Bug #1704102 “bonding: stack dump when unregistering a netdev” : Artful (17.10) : Bugs : linux package : Ubuntu

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2017-07-13: Missing required logs.

#1

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1704102

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Joseph Salisbury (jsalisbury) on 2017-07-13

Changed in linux (Ubuntu):
importance:	Undecided → Medium
status:	Incomplete → Triaged
tags:	added: kernel-da-key

Revision history for this message

Joseph Salisbury (jsalisbury) wrote on 2017-07-13:

#2

I built an Artful test kernel with commit f51048c3e07b. The test kernel can be downloaded from:
http://kernel.ubuntu.com/~jsalisbury/lp1704102/

Can you test this kernel and see if it resolves this bug?

Also, what other releases require this commit?

Changed in linux (Ubuntu):
status:	Triaged → In Progress
assignee:	nobody → Joseph Salisbury (jsalisbury)

Revision history for this message

Nicolas Dichtel (nicolas-dichtel) wrote on 2017-07-13:

#3

This bug was found on ubuntu 16.04.

I don't reproduce the bug with your Artful kernel.

Joseph Salisbury (jsalisbury) on 2017-07-14

Changed in linux (Ubuntu Zesty):
status:	New → In Progress
Changed in linux (Ubuntu Yakkety):
status:	New → In Progress
Changed in linux (Ubuntu Xenial):
status:	New → In Progress
Changed in linux (Ubuntu Yakkety):
importance:	Undecided → Medium
Changed in linux (Ubuntu Zesty):
importance:	Undecided → Medium
Changed in linux (Ubuntu Xenial):
importance:	Undecided → Medium
Changed in linux (Ubuntu Zesty):
assignee:	nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Yakkety):
assignee:	nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Xenial):
assignee:	nobody → Joseph Salisbury (jsalisbury)

Seth Forshee (sforshee) on 2017-07-17

Changed in linux (Ubuntu Artful):
status:	In Progress → Fix Committed

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-07-26: Closing unsupported series nomination.

#4

This bug was nominated against a series that is no longer supported, ie yakkety. The bug task representing the yakkety nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu Yakkety):
status:	In Progress → Won't Fix

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-08-10:

#5

Download full text (24.9 KiB)

This bug was fixed in the package linux - 4.11.0-13.19

---------------
linux (4.11.0-13.19) artful; urgency=low

* CVE-2017-7533
- dentry name snapshots

linux (4.11.0-12.18) artful; urgency=low

* linux: 4.11.0-12.18 -proposed tracker (LP: #1707635)
- no change rebuild to pick up the new binutils.

  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
    - [Packaging] tests -- reduce rebuild test to one flavour
    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter

* [ARM64] config EDAC_GHES=y depends on EDAC_MM_EDAC=y (LP: #1706141)
- [Config] set EDAC_MM_EDAC=y for ARM64

  * [Hyper-V] hv_netvsc: Exclude non-TCP port numbers from vRSS hashing
    (LP: #1690174)
    - hv_netvsc: Exclude non-TCP port numbers from vRSS hashing

* ath10k doesn't report full RSSI information (LP: #1706531)
- ath10k: add per chain RSSI reporting

* ideapad_laptop don't support v310-14isk (LP: #1705378)
- platform/x86: ideapad-laptop: Add several models to no_hw_rfkill

  * Ubuntu 16.04.3: Qemu fails on P9 (LP: #1686019)
    - KVM: PPC: Pass kvm* to kvmppc_find_table()
    - KVM: PPC: Use preregistered memory API to access TCE list
    - KVM: PPC: VFIO: Add in-kernel acceleration for VFIO
    - powerpc/powernv/iommu: Add real mode version of iommu_table_ops::exchange()
    - powerpc/iommu/vfio_spapr_tce: Cleanup iommu_table disposal
    - powerpc/vfio_spapr_tce: Add reference counting to iommu_table
    - powerpc/mmu: Add real mode support for IOMMU preregistered memory
    - KVM: PPC: Reserve KVM_CAP_SPAPR_TCE_VFIO capability number
    - KVM: PPC: Book3S HV: Add radix checks in real-mode hypercall handlers

* hns: ethtool selftest crashes system (LP: #1705712)
- net/hns:bugfix of ethtool -t phy self_test

  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
    (LP: #1673564)
    - KVM: arm/arm64: vgic-v3: Use PREbits to infer the number of ICH_APxRn_EL2
      registers
    - KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction
    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
    - arm64: Add MIDR values for Cavium cn83XX SoCs
    - arm64: Add wor...

This bug was fixed in the package linux - 4.11.0-13.19

---------------
linux (4.11.0-13.19) artful; urgency=low

* CVE-2017-7533
    - dentry name snapshots

linux (4.11.0-12.18) artful; urgency=low

* linux: 4.11.0-12.18 -proposed tracker (LP: #1707635)
    - no change rebuild to pick up the new binutils.

* Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
    - [Packaging] tests -- reduce rebuild test to one flavour
    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter

* [ARM64] config EDAC_GHES=y depends on EDAC_MM_EDAC=y (LP: #1706141)
    - [Config] set EDAC_MM_EDAC=y for ARM64

* [Hyper-V] hv_netvsc: Exclude non-TCP port numbers from vRSS hashing
    (LP: #1690174)
    - hv_netvsc: Exclude non-TCP port numbers from vRSS hashing

* ath10k doesn't report full RSSI information (LP: #1706531)
    - ath10k: add per chain RSSI reporting

* ideapad_laptop don't support v310-14isk (LP: #1705378)
    - platform/x86: ideapad-laptop: Add several models to no_hw_rfkill

* Ubuntu 16.04.3: Qemu fails on P9 (LP: #1686019)
    - KVM: PPC: Pass kvm* to kvmppc_find_table()
    - KVM: PPC: Use preregistered memory API to access TCE list
    - KVM: PPC: VFIO: Add in-kernel acceleration for VFIO
    - powerpc/powernv/iommu: Add real mode version of iommu_table_ops::exchange()
    - powerpc/iommu/vfio_spapr_tce: Cleanup iommu_table disposal
    - powerpc/vfio_spapr_tce: Add reference counting to iommu_table
    - powerpc/mmu: Add real mode support for IOMMU preregistered memory
    - KVM: PPC: Reserve KVM_CAP_SPAPR_TCE_VFIO capability number
    - KVM: PPC: Book3S HV: Add radix checks in real-mode hypercall handlers

* hns: ethtool selftest crashes system (LP: #1705712)
    - net/hns:bugfix of ethtool -t phy self_test

* ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
    (LP: #1673564)
    - KVM: arm/arm64: vgic-v3: Use PREbits to infer the number of ICH_APxRn_EL2
      registers
    - KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction
    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
    - arm64: Add MIDR values for Cavium cn83XX SoCs
    - arm64: Add workaround for Cavium Thunder erratum 30115
    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
    - arm64: KVM: Make unexpected reads from WO registers inject an undef
    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access

* ath9k freezes suspend resume Ubuntu 17.04 (LP: #1697027)
    - ath9k: fix an invalid pointer dereference in ath9k_rng_stop()

* xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2
    comp_code 13 (LP: #1667750)
    - xhci: Bad Ethernet performance plugged in ASM1042A host

* Migrating KSM page causes the VM lock up as the KSM page merging list is too
    large (LP: #1680513)
    - ksm: introduce ksm_max_page_sharing per page deduplication limit
    - ksm: fix use after free with merge_across_nodes = 0
    - ksm: cleanup stable_node chain collapse case
    - ksm: swap the two output parameters of chain/chain_prune
    - ksm: optimize refile of stable_node_dup at the head of the chain

* Artful update to v4.11.12 stable release (LP: #1706067)
    - net/phy: micrel: configure intterupts after autoneg workaround
    - ipv6: avoid unregistering inet6_dev for loopback
    - netvsc: don't access netdev->num_rx_queues directly
    - sfc: Fix MCDI command size for filter operations
    - net: account for current skb length when deciding about UFO
    - net: dp83640: Avoid NULL pointer dereference.
    - tcp: reset sk_rx_dst in tcp_disconnect()
    - net: prevent sign extension in dev_get_stats()
    - virtio-net: serialize tx routine during reset
    - net: sched: Fix one possible panic when no destroy callback
    - mlxsw: spectrum_router: Fix NULL pointer dereference
    - rocker: move dereference before free
    - bpf: prevent leaking pointer via xadd on unpriviledged
    - net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
    - net/mlx5: Cancel delayed recovery work when unloading the driver
    - net/mlx5e: Fix TX carrier errors report in get stats ndo
    - ipv6: dad: don't remove dynamic addresses if link is down
    - vxlan: fix hlist corruption
    - geneve: fix hlist corruption
    - net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
    - liquidio: fix bug in soft reset failure detection
    - net: ipv6: Compare lwstate in detecting duplicate nexthops
    - vrf: fix bug_on triggered by rx when destroying a vrf
    - rds: tcp: use sock_create_lite() to create the accept socket
    - net/mlx5e: Initialize CEE's getpermhwaddr address buffer to 0xff
    - cxgb4: fix BUG() on interrupt deallocating path of ULD
    - tap: convert a mutex to a spinlock
    - bridge: mdb: fix leak on complete_info ptr on fail path
    - brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
    - sfc: don't read beyond unicast address list
    - Adding asm-prototypes.h for genksyms to generate crc
    - sed regex in Makefile.build requires line break between exported symbols
    - Adding the type of exported symbols
    - sparc64: Fix gup_huge_pmd
    - block: Fix a blk_exit_rl() regression
    - brcmfmac: Fix a memory leak in error handling path in
      'brcmf_cfg80211_attach'
    - brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
    - efi: Process the MEMATTR table only if EFI_MEMMAP is enabled
    - cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
    - cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
    - cfg80211: Check if PMKID attribute is of expected size
    - cfg80211: Check if NAN service ID is of expected size
    - drm/amdgpu/gfx6: properly cache mc_arb_ramcfg
    - irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
    - parisc: Report SIGSEGV instead of SIGBUS when running out of stack
    - parisc: use compat_sys_keyctl()
    - parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
    - parisc/mm: Ensure IRQs are off in switch_mm()
    - tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/:
      Depth
    - thp, mm: fix crash due race in MADV_FREE handling
    - kernel/extable.c: mark core_kernel_text notrace
    - mm/list_lru.c: fix list_lru_count_node() to be race free
    - fs/dcache.c: fix spin lockup issue on nlru->lock
    - checkpatch: silence perl 5.26.0 unescaped left brace warnings
    - binfmt_elf: use ELF_ET_DYN_BASE only for PIE
    - arm: move ELF_ET_DYN_BASE to 4MB
    - arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
    - powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
    - s390: reduce ELF_ET_DYN_BASE
    - exec: Limit arg stack to at most 75% of _STK_LIM
    - powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR
    - ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
    - arm64: Preventing READ_IMPLIES_EXEC propagation
    - vt: fix unchecked __put_user() in tioclinux ioctls
    - rcu: Add memory barriers for NOCB leader wakeup
    - nvmem: core: fix leaks on registration errors
    - Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page
    - mnt: In umount propagation reparent in a separate pass
    - mnt: In propgate_umount handle visiting mounts in any order
    - mnt: Make propagate_umount less slow for overlapping mount propagation trees
    - selftests/capabilities: Fix the test_execve test
    - mm: fix overflow check in expand_upwards()
    - crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
    - crypto: atmel - only treat EBUSY as transient if backlog
    - crypto: sha1-ssse3 - Disable avx2
    - crypto: caam - properly set IV after {en,de}crypt
    - crypto: caam - fix signals handling
    - sched/fair, cpumask: Export for_each_cpu_wrap()
    - sched/topology: Fix building of overlapping sched-groups
    - sched/topology: Optimize build_group_mask()
    - sched/topology: Fix overlapping sched_group_mask
    - PM / wakeirq: Convert to SRCU
    - ALSA: x86: Clear the pdata.notify_lpe_audio pointer before teardown
    - PM / QoS: return -EINVAL for bogus strings
    - kvm: vmx: Do not disable intercepts for BNDCFGS
    - kvm: x86: Guest BNDCFGS requires guest MPX support
    - kvm: vmx: Check value written to IA32_BNDCFGS
    - kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
    - Linux 4.11.12

* Artful update to v4.11.11 stable release (LP: #1706066)
    - mqueue: fix a use-after-free in sys_mq_notify()
    - proc: Fix proc_sys_prune_dcache to hold a sb reference
    - locking/rwsem-spinlock: Fix EINTR branch in __down_write_common()
    - staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
    - staging: comedi: fix clean-up of comedi_class in comedi_init()
    - crypto: caam - fix gfp allocation flags (part I)
    - crypto: rsa-pkcs1pad - use constant time memory comparison for MACs
    - ext4: check return value of kstrtoull correctly in reserved_clusters_store
    - x86/mm/pat: Don't report PAT on CPUs that don't support it
    - Linux 4.11.11

* Change CONFIG_IBMVETH to module (LP: #1704479)
    - [Config] CONFIG_IBMVETH=m

* hns: use after free in hns_nic_net_xmit_hw (LP: #1704885)
    - net: hns: Fix a skb used after free bug

* Opal and POWER9 DD2 (LP: #1702159)
    - powerpc/powernv: Fix boot on Power8 bare metal due to opal_configure_cores()

* CVE-2017-1000364
    - mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack
    - mm/mmap.c: expand_downwards: don't require the gap if !vm_prev

* [Xenial] nvme: Quirks for PM1725 controllers (LP: #1704435)
    - nvme: Quirks for PM1725 controllers

* bonding: stack dump when unregistering a netdev (LP: #1704102)
    - bonding: avoid NETDEV_CHANGEMTU event when unregistering slave

* Ubuntu 16.04 IOB Error when the Mustang board rebooted (LP: #1693673)
    - drivers: net: xgene: Fix redundant prefetch buffer cleanup

* Ubuntu16.04: NVMe 4K+T10 DIF/DIX format returns I/O error on dd with split
    op (LP: #1689946)
    - blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split
      op

* linux >= 4.2: bonding 802.3ad does not work with 5G, 25G and 50G link speeds
    (LP: #1697892)
    - bonding: add 802.3ad support for 25G speeds
    - bonding: fix 802.3ad support for 5G and 50G speeds

* hns: under heavy load, NIC may fail and require reboot (LP: #1704146)
    - net: hns: Bugfix for Tx timeout handling in hns driver

* New ACPI identifiers for ThunderX SMMU (LP: #1703437)
    - iommu/arm-smmu: Plumb in new ACPI identifiers

* Transparent hugepages should default to enabled=madvise (LP: #1703742)
    - [Config] use CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y as default

* Miscellaneous Ubuntu changes
    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y

* Miscellaneous upstream changes
    - platform/x86: thinkpad_acpi: guard generic hotkey case
    - platform/x86: thinkpad_acpi: add mapping for new hotkeys
    - selftest/memfd/Makefile: Fix build error

linux (4.11.0-11.16) artful; urgency=low

* linux: 4.11.0-11.16 -proposed tracker (LP: #1703901)

* Artful update to v4.11.10 stable release (LP: #1703854)
    - fs: add a VALID_OPEN_FLAGS
    - fs: completely ignore unknown open flags
    - driver core: platform: fix race condition with driver_override
    - RDMA/uverbs: Check port number supplied by user verbs cmds
    - ceph: choose readdir frag based on previous readdir reply
    - tracing/kprobes: Allow to create probe with a module name starting with a
      digit
    - usb: dwc3: replace %p with %pK
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - Add USB quirk for HVR-950q to avoid intermittent device resets
    - usb: usbip: set buffer pointers to NULL after free
    - usb: Fix typo in the definition of Endpoint[out]Request
    - USB: core: fix device node leak
    - arm: remove wrong CONFIG_PROC_SYSCTL ifdef
    - pinctrl: sh-pfc: r8a7794: Swap ATA signals
    - pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data
    - pinctrl: sh-pfc: r8a7791: Add missing DVC_MUTE signal
    - pinctrl: sh-pfc: r8a7795: Fix hscif2_clk_b and hscif4_ctrl
    - pinctrl: meson: meson8b: fix the NAND DQS pins
    - pinctrl: stm32: Fix bad function call
    - pinctrl: sunxi: Fix SPDIF function name for A83T
    - pinctrl: core: Fix warning by removing bogus code
    - pinctrl: mxs: atomically switch mux and drive strength config
    - pinctrl: sh-pfc: r8a7791: Add missing HSCIF1 pinmux data
    - pinctrl: sh-pfc: Update info pointer after SoC-specific init
    - USB: serial: option: add two Longcheer device ids
    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
    - xhci: Limit USB2 port wake support for AMD Promontory hosts
    - gfs2: Fix glock rhashtable rcu bug
    - Add "shutdown" to "struct class".
    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
    - tpm: fix a kernel memory leak in tpm-sysfs.c
    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
    - xen: avoid deadlock in xenbus driver
    - crypto: drbg - Fixes panic in wait_for_completion call
    - rt286: add Thinkpad Helix 2 to force_combo_jack_table
    - Linux 4.11.10

* CVE-2017-10810
    - drm/virtio: don't leak bo on drm_gem_object_init failure

* cxlflash update request in the Xenial SRU stream (LP: #1702521)
    - scsi: cxlflash: Separate RRQ processing from the RRQ interrupt handler
    - scsi: cxlflash: Serialize RRQ access and support offlevel processing
    - scsi: cxlflash: Implement IRQ polling for RRQ processing
    - scsi: cxlflash: Update sysfs helper routines to pass config structure
    - scsi: cxlflash: Support dynamic number of FC ports
    - scsi: cxlflash: Remove port configuration assumptions
    - scsi: cxlflash: Hide FC internals behind common access routine
    - scsi: cxlflash: SISlite updates to support 4 ports
    - scsi: cxlflash: Support up to 4 ports
    - scsi: cxlflash: Fence EEH during probe
    - scsi: cxlflash: Remove unnecessary DMA mapping
    - scsi: cxlflash: Fix power-of-two validations
    - scsi: cxlflash: Fix warnings/errors
    - scsi: cxlflash: Improve asynchronous interrupt processing
    - scsi: cxlflash: Support multiple hardware queues
    - scsi: cxlflash: Add hardware queues attribute
    - scsi: cxlflash: Introduce hardware queue steering
    - cxl: Enable PCI device IDs for future IBM CXL adapters
    - scsi: cxlflash: Select IRQ_POLL
    - scsi: cxlflash: Combine the send queue locks
    - scsi: cxlflash: Update cxlflash_afu_sync() to return errno
    - scsi: cxlflash: Reset hardware queue context via specified register
    - scsi: cxlflash: Schedule asynchronous reset of the host
    - scsi: cxlflash: Handle AFU sync failures
    - scsi: cxlflash: Track pending scsi commands in each hardware queue
    - scsi: cxlflash: Flush pending commands in cleanup path
    - scsi: cxlflash: Add scsi command abort handler
    - scsi: cxlflash: Create character device to provide host management interface
    - scsi: cxlflash: Separate AFU internal command handling from AFU sync
      specifics
    - scsi: cxlflash: Introduce host ioctl support
    - scsi: cxlflash: Refactor AFU capability checking
    - scsi: cxlflash: Support LUN provisioning
    - scsi: cxlflash: Support AFU debug
    - scsi: cxlflash: Support WS16 unmap
    - scsi: cxlflash: Remove zeroing of private command data
    - scsi: cxlflash: Update TMF command processing
    - scsi: cxlflash: Avoid double free of character device
    - scsi: cxlflash: Update send_tmf() parameters
    - scsi: cxlflash: Update debug prints in reset handlers

* make snap-pkg support (LP: #1700747)
    - make snap-pkg support

* Quirk for non-compliant PCI bridge on HiSilicon D05 board (LP: #1698706)
    - SAUCE: PCI: Support hibmc VGA cards behind a misbehaving HiSilicon bridge

* arm64: fix crash reading /proc/kcore (LP: #1702749)
    - fs/proc: kcore: use kcore_list type to check for vmalloc/module address
    - arm64: mm: select CONFIG_ARCH_PROC_KCORE_TEXT

* Opal and POWER9 DD2 (LP: #1702159)
    - SAUCE: powerpc/powernv: Tell OPAL about our MMU mode on POWER9

* Data corruption with hio driver  (LP: #1701316)
    - SAUCE: hio: Fix incorrect use of enum req_opf values

* Artful update to v4.11.9 stable release (LP: #1702515)
    - net: don't call strlen on non-terminated string in dev_set_alias()
    - net: Fix inconsistent teardown and release of private netdev state.
    - net: s390: fix up for "Fix inconsistent teardown and release of private
      netdev state"
    - mac80211: free netdev on dev_alloc_name() error
    - decnet: dn_rtmsg: Improve input length sanitization in
      dnrmg_receive_user_skb
    - net: Zero ifla_vf_info in rtnl_fill_vfinfo()
    - net: ipv6: Release route when device is unregistering
    - net: vrf: Make add_fib_rules per network namespace flag
    - af_unix: Add sockaddr length checks before accessing sa_family in bind and
      connect handlers
    - Fix an intermittent pr_emerg warning about lo becoming free.
    - sctp: disable BH in sctp_for_each_endpoint
    - net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
    - net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
    - net/mlx5: Remove several module events out of ethtool stats
    - net/mlx5e: Added BW check for DIM decision mechanism
    - net/mlx5e: Fix wrong indications in DIM due to counter wraparound
    - net/mlx5: Enable 4K UAR only when page size is bigger than 4K
    - proc: snmp6: Use correct type in memset
    - igmp: acquire pmc lock for ip_mc_clear_src()
    - igmp: add a missing spin_lock_init()
    - qmi_wwan: new Telewell and Sierra device IDs
    - net: don't global ICMP rate limit packets originating from loopback
    - ipv6: fix calling in6_ifa_hold incorrectly for dad work
    - sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
    - net/mlx5e: Fix min inline value for VF rep SQs
    - net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
    - net/mlx5: Wait for FW readiness before initializing command interface
    - net/mlx5e: Fix timestamping capabilities reporting
    - decnet: always not take dst->__refcnt when inserting dst into hash table
    - net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
    - ipv6: Do not leak throw route references
    - rtnetlink: add IFLA_GROUP to ifla_policy
    - netfilter: synproxy: fix conntrackd interaction
    - NFSv4.x/callback: Create the callback service through svc_create_pooled
    - xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
    - MIPS: head: Reorder instructions missing a delay slot
    - MIPS: Avoid accidental raw backtrace
    - MIPS: pm-cps: Drop manual cache-line alignment of ready_count
    - MIPS: Fix IRQ tracing & lockdep when rescheduling
    - ALSA: hda - Fix endless loop of codec configure
    - ALSA: hda - set input_path bitmap to zero after moving it to new place
    - NFSv4.2: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask
    - NFSv4.1: Fix a race in nfs4_proc_layoutget
    - Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind"
    - ovl: copy-up: don't unlock between lookup and link
    - gpiolib: fix filtering out unwanted events
    - x86/intel_rdt: Fix memory leak on mount failure
    - perf/x86/intel/uncore: Fix wrong box pointer check
    - drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
    - dm thin: do not queue freed thin mapping for next stage processing
    - x86/mm: Fix boot crash caused by incorrect loop count calculation in
      sync_global_pgds()
    - mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
    - xen/blkback: don't free be structure too early
    - xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish
    - xfrm: move xfrm_garbage_collect out of xfrm_policy_flush
    - xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
    - xfrm: NULL dereference on allocation failure
    - xfrm: Oops on error in pfkey_msg2xfrm_state()
    - watchdog: bcm281xx: Fix use of uninitialized spinlock.
    - ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path
    - ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
    - ARM: 8685/1: ensure memblock-limit is pmd-aligned
    - ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init'
    - ARM: davinci: PM: Do not free useful resources in normal path in
      'davinci_pm_init'
    - tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel
    - Revert "x86/entry: Fix the end of the stack for newly forked tasks"
    - x86/mshyperv: Remove excess #includes from mshyperv.h
    - x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug
    - perf/x86: Fix spurious NMI with PEBS Load Latency event
    - x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
    - x86/mm: Fix flush_tlb_page() on Xen
    - ocfs2: o2hb: revert hb threshold to keep compatible
    - ocfs2: fix deadlock caused by recursive locking in xattr
    - iommu/dma: Don't reserve PCI I/O windows
    - iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
    - iommu/amd: Fix interrupt remapping when disable guest_mode
    - infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data
    - mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program
    - mtd: nand: fsmc: fix NAND width handling
    - KVM: x86: fix emulation of RSM and IRET instructions
    - KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
    - KVM: x86: zero base3 of unusable segments
    - KVM: nVMX: Fix exception injection
    - esp4: Fix udpencap for local TCP packets.
    - hsi: Fix build regression due to netdev destructor fix.
    - Linux 4.11.9

* update ENA driver to 1.2.0k from net-next (LP: #1701575)
    - net/ena: switch to pci_alloc_irq_vectors
    - net: ena: fix rare uncompleted admin command false alarm
    - net: ena: fix bug that might cause hang after consecutive open/close
      interface.
    - net: ena: add missing return when ena_com_get_io_handlers() fails
    - net: ena: fix race condition between submit and completion admin command
    - net: ena: add missing unmap bars on device removal
    - net: ena: fix theoretical Rx hang on low memory systems
    - net: ena: disable admin msix while working in polling mode
    - net: ena: bug fix in lost tx packets detection mechanism
    - net: ena: update ena driver to version 1.1.7
    - net: ena: change return value for unsupported features unsupported return
      value
    - net: ena: add hardware hints capability to the driver
    - net: ena: change sizeof() argument to be the type pointer
    - net: ena: add reset reason for each device FLR
    - net: ena: add support for out of order rx buffers refill
    - net: ena: allow the driver to work with small number of msix vectors
    - net: ena: use napi_schedule_irqoff when possible
    - net: ena: separate skb allocation to dedicated function
    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
    - net: ena: update driver's rx drop statistics
    - net: ena: update ena driver to version 1.2.0

* APST gets enabled against explicit kernel option (LP: #1699004)
    - nvme: Display raw APST configuration via DYNAMIC_DEBUG
    - nvme: Add nvme_core.force_apst to ignore the NO_APST quirk
    - nvme: explicitly disable APST on quirked devices

* New NVLINK2 patches (LP: #1701272)
    - powerpc/powernv/npu-dma: Add explicit flush when sending an ATSD
    - powerpc/npu-dma: Remove spurious WARN_ON when a PCI device has no of_node

* ERAT invalidate on context switch removal (LP: #1700819)
    - powerpc: Only do ERAT invalidate on radix context switch on P9 DD1

* Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl to 0.6.5.10-1, zfs to 0.6.5.10-1ubuntu2
    - snapcraft.yaml: Sync with xenial

* Miscellaneous upstream changes
    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and
      MokSBState"

-- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 01 Aug 2017 19:35:17 -0300

Changed in linux (Ubuntu Artful):
status:	Fix Committed → Fix Released

Stefan Bader (smb) on 2017-08-11

Changed in linux (Ubuntu Zesty):
status:	In Progress → Fix Committed

Kleber Sacilotto de Souza (kleber-souza) on 2017-08-11

Changed in linux (Ubuntu Xenial):
status:	In Progress → Fix Committed

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-08-16:

#6

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-xenial
tags:	added: verification-needed-zesty

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-08-16:

#7

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-zesty' to 'verification-done-zesty'. If the problem still exists, change the tag 'verification-needed-zesty' to 'verification-failed-zesty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message

Kleber Sacilotto de Souza (kleber-souza) wrote on 2017-08-22:

#8

Confirmed the issue to be fixed on xenial linux-image-4.4.0-93-generic and zesty linux-image-4.10.0-33-generic.

tags:

added: verification-done-xenial verification-done-zesty
removed: verification-needed-xenial verification-needed-zesty

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-08-28:

#9

Download full text (16.2 KiB)

This bug was fixed in the package linux - 4.4.0-93.116

---------------
linux (4.4.0-93.116) xenial; urgency=low

* linux: 4.4.0-93.116 -proposed tracker (LP: #1709296)

  * Creating conntrack entry failure with kernel 4.4.0-89 (LP: #1709032)
    - Revert "Revert "netfilter: synproxy: fix conntrackd interaction""
    - netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister

  * CVE-2017-1000112
    - Revert "udp: consistently apply ufo or fragmentation"
    - udp: consistently apply ufo or fragmentation

  * CVE-2017-1000111
    - Revert "net-packet: fix race in packet_set_ring on PACKET_RESERVE"
    - packet: fix tp_reserve race in packet_set_ring

  * kernel BUG at [tty_ldisc_reinit] mm/slub.c! (LP: #1709126)
    - tty: Simplify tty_set_ldisc() exit handling
    - tty: Reset c_line from driver's init_termios
    - tty: Handle NULL tty->ldisc
    - tty: Move tty_ldisc_kill()
    - tty: Use 'disc' for line discipline index name
    - tty: Refactor tty_ldisc_reinit() for reuse
    - tty: Destroy ldisc instance on hangup

* atheros bt failed after S3 (LP: #1706833)
- SAUCE: Bluetooth: Make request workqueue freezable

* The Precision Touchpad(PTP) button sends incorrect event code (LP: #1708372)
- HID: multitouch: handle external buttons for Precision Touchpads

* Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
- [Config] CONFIG_SATA_HIGHBANK=y

* xfs slab objects (memory) leak when xfs shutdown is called (LP: #1706132)
- xfs: fix xfs_log_ticket leak in xfs_end_io() after fs shutdown

* Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
- [Packaging] tests -- reduce rebuild test to one flavour

* CVE-2017-7495
- ext4: fix data exposure after a crash

  * ubuntu/rsi driver downlink wifi throughput drops to 5-6 Mbps when BT
    keyboard is connected (LP: #1706991)
    - SAUCE: Redpine: enable power save by default for coex mode
    - SAUCE: Redpine: uapsd configuration changes

  * [Hyper-V] hv_netvsc: Exclude non-TCP port numbers from vRSS hashing
    (LP: #1690174)
    - hv_netvsc: Exclude non-TCP port numbers from vRSS hashing

* ath10k doesn't report full RSSI information (LP: #1706531)
- ath10k: add per chain RSSI reporting

* ideapad_laptop don't support v310-14isk (LP: #1705378)
- platform/x86: ideapad-laptop: Add several models to no_hw_rfkill

  * [8087:0a2b] Failed to load bluetooth firmware(might affect some other Intel
    bt devices) (LP: #1705633)
    - Bluetooth: btintel: Create common Intel Version Read function
    - Bluetooth: Use switch statement for Intel hardware variants
    - Bluetooth: Replace constant hw_variant from Intel Bluetooth firmware
      filename
    - Bluetooth: hci_intel: Fix firmware file name to use hw_variant
    - Bluetooth: btintel: Add MODULE_FIRMWARE entries for iBT 3.5 controllers

  * xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2
    comp_code 13 (LP: #1667750)
    - xhci: Bad Ethernet performance plugged in ASM1042A host

  * OpenPower: Some multipaths temporarily have only a single path
    (LP: #1696445)
    - scsi: ses: don't get power status of SES device slot on probe

...

This bug was fixed in the package linux - 4.4.0-93.116

---------------
linux (4.4.0-93.116) xenial; urgency=low

* linux: 4.4.0-93.116 -proposed tracker (LP: #1709296)

* Creating conntrack entry failure with kernel 4.4.0-89 (LP: #1709032)
    - Revert "Revert "netfilter: synproxy: fix conntrackd interaction""
    - netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister

* CVE-2017-1000112
    - Revert "udp: consistently apply ufo or fragmentation"
    - udp: consistently apply ufo or fragmentation

* CVE-2017-1000111
    - Revert "net-packet: fix race in packet_set_ring on PACKET_RESERVE"
    - packet: fix tp_reserve race in packet_set_ring

* kernel BUG at [tty_ldisc_reinit] mm/slub.c! (LP: #1709126)
    - tty: Simplify tty_set_ldisc() exit handling
    - tty: Reset c_line from driver's init_termios
    - tty: Handle NULL tty->ldisc
    - tty: Move tty_ldisc_kill()
    - tty: Use 'disc' for line discipline index name
    - tty: Refactor tty_ldisc_reinit() for reuse
    - tty: Destroy ldisc instance on hangup

* atheros bt failed after S3 (LP: #1706833)
    - SAUCE: Bluetooth: Make request workqueue freezable

* The Precision Touchpad(PTP) button sends incorrect event code (LP: #1708372)
    - HID: multitouch: handle external buttons for Precision Touchpads

* Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
    - [Config] CONFIG_SATA_HIGHBANK=y

* xfs slab objects (memory) leak when xfs shutdown is called (LP: #1706132)
    - xfs: fix xfs_log_ticket leak in xfs_end_io() after fs shutdown

* Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
    - [Packaging] tests -- reduce rebuild test to one flavour

* CVE-2017-7495
    - ext4: fix data exposure after a crash

* ubuntu/rsi driver downlink wifi throughput drops to 5-6 Mbps when BT
    keyboard is connected (LP: #1706991)
    - SAUCE: Redpine: enable power save by default for coex mode
    - SAUCE: Redpine: uapsd configuration changes

* [Hyper-V] hv_netvsc: Exclude non-TCP port numbers from vRSS hashing
    (LP: #1690174)
    - hv_netvsc: Exclude non-TCP port numbers from vRSS hashing

* ath10k doesn't report full RSSI information (LP: #1706531)
    - ath10k: add per chain RSSI reporting

* ideapad_laptop don't support v310-14isk (LP: #1705378)
    - platform/x86: ideapad-laptop: Add several models to no_hw_rfkill

* [8087:0a2b] Failed to load bluetooth firmware(might affect some other Intel
    bt devices) (LP: #1705633)
    - Bluetooth: btintel: Create common Intel Version Read function
    - Bluetooth: Use switch statement for Intel hardware variants
    - Bluetooth: Replace constant hw_variant from Intel Bluetooth firmware
      filename
    - Bluetooth: hci_intel: Fix firmware file name to use hw_variant
    - Bluetooth: btintel: Add MODULE_FIRMWARE entries for iBT 3.5 controllers

* xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2
    comp_code 13 (LP: #1667750)
    - xhci: Bad Ethernet performance plugged in ASM1042A host

* OpenPower: Some multipaths temporarily have only a single path
    (LP: #1696445)
    - scsi: ses: don't get power status of SES device slot on probe

* Hotkeys on new Thinkpad systems aren't working (LP: #1705169)
    - platform/x86: thinkpad_acpi: Adding new hotkey ID for Lenovo thinkpad
    - platform/x86: thinkpad_acpi: guard generic hotkey case
    - platform/x86: thinkpad_acpi: add mapping for new hotkeys

* CVE-2015-7837
    - SAUCE: (no-up) kexec/uefi: copy secure_boot flag in boot params across kexec
      reboot

* misleading kernel warning skb_warn_bad_offload during checksum calculation
    (LP: #1705447)
    - net: reduce skb_warn_bad_offload() noise

* bonding: stack dump when unregistering a netdev (LP: #1704102)
    - bonding: avoid NETDEV_CHANGEMTU event when unregistering slave

* Ubuntu 16.04 IOB Error when the Mustang board rebooted (LP: #1693673)
    - drivers: net: xgene: Fix redundant prefetch buffer cleanup

* Ubuntu16.04: NVMe 4K+T10 DIF/DIX format returns I/O error on dd with split
    op (LP: #1689946)
    - blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split
      op

* linux >= 4.2: bonding 802.3ad does not work with 5G, 25G and 50G link speeds
    (LP: #1697892)
    - bonding: add 802.3ad support for 100G speeds
    - bonding: fix 802.3ad aggregator reselection
    - bonding: add 802.3ad support for 25G speeds
    - bonding: fix 802.3ad support for 5G and 50G speeds

* Xenial update to 4.4.79 stable release (LP: #1707233)
    - disable new gcc-7.1.1 warnings for now
    - ir-core: fix gcc-7 warning on bool arithmetic
    - s5p-jpeg: don't return a random width/height
    - thermal: cpu_cooling: Avoid accessing potentially freed structures
    - ath9k: fix tx99 use after free
    - ath9k: fix tx99 bus error
    - NFC: fix broken device allocation
    - NFC: nfcmrvl_uart: add missing tty-device sanity check
    - NFC: nfcmrvl: do not use device-managed resources
    - NFC: nfcmrvl: use nfc-device for firmware download
    - NFC: nfcmrvl: fix firmware-management initialisation
    - nfc: Ensure presence of required attributes in the activate_target handler
    - nfc: Fix the sockaddr length sanitization in llcp_sock_connect
    - NFC: Add sockaddr length checks before accessing sa_family in bind handlers
    - perf intel-pt: Move decoder error setting into one condition
    - perf intel-pt: Improve sample timestamp
    - perf intel-pt: Fix missing stack clear
    - perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
    - perf intel-pt: Clear FUP flag on error
    - Bluetooth: use constant time memory comparison for secret values
    - wlcore: fix 64K page support
    - ASoC: compress: Derive substream from stream based on direction
    - PM / Domains: Fix unsafe iteration over modified list of device links
    - PM / Domains: Fix unsafe iteration over modified list of domain providers
    - scsi: ses: do not add a device to an enclosure if enclosure_add_links()
      fails.
    - iscsi-target: Add login_keys_workaround attribute for non RFC initiators
    - powerpc/64: Fix atomic64_inc_not_zero() to return an int
    - powerpc: Fix emulation of mcrf in emulate_step()
    - powerpc: Fix emulation of mfocrf in emulate_step()
    - powerpc/asm: Mark cr0 as clobbered in mftb()
    - af_key: Fix sadb_x_ipsecrequest parsing
    - PCI/PM: Restore the status of PCI devices across hibernation
    - ipvs: SNAT packet replies only for NATed connections
    - xhci: fix 20000ms port resume timeout
    - xhci: Fix NULL pointer dereference when cleaning up streams for removed host
    - usb: storage: return on error to avoid a null pointer dereference
    - USB: cdc-acm: add device-id for quirky printer
    - usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
    - usb: renesas_usbhs: gadget: disable all eps when the driver stops
    - md: don't use flush_signals in userspace processes
    - x86/xen: allow userspace access during hypercalls
    - cx88: Fix regression in initial video standard setting
    - Raid5 should update rdev->sectors after reshape
    - s390/syscalls: Fix out of bounds arguments access
    - drm/amd/amdgpu: Return error if initiating read out of range on vram
    - drm/radeon/ci: disable mclk switching for high refresh rates (v2)
    - drm/radeon: Fix eDP for single-display iMac10,1 (v2)
    - ipmi: use rcu lock around call to intf->handlers->sender()
    - ipmi:ssif: Add missing unlock in error branch
    - f2fs: Don't clear SGID when inheriting ACLs
    - vfio: Fix group release deadlock
    - vfio: New external user group/file match
    - ftrace: Fix uninitialized variable in match_records()
    - MIPS: Fix mips_atomic_set() retry condition
    - MIPS: Fix mips_atomic_set() with EVA
    - MIPS: Negate error syscall return in trace
    - x86/acpi: Prevent out of bound access caused by broken ACPI tables
    - x86/ioapic: Pass the correct data to unmask_ioapic_irq()
    - MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
    - MIPS: Save static registers before sysmips
    - MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
    - MIPS: Fix unaligned PC interpretation in `compute_return_epc'
    - MIPS: math-emu: Prevent wrong ISA mode instruction emulation
    - MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
    - MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
    - MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
    - MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
    - Input: i8042 - fix crash at boot time
    - NFS: only invalidate dentrys that are clearly invalid.
    - udf: Fix deadlock between writeback and udf_setsize()
    - target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
    - perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its
      target
    - Revert "perf/core: Drop kernel samples even though :u is specified"
    - staging: rtl8188eu: add TL-WN722N v2 support
    - ceph: fix race in concurrent readdir
    - RDMA/core: Initialize port_num in qp_attr
    - drm/mst: Fix error handling during MST sideband message reception
    - drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
    - drm/mst: Avoid processing partially received up/down message transactions
    - of: device: Export of_device_{get_modalias, uvent_modalias} to modules
    - spmi: Include OF based modalias in device uevent
    - tracing: Fix kmemleak in instance_rmdir
    - alarmtimer: don't rate limit one-shot timers
    - Linux 4.4.79

* Xenial update to 4.4.78 stable release (LP: #1705707)
    - net_sched: fix error recovery at qdisc creation
    - net: sched: Fix one possible panic when no destroy callback
    - net/phy: micrel: configure intterupts after autoneg workaround
    - ipv6: avoid unregistering inet6_dev for loopback
    - net: dp83640: Avoid NULL pointer dereference.
    - tcp: reset sk_rx_dst in tcp_disconnect()
    - net: prevent sign extension in dev_get_stats()
    - bpf: prevent leaking pointer via xadd on unpriviledged
    - net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
    - ipv6: dad: don't remove dynamic addresses if link is down
    - net: ipv6: Compare lwstate in detecting duplicate nexthops
    - vrf: fix bug_on triggered by rx when destroying a vrf
    - rds: tcp: use sock_create_lite() to create the accept socket
    - brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
    - cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
    - cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
    - cfg80211: Check if PMKID attribute is of expected size
    - irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
    - parisc: Report SIGSEGV instead of SIGBUS when running out of stack
    - parisc: use compat_sys_keyctl()
    - parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
    - parisc/mm: Ensure IRQs are off in switch_mm()
    - tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/:
      Depth
    - kernel/extable.c: mark core_kernel_text notrace
    - mm/list_lru.c: fix list_lru_count_node() to be race free
    - fs/dcache.c: fix spin lockup issue on nlru->lock
    - checkpatch: silence perl 5.26.0 unescaped left brace warnings
    - binfmt_elf: use ELF_ET_DYN_BASE only for PIE
    - arm: move ELF_ET_DYN_BASE to 4MB
    - arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
    - powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
    - s390: reduce ELF_ET_DYN_BASE
    - exec: Limit arg stack to at most 75% of _STK_LIM
    - vt: fix unchecked __put_user() in tioclinux ioctls
    - mnt: In umount propagation reparent in a separate pass
    - mnt: In propgate_umount handle visiting mounts in any order
    - mnt: Make propagate_umount less slow for overlapping mount propagation trees
    - selftests/capabilities: Fix the test_execve test
    - tpm: Get rid of chip->pdev
    - tpm: Provide strong locking for device removal
    - Add "shutdown" to "struct class".
    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
    - mm: fix overflow check in expand_upwards()
    - crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
    - crypto: atmel - only treat EBUSY as transient if backlog
    - crypto: sha1-ssse3 - Disable avx2
    - crypto: caam - fix signals handling
    - sched/topology: Fix overlapping sched_group_mask
    - sched/topology: Optimize build_group_mask()
    - PM / wakeirq: Convert to SRCU
    - PM / QoS: return -EINVAL for bogus strings
    - tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
    - KVM: x86: disable MPX if host did not enable MPX XSAVE features
    - kvm: vmx: Do not disable intercepts for BNDCFGS
    - kvm: x86: Guest BNDCFGS requires guest MPX support
    - kvm: vmx: Check value written to IA32_BNDCFGS
    - kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
    - Linux 4.4.78

* Xenial update to 4.4.77 stable release (LP: #1705238)
    - fs: add a VALID_OPEN_FLAGS
    - fs: completely ignore unknown open flags
    - driver core: platform: fix race condition with driver_override
    - bgmac: reset & enable Ethernet core before using it
    - mm: fix classzone_idx underflow in shrink_zones()
    - tracing/kprobes: Allow to create probe with a module name starting with a
      digit
    - usb: dwc3: replace %p with %pK
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - Add USB quirk for HVR-950q to avoid intermittent device resets
    - usb: usbip: set buffer pointers to NULL after free
    - usb: Fix typo in the definition of Endpoint[out]Request
    - mac80211_hwsim: Replace bogus hrtimer clockid
    - sysctl: don't print negative flag for proc_douintvec
    - sysctl: report EINVAL if value is larger than UINT_MAX for proc_douintvec
    - pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data
    - pinctrl: meson: meson8b: fix the NAND DQS pins
    - pinctrl: sunxi: Fix SPDIF function name for A83T
    - pinctrl: mxs: atomically switch mux and drive strength config
    - pinctrl: sh-pfc: Update info pointer after SoC-specific init
    - USB: serial: option: add two Longcheer device ids
    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
    - gfs2: Fix glock rhashtable rcu bug
    - x86/tools: Fix gcc-7 warning in relocs.c
    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
    - ath10k: override CE5 config for QCA9377
    - KEYS: Fix an error code in request_master_key()
    - RDMA/uverbs: Check port number supplied by user verbs cmds
    - mqueue: fix a use-after-free in sys_mq_notify()
    - tools include: Add a __fallthrough statement
    - tools string: Use __fallthrough in perf_atoll()
    - tools strfilter: Use __fallthrough
    - perf top: Use __fallthrough
    - perf intel-pt: Use __fallthrough
    - perf thread_map: Correctly size buffer used with dirent->dt_name
    - perf scripting perl: Fix compile error with some perl5 versions
    - perf tests: Avoid possible truncation with dirent->d_name + snprintf
    - perf bench numa: Avoid possible truncation when using snprintf()
    - perf tools: Use readdir() instead of deprecated readdir_r()
    - perf thread_map: Use readdir() instead of deprecated readdir_r()
    - perf script: Use readdir() instead of deprecated readdir_r()
    - perf tools: Remove duplicate const qualifier
    - perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    - perf pmu: Fix misleadingly indented assignment (whitespace)
    - perf dwarf: Guard !x86_64 definitions under #ifdef else clause
    - perf trace: Do not process PERF_RECORD_LOST twice
    - perf tests: Remove wrong semicolon in while loop in CQM test
    - perf tools: Use readdir() instead of deprecated readdir_r() again
    - md: fix incorrect use of lexx_to_cpu in does_sb_need_changing
    - md: fix super_offset endianness in super_1_rdev_size_change
    - tcp: fix tcp_mark_head_lost to check skb len before fragmenting
    - staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
    - staging: comedi: fix clean-up of comedi_class in comedi_init()
    - ext4: check return value of kstrtoull correctly in reserved_clusters_store
    - x86/mm/pat: Don't report PAT on CPUs that don't support it
    - saa7134: fix warm Medion 7134 EEPROM read
    - Linux 4.4.77

-- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 11 Aug 2017 16:51:50 +0200

Changed in linux (Ubuntu Xenial):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-08-28:

#10

Download full text (8.5 KiB)

This bug was fixed in the package linux - 4.10.0-33.37

---------------
linux (4.10.0-33.37) zesty; urgency=low

* linux: 4.10.0-33.37 -proposed tracker (LP: #1709303)

  * CVE-2017-1000112
    - Revert "udp: consistently apply ufo or fragmentation"
    - udp: consistently apply ufo or fragmentation

  * CVE-2017-1000111
    - Revert "net-packet: fix race in packet_set_ring on PACKET_RESERVE"
    - packet: fix tp_reserve race in packet_set_ring

  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
    (LP: #1673564)
    - irqchip/gic-v3: Add missing system register definitions
    - arm64: KVM: Do not use stack-protector to compile EL2 code
    - KVM: arm/arm64: vgic-v3: Use PREbits to infer the number of ICH_APxRn_EL2
      registers
    - KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction
    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
    - arm64: Add MIDR values for Cavium cn83XX SoCs
    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y
    - arm64: Add workaround for Cavium Thunder erratum 30115
    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
    - arm64: KVM: Make unexpected reads from WO registers inject an undef
    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access

  * ibmvscsis: Do not send aborted task response (LP: #1689365)
    - target: Fix unknown fabric callback queue-full errors
    - ibmvscsis: Do not send aborted task response
    - ibmvscsis: Clear left-over abort_cmd pointers
    - ibmvscsis: Fix the incorrect req_lim_delta

  * hisi_sas performance improvements (LP: #1708734)
    - scsi: hisi_sas: define hisi_sas_device.device_id as int
    - scsi: hisi_sas: optimise the usage of hisi_hba.lock
    - scsi: hisi_sas: relocate sata_done_v2_hw()
    - scsi: hisi_sas: optimise DMA slot memory

* hisi_sas...

Ubuntu
linux package

bonding: stack dump when unregistering a netdev

Bug Description

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Joseph Salisbury
Xenial	Fix Released	Medium	Joseph Salisbury
Yakkety	Won't Fix	Medium	Joseph Salisbury
Zesty	Fix Released	Medium	Joseph Salisbury
Artful	Fix Released	Medium	Joseph Salisbury

Ubuntulinux package

bonding: stack dump when unregistering a netdev

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package