Unable to handle kernel pointer dereference in virtual kernel address space on Eoan
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | ubuntu-kernel-tests |
Undecided
|
Unassigned | ||
| | linux (Ubuntu) |
Undecided
|
Christian Brauner | ||
| | Eoan |
Undecided
|
Christian Brauner | ||
| | Focal |
Undecided
|
Christian Brauner | ||
Bug Description
Issue spotted on Eoan zVM / LPAR
It looks like this happens when running the ubunut_
[ 1225.137764] docker0: port 1(veth2fda0c6) entered blocking state
[ 1225.137767] docker0: port 1(veth2fda0c6) entered disabled state
[ 1225.138023] device veth2fda0c6 entered promiscuous mode
[ 1225.148523] Unable to handle kernel pointer dereference in virtual kernel address space
[ 1225.148529] Failing address: 6f766c5f646f5000 TEID: 6f766c5f646f5803
[ 1225.148531] Fault in home space mode while using kernel ASCE.
[ 1225.148533] AS:000000070d94c007 R3:0000000000000024
[ 1225.148575] Oops: 0038 ilc:3 [#1] SMP
[ 1225.148578] Modules linked in: veth xt_nat vxlan ip6_udp_tunnel udp_tunnel nf_conntrack_
[ 1225.148622] nf_defrag_ipv6 nf_defrag_ipv4 binfmt_misc zfs(PO) zunicode(PO) zavl(PO) icp(PO) zlua(PO) zcommon(PO) znvpair(PO) spl(O) genwqe_card crc_itu_t chsc_sch eadm_sch ctcm fsm vfio_ccw vfio_mdev mdev vfio_iommu_type1 vfio sch_fq_codel nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables x_tables btrfs zstd_compress zlib_deflate raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 linear dm_service_time mlx4_ib ib_uverbs mlx4_en ptp ib_core pps_core pkey zcrypt crc32_vx_s390 ghash_s390 prng aes_s390 des_s390 qeth_l2 des_generic sha512_s390 sha256_s390 sha1_s390 sha_common mlx4_core zfcp scsi_transport_fc qeth qdio ccwgroup dasd_eckd_mod dasd_mod scsi_dh_emc scsi_dh_rdac scsi_dh_alua dm_multipath
[ 1225.148711] CPU: 4 PID: 161930 Comm: dockerd Tainted: P O 5.3.0-52-generic #46-Ubuntu
[ 1225.148714] Hardware name: IBM 2964 N63 400 (LPAR)
[ 1225.148716] Krnl PSW : 0704d00180000000 000003ff808e972a (ovl_open_
[ 1225.148734] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
[ 1225.148736] Krnl GPRS: 0000000000000064 6f766c5f646f5f6d 00000007a14ac300 00000003a5df6600
[ 1225.148738] 0000000000008000 0000000000000001 0000000300000000 0000000372e45278
[ 1225.148740] 000003ff808ea508 0000000304048000 00000005c7f32b68 000000064a2ab900
[ 1225.148742] 00000003a5df6600 000003ff808f31d8 000003ff808e971a 000003e009c0faf8
[ 1225.148749] Krnl Code: 000003ff808e971a: a59a0404 oilh %r9,1028
[ 1225.148766] Call Trace:
[ 1225.148769] ([<000000000000
[ 1225.148774] [<000003ff808ea
[ 1225.148780] [<000000070cbf2
[ 1225.148784] [<000000070cc0a
[ 1225.148786] [<000000070cc0b
[ 1225.148788] [<000000070cc0c
[ 1225.148791] [<000000070cbf4
[ 1225.148798] [<000000070d1eb
[ 1225.148800] Last Breaking-
[ 1225.148802] [<000000070d1ed
[ 1225.148805] ---[ end trace dc1913214325ab11 ]---
ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: linux-image-
ProcVersionSign
Uname: Linux 5.3.0-52-generic s390x
NonfreeKernelMo
AlsaDevices: Error: command ['ls', '-l', '/dev/snd/'] failed with exit code 2: ls: cannot access '/dev/snd/': No such file or directory
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay': 'aplay'
ApportVersion: 2.20.11-0ubuntu8.8
Architecture: s390x
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord': 'arecord'
CRDA: Error: command ['iw', 'reg', 'get'] failed with exit code 1: nl80211 not found.
Date: Sun May 3 21:51:21 2020
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig': 'iwconfig'
Lsusb: Error: command ['lsusb'] failed with exit code 1:
PciMultimedia:
ProcEnviron:
TERM=xterm-
PATH=(custom, no user)
XDG_RUNTIME_
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcFB:
ProcKernelCmdLine: root=UUID=
RelatedPackageV
linux-
linux-
linux-firmware 1.183.5
RfKill: Error: [Errno 2] No such file or directory: 'rfkill': 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
CVE References
| Po-Hsu Lin (cypressyew) wrote : | #1 |
| description: | updated |
| tags: | added: sru-20200427 ubuntu-fan-smoke-test |
| tags: | added: kqa-blocker |
| Changed in linux (Ubuntu): | |
| status: | New → Confirmed |
| Po-Hsu Lin (cypressyew) wrote : | #3 |
This issue can be found on E PowerPC as well, test will stop at the fan smoke test as well.
[ 1316.676714] BUG: Unable to handle kernel data access at 0xd9d4a05293989f60
[ 1316.676743] Faulting instruction address: 0xc00800000cd9b164
[ 1316.676755] Oops: Kernel access of bad area, sig: 11 [#1]
[ 1316.676777] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
[ 1316.676788] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_
[ 1316.676839] twofish_common algif_skcipher af_alg dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua joydev input_leds mac_hid ofpart cmdlinepart ipmi_powernv powernv_flash ipmi_devintf mtd ipmi_msghandler at24 uio_pdrv_genirq opal_prd ibmpowernv uio vmx_crypto sch_fq_codel ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid ses enclosure scsi_transport_sas ast drm_vram_helper i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect crct10dif_vpmsum sysimgblt fb_sys_fops crc32c_vpmsum drm i40e aacraid drm_panel_
[ 1316.677182] CPU: 16 PID: 104008 Comm: dockerd Tainted: P O 5.3.0-52-generic #46-Ubuntu
[ 1316.677214] NIP: c00800000cd9b164 LR: c00800000cd9b148 CTR: c000000000161290
[ 1316.677235] REGS: c000000bbe603690 TRAP: 0380 Tainted: P O (5.3.0-52-generic)
[ 1316.677256] MSR: 9000000002009033 <SF,HV,
[ 1316.677291] CFAR: c00800000cd96ad0 IRQMASK: 0
| Po-Hsu Lin (cypressyew) wrote : | #4 |
You can triggered a general protection fault by running the ubuntu_
[ 101.715152] general protection fault: 0000 [#1] SMP PTI
[ 101.717403] CPU: 1 PID: 1236 Comm: dockerd Not tainted 5.3.0-52-generic #46-Ubuntu
[ 101.720424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 101.723856] RIP: 0010:ovl_
[ 101.725826] Code: 44 8b 6f 40 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 49 8b 7e 28 41 81 cd 00 00 04 04 e8 cd d4 ff ff 49 89 c7 48 8b 45 c8 <48> 8b 40 68 48 81 78 60 62 6a 65 6a 0f 84 a6 00 00 00 65 48 8b 04
[ 101.731311] RSP: 0018:ffffaa2840
[ 101.732773] RAX: 044555892ac42800 RBX: ffff9af67a149ea8 RCX: 0000000000000001
[ 101.734759] RDX: 0000000000008000 RSI: ffff9af67a149ea8 RDI: ffff9af67b3d9000
[ 101.736866] RBP: ffffaa28406afc50 R08: ffff9af67b031240 R09: 0000000000000000
[ 101.738854] R10: ffff9af67a7d6900 R11: 0000000000000000 R12: ffff9af6799a1d00
[ 101.740883] R13: 0000000004048001 R14: ffff9af67a1a4818 R15: ffff9af67b031240
[ 101.742902] FS: 00007f58a57fa70
[ 101.745194] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 101.746798] CR2: 0000000001178b78 CR3: 000000007b060000 CR4: 00000000000006e0
[ 101.748817] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 101.750798] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 101.752804] Call Trace:
[ 101.753502] ? ovl_llseek+
[ 101.754770] ovl_open+0x57/0x90 [overlay]
[ 101.755951] do_dentry_
[ 101.757013] vfs_open+0x2d/0x30
[ 101.757949] do_last+0x194/0x8f0
[ 101.758843] path_openat+
[ 101.759908] ? __switch_
[ 101.760984] ? __switch_
[ 101.762099] do_filp_
[ 101.763088] ? __alloc_
[ 101.764171] do_sys_
[ 101.765168] __x64_sys_
[ 101.766297] do_syscall_
[ 101.767512] entry_SYSCALL_
[ 101.768932] RIP: 0033:0x56465af612ba
[ 101.769922] Code: e8 8b 3d f8 ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 4c 8b 54 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 40 ff ff ff ff 48 c7 44 24 48
[ 101.775167] RSP: 002b:000000c000
[ 101.777440] RAX: ffffffffffffffda RBX: 000000c00005e500 RCX: 000056465af612ba
[ 101.779553] RDX: 0000000000080241 RSI: 000000c000814e00 RDI: ffffffffffffff9c
[ 101.781538] RBP: 000000c000956818 R08: 0000000000000000 R09: 0000000000000000
[ 101.783650] R10: 00000000000001a4 R11: 0000000000000202 R12: ffffffffffffffff
[ 101.785789] R13: 0000000000000039 R14: 0000000000000038 R15: 0000000000000080
[ 101.787887] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_
| tags: | added: regression-proposed |
| Changed in linux (Ubuntu Eoan): | |
| status: | New → Confirmed |
| Khaled El Mously (kmously) wrote : | #5 |
This commit looks highly suspicious:
"UBUNTU: SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay"
That patch was submitted as a fix for bug 1857257, which was applied for Focal as well. Therefore this bug might affect Focal too, we are waiting for some test results to confirm it.
| Changed in linux (Ubuntu): | |
| status: | Confirmed → In Progress |
| Changed in linux (Ubuntu Eoan): | |
| status: | Confirmed → In Progress |
| Changed in linux (Ubuntu Focal): | |
| status: | New → In Progress |
| Changed in linux (Ubuntu): | |
| assignee: | nobody → Christian Brauner (cbrauner) |
| Changed in linux (Ubuntu Eoan): | |
| assignee: | nobody → Christian Brauner (cbrauner) |
| Changed in linux (Ubuntu Focal): | |
| assignee: | nobody → Christian Brauner (cbrauner) |
| Po-Hsu Lin (cypressyew) wrote : | #7 |
I can reproduce this issue on Focal (5.4.0-30-generic) AMD64 KVM as well with the ubuntu_
4331.987024] general protection fault: 0000 [#1] SMP PTI
[ 4331.989188] CPU: 0 PID: 34912 Comm: dockerd Not tainted 5.4.0-30-generic #34-Ubuntu
[ 4331.992158] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 4331.995189] RIP: 0010:ovl_
[ 4331.997100] Code: 44 8b 6f 40 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 49 8b 7e 28 41 81 cd 00 00 04 04 e8 9d d4 ff ff 49 89 c7 48 8b 45 c8 <48> 8b 40 68 48 81 78 60 62 6a 65 6a 0f 84 a6 00 00 00 65 48 8b 04
[ 4332.003304] RSP: 0018:ffffb10b00
[ 4332.004841] RAX: 5ebabec054698800 RBX: ffff8ed6b776a770 RCX: 0000000000000001
[ 4332.006838] RDX: ffff8ed6b774bf00 RSI: ffff8ed6b776a770 RDI: ffff8ed6affea3c0
[ 4332.008842] RBP: ffffb10b00b33c50 R08: ffff8ed6afc79600 R09: 0000000000000000
[ 4332.010862] R10: ffff8ed6b774bf00 R11: 0000000000000000 R12: ffff8ed6b0a06c00
[ 4332.013003] R13: 0000000004048001 R14: ffff8ed6b75b6b20 R15: ffff8ed6afc79600
[ 4332.015049] FS: 00007f3a3894170
[ 4332.017326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4332.019058] CR2: 000056296e62b358 CR3: 0000000130f94000 CR4: 00000000000006f0
[ 4332.021028] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4332.023134] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4332.025142] Call Trace:
[ 4332.025885] ? ovl_llseek+
[ 4332.027239] ovl_open+0x57/0x90 [overlay]
[ 4332.028391] do_dentry_
[ 4332.029490] vfs_open+0x2d/0x30
[ 4332.030422] do_last+0x194/0x900
[ 4332.031407] path_openat+
[ 4332.033084] ? __switch_
[ 4332.035151] ? __switch_
[ 4332.037142] do_filp_
[ 4332.039032] ? __alloc_
[ 4332.040860] do_sys_
[ 4332.042954] __x64_sys_
[ 4332.044980] do_syscall_
[ 4332.047058] entry_SYSCALL_
| Christian Brauner (cbrauner) wrote : | #8 |
With the fixup patch applied, I could not reproduce the issue anymore on both Eoan and Focal running ubuntu_
| Christian Brauner (cbrauner) wrote : Re: [Bug 1876645] Re: Unable to handle kernel pointer dereference in virtual kernel address space on Eoan | #10 |
On Wed, May 06, 2020 at 10:32:19AM -0000, Kleber Sacilotto de Souza wrote:
> With the fixup patch applied, I could not reproduce the issue anymore on
> both Eoan and Focal running ubuntu_
> ubuntu_
Sweet, thank you and sorry for the rebase mess-up with Andrei's patch.
| Changed in linux (Ubuntu Eoan): | |
| status: | In Progress → Fix Committed |
| Changed in linux (Ubuntu Focal): | |
| status: | In Progress → Fix Committed |
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/
| tags: | added: verification-needed-focal |
| tags: | added: verification-needed-eoan |
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/
Overlayfs related tests completed successfully with focal kernel in -proposed (5.4.0-31.35):
https:/
- ubuntu_
- ubuntu_
| tags: |
added: verification-done-focal removed: verification-needed-focal |
Overlayfs related tests completed successfully with eoan kernel in -proposed (5.3.0-53.47):
https:/
- ubuntu_
- ubuntu_
| tags: |
added: verification-done-eoan removed: verification-needed-eoan |
| Launchpad Janitor (janitor) wrote : | #15 |
This bug was fixed in the package linux - 5.4.0-31.35
---------------
linux (5.4.0-31.35) focal; urgency=medium
* focal/linux: 5.4.0-31.35 -proposed tracker (LP: #1877253)
* Intermittent display blackouts on event (LP: #1875254)
- drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only
* Unable to handle kernel pointer dereference in virtual kernel address space
on Eoan (LP: #1876645)
- SAUCE: overlayfs: fix shitfs special-casing
linux (5.4.0-30.34) focal; urgency=medium
* focal/linux: 5.4.0-30.34 -proposed tracker (LP: #1875385)
* ubuntu/focal64 fails to mount Vagrant shared folders (LP: #1873506)
- [Packaging] Move virtualbox modules to linux-modules
- [Packaging] Remove vbox and zfs modules from generic.
* linux-image-
(LP: #1857257)
- SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay
* shiftfs: broken shiftfs nesting (LP: #1872094)
- SAUCE: shiftfs: record correct creator credentials
* Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
- [Packaging] add support to compile/run selftests
* shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
- SAUCE: shiftfs: fix dentry revalidation
* LIO hanging in iscsit_free_session and iscsit_stop_session (LP: #1871688)
- scsi: target: iscsi: calling iscsit_
iscsit_
* [ICL] TC port in legacy/static mode can't be detected due TCCOLD
(LP: #1868936)
- SAUCE: drm/i915: Align power domain names with port names
- SAUCE: drm/i915/display: Move out code to return the digital_port of the aux
ch
- SAUCE: drm/i915/display: Add intel_legacy_
- SAUCE: drm/i915/display: Split hsw_power_
- SAUCE: drm/i915/tc/icl: Implement TC cold sequences
- SAUCE: drm/i915/tc: Skip ref held check for TC legacy aux power wells
- SAUCE: drm/i915/tc/tgl: Implement TC cold sequences
- SAUCE: drm/i915/tc: Catch TC users accessing FIA registers without enable
aux
- SAUCE: drm/i915/tc: Do not warn when aux power well of static TC ports
timeout
* alsa/sof: external mic can't be deteced on Lenovo and HP laptops
(LP: #1872569)
- SAUCE: ASoC: intel/skl/hda - set autosuspend timeout for hda codecs
* amdgpu kernel errors in Linux 5.4 (LP: #1871248)
- drm/amd/display: Stop if retimer is not available
* Focal update: v5.4.34 upstream stable release (LP: #1874111)
- amd-xgbe: Use __napi_schedule() in BH context
- hsr: check protocol version in hsr_newlink()
- l2tp: Allow management of tunnels and session in user namespace
- net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode
- net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
- net: ipv6: do not consider routes via gateways for anycast address check
- net: phy: micrel: use genphy_read_status for KSZ9131
- net: qrtr: send msgs from local of same id as broadcast
- net: revert default NAPI poll timeout to 2 jiffies
- net: tun: record RX queue in skb before do_xdp_gener...
| Changed in linux (Ubuntu Focal): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote : | #16 |
This bug was fixed in the package linux - 5.3.0-53.47
---------------
linux (5.3.0-53.47) eoan; urgency=medium
* eoan/linux: 5.3.0-53.47 -proposed tracker (LP: #1877257)
* Intermittent display blackouts on event (LP: #1875254)
- drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only
* Unable to handle kernel pointer dereference in virtual kernel address space
on Eoan (LP: #1876645)
- SAUCE: overlayfs: fix shitfs special-casing
linux (5.3.0-52.46) eoan; urgency=medium
* eoan/linux: 5.3.0-52.46 -proposed tracker (LP: #1874752)
* alsa: make the dmic detection align to the mainline kernel-5.6
(LP: #1871284)
- ALSA: hda: add Intel DSP configuration / probe code
- ALSA: hda: fix intel DSP config
- ALSA: hda: Allow non-Intel device probe gracefully
- ALSA: hda: More constifications
- ALSA: hda: Rename back to dmic_detect option
- [Config] SND_INTEL_
- [packaging] Remove snd-intel-nhlt from modules
* built-using constraints preventing uploads (LP: #1875601)
- temporarily drop Built-Using data
* ubuntu/focal64 fails to mount Vagrant shared folders (LP: #1873506)
- [Packaging] Move virtualbox modules to linux-modules
- [Packaging] Remove vbox and zfs modules from generic.
* linux-image-
(LP: #1857257)
- SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay
* shiftfs: broken shiftfs nesting (LP: #1872094)
- SAUCE: shiftfs: record correct creator credentials
* Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
- [Packaging] add support to compile/run selftests
* shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
- SAUCE: shiftfs: fix dentry revalidation
* getitimer returns it_value=0 erroneously (LP: #1349028)
- [Config] CONTEXT_
* 5.3.0-46-generic - i915 - frequent GPU hangs / resets rcs0 (LP: #1872001)
- drm/i915/execlists: Preempt-to-busy
- drm/i915/gt: Detect if we miss WaIdleLiteRestore
- drm/i915/execlists: Always force a context reload when rewinding RING_TAIL
* alsa/sof: external mic can't be deteced on Lenovo and HP laptops
(LP: #1872569)
- SAUCE: ASoC: intel/skl/hda - set autosuspend timeout for hda codecs
* Eoan update: upstream stable patchset 2020-04-22 (LP: #1874325)
- ARM: dts: sun8i-a83t-
- bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
- net: vxge: fix wrong __VA_ARGS__ usage
- hinic: fix a bug of waitting for IO stopped
- hinic: fix wrong para of wait_for_
- cxgb4/ptp: pass the sign of offset delta in FW CMD
- qlcnic: Fix bad kzalloc null test
- i2c: st: fix missing struct parameter description
- cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
- media: venus: hfi_parser: Ignore HEVC encoding for V1
- firmware: arm_sdei: fix double-lock on hibernate with shared events
- null_blk: Fix the null_add_dev() error path
- null_blk: Handle null_add_dev() failures properly
- null_blk: fix spuri...
| Changed in linux (Ubuntu Eoan): | |
| status: | Fix Committed → Fix Released |
| Florian W. (florian-will) wrote : | #17 |
It's too late now, but there's a typo in the changelog: "shitfs".
| Colin Ian King (colin-king) wrote : | #18 |
That's an unfortunate typo
This change was made by a bot.