apparmor kernel BUG kills firefox

[James Troup]

I got this kernel BUG last night and its happened a couple of times
now since I upgraded to Utopic. When it happens one of my firefoxs
will becomes non-functional and I have to reboot to get it unstuck.

I'm using encrypted home dir (ecryptfs) and the packaged firefox
profile in enforce mode with a small
/etc/apparmor.d/local/usr.bin.firefox.

ProblemType: Bug
DistroRelease: Ubuntu 14.10
Package: linux-image-3.16.0-31-generic 3.16.0-31.41
ProcVersionSignature: Ubuntu 3.16.0-31.41-generic 3.16.7-ckt5
Uname: Linux 3.16.0-31-generic x86_64
ApportVersion: 2.14.7-0ubuntu8.2
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/pcmC0D0p: james 3599 F...m pulseaudio
 /dev/snd/controlC0: james 3599 F.... pulseaudio
CurrentDesktop: Unity
Date: Tue Mar 10 21:38:33 2015
EcryptfsInUse: Yes
InstallationDate: Installed on 2011-10-20 (1237 days ago)
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
MachineType: TOSHIBA TECRA R840
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-31-generic root=UUID=b59c3fb7-c197-4238-8dd3-f71d81bbb315 ro quiet splash vt.handoff=7
RelatedPackageVersions:
 linux-restricted-modules-3.16.0-31-generic N/A
 linux-backports-modules-3.16.0-31-generic N/A
 linux-firmware 1.138.1
RfKill:
 0: phy0: Wireless LAN
  Soft blocked: no
  Hard blocked: no
SourcePackage: linux
UpgradeStatus: Upgraded to utopic on 2015-01-05 (64 days ago)
dmi.bios.date: 07/12/2011
dmi.bios.vendor: TOSHIBA
dmi.bios.version: Version 2.90
dmi.board.asset.tag: 0000000000
dmi.board.name: Portable PC
dmi.board.vendor: TOSHIBA
dmi.board.version: Version A0
dmi.chassis.asset.tag: 0000000000
dmi.chassis.type: 10
dmi.chassis.vendor: TOSHIBA
dmi.chassis.version: Version 1.0
dmi.modalias: dmi:bvnTOSHIBA:bvrVersion2.90:bd07/12/2011:svnTOSHIBA:pnTECRAR840:pvrPT42GE-00N006EN:rvnTOSHIBA:rnPortablePC:rvrVersionA0:cvnTOSHIBA:ct10:cvrVersion1.0:
dmi.product.name: TECRA R840
dmi.product.version: PT42GE-00N006EN
dmi.sys.vendor: TOSHIBA

[Brad Figg (brad-figg)]

This change was made by a bot.

[John Johansen (jjohansen)]

Christopher,

Testing upstream kernels will not help with this issue as Ubuntu carries a newer version of apparmor than is currently upstream. From the back trace it is clear to me that the bug is in the newer code that ubuntu is carrying. I am working on a patch and have a test kernel building.

[John Johansen (jjohansen)]

Can you please install the following test kernel and report whether it fixes the issue

http://people.canonical.com/~jj/lp1430546/

[John Johansen (jjohansen)]

After looking at this some bug some more the above fix, addresses a different issue.

There is something else going on here, either there is a hardware problem, or something at some point is scribbling on kernel memory resulting in an invalid op code.

James,
If you hit any more oops please attach them so we can compare and try and figure out what is going on

[Tyler Hicks (tyhicks)]

I've hit this bug in Vivid while attempting to join a Google Hangout. Just before attempting to join the Hangout, I reloaded the Firefox profile in complain mode while Firefox was already running.

[John Johansen (jjohansen)]

So this is failing because the task->cred does not equal the task->real_cred during the update of the cred on the task

[John Johansen (jjohansen)]

There is a new test kernel for this issue at

http://people.canonical.com/~jj/lp1430546/

[Tyler Hicks (tyhicks)]

The test kernel linked in comment #11 has been solid for me. I've not hit this oops while running it. I accidentally rebooted into the latest Vivid kernel and the kernel oopsed upon joining a Google Hangout.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-9.24

---------------
linux (4.4.0-9.24) xenial; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
    - LP: #1551319

  * AppArmor logs denial for when the device path is ENOENT (LP: #1482943)
    - SAUCE: apparmor: fix log of apparmor audit message when kern_path() fails

  * BUG: unable to handle kernel NULL pointer dereference (aa_label_merge) (LP:
    #1448912)
    - SAUCE: apparmor: Fix: insert race between label_update and label_merge
    - SAUCE: apparmor: Fix: ensure aa_get_newest will trip debugging if the
      replacedby is not setup
    - SAUCE: apparmor: Fix: label merge handling of marking unconfined and stale
    - SAUCE: apparmor: Fix: refcount race between locating in labelset and get
    - SAUCE: apparmor: Fix: ensure new labels resulting from merge have a
      replacedby
    - SAUCE: apparmor: Fix: label_vec_merge insertion
    - SAUCE: apparmor: Fix: deadlock in aa_put_label() call chain
    - SAUCE: apparmor: Fix: add required locking of __aa_update_replacedby on
      merge path
    - SAUCE: apparmor: Fix: convert replacedby update to be protected by the
      labelset lock
    - SAUCE: apparmor: Fix: update replacedby allocation to take a gfp parameter

  * apparmor kernel BUG kills firefox (LP: #1430546)
    - SAUCE: apparmor: Disallow update of cred when then subjective != the
      objective cred
    - SAUCE: apparmor: rework retrieval of the current label in the profile update
      case

  * sleep from invalid context in aa_move_mount (LP: #1539349)
    - SAUCE: apparmor: fix sleep from invalid context

  * s390x: correct restore of high gprs on signal return (LP: #1550468)
    - s390/compat: correct restore of high gprs on signal return

  * missing SMAP support (LP: #1550517)
    - x86/entry/compat: Add missing CLAC to entry_INT80_32

  * Floating-point exception handler receives empty Data-Exception Code in
    Floating Point Control register (LP: #1548414)
    - s390/fpu: signals vs. floating point control register

  * kvm fails to boot GNU Hurd kernels with 4.4 Xenial kernel (LP: #1550596)
    - KVM: x86: fix conversion of addresses to linear in 32-bit protected mode

  * Surelock GA2 SP1: capiredp01: cxl_init_adapter fails for CAPI devices
    0000:01:00.0 and 0005:01:00.0 after upgrading to 840.10 Platform firmware
    build fips840/b1208b_1604.840 (LP: #1532914)
    - cxl: Fix PSL timebase synchronization detection

  * [Feature]EDAC support for Knights Landing (LP: #1519631)
    - EDAC, sb_edac: Set fixed DIMM width on Xeon Knights Landing

  * Various failures of kernel_security suite on Xenial kernel on s390x arch
    (LP: #1531327)
    - [config] s390x -- CONFIG_DEFAULT_MMAP_MIN_ADDR=65536

  * Unable to install VirtualBox Guest Service in 15.04 (LP: #1434579)
    - [Config] Provides: virtualbox-guest-modules when appropriate

  * linux is missing provides for virtualbox-guest-modules [i386 amd64 x32] (LP:
    #1507588)
    - [Config] Provides: virtualbox-guest-modules when appropriate

  * Backport more recent driver for SKL, KBL and BXT graphics (LP: #1540390)
    - SAUCE: i915_bpo: Provide a backport driver for SKL, KBL & BXT graphics
    - SA...