Saucy update to 3.11.10.9 stable release

[Luis Henriques]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 3.11.10.9 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches are in the 3.11.10.9 stable release:
drm/i915: quirk invert brightness for Acer Aspire 5336
w1: fix w1_send_slave dropping a slave id
ARM: 7954/1: mm: remove remaining domain support from ARMv6
matroxfb: restore the registers M_ACCESS and M_PITCH
framebuffer: fix cfb_copyarea
mach64: use unaligned access
mach64: fix cursor when character width is not a multiple of 8 pixels
tgafb: potential NULL dereference in init
tgafb: fix mode setting with fbset
tgafb: fix data copying
hvc: ensure hvc_init is only ever called once in hvc_console.c
ARM: dts: Keep G3D regulator always on for exynos5250-arndale
ext4: fix error return from ext4_ext_handle_uninitialized_extents()
usb: dwc3: fix wrong bit mask in dwc3_event_devt
x86, cpufeature: Define the Intel MPX feature flag
x86, AVX-512: AVX-512 Feature Detection
s390/cio: fix driver callback initialization for ccw consoles
ARM: Fix default CPU selection for ARCH_MULTI_V5
[media] omap3isp: preview: Fix the crop margins
fs: NULL dereference in posix_acl_to_xattr()
ACPICA: Restore code that repairs NULL package elements in return values.
[media] media: gspca: sn9c20x: add ID for Genius Look 1320 V2
[media] m88rs2000: add caps FE_CAN_INVERSION_AUTO
[media] m88rs2000: prevent frontend crash on continuous transponder scans
tty: Set correct tty name in 'active' sysfs attribute
usb: musb: avoid NULL pointer dereference
Bluetooth: Fix removing Long Term Key
[media] uvcvideo: Do not use usb_set_interface on bulk EP
usb: dwc3: fix randconfig build errors
usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled
rtlwifi: rtl8192cu: Fix too long disable of IRQs
rtlwifi: rtl8192se: Fix too long disable of IRQs
rtlwifi: rtl8188ee: Fix too long disable of IRQs
rtlwifi: rtl8723ae: Fix too long disable of IRQs
xhci: Prevent runtime pm from autosuspending during initialization
staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer
Btrfs: skip submitting barrier for missing device
jffs2: remove from wait queue after schedule()
jffs2: avoid soft-lockup in jffs2_reserve_space_gc()
jffs2: Fix segmentation fault found in stress test
jffs2: Fix crash due to truncation of csize
mtd: atmel_nand: Disable subpage NAND write when using Atmel PMECC
iwlwifi: dvm: take mutex when sending SYNC BT config command
[media] v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support
virtio_balloon: don't softlockup on huge balloon changes.
arm64: Make DMA coherent and strongly ordered mappings not executable
arm64: Do not synchronise I and D caches for special ptes
ARM: OMAP2+: INTC: Acknowledge stuck active interrupts
mtip32xx: Set queue bounce limit
mtip32xx: Unmap the DMA segments before completing the IO request
ext4: fix partial cluster handling for bigalloc file systems
staging: comedi: 8255_pci: initialize MITE data window
mei: fix memory leak of pending write cb objects
usb: gadget: tcm_usb_gadget: stop format strings
usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210
USB: unbind all interfaces before rebinding any
IB/ipath: Fix potential buffer overrun in sending diag packet routine
IB/qib: Fix debugfs ordering issue with multiple HCAs
IB/qib: add missing braces in do_qib_user_sdma_queue_create()
IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL
mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error
regulator: arizona-ldo1: Correct default regulator init_data
ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE
ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE
ACPI / button: Add ACPI Button event via netlink routine
mfd: Include all drivers in subsystem menu
mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: 88pm860x: Fix I2C device resource leak on regmap init fail
mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error
mfd: 88pm800: Fix I2C device resource leak if probe fails
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
MIPS: KVM: Pass reserved instruction exceptions to guest
ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols
mac80211: fix potential use-after-free
mac80211: fix suspend vs. authentication race
mac80211: fix WPA with VLAN on AP side with ps-sta again
pid: get pid_t ppid of task in init_pid_ns
audit: convert PPIDs to the inital PID namespace.
