Bug #1463911 “IPV6 fragmentation and mtu issue” : Bugs : linux package : Ubuntu

SecurityFun23 (securityfun23) on 2015-07-29

Changed in nova:
status:	New → Confirmed
Changed in neutron:
status:	New → Confirmed

Revision history for this message

SecurityFun23 (securityfun23) wrote on 2015-07-29:

#1

This issues is documented in more details in the following old question: https://ask.openstack.org/en/question/43063/ipv6-fragmentationmtu-issue-on-icehouseubuntu-1404/

We have also seen this issue in our lab using Ubuntu 14.04 and RHEL 6. As far as we can tell, the proposed kernel patch has not been implemented in any of the current linux kernel load lines (its possible that a different patch than the one referenced in the bug report could have been applied, but if that's the case the fix has not made it into the latest Ubuntu 14.04 or RHEL6 kernels).

The underlying issue is that IPv6 fragmented packets are being re-assembled as part of the ip6tables inspection performed by the "neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver" driver. This inspection occurs on the linux bridge layer, and it appears that once the packets have been assembled they are too big to be sent out of the bridge to the next interface. A better behavior would be to re-fragment the IPv6 packet, or to store and then send the original fragments.

This issue does not impact TCP in IPv6, since IPv6 does not fragment packets in the network just at the endpoints, and TCP will never create IP fragments. However, UDP and ICMP are both impacted by this issue. This means that IPv6 is essentially broken when the standard "neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver" driver is used. If the NOOP driver is used or if "net.bridge.bridge-nf-call-ip6tables = 0" option is set in /etc/sysctl.conf to disable ip6tables on bridges, then IPv6 will operate properly. However, in that case Neutron Security Groups and default neutron security rules will have no impact on IPv6 packets.

Possible solutions are to get a fix for this put into the Linux Kernel, or to modify the "OVSHybridIptablesFirewallDriver" so that it does not trigger re-assembly (if this is even possible).

Revision history for this message

Gyula Halmos (gyula-halmos) wrote on 2015-07-29:

#2

Hi there,

We are rebuilding our computes' kernels with the patch to test the solution. But other than that we are waiting for some solution is it is a real showstopper for some of our customers, as their security policies doesnt allow to bypass ip6tables.

BR,

Gyula

Revision history for this message

Kevin Benton (kevinbenton) wrote on 2015-08-03:

#3

Thanks for the report. I've been looking at the netfilter docs and it doesn't look like we can stop the re-assembly and still have the first packet processed by conntrack. Do you know if this is possible?

If so, I can submit a patch to install a rule that would allow the subsequent fragments to go by as a temporary workaround. The downside would be that arbitrary fragments could get through.

Revision history for this message

Sean M. Collins (scollins) wrote on 2015-08-10:

#4

I'd like to see the fix get merged into the linux kernel, inside netfilter. I don't think this is a Nova/Neutron specific thing that we can fix independently, since even the proposed fix has side-effects that can be undesirable.

Revision history for this message

SecurityFun23 (securityfun23) wrote on 2015-08-10:

#5

I agree that the best solution would be to have this merged into the linux kernel. Also, I am unaware of a method to prevent reassembly while still using conntrack. Probably the only way to prevent the re-assembly would be to disable conntrack, but then that would break stateful firewalling, and that wouldn't be consistent with OpenStack security groups. So not only is the kernel update the "best" solution, I think its probably the only complete / consistent one.

As far as kernel patches go, I did want to point out that the current behavior for the IPv4 iptables re-assembly / re-fragmentation is to create entirely new fragments. For linux bridges, in both IPv4 and IPv6, I think that the more desirable behavior is to transmit the original fragments instead of re-fragmenting. The reason this behavior would be preferred is that re-fragmentation now introduces the MTU of the bridge into the picture. If the MTU of the bridge is larger or smaller than the MTU of the VM or gateway this can cause problems. Note that with OpenStack Juno the MTU of the bridges used by the OVSHybridIptablesFirewallDriver is a global value, so if you are using differ MTU for provider and internal networks, you can NOT use OVSHybridIptablesFirewallDriver for IPv4 either. In OpenStack Kilo, per network MTU is a supported feature, so I assume this is not a problem for Kilo (we are using Juno, so I cannot confirm this).

However, I should mention that an advantage of re-fragmentation is that you are guaranteed that the packet that is passed by iptables really matches what iptables thinks it does. I know there are some security attacks that take advantage of fact that ip fragment overlaps are handled differently by different operating systems. So iptables might interpret the packet as having one meaning and the end system might interpret it as something else. Doing re-fragmentation solves this issue. However, I would suggest ip fragment overlaps are really bad behavior, and the packet should probably just be dropped rather than trying to fix this by re-fragmenting.

This MTU issue is sort of secondardy to the IPv6 fragmentation patch BUT if someone is looking here to figure out the patch they should submit, I would like them to have this extra info in case they want to improve the patch.

