SMC stats: Wrong bucket calculation for payload of exactly 4096 bytes

[bugproxy]

SRU Justification:

[Impact]

 * There is a wrong bucket calculation for payload of exactly 4096 bytes
   in SMC stats counters.

 * SMC_STAT_PAYLOAD_SUB and SMC_STAT_RMB_SIZE_SUB have these issues.

 * The impact is that a system silently updates an incorrect stats counter
   in case the underlying kernel is not UBSAN enabled.
   (Difficult to detect.)

 * But if a kernel is UBSAN enabled, one will see a UBSAN
   'array-index-out-of-bounds' warning every time this occurs, like:
   [ 26.335381] UBSAN: array-index-out-of-bounds in /build/linux-O6Qi7m/linux-5.15.0/net/smc/af_smc.c:2402:3
   [ 26.335385] index -1 is out of range for type 'u64 [9]'
   [ 26.335388] CPU: 0 PID: 274 Comm: iperf3 Tainted: G E 5.15.0-79-generic #86-Ubuntu
   [ 26.335391] Hardware name: IBM 8561 T01 772 (KVM/Linux)
   [ 26.335393] Call Trace:
   [ 26.335397] [<00000000cd92e63a>] dump_stack_lvl+0x62/0x80
   [ 26.335404] [<00000000cd92e36c>] ubsan_epilogue+0x1c/0x48
   [ 26.335406] [<00000000cd52d3c4>] __ubsan_handle_out_of_bounds+0x94/0xa0
   [ 26.335411] [<000003ff8033f9da>] smc_sendmsg+0x2aa/0x2d0 [smc]
   [ 26.335425] [<00000000cd6a79a4>] sock_sendmsg+0x64/0x80
   [ 26.335431] [<00000000cd6a7a32>] sock_write_iter+0x72/0xa0
   [ 26.335433] [<00000000cd1d4000>] new_sync_write+0x100/0x190
   [ 26.335438] [<00000000cd1d4bb8>] vfs_write+0x1e8/0x280
   [ 26.335440] [<00000000cd1d7014>] ksys_write+0xb4/0x100
   [ 26.335442] [<00000000cd932c7c>] __do_syscall+0x1bc/0x1f0
   [ 26.335446] [<00000000cd940148>] system_call+0x78/0xa0

[Fix]

 * a950a5921db4 a950a5921db450c74212327f69950ff03419483a "net/smc: Fix pos miscalculation in statistics"

[Test Plan]

 * Since this got identified while the livepatch for jammy patches got added,
   one could run a simiar (or the same) test like mentioned at LP#1639924
   (but only jammy comes with official livepatch support).

 * Alternatively a dedicated SMC stats counters test with a payload of
   exactly 4096 bytes could be done (which is probably easier):

 * Install uperf (https://uperf.org/ - https://github.com/uperf/uperf).
   (Wondering if it makes sense to pick this up as Debian/Ubuntu package ?!)

 * Reset SMC-D stats on client and server side.

 * Start uperf at the server side using: # uperf -vs

 * Update profile with remote IP (server IP)
   and start uperf at client: # uperf -vai 5 -m rr1c-4kx4k---1.xml
   with uperf profile:
   # cat rr1c-4kx4k---1.xml
   <?xml version="1.0"?>
   <profile name="TCP_RR">
    <group nprocs="1">
    <!--group nthreads="1"-->
    <!-- if we want to run processes -->
    <!--group nprocs="1"-->
     <transaction iterations="1">
      <flowop type="connect" options="remotehost=<remote IP> protocol=tcp tcp_nodelay" />
     </transaction>
     <transaction iterations="1">
      <flowop type="write" options="size=4096"/>
      <flowop type="read" options="size=4096"/>
     </transaction>
     <transaction iterations="1">
      <flowop type="disconnect" />
     </transaction>
    </group>
   </profile>

 * The smcd stats output is:
   # smcd -d stats reset
   SMC-D Connections Summary
     Total connections handled 2
     SMC connections 2 (client 2, server 0)
       v1 0
       v2 2
     Handshake errors 0 (client 0, server 0)
     Avg requests per SMC conn 14.0
     TCP fallback 0 (client 0, server 0)
   RX Stats
     Data transmitted (Bytes) 5796 (5.796K)
     Total requests 9
     Buffer full 0 (0.00%)
     Buffer downgrades 0
     Buffer reuses 0
               8KB 16KB 32KB 64KB 128KB 256KB 512KB >512KB
     Bufs 0 0 0 2 0 0 0 1
     Reqs 8 0 0 0 0 0 0 0
   TX Stats
     Data transmitted (Bytes) 9960 (9.960K)
     Total requests 19
     Buffer full 0 (0.00%)
     Buffer full (remote) 0 (0.00%)
     Buffer too small 0 (0.00%)
     Buffer too small (remote) 0 (0.00%)
     Buffer downgrades 0
     Buffer reuses 0
               8KB 16KB 32KB 64KB 128KB 256KB 512KB >512KB
     Bufs 0 2 0 0 0 0 0 0
     Reqs 18 0 0 0 0 0 0 1
   Extras
     Special socket calls 0
       cork 0
       nodelay 0
       sendpage 0
       splice 0
       urgent data 0

 * Instead of including the payload in the wrong >512 KB buckets,
   the output should be to have 19 reqs in the 8 KB buckets for TX stats
   and 9 reqs in the 8 KB bucket for RX stats.

[Where problems could occur]

 * The changes are in common code /net/smc/smc_stats.h
   hence any potential negativ impact is not limited to a specific platform.
   but limited to statistics for shared memory communication (SMC)
   hardware statistics.

 * But limited to the functions SMC_STAT_PAYLOAD_SUB and
   SMC_STAT_RMB_SIZE_SUB.

 * The bucket (aka pos) calculation is not that trivial,
   issues here could cause other calculation error,
   that may lead to slightly different, but still wrong numbers.

 * Further issues can happen in case variables in use may overflow.

 * Issues can also happen if the ternary conditional operators
   are not correctly used, which again may lead to wrong calculations.

[Other Info]

 * This patch fixes upstream e0e4b8fa5338
   ("net/smc: Add SMC statistics support").

 * Since the fix got upstream accepted with v6.6-rc6,
   not only 22.04, but also 23.04 and 23.10 are affected.
   (22.10 already reached it EOS).

 * Will not affected the current development release (N-release),
   since it will at least be based on a 6.6 kernel.
__________

Bug description by Nils H.:

------------
 Overview:
------------
The following line in the SMC stats code (net/smc/smc_stats.h) caught my attention when using a payload of exactly 4096 bytes:

#define SMC_STAT_PAYLOAD_SUB(_smc_stats, _tech, key, _len, _rc) \
do { \
 typeof(_smc_stats) stats = (_smc_stats); \
 typeof(_tech) t = (_tech); \
 typeof(_len) l = (_len); \
 int _pos = fls64((l) >> 13); \
 typeof(_rc) r = (_rc); \
 int m = SMC_BUF_MAX - 1; \
 this_cpu_inc((*stats).smc[t].key ## _cnt); \
 if (r <= 0) \
  break; \
 _pos = (_pos < m) ? ((l == 1 << (_pos + 12)) ? _pos - 1 : _pos) : m; \ <---
 this_cpu_inc((*stats).smc[t].key ## _pd.buf[_pos]); \
 this_cpu_add((*stats).smc[t].key ## _bytes, r); \
} \
while (0)

With l = 4096, _pos evaluates to -1.

Checking with the following uperf profile:
# cat rr1c-4kx4k---1.xml
<?xml version="1.0"?>
<profile name="TCP_RR">
 <group nprocs="1">
 <!--group nthreads="1"-->
 <!-- if we want to run processes -->
 <!--group nprocs="1"-->
  <transaction iterations="1">
   <flowop type="connect" options="remotehost=<remote IP> protocol=tcp tcp_nodelay" />
  </transaction>
  <transaction iterations="1">
   <flowop type="write" options="size=4096"/>
   <flowop type="read" options="size=4096"/>
  </transaction>
  <transaction iterations="1">
   <flowop type="disconnect" />
  </transaction>
 </group>
</profile>

smcd stats output:
# smcd -d stats reset
SMC-D Connections Summary
  Total connections handled 2
  SMC connections 2 (client 2, server 0)
    v1 0
    v2 2
  Handshake errors 0 (client 0, server 0)
  Avg requests per SMC conn 14.0
  TCP fallback 0 (client 0, server 0)

RX Stats
  Data transmitted (Bytes) 5796 (5.796K)
  Total requests 9
  Buffer full 0 (0.00%)
  Buffer downgrades 0
  Buffer reuses 0
            8KB 16KB 32KB 64KB 128KB 256KB 512KB >512KB
  Bufs 0 0 0 2 0 0 0 1
  Reqs 8 0 0 0 0 0 0 0

TX Stats
  Data transmitted (Bytes) 9960 (9.960K)
  Total requests 19
  Buffer full 0 (0.00%)
  Buffer full (remote) 0 (0.00%)
  Buffer too small 0 (0.00%)
  Buffer too small (remote) 0 (0.00%)
  Buffer downgrades 0
  Buffer reuses 0
            8KB 16KB 32KB 64KB 128KB 256KB 512KB >512KB
  Bufs 0 2 0 0 0 0 0 0
  Reqs 18 0 0 0 0 0 0 1

Extras
  Special socket calls 0
    cork 0
    nodelay 0
    sendpage 0
    splice 0
    urgent data 0

Instead of including the payload in the wrong >512KB buckets, output should be to have 19 reqs in the 8KB buckets for TX stats and 9 reqs in the 8KB bucket for RX stats.

--------
 Repro:
--------
0. Install uperf.
1. Reset SMC-D stats on client and server.
2. Start uperf at server side: "uperf -vs".
3. Update profile with remote IP (server IP) and start uperf at client: "uperf -vai 5 -m rr1c-4kx4k---1.xml" (uperf profile, see above)

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-10-17 10:23 EDT-------
--- MATTHEW R. commented ---

I encountered this issue recently while verifying a KVM feature. It's worth noting that if a kernel has UBSAN enabled (https://docs.kernel.org/dev-tools/ubsan.html) then rather than silently updating an incorrect stats counter you will also get a UBSAN array-index-out-of-bounds warning every time this occurs. In my case, I bumped into this because I was using an Ubuntu kernel which came with UBSAN enabled. Example of the warning:

[ 26.335369] ================================================================================
[ 26.335381] UBSAN: array-index-out-of-bounds in /build/linux-O6Qi7m/linux-5.15.0/net/smc/af_smc.c:2402:3
[ 26.335385] index -1 is out of range for type 'u64 [9]'
[ 26.335388] CPU: 0 PID: 274 Comm: iperf3 Tainted: G E 5.15.0-79-generic #86-Ubuntu
[ 26.335391] Hardware name: IBM 8561 T01 772 (KVM/Linux)
[ 26.335393] Call Trace:
[ 26.335397] [<00000000cd92e63a>] dump_stack_lvl+0x62/0x80
[ 26.335404] [<00000000cd92e36c>] ubsan_epilogue+0x1c/0x48
[ 26.335406] [<00000000cd52d3c4>] __ubsan_handle_out_of_bounds+0x94/0xa0
[ 26.335411] [<000003ff8033f9da>] smc_sendmsg+0x2aa/0x2d0 [smc]
[ 26.335425] [<00000000cd6a79a4>] sock_sendmsg+0x64/0x80
[ 26.335431] [<00000000cd6a7a32>] sock_write_iter+0x72/0xa0
[ 26.335433] [<00000000cd1d4000>] new_sync_write+0x100/0x190
[ 26.335438] [<00000000cd1d4bb8>] vfs_write+0x1e8/0x280
[ 26.335440] [<00000000cd1d7014>] ksys_write+0xb4/0x100
[ 26.335442] [<00000000cd932c7c>] __do_syscall+0x1bc/0x1f0
[ 26.335446] [<00000000cd940148>] system_call+0x78/0xa0

This makes the issue much more visible.

Worse, if you have panic_on_warn enabled (like I did) then this warning will subsequently trigger a kernel panic.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-10-17 10:31 EDT-------
There is a fix available (thanks Wenjia) to address this problem which occurs with kernel 5.14 and above:

The fix patch "a950a5921db4 (net/smc: Fix pos miscalculation in statistics)" is already upstream

------- Comment From <email address hidden> 2023-10-17 10:33 EDT-------
FYI: This fix also resolves the UBSAN array-index-out-of-bounds issue mentioned by Matthew
during the verification performed as part of IBM BZ 182254 / launchpad 1853306.

[Frank Heimes (fheimes)]

So it's upstream with kernel v6.6-rc6.
With that it affects jammy, lunar and mantic.
(Would have been ideal to have it tagged as upstream stable update.)

[Frank Heimes (fheimes)]

SRU request submitted to the Ubuntu kernel team mailing list for mantic, lunar and jammy.
https://lists.ubuntu.com/archives/kernel-team/2023-October/thread.html#146511
Changing status to 'In Progress' for mantic, lunar and jammy.

Kernel test builds are available here:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2039575

[Frank Heimes (fheimes)]

@roxanan many thx for having accepted and applied this (even if it was a bit late) - appreciate it!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/5.15.0-90.100 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux' to 'verification-done-jammy-linux'. If the problem still exists, change the tag 'verification-needed-jammy-linux' to 'verification-failed-jammy-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/6.2.0-38.39 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux' to 'verification-done-lunar-linux'. If the problem still exists, change the tag 'verification-needed-lunar-linux' to 'verification-failed-lunar-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/6.5.0-12.12 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux' to 'verification-done-mantic-linux'. If the problem still exists, change the tag 'verification-needed-mantic-linux' to 'verification-failed-mantic-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-11-28 08:14 EDT-------
Thanks you @Wenjia for successfully verifying that the updated kernels in -proposed for jammy, lunar and mantic solve the problem.

With that, we can change / add the tags accordingly to:
verification-done-jammy
verification-done-lunar
verification-done-mantic

Thanks everyone for all your work.

[Frank Heimes (fheimes)]

Thx @Boris and @Wenjia - I'll update the tags accordingly ...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp-tcpx/5.15.0-1003.3 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-gcp-tcpx' to 'verification-done-focal-linux-gcp-tcpx'. If the problem still exists, change the tag 'verification-needed-focal-linux-gcp-tcpx' to 'verification-failed-focal-linux-gcp-tcpx'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Frank Heimes (fheimes)]

affects linux-generic only

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 6.2.0-39.40

---------------
linux (6.2.0-39.40) lunar; urgency=medium

  * lunar/linux: 6.2.0-39.40 -proposed tracker (LP: #2043451)

  * USB bus error after upgrading to proposed kernel on lunar and jammy
    (LP: #2043197)
    - USB: core: Fix oversight in SuperSpeed initialization

  * Include cifs.ko in linux-modules package (LP: #2042546)
    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list

linux (6.2.0-38.39) lunar; urgency=medium

  * lunar/linux: 6.2.0-38.39 -proposed tracker (LP: #2041557)

  * CVE-2023-25775
    - RDMA/irdma: Prevent zero-length STAG registration

  * CVE-2023-5345
    - fs/smb/client: Reset password pointer to NULL

  * CVE-2023-39189
    - netfilter: nfnetlink_osf: avoid OOB read

  * SMC stats: Wrong bucket calculation for payload of exactly 4096 bytes
    (LP: #2039575)
    - net/smc: Fix pos miscalculation in statistics

  * [SRU][J/L/M] UBUNTU: [Packaging] Make WWAN driver a loadable module
    (LP: #2033406)
    - [Packaging] Make WWAN driver loadable modules

  * CVE-2023-45871
    - igb: set max size RX buffer when store bad packet is enabled

  * CVE-2023-39193
    - netfilter: xt_sctp: validate the flag_info count

  * CVE-2023-39192
    - netfilter: xt_u32: validate user space input

  * CVE-2023-31085
    - ubi: Refuse attaching if mtd's erasesize is 0

  * CVE-2023-5717
    - perf: Disallow mis-matched inherited group reads

  * CVE-2023-5178
    - nvmet-tcp: Fix a possible UAF in queue intialization setup

  * CVE-2023-5158
    - vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()

  * CVE-2023-5090
    - x86: KVM: SVM: always update the x2avic msr interception

  * usbip: error: failed to open /usr/share/hwdata//usb.ids (LP: #2039439)
    - [Packaging] Make linux-tools-common depend on hwdata

  * Unable to use nvme drive to install Ubuntu 23.10 (LP: #2040157)
    - misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to
      probe

  * Lunar update: upstream stable patchset 2023-10-19 (LP: #2039884)
    - ACPI: thermal: Drop nocrt parameter
    - module: Expose module_init_layout_section()
    - arm64: module-plts: inline linux/moduleloader.h
    - arm64: module: Use module_init_layout_section() to spot init sections
    - ARM: module: Use module_init_layout_section() to spot init sections
    - lockdep: fix static memory detection even more
    - parisc: Cleanup mmap implementation regarding color alignment
    - parisc: sys_parisc: parisc_personality() is called from asm code
    - io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc
    - kallsyms: Fix kallsyms_selftest failure
    - module/decompress: use vmalloc() for zstd decompression workspace
    - Upstream stable to v6.1.51, v6.4.14
    - erofs: ensure that the post-EOF tails are all zeroed
    - ksmbd: fix wrong DataOffset validation of create context
    - ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
    - ksmbd: replace one-element array with flex-array member in struct
      smb2_ea_info
    - ksmbd: reduce descriptor size if remaining bytes is less than request size
    - ARM: pxa: remove use of symbol_get()
    - mmc: au1x...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency-hwe-6.2/6.2.0-1018.18~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.2' to 'verification-done-jammy-linux-lowlatency-hwe-6.2'. If the problem still exists, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.2' to 'verification-failed-jammy-linux-lowlatency-hwe-6.2'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp/6.2.0-1020.22 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-gcp' to 'verification-done-lunar-linux-gcp'. If the problem still exists, change the tag 'verification-needed-lunar-linux-gcp' to 'verification-failed-lunar-linux-gcp'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-kvm/6.2.0-1018.18 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-kvm' to 'verification-done-lunar-linux-kvm'. If the problem still exists, change the tag 'verification-needed-lunar-linux-kvm' to 'verification-failed-lunar-linux-kvm'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-aws/6.2.0-1017.17 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-aws' to 'verification-done-lunar-linux-aws'. If the problem still exists, change the tag 'verification-needed-lunar-linux-aws' to 'verification-failed-lunar-linux-aws'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/6.2.0-1018.18 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-azure' to 'verification-done-lunar-linux-azure'. If the problem still exists, change the tag 'verification-needed-lunar-linux-azure' to 'verification-failed-lunar-linux-azure'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-starfive/6.2.0-1010.11 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-starfive' to 'verification-done-lunar-linux-starfive'. If the problem still exists, change the tag 'verification-needed-lunar-linux-starfive' to 'verification-failed-lunar-linux-starfive'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-hwe-6.2/6.2.0-39.40~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-hwe-6.2' to 'verification-done-jammy-linux-hwe-6.2'. If the problem still exists, change the tag 'verification-needed-jammy-linux-hwe-6.2' to 'verification-failed-jammy-linux-hwe-6.2'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-riscv/6.2.0-39.40.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux-riscv' to 'verification-done-lunar-linux-riscv'. If the problem still exists, change the tag 'verification-needed-lunar-linux-riscv' to 'verification-failed-lunar-linux-riscv'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure-fips/5.15.0-1053.61+fips1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure-fips' to 'verification-done-jammy-linux-azure-fips'. If the problem still exists, change the tag 'verification-needed-jammy-linux-azure-fips' to 'verification-failed-jammy-linux-azure-fips'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-laptop/6.5.0-1007.10 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux-laptop' to 'verification-done-mantic-linux-laptop'. If the problem still exists, change the tag 'verification-needed-mantic-linux-laptop' to 'verification-failed-mantic-linux-laptop'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/6.5.0-1010.10 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux-azure' to 'verification-done-mantic-linux-azure'. If the problem still exists, change the tag 'verification-needed-mantic-linux-azure' to 'verification-failed-mantic-linux-azure'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp/6.5.0-1010.10 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux-gcp' to 'verification-done-mantic-linux-gcp'. If the problem still exists, change the tag 'verification-needed-mantic-linux-gcp' to 'verification-failed-mantic-linux-gcp'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-hwe-6.5/6.5.0-14.14~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-hwe-6.5' to 'verification-done-jammy-linux-hwe-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-hwe-6.5' to 'verification-failed-jammy-linux-hwe-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.15.0-91.101

---------------
linux (5.15.0-91.101) jammy; urgency=medium

  * jammy/linux: 5.15.0-91.101 -proposed tracker (LP: #2043452)

  * USB bus error after upgrading to proposed kernel on lunar and jammy
    (LP: #2043197)
    - USB: core: Fix oversight in SuperSpeed initialization

linux (5.15.0-90.100) jammy; urgency=medium

  * jammy/linux: 5.15.0-90.100 -proposed tracker (LP: #2041603)

  * CVE-2023-25775
    - RDMA/irdma: Remove irdma_uk_mw_bind()
    - RDMA/irdma: Remove irdma_sc_send_lsmm_nostag()
    - RDMA/irdma: Remove irdma_cqp_up_map_cmd()
    - RDMA/irdma: Remove irdma_get_hw_addr()
    - RDMA/irdma: Make irdma_uk_cq_init() return a void
    - RDMA/irdma: optimize rx path by removing unnecessary copy
    - RDMA/irdma: Remove enum irdma_status_code
    - RDMA/irdma: Remove excess error variables
    - RDMA/irdma: Prevent zero-length STAG registration

  * CVE-2023-39189
    - netfilter: nfnetlink_osf: avoid OOB read

  * SMC stats: Wrong bucket calculation for payload of exactly 4096 bytes
    (LP: #2039575)
    - net/smc: Fix pos miscalculation in statistics

  * CVE-2023-45871
    - igb: set max size RX buffer when store bad packet is enabled

  * CVE-2023-39193
    - netfilter: xt_sctp: validate the flag_info count

  * CVE-2023-39192
    - netfilter: xt_u32: validate user space input

  * CVE-2023-31085
    - ubi: Refuse attaching if mtd's erasesize is 0

  * CVE-2023-5717
    - perf: Disallow mis-matched inherited group reads

  * CVE-2023-5178
    - nvmet-tcp: Fix a possible UAF in queue intialization setup

  * CVE-2023-5158
    - vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()

  * [SRU][J/L/M] UBUNTU: [Packaging] Make WWAN driver a loadable module
    (LP: #2033406)
    - [Packaging] Make WWAN driver loadable modules

  * HP ProBook 450 G8 Notebook fail to wifi test (LP: #2037513)
    - iwlwifi: mvm: Don't fail if PPAG isn't supported
    - wifi: iwlwifi: fw: skip PPAG for JF

  * usbip: error: failed to open /usr/share/hwdata//usb.ids (LP: #2039439)
    - [Packaging] Make linux-tools-common depend on hwdata

  * scripts/pahole-flags.sh change return to exit 0 (LP: #2035123)
    - SAUCE: scripts/pahole-flags.sh change return to exit 0

  * Unable to use nvme drive to install Ubuntu 23.10 (LP: #2040157)
    - misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to
      probe

  * Jammy update: v5.15.131 upstream stable release (LP: #2039610)
    - erofs: ensure that the post-EOF tails are all zeroed
    - ksmbd: fix wrong DataOffset validation of create context
    - ksmbd: replace one-element array with flex-array member in struct
      smb2_ea_info
    - ARM: pxa: remove use of symbol_get()
    - mmc: au1xmmc: force non-modular build and remove symbol_get usage
    - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    - USB: serial: option: add Quectel EM05G variant (0x030e)
    - USB: serial: option: add FOXCONN T99W368/T99W373 product
    - ALSA: usb-audio: Fix init call orders for UAC1
    - usb: dwc3:...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gkeop/5.15.0-1034.40 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-gkeop' to 'verification-done-jammy-linux-gkeop'. If the problem still exists, change the tag 'verification-needed-jammy-linux-gkeop' to 'verification-failed-jammy-linux-gkeop'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-intel-iotg/5.15.0-1046.52 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-intel-iotg' to 'verification-done-jammy-linux-intel-iotg'. If the problem still exists, change the tag 'verification-needed-jammy-linux-intel-iotg' to 'verification-failed-jammy-linux-intel-iotg'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency/5.15.0-91.101 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-lowlatency' to 'verification-done-jammy-linux-lowlatency'. If the problem still exists, change the tag 'verification-needed-jammy-linux-lowlatency' to 'verification-failed-jammy-linux-lowlatency'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp-5.15/5.15.0-1048.56~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-gcp-5.15' to 'verification-done-focal-linux-gcp-5.15'. If the problem still exists, change the tag 'verification-needed-focal-linux-gcp-5.15' to 'verification-failed-focal-linux-gcp-5.15'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia-tegra/5.15.0-1020.20 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-nvidia-tegra' to 'verification-done-jammy-linux-nvidia-tegra'. If the problem still exists, change the tag 'verification-needed-jammy-linux-nvidia-tegra' to 'verification-failed-jammy-linux-nvidia-tegra'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia-6.5/6.5.0-1007.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-nvidia-6.5' to 'verification-done-jammy-linux-nvidia-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-nvidia-6.5' to 'verification-failed-jammy-linux-nvidia-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia-tegra-igx/5.15.0-1007.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-nvidia-tegra-igx' to 'verification-done-jammy-linux-nvidia-tegra-igx'. If the problem still exists, change the tag 'verification-needed-jammy-linux-nvidia-tegra-igx' to 'verification-failed-jammy-linux-nvidia-tegra-igx'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-intel-iotg-5.15/5.15.0-1046.52~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-intel-iotg-5.15' to 'verification-done-focal-linux-intel-iotg-5.15'. If the problem still exists, change the tag 'verification-needed-focal-linux-intel-iotg-5.15' to 'verification-failed-focal-linux-intel-iotg-5.15'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia-tegra-5.15/5.15.0-1020.20~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-nvidia-tegra-5.15' to 'verification-done-focal-linux-nvidia-tegra-5.15'. If the problem still exists, change the tag 'verification-needed-focal-linux-nvidia-tegra-5.15' to 'verification-failed-focal-linux-nvidia-tegra-5.15'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency-hwe-6.5/6.5.0-14.14.1~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.5' to 'verification-done-jammy-linux-lowlatency-hwe-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.5' to 'verification-failed-jammy-linux-lowlatency-hwe-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Kleber Sacilotto de Souza (kleber-souza)]

The fix for the Mantic kernel has already been released with linux 6.5.0-14.14:
https://launchpad.net/ubuntu/+source/linux/6.5.0-14.14

This version was promoted to -updates/-security on 2023-12-05, therefore the bug should have been marked automatically as "Fix Released". Assuming this was an issue with Launchpad janitor, I'll mark it manually as released.

[Frank Heimes (fheimes)]

Thx for the hint, klebers - I missed that.
With that I can also set the project entry to Fix Released and close this bug.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-bluefield/5.15.0-1033.35 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-bluefield' to 'verification-done-jammy-linux-bluefield'. If the problem still exists, change the tag 'verification-needed-jammy-linux-bluefield' to 'verification-failed-jammy-linux-bluefield'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp-6.2/6.2.0-1021.23~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-gcp-6.2' to 'verification-done-jammy-linux-gcp-6.2'. If the problem still exists, change the tag 'verification-needed-jammy-linux-gcp-6.2' to 'verification-failed-jammy-linux-gcp-6.2'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-mtk/5.15.0-1030.34 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-done-jammy-linux-mtk'. If the problem still exists, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-failed-jammy-linux-mtk'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!