This bug was fixed in the package linux - 4.4.0-83.106 --------------- linux (4.4.0-83.106) xenial; urgency=low
* linux: 4.4.0-83.106 -proposed tracker (LP: #1700541) * CVE-2017-1000364 - Revert "UBUNTU: SAUCE: mm: Only expand stack if guard area is hit" - Revert "mm: do not collapse stack gap into THP" - Revert "mm: enlarge stack guard gap" - mm: vma_adjust: remove superfluous confusing update in remove_next == 1 case - mm: larger stack guard gap, between vmas - mm: fix new crash in unmapped_area_topdown() - Allow stack to grow up to address space limit linux (4.4.0-82.105) xenial; urgency=low * linux: 4.4.0-82.105 -proposed tracker (LP: #1699064) * CVE-2017-1000364 - SAUCE: mm: Only expand stack if guard area is hit * linux-aws/linux-gke incorrectly producing and using linux-*-tools- common/linux-*-cloud-tools-common (LP: #1688579) - [Config] make linux-tools-common and linux-cloud-tools-common protection consistent * CVE-2017-9242 - ipv6: fix out of bound writes in __ip6_append_data() * CVE-2017-9075 - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent * CVE-2017-9074 - ipv6: Prevent overrun when parsing v6 header options * CVE-2017-9076 - ipv6/dccp: do not inherit ipv6_mc_list from parent * CVE-2017-9077 - ipv6/dccp: do not inherit ipv6_mc_list from parent * CVE-2017-8890 - dccp/tcp: do not inherit mc_list from parent * Module signing exclusion for staging drivers does not work properly (LP: #1690908) - SAUCE: Fix module signing exclusion in package builds * extend-diff-ignore should use exact matches (LP: #1693504) - [Packaging] exact extend-diff-ignore matches * Dell XPS 9360 wifi 5G performance is poor (LP: #1692836) - SAUCE: ath10k: fix the wifi speed issue for kill 1535 * Upgrade Redpine WLAN/BT driver to ver. 1.2.RC12 (LP: #1694607) - SAUCE: Redpine: Upgrade to ver. 1.2.RC12 * [DP MST] No audio output through HDMI/DP/mDP ports in Dell WD15 and TB15 docking stations (LP: #1694665) - drm/i915: Store port enum in intel_encoder - drm/i915: Eliminate redundant local variable definition - drm/i915: Switch to using port stored in intel_encoder - drm/i915: Move audio_connector to intel_encoder - drm/i915/dp: DP audio API changes for MST - drm/i915: abstract ddi being audio enabled - drm/i915/audio: extend get_saved_enc() to support more scenarios - drm/i915: enable dp mst audio * Xenial update to 4.4.70 stable release (LP: #1694621) - usb: misc: legousbtower: Fix buffers on stack - usb: misc: legousbtower: Fix memory leak - USB: ene_usb6250: fix DMA to the stack - watchdog: pcwd_usb: fix NULL-deref at probe - char: lp: fix possible integer overflow in lp_setup() - USB: core: replace %p with %pK - ARM: tegra: paz00: Mark panel regulator as enabled on boot - tpm_crb: check for bad response size - infiniband: call ipv6 route lookup via the stub interface - dm btree: fix for dm_btree_find_lowest_key() - dm raid: select the Kconfig option CONFIG_MD_RAID0 - dm bufio: avoid a possible ABBA deadlock - dm bufio: check new buffer allocation watermark every 30 seconds - dm cache metadata: fail operations if fail_io mode has been established - dm bufio: make the parameter "retain_bytes" unsigned long - dm thin metadata: call precommit before saving the roots - dm space map disk: fix some book keeping in the disk space map - md: update slab_cache before releasing new stripes when stripes resizing - rtlwifi: rtl8821ae: setup 8812ae RFE according to device type - mwifiex: pcie: fix cmd_buf use-after-free in remove/reset - ima: accept previously set IMA_NEW_FILE - KVM: x86: Fix load damaged SSEx MXCSR register - KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation - regulator: tps65023: Fix inverted core enable logic. - s390/kdump: Add final note - s390/cputime: fix incorrect system time - ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device - ath9k_htc: fix NULL-deref at probe - drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. - drm/amdgpu: Make display watermark calculations more accurate - drm/nouveau/therm: remove ineffective workarounds for alarm bugs - drm/nouveau/tmr: ack interrupt before processing alarms - drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm - drm/nouveau/tmr: avoid processing completed alarms when adding a new one - drm/nouveau/tmr: handle races with hw when updating the next alarm time - cdc-acm: fix possible invalid access when processing notification - proc: Fix unbalanced hard link numbers - of: fix sparse warning in of_pci_range_parser_one - iio: dac: ad7303: fix channel description - pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes - pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() - USB: serial: ftdi_sio: fix setting latency for unprivileged users - USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs - ext4 crypto: don't let data integrity writebacks fail with ENOMEM - ext4 crypto: fix some error handling - net: qmi_wwan: Add SIMCom 7230E - fscrypt: fix context consistency check when key(s) unavailable - f2fs: check entire encrypted bigname when finding a dentry - fscrypt: avoid collisions when presenting long encrypted filenames - usb: host: xhci-plat: propagate return value of platform_get_irq() - xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton - usb: host: xhci-mem: allocate zeroed Scratchpad Buffer - net: irda: irda-usb: fix firmware name on big-endian hosts - usbvision: fix NULL-deref at probe - mceusb: fix NULL-deref at probe - ttusb2: limit messages to buffer size - usb: musb: tusb6010_omap: Do not reset the other direction's packet size - USB: iowarrior: fix info ioctl on big-endian hosts - usb: serial: option: add Telit ME910 support - USB: serial: qcserial: add more Lenovo EM74xx device IDs - USB: serial: mct_u232: fix big-endian baud-rate handling - USB: serial: io_ti: fix div-by-zero in set_termios - USB: hub: fix SS hub-descriptor handling - USB: hub: fix non-SS hub-descriptor handling - ipx: call ipxitf_put() in ioctl error path - iio: proximity: as3935: fix as3935_write - ceph: fix recursion between ceph_set_acl() and __ceph_setattr() - gspca: konica: add missing endpoint sanity check - s5p-mfc: Fix unbalanced call to clock management - dib0700: fix NULL-deref at probe - zr364xx: enforce minimum size when reading header - dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops - cx231xx-audio: fix init error path - cx231xx-audio: fix NULL-deref at probe - cx231xx-cards: fix NULL-deref at probe - powerpc/book3s/mce: Move add_taint() later in virtual mode - powerpc/pseries: Fix of_node_put() underflow during DLPAR remove - powerpc/64e: Fix hang when debugging programs with relocated kernel - ARM: dts: at91: sama5d3_xplained: fix ADC vref - ARM: dts: at91: sama5d3_xplained: not all ADC channels are available - arm64: xchg: hazard against entire exchange variable - arm64: uaccess: ensure extension of access_ok() addr - arm64: documentation: document tagged pointer stack constraints - xc2028: Fix use-after-free bug properly - Revert "UBUNTU: SAUCE: mm: Respect FOLL_FORCE/FOLL_COW for thp" - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp - staging: rtl8192e: fix 2 byte alignment of register BSSIDR. - staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. - iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings - metag/uaccess: Fix access_ok() - metag/uaccess: Check access_ok in strncpy_from_user - uwb: fix device quirk on big-endian hosts - genirq: Fix chained interrupt data ordering - osf_wait4(): fix infoleak - tracing/kprobes: Enforce kprobes teardown after testing - PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms - PCI: Freeze PME scan before suspending devices - drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 - nfsd: encoders mustn't use unitialized values in error cases - drivers: char: mem: Check for address space wraparound with mmap() - Linux 4.4.70 * Xenial update to 4.4.69 stable release (LP: #1692900) - xen: adjust early dom0 p2m handling to xen hypervisor behavior - target: Fix compare_and_write_callback handling for non GOOD status - target/fileio: Fix zero-length READ and WRITE handling - target: Convert ACL change queue_depth se_session reference usage - iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement - usb: host: xhci: print correct command ring address - USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit - USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously - staging: vt6656: use off stack for in buffer USB transfers. - staging: vt6656: use off stack for out buffer USB transfers. - staging: gdm724x: gdm_mux: fix use-after-free on module unload - staging: comedi: jr3_pci: fix possible null pointer dereference - staging: comedi: jr3_pci: cope with jiffies wraparound - usb: misc: add missing continue in switch - usb: Make sure usb/phy/of gets built-in - usb: hub: Fix error loop seen after hub communication errors - usb: hub: Do not attempt to autosuspend disconnected devices - x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup - selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug - x86, pmem: Fix cache flushing for iovec write < 8 bytes - um: Fix PTRACE_POKEUSER on x86_64 - KVM: x86: fix user triggerable warning in kvm_apic_accept_events() - KVM: arm/arm64: fix races in kvm_psci_vcpu_on - block: fix blk_integrity_register to use template's interval_exp if not 0 - crypto: algif_aead - Require setkey before accept(2) - dm era: save spacemap metadata root after the pre-commit - vfio/type1: Remove locked page accounting workqueue - IB/core: Fix sysfs registration error flow - IB/IPoIB: ibX: failed to create mcg debug file - IB/mlx4: Fix ib device initialization error flow - IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level - ext4: evict inline data when writing to memory map - fs/xattr.c: zero out memory copied to userspace in getxattr - ceph: fix memory leak in __ceph_setxattr() - fs/block_dev: always invalidate cleancache in invalidate_bdev() - Set unicode flag on cifs echo request to avoid Mac error - SMB3: Work around mount failure when using SMB3 dialect to Macs - CIFS: fix mapping of SFM_SPACE and SFM_PERIOD - cifs: fix CIFS_IOC_GET_MNT_INFO oops - CIFS: add misssing SFM mapping for doublequote - padata: free correct variable - arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses - serial: samsung: Use right device for DMA-mapping calls - serial: omap: fix runtime-pm handling on unbind - serial: omap: suspend device on probe errors - tty: pty: Fix ldisc flush after userspace become aware of the data already - Bluetooth: Fix user channel for 32bit userspace on 64bit kernel - Bluetooth: hci_bcm: add missing tty-device sanity check - Bluetooth: hci_intel: add missing tty-device sanity check - mac80211: pass RX aggregation window size to driver - mac80211: pass block ack session timeout to to driver - mac80211: RX BA support for sta max_rx_aggregation_subframes - wlcore: Pass win_size taken from ieee80211_sta to FW - wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event - ipmi: Fix kernel panic at ipmi_ssif_thread() - Linux 4.4.69 * Support IPMI system interface on Cavium ThunderX (LP: #1688132) - i2c: octeon: Cleanup kerneldoc comments - i2c: octeon: Cleanup i2c-octeon driver - i2c: octeon: Cleanup resource allocation code - i2c: octeon: Support I2C_M_RECV_LEN - i2c: octeon: Increase retry default and use fixed timeout value - i2c: octeon: Move set-clock and init-lowlevel upward - i2c: octeon: Rename [read|write]_sw to reg_[read|write] - i2c: octeon: Introduce helper functions for register access - i2c: octeon: Remove superfluous check in octeon_i2c_test_iflg - i2c: octeon: Improve error status checking - i2c: octeon: Use i2c recovery framework - i2c: octeon: Add flush writeq helper function - i2c: octeon: Enable High-Level Controller - i2c: octeon: Add support for cn78xx chips - i2c: octeon: Remove zero-length message support - i2c: octeon: Improve performance if interrupt is early - i2c: octeon: Add workaround for broken irqs on CN3860 - i2c: octeon: Missing AAK flag in case of I2C_M_RECV_LEN - i2c: octeon: Avoid printk after too long SMBUS message - i2c: octeon: Rename driver to prepare for split - i2c: octeon: Split the driver into two parts - [Config] CONFIG_I2C_THUNDERX=m - i2c: thunderx: Add i2c driver for ThunderX SOC - i2c: thunderx: Add SMBUS alert support - i2c: octeon,thunderx: Move register offsets to struct - i2c: octeon: Sort include files alphabetically - i2c: octeon: Use booleon values for booleon variables - i2c: octeon: thunderx: Add MAINTAINERS entry - i2c: octeon: Fix set SCL recovery function - i2c: octeon: Avoid sending STOP during recovery - i2c: octeon: Fix high-level controller status check - i2c: octeon: thunderx: TWSI software reset in recovery - i2c: octeon: thunderx: Remove double-check after interrupt - i2c: octeon: thunderx: Limit register access retries - i2c: thunderx: Enable HWMON class probing * Xenial update to 4.4.68 stable release (LP: #1691418) - 9p: fix a potential acl leak - ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode - cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores - powerpc/powernv: Fix opal_exit tracepoint opcode - power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING - power: supply: bq24190_charger: Call set_mode_host() on pm_resume() - power: supply: bq24190_charger: Install irq_handler_thread() at end of probe() - power: supply: bq24190_charger: Call power_supply_changed() for relevant component - power: supply: bq24190_charger: Don't read fault register outside irq_handle_thread() - power: supply: bq24190_charger: Handle fault before status on interrupt - leds: ktd2692: avoid harmless maybe-uninitialized warning - ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build - mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print - mwifiex: remove redundant dma padding in AMSDU - mwifiex: Avoid skipping WEP key deletion for AP - x86/ioapic: Restore IO-APIC irq_chip retrigger callback - x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0 - clk: Make x86/ conditional on CONFIG_COMMON_CLK - kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed - x86/platform/intel-mid: Correct MSI IRQ line for watchdog device - Revert "KVM: nested VMX: disable perf cpuid reporting" - KVM: nVMX: initialize PML fields in vmcs02 - KVM: nVMX: do not leak PML full vmexit to L1 - usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths - usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths - usb: chipidea: Only read/write OTGSC from one place - usb: chipidea: Handle extcon events properly - USB: serial: keyspan_pda: fix receive sanity checks - USB: serial: digi_acceleport: fix incomplete rx sanity check - USB: serial: ssu100: fix control-message error handling - USB: serial: io_edgeport: fix epic-descriptor handling - USB: serial: ti_usb_3410_5052: fix control-message error handling - USB: serial: ark3116: fix open error handling - USB: serial: ftdi_sio: fix latency-timer error handling - USB: serial: quatech2: fix control-message error handling - USB: serial: mct_u232: fix modem-status error handling - USB: serial: io_edgeport: fix descriptor error handling - phy: qcom-usb-hs: Add depends on EXTCON - serial: 8250_omap: Fix probe and remove for PM runtime - scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m - MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix - brcmfmac: Ensure pointer correctly set if skb data location changes - brcmfmac: Make skb header writable before use - staging: wlan-ng: add missing byte order conversion - staging: emxx_udc: remove incorrect __init annotations - ALSA: hda - Fix deadlock of controller device lock at unbinding - tcp: do not underestimate skb->truesize in tcp_trim_head() - bpf, arm64: fix jit branch offset related to ldimm64 - tcp: fix wraparound issue in tcp_lp - tcp: do not inherit fastopen_req from parent - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string - ipv6: initialize route null entry in addrconf_init() - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf - bnxt_en: allocate enough space for ->ntp_fltr_bmap - f2fs: sanity check segment count - drm/ttm: fix use-after-free races in vm fault handling - block: get rid of blk_integrity_revalidate() - Linux 4.4.68 * Keyboard backlight control does not work on some dell laptops. (LP: #1693126) - platform/x86: dell-laptop: Add Latitude 7480 and others to the DMI whitelist - platform/x86: dell-laptop: Add keyboard backlight timeout AC settings * Upgrade Redpine WLAN/BT driver to ver. 1.2.RC9 (LP: #1690498) - SAUCE: Redpine: Upgrade to ver. 1.2.RC9 * exec'ing a setuid binary from a threaded program sometimes fails to setuid (LP: #1672819) - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct * attempts to rename vlans / vlans have addr_assign_type of 0 on kernel 4.4 (LP: #1682871) - vlan: Propagate MAC address to VLANs * Exar usb-serial doesn't restore baud rate after resume from S3/S4 (LP: #1690362) - SAUCE: xr-usb-serial: re-initialise baudrate after resume from S3/S4 * st_pressure, st_accel IIO drivers fail to detect sensors after reloading kernel modules (LP: #1690310) - SAUCE: (no-up) iio: st_pressure: st_accel: Initialise sensor platform data properly * nvidia-docker on ppc64le-ubuntu16.04 issue due to cross-thread naming if !PR_DUMPABLE (LP: #1690225) - procfs: fix pthread cross-thread naming if !PR_DUMPABLE * linux xenial derivatives fail to build (LP: #1691814) - [Packaging] Set do_tools_common in common vars -- Thadeu Lima de Souza Cascardo <casca...@canonical.com> Mon, 26 Jun 2017 12:27:55 -0300 ** Changed in: linux (Ubuntu Xenial) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1672819 Title: exec'ing a setuid binary from a threaded program sometimes fails to setuid Status in Linux: Unknown Status in linux package in Ubuntu: Fix Committed Status in linux source package in Xenial: Fix Released Status in linux source package in Yakkety: Fix Released Status in linux source package in Zesty: Fix Committed Bug description: == SRU REQUEST XENIAL, YAKKETY, ZESTY == Due to two race conditions in check_unsafe_exec(), exec'ing a setuid binary from a threaded program sometimes fails to setuid. == Fix == Sauce patch for Xenial, Yakkety + Zesty: https://lists.ubuntu.com/archives/kernel-team/2017-May/084102.html This fix re-executes the unsafe check if there is a discrepancy between the expected fs count and the found count during the racy window during thread exec or exit. This re-check occurs very infrequently and saves a lot of addition locking on per thread structures that would make performance of fork/exec/exit prohibitively expensive. == Test case == See the example C code in the patch, https://lists.ubuntu.com/archives /kernel-team/2017-May/084102.html Run the test code as follows: for i in $(seq 1000); do ./a; done With the patch, no messages are emitted, without the patch, one sees a message: "Failed, got euid 1000 (expecting 0)" ..which shows the setuid program failed the check_unsafe_exec() because of the race. == Regression potential == breaking existing safe exec semantics. ==================== This can be reproduced with https://gist.github.com/chipaca/806c90d96c437444f27f45a83d00a813 With that, and go 1.8, if you run “make” and then for i in `seq 99`; do ./a_go; done you'll see a variable number of ”GOT 1000” (or whatever your user id is). If you don't, add one or two more 9s on there. That's a simple go reproducer. You can also use “a_p” instead of “a_go” to see one that only uses pthreads. “a_c” is a C version that does *not* reproduce the issue. But it's not pthreads: if in a_go.go you comment out the “import "C"”, you'll still see the “GOT 1000” messages, in a static binary that uses no pthreads, just clone(2). You'll also see a bunch of warnings because it's not properly handling an EAGAIN from clone, but that's unrelated. If you pin the process to a single thread using taskset, you don't get the issue from a_go; a_p continues to reproduce the issue. In some virtualized environments we haven't been able to reproduce the issue either (e.g. some aws instances), but kvm works (you need -smp to see the issue from a_go). ProblemType: Bug DistroRelease: Ubuntu 16.04 Package: linux-image-4.4.0-64-generic 4.4.0-64.85 ProcVersionSignature: Ubuntu 4.4.0-64.85-generic 4.4.44 Uname: Linux 4.4.0-64-generic x86_64 NonfreeKernelModules: zfs zunicode zcommon znvpair zavl ApportVersion: 2.20.1-0ubuntu2.5 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/pcmC0D0p: john 2354 F...m pulseaudio /dev/snd/controlC0: john 2354 F.... pulseaudio CurrentDesktop: Unity Date: Tue Mar 14 17:17:23 2017 HibernationDevice: RESUME=UUID=b9fd155b-dcbe-4337-ae77-6daa6569beaf InstallationDate: Installed on 2014-04-27 (1051 days ago) InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417) MachineType: Dell Inc. Latitude E6510 ProcFB: 0 inteldrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-4.4.0-64-generic root=/dev/mapper/ubuntu--vg-root ro enable_mtrr_cleanup mtrr_spare_reg_nr=8 mtrr_gran_size=32M mtrr_chunk_size=32M quiet splash RelatedPackageVersions: linux-restricted-modules-4.4.0-64-generic N/A linux-backports-modules-4.4.0-64-generic N/A linux-firmware 1.157.8 SourcePackage: linux SystemImageInfo: Error: command ['system-image-cli', '-i'] failed with exit code 2: UpgradeStatus: Upgraded to xenial on 2015-06-18 (634 days ago) dmi.bios.date: 12/05/2013 dmi.bios.vendor: Dell Inc. dmi.bios.version: A16 dmi.board.vendor: Dell Inc. dmi.chassis.type: 9 dmi.chassis.vendor: Dell Inc. dmi.modalias: dmi:bvnDellInc.:bvrA16:bd12/05/2013:svnDellInc.:pnLatitudeE6510:pvr0001:rvnDellInc.:rn:rvr:cvnDellInc.:ct9:cvr: dmi.product.name: Latitude E6510 dmi.product.version: 0001 dmi.sys.vendor: Dell Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/linux/+bug/1672819/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp