Bug #1672819 “exec'ing a setuid binary from a threaded program s...” : Bugs : golang-1.6 package : Ubuntu

Revision history for this message

John Lenton (chipaca) wrote on 2017-03-14:

#1

AlsaInfo.txt Edit (36.2 KiB, text/plain; charset="utf-8")
CRDA.txt Edit (392 bytes, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (197.3 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (2.7 KiB, text/plain; charset="utf-8")
IwConfig.txt Edit (513 bytes, text/plain; charset="utf-8")
JournalErrors.txt Edit (105.5 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (14.2 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (417 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.4 KiB, text/plain; charset="utf-8")
ProcEnviron.txt Edit (328 bytes, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.6 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (6.4 KiB, text/plain; charset="utf-8")
PulseList.txt Edit (29.1 KiB, text/plain; charset="utf-8")
RfKill.txt Edit (186 bytes, text/plain; charset="utf-8")
UdevDb.txt Edit (157.7 KiB, text/plain; charset="utf-8")
WifiSyslog.txt Edit (1.2 MiB, text/plain; charset="utf-8")

Revision history for this message

John Lenton (chipaca) wrote on 2017-03-14:

#2

I also tried this in 4.10.0-11-generic, same results.

Joseph Salisbury (jsalisbury) on 2017-03-14

Changed in linux (Ubuntu):
status:	New → Triaged
importance:	Undecided → High
Changed in linux (Ubuntu Xenial):
status:	New → Triaged
importance:	Undecided → High
tags:	added: kernel-key

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2017-03-14:

#3

I can reproduce this with the simple pthreads-only reproducer (loop of ./a_p running setuid binary ./b) running 4.4.0-57-generic on bare metal.

$ for i in `seq 10`; do ./a_p; done
GOT 1000
GOT 1000

$ for i in `seq 1000`; do ./a_p; done | wc -l
117

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2017-03-14:

#4

An AWS instance (t2.xlarge with 4 vCPU's) running 4.4.0-1001-aws reproduces the problem:

$ for i in `seq 10000`; do ./a_p; done | wc -l
124

Revision history for this message

Michael Hudson-Doyle (mwhudson) wrote on 2017-03-14:

#5

I had a bit of a stare at the kernel source and suspected that the downgrade of uid is happening here: https://github.com/torvalds/linux/blob/v4.4/security/commoncap.c#L547-L548

I added a "WARN(1, "downgrading in subprocess %d %d\n", bprm->unsafe, (int)capable(CAP_SETUID))" which revealed that bprm->unsafe is 1 aka LSM_UNSAFE_SHARE.

The only place (I can find) that bprm->unsafe is set to LSM_UNSAFE_SHARE is this check in check_unsafe_exec here (from https://github.com/torvalds/linux/blob/v4.4/fs/exec.c#L1281):

t = p;
n_fs = 1;
spin_lock(&p->fs->lock);
rcu_read_lock();
while_each_thread(p, t) {
if (t->fs == p->fs)
n_fs++;
}
rcu_read_unlock();

if (p->fs->users > n_fs)
bprm->unsafe |= LSM_UNSAFE_SHARE;
else
p->fs->in_exec = 1;
spin_unlock(&p->fs->lock);

So I think (and here it gets a bit sketchy) we're racing with copy_process in kernel/fork.c: that calls copy_fs (which is what increments p->fs->users) some way before it does the stuff necessary to make the new thread be included in the while_each_thread(p, t) loop. So n_fs is too low, the check triggers and the setuid bits get ignored.

No idea at all how to fix this of course.

Joseph Salisbury (jsalisbury) on 2017-03-20

tags:

added: kernel-da-key
removed: kernel-key

Joseph Salisbury (jsalisbury) on 2017-03-20

tags:

added: kernel-key
removed: kernel-da-key

Colin Ian King (colin-king) on 2017-03-28

Changed in linux (Ubuntu Xenial):
assignee:	nobody → Colin Ian King (colin-king)
status:	Triaged → In Progress

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-03-31:

#6

The following seems to fix it, but I need to exercise this a bit more to be 100% certain it is rock solid:

diff --git a/fs/fs_struct.c b/fs/fs_struct.c
index 7dca743..cd7175e2 100644
--- a/fs/fs_struct.c
+++ b/fs/fs_struct.c
@@ -98,8 +98,10 @@ void exit_fs(struct task_struct *tsk)
                int kill;
                task_lock(tsk);
                spin_lock(&fs->lock);
+ rcu_read_lock();
                tsk->fs = NULL;
                kill = !--fs->users;
+ rcu_read_unlock();
                spin_unlock(&fs->lock);
                task_unlock(tsk);
                if (kill)

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-03-31:

#7

Nope, that fails too.

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-03-31:

#8

So the thread fs has been torn down and so t->fs is null which then triggers the miscounting of n_fs; so I'm sspeculating we may need to try:

while_each_thread(p, t) {
if (t->fs == p->fs || !t->fs)
n_fs++;
}

Revision history for this message

John Lenton (chipaca) wrote on 2017-04-03:

#9

Might this be related to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857909 ?

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-04-03:

#10

With the change mentioned in comment #8 I now cannot reproduce the issue.

Revision history for this message

Zygmunt Krynicki (zyga) wrote on 2017-04-04:

#11

This also happens on Fedora 25 running 4.10.8-200.fc25.x64_64

Revision history for this message

In Linux Kernel Bug Tracker #195453, colin.king (colin.king-linux-kernel-bugs) wrote on 2017-04-18:

#35

There is a race condition on the fs->users counter and fs->in_exec flag that impacts exec() on a suid program when there are multiple threads being created and destroyed by a parent process. This in_exec flag was introduced way back in 2009 with commit:

commit 498052bba55ecaff58db6a1436b0e25bfd75a7ff
Author: Al Viro <email address hidden>
Date: Mon Mar 30 07:20:30 2009 -0400

When performing an exec() on a suid program, check_unsafe_exec() checks to see we have more f->fs->users than the count of child threads that share the same fs with the parent.

However, there are two race conditions that this seems to fail on:

1. The parent may be creating a new thread and copy_fs in kernel/fork.c bumps the fs->users count before the thread is attached to the parent hence causing the check p->fs->users > n_fs in check_unsafe_exec() to be true in check_unsafe_exec() and cause the execution a the suid program by the parent to fail to marked as unsafe and so it executes as a non-suid executable. The crux of the matter is that the fs->user count temporarily ahead by 1 with the number of threads linked to the process and we don't have any locking mechanism to protect us from this in the exec phase.

2. A thread my be dying and the associated fs pointer is nullified before it is removed from the parent and this also causes issues in the check_unsafe_exec() fs sanity check. I believe this can be fixed checking for t->fs being NULL, e.g.:

diff --git a/fs/exec.c b/fs/exec.c
index 72934df68471..ebfd9b76b69f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1447,7 +1447,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
        spin_lock(&p->fs->lock);
        rcu_read_lock();
        while_each_thread(p, t) {
- if (t->fs == p->fs)
+ if (t->fs == p->fs || !t->fs)
                        n_fs++;
        }
        rcu_read_unlock();

The reproducer is quite simple and always easy to reproduce:

$ cat Makefile
ALL=a b
all: $(ALL)

a: LDFLAGS=-pthread

b: b.c
$(CC) b.c -o b
sudo chown root:root b
sudo chmod u+s b

test:
for I in $$(seq 1000); do echo $I; ./a ; done

clean:
rm -vf $(ALL)

$ cat a.c
#include <unistd.h>
#include <stdio.h>
#include <pthread.h>
#include <time.h>

void *nothing(void *p)
{
return NULL;
}

void *target(void *p) {
for (;;) {
  pthread_t t;
  if (pthread_create(&t, NULL, nothing, NULL) == 0)
   pthread_join(t, NULL);
     }
return NULL;
}

int main(void)
{
struct timespec tv;
int i;

for (i = 0; i < 10; i++) {
  pthread_t t;
  pthread_create(&t, NULL, target, NULL);
}
tv.tv_sec = 0;
tv.tv_nsec = 100000;
nanosleep(&tv, NULL);
if (execl("./b", "./b", NULL) < 0)
  perror("execl");
return 0;
}

$ cat b.c
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>

int main(void)
{
const uid_t euid = geteuid();
if (euid != 0) {
printf("Failed, got euid %d (expecting 0)\n", euid);
return 1;
}
return 0;
}

To reproduce:

make
make test

You will see "Failed, got euid 1000 (expecting 0)" errors whenever the suid program being exec'd fails to exec as a suid process because of the race and failure in check_unsafe_exec()

There is a race condition on the fs->users counter and fs->in_exec flag that impacts exec() on a suid program when there are multiple threads being created and destroyed by a parent process.  This in_exec flag was introduced way back in 2009 with commit:

commit 498052bba55ecaff58db6a1436b0e25bfd75a7ff
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Mar 30 07:20:30 2009 -0400

When performing an exec() on a suid program, check_unsafe_exec() checks to see we have more f->fs->users than the count of child threads that share the same fs with the parent.

However, there are two race conditions that this seems to fail on:

1. The parent may be creating a new thread and copy_fs in kernel/fork.c bumps the fs->users count before the thread is attached to the parent hence causing the check p->fs->users > n_fs in check_unsafe_exec() to be true in check_unsafe_exec() and cause the execution a the suid program by the parent to fail to marked as unsafe and so it executes as a non-suid executable.  The crux of the matter is that the fs->user count temporarily ahead by 1 with the number of threads linked to the process and we don't have any locking mechanism to protect us from this in the exec phase.

2. A thread my be dying and the associated fs pointer is nullified before it is removed from the parent and this also causes issues in the check_unsafe_exec() fs sanity check. I believe this can be fixed checking for t->fs being NULL, e.g.:

diff --git a/fs/exec.c b/fs/exec.c
index 72934df68471..ebfd9b76b69f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1447,7 +1447,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
        spin_lock(&p->fs->lock);
        rcu_read_lock();
        while_each_thread(p, t) {
-               if (t->fs == p->fs)
+               if (t->fs == p->fs || !t->fs)
                        n_fs++;
        }
        rcu_read_unlock();

The reproducer is quite simple and always easy to reproduce:

$ cat Makefile 
ALL=a b
all: $(ALL)

a: LDFLAGS=-pthread

b: b.c
	$(CC) b.c -o b
	sudo chown root:root b
	sudo chmod u+s b

test:
	for I in $$(seq 1000); do echo $I; ./a ; done

clean:
	rm -vf $(ALL)

$ cat a.c
#include <unistd.h>
#include <stdio.h>
#include <pthread.h>
#include <time.h>

void *nothing(void *p)
{
	return NULL;
}

void *target(void *p) {
	for (;;) {
		pthread_t t;
		if (pthread_create(&t, NULL, nothing, NULL) == 0)
			pthread_join(t, NULL);
    	}
	return NULL;
}

int main(void)
{
	struct timespec tv;
	int i;

for (i = 0; i < 10; i++) {
		pthread_t t;
		pthread_create(&t, NULL, target, NULL);
	}
	tv.tv_sec = 0;
	tv.tv_nsec = 100000;
	nanosleep(&tv, NULL);
	if (execl("./b", "./b", NULL) < 0)
		perror("execl");
	return 0;
}

$ cat b.c
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>

int main(void)
{
	const uid_t euid = geteuid();
	if (euid != 0) {
		printf("Failed, got euid %d (expecting 0)\n", euid);
        	return 1;
	}
	return 0;
}

To reproduce:

make
make test

You will see "Failed, got euid 1000 (expecting 0)" errors whenever the suid program being exec'd fails to exec as a suid process because of the race and failure in check_unsafe_exec()

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-04-18:

#12

This bug has been around since at least 2009.

Kernel Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195453

Revision history for this message

In Linux Kernel Bug Tracker #195453, dev.jongy (dev.jongy-linux-kernel-bugs) wrote on 2017-04-21:

#36

I don't think the second condition you gave is relevant, because once the task_struct->fs pointer is nullified, this thread is not accounted in fs->users anymore. Since this thread doesn't count for neither fs->count nor n_fs, it is okay.

The first condition is indeed a problem. I'm not sure of the wanted fix (probably some kind of locking in copy_process, that while_each_thread could use too), but currently this race is bad.

Revision history for this message

In Linux Kernel Bug Tracker #195453, colin.king (colin.king-linux-kernel-bugs) wrote on 2017-04-21:

#37

Thanks for looking at this. The locking on copy_process concerns me as I didn't want to introduce a locking fix that caused a serious performance regression on the copy and exec paths.

Joseph Salisbury (jsalisbury) on 2017-04-24

tags:

added: kernel-da-key
removed: kernel-key

Revision history for this message

In Linux Kernel Bug Tracker #195453, colin.king (colin.king-linux-kernel-bugs) wrote on 2017-05-03:

#38

Any updates on this?

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-05-07:

#13

exec'ing from a thread is an interesting problem; the semantics of exec should be to terminal all the threads before the exec occurs according to http://maxim.int.ru/bookshelf/PthreadsProgram/htm/r_44.html

The normal idiom would be to do:
  fork()
      child exec's
      parent waits for child

I'm not sure in your case if you desire all the threads to terminate after the exec, so the wait() may be in fact be replaced by pthread termination calls on all the threads for your implementation.

Unfortunately there is an issue with fork'ing in a thread; any mutex held by another thread at the moment of fork becomes locked forever since we have once mutex locked by the parent and one by the child. Normally one would therefore use pthread_atfork() to help workaround this issue, see https://stackoverflow.com/questions/14407544/mixing-threads-fork-and-mutexes-what-should-i-watch-out-for

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-05-07:

#14

"to terminal all the threads" should read "to terminate all the threads"

Revision history for this message

Michael Hudson-Doyle (mwhudson) wrote on 2017-05-07: Re: [Bug 1672819] Re: exec'ing a setuid binary from a threaded program sometimes fails to setuid

#15

On 8 May 2017 at 10:32, Colin Ian King <email address hidden> wrote:

> exec'ing from a thread is an interesting problem; the semantics of exec
> should be to terminal all the threads before the exec occurs according
> to http://maxim.int.ru/bookshelf/PthreadsProgram/htm/r_44.html
>
> The normal idiom would be to do:
> fork()
> child exec's
> parent waits for child
>
> I'm not sure in your case if you desire all the threads to terminate
> after the exec, so the wait() may be in fact be replaced by pthread
> termination calls on all the threads for your implementation.
>

The original bug report was about a process calling execve directly, not a
fork/exec situation. So yes, the expectation is that all threads are gone.

> Unfortunately there is an issue with fork'ing in a thread; any mutex
> held by another thread at the moment of fork becomes locked forever
> since we have once mutex locked by the parent and one by the child.
> Normally one would therefore use pthread_atfork() to help workaround
> this issue, see https://stackoverflow.com/questions/14407544/mixing-
> threads-fork-and-mutexes-what-should-i-watch-out-for

Go doesn't support forking (except for some very careful code that calls
exec in the child), for exactly this sort of reason.

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-05-09:

#16

I think I've found the simplest solution that avoids costly locking overhead and seems to work in my tests. I've uploaded the debs for Xenial in:

http://kernel.ubuntu.com/~cking/lp-1672819/

Would you mind testing these and seeing if it helps.

Changed in linux (Ubuntu Xenial):
status:	In Progress → Incomplete

Revision history for this message

John Lenton (chipaca) wrote on 2017-05-10:

#17

With the kernel from #16 I am no longer able to reproduce the issue, not with the simplified reproducers described in this bug, nor with the original (slower and more convoluted) snapd reproducer.

Revision history for this message

In Linux Kernel Bug Tracker #195453, colin.king (colin.king-linux-kernel-bugs) wrote on 2017-05-10:

#39

Created attachment 256351
this fix solves the issue without any overhead of extra per thread locking and a simple lightweight retry

This has been extensively tested on a multi-proc Xeon server with the reproducers and fixes the issue. I've checked this out with a high contention of pthreads and the retry loop occurs very rarely, so the overhead of the retry is very small indeed.

John Lenton (chipaca) on 2017-05-11

Changed in linux (Ubuntu Xenial):
status:	Incomplete → In Progress

Colin Ian King (colin-king) on 2017-05-12

description:

updated

Seth Forshee (sforshee) on 2017-05-17

Changed in linux (Ubuntu):
status:	Triaged → Fix Committed

Thadeu Lima de Souza Cascardo (cascardo) on 2017-05-31

Changed in linux (Ubuntu Zesty):
status:	New → Fix Committed
Changed in linux (Ubuntu Yakkety):
status:	New → Fix Committed

Thadeu Lima de Souza Cascardo (cascardo) on 2017-05-31

Changed in linux (Ubuntu Xenial):
status:	In Progress → Fix Committed

Colin Ian King (colin-king) on 2017-05-31

Changed in linux (Ubuntu Yakkety):
assignee:	nobody → Colin Ian King (colin-king)
Changed in linux (Ubuntu Zesty):
assignee:	nobody → Colin Ian King (colin-king)
importance:	Undecided → High
Changed in linux (Ubuntu Yakkety):
importance:	Undecided → High

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-06-14:

#18

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-xenial
tags:	added: verification-needed-yakkety

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-06-14:

#19

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-yakkety' to 'verification-done-yakkety'. If the problem still exists, change the tag 'verification-needed-yakkety' to 'verification-failed-yakkety'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-zesty

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-06-14:

#20

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-zesty' to 'verification-done-zesty'. If the problem still exists, change the tag 'verification-needed-zesty' to 'verification-failed-zesty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Colin Ian King (colin-king) on 2017-06-15

Changed in linux (Ubuntu):
assignee:	nobody → Colin Ian King (colin-king)

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-06-15:

#21

tested on xenial, 4.4.0-80-generic #101-Ubuntu, passed the test.

tags:

added: verification-done-xenial
removed: verification-needed-xenial

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-06-15:

#22

tested on yakkety, 4.8.0-55-generic #58-Ubuntu, passed the test.

tags:

added: verification-done-yakkety
removed: verification-needed-yakkety

Revision history for this message

Colin Ian King (colin-king) wrote on 2017-06-15:

#23

tested on zesty, 4.10.0-23-generic #25-Ubuntu, passed the test.

tags:

added: verification-done-zesty
removed: verification-needed-zesty

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-06-28:

#24

Download full text (3.8 KiB)

This bug was fixed in the package linux - 4.8.0-58.63

---------------
linux (4.8.0-58.63) yakkety; urgency=low

* linux: 4.8.0-58.63 -proposed tracker (LP: #1700533)

  * CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.8.0-57.62) yakkety; urgency=low

* linux: 4.8.0-57.62 -proposed tracker (LP: #1699035)

* CVE-2017-1000364
- SAUCE: mm: Only expand stack if guard area is hit

* CVE-2017-7374
- fscrypt: remove broken support for detecting keyring key revocation

* CVE-2017-100363
- char: lp: fix possible integer overflow in lp_setup()

* CVE-2017-9242
- ipv6: fix out of bound writes in __ip6_append_data()

* CVE-2017-9075
- sctp: do not inherit ipv6_{mc|ac|fl}_list from parent

* CVE-2017-9074
- ipv6: Prevent overrun when parsing v6 header options

* CVE-2017-9076
- ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-9077
- ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-8890
- dccp/tcp: do not inherit mc_list from parent

* extend-diff-ignore should use exact matches (LP: #1693504)
- [Packaging] exact extend-diff-ignore matches

* APST quirk needed for Intel NVMe (LP: #1686592)
- nvme: Quirk APST on Intel 600P/P3100 devices

  * regression: the 4.8 hwe kernel does not create the
    /sys/block/*/device/enclosure_device:* symlinks (LP: #1691899)
    - scsi: ses: Fix SAS device detection in enclosure

* datapath: Add missing case OVS_TUNNEL_KEY_ATTR_PAD (LP: #1676679)
- openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD

  * connection flood to port 445 on mounting cifs volume under kernel
    (LP: #1686099)
    - cifs: Do not send echoes before Negotiate is complete

  * Support IPMI system interface on Cavium ThunderX (LP: #1688132)
    - i2c: octeon: Rename driver to prepare for split
    - i2c: octeon: Split the driver into two parts
    - [Config] CONFIG_I2C_THUNDERX=m
    - i2c: thunderx: Add i2c driver for ThunderX SOC
    - i2c: thunderx: Add SMBUS alert support
    - i2c: octeon,thunderx: Move register offsets to struct
    - i2c: octeon: Sort include files alphabetically
    - i2c: octeon: Use booleon values for booleon variables
    - i2c: octeon: thunderx: Add MAINTAINERS entry
    - i2c: octeon: Fix set SCL recovery function
    - i2c: octeon: Avoid sending STOP during recovery
    - i2c: octeon: Fix high-level controller status check
    - i2c: octeon: thunderx: TWSI software reset in recovery
    - i2c: octeon: thunderx: Remove double-check after interrupt
    - i2c: octeon: thunderx: Limit register access retries
    - i2c: thunderx: Enable HWMON class probing

* CVE-2017-5577
- drm/vc4: Return -EINVAL on the overflow checks failing.

* Merlin SGMII fail on Ubuntu Xenial HWE kernel (LP: #1686305)
- net: phy: marvell: fix Marvell 88E1512 u...

This bug was fixed in the package linux - 4.8.0-58.63

---------------
linux (4.8.0-58.63) yakkety; urgency=low

* linux: 4.8.0-58.63 -proposed tracker (LP: #1700533)

* CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.8.0-57.62) yakkety; urgency=low

* linux: 4.8.0-57.62 -proposed tracker (LP: #1699035)

* CVE-2017-1000364
    - SAUCE: mm: Only expand stack if guard area is hit

* CVE-2017-7374
    - fscrypt: remove broken support for detecting keyring key revocation

* CVE-2017-100363
    - char: lp: fix possible integer overflow in lp_setup()

* CVE-2017-9242
    - ipv6: fix out of bound writes in __ip6_append_data()

* CVE-2017-9075
    - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent

* CVE-2017-9074
    - ipv6: Prevent overrun when parsing v6 header options

* CVE-2017-9076
    - ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-9077
    - ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-8890
    - dccp/tcp: do not inherit mc_list from parent

* extend-diff-ignore should use exact matches (LP: #1693504)
    - [Packaging] exact extend-diff-ignore matches

* APST quirk needed for Intel NVMe (LP: #1686592)
    - nvme: Quirk APST on Intel 600P/P3100 devices

* regression: the 4.8 hwe kernel does not create the
    /sys/block/*/device/enclosure_device:* symlinks (LP: #1691899)
    - scsi: ses: Fix SAS device detection in enclosure

* datapath: Add missing case OVS_TUNNEL_KEY_ATTR_PAD (LP: #1676679)
    - openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD

* connection flood to port 445 on mounting cifs volume under kernel
    (LP: #1686099)
    - cifs: Do not send echoes before Negotiate is complete

* Support IPMI system interface on Cavium ThunderX (LP: #1688132)
    - i2c: octeon: Rename driver to prepare for split
    - i2c: octeon: Split the driver into two parts
    - [Config] CONFIG_I2C_THUNDERX=m
    - i2c: thunderx: Add i2c driver for ThunderX SOC
    - i2c: thunderx: Add SMBUS alert support
    - i2c: octeon,thunderx: Move register offsets to struct
    - i2c: octeon: Sort include files alphabetically
    - i2c: octeon: Use booleon values for booleon variables
    - i2c: octeon: thunderx: Add MAINTAINERS entry
    - i2c: octeon: Fix set SCL recovery function
    - i2c: octeon: Avoid sending STOP during recovery
    - i2c: octeon: Fix high-level controller status check
    - i2c: octeon: thunderx: TWSI software reset in recovery
    - i2c: octeon: thunderx: Remove double-check after interrupt
    - i2c: octeon: thunderx: Limit register access retries
    - i2c: thunderx: Enable HWMON class probing

* CVE-2017-5577
    - drm/vc4: Return -EINVAL on the overflow checks failing.

* Merlin SGMII fail on Ubuntu Xenial HWE kernel (LP: #1686305)
    - net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
    - drivers: net: phy: xgene: Fix mdio write

* Keyboard backlight control does not work on some dell laptops.
    (LP: #1693126)
    - platform/x86: dell-laptop: Add Latitude 7480 and others to the DMI whitelist
    - platform/x86: dell-laptop: Add keyboard backlight timeout AC settings

* exec'ing a setuid binary from a threaded program sometimes fails to setuid
    (LP: #1672819)
    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct

* CVE-2017-7294
    - drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

-- Stefan Bader <stefan.bader@canonical.com>  Mon, 26 Jun 2017 17:31:13 +0200

Changed in linux (Ubuntu Yakkety):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-06-28:

#25

Download full text (18.8 KiB)

This bug was fixed in the package linux - 4.4.0-83.106

---------------
linux (4.4.0-83.106) xenial; urgency=low

* linux: 4.4.0-83.106 -proposed tracker (LP: #1700541)

  * CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.4.0-82.105) xenial; urgency=low

* linux: 4.4.0-82.105 -proposed tracker (LP: #1699064)

* CVE-2017-1000364
- SAUCE: mm: Only expand stack if guard area is hit

  * linux-aws/linux-gke incorrectly producing and using linux-*-tools-
    common/linux-*-cloud-tools-common (LP: #1688579)
    - [Config] make linux-tools-common and linux-cloud-tools-common protection
      consistent

* CVE-2017-9242
- ipv6: fix out of bound writes in __ip6_append_data()

* CVE-2017-9075
- sctp: do not inherit ipv6_{mc|ac|fl}_list from parent

* CVE-2017-9074
- ipv6: Prevent overrun when parsing v6 header options

* CVE-2017-9076
- ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-9077
- ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-8890
- dccp/tcp: do not inherit mc_list from parent

  * Module signing exclusion for staging drivers does not work properly
    (LP: #1690908)
    - SAUCE: Fix module signing exclusion in package builds

* extend-diff-ignore should use exact matches (LP: #1693504)
- [Packaging] exact extend-diff-ignore matches

* Dell XPS 9360 wifi 5G performance is poor (LP: #1692836)
- SAUCE: ath10k: fix the wifi speed issue for kill 1535

* Upgrade Redpine WLAN/BT driver to ver. 1.2.RC12 (LP: #1694607)
- SAUCE: Redpine: Upgrade to ver. 1.2.RC12

  * [DP MST] No audio output through HDMI/DP/mDP ports in Dell WD15 and TB15
    docking stations (LP: #1694665)
    - drm/i915: Store port enum in intel_encoder
    - drm/i915: Eliminate redundant local variable definition
    - drm/i915: Switch to using port stored in intel_encoder
    - drm/i915: Move audio_connector to intel_encoder
    - drm/i915/dp: DP audio API changes for MST
    - drm/i915: abstract ddi being audio enabled
    - drm/i915/audio: extend get_saved_enc() to support more scenarios
    - drm/i915: enable dp mst audio

  * Xenial update to 4.4.70 stable release (LP: #1694621)
    - usb: misc: legousbtower: Fix buffers on stack
    - usb: misc: legousbtower: Fix memory leak
    - USB: ene_usb6250: fix DMA to the stack
    - watchdog: pcwd_usb: fix NULL-deref at probe
    - char: lp: fix possible integer overflow in lp_setup()
    - USB: core: replace %p with %pK
    - ARM: tegra: paz00: Mark panel regulator as enabled on boot
    - tpm_crb: check for bad response size
    - infiniband: call ipv6 route lookup via the stub interface
    - dm btree: fix for dm_btree_find_lowest_key()
    - dm raid: select the Kconfig option CONFIG_MD_RAID0
    - dm bufio: avoid a possible ABBA deadlock
    - dm bufio: check ...

This bug was fixed in the package linux - 4.4.0-83.106

---------------
linux (4.4.0-83.106) xenial; urgency=low

* linux: 4.4.0-83.106 -proposed tracker (LP: #1700541)

* CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.4.0-82.105) xenial; urgency=low

* linux: 4.4.0-82.105 -proposed tracker (LP: #1699064)

* CVE-2017-1000364
    - SAUCE: mm: Only expand stack if guard area is hit

* linux-aws/linux-gke incorrectly producing and using linux-*-tools-
    common/linux-*-cloud-tools-common (LP: #1688579)
    - [Config] make linux-tools-common and linux-cloud-tools-common protection
      consistent

* CVE-2017-9242
    - ipv6: fix out of bound writes in __ip6_append_data()

* CVE-2017-9075
    - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent

* CVE-2017-9074
    - ipv6: Prevent overrun when parsing v6 header options

* CVE-2017-9076
    - ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-9077
    - ipv6/dccp: do not inherit ipv6_mc_list from parent

* CVE-2017-8890
    - dccp/tcp: do not inherit mc_list from parent

* Module signing exclusion for staging drivers does not work properly
    (LP: #1690908)
    - SAUCE: Fix module signing exclusion in package builds

* extend-diff-ignore should use exact matches (LP: #1693504)
    - [Packaging] exact extend-diff-ignore matches

* Dell XPS 9360 wifi 5G performance is poor (LP: #1692836)
    - SAUCE: ath10k: fix the wifi speed issue for kill 1535

*  Upgrade Redpine WLAN/BT driver to ver. 1.2.RC12 (LP: #1694607)
    - SAUCE: Redpine: Upgrade to ver. 1.2.RC12

* [DP MST] No audio output through HDMI/DP/mDP ports in Dell WD15 and TB15
    docking stations (LP: #1694665)
    - drm/i915: Store port enum in intel_encoder
    - drm/i915: Eliminate redundant local variable definition
    - drm/i915: Switch to using port stored in intel_encoder
    - drm/i915: Move audio_connector to intel_encoder
    - drm/i915/dp: DP audio API changes for MST
    - drm/i915: abstract ddi being audio enabled
    - drm/i915/audio: extend get_saved_enc() to support more scenarios
    - drm/i915: enable dp mst audio

* Xenial update to 4.4.70 stable release (LP: #1694621)
    - usb: misc: legousbtower: Fix buffers on stack
    - usb: misc: legousbtower: Fix memory leak
    - USB: ene_usb6250: fix DMA to the stack
    - watchdog: pcwd_usb: fix NULL-deref at probe
    - char: lp: fix possible integer overflow in lp_setup()
    - USB: core: replace %p with %pK
    - ARM: tegra: paz00: Mark panel regulator as enabled on boot
    - tpm_crb: check for bad response size
    - infiniband: call ipv6 route lookup via the stub interface
    - dm btree: fix for dm_btree_find_lowest_key()
    - dm raid: select the Kconfig option CONFIG_MD_RAID0
    - dm bufio: avoid a possible ABBA deadlock
    - dm bufio: check new buffer allocation watermark every 30 seconds
    - dm cache metadata: fail operations if fail_io mode has been established
    - dm bufio: make the parameter "retain_bytes" unsigned long
    - dm thin metadata: call precommit before saving the roots
    - dm space map disk: fix some book keeping in the disk space map
    - md: update slab_cache before releasing new stripes when stripes resizing
    - rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
    - mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
    - ima: accept previously set IMA_NEW_FILE
    - KVM: x86: Fix load damaged SSEx MXCSR register
    - KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
    - regulator: tps65023: Fix inverted core enable logic.
    - s390/kdump: Add final note
    - s390/cputime: fix incorrect system time
    - ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
    - ath9k_htc: fix NULL-deref at probe
    - drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark
      calculations.
    - drm/amdgpu: Make display watermark calculations more accurate
    - drm/nouveau/therm: remove ineffective workarounds for alarm bugs
    - drm/nouveau/tmr: ack interrupt before processing alarms
    - drm/nouveau/tmr: fix corruption of the pending list when rescheduling an
      alarm
    - drm/nouveau/tmr: avoid processing completed alarms when adding a new one
    - drm/nouveau/tmr: handle races with hw when updating the next alarm time
    - cdc-acm: fix possible invalid access when processing notification
    - proc: Fix unbalanced hard link numbers
    - of: fix sparse warning in of_pci_range_parser_one
    - iio: dac: ad7303: fix channel description
    - pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
    - pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
    - USB: serial: ftdi_sio: fix setting latency for unprivileged users
    - USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
    - ext4 crypto: don't let data integrity writebacks fail with ENOMEM
    - ext4 crypto: fix some error handling
    - net: qmi_wwan: Add SIMCom 7230E
    - fscrypt: fix context consistency check when key(s) unavailable
    - f2fs: check entire encrypted bigname when finding a dentry
    - fscrypt: avoid collisions when presenting long encrypted filenames
    - usb: host: xhci-plat: propagate return value of platform_get_irq()
    - xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
    - usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
    - net: irda: irda-usb: fix firmware name on big-endian hosts
    - usbvision: fix NULL-deref at probe
    - mceusb: fix NULL-deref at probe
    - ttusb2: limit messages to buffer size
    - usb: musb: tusb6010_omap: Do not reset the other direction's packet size
    - USB: iowarrior: fix info ioctl on big-endian hosts
    - usb: serial: option: add Telit ME910 support
    - USB: serial: qcserial: add more Lenovo EM74xx device IDs
    - USB: serial: mct_u232: fix big-endian baud-rate handling
    - USB: serial: io_ti: fix div-by-zero in set_termios
    - USB: hub: fix SS hub-descriptor handling
    - USB: hub: fix non-SS hub-descriptor handling
    - ipx: call ipxitf_put() in ioctl error path
    - iio: proximity: as3935: fix as3935_write
    - ceph: fix recursion between ceph_set_acl() and __ceph_setattr()
    - gspca: konica: add missing endpoint sanity check
    - s5p-mfc: Fix unbalanced call to clock management
    - dib0700: fix NULL-deref at probe
    - zr364xx: enforce minimum size when reading header
    - dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
    - cx231xx-audio: fix init error path
    - cx231xx-audio: fix NULL-deref at probe
    - cx231xx-cards: fix NULL-deref at probe
    - powerpc/book3s/mce: Move add_taint() later in virtual mode
    - powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
    - powerpc/64e: Fix hang when debugging programs with relocated kernel
    - ARM: dts: at91: sama5d3_xplained: fix ADC vref
    - ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
    - arm64: xchg: hazard against entire exchange variable
    - arm64: uaccess: ensure extension of access_ok() addr
    - arm64: documentation: document tagged pointer stack constraints
    - xc2028: Fix use-after-free bug properly
    - Revert "UBUNTU: SAUCE: mm: Respect FOLL_FORCE/FOLL_COW for thp"
    - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
    - staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
    - staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
    - iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
    - metag/uaccess: Fix access_ok()
    - metag/uaccess: Check access_ok in strncpy_from_user
    - uwb: fix device quirk on big-endian hosts
    - genirq: Fix chained interrupt data ordering
    - osf_wait4(): fix infoleak
    - tracing/kprobes: Enforce kprobes teardown after testing
    - PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
    - PCI: Freeze PME scan before suspending devices
    - drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
    - nfsd: encoders mustn't use unitialized values in error cases
    - drivers: char: mem: Check for address space wraparound with mmap()
    - Linux 4.4.70

* Xenial update to 4.4.69 stable release (LP: #1692900)
    - xen: adjust early dom0 p2m handling to xen hypervisor behavior
    - target: Fix compare_and_write_callback handling for non GOOD status
    - target/fileio: Fix zero-length READ and WRITE handling
    - target: Convert ACL change queue_depth se_session reference usage
    - iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
    - usb: host: xhci: print correct command ring address
    - USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
    - USB: Proper handling of Race Condition when two USB class drivers try to
      call init_usb_class simultaneously
    - staging: vt6656: use off stack for in buffer USB transfers.
    - staging: vt6656: use off stack for out buffer USB transfers.
    - staging: gdm724x: gdm_mux: fix use-after-free on module unload
    - staging: comedi: jr3_pci: fix possible null pointer dereference
    - staging: comedi: jr3_pci: cope with jiffies wraparound
    - usb: misc: add missing continue in switch
    - usb: Make sure usb/phy/of gets built-in
    - usb: hub: Fix error loop seen after hub communication errors
    - usb: hub: Do not attempt to autosuspend disconnected devices
    - x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
    - selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
    - x86, pmem: Fix cache flushing for iovec write < 8 bytes
    - um: Fix PTRACE_POKEUSER on x86_64
    - KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
    - KVM: arm/arm64: fix races in kvm_psci_vcpu_on
    - block: fix blk_integrity_register to use template's interval_exp if not 0
    - crypto: algif_aead - Require setkey before accept(2)
    - dm era: save spacemap metadata root after the pre-commit
    - vfio/type1: Remove locked page accounting workqueue
    - IB/core: Fix sysfs registration error flow
    - IB/IPoIB: ibX: failed to create mcg debug file
    - IB/mlx4: Fix ib device initialization error flow
    - IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level
    - ext4: evict inline data when writing to memory map
    - fs/xattr.c: zero out memory copied to userspace in getxattr
    - ceph: fix memory leak in __ceph_setxattr()
    - fs/block_dev: always invalidate cleancache in invalidate_bdev()
    - Set unicode flag on cifs echo request to avoid Mac error
    - SMB3: Work around mount failure when using SMB3 dialect to Macs
    - CIFS: fix mapping of SFM_SPACE and SFM_PERIOD
    - cifs: fix CIFS_IOC_GET_MNT_INFO oops
    - CIFS: add misssing SFM mapping for doublequote
    - padata: free correct variable
    - arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
    - serial: samsung: Use right device for DMA-mapping calls
    - serial: omap: fix runtime-pm handling on unbind
    - serial: omap: suspend device on probe errors
    - tty: pty: Fix ldisc flush after userspace become aware of the data already
    - Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
    - Bluetooth: hci_bcm: add missing tty-device sanity check
    - Bluetooth: hci_intel: add missing tty-device sanity check
    - mac80211: pass RX aggregation window size to driver
    - mac80211: pass block ack session timeout to to driver
    - mac80211: RX BA support for sta max_rx_aggregation_subframes
    - wlcore: Pass win_size taken from ieee80211_sta to FW
    - wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event
    - ipmi: Fix kernel panic at ipmi_ssif_thread()
    - Linux 4.4.69

* Support IPMI system interface on Cavium ThunderX (LP: #1688132)
    - i2c: octeon: Cleanup kerneldoc comments
    - i2c: octeon: Cleanup i2c-octeon driver
    - i2c: octeon: Cleanup resource allocation code
    - i2c: octeon: Support I2C_M_RECV_LEN
    - i2c: octeon: Increase retry default and use fixed timeout value
    - i2c: octeon: Move set-clock and init-lowlevel upward
    - i2c: octeon: Rename [read|write]_sw to reg_[read|write]
    - i2c: octeon: Introduce helper functions for register access
    - i2c: octeon: Remove superfluous check in octeon_i2c_test_iflg
    - i2c: octeon: Improve error status checking
    - i2c: octeon: Use i2c recovery framework
    - i2c: octeon: Add flush writeq helper function
    - i2c: octeon: Enable High-Level Controller
    - i2c: octeon: Add support for cn78xx chips
    - i2c: octeon: Remove zero-length message support
    - i2c: octeon: Improve performance if interrupt is early
    - i2c: octeon: Add workaround for broken irqs on CN3860
    - i2c: octeon: Missing AAK flag in case of I2C_M_RECV_LEN
    - i2c: octeon: Avoid printk after too long SMBUS message
    - i2c: octeon: Rename driver to prepare for split
    - i2c: octeon: Split the driver into two parts
    - [Config] CONFIG_I2C_THUNDERX=m
    - i2c: thunderx: Add i2c driver for ThunderX SOC
    - i2c: thunderx: Add SMBUS alert support
    - i2c: octeon,thunderx: Move register offsets to struct
    - i2c: octeon: Sort include files alphabetically
    - i2c: octeon: Use booleon values for booleon variables
    - i2c: octeon: thunderx: Add MAINTAINERS entry
    - i2c: octeon: Fix set SCL recovery function
    - i2c: octeon: Avoid sending STOP during recovery
    - i2c: octeon: Fix high-level controller status check
    - i2c: octeon: thunderx: TWSI software reset in recovery
    - i2c: octeon: thunderx: Remove double-check after interrupt
    - i2c: octeon: thunderx: Limit register access retries
    - i2c: thunderx: Enable HWMON class probing

* Xenial update to 4.4.68 stable release (LP: #1691418)
    - 9p: fix a potential acl leak
    - ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode
    - cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
    - powerpc/powernv: Fix opal_exit tracepoint opcode
    - power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING
    - power: supply: bq24190_charger: Call set_mode_host() on pm_resume()
    - power: supply: bq24190_charger: Install irq_handler_thread() at end of
      probe()
    - power: supply: bq24190_charger: Call power_supply_changed() for relevant
      component
    - power: supply: bq24190_charger: Don't read fault register outside
      irq_handle_thread()
    - power: supply: bq24190_charger: Handle fault before status on interrupt
    - leds: ktd2692: avoid harmless maybe-uninitialized warning
    - ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build
    - mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print
    - mwifiex: remove redundant dma padding in AMSDU
    - mwifiex: Avoid skipping WEP key deletion for AP
    - x86/ioapic: Restore IO-APIC irq_chip retrigger callback
    - x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0
    - clk: Make x86/ conditional on CONFIG_COMMON_CLK
    - kprobes/x86: Fix kernel panic when certain exception-handling addresses are
      probed
    - x86/platform/intel-mid: Correct MSI IRQ line for watchdog device
    - Revert "KVM: nested VMX: disable perf cpuid reporting"
    - KVM: nVMX: initialize PML fields in vmcs02
    - KVM: nVMX: do not leak PML full vmexit to L1
    - usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error
      paths
    - usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error
      paths
    - usb: chipidea: Only read/write OTGSC from one place
    - usb: chipidea: Handle extcon events properly
    - USB: serial: keyspan_pda: fix receive sanity checks
    - USB: serial: digi_acceleport: fix incomplete rx sanity check
    - USB: serial: ssu100: fix control-message error handling
    - USB: serial: io_edgeport: fix epic-descriptor handling
    - USB: serial: ti_usb_3410_5052: fix control-message error handling
    - USB: serial: ark3116: fix open error handling
    - USB: serial: ftdi_sio: fix latency-timer error handling
    - USB: serial: quatech2: fix control-message error handling
    - USB: serial: mct_u232: fix modem-status error handling
    - USB: serial: io_edgeport: fix descriptor error handling
    - phy: qcom-usb-hs: Add depends on EXTCON
    - serial: 8250_omap: Fix probe and remove for PM runtime
    - scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
    - MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix
    - brcmfmac: Ensure pointer correctly set if skb data location changes
    - brcmfmac: Make skb header writable before use
    - staging: wlan-ng: add missing byte order conversion
    - staging: emxx_udc: remove incorrect __init annotations
    - ALSA: hda - Fix deadlock of controller device lock at unbinding
    - tcp: do not underestimate skb->truesize in tcp_trim_head()
    - bpf, arm64: fix jit branch offset related to ldimm64
    - tcp: fix wraparound issue in tcp_lp
    - tcp: do not inherit fastopen_req from parent
    - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
    - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
    - ipv6: initialize route null entry in addrconf_init()
    - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
    - bnxt_en: allocate enough space for ->ntp_fltr_bmap
    - f2fs: sanity check segment count
    - drm/ttm: fix use-after-free races in vm fault handling
    - block: get rid of blk_integrity_revalidate()
    - Linux 4.4.68

* Keyboard backlight control does not work on some dell laptops.
    (LP: #1693126)
    - platform/x86: dell-laptop: Add Latitude 7480 and others to the DMI whitelist
    - platform/x86: dell-laptop: Add keyboard backlight timeout AC settings

* Upgrade Redpine WLAN/BT driver to ver. 1.2.RC9 (LP: #1690498)
    - SAUCE: Redpine: Upgrade to ver. 1.2.RC9

* exec'ing a setuid binary from a threaded program sometimes fails to setuid
    (LP: #1672819)
    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct

* attempts to rename vlans / vlans have addr_assign_type of 0 on kernel 4.4
    (LP: #1682871)
    - vlan: Propagate MAC address to VLANs

* Exar usb-serial doesn't restore baud rate after resume from S3/S4
    (LP: #1690362)
    - SAUCE: xr-usb-serial: re-initialise baudrate after resume from S3/S4

* st_pressure, st_accel IIO drivers fail to detect sensors after reloading
    kernel modules (LP: #1690310)
    - SAUCE: (no-up) iio: st_pressure: st_accel: Initialise sensor platform data
      properly

* nvidia-docker on ppc64le-ubuntu16.04  issue due to cross-thread naming if
    !PR_DUMPABLE (LP: #1690225)
    - procfs: fix pthread cross-thread naming if !PR_DUMPABLE

* linux xenial derivatives fail to build (LP: #1691814)
    - [Packaging] Set do_tools_common in common vars

-- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 26 Jun 2017 12:27:55 -0300

Changed in linux (Ubuntu Xenial):
status:	Fix Committed → Fix Released
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-06-29:

#27

Download full text (19.7 KiB)

This bug was fixed in the package linux - 4.10.0-26.30

---------------
linux (4.10.0-26.30) zesty; urgency=low

* linux: 4.10.0-26.30 -proposed tracker (LP: #1700528)

  * CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.10.0-25.29) zesty; urgency=low

* linux: 4.10.0-25.29 -proposed tracker (LP: #1699028)

* CVE-2017-1000364
- SAUCE: mm: Only expand stack if guard area is hit

  * CVE-2017-9074
    - ipv6: Prevent overrun when parsing v6 header options
    - ipv6: Check ip6_find_1stfragopt() return value properly.

  * [Zesty] QDF2400 ARM64 server - NMI watchdog: BUG: soft lockup - CPU#8 stuck
    for 22s! (LP: #1680549)
    - iommu/dma: Stop getting dma_32bit_pfn wrong
    - iommu/dma: Implement PCI allocation optimisation
    - iommu/dma: Convert to address-based allocation
    - iommu/dma: Clean up MSI IOVA allocation
    - iommu/dma: Plumb in the per-CPU IOVA caches
    - iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range

  * Zesty update to 4.10.17 stable release (LP: #1692898)
    - xen: adjust early dom0 p2m handling to xen hypervisor behavior
    - target: Fix compare_and_write_callback handling for non GOOD status
    - target/fileio: Fix zero-length READ and WRITE handling
    - iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
    - usb: xhci: bInterval quirk for TI TUSB73x0
    - usb: host: xhci: print correct command ring address
    - USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
    - USB: Proper handling of Race Condition when two USB class drivers try to
      call init_usb_class simultaneously
    - USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications"
    - staging: vt6656: use off stack for in buffer USB transfers.
    - staging: vt6656: use off stack for out buffer USB transfers.
    - staging: gdm724x: gdm_mux: fix use-after-free on module unload
    - staging: wilc1000: Fix problem with wrong vif index
    - staging: comedi: jr3_pci: fix possible null pointer dereference
    - staging: comedi: jr3_pci: cope with jiffies wraparound
    - usb: misc: add missing continue in switch
    - usb: gadget: legacy gadgets are optional
    - usb: Make sure usb/phy/of gets built-in
    - usb: hub: Fix error loop seen after hub communication errors
    - usb: hub: Do not attempt to autosuspend disconnected devices
    - x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
    - selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
    - x86, pmem: Fix cache flushing for iovec write < 8 bytes
    - um: Fix PTRACE_POKEUSER on x86_64
    - perf/x86: Fix Broadwell-EP DRAM RAPL events
    - KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
    - KVM: arm/arm64: fix races in kvm_psci_vcpu_on
    - arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
    - block: fix blk_integrity_register to use templ...

This bug was fixed in the package linux - 4.10.0-26.30

---------------
linux (4.10.0-26.30) zesty; urgency=low

* linux: 4.10.0-26.30 -proposed tracker (LP: #1700528)

* CVE-2017-1000364
    - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit"
    - Revert "mm: do not collapse stack gap into THP"
    - Revert "mm: enlarge stack guard gap"
    - mm: larger stack guard gap, between vmas
    - mm: fix new crash in unmapped_area_topdown()
    - Allow stack to grow up to address space limit

linux (4.10.0-25.29) zesty; urgency=low

* linux: 4.10.0-25.29 -proposed tracker (LP: #1699028)

* CVE-2017-1000364
    - SAUCE: mm: Only expand stack if guard area is hit

* CVE-2017-9074
    - ipv6: Prevent overrun when parsing v6 header options
    - ipv6: Check ip6_find_1stfragopt() return value properly.

* [Zesty] QDF2400 ARM64 server - NMI watchdog: BUG: soft lockup - CPU#8 stuck
    for 22s!  (LP: #1680549)
    - iommu/dma: Stop getting dma_32bit_pfn wrong
    - iommu/dma: Implement PCI allocation optimisation
    - iommu/dma: Convert to address-based allocation
    - iommu/dma: Clean up MSI IOVA allocation
    - iommu/dma: Plumb in the per-CPU IOVA caches
    - iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range

* Zesty update to 4.10.17 stable release (LP: #1692898)
    - xen: adjust early dom0 p2m handling to xen hypervisor behavior
    - target: Fix compare_and_write_callback handling for non GOOD status
    - target/fileio: Fix zero-length READ and WRITE handling
    - iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
    - usb: xhci: bInterval quirk for TI TUSB73x0
    - usb: host: xhci: print correct command ring address
    - USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
    - USB: Proper handling of Race Condition when two USB class drivers try to
      call init_usb_class simultaneously
    - USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications"
    - staging: vt6656: use off stack for in buffer USB transfers.
    - staging: vt6656: use off stack for out buffer USB transfers.
    - staging: gdm724x: gdm_mux: fix use-after-free on module unload
    - staging: wilc1000: Fix problem with wrong vif index
    - staging: comedi: jr3_pci: fix possible null pointer dereference
    - staging: comedi: jr3_pci: cope with jiffies wraparound
    - usb: misc: add missing continue in switch
    - usb: gadget: legacy gadgets are optional
    - usb: Make sure usb/phy/of gets built-in
    - usb: hub: Fix error loop seen after hub communication errors
    - usb: hub: Do not attempt to autosuspend disconnected devices
    - x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
    - selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
    - x86, pmem: Fix cache flushing for iovec write < 8 bytes
    - um: Fix PTRACE_POKEUSER on x86_64
    - perf/x86: Fix Broadwell-EP DRAM RAPL events
    - KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
    - KVM: arm/arm64: fix races in kvm_psci_vcpu_on
    - arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
    - block: fix blk_integrity_register to use template's interval_exp if not 0
    - crypto: s5p-sss - Close possible race for completed requests
    - crypto: algif_aead - Require setkey before accept(2)
    - crypto: ccp - Use only the relevant interrupt bits
    - crypto: ccp - Disable interrupts early on unload
    - crypto: ccp - Change ISR handler method for a v3 CCP
    - crypto: ccp - Change ISR handler method for a v5 CCP
    - dm crypt: rewrite (wipe) key in crypto layer using random data
    - dm era: save spacemap metadata root after the pre-commit
    - dm rq: check blk_mq_register_dev() return value in
      dm_mq_init_request_queue()
    - dm thin: fix a memory leak when passing discard bio down
    - vfio/type1: Remove locked page accounting workqueue
    - iov_iter: don't revert iov buffer if csum error
    - IB/core: Fix sysfs registration error flow
    - IB/core: For multicast functions, verify that LIDs are multicast LIDs
    - IB/IPoIB: ibX: failed to create mcg debug file
    - IB/mlx4: Fix ib device initialization error flow
    - IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level
    - IB/hfi1: Prevent kernel QP post send hard lockups
    - perf auxtrace: Fix no_size logic in addr_filter__resolve_kernel_syms()
    - perf annotate s390: Fix perf annotate error -95 (4.10 regression)
    - perf annotate s390: Implement jump types for perf annotate
    - jbd2: fix dbench4 performance regression for 'nobarrier' mounts
    - ext4: evict inline data when writing to memory map
    - orangefs: fix bounds check for listxattr
    - orangefs: clean up oversize xattr validation
    - orangefs: do not set getattr_time on orangefs_lookup
    - orangefs: do not check possibly stale size on truncate
    - fs/xattr.c: zero out memory copied to userspace in getxattr
    - ceph: fix memory leak in __ceph_setxattr()
    - fs/block_dev: always invalidate cleancache in invalidate_bdev()
    - mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC
    - Fix match_prepath()
    - Set unicode flag on cifs echo request to avoid Mac error
    - SMB3: Work around mount failure when using SMB3 dialect to Macs
    - CIFS: fix mapping of SFM_SPACE and SFM_PERIOD
    - cifs: fix leak in FSCTL_ENUM_SNAPS response handling
    - cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops
    - CIFS: fix oplock break deadlocks
    - cifs: fix CIFS_IOC_GET_MNT_INFO oops
    - CIFS: add misssing SFM mapping for doublequote
    - ovl: do not set overlay.opaque on non-dir create
    - padata: free correct variable
    - md/raid1: avoid reusing a resync bio after error handling.
    - device-dax: fix cdev leak
    - device-dax: fix sysfs attribute deadlock
    - dax: prevent invalidation of mapped DAX entries
    - mm: fix data corruption due to stale mmap reads
    - f2fs: fix fs corruption due to zero inode page
    - fscrypt: fix context consistency check when key(s) unavailable
    - serial: samsung: Use right device for DMA-mapping calls
    - serial: omap: fix runtime-pm handling on unbind
    - serial: omap: suspend device on probe errors
    - tty: pty: Fix ldisc flush after userspace become aware of the data already
    - Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
    - Bluetooth: hci_bcm: add missing tty-device sanity check
    - Bluetooth: hci_intel: add missing tty-device sanity check
    - libnvdimm, region: fix flush hint detection crash
    - libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify
    - libnvdimm: fix nvdimm_bus_lock() vs device_lock() ordering
    - libnvdimm, pfn: fix 'npfns' vs section alignment
    - pstore: Shut down worker when unregistering
    - Linux 4.10.17

* [SRU][Zesty] Support SMMU passthrough using the default domain
    (LP: #1688158)
    - iommu/arm-smmu: Restrict domain attributes to UNMANAGED domains
    - iommu/arm-smmu: Install bypass S2CRs for IOMMU_DOMAIN_IDENTITY domains
    - iommu/arm-smmu-v3: Make arm_smmu_install_ste_for_dev return void
    - iommu: Rename iommu_get_instance()
    - iommu: Rename struct iommu_device
    - iommu: Introduce new 'struct iommu_device'
    - iommu: Add sysfs bindings for struct iommu_device
    - iommu: Make iommu_device_link/unlink take a struct iommu_device
    - iommu: Add iommu_device_set_fwnode() interface
    - iommu/arm-smmu: Make use of the iommu_register interface
    - iommu/arm-smmu-v3: Install bypass STEs for IOMMU_DOMAIN_IDENTITY domains
    - iommu: Allow default domain type to be set on the kernel command line
    - arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA
    - iommu/vt-d: Fix crash on boot when DMAR is disabled

* Enable Matrox driver for Ubuntu 16.04.3 (LP: #1693337)
    - [Config] Enable CONFIG_DRM_MGAG200 as module
    - drm/mgag200: Added support for the new device G200eH3

* Ubuntu16.04.03: POWER9 XIVE: msgsnd/doorbell IPI support (backport)
    (LP: #1691973)
    - powerpc/64s: Add msgp facility unavailable log string
    - powerpc/64s: Add SCV FSCR bit for ISA v3.0
    - powerpc/xmon: Dump memory in CPU endian format
    - powerpc/xive: Native exploitation of the XIVE interrupt controller
    - powerpc: Change the doorbell IPI calling convention
    - powerpc: Introduce msgsnd/doorbell barrier primitives
    - powerpc/64s: Avoid a branch for ppc_msgsnd
    - powerpc/powernv: POWER9 support for msgsnd/doorbell IPI
    - powerpc: Add optional smp_ops->prepare_cpu SMP callback
    - powerpc: Add more PPC bit conversion macros
    - powerpc/powernv: Add XIVE related definitions to opal-api.h
    - powerpc/smp: Remove migrate_irq() custom implementation
    - powerpc/powernv: Fix oops on P9 DD1 in cause_ipi()
    - (config) Update configs with PPC_XIVE options