This bug was fixed in the package linux - 5.4.0-124.140
---------------
linux (5.4.0-124.140) focal; urgency=medium
* CVE-2022-2586
- SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
- SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another
chain
* CVE-2022-2588
- SAUCE: net_sched: cls_route: remove from list when handle is 0
* CVE-2022-34918
- netfilter: nf_tables: stricter validation of element data
linux (5.4.0-123.139) focal; urgency=medium
* focal/linux: 5.4.0-123.139 -proposed tracker (LP: #1981284)
* Packaging resync (LP: #1786013)
- debian/dkms-versions -- update from kernel-versions (main/2022.07.11)
* Hairpin traffic does not work with centralized NAT gw (LP: #1967856)
- net: openvswitch: fix misuse of the cached connection on tuple changes
* [UBUNTU 20.04] Include patches to avoid self-detected stall with Secure
Execution (LP: #1979296)
- KVM: s390: pv: add macros for UVC CC values
- KVM: s390: pv: avoid stalls when making pages secure
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
* Focal update: v5.4.195 upstream stable release (LP: #1980407)
- batman-adv: Don't skb_split skbuffs with frag_list
- hwmon: (tmp401) Add OF device ID table
- mac80211: Reset MBSSID parameters upon connection
- net: Fix features skip in for_each_netdev_feature()
- ipv4: drop dst in multicast routing path
- drm/nouveau: Fix a potential theorical leak in
nouveau_get_backlight_name()
- netlink: do not reset transport header in netlink_recvmsg()
- mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
- dim: initialize all struct fields
- hwmon: (ltq-cputemp) restrict it to SOC_XWAY
- s390/ctcm: fix variable dereferenced before check
- s390/ctcm: fix potential memory leak
- s390/lcs: fix variable dereferenced before check
- net/sched: act_pedit: really ensure the skb is writable
- net/smc: non blocking recvmsg() return -EAGAIN when no data and
signal_pending
- net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
- gfs2: Fix filesystem block deallocation for short writes
- hwmon: (f71882fg) Fix negative temperature
- ASoC: max98090: Reject invalid values in custom control put()
- ASoC: max98090: Generate notifications on changes for custom control
- ASoC: ops: Validate input values in snd_soc_put_volsw_range()
- s390: disable -Warray-bounds
- net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
- tcp: resalt the secret every 10 seconds
- tty: n_gsm: fix mux activation issues in gsm_config()
- usb: cdc-wdm: fix reading stuck on device close
- usb: typec: tcpci: Don't skip cleanup in .remove() on error
- USB: serial: pl2303: add device id for HP LM930 Display
- USB: serial: qcserial: add support for Sierra Wireless EM7590
- USB: serial: option: add Fibocom L610 modem
- USB: serial: option: add Fibocom MA510 modem
- slimbus: qcom: Fix IRQ check in qcom_slim_probe
- serial: 8250_mtk: Fix UART_EFR register address
- serial: 8250_mtk: Fix register address for XON/XOFF character
- drm/nouveau/tegra: Stop using iommu_present()
- i40e: i40e_main: fix a missing check on list iterator
- cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
- drm/vmwgfx: Initialize drm_mode_fb_cmd2
- MIPS: fix build with gcc-12
- net: phy: Fix race condition on link status change
- arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
- ping: fix address binding wrt vrf
- tty/serial: digicolor: fix possible null-ptr-deref in
digicolor_uart_probe()
- Linux 5.4.195
* Focal update: v5.4.194 upstream stable release (LP: #1980399)
- MIPS: Use address-of operator on section symbols
- block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
- drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version,
environment} types
- drm/i915: Cast remain to unsigned long in eb_relocate_vma
- nfp: bpf: silence bitwise vs. logical OR warning
- can: grcan: grcan_probe(): fix broken system id check for errata
workaround
needs
- can: grcan: only use the NAPI poll budget for RX
- arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
- [Config] updateconfigs for ARCH_HAS_HOLES_MEMORYMODEL
- KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
- x86/asm: Allow to pass macros to __ASM_FORM()
- x86: xen: kvm: Gather the definition of emulate prefixes
- x86: xen: insn: Decode Xen and KVM emulate-prefix signature
- x86: kprobes: Prohibit probing on instruction which has emulate prefix
- KVM: x86/svm: Account for family 17h event renumberings in
amd_pmc_perf_hw_id
- Bluetooth: Fix the creation of hdev->name
- mm: fix missing cache flush for all tail pages of compound page
- mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
- mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
__mcopy_atomic()
- Linux 5.4.194
* Focal update: v5.4.193 upstream stable release (LP: #1979566)
- MIPS: Fix CP0 counter erratum detection for R4k CPUs
- parisc: Merge model and model name into one line in /proc/cpuinfo
- ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
- gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
- Revert "SUNRPC: attempt AF_LOCAL connect on setup"
- firewire: fix potential uaf in outbound_phy_packet_callback()
- firewire: remove check of list iterator against head past the loop body
- firewire: core: extend card->lock in fw_core_handle_bus_reset
- ACPICA: Always create namespace nodes using acpi_ns_create_node()
- genirq: Synchronize interrupt thread startup
- ASoC: da7219: Fix change notifications for tone generator frequency
- ASoC: wm8958: Fix change notifications for DSP controls
- ASoC: meson: Fix event generation for G12A tohdmi mux
- s390/dasd: fix data corruption for ESE devices
- s390/dasd: prevent double format of tracks for ESE devices
- s390/dasd: Fix read for ESE with blksize < 4k
- s390/dasd: Fix read inconsistency for ESE DASD devices
- can: grcan: grcan_close(): fix deadlock
- can: grcan: use ofdev->dev when allocating DMA memory
- nfc: replace improper check device_is_registered() in netlink related
functions
- NFC: netlink: fix sleep in atomic bug when firmware download timeout
- hwmon: (adt7470) Fix warning on module removal
- ASoC: dmaengine: Restore NULL prepare_slave_config() callback
- RDMA/siw: Fix a condition race issue in MPA request processing
- net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
- net: stmmac: dwmac-sun8i: add missing of_node_put() in
sun8i_dwmac_register_mdio_mux()
- net: emaclite: Add error handling for of_address_to_resource()
- selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is
operational
- bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
- smsc911x: allow using IRQ0
- btrfs: always log symlinks in full mode
- net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
- drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
- NFSv4: Don't invalidate inode attributes on delegation return
- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
- x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
- KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is
advertised
- net: ipv6: ensure we call ipv6_mc_down() at most once
- block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
- mm: fix unexpected zeroed page mapping with zram swap
- ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
- ALSA: pcm: Fix races among concurrent read/write and buffer changes
- ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
- ALSA: pcm: Fix races among concurrent prealloc proc writes
- ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
- tcp: make sure treq->af_specific is initialized
- dm: fix mempool NULL pointer race when completing IO
- dm: interlock pending dm_io and dm_wait_for_bios_completion
- PCI: aardvark: Clear all MSIs at setup
- PCI: aardvark: Fix reading MSI interrupt number
- mmc: rtsx: add 74 Clocks in power on flow
- Linux 5.4.193
* CVE-2022-1679
- SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
* CVE-2022-28893
- SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
- SUNRPC: Don't leak sockets in xs_local_connect()
* CVE-2022-1734
- nfc: nfcmrvl: main: reorder destructive operations in
nfcmrvl_nci_unregister_dev to avoid bugs
* CVE-2022-1652
- floppy: use a statically allocated error counter
-- Thadeu Lima de Souza Cascardo <casca...@canonical.com> Wed, 03 Aug
2022 22:48:34 -0300
** Changed in: linux (Ubuntu Focal)
Status: Fix Committed => Fix Released
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-1734
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-2586
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-2588
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1979296
Title:
[UBUNTU 20.04] Include patches to avoid self-detected stall with
Secure Execution
Status in Ubuntu on IBM z Systems:
Fix Committed
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Focal:
Fix Released
Status in linux source package in Jammy:
Fix Released
Bug description:
SRU Justification:
==================
[Impact]
* On IBM Z secure execution environments under heavy load
(means with over-committed resources - KVM guests)
rcu_sched self-detected stalls can occur,
which lead to LPAR crashes.
[Fix]
* 57c5df13eca4 57c5df13eca4017ed28f9375dc1d246ec0f54217 "KVM: s390:
pv: add macros for UVC CC values"
* 1e2aa46de526 1e2aa46de526a5adafe580bca4c25856bb06f09e "KVM: s390:
pv: avoid stalls for kvm_s390_pv_init_vm"
* f0a1a0615a6f f0a1a0615a6ff6d38af2c65a522698fb4bb85df6 "KVM: s390:
pv: avoid stalls when making pages secure"
[Test Plan]
* An IBM z15 or LinuxONE III LPAR with FC 115 (secure execution)
enabled is required.
* Installation of Ubuntu Server 20.04 LTS (18.04 with hwe-5.4)
or 22.04 LTS on top.
* Install a kernel that incl. the above two patches/commits
* Bring the system under high load with KVM guests.
* Monitor dmesg for 'rcu_sched self-detected stalls'
and/or look for crashes.
* Due to hardware requirements this test needs to be conducted by
IBM.
[Where problems could occur]
* The definition from 57c5df13eca4 are missing in both jammy
and focal, but shouldn't harm.
* The change in 1e2aa46de526 only uses uv_call_sched instead
of just uv_call, which should lead to a snappier system
under high load, but may consume overall some more cycles.
* With f0a1a0615a6f the uv_call_sched cannot simply replace
uv_call, due to locks being held.
* Instead __uv_call is replacing uv_call, which does not loop.
* But due to these changes of the (uv) calls,
- in case erroneous - they may lead to wrong states,
and even broken ultravisor calls
and with that broken secure execution (SE).
* As a side effect the uv might no longer loop over all pages,
and in worst case leaving some unprotected.
* All this is s390x-only functionality,
that is only available on IBM z15 / LinuxONE III systems and newer,
and only is the optional feature 'FC 115' in place,
which is limited to 'secure-execution' workloads.
[Other Info]
* Patches are upstream accepted with kernel 5.16.
* Commit 1e2aa46de526 is already included in jammy
but 57c5df13eca4 and f0a1a0615a6f are missing.
* Focal requires all 3 commits 57c5df13eca4, 1e2aa46de526 and
f0a1a0615a6f.
* Since impish is very close to it's EOL, it's not covered by this SRU.
__________
---Problem Description---
rcu_sched self-detected stall with Secure Execution
When the system is busy and additional Secure Execution guests are started,
the LPAR crashes.
Christian Borntraeger looked at the stack trace and identified two commits
which should fix the issue:
1e2aa46de526a5adafe580bca4c25856bb06f09e
and
f0a1a0615a6ff6d38af2c65a522698fb4bb85df6
Please include these two fixes into 20.04, and 18.04 HWE.
Here the stack trace:
[592792.725078] rcu: INFO: rcu_sched self-detected stall on CPU
[592792.725089] rcu: 4-....: (2099 ticks this GP)
idle=7d2/1/0x4000000000000002 softirq=3920041/3920042 fqs=984
[592792.725133] (t=2100 jiffies g=26268505 q=410280)
[592792.725135] Task dump for CPU 4:
[592792.725137] qemu-system-s39 R running task 0 2557923 1644255 0x06000004
[592792.725139] Call Trace:
[592792.725146] ([<000000566e2dcf52>] show_stack+0x7a/0xc0)
[592792.725150] [<000000566dab696c>] sched_show_task.part.0+0xdc/0x100
[592792.725151] [<000000566e2df248>] rcu_dump_cpu_stacks+0xc0/0x100
[592792.725154] [<000000566db0510c>] rcu_sched_clock_irq+0x75c/0x980
[592792.725156] [<000000566db1326c>] update_process_times+0x3c/0x80
[592792.725160] [<000000566db24fea>] tick_sched_handle.isra.0+0x4a/0x70
[592792.725161] [<000000566db2528e>] tick_sched_timer+0x5e/0xc0
[592792.725163] [<000000566db14294>] __hrtimer_run_queues+0x114/0x2f0
[592792.725165] [<000000566db14fdc>] hrtimer_interrupt+0x12c/0x2a0
[592792.725167] [<000000566da14b6a>] do_IRQ+0xaa/0xb0
[592792.725170] [<000000566e2eed08>] ext_int_handler+0x130/0x134
[592792.725174] [<000000566da2bad8>] gmap_make_secure+0x1c8/0x340
[592792.725175] ([<000000566da2b9fe>] gmap_make_secure+0xee/0x340)
[592792.725180] [<000000566da6e796>] kvm_s390_pv_unpack+0xc6/0x2b0
[592792.725183] [<000000566da535c0>] kvm_s390_handle_pv+0x390/0x580
[592792.725184] [<000000566da55b30>] kvm_arch_vm_ioctl+0x250/0x9e0
[592792.725187] [<000000566da44c26>] kvm_vm_ioctl+0x396/0x760
[592792.725191] [<000000566dceb0b6>] do_vfs_ioctl+0x376/0x690
[592792.725193] [<000000566dceb454>] ksys_ioctl+0x84/0xb0
[592792.725194] [<000000566dceb4ea>] __s390x_sys_ioctl+0x2a/0x40
[592792.725195] [<000000566e2ee6b2>] system_call+0x2a6/0x2c8
Contact Information = stefan.am...@de.ibm.com, cborn...@de.ibm.com
---uname output---
5.4.0-90-generic #101-Ubuntu
Machine Type = 8562 A00-GT2
---System Hang---
LPAR crashed and needed to be re-booted
---Debugger---
A debugger is not configured
---Steps to Reproduce---
Cause high load. Then start Secure Execution enabled KVM guest
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1979296/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
