Avoid potential memory corruption on HiSilicon SoCs
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| linux (Ubuntu) |
Medium
|
Unassigned | ||
| Bionic |
Undecided
|
dann frazier | ||
| Cosmic |
Undecided
|
dann frazier | ||
| Disco |
Medium
|
Unassigned |
Bug Description
[Impact]
There is a potential for memory corruption in MSI payloads. For reasons mentioned in the commit message, this happens to not be triggerable today, but is fragile, and could rear it's ugly head if a struct layout changes due to other backports in the future.
[Test Case]
Regression-only.
[Fix]
84a9a75774961 iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads
[Regression Risk]
The fix is to add some explicit padding into an internal structure. This padding is already implicit today.
Changed in linux (Ubuntu Cosmic): | |
status: | New → In Progress |
Changed in linux (Ubuntu Bionic): | |
status: | New → In Progress |
assignee: | nobody → dann frazier (dannf) |
Changed in linux (Ubuntu Cosmic): | |
assignee: | nobody → dann frazier (dannf) |
Changed in linux (Ubuntu Disco): | |
assignee: | dann frazier (dannf) → nobody |
Changed in linux (Ubuntu Bionic): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Cosmic): | |
status: | In Progress → Fix Committed |
tags: | added: verification-needed-cosmic |
tags: | added: verification-needed-bionic |
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/
dann frazier (dannf) wrote : | #3 |
Verified - boot tested both cosmic & bionic proposed kernels on a D06 system.
tags: |
added: verification-don-bionic verification-done-cosmic removed: verification-needed-bionic verification-needed-cosmic |
tags: |
added: verification-done-bionic removed: verification-don-bionic |
Launchpad Janitor (janitor) wrote : | #4 |
This bug was fixed in the package linux - 4.18.0-18.19
---------------
linux (4.18.0-18.19) cosmic; urgency=medium
* linux: 4.18.0-18.19 -proposed tracker (LP: #1822796)
* Packaging resync (LP: #1786013)
- [Packaging] update helper scripts
- [Packaging] resync retpoline extraction
* 3b080b2564287be
triggers system hang on i386 (LP: #1812845)
- btrfs: raid56: properly unmap parity page in finish_
* [SRU][B/
- ACPI / property: Allow multiple property compatible _DSD entries
- PCI / ACPI: Identify untrusted PCI devices
- iommu/vt-d: Force IOMMU on for platform opt in hint
- iommu/vt-d: Do not enable ATS for untrusted devices
- thunderbolt: Export IOMMU based DMA protection support to userspace
- iommu/vt-d: Disable ATS support on untrusted devices
* Huawei Hi1822 NIC has poor performance (LP: #1820187)
- net-next: hinic: fix a problem in free_tx_poll()
- hinic: remove ndo_poll_controller
- net-next/hinic: add checksum offload and TSO support
- hinic: Fix l4_type parameter in hinic_task_
- net-next/
- net-next/hinic:add rx checksum offload for HiNIC
- net-next/hinic:fix a bug in set mac address
- net-next/hinic: fix a bug in rx data flow
- net: hinic: fix null pointer dereference on pointer hwdev
- hinic: optmize rx refill buffer mechanism
- net-next/hinic:add shutdown callback
- net-next/hinic: replace disable_
* [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
- Fonts: New Terminus large console font
- [Config]: enable highdpi Terminus 16x32 font support
* [19.04 FEAT] qeth: Enhanced link speed - kernel part (LP: #1814892)
- s390/qeth: report 25Gbit link speed
* Avoid potential memory corruption on HiSilicon SoCs (LP: #1819546)
- iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads
* CVE-2017-5715
- x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
- x86/speculation: Propagate information about RSB filling mitigation to sysfs
- x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC
variant
- x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
- x86/retpoline: Remove minimal retpoline support
- x86/speculation: Update the TIF_SSBD comment
- x86/speculation: Clean up spectre_
- x86/speculation: Remove unnecessary ret variable in cpu_show_common()
- x86/speculation: Move STIPB/IBPB string conditionals out of
cpu_
- x86/speculation: Disable STIBP when enhanced IBRS is in use
- x86/speculation: Rename SSBD update functions
- x86/speculation: Reorganize speculation control MSRs update
- sched/smt: Make sched_smt_present track topology
- x86/Kconfig: Select SCHED_SMT if SMP enabled
- sched/smt: Expose sched_smt_present static key
- x86/speculation: Rework SMT state change
- x86/l1tf: Show actual SMT state
- x86/speculation: R...
Changed in linux (Ubuntu Cosmic): | |
status: | Fix Committed → Fix Released |
Launchpad Janitor (janitor) wrote : | #5 |
This bug was fixed in the package linux - 4.15.0-48.51
---------------
linux (4.15.0-48.51) bionic; urgency=medium
* linux: 4.15.0-48.51 -proposed tracker (LP: #1822820)
* Packaging resync (LP: #1786013)
- [Packaging] update helper scripts
- [Packaging] resync retpoline extraction
* 3b080b2564287be
triggers system hang on i386 (LP: #1812845)
- btrfs: raid56: properly unmap parity page in finish_
* [P9][LTCTest]
(LP: #1719545)
- cpupower : Fix header name to read idle state name
* [amdgpu] screen corruption when using touchpad (LP: #1818617)
- drm/amdgpu/gmc: steal the appropriate amount of vram for fw hand-over (v3)
- drm/amdgpu: Free VGA stolen memory as soon as possible.
* [SRU][B/
- ACPICA: AML parser: attempt to continue loading table after error
- ACPI / property: Allow multiple property compatible _DSD entries
- PCI / ACPI: Identify untrusted PCI devices
- iommu/vt-d: Force IOMMU on for platform opt in hint
- iommu/vt-d: Do not enable ATS for untrusted devices
- thunderbolt: Export IOMMU based DMA protection support to userspace
- iommu/vt-d: Disable ATS support on untrusted devices
* Add basic support to NVLink2 passthrough (LP: #1819989)
- powerpc/
enabled
- powerpc/powernv: call OPAL_QUIESCE before OPAL_SIGNAL_
- powerpc/powernv: Export opal_check_token symbol
- powerpc/powernv: Make possible for user to force a full ipl cec reboot
- powerpc/
- powerpc/powernv: Move npu struct from pnv_phb to pci_controller
- powerpc/
- powerpc/
- powerpc/
- powerpc/pseries: Remove IOMMU API support for non-LPAR systems
- powerpc/
- powerpc/
* Huawei Hi1822 NIC has poor performance (LP: #1820187)
- net-next: hinic: fix a problem in free_tx_poll()
- hinic: remove ndo_poll_controller
- net-next/hinic: add checksum offload and TSO support
- hinic: Fix l4_type parameter in hinic_task_
- net-next/
- net-next/hinic:add rx checksum offload for HiNIC
- net-next/hinic:fix a bug in set mac address
- net-next/hinic: fix a bug in rx data flow
- net: hinic: fix null pointer dereference on pointer hwdev
- hinic: optmize rx refill buffer mechanism
- net-next/hinic:add shutdown callback
- net-next/hinic: replace disable_
* [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
- Fonts: New Terminus large console font
- [Config]: enable highdpi Terminus 16x32 font support
* [19.04 FEAT] qeth: Enhanced link...
Changed in linux (Ubuntu Bionic): | |
status: | Fix Committed → Fix Released |
Steve Langasek (vorlon) wrote : Update Released | #6 |
The verification of the Stable Release Update for linux-azure has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.
tags: | added: cscc |
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification- needed- cosmic' to 'verification- done-cosmic' . If the problem still exists, change the tag 'verification- needed- cosmic' to 'verification- failed- cosmic' .
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation how to enable and use -proposed. Thank you!