BUG in nf_nat_cleanup_conntrack

[Steve Conklin]

SRU Justification:

[Impact]
A race condition can occur that can be triggered when cleaning up LXC containers that use NAT/netns.

[Fix]
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f

[Testcase]
Using many LXC containers with NAT/netns and creating and destroying may trigger this issue.

--

Seeing this bug, which has been reported upstream:

https://bugzilla.kernel.org/show_bug.cgi?id=65191

Our stacktrace:

[17792296.022138] BUG: unable to handle kernel paging request at ffffc9000340a750
[17792296.022161] IP: [<ffffffffa0137200>] nf_nat_cleanup_conntrack+0x40/0x70 [nf_nat]
[17792296.022173] PGD 1b6426067 PUD 1b6427067 PMD 156481067 PTE 0
[17792296.022196] Oops: 0002 [#1] SMP
[17792296.022205] Modules linked in: xt_nat veth tcp_diag inet_diag xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat bridge stp llc xt_owner ipt_REJECT xt_LOG xt_limit nf_conntrack_ipv4 nf_defrag_ipv4 xt_tcpudp xt_conntrack nf_conntrack iptable_filter ip_tables x_tables isofs dm_crypt raid10 raid456 async_memcpy async_raid6_recov async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear
[17792296.022254] CPU: 4 PID: 6 Comm: kworker/u16:0 Not tainted 3.13.0-24-generic #46-Ubuntu
[17792296.022267] Workqueue: netns cleanup_net
[17792296.022271] task: ffff8801b39e0000 ti: ffff8801b39dc000 task.ti: ffff8801b39dc000
[17792296.022276] RIP: e030:[<ffffffffa0137200>] [<ffffffffa0137200>] nf_nat_cleanup_conntrack+0x40/0x70 [nf_nat]
[17792296.022286] RSP: e02b:ffff8801b39ddcb8 EFLAGS: 00010246
[17792296.022290] RAX: 0000000000000000 RBX: ffff880081691508 RCX: ffff8801b26b8988
[17792296.022297] RDX: ffffc9000340a750 RSI: 000000001e321e30 RDI: ffffffffa013a4c0
[17792296.022302] RBP: ffff8801b39ddcc0 R08: 0000000000000200 R09: 0000000000000000
[17792296.022306] R10: 0000000000007ff0 R11: 0000000000000005 R12: ffff880081691480
[17792296.022312] R13: ffff8800c07d0000 R14: ffff8800c07d0008 R15: ffff8801b26b8000
[17792296.022324] FS: 00007fcd1d936740(0000) GS:ffff8801bed00000(0000) knlGS:0000000000000000
[17792296.022329] CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[17792296.022333] CR2: ffffc9000340a750 CR3: 0000000001c0e000 CR4: 0000000000002660
[17792296.022339] Stack:
[17792296.022342] 0000000000000001 ffff8801b39ddce8 ffffffffa00f15a4 ffff8800c07d0000
[17792296.022351] ffff8801b26b8000 ffffffffa00b92c0 ffff8801b39ddd08 ffffffffa00e92d5
[17792296.022358] ffff8800c07d0000 ffff8801b26b8000 ffff8801b39ddd28 ffffffffa00ea7b4
[17792296.022366] Call Trace:
[17792296.022379] [<ffffffffa00f15a4>] __nf_ct_ext_destroy+0x44/0x60 [nf_conntrack]
[17792296.022388] [<ffffffffa00e92d5>] nf_conntrack_free+0x25/0x60 [nf_conntrack]
[17792296.022397] [<ffffffffa00ea7b4>] destroy_conntrack+0xb4/0x110 [nf_conntrack]
[17792296.022407] [<ffffffffa00ee260>] ? nf_conntrack_helper_fini+0x30/0x30 [nf_conntrack]
[17792296.022415] [<ffffffff81649d77>] nf_conntrack_destroy+0x17/0x20
[17792296.022423] [<ffffffffa00ea23b>] nf_ct_iterate_cleanup+0x12b/0x150 [nf_conntrack]
[17792296.022433] [<ffffffffa00ee53d>] nf_ct_l3proto_pernet_unregister+0x1d/0x20 [nf_conntrack]
[17792296.022441] [<ffffffffa00b7309>] ipv4_net_exit+0x19/0x50 [nf_conntrack_ipv4]
[17792296.022448] [<ffffffff81612b49>] ops_exit_list.isra.1+0x39/0x60
[17792296.022453] [<ffffffff816133d0>] cleanup_net+0x110/0x250
[17792296.022464] [<ffffffff810838a2>] process_one_work+0x182/0x450
[17792296.022470] [<ffffffff81084641>] worker_thread+0x121/0x410
[17792296.022476] [<ffffffff81084520>] ? rescuer_thread+0x3e0/0x3e0
[17792296.022483] [<ffffffff8108b312>] kthread+0xd2/0xf0
[17792296.022488] [<ffffffff8108b240>] ? kthread_create_on_node+0x1d0/0x1d0
[17792296.022496] [<ffffffff8172637c>] ret_from_fork+0x7c/0xb0
[17792296.022501] [<ffffffff8108b240>] ? kthread_create_on_node+0x1d0/0x1d0
[17792296.022505] Code: 53 0f b6 58 11 84 db 74 45 48 01 c3 74 40 48 83 7b 10 00 74 39 48 c7 c7 c0 a4 13 a0 e8 0a 68 5e e1 48 8b 03 48 8b 53 08 48 85 c0 <48> 89 02 74 04 48 89 50 08 48 b8 00 02 20 00 00 00 ad de 48 c7
[17792296.022550] RIP [<ffffffffa0137200>] nf_nat_cleanup_conntrack+0x40/0x70 [nf_nat]
[17792296.022557] RSP <ffff8801b39ddcb8>
[17792296.022560] CR2: ffffc9000340a750
[17792296.022569] ---[ end trace 321f62b987d4a83b ]---
[17792296.022573] Kernel panic - not syncing: Fatal exception in interrupt

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: linux-image-3.13.0-24-generic 3.13.0-24.46
ProcVersionSignature: Ubuntu 3.13.0-24.46-generic 3.13.9
Uname: Linux 3.13.0-24-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.14.1-0ubuntu3
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC3: sconklin 2706 F.... pulseaudio
 /dev/snd/controlC2: sconklin 2706 F.... pulseaudio
 /dev/snd/controlC1: sconklin 2706 F.... pulseaudio
 /dev/snd/controlC0: sconklin 2706 F.... pulseaudio
CurrentDesktop: Unity
Date: Tue Apr 29 11:25:06 2014
HibernationDevice: RESUME=UUID=e701c443-34ca-4e0f-bd28-86dbe9ace3ab
InstallationDate: Installed on 2014-02-19 (68 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Alpha amd64 (20140218)
MachineType: ASUS All Series
ProcFB:

ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.13.0-24-generic root=UUID=1cb2ef0d-01b3-450f-bfd1-5fb647a3cb30 ro quiet splash crashkernel=384M-:128M crashkernel=384M-:128M crashkernel=384M-:128M crashkernel=384M-:128M
RelatedPackageVersions:
 linux-restricted-modules-3.13.0-24-generic N/A
 linux-backports-modules-3.13.0-24-generic N/A
 linux-firmware 1.127
RfKill:

SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/20/2013
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1102
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: MAXIMUS VI GENE
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Asset-1234567890
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1102:bd11/20/2013:svnASUS:pnAllSeries:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnMAXIMUSVIGENE:rvrRev1.xx:cvnChassisManufacture:ct3:cvrChassisVersion:
dmi.product.name: All Series
dmi.product.version: System Version
dmi.sys.vendor: ASUS

[Steve Conklin (sconklin)]

NOTE: This bug was not reported from the affected machine, but from a workstation running the same kernel.

This bug appears after adding then removing a number of LXC containers

[Chris J Arges (arges)]

Link to upstream bug: https://bugzilla.kernel.org/show_bug.cgi?id=65191

[Steve Conklin (sconklin)]

The problem also occurs with the mainline v3.15-rc2-trusty build:

[17345307.967478] BUG: unable to handle kernel paging request at ffffc90003777a70
[17345307.967497] IP: [<ffffffffa013f0b6>] nf_nat_cleanup_conntrack+0x46/0x70 [nf_nat]
[17345307.967510] PGD 1b6425067 PUD 1b6426067 PMD 1b0aed067 PTE 0
[17345307.967519] Oops: 0002 [#1] SMP
[17345307.967525] Modules linked in: xt_nat veth tcp_diag inet_diag xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat bridge stp llc xt_owner isofs ipt_REJECT xt_LOG xt_limit nf_conntrack_ipv4 nf_defrag_ipv4 xt_tcpudp xt_conntrack nf_conntrack iptable_filter ip_tables x_tables dm_crypt microcode raid10 raid456 async_memcpy async_raid6_recov async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear
[17345307.967578] CPU: 0 PID: 6 Comm: kworker/u16:0 Not tainted 3.15.0-031500rc2-generic #201404201435
[17345307.967591] Workqueue: netns cleanup_net
[17345307.967596] task: ffff8801b39d0000 ti: ffff8801b39cc000 task.ti: ffff8801b39cc000
[17345307.967601] RIP: e030:[<ffffffffa013f0b6>] [<ffffffffa013f0b6>] nf_nat_cleanup_conntrack+0x46/0x70 [nf_nat]
[17345307.967611] RSP: e02b:ffff8801b39cdc48 EFLAGS: 00010246
[17345307.967617] RAX: 0000000000000000 RBX: ffff8801b1cf7b10 RCX: ffff880003110000
[17345307.967624] RDX: ffffc90003777a70 RSI: 0000000000000200 RDI: ffffffffa01434e0
[17345307.967630] RBP: ffff8801b39cdc58 R08: 0000000058690aeb R09: 00000000e834b0f3
[17345307.967636] R10: ffff880003110070 R11: 0000000000000002 R12: ffff8801b1cf7a80
[17345307.967643] R13: ffff880003110000 R14: 0000000000000000 R15: 0000000000000000
[17345307.967655] FS: 00007fd6682cc740(0000) GS:ffff8801bec00000(0000) knlGS:0000000000000000
[17345307.967662] CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[17345307.967667] CR2: ffffc90003777a70 CR3: 00000000058f9000 CR4: 0000000000002660
[17345307.967673] Stack:
[17345307.967677] ffffffff8176ce52 0000000000000001 ffff8801b39cdc88 ffffffffa00d1013
[17345307.967686] 0000000000000000 ffff880003110000 ffff8800ca7b8000 ffffffffa00e5140
[17345307.967694] ffff8801b39cdca8 ffffffffa00c867e ffff880003110000 ffff8800ca7b8000
[17345307.967703] Call Trace:
[17345307.967712] [<ffffffff8176ce52>] ? _raw_spin_lock+0x12/0x50
[17345307.967726] [<ffffffffa00d1013>] __nf_ct_ext_destroy+0x43/0x60 [nf_conntrack]
[17345307.967736] [<ffffffffa00c867e>] nf_conntrack_free+0x2e/0x70 [nf_conntrack]
[17345307.967746] [<ffffffffa00c946e>] destroy_conntrack+0x9e/0xf0 [nf_conntrack]
[17345307.967756] [<ffffffffa00cdc40>] ? nf_conntrack_helper_fini+0x30/0x30 [nf_conntrack]
[17345307.967766] [<ffffffff81686617>] nf_conntrack_destroy+0x17/0x20
[17345307.967775] [<ffffffffa00c9358>] nf_ct_iterate_cleanup+0x78/0xb0 [nf_conntrack]
[17345307.967786] [<ffffffffa00cdd1d>] nf_ct_l3proto_pernet_unregister+0x1d/0x20 [nf_conntrack]
[17345307.967796] [<ffffffffa00e355d>] ipv4_net_exit+0x1d/0x60 [nf_conntrack_ipv4]
[17345307.967804] [<ffffffff8164b918>] ops_exit_list.isra.1+0x38/0x60
[17345307.967811] [<ffffffff8164c222>] cleanup_net+0x112/0x230
[17345307.967820] [<ffffffff81085e2f>] process_one_work+0x17f/0x4c0
[17345307.967827] [<ffffffff81086d7b>] worker_thread+0x11b/0x3d0
[1734...

[Steve Conklin (sconklin)]

This also happens with the (almost) current mainline kernel,
from here:

http://kernel.ubuntu.com/~kernel-ppa/mainline/daily/current/

Commit for this build was:

ed8c37e158cb697df905d6b4933bc107c69e8936

Traceback (most recent call last):
  File "/usr/bin/cloud-init", line 618, in <module>
    sys.exit(main())
  File "/usr/bin/cloud-init", line 614, in main
    get_uptime=True, func=functor, args=(name, args))
  File "/usr/lib/python2.7/dist-packages/cloudinit/util.py", line 1875, in log_time
    ret = func(*args, **kwargs)
  File "/usr/bin/cloud-init", line 510, in status_wrapper
    atomic_write_json(status_path, status)
  File "/usr/bin/cloud-init", line 434, in atomic_write_json
    raise e
OSError: [Errno 2] No such file or directory: '/var/lib/cloud/data/tmpMBxCza'
[474208.150506] BUG: unable to handle kernel paging request at ffffc90003661288
[474208.150524] IP: [<ffffffffa013a0b6>] nf_nat_cleanup_conntrack+0x46/0x70 [nf_nat]
[474208.150536] PGD 1b6423067 PUD 1b6424067 PMD 1b255b067 PTE 0
[474208.150544] Oops: 0002 [#1] SMP
[474208.150549] Modules linked in: xt_nat veth tcp_diag inet_diag xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat bridge stp llc xt_owner ipt_REJECT xt_LOG xt_limit nf_conntrack_ipv4 nf_defrag_ipv4 xt_tcpudp xt_conntrack nf_conntrack iptable_filter ip_tables x_tables isofs dm_crypt raid10 raid456 async_memcpy async_raid6_recov async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear
[474208.150602] CPU: 3 PID: 6 Comm: kworker/u16:0 Not tainted 3.15.0-999-generic #201404300254
[474208.150614] Workqueue: netns cleanup_net
[474208.150619] task: ffff8801b39d0000 ti: ffff8801b39c6000 task.ti: ffff8801b39c6000
[474208.150625] RIP: e030:[<ffffffffa013a0b6>] [<ffffffffa013a0b6>] nf_nat_cleanup_conntrack+0x46/0x70 [nf_nat]
[474208.150634] RSP: e02b:ffff8801b39c7c48 EFLAGS: 00010246
[474208.150639] RAX: 0000000000000000 RBX: ffff8801af4e5510 RCX: ffff8801b2040000
[474208.150645] RDX: ffffc90003661288 RSI: 0000000000000200 RDI: ffffffffa013d4e0
[474208.150651] RBP: ffff8801b39c7c58 R08: 00000000f72af2f7 R09: 0000000002eb94ae
[474208.150657] R10: ffff8801b2040070 R11: 0000000000000002 R12: ffff8801af4e5480
[474208.150664] R13: ffff8801b2040000 R14: 0000000000000000 R15: 0000000000000000
[474208.150674] FS: 00007fb3072be700(0000) GS:ffff8801becc0000(0000) knlGS:0000000000000000
[474208.150681] CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[474208.150686] CR2: ffffc90003661288 CR3: 00000000f54bb000 CR4: 0000000000002660
[474208.150692] Stack:
[474208.150695] ffffffff81763762 0000000000000001 ffff8801b39c7c88 ffffffffa00f2f53
[474208.150704] 0000000000000000 ffff8801b2040000 ffff88008c4e0000 ffffffffa00d1140
[474208.150712] ffff8801b39c7ca8 ffffffffa00ea67e ffff8801b2040000 ffff88008c4e0000
[474208.150721] Call Trace:
[474208.150729] [<ffffffff81763762>] ? _raw_spin_lock+0x12/0x50
[474208.150744] [<ffffffffa00f2f53>] __nf_ct_ext_destroy+0x43/0x60 [nf_conntrack]
[474208.150755] [<ffffffffa00ea67e>] nf_conntrack_free+0x2e/0x70 [nf_conntrack]
[474208.150765] [<ffffffffa00eb46e>] destroy_conntrack+0x9e/0xf0 [nf_conntrack]
[474208.150775] [<ffffffffa00efbd0>] ? nf_conntrack_helper_...

[Chris J Arges (arges)]

Can you test this kernel built with lockdep debugging on and see what output it provides? It also may be worthwhile to getting a crashdump if lockdep debugging is inconclusive.

[Chris J Arges (arges)]

And the link to the build is here: http://people.canonical.com/~arges/lp1314274/

[Rodrigo Vaz (rodrigo-vaz)]

Chris,

I work with Steve and was able to reproduce with the lockdep debugging, the output as follows:

[18075576.538133] BUG: unable to handle kernel paging request at ffffc900038ebac8
[18075576.538153] IP: [<ffffffffa013d1a1>] nf_nat_cleanup_conntrack+0x41/0x70 [nf_nat]
[18075576.538166] PGD 1b6428067 PUD 1b6429067 PMD 152eae067 PTE 0
[18075576.538176] Oops: 0002 [#1] SMP
[18075576.538183] Modules linked in: xt_nat veth tcp_diag inet_diag xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat bridge stp llc xt_owner isofs ipt_REJECT xt_LOG xt_limit nf_conntrack_ipv4 nf_defrag_ipv4 xt_tcpudp xt_conntrack nf_conntrack iptable_filter ip_tables x_tables dm_crypt microcode raid10 raid456 async_memcpy async_raid6_recov async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear
[18075576.538246] CPU: 6 PID: 6 Comm: kworker/u16:0 Not tainted 3.15.0-0-generic #1~lp1314274
[18075576.538260] Workqueue: netns cleanup_net
[18075576.538267] task: ffff8801b3a04440 ti: ffff8801b3a0a000 task.ti: ffff8801b3a0a000
[18075576.538274] RIP: e030:[<ffffffffa013d1a1>] [<ffffffffa013d1a1>] nf_nat_cleanup_conntrack+0x41/0x70 [nf_nat]
[18075576.538285] RSP: e02b:ffff8801b3a0bc00 EFLAGS: 00010246
[18075576.538291] RAX: 0000000000000000 RBX: ffff8800eee261b0 RCX: 00000000040003fe
[18075576.538299] RDX: ffffc900038ebac8 RSI: 000000000000035c RDI: ffffffffa0141100
[18075576.538305] RBP: ffff8801b3a0bc08 R08: 0000000000000000 R09: 0000000000000000
[18075576.538312] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8800eee26100
[18075576.538319] R13: ffff8801b238c000 R14: 000000000004c2b8 R15: ffff8801b238c048
[18075576.538330] FS: 00007f3bdf8d8740(0000) GS:ffff8801bed80000(0000) knlGS:0000000000000000
[18075576.538337] CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[18075576.538343] CR2: ffffc900038ebac8 CR3: 000000008c774000 CR4: 0000000000002660
[18075576.538350] Stack:
[18075576.538354] 0000000000000001 ffff8801b3a0bc38 ffffffffa00ce852 ffffffffa00ce813
[18075576.538364] ffff8801b238c000 ffff8801b20b8000 ffff8801b238c000 ffff8801b3a0bc58
[18075576.538374] ffffffffa00c5415 ffff8801b238c000 ffff8801b20b8000 ffff8801b3a0bc80
[18075576.538384] Call Trace:
[18075576.538399] [<ffffffffa00ce852>] __nf_ct_ext_destroy+0x72/0xa0 [nf_conntrack]
[18075576.538413] [<ffffffffa00ce813>] ? __nf_ct_ext_destroy+0x33/0xa0 [nf_conntrack]
[18075576.538424] [<ffffffffa00c5415>] nf_conntrack_free+0x25/0x60 [nf_conntrack]
[18075576.538435] [<ffffffffa00c706d>] destroy_conntrack+0xdd/0x130 [nf_conntrack]
[18075576.538447] [<ffffffffa00c6fb7>] ? destroy_conntrack+0x27/0x130 [nf_conntrack]
[18075576.538458] [<ffffffff8167df55>] nf_conntrack_destroy+0x45/0x70
[18075576.538466] [<ffffffff8167df15>] ? nf_conntrack_destroy+0x5/0x70
[18075576.538477] [<ffffffffa00cb190>] ? nf_conntrack_helper_fini+0x30/0x30 [nf_conntrack]
[18075576.538488] [<ffffffffa00c6b53>] nf_ct_iterate_cleanup+0x203/0x230 [nf_conntrack]
[18075576.538501] [<ffffffffa00cb32d>] nf_ct_l3proto_pernet_unregister+0x1d/0x20 [nf_conntrack]
[18075576.538512] [<ffffffffa00b62f9>] ipv4_net_exit+0x19/0x50 [nf_conntrack_ipv4]
[18075576.538522] [<ffffffff81642539>] ops_exit_list.isra.1+0x39/...

[Chris J Arges (arges)]

I assume there wasn't anything else interesting in the kernel logs... this just looks similar to the existing bug.
Can you get a proper crash dump when this issue occurs?
https://wiki.ubuntu.com/Kernel/CrashdumpRecipe

[Rodrigo Vaz (rodrigo-vaz)]

I still wasn't able to get a kdump loaded for a crashdump on this ec2 instance although I was able to capture lockdep with the container running and when it get killed that is just before the crash happens.

[Rodrigo Vaz (rodrigo-vaz)]

I still didn't had luck generating a crashdump but with small change on the patch posted on the upstream bug I can confirm the crash doesn't happen anymore, tested on ubuntu trusty kernel 3.13.0-24-generic.

[Chris J Arges (arges)]

Also noticed a newer patch here:
http://patchwork.ozlabs.org/patch/357147/raw/

And I see someone has already built a test package with that patch:
https://github.com/gdm85/tenku/releases/tag/v0.2.0

It may be good to verify that as well in the upstream bug.

[Rodrigo Vaz (rodrigo-vaz)]

Chris, I've tested this patch too and it prevent the crash on our test case as well. The new patch applied clean on ubuntu kernel.

[Chris J Arges (arges)]

I've backported the patch to trusty and utopic. It would be swell if people can test and then I can start the SRU process.
Thanks,

http://people.canonical.com/~arges/lp1314274.trusty/
http://people.canonical.com/~arges/lp1314274.utopic/

[Chris J Arges (arges)]

Looks like there is confirmation on the upstream bug and patch is upstream:
945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f

[Chris J Arges (arges)]

Request for stable inclusion sent:
http://www.spinics.net/lists/netdev/msg287462.html

[Rodrigo Vaz (rodrigo-vaz)]

I can confirm the test kernels are good. Couldn't reproduce the bug on our environment.

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Rodrigo Vaz (rodrigo-vaz)]

I verified the kernel on -proposed (3.13.0-32-generic) and could not reproduce the bug using our test case. No crashes.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-32.57

---------------
linux (3.13.0-32.57) trusty; urgency=low

  [ Upstream Kernel Changes ]

  * l2tp: Privilege escalation in ppp over l2tp sockets
    - LP: #1341472
    - CVE-2014-4943

linux (3.13.0-32.56) trusty; urgency=low

  [ Luis Henriques ]

  * Merged back Ubuntu-3.13.0-30.55 security release
  * Revert "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)"
    - LP: #1337339
  * Release Tracking Bug
    - LP: #1338524

  [ Upstream Kernel Changes ]

  * ptrace,x86: force IRET path after a ptrace_stop()
    - LP: #1337339
    - CVE-2014-4699
  * hpsa: add new Smart Array PCI IDs (May 2014)
    - LP: #1337516

linux (3.13.0-31.55) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1336278

  [ Andy Whitcroft ]

  * [Config] switch hyper-keyboard to virtual
    - LP: #1325306
  * [Packaging] linux-udeb-flavour -- standardise on linux prefix

  [ dann frazier ]

  * [Config] CONFIG_GPIO_DWAPB=m
    - LP: #1334823

  [ Feng Kan ]

  * SAUCE: (no-up) arm64: dts: Add Designware GPIO dts binding to APM
    X-Gene platform
    - LP: #1334823

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: fix apparmor spams log with warning message
    - LP: #1308761

  [ Kamal Mostafa ]

  * [Config] updateconfigs ACPI_PROCFS_POWER=y after v3.13.11.4 rebase

  [ Loc Ho ]

  * SAUCE: (no-up) phy-xgene: Use correct tuning for Mustang
    - LP: #1335636

  [ Michael Ellerman ]

  * SAUCE: (no-up) powerpc/perf: Ensure all EBB register state is cleared
    on fork()
    - LP: #1328914

  [ Ming Lei ]

  * Revert "SAUCE: (no-up) rtc: Add X-Gene SoC Real Time Clock Driver"
    - LP: #1274305

  [ Suman Tripathi ]

  * SAUCE: (no-up) libahci: Implement the function ahci_restart_engine to
    restart the port dma engine.
    - LP: #1335645
  * SAUCE: (no-up) ata: Fix the dma state machine lockup for the IDENTIFY
    DEVICE PIO mode command.
    - LP: #1335645

  [ Tim Gardner ]

  * [Config] CONFIG_POWERNV_CPUFREQ=y for powerpc, ppc64el
    - LP: #1324571
  * [Debian] Add UTS_UBUNTU_RELEASE_ABI to utsrelease.h
    - LP: #1327619
  * [Config] CONFIG_HAVE_MEMORYLESS_NODES=y
    - LP: #1332063
  * [Config] CONFIG_HID_RMI=m
    - LP: #1305522

  [ Upstream Kernel Changes ]

  * Revert "offb: Add palette hack for little endian"
    - LP: #1333430
  * Revert "net: mvneta: fix usage as a module on RGMII configurations"
    - LP: #1333837
  * Revert "USB: serial: add usbid for dell wwan card to sierra.c"
    - LP: #1333837
  * Revert "macvlan : fix checksums error when we are in bridge mode"
    - LP: #1333838
  * serial: uart: add hw flow control support configuration
    - LP: #1328295
  * mm/numa: Remove BUG_ON() in __handle_mm_fault()
    - LP: #1323165
  * Tools: hv: Handle the case when the target file exists correctly
    - LP: #1306215
  * Documentation/devicetree/bindings: add documentation for the APM X-Gene
    SoC RTC DTS binding
    - LP: #1274305
  * drivers/rtc: add APM X-Gene SoC RTC driver
    - LP: #1274305
  * arm64: add APM X-Gene SoC RTC DTS entry
    - LP: #1274305
  * powerpc/perf: Add Power8 cache & TLB events
    - LP: #1328914
  * powerpc/perf: Configure BH...