kernel crash in iov_iter_advance (caused by nfs-kernel-server)

Bug #231746 reported by deti on 2008-05-18
46
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Undecided
Unassigned
Hardy
Medium
Stefan Bader

Bug Description

Binary package hint: linux-image-2.6.24-16-xen

Description: Ubuntu 8.04
Release: 8.04
linux-image-2.6.24-16-xen:
  Installed: 2.6.24-16.30zng1
  Candidate: 2.6.24-16.30zng1
  Version table:
 *** 2.6.24-16.30zng1 0
        100 /var/lib/dpkg/status
     2.6.24-16.30 0
        500 http://de.archive.ubuntu.com hardy/universe Packages

When using the nfs kernel server with a very simple export file like this:
/lvm/backup *(rw,no_root_squash,async,no_subtree_check)

a crash in the kernel occurs. See log attached.

This kernel is patched to make xen networking work. There is no way to test nfsd functionality in this setup by using the original ubuntu kernel.

deti (deti) wrote :
deti (deti) wrote :

There was a fix commited by Nick Piggin (http://linux.derkeiler.com/Mailing-Lists/Kernel/2008-03/msg08396.html) which was included in 2.6.25-rc6. Please apply this patch to standard 8.04 kernel.

--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1725,21 +1725,27 @@ size_t iov_iter_copy_from_user(struct pa
}
EXPORT_SYMBOL(iov_iter_copy_from_user);

-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
{
+ BUG_ON(i->count < bytes);
+
if (likely(i->nr_segs == 1)) {
i->iov_offset += bytes;
+ i->count -= bytes;
} else {
const struct iovec *iov = i->iov;
size_t base = i->iov_offset;

/*
* The !iov->iov_len check ensures we skip over unlikely
- * zero-length segments.
+ * zero-length segments (without overruning the iovec).
*/
- while (bytes || !iov->iov_len) {
- int copy = min(bytes, iov->iov_len - base);
+ while (bytes || unlikely(!iov->iov_len && i->count)) {
+ int copy;

+ copy = min(bytes, iov->iov_len - base);
+ BUG_ON(!i->count || i->count < copy);
+ i->count -= copy;
bytes -= copy;
base += copy;
if (iov->iov_len == base) {
@@ -1751,14 +1757,6 @@ static void __iov_iter_advance_iov(struc
i->iov_offset = base;
}
}
-
-void iov_iter_advance(struct iov_iter *i, size_t bytes)
-{
- BUG_ON(i->count < bytes);
-
- __iov_iter_advance_iov(i, bytes);
- i->count -= bytes;
-}
EXPORT_SYMBOL(iov_iter_advance);

/*

deti (deti) wrote :
deti (deti) wrote :

A fixed xen kernel for the x86_64 platform can be downloaded from:

http://www.fliegl.de/download/linux-image-2.6.24-16-xen_2.6.24-16.30_amd64.deb
http://www.fliegl.de/download/linux-headers-2.6.24-16-xen_2.6.24-16.30_amd64.deb

(This kernel also includes the patch of Hirano Takahito to fix xen networking. See Bug #218126)

deti (deti) wrote :

The crash still occurs with original ubuntu kernel 2.6.24-17-xen, see log attached. The patch above does not fix the problem, it just reduces the probability

mar_rio (mario-minners) wrote :

The oops still occurs with original ubuntu kernel 2.6.24-19.34-xen

Andy Boyett (aboyett) wrote :

This is definitely reproducible here too. I'm bootstrapping new domUs and seeing the bug rear it's head in the form shown in Bug #207774. The patch in this thread completely eliminates the bug here. I have not seen the oops in weeks of use since applying the patch, creating quite a few domU's in that time.

FYI: the patch is commit f7009264c519603b8ec67c881bd368a56703cfc9 in Linus's linux-2.6 tree.

