[Bug 1889735] Re: tap: use after free

2020-09-01 Thread Launchpad Bug Tracker
This bug was fixed in the package linux - 4.15.0-115.116 --- linux (4.15.0-115.116) bionic; urgency=medium * bionic/linux: 4.15.0-115.116 -proposed tracker (LP: #1893055) * [Potential Regression] dscr_inherit_exec_test from powerpc in ubuntu_kernel_selftests failed on B/E/F (

[Bug 1889735] Re: tap: use after free

2020-08-25 Thread Stefan Bader
This is an upstream fix for a change that was released in v4.8. So we can treat that as part of stable. ** Tags removed: verification-needed-bionic ** Tags added: verification-done-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu

[Bug 1889735] Re: tap: use after free

2020-08-10 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed- bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verifica

[Bug 1889735] Re: tap: use after free

2020-08-07 Thread Khaled El Mously
** Changed in: linux (Ubuntu Bionic) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1889735 Title: tap: use after free To manage notifications about this bu

[Bug 1889735] Re: tap: use after free

2020-08-04 Thread Juerg Haefliger
** Description changed: [Impact] If the socket buffer array of a tap queue is full, a received package needs to be dropped. Currently, the check for the array being full is performed lockless, which might lead to use-after-free errors if the socket buffer array has been resized.

[Bug 1889735] Re: tap: use after free

2020-07-31 Thread Juerg Haefliger
** Description changed: - TBD + [Impact] + + If the socket buffer array of a tap queue is full, a received package + needs to be dropped. Currently, the check for the array being full is + performed lockless, which might lead to use-after-free errors if the + socket buffer array has been resized.