This bug was fixed in the package linux - 4.18.0-20.21 --------------- linux (4.18.0-20.21) cosmic; urgency=medium
* CVE-2018-12126 // CVE-2018-12127 // CVE-2018-12130 - Documentation/l1tf: Fix small spelling typo - x86/cpu: Sanitize FAM6_ATOM naming - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID - locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file - tools include: Adopt linux/bits.h - x86/msr-index: Cleanup bit defines - x86/speculation: Consolidate CPU whitelists - x86/speculation/mds: Add basic bug infrastructure for MDS - x86/speculation/mds: Add BUG_MSBDS_ONLY - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests - x86/speculation/mds: Add mds_clear_cpu_buffers() - x86/speculation/mds: Clear CPU buffers on exit to user - x86/kvm/vmx: Add MDS protection when L1D Flush is not active - x86/speculation/mds: Conditionally clear CPU buffers on idle entry - x86/speculation/mds: Add mitigation control for MDS - x86/speculation/mds: Add sysfs reporting for MDS - x86/speculation/mds: Add mitigation mode VMWERV - Documentation: Move L1TF to separate directory - Documentation: Add MDS vulnerability documentation - x86/speculation/mds: Add mds=full,nosmt cmdline option - x86/speculation: Move arch_smt_update() call to after mitigation decisions - x86/speculation/mds: Add SMT warning message - x86/speculation/mds: Fix comment - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off - x86/speculation/mds: Add 'mitigations=' support for MDS * CVE-2017-5715 // CVE-2017-5753 - s390/speculation: Support 'mitigations=' cmdline option * CVE-2017-5715 // CVE-2017-5753 // CVE-2017-5754 // CVE-2018-3639 - powerpc/speculation: Support 'mitigations=' cmdline option * CVE-2017-5715 // CVE-2017-5754 // CVE-2018-3620 // CVE-2018-3639 // CVE-2018-3646 - cpu/speculation: Add 'mitigations=' cmdline option - x86/speculation: Support 'mitigations=' cmdline option * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log linux (4.18.0-19.20) cosmic; urgency=medium * linux: 4.18.0-19.20 -proposed tracker (LP: #1826171) * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log * autopkgtests run too often, too much and don't skip enough (LP: #1823056) - [Debian] Set +x on rebuild testcase. - [Debian] Skip rebuild test, for regression-suite deps. - [Debian] Make ubuntu-regression-suite skippable on unbootable kernels. - [Debian] make rebuild use skippable error codes when skipping. - [Debian] Only run regression-suite, if requested to. * CVE-2017-5753 - s390/keyboard: sanitize array index in do_kdsk_ioctl - drm/bufs: Fix Spectre v1 vulnerability - drivers/misc/sgi-gru: fix Spectre v1 vulnerability - ipv4: Fix potential Spectre v1 vulnerability - aio: fix spectre gadget in lookup_ioctx - ALSA: emux: Fix potential Spectre v1 vulnerabilities - ALSA: pcm: Fix potential Spectre v1 vulnerability - ip6mr: Fix potential Spectre v1 vulnerability - ALSA: rme9652: Fix potential Spectre v1 vulnerability - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities - KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq() - drm/ioctl: Fix Spectre v1 vulnerabilities - net: core: Fix Spectre v1 vulnerability - phonet: af_phonet: Fix Spectre v1 vulnerability - nfc: af_nfc: Fix Spectre v1 vulnerability - can: af_can: Fix Spectre v1 vulnerability - net: Revert recent Spectre-v1 patches. - char/mwave: fix potential Spectre v1 vulnerability - applicom: Fix potential Spectre v1 vulnerabilities - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities - powerpc/ptrace: Mitigate potential Spectre v1 - cfg80211: prevent speculation on cfg80211_classify8021d() return - ALSA: rawmidi: Fix potential Spectre v1 vulnerability - ALSA: seq: oss: Fix Spectre v1 vulnerability * NULL pointer dereference when using z3fold and zswap (LP: #1814874) - z3fold: fix possible reclaim races * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487) - misc: rtsx: Enable OCP for rts522a rts524a rts525a rts5260 - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch * headset-mic doesn't work on two Dell laptops. (LP: #1825272) - ALSA: hda/realtek - add two more pin configuration sets to quirk table * CVE-2018-16884 - sunrpc: use SVC_NET() in svcauth_gss_* functions - sunrpc: use-after-free in svc_process_common() * AMD Rome : Minimal support patches (LP: #1816669) - x86: irq_remapping: Move irq remapping mode enum - iommu/amd: Add support for higher 64-bit IOMMU Control Register - iommu/amd: Add support for IOMMU XT mode * sky2 ethernet card don't work after returning from suspension (LP: #1798921) - sky2: Increase D3 delay again * CVE-2019-9500 - brcmfmac: assure SSID length from firmware is limited * CVE-2019-9503 - brcmfmac: add subtype check for event handling in data path * CVE-2019-3882 - vfio/type1: Limit DMA mappings per container * CVE-2019-3887 - KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) - KVM: x86: nVMX: fix x2APIC VTPR read intercept * CVE-2019-3874 - sctp: use sk_wmem_queued to check for writable space - sctp: implement memory accounting on tx path - sctp: implement memory accounting on rx path * Intel I210 Ethernet card not working after hotplug [8086:1533] (LP: #1818490) - igb: Fix WARN_ONCE on runtime suspend * autofs kernel module missing (LP: #1824333) - [Config] Update autofs4 path in inclusion list * tasks doing write()/fsync() hit deadlock in write_cache_pages() (LP: #1824827) - mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock * Pop noise when headset is plugged in or removed from GHS/Line-out jack (LP: #1821290) - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225 - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB * mac80211_hwsim unable to handle kernel NULL pointer dereference at0000000000000000 (LP: #1825058) - mac80211_hwsim: Timer should be initialized before device registered * [regression][snd_hda_codec_realtek] repeating crackling noise after 19.04 upgrade (LP: #1821663) - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist - ALSA: hda - Add two more machines to the power_save_blacklist * systemd cause kernel trace "BUG: unable to handle kernel paging request at 6db23a14" on Cosmic i386 (LP: #1813244) // systemd cause kernel trace "BUG: unable to handle kernel paging request at 6db23a14" on Cosmic i386 (LP: #1813244) - openvswitch: fix flow actions reallocation -- Stefan Bader <stefan.ba...@canonical.com> Mon, 06 May 2019 18:19:46 +0200 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1814874 Title: NULL pointer dereference when using z3fold and zswap Status in Linux: Fix Released Status in linux package in Ubuntu: Fix Released Status in linux source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Bug description: == Justification == When using z3fold and zswap on a VM under overcommitted memory stress, z3fold will complains about an "unknown buddy id 0" and fail to get a pointer to the mapped allocation in z3fold_map(). z3fold: unknown buddy id 0 WARNING: CPU: 2 PID: 1584 at mm/z3fold.c:971 z3fold_zpool_map+0xce/0x100 [z3fold] And it will leads to a null pointer dereference in zswap BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 1584 Comm: stress Tainted: G W 4.18.0-17-generic #18-Ubuntu Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1ubuntu1 04/01/2014 RIP: 0010:zswap_writeback_entry+0x4d/0x360 == Fix == ca0246bb (z3fold: fix possible reclaim races) This patch has already in Disco, and can be cherry-picked into B/C. Not needed for Xenial and older kernels as z3fold is not supported. == Test == Test kernels for Bionic / Cosmic could be found here: http://people.canonical.com/~phlin/kernel/lp-1814874-z3fold-zswap/Bionic/ http://people.canonical.com/~phlin/kernel/lp-1814874-z3fold-zswap/Cosmic/ This issue can be reproduced easily in a KVM with the following setup: * 8G disk, 4G RAM, 4 CPUs * 1G swap * "zswap.enabled=1 zswap.zpool=z3fold zswap.max_pool_percent=7" added to grub * "z3fold" module added into /etc/initramfs-tools/modules Stress it with two childs running: * stress --vm-bytes 512M --vm 4 --vm-hang 3 * stress --vm-bytes 512M --vm 4 --vm-hang 7 The VM is expected to crash within 5 minutes. With the patched kernel, the VM can withstand this stress for over an hour with crashing with this issue == Regression potential == Small. Fix limited to z3fold. User needs to enable it explicitly for this feature. == Original Bug Report == Under memory pressure, my VM locks up. This has been reported upstream though I don't know how far any solution has progressed. https://bugzilla.kernel.org/show_bug.cgi?id=201603 Feb 6 07:15:42 vps632258 kernel: [151336.450064] z3fold: unknown buddy id 0 Feb 6 07:15:42 vps632258 kernel: [151336.454450] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 The little bit of log I managed to salvage is attached. This has happened to two identical VMs. Unusually it has not occurred on a third VM which is configured the same but has less RAM (fingers crossed it won't). Irrelevant information: I thought the lock-ups were due to me using a BTRFS filesystem, however I swapped over to NILFS2 and this still occurs. The only difference seems to be that I am now able to grab some of the kernel output. ProblemType: Bug DistroRelease: Ubuntu 18.04 Package: linux-image-4.18.0-14-generic 4.18.0-14.15~18.04.1 ProcVersionSignature: Ubuntu 4.18.0-14.15~18.04.1-generic 4.18.20 Uname: Linux 4.18.0-14-generic x86_64 ApportVersion: 2.20.9-0ubuntu7.5 Architecture: amd64 Date: Wed Feb 6 10:55:05 2019 ProcEnviron: TERM=xterm PATH=(custom, no user) XDG_RUNTIME_DIR=<set> LANG=en_GB.UTF-8 SHELL=/bin/bash SourcePackage: linux-signed-hwe UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/linux/+bug/1814874/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp