unable to handle kernel NULL pointer dereference at 000000000000002c (IP: iget5_locked+0x9e/0x1f0)

Bug #1838982 reported by Stefan Bader
24
This bug affects 3 people
Affects Status Importance Assigned to Milestone
HWE Next
Fix Released
Critical
AaronMa
linux (Ubuntu)
Fix Released
Critical
Unassigned
Bionic
Fix Released
Critical
Unassigned
linux-oem (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Fix Released
High
Unassigned

Bug Description

Crash happens during the setup (dpkg) phase of sbuild using a overlayfs based chroot with the current bionic-proposed kernel (4.15.0-56-generic #62-Ubuntu).

[25553.379381] ? ovl_get_origin_fh+0x23/0x150 [overlay]
[25553.379386] ? ovl_inode_test+0x20/0x20 [overlay]
[25553.379390] ? ovl_lock_rename_workdir+0x50/0x50 [overlay]
[25553.379396] ovl_get_inode+0xa2/0x450 [overlay]
[25553.379401] ovl_lookup+0x275/0x760 [overlay]
[25553.379406] lookup_slow+0xab/0x170
[25553.379409] ? lookup_slow+0xab/0x170
[25553.379413] walk_component+0x1c3/0x470
[25553.379416] ? path_init+0x177/0x2f0
[25553.379419] path_lookupat+0x84/0x1f0
[25553.379423] ? __put_cred+0x3d/0x50
[25553.379426] ? revert_creds+0x2f/0x40
[25553.379429] filename_lookup+0xb6/0x190
[25553.379434] ? __check_object_size+0xaf/0x1b0
[25553.379438] user_path_at_empty+0x36/0x40
[25553.379441] ? user_path_at_empty+0x36/0x40
[25553.379444] SyS_chown+0x4d/0xe0
[25553.379449] do_syscall_64+0x73/0x130
[25553.379453] entry_SYSCALL_64_after_hwframe+0x3d/0xa2

SRU justication:
=============
[Impact]
Crash happens during the setup (dpkg) phase of sbuild using a overlayfs
based chroot with the current bionic-proposed kernel (4.15.0-56-generic
#62-Ubuntu).

[Fix]
Fix protential NULL in overlay fs.

[Test]
Verified on fs test and dpkg installation on overlayfs.

[Regression Potential]
Low, remove regression of previous bionic kernel.

Stefan Bader (smb)
Changed in linux (Ubuntu Bionic):
status: New → Confirmed
Changed in linux (Ubuntu):
status: Confirmed → New
Changed in linux (Ubuntu Bionic):
importance: Undecided → High
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1838982

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
tags: added: bionic
Stefan Bader (smb)
Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Stefan Bader (smb) wrote :
Revision history for this message
Stefan Bader (smb) wrote :

I confirmed this in a VM which was doing a dist-upgrade inside an overlay chroot ok with the 4.15.0-55 kernel and did the crash doing the same on 4.15.0-56.

AaronMa (mapengyu)
tags: added: oem-priority originate-from-1838490 sutton
Changed in hwe-next:
assignee: nobody → AaronMa (mapengyu)
description: updated
Revision history for this message
Kamal Mostafa (kamalmostafa) wrote :

Submitter has verified that the problem is fixed by a test kernel with these two reverts applied:

Revert "ovl: set I_CREATING on inode being created"
Revert "new primitive: discard_new_inode()"

See kernel-team mailing list thread Subject: [SRU][B/OEM-B][PATCH 0/1] Fix crash on overlay fs

Revision history for this message
Bin Li (binli) wrote :

Cool, we also met this issue.

Revision history for this message
AaronMa (mapengyu) wrote :

With this regression, Ubuntu can not be installed in OEM image which is using current 4.15-56 kernel.
So set it as critical.

Changed in linux (Ubuntu Bionic):
importance: High → Critical
Changed in linux (Ubuntu):
importance: Undecided → Critical
Changed in hwe-next:
importance: Undecided → Critical
status: New → In Progress
Changed in linux (Ubuntu Bionic):
status: Confirmed → Fix Committed
Changed in linux-oem (Ubuntu Bionic):
status: New → Triaged
importance: Undecided → High
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-bionic
Revision history for this message
Bin Li (binli) wrote :

Tested the 4.15.0-58-generic #64-Ubuntu on OEM image, this issue is gone.

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (171.3 KiB)

This bug was fixed in the package linux - 4.15.0-58.64

---------------
linux (4.15.0-58.64) bionic; urgency=medium

  * unable to handle kernel NULL pointer dereference at 000000000000002c (IP:
    iget5_locked+0x9e/0x1f0) (LP: #1838982)
    - Revert "ovl: set I_CREATING on inode being created"
    - Revert "new primitive: discard_new_inode()"

linux (4.15.0-57.63) bionic; urgency=medium

  * CVE-2019-1125
    - x86/cpufeatures: Carve out CQM features retrieval
    - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word
    - x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
    - x86/speculation: Enable Spectre v1 swapgs mitigations
    - x86/entry/64: Use JMP instead of JMPQ
    - x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS

  * Packaging resync (LP: #1786013)
    - update dkms package versions

linux (4.15.0-56.62) bionic; urgency=medium

  * bionic/linux: 4.15.0-56.62 -proposed tracker (LP: #1837626)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] update helper scripts

  * CVE-2019-2101
    - media: uvcvideo: Fix 'type' check leading to overflow

  * hibmc-drm Causes Unreadable Display for Huawei amd64 Servers (LP: #1762940)
    - [Config] Set CONFIG_DRM_HISI_HIBMC to arm64 only
    - SAUCE: Make CONFIG_DRM_HISI_HIBMC depend on ARM64

  * Bionic: support for Solarflare X2542 network adapter (sfc driver)
    (LP: #1836635)
    - sfc: make mem_bar a function rather than a constant
    - sfc: support VI strides other than 8k
    - sfc: add Medford2 (SFC9250) PCI Device IDs
    - sfc: improve PTP error reporting
    - sfc: update EF10 register definitions
    - sfc: populate the timer reload field
    - sfc: update MCDI protocol headers
    - sfc: support variable number of MAC stats
    - sfc: expose FEC stats on Medford2
    - sfc: expose CTPIO stats on NICs that support them
    - sfc: basic MCDI mapping of 25/50/100G link speeds
    - sfc: support the ethtool ksettings API properly so that 25/50/100G works
    - sfc: add bits for 25/50/100G supported/advertised speeds
    - sfc: remove tx and MCDI handling from NAPI budget consideration
    - sfc: handle TX timestamps in the normal data path
    - sfc: add function to determine which TX timestamping method to use
    - sfc: use main datapath for HW timestamps if available
    - sfc: only enable TX timestamping if the adapter is licensed for it
    - sfc: MAC TX timestamp handling on the 8000 series
    - sfc: on 8000 series use TX queues for TX timestamps
    - sfc: only advertise TX timestamping if we have the license for it
    - sfc: simplify RX datapath timestamping
    - sfc: support separate PTP and general timestamping
    - sfc: support second + quarter ns time format for receive datapath
    - sfc: support Medford2 frequency adjustment format
    - sfc: add suffix to large constant in ptp
    - sfc: mark some unexported symbols as static
    - sfc: update MCDI protocol headers
    - sfc: support FEC configuration through ethtool
    - sfc: remove ctpio_dmabuf_start from stats
    - sfc: stop the TX queue before pushing new buffers

  * [18.04 FEAT] zKVM: Add hardwar...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-oem - 4.15.0-1050.57

---------------
linux-oem (4.15.0-1050.57) bionic; urgency=medium

  * bionic/linux-oem: 4.15.0-1050.57 -proposed tracker (LP: #1839261)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  [ Ubuntu: 4.15.0-58.64 ]

  * unable to handle kernel NULL pointer dereference at 000000000000002c (IP:
    iget5_locked+0x9e/0x1f0) (LP: #1838982)
    - Revert "ovl: set I_CREATING on inode being created"
    - Revert "new primitive: discard_new_inode()"

 -- Chia-Lin Kao (AceLan) <email address hidden> Wed, 07 Aug 2019 18:14:17 +0800

Changed in linux-oem (Ubuntu Bionic):
status: Triaged → Fix Released
Changed in linux-oem (Ubuntu):
status: New → Fix Released
Changed in hwe-next:
status: In Progress → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-xenial
Rex Tsai (chihchun)
Changed in linux (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.