Bug #1582864 “use after free of BOS in usb_reset_and_verify_devi...” : Bugs : linux package : Ubuntu

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-05-17: Missing required logs.

#1

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1582864

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete
tags:	added: trusty

Joseph Salisbury (jsalisbury) on 2016-05-17

tags:	added: kernel-da.key
Changed in linux (Ubuntu):
importance:	Undecided → Medium
status:	Incomplete → Triaged
Changed in linux (Ubuntu Trusty):
status:	New → Triaged
importance:	Undecided → Medium

Joseph Salisbury (jsalisbury) on 2016-05-17

Changed in linux (Ubuntu):
status:	Triaged → In Progress
Changed in linux (Ubuntu Trusty):
status:	Triaged → In Progress
Changed in linux (Ubuntu Vivid):
status:	New → In Progress
Changed in linux (Ubuntu Wily):
status:	New → In Progress
Changed in linux (Ubuntu Vivid):
importance:	Undecided → Medium
Changed in linux (Ubuntu Wily):
importance:	Undecided → Medium
Changed in linux (Ubuntu):
assignee:	nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Trusty):
assignee:	nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Vivid):
assignee:	nobody → Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu Wily):
assignee:	nobody → Joseph Salisbury (jsalisbury)

Revision history for this message

Joseph Salisbury (jsalisbury) wrote on 2016-05-17:

#2

This commit is in mainline as of: 4.5-rc6.

Per the commit message, this patch has already been included in several -stable kernels:
    4.5.0-rc4 (current git)
    4.4.2
    4.3.6 (currently in review)
    4.1.18
    3.18.27
    3.14.61

This indicates that this commit is needed in Trusty(3.13), lts-vivid(3.19) and Wily(4.2).

I built a Trusty test kernel with a pick of commit e5bdfd50. The test kernel can be downloaded from:

http://kernel.ubuntu.com/~jsalisbury/lp1582864/

Can you test this kernel and see if it resolves this bug?

Revision history for this message

Mike Gerow (gerow) wrote on 2016-05-17:

#3

Download full text (4.3 KiB)

Nice, looks like it works for me!

$ uname -rsov
Linux 3.13.0-86-generic #131~lp1582864 SMP Tue May 17 20:16:27 UTC 2016 GNU/Linux

And here's my dmesg (previously I was getting an oops when unplugging my usb3 thumbdrive).
$ dmesg
...
[ 90.797829] usb 4-3: new SuperSpeed USB device number 2 using xhci_hcd
[ 90.815906] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 90.819631] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[ 90.819633] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 90.819634] usb 4-3: Product: USB Flash Disk
[ 90.819635] usb 4-3: Manufacturer: General
[ 90.819636] usb 4-3: SerialNumber: 0411200000013498
[ 90.827444] usb-storage 4-3:1.0: USB Mass Storage device detected
[ 90.827485] scsi9 : usb-storage 4-3:1.0
[ 90.827522] usbcore: registered new interface driver usb-storage
[ 92.162200] scsi 9:0:0:0: Direct-Access General USB Flash Disk 1100 PQ: 0 ANSI: 6
[ 92.162387] sd 9:0:0:0: Attached scsi generic sg1 type 0
[ 92.162925] sd 9:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[ 92.163355] sd 9:0:0:0: [sdb] Write Protect is off
[ 92.163358] sd 9:0:0:0: [sdb] Mode Sense: 43 00 00 00
[ 92.163785] sd 9:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 92.171207] sdb: sdb1 sdb2
[ 92.172967] sd 9:0:0:0: [sdb] Attached SCSI removable disk
[ 94.797927] usb 4-3: USB disconnect, device number 2
[ 100.640350] usb 4-3: new SuperSpeed USB device number 3 using xhci_hcd
[ 100.658527] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 100.662189] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[ 100.662191] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 100.662192] usb 4-3: Product: USB Flash Disk
[ 100.662193] usb 4-3: Manufacturer: General
[ 100.662194] usb 4-3: SerialNumber: 0411200000013498
[ 100.663121] usb-storage 4-3:1.0: USB Mass Storage device detected
[ 100.663219] scsi10 : usb-storage 4-3:1.0
[ 101.996701] scsi 10:0:0:0: Direct-Access General USB Flash Disk 1100 PQ: 0 ANSI: 6
[ 101.996889] sd 10:0:0:0: Attached scsi generic sg1 type 0
[ 101.997446] sd 10:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[ 101.997894] sd 10:0:0:0: [sdb] Write Protect is off
[ 101.997897] sd 10:0:0:0: [sdb] Mode Sense: 43 00 00 00
[ 101.998325] sd 10:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 102.005805] sdb: sdb1 sdb2
[ 102.007584] sd 10:0:0:0: [sdb] Attached SCSI removable disk
[ 102.718253] usb 4-3: USB disconnect, device number 3
[ 102.718566] sd 10:0:0:0: [sdb] Synchronizing SCSI cache
[ 102.718599] sd 10:0:0:0: [sdb]
[ 102.718601] Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[ 108.333005] usb 4-3: new SuperSpeed USB device number 4 using xhci_hcd
[ 108.351069] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 108.354758] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[ 108.354764] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[...

Nice, looks like it works for me!

$ uname -rsov
Linux 3.13.0-86-generic #131~lp1582864 SMP Tue May 17 20:16:27 UTC 2016 GNU/Linux

And here's my dmesg (previously I was getting an oops when unplugging my usb3 thumbdrive).
$ dmesg
...
[   90.797829] usb 4-3: new SuperSpeed USB device number 2 using xhci_hcd
[   90.815906] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[   90.819631] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[   90.819633] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   90.819634] usb 4-3: Product: USB Flash Disk
[   90.819635] usb 4-3: Manufacturer: General
[   90.819636] usb 4-3: SerialNumber: 0411200000013498
[   90.827444] usb-storage 4-3:1.0: USB Mass Storage device detected
[   90.827485] scsi9 : usb-storage 4-3:1.0
[   90.827522] usbcore: registered new interface driver usb-storage
[   92.162200] scsi 9:0:0:0: Direct-Access     General  USB Flash Disk   1100 PQ: 0 ANSI: 6
[   92.162387] sd 9:0:0:0: Attached scsi generic sg1 type 0
[   92.162925] sd 9:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[   92.163355] sd 9:0:0:0: [sdb] Write Protect is off
[   92.163358] sd 9:0:0:0: [sdb] Mode Sense: 43 00 00 00
[   92.163785] sd 9:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   92.171207]  sdb: sdb1 sdb2
[   92.172967] sd 9:0:0:0: [sdb] Attached SCSI removable disk
[   94.797927] usb 4-3: USB disconnect, device number 2
[  100.640350] usb 4-3: new SuperSpeed USB device number 3 using xhci_hcd
[  100.658527] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[  100.662189] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[  100.662191] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  100.662192] usb 4-3: Product: USB Flash Disk
[  100.662193] usb 4-3: Manufacturer: General
[  100.662194] usb 4-3: SerialNumber: 0411200000013498
[  100.663121] usb-storage 4-3:1.0: USB Mass Storage device detected
[  100.663219] scsi10 : usb-storage 4-3:1.0
[  101.996701] scsi 10:0:0:0: Direct-Access     General  USB Flash Disk   1100 PQ: 0 ANSI: 6
[  101.996889] sd 10:0:0:0: Attached scsi generic sg1 type 0
[  101.997446] sd 10:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[  101.997894] sd 10:0:0:0: [sdb] Write Protect is off
[  101.997897] sd 10:0:0:0: [sdb] Mode Sense: 43 00 00 00
[  101.998325] sd 10:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[  102.005805]  sdb: sdb1 sdb2
[  102.007584] sd 10:0:0:0: [sdb] Attached SCSI removable disk
[  102.718253] usb 4-3: USB disconnect, device number 3
[  102.718566] sd 10:0:0:0: [sdb] Synchronizing SCSI cache
[  102.718599] sd 10:0:0:0: [sdb]  
[  102.718601] Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[  108.333005] usb 4-3: new SuperSpeed USB device number 4 using xhci_hcd
[  108.351069] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[  108.354758] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[  108.354764] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  108.354768] usb 4-3: Product: USB Flash Disk
[  108.354771] usb 4-3: Manufacturer: General
[  108.354773] usb 4-3: SerialNumber: 0411200000013498
[  108.355795] usb-storage 4-3:1.0: USB Mass Storage device detected
[  108.355949] scsi11 : usb-storage 4-3:1.0
[  109.689267] scsi 11:0:0:0: Direct-Access     General  USB Flash Disk   1100 PQ: 0 ANSI: 6
[  109.689642] sd 11:0:0:0: Attached scsi generic sg1 type 0
[  109.690191] sd 11:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[  109.690635] sd 11:0:0:0: [sdb] Write Protect is off
[  109.690638] sd 11:0:0:0: [sdb] Mode Sense: 43 00 00 00
[  109.691070] sd 11:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[  109.698735]  sdb: sdb1 sdb2
[  109.700562] sd 11:0:0:0: [sdb] Attached SCSI removable disk
[  110.854797] usb 4-3: USB disconnect, device number 4
[  110.855419] sd 11:0:0:0: [sdb] Synchronizing SCSI cache
[  110.855455] sd 11:0:0:0: [sdb]  
[  110.855458] Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[  158.381766] init: kdump-tools main process (6045) terminated with status 1
[  159.852867] init: mnp_logger_goobuntu main process ended, respawning

Revision history for this message

Joseph Salisbury (jsalisbury) wrote on 2016-05-18:

#4

Great, thanks for testing. I'll submit that commit to the appropriate upstream kernels and SRU it to Ubuntu.

Revision history for this message

Mike Gerow (gerow) wrote on 2016-05-20:

#5

Excellent. Thanks for the prompt response!

Kamal Mostafa (kamalmostafa) on 2016-05-20

Changed in linux (Ubuntu Trusty):
status:	In Progress → Fix Committed
Changed in linux (Ubuntu Vivid):
status:	In Progress → Fix Committed
Changed in linux (Ubuntu Wily):
status:	In Progress → Fix Committed

Revision history for this message

Philipp Kern (pkern) wrote on 2016-05-21:

#6

It'd be helpful if this memory corruption regression could be accelerated. It means that unplugging a USB3 device can mess up the memory enough that file lookups that happen afterwards break if apparmor is enabled - just because the allocation size is similar by chance. The resulting oops is very misleading and it took a long time to track this down. It also causes process hangs. Thanks.

Joseph Salisbury (jsalisbury) on 2016-05-24

Changed in linux (Ubuntu):
status:	In Progress → Fix Committed

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-05-25:

#7

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-trusty

Revision history for this message

Mike Gerow (gerow) wrote on 2016-05-25:

#8

Download full text (3.1 KiB)

Looks good! Started with slub_debug and not seeing any Oopses when uplugging usb3 storage.

$ uname -rsov
Linux 3.13.0-87-generic #133-Ubuntu SMP Tue May 24 18:32:09 UTC 2016 GNU/Linux

$ dmesg
...
[ 79.103213] usb 4-3: new SuperSpeed USB device number 2 using xhci_hcd
[ 79.121274] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 79.124995] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[ 79.124997] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 79.124998] usb 4-3: Product: USB Flash Disk
[ 79.124999] usb 4-3: Manufacturer: General
[ 79.125000] usb 4-3: SerialNumber: 0411200000013498
[ 79.133013] usb-storage 4-3:1.0: USB Mass Storage device detected
[ 79.133058] scsi9 : usb-storage 4-3:1.0
[ 79.133100] usbcore: registered new interface driver usb-storage
[ 80.467553] scsi 9:0:0:0: Direct-Access General USB Flash Disk 1100 PQ: 0 ANSI: 6
[ 80.467749] sd 9:0:0:0: Attached scsi generic sg1 type 0
[ 80.468294] sd 9:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[ 80.468733] sd 9:0:0:0: [sdb] Write Protect is off
[ 80.468735] sd 9:0:0:0: [sdb] Mode Sense: 43 00 00 00
[ 80.469164] sd 9:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 80.476633] sdb: sdb1 sdb2
[ 80.478409] sd 9:0:0:0: [sdb] Attached SCSI removable disk
[ 84.533954] usb 4-3: USB disconnect, device number 2
[ 84.534205] sd 9:0:0:0: [sdb] Synchronizing SCSI cache
[ 84.534243] sd 9:0:0:0: [sdb]
[ 84.534246] Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[ 92.110736] usb 4-3: new SuperSpeed USB device number 3 using xhci_hcd
[ 92.128888] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 92.132571] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[ 92.132573] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 92.132574] usb 4-3: Product: USB Flash Disk
[ 92.132575] usb 4-3: Manufacturer: General
[ 92.132576] usb 4-3: SerialNumber: 0411200000013498
[ 92.133446] usb-storage 4-3:1.0: USB Mass Storage device detected
[ 92.133507] scsi10 : usb-storage 4-3:1.0
[ 93.393578] usb 4-3: reset SuperSpeed USB device number 3 using xhci_hcd
[ 93.411644] usb 4-3: Parent hub missing LPM exit latency info. Power management will be impacted.
[ 93.412809] xhci_hcd 0000:08:00.0: xHCI xhci_drop_endpoint called with disabled ep ffff8807a239f400
[ 93.412811] xhci_hcd 0000:08:00.0: xHCI xhci_drop_endpoint called with disabled ep ffff8807a239f440
[ 93.751289] scsi 10:0:0:0: Direct-Access General USB Flash Disk 1100 PQ: 0 ANSI: 6
[ 93.751502] sd 10:0:0:0: Attached scsi generic sg1 type 0
[ 93.752012] sd 10:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[ 93.752456] sd 10:0:0:0: [sdb] Write Protect is off
[ 93.752459] sd 10:0:0:0: [sdb] Mode Sense: 43 00 00 00
[ 93.752888] sd 10:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 93.760680] sdb: sdb1 sdb2
[ 93.762441] sd 10:0:0:0: [sdb] Attached SCSI removable disk
[ 98.704248] usb 4-3: USB disconnect, devic...

Looks good! Started with slub_debug and not seeing any Oopses when uplugging usb3 storage.

$ uname -rsov
Linux 3.13.0-87-generic #133-Ubuntu SMP Tue May 24 18:32:09 UTC 2016 GNU/Linux

$ dmesg
...
[   79.103213] usb 4-3: new SuperSpeed USB device number 2 using xhci_hcd
[   79.121274] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[   79.124995] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[   79.124997] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   79.124998] usb 4-3: Product: USB Flash Disk
[   79.124999] usb 4-3: Manufacturer: General
[   79.125000] usb 4-3: SerialNumber: 0411200000013498
[   79.133013] usb-storage 4-3:1.0: USB Mass Storage device detected
[   79.133058] scsi9 : usb-storage 4-3:1.0
[   79.133100] usbcore: registered new interface driver usb-storage
[   80.467553] scsi 9:0:0:0: Direct-Access     General  USB Flash Disk   1100 PQ: 0 ANSI: 6
[   80.467749] sd 9:0:0:0: Attached scsi generic sg1 type 0
[   80.468294] sd 9:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[   80.468733] sd 9:0:0:0: [sdb] Write Protect is off
[   80.468735] sd 9:0:0:0: [sdb] Mode Sense: 43 00 00 00
[   80.469164] sd 9:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   80.476633]  sdb: sdb1 sdb2
[   80.478409] sd 9:0:0:0: [sdb] Attached SCSI removable disk
[   84.533954] usb 4-3: USB disconnect, device number 2
[   84.534205] sd 9:0:0:0: [sdb] Synchronizing SCSI cache
[   84.534243] sd 9:0:0:0: [sdb]  
[   84.534246] Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[   92.110736] usb 4-3: new SuperSpeed USB device number 3 using xhci_hcd
[   92.128888] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[   92.132571] usb 4-3: New USB device found, idVendor=090c, idProduct=1000
[   92.132573] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   92.132574] usb 4-3: Product: USB Flash Disk
[   92.132575] usb 4-3: Manufacturer: General
[   92.132576] usb 4-3: SerialNumber: 0411200000013498
[   92.133446] usb-storage 4-3:1.0: USB Mass Storage device detected
[   92.133507] scsi10 : usb-storage 4-3:1.0
[   93.393578] usb 4-3: reset SuperSpeed USB device number 3 using xhci_hcd
[   93.411644] usb 4-3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[   93.412809] xhci_hcd 0000:08:00.0: xHCI xhci_drop_endpoint called with disabled ep ffff8807a239f400
[   93.412811] xhci_hcd 0000:08:00.0: xHCI xhci_drop_endpoint called with disabled ep ffff8807a239f440
[   93.751289] scsi 10:0:0:0: Direct-Access     General  USB Flash Disk   1100 PQ: 0 ANSI: 6
[   93.751502] sd 10:0:0:0: Attached scsi generic sg1 type 0
[   93.752012] sd 10:0:0:0: [sdb] 125960192 512-byte logical blocks: (64.4 GB/60.0 GiB)
[   93.752456] sd 10:0:0:0: [sdb] Write Protect is off
[   93.752459] sd 10:0:0:0: [sdb] Mode Sense: 43 00 00 00
[   93.752888] sd 10:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   93.760680]  sdb: sdb1 sdb2
[   93.762441] sd 10:0:0:0: [sdb] Attached SCSI removable disk
[   98.704248] usb 4-3: USB disconnect, device number 3
...

tags:

added: verification-done-trusty
removed: verification-needed-trusty

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-05-31:

#9

This bug was fixed in the package linux - 3.13.0-87.133

---------------
linux (3.13.0-87.133) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1585315

[ Upstream Kernel Changes ]

* Revert "usb: hub: do not clear BOS field during reset device"
- LP: #1582864

linux (3.13.0-87.132) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1582398

[ Kamal Mostafa ]

* [Config] Drop ozwpan from the ABI

[ Luis Henriques ]

  * [Config] CONFIG_USB_WPAN_HCD=n
    - LP: #1463740
    - CVE-2015-4004

[ Prarit Bhargava ]

  * SAUCE: (no-up) ACPICA: Dispatcher: Update thread ID for recursive
    method calls
    - LP: #1577898

[ Upstream Kernel Changes ]

  * usbnet: cleanup after bind() in probe()
    - LP: #1567191
    - CVE-2016-3951
  * KVM: x86: bit-ops emulation ignores offset on 64-bit
    - LP: #1423672
  * USB: usbip: fix potential out-of-bounds write
    - LP: #1572666
    - CVE-2016-3955
  * x86/mm/32: Enable full randomization on i386 and X86_32
    - LP: #1568523
    - CVE-2016-3672
  * Input: gtco - fix crash on detecting device without endpoints
    - LP: #1575706
    - CVE-2016-2187
  * atl2: Disable unimplemented scatter/gather feature
    - LP: #1561403
    - CVE-2016-2117
  * ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
    - LP: #1577905
  * fs/pnode.c: treat zero mnt_group_id-s as unequal
    - LP: #1572316
  * propogate_mnt: Handle the first propogated copy being a slave
    - LP: #1572316
  * drm: Balance error path for GEM handle allocation
    - LP: #1579610
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1538429
    - CVE-2016-2069
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1538429
    - CVE-2016-2069
  * net: fix infoleak in llc
    - LP: #1578496
    - CVE-2016-4485
  * net: fix infoleak in rtnetlink
    - LP: #1578497
    - CVE-2016-4486

-- Kamal Mostafa <email address hidden> Tue, 24 May 2016 11:04:30 -0700

This bug was fixed in the package linux - 3.13.0-87.133

---------------
linux (3.13.0-87.133) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1585315

[ Upstream Kernel Changes ]

* Revert "usb: hub: do not clear BOS field during reset device"
    - LP: #1582864

linux (3.13.0-87.132) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1582398

[ Kamal Mostafa ]

* [Config] Drop ozwpan from the ABI

[ Luis Henriques ]

* [Config] CONFIG_USB_WPAN_HCD=n
    - LP: #1463740
    - CVE-2015-4004

[ Prarit Bhargava ]

* SAUCE: (no-up) ACPICA: Dispatcher: Update thread ID for recursive
    method calls
    - LP: #1577898

[ Upstream Kernel Changes ]

* usbnet: cleanup after bind() in probe()
    - LP: #1567191
    - CVE-2016-3951
  * KVM: x86: bit-ops emulation ignores offset on 64-bit
    - LP: #1423672
  * USB: usbip: fix potential out-of-bounds write
    - LP: #1572666
    - CVE-2016-3955
  * x86/mm/32: Enable full randomization on i386 and X86_32
    - LP: #1568523
    - CVE-2016-3672
  * Input: gtco - fix crash on detecting device without endpoints
    - LP: #1575706
    - CVE-2016-2187
  * atl2: Disable unimplemented scatter/gather feature
    - LP: #1561403
    - CVE-2016-2117
  * ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
    - LP: #1577905
  * fs/pnode.c: treat zero mnt_group_id-s as unequal
    - LP: #1572316
  * propogate_mnt: Handle the first propogated copy being a slave
    - LP: #1572316
  * drm: Balance error path for GEM handle allocation
    - LP: #1579610
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1538429
    - CVE-2016-2069
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1538429
    - CVE-2016-2069
  * net: fix infoleak in llc
    - LP: #1578496
    - CVE-2016-4485
  * net: fix infoleak in rtnetlink
    - LP: #1578497
    - CVE-2016-4486

-- Kamal Mostafa <kamal@canonical.com>  Tue, 24 May 2016 11:04:30 -0700

Changed in linux (Ubuntu Trusty):
status:	Fix Committed → Fix Released

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-06-14:

#10

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-vivid
tags:	added: verification-needed-wily

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-06-14:

#11

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-wily' to 'verification-done-wily'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message

Mike Gerow (gerow) wrote on 2016-06-17:

#12

$ uname -a
Linux gerow0 4.2.0-39-generic #46~14.04.1-Ubuntu SMP Mon Jun 13 15:40:38 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

No oopses in wily, verified. Booting into vivid next.

tags:

added: verification-done-wily
removed: verification-needed-wily

Revision history for this message

Mike Gerow (gerow) wrote on 2016-06-17:

#13

$ uname -a
Linux gerow0 3.19.0-62-generic #70~14.04.1-Ubuntu SMP Mon Jun 13 16:30:31 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

No oopses in vivid either, verified.

tags:

added: verification-done-vivid
removed: verification-needed-vivid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-06-27:

#14

Download full text (7.4 KiB)

This bug was fixed in the package linux - 4.2.0-41.48

---------------
linux (4.2.0-41.48) wily; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1595914

[ Upstream Kernel Changes ]

  * netfilter: x_tables: validate e->target_offset early
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: make sure e->next_offset covers remaining blob
    size
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: fix unconditional helper
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: don't move to non-existent next rule
    - LP: #1595350
  * netfilter: x_tables: validate targets of jumps
    - LP: #1595350
  * netfilter: x_tables: add and use xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: kill check_entry helper
    - LP: #1595350
  * netfilter: x_tables: assert minimum target size
    - LP: #1595350
  * netfilter: x_tables: add compat version of xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: check standard target size too
    - LP: #1595350
  * netfilter: x_tables: check for bogus target offset
    - LP: #1595350
  * netfilter: x_tables: validate all offsets and sizes in a rule
    - LP: #1595350
  * netfilter: x_tables: don't reject valid target size on some
    architectures
    - LP: #1595350
  * netfilter: arp_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip6_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
    - LP: #1595350
  * netfilter: x_tables: do compat validation via translate_table
    - LP: #1595350
  * netfilter: x_tables: introduce and use xt_copy_counters_from_user
    - LP: #1595350

linux (4.2.0-40.47) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1595725

[ Serge Hallyn ]

* SAUCE: add a sysctl to disable unprivileged user namespace unsharing
- LP: #1555338, #1595350

linux (4.2.0-39.46) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1591301

[ J. R. Okajima ]

  * SAUCE: AUFS: mm/mmap: fix oopsing on remap_file_pages aufs mmap:
    bugfix, mainly for linux-4.5-rc5, remap_file_pages(2) emulation
    - LP: #1558120

[ Kamal Mostafa ]

  * [debian] getabis: Only git add $abidir if running in local repo
    - LP: #1584890
  * [debian] getabis: Fix inconsistent compiler versions check
    - LP: #1584890

[ Tim Gardner ]

  * Revert "SAUCE: mm/mmap: fix oopsing on remap_file_pages"
    - LP: #1558120
  * [Config] Remove arc4 from nic-modules
    - LP: #1582991

[ Upstream Kernel Changes ]

  * Revert "usb: hub: do not clear BOS field during reset device"
    - LP: #1582864
  * hpsa: move lockup_detected attribute to host attr
    - LP: #1581169
  * ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
    - LP: #1580379
    - CVE-2016-4569
  * ALSA: timer: Fix leak in events via snd_timer_user_ccallback
    - LP: #1581866
    - CVE-2016-4578
  * ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
    - LP: #1581866
    - CVE-2016-4578
  * net: fix a kernel inf...

This bug was fixed in the package linux - 4.2.0-41.48

---------------
linux (4.2.0-41.48) wily; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1595914

[ Upstream Kernel Changes ]

* netfilter: x_tables: validate e->target_offset early
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: make sure e->next_offset covers remaining blob
    size
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: fix unconditional helper
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: don't move to non-existent next rule
    - LP: #1595350
  * netfilter: x_tables: validate targets of jumps
    - LP: #1595350
  * netfilter: x_tables: add and use xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: kill check_entry helper
    - LP: #1595350
  * netfilter: x_tables: assert minimum target size
    - LP: #1595350
  * netfilter: x_tables: add compat version of xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: check standard target size too
    - LP: #1595350
  * netfilter: x_tables: check for bogus target offset
    - LP: #1595350
  * netfilter: x_tables: validate all offsets and sizes in a rule
    - LP: #1595350
  * netfilter: x_tables: don't reject valid target size on some
    architectures
    - LP: #1595350
  * netfilter: arp_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip6_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
    - LP: #1595350
  * netfilter: x_tables: do compat validation via translate_table
    - LP: #1595350
  * netfilter: x_tables: introduce and use xt_copy_counters_from_user
    - LP: #1595350

linux (4.2.0-40.47) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1595725

[ Serge Hallyn ]

* SAUCE: add a sysctl to disable unprivileged user namespace unsharing
    - LP: #1555338, #1595350

linux (4.2.0-39.46) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1591301

[ J. R. Okajima ]

* SAUCE: AUFS: mm/mmap: fix oopsing on remap_file_pages aufs mmap:
    bugfix, mainly for linux-4.5-rc5, remap_file_pages(2) emulation
    - LP: #1558120

[ Kamal Mostafa ]

* [debian] getabis: Only git add $abidir if running in local repo
    - LP: #1584890
  * [debian] getabis: Fix inconsistent compiler versions check
    - LP: #1584890

[ Tim Gardner ]

* Revert "SAUCE: mm/mmap: fix oopsing on remap_file_pages"
    - LP: #1558120
  * [Config] Remove arc4 from nic-modules
    - LP: #1582991

[ Upstream Kernel Changes ]

* Revert "usb: hub: do not clear BOS field during reset device"
    - LP: #1582864
  * hpsa: move lockup_detected attribute to host attr
    - LP: #1581169
  * ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
    - LP: #1580379
    - CVE-2016-4569
  * ALSA: timer: Fix leak in events via snd_timer_user_ccallback
    - LP: #1581866
    - CVE-2016-4578
  * ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
    - LP: #1581866
    - CVE-2016-4578
  * net: fix a kernel infoleak in x25 module
    - LP: #1585366
    - CVE-2016-4580
  * get_rock_ridge_filename(): handle malformed NM entries
    - LP: #1583962
    - CVE-2016-4913
  * tipc: check nl sock before parsing nested attributes
    - LP: #1585365
    - CVE-2016-4951
  * netfilter: Set /proc/net entries owner to root in namespace
    - LP: #1584953
  * USB: usbfs: fix potential infoleak in devio
    - LP: #1578493
    - CVE-2016-4482
  * USB: leave LPM alone if possible when binding/unbinding interface
    drivers
    - LP: #1577024
  * [4.2-stable only] fix backport "IB/security: restrict use of the
    write() interface"
    - LP: #1586447
  * regulator: s2mps11: Fix invalid selector mask and voltages for buck9
    - LP: #1586447
  * regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case
    - LP: #1586447
  * ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2)
    - LP: #1586447
  * atomic_open(): fix the handling of create_error
    - LP: #1586447
  * drm/i915/bdw: Add missing delay during L3 SQC credit programming
    - LP: #1586447
  * crypto: hash - Fix page length clamping in hash walk
    - LP: #1586447
  * drm/radeon: fix DP link training issue with second 4K monitor
    - LP: #1586447
  * drm/radeon: fix PLL sharing on DCE6.1 (v2)
    - LP: #1586447
  * ALSA: hda - Fix white noise on Asus UX501VW headset
    - LP: #1586447
  * Input: max8997-haptic - fix NULL pointer dereference
    - LP: #1586447
  * drm/i915: Bail out of pipe config compute loop on LPT
    - LP: #1586447
  * ALSA: hda - Fix broken reconfig
    - LP: #1586447
  * ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
    - LP: #1586447
  * vfs: add vfs_select_inode() helper
    - LP: #1586447
  * vfs: rename: check backing inode being equal
    - LP: #1586447
  * ALSA: usb-audio: Yet another Phoneix Audio device quirk
    - LP: #1586447
  * perf/x86: Fix undefined shift on 32-bit kernels
    - LP: #1586447
  * perf/x86/intel/pt: Generate PMI in the STOP region as well
    - LP: #1586447
  * perf/core: Disable the event on a truncated AUX record
    - LP: #1586447
  * tools lib traceevent: Do not reassign parg after collapse_tree()
    - LP: #1586447
  * workqueue: fix rebind bound workers warning
    - LP: #1586447
  * ocfs2: fix posix_acl_create deadlock
    - LP: #1586447
  * nf_conntrack: avoid kernel pointer value leak in slab name
    - LP: #1586447
  * macvtap: segmented packet is consumed
    - LP: #1586447
  * regulator: axp20x: Fix axp22x ldo_io voltage ranges
    - LP: #1586447
  * arm64: bpf: jit JMP_JSET_{X,K}
    - LP: #1586447
  * bridge: fix igmp / mld query parsing
    - LP: #1586447
  * net/mlx4_en: Fix endianness bug in IPV6 csum calculation
    - LP: #1586447
  * net: fec: only clear a queue's work bit if the queue was emptied
    - LP: #1586447
  * tcp: refresh skb timestamp at retransmit time
    - LP: #1586447
  * net/route: enforce hoplimit max value
    - LP: #1586447
  * decnet: Do not build routes to devices without decnet private data.
    - LP: #1586447
  * route: do not cache fib route info on local routes with oif
    - LP: #1586447
  * net: use skb_postpush_rcsum instead of own implementations
    - LP: #1586447
  * vlan: pull on __vlan_insert_tag error path and fix csum correction
    - LP: #1586447
  * ipv4/fib: don't warn when primary address is missing if in_dev is dead
    - LP: #1586447
  * bpf: fix double-fdput in replace_map_fd_with_map_ptr()
    - LP: #1586447
  * net_sched: introduce qdisc_replace() helper
    - LP: #1586447
  * net_sched: update hierarchical backlog too
    - LP: #1586447
  * sch_htb: update backlog as well
    - LP: #1586447
  * sch_dsmark: update backlog as well
    - LP: #1586447
  * netem: Segment GSO packets on enqueue
    - LP: #1586447
  * VSOCK: do not disconnect socket when peer has shutdown SEND only
    - LP: #1586447
  * net: bridge: fix old ioctl unlocked net device walk
    - LP: #1586447
  * cdc_mbim: apply "NDP to end" quirk to all Huawei devices
    - LP: #1586447
  * soreuseport: fix ordering for mixed v4/v6 sockets
    - LP: #1586447
  * uapi glibc compat: fix compile errors when glibc net/if.h included
    before linux/if.h
    - LP: #1586447
  * Linux 4.2.8-ckt11
    - LP: #1586447
  * usb: core: hub: hub_port_init lock controller instead of bus
    - LP: #1437492

-- Luis Henriques <luis.henriques@canonical.com>  Fri, 24 Jun 2016 11:46:57 +0100

Changed in linux (Ubuntu Wily):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-06-27:

#15

Download full text (6.2 KiB)

This bug was fixed in the package linux - 3.19.0-64.72

---------------
linux (3.19.0-64.72) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1595976

[ Upstream Kernel Changes ]

  * netfilter: x_tables: validate e->target_offset early
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: make sure e->next_offset covers remaining blob
    size
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: fix unconditional helper
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: don't move to non-existent next rule
    - LP: #1595350
  * netfilter: x_tables: validate targets of jumps
    - LP: #1595350
  * netfilter: x_tables: add and use xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: kill check_entry helper
    - LP: #1595350
  * netfilter: x_tables: assert minimum target size
    - LP: #1595350
  * netfilter: x_tables: add compat version of xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: check standard target size too
    - LP: #1595350
  * netfilter: x_tables: check for bogus target offset
    - LP: #1595350
  * netfilter: x_tables: validate all offsets and sizes in a rule
    - LP: #1595350
  * netfilter: x_tables: don't reject valid target size on some
    architectures
    - LP: #1595350
  * netfilter: arp_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip6_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
    - LP: #1595350
  * netfilter: x_tables: do compat validation via translate_table
    - LP: #1595350
  * netfilter: x_tables: introduce and use xt_copy_counters_from_user
    - LP: #1595350

linux (3.19.0-63.71) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1595723

[ Serge Hallyn ]

* SAUCE: add a sysctl to disable unprivileged user namespace unsharing
- LP: #1555338, #1595350

linux (3.19.0-62.70) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1591307

[ Kamal Mostafa ]

  * [debian] getabis: Only git add $abidir if running in local repo
    - LP: #1584890
  * [debian] getabis: Fix inconsistent compiler versions check
    - LP: #1584890

[ Tim Gardner ]

* [Config] Remove arc4 from nic-modules
- LP: #1582991

[ Upstream Kernel Changes ]

  * Revert "usb: hub: do not clear BOS field during reset device"
    - LP: #1582864
  * ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
    - LP: #1580379
    - CVE-2016-4569
  * ALSA: timer: Fix leak in events via snd_timer_user_ccallback
    - LP: #1581866
    - CVE-2016-4578
  * ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
    - LP: #1581866
    - CVE-2016-4578
  * net: fix a kernel infoleak in x25 module
    - LP: #1585366
    - CVE-2016-4580
  * get_rock_ridge_filename(): handle malformed NM entries
    - LP: #1583962
    - CVE-2016-4913
  * tipc: check nl sock before parsing nested attributes
    - LP: #1585365
    - CVE-2016-4951
  * netfilter: Set /proc/net entries owner to root in namespace
    - L...

This bug was fixed in the package linux - 3.19.0-64.72

---------------
linux (3.19.0-64.72) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1595976

[ Upstream Kernel Changes ]

* netfilter: x_tables: validate e->target_offset early
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: make sure e->next_offset covers remaining blob
    size
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: fix unconditional helper
    - LP: #1555338
    - CVE-2016-3134
  * netfilter: x_tables: don't move to non-existent next rule
    - LP: #1595350
  * netfilter: x_tables: validate targets of jumps
    - LP: #1595350
  * netfilter: x_tables: add and use xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: kill check_entry helper
    - LP: #1595350
  * netfilter: x_tables: assert minimum target size
    - LP: #1595350
  * netfilter: x_tables: add compat version of xt_check_entry_offsets
    - LP: #1595350
  * netfilter: x_tables: check standard target size too
    - LP: #1595350
  * netfilter: x_tables: check for bogus target offset
    - LP: #1595350
  * netfilter: x_tables: validate all offsets and sizes in a rule
    - LP: #1595350
  * netfilter: x_tables: don't reject valid target size on some
    architectures
    - LP: #1595350
  * netfilter: arp_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: ip6_tables: simplify translate_compat_table args
    - LP: #1595350
  * netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
    - LP: #1595350
  * netfilter: x_tables: do compat validation via translate_table
    - LP: #1595350
  * netfilter: x_tables: introduce and use xt_copy_counters_from_user
    - LP: #1595350

linux (3.19.0-63.71) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1595723

[ Serge Hallyn ]

* SAUCE: add a sysctl to disable unprivileged user namespace unsharing
    - LP: #1555338, #1595350

linux (3.19.0-62.70) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1591307

[ Kamal Mostafa ]

* [debian] getabis: Only git add $abidir if running in local repo
    - LP: #1584890
  * [debian] getabis: Fix inconsistent compiler versions check
    - LP: #1584890

[ Tim Gardner ]

* [Config] Remove arc4 from nic-modules
    - LP: #1582991

[ Upstream Kernel Changes ]

* Revert "usb: hub: do not clear BOS field during reset device"
    - LP: #1582864
  * ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
    - LP: #1580379
    - CVE-2016-4569
  * ALSA: timer: Fix leak in events via snd_timer_user_ccallback
    - LP: #1581866
    - CVE-2016-4578
  * ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
    - LP: #1581866
    - CVE-2016-4578
  * net: fix a kernel infoleak in x25 module
    - LP: #1585366
    - CVE-2016-4580
  * get_rock_ridge_filename(): handle malformed NM entries
    - LP: #1583962
    - CVE-2016-4913
  * tipc: check nl sock before parsing nested attributes
    - LP: #1585365
    - CVE-2016-4951
  * netfilter: Set /proc/net entries owner to root in namespace
    - LP: #1584953
  * USB: usbfs: fix potential infoleak in devio
    - LP: #1578493
    - CVE-2016-4482
  * USB: leave LPM alone if possible when binding/unbinding interface
    drivers
    - LP: #1577024
  * compiler-gcc: integrate the various compiler-gcc[345].h files
    - LP: #1587557
  * fix backport "IB/security: restrict use of the write() interface"
    - LP: #1587557
  * x86: LLVMLinux: Fix "incomplete type const struct x86cpu_device_id"
    - LP: #1587557
  * regulator: s2mps11: Fix invalid selector mask and voltages for buck9
    - LP: #1587557
  * regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case
    - LP: #1587557
  * atomic_open(): fix the handling of create_error
    - LP: #1587557
  * crypto: hash - Fix page length clamping in hash walk
    - LP: #1587557
  * drm/radeon: fix PLL sharing on DCE6.1 (v2)
    - LP: #1587557
  * ALSA: hda - Fix white noise on Asus UX501VW headset
    - LP: #1587557
  * Input: max8997-haptic - fix NULL pointer dereference
    - LP: #1587557
  * drm/i915: Bail out of pipe config compute loop on LPT
    - LP: #1587557
  * ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
    - LP: #1587557
  * tools lib traceevent: Free filter tokens in process_filter()
    - LP: #1587557
  * tools lib traceevent: Do not reassign parg after collapse_tree()
    - LP: #1587557
  * workqueue: fix rebind bound workers warning
    - LP: #1587557
  * ocfs2: fix posix_acl_create deadlock
    - LP: #1587557
  * nf_conntrack: avoid kernel pointer value leak in slab name
    - LP: #1587557
  * net: fec: only clear a queue's work bit if the queue was emptied
    - LP: #1587557
  * net/mlx4_en: Fix endianness bug in IPV6 csum calculation
    - LP: #1587557
  * macvtap: segmented packet is consumed
    - LP: #1587557
  * tcp: refresh skb timestamp at retransmit time
    - LP: #1587557
  * arm64: bpf: jit JMP_JSET_{X,K}
    - LP: #1587557
  * decnet: Do not build routes to devices without decnet private data.
    - LP: #1587557
  * route: do not cache fib route info on local routes with oif
    - LP: #1587557
  * net: use skb_postpush_rcsum instead of own implementations
    - LP: #1587557
  * vlan: pull on __vlan_insert_tag error path and fix csum correction
    - LP: #1587557
  * ipv4/fib: don't warn when primary address is missing if in_dev is dead
    - LP: #1587557
  * bpf: fix double-fdput in replace_map_fd_with_map_ptr()
    - LP: #1587557
  * net_sched: introduce qdisc_replace() helper
    - LP: #1587557
  * net_sched: update hierarchical backlog too
    - LP: #1587557
  * sch_htb: update backlog as well
    - LP: #1587557
  * sch_dsmark: update backlog as well
    - LP: #1587557
  * netem: Segment GSO packets on enqueue
    - LP: #1587557
  * VSOCK: do not disconnect socket when peer has shutdown SEND only
    - LP: #1587557
  * net: bridge: fix old ioctl unlocked net device walk
    - LP: #1587557
  * Linux 3.19.8-ckt22
    - LP: #1587557
  * usb: core: hub: hub_port_init lock controller instead of bus
    - LP: #1437492
  * i915_bpo: Check live status before reading edid
    - LP: #1588375

-- Luis Henriques <luis.henriques@canonical.com>  Fri, 24 Jun 2016 15:39:13 +0100

Changed in linux (Ubuntu Vivid):
status:	Fix Committed → Fix Released

Po-Hsu Lin (cypressyew) on 2019-10-03

Changed in linux (Ubuntu):
status:	Fix Committed → Fix Released

Ubuntu
linux package

use after free of BOS in usb_reset_and_verify_device

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Joseph Salisbury
Trusty	Fix Released	Medium	Joseph Salisbury
Vivid	Fix Released	Medium	Joseph Salisbury
Wily	Fix Released	Medium	Joseph Salisbury

Ubuntulinux package

use after free of BOS in usb_reset_and_verify_device

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package