 package

BUG: kernel NULL pointer dereference, address: 0000000000000008

Bug Description

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntulinux-hwe-5.4 package

BUG: kernel NULL pointer dereference, address: 0000000000000008

Bug Description

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux-hwe-5.4 package