Ubuntu
linux package

VIA C7-D machine "kernel NULL pointer dereference" in skcipher_recvmsg_async

Bug #1556562 reported by Jeffrey Walton on 2016-03-13

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux (Ubuntu)	Fix Released	Critical	Kamal Mostafa
	Wily	Fix Released	Critical	Kamal Mostafa

Bug Description

I'm working on an Lubuntu 15 machine. It was chosen because it supports VIA C7-D processor and the VIA PM400 chipset without crashing (also see ). Lubuntu 15 uses the 4.2 kernel:

  $ lsb_release -a
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description: Ubuntu 15.10
  Release: 15.10
  Codename: wily

And:

$ uname -a
Linux via 4.2.0-30-generic #36-Ubuntu SMP Fri Feb 26 00:57:19 UTC 2016 i686 i686 i686 GNU/Linux

When running a particular program (details below), it hangs in syscall 248 and results in the following dmesg/syslog output. The process cannot be killed, the machine does not respond to a 'shutdown -r now', and the machine requires a hard reset.

...
[ 4505.429577] BUG: unable to handle kernel NULL pointer dereference at 00000008
[ 4505.429593] IP: [<f8a6ccf2>] skcipher_recvmsg_async.isra.13+0x4b2/0x500 [algif_skcipher]
[ 4505.429607] *pdpt = 0000000034ee3001 *pde = 0000000000000000
[ 4505.429614] Oops: 0000 [#3] SMP
[ 4505.429621] Modules linked in: jitterentropy_rng drbg ansi_cprng algif_skcipher af_alg snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi padlock_sha snd_seq padlock_aes snd_seq_device via_cputemp snd_timer hwmon_vid via_rng snd input_leds serio_raw soundcore i2c_viapro shpchp 8250_fintek mac_hid parport_pc ppdev lp parport autofs4 pata_acpi hid_generic usbhid hid psmouse r8169 pata_via sata_via mii
[ 4505.429689] CPU: 0 PID: 1532 Comm: afalgtest Tainted: G D 4.2.0-30-generic #36-Ubuntu
[ 4505.429695] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Weibu, BIOS 080014 11/17/2011
[ 4505.429700] task: f4e0e040 ti: f4e3c000 task.ti: f4e3c000
[ 4505.429705] EIP: 0060:[<f8a6ccf2>] EFLAGS: 00010202 CPU: 0
[ 4505.429712] EIP is at skcipher_recvmsg_async.isra.13+0x4b2/0x500 [algif_skcipher]
[ 4505.429717] EAX: f3f97c00 EBX: f3f3ee00 ECX: f3f97c00 EDX: 00000000
[ 4505.429722] ESI: f3f3ee00 EDI: 00000ff0 EBP: f4e3ddc8 ESP: f4e3dd70
[ 4505.429726] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 4505.429731] CR0: 80050033 CR2: 00000008 CR3: 3247a520 CR4: 000006b0
[ 4505.429735] Stack:
[ 4505.429738] f3f97df4 f3f97c00 f3f97de0 00000000 f3f97c04 00000020 f4e3dd00 00000018
[ 4505.429750] 00001ff0 f3fb4400 f3f97c04 00000ff0 f4e3de40 f3f97de8 f4e3de38 f3fa0000
[ 4505.429761] 00000002 00000002 f3f97c00 f1f58180 c1210510 f4e3de38 f4e3ddf4 f8a6cd6b
[ 4505.429772] Call Trace:
[ 4505.429788] [<c1210510>] ? free_ioctx_users+0xa0/0xa0
[ 4505.429795] [<f8a6cd6b>] skcipher_recvmsg+0x2b/0x1f0 [algif_skcipher]
[ 4505.429803] [<f8a6c71a>] ? skcipher_check_key.isra.8+0x2a/0xb0 [algif_skcipher]
[ 4505.429810] [<f8a6cf61>] skcipher_recvmsg_nokey+0x31/0x40 [algif_skcipher]
[ 4505.429820] [<c164e1fd>] sock_recvmsg+0x3d/0x50
[ 4505.429826] [<c164e294>] sock_read_iter+0x84/0xd0
[ 4505.429833] [<c164e210>] ? sock_recvmsg+0x50/0x50
[ 4505.429839] [<c12108b0>] aio_run_iocb+0x110/0x2c0
[ 4505.429846] [<c164e210>] ? sock_recvmsg+0x50/0x50
[ 4505.429854] [<c1767b8f>] ? error_code+0x67/0x6c
[ 4505.429865] [<c11b25e4>] ? kmem_cache_alloc+0x1b4/0x1e0
[ 4505.429875] [<c11e5112>] ? __fdget+0x12/0x20
[ 4505.429881] [<c121168f>] do_io_submit+0x1ef/0x4a0
[ 4505.429893] [<c12ddd2f>] ? security_file_alloc+0x2f/0x50
[ 4505.429900] [<c1211960>] SyS_io_submit+0x20/0x30
[ 4505.429911] [<c176695f>] sysenter_do_call+0x12/0x12
[ 4505.429915] Code: 00 00 00 75 24 8b 45 ac ff 52 0c 89 c7 83 ff 8d 75 8f 8b 45 e4 3e ff 80 fc 01 00 00 bf ef fd ff ff e9 62 fc ff ff 8d 76 00 89 c8 <ff> 52 08 89 c7 eb db 8b 45 e4 31 d2 8b 80 20 02 00 00 8b 58 1c
[ 4505.429982] EIP: [<f8a6ccf2>] skcipher_recvmsg_async.isra.13+0x4b2/0x500 [algif_skcipher] SS:ESP 0068:f4e3dd70
[ 4505.429991] CR2: 0000000000000008
[ 4505.429997] ---[ end trace 3cce7cc6be0ad960 ]---

**********

The process details is this is a failed self test for the upcoming OpenSSL 1.1.0. The OpenSSL RT bug report for this issue is at http://rt.openssl.org/Ticket/Display.html?id=4411. Two attempts to debug it resulted in two hung processes:

$ ps -A | grep afalgtest
1030 pts/0 00:00:00 afalgtest
1196 pts/0 00:00:00 afalgtest

And:

via:test$ sudo cat /proc/1030/syscall
248 0xb7fd6000 0x1 0xbfff98d4 0xb7fb9270 0xbfff98e0 0xb7ec45f7 0xbfff986c 0xb7fdbbe8
via:test$ sudo cat /proc/1196/syscall
248 0xb7fd6000 0x1 0xbfff98d4 0xb7fb9270 0xbfff98e0 0xb7ec45f7 0xbfff986c 0xb7fdbbe8

Its not clear to me what that particular syscall is:

$ cat /usr/include/asm-generic/unistd.h
...
/*
* Architectures may provide up to 16 syscalls of their own
* starting with this value.
*/
#define __NR_arch_specific_syscall 244

#define __NR_wait4 260
__SC_COMP(__NR_wait4, sys_wait4, compat_sys_wait4)
#define __NR_prlimit64 261
__SYSCALL(__NR_prlimit64, sys_prlimit64)
#define __NR_fanotify_init 262
__SYSCALL(__NR_fanotify_init, sys_fanotify_init)
#define __NR_fanotify_mark 263
...

**********

If interested, you should be able to duplicate it with the following. That's resuming you have the hardware.

$ git clone git://git.openssl.org/openssl.git
$ cd openssl

$ ./config -d
$ make
$ make test/afalgtest
$ cd test
$ OPENSSL_ENGINES=../engines/afalg gdb ./afalgtest

**********

In this case, the hardware was selected for the VIA C7-D processor and the Padlock engine. Its relatively low-end, and can be found at http://www.amazon.com/gp/product/B01AXR2KBQ.
---
ApportVersion: 2.19.1-0ubuntu5
Architecture: i386
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: jwalton 16458 F.... lxpanel
DistroRelease: Ubuntu 15.10
HibernationDevice: RESUME=UUID=e056d1a4-73ea-4667-a51f-604158d1b9fb
InstallationDate: Installed on 2016-03-22 (1 days ago)
InstallationMedia: Lubuntu 15.10 "Wily Werewolf" - Release i386 (20151021)
IwConfig:
lo no wireless extensions.

enp3s0 no wireless extensions.
MachineType: To Be Filled By O.E.M. To Be Filled By O.E.M.
Package: linux (not installed)
ProcEnviron:
TERM=xterm-256color
PATH=(custom, no user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcFB: 0 VESA VGA
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.2.0-35-generic root=UUID=ed37a08c-3f91-4903-b20a-ba9829326044 ro ipv6.disable=1 biosdevname=0 audit=0 quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 4.2.0-35.40-generic 4.2.8-ckt5
RelatedPackageVersions:
linux-restricted-modules-4.2.0-35-generic N/A
linux-backports-modules-4.2.0-35-generic N/A
linux-firmware 1.149.3
RfKill:

Tags: wily wily
UdevLog: Error: [Errno 2] No such file or directory: '/var/log/udev'
Uname: Linux 4.2.0-35-generic i686
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

_MarkForUpload: True
dmi.bios.date: 11/17/2011
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 080014
dmi.board.asset.tag: To Be Filled By O.E.M.
dmi.board.name: Weibu
dmi.board.vendor: WB
dmi.board.version: 1.0
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr080014:bd11/17/2011:svnToBeFilledByO.E.M.:pnToBeFilledByO.E.M.:pvrToBeFilledByO.E.M.:rvnWB:rnWeibu:rvr1.0:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: To Be Filled By O.E.M.

See original description

Tags:

Related branches

lp:ubuntu/trusty-proposed/linux-lts-wily

CVE References

Jeffrey Walton (noloader) on 2016-03-13

affects:

ubuntu → linux-kernel-no-pae

Kamal Mostafa (kamalmostafa) on 2016-03-23

Changed in linux-kernel-no-pae:
assignee:	nobody → Kamal Mostafa (kamalmostafa)

Kamal Mostafa (kamalmostafa) on 2016-03-23

affects:	linux-kernel-no-pae → linux
no longer affects:	linux
Changed in linux (Ubuntu Wily):
status:	New → In Progress
assignee:	nobody → Kamal Mostafa (kamalmostafa)

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-03-23: Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1556562

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Kamal Mostafa (kamalmostafa) on 2016-03-23

summary:

- VIA C7-D machine and "unable to handle kernel NULL pointer dereference
- at 00000008"
+ VIA C7-D machine "kernel NULL pointer dereference" in
+ skcipher_recvmsg_async

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-03-23:

No additional logs are required at this time.

Changed in linux (Ubuntu):
status:	Incomplete → Confirmed

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-03-23:

@Jeffrey-

Please try this test kernel: http://kernel.ubuntu.com/~kamal/lp1556562.0/

(For reference, this is 4.2.0-35.40 plus backports of these mainline commits:)
6454c2b crypto: algif_skcipher - Do not dereference ctx without socket lock
ec69bbf crypto: algif_skcipher - Do not assume that req is unchanged
6e8d8ec crypto: algif_skcipher - Add key check exception for cipher_null
a1383cd crypto: skcipher - Add crypto_skcipher_has_setkey

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: AlsaInfo.txt

AlsaInfo.txt Edit (28.5 KiB, text/plain)

apport information

tags:	added: apport-collected wily
description:	updated

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: CRDA.txt

CRDA.txt Edit (392 bytes, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: CurrentDmesg.txt

CurrentDmesg.txt Edit (54.0 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: JournalErrors.txt

JournalErrors.txt Edit (11.6 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: Lspci.txt

Lspci.txt Edit (25.3 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: Lsusb.txt

Lsusb.txt Edit (375 bytes, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: ProcCpuinfo.txt

#10

ProcCpuinfo.txt Edit (660 bytes, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: ProcInterrupts.txt

#11

ProcInterrupts.txt Edit (1.5 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: ProcModules.txt

#12

ProcModules.txt Edit (2.1 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: UdevDb.txt

#13

UdevDb.txt Edit (100.5 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24: WifiSyslog.txt

#14

WifiSyslog.txt Edit (70.8 KiB, text/plain)

apport information

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24:

#15

Kamal - to avoid confusion, the log files were uploaded based on the 4.2.0-35-generic kernel without the patches (re: Luis' request).

I'm getting to the updated 4.2.0-35-generic now (re: Kamal's request).

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-24:

#16

Kamal - the updated kernel files cleared the issue. Thank you so much.

Dmesg shows only the following, which I believe is expected when creating a socket with "AF_ALG" domain:

[ 806.458783] NET: Registered protocol family 38

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-03-24:

#17

Jeffrey- Thanks for testing and confirming the fix. We'll get those patches into the (likely next) Wily 4.2 kernel. A message will be posted to this bug once the fix lands in -proposed.

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-25:

#18

I wanted to provide some feedback, if interested. Using Kamal's test kernel and asynchronus test vectors from Taruk's GitHub (https://github.com/tstruk/afalg_async_test)...

The SKCIPHER asynchronous test program passed.

However, the the AEAD asynchronous test program failed with:

  $ cd aead
  $ make
  $ ...

  $ ./test
  $ doing copy,
  $ bind error 2

HASH, MAC, etc were not tested.

-----------

I also noticed Torvalds has some tests at:

  linux$ find . -name '*tcrypt*'
  ./crypto/tcrypt.c
  ./crypto/tcrypt.h

I'm going to try and get them running on this kernel tonight or tomorrow.

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-03-26:

#19

It looks like this is why the AEAD test is failing (if I am parsing things correctly): http://patchwork.kernel.org/patch/8182971/. The current kernel sources are missing struct aead_async_rsgl, struct aead_async_req, et al.

Also, from comment 18: s/Taruk's GitHub/Tadeusz GitHub/g. I'm not sure how I managed to munge the name.

Brad Figg (brad-figg) on 2016-03-29

Changed in linux (Ubuntu Wily):
status:	In Progress → Fix Committed

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-03-29:

#20

Jeffrey, my understanding here is that this bug report is now resolved (or will be) by the patch set you confirmed in comment #16.

If I understand correctly, the AEAD test failure you mention in comment #18 is a separate issue -- it would require a separate bug report. I note though, that the patch you reference in #19 doesn't appear upstream (yet at least). It seems like it would be considered a "new feature" (so "Wishlist" importance, if you file a new bug for it).

Alberto Salvia Novella (es20490446e) on 2016-04-20

Changed in linux (Ubuntu):
importance:	Undecided → Critical
status:	Confirmed → Fix Committed
Changed in linux (Ubuntu Wily):
importance:	Undecided → Critical
Changed in linux (Ubuntu):
assignee:	nobody → Kamal Mostafa (kamalmostafa)

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-04-20:

#21

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-wily' to 'verification-done-wily'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-wily

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-05-04:

#22

Hi Jeffrey- Can you confirm that the Wily kernel (4.2.0-36.41) currently in -proposed fixes this bug? Thanks!

Revision history for this message

Jeffrey Walton (noloader) wrote on 2016-05-05: Re: [Bug 1556562] Re: VIA C7-D machine "kernel NULL pointer dereference" in skcipher_recvmsg_async

#23

> Can you confirm that the Wily kernel (4.2.0-36.41)
> currently in -proposed fixes this bug? Thanks!

All looks good when installing the three packages from wily-proposed:
linux-headers-4.2.0-36-generic linux-image-4.2.0-36-generic
linux-image-extra-4.2.0-36-generic. The kernel did not deference the
NULL pointer, and the particular OpenSSL self test passed:

    make test
    ../test/recipes/25-test_x509.t ............. ok
    ../test/recipes/30-test_afalg.t ............ ok
    ../test/recipes/30-test_engine.t ........... ok

And the only thing I see under dmesg:

    $ dmesg
    ...
    [ 913.294639] NET: Registered protocol family 38
    $

A small nit, which is probably due to my misunderstanding of the way
dependencies are handled when using Selective Upgrades
(http://wiki.ubuntu.com/Testing/EnableProposed#Selective_upgrading_from_-proposed).
When I performed only 'apt-get install
linux-image-4.2.0-36-generic/wily-proposed', the machine did not boot,
and it was stuck at the initramfs prompt. I needed to install
linux-image-extra-4.2.0-36-generic manually.

Kamal Mostafa (kamalmostafa) on 2016-05-05

tags:

added: verification-done-wily
removed: verification-needed-wily

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-05-09:

#24

Download full text (30.4 KiB)

This bug was fixed in the package linux - 4.2.0-36.41

---------------
linux (4.2.0-36.41) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1571667

[ Benjamin Tissoires ]

  * SAUCE: Input: synaptics - handle spurious release of trackstick
    buttons, again
    - LP: #1553811

[ dann frazier ]

  * Revert "SAUCE: arm64, numa, dt: adding dt based numa support using dt
    node property arm, associativity"
    - LP: #1558828
  * Revert "SAUCE: Documentation: arm64/arm: dt bindings for numa."
    - LP: #1558828
  * Revert "SAUCE: arm64, numa: adding numa support for arm64 platforms."
    - LP: #1558828
  * Revert "[Config] Enable NUMA on ARM64"
    - LP: #1558828

[ K. Y. Srinivasan ]

  * SAUCE: (noup): Drivers: hv: vmbus: Fix a bug in
    hv_need_to_signal_on_read()
    - LP: #1556264

[ Kamal Mostafa ]

* [debian] BugLink: close LP: bugs only for Launchpad urls
* [Config] updateconfigs after v4.2.8-ckt7

[ Upstream Kernel Changes ]

This bug was fixed in the package linux - 4.2.0-36.41

---------------
linux (4.2.0-36.41) wily; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1571667

[ Benjamin Tissoires ]

* SAUCE: Input: synaptics - handle spurious release of trackstick
    buttons, again
    - LP: #1553811

[ dann frazier ]

[ K. Y. Srinivasan ]

* SAUCE: (noup): Drivers: hv: vmbus: Fix a bug in
    hv_need_to_signal_on_read()
    - LP: #1556264

[ Kamal Mostafa ]

* [debian] BugLink: close LP: bugs only for Launchpad urls
  * [Config] updateconfigs after v4.2.8-ckt7

[ Upstream Kernel Changes ]

* Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin"
    - LP: #1561677
  * tipc: fix connection abort during subscription cancel
    - LP: #1561677
  * tipc: fix nullptr crash during subscription cancel
    - LP: #1561677
  * s390/mm: four page table levels vs. fork
    - LP: #1561677
  * Input: aiptek - fix crash on detecting device without endpoints
    - LP: #1561677
  * wext: fix message delay/ordering
    - LP: #1561677
  * cfg80211/wext: fix message ordering
    - LP: #1561677
  * mac80211: fix use of uninitialised values in RX aggregation
    - LP: #1561677
  * mac80211: minstrel: Change expected throughput unit back to Kbps
    - LP: #1561677
  * libata: fix HDIO_GET_32BIT ioctl
    - LP: #1561677
  * iwlwifi: mvm: inc pending frames counter also when txing non-sta
    - LP: #1561677
  * [media] adv7604: fix tx 5v detect regression
    - LP: #1561677
  * ahci: add new Intel device IDs
    - LP: #1561677
  * ahci: Order SATA device IDs for codename Lewisburg
    - LP: #1561677
  * Adding Intel Lewisburg device IDs for SATA
    - LP: #1561677
  * ASoC: samsung: Use IRQ safe spin lock calls
    - LP: #1561677
  * mac80211: minstrel_ht: set default tx aggregation timeout to 0
    - LP: #1561677
  * usb: chipidea: otg: change workqueue ci_otg as freezable
    - LP: #1561677
  * jffs2: Fix page lock / f->sem deadlock
    - LP: #1561677
  * Fix directory hardlinks from deleted directories
    - LP: #1561677
  * iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered
    - LP: #1561677
  * iommu/amd: Apply workaround for ATS write permission check
    - LP: #1561677
  * libata: Align ata_device's id on a cacheline
    - LP: #1561677
  * can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()
    - LP: #1561677
  * fbcon: set a default value to blink interval
    - LP: #1561677
  * KVM: x86: fix root cause for missed hardware breakpoints
    - LP: #1561677
  * arm64: vmemmap: use virtual projection of linear region
    - LP: #1561677
  * vfio: fix ioctl error handling
    - LP: #1561677
  * ALSA: ctl: Fix ioctls for X32 ABI
    - LP: #1561677
  * ALSA: pcm: Fix ioctls for X32 ABI
    - LP: #1561677
  * ALSA: rawmidi: Fix ioctls X32 ABI
    - LP: #1561677
  * ALSA: timer: Fix broken compat timer user status ioctl
    - LP: #1561677
  * ALSA: timer: Fix ioctls for X32 ABI
    - LP: #1561677
  * cifs: fix out-of-bounds access in lease parsing
    - LP: #1561677
  * CIFS: Fix SMB2+ interim response processing for read requests
    - LP: #1561677
  * Fix cifs_uniqueid_to_ino_t() function for s390x
    - LP: #1561677
  * arm/arm64: KVM: Fix ioctl error handling
    - LP: #1561677
  * MIPS: kvm: Fix ioctl error handling.
    - LP: #1561677
  * ALSA: hdspm: Fix wrong boolean ctl value accesses
    - LP: #1561677
  * ALSA: hdspm: Fix zero-division
    - LP: #1561677
  * ALSA: hdsp: Fix wrong boolean ctl value accesses
    - LP: #1561677
  * use ->d_seq to get coherency between ->d_inode and ->d_flags
    - LP: #1561677
  * USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3)
    - LP: #1561677
  * USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder
    - LP: #1561677
  * ASoC: dapm: Fix ctl value accesses in a wrong type
    - LP: #1561677
  * ASoC: wm8958: Fix enum ctl accesses in a wrong type
    - LP: #1561677
  * ASoC: wm8994: Fix enum ctl accesses in a wrong type
    - LP: #1561677
  * ASoC: wm_adsp: Fix enum ctl accesses in a wrong type
    - LP: #1561677
  * USB: serial: option: add support for Telit LE922 PID 0x1045
    - LP: #1561677
  * USB: serial: option: add support for Quectel UC20
    - LP: #1561677
  * ALSA: usb-audio: Add a quirk for Plantronics DA45
    - LP: #1561677
  * mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs
    - LP: #1561677
  * mac80211: Fix Public Action frame RX in AP mode
    - LP: #1561677
  * i2c: brcmstb: allocate correct amount of memory for regmap
    - LP: #1561677
  * ALSA: seq: oss: Don't drain at closing a client
    - LP: #1561677
  * parisc: Fix ptrace syscall number and return value modification
    - LP: #1561677
  * drm/ast: Fix incorrect register check for DRAM width
    - LP: #1561677
  * USB: qcserial: add Sierra Wireless EM74xx device ID
    - LP: #1561677
  * drm/amdgpu/pm: update current crtc info after setting the powerstate
    - LP: #1561677
  * drm/radeon/pm: update current crtc info after setting the powerstate
    - LP: #1561677
  * drm/amdgpu: return from atombios_dp_get_dpcd only when error
    - LP: #1561677
  * PM / sleep / x86: Fix crash on graph trace through x86 suspend
    - LP: #1561677
  * ALSA: hda - Fix mic issues on Acer Aspire E1-472
    - LP: #1561677
  * ovl: fix working on distributed fs as lower layer
    - LP: #1561677
  * ovl: fix getcwd() failure after unsuccessful rmdir
    - LP: #1561677
  * ovl: ignore lower entries when checking purity of non-directory entries
    - LP: #1561677
  * MIPS: traps: Fix SIGFPE information leak from `do_ov' and
    `do_trap_or_bp'
    - LP: #1561677
  * ubi: Fix out of bounds write in volume update code
    - LP: #1561677
  * target: Drop incorrect ABORT_TASK put for completed commands
    - LP: #1561677
  * ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property
    - LP: #1561677
  * ARM: dts: dra7: do not gate cpsw clock due to errata i877
    - LP: #1561677
  * PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr()
    - LP: #1561677
  * KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest
    exit
    - LP: #1561677
  * ncpfs: fix a braino in OOM handling in ncp_fill_cache()
    - LP: #1561677
  * jffs2: reduce the breakage on recovery from halfway failed rename()
    - LP: #1561677
  * KVM: VMX: disable PEBS before a guest entry
    - LP: #1561677
  * arm64: account for sparsemem section alignment when choosing vmemmap
    offset
    - LP: #1561677
  * tracing: Fix check for cpu online when event is disabled
    - LP: #1561677
  * KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo
    - LP: #1561677
  * dmaengine: at_xdmac: fix residue computation
    - LP: #1561677
  * MIPS: Fix build error when SMP is used without GIC
    - LP: #1561677
  * IB/core: Use GRH when the path hop-limit > 0
    - LP: #1561677
  * dmaengine: pxa_dma: fix cyclic transfers
    - LP: #1561677
  * MIPS: smp.c: Fix uninitialised temp_foreign_map
    - LP: #1561677
  * tcp: fix tcpi_segs_in after connection establishment
    - LP: #1561677
  * be2net: Don't leak iomapped memory on removal.
    - LP: #1561677
  * tcp: convert cached rtt from usec to jiffies when feeding initial rto
    - LP: #1561677
  * ext4: iterate over buffer heads correctly in move_extent_per_page()
    - LP: #1561677
  * ppp: release rtnl mutex when interface creation fails
    - LP: #1561677
  * net/mlx4_core: Allow resetting VF admin mac to zero
    - LP: #1561677
  * ipv6: re-enable fragment header matching in ipv6_find_hdr
    - LP: #1561677
  * net/mlx5e: Remove wrong poll CQ optimization
    - LP: #1561677
  * cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
    - LP: #1561677
  * net: qca_spi: Don't clear IFF_BROADCAST
    - LP: #1561677
  * net: moxa: fix an error code
    - LP: #1561677
  * mld, igmp: Fix reserved tailroom calculation
    - LP: #1561677
  * Linux 4.2.8-ckt6
    - LP: #1561677
  * (upstream) net/mlx5e: Avoid NULL pointer access in case of
    configuration failure
    - LP: #1528466
  * PCI: Disable IO/MEM decoding for devices with non-compliant BARs
    - LP: #1559929
  * x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant
    BARs
    - LP: #1559929
  * fuse: do not use iocb after it may have been freed
    - LP: #1505948
  * fuse: Add reference counting for fuse_io_priv
    - LP: #1505948
  * intel_idle: prevent SKL-H boot failure when C8+C9+C10 enabled
    - LP: #1559918
  * crypto: skcipher - Add crypto_skcipher_has_setkey
    - LP: #1556562
  * crypto: algif_skcipher - Add key check exception for cipher_null
    - LP: #1556562
  * crypto: algif_skcipher - Do not assume that req is unchanged
    - LP: #1556562
  * crypto: algif_skcipher - Do not dereference ctx without socket lock
    - LP: #1556562
  * proc: revert /proc/<pid>/maps [stack:TID] annotation
    - LP: #1547231
  * ACPI / processor: Request native thermal interrupt handling via _OSC
    - LP: #1559923
  * gpiolib: do not allow to insert an empty gpiochip
    - LP: #1566544
  * gpio: add a data pointer to gpio_chip
    - LP: #1566544
  * gpio: rcar: Add Runtime PM handling for interrupts
    - LP: #1566544
  * ipv4: Don't do expensive useless work during inetdev destroy.
    - LP: #1566544
  * Input: powermate - fix oops with malicious USB descriptors
    - LP: #1566544
  * USB: iowarrior: fix oops with malicious USB descriptors
    - LP: #1566544
  * ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
    - LP: #1566544
  * ALSA: usb-audio: Add sanity checks for endpoint accesses
    - LP: #1566544
  * include/linux/poison.h: fix LIST_POISON{1,2} offset
    - LP: #1566544
  * Input: ati_remote2 - fix crashes on detecting device with invalid
    descriptor
    - LP: #1566544
  * USB: cdc-acm: more sanity checking
    - LP: #1566544
  * drm/i915: Workaround CHV pipe C cursor fail
    - LP: #1566544
  * EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
    - LP: #1566544
  * crypto: ccp - Add hash state import and export support
    - LP: #1566544
  * clk: rockchip: add pclk_cpu to the list of rk3188 critical clocks
    - LP: #1566544
  * clk: rockchip: Add pclk_peri to critical clocks on RK3066/RK3188
    - LP: #1566544
  * clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks
    - LP: #1566544
  * tty: Fix GPF in flush_to_ldisc(), part 2
    - LP: #1566544
  * media: v4l2-compat-ioctl32: fix missing length copy in
    put_v4l2_buffer32
    - LP: #1566544
  * pwc: Add USB id for Philips Spc880nc webcam
    - LP: #1566544
  * crypto: ccp - Limit the amount of information exported
    - LP: #1566544
  * crypto: ccp - Don't assume export/import areas are aligned
    - LP: #1566544
  * 8250: use callbacks to access UART_DLL/UART_DLM
    - LP: #1566544
  * net: irda: Fix use-after-free in irtty_open()
    - LP: #1566544
  * mei: bus: check if the device is enabled before data transfer
    - LP: #1566544
  * staging: comedi: ni_tiocmd: change mistaken use of start_src for
    start_arg
    - LP: #1566544
  * tools/hv: Use include/uapi with __EXPORTED_HEADERS__
    - LP: #1566544
  * tpm: fix the rollback in tpm_chip_register()
    - LP: #1566544
  * tpm: fix the cleanup of struct tpm_chip
    - LP: #1566544
  * ARM: dts: armada-375: use armada-370-sata for SATA
    - LP: #1566544
  * usb: retry reset if a device times out
    - LP: #1566544
  * HID: fix hid_ignore_special_drivers module parameter
    - LP: #1566544
  * scripts/coccinelle: modernize &
    - LP: #1566544
  * adv7511: TX_EDID_PRESENT is still 1 after a disconnect
    - LP: #1566544
  * saa7134: Fix bytesperline not being set correctly for planar formats
    - LP: #1566544
  * tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()
    - LP: #1566544
  * perf tools: Dont stop PMU parsing on alias parse error
    - LP: #1566544
  * Bluetooth: btusb: Add new AR3012 ID 13d3:3395
    - LP: #1542564, #1566544
  * Bluetooth: Add new AR3012 ID 0489:e095
    - LP: #1542944, #1566544
  * aacraid: Fix RRQ overload
    - LP: #1566544
  * aacraid: Fix memory leak in aac_fib_map_free
    - LP: #1566544
  * aic7xxx: Fix queue depth handling
    - LP: #1566544
  * mtd: onenand: fix deadlock in onenand_block_markbad
    - LP: #1566544
  * md/raid5: Compare apples to apples (or sectors to sectors)
    - LP: #1566544
  * RAID5: check_reshape() shouldn't call mddev_suspend
    - LP: #1566544
  * RAID5: revert e9e4c377e2f563 to fix a livelock
    - LP: #1566544
  * crypto: ccp - memset request context to zero during import
    - LP: #1566544
  * Bluetooth: btusb: Add a new AR3012 ID 04ca:3014
    - LP: #1546694, #1566544
  * mmc: sdhci: fix data timeout (part 1)
    - LP: #1566544
  * mmc: sdhci: fix data timeout (part 2)
    - LP: #1566544
  * perf tools: Fix python extension build
    - LP: #1566544
  * IB/srpt: Simplify srpt_handle_tsk_mgmt()
    - LP: #1566544
  * bttv: Width must be a multiple of 16 when capturing planar formats
    - LP: #1566544
  * watchdog: rc32434_wdt: fix ioctl error handling
    - LP: #1566544
  * nfsd4: fix bad bounds checking
    - LP: #1566544
  * xfs: fix two memory leaks in xfs_attr_list.c error paths
    - LP: #1566544
  * quota: Fix possible GPF due to uninitialised pointers
    - LP: #1566544
  * mtip32xx: Fix broken service thread handling
    - LP: #1566544
  * mtip32xx: Remove unwanted code from taskfile error handler
    - LP: #1566544
  * mtip32xx: Print exact time when an internal command is interrupted
    - LP: #1566544
  * mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild
    - LP: #1566544
  * mtip32xx: Fix for rmmod crash when drive is in FTL rebuild
    - LP: #1566544
  * mtip32xx: Handle safe removal during IO
    - LP: #1566544
  * mtip32xx: Handle FTL rebuild failure state during device initialization
    - LP: #1566544
  * of: alloc anywhere from memblock if range not specified
    - LP: #1566544
  * usb: hub: fix a typo in hub_port_init() leading to wrong logic
    - LP: #1566544
  * KVM: i8254: change PIT discard tick policy
    - LP: #1566544
  * sched/cputime: Fix steal time accounting vs. CPU hotplug
    - LP: #1566544
  * libnvdimm: Fix security issue with DSM IOCTL.
    - LP: #1566544
  * rt2x00: add new rt2800usb device Buffalo WLI-UC-G450
    - LP: #1566544
  * pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing
    - LP: #1566544
  * perf/core: Fix perf_sched_count derailment
    - LP: #1566544
  * perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2
    - LP: #1566544
  * perf/x86/intel: Fix PEBS warning by only restoring active PMU in pmi
    - LP: #1566544
  * sched/cputime: Fix steal_account_process_tick() to always return
    jiffies
    - LP: #1566544
  * bcache: fix race of writeback thread starting before complete
    initialization
    - LP: #1566544
  * bcache: cleaned up error handling around register_cache()
    - LP: #1566544
  * bcache: fix cache_set_flush() NULL pointer dereference on OOM
    - LP: #1566544
  * be2iscsi: set the boot_kset pointer to NULL in case of failure
    - LP: #1566544
  * md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list
    - LP: #1566544
  * drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.
    - LP: #1566544
  * sg: fix dxferp in from_to case
    - LP: #1566544
  * jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount
    path
    - LP: #1566544
  * ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
    - LP: #1566544
  * EDAC/sb_edac: Fix computation of channel address
    - LP: #1566544
  * Bluetooth: btusb: Add a new AR3012 ID 13d3:3472
    - LP: #1552925, #1566544
  * ALSA: pcm: Avoid "BUG:" string for warnings again
    - LP: #1566544
  * dm snapshot: disallow the COW and origin devices from being identical
    - LP: #1566544
  * dm thin metadata: don't issue prefetches if a transaction abort has
    failed
    - LP: #1566544
  * dm cache: make sure every metadata function checks fail_io
    - LP: #1566544
  * iser-target: Fix identification of login rx descriptor type
    - LP: #1566544
  * iser-target: Add new state ISER_CONN_BOUND to isert_conn
    - LP: #1566544
  * iser-target: Separate flows for np listeners and connections cma events
    - LP: #1566544
  * ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
    - LP: #1555912, #1566544
  * xtensa: ISS: don't hang if stdin EOF is reached
    - LP: #1566544
  * xtensa: fix preemption in {clear,copy}_user_highpage
    - LP: #1566544
  * xtensa: clear all DBREAKC registers on start
    - LP: #1566544
  * Bluetooth: Fix potential buffer overflow with Add Advertising
    - LP: #1566544
  * ARC: [BE] readl()/writel() to work in Big Endian CPU configuration
    - LP: #1566544
  * bus: imx-weim: Take the 'status' property value into account
    - LP: #1566544
  * ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
    - LP: #1566544
  * s390/pci: enforce fmb page boundary rule
    - LP: #1566544
  * drm/radeon: rework fbdev handling on chips with no connectors
    - LP: #1566544
  * md: multipath: don't hardcopy bio in .make_request path
    - LP: #1566544
  * net: mvneta: enable change MAC address when interface is up
    - LP: #1566544
  * dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request()
    - LP: #1566544
  * HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
    - LP: #1566544
  * ALSA: hda - Fix unconditional GPIO toggle via automute
    - LP: #1566544
  * mmc: mmc_spi: Add Card Detect comments and fix CD GPIO case
    - LP: #1566544
  * nfsd: fix deadlock secinfo+readdir compound
    - LP: #1566544
  * vfs: show_vfsstat: do not ignore errors from show_devname method
    - LP: #1566544
  * x86/iopl: Fix iopl capability check on Xen PV
    - LP: #1566544
  * crypto: marvell/cesa - forward devm_ioremap_resource() error code
    - LP: #1566544
  * mmc: sdhci: Fix override of timeout clk wrt max_busy_timeout
    - LP: #1566544
  * drm/amdgpu: include the right version of gmc header files for iceland
    - LP: #1566544
  * Input: ims-pcu - sanity check against missing interfaces
    - LP: #1566544
  * watchdog: don't run proc_watchdog_update if new value is same as old
    - LP: #1566544
  * mm: memcontrol: reclaim when shrinking memory.high below usage
    - LP: #1566544
  * mm: memcontrol: reclaim and OOM kill when shrinking memory.max below
    usage
    - LP: #1566544
  * x86/apic: Fix suspicious RCU usage in
    smp_trace_call_function_interrupt()
    - LP: #1566544
  * USB: usb_driver_claim_interface: add sanity checking
    - LP: #1566544
  * USB: uas: Reduce can_queue to MAX_CMNDS
    - LP: #1566544
  * tracing: Have preempt(irqs)off trace preempt disabled functions
    - LP: #1566544
  * tracing: Fix crash from reading trace_pipe with sendfile
    - LP: #1566544
  * splice: handle zero nr_pages in splice_to_pipe()
    - LP: #1566544
  * ALSA: usb-audio: add Microsoft HD-5001 to quirks
    - LP: #1566544
  * writeback, cgroup: fix premature wb_put() in
    locked_inode_to_wb_and_lock_list()
    - LP: #1566544
  * fs-writeback: unplug before cond_resched in writeback_sb_inodes
    - LP: #1566544
  * writeback, cgroup: fix use of the wrong bdi_writeback which mismatches
    the inode
    - LP: #1566544
  * bitops: Do not default to __clear_bit() for __clear_bit_unlock()
    - LP: #1566544
  * target: Fix target_release_cmd_kref shutdown comp leak
    - LP: #1566544
  * KVM: VMX: avoid guest hang on invalid invept instruction
    - LP: #1566544
  * KVM: fix spin_lock_init order on x86
    - LP: #1566544
  * tracing: Fix trace_printk() to print when not using bprintk()
    - LP: #1566544
  * fs/coredump: prevent fsuid=0 dumps into user-controlled directories
    - LP: #1566544
  * rapidio/rionet: fix deadlock on SMP
    - LP: #1566544
  * staging: comedi: ni_mio_common: fix the ni_write[blw]() functions
    - LP: #1566544
  * staging: android: ion_test: fix check of
    platform_device_register_simple() error code
    - LP: #1566544
  * ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list
    - LP: #1566544
  * MAINTAINERS: Update mailing list and web page for hwmon subsystem
    - LP: #1566544
  * ocfs2/dlm: fix race between convert and recovery
    - LP: #1566544
  * ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list
    - LP: #1566544
  * mm/page_alloc: prevent merging between isolated and other pageblocks
    - LP: #1566544
  * mac80211: avoid excessive stack usage in sta_info
    - LP: #1566544
  * clk: xgene: Add missing parenthesis when clearing divider value
    - LP: #1566544
  * clk: qcom: msm8960: Fix ce3_src register offset
    - LP: #1566544
  * xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"
    - LP: #1566544
  * ppp: take reference on channels netns
    - LP: #1566544
  * mdio-sun4i: oops in error handling in probe
    - LP: #1566544
  * clk: rockchip: free memory in error cases when registering clock
    branches
    - LP: #1566544
  * ARC: bitops: Remove non relevant comments
    - LP: #1566544
  * mac80211: fix txq queue related crashes
    - LP: #1566544
  * net: Fix use after free in the recvmmsg exit path
    - LP: #1566544
  * ath9k: fix misleading indentation
    - LP: #1566544
  * sctp: fix the transports round robin issue when init is retransmitted
    - LP: #1566544
  * ethernet: micrel: fix some error codes
    - LP: #1566544
  * megaraid_sas: add missing curly braces in ioctl handler
    - LP: #1566544
  * clk-divider: make sure read-only dividers do not write to their
    register
    - LP: #1566544
  * misc/bmp085: Enable building as a module
    - LP: #1566544
  * HID: logitech: fix Dual Action gamepad support
    - LP: #1566544
  * net/mlx5: Make command timeout way shorter
    - LP: #1566544
  * ASoC: ssm4567: Reset device before regcache_sync()
    - LP: #1566544
  * fbdev: da8xx-fb: fix videomodes of lcd panels
    - LP: #1566544
  * clk: qcom: msm8960: fix ce3_core clk enable register
    - LP: #1566544
  * ipvs: correct initial offset of Call-ID header search in SIP
    persistence engine
    - LP: #1566544
  * drm/i915: Cleanup phys status page too
    - LP: #1566544
  * ata: ahci_xgene: dereferencing uninitialized pointer in probe
    - LP: #1566544
  * ath9k: fix buffer overrun for ar9287
    - LP: #1566544
  * perf tools: handle spaces in file names obtained from /proc/pid/maps
    - LP: #1566544
  * rtc: ds1685: passing bogus values to irq_restore
    - LP: #1566544
  * ARM: davinci: make I2C support optional
    - LP: #1566544
  * drm/amdkfd: uninitialized variable in
    dbgdev_wave_control_set_registers()
    - LP: #1566544
  * mtd: map: fix .set_vpp() documentation
    - LP: #1566544
  * ARM: OMAP3: Add cpuidle parameters table for omap3430
    - LP: #1566544
  * efi: Expose non-blocking set_variable() wrapper to efivars
    - LP: #1566544
  * rtc: vr41xx: Wire up alarm_irq_enable
    - LP: #1566544
  * sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a
    race
    - LP: #1566544
  * ipv4: fix broadcast packets reception
    - LP: #1566544
  * lpfc: fix misleading indentation
    - LP: #1566544
  * sched/preempt, sh: kmap_coherent relies on disabled preemption
    - LP: #1566544
  * ipip: Properly mark ipip GRO packets as encapsulated.
    - LP: #1566544
  * spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
    - LP: #1566544
  * ASoC: s3c24xx: use const snd_soc_component_driver pointer
    - LP: #1566544
  * mlx4: add missing braces in verify_qp_parameters
    - LP: #1566544
  * clk: meson: Fix meson_clk_register_clks() signature type mismatch
    - LP: #1566544
  * coda: fix error path in case of missing pdata on non-DT platform
    - LP: #1566544
  * kbuild/mkspec: fix grub2 installkernel issue
    - LP: #1566544
  * bpf: avoid copying junk bytes in bpf_get_current_comm()
    - LP: #1566544
  * mac80211: fix unnecessary frame drops in mesh fwding
    - LP: #1566544
  * mtd: brcmnand: Fix v7.1 register offsets
    - LP: #1566544
  * mac80211: fix ibss scan parameters
    - LP: #1566544
  * at803x: fix reset handling
    - LP: #1566544
  * rtc: hym8563: fix invalid year calculation
    - LP: #1566544
  * perf pmu: Fix misleadingly indented assignment (whitespace)
    - LP: #1566544
  * paride: make 'verbose' parameter an 'int' again
    - LP: #1566544
  * regulator: s5m8767: fix get_register() error handling
    - LP: #1566544
  * ppp: ensure file->private_data can't be overridden
    - LP: #1566544
  * clk: versatile: sp810: support reentrance
    - LP: #1566544
  * net: add description for len argument of dev_get_phys_port_name
    - LP: #1566544
  * net: bcmgenet: fix dma api length mismatch
    - LP: #1566544
  * ARM: prima2: always enable reset controller
    - LP: #1566544
  * drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
    - LP: #1566544
  * perf stat: Document --detailed option
    - LP: #1566544
  * v4l: vsp1: Set the SRU CTRL0 register when starting the stream
    - LP: #1566544
  * ipvs: drop first packet to redirect conntrack
    - LP: #1566544
  * rtc: max77686: Properly handle regmap_irq_get_virq() error code
    - LP: #1566544
  * x86/iopl/64: Properly context-switch IOPL on Xen PV
    - LP: #1566544
  * Linux 4.2.8-ckt7
    - LP: #1566544
  * PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
    - LP: #1571027
  * ALSA: hda - Asus N750JV external subwoofer fixup
    - LP: #1571027
  * ALSA: hda - Fix white noise on Asus N750JV headphone
    - LP: #1571027
  * ALSA: hda - Apply fix for white noise on Asus N550JV, too
    - LP: #1571027
  * drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
    - LP: #1571027
  * fs: add file_dentry()
    - LP: #1571027
  * nfs: use file_dentry()
    - LP: #1571027
  * hwmon: (max1111) Return -ENODEV from max1111_read_channel if not
    instantiated
    - LP: #1571027
  * drm/radeon: add another R7 370 quirk
    - LP: #1571027
  * drm/radeon: add a dpm quirk for all R7 370 parts
    - LP: #1571027
  * powerpc/mm: Fixup preempt underflow with huge pages
    - LP: #1571027
  * pinctrl: pistachio: fix mfio84-89 function description and pinmux.
    - LP: #1571027
  * pinctrl: sunxi: Fix A33 external interrupts not working
    - LP: #1571027
  * usb: renesas_usbhs: avoid NULL pointer derefernce in
    usbhsf_pkt_handler()
    - LP: #1571027
  * usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
    - LP: #1571027
  * btrfs: fix crash/invalid memory access on fsync when using overlayfs
    - LP: #1571027
  * ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
    - LP: #1571027
  * ALSA: usb-audio: Fix double-free in error paths after
    snd_usb_add_audio_stream() call
    - LP: #1571027
  * USB: mct_u232: add sanity checking in probe
    - LP: #1571027
    - CVE-2016-3136
  * USB: cypress_m8: add endpoint sanity check
    - LP: #1571027
    - CVE-2016-3137
  * USB: digi_acceleport: do sanity checking for the number of ports
    - LP: #1571027
  * [media] au0828: fix au0828_v4l2_close() dev_state race condition
    - LP: #1571027
  * [media] au0828: Fix dev_state handling
    - LP: #1571027
  * sd: Fix excessive capacity printing on devices with blocks bigger than
    512 bytes
    - LP: #1571027
  * drm/dp: move hw_mutex up the call stack
    - LP: #1571027
  * drm/udl: Use unlocked gem unreferencing
    - LP: #1571027
  * ext4: add lockdep annotations for i_data_sem
    - LP: #1571027
  * ALSA: hda - fix front mic problem for a HP desktop
    - LP: #1564712, #1571027
  * KVM: x86: Inject pending interrupt even if pending nmi exist
    - LP: #1571027
  * ALSA: timer: Use mod_timer() for rearming the system timer
    - LP: #1571027
  * mm: fix invalid node in alloc_migrate_target()
    - LP: #1571027
  * iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
    - LP: #1571027
  * ext4: ignore quota mount options if the quota feature is enabled
    - LP: #1571027
  * xen/events: Mask a moving irq
    - LP: #1571027
  * usb: renesas_usbhs: fix to avoid using a disabled ep in
    usbhsg_queue_done()
    - LP: #1571027
  * mac80211: properly deal with station hashtable insert errors
    - LP: #1571027
  * compiler-gcc: disable -ftracer for __noclone functions
    - LP: #1571027
  * rbd: use GFP_NOIO consistently for request allocations
    - LP: #1571027
  * Btrfs: fix file/data loss caused by fsync after rename and new inode
    - LP: #1571027
  * USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
    - LP: #1571027
  * USB: serial: cp210x: Adding GE Healthcare Device ID
    - LP: #1571027
  * USB: option: add "D-Link DWM-221 B1" device id
    - LP: #1571027
  * virtio: virtio 1.0 cs04 spec compliance for reset
    - LP: #1571027
  * libnvdimm: fix smart data retrieval
    - LP: #1571027
  * gpio: pca953x: Use correct u16 value for register word write
    - LP: #1571027
  * parisc: Avoid function pointers for kernel exception routines
    - LP: #1571027
  * parisc: Fix kernel crash with reversed copy_from_user()
    - LP: #1571027
  * parisc: Unbreak handling exceptions from kernel modules
    - LP: #1571027
  * net: macb: replace macb_writel() call by queue_writel() to update queue
    ISR
    - LP: #1571027
  * net: bcmgenet: fix dev->stats.tx_bytes accounting
    - LP: #1571027
  * net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
    - LP: #1571027
  * ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates
    - LP: #1571027
  * pinctrl: nomadik: fix pull debug print inversion
    - LP: #1571027
  * ip6_tunnel: set rtnl_link_ops before calling register_netdevice
    - LP: #1571027
  * KVM: x86: move steal time initialization to vcpu entry time
    - LP: #1571027
  * lib/ucs2_string: Add ucs2 -> utf8 helper functions
    - LP: #1571027
  * efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version
    - LP: #1571027
  * efi: Do variable name validation tests in utf8
    - LP: #1571027
  * efi: Make our variable validation list include the guid
    - LP: #1571027
  * efi: Make efivarfs entries immutable by default
    - LP: #1571027
  * efi: Add pstore variables to the deletion whitelist
    - LP: #1571027
  * lib/ucs2_string: Correct ucs2 -> utf8 conversion
    - LP: #1571027
  * ipr: Fix out-of-bounds null overwrite
    - LP: #1571027
  * ipr: Fix regression when loading firmware
    - LP: #1571027
  * perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere
    - LP: #1571027
  * ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda
    - LP: #1571027
  * mwifiex: fix corner case association failure
    - LP: #1571027
  * net: phy: at803x: Request 'reset' GPIO only for AT8030 PHY
    - LP: #1571027
  * Linux 4.2.8-ckt8
    - LP: #1571027

-- Kamal Mostafa <kamal@canonical.com>  Mon, 18 Apr 2016 06:54:19 -0700

Changed in linux (Ubuntu Wily):
status:	Fix Committed → Fix Released

Dimitrenko (paviliong6) on 2017-07-04

Changed in linux (Ubuntu):
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package

VIA C7-D machine "kernel NULL pointer dereference" in skcipher_recvmsg_async

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux package