This bug was fixed in the package linux - 4.15.0-135.139 --------------- linux (4.15.0-135.139) bionic; urgency=medium
* bionic/linux: 4.15.0-135.139 -proposed tracker (LP: #1912223) * [drm:qxl_enc_commit [qxl]] *ERROR* head number too large or missing monitors config: (LP: #1908219) - qxl: remove qxl_io_log() - qxl: move qxl_send_monitors_config() - qxl: hook monitors_config updates into crtc, not encoder. * Touchpad not detected on ByteSpeed C15B laptop (LP: #1906128) - Input: i8042 - add ByteSpeed touchpad to noloop table * vmx_nm_test in ubuntu_kvm_unit_tests interrupted on X-oracle-4.15 / B-oracle-4.15 / X-KVM / B-KVM (LP: #1872401) - KVM: nVMX: Always reflect #NM VM-exits to L1 * stack trace in kernel (LP: #1903596) - net: napi: remove useless stack trace * CVE-2020-27777 - [Config]: Set CONFIG_PPC_RTAS_FILTER * Bionic update: upstream stable patchset 2020-12-04 (LP: #1906875) - regulator: defer probe when trying to get voltage from unresolved supply - ring-buffer: Fix recursion protection transitions between interrupt context - time: Prevent undefined behaviour in timespec64_to_ns() - nbd: don't update block size after device is started - btrfs: sysfs: init devices outside of the chunk_mutex - btrfs: reschedule when cloning lots of extents - genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY - hv_balloon: disable warning when floor reached - net: xfrm: fix a race condition during allocing spi - perf tools: Add missing swap for ino_generation - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() - can: rx-offload: don't call kfree_skb() from IRQ context - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() - can: peak_usb: add range checking in decode operations - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on - xfs: flush new eof page on truncate to avoid post-eof corruption - Btrfs: fix missing error return if writeback for extent buffer never started - ath9k_htc: Use appropriate rs_datalen type - usb: gadget: goku_udc: fix potential crashes in probe - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free - gfs2: Add missing truncate_inode_pages_final for sd_aspace - gfs2: check for live vs. read-only file system in gfs2_fitrim - scsi: hpsa: Fix memory leak in hpsa_init_one() - drm/amdgpu: perform srbm soft reset always on SDMA resume - mac80211: fix use of skb payload instead of header - cfg80211: regulatory: Fix inconsistent format argument - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() - iommu/amd: Increase interrupt remapping table limit to 512 entries - pinctrl: intel: Set default bias in case no particular value given - ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template - pinctrl: aspeed: Fix GPI only function problem. - nbd: fix a block_device refcount leak in nbd_release - xfs: fix flags argument to rmap lookup when converting shared file rmaps - xfs: fix rmap key and record comparison functions - xfs: fix a missing unlock on error in xfs_fs_map_blocks - of/address: Fix of_node memory leak in of_dma_is_coherent - cosa: Add missing kfree in error path of cosa_write - perf: Fix get_recursion_context() - ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA - ext4: unlock xattr_sem properly in ext4_inline_data_truncate() - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() - uio: Fix use-after-free in uio_unregister_device() - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode - mei: protect mei_cl_mtu from null dereference - futex: Don't enable IRQs unconditionally in put_pi_state() - ocfs2: initialize ip_next_orphan - selinux: Fix error return code in sel_ib_pkey_sid_slow() - don't dump the threads that had been already exiting when zapped. - drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] - pinctrl: amd: use higher precision for 512 RtcClk - pinctrl: amd: fix incorrect way to disable debounce filter - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" - IPv6: Set SIT tunnel hard_header_len to zero - net/af_iucv: fix null pointer dereference on shutdown - net/x25: Fix null-ptr-deref in x25_connect - vrf: Fix fast path output packet handling with async Netfilter rules - r8169: fix potential skb double free in an error path - net: Update window_clamp if SOCK_RCVBUF is set - random32: make prandom_u32() output unpredictable - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always- on STIBP - perf/core: Fix bad use of igrab() - perf/core: Fix crash when using HW tracing kernel filters - perf/core: Fix a memory leak in perf_event_parse_addr_filter() - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" - reboot: fix overflow parsing reboot cpu number - Convert trailing spaces and periods in path components - xfs: fix scrub flagging rtinherit even if there is no rt device - drm/amd/pm: perform SMC reset on suspend/hibernation - drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running - s390/smp: move rcu_cpu_starting() earlier - tpm_tis: Disable interrupts on ThinkPad T490s - tick/common: Touch watchdog in tick_unfreeze() on all CPUs - mfd: sprd: Add wakeup capability for PMIC IRQ - btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod - thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch - mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove -- Kleber Sacilotto de Souza <kleber.so...@canonical.com> Mon, 18 Jan 2021 18:20:48 +0100 ** Changed in: linux (Ubuntu Bionic) Status: Fix Committed => Fix Released ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-27777 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1872401 Title: vmx_nm_test in ubuntu_kvm_unit_tests interrupted on X-oracle-4.15 / B-oracle-4.15 / X-KVM / B-KVM Status in ubuntu-kernel-tests: New Status in linux package in Ubuntu: Invalid Status in linux source package in Xenial: New Status in linux source package in Bionic: Fix Released Bug description: [Impact] When running kvm-unit-tests under a guest, it will be paused, requiring a reset. When running the same test on a host (vmx_nm_test), it will fail. [Test case] Grab kvm-unit-tests, build it and run: TESTNAME=vmx TIMEOUT=90s ACCEL= ./x86/run x86/vmx.flat -smp 1 -cpu host,+vmx -append "vmx_nm_test" If done inside a guest, when the host runs the bionic 4.15 kernel, the guest will pause. [Potential regressions] Nested KVM could stop working. Floating point could stop working on KVM guests, though the code that relied on this was already removed from Bionic. ------------------------------ This issue was first spotted on Mar.16 [1] The ubuntu_kvm_unit_tests will be interrupted on X-oracle-4.15 on both VM.Standard2.1 and VM.Standard2.16, this is not a regression since it can be reproduced with 4.15.0-1031-oracle #34~16.04.1: Running '/home/ubuntu/autotest/client/tmp/ubuntu_kvm_unit_tests/src/kvm-unit-tests/tests/vmx_nm_test' BUILD_HEAD=4671e4ba timeout -k 1s --foreground 30 /usr/bin/qemu-system-x86_64 -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel /tmp/tmp.da3iFrsCzC -smp 1 -cpu host,+vmx -append vmx_nm_test # -initrd /tmp/tmp.h2DFw8L0AF enabling apic paging enabled cr0 = 80010011 cr3 = 477000 cr4 = 20 Test suite: vmx_nm_test client_loop: send disconnect: Broken pipe (node disconnected here) Before the test started, this can be found in syslog: Apr 13 06:26:25 selfprovisioned-phlin-kvm-unit kernel: [ 1073.529005] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. After that, noting was printed and node disconnected. If you try to run this case manually, it will stop at: # ./vmx_nm_test BUILD_HEAD=4671e4ba ready!!! timeout -k 1s --foreground 30 /usr/bin/qemu-system-x86_64 -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel /tmp/tmp.ZcGrnXu6se -smp 1 -cpu host,+vmx -append vmx_nm_test # -initrd /tmp/tmp.ADjEOAcRKM enabling ap (stopped here, even the "enabling apic" string was not printed) It looks like this is a new test case added since the cycle of 4.15.0-1037.41~16.04.1-oracle [1] https://bugs.launchpad.net/ubuntu-kernel- tests/+bug/1867623/comments/2 ProblemType: Bug DistroRelease: Ubuntu 16.04 Package: linux-image-4.15.0-1031-oracle 4.15.0-1031.34~16.04.1 ProcVersionSignature: User Name 4.15.0-1031.34~16.04.1-oracle 4.15.18 Uname: Linux 4.15.0-1031-oracle x86_64 ApportVersion: 2.20.1-0ubuntu2.21 Architecture: amd64 Date: Mon Apr 13 05:18:03 2020 ProcEnviron: TERM=xterm-256color PATH=(custom, no user) XDG_RUNTIME_DIR=<set> LANG=en_US.UTF-8 SHELL=/bin/bash SourcePackage: linux-signed-oracle UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/1872401/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp