This bug was fixed in the package linux - 3.16.0-36.48 --------------- linux (3.16.0-36.48) utopic; urgency=low
[ Luis Henriques ] * Release Tracking Bug - LP: #1443946 * Merged back Ubuntu-3.16.0-34.47 security release linux (3.16.0-35.46) utopic; urgency=low [ Brad Figg ] * Release Tracking Bug - LP: #1442324 [ Andy Whitcroft ] * [Config] CONFIG_DEFAULT_MMAP_MIN_ADDR needs to match on armhf and arm64 - LP: #1418140 [ Chris J Arges ] * [Config] CONFIG_PCIEASPM_DEBUG=y - LP: #1398544 [ dann frazier ] * [Config] CONFIG_RTC_DRV_EFI=y on arm64 - LP: #1441291 [ Upstream Kernel Changes ] * Revert "USB: serial: make bulk_out_size a lower limit" - LP: #1441317 * Revert "i2c: core: Dispose OF IRQ mapping at client removal time" - LP: #1441317 * Revert "net: cx82310_eth: use common match macro" - LP: #1441317 * KEYS: request_key() should reget expired keys rather than give EKEYEXPIRED - LP: #1124250 * drm/i915/bdw: 3D_CHICKEN3 has write mask bits - LP: #1374389 * drm/i915: call lpt_init_clock_gating on BDW too - LP: #1374389 * drm/i915/bdw: Apply workarounds in render ring init function - LP: #1374389 * drm/i915/bdw: Cleanup pre prod workarounds - LP: #1374389 * drm/i915: Refactor Broadwell PIPE_CONTROL emission into a helper. - LP: #1374389 * drm/i915: Add the WaCsStallBeforeStateCacheInvalidate:bdw workaround. - LP: #1374389 * drm/i915/bdw: Remove BDW preproduction W/As until C stepping. - LP: #1374389 * drm/i915: Rework GPU reset sequence to match driver load & thaw - LP: #1384469 * drm/ast: switch to using CACHED by default for sysram - LP: #1420627 * drm/ast: Add missing entry to dclk_table[] - LP: #1420627 * drm/ast: Add reduced blanking modes for wide screen mode - LP: #1420627 * drm/ast: Try to use MMIO registers when PIO isn't supported - LP: #1420627 * drm/ast: POST chip at probe time if VGA not enabled - LP: #1420627 * drm/ast: Properly initialize P2A base before using it in ast_init_3rdtx() - LP: #1420627 * drm/ast: Don't assume DVO enabled means SIL164 on uninitialized chips - LP: #1420627 * drm/ast: Cleanup analog init code path - LP: #1420627 * audit: correctly record file names with different path name types - LP: #1439441 * of: Create of_console_check() for selecting a console specified in /chosen - LP: #1438585 * of: Enable console on serial ports specified by /chosen/stdout-path - LP: #1438585 * of: correct of_console_check()'s return value - LP: #1438585 * of: Add bindings for chosen node, stdout-path - LP: #1438585 * of: add optional options parameter to of_find_node_by_path() - LP: #1438585 * of: support passing console options with stdout-path - LP: #1438585 * netfilter: nf_tables: disable preemption when restoring chain counters - LP: #1441317 * netfilter: nf_tables: fix leaks in error path of nf_tables_newchain() - LP: #1441317 * ipvs: rerouting to local clients is not needed anymore - LP: #1441317 * netfilter: nft_compat: fix module refcount underflow - LP: #1441317 * netfilter: xt_socket: fix a stack corruption bug - LP: #1441317 * ipvs: add missing ip_vs_pe_put in sync code - LP: #1441317 * flowcache: Fix kernel panic in flow_cache_flush_task - LP: #1441317 * pktgen: fix UDP checksum computation - LP: #1441317 * rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY - LP: #1441317 * tcp: make sure skb is not shared before using skb_get() - LP: #1441317 * ipv6: fix ipv6_cow_metrics for non DST_HOST case - LP: #1441317 * rtnetlink: call ->dellink on failure when ->newlink exists - LP: #1441317 * gen_stats.c: Duplicate xstats buffer for later use - LP: #1441317 * ipv4: ip_check_defrag should correctly check return value of skb_copy_bits - LP: #1441317 * ipv4: ip_check_defrag should not assume that skb_network_offset is zero - LP: #1441317 * net: phy: Fix verification of EEE support in phy_init_eee - LP: #1441317 * ematch: Fix auto-loading of ematch modules. - LP: #1441317 * openvswitch: Fix net exit. - LP: #1441317 * net: reject creation of netdev names with colons - LP: #1441317 * team: fix possible null pointer dereference in team_handle_frame - LP: #1441317 * net: compat: Ignore MSG_CMSG_COMPAT in compat_sys_{send, recv}msg - LP: #1441317 * macvtap: make sure neighbour code can push ethernet header - LP: #1441317 * usb: plusb: Add support for National Instruments host-to-host cable - LP: #1441317 * udp: only allow UFO for packets from SOCK_DGRAM sockets - LP: #1441317 * net: ping: Return EAFNOSUPPORT when appropriate. - LP: #1441317 * team: don't traverse port list using rcu in team_set_mac_address - LP: #1441317 * ALSA: hda - Add pin configs for ASUS mobo with IDT 92HD73XX codec - LP: #1441317 * xfs: Fix quota type in quota structures when reusing quota file - LP: #1441317 * drm/i915: Dell Chromebook 11 has PWM backlight - LP: #1441317 * gpiolib: of: allow of_gpiochip_find_and_xlate to find more than one chip per node - LP: #1441317 * gpio: tps65912: fix wrong container_of arguments - LP: #1441317 * ALSA: pcm: Don't leave PREPARED state after draining - LP: #1441317 * metag: Fix KSTK_EIP() and KSTK_ESP() macros - LP: #1441317 * ALSA: hda: controller code - do not export static functions - LP: #1441317 * drm/i915: Check obj->vma_list under the struct_mutex - LP: #1441317 * md/raid1: fix read balance when a drive is write-mostly. - LP: #1441317 * ALSA: hda - Disable runtime PM for Panther Point again - LP: #1441317 * drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh - LP: #1441317 * drm/radeon: fix 1 RB harvest config setup for TN/RL - LP: #1441317 * arm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian - LP: #1441317 * nilfs2: fix potential memory overrun on inode - LP: #1441317 * iio: mxs-lradc: separate touchscreen and buffer virtual channels - LP: #1441317 * iio: mxs-lradc: make ADC reads not disable touchscreen interrupts - LP: #1441317 * iio: mxs-lradc: make ADC reads not unschedule touchscreen conversions - LP: #1441317 * iio: mxs-lradc: only update the buffer when its conversions have finished - LP: #1441317 * iio: imu: adis16400: Fix sign extension - LP: #1441317 * iio: mxs-lradc: fix iio channel map regression - LP: #1441317 * iio:adc:mcp3422 Fix incorrect scales table - LP: #1441317 * iio: ad5686: fix optional reference voltage declaration - LP: #1441317 * usb: dwc3: dwc3-omap: Fix disable IRQ - LP: #1441317 * usb: gadget: configfs: don't NUL-terminate (sub)compatible ids - LP: #1441317 * KVM: emulate: fix CMPXCHG8B on 32-bit hosts - LP: #1441317 * usb: XHCI: platform: Move the Marvell quirks after the enabling the clocks - LP: #1441317 * xhci: Allocate correct amount of scratchpad buffers - LP: #1441317 * USB: usbfs: don't leak kernel data in siginfo - LP: #1441317 * uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS539 - LP: #1441317 * efi/libstub: Fix boundary checking in efi_high_alloc() - LP: #1441317 * USB: ftdi_sio: add PIDs for Actisense USB devices - LP: #1441317 * USB: serial: fix potential use-after-free after failed probe - LP: #1441317 * USB: serial: fix tty-device error handling at probe - LP: #1441317 * USB: mxuport: fix null deref when used as a console - LP: #1441317 * mac80211: Send EAPOL frames at lowest rate - LP: #1441317 * ARC: Fix KSTK_ESP() - LP: #1441317 * USB: serial: cp210x: Adding Seletek device id's - LP: #1441317 * staging: comedi: adv_pci1710: fix AI INSN_READ for non-zero channel - LP: #1441317 * mei: make device disabled on stop unconditionally - LP: #1441317 * NFSv4: Don't call put_rpccred() under the rcu_read_lock() - LP: #1441317 * btrfs: fix lost return value due to variable shadowing - LP: #1441317 * KVM: MIPS: Fix trace event to save PC directly - LP: #1441317 * usb: ftdi_sio: Add jtag quirk support for Cyber Cortex AV boards - LP: #1441317 * ecryptfs: ->f_op is never NULL - LP: #1441317 * eCryptfs: don't pass fs-specific ioctl commands through - LP: #1441317 * drm/radeon: do a posting read in r100_set_irq - LP: #1441317 * drm/radeon: do a posting read in rs600_set_irq - LP: #1441317 * drm/radeon: do a posting read in r600_set_irq - LP: #1441317 * drm/radeon: do a posting read in evergreen_set_irq - LP: #1441317 * drm/radeon: do a posting read in si_set_irq - LP: #1441317 * drm/radeon: do a posting read in cik_set_irq - LP: #1441317 * drm/radeon: fix DRM_IOCTL_RADEON_CS oops - LP: #1441317 * drm/radeon: fix interlaced modes on DCE8 - LP: #1441317 * ACPI / video: Load the module even if ACPI is disabled - LP: #1441317 * ASoC: omap-pcm: Correct dma mask - LP: #1441317 * x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization - LP: #1441317 * Btrfs: fix data loss in the fast fsync path - LP: #1441317 * Btrfs:__add_inode_ref: out of bounds memory read when looking for extended ref. - LP: #1441317 * xhci: fix reporting of 0-sized URBs in control endpoint - LP: #1441317 * xhci: Workaround for PME stuck issues in Intel xhci - LP: #1441317 * Change email address for 8250_pci - LP: #1441317 * tty: fix up atime/mtime mess, take four - LP: #1441317 * console: Fix console name size mismatch - LP: #1441317 * net: irda: fix wait_until_sent poll timeout - LP: #1441317 * USB: serial: fix infinite wait_until_sent timeout - LP: #1441317 * TTY: fix tty_wait_until_sent on 64-bit machines - LP: #1441317 * sunrpc: fix braino in ->poll() - LP: #1441317 * svcrpc: fix memory leak in gssp_accept_sec_context_upcall - LP: #1441317 * SUNRPC: Always manipulate rpc_rqst::rq_bc_pa_list under xprt->bc_pa_lock - LP: #1441317 * ath5k: fix spontaneus AR5312 freezes - LP: #1441317 * net: cls_bpf: fix size mismatch on filter preparation - LP: #1441317 * net: cls_bpf: fix auto generation of per list handles - LP: #1441317 * qlge: Fix qlge_update_hw_vlan_features to handle if interface is down - LP: #1441317 * ip6_gre: fix endianness errors in ip6gre_err - LP: #1441317 * PCI: Don't read past the end of sysfs "driver_override" buffer - LP: #1441317 * spi: dw: revisit FIFO size detection again - LP: #1441317 * spi: atmel: Fix interrupt setup for PDC transfers - LP: #1441317 * mtd: nand: pxa3xx: Fix PIO FIFO draining - LP: #1441317 * cpuset: Fix cpuset sched_relax_domain_level - LP: #1441317 * workqueue: fix hang involving racing cancel[_delayed]_work_sync()'s for PREEMPT_NONE - LP: #1441317 * bnx2x: Force fundamental reset for EEH recovery - LP: #1441317 * xen/events: avoid NULL pointer dereference in dom0 on large machines - LP: #1441317 * spi: pl022: Fix race in giveback() leading to driver lock-up - LP: #1441317 * tpm/ibmvtpm: Additional LE support for tpm_ibmvtpm_send - LP: #1441317 * libsas: Fix Kernel Crash in smp_execute_task - LP: #1441317 * irqchip: armada-370-xp: Fix chained per-cpu interrupts - LP: #1441317 * ALSA: hda - Fix regression of HD-audio controller fallback modes - LP: #1441317 * can: add missing initialisations in CAN related skbuffs - LP: #1441317 * can: kvaser_usb: Avoid double free on URB submission failures - LP: #1441317 * can: kvaser_usb: Read all messages in a bulk-in URB buffer - LP: #1441317 * ftrace: Fix en(dis)able graph caller when en(dis)abling record via sysctl - LP: #1441317 * ftrace: Fix ftrace enable ordering of sysctl ftrace_enabled - LP: #1441317 * ARM: imx6qdl-sabresd: set swbst_reg as vbus's parent reg - LP: #1441317 * ARM: imx6sl-evk: set swbst_reg as vbus's parent reg - LP: #1441317 * drm/radeon: drop setting UPLL to sleep mode - LP: #1441317 * xen-pciback: limit guest control of command register - LP: #1441317 * ALSA: hda - Fix built-in mic on Compaq Presario CQ60 - LP: #1441317 * drm/vmwgfx: Fix a couple of lock dependency violations - LP: #1441317 * drm/vmwgfx: Reorder device takedown somewhat - LP: #1441317 * ALSA: control: Add sanity checks for user ctl id name string - LP: #1441317 * ALSA: snd-usb: add quirks for Roland UA-22 - LP: #1441317 * ALSA: hda - Set single_adc_amp flag for CS420x codecs - LP: #1441317 * ALSA: hda - Add workaround for MacBook Air 5,2 built-in mic - LP: #1441317 * nilfs2: fix deadlock of segment constructor during recovery - LP: #1441317 * ALSA: hda - Don't access stereo amps for mono channel widgets - LP: #1441317 * ARM: at91: pm: fix at91rm9200 standby - LP: #1441317 * ARM: dts: DRA7x: Fix the bypass clock source for dpll_iva and others - LP: #1441317 * ARM: dts: am33xx-clocks: Fix ehrpwm tbclk data on am33xx - LP: #1441317 * ARM: dts: am43xx-clocks: Fix ehrpwm tbclk data on am43xx - LP: #1441317 * clk: divider: fix calculation of maximal parent rate for a given divider - LP: #1441317 * clk: divider: fix selection of divider when rounding to closest - LP: #1441317 * USB: serial: add Google simple serial SubClass support - LP: #1441317 * HID: add support for MS Surface Pro 3 Type Cover - LP: #1441317 * HID: apple: fix battery support for the 2009 ANSI wireless keyboard - LP: #1441317 * HID: microsoft: add support for Japanese Surface Type Cover 3 - LP: #1441317 * HID: pidff: Fix initialisation forMicrosoft Sidewinder FF Pro 2 - LP: #1441317 * usb: gadget: function: phonet: balance usb_ep_disable calls - LP: #1441317 * usb: musb: core: add pm_runtime_irq_safe() - LP: #1441317 * cdc-acm: Add support for Denso cradle CU-321 - LP: #1441317 * HID: microsoft: Add ID for NE7K wireless keyboard - LP: #1441317 * sparc32: destroy_context() and switch_mm() needs to disable interrupts. - LP: #1441317 * sparc: semtimedop() unreachable due to comparison error - LP: #1441317 * sparc: perf: Remove redundant perf_pmu_{en|dis}able calls - LP: #1441317 * sparc: perf: Make counting mode actually work - LP: #1441317 * sparc: Touch NMI watchdog when walking cpus and calling printk - LP: #1441317 * sparc64: Fix several bugs in memmove(). - LP: #1441317 * net: sysctl_net_core: check SNDBUF and RCVBUF for min length - LP: #1441317 * rds: avoid potential stack overflow - LP: #1441317 * inet_diag: fix possible overflow in inet_diag_dump_one_icsk() - LP: #1441317 * caif: fix MSG_OOB test in caif_seqpkt_recvmsg() - LP: #1441317 * rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg() - LP: #1441317 * ipv6: fix backtracking for throw routes - LP: #1441317 * tcp: fix tcp fin memory accounting - LP: #1441317 * net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour - LP: #1441317 * tcp: make connect() mem charging friendly - LP: #1441317 * Linux 3.16.7-ckt9 - LP: #1441317 * rtc: ia64: allow other architectures to use EFI RTC - LP: #1441291 * rtc: Disable EFI rtc for x86 - LP: #1441291 * ipv6: Don't reduce hop limit for an interface - LP: #1441103 - CVE-2015-2922 * x86/microcode/intel: Guard against stack overflow in the loader - LP: #1438504 - CVE-2015-2666 -- Luis Henriques <luis.henriq...@canonical.com> Tue, 14 Apr 2015 14:04:46 +0100 ** Changed in: linux (Ubuntu Trusty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1124250 Title: Partially incorrect uid mapping with nfs4/idmapd/ldap-auth Status in linux package in Ubuntu: Fix Released Status in linux source package in Trusty: Fix Released Status in linux source package in Utopic: Fix Released Status in nfs-utils package in Debian: Fix Released Status in Fedora: Unknown Bug description: [Impact] * This bug is likely to cause an incorrect UID/GID mapping for NFS shares in case of large numbers of differend UIDs/GIDs or in case of expired UID/GID mappings (stored as keys in the kernel). [Test Case] 1. Setup a nfs4 server exporting /home with a large number of different users and ldap-based authentication. 2. Mount the share on a ldap-connected client machine. 3. List the mounted /home directory. 4. Wait more than 10 minutes (the default key expiration time) and list it again with ls -l. Expected result - all directories are listed with correct UIDs/GIDs. Actual result - some of the directories may be listed with incorrect UID/GID of 4294967294. [Regression Potential] * This issue has been merged upstream in the 3.18 kernel and is also present in Debian's 3.16 kernel. [Other Info] * Original bug description: I'm running a nfs4 server exporting a directory /home (ext4,usrquota). This server is running Ubuntu 12.04 amd64(up-to-date). This directory is handling 662 homedirs for ldap authenticated users. /etc/exports is : /exports 192.168.0.0/24(rw,fsid=0,no_subtree_check) Important lines in /etc/idmapd.conf : domain=my-domain.org [Translation] Method=nsswitch. In /etc/default/nfs-common : NEED_IDMAPD=yes In /etc/default/nfs-kernel-server : RPCNFSDCOUNT=75 RPCMOUNTDOPTS=--manage-gids 2 Clients (rhel6 x86 & Ubuntu 12.04.2 i686) are mounting this nfs4 exported directory with no problems : When doing ls -l /home on this clients, I have : ... drwx------ 4 user100 oldusers 4096 sept. 21 2011 user100 drwx------ 4 user101 oldusers 4096 sept. 21 2011 user101 drwx------ 37 user102 oldusers 4096 oct. 1 19:06 user102 drwx------ 36 user103 users 4096 févr. 5 21:08 user103 drwx------ 36 user104 users 4096 févr. 8 14:03 user104 drwx------ 30 user105 users 4096 févr. 4 18:01 user105 drwx------ 28 user106 oldusers 4096 oct. 5 2011 user106 drwx------ 37 user107 oldusers 4096 janv. 8 14:52 user107 drwx------ 31 user108 users 4096 déc. 4 11:52 user108 drwx------ 4 user109 oldusers 4096 sept. 21 2011 user109 drwx--x--x 45 user110 oldusers 4096 janv. 22 15:53 user109 drwx------ 31 user111 users 4096 janv. 29 12:03 user110 ... uid/gid mapping works fine, authldap works fine, ... All Clients running Ubuntu 12.10 i686 or Ubuntu 12.10 amd64 are experiencing the same problem : The config files are the same that used in ubuntu 12.04. Auth ldap is correctly configured, user can log in. This is the /etc/fstab entry for /home : 192.168.0.1:/ /home nfs rw,nfsvers=4 0 0 Important lines in /etc/idmapd.conf : domain=my-domain.org [Translation] Method=nsswitch In /etc/default/nfs-common : NEED_IDMAPD=yes /etc/nsswitch.conf is : passwd: files ldap group: files ldap shadow: files ldap When doing ls -l /home there is a strange problem : drwx------ 4 4294967294 oldusers 4096 sept. 21 2011 user100 drwx------ 4 user101 oldusers 4096 sept. 21 2011 user101 drwx------ 37 user102 oldusers 4096 oct. 1 19:06 user102 drwx------ 36 4294967294 users 4096 févr. 5 21:08 user103 drwx------ 36 4294967294 users 4096 févr. 8 14:03 user104 drwx------ 30 4294967294 users 4096 févr. 4 18:01 user105 drwx------ 28 4294967294 oldusers 4096 oct. 5 2011 user106 drwx------ 37 4294967294 oldusers 4096 janv. 8 14:52 user107 drwx------ 31 4294967294 users 4096 déc. 4 11:52 user108 drwx------ 4 user109 oldusers 4096 sept. 21 2011 user109 drwx--x--x 45 4294967294 oldusers 4096 janv. 22 15:53 user110 drwx------ 31 4294967294 users 4096 janv. 29 12:03 user111 for 571 homedirs (this number varies at each reboot)/662, the owner is the value 4294967294. For the 91 remaining homedirs, the owner is correct. The gidnumber is correctly mapped for all (only 5 differents values used for gidNumber). In /var/log/syslog, I can see : For example : user110 is mapped as 4294967294. but the command "id user110" returns : uid=31124(user110) gid=666(oldusers) groupes=666(oldusers) user110 logs in (auth ldap) from tty1. He runs "ls -l /home/user110/" : drwxr-xr-x 8 4294967294 oldusers 4096 janv. 19 2012 Bureau drwxr-xr-x 3 4294967294 oldusers 4096 déc. 2 2011 Documents drwxr-xr-x 2 4294967294 oldusers 4096 déc. 2 2011 Images Then, he runs "touch /home/user110/test" : drwxr-xr-x 8 4294967294 oldusers 4096 janv. 19 2012 Bureau drwxr-xr-x 3 4294967294 oldusers 4096 déc. 2 2011 Documents drwxr-xr-x 2 4294967294 oldusers 4096 déc. 2 2011 Images drwxr-xr-x 2 4294967294 oldusers 0 févr. 13 16:01 test On the nfs server, If i do a ls -l in the same directory : drwxr-xr-x 8 user110 oldusers 4096 janv. 19 2012 Bureau drwxr-xr-x 3 user110 oldusers 4096 déc. 2 2011 Documents drwxr-xr-x 2 user110 oldusers 4096 déc. 2 2011 Images drwxr-xr-x 2 user110 oldusers 0 févr. 13 16:01 test I can see that the "test" file is owned by the correct user. I've tried without & with nscd, same results. I've tried using sssd, libnss-sss & pam_sss for ldap auth and having exactly the same results : In /var/log/syslog, I have : ... rpc.idmapd[561]: nss_getpwnam: name 'user...@my-domain.org' domain 'my-domain.org': resulting localname 'user109' rpc.idmapd[561]: nfs4_name_to_uid: nsswitch->name_to_uid returned 0 rpc.idmapd[561]: nfs4_name_to_uid: final return value is 0 rpc.idmapd[561]: Client 0: (user) name "user...@my-domain.org" -> id "55101" rpc.idmapd[561]: nfs4_name_to_uid: calling nsswitch->name_to_uid rpc.idmapd[561]: nss_getpwnam: name 'user...@my-domain.org' domain 'my-domain.org': resulting localname 'user102' rpc.idmapd[561]: nfs4_name_to_uid: nsswitch->name_to_uid returned 0 rpc.idmapd[561]: nfs4_name_to_uid: final return value is 0 rpc.idmapd[561]: Client 0: (user) name "user...@my-domain.org" -> id "55199" ... only for the correctly mapped entries. No warnings or errors (rate limit disabled in rsyslog.conf) and verbosity set to 5 in idmapd.conf. It seems that rpc.idmapd never does mapping for other entries. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1124250/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp