ubuntu-kernel-tests

kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout

Bug #1932966 reported by Guilherme G. Piccoli on 2021-06-18

This bug affects 3 people

	Status	Importance	Assigned to
ubuntu-kernel-tests	Confirmed	Medium	Unassigned
linux (Ubuntu)	Fix Released	Medium	Unassigned
Xenial	Confirmed	Undecided	Unassigned
Bionic	Fix Released	Medium	Po-Hsu Lin

Bug Description

[Impact]
Our Bionic 4.15 kernel lacks of movups/movupd emulation support.

With the following commit added into the emulator test in
ubuntu_kvm_unit_tests:
  commit 8726f9771911d6749dbd36ab2fc70f0f25e2b1a9
  Author: Jacob Xu <email address hidden>
  Date: Wed Apr 21 16:12:57 2021 -0700

x86: add movups/movupd sse testcases to emulator.c

Here we add movups/movupd tests corresponding to functionality
introduced in commit 29916968c486 ("kvm: Add emulation for movups/movupd").

      Signed-off-by: Jacob Xu <email address hidden>
      Message-Id: <email address hidden>
      Signed-off-by: Paolo Bonzini <email address hidden>

It will cause the emulator test in ubuntu_kvm_unit_tests fail with timeout:
  ...
  PASS: movdqu (read)
  PASS: movdqu (write)
  PASS: movaps (read)
  PASS: movaps (write)
  PASS: movapd (read)
  PASS: movapd (write)
  KVM internal error. Suberror: 1
  emulation failure
  RAX=000000000000000a RBX=ffffffffffffe000 RCX=00000000000003fd RDX=00000000000003f8
  RSI=0000000000419991 RDI=0000000000419991 RBP=000000000051b490 RSP=000000000051b470
  R8 =000000000000000a R9 =00000000000003f8 R10=000000000000000d R11=0000000000000000
  R12=ffffffffffffe000 R13=1111111111111111 R14=ffffffffffffd000 R15=3333333333333333
  RIP=0000000000400a1f RFL=00010006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
  ES =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
  CS =0008 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
  SS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
  DS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
  FS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
  GS =0010 000000000051a510 ffffffff 00c09300 DPL=0 DS [-WA]
  LDT=0000 0000000000000000 0000ffff 00008200 DPL=0 LDT
  TR =0080 000000000041207a 0000ffff 00008b00 DPL=0 TSS64-busy
  GDT= 000000000041100a 0000106f
  IDT= 0000000000410000 00000fff
  CR0=80010011 CR2=0000000000000000 CR3=0000000001007000 CR4=00000220
  DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
  DR6=00000000ffff0ff0 DR7=0000000000000400
  EFER=0000000000000500
  Code=00 c7 45 e8 03 00 00 00 c7 45 ec 04 00 00 00 66 0f 6f 45 e0 <0f> 11 03 48 89 de 48 8d 7d e0 e8 e5 f9 ff ff 0f b6 f8 be a1 8f 41 00 b8 00 00 00 00 e8 07
  qemu-system-x86_64: terminating on signal 15 from pid 15758 (timeout)
  FAIL emulator (timeout; duration=90s)

[Fix]
* 29916968c48691 kvm: Add emulation for movups/movupd

This patch can be cherry-picked into Bionic.

It can fix our test failure plus, as mentioned in the commit message,
emulation failures with openbsd as guest and with Windows 10 with
intel HD graphics pass through.

[Test]
Test kernel can be found here:
https://people.canonical.com/~phlin/kernel/lp-1932966-kvm-emulator/

Run the emulator test from ubuntu_kvm_unit_tests, with this patch
applied it will pass without any issue:
  ...
  PASS: movdqu (read)
  PASS: movdqu (write)
  PASS: movaps (read)
  PASS: movaps (write)
  PASS: movapd (read)
  PASS: movapd (write)
  PASS: movups (read)
  PASS: movups (write)
  PASS: movupd (read)
  PASS: movupd (write)
  PASS: movups unaligned
  PASS: movupd unaligned
  PASS: unaligned movaps exception
  PASS: movups unaligned crosspage
  PASS: movups crosspage exception
  PASS: movq (mmx, read)
  PASS: movq (mmx, write)
  PASS: movb $imm, 0(%rip)
  PASS: shld (cl)
  PASS: shrd (cl)
  PASS: mov null, %ss
  PASS: mov null, %ss (with ss.rpl != cpl)
  PASS: Test ret/iret with a nullified segment
  PASS: ltr
  PASS: cmovnel
  SKIP: skipping register-only tests, use kvm.force_emulation_prefix=1 to enable
  PASS: push16
  PASS: cross-page mmio read
  PASS: cross-page mmio write
  PASS: string_io_mmio
  PASS: jump to non-canonical address
  SKIP: illegal movbe
  SUMMARY: 135 tests, 2 skipped
  PASS emulator (135 tests, 2 skipped)

[Where problems could occur]
I didn't see any other patch that claims to be a fix of this one in
the upstream tree. The problem I think of for the moment is that we
might see other failures when using this in the future.

[Original Bug Report]
Found this on B/KVM, current cycle (sru-20210531):

18:27:11 DEBUG| [stdout] PASS: movapd (write)^M
18:27:11 DEBUG| [stderr] KVM internal error. Suberror: 1
18:27:11 DEBUG| [stderr] emulation failure
18:27:11 DEBUG| [stderr] RAX=000000000000000a RBX=ffffffffffffe000 RCX=00000000000003fd RDX=00000000000003f8
18:27:11 DEBUG| [stderr] RSI=0000000000419991 RDI=0000000000419991 RBP=000000000051b440 RSP=000000000051b420
18:27:11 DEBUG| [stderr] R8 =000000000000000a R9 =00000000000003f8 R10=000000000000000d R11=0000000000000000
18:27:11 DEBUG| [stderr] R12=ffffffffffffe000 R13=1111111111111111 R14=ffffffffffffd000 R15=3333333333333333
18:27:11 DEBUG| [stderr] RIP=0000000000400a0c RFL=00010006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
18:27:11 DEBUG| [stderr] ES =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
18:27:11 DEBUG| [stderr] CS =0008 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
18:27:11 DEBUG| [stderr] SS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
18:27:11 DEBUG| [stderr] DS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
18:27:11 DEBUG| [stderr] FS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
18:27:11 DEBUG| [stderr] GS =0010 000000000051a4d0 ffffffff 00c09300 DPL=0 DS [-WA]
18:27:11 DEBUG| [stderr] LDT=0000 0000000000000000 0000ffff 00008200 DPL=0 LDT
18:27:11 DEBUG| [stderr] TR =0080 000000000041207a 0000ffff 00008b00 DPL=0 TSS64-busy
18:27:11 DEBUG| [stderr] GDT= 000000000041100a 0000106f
18:27:11 DEBUG| [stderr] IDT= 0000000000410000 00000fff
18:27:11 DEBUG| [stderr] CR0=80010011 CR2=0000000000000000 CR3=0000000001007000 CR4=00000220
18:27:11 DEBUG| [stderr] DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
18:27:11 DEBUG| [stderr] DR6=00000000ffff0ff0 DR7=0000000000000400
18:27:11 DEBUG| [stderr] EFER=0000000000000500
18:27:11 DEBUG| [stderr] Code=00 c7 45 e8 03 00 00 00 c7 45 ec 04 00 00 00 66 0f 6f 45 e0 <0f> 11 03 48 89 de 48 8d 7d e0 e8 f8 f9 ff ff 0f b6 f8 be a1 8f 41 00 b8 00 00 00 00 e8 05
18:28:40 DEBUG| [stderr] qemu-system-x86_64: terminating on signal 15 from pid 13634 (timeout)
18:28:40 DEBUG| [stdout] FAIL emulator (timeout; duration=90s)
[...]
TestError: Test failed for emulator
18:28:40 ERROR| child process failed
18:28:40 DEBUG| Traceback (most recent call last):
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/parallel.py", line 25, in fork_start
18:28:40 DEBUG| l()
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/job.py", line 505, in <lambda>
18:28:40 DEBUG| l = lambda: test.runtest(self, url, tag, args, dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/test.py", line 125, in runtest
18:28:40 DEBUG| job.sysinfo.log_after_each_iteration)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/shared/test.py", line 913, in runtest
18:28:40 DEBUG| mytest._exec(args, dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/shared/test.py", line 411, in _exec
18:28:40 DEBUG| _call_test_function(self.execute, *p_args, **p_dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/shared/test.py", line 823, in _call_test_function
18:28:40 DEBUG| return func(*args, **dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/shared/test.py", line 291, in execute
18:28:40 DEBUG| postprocess_profiled_run, args, dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/shared/test.py", line 212, in _call_run_once
18:28:40 DEBUG| self.run_once(*args, **dargs)
18:28:40 DEBUG| File "/home/ubuntu/autotest/client/tests/ubuntu_kvm_unit_tests/ubuntu_kvm_unit_tests.py", line 82, in run_once
18:28:40 DEBUG| raise error.TestError("Test failed for {}".format(test_name))
18:28:40 DEBUG| TestError: Test failed for emulator
18:28:41 INFO | ERROR ubuntu_kvm_unit_tests.emulator ubuntu_kvm_unit_tests.emulator timestamp=1624040921 localtime=Jun 18 18:28:41 Test failed for emulator
18:28:41 INFO | END ERROR ubuntu_kvm_unit_tests.emulator ubuntu_kvm_unit_tests.emulator timestamp=1624040921 localtime=Jun 18 18:28:41

See original description

Tags:

Guilherme G. Piccoli (gpiccoli) on 2021-06-18

Changed in linux-kvm (Ubuntu):
status:	New → Confirmed
Changed in linux-kvm (Ubuntu Bionic):
status:	New → Confirmed
Changed in linux-kvm (Ubuntu):
importance:	Undecided → Medium
Changed in linux-kvm (Ubuntu Bionic):
importance:	Undecided → Medium
assignee:	nobody → Guilherme G. Piccoli (gpiccoli)
Changed in linux-kvm (Ubuntu):
assignee:	nobody → Guilherme G. Piccoli (gpiccoli)

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-06-21:

While debugging this please use hirsute-WIP branch in our own kvm-unit-tests (don't use disco branch)
Thanks!

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-06-22:

This test can pass with the disco branch, so out of curiosity I ran a bisect against kvm-unit-test and this test case seem to be the cause:

8726f9771911d6749dbd36ab2fc70f0f25e2b1a9 is the first bad commit
commit 8726f9771911d6749dbd36ab2fc70f0f25e2b1a9
Author: Jacob Xu <email address hidden>
Date: Wed Apr 21 16:12:57 2021 -0700

x86: add movups/movupd sse testcases to emulator.c

Here we add movups/movupd tests corresponding to functionality
introduced in commit 29916968c486 ("kvm: Add emulation for movups/movupd").

    Signed-off-by: Jacob Xu <email address hidden>
    Message-Id: <email address hidden>
    Signed-off-by: Paolo Bonzini <email address hidden>

$ git bisect log
git bisect start
# bad: [d4123fddf8a39b504fecd89ccb3dde61e338b4ee] Merge branch 's390x-pull-2021-22-06' into 'master'
git bisect bad d4123fddf8a39b504fecd89ccb3dde61e338b4ee
# good: [764aa0b88d9556520457f13b38d5cea21600545b] arm: powerpc: comment halt(code)
git bisect good 764aa0b88d9556520457f13b38d5cea21600545b
# good: [f3154609b29ad92746c77d46bca03e3b79431437] x86: use a non-negative number in shift
git bisect good f3154609b29ad92746c77d46bca03e3b79431437
# good: [a7eb7780d525b69a8fcfc8a3cfba85570a321c33] lib/list.h: add list_add_tail
git bisect good a7eb7780d525b69a8fcfc8a3cfba85570a321c33
# good: [956e3107eb042b3b9f9806c4850eebe04da0bc43] update git tree location in MAINTAINERS to point at gitlab
git bisect good 956e3107eb042b3b9f9806c4850eebe04da0bc43
# bad: [83d815a2bf92890d6fddcb5b9503006550285d2b] s390x: Add more Ultravisor command structure definitions
git bisect bad 83d815a2bf92890d6fddcb5b9503006550285d2b
# bad: [7fbcef02aaef9797724b818898bca662293cfff8] s390x: css: Store CSS Characteristics
git bisect bad 7fbcef02aaef9797724b818898bca662293cfff8
# good: [142ff6358dacd32a170602de608f2d920cc924d2] x86: msr: Verify 64-bit only MSRs fault on 32-bit hosts
git bisect good 142ff6358dacd32a170602de608f2d920cc924d2
# bad: [0b6f6cedcd6ef4a881fb8806cefde35b88a0363a] nSVM: Test VMLOAD/VMSAVE intercepts
git bisect bad 0b6f6cedcd6ef4a881fb8806cefde35b88a0363a
# bad: [88f0bb17adea42f5d86e00c243c70104c3598620] x86: msr: Test that always-canonical MSRs #GP on non-canonical value
git bisect bad 88f0bb17adea42f5d86e00c243c70104c3598620
# bad: [e5e76263b544c4f1032d0201611ffb7b9b7f408c] x86: add additional test cases for sse exceptions to emulator.c
git bisect bad e5e76263b544c4f1032d0201611ffb7b9b7f408c
# bad: [8726f9771911d6749dbd36ab2fc70f0f25e2b1a9] x86: add movups/movupd sse testcases to emulator.c
git bisect bad 8726f9771911d6749dbd36ab2fc70f0f25e2b1a9
# first bad commit: [8726f9771911d6749dbd36ab2fc70f0f25e2b1a9] x86: add movups/movupd sse testcases to emulator.c

Which leads to this commit, I think it's the fix:
https://github.com/torvalds/linux/commit/29916968c48691c94be466a0b47cc9adcea9cb8d

This test can pass with the disco branch, so out of curiosity I ran a bisect against kvm-unit-test and this test case seem to be the cause:

8726f9771911d6749dbd36ab2fc70f0f25e2b1a9 is the first bad commit
commit 8726f9771911d6749dbd36ab2fc70f0f25e2b1a9
Author: Jacob Xu <jacobhxu@google.com>
Date:   Wed Apr 21 16:12:57 2021 -0700

x86: add movups/movupd sse testcases to emulator.c
    
    Here we add movups/movupd tests corresponding to functionality
    introduced in commit 29916968c486 ("kvm: Add emulation for movups/movupd").
    
    Signed-off-by: Jacob Xu <jacobhxu@google.com>
    Message-Id: <20210421231258.2583654-1-jacobhxu@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Which leads to this commit, I think it's the fix:
https://github.com/torvalds/linux/commit/29916968c48691c94be466a0b47cc9adcea9cb8d

Sean Feole (sfeole) on 2021-07-12

tags:

added: hinted

Guilherme G. Piccoli (gpiccoli) on 2021-07-23

Changed in ubuntu-kernel-tests:
assignee:	Guilherme G. Piccoli (gpiccoli) → nobody
Changed in linux-kvm (Ubuntu Bionic):
assignee:	Guilherme G. Piccoli (gpiccoli) → nobody
Changed in linux-kvm (Ubuntu):
assignee:	Guilherme G. Piccoli (gpiccoli) → nobody

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-08-02:

Found on node riccioli with 4.15.0-153.160

tags:

added: sru-20210719

Revision history for this message

Krzysztof Kozlowski (krzk) wrote on 2021-08-26:

Also on: xenial/linux-oracle/4.15.0-1080.88~16.04.1

Po-Hsu Lin (cypressyew) on 2021-08-30

affects:	linux-kvm (Ubuntu) → linux (Ubuntu)
Changed in ubuntu-kernel-tests:
assignee:	nobody → Po-Hsu Lin (cypressyew)
Changed in linux (Ubuntu Bionic):
assignee:	nobody → Po-Hsu Lin (cypressyew)
Changed in ubuntu-kernel-tests:
status:	Confirmed → In Progress
Changed in linux (Ubuntu Bionic):
status:	Confirmed → In Progress

Po-Hsu Lin (cypressyew) on 2021-08-30

description:	updated
Changed in linux (Ubuntu):
status:	Confirmed → Fix Released
description:	updated

Po-Hsu Lin (cypressyew) on 2021-08-30

description:

updated

Po-Hsu Lin (cypressyew) on 2021-08-31

description:

updated

Po-Hsu Lin (cypressyew) on 2021-08-31

description:

updated

Po-Hsu Lin (cypressyew) on 2021-08-31

description:

updated

Po-Hsu Lin (cypressyew) on 2021-08-31

description:	updated
description:	updated

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-08-31:

https://lists.ubuntu.com/archives/kernel-team/2021-August/123672.html

description:

updated

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-09-01:

I found this is failing on X-4.4 as well. Since it's an ESM series now I don't think we will fix it.

Po-Hsu Lin (cypressyew) on 2021-09-01

summary:

- kvm_unit_tests: emulator test fails on 4.15 kernel, timeout
+ kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout

Kleber Sacilotto de Souza (kleber-souza) on 2021-09-01

Changed in linux (Ubuntu Bionic):
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-09-01:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in linux (Ubuntu Xenial):
status:	New → Confirmed

Revision history for this message

Krzysztof Kozlowski (krzk) wrote on 2021-09-01:

Found on xenial/linux-aws/4.4.0-1132.146

tags:	added: 4.4 aws
tags:	added: sru-20210816

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2021-09-07:

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-bionic

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2021-09-17:

#10

Test passed with 4.15 kernel, verified on X-Azure 4.15.0-1124.137~16.04.1 and B-4.15 4.15.0-157.164

tags:	added: verificationeon-d-bionic removed: verification-needed-bionic
tags:	added: verification-done-bionic removed: verificationeon-d-bionic

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-09-28:

#11

Download full text (12.2 KiB)

This bug was fixed in the package linux - 4.15.0-159.167

---------------
linux (4.15.0-159.167) bionic; urgency=medium

* Packaging resync (LP: #1786013)
- debian/dkms-versions -- update from kernel-versions (main/2021.09.06)

  * dell300x: rsi wifi and bluetooth crash after suspend and resume
    (LP: #1940488)
    - Revert "rsi: Use resume_noirq for SDIO"

  * LRMv5: switch primary version handling to kernel-versions data set
    (LP: #1928921)
    - [Packaging] switch to kernel-versions

  * kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout
    (LP: #1932966)
    - kvm: Add emulation for movups/movupd

  * memory leaking when removing a profile (LP: #1939915)
    - security/apparmor/label.c: Clean code by removing redundant instructions
    - apparmor: Fix memory leak of profile proxy

  * ubunut_kernel_selftests: memory-hotplug: avoid spamming logs with
    dump_page() (LP: #1941829)
    - selftests: memory-hotplug: avoid spamming logs with dump_page(), ratio limit
      hot-remove error test

This bug was fixed in the package linux - 4.15.0-159.167

---------------
linux (4.15.0-159.167) bionic; urgency=medium

* Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.09.06)

* dell300x: rsi wifi and bluetooth crash after suspend and resume
    (LP: #1940488)
    - Revert "rsi: Use resume_noirq for SDIO"

*  LRMv5: switch primary version handling to kernel-versions data set
    (LP: #1928921)
    - [Packaging] switch to kernel-versions

* kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout
    (LP: #1932966)
    - kvm: Add emulation for movups/movupd

* memory leaking when removing a profile (LP: #1939915)
    - security/apparmor/label.c: Clean code by removing redundant instructions
    - apparmor: Fix memory leak of profile proxy

* Bionic update: upstream stable patchset 2021-08-27 (LP: #1941916)
    - btrfs: mark compressed range uptodate only if all bio succeed
    - regulator: rt5033: Fix n_voltages settings for BUCK and LDO
    - r8152: Fix potential PM refcount imbalance
    - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
    - net: Fix zero-copy head len calculation.
    - Revert "Bluetooth: Shutdown controller after workqueues are flushed or
      cancelled"
    - KVM: do not allow mapping valid but non-reference-counted pages
    - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
    - spi: mediatek: Fix fifo transfer
    - padata: validate cpumask without removed CPU during offline
    - Revert "ACPICA: Fix memory leak caused by _CID repair function"
    - ALSA: seq: Fix racy deletion of subscriber
    - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
    - omap5-board-common: remove not physically existing vdds_1v8_main fixed-
      regulator
    - scsi: sr: Return correct event when media event code is 3
    - media: videobuf2-core: dequeue if start_streaming fails
    - net: natsemi: Fix missing pci_disable_device() in probe and remove
    - nfp: update ethtool reporting of pauseframe control
    - mips: Fix non-POSIX regexp
    - bnx2x: fix an error code in bnx2x_nic_load()
    - net: pegasus: fix uninit-value in get_interrupt_interval
    - net: fec: fix use-after-free in fec_drv_remove
    - net: vxge: fix use-after-free in vxge_device_unregister
    - Bluetooth: defer cleanup of resources in hci_unregister_dev()
    - USB: usbtmc: Fix RCU stall warning
    - USB: serial: option: add Telit FD980 composition 0x1056
    - USB: serial: ch341: fix character loss at high transfer rates
    - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
    - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
    - usb: gadget: f_hid: fixed NULL pointer dereference
    - usb: gadget: f_hid: idle uses the highest byte for duration
    - usb: otg-fsm: Fix hrtimer list corruption
    - scripts/tracing: fix the bug that can't parse raw_trace_func
    - staging: rtl8723bs: Fix a resource leak in sd_int_dpc
    - media: rtl28xxu: fix zero-length control request
    - pipe: increase minimum default pipe size to 2 pages
    - ext4: fix potential htree corruption when growing large_dir directories
    - serial: 8250: Mask out floating 16/32-bit bus bits
    - MIPS: Malta: Do not byte-swap accesses to the CBUS UART
    - pcmcia: i82092: fix a null pointer dereference bug
    - spi: meson-spicc: fix memory leak in meson_spicc_remove
    - perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
    - qmi_wwan: add network device usage statistics for qmimux devices
    - libata: fix ata_pio_sector for CONFIG_HIGHMEM
    - reiserfs: add check for root_inode in reiserfs_fill_super
    - reiserfs: check directory items on read from disk
    - alpha: Send stop IPI to send to online CPUs
    - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and
      ql_adapter_reset
    - USB:ehci:fix Kunpeng920 ehci hardware problem
    - ppp: Fix generating ppp unit id when ifname is not specified
    - ovl: prevent private clone if bind mount is not allowed
    - net: xilinx_emaclite: Do not print real IOMEM pointer
    - KVM: x86: accept userspace interrupt only if no event is injected
    - KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds

* Bionic update: upstream stable patchset 2021-08-17 (LP: #1940315)
    - selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
    - KVM: x86: determine if an exception has an error code only when injecting
      it.
    - net: split out functions related to registering inflight socket files
    - [Config] updateconfigs for UNIX_SCM
    - af_unix: fix garbage collect vs MSG_PEEK
    - net/802/mrp: fix memleak in mrp_request_join()
    - net/802/garp: fix memleak in garp_request_join()
    - net: annotate data race around sk_ll_usec
    - sctp: move 198 addresses from unusable to private scope
    - hfs: add missing clean-up in hfs_fill_super
    - hfs: fix high memory mapping in hfs_bnode_read
    - hfs: add lock nesting notation to hfs_find_init
    - ARM: dts: versatile: Fix up interrupt controller node names
    - virtio_net: Do not pull payload in skb->head
    - gro: ensure frag0 meets IP header alignment
    - x86/kvm: fix vcpu-id indexed array sizes
    - ocfs2: fix zero out valid data
    - ocfs2: issue zeroout to EOF blocks
    - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
    - can: mcba_usb_start(): add missing urb->transfer_dma initialization
    - can: usb_8dev: fix memory leak
    - can: ems_usb: fix memory leak
    - can: esd_usb2: fix memory leak
    - NIU: fix incorrect error return, missed in previous revert
    - nfc: nfcsim: fix use after free during module unload
    - x86/asm: Ensure asm/proto.h can be included stand-alone
    - cfg80211: Fix possible memory leak in function cfg80211_bss_update
    - netfilter: conntrack: adjust stop timestamp to real expiry value
    - netfilter: nft_nat: allow to specify layer 4 protocol NAT only
    - tipc: fix sleeping in tipc accept routine
    - mlx4: Fix missing error code in mlx4_load_one()
    - net: llc: fix skb_over_panic
    - net/mlx5: Fix flow table chaining
    - sctp: fix return value check in __sctp_rcv_asconf_lookup
    - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
    - sis900: Fix missing pci_disable_device() in probe and remove
    - can: hi311x: fix a signedness bug in hi3110_cmd()
    - i40e: Fix log TC creation failure when max num of queues is exceeded
    - i40e: Add additional info to PHY type error

* Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913)
    - ARM: dts: gemini: add device_type on pci
    - ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
    - arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
    - ARM: dts: rockchip: Fix the timer clocks order
    - ARM: dts: rockchip: Fix power-controller node names for rk3288
    - arm64: dts: rockchip: Fix power-controller node names for rk3328
    - reset: ti-syscon: fix to_ti_syscon_reset_data macro
    - ARM: brcmstb: dts: fix NAND nodes names
    - ARM: Cygnus: dts: fix NAND nodes names
    - ARM: NSP: dts: fix NAND nodes names
    - ARM: dts: BCM63xx: Fix NAND nodes names
    - ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
    - ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
    - ARM: dts: stm32: fix RCC node name on stm32f429 MCU
    - arm64: dts: juno: Update SCPI nodes as per the YAML schema
    - arm64: dts: ls208xa: remove bus-num from dspi node
    - thermal/core: Correct function name thermal_zone_device_unregister()
    - kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
    - rtc: max77686: Do not enforce (incorrect) interrupt trigger type
    - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
    - scsi: libfc: Fix array index out of bound exception
    - sched/fair: Fix CFS bandwidth hrtimer expiry type
    - net: ipv6: fix return value of ip6_skb_dst_mtu
    - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
    - net: bridge: sync fdb to new unicast-filtering ports
    - net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
    - net: moxa: fix UAF in moxart_mac_probe
    - net: qcom/emac: fix UAF in emac_remove
    - net: ti: fix UAF in tlan_remove_one
    - net: send SYNACK packet with accepted fwmark
    - net: validate lwtstate->data before returning from skb_tunnel_info()
    - dma-buf/sync_file: Don't leak fences on merge failure
    - tcp: annotate data races around tp->mtu_info
    - ipv6: tcp: drop silly ICMPv6 packet too big messages
    - igb: Fix use-after-free error during reset
    - ixgbe: Fix an error handling path in 'ixgbe_probe()'
    - igb: Fix an error handling path in 'igb_probe()'
    - fm10k: Fix an error handling path in 'fm10k_probe()'
    - e1000e: Fix an error handling path in 'e1000_probe()'
    - iavf: Fix an error handling path in 'iavf_probe()'
    - igb: Check if num of q_vectors is smaller than max before array access
    - perf probe: Fix dso->nsinfo refcounting
    - perf lzma: Close lzma stream on exit
    - perf test bpf: Free obj_buf
    - perf probe-file: Delete namelist in del_events() on the error path
    - spi: mediatek: fix fifo rx mode
    - liquidio: Fix unintentional sign extension issue on left shift of u16
    - s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
    - net: fix uninit-value in caif_seqpkt_sendmsg
    - net: decnet: Fix sleeping inside in af_decnet
    - netrom: Decrease sock refcount when sock timers expire
    - scsi: iscsi: Fix iface sysfs attr detection
    - scsi: target: Fix protect handling in WRITE SAME(32)
    - spi: cadence: Correct initialisation of runtime PM again
    - Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
    - proc: Avoid mixing integer types in mem_rw()
    - s390/ftrace: fix ftrace_update_ftrace_func implementation
    - ALSA: sb: Fix potential ABBA deadlock in CSP driver
    - xhci: Fix lost USB 2 remote wake
    - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
    - usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
    - USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
    - usb: max-3421: Prevent corruption of freed memory
    - usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
    - USB: serial: option: add support for u-blox LARA-R6 family
    - USB: serial: cp210x: fix comments for GE CS1000
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
    - tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
    - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
    - ixgbe: Fix packet corruption due to missing DMA sync
    - selftest: use mmap instead of posix_memalign to allocate memory
    - drm: Return -ENOTTY for non-drm ioctls
    - net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
    - iio: accel: bma180: Use explicit member assignment
    - iio: accel: bma180: Fix BMA25x bandwidth register values
    - btrfs: compression: don't try to compress if we don't have enough pages
    - spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    - xhci: add xhci_get_virt_ep() helper
    - bpftool: Properly close va_list 'ap' by va_end() on error
    - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
    - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
    - perf dso: Fix memory leak in dso__new_map()
    - net/tcp_fastopen: fix data races around tfo_active_disable_stamp
    - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
    - drm/panel: raspberrypi-touchscreen: Prevent double-free
    - KVM: do not assume PTE is writable after follow_pfn
    - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
    - net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
    - workqueue: fix UAF in pwq_unbound_release_workfn()
    - upstream stable to v4.14.241, v4.19.200

-- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Mon, 20 Sep 2021 16:11:14 -0600

Changed in linux (Ubuntu Bionic):
status:	Fix Committed → Fix Released

Revision history for this message

Thadeu Lima de Souza Cascardo (cascardo) wrote on 2021-11-04:

#12

I found this failing on 3.13.0-187 and 3.13.0-188 as well, though after doing movdqu (write).

Revision history for this message

Po-Hsu Lin (cypressyew) wrote on 2022-10-07:

#13

Unassign myself as it's unlikely to get fixed in X-4.4, which is an ESM kernel now.

Issue still exist with kvm-unit-test repo updated to d8a4f9e5 (ci: Update the list of tests that we run in the Fedora Cirrus-CI)

Changed in ubuntu-kernel-tests:
status:	In Progress → Confirmed
assignee:	Po-Hsu Lin (cypressyew) → nobody

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

Bug #1942055

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.