Cherry Pick needed for Critical upstream patch for Kernel null pointer dereference - usb-c altmode

Bug #1897963 reported by Igor Campos
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Undecided
Unassigned
Focal
High
Unassigned

Bug Description

Basically a null pointer dereference was happening while using a lenovo usb-c dock. The issue has been addressed upstream with commit: https://github.com/torvalds/linux/commit/386e15a650447f53de3d2d8819ce9393f31650a4

Apparently the dock kept sending altmode information repeatedly, and the kernel did not expect this to happen, a check was added to make sure it only observes the amount of altmodes limited by the standard.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: linux-image-5.4.0-48-generic 5.4.0-48.52~18.04.1
ProcVersionSignature: Ubuntu 5.4.0-48.52~18.04.1-generic 5.4.60
Uname: Linux 5.4.0-48-generic x86_64
ApportVersion: 2.20.9-0ubuntu7.17
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Wed Sep 30 15:40:24 2020
InstallationDate: Installed on 2020-09-30 (0 days ago)
InstallationMedia: Ubuntu 18.04.5 LTS "Bionic Beaver" - Release amd64 (20200806.1)
SourcePackage: linux-signed-hwe-5.4
UpgradeStatus: No upgrade log present (probably fresh install)

CVE References

Revision history for this message
Igor Campos (igor-gama-90-8) wrote :
Revision history for this message
Igor Campos (igor-gama-90-8) wrote :

I would like to request Ubuntu devs to please cherry pick the changes from the bug report into Ubuntu's 5.4 kernel as this is a critical issue.

Revision history for this message
Igor Campos (igor-gama-90-8) wrote :
affects: linux-signed-hwe-5.4 (Ubuntu) → linux (Ubuntu)
tags: added: patch
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1897963

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Igor Campos (igor-gama-90-8) wrote : Re: Kernel null pointer dereference - Lenovo Thinkpad USB-C Dock Gen2

the kernel crashes, I am unable to capture the event, only the dmesg running is able to show what happens. there is already a fix.

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Igor Campos (igor-gama-90-8) wrote :

bump

tags: added: critical
tags: added: cherry-pick patch-accepted-upstream
summary: - Kernel null pointer dereference - Lenovo Thinkpad USB-C Dock Gen2
+ Cherry Pick needed for Critical upstream patch for Kernel null pointer
+ dereference - usb-c altmode
Changed in linux (Ubuntu Focal):
importance: Undecided → High
Ian May (ian-may)
Changed in linux (Ubuntu Focal):
status: New → Fix Committed
Revision history for this message
Igor Campos (igor-gama-90-8) wrote :

Could this also be applied to the bionic branch?

Thanks and best regards!

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

As this got applied in 5.4 Focal, Bionic 5.4 will get this fix as well when it got released.
Thanks

Revision history for this message
Kelsey Skunberg (kelsey-skunberg) wrote :

Hi @Igor, may you please complete the verification? Thank you!

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (78.9 KiB)

This bug was fixed in the package linux - 5.4.0-56.62

---------------
linux (5.4.0-56.62) focal; urgency=medium

  * focal/linux: 5.4.0-56.62 -proposed tracker (LP: #1905300)

  * CVE-2020-4788
    - selftests/powerpc: rfi_flush: disable entry flush if present
    - powerpc/64s: flush L1D on kernel entry
    - powerpc/64s: flush L1D after user accesses
    - selftests/powerpc: entry flush test

linux (5.4.0-55.61) focal; urgency=medium

  * focal/linux: 5.4.0-55.61 -proposed tracker (LP: #1903175)

  * Update kernel packaging to support forward porting kernels (LP: #1902957)
    - [Debian] Update for leader included in BACKPORT_SUFFIX

  * Avoid double newline when running insertchanges (LP: #1903293)
    - [Packaging] insertchanges: avoid double newline

  * EFI: Fails when BootCurrent entry does not exist (LP: #1899993)
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.

  * CVE-2020-14351
    - perf/core: Fix race in the perf_mmap_close() function

  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for submitting discard bio
    - md/raid10: extend r10bio devs to raid disks
    - md/raid10: pull codes that wait for blocked dev into one function
    - md/raid10: improve raid10 discard request
    - md/raid10: improve discard request for far layout
    - dm raid: fix discard limits for raid1 and raid10
    - dm raid: remove unnecessary discard limits for raid10

  * Bionic: btrfs: kernel BUG at /build/linux-
    eTBZpZ/linux-4.15.0/fs/btrfs/ctree.c:3233! (LP: #1902254)
    - btrfs: drop unnecessary offset_in_page in extent buffer helpers
    - btrfs: extent_io: do extra check for extent buffer read write functions
    - btrfs: extent-tree: kill BUG_ON() in __btrfs_free_extent()
    - btrfs: extent-tree: kill the BUG_ON() in insert_inline_extent_backref()
    - btrfs: ctree: check key order before merging tree blocks

  * Ethernet no link lights after reboot (Intel i225-v 2.5G) (LP: #1902578)
    - igc: Add PHY power management control

  * Undetected Data corruption in MPI workloads that use VSX for reductions on
    POWER9 DD2.1 systems (LP: #1902694)
    - powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation
    - selftests/powerpc: Make alignment handler test P9N DD2.1 vector CI load
      workaround

  * [20.04 FEAT] Support/enhancement of NVMe IPL (LP: #1902179)
    - s390: nvme ipl
    - s390: nvme reipl
    - s390/ipl: support NVMe IPL kernel parameters

  * uvcvideo: add mapping for HEVC payloads (LP: #1895803)
    - media: uvcvideo: Add mapping for HEVC payloads

  * Focal update: v5.4.73 upstream stable release (LP: #1902115)
    - ibmveth: Switch order of ibmveth_helper calls.
    - ibmveth: Identify ingress large send packets.
    - ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
    - mlx4: handle non-napi callers to napi_poll
    - net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
    - net: fec: Fix PHY init after phy_reset_after_clk_enable()
    - net: fix pos incrementment in ipv6_route_seq_next
    - net/smc: fix valid DMBE buffer sizes
    - net...

Changed in linux (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

This commit 386e15a650447f53de3d2d8819ce9393f31650a4 can be found in Hirsute as well. Closing this bug.

Changed in linux (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers