| 2018-10-30 11:49:13 |
bugproxy |
bug |
|
|
added bug |
| 2018-10-30 11:49:15 |
bugproxy |
tags |
|
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 |
|
| 2018-10-30 11:49:16 |
bugproxy |
ubuntu: assignee |
|
Skipper Bug Screeners (skipper-screen-team) |
|
| 2018-10-30 11:49:18 |
bugproxy |
affects |
ubuntu |
linux (Ubuntu) |
|
| 2018-10-30 12:20:50 |
Frank Heimes |
bug task added |
|
ubuntu-z-systems |
|
| 2018-10-30 12:20:55 |
Frank Heimes |
ubuntu-z-systems: status |
New |
Triaged |
|
| 2018-10-30 12:20:58 |
Frank Heimes |
ubuntu-z-systems: importance |
Undecided |
High |
|
| 2018-10-30 12:21:18 |
Frank Heimes |
ubuntu-z-systems: assignee |
|
Canonical Kernel Team (canonical-kernel-team) |
|
| 2018-10-30 13:02:31 |
Joseph Salisbury |
linux (Ubuntu): status |
New |
Triaged |
|
| 2018-10-30 13:02:36 |
Joseph Salisbury |
linux (Ubuntu): importance |
Undecided |
High |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
nominated for series |
|
Ubuntu Cosmic |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
bug task added |
|
linux (Ubuntu Cosmic) |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
nominated for series |
|
Ubuntu Xenial |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
bug task added |
|
linux (Ubuntu Xenial) |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
nominated for series |
|
Ubuntu Bionic |
|
| 2018-10-30 13:04:44 |
Joseph Salisbury |
bug task added |
|
linux (Ubuntu Bionic) |
|
| 2018-10-30 13:04:52 |
Joseph Salisbury |
linux (Ubuntu Xenial): status |
New |
Triaged |
|
| 2018-10-30 13:04:55 |
Joseph Salisbury |
linux (Ubuntu Bionic): status |
New |
Triaged |
|
| 2018-10-30 13:05:00 |
Joseph Salisbury |
linux (Ubuntu Cosmic): status |
New |
Triaged |
|
| 2018-10-30 13:05:06 |
Joseph Salisbury |
linux (Ubuntu Xenial): importance |
Undecided |
High |
|
| 2018-10-30 13:05:12 |
Joseph Salisbury |
linux (Ubuntu Bionic): importance |
Undecided |
High |
|
| 2018-10-30 13:05:15 |
Joseph Salisbury |
linux (Ubuntu Cosmic): importance |
Undecided |
High |
|
| 2018-10-30 14:27:12 |
Joseph Salisbury |
linux (Ubuntu Xenial): assignee |
|
Joseph Salisbury (jsalisbury) |
|
| 2018-10-30 14:27:15 |
Joseph Salisbury |
linux (Ubuntu Bionic): assignee |
|
Joseph Salisbury (jsalisbury) |
|
| 2018-10-30 14:27:17 |
Joseph Salisbury |
linux (Ubuntu Cosmic): assignee |
|
Joseph Salisbury (jsalisbury) |
|
| 2018-10-30 14:27:28 |
Joseph Salisbury |
linux (Ubuntu): assignee |
Skipper Bug Screeners (skipper-screen-team) |
Joseph Salisbury (jsalisbury) |
|
| 2018-10-31 17:50:42 |
Joseph Salisbury |
linux (Ubuntu): status |
Triaged |
Fix Released |
|
| 2018-10-31 17:50:50 |
Joseph Salisbury |
linux (Ubuntu): status |
Fix Released |
In Progress |
|
| 2018-10-31 17:50:53 |
Joseph Salisbury |
linux (Ubuntu Xenial): status |
Triaged |
In Progress |
|
| 2018-10-31 17:50:55 |
Joseph Salisbury |
linux (Ubuntu Bionic): status |
Triaged |
In Progress |
|
| 2018-10-31 17:50:57 |
Joseph Salisbury |
linux (Ubuntu Cosmic): status |
Triaged |
In Progress |
|
| 2018-10-31 17:53:38 |
Joseph Salisbury |
description |
Description: qeth: Fix potential array overrun in cmd/rc lookup
Symptom: Infinite loop when processing a received cmd.
Problem: qeth_get_ipa_cmd_name() and qeth_get_ipa_msg() are used
to build human-readable messages for received cmd data.
They store the to-be translated value in the last entry of a
global array, and then iterate over each entry until they found
the queried value (and the corresponding message string).
If there is no prior match, the lookup is intended to stop at
the final entry (which was previously prepared).
If two qeth devices are concurrently processing a received cmd,
one lookup can over-write the last entry of the global array
while a second lookup is in process. This second lookup will then
never hit its stop-condition, and loop.
Solution: Remove the modification of the global array, and limit the number
of iterations to the size of the array.
Upstream-ID: kernel 4.19
- 065a2cdcbdf8eb9aefb66e1a24b2d684b8b8852b
- 048a7f8b4ec085d5c56ad4a3bf450389a4aed5f9
Should also be applied, to all other Ubuntu Releases in the field ! |
== SRU Justification ==
IBM is requesting these commits in s390 for X, B and C. The bug
description the commits fix is as follows:
Description: qeth: Fix potential array overrun in cmd/rc lookup Symptom:
Infinite loop when processing a received cmd.
Problem: qeth_get_ipa_cmd_name() and qeth_get_ipa_msg() are used to build
human-readable messages for received cmd data.
== Fixes ==
065a2cdcbdf8 ("s390: qeth_core_mpc: Use ARRAY_SIZE instead of reimplementing its function")
048a7f8b4ec0 ("s390: qeth: Fix potential array overrun in cmd/rc lookup")
== Regression Potential ==
Low. Limited to s390.
== Test Case ==
A test kernel was built with these two patches and tested by IBM.
The bug reporter states the test kernel resolved the bug.
Description: qeth: Fix potential array overrun in cmd/rc lookup
Symptom: Infinite loop when processing a received cmd.
Problem: qeth_get_ipa_cmd_name() and qeth_get_ipa_msg() are used
to build human-readable messages for received cmd data.
They store the to-be translated value in the last entry of a
global array, and then iterate over each entry until they found
the queried value (and the corresponding message string).
If there is no prior match, the lookup is intended to stop at
the final entry (which was previously prepared).
If two qeth devices are concurrently processing a received cmd,
one lookup can over-write the last entry of the global array
while a second lookup is in process. This second lookup will then
never hit its stop-condition, and loop.
Solution: Remove the modification of the global array, and limit the number
of iterations to the size of the array.
Upstream-ID: kernel 4.19
- 065a2cdcbdf8eb9aefb66e1a24b2d684b8b8852b
- 048a7f8b4ec085d5c56ad4a3bf450389a4aed5f9
Should also be applied, to all other Ubuntu Releases in the field ! |
|
| 2018-10-31 19:07:51 |
Frank Heimes |
ubuntu-z-systems: status |
Triaged |
In Progress |
|
| 2018-11-07 06:56:57 |
Khaled El Mously |
linux (Ubuntu Xenial): status |
In Progress |
Fix Committed |
|
| 2018-11-07 06:57:00 |
Khaled El Mously |
linux (Ubuntu Bionic): status |
In Progress |
Fix Committed |
|
| 2018-11-07 06:57:03 |
Khaled El Mously |
linux (Ubuntu Cosmic): status |
In Progress |
Fix Committed |
|
| 2018-11-07 07:16:03 |
Frank Heimes |
ubuntu-z-systems: status |
In Progress |
Fix Committed |
|
| 2018-11-09 08:46:23 |
Frank Heimes |
linux (Ubuntu): status |
In Progress |
Fix Committed |
|
| 2018-11-15 11:03:57 |
Brad Figg |
tags |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-cosmic |
|
| 2018-11-15 11:34:47 |
Brad Figg |
tags |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-cosmic |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-bionic verification-needed-cosmic |
|
| 2018-11-16 16:36:36 |
Brad Figg |
tags |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-bionic verification-needed-cosmic |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-bionic verification-needed-cosmic verification-needed-xenial |
|
| 2018-11-19 08:14:27 |
Frank Heimes |
tags |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-needed-bionic verification-needed-cosmic verification-needed-xenial |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-done-bionic verification-done-cosmic verification-done-xenial |
|
| 2018-12-03 08:49:32 |
Launchpad Janitor |
linux (Ubuntu Cosmic): status |
Fix Committed |
Fix Released |
|
| 2018-12-03 08:49:32 |
Launchpad Janitor |
cve linked |
|
2018-18653 |
|
| 2018-12-03 08:49:32 |
Launchpad Janitor |
cve linked |
|
2018-18955 |
|
| 2018-12-03 08:49:32 |
Launchpad Janitor |
cve linked |
|
2018-6559 |
|
| 2018-12-03 14:01:15 |
Launchpad Janitor |
linux (Ubuntu Bionic): status |
Fix Committed |
Fix Released |
|
| 2018-12-03 14:59:47 |
Launchpad Janitor |
linux (Ubuntu Xenial): status |
Fix Committed |
Fix Released |
|
| 2018-12-04 13:17:35 |
Frank Heimes |
linux (Ubuntu): status |
Fix Committed |
Fix Released |
|
| 2018-12-04 13:17:39 |
Frank Heimes |
ubuntu-z-systems: status |
Fix Committed |
Fix Released |
|
| 2019-07-24 20:56:50 |
Brad Figg |
tags |
architecture-s39064 bugnameltc-172700 severity-high targetmilestone-inin1810 verification-done-bionic verification-done-cosmic verification-done-xenial |
architecture-s39064 bugnameltc-172700 cscc severity-high targetmilestone-inin1810 verification-done-bionic verification-done-cosmic verification-done-xenial |
|
