Bug #1559194 “Bad page state in process genwqe_gunzip pfn:3c275 ...” : Bugs : Ubuntu on IBM z Systems

Revision history for this message

bugproxy (bugproxy) wrote on 2016-03-18: zEDC_compression_1g_logs

#1

zEDC_compression_1g_logs Edit (35.7 KiB, application/octet-stream)

Default Comment by Bridge

tags:	added: architecture-s39064 bugnameltc-139188 severity-critical targetmilestone-inin1604
Changed in ubuntu:
assignee:	nobody → Skipper Bug Screeners (skipper-screen-team)

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2016-03-18:

#2

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1559194/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

tags:

added: bot-comment

Dimitri John Ledkov (xnox) on 2016-03-18

affects:

ubuntu → linux (Ubuntu)

dann frazier (dannf) on 2016-03-18

Changed in linux (Ubuntu):
assignee:	Skipper Bug Screeners (skipper-screen-team) → Andy Whitcroft (apw)

Revision history for this message

bugproxy (bugproxy) wrote on 2016-03-31: Comment bridged from LTC Bugzilla

#3

------- Comment From <email address hidden> 2016-03-31 06:36 EDT-------
Just a heads-up: the root cause for this problem is still under investigation.

Revision history for this message

Dimitri John Ledkov (xnox) wrote on 2016-04-06:

#4

Setting to incomplete for now, pending more information.

Changed in linux (Ubuntu):
status:	New → Incomplete

Revision history for this message

Dimitri John Ledkov (xnox) wrote on 2016-04-08:

#5

Hello this is being re-escalated by hws again, are there any actions that are expected from our side on this ticket? Or should this priority be lowered?

dann frazier (dannf) on 2016-04-08

Changed in ubuntu-z-systems:
importance:	Undecided → Critical
status:	New → Incomplete

Revision history for this message

bugproxy (bugproxy) wrote on 2016-04-12:

#6

------- Comment From <email address hidden> 2016-04-12 11:40 EDT-------
IBM is working on a upstream fix. Therefore changed severity from ship -> high , for further tracking purposes.

tags:

added: severity-high
removed: severity-critical

Revision history for this message

Dimitri John Ledkov (xnox) wrote on 2016-04-12:

#7

As far as I understand this is a runtime bug, but is not install time critical. If we respin a kernel for any reason between now and final release we will try to include a fix for this bug if a backported patch for 4.4 stable exists. Othwerwise we will work on landing this as part of the SRU (Stable Release Update) cadence for the kernel. Therefore opening tasks for both xenial and y-series, in anticipation for a fix.

Changed in linux (Ubuntu Xenial):
importance:	Undecided → High
Changed in ubuntu-z-systems:
importance:	Critical → High

bugproxy (bugproxy) on 2016-04-20

tags:

added: targetmilestone-inin16041
removed: targetmilestone-inin1604

Dimitri John Ledkov (xnox) on 2016-04-21

Changed in ubuntu-release-notes:
status:	New → Fix Released

Dimitri John Ledkov (xnox) on 2016-07-05

Changed in linux (Ubuntu Yakkety):
importance:	High → Wishlist
Changed in linux (Ubuntu Xenial):
importance:	High → Wishlist

Revision history for this message

Dimitri John Ledkov (xnox) wrote on 2016-08-05:

#8

Is there an upstream fix for this problem? Should this ticket be closed, there were no updates for a while about this issue.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-08-09:

#9

------- Comment From <email address hidden> 2016-08-09 10:12 EDT-------
This is the commit. does that help?

https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial/commit/?h=master-next&id=ab72705a2737c90c03d24b91afa10ef1b7403448

Dimitri John Ledkov (xnox) on 2016-08-12

Changed in ubuntu-z-systems:
status:	Incomplete → Fix Released
Changed in linux (Ubuntu Xenial):
status:	Incomplete → Fix Released
Changed in linux (Ubuntu Yakkety):
status:	Incomplete → Fix Released

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-02:

#10

------- Comment From <email address hidden> 2016-09-02 07:48 EDT-------
(In reply to comment #29)
> This is the commit. does that help?
>
> https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial/
> commit/?h=master-next&id=ab72705a2737c90c03d24b91afa10ef1b7403448

The error is still reproducible with kernel 4.4.0-33
Additional warning message before the BUG is available:

------------[ cut here ]------------
WARNING: at /build/linux-o03cxz/linux-4.4.0/arch/s390/include/asm/pci_dma.h:141
Modules linked in: qeth_l2 ghash_s390 prng aes_s390 des_s390 des_generic sha512_s390 sha256_s390 sha1_s390 sha_common genwqe_card qeth crc_itu_t qdio ccwgroup vmur dm_multipath dasd_eckd_mod dasd_mod
CPU: 2 PID: 3293 Comm: genwqe_gunzip Not tainted 4.4.0-33-generic #52-Ubuntu
task: 0000000032c7e270 ti: 00000000324e4000 task.ti: 00000000324e4000
Krnl PSW : 0404c00180000000 0000000000156346 (dma_update_cpu_trans+0x9e/0xa8)
R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
Krnl GPRS: 00000000324e7bcd 0000000000c3c34a 0000000027628298 000000003215b400
0000000000000400 0000000000001fff 0000000000000400 0000000116853000
07000000324e7b1e 0000000000000001 0000000000000001 0000000000000001
0000000000001000 0000000116854000 0000000000156402 00000000324e7a38
Krnl Code: 000000000015633a: 95001000 cli 0(%r1),0
000000000015633e: a774ffc3 brc 7,1562c4
#0000000000156342: a7f40001 brc 15,156344
>0000000000156346: 92011000 mvi 0(%r1),1
000000000015634a: a7f4ffbd brc 15,1562c4
000000000015634e: 0707 bcr 0,%r7
0000000000156350: c00400000000 brcl 0,156350
0000000000156356: eb7ff0500024 stmg %r7,%r15,80(%r15)
Call Trace:
([<00000000001563e0>] dma_update_trans+0x90/0x228)
[<00000000001565dc>] s390_dma_unmap_pages+0x64/0x160
[<00000000001567c2>] s390_dma_free+0x62/0x98
[<000003ff801310ce>] __genwqe_free_consistent+0x56/0x70 [genwqe_card]
[<000003ff801316d0>] genwqe_free_sync_sgl+0xf8/0x160 [genwqe_card]
[<000003ff8012bd6e>] ddcb_cmd_cleanup+0x86/0xa8 [genwqe_card]
[<000003ff8012c1c0>] do_execute_ddcb+0x110/0x348 [genwqe_card]
[<000003ff8012c914>] genwqe_ioctl+0x51c/0xc20 [genwqe_card]
[<000000000032513a>] do_vfs_ioctl+0x3b2/0x518
[<0000000000325344>] SyS_ioctl+0xa4/0xb8
[<00000000007b86c6>] system_call+0xd6/0x264
[<000003ff9e8e520a>] 0x3ff9e8e520a
Last Breaking-Event-Address:
[<0000000000156342>] dma_update_cpu_trans+0x9a/0xa8
---[ end trace 35996336235145c8 ]---
BUG: Bad page state in process jbd2/dasdb1-8 pfn:3215b
page:000003d100c856c0 count:-1 mapcount:0 mapping: (null) index:0x0
flags: 0x3fffc0000000000()
page dumped because: nonzero _count

------- Comment From Alexander.Efremkin1@de.ibm.com 2016-09-02 07:48 EDT-------
(In reply to comment #29)
> This is the commit. does that help?
>
> https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial/
> commit/?h=master-next&id=ab72705a2737c90c03d24b91afa10ef1b7403448

The error is still reproducible with kernel 4.4.0-33
Additional warning message before the BUG is available:

------------[ cut here ]------------
WARNING: at /build/linux-o03cxz/linux-4.4.0/arch/s390/include/asm/pci_dma.h:141
Modules linked in: qeth_l2 ghash_s390 prng aes_s390 des_s390 des_generic sha512_s390 sha256_s390 sha1_s390 sha_common genwqe_card qeth crc_itu_t qdio ccwgroup vmur dm_multipath dasd_eckd_mod dasd_mod
CPU: 2 PID: 3293 Comm: genwqe_gunzip Not tainted 4.4.0-33-generic #52-Ubuntu
task: 0000000032c7e270 ti: 00000000324e4000 task.ti: 00000000324e4000
Krnl PSW : 0404c00180000000 0000000000156346 (dma_update_cpu_trans+0x9e/0xa8)
R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
Krnl GPRS: 00000000324e7bcd 0000000000c3c34a 0000000027628298 000000003215b400
0000000000000400 0000000000001fff 0000000000000400 0000000116853000
07000000324e7b1e 0000000000000001 0000000000000001 0000000000000001
0000000000001000 0000000116854000 0000000000156402 00000000324e7a38
Krnl Code: 000000000015633a: 95001000		cli	0(%r1),0
000000000015633e: a774ffc3		brc	7,1562c4
#0000000000156342: a7f40001		brc	15,156344
>0000000000156346: 92011000		mvi	0(%r1),1
000000000015634a: a7f4ffbd		brc	15,1562c4
000000000015634e: 0707		bcr	0,%r7
0000000000156350: c00400000000	brcl	0,156350
0000000000156356: eb7ff0500024	stmg	%r7,%r15,80(%r15)
Call Trace:
([<00000000001563e0>] dma_update_trans+0x90/0x228)
[<00000000001565dc>] s390_dma_unmap_pages+0x64/0x160
[<00000000001567c2>] s390_dma_free+0x62/0x98
[<000003ff801310ce>] __genwqe_free_consistent+0x56/0x70 [genwqe_card]
[<000003ff801316d0>] genwqe_free_sync_sgl+0xf8/0x160 [genwqe_card]
[<000003ff8012bd6e>] ddcb_cmd_cleanup+0x86/0xa8 [genwqe_card]
[<000003ff8012c1c0>] do_execute_ddcb+0x110/0x348 [genwqe_card]
[<000003ff8012c914>] genwqe_ioctl+0x51c/0xc20 [genwqe_card]
[<000000000032513a>] do_vfs_ioctl+0x3b2/0x518
[<0000000000325344>] SyS_ioctl+0xa4/0xb8
[<00000000007b86c6>] system_call+0xd6/0x264
[<000003ff9e8e520a>] 0x3ff9e8e520a
Last Breaking-Event-Address:
[<0000000000156342>] dma_update_cpu_trans+0x9a/0xa8
---[ end trace 35996336235145c8 ]---
BUG: Bad page state in process jbd2/dasdb1-8  pfn:3215b
page:000003d100c856c0 count:-1 mapcount:0 mapping:          (null) index:0x0
flags: 0x3fffc0000000000()
page dumped because: nonzero _count

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-02: dmesg for re-run on kernel 4.4.0-33

#11

------- Comment (attachment only) From <email address hidden> 2016-09-02 08:48 EDT-------

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-02: Comment bridged from LTC Bugzilla

#12

------- Comment From <email address hidden> 2016-09-02 09:22 EDT-------
From the dmesg it looks like this time ext4 page allocation stumbles upon the doubly freed page first, but it is immediately after the page got corrupted by the double free (indicated by the WARNING), so this just means that ext4 happened to be the first to get its fingers on the corrupted page during a page alloc. It could hit anyone, and we also see later another occurrence where copy_pte_range() stumbles over another corrupted page (no WARNING before that because it is a WARN_ONCE).

We still need to find the root cause for the double free and the resulting page corruption (count -1), and for that we only have the WARNING trace as reliable hint for a double free. So my analysis from comment #5 is still valid, even though this time genwqe itself is not the one who stumbled over the corrupted page, it was still involved in the double free (anyone can see the corrupted page afterwards, genwqe was just a more likely candidate because it was an active consumer at the time).

BTW, instead of "double free" of course a call of dma_free() on previously unmapped addresses would result in the same issue, but a double free is much more likely, e.g. caused by broken error handling with "off by one" or other issues. Speaking of error handling, the "genwqe 0001:00:00.0: [genwqe_map_pages] err: no dma addr daddr=ffffffffffffffff!" messages may be a good starting point to verify the genwqe error handling and the page freeing strategy. Those messages by itself are no problem and even expected given the nature of the test (online/offline and failing rpcit), but of course there is some error handling involved which may have issues that could lead to a double free.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-06:

#13

------- Comment From <email address hidden> 2016-09-06 10:21 EDT-------
I think I found the bug in the genwqe code:

ddcb_cmd_fixups() -> genwqe_alloc_sync_sgl() (fails in f/lpage, but sgl->sgl != NULL and f/lpage maybe also != NULL) -> ddcb_cmd_cleanup() -> genwqe_free_sync_sgl() (double free, because sgl->sgl != NULL and f/lpage maybe also != NULL)

In this scenario we would have exactly the kind of double free that would explain the WARNING / Bad page state, and as expected it is caused by broken error handling (cleanup).

Not being familiar with the genwqe code, it would be good if Frank could have a look at the patch.

Using the Ubuntu git source, tag Ubuntu-4.4.0-33.52, I can reproduce the "Bad page state" issue, and with the patch on top I cannot reproduce it any more.

Alex, I'll attach a debian kernel package with the patch applied, please verify if it also solves the issue for you.

Frank, I'll attach the patch, please comment.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-06: genwqe-bad-page.patch

#14

genwqe-bad-page.patch Edit (933 bytes, text/plain)

------- Comment on attachment From <email address hidden> 2016-09-06 10:23 EDT-------

Fix double free in the genwqe code, resulting from missing pointer clearing in genwqe_alloc_sync_sgl() error handling.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-06: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#15

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Tim Gardner (timg-tpi) on 2016-09-06

Changed in linux (Ubuntu Xenial):
status:	Fix Released → In Progress
Changed in linux (Ubuntu Yakkety):
status:	Fix Released → In Progress

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-12: Comment bridged from LTC Bugzilla

#18

------- Comment From <email address hidden> 2016-09-12 10:45 EDT-------
(In reply to comment #36)

> Alex, I'll attach a debian kernel package with the patch applied, please
> verify if it also solves the issue for you.

Thanks, with the attached kernel I could not reproduce this issue.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-12: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#19

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-09-30:

#20

Hello IBM - is this patch going upstream ? It is not currently in a consumable form, i.e., no provenance.

Changed in linux (Ubuntu Xenial):
assignee:	Andy Whitcroft (apw) → Tim Gardner (timg-tpi)
Changed in linux (Ubuntu Yakkety):
assignee:	Andy Whitcroft (apw) → Tim Gardner (timg-tpi)

Revision history for this message

bugproxy (bugproxy) wrote on 2016-09-30:

#21

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-06: Comment bridged from LTC Bugzilla

#23

------- Comment From <email address hidden> 2016-10-06 09:13 EDT-------
We are waiting for review/approval from the genwqe owner fromFrank Haverkamp, assigning LTC bugzilla to him.

Frank, please handle ASAP in order to meet the current merge window for 4.9.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-06: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#24

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-07:

#28

Default Comment by Bridge

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-12:

#29

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-19: Comment bridged from LTC Bugzilla

#30

------- Comment From <email address hidden> 2016-10-19 11:41 EDT-------
Patch was submitted upstream, should be added in a few days, here is the LKML discussion link: https://marc.info/?l=linux-kernel&m=147688806928316&w=2

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-19: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#31

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2016-10-19:

#32

https://lists.ubuntu.com/archives/kernel-team/2016-October/080462.html

Tim Gardner (timg-tpi) on 2016-10-26

Changed in linux (Ubuntu Xenial):
status:	In Progress → Fix Committed
Changed in linux (Ubuntu Yakkety):
status:	In Progress → Fix Committed

Revision history for this message

bugproxy (bugproxy) wrote on 2016-10-26:

#33

------- Comment on attachment From <email address hidden> 2016-09-06 10:25 EDT-------

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

Luis Henriques (henrix) wrote on 2016-11-16:

#34

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-xenial

Revision history for this message

Luis Henriques (henrix) wrote on 2016-11-16:

#35

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-yakkety' to 'verification-done-yakkety'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-yakkety

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-21:

#36

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-21: Comment bridged from LTC Bugzilla

#37

------- Comment From <email address hidden> 2016-11-21 08:05 EDT-------
Verified , could not be reproduced anymore..

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-21: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#38

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

Luis Henriques (henrix) wrote on 2016-11-21:

#39

As per comment #37 I'm tagging this bug as verified.

tags:

added: verification-done-xenial verification-done-yakkety
removed: verification-needed-xenial verification-needed-yakkety

Revision history for this message

Steve Langasek (vorlon) wrote on 2016-11-30: Update Released

#40

The verification of the Stable Release Update for linux-lts-xenial has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-11-30:

#41

Download full text (22.5 KiB)

This bug was fixed in the package linux - 4.4.0-51.72

---------------
linux (4.4.0-51.72) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1644611

  * 4.4.0-1037-snapdragon #41: kernel panic on boot (LP: #1644596)
    - Revert "dma-mapping: introduce the DMA_ATTR_NO_WARN attribute"
    - Revert "powerpc: implement the DMA_ATTR_NO_WARN attribute"
    - Revert "nvme: use the DMA_ATTR_NO_WARN attribute"

linux (4.4.0-50.71) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1644169

  * xenial 4.4.0-49.70 kernel breaks LXD userspace (LP: #1644165)
    - Revert "UBUNTU: SAUCE: (namespace) fuse: Allow user namespace mounts by
      default"
    - Revert "UBUNTU: SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for
      userns root"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Don't remove suid for
      CAP_FSETID in s_user_ns""
    - Revert "UBUNTU: SAUCE: (namespace) fs: Allow superblock owner to change
      ownership of inodes"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Allow superblock owner to
      change ownership of inodes with unmappable ids""
    - Revert "UBUNTU: SAUCE: (namespace) security/integrity: Harden against
      malformed xattrs"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: ima/evm: Allow root in s_user_ns
      to set xattrs""
    - Revert "(namespace) dquot: For now explicitly don't support filesystems
      outside of init_user_ns"
    - Revert "(namespace) quota: Handle quota data stored in s_user_ns in
      quota_setxquota"
    - Revert "(namespace) quota: Ensure qids map to the filesystem"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: quota: Convert ids relative to
      s_user_ns""
    - Revert "(namespace) Revert "UBUNTU: SAUCE: quota: Require that qids passed
      to dqget() be valid and map into s_user_ns""
    - Revert "(namespace) vfs: Don't create inodes with a uid or gid unknown to
      the vfs"
    - Revert "(namespace) vfs: Don't modify inodes with a uid or gid unknown to
      the vfs"
    - Revert "UBUNTU: SAUCE: (namespace) fuse: Translate ids in posix acl xattrs"
    - Revert "UBUNTU: SAUCE: (namespace) posix_acl: Export
      posix_acl_fix_xattr_userns() to modules"
    - Revert "(namespace) vfs: Verify acls are valid within superblock's
      s_user_ns."
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Update posix_acl support to
      handle user namespace mounts""
    - Revert "(namespace) fs: Refuse uid/gid changes which don't map into
      s_user_ns"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Refuse uid/gid changes which
      don't map into s_user_ns""
    - Revert "(namespace) mnt: Move the FS_USERNS_MOUNT check into sget_userns"

linux (4.4.0-49.70) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1640921

  * Infiniband driver (kernel module) needed for Azure (LP: #1641139)
    - SAUCE: RDMA Infiniband for Windows Azure
    - [Config] CONFIG_HYPERV_INFINIBAND_ND=m
    - SAUCE: Makefile RDMA infiniband driver for Windows Azure
    - [Config] Add hv_network_direct.ko to generic inclusion list
    - SAUCE: RDMA Infiniband for Windows Azure is dependent on amd64...

This bug was fixed in the package linux - 4.4.0-51.72

---------------
linux (4.4.0-51.72) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1644611

* 4.4.0-1037-snapdragon #41: kernel panic on boot (LP: #1644596)
    - Revert "dma-mapping: introduce the DMA_ATTR_NO_WARN attribute"
    - Revert "powerpc: implement the DMA_ATTR_NO_WARN attribute"
    - Revert "nvme: use the DMA_ATTR_NO_WARN attribute"

linux (4.4.0-50.71) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1644169

* xenial 4.4.0-49.70 kernel breaks LXD userspace (LP: #1644165)
    - Revert "UBUNTU: SAUCE: (namespace) fuse: Allow user namespace mounts by
      default"
    - Revert "UBUNTU: SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for
      userns root"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Don't remove suid for
      CAP_FSETID in s_user_ns""
    - Revert "UBUNTU: SAUCE: (namespace) fs: Allow superblock owner to change
      ownership of inodes"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Allow superblock owner to
      change ownership of inodes with unmappable ids""
    - Revert "UBUNTU: SAUCE: (namespace) security/integrity: Harden against
      malformed xattrs"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: ima/evm: Allow root in s_user_ns
      to set xattrs""
    - Revert "(namespace) dquot: For now explicitly don't support filesystems
      outside of init_user_ns"
    - Revert "(namespace) quota: Handle quota data stored in s_user_ns in
      quota_setxquota"
    - Revert "(namespace) quota: Ensure qids map to the filesystem"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: quota: Convert ids relative to
      s_user_ns""
    - Revert "(namespace) Revert "UBUNTU: SAUCE: quota: Require that qids passed
      to dqget() be valid and map into s_user_ns""
    - Revert "(namespace) vfs: Don't create inodes with a uid or gid unknown to
      the vfs"
    - Revert "(namespace) vfs: Don't modify inodes with a uid or gid unknown to
      the vfs"
    - Revert "UBUNTU: SAUCE: (namespace) fuse: Translate ids in posix acl xattrs"
    - Revert "UBUNTU: SAUCE: (namespace) posix_acl: Export
      posix_acl_fix_xattr_userns() to modules"
    - Revert "(namespace) vfs: Verify acls are valid within superblock's
      s_user_ns."
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Update posix_acl support to
      handle user namespace mounts""
    - Revert "(namespace) fs: Refuse uid/gid changes which don't map into
      s_user_ns"
    - Revert "(namespace) Revert "UBUNTU: SAUCE: fs: Refuse uid/gid changes which
      don't map into s_user_ns""
    - Revert "(namespace) mnt: Move the FS_USERNS_MOUNT check into sget_userns"

linux (4.4.0-49.70) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1640921

* Infiniband driver (kernel module) needed for Azure (LP: #1641139)
    - SAUCE: RDMA Infiniband for Windows Azure
    - [Config] CONFIG_HYPERV_INFINIBAND_ND=m
    - SAUCE: Makefile RDMA infiniband driver for Windows Azure
    - [Config] Add hv_network_direct.ko to generic inclusion list
    - SAUCE: RDMA Infiniband for Windows Azure is dependent on amd64

linux (4.4.0-48.69) xenial; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1640758

* lxc-attach to malicious container allows access to host (LP: #1639345)
    - Revert "UBUNTU: SAUCE: (noup) ptrace: being capable wrt a process requires
      mapped uids/gids"
    - (upstream) mm: Add a user_ns owner to mm_struct and fix ptrace permission
      checks

* take 'P' command from upstream xmon (LP: #1637978)
    - powerpc/xmon: Add xmon command to dump process/task similar to ps(1)

* zfs: importing zpool with vdev on zvol hangs kernel (LP: #1636517)
    - SAUCE: (noup) Update zfs to 0.6.5.6-0ubuntu15

* I2C touchpad does not work on AMD platform (LP: #1612006)
    - pinctrl/amd: Configure GPIO register using BIOS settings
    - pinctrl/amd: switch to using a bool for level

* [LTCTest] vfio_pci not loaded on Ubuntu 16.10 by default (LP: #1636733)
    - [Config] CONFIG_VFIO_PCI=y for ppc64el

* QEMU throws failure msg while booting guest with SRIOV VF (LP: #1630554)
    - KVM: PPC: Always select KVM_VFIO, plus Makefile cleanup

* Allow fuse user namespace mounts by default in xenial (LP: #1634964)
    - (namespace) mnt: Move the FS_USERNS_MOUNT check into sget_userns
    - (namespace) Revert "UBUNTU: SAUCE: fs: Refuse uid/gid changes which don't
      map into s_user_ns"
    - (namespace) fs: Refuse uid/gid changes which don't map into s_user_ns
    - (namespace) Revert "UBUNTU: SAUCE: fs: Update posix_acl support to handle
      user namespace mounts"
    - (namespace) vfs: Verify acls are valid within superblock's s_user_ns.
    - SAUCE: (namespace) posix_acl: Export posix_acl_fix_xattr_userns() to modules
    - SAUCE: (namespace) fuse: Translate ids in posix acl xattrs
    - (namespace) vfs: Don't modify inodes with a uid or gid unknown to the vfs
    - (namespace) vfs: Don't create inodes with a uid or gid unknown to the vfs
    - (namespace) Revert "UBUNTU: SAUCE: quota: Require that qids passed to
      dqget() be valid and map into s_user_ns"
    - (namespace) Revert "UBUNTU: SAUCE: quota: Convert ids relative to s_user_ns"
    - (namespace) quota: Ensure qids map to the filesystem
    - (namespace) quota: Handle quota data stored in s_user_ns in quota_setxquota
    - (namespace) dquot: For now explicitly don't support filesystems outside of
      init_user_ns
    - (namespace) Revert "UBUNTU: SAUCE: ima/evm: Allow root in s_user_ns to set
      xattrs"
    - SAUCE: (namespace) security/integrity: Harden against malformed xattrs
    - (namespace) Revert "UBUNTU: SAUCE: fs: Allow superblock owner to change
      ownership of inodes with unmappable ids"
    - SAUCE: (namespace) fs: Allow superblock owner to change ownership of inodes
    - (namespace) Revert "UBUNTU: SAUCE: fs: Don't remove suid for CAP_FSETID in
      s_user_ns"
    - SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root
    - SAUCE: (namespace) fuse: Allow user namespace mounts by default

* [Feature] KBL - New device ID for Kabypoint(KbP) (LP: #1591618)
    - SAUCE: mfd: lpss: Fix Intel Kaby Lake PCH-H properties

* hio: SSD data corruption under stress test (LP: #1638700)
    - SAUCE: hio: set bi_error field to signal an I/O error on a BIO
    - SAUCE: hio: splitting bio in the entry of .make_request_fn

* Module sha1-mb fails to load (LP: #1637165)
    - crypto: sha-mb - Fix load failure
    - crypto: mcryptd - Fix load failure

* please include mlx5_core modules in linux-image-generic package
    (LP: #1635223)
    - [Config] Include mlx5 in main package

* xgene i2c slimpro driver fails to load (LP: #1625232)
    - mailbox: Add support for APM X-Gene platform mailbox driver
    - mailbox/xgene-slimpro: Checking for IS_ERR instead of NULL
    - mailbox: xgene-slimpro: Fix wrong test for devm_kzalloc
    - [Config] Enabled XGENE_SLIMPRO_MBOX as a module

* [Dell][XPS]Touchscreen fails to function after resume from s3 by Lid
    close/open (LP: #1632527)
    - gpio/pinctrl: sunxi: stop poking around in private vars
    - pinctrl: intel: Only restore pins that are used by the driver

* Xenial update to v4.4.30 stable release (LP: #1638272)
    - Revert "x86/mm: Expand the exception table logic to allow new handling
      options"
    - Revert "fix minor infoleak in get_user_ex()"
    - Linux 4.4.30

* Xenial update to v4.4.29 stable release (LP: #1638267)
    - drm/prime: Pass the right module owner through to dma_buf_export()
    - drm/amdgpu: fix IB alignment for UVD
    - drm/amdgpu/dce10: disable hpd on local panels
    - drm/amdgpu/dce8: disable hpd on local panels
    - drm/amdgpu/dce11: disable hpd on local panels
    - drm/amdgpu/dce11: add missing drm_mode_config_cleanup call
    - drm/amdgpu: change vblank_time's calculation method to reduce computational
      error.
    - drm/radeon: narrow asic_init for virtualization
    - drm/radeon/si/dpm: fix phase shedding setup
    - drm/radeon: change vblank_time's calculation method to reduce computational
      error.
    - drm/vmwgfx: Limit the user-space command buffer size
    - drm/i915/gen9: fix the WaWmMemoryReadLatency implementation
    - Revert "drm/i915: Check live status before reading edid"
    - drm/i915: Account for TSEG size when determining 865G stolen base
    - drm/i915: Unalias obj->phys_handle and obj->userptr
    - mm/hugetlb: fix memory offline with hugepage size > memory block size
    - posix_acl: Clear SGID bit when setting file permissions
    - ipip: Properly mark ipip GRO packets as encapsulated.
    - powerpc/eeh: Null check uses of eeh_pe_bus_get
    - perf stat: Fix interval output values
    - genirq/generic_chip: Add irq_unmap callback
    - uio: fix dmem_region_start computation
    - ARM: clk-imx35: fix name for ckil clk
    - spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function
    - mwifiex: correct aid value during tdls setup
    - crypto: gcm - Fix IV buffer size in crypto_gcm_setkey
    - crypto: arm/ghash-ce - add missing async import/export
    - hwrng: omap - Only fail if pm_runtime_get_sync returns < 0
    - ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()
    - ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()
    - ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel
    - ASoC: dapm: Fix kcontrol creation for output driver widget
    - staging: r8188eu: Fix scheduling while atomic splat
    - power: bq24257: Fix use of uninitialized pointer bq->charger
    - dmaengine: ipu: remove bogus NO_IRQ reference
    - x86/mm: Expand the exception table logic to allow new handling options
    - s390/cio: fix accidental interrupt enabling during resume
    - s390/con3270: fix use of uninitialised data
    - s390/con3270: fix insufficient space padding
    - clk: qoriq: fix a register offset error
    - clk: divider: Fix clk_divider_round_rate() to use clk_readl()
    - perf hists browser: Fix event group display
    - perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too
    - perf symbols: Fixup symbol sizes before picking best ones
    - mpt3sas: Don't spam logs if logging level is 0
    - powerpc/nvram: Fix an incorrect partition merge
    - ARM: pxa: pxa_cplds: fix interrupt handling
    - Linux 4.4.29

* KVM: PPC: Book3S HV: Migrate pinned pages out of CMA (LP: #1632045)
    - KVM: PPC: Book3S HV: Migrate pinned pages out of CMA

* Xenial update to v4.4.28 stable release (LP: #1637510)
    - gpio: mpc8xxx: Correct irq handler function
    - mei: me: add kaby point device ids
    - regulator: tps65910: Work around silicon erratum SWCZ010
    - clk: imx6: initialize GPU clocks
    - PM / devfreq: event: remove duplicate devfreq_event_get_drvdata()
    - rtlwifi: Fix missing country code for Great Britain
    - mmc: block: don't use CMD23 with very old MMC cards
    - mmc: sdhci: cast unsigned int to unsigned long long to avoid unexpeted error
    - PCI: Mark Atheros AR9580 to avoid bus reset
    - platform: don't return 0 from platform_get_irq[_byname]() on error
    - cpufreq: intel_pstate: Fix unsafe HWP MSR access
    - parisc: Increase KERNEL_INITIAL_SIZE for 32-bit SMP kernels
    - parisc: Fix kernel memory layout regarding position of __gp
    - parisc: Increase initial kernel mapping size
    - pstore/ramoops: fixup driver removal
    - pstore/core: drop cmpxchg based updates
    - pstore/ram: Use memcpy_toio instead of memcpy
    - pstore/ram: Use memcpy_fromio() to save old buffer
    - perf intel-pt: Fix snapshot overlap detection decoder errors
    - perf intel-pt: Fix estimated timestamps for cycle-accurate mode
    - perf intel-pt: Fix MTC timestamp calculation for large MTC periods
    - dm: mark request_queue dead before destroying the DM device
    - dm: return correct error code in dm_resume()'s retry loop
    - dm mpath: check if path's request_queue is dying in activate_path()
    - dm crypt: fix crash on exit
    - powerpc/vdso64: Use double word compare on pointers
    - powerpc/powernv: Pass CPU-endian PE number to opal_pci_eeh_freeze_clear()
    - powerpc/powernv: Use CPU-endian hub diag-data type in
      pnv_eeh_get_and_dump_hub_diag()
    - powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data()
    - ubi: Deal with interrupted erasures in WL
    - zfcp: fix fc_host port_type with NPIV
    - zfcp: fix ELS/GS request&response length for hardware data router
    - zfcp: close window with unblocked rport during rport gone
    - zfcp: retain trace level for SCSI and HBA FSF response records
    - zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace
    - zfcp: trace on request for open and close of WKA port
    - zfcp: restore tracing of handle for port and LUN with HBA records
    - zfcp: fix D_ID field with actual value on tracing SAN responses
    - zfcp: fix payload trace length for SAN request&response
    - zfcp: trace full payload of all SAN records (req,resp,iels)
    - scsi: zfcp: spin_lock_irqsave() is not nestable
    - fbdev/efifb: Fix 16 color palette entry calculation
    - ovl: Fix info leak in ovl_lookup_temp()
    - ovl: copy_up_xattr(): use strnlen
    - mb86a20s: fix the locking logic
    - mb86a20s: fix demod settings
    - cx231xx: don't return error on success
    - cx231xx: fix GPIOs for Pixelview SBTVD hybrid
    - ALSA: hda - Fix a failure of micmute led when having multi adcs
    - MIPS: Fix -mabi=64 build of vdso.lds
    - MIPS: ptrace: Fix regs_return_value for kernel context
    - lib: move strtobool() to kstrtobool()
    - lib: update single-char callers of strtobool()
    - lib: add "on"/"off" support to kstrtobool
    - Input: i8042 - skip selftest on ASUS laptops
    - Input: elantech - force needed quirks on Fujitsu H760
    - Input: elantech - add Fujitsu Lifebook E556 to force crc_enabled
    - sunrpc: fix write space race causing stalls
    - NFSv4: Don't report revoked delegations as valid in nfs_have_delegation()
    - NFSv4: nfs4_copy_delegation_stateid() must fail if the delegation is invalid
    - NFSv4: Open state recovery must account for file permission changes
    - NFSv4.2: Fix a reference leak in nfs42_proc_layoutstats_generic
    - scsi: Fix use-after-free
    - metag: Only define atomic_dec_if_positive conditionally
    - mm: filemap: don't plant shadow entries without radix tree node
    - ipc/sem.c: fix complex_count vs. simple op race
    - arc: don't leak bits of kernel stack into coredump
    - fs/super.c: fix race between freeze_super() and thaw_super()
    - cifs: Limit the overall credit acquired
    - fs/cifs: keep guid when assigning fid to fileinfo
    - Clarify locking of cifs file and tcon structures and make more granular
    - Display number of credits available
    - Set previous session id correctly on SMB3 reconnect
    - SMB3: GUIDs should be constructed as random but valid uuids
    - Do not send SMB3 SET_INFO request if nothing is changing
    - Cleanup missing frees on some ioctls
    - blkcg: Unlock blkcg_pol_mutex only once when cpd == NULL
    - x86/e820: Don't merge consecutive E820_PRAM ranges
    - kvm: x86: memset whole irq_eoi
    - irqchip/gicv3: Handle loop timeout proper
    - sd: Fix rw_max for devices that report an optimal xfer size
    - hpsa: correct skipping masked peripherals
    - PKCS#7: Don't require SpcSpOpusInfo in Authenticode pkcs7 signatures
    - bnx2x: Prevent false warning for lack of FC NPIV
    - net/mlx4_core: Allow resetting VF admin mac to zero
    - acpi, nfit: check for the correct event code in notifications
    - mm: workingset: fix crash in shadow node shrinker caused by
      replace_page_cache_page()
    - mm: filemap: fix mapping->nrpages double accounting in fuse
    - Using BUG_ON() as an assert() is _never_ acceptable
    - s390/mm: fix gmap tlb flush issues
    - irqchip/gic-v3-its: Fix entry size mask for GITS_BASER
    - isofs: Do not return EACCES for unknown filesystems
    - memstick: rtsx_usb_ms: Runtime resume the device when polling for cards
    - memstick: rtsx_usb_ms: Manage runtime PM when accessing the device
    - arm64: percpu: rewrite ll/sc loops in assembly
    - arm64: kernel: Init MDCR_EL2 even in the absence of a PMU
    - ceph: fix error handling in ceph_read_iter
    - powerpc/mm: Prevent unlikely crash in copro_calculate_slb()
    - mmc: core: Annotate cmd_hdr as __le32
    - mmc: rtsx_usb_sdmmc: Avoid keeping the device runtime resumed when unused
    - mmc: rtsx_usb_sdmmc: Handle runtime PM while changing the led
    - ext4: do not advertise encryption support when disabled
    - jbd2: fix incorrect unlock on j_list_lock
    - ubifs: Fix xattr_names length in exit paths
    - target: Re-add missing SCF_ACK_KREF assignment in v4.1.y
    - target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT
      REACHABLE
    - target: Don't override EXTENDED_COPY xcopy_pt_cmd SCSI status code
    - Linux 4.4.28

* Xenial update to v4.4.27 stable release (LP: #1637501)
    - serial: 8250_dw: Check the data->pclk when get apb_pclk
    - btrfs: assign error values to the correct bio structs
    - drivers: base: dma-mapping: page align the size when unmap_kernel_range
    - fuse: listxattr: verify xattr list
    - fuse: invalidate dir dentry after chmod
    - fuse: fix killing s[ug]id in setattr
    - i40e: avoid NULL pointer dereference and recursive errors on early PCI error
    - brcmfmac: fix memory leak in brcmf_fill_bss_param
    - ASoC: Intel: Atom: add a missing star in a memcpy call
    - reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
    - reiserfs: switch to generic_{get,set,remove}xattr()
    - async_pq_val: fix DMA memory leak
    - scsi: arcmsr: Simplify user_len checking
    - ext4: enforce online defrag restriction for encrypted files
    - ext4: reinforce check of i_dtime when clearing high fields of uid and gid
    - ext4: fix memory leak in ext4_insert_range()
    - ext4: allow DAX writeback for hole punch
    - ext4: release bh in make_indexed_dir
    - dlm: free workqueues after the connections
    - vfs: move permission checking into notify_change() for utimes(NULL)
    - cfq: fix starvation of asynchronous writes
    - Linux 4.4.27

* Xenial update to v4.4.26 stable release (LP: #1637500)
    - x86/build: Build compressed x86 kernels as PIE
    - Linux 4.4.26

* ISST-LTE:pVM nvme 0000:a0:00.0: iommu_alloc failed on NVMe card
    (LP: #1633128)
    - dma-mapping: introduce the DMA_ATTR_NO_WARN attribute
    - powerpc: implement the DMA_ATTR_NO_WARN attribute
    - nvme: use the DMA_ATTR_NO_WARN attribute

* CVE-2016-8658
    - brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()

* Hotkey doesn't work on HP x360 (LP: #1620979)
    - gpiolib: Make it possible to exclude GPIOs from IRQ domain
    - pinctrl: cherryview: Do not mask all interrupts in probe
    - pinctrl: cherryview: Do not add all southwest and north GPIOs to IRQ domain

* Bad page state in process genwqe_gunzip pfn:3c275 in the genwqe device
    driver (LP: #1559194)
    - SAUCE: (noup) Bad page state in process genwqe_gunzip pfn:3c275 in the
      genwqe device driver

* CVE-2016-7425
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

* Add ipvlan module to 16.04 kernel (LP: #1634705)
    - [Config] Add ipvlan to the generic inclusion list

* kernel generates ACPI Exception: AE_NOT_FOUND, Evaluating _DOD incorrectly
    (LP: #1634607)
    - ACPI / video: skip evaluating _DOD when it does not exist

* BT still shows off after resume by wireless hotkey (LP: #1634380)
    - Bluetooth: btusb: Fix atheros firmware download error

* ghash-clmulni-intel module fails to load (LP: #1633058)
    - crypto: ghash-clmulni - Fix load failure
    - crypto: cryptd - Assign statesize properly

* Xenial update to v4.4.25 stable release (LP: #1634153)
    - timekeeping: Fix __ktime_get_fast_ns() regression
    - ALSA: ali5451: Fix out-of-bound position reporting
    - ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants
    - ALSA: usb-line6: use the same declaration as definition in header for MIDI
      manufacturer ID
    - mfd: rtsx_usb: Avoid setting ucr->current_sg.status
    - mfd: atmel-hlcdc: Do not sleep in atomic context
    - mfd: 88pm80x: Double shifting bug in suspend/resume
    - mfd: wm8350-i2c: Make sure the i2c regmap functions are compiled
    - KVM: PPC: Book3s PR: Allow access to unprivileged MMCR2 register
    - KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
    - KVM: PPC: BookE: Fix a sanity check
    - x86/boot: Fix kdump, cleanup aborted E820_PRAM max_pfn manipulation
    - x86/irq: Prevent force migration of irqs which are not in the vector domain
    - x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access
    - ARM: dts: mvebu: armada-390: add missing compatibility string and bracket
    - ARM: dts: MSM8064 remove flags from SPMI/MPP IRQs
    - ARM: cpuidle: Fix error return code
    - ima: use file_dentry()
    - tpm: fix a race condition in tpm2_unseal_trusted()
    - tpm_crb: fix crb_req_canceled behavior
    - Linux 4.4.25

* backport fwts UEFI test driver to Xenial (LP: #1633506)
    - efi: Add efi_test driver for exporting UEFI runtime service interfaces
    - [Config] CONFIG_EFI_TEST=m

* Fix alps driver for multitouch function. (LP: #1633321)
    - HID: alps: fix multitouch cursor issue

* xgene merlin crashes when running as iperf server (LP: #1632739)
    - drivers: net: xgene: optimizing the code
    - xgene: get_phy_device() doesn't return NULL anymore
    - drivers: net: xgene: Get channel number from device binding
    - drivers: net: xgene: constify xgene_cle_ops structure
    - drivers: net: xgene: Fix error handling
    - drivers: net: xgene: fix IPv4 forward crash
    - drivers: net: xgene: fix sharing of irqs
    - drivers: net: xgene: fix ununiform latency across queues
    - drivers: net: xgene: fix statistics counters race condition
    - drivers: net: xgene: fix register offset
    - drivers: net: xgene: Separate set_speed from mac_init
    - drivers: net: xgene: Fix module unload crash - hw resource cleanup
    - drivers: net: xgene: Fix module unload crash - change sw sequence
    - drivers: net: xgene: Fix module unload crash - clkrst sequence
    - drivers: net: phy: xgene: Add MDIO driver
    - drivers: net: xgene: Add backward compatibility
    - drivers: net: xgene: Enable MDIO driver
    - drivers: net: xgene: Use exported functions
    - drivers: net: xgene: ethtool: Use phy_ethtool_gset and sset
    - dtb: xgene: Add MDIO node
    - MAINTAINERS: xgene: Add driver and documentation path
    - [Config] Enable MDIO_XGENE as a modules

* Add support for KabeLake i219-LOM chips (LP: #1632578)
    - e1000e: Initial support for KabeLake

-- Luis Henriques <luis.henriques@canonical.com>  Thu, 24 Nov 2016 17:56:21 +0000

Changed in linux (Ubuntu Xenial):
status:	Fix Committed → Fix Released
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-11-30:

#43

Download full text (26.6 KiB)

This bug was fixed in the package linux - 4.8.0-28.30

---------------
linux (4.8.0-28.30) yakkety; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1641083

  * lxc-attach to malicious container allows access to host (LP: #1639345)
    - Revert "UBUNTU: SAUCE: (noup) ptrace: being capable wrt a process requires
      mapped uids/gids"
    - (upstream) mm: Add a user_ns owner to mm_struct and fix ptrace permission
      checks

  * [Feature] AVX-512 new instruction sets (avx512_4vnniw, avx512_4fmaps)
    (LP: #1637526)
    - x86/cpufeature: Add AVX512_4VNNIW and AVX512_4FMAPS features

* zfs: importing zpool with vdev on zvol hangs kernel (LP: #1636517)
- SAUCE: (noup) Update zfs to 0.6.5.8-0ubuntu4.1

  * Move some device drivers build from kernel built-in to modules
    (LP: #1637303)
    - [Config] CONFIG_TIGON3=m for all arches
    - [Config] CONFIG_VIRTIO_BLK=m, CONFIG_VIRTIO_NET=m

* I2C touchpad does not work on AMD platform (LP: #1612006)
- pinctrl/amd: Configure GPIO register using BIOS settings

  * guest experiencing Transmit Timeouts on CX4 (LP: #1636330)
    - powerpc/64: Re-fix race condition between going idle and entering guest
    - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code

* QEMU throws failure msg while booting guest with SRIOV VF (LP: #1630554)
- KVM: PPC: Always select KVM_VFIO, plus Makefile cleanup

* [Feature] KBL - New device ID for Kabypoint(KbP) (LP: #1591618)
- SAUCE: mfd: lpss: Fix Intel Kaby Lake PCH-H properties

  * hio: SSD data corruption under stress test (LP: #1638700)
    - SAUCE: hio: set bi_error field to signal an I/O error on a BIO
    - SAUCE: hio: splitting bio in the entry of .make_request_fn

  * cleanup primary tree for linux-hwe layering issues (LP: #1637473)
    - [Config] switch Vcs-Git: to yakkety repository
    - [Packaging] handle both linux-lts* and linux-hwe* as backports
    - [Config] linux-tools-common and linux-cloud-tools-common are one per series
    - [Config] linux-source-* is in the primary linux namespace
    - [Config] linux-tools -- always suggest the base package

  * SRU: sync zfsutils-linux and spl-linux changes to linux (LP: #1635656)
    - SAUCE: (noup) Update spl to 0.6.5.8-2, zfs to 0.6.5.8-0ubuntu4 (LP:
      #1635656)

  * [Feature] SKX: perf uncore PMU support (LP: #1591810)
    - perf/x86/intel/uncore: Add Skylake server uncore support
    - perf/x86/intel/uncore: Remove hard-coded implementation for Node ID mapping
      location
    - perf/x86/intel/uncore: Handle non-standard counter offset

  * [Feature] Purley: Memory Protection Keys (LP: #1591804)
    - x86/pkeys: Add fault handling for PF_PK page fault bit
    - mm: Implement new pkey_mprotect() system call
    - x86/pkeys: Make mprotect_key() mask off additional vm_flags
    - x86/pkeys: Allocation/free syscalls
    - x86: Wire up protection keys system calls
    - generic syscalls: Wire up memory protection keys syscalls
    - pkeys: Add details of system call use to Documentation/
    - x86/pkeys: Default to a restrictive init PKRU
    - x86/pkeys: Allow configuration of init_pkru
    - x86/pkeys: Add self-tests

* kernel invalid ...

This bug was fixed in the package linux - 4.8.0-28.30

---------------
linux (4.8.0-28.30) yakkety; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1641083

* lxc-attach to malicious container allows access to host (LP: #1639345)
    - Revert "UBUNTU: SAUCE: (noup) ptrace: being capable wrt a process requires
      mapped uids/gids"
    - (upstream) mm: Add a user_ns owner to mm_struct and fix ptrace permission
      checks

* [Feature] AVX-512 new instruction sets (avx512_4vnniw, avx512_4fmaps)
    (LP: #1637526)
    - x86/cpufeature: Add AVX512_4VNNIW and AVX512_4FMAPS features

* zfs: importing zpool with vdev on zvol hangs kernel (LP: #1636517)
    - SAUCE: (noup) Update zfs to 0.6.5.8-0ubuntu4.1

* Move some device drivers build from kernel built-in to modules
    (LP: #1637303)
    - [Config] CONFIG_TIGON3=m for all arches
    - [Config] CONFIG_VIRTIO_BLK=m, CONFIG_VIRTIO_NET=m

* I2C touchpad does not work on AMD platform (LP: #1612006)
    - pinctrl/amd: Configure GPIO register using BIOS settings

* guest experiencing Transmit Timeouts on CX4 (LP: #1636330)
    - powerpc/64: Re-fix race condition between going idle and entering guest
    - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code

* QEMU throws failure msg while booting guest with SRIOV VF (LP: #1630554)
    - KVM: PPC: Always select KVM_VFIO, plus Makefile cleanup

* [Feature] KBL - New device ID for Kabypoint(KbP) (LP: #1591618)
    - SAUCE: mfd: lpss: Fix Intel Kaby Lake PCH-H properties

* hio: SSD data corruption under stress test (LP: #1638700)
    - SAUCE: hio: set bi_error field to signal an I/O error on a BIO
    - SAUCE: hio: splitting bio in the entry of .make_request_fn

* cleanup primary tree for linux-hwe layering issues (LP: #1637473)
    - [Config] switch Vcs-Git: to yakkety repository
    - [Packaging] handle both linux-lts* and linux-hwe* as backports
    - [Config] linux-tools-common and linux-cloud-tools-common are one per series
    - [Config] linux-source-* is in the primary linux namespace
    - [Config] linux-tools -- always suggest the base package

* SRU: sync zfsutils-linux and spl-linux changes to linux (LP: #1635656)
    - SAUCE: (noup) Update spl to 0.6.5.8-2, zfs to 0.6.5.8-0ubuntu4 (LP:
      #1635656)

* [Feature] SKX: perf uncore PMU support (LP: #1591810)
    - perf/x86/intel/uncore: Add Skylake server uncore support
    - perf/x86/intel/uncore: Remove hard-coded implementation for Node ID mapping
      location
    - perf/x86/intel/uncore: Handle non-standard counter offset

* [Feature] Purley: Memory Protection Keys (LP: #1591804)
    - x86/pkeys: Add fault handling for PF_PK page fault bit
    - mm: Implement new pkey_mprotect() system call
    - x86/pkeys: Make mprotect_key() mask off additional vm_flags
    - x86/pkeys: Allocation/free syscalls
    - x86: Wire up protection keys system calls
    - generic syscalls: Wire up memory protection keys syscalls
    - pkeys: Add details of system call use to Documentation/
    - x86/pkeys: Default to a restrictive init PKRU
    - x86/pkeys: Allow configuration of init_pkru
    - x86/pkeys: Add self-tests

* kernel invalid opcode in intel_powerclamp (LP: #1630774)
    - SAUCE: (no-up) thermal/powerclamp: correct cpu support check

* please include mlx5_core modules in linux-image-generic package
    (LP: #1635223)
    - [Config] Include mlx5 in main package

* [LTCTest] vfio_pci not loaded on Ubuntu 16.10 by default (LP: #1636733)
    - [Config] CONFIG_VFIO_PCI=y for ppc64el

* Yakkety update to v4.8.6 stable release (LP: #1638748)
    - drm/vc4: Fix races when the CS reads from render targets.
    - drm/prime: Pass the right module owner through to dma_buf_export()
    - drm/i915/backlight: setup and cache pwm alternate increment value
    - drm/i915/backlight: setup backlight pwm alternate increment on backlight
      enable
    - drm/amdgpu: fix IB alignment for UVD
    - drm/amdgpu/dce10: disable hpd on local panels
    - drm/amdgpu/dce8: disable hpd on local panels
    - drm/amdgpu/dce11: disable hpd on local panels
    - drm/amdgpu/dce11: add missing drm_mode_config_cleanup call
    - drm/amdgpu: initialize the context reset_counter in amdgpu_ctx_init
    - drm/amdgpu: change vblank_time's calculation method to reduce computational
      error.
    - drm/radeon: narrow asic_init for virtualization
    - drm/radeon/si/dpm: fix phase shedding setup
    - drm/radeon: change vblank_time's calculation method to reduce computational
      error.
    - drm/vmwgfx: Limit the user-space command buffer size
    - drm/fsl-dcu: fix endian issue when using clk_register_divider
    - drm/amd/powerplay: fix mclk not switching back after multi-head was disabled
    - HID: add quirk for Akai MIDImix.
    - drm/i915/skl: Update plane watermarks atomically during plane updates
    - drm/i915: Move CRTC updating in atomic_commit into it's own hook
    - drm/i915/skl: Update DDB values atomically with wms/plane attrs
    - drm/i915/skl: Don't try to update plane watermarks if they haven't changed
    - drm/i915/gen9: only add the planes actually affected by ddb changes
    - drm/i915/gen9: fix the WaWmMemoryReadLatency implementation
    - drm/i915/gen9: minimum scanlines for Y tile is not always 4
    - drm/i915/gen9: fix plane_blocks_per_line on watermarks calculations
    - drm/i915/gen9: fix the watermark res_blocks value
    - drm/i915: SAGV is not SKL-only, so rename a few things
    - drm/i915: introduce intel_has_sagv()
    - drm/i915/kbl: KBL also needs to run the SAGV code
    - Revert "drm/i915: Check live status before reading edid"
    - drm/i915: Account for TSEG size when determining 865G stolen base
    - drm/i915/skl: Ensure pipes with changed wms get added to the state
    - drm/i915: Allow PCH DPLL sharing regardless of DPLL_SDVO_HIGH_SPEED
    - drm/i915: Move long hpd handling into the hotplug work
    - drm/i915: Allow DP to work w/o EDID
    - drm/i915: Just clear the mmiodebug before a register access
    - drm/i915: Unalias obj->phys_handle and obj->userptr
    - posix_acl: Clear SGID bit when setting file permissions
    - rt2x00usb: Fix error return code
    - scsi: cxlflash: Remove the device cleanly in the system shutdown path
    - genirq/generic_chip: Add irq_unmap callback
    - coresight: Remove erroneous dma_free_coherent in tmc_probe
    - uio: fix dmem_region_start computation
    - ARM: clk-imx35: fix name for ckil clk
    - spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function
    - i40e: remove a stray unlock
    - i40e: fix broken i40e_config_rss_aq function
    - mwifiex: correct aid value during tdls setup
    - mwifiex: fix failed to reconnect after interface disabled/enabled
    - ath10k: Add WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT wmi service
    - ath10k: fix sending frame in management path in push txq logic
    - ath10k: fix reporting channel survey data
    - ath10k: fix throughput regression in multi client mode
    - crypto: marvell - Don't overwrite default creq->state during initialization
    - crypto: gcm - Fix IV buffer size in crypto_gcm_setkey
    - crypto: marvell - Update transformation context for each dequeued req
    - crypto: arm/ghash-ce - add missing async import/export
    - crypto: ccp - Fix return value check in ccp_dmaengine_register()
    - hwrng: omap - Only fail if pm_runtime_get_sync returns < 0
    - ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()
    - ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()
    - ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel
    - ASoC: dapm: Fix kcontrol creation for output driver widget
    - ASoC: sst-bxt-rt298: fix obsoleted initializers for array
    - ASoC: sst-bxt-da7219_max98357a: fix obsoleted initializers for array
    - iio: ad5755: fix off-by-one on devnr limit check
    - iio: light: us5182d: Add missing error code assignment before test
    - staging: android ion/hisi: fix dependencies
    - staging: sm750fb: Correctly set CLOCK_PHASE bit of display controller.
    - staging: r8188eu: Fix scheduling while atomic splat
    - staging: ks7010: fix wait_for_completion_interruptible_timeout return
      handling
    - staging: ks7010: declare private functions static
    - IB/hfi1: Move iowait_init() to priv allocate
    - IB/rdmavt: Correct sparse annotation
    - IB/qib: Remove qpt_mask global
    - IB/mlx5: Fix steering resource leak
    - power: bq24257: Fix use of uninitialized pointer bq->charger
    - dmaengine: ipu: remove bogus NO_IRQ reference
    - mm/hugetlb: check for reserved hugepages during memory offline
    - mm/hugetlb: improve locking in dissolve_free_huge_pages()
    - drm/vmwgfx: Avoid validating views on view destruction
    - s390/cio: fix accidental interrupt enabling during resume
    - s390/con3270: fix use of uninitialised data
    - s390/con3270: fix insufficient space padding
    - clk: bcm2835: Skip PLLC clocks when deciding on a new clock parent
    - clk: gcc-msm8996: Fix pcie 2 pipe register offset
    - clk: qcom: select GDSC for msm8996 gcc and mmcc
    - clk: qoriq: fix a register offset error
    - clk: Return errors from clk providers in __of_clk_get_from_provider()
    - clk: core: Force setting the phase delay when no change
    - clk: divider: Fix clk_divider_round_rate() to use clk_readl()
    - perf data: Fix building in 32 bit platform with libbabeltrace
    - perf hists browser: Fix event group display
    - perf powerpc: Fix build-test failure
    - perf ui/tui: Reset output width for hierarchy
    - perf ui/stdio: Always reset output width for hierarchy
    - perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too
    - perf symbols: Fixup symbol sizes before picking best ones
    - iwlwifi: check for valid ethernet address provided by OEM
    - iwlwifi: mvm: fix pending frames tracking on tx resp
    - iwlwifi: mvm: call a different txq_enable function
    - iwlwifi: mvm: free reserved queue on STA removal
    - iwlwifi: mvm: support BAR in reorder buffer
    - iwlwifi: mvm: disable P2P queue on mac context release
    - iwlwifi: mvm: bail out if CTDP start operation fails
    - ARM: dts: sun9i: Add missing #interrupt-cells to R_PIO pinctrl device node
    - pinctrl: qcom: fix masking of pinmux functions
    - mpt3sas: Don't spam logs if logging level is 0
    - powerpc: Always restore FPU/VEC/VSX if hardware transactional memory in use
    - powerpc: Add check_if_tm_restore_required() to giveup_all()
    - powerpc/nvram: Fix an incorrect partition merge
    - powerpc: Fix usage of _PAGE_RO in hugepage
    - ARM: pxa: pxa_cplds: fix interrupt handling
    - ARM: pxa: fix GPIO double shifts
    - ARM: dts: NSP: Correct RAM amount for BCM958625HR board
    - ARM: dts: fix RealView EB SMSC ethernet version
    - ARM: dts: omap3: overo: add missing unit name for lcd35 display
    - PCI: rcar: Fix pci_remap_iospace() failure path
    - PCI: aardvark: Fix pci_remap_iospace() failure path
    - PCI: generic: Fix pci_remap_iospace() failure path
    - PCI: versatile: Fix pci_remap_iospace() failure path
    - PCI: designware: Fix pci_remap_iospace() failure path
    - PCI: tegra: Fix pci_remap_iospace() failure path
    - libnvdimm: clear the internal poison_list when clearing badblocks
    - Linux 4.8.6

* Yakkety update to v4.8.5 stable release (LP: #1637520)
    - gpio: mpc8xxx: Correct irq handler function
    - mei: fix return value on disconnection
    - mei: me: add kaby point device ids
    - regulator: tps65910: Work around silicon erratum SWCZ010
    - clk: imx6: initialize GPU clocks
    - clk: imx6: fix i.MX6DL clock tree to reflect reality
    - spi: spidev_test: Fix buffer overflow in unescape()
    - PM / devfreq: event: remove duplicate devfreq_event_get_drvdata()
    - ath10k: fix copy engine 5 destination ring stuck
    - rtlwifi: Fix missing country code for Great Britain
    - mmc: block: don't use CMD23 with very old MMC cards
    - mmc: sdhci: cast unsigned int to unsigned long long to avoid unexpeted error
    - PCI: Mark Atheros AR9580 to avoid bus reset
    - PCI: tegra: Fix argument order in tegra_pcie_phy_disable()
    - platform: don't return 0 from platform_get_irq[_byname]() on error
    - cpufreq: ti: Use generic platdev driver
    - cpufreq: conservative: Fix next frequency selection
    - cpufreq: skip invalid entries when searching the frequency
    - cpufreq: intel_pstate: Fix unsafe HWP MSR access
    - cpufreq: fix overflow in cpufreq_table_find_index_dl()
    - parisc: Increase KERNEL_INITIAL_SIZE for 32-bit SMP kernels
    - parisc: Fix self-detected CPU stall warnings on Mako machines
    - parisc: Fix kernel memory layout regarding position of __gp
    - parisc: Increase initial kernel mapping size
    - pstore/ramoops: fixup driver removal
    - pstore/core: drop cmpxchg based updates
    - pstore/ram: Use memcpy_toio instead of memcpy
    - pstore/ram: Use memcpy_fromio() to save old buffer
    - perf intel-pt: Fix snapshot overlap detection decoder errors
    - perf intel-pt: Fix estimated timestamps for cycle-accurate mode
    - perf intel-pt: Fix MTC timestamp calculation for large MTC periods
    - dm: mark request_queue dead before destroying the DM device
    - dm: return correct error code in dm_resume()'s retry loop
    - dm rq: take request_queue lock while clearing QUEUE_FLAG_STOPPED
    - dm mpath: check if path's request_queue is dying in activate_path()
    - dm crypt: fix crash on exit
    - powerpc/xmon: Don't use ld on 32-bit
    - powerpc/vdso64: Use double word compare on pointers
    - powerpc/powernv: Pass CPU-endian PE number to opal_pci_eeh_freeze_clear()
    - powerpc/eeh: Null check uses of eeh_pe_bus_get
    - powerpc/powernv: Use CPU-endian hub diag-data type in
      pnv_eeh_get_and_dump_hub_diag()
    - powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data()
    - powerpc/mm: Update FORCE_MAX_ZONEORDER range to allow hugetlb w/4K
    - powerpc/mm/hash64: Fix might_have_hea() check
    - IB/srp: Fix infinite loop when FMR sg[0].offset != 0
    - IB/core: correctly handle rdma_rw_init_mrs() failure
    - ubi: Deal with interrupted erasures in WL
    - zfcp: fix fc_host port_type with NPIV
    - zfcp: fix ELS/GS request&response length for hardware data router
    - zfcp: close window with unblocked rport during rport gone
    - zfcp: retain trace level for SCSI and HBA FSF response records
    - zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace
    - zfcp: trace on request for open and close of WKA port
    - zfcp: restore tracing of handle for port and LUN with HBA records
    - zfcp: fix D_ID field with actual value on tracing SAN responses
    - zfcp: fix payload trace length for SAN request&response
    - zfcp: trace full payload of all SAN records (req,resp,iels)
    - scsi: zfcp: spin_lock_irqsave() is not nestable
    - fbdev/efifb: Fix 16 color palette entry calculation
    - ovl: Fix info leak in ovl_lookup_temp()
    - ovl: copy_up_xattr(): use strnlen
    - mb86a20s: fix the locking logic
    - mb86a20s: fix demod settings
    - cx231xx: don't return error on success
    - cx231xx: fix GPIOs for Pixelview SBTVD hybrid
    - cx231xx: can't proceed if I2C bus register fails
    - ALSA: hda - Fix a failure of micmute led when having multi adcs
    - MIPS: Fix -mabi=64 build of vdso.lds
    - MIPS: ptrace: Fix regs_return_value for kernel context
    - Input: i8042 - skip selftest on ASUS laptops
    - Input: elantech - force needed quirks on Fujitsu H760
    - Input: elantech - add Fujitsu Lifebook E556 to force crc_enabled
    - sunrpc: fix write space race causing stalls
    - NFSD: fix corruption in notifier registration
    - NFS: Fix inode corruption in nfs_prime_dcache()
    - NFSv4: Don't report revoked delegations as valid in nfs_have_delegation()
    - NFSv4: nfs4_copy_delegation_stateid() must fail if the delegation is invalid
    - NFSv4: Open state recovery must account for file permission changes
    - NFSv4.2: Fix a reference leak in nfs42_proc_layoutstats_generic
    - pnfs/blocklayout: fix last_write_offset incorrectly set to page boundary
    - scsi: Fix use-after-free
    - watchdog: rt2880_wdt: Remove assignment of dev pointer
    - watchdog: mt7621_wdt: Remove assignment of dev pointer
    - metag: Only define atomic_dec_if_positive conditionally
    - soc/fsl/qe: fix gpio save_regs functions
    - soc/fsl/qe: fix Oops on CPM1 (and likely CPM2)
    - arm64: KVM: VHE: reset PSTATE.PAN on entry to EL2
    - arc: don't leak bits of kernel stack into coredump
    - fs/super.c: fix race between freeze_super() and thaw_super()
    - cifs: Limit the overall credit acquired
    - fs/cifs: keep guid when assigning fid to fileinfo
    - Clarify locking of cifs file and tcon structures and make more granular
    - Display number of credits available
    - Set previous session id correctly on SMB3 reconnect
    - SMB3: GUIDs should be constructed as random but valid uuids
    - Do not send SMB3 SET_INFO request if nothing is changing
    - Cleanup missing frees on some ioctls
    - blkcg: Unlock blkcg_pol_mutex only once when cpd == NULL
    - x86/e820: Don't merge consecutive E820_PRAM ranges
    - kvm: x86: memset whole irq_eoi
    - x86/platform/UV: Fix support for EFI_OLD_MEMMAP after BIOS callback updates
    - x86/boot/smp: Don't try to poke disabled/non-existent APIC
    - pinctrl: intel: Only restore pins that are used by the driver
    - pinctrl: baytrail: Fix lockdep
    - sched/fair: Fix incorrect task group ->load_avg
    - sched/fair: Fix min_vruntime tracking
    - irqchip/gicv3: Handle loop timeout proper
    - irqchip/eznps: Acknowledge NPS_IPI before calling the handler
    - irqchip/gic-v3-its: Fix entry size mask for GITS_BASER
    - cxl: Prevent adapter reset if an active context exists
    - isofs: Do not return EACCES for unknown filesystems
    - memstick: rtsx_usb_ms: Runtime resume the device when polling for cards
    - memstick: rtsx_usb_ms: Manage runtime PM when accessing the device
    - arm64: swp emulation: bound LL/SC retries before rescheduling
    - arm64: kaslr: fix breakage with CONFIG_MODVERSIONS=y
    - arm64: percpu: rewrite ll/sc loops in assembly
    - arm64: kernel: Init MDCR_EL2 even in the absence of a PMU
    - arm64: Cortex-A53 errata workaround: check for kernel addresses
    - arm64: KVM: Take S1 walks into account when determining S2 write faults
    - ceph: fix error handling in ceph_read_iter
    - powerpc/mm: Prevent unlikely crash in copro_calculate_slb()
    - mmc: core: Annotate cmd_hdr as __le32
    - mmc: core: switch to 1V8 or 1V2 for hs400es mode
    - mmc: rtsx_usb_sdmmc: Avoid keeping the device runtime resumed when unused
    - mmc: rtsx_usb_sdmmc: Handle runtime PM while changing the led
    - KVM: s390: reject invalid modes for runtime instrumentation
    - fscrypto: make XTS tweak initialization endian-independent
    - fscrypto: lock inode while setting encryption policy
    - ext4: do not advertise encryption support when disabled
    - jbd2: fix incorrect unlock on j_list_lock
    - ubifs: Fix xattr_names length in exit paths
    - target/tcm_fc: use CPU affinity for responses
    - target: Re-add missing SCF_ACK_KREF assignment in v4.1.y
    - target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT
      REACHABLE
    - target: Don't override EXTENDED_COPY xcopy_pt_cmd SCSI status code
    - Revert "target: Fix residual overflow handling in
      target_complete_cmd_with_length"
    - Linux 4.8.5

* Yakkety update to v4.8.4 stable release (LP: #1637517)
    - serial: imx: Fix DCD reading
    - BUG: atmel_serial: Interrupts not disabled on close
    - serial: 8250_dw: Check the data->pclk when get apb_pclk
    - serial: 8250_port: fix runtime PM use in __do_stop_tx_rs485()
    - ARCv2: intc: Use kflag if STATUS32.IE must be reset
    - ARCv2: fix local_save_flags
    - debugfs: introduce a public file_operations accessor
    - b43: fix debugfs crash
    - b43legacy: fix debugfs crash
    - carl9170: fix debugfs crashes
    - Btrfs: fix free space tree bitmaps on big-endian systems
    - Btrfs: fix mount -o clear_cache,space_cache=v2
    - Btrfs: catch invalid free space trees
    - btrfs: assign error values to the correct bio structs
    - mei: amthif: fix deadlock in initialization during a reset
    - drivers: base: dma-mapping: page align the size when unmap_kernel_range
    - IB/hfi1: Fix defered ack race with qp destroy
    - clk: mvebu: fix setting unwanted flags in CP110 gate clock
    - clk: mvebu: dynamically allocate resources in Armada CP110 system controller
    - fuse: listxattr: verify xattr list
    - fuse: invalidate dir dentry after chmod
    - fuse: fix killing s[ug]id in setattr
    - mm: filemap: fix mapping->nrpages double accounting in fuse
    - i40e: avoid NULL pointer dereference and recursive errors on early PCI error
    - xfs: change mailing list address
    - mm: filemap: don't plant shadow entries without radix tree node
    - brcmfmac: fix pmksa->bssid usage
    - brcmfmac: fix memory leak in brcmf_fill_bss_param
    - brcmfmac: use correct skb freeing helper when deleting flowring
    - ASoC: nau8825: fix bug in FLL parameter
    - ASoC: Intel: Atom: add a missing star in a memcpy call
    - reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
    - async_pq_val: fix DMA memory leak
    - scsi: arcmsr: Simplify user_len checking
    - ipc/sem.c: fix complex_count vs. simple op race
    - mm/hugetlb: fix memory offline with hugepage size > memory block size
    - vfs,mm: fix a dead loop in truncate_inode_pages_range()
    - jbd2: fix lockdep annotation in add_transaction_credits()
    - ext4: enforce online defrag restriction for encrypted files
    - ext4: reinforce check of i_dtime when clearing high fields of uid and gid
    - ext4: bugfix for mmaped pages in mpage_release_unused_pages()
    - ext4: fix memory leak in ext4_insert_range()
    - ext4: fix memory leak when symlink decryption fails
    - ext4: allow DAX writeback for hole punch
    - ext4: release bh in make_indexed_dir
    - ext4: unmap metadata when zeroing blocks
    - dlm: free workqueues after the connections
    - vfs: move permission checking into notify_change() for utimes(NULL)
    - cachefiles: Fix attempt to read i_blocks after deleting file [ver #2]
    - drm: virtio: reinstate drm_virtio_set_busid()
    - acpi, nfit: check for the correct event code in notifications
    - cfq: fix starvation of asynchronous writes
    - Linux 4.8.4

* Yakkety update to v4.8.3 stable release (LP: #1637512)
    - v4l: rcar-fcp: Don't force users to check for disabled FCP support
    - scsi: configure runtime pm before calling device_add in
      scsi_add_host_with_dma
    - Make __xfs_xattr_put_listen preperly report errors.
    - Linux 4.8.3

* KVM: PPC: Book3S HV: Migrate pinned pages out of CMA (LP: #1632045)
    - KVM: PPC: Book3S HV: Migrate pinned pages out of CMA

* unexpectedly large memory usage of mounted snaps (LP: #1636847)
    - [Config] switch squashfs to single threaded decode

* Fix bugs under virtual scsi server driver for Power (LP: #1621088)
    - target/user: Use sense_reason_t in tcmu_queue_cmd_ring
    - target/user: Return an error if cmd data size is too large
    - target/user: Fix comments to not refer to data ring

* ISST-LTE:pVM nvme 0000:a0:00.0: iommu_alloc failed on NVMe card
    (LP: #1633128)
    - dma-mapping: introduce the DMA_ATTR_NO_WARN attribute
    - powerpc: implement the DMA_ATTR_NO_WARN attribute
    - nvme: use the DMA_ATTR_NO_WARN attribute

* arm64: kprobes disabled (LP: #1634271)
    - [Config] Enable KPROBES on arm64

* Bad page state in process genwqe_gunzip pfn:3c275 in the genwqe device
    driver (LP: #1559194)
    - SAUCE: (noup) Bad page state in process genwqe_gunzip pfn:3c275 in the
      genwqe device driver

* CVE-2016-7425
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

* Add ipvlan module to 16.04 kernel (LP: #1634705)
    - [Config] Add ipvlan to the generic inclusion list

* hio Ubuntu sauce driver needs porting to 4.8 (LP: #1635594)
    - SAUCE: import Huawei ES3000_V2 (2.1.0.23)
    - SAUCE: hio: bio_endio() no longer takes errors arg
    - SAUCE: hio: blk_queue make_request_fn now returns a blk_qc_t
    - SAUCE: hio: use alloc_cpumask_var to avoid -Wframe-larger-than
    - SAUCE: hio: fix mask maybe-uninitialized warning
    - SAUCE: hio: port to v4.8 base
    - [config] enable CONFIG_HIO (Huawei ES3000_V2 PCIe SSD driver)
    - SAUCE: hio: Makefile and Kconfig
    - [Config] Enforce CONFIG_HIO

* Yakkety update to v4.8.2 stable release (LP: #1633973)
    - usb: storage: fix runtime pm issue in usb_stor_probe2
    - timekeeping: Fix __ktime_get_fast_ns() regression
    - usb: dwc3: fix Clear Stall EP command failure
    - phy: sun4i-usb: Use spinlock to guard phyctl register access
    - ALSA: ali5451: Fix out-of-bound position reporting
    - ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants
    - ALSA: usb-line6: use the same declaration as definition in header for MIDI
      manufacturer ID
    - mfd: rtsx_usb: Avoid setting ucr->current_sg.status
    - mfd: atmel-hlcdc: Do not sleep in atomic context
    - mfd: 88pm80x: Double shifting bug in suspend/resume
    - mfd: wm8350-i2c: Make sure the i2c regmap functions are compiled
    - xen/x86: Update topology map for PV VCPUs
    - KVM: PPC: Book3s PR: Allow access to unprivileged MMCR2 register
    - KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
    - KVM: arm64: Require in-kernel irqchip for PMU support
    - KVM: arm/arm64: vgic: Don't flush/sync without a working vgic
    - KVM: PPC: BookE: Fix a sanity check
    - arm64: fix dump_backtrace/unwind_frame with NULL tsk
    - x86/boot: Fix kdump, cleanup aborted E820_PRAM max_pfn manipulation
    - x86/irq: Prevent force migration of irqs which are not in the vector domain
    - x86/pkeys: Make protection keys an "eager" feature
    - x86/cpu: Rename Merrifield2 to Moorefield
    - x86/platform/intel-mid: Add Intel Penwell to ID table
    - x86/platform/intel-mid: Keep SRAM powered on at boot
    - x86/apic: Get rid of apic_version[] array
    - arch/x86: Handle non enumerated CPU after physical hotplug
    - x86/mm/pkeys: Do not skip PKRU register if debug registers are not used
    - x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access
    - ARM: fix delays
    - ARM: dts: mvebu: armada-390: add missing compatibility string and bracket
    - ARM: dts: MSM8064 remove flags from SPMI/MPP IRQs
    - ARM: dts: MSM8660 remove flags from SPMI/MPP IRQs
    - ARM: cpuidle: Fix error return code
    - Bluetooth: Add a new 04ca:3011 QCA_ROME device
    - ima: use file_dentry()
    - tpm: fix a race condition in tpm2_unseal_trusted()
    - tpm_crb: fix crb_req_canceled behavior
    - Linux 4.8.2

* Bluetooth 04ca:3011 [Asus Aspire V3-371] doesn't work (LP: #1535802)
    - Bluetooth: Add a new 04ca:3011 QCA_ROME device

-- Luis Henriques <luis.henriques@canonical.com>  Fri, 11 Nov 2016 10:30:54 +0000

Changed in linux (Ubuntu Yakkety):
status:	Fix Committed → Fix Released

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-30: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#44

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-30: Comment bridged from LTC Bugzilla

#45

------- Comment From <email address hidden> 2016-11-30 12:30 EDT-------
Verified with Ubuntu 16.04.1-LTS, the issue can no longer be reproduced.

root@s8330026:~# uname -a
Linux s8330026 4.4.0-51-generic #72-Ubuntu SMP Thu Nov 24 18:29:36 UTC 2016 s390x s390x s390x GNU/Linux

Revision history for this message

bugproxy (bugproxy) wrote on 2016-11-30: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#46

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-12-06:

#49

This bug was fixed in the package linux - 4.8.0-30.32

---------------
linux (4.8.0-30.32) yakkety; urgency=low

* CVE-2016-8655 (LP: #1646318)
- packet: fix race condition in packet_set_ring

-- Brad Figg <email address hidden> Thu, 01 Dec 2016 08:02:53 -0800

Changed in linux (Ubuntu):
status:	In Progress → Fix Released

Revision history for this message

bugproxy (bugproxy) wrote on 2016-12-06:

#50

Debian kernel package with genwqe-bad-page.patch applied.

Revision history for this message

bugproxy (bugproxy) wrote on 2016-12-20:

#58

dmesg for re-run on kernel 4.4.0-33 Edit (58.8 KiB, application/octet-stream)

Revision history for this message

bugproxy (bugproxy) wrote on 2016-12-20: linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb

#59

linux-image-4.4.0-33.52+_4.4.0-33.52+-6_s390x.deb Edit (11.4 MiB, application/x-deb)

Debian kernel package with genwqe-bad-page.patch applied.

Ubuntu on IBM z Systems

Bad page state in process genwqe_gunzip pfn:3c275 in the genwqe device driver

Bug Description

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
Release Notes for Ubuntu	Fix Released	Undecided	Unassigned
Ubuntu on IBM z Systems	Fix Released	High	Unassigned
linux (Ubuntu)	Fix Released	Wishlist	Tim Gardner
Xenial	Fix Released	Wishlist	Tim Gardner
Yakkety	Fix Released	Wishlist	Tim Gardner