[PATCH 0/5] [Xenial] CVE-2019-10124 - hwpoison memory DoS

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

[PATCH 0/5] [Xenial] CVE-2019-10124 - hwpoison memory DoS

Andrea Righi
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10124.html

When memory_failure() is called on a thp tail page after pmd is split an
attacker can cause a denial of service (via hwpoison), triggering a
reference counter bug, reported by VM_BUG_ON_PAGE().

The reason is that memory_failure() is always using page refcount and
page lock from tail page to head page when calling split_huge_page(),
but it can pass any subpage to split_huge_page(), causing a potential
refcount / locking bug. Fix by locking and checking the proper subpage.

The fix requires backporting additional patches:

 PATCH 1/5: introduce hpage locking in memory_failure()
 PATCH 2/5: no functional changes, only code refactoring that helps to
            apply the next patches
 PATCH 3/5: properly handle non anonymous thp
 PATCH 4/5: a fix similar to the actual CVE
 PATCH 5/5: the actual CVE

Kirill A. Shutemov (1):
 thp, mm: split_huge_page(): caller need to lock page

Naoya Horiguchi (3):
 mm: soft-offline: clean up soft_offline_page()
 mm: soft-offline: exit with failure for non anonymous thp
 mm: hwpoison: fix thp split handling in memory_failure()

zhongjiang (1):
 mm: hwpoison: fix thp split handing in soft_offline_in_use_page()

 mm/memory-failure.c | 80 ++++++++++++++++++++++++++++++++++-------------------
 mm/migrate.c        |  8 ++++--
 2 files changed, 58 insertions(+), 30 deletions(-)


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH 1/5] thp, mm: split_huge_page(): caller need to lock page

Andrea Righi
From: "Kirill A. Shutemov" <[hidden email]>

We're going to use migration entries instead of compound_lock() to
stabilize page refcounts.  Setup and remove migration entries require
page to be locked.

Some of split_huge_page() callers already have the page locked.  Let's
require everybody to lock the page before calling split_huge_page().

Signed-off-by: Kirill A. Shutemov <[hidden email]>
Tested-by: Sasha Levin <[hidden email]>
Tested-by: Aneesh Kumar K.V <[hidden email]>
Acked-by: Vlastimil Babka <[hidden email]>
Acked-by: Jerome Marchand <[hidden email]>
Cc: Andrea Arcangeli <[hidden email]>
Cc: Hugh Dickins <[hidden email]>
Cc: Dave Hansen <[hidden email]>
Cc: Mel Gorman <[hidden email]>
Cc: Rik van Riel <[hidden email]>
Cc: Naoya Horiguchi <[hidden email]>
Cc: Steve Capper <[hidden email]>
Cc: Johannes Weiner <[hidden email]>
Cc: Michal Hocko <[hidden email]>
Cc: Christoph Lameter <[hidden email]>
Cc: David Rientjes <[hidden email]>
Signed-off-by: Andrew Morton <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-10124

(cherry-picked from commit 4d2fa965483f4c39bd097ff9bbf3efe62d4cf367)
Signed-off-by: Andrea Righi <[hidden email]>
---
 mm/memory-failure.c | 8 +++++++-
 mm/migrate.c        | 8 ++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 92a647957f91..6de1daa1fcc7 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1156,7 +1156,9 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  }
 
  if (!PageHuge(p) && PageTransHuge(hpage)) {
+ lock_page(hpage);
  if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
+ unlock_page(hpage);
  if (!PageAnon(hpage))
  pr_err("MCE: %#lx: non anonymous thp\n", pfn);
  else
@@ -1166,6 +1168,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  put_hwpoison_page(p);
  return -EBUSY;
  }
+ unlock_page(hpage);
  VM_BUG_ON_PAGE(!page_count(p), p);
  hpage = compound_head(p);
  }
@@ -1757,7 +1760,10 @@ int soft_offline_page(struct page *page, int flags)
  return -EBUSY;
  }
  if (!PageHuge(page) && PageTransHuge(hpage)) {
- if (PageAnon(hpage) && unlikely(split_huge_page(hpage))) {
+ lock_page(page);
+ ret = split_huge_page(hpage);
+ unlock_page(page);
+ if (unlikely(ret)) {
  pr_info("soft offline: %#lx: failed to split THP\n",
  pfn);
  if (flags & MF_COUNT_INCREASED)
diff --git a/mm/migrate.c b/mm/migrate.c
index 73da75d5e5b2..8f1c69e0cb70 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -947,9 +947,13 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page,
  goto out;
  }
 
- if (unlikely(PageTransHuge(page)))
- if (unlikely(split_huge_page(page)))
+ if (unlikely(PageTransHuge(page))) {
+ lock_page(page);
+ rc = split_huge_page(page);
+ unlock_page(page);
+ if (rc)
  goto out;
+ }
 
  rc = __unmap_and_move(page, newpage, force, mode);
  if (rc == MIGRATEPAGE_SUCCESS)
--
2.19.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH 2/5] mm: soft-offline: clean up soft_offline_page()

Andrea Righi
In reply to this post by Andrea Righi
From: Naoya Horiguchi <[hidden email]>

soft_offline_page() has some deeply indented code, that's the sign of
demand for cleanup.  So let's do this.  No functionality change.

Signed-off-by: Naoya Horiguchi <[hidden email]>
Cc: Andi Kleen <[hidden email]>
Cc: "Kirill A. Shutemov" <[hidden email]>
Signed-off-by: Andrew Morton <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-10124

(backported from commit acc14dc4bd484f1fc8c227dd9fc2a1e592312d2b)
Signed-off-by: Andrea Righi <[hidden email]>
---
 mm/memory-failure.c | 78 ++++++++++++++++++++++++++++-----------------
 1 file changed, 49 insertions(+), 29 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 6de1daa1fcc7..25c4dc2035c9 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1725,6 +1725,49 @@ static int __soft_offline_page(struct page *page, int flags)
  return ret;
 }
 
+static int soft_offline_in_use_page(struct page *page, int flags)
+{
+ int ret;
+ struct page *hpage = compound_head(page);
+
+ if (!PageHuge(page) && PageTransHuge(hpage)) {
+ lock_page(hpage);
+ ret = split_huge_page(hpage);
+ unlock_page(hpage);
+ if (unlikely(ret || PageTransCompound(page) ||
+     !PageAnon(page))) {
+ pr_info("soft offline: %#lx: failed to split THP\n",
+ page_to_pfn(page));
+ if (flags & MF_COUNT_INCREASED)
+ put_hwpoison_page(hpage);
+ return -EBUSY;
+ }
+ get_hwpoison_page(page);
+ put_hwpoison_page(hpage);
+ }
+
+ if (PageHuge(page))
+ ret = soft_offline_huge_page(page, flags);
+ else
+ ret = __soft_offline_page(page, flags);
+
+ return ret;
+}
+
+static void soft_offline_free_page(struct page *page)
+{
+ if (PageHuge(page)) {
+ struct page *hpage = compound_head(page);
+
+ set_page_hwpoison_huge_page(hpage);
+ if (!dequeue_hwpoisoned_huge_page(hpage))
+ num_poisoned_pages_add(1 << compound_order(hpage));
+ } else {
+ if (!TestSetPageHWPoison(page))
+ num_poisoned_pages_inc();
+ }
+}
+
 /**
  * soft_offline_page - Soft offline a page.
  * @page: page to offline
@@ -1751,7 +1794,6 @@ int soft_offline_page(struct page *page, int flags)
 {
  int ret;
  unsigned long pfn = page_to_pfn(page);
- struct page *hpage = compound_head(page);
 
  if (PageHWPoison(page)) {
  pr_info("soft offline: %#lx page already poisoned\n", pfn);
@@ -1759,37 +1801,15 @@ int soft_offline_page(struct page *page, int flags)
  put_hwpoison_page(page);
  return -EBUSY;
  }
- if (!PageHuge(page) && PageTransHuge(hpage)) {
- lock_page(page);
- ret = split_huge_page(hpage);
- unlock_page(page);
- if (unlikely(ret)) {
- pr_info("soft offline: %#lx: failed to split THP\n",
- pfn);
- if (flags & MF_COUNT_INCREASED)
- put_hwpoison_page(page);
- return -EBUSY;
- }
- }
 
  get_online_mems();
-
  ret = get_any_page(page, pfn, flags);
  put_online_mems();
- if (ret > 0) { /* for in-use pages */
- if (PageHuge(page))
- ret = soft_offline_huge_page(page, flags);
- else
- ret = __soft_offline_page(page, flags);
- } else if (ret == 0) { /* for free pages */
- if (PageHuge(page)) {
- set_page_hwpoison_huge_page(hpage);
- if (!dequeue_hwpoisoned_huge_page(hpage))
- num_poisoned_pages_add(1 << compound_order(hpage));
- } else {
- if (!TestSetPageHWPoison(page))
- num_poisoned_pages_inc();
- }
- }
+
+ if (ret > 0)
+ ret = soft_offline_in_use_page(page, flags);
+ else if (ret == 0)
+ soft_offline_free_page(page);
+
  return ret;
 }
--
2.19.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH 3/5] mm: soft-offline: exit with failure for non anonymous thp

Andrea Righi
In reply to this post by Andrea Righi
From: Naoya Horiguchi <[hidden email]>

Currently memory_failure() doesn't handle non anonymous thp case,
because we can hardly expect the error handling to be successful, and it
can just hit some corner case which results in BUG_ON or something
severe like that.  This is also the case for soft offline code, so let's
make it in the same way.

Orignal code has a MF_COUNT_INCREASED check before put_hwpoison_page(),
but it's unnecessary because get_any_page() is already called when
running on this code, which takes a refcount of the target page
regardress of the flag.  So this patch also removes it.

[[hidden email]: fix build]
Signed-off-by: Naoya Horiguchi <[hidden email]>
Cc: Andi Kleen <[hidden email]>
Cc: "Kirill A. Shutemov" <[hidden email]>
Signed-off-by: Andrew Morton <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-10124

(backported from commit 98fd1ef4241ce0c700a174dd3e33c643b4774690)
Signed-off-by: Andrea Righi <[hidden email]>
---
 mm/memory-failure.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 25c4dc2035c9..3730845e349a 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1732,16 +1732,16 @@ static int soft_offline_in_use_page(struct page *page, int flags)
 
  if (!PageHuge(page) && PageTransHuge(hpage)) {
  lock_page(hpage);
- ret = split_huge_page(hpage);
- unlock_page(hpage);
- if (unlikely(ret || PageTransCompound(page) ||
-     !PageAnon(page))) {
- pr_info("soft offline: %#lx: failed to split THP\n",
- page_to_pfn(page));
- if (flags & MF_COUNT_INCREASED)
- put_hwpoison_page(hpage);
+ if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
+ unlock_page(hpage);
+ if (!PageAnon(hpage))
+ pr_info("soft offline: %#lx: non anonymous thp\n", page_to_pfn(page));
+ else
+ pr_info("soft offline: %#lx: thp split failed\n", page_to_pfn(page));
+ put_hwpoison_page(hpage);
  return -EBUSY;
  }
+ unlock_page(hpage);
  get_hwpoison_page(page);
  put_hwpoison_page(hpage);
  }
--
2.19.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH 4/5] mm: hwpoison: fix thp split handling in memory_failure()

Andrea Righi
In reply to this post by Andrea Righi
From: Naoya Horiguchi <[hidden email]>

When memory_failure() runs on a thp tail page after pmd is split, we
trigger the following VM_BUG_ON_PAGE():

   page:ffffd7cd819b0040 count:0 mapcount:0 mapping:         (null) index:0x1
   flags: 0x1fffc000400000(hwpoison)
   page dumped because: VM_BUG_ON_PAGE(!page_count(p))
   ------------[ cut here ]------------
   kernel BUG at /src/linux-dev/mm/memory-failure.c:1132!

memory_failure() passed refcount and page lock from tail page to head
page, which is not needed because we can pass any subpage to
split_huge_page().

Fixes: 61f5d698cc97 ("mm: re-enable THP")
Link: http://lkml.kernel.org/r/1477961577-7183-1-git-send-email-n-horiguchi@...
Signed-off-by: Naoya Horiguchi <[hidden email]>
Cc: <[hidden email]> [4.5+]
Signed-off-by: Andrew Morton <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-10124

(backported from commit c3901e722b2975666f42748340df798114742d6d)
Signed-off-by: Andrea Righi <[hidden email]>
---
 mm/memory-failure.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 3730845e349a..2d7355cf70bf 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1156,10 +1156,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  }
 
  if (!PageHuge(p) && PageTransHuge(hpage)) {
- lock_page(hpage);
- if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
- unlock_page(hpage);
- if (!PageAnon(hpage))
+ lock_page(p);
+ if (!PageAnon(p) || unlikely(split_huge_page(p))) {
+ unlock_page(p);
+ if (!PageAnon(p))
  pr_err("MCE: %#lx: non anonymous thp\n", pfn);
  else
  pr_err("MCE: %#lx: thp split failed\n", pfn);
@@ -1168,7 +1168,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  put_hwpoison_page(p);
  return -EBUSY;
  }
- unlock_page(hpage);
+ unlock_page(p);
  VM_BUG_ON_PAGE(!page_count(p), p);
  hpage = compound_head(p);
  }
--
2.19.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH 5/5] mm: hwpoison: fix thp split handing in soft_offline_in_use_page()

Andrea Righi
In reply to this post by Andrea Righi
From: zhongjiang <[hidden email]>

When soft_offline_in_use_page() runs on a thp tail page after pmd is
split, we trigger the following VM_BUG_ON_PAGE():

  Memory failure: 0x3755ff: non anonymous thp
  __get_any_page: 0x3755ff: unknown zero refcount page type 2fffff80000000
  Soft offlining pfn 0x34d805 at process virtual address 0x20fff000
  page:ffffea000d360140 count:0 mapcount:0 mapping:0000000000000000 index:0x1
  flags: 0x2fffff80000000()
  raw: 002fffff80000000 ffffea000d360108 ffffea000d360188 0000000000000000
  raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
  page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
  ------------[ cut here ]------------
  kernel BUG at ./include/linux/mm.h:519!

soft_offline_in_use_page() passed refcount and page lock from tail page
to head page, which is not needed because we can pass any subpage to
split_huge_page().

Naoya had fixed a similar issue in c3901e722b29 ("mm: hwpoison: fix thp
split handling in memory_failure()").  But he missed fixing soft
offline.

Link: http://lkml.kernel.org/r/1551452476-24000-1-git-send-email-zhongjiang@...
Fixes: 61f5d698cc97 ("mm: re-enable THP")
Signed-off-by: zhongjiang <[hidden email]>
Acked-by: Naoya Horiguchi <[hidden email]>
Cc: Michal Hocko <[hidden email]>
Cc: Hugh Dickins <[hidden email]>
Cc: Kirill A. Shutemov <[hidden email]>
Cc: Andrea Arcangeli <[hidden email]>
Cc: <[hidden email]> [4.5+]
Signed-off-by: Andrew Morton <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-10124

(backported from commit 46612b751c4941c5c0472ddf04027e877ae5990f)
Signed-off-by: Andrea Righi <[hidden email]>
---
 mm/memory-failure.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 2d7355cf70bf..282d656252da 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1731,19 +1731,17 @@ static int soft_offline_in_use_page(struct page *page, int flags)
  struct page *hpage = compound_head(page);
 
  if (!PageHuge(page) && PageTransHuge(hpage)) {
- lock_page(hpage);
- if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
- unlock_page(hpage);
- if (!PageAnon(hpage))
+ lock_page(page);
+ if (!PageAnon(page) || unlikely(split_huge_page(page))) {
+ unlock_page(page);
+ if (!PageAnon(page))
  pr_info("soft offline: %#lx: non anonymous thp\n", page_to_pfn(page));
  else
  pr_info("soft offline: %#lx: thp split failed\n", page_to_pfn(page));
- put_hwpoison_page(hpage);
+ put_hwpoison_page(page);
  return -EBUSY;
  }
- unlock_page(hpage);
- get_hwpoison_page(page);
- put_hwpoison_page(hpage);
+ unlock_page(page);
  }
 
  if (PageHuge(page))
--
2.19.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK/Cmnt: [PATCH 0/5] [Xenial] CVE-2019-10124 - hwpoison memory DoS

Stefan Bader-2
In reply to this post by Andrea Righi
On 02.04.19 16:52, Andrea Righi wrote:

> https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10124.html
>
> When memory_failure() is called on a thp tail page after pmd is split an
> attacker can cause a denial of service (via hwpoison), triggering a
> reference counter bug, reported by VM_BUG_ON_PAGE().
>
> The reason is that memory_failure() is always using page refcount and
> page lock from tail page to head page when calling split_huge_page(),
> but it can pass any subpage to split_huge_page(), causing a potential
> refcount / locking bug. Fix by locking and checking the proper subpage.
>
> The fix requires backporting additional patches:
>
>  PATCH 1/5: introduce hpage locking in memory_failure()
>  PATCH 2/5: no functional changes, only code refactoring that helps to
>             apply the next patches
>  PATCH 3/5: properly handle non anonymous thp
>  PATCH 4/5: a fix similar to the actual CVE
>  PATCH 5/5: the actual CVE
>
> Kirill A. Shutemov (1):
>  thp, mm: split_huge_page(): caller need to lock page
>
> Naoya Horiguchi (3):
>  mm: soft-offline: clean up soft_offline_page()
>  mm: soft-offline: exit with failure for non anonymous thp
>  mm: hwpoison: fix thp split handling in memory_failure()
>
> zhongjiang (1):
>  mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
>
>  mm/memory-failure.c | 80 ++++++++++++++++++++++++++++++++++-------------------
>  mm/migrate.c        |  8 ++++--
>  2 files changed, 58 insertions(+), 30 deletions(-)
>
>
When doing backports it helps to review when you add a short hint about how hard
it was or what had to be adapted. The submitted patches still look reasonably
compact, so I assume it was mostly context adjustments.

Acked-by: Stefan Bader <[hidden email]>


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: ACK/Cmnt: [PATCH 0/5] [Xenial] CVE-2019-10124 - hwpoison memory DoS

Andrea Righi
On Wed, Apr 17, 2019 at 04:13:39PM +0200, Stefan Bader wrote:

> On 02.04.19 16:52, Andrea Righi wrote:
> > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10124.html
> >
> > When memory_failure() is called on a thp tail page after pmd is split an
> > attacker can cause a denial of service (via hwpoison), triggering a
> > reference counter bug, reported by VM_BUG_ON_PAGE().
> >
> > The reason is that memory_failure() is always using page refcount and
> > page lock from tail page to head page when calling split_huge_page(),
> > but it can pass any subpage to split_huge_page(), causing a potential
> > refcount / locking bug. Fix by locking and checking the proper subpage.
> >
> > The fix requires backporting additional patches:
> >
> >  PATCH 1/5: introduce hpage locking in memory_failure()
> >  PATCH 2/5: no functional changes, only code refactoring that helps to
> >             apply the next patches
> >  PATCH 3/5: properly handle non anonymous thp
> >  PATCH 4/5: a fix similar to the actual CVE
> >  PATCH 5/5: the actual CVE
> >
> > Kirill A. Shutemov (1):
> >  thp, mm: split_huge_page(): caller need to lock page
> >
> > Naoya Horiguchi (3):
> >  mm: soft-offline: clean up soft_offline_page()
> >  mm: soft-offline: exit with failure for non anonymous thp
> >  mm: hwpoison: fix thp split handling in memory_failure()
> >
> > zhongjiang (1):
> >  mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
> >
> >  mm/memory-failure.c | 80 ++++++++++++++++++++++++++++++++++-------------------
> >  mm/migrate.c        |  8 ++++--
> >  2 files changed, 58 insertions(+), 30 deletions(-)
> >
> >
> When doing backports it helps to review when you add a short hint about how hard
> it was or what had to be adapted. The submitted patches still look reasonably
> compact, so I assume it was mostly context adjustments.

Exactly, the "backporting" I'm mentioning were alsmost clean cherry
picks, they only require minor context adjustments.

>
> Acked-by: Stefan Bader <[hidden email]>
>

Thanks,
-Andrea

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

NACK: [PATCH 0/5] [Xenial] CVE-2019-10124 - hwpoison memory DoS

Andrea Righi
In reply to this post by Stefan Bader-2
I have a test case to trigger a kernel bug in Xenial that might be
related to this particular problem (or something very similar to this),
and it happens even with this patch set applied.

So, let's ignore this patch set for now, I'll send a new version when I
figure out a proper fix for this problem.

-Andrea

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team