Jesper Krogh (jesper) wrote :
Download full text (5.8 KiB)

We're also seing this kernel bug in relation to NFS .. (not using XEN at all);

Aug 4 14:56:00 ko kernel: [263156.166854] PGD 8063 PUD 9063 PMD 0
Aug 4 14:56:00 ko kernel: [263156.166905] CPU 2
Aug 4 14:56:00 ko kernel: [263156.166926] Modules linked in: nfsd auth_rpcgss exportfs nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables x_
tables parport_pc lp parport loop joydev ipv6 psmouse evdev serio_raw pcspkr jedec_probe cfi_probe gen_probe mtd chipreg map_funcs i2c_nforce2 i2c_c
ore button shpchp pci_hotplug k8temp ext3 jbd mbcache pata_amd pata_acpi sr_mod cdrom usb_storage libusual usbhid hid sg sd_mod mptsas mptscsih mptb
ase scsi_transport_sas qla2xxx scsi_transport_fc e1000 scsi_tgt ata_generic ehci_hcd ohci_hcd libata scsi_mod usbcore thermal processor fan fbcon tileblit font bitblit softcursor fuse
Aug 4 14:56:00 ko kernel: [263156.167218] Pid: 7150, comm: nfsd Not tainted 2.6.24-19-server #1
Aug 4 14:56:00 ko kernel: [263156.167246] RIP: 0010:[iov_iter_advance+0x66/0x80] [iov_iter_advance+0x66/0x80] iov_iter_advance+0x66/0x80
Aug 4 14:56:00 ko kernel: [263156.167292] RSP: 0018:ffff8101fa8478e8 EFLAGS: 00010246
Aug 4 14:56:00 ko kernel: [263156.167317] RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000000
Aug 4 14:56:00 ko kernel: [263156.167360] RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff8101fa847980
Aug 4 14:56:00 ko kernel: [263156.167402] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
Aug 4 14:56:00 ko kernel: [263156.167444] R10: ffff810004000000 R11: 0000000000000000 R12: 00000005ba1f8000
Aug 4 14:56:00 ko kernel: [263156.167487] R13: 0000000000001000 R14: ffff8101760241d8 R15: 0000000000000000
Aug 4 14:56:00 ko kernel: [263156.167530] FS: 00007f9a5e8106e0(0000) GS:ffff8101fb042380(0000) knlGS:0000000000000000
Aug 4 14:56:00 ko kernel: [263156.167574] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Aug 4 14:56:00 ko kernel: [263156.167600] CR2: ffff810004000008 CR3: 0000000055597000 CR4: 00000000000006e0
Aug 4 14:56:00 ko kernel: [263156.167643] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Aug 4 14:56:00 ko kernel: [263156.167686] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Aug 4 14:56:00 ko kernel: [263156.167730] Process nfsd (pid: 7150, threadinfo ffff8101fa846000, task ffff8101fb8947e0)
Aug 4 14:56:00 ko kernel: [263156.167774] Stack: ffffffff80286a9e ffff8101e8df4600 ffff81033ec88680 0000000100000000
Aug 4 14:56:00 ko kernel: [263156.167823] ffff8101fa847b90 00000005ba0f9000 ffff8101fa847b10 ffff8101e8df4600
Aug 4 14:56:00 ko kernel: [263156.167871] ffff8101760241d8 ffffffff882559a0 ffff8101760240c8 ffffffff882559a0
Aug 4 14:56:00 ko kernel: [263156.167903] Call Trace:
Aug 4 14:56:00 ko kernel: [263156.167940] [generic_file_buffered_write+0x1de/0x6b0] generic_file_buffered_write+0x1de/0x6b0
Aug 4 14:56:00 ko kernel: [263156.167979] [__generic_file_aio_write_nolock+0x24f/0x400] __generic_file_aio_write_nolock+0x24f/0x400
Aug 4 14:56:00 ko kernel: [263156.168028] [ext3:generic_file_aio_write+0x64/0x450] generic_file_aio_write+0x64/0xd0
Aug 4 14:56:00 ko kernel: [263156.168069] [ext3:ext3_file_write+...

Read more...

Torsten Krah (tkrah) wrote :
Download full text (3.4 KiB)

I am facing this one too - not using nfs, but a simple dovecot imap server (but using xen):

[2831529.979439] Unable to handle kernel paging request at ffff88005e800008 RIP:
[2831529.979447] [<ffffffff80271fc6>] iov_iter_advance+0x66/0x80
[2831529.979458] PGD 1f6b067 PUD 216d067 PMD 2262067 PTE 0
[2831529.979462] Oops: 0000 [1] SMP
[2831529.979465] CPU 0
[2831529.979467] Modules linked in: af_packet ipv6 evdev ext3 jbd mbcache raid10 raid456 async_xor async_memcpy async_tx xor raid1 raid0 multipath linear md_mod dm_mirror dm_snapshot dm_mod fuse
[2831529.979482] Pid: 9629, comm: imap Not tainted 2.6.24-18-xen #1
[2831529.979484] RIP: e030:[<ffffffff80271fc6>] [<ffffffff80271fc6>] iov_iter_advance+0x66/0x80
[2831529.979488] RSP: e02b:ffff8800308e3b10 EFLAGS: 00010246
[2831529.979490] RAX: 0000000000000000 RBX: 00000000000003f2 RCX: 0000000000000000
[2831529.979492] RDX: 0000000000000000 RSI: 00000000000003f2 RDI: ffff8800308e3ba8
[2831529.979494] RBP: 00000000000003f2 R08: 0000000000000000 R09: 0000000000000000
[2831529.979496] R10: ffff88005e800000 R11: 0000000000000000 R12: 00000000001cab54
[2831529.979498] R13: 00000000000004ac R14: ffff88005ce7e598 R15: 0000000000000b54
[2831529.979501] FS: 00007ff0dd2e36e0(0000) GS:ffffffff805c6000(0000) knlGS:0000000000000000
[2831529.979503] CS: e033 DS: 0000 ES: 0000
[2831529.979505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[2831529.979507] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000000
[2831529.979510] Process imap (pid: 9629, threadinfo ffff8800308e2000, task ffff88005d9e8040)
[2831529.979512] Stack: ffffffff80273f9e ffff8800096bfe80 0000000000000026 0000000000000026
[2831529.979517] ffff8800308e3db8 00000000001cab54 ffff8800308e3d38 ffff88005007c840
[2831529.979520] ffff88005ce7e598 ffffffff880bcac0 ffff88005ce7e488 0000000000000000
[2831529.979524] Call Trace:
[2831529.979528] [<ffffffff80273f9e>] generic_file_buffered_write+0x1de/0x6e0
[2831529.979532] [<ffffffff8023ab0e>] current_fs_time+0x1e/0x30
[2831529.979536] [<ffffffff802746ef>] __generic_file_aio_write_nolock+0x24f/0x400
[2831529.979539] [<ffffffff80461fd9>] unix_stream_recvmsg+0x269/0x5d0
[2831529.979543] [<ffffffff80274904>] generic_file_aio_write+0x64/0xd0
[2831529.979552] [<ffffffff880a9663>] :ext3:ext3_file_write+0x23/0xc0
[2831529.979558] [<ffffffff880a9640>] :ext3:ext3_file_write+0x0/0xc0
[2831529.979561] [<ffffffff8029d6bb>] do_sync_readv_writev+0xcb/0x110
[2831529.979565] [<ffffffff8024cc20>] autoremove_wake_function+0x0/0x30
[2831529.979568] [<ffffffff8029d8f9>] do_sync_read+0xd9/0x120
[2831529.979571] [<ffffffff8029a30c>] __kmalloc+0x13c/0x160
[2831529.979574] [<ffffffff8029de5d>] do_readv_writev+0xfd/0x230
[2831529.979577] [<ffffffff8046ffea>] schedule_timeout+0x5a/0xd0
[2831529.979579] [<ffffffff80470349>] mutex_lock+0x9/0x20
[2831529.979582] [<ffffffff802ce5e5>] sys_epoll_wait+0x245/0x4e0
[2831529.979586] [<ffffffff8029e4d3>] sys_writev+0x53/0xc0
[2831529.979589] [<ffffffff8020c698>] system_call+0x68/0x6d
[2831529.979591] [<ffffffff8020c630>] system_call+0x0/0x6d
[2831529.979593]
[2831529.979594]
[2831529.979595] Code: 49 8b 52 08 49 89 d3 eb c4 4c 89 ...

Read more...

Torsten Krah (tkrah) wrote :

It also does need this patch:

http://www.gossamer-threads.com/lists/linux/kernel/954043#954043
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.1

commit a6b79bb88e6682d2739aa5b4db7184038bbb32ce
Author: Linus Torvalds <email address hidden>
Date: Wed Jul 30 22:20:18 2008 +0000

    Fix off-by-one error in iov_iter_advance()

    commit 94ad374a0751f40d25e22e036c37f7263569d24c upstream

    The iov_iter_advance() function would look at the iov->iov_len entry
    even though it might have iterated over the whole array, and iov was
    pointing past the end. This would cause DEBUG_PAGEALLOC to trigger a
    kernel page fault if the allocation was at the end of a page, and the
    next page was unallocated.

    The quick fix is to just change the order of the tests: check that there
    is any iovec data left before we check the iov entry itself.

    Thanks to Alexey Dobriyan for finding this case, and testing the fix.

    Reported-and-tested-by: Alexey Dobriyan <email address hidden>
    Cc: Nick Piggin <email address hidden>
    Cc: Andrew Morton <email address hidden>
    Signed-off-by: Linus Torvalds <email address hidden>
    Signed-off-by: Greg Kroah-Hartman <email address hidden>

deti (deti) wrote :

Ok, you mean the patch attached. Will do a kernel build and give it a try. Does anyone else need x86_64 generic and xen kernels for testing?

Deti

Torsten Krah (tkrah) wrote :

Yeah, this is the one from commit a6b79bb88e6682d2739aa5b4db7184038bbb32ce.
I am interested in x86_x64 latest xen build too, did not rebuild stuff yet - only searched what's needed yet ;)

deti (deti) wrote :

You can find my builds here:

http://www.fliegl.de/download/ubuntu/

deti (deti) wrote :

After some tests: I was not able to reproduce any oops. The issue seems to be fixed by these two patches.
Now could please anyone from ubuntu review and include these fixes into upcoming kernels?

deti (deti) on 2008-08-07
Changed in linux:
status: New → Confirmed
status: Confirmed → Fix Committed
Download full text (6.4 KiB)

I think bug #249340 may be related to this one.

I've just run the same version of localedef on 2.6.22-14-generic, where it runs fine, and on 2.6.22-15-generic, where it hangs.

Here's the output of "strace localedef" immediately before it hung:

1218150691.384821 creat("/usr/lib/locale/en_NZ.utf8/LC_CTYPE", 0666) = 3
1218150691.403450 writev(3, [{"\x15\x11\x03\x20\x58\x00\x00\x00", 8}, {"\x68\x01\x00\x00\x68\x04\x00\x00\x68\x0a\x00\x00\x68\x0a"..., 352}, {"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 768}, {"\x80\x00\x00\x00\x81\x00\x00\x00\x82\x00\x00\x00\x83\x00"..., 1536}, {NULL, 0}, {"\x80\x00\x00\x00\x81\x00\x00\x00\x82\x00\x00\x00\x83\x00"..., 1536}, {NULL, 0}, {"\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00"..., 1024}, {NULL, 0}, {NULL, 0}, {NULL, 0}, {NULL, 0}, {"\x75\x70\x70\x65\x72\x00", 6}, {"\x6c\x6f\x77\x65\x72\x00", 6}, {"\x61\x6c\x70\x68\x61\x00", 6}, {"\x64\x69\x67\x69\x74\x00", 6}, {"\x78\x64\x69\x67\x69\x74\x00", 7}, {"\x73\x70\x61\x63\x65\x00", 6}, {"\x70\x72\x69\x6e\x74\x00", 6}, {"\x67\x72\x61\x70\x68\x00", 6}, {"\x62\x6c\x61\x6e\x6b\x00", 6}, {"\x63\x6e\x74\x72\x6c\x00", 6}, {"\x70\x75\x6e\x63\x74\x00", 6}, {"\x61\x6c\x6e\x75\x6d\x00", 6}, {"\x63\x6f\x6d\x62\x69\x6e\x69\x6e\x67\x00", 10}, {"\x63\x6f\x6d\x62\x69\x6e\x69\x6e\x67\x5f\x6c\x65\x76\x65"..., 17}, {"\x00\x00\x00\x00", 4}, {"\x74\x6f\x75\x70\x70\x65\x72\x00", 8}, {"\x74\x6f\x6c\x6f\x77\x65\x72\x00", 8}, {"\x74\x6f\x74\x69\x74\x6c\x65\x00", 8}, {"\x00\x00\x00\x00", 4}, {"\x10\x00\x00\x00\x11\x00\x00\x00\x07\x00\x00\x00\xff\x01"..., 25560}, ...], 125

(Note the "{NULL, 0}" elements.)

Here's the relevant part of the diff for mm/file:
--- linux-source-2.6.22-2.6.22.orig/mm/filemap.c
+++ linux-source-2.6.22-2.6.22/mm/filemap.c
@@ -2146,22 +2146,9 @@
                }

                status = a_ops->prepare_write(file, page, offset, offset+bytes);
- if (unlikely(status)) {
- loff_t isize = i_size_read(inode);
+ if (unlikely(status))
+ goto fs_write_aop_error;

- if (status != AOP_TRUNCATED_PAGE)
- unlock_page(page);
- page_cache_release(page);
- if (status == AOP_TRUNCATED_PAGE)
- continue;
- /*
- * prepare_write() may have instantiated a few blocks
- * outside i_size. Trim these off again.
- */
- if (pos + bytes > isize)
- vmtruncate(inode, isize);
- break;
- }
                if (likely(nr_segs == 1))
                        copied = filemap_copy_from_user(page, offset,
                                                        buf, bytes);
@@ -2170,41 +2157,54 @@
                                                cur_iov, iov_base, bytes);
                flush_dcache_page(page);
                status = a_ops->commit_write(file, page, offset, offset+bytes);
- if (status == AOP_TRUNCATED_PAGE) {
- page_cache_release(page);
- ...

Read more...

Stefan Bader (smb) wrote :

I uploaded a Hardy kernel to my PPA at https://launchpad.net/~stefan-bader-canonical/+archive
It is currently building (-21.42smb1) but if it completes, could you please verify whether the problem is fixed for you? Thanks.

Changed in linux:
assignee: nobody → stefan-bader-canonical
importance: Undecided → Medium
status: New → In Progress

Stefan Bader wrote:
> I uploaded a Hardy kernel to my PPA at https://launchpad.net/~stefan-bader-canonical/+archive
> It is currently building (-21.42smb1) but if it completes, could you please verify whether the problem is fixed for you? Thanks.
>
> ** Changed in: linux (Ubuntu Hardy)
> Importance: Undecided => Medium
> Assignee: (unassigned) => Stefan Bader (stefan-bader-canonical)
> Status: New => In Progress
>
Your build did not succeed:
Checking ABI for generic...previous or current ABI file missing!
    /build/buildd/linux-2.6.24/debian/abi/2.6.24-21.42smb1/amd64/generic
    /build/buildd/linux-2.6.24/debian/abi/2.6.24-21.42/amd64/generic
make: *** [abi-check-generic] Error 1
dpkg-buildpackage: failure: /usr/bin/fakeroot debian/rules binary-arch
gave error exit status 2

Deti

Stefan Bader (smb) wrote :

Uploaded revised build (amd64 is done already) but waiting for this to finish.

deti (deti) wrote :

Have a system running 2.6.24-21-xen fine now for 12 hours. Any other
reports?

Stefan Bader (smb) wrote :

SRU justification:

Impact: iov_iter_advance() skips over zero-length iovecs, however it does not properly terminate at the end of the iovec array. This leads to kernel crashed under this circumstances.

Fix: Check i->count before skipping zero length iov. And also include a fixup to check whther already iteraded over the whole array. One fix comes from the 2.6.24.y stable tree, the other from the 2.6.26.y stable tree.

Testcase: see bug report.

Stefan Bader (smb) wrote :

commit 8c9a1f5a9c5be826db0ad9af5db6bf373452024e
    Fix off-by-one error in iov_iter_advance()
commit 640b5c6dbe62ecf5ce9efd936273deb25afc7b27
    iov_iter_advance() fix

Changed in linux:
status: In Progress → Fix Committed
Martin Pitt (pitti) wrote :

linux 2.6.24-21 copied to hardy-updates.

Changed in linux:
status: Fix Committed → Fix Released
Ian Taylor (ibtaylor) wrote :

Has this really been resolved? I tried 2.6.24-21-xen and it still occurs.

Is there any known workaround?

Should I use an older kernel before 2.6.22-15 where it seems to have been introduced (according to Martin Kealey above)?

Stefan Bader (smb) wrote :

For Intrepid it is released

Changed in linux:
status: Fix Committed → Fix Released
Stefan Bader (smb) wrote :

For Hardy unfortunately not, yet. It will come with the next updates.

Changed in linux:
status: Fix Released → Fix Committed
Martin Pitt (pitti) wrote :

Accepted linux into hardy-proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Launchpad Janitor (janitor) wrote :
Download full text (12.0 KiB)

This bug was fixed in the package linux - 2.6.24-23.46

---------------
linux (2.6.24-23.46) hardy-proposed; urgency=low

  [Alessio Igor Bogani]

  * rt: Updated PREEMPT_RT support to rt21
    - LP: #302138

  [Amit Kucheria]

  * SAUCE: Update lpia patches from moblin tree
    - LP: #291457

  [Andy Whitcroft]

  * SAUCE: replace gfs2_bitfit with upstream version to prevent oops
    - LP: #276641

  [Colin Ian King]

  * isdn: Do not validate ISDN net device address prior to interface-up
    - LP: #237306
  * hwmon: (coretemp) Add Penryn CPU to coretemp
    - LP: #235119
  * USB: add support for Motorola ROKR Z6 cellphone in mass storage mode
    - LP: #263217
  * md: fix an occasional deadlock in raid5
    - LP: #208551

  [Stefan Bader]

  * SAUCE: buildenv: Show CVE entries in printchanges
  * SAUCE: buildenv: Send git-ubuntu-log informational message to stderr
  * Xen: dma: avoid unnecessarily SWIOTLB bounce buffering
    - LP: #247148
  * Update openvz patchset to apply to latest stable tree.
    - LP: #301634
  * XEN: Fix FTBS with stable updates
    - LP: #301634

  [Steve Conklin]

  * Add HID quirk for dual USB gamepad
    - LP: #140608

  [Tim Gardner]

  * Enable CONFIG_AX25_DAMA_SLAVE=y
    - LP: #257684
  * SAUCE: Correctly blacklist Thinkpad r40e in ACPI
    - LP: #278794
  * SAUCE: ALPS touchpad for Dell Latitude E6500/E6400
    - LP: #270643

  [Upstream Kernel Changes]

  * Revert "[Bluetooth] Eliminate checks for impossible conditions in IRQ
    handler"
    - LP: #217659
  * KVM: VMX: Clear CR4.VMXE in hardware_disable
    - LP: #268981
  * iov_iter_advance() fix
    - LP: #231746
  * Fix off-by-one error in iov_iter_advance()
    - LP: #231746
  * USB: serial: ch341: New VID/PID for CH341 USB-serial
    - LP: #272485
  * x86: Fix 32-bit x86 MSI-X allocation leakage
    - LP: #273103
  * b43legacy: Fix failure in rate-adjustment mechanism
    - LP: #273143
  * x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
    - LP: #276334
  * openvz: merge missed fixes from vanilla 2.6.24 openvz branch
    - LP: #298059
  * openvz: some autofs related fixes
    - LP: #298059
  * openvz: fix ve stop deadlock after nfs connect
    - LP: #298059
  * openvz: fix netlink and rtnl inside container
    - LP: #298059
  * openvz: fix wrong size of ub0_percpu
    - LP: #298059
  * openvz: fix OOPS while stopping VE started before binfmt_misc.ko loaded
    - LP: #298059
  * x86-64: Fix "bytes left to copy" return value for copy_from_user()
  * NET: Fix race in dev_close(). (Bug 9750)
    - LP: #301608
  * IPV6: Fix IPsec datagram fragmentation
    - LP: #301608
  * IPV6: dst_entry leak in ip4ip6_err.
    - LP: #301608
  * IPV4: Remove IP_TOS setting privilege checks.
    - LP: #301608
  * IPCONFIG: The kernel gets no IP from some DHCP servers
    - LP: #301608
  * IPCOMP: Disable BH on output when using shared tfm
    - LP: #301608
  * IRQ_NOPROBE helper functions
    - LP: #301608
  * MIPS: Mark all but i8259 interrupts as no-probe.
    - LP: #301608
  * ub: fix up the conversion to sg_init_table()
    - LP: #301608
  * x86: adjust enable_NMI_through_LVT0()
    - LP: #301608
  * SCSI ips: handle scsi_add_host() failure, and other err cl...

Changed in linux:
status: Fix Committed → Fix Released

deti, since you are the original bug reporter, it would be great to get confirmation from you that this newer kernel does indeed fix the bug you had reported here. Thanks.

deti (deti) wrote :

Tested it, works for me. Thanks.

Deti

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers