Bug #861296 “mmap fails to allocate 2030Mb heap on ARM” : Lucid (10.04) : Bugs : linux-fsl-imx51 package : Ubuntu

Revision history for this message

Xerxes Rånby (xranby) wrote on 2011-09-28:

#1

mmap-test.c testcase Edit (569 bytes, text/plain)

description:

updated

Matthias Klose (doko) on 2011-09-28

tags:

added: arm-porting-queue

Revision history for this message

Dr. David Alan Gilbert (davidgil-uk) wrote on 2011-09-28:

#2

This is an artefact of a different in where the libraries are mapped on the two architectures.

On ARM we have;
   executable
   heap
                        <---- ~1GB
   libs
                        <---- ~3GB
  stack

So there isn't one big 2GB chunk to allocate.

On x86 they have:
   executable
   heap
                       <--- ~3GB
   libs

I don't know why ARM does it this way however and whether it's changeable.

Dave

Revision history for this message

Xerxes Rånby (xranby) wrote on 2011-09-28:

#3

mmap-test-slices.c testcase Edit (1.1 KiB, text/plain)

updated testcase that try to allocate the memory rande using multiple smaller memory slices.

For example my ac100 fails to allocate 2010mb using 30*67Mb slices.

Revision history for this message

Dr. David Alan Gilbert (davidgil-uk) wrote on 2011-09-28:

#4

Download full text (5.1 KiB)

That one is much more fun; running under gdb it fails at:

2031Mb allocated using slize size = 5*406Mb OK
2031Mb allocated using slize size = 4*507Mb OK
Couldn't allocate the heap: 2031Mb
slize size = 677Mb slize no= 2/3

I added debug to print the pointers:

Slize 2 @ 0xffffffff
Slize 1 @ 0x6a613000
Slize 0 @ 0x40113000

and /proc/.../maps looks like:

daveg@panda-01:~$ cat /proc/19930/maps
00008000-00009000 r-xp 00000000 b3:02 61316 /home/daveg/t2
00010000-00011000 r--p 00000000 b3:02 61316 /home/daveg/t2
00011000-00012000 rw-p 00001000 b3:02 61316 /home/daveg/t2
40000000-40016000 r-xp 00000000 b3:02 189877 /lib/arm-linux-gnueabi/ld-2.13.so
40016000-4001a000 rw-p 00000000 00:00 0
4001d000-4001e000 r--p 00015000 b3:02 189877 /lib/arm-linux-gnueabi/ld-2.13.so
4001e000-4001f000 rw-p 00016000 b3:02 189877 /lib/arm-linux-gnueabi/ld-2.13.so
40031000-40106000 r-xp 00000000 b3:02 189898 /lib/arm-linux-gnueabi/libc-2.13.so
40106000-4010d000 ---p 000d5000 b3:02 189898 /lib/arm-linux-gnueabi/libc-2.13.so
4010d000-4010f000 r--p 000d4000 b3:02 189898 /lib/arm-linux-gnueabi/libc-2.13.so
4010f000-40110000 rw-p 000d6000 b3:02 189898 /lib/arm-linux-gnueabi/libc-2.13.so
40110000-94b13000 rw-p 00000000 00:00 0
befdf000-bf000000 rw-p 00000000 00:00 0 [stack]
ffff0000-ffff1000 r-xp 00000000 00:00 0 [vectors]

ulimit -a shows:
virtual memory (kbytes, -v) unlimited

and max memory size is also:
max memory size (kbytes, -m) unlimited

What's happening here is that the 3rd map would run into the stack, and it's not using the heap space below the libraries,
but instead it's failing.

2010Mb allocated using slize size = 32*62Mb OK
2010Mb allocated using slize size = 31*64Mb OK
Couldn't allocate the heap: 2010Mb
slize size = 67Mb slize no= 29/30
Slize 29 @ 0xffffffff
Slize 28 @ 0xb64c3000
Slize 27 @ 0xb215d000
Slize 26 @ 0xaddd9000
Slize 25 @ 0xa9ad2000
Slize 24 @ 0xa5707000
Slize 23 @ 0xa13e7000
Slize 22 @ 0x9d0df000
Slize 21 @ 0x98d8d000
Slize 20 @ 0x949a7000
Slize 19 @ 0x905d9000
Slize 18 @ 0x8c280000
Slize 17 @ 0x87e8d000
Slize 16 @ 0x83ab7000
Slize 15 @ 0x7f767000
Slize 14 @ 0x7b3bf000
Slize 13 @ 0x77022000
Slize 12 @ 0x72c5e000
Slize 11 @ 0x6e8a1000
Slize 10 @ 0x6a55e000
Slize 9 @ 0x6617a000
Slize 8 @ 0x61ddf000
Slize 7 @ 0x5da1e000
Slize 6 @ 0x59671000
Slize 5 @ 0x552e8000
Slize 4 @ 0x50fe1000
Slize 3 @ 0x4cca7000
Slize 2 @ 0x48954000
Slize 1 @ 0x4460a000
Slize 0 @ 0x402fa000
^Z
[2]+ Stopped ./t2
daveg@panda-01:~$ ps -eaf|grep t2
daveg 19928 19775 0 14:38 pts/1 00:00:01 gdb ./t2
daveg 19930 19928 0 14:38 pts/1 00:00:00 /home/daveg/t2
daveg 19975 19775 3 14:42 pts/1 00:00:00 ./t2
daveg 19977 19775 0 14:42 pts/1 00:00:00 grep --color=auto t2
daveg@panda-01:~$ cat /proc/19975/maps
00008000-00009000 r-xp 00000000 b3:02 61317 /home/daveg/t2
00010000-00011000 r--p 00000000 b3:02 61317 /home/daveg/t2
00011000-00012000 rw-p 00001000 b3:02 61317 /home/daveg/t2
4005a000-40070000 r-xp 00000000 b3:02 189877 /lib/arm-linux-gnueabi/ld-2.13.so
40070000-40071000 rw-p 00000000 00:00 0
40077000-40078000 r--p 00015000 b3:02 189877 ...

That one is much more fun; running under gdb it fails at:

2031Mb allocated using slize size = 5*406Mb OK
2031Mb allocated using slize size = 4*507Mb OK
Couldn't allocate the heap: 2031Mb
slize size = 677Mb slize no= 2/3

I added debug to print the pointers:

Slize 2 @ 0xffffffff
Slize 1 @ 0x6a613000
Slize 0 @ 0x40113000

and /proc/.../maps looks like:

daveg@panda-01:~$ cat /proc/19930/maps 
00008000-00009000 r-xp 00000000 b3:02 61316      /home/daveg/t2
00010000-00011000 r--p 00000000 b3:02 61316      /home/daveg/t2
00011000-00012000 rw-p 00001000 b3:02 61316      /home/daveg/t2
40000000-40016000 r-xp 00000000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
40016000-4001a000 rw-p 00000000 00:00 0 
4001d000-4001e000 r--p 00015000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
4001e000-4001f000 rw-p 00016000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
40031000-40106000 r-xp 00000000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
40106000-4010d000 ---p 000d5000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
4010d000-4010f000 r--p 000d4000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
4010f000-40110000 rw-p 000d6000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
40110000-94b13000 rw-p 00000000 00:00 0 
befdf000-bf000000 rw-p 00000000 00:00 0          [stack]
ffff0000-ffff1000 r-xp 00000000 00:00 0          [vectors]

ulimit -a shows:
virtual memory          (kbytes, -v) unlimited

and max memory size is also:
max memory size         (kbytes, -m) unlimited

What's happening here is that the 3rd map would run into the stack, and it's not using the heap space below the libraries,
but instead it's failing.

2010Mb allocated using slize size = 32*62Mb OK
2010Mb allocated using slize size = 31*64Mb OK
Couldn't allocate the heap: 2010Mb
slize size = 67Mb slize no= 29/30
Slize 29 @ 0xffffffff
Slize 28 @ 0xb64c3000
Slize 27 @ 0xb215d000
Slize 26 @ 0xaddd9000
Slize 25 @ 0xa9ad2000
Slize 24 @ 0xa5707000
Slize 23 @ 0xa13e7000
Slize 22 @ 0x9d0df000
Slize 21 @ 0x98d8d000
Slize 20 @ 0x949a7000
Slize 19 @ 0x905d9000
Slize 18 @ 0x8c280000
Slize 17 @ 0x87e8d000
Slize 16 @ 0x83ab7000
Slize 15 @ 0x7f767000
Slize 14 @ 0x7b3bf000
Slize 13 @ 0x77022000
Slize 12 @ 0x72c5e000
Slize 11 @ 0x6e8a1000
Slize 10 @ 0x6a55e000
Slize 9 @ 0x6617a000
Slize 8 @ 0x61ddf000
Slize 7 @ 0x5da1e000
Slize 6 @ 0x59671000
Slize 5 @ 0x552e8000
Slize 4 @ 0x50fe1000
Slize 3 @ 0x4cca7000
Slize 2 @ 0x48954000
Slize 1 @ 0x4460a000
Slize 0 @ 0x402fa000
^Z
[2]+  Stopped                 ./t2
daveg@panda-01:~$ ps -eaf|grep t2
daveg    19928 19775  0 14:38 pts/1    00:00:01 gdb ./t2
daveg    19930 19928  0 14:38 pts/1    00:00:00 /home/daveg/t2
daveg    19975 19775  3 14:42 pts/1    00:00:00 ./t2
daveg    19977 19775  0 14:42 pts/1    00:00:00 grep --color=auto t2
daveg@panda-01:~$ cat /proc/19975/maps 
00008000-00009000 r-xp 00000000 b3:02 61317      /home/daveg/t2
00010000-00011000 r--p 00000000 b3:02 61317      /home/daveg/t2
00011000-00012000 rw-p 00001000 b3:02 61317      /home/daveg/t2
4005a000-40070000 r-xp 00000000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
40070000-40071000 rw-p 00000000 00:00 0 
40077000-40078000 r--p 00015000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
40078000-40079000 rw-p 00016000 b3:02 189877     /lib/arm-linux-gnueabi/ld-2.13.so
400b5000-400b7000 rw-p 00000000 00:00 0 
400f4000-400f5000 rw-p 00000000 00:00 0 
40218000-402ed000 r-xp 00000000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
402ed000-402f4000 ---p 000d5000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
402f4000-402f6000 r--p 000d4000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
402f6000-402f7000 rw-p 000d6000 b3:02 189898     /lib/arm-linux-gnueabi/libc-2.13.so
402f7000-445fa000 rw-p 00000000 00:00 0 
4460a000-4890a000 rw-p 00000000 00:00 0 
48954000-4cc54000 rw-p 00000000 00:00 0 
4cca7000-50fa7000 rw-p 00000000 00:00 0 
50fe1000-552e1000 rw-p 00000000 00:00 0 
552e8000-595e8000 rw-p 00000000 00:00 0 
59671000-5d971000 rw-p 00000000 00:00 0 
5da1e000-61d1e000 rw-p 00000000 00:00 0 
61ddf000-660df000 rw-p 00000000 00:00 0 
6617a000-6a47a000 rw-p 00000000 00:00 0 
6a55e000-6e85e000 rw-p 00000000 00:00 0 
6e8a1000-72ba1000 rw-p 00000000 00:00 0 
72c5e000-76f5e000 rw-p 00000000 00:00 0 
77022000-7b322000 rw-p 00000000 00:00 0 
7b3bf000-7f6bf000 rw-p 00000000 00:00 0 
7f767000-83a67000 rw-p 00000000 00:00 0 
83ab7000-87db7000 rw-p 00000000 00:00 0 
87e8d000-8c18d000 rw-p 00000000 00:00 0 
8c280000-90580000 rw-p 00000000 00:00 0 
905d9000-948d9000 rw-p 00000000 00:00 0 
949a7000-98ca7000 rw-p 00000000 00:00 0 
98d8d000-9d08d000 rw-p 00000000 00:00 0 
9d0df000-a13df000 rw-p 00000000 00:00 0 
a13e7000-a56e7000 rw-p 00000000 00:00 0 
a5707000-a9a07000 rw-p 00000000 00:00 0 
a9ad2000-addd2000 rw-p 00000000 00:00 0 
addd9000-b20d9000 rw-p 00000000 00:00 0 
b215d000-b645d000 rw-p 00000000 00:00 0 
b64c3000-ba7c3000 rw-p 00000000 00:00 0 
be9fa000-bea1b000 rw-p 00000000 00:00 0          [stack]
ffff0000-ffff1000 r-xp 00000000 00:00 0          [vectors]

Here it's the same - we're running out of space at the top, and not using the space below 4......

(Are we supposed to?)

Dave

Revision history for this message

Ulrich Weigand (uweigand) wrote on 2011-09-28:

#5

Note that all this is decided by the kernel's mmap area allocation strategy; see the various "get_unmapped_area" routines in platform-specific kernel code (e.g arch/arm/mm/mmap.c:arch_get_unmapped_area vs. x86/kernel/sys_x86_64.c:arch_get_unmapped_area_topdown).

If any change is required here (and this behaviour *was* in fact changed on x86; they used to behave the same way arm still does), it needs to be done on the kernel side.

Matthias Klose (doko) on 2011-10-25

affects:	eglibc (Ubuntu) → linux (Ubuntu)
Changed in linux (Ubuntu):
importance:	Undecided → High
status:	New → Confirmed

Revision history for this message

Rob Herring (r-herring) wrote on 2011-11-07:

#6

The necessary kernel support for this is posted here:

http://lists.infradead.org/pipermail/linux-arm-kernel/2011-November/071777.html
http://lists.infradead.org/pipermail/linux-arm-kernel/2011-November/071778.html

Revision history for this message

Matthias Klose (doko) wrote on 2011-11-24:

#7

needed on the buildds as well (running oneiric)

Changed in linux (Ubuntu Oneiric):
status:	New → Confirmed

Revision history for this message

Paolo Pisati (p-pisati) wrote on 2011-11-24:

#8

here is latest oneiric/omap4 kernel with the rherring patchset from rmk patch system:

http://people.canonical.com/~ppisati/lp861296/linux-image-3.0.0-1206-omap4_3.0.0-1206.13~lp861296_armel.deb

works on my panda, please try it on our oneiric/omap4 builders.

Revision history for this message

Paolo Pisati (p-pisati) wrote on 2011-11-24:

#9

http://people.canonical.com/~ppisati/lp861296/linux-image-2.6.38-1209-omap4_2.6.38-1209.17~lp861296_armel.deb

same as above, but this time for natty/omap4

Revision history for this message

Paolo Pisati (p-pisati) wrote on 2011-11-24:

#10

http://people.canonical.com/~ppisati/lp861296/linux-image-2.6.31-612-imx51_2.6.31-612.30~lp861296_armel.deb

and here is a lucid/imx51 version.

Revision history for this message

Tobin Davis (gruemaster) wrote on 2011-11-24:

#11

Tested both kernels in their respective images. After increasing swap to 4G, both testcases ran ok.

Revision history for this message

Xerxes Rånby (xranby) wrote on 2011-11-25:

#12

It work! Now java applications can use up to around -Xmx2909M on the panda.
This will allow compilation of eclipse on ARM where -Xmx2048M are in use.

As a bonus java applications can run 50% more concurrent threads with the patched kernel.

Revision history for this message

LaMont Jones (lamont) wrote on 2011-11-28:

#13

the above lucid kernel works on bbg3 with lucid

Revision history for this message

Tobin Davis (gruemaster) wrote on 2011-11-29:

#14

Should this bug be amended to ensure that this patch gets into all armel kernels during the next SRU cycle? I have tested all available test kernels and with the patch, I can now run test-kernel-aslr-collisions from the qa-regression-tests w/o failures. Plus, it sounds like it enables a lot more for more users.

Matthias Klose (doko) on 2011-11-29

Changed in linux (Ubuntu Lucid):
status:	New → Confirmed

Tim Gardner (timg-tpi) on 2011-12-05

Changed in linux (Ubuntu Natty):
status:	New → Fix Committed
Changed in linux (Ubuntu Oneiric):
status:	Confirmed → Fix Committed
Changed in linux (Ubuntu Maverick):
status:	New → Fix Committed
Changed in linux (Ubuntu Lucid):
status:	Confirmed → Invalid
Changed in linux (Ubuntu Maverick):
status:	Fix Committed → Invalid
Changed in linux (Ubuntu Natty):
status:	Fix Committed → Fix Released
Changed in linux (Ubuntu Oneiric):
status:	Fix Committed → Fix Released
Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	New → Fix Committed

Tim Gardner (timg-tpi) on 2011-12-05

Changed in linux-fsl-imx51 (Ubuntu Maverick):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Natty):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Oneiric):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Maverick):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Natty):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Oneiric):
status:	New → Fix Committed
Changed in linaro-toolchain-misc:
status:	New → Invalid
Changed in linux (Ubuntu):
status:	Confirmed → Invalid
Changed in linux (Ubuntu Precise):
status:	Invalid → Fix Released
Changed in linux-fsl-imx51 (Ubuntu Precise):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Precise):
status:	New → Fix Released

Jani Monoses (jani) on 2011-12-06

no longer affects:	linux-ac100 (Ubuntu Lucid)
no longer affects:	linux-ac100 (Ubuntu Maverick)
no longer affects:	linux-ac100 (Ubuntu Natty)

Jani Monoses (jani) on 2011-12-14

Changed in linux-ac100 (Ubuntu Precise):
status:	New → Fix Released

Jani Monoses (jani) on 2011-12-14

Changed in linux-ac100 (Ubuntu Precise):
status:	Fix Released → Confirmed
Changed in linux-ac100 (Ubuntu Oneiric):
status:	New → Confirmed

Revision history for this message

Jani Monoses (jani) wrote on 2011-12-14:

#15

I see no change to exported functions in the patch, but is it introducing an ABI change that needs a ABI number bump in the debian packaging?

Kate Stewart (kate.stewart) on 2011-12-16

tags:

added: rls-mgr-p-tracking

Revision history for this message

Matthias Klose (doko) wrote on 2011-12-19:

#16

checked that linux-ti-omap4 (3.0.0-1206.14) oneiric-proposed; urgency=low
fixes the issue (https://launchpad.net/~canonical-kernel-team/+archive/ppa/+packages).

Revision history for this message

Martin Pitt (pitti) wrote on 2011-12-20:

#17

Please fix linux-ac100 in precise, otherwise this can't progress into -updates.

Changed in linux-ac100 (Ubuntu Oneiric):
status:	Confirmed → Fix Committed

Revision history for this message

Martin Pitt (pitti) wrote on 2011-12-20: Please test proposed package

#18

Hello Xerxes, or anyone else affected,

Accepted linux-ac100 into oneiric-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Revision history for this message

Xerxes Rånby (xranby) wrote on 2011-12-25:

#19

Both testcases pass ok!
when using the linux-ac100 linux-image-2.6.38-1001-ac100_2.6.38-1001.2_armel.deb from oneiric-proposed
,with 3Gb swap added, on my ac100.

Jani Monoses (jani) on 2012-01-09

Changed in linux-ac100 (Ubuntu Precise):
status:	Confirmed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-01-09:

#20

This bug was fixed in the package linux-ac100 - 2.6.38-1001.2

---------------
linux-ac100 (2.6.38-1001.2) oneiric-proposed; urgency=low

* Cherry pick two patches from upstream 3.x branch to fix
mmap()-ing large memory chunks. (LP: #861296)
-- Jani Monoses <email address hidden> Thu, 15 Dec 2011 09:58:05 +0200

Changed in linux-ac100 (Ubuntu Oneiric):
status:	Fix Committed → Fix Released

Revision history for this message

Herton R. Krzesinski (herton) wrote on 2012-01-27:

#21

This bug is awaiting verification that the omap kernel for Maverick in -proposed (linux-image-2.6.35-32-omap 2.6.35-32.65) solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-maverick' to 'verification-done-maverick'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-maverick

Revision history for this message

Herton R. Krzesinski (herton) wrote on 2012-01-27:

#22

Also we are awaiting verification for Natty (linux-image-2.6.38-13-omap 2.6.38-13.55). If the problem is solved, change the tag 'verification-needed-natty' to 'verification-done-natty'.

tags:

added: verification-needed-natty

Revision history for this message

Herton R. Krzesinski (herton) wrote on 2012-01-27:

#23

The same with oneiric as well (linux-image-3.0.0-16-omap >= 3.0.0-16.27)

tags:

added: verification-needed-oneiric

Herton R. Krzesinski (herton) on 2012-02-02

Changed in linux (Ubuntu Maverick):
status:	Invalid → Fix Committed
Changed in linux (Ubuntu Natty):
status:	Fix Released → Fix Committed
Changed in linux (Ubuntu Oneiric):
status:	Fix Released → Fix Committed

Revision history for this message

Tobin Davis (gruemaster) wrote on 2012-02-03:

#24

Tested Natty and Oneiric. Both passed. Not currently able to test Maverick as support for my board happened in Natty. Will dig out old beagleboard (C4) and try it tomorrow.

tags:

added: verification-done-natty verification-done-oneiric
removed: verification-needed-natty verification-needed-oneiric

Revision history for this message

Tobin Davis (gruemaster) wrote on 2012-02-03:

#25

tested Maverick. Mem tests passed with no problems.

tags:

added: verification-done-maverick
removed: verification-needed-maverick

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-10:

#26

This bug was fixed in the package linux - 2.6.35-32.65

---------------
linux (2.6.35-32.65) maverick-proposed; urgency=low

[Brad Figg]

* Release Tracking Bug
- LP: #920677

[ Upstream Kernel Changes ]

  * fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message, CVE-2011-3353
    - LP: #905058
    - CVE-2011-3353
  * KVM: x86: Prevent starting PIT timers in the absence of irqchip support
    - LP: #911303
    - CVE-2011-4622
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #805341
  * use cache type functions for arch_get_unmapped_area
    - LP: #861296
  * topdown mmap support
    - LP: #861296
  * xfs: validate acl count
    - LP: #917706
    - CVE-2012-0038
  * xfs: fix acl count validation in xfs_acl_from_disk()
    - LP: #917706
    - CVE-2012-0038
  * drm: integer overflow in drm_mode_dirtyfb_ioctl()
    - LP: #917838
    - CVE-2012-0044
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #647043
  * PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB
    - LP: #647043
-- Brad Figg <email address hidden> Mon, 23 Jan 2012 13:40:13 -0800

Changed in linux (Ubuntu Maverick):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-10:

#27

This bug was fixed in the package linux - 2.6.38-13.55

---------------
linux (2.6.38-13.55) natty-proposed; urgency=low

[Brad Figg]

* Release Tracking Bug
- LP: #920790

[ Upstream Kernel Changes ]

  * fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message, CVE-2011-3353
    - LP: #905058
    - CVE-2011-3353
  * KVM: x86: Prevent starting PIT timers in the absence of irqchip support
    - LP: #911303
    - CVE-2011-4622
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #805341
  * use cache type functions for arch_get_unmapped_area
    - LP: #861296
  * topdown mmap support
    - LP: #861296
  * xfs: validate acl count
    - LP: #917706
    - CVE-2012-0038
  * xfs: fix acl count validation in xfs_acl_from_disk()
    - LP: #917706
    - CVE-2012-0038
  * drm: integer overflow in drm_mode_dirtyfb_ioctl()
    - LP: #917838
    - CVE-2012-0044
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #647043
  * PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that
    - LP: #647043
-- Brad Figg <email address hidden> Mon, 23 Jan 2012 18:31:33 -0800

Changed in linux (Ubuntu Natty):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-10:

#28

Download full text (14.0 KiB)

This bug was fixed in the package linux-ti-omap4 - 3.0.0-1207.16

---------------
linux-ti-omap4 (3.0.0-1207.16) oneiric-proposed; urgency=low

* Release Tracking Bug
- LP: #922006

[ Upstream Kernel Changes ]

* omap4: add 4430 ES2.3 support
- LP: #917264

[ Ubuntu: 3.0.0-16.27 ]

  * Release Tracking Bug
    - LP: #920735
  * Revert "SAUCE: omap3: beagle: if rev unknown, assume xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision B"
    - LP: #912199
  * Revert "SAUCE: omap3: beaglexm: fix DVI initialization"
    - LP: #912199
  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346
  * Revert "rtc: Disable the alarm in the hardware"
    - LP: #913373
  * Support for Terratec G1
    - LP: #821061
  * drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
    - LP: #825777
  * drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP
    bridges (v2)
    - LP: #825777
  * drm/radeon/kms: cleanup atombios_adjust_pll()
    - LP: #825777
  * drm/radeon/kms/atom: rework encoder dpms
    - LP: #825777
  * drm/radeon/kms: check for DP MST mode in a few more places (v2)
    - LP: #825777
  * drm/radeon/kms: rework DP bridge checks
    - LP: #825777
  * drm/radeon/kms: fix DP setup on TRAVIS bridges
    - LP: #825777
  * ALSA: sis7019 - give slow codecs more time to reset
    - LP: #907778
  * ALSA: hda/realtek - Fix Oops in alc_mux_select()
    - LP: #907778
  * alarmtimers: Fix time comparison
    - LP: #907778
  * ARM: davinci: da850 evm: change audio edma event queue to EVENTQ_0
    - LP: #907778
  * arm: mx23: recognise stmp378x as mx23
    - LP: #907778
  * ARM: at91: fix clock conid for atmel_tcb.1 on 9260/9g20
    - LP: #907778
  * ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode
    - LP: #907778
  * ASoC: Provide a more complete DMA driver stub
    - LP: #907778
  * fs/proc/meminfo.c: fix compilation error
    - LP: #907778
  * thp: add compound tail page _mapcount when mapped
    - LP: #907778
  * thp: set compound tail page _count to zero
    - LP: #907778
  * ptp: Fix clock_getres() implementation
    - LP: #907778
  * mm: Ensure that pfn_valid() is called once per pageblock when reserving
    pageblocks
    - LP: #907778
  * mm: vmalloc: check for page allocation failure before vmlist insertion
    - LP: #907778
  * fix apparmor dereferencing potentially freed dentry, sanitize
    __d_path() API
    - LP: #907778
  * target: Handle 0 correctly in transport_get_sectors_6()
    - LP: #907778
  * intel-iommu: fix return value of iommu_unmap() API
    - LP: #907778
  * intel-iommu: set iommu_superpage on VM domains to lowest common
    denominator
    - LP: #907778
  * intel-iommu: fix superpage support in pfn_to_dma_pte()
    - LP: #907778
  * percpu: fix chunk range calculation
    - LP: #907778
  * iwlwifi: do not re-configure HT40 after associated
    - LP: #907778
  * mac80211: fix race condition caused by late addBA response
    - LP: #907778
  * linux/log2.h: Fix rounddown_pow_of_two(1)
    - LP: #907778
  * hwmon: (jz4740) fix signedness bug
   ...

This bug was fixed in the package linux-ti-omap4 - 3.0.0-1207.16

---------------
linux-ti-omap4 (3.0.0-1207.16) oneiric-proposed; urgency=low

* Release Tracking Bug
    - LP: #922006

[ Upstream Kernel Changes ]

* omap4: add 4430 ES2.3 support
    - LP: #917264

[ Ubuntu: 3.0.0-16.27 ]

* Release Tracking Bug
    - LP: #920735
  * Revert "SAUCE: omap3: beagle: if rev unknown, assume xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision B"
    - LP: #912199
  * Revert "SAUCE: omap3: beaglexm: fix DVI initialization"
    - LP: #912199
  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346
  * Revert "rtc: Disable the alarm in the hardware"
    - LP: #913373
  * Support for Terratec G1
    - LP: #821061
  * drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
    - LP: #825777
  * drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP
    bridges (v2)
    - LP: #825777
  * drm/radeon/kms: cleanup atombios_adjust_pll()
    - LP: #825777
  * drm/radeon/kms/atom: rework encoder dpms
    - LP: #825777
  * drm/radeon/kms: check for DP MST mode in a few more places (v2)
    - LP: #825777
  * drm/radeon/kms: rework DP bridge checks
    - LP: #825777
  * drm/radeon/kms: fix DP setup on TRAVIS bridges
    - LP: #825777
  * ALSA: sis7019 - give slow codecs more time to reset
    - LP: #907778
  * ALSA: hda/realtek - Fix Oops in alc_mux_select()
    - LP: #907778
  * alarmtimers: Fix time comparison
    - LP: #907778
  * ARM: davinci: da850 evm: change audio edma event queue to EVENTQ_0
    - LP: #907778
  * arm: mx23: recognise stmp378x as mx23
    - LP: #907778
  * ARM: at91: fix clock conid for atmel_tcb.1 on 9260/9g20
    - LP: #907778
  * ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode
    - LP: #907778
  * ASoC: Provide a more complete DMA driver stub
    - LP: #907778
  * fs/proc/meminfo.c: fix compilation error
    - LP: #907778
  * thp: add compound tail page _mapcount when mapped
    - LP: #907778
  * thp: set compound tail page _count to zero
    - LP: #907778
  * ptp: Fix clock_getres() implementation
    - LP: #907778
  * mm: Ensure that pfn_valid() is called once per pageblock when reserving
    pageblocks
    - LP: #907778
  * mm: vmalloc: check for page allocation failure before vmlist insertion
    - LP: #907778
  * fix apparmor dereferencing potentially freed dentry, sanitize
    __d_path() API
    - LP: #907778
  * target: Handle 0 correctly in transport_get_sectors_6()
    - LP: #907778
  * intel-iommu: fix return value of iommu_unmap() API
    - LP: #907778
  * intel-iommu: set iommu_superpage on VM domains to lowest common
    denominator
    - LP: #907778
  * intel-iommu: fix superpage support in pfn_to_dma_pte()
    - LP: #907778
  * percpu: fix chunk range calculation
    - LP: #907778
  * iwlwifi: do not re-configure HT40 after associated
    - LP: #907778
  * mac80211: fix race condition caused by late addBA response
    - LP: #907778
  * linux/log2.h: Fix rounddown_pow_of_two(1)
    - LP: #907778
  * hwmon: (jz4740) fix signedness bug
    - LP: #907778
  * mmc: mxcmmc: fix falling back to PIO
    - LP: #907778
  * x86, hpet: Immediately disable HPET timer 1 if rtc irq is masked
    - LP: #907778
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #907778
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops
    - LP: #907778
  * hwmon: (coretemp) Fix oops on CPU offlining
    - LP: #907778
  * xfs: fix nfs export of 64-bit inodes numbers on 32-bit kernels
    - LP: #907778
  * xfs: avoid synchronous transactions when deleting attr blocks
    - LP: #907778
  * md/raid5: fix bug that could result in reads from a failed device.
    - LP: #907778
  * xen: only limit memory map to maximum reservation for domain 0.
    - LP: #907778
  * ext4: display the correct mount option in /proc/mounts for
    [no]init_itable
    - LP: #907778
  * ext4: avoid hangs in ext4_da_should_update_i_disksize()
    - LP: #907778
  * ext4: avoid potential hang in mpage_submit_io() when blocksize <
    pagesize
    - LP: #907778
  * ext4: handle EOF correctly in ext4_bio_write_page()
    - LP: #907778
  * fuse: fix fuse_retrieve
    - LP: #907778
  * staging: r8712u: Add new USB ID
    - LP: #907778
  * drm/radeon/kms: add some new pci ids
    - LP: #907778
  * ibft: Fix finding IBFT ACPI table on UEFI
    - LP: #907778
  * USB: cdc-acm: add IDs for Motorola H24 HSPA USB module.
    - LP: #907778
  * usb: option: Add Huawei E398 controlling interfaces
    - LP: #907778
  * USB: option: Removing one bogus and adding some new Huawei combinations
    - LP: #907778
  * ASoC: core: Don't schedule deferred_resume_work twice
    - LP: #907778
  * Linux 3.0.14
    - LP: #907778
  * drm/i915: Fix PCH port pipe select in CPT disable paths
    - LP: #906756
  * KVM: x86: Prevent starting PIT timers in the absence of irqchip support
    - LP: #911303
    - CVE-2011-4622
  * Linux 3.0.15
    - LP: #913373
  * ARM: OMAP: rx51: fix USB
    - LP: #913373
  * ipip, sit: copy parms.name after register_netdevice
    - LP: #913373
  * rtc: m41t80: Workaround broken alarm functionality
    - LP: #913373
  * drm/i915: prevent division by zero when asking for chipset power
    - LP: #913373
  * cfq-iosched: free cic_index if blkio_alloc_blkg_stats fails
    - LP: #913373
  * cfq-iosched: fix cfq_cic_link() race confition
    - LP: #913373
  * SCSI: zfcp: return early from slave_destroy if slave_alloc returned
    early
    - LP: #913373
  * SCSI: mpt2sas: _scsih_smart_predicted_fault uses GFP_KERNEL in
    interrupt context
    - LP: #913373
  * SCSI: fcoe: Fix preempt count leak in fcoe_filter_frames()
    - LP: #913373
  * mac80211: fix another race in aggregation start
    - LP: #913373
  * block: initialize request_queue's numa node during
    - LP: #913373
  * ssb: fix init regression with SoCs
    - LP: #913373
  * MXC PWM: should active during DOZE/WAIT/DBG mode
    - LP: #913373
  * Input: synaptics - fix touchpad not working after S2R on Vostro V13
    - LP: #913373
  * percpu: fix per_cpu_ptr_to_phys() handling of non-page-aligned
    addresses
    - LP: #913373
  * binary_sysctl(): fix memory leak
    - LP: #913373
  * oom: fix integer overflow of points in oom_badness
    - LP: #913373
  * oprofile: Fix uninitialized memory access when writing to writing to
    oprofilefs
    - LP: #913373
  * NFSv4.1: Ensure that we handle _all_ SEQUENCE status bits.
    - LP: #913373
  * SELinux: Fix RCU deref check warning in sel_netport_insert()
    - LP: #913373
  * nilfs2: unbreak compat ioctl
    - LP: #913373
  * mmc: vub300: fix type of firmware_rom_wait_states module parameter
    - LP: #913373
  * cgroups: fix a css_set not found bug in cgroup_attach_proc
    - LP: #913373
  * mfd: Fix twl-core oops while calling twl_i2c_* for unbound driver
    - LP: #913373
  * vfs: __read_cache_page should use gfp argument rather than GFP_KERNEL
    - LP: #913373
  * media: s5p-fimc: Use correct fourcc for RGB565 colour format
    - LP: #913373
  * ath9k: fix max phy rate at rate control init
    - LP: #913373
  * iwlwifi: do not set the sequence control bit is not needed
    - LP: #913373
  * iwlwifi: allow to switch to HT40 if not associated
    - LP: #913373
  * memcg: keep root group unchanged if creation fails
    - LP: #913373
  * VFS: Fix race between CPU hotplug and lglocks
    - LP: #913373
  * ARM:imx:fix pwm period value
    - LP: #913373
  * ARM: 7214/1: mmc: mmci: Fixup handling of MCI_STARTBITERR
    - LP: #913373
  * ARM: 7220/1: mmc: mmci: Fixup error handling for dma
    - LP: #913373
  * oprofile, arm/sh: Fix oprofile_arch_exit() linkage issue
    - LP: #913373
  * futex: Fix uninterruptible loop due to gate_area
    - LP: #913373
  * watchdog: hpwdt: Changes to handle NX secure bit in 32bit path
    - LP: #913373
  * drm/radeon/kms: bail on BTC parts if MC ucode is missing
    - LP: #913373
  * mm: hugetlb: fix non-atomic enqueue of huge page
    - LP: #913373
  * mpt2sas: fix non-x86 crash on shutdown
    - LP: #913373
  * sparc64: Fix MSIQ HV call ordering in pci_sun4v_msiq_build_irq().
    - LP: #913373
  * sparc32: Be less strict in matching %lo part of relocation.
    - LP: #913373
  * sparc64: Patch sun4v code sequences properly on module load.
    - LP: #913373
  * sparc: Kill custom io_remap_pfn_range().
    - LP: #913373
  * sparc32: Remove non-kernel code from memcpy implementation.
    - LP: #913373
  * sparc32: Remove uses of %g7 in memcpy implementation.
    - LP: #913373
  * sparc32: Correct the return value of memcpy.
    - LP: #913373
  * sparc64: Fix masking and shifting in VIS fpcmp emulation.
    - LP: #913373
  * sparc: Fix handling of orig_i0 wrt. debugging when restarting syscalls.
    - LP: #913373
  * net: bpf_jit: fix an off-one bug in x86_64 cond jump target
    - LP: #913373
  * ppp: fix pptp double release_sock in pptp_bind()
    - LP: #913373
  * llc: llc_cmsg_rcv was getting called after sk_eat_skb.
    - LP: #913373
  * mqprio: Avoid panic if no options are provided
    - LP: #913373
  * net: have ipconfig not wait if no dev is available
    - LP: #913373
  * sch_gred: should not use GFP_KERNEL while holding a spinlock
    - LP: #913373
  * sctp: fix incorrect overflow check on autoclose
    - LP: #913373
  * sctp: Do not account for sizeof(struct sk_buff) in estimated rwnd
    - LP: #913373
  * ipv4: flush route cache after change accept_local
    - LP: #913373
  * ipv4: reintroduce route cache garbage collector
    - LP: #913373
  * ipv4: using prefetch requires including prefetch.h
    - LP: #913373
  * iwlwifi: update SCD BC table for all SCD queues
    - LP: #913373
  * mfd: Fix mismatch in twl4030 mutex lock-unlock
    - LP: #913373
  * mfd: Copy the device pointer to the twl4030-madc structure
    - LP: #913373
  * mfd: Check for twl4030-madc NULL pointer
    - LP: #913373
  * mfd: Turn on the twl4030-madc MADC clock
    - LP: #913373
  * xen/swiotlb: Use page alignment for early buffer allocation.
    - LP: #913373
  * xfs: log the inode in ->write_inode calls for kupdate
    - LP: #913373
  * xfs: log all dirty inodes in xfs_fs_sync_fs
    - LP: #913373
  * drm/radeon/kms/atom: fix possible segfault in pm setup
    - LP: #913373
  * hung_task: fix false positive during vfork
    - LP: #913373
  * ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE
    race
    - LP: #913373
  * ath9k: Fix kernel panic in AR2427 in AP mode
    - LP: #913373
  * Linux 3.0.16
    - LP: #913373
  * OMAP3: beagle: add support for beagleboard xM revision C
    - LP: #912199
  * MAINTAINERS: stable: Update address
    - LP: #915926
  * Documentation: Update stable address
    - LP: #915926
  * firmware: Fix an oops on reading fw_priv->fw in sysfs loading file
    - LP: #915926
  * rt2800usb: Move ID out of unknown
    - LP: #915926
  * offb: Fix setting of the pseudo-palette for >8bpp
    - LP: #915926
  * offb: Fix bug in calculating requested vram size
    - LP: #915926
  * wl12xx: Validate FEM index from ini file and FW
    - LP: #915926
  * wl12xx: Check buffer bound when processing nvs data
    - LP: #915926
  * powerpc/time: Handle wrapping of decrementer
    - LP: #915926
  * powerpc: Fix unpaired probe_hcall_entry and probe_hcall_exit
    - LP: #915926
  * asix: new device id
    - LP: #915926
  * IB/qib: Fix a possible data corruption when receiving packets
    - LP: #915926
  * perf: Fix parsing of __print_flags() in TP_printk()
    - LP: #915926
  * reiserfs: Fix quota mount option parsing
    - LP: #915926
  * reiserfs: Force inode evictions before umount to avoid crash
    - LP: #915926
  * ext3: Don't warn from writepage when readonly inode is spotted after
    error
    - LP: #915926
  * USB: update documentation for usbmon
    - LP: #915926
  * atmel_serial: fix spinlock lockup in RS485 code
    - LP: #915926
  * cgroup: fix to allow mounting a hierarchy by name
    - LP: #915926
  * udf: Fix deadlock when converting file from in-ICB one to normal one
    - LP: #915926
  * drivers/usb/class/cdc-acm.c: clear dangling pointer
    - LP: #915926
  * USB: isight: fix kernel bug when loading firmware
    - LP: #915926
  * usb: usb-storage doesn't support dynamic id currently, the patch
    disables the feature to fix an oops
    - LP: #915926
  * USB: add quirk for another camera
    - LP: #915926
  * usb: musb: fix pm_runtime mismatch
    - LP: #915926
  * USB: omninet: fix write_room
    - LP: #915926
  * USB: Add USB-ID for Multiplex RC serial adapter to cp210x.c
    - LP: #915926
  * usb: fix number of mapped SG DMA entries
    - LP: #915926
  * xhci: Properly handle COMP_2ND_BW_ERR
    - LP: #915926
  * USB: option: add id for 3G dongle Model VT1000 of Viettel
    - LP: #915926
  * usb: option: add ZD Incorporated HSPA modem
    - LP: #915926
  * usb: ch9: fix up MaxStreams helper
    - LP: #915926
  * OHCI: final fix for NVIDIA problems (I hope)
    - LP: #915926
  * igmp: Avoid zero delay when receiving odd mixture of IGMP queries
    - LP: #915926
  * asix: fix infinite loop in rx_fixup()
    - LP: #915926
  * bonding: fix error handling if slave is busy (v2)
    - LP: #915926
  * PM / Sleep: Fix race between CPU hotplug and freezer
    - LP: #915926
  * SCSI: mpt2sas: Added missing mpt2sas_base_detach call from scsih_remove
    context
    - LP: #915926
  * usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race
    - LP: #915926
  * xfs: fix acl count validation in xfs_acl_from_disk()
    - LP: #915926
  * Linux 3.0.17
    - LP: #915926
  * use cache type functions for arch_get_unmapped_area
    - LP: #861296
  * topdown mmap support
    - LP: #861296
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #647043
  * PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB
    - LP: #647043
  * overlayfs: apply device cgroup and security permissions to overlay
    files
    - LP: #915941, #918212
    - CVE-2012-0055
  * drivers/block/loop.c: emit uevent on auto release
    - LP: #548546

[ Ubuntu: 3.0.0-15.26 ]

* Revert "proc: enable writing to /proc/pid/mem"
    - LP: #919115
    - CVE-2012-0056
 -- Paolo Pisati <paolo.pisati@canonical.com>   Thu, 26 Jan 2012 18:29:38 +0100

Changed in linux-ti-omap4 (Ubuntu Oneiric):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-13:

#29

Download full text (14.0 KiB)

This bug was fixed in the package linux - 3.0.0-16.28

---------------
linux (3.0.0-16.28) oneiric-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #922692

[ Upstream Kernel Changes ]

* Revert "drm/i915/dp: Fix the math in intel_dp_link_required"
- LP: #919350

linux (3.0.0-16.27) oneiric-proposed; urgency=low

[Brad Figg]

* Release Tracking Bug
- LP: #920735

[ Paolo Pisati ]

  * Revert "SAUCE: omap3: beagle: if rev unknown, assume xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision B"
    - LP: #912199
  * Revert "SAUCE: omap3: beaglexm: fix DVI initialization"
    - LP: #912199
  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346

[ Upstream Kernel Changes ]

  * Revert "rtc: Disable the alarm in the hardware"
    - LP: #913373
  * Support for Terratec G1
    - LP: #821061
  * drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
    - LP: #825777
  * drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP
    bridges (v2)
    - LP: #825777
  * drm/radeon/kms: cleanup atombios_adjust_pll()
    - LP: #825777
  * drm/radeon/kms/atom: rework encoder dpms
    - LP: #825777
  * drm/radeon/kms: check for DP MST mode in a few more places (v2)
    - LP: #825777
  * drm/radeon/kms: rework DP bridge checks
    - LP: #825777
  * drm/radeon/kms: fix DP setup on TRAVIS bridges
    - LP: #825777
  * ALSA: sis7019 - give slow codecs more time to reset
    - LP: #907778
  * ALSA: hda/realtek - Fix Oops in alc_mux_select()
    - LP: #907778
  * alarmtimers: Fix time comparison
    - LP: #907778
  * ARM: davinci: da850 evm: change audio edma event queue to EVENTQ_0
    - LP: #907778
  * arm: mx23: recognise stmp378x as mx23
    - LP: #907778
  * ARM: at91: fix clock conid for atmel_tcb.1 on 9260/9g20
    - LP: #907778
  * ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode
    - LP: #907778
  * ASoC: Provide a more complete DMA driver stub
    - LP: #907778
  * fs/proc/meminfo.c: fix compilation error
    - LP: #907778
  * thp: add compound tail page _mapcount when mapped
    - LP: #907778
  * thp: set compound tail page _count to zero
    - LP: #907778
  * ptp: Fix clock_getres() implementation
    - LP: #907778
  * mm: Ensure that pfn_valid() is called once per pageblock when reserving
    pageblocks
    - LP: #907778
  * mm: vmalloc: check for page allocation failure before vmlist insertion
    - LP: #907778
  * fix apparmor dereferencing potentially freed dentry, sanitize
    __d_path() API
    - LP: #907778
  * target: Handle 0 correctly in transport_get_sectors_6()
    - LP: #907778
  * intel-iommu: fix return value of iommu_unmap() API
    - LP: #907778
  * intel-iommu: set iommu_superpage on VM domains to lowest common
    denominator
    - LP: #907778
  * intel-iommu: fix superpage support in pfn_to_dma_pte()
    - LP: #907778
  * percpu: fix chunk range calculation
    - LP: #907778
  * iwlwifi: do not re-configure HT40 after associated
    - LP: #907778
  * mac80211: fix race condition caused by late addBA respon...

This bug was fixed in the package linux - 3.0.0-16.28

---------------
linux (3.0.0-16.28) oneiric-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
    - LP: #922692

[ Upstream Kernel Changes ]

* Revert "drm/i915/dp: Fix the math in intel_dp_link_required"
    - LP: #919350

linux (3.0.0-16.27) oneiric-proposed; urgency=low

[Brad Figg]

* Release Tracking Bug
    - LP: #920735

[ Paolo Pisati ]

* Revert "SAUCE: omap3: beagle: if rev unknown, assume xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision C"
    - LP: #912199
  * Revert "SAUCE: omap3: beagle: detect new xM revision B"
    - LP: #912199
  * Revert "SAUCE: omap3: beaglexm: fix DVI initialization"
    - LP: #912199
  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346

[ Upstream Kernel Changes ]

* Revert "rtc: Disable the alarm in the hardware"
    - LP: #913373
  * Support for Terratec G1
    - LP: #821061
  * drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
    - LP: #825777
  * drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP
    bridges (v2)
    - LP: #825777
  * drm/radeon/kms: cleanup atombios_adjust_pll()
    - LP: #825777
  * drm/radeon/kms/atom: rework encoder dpms
    - LP: #825777
  * drm/radeon/kms: check for DP MST mode in a few more places (v2)
    - LP: #825777
  * drm/radeon/kms: rework DP bridge checks
    - LP: #825777
  * drm/radeon/kms: fix DP setup on TRAVIS bridges
    - LP: #825777
  * ALSA: sis7019 - give slow codecs more time to reset
    - LP: #907778
  * ALSA: hda/realtek - Fix Oops in alc_mux_select()
    - LP: #907778
  * alarmtimers: Fix time comparison
    - LP: #907778
  * ARM: davinci: da850 evm: change audio edma event queue to EVENTQ_0
    - LP: #907778
  * arm: mx23: recognise stmp378x as mx23
    - LP: #907778
  * ARM: at91: fix clock conid for atmel_tcb.1 on 9260/9g20
    - LP: #907778
  * ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode
    - LP: #907778
  * ASoC: Provide a more complete DMA driver stub
    - LP: #907778
  * fs/proc/meminfo.c: fix compilation error
    - LP: #907778
  * thp: add compound tail page _mapcount when mapped
    - LP: #907778
  * thp: set compound tail page _count to zero
    - LP: #907778
  * ptp: Fix clock_getres() implementation
    - LP: #907778
  * mm: Ensure that pfn_valid() is called once per pageblock when reserving
    pageblocks
    - LP: #907778
  * mm: vmalloc: check for page allocation failure before vmlist insertion
    - LP: #907778
  * fix apparmor dereferencing potentially freed dentry, sanitize
    __d_path() API
    - LP: #907778
  * target: Handle 0 correctly in transport_get_sectors_6()
    - LP: #907778
  * intel-iommu: fix return value of iommu_unmap() API
    - LP: #907778
  * intel-iommu: set iommu_superpage on VM domains to lowest common
    denominator
    - LP: #907778
  * intel-iommu: fix superpage support in pfn_to_dma_pte()
    - LP: #907778
  * percpu: fix chunk range calculation
    - LP: #907778
  * iwlwifi: do not re-configure HT40 after associated
    - LP: #907778
  * mac80211: fix race condition caused by late addBA response
    - LP: #907778
  * linux/log2.h: Fix rounddown_pow_of_two(1)
    - LP: #907778
  * hwmon: (jz4740) fix signedness bug
    - LP: #907778
  * mmc: mxcmmc: fix falling back to PIO
    - LP: #907778
  * x86, hpet: Immediately disable HPET timer 1 if rtc irq is masked
    - LP: #907778
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #907778
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops
    - LP: #907778
  * hwmon: (coretemp) Fix oops on CPU offlining
    - LP: #907778
  * xfs: fix nfs export of 64-bit inodes numbers on 32-bit kernels
    - LP: #907778
  * xfs: avoid synchronous transactions when deleting attr blocks
    - LP: #907778
  * md/raid5: fix bug that could result in reads from a failed device.
    - LP: #907778
  * xen: only limit memory map to maximum reservation for domain 0.
    - LP: #907778
  * ext4: display the correct mount option in /proc/mounts for
    [no]init_itable
    - LP: #907778
  * ext4: avoid hangs in ext4_da_should_update_i_disksize()
    - LP: #907778
  * ext4: avoid potential hang in mpage_submit_io() when blocksize <
    pagesize
    - LP: #907778
  * ext4: handle EOF correctly in ext4_bio_write_page()
    - LP: #907778
  * fuse: fix fuse_retrieve
    - LP: #907778
  * staging: r8712u: Add new USB ID
    - LP: #907778
  * drm/radeon/kms: add some new pci ids
    - LP: #907778
  * ibft: Fix finding IBFT ACPI table on UEFI
    - LP: #907778
  * USB: cdc-acm: add IDs for Motorola H24 HSPA USB module.
    - LP: #907778
  * usb: option: Add Huawei E398 controlling interfaces
    - LP: #907778
  * USB: option: Removing one bogus and adding some new Huawei combinations
    - LP: #907778
  * ASoC: core: Don't schedule deferred_resume_work twice
    - LP: #907778
  * Linux 3.0.14
    - LP: #907778
  * drm/i915: Fix PCH port pipe select in CPT disable paths
    - LP: #906756
  * KVM: x86: Prevent starting PIT timers in the absence of irqchip support
    - LP: #911303
    - CVE-2011-4622
  * Linux 3.0.15
    - LP: #913373
  * ARM: OMAP: rx51: fix USB
    - LP: #913373
  * ipip, sit: copy parms.name after register_netdevice
    - LP: #913373
  * rtc: m41t80: Workaround broken alarm functionality
    - LP: #913373
  * drm/i915: prevent division by zero when asking for chipset power
    - LP: #913373
  * cfq-iosched: free cic_index if blkio_alloc_blkg_stats fails
    - LP: #913373
  * cfq-iosched: fix cfq_cic_link() race confition
    - LP: #913373
  * SCSI: zfcp: return early from slave_destroy if slave_alloc returned
    early
    - LP: #913373
  * SCSI: mpt2sas: _scsih_smart_predicted_fault uses GFP_KERNEL in
    interrupt context
    - LP: #913373
  * SCSI: fcoe: Fix preempt count leak in fcoe_filter_frames()
    - LP: #913373
  * mac80211: fix another race in aggregation start
    - LP: #913373
  * block: initialize request_queue's numa node during
    - LP: #913373
  * ssb: fix init regression with SoCs
    - LP: #913373
  * MXC PWM: should active during DOZE/WAIT/DBG mode
    - LP: #913373
  * Input: synaptics - fix touchpad not working after S2R on Vostro V13
    - LP: #913373
  * percpu: fix per_cpu_ptr_to_phys() handling of non-page-aligned
    addresses
    - LP: #913373
  * binary_sysctl(): fix memory leak
    - LP: #913373
  * oom: fix integer overflow of points in oom_badness
    - LP: #913373
  * oprofile: Fix uninitialized memory access when writing to writing to
    oprofilefs
    - LP: #913373
  * NFSv4.1: Ensure that we handle _all_ SEQUENCE status bits.
    - LP: #913373
  * SELinux: Fix RCU deref check warning in sel_netport_insert()
    - LP: #913373
  * nilfs2: unbreak compat ioctl
    - LP: #913373
  * mmc: vub300: fix type of firmware_rom_wait_states module parameter
    - LP: #913373
  * cgroups: fix a css_set not found bug in cgroup_attach_proc
    - LP: #913373
  * mfd: Fix twl-core oops while calling twl_i2c_* for unbound driver
    - LP: #913373
  * vfs: __read_cache_page should use gfp argument rather than GFP_KERNEL
    - LP: #913373
  * media: s5p-fimc: Use correct fourcc for RGB565 colour format
    - LP: #913373
  * ath9k: fix max phy rate at rate control init
    - LP: #913373
  * iwlwifi: do not set the sequence control bit is not needed
    - LP: #913373
  * iwlwifi: allow to switch to HT40 if not associated
    - LP: #913373
  * memcg: keep root group unchanged if creation fails
    - LP: #913373
  * VFS: Fix race between CPU hotplug and lglocks
    - LP: #913373
  * ARM:imx:fix pwm period value
    - LP: #913373
  * ARM: 7214/1: mmc: mmci: Fixup handling of MCI_STARTBITERR
    - LP: #913373
  * ARM: 7220/1: mmc: mmci: Fixup error handling for dma
    - LP: #913373
  * oprofile, arm/sh: Fix oprofile_arch_exit() linkage issue
    - LP: #913373
  * futex: Fix uninterruptible loop due to gate_area
    - LP: #913373
  * watchdog: hpwdt: Changes to handle NX secure bit in 32bit path
    - LP: #913373
  * drm/radeon/kms: bail on BTC parts if MC ucode is missing
    - LP: #913373
  * mm: hugetlb: fix non-atomic enqueue of huge page
    - LP: #913373
  * mpt2sas: fix non-x86 crash on shutdown
    - LP: #913373
  * sparc64: Fix MSIQ HV call ordering in pci_sun4v_msiq_build_irq().
    - LP: #913373
  * sparc32: Be less strict in matching %lo part of relocation.
    - LP: #913373
  * sparc64: Patch sun4v code sequences properly on module load.
    - LP: #913373
  * sparc: Kill custom io_remap_pfn_range().
    - LP: #913373
  * sparc32: Remove non-kernel code from memcpy implementation.
    - LP: #913373
  * sparc32: Remove uses of %g7 in memcpy implementation.
    - LP: #913373
  * sparc32: Correct the return value of memcpy.
    - LP: #913373
  * sparc64: Fix masking and shifting in VIS fpcmp emulation.
    - LP: #913373
  * sparc: Fix handling of orig_i0 wrt. debugging when restarting syscalls.
    - LP: #913373
  * net: bpf_jit: fix an off-one bug in x86_64 cond jump target
    - LP: #913373
  * ppp: fix pptp double release_sock in pptp_bind()
    - LP: #913373
  * llc: llc_cmsg_rcv was getting called after sk_eat_skb.
    - LP: #913373
  * mqprio: Avoid panic if no options are provided
    - LP: #913373
  * net: have ipconfig not wait if no dev is available
    - LP: #913373
  * sch_gred: should not use GFP_KERNEL while holding a spinlock
    - LP: #913373
  * sctp: fix incorrect overflow check on autoclose
    - LP: #913373
  * sctp: Do not account for sizeof(struct sk_buff) in estimated rwnd
    - LP: #913373
  * ipv4: flush route cache after change accept_local
    - LP: #913373
  * ipv4: reintroduce route cache garbage collector
    - LP: #913373
  * ipv4: using prefetch requires including prefetch.h
    - LP: #913373
  * iwlwifi: update SCD BC table for all SCD queues
    - LP: #913373
  * mfd: Fix mismatch in twl4030 mutex lock-unlock
    - LP: #913373
  * mfd: Copy the device pointer to the twl4030-madc structure
    - LP: #913373
  * mfd: Check for twl4030-madc NULL pointer
    - LP: #913373
  * mfd: Turn on the twl4030-madc MADC clock
    - LP: #913373
  * xen/swiotlb: Use page alignment for early buffer allocation.
    - LP: #913373
  * xfs: log the inode in ->write_inode calls for kupdate
    - LP: #913373
  * xfs: log all dirty inodes in xfs_fs_sync_fs
    - LP: #913373
  * drm/radeon/kms/atom: fix possible segfault in pm setup
    - LP: #913373
  * hung_task: fix false positive during vfork
    - LP: #913373
  * ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE
    race
    - LP: #913373
  * ath9k: Fix kernel panic in AR2427 in AP mode
    - LP: #913373
  * Linux 3.0.16
    - LP: #913373
  * OMAP3: beagle: add support for beagleboard xM revision C
    - LP: #912199
  * MAINTAINERS: stable: Update address
    - LP: #915926
  * Documentation: Update stable address
    - LP: #915926
  * firmware: Fix an oops on reading fw_priv->fw in sysfs loading file
    - LP: #915926
  * rt2800usb: Move ID out of unknown
    - LP: #915926
  * offb: Fix setting of the pseudo-palette for >8bpp
    - LP: #915926
  * offb: Fix bug in calculating requested vram size
    - LP: #915926
  * wl12xx: Validate FEM index from ini file and FW
    - LP: #915926
  * wl12xx: Check buffer bound when processing nvs data
    - LP: #915926
  * powerpc/time: Handle wrapping of decrementer
    - LP: #915926
  * powerpc: Fix unpaired probe_hcall_entry and probe_hcall_exit
    - LP: #915926
  * asix: new device id
    - LP: #915926
  * IB/qib: Fix a possible data corruption when receiving packets
    - LP: #915926
  * perf: Fix parsing of __print_flags() in TP_printk()
    - LP: #915926
  * reiserfs: Fix quota mount option parsing
    - LP: #915926
  * reiserfs: Force inode evictions before umount to avoid crash
    - LP: #915926
  * ext3: Don't warn from writepage when readonly inode is spotted after
    error
    - LP: #915926
  * USB: update documentation for usbmon
    - LP: #915926
  * atmel_serial: fix spinlock lockup in RS485 code
    - LP: #915926
  * cgroup: fix to allow mounting a hierarchy by name
    - LP: #915926
  * udf: Fix deadlock when converting file from in-ICB one to normal one
    - LP: #915926
  * drivers/usb/class/cdc-acm.c: clear dangling pointer
    - LP: #915926
  * USB: isight: fix kernel bug when loading firmware
    - LP: #915926
  * usb: usb-storage doesn't support dynamic id currently, the patch
    disables the feature to fix an oops
    - LP: #915926
  * USB: add quirk for another camera
    - LP: #915926
  * usb: musb: fix pm_runtime mismatch
    - LP: #915926
  * USB: omninet: fix write_room
    - LP: #915926
  * USB: Add USB-ID for Multiplex RC serial adapter to cp210x.c
    - LP: #915926
  * usb: fix number of mapped SG DMA entries
    - LP: #915926
  * xhci: Properly handle COMP_2ND_BW_ERR
    - LP: #915926
  * USB: option: add id for 3G dongle Model VT1000 of Viettel
    - LP: #915926
  * usb: option: add ZD Incorporated HSPA modem
    - LP: #915926
  * usb: ch9: fix up MaxStreams helper
    - LP: #915926
  * OHCI: final fix for NVIDIA problems (I hope)
    - LP: #915926
  * igmp: Avoid zero delay when receiving odd mixture of IGMP queries
    - LP: #915926
  * asix: fix infinite loop in rx_fixup()
    - LP: #915926
  * bonding: fix error handling if slave is busy (v2)
    - LP: #915926
  * PM / Sleep: Fix race between CPU hotplug and freezer
    - LP: #915926
  * SCSI: mpt2sas: Added missing mpt2sas_base_detach call from scsih_remove
    context
    - LP: #915926
  * usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race
    - LP: #915926
  * xfs: fix acl count validation in xfs_acl_from_disk()
    - LP: #915926
  * Linux 3.0.17
    - LP: #915926
  * use cache type functions for arch_get_unmapped_area
    - LP: #861296
  * topdown mmap support
    - LP: #861296
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #647043
  * PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB
    - LP: #647043
  * overlayfs: apply device cgroup and security permissions to overlay
    files
    - LP: #915941, #918212
    - CVE-2012-0055
  * drivers/block/loop.c: emit uevent on auto release
    - LP: #548546
 -- Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>   Fri, 27 Jan 2012 14:38:31 -0200

Changed in linux (Ubuntu Oneiric):
status:	Fix Committed → Fix Released

Revision history for this message

Paolo Pisati (p-pisati) wrote on 2012-02-27:

#30

in M/omap4 we were still using a 2G/2G split (and thus we were exhausting the vm address space), moving to a 3G/1G fixes it:

http://people.canonical.com/~ppisati/lp861296/linux-image-2.6.35-903-omap4_2.6.35-903.31~3g1gsplit_armel.deb

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-03-06:

#31

This bug was fixed in the package linux-ti-omap4 - 2.6.35-903.32

---------------
linux-ti-omap4 (2.6.35-903.32) maverick-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #942766

[ Paolo Pisati ]

* [Config] Move to a 3G/1G memory split
- LP: #861296

linux-ti-omap4 (2.6.35-903.31) maverick-proposed; urgency=low

* Release Tracking Bug
- LP: #932237

[ Upstream Kernel Changes ]

  * net: ip_expire() must revalidate route
    - LP: #922051
    - CVE-2011-1927
  * inotify: stop kernel memory leak on file creation failure
    - LP: #917797
    - CVE-2010-4250
  * inotify: fix double free/corruption of stuct user
    - LP: #869203
    - CVE-2011-1479
  * fuse: verify ioctl retries
    - LP: #917804
    - CVE-2010-4650
  * ima: fix add LSM rule bug
    - LP: #917808
    - CVE-2011-0006
  * bridge: Fix mglist corruption that leads to memory corruption
    - LP: #917813
    - CVE-2011-0716
  * sound/oss: remove offset from load_patch callbacks
    - LP: #925337
    - CVE-2011-1476
  * ARM: 6891/1: prevent heap corruption in OABI semtimedop
    - LP: #925373
    - CVE-2011-1759
  * sound/oss/opl3: validate voice and channel indexes
    - LP: #925335
    - CVE-2011-1477
  * Fix for buffer overflow in ldm_frag_add not sufficient
    - LP: #922371
    - CVE-2011-2182
  * AppArmor: fix oops in apparmor_setprocattr
    - LP: #789409
    - CVE-2011-3619
-- Herton Ronaldo Krzesinski <email address hidden> Tue, 28 Feb 2012 14:33:28 -0300

Changed in linux-ti-omap4 (Ubuntu Maverick):
status:	Fix Committed → Fix Released

Revision history for this message

Andy Whitcroft (apw) wrote on 2012-04-24:

#32

Confirmed as released in Ubuntu-2.6.38-1209.19. Closing Fix Released

Changed in linux-ti-omap4 (Ubuntu Natty):
status:	Fix Committed → Fix Released

Revision history for this message

Andy Whitcroft (apw) wrote on 2012-04-24:

#33

Confirmed released with Ubuntu-2.6.31-612.32. Marking Fix Released.

Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	Fix Committed → Fix Released

Ubuntu
linux-fsl-imx51 package

mmap fails to allocate 2030Mb heap on ARM

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
Linaro Toolchain Miscellanies	Invalid	Undecided	Unassigned
linux (Ubuntu)	Fix Released	High	Unassigned
Lucid	Invalid	Undecided	Unassigned
Maverick	Fix Released	Undecided	Unassigned
Natty	Fix Released	Undecided	Unassigned
Oneiric	Fix Released	Undecided	Unassigned
Precise	Fix Released	High	Unassigned
linux-ac100 (Ubuntu)	Fix Released	Undecided	Unassigned
Oneiric	Fix Released	Undecided	Unassigned
Precise	Fix Released	Undecided	Unassigned
linux-fsl-imx51 (Ubuntu)	Invalid	Undecided	Unassigned
Lucid	Fix Released	Undecided	Unassigned
Maverick	Invalid	Undecided	Unassigned
Natty	Invalid	Undecided	Unassigned
Oneiric	Invalid	Undecided	Unassigned
Precise	Invalid	Undecided	Unassigned
linux-ti-omap4 (Ubuntu)	Fix Released	Undecided	Unassigned
Lucid	Invalid	Undecided	Unassigned
Maverick	Fix Released	Undecided	Unassigned
Natty	Fix Released	Undecided	Unassigned
Oneiric	Fix Released	Undecided	Unassigned
Precise	Fix Released	Undecided	Unassigned

Ubuntulinux-fsl-imx51 package

mmap fails to allocate 2030Mb heap on ARM

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux-fsl-imx51 package