This bug was fixed in the package linux - 4.8.0-11.12

---------------
linux (4.8.0-11.12) yakkety; urgency=low

  * change_hat is logging failures during expected hat probing (LP: #1615893)
    - SAUCE: apparmor: Fix auditing behavior for change_hat probing

  * deleted files outside of the namespace are not being treated as
    disconnected
    (LP: #1615892)
    - SAUCE: apparmor: deleted dentries can be disconnected

  * stacking to unconfined in a child namespace confuses mediation
    (LP: #1615890)
    - SAUCE: apparmor: special case unconfined when determining the mode

  * apparmor module parameters can be changed after the policy is locked
    (LP: #1615895)
    - SAUCE: apparmor: fix: parameters can be changed after policy is locked

  * AppArmor profile reloading causes an intermittent kernel BUG (LP:
    #1579135)
    - SAUCE: apparmor: fix vec_unique for vectors larger than 8

  * label vec reductions can result in reference labels instead of direct
    access
    to labels (LP: #1615889)
    - SAUCE: apparmor: reduction of vec to single entry is just that entry

  * profiles from different namespaces can block other namespaces from being
    able to load a profile (LP: #1615887)
    - SAUCE: apparmor: profiles in one ns can affect mediation in another ns

  * The label build for onexec when stacking is wrong (LP: #1615881)
    - SAUCE: apparmor: Fix label build for onexec stacking.

  * The inherit check for new to old label comparison for domain transitions
    is
    wrong (LP: #1615880)
    - SAUCE: apparmor: Fix new to old label comparison for domain transitions

  * warning stack trace while playing with apparmor namespaces (LP: #1593874)
    - SAUCE: apparmor: fix stack trace when removing namespace with profiles

  * __label_update proxy comparison test is wrong (LP: #1615878)
    - SAUCE: apparmor: Fix __label_update proxy comparison test

  * reading /sys/kernel/security/apparmor/profiles requires CAP_MAC_ADMIN
    (LP: #1560583)
    - SAUCE: apparmor: Allow ns_root processes to open profiles file
    - SAUCE: apparmor: Consult sysctl when reading profiles in a user ns

  * policy namespace stacking (LP: #1379535)
    - SAUCE: (no-up) apparmor: rebase of apparmor3.5-beta1 snapshot for 4.8
    - SAUCE: add a sysctl to enable unprivileged user ns AppArmor policy loading

  * Miscellaneous Ubuntu changes
    - [Debian] Dynamically determine linux udebs package name
    - [Debian] d-i -- fix dtb handling in new kernel-wedge form
    - SAUCE: apparmor: Fix FTBFS due to bad include path
    - SAUCE: apparmor: add data query support
    - [Config] Set CONFIG_SECURITY_APPARMOR_UNCONFINED_INIT=y

  * Miscellaneous upstream changes
    - fixup backout policy view capable for forward port
    - apparmor: fix: Rework the iter loop for label_update
    - apparmor: add more assertions for updates/merges to help catch errors
    - apparmor: Make pivot root transitions work with stacking
    - apparmor: convert delegating deleted files to mediate deleted files
    - apparmor: add missing parens. not a bug fix but highly recommended
    - apparmor: add a stack_version file to allow detection of bug fixes
    - apparmor: push path lookup into mediation loop
    - apparmor: default to allowing unprivileged userns policy
    - apparmor: fix: permissions test to view and manage policy
    - apparmor: Add Basic ns cross check condition for ipc

 -- Leann Ogasawara <leann.ogasaw...@canonical.com>  Sat, 17 Sep 2016
10:03:16 -0700

** Changed in: linux (Ubuntu Yakkety)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1579135

Title:
  AppArmor profile reloading causes an intermittent kernel BUG

Status in apparmor package in Ubuntu:
  Incomplete
Status in linux package in Ubuntu:
  Fix Released
Status in apparmor source package in Xenial:
  Confirmed
Status in linux source package in Xenial:
  Fix Released
Status in apparmor source package in Yakkety:
  Incomplete
Status in linux source package in Yakkety:
  Fix Released

Bug description:
  First, a bit of background: I've built a go binary of the upstream
  snappy integration tests, and built them into a snap so that we can
  easily keep them up to date, and call them from other test suites.

  I'm running through the tests in qemu on a current 16 image (built
  yesteray), and hitting this most of the time with the homeInterface
  Suite tests in particular. The networkInterfaceSuite tests also seem
  to produce a similar problem:

  sudo snap connect home-consumer:home ubuntu-core:home
  [/] Connect home-consumer:home to ubuntu-core:home
  home-consumer.writer /home/ubuntu/snap/snappy-tests/100001/writable
  sudo snap disconnect home-consumer:home ubuntu-core:home
  [  519.416354] BUG: unable to handle kernel NULL pointer dereference at 
0000000000000038
  [  519.417327] IP: [<ffffffff81388eef>] profile_cmp+0x2f/0x180
  [  519.417978] PGD 1f26a067 PUD 1aa4f067 PMD 0 
  [  519.418574] Oops: 0000 [#1] SMP 
  [  519.419032] Modules linked in: kvm_intel joydev kvm ppdev snd_pcm 
snd_timer irqbypass snd soundcore parport_pc pcspkr input_leds floppy parport 
evbug psmouse e1000 8250_fintek i2c_piix4 mac_hid pata_acpi serio_raw autofs4 
nls_iso8859_1 usb_storage ahci libahci squashfs
  [  519.422747] CPU: 0 PID: 1915 Comm: apparmor_parser Tainted: G        W     
  4.4.0-21-generic #37-Ubuntu
  [  519.423689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
Ubuntu-1.8.2-1ubuntu1 04/01/2014
  [  519.424627] task: ffff88001d23cb00 ti: ffff88001b58c000 task.ti: 
ffff88001b58c000
  [  519.425385] RIP: 0010:[<ffffffff81388eef>]  [<ffffffff81388eef>] 
profile_cmp+0x2f/0x180
  [  519.426242] RSP: 0018:ffff88001b58fcb0  EFLAGS: 00010086
  [  519.426791] RAX: 0000000000000000 RBX: ffff88001b1b1400 RCX: 
0000000000000006
  [  519.427628] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 
0000000000000009
  [  519.428405] RBP: ffff88001b58fcc0 R08: 000000000000000a R09: 
0000000000000274
  [  519.429127] R10: ffff88001f236890 R11: 0000000000000274 R12: 
0000000000000000
  [  519.429956] R13: 000000000000000b R14: 0000000000000000 R15: 
ffff88001abff950
  [  519.430957] FS:  00007f0c1609b740(0000) GS:ffff88001fc00000(0000) 
knlGS:0000000000000000
  [  519.432256] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [  519.433030] CR2: 0000000000000038 CR3: 000000001b14b000 CR4: 
00000000000006f0
  [  519.433868] Stack:
  [  519.434204]  000000000000000c ffff88001abff9b0 ffff88001b58fd08 
ffffffff8138a0c3
  [  519.435355]  000000011f2b9450 ffff88000000000c ffff88001abff950 
ffff88001b1b1760
  [  519.436480]  ffff88001f236848 ffff88001abff900 ffff88001f236840 
ffff88001b58fd98
  [  519.437609] Call Trace:
  [  519.438007]  [<ffffffff8138a0c3>] aa_vec_unique+0x163/0x240
  [  519.438709]  [<ffffffff8138e337>] __aa_labelset_update_subtree+0x687/0x820
  [  519.439537]  [<ffffffff813811fb>] aa_replace_profiles+0x59b/0xb70
  [  519.440268]  [<ffffffff811ec5ae>] ? __kmalloc+0x22e/0x250
  [  519.440944]  [<ffffffff81375f1f>] policy_update+0x9f/0x1f0
  [  519.441617]  [<ffffffff81376083>] profile_replace+0x13/0x20
  [  519.442299]  [<ffffffff8120bf38>] __vfs_write+0x18/0x40
  [  519.443032]  [<ffffffff8120c8c9>] vfs_write+0xa9/0x1a0
  [  519.443721]  [<ffffffff8120b85f>] ? do_sys_open+0x1bf/0x2a0
  [  519.444416]  [<ffffffff8120d585>] SyS_write+0x55/0xc0
  [  519.445042]  [<ffffffff818244f2>] entry_SYSCALL_64_fastpath+0x16/0x71
  [  519.445802] Code: 00 55 48 85 ff 48 89 e5 41 54 53 49 89 f4 48 89 fb 0f 84 
8b 00 00 00 4d 85 e4 0f 84 aa 00 00 00 48 83 7b 38 00 0f 84 c9 00 00 00 <49> 83 
7c 24 38 00 0f 84 e8 00 00 00 48 83 7b 08 00 0f 84 07 01 
  [  519.451336] RIP  [<ffffffff81388eef>] profile_cmp+0x2f/0x180
  [  519.452088]  RSP <ffff88001b58fcb0>
  [  519.452570] CR2: 0000000000000038
  [  519.453032] ---[ end trace 65ff12ee2e7c26af ]---

  The details of this test can be found at:
  
https://github.com/ubuntu-core/snappy/tree/master/integration-tests/data/snaps/home-consumer

  Will follow up with more details

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1579135/+subscriptions

_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to     : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp

Reply via email to