This bug was fixed in the package linux - 4.8.0-11.12
---------------
linux (4.8.0-11.12) yakkety; urgency=low
* change_hat is logging failures during expected hat probing (LP: #1615893)
- SAUCE: apparmor: Fix auditing behavior for change_hat probing
* deleted files outside of the namespace are not being treated as
disconnected
(LP: #1615892)
- SAUCE: apparmor: deleted dentries can be disconnected
* stacking to unconfined in a child namespace confuses mediation
(LP: #1615890)
- SAUCE: apparmor: special case unconfined when determining the mode
* apparmor module parameters can be changed after the policy is locked
(LP: #1615895)
- SAUCE: apparmor: fix: parameters can be changed after policy is locked
* AppArmor profile reloading causes an intermittent kernel BUG (LP:
#1579135)
- SAUCE: apparmor: fix vec_unique for vectors larger than 8
* label vec reductions can result in reference labels instead of direct
access
to labels (LP: #1615889)
- SAUCE: apparmor: reduction of vec to single entry is just that entry
* profiles from different namespaces can block other namespaces from being
able to load a profile (LP: #1615887)
- SAUCE: apparmor: profiles in one ns can affect mediation in another ns
* The label build for onexec when stacking is wrong (LP: #1615881)
- SAUCE: apparmor: Fix label build for onexec stacking.
* The inherit check for new to old label comparison for domain transitions
is
wrong (LP: #1615880)
- SAUCE: apparmor: Fix new to old label comparison for domain transitions
* warning stack trace while playing with apparmor namespaces (LP: #1593874)
- SAUCE: apparmor: fix stack trace when removing namespace with profiles
* __label_update proxy comparison test is wrong (LP: #1615878)
- SAUCE: apparmor: Fix __label_update proxy comparison test
* reading /sys/kernel/security/apparmor/profiles requires CAP_MAC_ADMIN
(LP: #1560583)
- SAUCE: apparmor: Allow ns_root processes to open profiles file
- SAUCE: apparmor: Consult sysctl when reading profiles in a user ns
* policy namespace stacking (LP: #1379535)
- SAUCE: (no-up) apparmor: rebase of apparmor3.5-beta1 snapshot for 4.8
- SAUCE: add a sysctl to enable unprivileged user ns AppArmor policy loading
* Miscellaneous Ubuntu changes
- [Debian] Dynamically determine linux udebs package name
- [Debian] d-i -- fix dtb handling in new kernel-wedge form
- SAUCE: apparmor: Fix FTBFS due to bad include path
- SAUCE: apparmor: add data query support
- [Config] Set CONFIG_SECURITY_APPARMOR_UNCONFINED_INIT=y
* Miscellaneous upstream changes
- fixup backout policy view capable for forward port
- apparmor: fix: Rework the iter loop for label_update
- apparmor: add more assertions for updates/merges to help catch errors
- apparmor: Make pivot root transitions work with stacking
- apparmor: convert delegating deleted files to mediate deleted files
- apparmor: add missing parens. not a bug fix but highly recommended
- apparmor: add a stack_version file to allow detection of bug fixes
- apparmor: push path lookup into mediation loop
- apparmor: default to allowing unprivileged userns policy
- apparmor: fix: permissions test to view and manage policy
- apparmor: Add Basic ns cross check condition for ipc
-- Leann Ogasawara <leann.ogasaw...@canonical.com> Sat, 17 Sep 2016
10:03:16 -0700
** Changed in: linux (Ubuntu)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1592547
Title:
vmalloc failure leads to null ptr dereference in aa_dfa_next
Status in AppArmor:
New
Status in linux package in Ubuntu:
Fix Released
Status in linux source package in Xenial:
Fix Released
Bug description:
running stress-ng apparmor stressor with a vmalloc NULL return trips a
null ptr dereference in aa_dfa_next:
$ uname -a
Linux ubuntu 4.4.0-24-generic #43
[ 46.271517] BUG: unable to handle kernel NULL pointer dereference at
0000000000000020
[ 46.271641] IP: [<ffffffff8137a8a6>] aa_dfa_next+0x6/0x70
[ 46.271743] PGD 39ebd067 PUD 39ebe067 PMD 0
[ 46.271833] Oops: 0000 [#1] SMP
[ 46.271926] Modules linked in: jitterentropy_rng algif_rng salsa20_generic
salsa20_x86_64 camellia_generic camellia_aesni_avx_x86_64 camellia_x86_64
cast6_avx_x86_64 cast6_generic cast_common serpent_avx_x86_64
serpent_sse2_x86_64 serpent_generic twofish_generic twofish_avx_x86_64
twofish_x86_64_3way twofish_x86_64 twofish_common xts algif_skcipher tgr192
wp512 rmd320 rmd256 rmd160 rmd128 md4 algif_hash af_alg ppdev
snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep
snd_pcm input_leds joydev snd_timer serio_raw snd soundcore i2c_piix4 mac_hid
8250_fintek parport_pc parport ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core
ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs
raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor
raid6_pq
[ 46.273290] libcrc32c raid1 raid0 multipath linear 8139too
crct10dif_pclmul crc32_pclmul qxl aesni_intel aes_x86_64 lrw gf128mul ttm
drm_kms_helper glue_helper ablk_helper cryptd syscopyarea sysfillrect sysimgblt
fb_sys_fops psmouse drm floppy 8139cp mii pata_acpi
[ 46.274250] CPU: 0 PID: 1349 Comm: stress-ng-appar Not tainted
4.4.0-24-generic #43
[ 46.274436] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 46.274632] task: ffff8800374be040 ti: ffff88003746c000 task.ti:
ffff88003746c000
[ 46.274854] RIP: 0010:[<ffffffff8137a8a6>] [<ffffffff8137a8a6>]
aa_dfa_next+0x6/0x70
[ 46.275072] RSP: 0018:ffff88003746fca8 EFLAGS: 00010282
[ 46.275450] RAX: 0000000000000000 RBX: 0000000000000003 RCX:
0000000000004a46
[ 46.275934] RDX: 0000000000000002 RSI: 0000000000000001 RDI:
0000000000000000
[ 46.276348] RBP: ffff88003746fd28 R08: ffff88003fc19f40 R09:
ffff88003e001d00
[ 46.276757] R10: ffff88003da8e600 R11: ffff88003e001500 R12:
ffff88003746fd48
[ 46.276979] R13: ffff88003acc4800 R14: ffff88003acc4894 R15:
0000000000000029
[ 46.277202] FS: 00007f7198a0f700(0000) GS:ffff88003fc00000(0000)
knlGS:0000000000000000
[ 46.277500] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 46.278006] CR2: 0000000000000020 CR3: 0000000039ebc000 CR4:
00000000001406f0
[ 46.278592] Stack:
[ 46.278846] ffff88003746fd28 ffffffff81383585 0000000000000000
0000000000000000
[ 46.279271] 000000003746fd00 0000000000000000 ffffc9000268e400
0000000000000000
[ 46.279860] ffff88003746fd40 0000000000000000 000000005833b243
ffff88003746fe28
[ 46.280311] Call Trace:
[ 46.280606] [<ffffffff81383585>] ? unpack_profile+0x5c5/0x970
[ 46.280854] [<ffffffff81383ad9>] aa_unpack+0xe9/0x450
[ 46.281091] [<ffffffff81381e97>] aa_replace_profiles+0x77/0xb70
[ 46.281341] [<ffffffff811cf81b>] ? vmalloc+0x6b/0x70
[ 46.281610] [<ffffffff813770df>] policy_update+0x9f/0x1f0
[ 46.281887] [<ffffffff81377243>] profile_replace+0x13/0x20
[ 46.282169] [<ffffffff8120c528>] __vfs_write+0x18/0x40
[ 46.282444] [<ffffffff8120ceb9>] vfs_write+0xa9/0x1a0
[ 46.282728] [<ffffffff8120be4f>] ? do_sys_open+0x1bf/0x2a0
[ 46.283418] [<ffffffff8120db75>] SyS_write+0x55/0xc0
[ 46.284188] [<ffffffff81825cb2>] entry_SYSCALL_64_fastpath+0x16/0x71
[ 46.284753] Code: 0c 42 39 ce 74 d9 0f b6 02 41 0f b7 34 7b 84 c0 75 d9 eb
c3 41 0f b7 34 44 eb 89 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 <48> 8b
47 20 4c 8b 5f 28 4c 8b 57 40 48 89 e5 4c 8b 4f 18 48 8d
[ 46.285401] RIP [<ffffffff8137a8a6>] aa_dfa_next+0x6/0x70
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1592547/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
