Ubuntu
linux package

[SRU][Jammy/OEM-5.17][PATCH 0/1] Fix calltrace in mac80211

Bug #1978297 reported by AaronMa
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Fix Released
Medium
Unassigned
linux-oem-5.17 (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Fix Released
Undecided
Unassigned

Bug Description

[Impact]
When bootup Jammy kernel, it shows callrace:
kernel: ================================================================================
kernel: UBSAN: invalid-load in /home/u/aaron/bionic/net/mac80211/status.c:1164:21
kernel: load of value 216 is not a valid value for type '_Bool'
kernel: CPU: 9 PID: 0 Comm: swapper/9 Not tainted 5.15.36+ #12
kernel: Hardware name: LENOVO 21D2SIT061/21D2SIT061, BIOS N3GET30W (1.11 ) 05/27/2022
kernel: Call Trace:
kernel: <IRQ>
kernel: dump_stack_lvl+0x4a/0x5f
kernel: dump_stack+0x10/0x12
kernel: ubsan_epilogue+0x9/0x45
kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49
kernel: ieee80211_tx_status_ext.cold+0x1e/0xb0 [mac80211]
kernel: ? percpu_ref_kill_and_confirm+0xd0/0xd0
kernel: ? rht_key_get_hash.isra.0+0x19/0x20 [mac80211]
kernel: ? sta_info_hash_lookup+0xac/0x100 [mac80211]
kernel: ieee80211_tx_status+0x72/0xa0 [mac80211]
kernel: ieee80211_tasklet_handler+0xa2/0xd0 [mac80211]
kernel: tasklet_action_common.constprop.0+0xc0/0xf0
kernel: tasklet_action+0x22/0x30
kernel: __do_softirq+0xd9/0x2e3
kernel: irq_exit_rcu+0x8c/0xb0
kernel: common_interrupt+0x8a/0xa0
kernel: </IRQ>
kernel: <TASK>
kernel: asm_common_interrupt+0x1e/0x40
kernel: RIP: 0010:cpuidle_enter_state+0xd9/0x620
kernel: Code: 3d b4 85 3d 5c e8 57 a7 6b ff 49 89 c7 0f 1f 44 00 00 31 ff e8 a8 b3 6b ff 80 7d d0>
kernel: RSP: 0018:ffff9e2dc01f7e38 EFLAGS: 00000246
kernel: RAX: ffff8dfdb6870b00 RBX: ffff8df6c3ab6c00 RCX: 000000023cd33784
kernel: RDX: 000000023d103fa8 RSI: 000000023cd33784 RDI: 0000000000000000
kernel: RBP: ffff9e2dc01f7e88 R08: 000000023cd33d63 R09: 00000000000aae60
kernel: R10: 0000000000000004 R11: 071c71c71c71c71c R12: ffffffffa4ce65a0
kernel: R13: 0000000000000003 R14: 0000000000000003 R15: 000000023cd33d63
kernel: ? cpuidle_enter_state+0xc8/0x620
kernel: ? sched_clock_local+0x13/0x90
kernel: cpuidle_enter+0x2e/0x40
kernel: do_idle+0x203/0x2a0
kernel: cpu_startup_entry+0x20/0x30
kernel: start_secondary+0x12a/0x180
kernel: secondary_startup_64_no_verify+0xc2/0xcb
kernel: </TASK>
kernel: ================================================================================

[Fix]
The size of the status_driver_data field was not adjusted
when the is_valid_ack_signal field was added.
Adjust the struct size accordingly.

[Test]
Verified on hardware, no error.

[Where problems could occur]
Low risk, It may break wifi driver.
Minor changes in title of "Copyright" when backport.

See original description

CVE References

AaronMa (mapengyu)
Changed in linux (Ubuntu):
status: New → In Progress
Changed in linux (Ubuntu Jammy):
status: New → In Progress
Changed in linux-oem-5.17 (Ubuntu):
status: New → In Progress
Changed in linux-oem-5.17 (Ubuntu Jammy):
status: New → In Progress
description: updated
Timo Aaltonen (tjaalton)
Changed in linux-oem-5.17 (Ubuntu Jammy):
status: In Progress → Fix Committed
Changed in linux-oem-5.17 (Ubuntu):
status: In Progress → Invalid
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-oem-5.17/5.17.0-1012.13 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-jammy
Stefan Bader (smb)
Changed in linux (Ubuntu Jammy):
importance: Undecided → Medium
status: In Progress → Fix Committed
AaronMa (mapengyu)
tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-oem-5.17 - 5.17.0-1012.13

---------------
linux-oem-5.17 (5.17.0-1012.13) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1012.13 -proposed tracker (LP: #1978578)

  * [SRU][OEM-5.14/OEM-5.17][PATCH 0/1] Fix oled brightness set above frame-
    average luminance on AMD (LP: #1978986)
    - SAUCE: drm/amd/display: Cap OLED brightness per max frame-average luminance

  * Fix headset mic no sound on an HP desktop (LP: #1978925)
    - ALSA: hda/realtek - ALC897 headset MIC no sound

  * [SRU][Jammy/OEM-5.17][PATCH 0/1] Fix calltrace in mac80211 (LP: #1978297)
    - mac80211: fix struct ieee80211_tx_info size

  * pl2303 serial adapter not recognized (LP: #1967493)
    - USB: serial: pl2303: fix type detection for odd device

  * Fix can't boot up after change to vmd (LP: #1976587)
    - PCI: vmd: Assign VMD IRQ domain before enumeration
    - PCI: vmd: Revert 2565e5b69c44 ("PCI: vmd: Do not disable MSI-X remapping if
      interrupt remapping is enabled by IOMMU.")

  * Power cycle USB ports on shutdown/reboot (LP: #1976503)
    - SAUCE: xhci: turn off port power in shutdown

  * Fix sub-optimal I210 network speed (LP: #1976438)
    - SAUCE: igb: Make DMA faster when CPU is active on the PCIe link

  * Remove SAUCE patches from test_vxlan_under_vrf.sh in net of
    ubuntu_kernel_selftests (LP: #1975691)
    - Revert "UBUNTU: SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on
      xfail"
    - Revert "UBUNTU: SAUCE: selftests: net: Make test for VXLAN underlay in non-
      default VRF an expected failure"

  * [SRU][OEM-5.14/OEM-5.17/Jammy][PATCH 0/1] Fix i915 calltrace on new ADL BIOS
    (LP: #1976214)
    - drm/i915: update new TMDS clock setting defined by VBT

  * [SRU][OEM-5.14/OEM-5.17/J][PATCH 0/2] Fix system hangs after s2idle on AMD
    A+A GPU (LP: #1975804)
    - drm/amd: Don't reset dGPUs if the system is going to s2idle

  * [SRU][OEM-5.14/OEM-5.17/J][PATCH 0/1] Read the discovery registers for
    AMD_SFH (LP: #1975798)
    - HID: amd_sfh: Add support for sensor discovery

 -- Chia-Lin Kao (AceLan) <email address hidden> Fri, 17 Jun 2022 15:36:34 +0800

Changed in linux-oem-5.17 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
cmeerw (cmeerw) wrote :

same as Bug #1968631

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (31.7 KiB)

This bug was fixed in the package linux - 5.15.0-41.44

---------------
linux (5.15.0-41.44) jammy; urgency=medium

  * jammy/linux: 5.15.0-41.44 -proposed tracker (LP: #1979448)

  * Fix can't boot up after change to vmd (LP: #1976587)
    - PCI: vmd: Assign VMD IRQ domain before enumeration
    - PCI: vmd: Revert 2565e5b69c44 ("PCI: vmd: Do not disable MSI-X remapping if
      interrupt remapping is enabled by IOMMU.")

  * [SRU][Jammy/OEM-5.17][PATCH 0/1] Fix calltrace in mac80211 (LP: #1978297)
    - mac80211: fix struct ieee80211_tx_info size

  * [SRU][Jammy][PATCH 0/1] Fix amd display corruption on s2idle resume
    (LP: #1978244)
    - drm/amd/display: Don't reinitialize DMCUB on s0ix resume

  * pl2303 serial adapter not recognized (LP: #1967493)
    - USB: serial: pl2303: fix type detection for odd device

  * Remove SAUCE patches from test_vxlan_under_vrf.sh in net of
    ubuntu_kernel_selftests (LP: #1975691)
    - Revert "UBUNTU: SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on
      xfail"
    - Revert "UBUNTU: SAUCE: selftests: net: Make test for VXLAN underlay in non-
      default VRF an expected failure"

  * Fix hp_wmi_read_int() reporting error (0x05) (LP: #1979051)
    - platform/x86: hp-wmi: Fix hp_wmi_read_int() reporting error (0x05)

  * Request to back port vmci patches to Ubuntu kernel (LP: #1978145)
    - VMCI: dma dg: whitespace formatting change for vmci register defines
    - VMCI: dma dg: add MMIO access to registers
    - VMCI: dma dg: detect DMA datagram capability
    - VMCI: dma dg: set OS page size
    - VMCI: dma dg: register dummy IRQ handlers for DMA datagrams
    - VMCI: dma dg: allocate send and receive buffers for DMA datagrams
    - VMCI: dma dg: add support for DMA datagrams sends
    - VMCI: dma dg: add support for DMA datagrams receive
    - VMCI: Fix some error handling paths in vmci_guest_probe_device()
    - VMCI: Release notification_bitmap in error path
    - VMCI: Check exclusive_vectors when freeing interrupt 1
    - VMCI: Add support for ARM64
    - [Config] Update policies for VMWARE_VMCI and VMWARE_VMCI_VSOCKETS

  * [UBUNTU 20.04] rcu stalls with many storage key guests (LP: #1975582)
    - s390/gmap: voluntarily schedule during key setting
    - s390/mm: use non-quiescing sske for KVM switch to keyed guest

  * [SRU][OEM-5.14/OEM-5.17/Jammy][PATCH 0/1] Fix i915 calltrace on new ADL BIOS
    (LP: #1976214)
    - drm/i915: update new TMDS clock setting defined by VBT

  * Revert PPC get_user workaround (LP: #1976248)
    - powerpc: Export mmu_feature_keys[] as non-GPL

  * Jammy update: v5.15.39 upstream stable release (LP: #1978240)
    - MIPS: Fix CP0 counter erratum detection for R4k CPUs
    - parisc: Merge model and model name into one line in /proc/cpuinfo
    - ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
    - mmc: sunxi-mmc: Fix DMA descriptors allocated above 32 bits
    - mmc: core: Set HS clock speed before sending HS CMD13
    - gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
    - x86/fpu: Prevent FPU s...

Changed in linux (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-gkeop-5.15/5.15.0-1003.5~20.04.2 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

in 5.18 and up

Changed in linux (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.