I agree that the best solution would be to have this merged into the linux kernel.   Also, I am unaware of a method to prevent reassembly while still using conntrack.  Probably the only way to prevent the re-assembly would be to disable conntrack, but then that would break stateful firewalling, and that wouldn't be consistent with OpenStack security groups.  So not only is the kernel update the "best" solution, I think its probably the only complete / consistent one.

As far as kernel patches go, I did want to point out that the current behavior for the IPv4 iptables re-assembly / re-fragmentation is to create entirely new fragments.  For linux bridges, in both IPv4 and IPv6, I think that the more desirable behavior is to transmit the original fragments instead of re-fragmenting.  The reason this behavior would be preferred is that re-fragmentation now introduces the MTU of the bridge into the picture.  If the MTU of the bridge is larger or smaller than the MTU of the VM or gateway this can cause problems.  Note that with OpenStack Juno the MTU of the bridges used by the OVSHybridIptablesFirewallDriver is a global value, so if you are using differ MTU for provider and internal networks, you can NOT use OVSHybridIptablesFirewallDriver for IPv4 either.  In OpenStack Kilo, per network MTU is a supported feature, so I assume this is not a problem for Kilo (we are using Juno, so I cannot confirm this).

However, I should mention that an advantage of re-fragmentation is that you are guaranteed  that the packet that is passed by iptables really matches what iptables thinks it does.  I know there are some security attacks that take advantage of fact that ip fragment overlaps are handled differently by different operating systems.  So iptables might interpret the packet as having one meaning and the end system might interpret it as something else.  Doing re-fragmentation solves this issue.  However, I would suggest ip fragment overlaps are really bad behavior, and the packet should probably just be dropped rather than trying to fix this by re-fragmenting.

This MTU issue is sort of secondardy to the IPv6 fragmentation patch BUT if someone is looking here to figure out the patch they should submit, I would like them to have this extra info in case they want to improve the patch.

Revision history for this message

Sean M. Collins (scollins) wrote on 2015-08-11:

#6

A fix to Netfilter was merged into Linux Kernel version 4.2:

https://github.com/torvalds/linux/commit/efb6de9b4ba0092b2c55f6a52d16294a8a698edd

So, in my mind this isn't really an OpenStack bug. It's a Linux bug that just so happens to be hurting OpenStack deployers that want to do IPv6 related things. I think this bug can be closed, since the real fix is "Wait until distros start deploying the fix" - which yes is a long time away - unless someone backports. Regardless, more of a kernel issue than Nova or OpenStack.

Revision history for this message

Kevin Benton (kevinbenton) wrote on 2015-08-13:

#7

Setting the MTU on the tap, bridge and veth pair to something high seems to fix it in my rudimentary testing.

for int in $(ifconfig | grep 1234abcd | grep -v qbr | awk '{ print $1 }'); do sudo ifconfig $int mtu 9000; done

Where "1234abcd" is the first part of the VM port's UUID.

Revision history for this message

SecurityFun23 (securityfun23) wrote on 2015-08-13:

#8

Note that increasing the MTU is only possible if your network allows large ethernet frames, which is often not the case. Also, it is only a partial fix since you can't normally increase the MTU much above 9000 (as the Jumbo frame limit is usually near there).

Joseph Salisbury (jsalisbury) on 2015-09-01

tags:

added: kernel-key

Revision history for this message

Brad Figg (brad-figg) wrote on 2015-09-01: Missing required logs.

#9

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1463911

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Joseph Salisbury (jsalisbury) on 2015-09-01

Changed in linux (Ubuntu):
importance:	Undecided → Medium
status:	Incomplete → Confirmed
tags:	added: bot-stop-nagging

Dave Chiluk (chiluk) on 2015-09-04

tags:

added: sts

Revision history for this message

Dave Chiluk (chiluk) wrote on 2015-09-08:

#10

I have confirmed that this exists with the latest trusty kernels. I have also attempted a cherry-pick+requisite patches, and that quickly ballooned into ridiculousness. I'm going to need to do a back-port/re-implementation of this.

Changed in linux (Ubuntu):
assignee:	nobody → Dave Chiluk (chiluk)

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-09-17:

#11

I have done a backport of

commit efb6de9b4ba0092b2c55f6a52d16294a8a698edd
Author: Bernhard Thaler <email address hidden>
Date: Sat May 30 15:30:16 2015 +0200

netfilter: bridge: forward IPv6 fragmented packets

to the trusty 3.13 kernel. This necessitated pulling in some bits from other patches as well. I am currently testing for regressions and will submit it for SRU if all goes well.

Dave Chiluk (chiluk) on 2015-09-17

Changed in linux (Ubuntu):
assignee:	Dave Chiluk (chiluk) → Jay Vosburgh (jvosburgh)

Revision history for this message

SecurityFun23 (securityfun23) wrote on 2015-10-08:

#12

Jay Vosburgh,

Have you finished your testing of the patch for Ubuntu Trusty? I would be interesting in getting a hold of a "beta" version of that patch even if i wasn't an official part of Ubuntu.

Thanks!

Revision history for this message

Gyula Halmos (gyula-halmos) wrote on 2015-10-08:

#13

Would be interested as well.

Thanks!

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-10-10:

#14

The original patch had an error in it; I believe I've found it and once I verify that and clean it up a bit I"ll attach it to the bug.

Revision history for this message

SecurityFun23 (securityfun23) wrote on 2015-10-26:

#15

Jay Vosburgh,

Just wondering if you found some time to clean up that patch.

Thanks!

Joseph Salisbury (jsalisbury) on 2015-11-10

tags:

added: kernel-da-key
removed: kernel-key

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#16

SRU Justification:

Impact:

This bug causes issues when ip6tables modules are loaded with IPv6
fragmented packets traversing a bridge. The extant conntrack processing
will reassemble the IPv6 fragments for netfilter processing, but is
incapable of re-fragmenting these datagrams for subsequent forwarding.
This causes the fragmented IPv6 datagrams to be dropped.

Fix:

This is resolved by backporting functionality from mainline that
re-fragments the IPv6 datagrams upon bridge egress.

Testcase:

The patch commit log includes a test case; to summarize:

A bridge is configured with two ports and interfaces are attached
to these ports. A traffic source beyond one port generates fragmented
IPv6 datagrams, e.g., ping6 -s 2000, destined for a host beyond the
bridge.

With ip6tables modules unloaded, the IPv6 fragments will traverse
the bridge. Loading ip6tables, e.g., "ip6tables -t nat -L", will cause
IPv6 fragmented datagrams to be dropped on the unpatched kernel.

These datagrams are correctly forwarded with the patch applied.

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#17

Backport patch for trusty 3.13 Edit (11.0 KiB, text/plain)

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#18

Backport patch for trusty 3.16 Edit (10.9 KiB, text/plain)

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#19

Backport patch for vivid 3.19 Edit (11.0 KiB, text/plain)

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#20

Test methodology performed on 3.19 kernel with patch applied:

Host A: fd01:2222::1/64 direct connect to host C

ip addr add fd01:2222::1/64 dev eth0

Host B: fd01:2222::2/64 direct connect to host C

ip addr add fd01:2222::2/64 dev eth0

host C: direct connect interfaces for Hosts A & B bridged together:

brctl addbr testbr0
brctl addif testbr0 eth1
brctl addif testbr0 eth5
ip link set dev eth1 up
ip link set dev eth5 up
ip link set dev testbr0 up
ip addr add fd01:2222::99/64 dev testbr0

host A:

continuous ping6 to host C's address beyond the bridge, using size large
enough to generate fragmented IPv6 datagrams for mtu setting of 1500:

ping6 -s 4000 fd01:2222::2

host C:

load ip6tables_nat:

ip6tables -t nat -Ln

Observe on host A that ping continues uninterrupted

Inspect eth1 and eth5 interfaces on host C with tcpdump to confirm traffic passes
through the bridge

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2015-11-18:

#21

The equivalent testing to comment #20 was also performed on the 3.13 and 3.16 kernels, additionally, a customer separately validated the 3.13 and 3.16 patches in their environment.

Brad Figg (brad-figg) on 2016-02-19

Changed in linux (Ubuntu Trusty):
status:	New → Fix Committed

Brad Figg (brad-figg) on 2016-02-19

Changed in linux (Ubuntu Vivid):
status:	New → Fix Committed

Revision history for this message

BALAJI SRINIVASAN (balaji-vasan) wrote on 2016-02-22:

#22

I understand a patch is going to come for Ubuntu.

We are using Centos latest release.

[root@sienna net]# uname -r
3.10.0-327.10.1.el7.x86_64
[root@sienna net]# cat /etc/centos-release
CentOS Linux release 7.2.1511 (Core)

Any information on patch for Centos distro?

Is there any patch in neutron too?

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2016-02-23:

#23

Yes, the patch has been committed for the next Ubuntu kernel releases.

I have no information on a Centos patch; you would need to file a bug against Centos or RHEL.

No patch to Neutron is required.

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-25:

#24

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-trusty
tags:	added: verification-needed-vivid

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-25:

#25

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message

Travis Parchman (travis-parchman) wrote on 2016-03-02:

#26

So, is this problem already resolved in Wily or is Xenial the first formal release that will not exhibit the problem?

Revision history for this message

Jay Vosburgh (jvosburgh) wrote on 2016-03-02:

#27

The Wily kernel (4.2) already contains the fixes for this bug.

Revision history for this message

Travis Parchman (travis-parchman) wrote on 2016-03-03:

#28

Awesome. Thank you most kindly for the info.

Jay Vosburgh (jvosburgh) on 2016-03-03

tags:

added: verification-done-trusty verification-done-vivid
removed: verification-needed-trusty verification-needed-vivid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-03-14:

#29

Download full text (21.3 KiB)

This bug was fixed in the package linux - 3.19.0-56.62

---------------
linux (3.19.0-56.62) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555832

[ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.19.0-55.61) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1554708

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
- LP: #1554608

linux (3.19.0-54.60) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1552337

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
- LP: #1551419

linux (3.19.0-53.59) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1550576

[ Kamal Mostafa ]

* Merged back 3.19.0-52.58

linux (3.19.0-52.58) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1548548

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
- LP: #1505564

[ Upstream Kernel Changes ]

  * Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1542457
  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * net: ipmr: fix static mfc/dev leaks on table destruction
    - LP: #1542457
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1542457
  * ovl: allow zero size xattr
    - LP: #1542457
  * ovl: use a minimal buffer in ovl_copy_xattr
    - LP: #1542457
  * [media] vb2: fix a regression in poll() behavior for output,streams
    - LP: #1542457
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542457
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542457
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542457
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1542457
  * KVM: x86: correctly print #AC in traces
    - LP: #1542457
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542457
  * xhci: refuse loading if nousb is used
    - LP: #1542457
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542457
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542457
  * ovl: root: copy attr
    - LP: #1542457
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1542457
  * rtlwifi: fix memory leak for USB device
    - LP: #1542457
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542457
  * ovl: check dentry positiveness in ovl_cleanup_whiteouts()
    - LP: #1542457
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542457
  * EDAC: Robustify workqueues destruction
    - LP: #1542457
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1542457
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542457
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542457
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542457
  * dm thi...

This bug was fixed in the package linux - 3.19.0-56.62

---------------
linux (3.19.0-56.62) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555832

[ Florian Westphal ]

* SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.19.0-55.61) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1554708

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608

linux (3.19.0-54.60) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1552337

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419

linux (3.19.0-53.59) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1550576

[ Kamal Mostafa ]

* Merged back 3.19.0-52.58

linux (3.19.0-52.58) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1548548

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

[ Upstream Kernel Changes ]

* Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1542457
  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * net: ipmr: fix static mfc/dev leaks on table destruction
    - LP: #1542457
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1542457
  * ovl: allow zero size xattr
    - LP: #1542457
  * ovl: use a minimal buffer in ovl_copy_xattr
    - LP: #1542457
  * [media] vb2: fix a regression in poll() behavior for output,streams
    - LP: #1542457
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542457
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542457
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542457
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1542457
  * KVM: x86: correctly print #AC in traces
    - LP: #1542457
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542457
  * xhci: refuse loading if nousb is used
    - LP: #1542457
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542457
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542457
  * ovl: root: copy attr
    - LP: #1542457
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1542457
  * rtlwifi: fix memory leak for USB device
    - LP: #1542457
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542457
  * ovl: check dentry positiveness in ovl_cleanup_whiteouts()
    - LP: #1542457
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542457
  * EDAC: Robustify workqueues destruction
    - LP: #1542457
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1542457
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542457
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542457
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542457
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542457
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542457
  * arm64: mdscr_el1: avoid exposing DCC to userspace
    - LP: #1542457
  * arm64: kernel: enforce pmuserenr_el0 initialization and restore
    - LP: #1542457
  * drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr
    - LP: #1542457
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542457
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542457
  * mmc: sdhci: Fix DMA descriptor with zero data length
    - LP: #1542457
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542457
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542457
  * [media] rc: sunxi-cir: Initialize the spinlock properly
    - LP: #1542457
  * nfs: Fix race in __update_open_stateid()
    - LP: #1542457
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1542457
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1542457
  * NFS: Ensure we revalidate attributes before using execute_ok()
    - LP: #1542457
  * Thermal: initialize thermal zone device correctly
    - LP: #1542457
  * Thermal: handle thermal zone device properly during system sleep
    - LP: #1542457
  * Thermal: do thermal zone update after a cooling device registered
    - LP: #1542457
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1542457
  * rtlwifi: rtl8723be: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8723ae: Fix initialization of module parameters
    - LP: #1542457
  * rtlwifi: rtl8821ae: Fix errors in parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8188ee: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1542457
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1542457
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1542457
  * NFS: Fix attribute cache revalidation
    - LP: #1542457
  * rtlwifi: rtl_pci: Fix kernel panic
    - LP: #1542457
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1542457
  * bcache: Add a cond_resched() call to gc
    - LP: #1542457
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1542457
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1542457
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1542457
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1542457
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1542457
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1542457
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1542457
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1542457
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1542457
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1542457
  * udf: Check output buffer length when converting name to CS0
    - LP: #1542457
  * drm/dp/mst: process broadcast messages correctly
    - LP: #1542457
  * drm/dp/mst: always send reply for UP request
    - LP: #1542457
  * drm/dp/mst: fix in MSTB RAD initialization
    - LP: #1542457
  * drm/dp/mst: fix in RAD element access
    - LP: #1542457
  * PCI: Fix minimum allocation address overwrite
    - LP: #1542457
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1542457
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1542457
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1542457
  * ASoC: compress: Fix compress device direction check
    - LP: #1542457
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1542457
  * uml: fix hostfs mknod()
    - LP: #1542457
  * uml: flush stdout before forking
    - LP: #1542457
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1542457
  * ALSA: usb: Add native DSD support for Oppo HA-1
    - LP: #1542457
  * ALSA: hda - Fixup inverted internal mic for Lenovo E50-80
    - LP: #1529624, #1542457
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1542457
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1542457
  * s390: fix normalization bug in exception table sorting
    - LP: #1542457
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1542457
  * xfs: handle dquot buffer readahead in log recovery correctly
    - LP: #1542457
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1542457
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1542457
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1542457
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1542457
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1542457
  * virtio_balloon: fix race by fill and leak
    - LP: #1542457
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1542457
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1542457
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1542457
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1542457
  * ALSA: hda - fix the headset mic detection problem for a Dell laptop
    - LP: #1533461, #1542457
  * ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices
    - LP: #1542457
  * drm/i915: intel_hpd_init(): Fix suspend/resume reprobing
    - LP: #1542457
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1542457
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1542457
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1542457
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1542457
  * mmc: mmci: fix an ages old detection error
    - LP: #1542457
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1542457
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1542457
  * cifs: Ratelimit kernel log messages
    - LP: #1542457
  * cifs: fix race between call_async() and reconnect()
    - LP: #1542457
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1542457
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1542457
  * dma-debug: switch check from _text to _stext
    - LP: #1542457
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1542457
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1542457
  * ALSA: timer: Harden slave timer list handling
    - LP: #1542457
  * zram/zcomp: use GFP_NOIO to allocate streams
    - LP: #1542457
  * zram: try vmalloc() after kmalloc()
    - LP: #1542457
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1542457
  * memcg: only free spare array when readers are done
    - LP: #1542457
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1542457
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1542457
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1542457
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1542457
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1542457
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1542457
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1542457
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1542457
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1542457
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1542457
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1542457
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1542457
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1542457
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1542457
  * ARM: debug-ll: fix BCM63xx entry for multiplatform
    - LP: #1542457
  * xfs: log mount failures don't wait for buffers to be released
    - LP: #1542457
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1542457
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1542457
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1542457
  * IB/qib: Support creating qps with GFP_NOIO flag
    - LP: #1542457
  * ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list
    - LP: #1542457
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1542457
  * ALSA: hda - Flush the pending probe work at remove
    - LP: #1542457
  * ALSA: timer: Handle disconnection more safely
    - LP: #1542457
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1542457
  * MAINTAINERS: return arch/sh to maintained state, with new maintainers
    - LP: #1542457
  * ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
    - LP: #1542457
  * drm/i915: On fb alloc failure, unref gem object where it gets refed
    - LP: #1542457
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1542457
  * SCSI: initio: remove duplicate module device table
    - LP: #1542457
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1542457
  * clk: st: avoid uninitialized variable use
    - LP: #1542457
  * ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
    - LP: #1542457
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1542457
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1542457
  * mtd: nand: denali: add missing nand_release() call in denali_remove()
    - LP: #1542457
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1542457
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1542457
  * mmc: sdhci: restore behavior when setting VDD via external regulator
    - LP: #1542457
  * x86/LDT: Print the real LDT base address
    - LP: #1542457
  * sysrq: Fix warning in sysrq generated crash.
    - LP: #1542457
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1542457
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1542457
  * power: test_power: correctly handle empty writes
    - LP: #1542457
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1542457
  * target: Fix a memory leak in target_dev_lba_map_store()
    - LP: #1542457
  * m68k/atari, m68k/sun3: Fix SCSI platform device registration when
    driver is modular
    - LP: #1542457
  * um: Fix build error and kconfig for i386
    - LP: #1542457
  * kbuild: Demote 'sign-compare' warning to W=2
    - LP: #1542457
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1542457
  * net: tcp_memcontrol: properly detect ancestor socket pressure
    - LP: #1542457
  * vmstat: make vmstat_updater deferrable again and shut down on idle
    - LP: #1542457
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1542457
  * btrfs: initialize the seq counter in struct btrfs_device
    - LP: #1542457
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1542457
  * ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
    - LP: #1542457
  * mmc: debugfs: correct wrong voltage value
    - LP: #1542457
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1542457
  * net/mlx4: Remove unused macro
    - LP: #1542457
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1542457
  * net: cdc_ncm: avoid changing RX/TX buffers on MTU changes
    - LP: #1542457
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1542457
  * connector: bump skb->users before callback invocation
    - LP: #1542457
  * unix: properly account for FDs passed over unix sockets
    - LP: #1542457
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1542457
  * vxlan: fix test which detect duplicate vxlan iface
    - LP: #1542457
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1542457
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1542457
  * udp: disallow UFO for sockets with SO_NO_CHECK option
    - LP: #1542457
  * net: preserve IP control block during GSO segmentation
    - LP: #1542457
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1542457
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1542457
  * net: bpf: reject invalid shifts
    - LP: #1542457
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1542457
  * bridge: fix lockdep addr_list_lock false positive splat
    - LP: #1542457
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1542457
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1542457
  * batman-adv: Drop immediate batadv_orig_ifinfo free function
    - LP: #1542457
  * batman-adv: Drop immediate batadv_neigh_node free function
    - LP: #1542457
  * batman-adv: Drop immediate neigh_ifinfo free function
    - LP: #1542457
  * batman-adv: Drop immediate batadv_hard_iface free function
    - LP: #1542457
  * batman-adv: Drop immediate orig_node free function
    - LP: #1542457
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1542457
  * sctp: Prevent soft lockup when sctp_accept() is called during a timeout
    event
    - LP: #1542457
  * xen-netback: respect user provided max_queues
    - LP: #1542457
  * xen-netfront: respect user provided max_queues
    - LP: #1542457
  * xen-netfront: update num_queues to real created
    - LP: #1542457
  * Linux 3.19.8-ckt14
    - LP: #1542457
  * x86/xen/p2m: hint at the last populated P2M entry
    - LP: #1542941
  * qeth: initialize net_device with carrier off
    - LP: #1541907
  * HID: i2c-hid: Prevent sending reports from racing with device reset
    - LP: #1535513
  * iio: adis_buffer: Fix out-of-bounds memory access
    - LP: #1546183
  * KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
    - LP: #1546183
  * KVM: PPC: Fix ONE_REG AltiVec support
    - LP: #1546183
  * x86/irq: Call chip->irq_set_affinity in proper context
    - LP: #1546183
  * ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist"
    - LP: #1546183
  * ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot()
    - LP: #1546183
  * usb: cdc-acm: handle unlinked urb in acm read callback
    - LP: #1546183
  * usb: cdc-acm: send zero packet for intel 7260 modem
    - LP: #1546183
  * cdc-acm:exclude Samsung phone 04e8:685d
    - LP: #1546183
  * usb: hub: do not clear BOS field during reset device
    - LP: #1546183
  * USB: cp210x: add ID for IAI USB to RS485 adaptor
    - LP: #1546183
  * USB: visor: fix null-deref at probe
    - LP: #1546183
  * USB: serial: visor: fix crash on detecting device without write_urbs
    - LP: #1546183
  * USB: serial: option: Adding support for Telit LE922
    - LP: #1546183
  * ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
    - LP: #1546183
  * ALSA: seq: Degrade the error message for too many opens
    - LP: #1546183
  * USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
    - LP: #1546183
  * arm64: kernel: fix architected PMU registers unconditional access
    - LP: #1546183
  * USB: option: fix Cinterion AHxx enumeration
    - LP: #1546183
  * ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
    - LP: #1546183
  * ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
    - LP: #1546183
  * ALSA: bebob: Use a signed return type for get_formation_index
    - LP: #1546183
  * arm64: errata: Add -mpc-relative-literal-loads to build flags
    - LP: #1533009, #1546183
  * arm64: mm: avoid calling apply_to_page_range on empty range
    - LP: #1546183
  * x86/mm: Fix types used in pgprot cacheability flags translations
    - LP: #1546183
  * powerpc/eeh: Fix PE location code
    - LP: #1546183
  * SCSI: fix crashes in sd and sr runtime PM
    - LP: #1546183
  * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
    - LP: #1546183
  * n_tty: Fix unsafe reference to "other" ldisc
    - LP: #1546183
  * staging/speakup: Use tty_ldisc_ref() for paste kworker
    - LP: #1546183
  * irqchip/atmel-aic: Fix wrong bit operation for IRQ priority
    - LP: #1546183
  * seccomp: always propagate NO_NEW_PRIVS on tsync
    - LP: #1546183
  * ALSA: dummy: Disable switching timer backend via sysfs
    - LP: #1546183
  * drm/vmwgfx: respect 'nomodeset'
    - LP: #1546183
  * Staging: speakup: Fix getting port information
    - LP: #1546183
  * x86/mm/pat: Avoid truncation when converting cpa->numpages to address
    - LP: #1546183
  * serial: 8250_pci: Add Intel Broadwell ports
    - LP: #1546183
  * perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    - LP: #1546183
  * perf hists: Fix HISTC_MEM_DCACHELINE width setting
    - LP: #1546183
  * powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
    - LP: #1546183
  * [media] usbvision fix overflow of interfaces array
    - LP: #1546183
  * [media] usbvision: fix leak of usb_dev on failure paths in
    usbvision_probe()
    - LP: #1546183
  * [media] usbvision: fix crash on detecting device with invalid
    configuration
    - LP: #1546183
  * ASN.1: Fix non-match detection failure on data overrun
    - LP: #1546183
  * Linux 3.19.8-ckt15
    - LP: #1546183
  * netfilter: bridge: don't use nf_bridge_info data to store mac header
    - LP: #1463911
  * netfilter: bridge: restore vlan tag when refragmenting
    - LP: #1463911
  * netfilter: bridge: forward IPv6 fragmented packets
    - LP: #1463911
  * netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in
    br_validate_ipv6
    - LP: #1463911
  * mwifiex: remove USB8897 chipset support
    - LP: #1494593
  * ALSA: usb-audio: avoid freeing umidi object twice
    - LP: #1546177
    - CVE-2016-2384
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1546320

-- Brad Figg <brad.figg@canonical.com>  Thu, 10 Mar 2016 14:11:41 -0800

Changed in linux (Ubuntu Vivid):
status:	Fix Committed → Fix Released
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-03-14:

#31

Download full text (14.5 KiB)

This bug was fixed in the package linux - 3.13.0-83.127

---------------
linux (3.13.0-83.127) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555839

[ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.13.0-82.126) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1554732

[ Upstream Kernel Changes ]

  * Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608
  * net: generic dev_disable_lro() stacked device handling
    - LP: #1547680

linux (3.13.0-81.125) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1552316

[ Upstream Kernel Changes ]

  * Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419
  * bcache: Fix a lockdep splat in an error path
    - LP: #1551327

linux (3.13.0-80.124) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1548519

[ Andy Whitcroft ]

  * [Debian] hv: hv_set_ifconfig -- convert to python3
    - LP: #1506521
  * [Debian] hv: hv_set_ifconfig -- switch to approved indentation
    - LP: #1540586
  * [Debian] hv: hv_set_ifconfig -- fix numerous parameter handling issues
    - LP: #1540586

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
- LP: #1505564

[ Upstream Kernel Changes ]

  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542497
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542497
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542497
  * KVM: x86: correctly print #AC in traces
    - LP: #1542497
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542497
  * xhci: refuse loading if nousb is used
    - LP: #1542497
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542497
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542497
  * rtlwifi: fix memory leak for USB device
    - LP: #1542497
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542497
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542497
  * EDAC: Don't try to cancel workqueue when it's never setup
    - LP: #1542497
  * EDAC: Robustify workqueues destruction
    - LP: #1542497
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542497
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542497
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542497
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542497
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542497
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542497
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542497
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542497
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542497
  * nfs: Fix race in __update_open_stateid...

This bug was fixed in the package linux - 3.13.0-83.127

---------------
linux (3.13.0-83.127) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555839

[ Florian Westphal ]

* SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.13.0-82.126) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1554732

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608
  * net: generic dev_disable_lro() stacked device handling
    - LP: #1547680

linux (3.13.0-81.125) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1552316

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419
  * bcache: Fix a lockdep splat in an error path
    - LP: #1551327

linux (3.13.0-80.124) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1548519

[ Andy Whitcroft ]

* [Debian] hv: hv_set_ifconfig -- convert to python3
    - LP: #1506521
  * [Debian] hv: hv_set_ifconfig -- switch to approved indentation
    - LP: #1540586
  * [Debian] hv: hv_set_ifconfig -- fix numerous parameter handling issues
    - LP: #1540586

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

[ Upstream Kernel Changes ]

* Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542497
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542497
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542497
  * KVM: x86: correctly print #AC in traces
    - LP: #1542497
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542497
  * xhci: refuse loading if nousb is used
    - LP: #1542497
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542497
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542497
  * rtlwifi: fix memory leak for USB device
    - LP: #1542497
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542497
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542497
  * EDAC: Don't try to cancel workqueue when it's never setup
    - LP: #1542497
  * EDAC: Robustify workqueues destruction
    - LP: #1542497
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542497
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542497
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542497
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542497
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542497
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542497
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542497
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542497
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542497
  * nfs: Fix race in __update_open_stateid()
    - LP: #1542497
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1542497
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1542497
  * NFS: Fix attribute cache revalidation
    - LP: #1542497
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1542497
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1542497
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1542497
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1542497
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1542497
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1542497
  * bcache: Add a cond_resched() call to gc
    - LP: #1542497
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1542497
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1542497
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1542497
  * bcache: add mutex lock for bch_is_open
    - LP: #1542497
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1542497
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1542497
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1542497
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1542497
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1542497
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1542497
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1542497
  * udf: Check output buffer length when converting name to CS0
    - LP: #1542497
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1542497
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1542497
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1542497
  * ASoC: compress: Fix compress device direction check
    - LP: #1542497
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1542497
  * uml: fix hostfs mknod()
    - LP: #1542497
  * uml: flush stdout before forking
    - LP: #1542497
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1542497
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1542497
  * s390: fix normalization bug in exception table sorting
    - LP: #1542497
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1542497
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1542497
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1542497
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1542497
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1542497
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1542497
  * virtio_balloon: fix race by fill and leak
    - LP: #1542497
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1542497
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1542497
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1542497
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1542497
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1542497
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1542497
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1542497
  * mmc: mmci: fix an ages old detection error
    - LP: #1542497
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1542497
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1542497
  * cifs: Ratelimit kernel log messages
    - LP: #1542497
  * cifs: fix race between call_async() and reconnect()
    - LP: #1542497
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1542497
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1542497
  * dma-debug: switch check from _text to _stext
    - LP: #1542497
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1542497
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1542497
  * ALSA: timer: Harden slave timer list handling
    - LP: #1542497
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1542497
  * memcg: only free spare array when readers are done
    - LP: #1542497
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1542497
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1542497
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1542497
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1542497
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1542497
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1542497
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1542497
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1542497
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1542497
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1542497
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1542497
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1542497
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1542497
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1542497
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1542497
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1542497
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1542497
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1542497
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1542497
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1542497
  * SCSI: initio: remove duplicate module device table
    - LP: #1542497
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1542497
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1542497
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1542497
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1542497
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1542497
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1542497
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1542497
  * power: test_power: correctly handle empty writes
    - LP: #1542497
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1542497
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1542497
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1542497
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1542497
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1542497
  * batman-adv: Drop immediate orig_node free function
    - LP: #1542497
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1542497
  * mmc: debugfs: correct wrong voltage value
    - LP: #1542497
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1542497
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1542497
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1542497
  * connector: bump skb->users before callback invocation
    - LP: #1542497
  * unix: properly account for FDs passed over unix sockets
    - LP: #1542497
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1542497
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1542497
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1542497
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1542497
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1542497
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1542497
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1542497
  * Linux 3.13.11-ckt34
    - LP: #1542497
  * qeth: initialize net_device with carrier off
    - LP: #1541907
  * umount: Do not allow unmounting rootfs.
    - LP: #1541313
  * [media] usbvision fix overflow of interfaces array
    - LP: #1546273
  * [media] usbvision: fix leak of usb_dev on failure paths in
    usbvision_probe()
    - LP: #1546273
  * [media] usbvision: fix crash on detecting device with invalid
    configuration
    - LP: #1546273
  * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
    - LP: #1546273
  * USB: serial: visor: fix crash on detecting device without write_urbs
    - LP: #1546273
  * ASN.1: Fix non-match detection failure on data overrun
    - LP: #1546273
  * iio: adis_buffer: Fix out-of-bounds memory access
    - LP: #1546273
  * x86/irq: Call chip->irq_set_affinity in proper context
    - LP: #1546273
  * usb: cdc-acm: handle unlinked urb in acm read callback
    - LP: #1546273
  * usb: cdc-acm: send zero packet for intel 7260 modem
    - LP: #1546273
  * cdc-acm:exclude Samsung phone 04e8:685d
    - LP: #1546273
  * usb: hub: do not clear BOS field during reset device
    - LP: #1546273
  * USB: cp210x: add ID for IAI USB to RS485 adaptor
    - LP: #1546273
  * USB: visor: fix null-deref at probe
    - LP: #1546273
  * USB: serial: option: Adding support for Telit LE922
    - LP: #1546273
  * ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
    - LP: #1546273
  * ALSA: seq: Degrade the error message for too many opens
    - LP: #1546273
  * USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
    - LP: #1546273
  * USB: option: fix Cinterion AHxx enumeration
    - LP: #1546273
  * ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
    - LP: #1546273
  * ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
    - LP: #1546273
  * arm64: errata: Add -mpc-relative-literal-loads to build flags
    - LP: #1533009, #1546273
  * SCSI: fix crashes in sd and sr runtime PM
    - LP: #1546273
  * n_tty: Fix unsafe reference to "other" ldisc
    - LP: #1546273
  * ALSA: dummy: Disable switching timer backend via sysfs
    - LP: #1546273
  * drm/vmwgfx: respect 'nomodeset'
    - LP: #1546273
  * x86/mm/pat: Avoid truncation when converting cpa->numpages to address
    - LP: #1546273
  * perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    - LP: #1546273
  * powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
    - LP: #1546273
  * Linux 3.13.11-ckt35
    - LP: #1546273
  * netfilter: bridge: don't use nf_bridge_info data to store mac header
    - LP: #1463911
  * netfilter: bridge: restore vlan tag when refragmenting
    - LP: #1463911
  * netfilter: bridge: forward IPv6 fragmented packets
    - LP: #1463911
  * netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in
    br_validate_ipv6
    - LP: #1463911
  * ALSA: usb-audio: avoid freeing umidi object twice
    - LP: #1546177
    - CVE-2016-2384
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1546320

-- Brad Figg <brad.figg@canonical.com>  Thu, 10 Mar 2016 14:41:56 -0800

Changed in linux (Ubuntu Trusty):
status:	Fix Committed → Fix Released
status:	Fix Committed → Fix Released

John Garbutt (johngarbutt) on 2016-07-12

no longer affects:

nova

Brandon Logan (brandon-logan) on 2016-07-12

Changed in neutron:
importance:	Undecided → Medium

Kevin Benton (kevinbenton) on 2017-03-15

no longer affects:

neutron

Ubuntu
linux package

IPV6 fragmentation and mtu issue

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Ubuntulinux package

IPV6 fragmentation and mtu issue

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Ubuntu
linux package