mfd: kempld-core: Fix potential hang-up during boot
Btrfs: fix deadlock with nested trans handles
powerpc/compat: 32-bit little endian machine name is ppcle, not ppc
KVM: PPC: Book3S HV: Fix KVM hang with CONFIG_KVM_XICS=n
gpio: mxs: Allow for recursive enable_irq_wake() call
x86, hyperv: Bypass the timer_irq_works() check
nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
nfsd4: session needs room for following op to error out
nfsd4: leave reply buffer space for failed setattr
nfsd4: fix test_stateid error reply encoding
nfsd: notify_change needs elevated write count
dm cache: prevent corruption caused by discard_block_size > cache_block_size
dm transaction manager: fix corruption due to non-atomic transaction commit
dm: take care to copy the space map roots before locking the superblock
NFSD: Traverse unconfirmed client through hash-table
lockd: ensure we tear down any live sockets when socket creation fails during lockd_up
drm/i915/tv: fix gen4 composite s-video tv-out
dm thin: fix dangling bio in process_deferred_bios error path
[media] saa7134: fix WARN_ON during resume
[media] em28xx: fix PCTV 290e LNA oops
NFSv4: Fix a use-after-free problem in open()
nfsd4: fix setclientid encode size
MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume()
ALSA: hda - Enable beep for ASUS 1015E
x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets
nfsd: check passed socket's net matches NFSd superblock's one
IB/mthca: Return an error on ib_copy_to_udata() failure
IB/ehca: Returns an error on ib_copy_to_udata() failure
ext4: fix premature freeing of partial clusters split across leaf blocks
drm/qxl: unset a pointer in sync_obj_unref
don't bother with {get,put}_write_access() on non-regular files
reiserfs: fix race in readdir
pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
drm/vmwgfx: correct fb_fix_screeninfo.line_length
ALSA: hda - Fix silent speaker output due to mute LED fixup
drm/radeon: call drm_edid_to_eld when we update the edid
drm/radeon: fix typo in spectre_golden_registers
xfs: fix directory hash ordering bug
sh: fix format string bug in stack tracer
backing_dev: fix hung task on sync
bdi: avoid oops on device removal
ocfs2: dlm: fix lock migration crash
ocfs2: dlm: fix recovery hung
ocfs2: do not put bh when buffer_uptodate failed
Skip intel_crt_init for Dell XPS 8700
dm cache: fix a lock-inversion
ARC: [nsimosci] Change .dts to use generic 8250 UART
ARC: [nsimosci] Unbork console
iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
mm: try_to_unmap_cluster() should lock_page() before mlocking
mm: hugetlb: fix softlockup when a large number of hugepages are freed.
exit: call disassociate_ctty() before exit_task_namespaces()
wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race
hung_task: check the value of "sysctl_hung_task_timeout_sec"
ALSA: ice1712: Fix boundary checks in PCM pointer ops
lib/percpu_counter.c: fix bad percpu counter state during suspend
md/raid1: r1buf_pool_alloc: free allocate pages when subsequent allocation fails.
ALSA: hda - add headset mic detect quirk for a Dell laptop
b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR
x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
target/tcm_fc: Fix use-after-free of ft_tpg
ib_srpt: Use correct ib_sg_dma primitives
brcmsmac: fix deadlock on missing firmware
Char: ipmi_bt_sm, fix infinite loop
mac80211: fix software remain-on-channel implementation
mac80211: exclude AP_VLAN interfaces from tx power calculation
parisc: fix epoll_pwait syscall on compat kernel
Revert "net: mvneta: fix usage as a module on RGMII configurations"
ALSA: hda/realtek - Add support of ALC288 codec
user namespace: fix incorrect memory barriers
tick-common: Fix wrong check in tick_check_replacement()
ALSA: hda/realtek - Add headset Mic support for Dell machine
mlx4_en: don't use napi_synchronize inside mlx4_en_netpoll
mei: me: do not load the driver if the FW doesn't support MEI interface
mei: ignore client writing state during cb completion
staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
USB: serial: ftdi_sio: add id for Brainboxes serial cards
Revert "USB: serial: add usbid for dell wwan card to sierra.c"
usb: option driver, add support for Telit UE910v2
USB: cp210x: Add 8281 (Nanotec Plug & Drive)
USB: pl2303: add ids for Hewlett-Packard HP POS pole displays
USB: usb_wwan: fix handling of missing bulk endpoints
USB: fix crash during hotplug of PCI USB controller card
USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver
Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts
drm/radeon: add support for newer mc ucode on SI (v2)
drm/radeon: memory leak on bo reservation failure. v2
drm/radeon/si: make sure mc ucode is loaded before checking the size
mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()
mm: use paravirt friendly ops for NUMA hinting ptes
coredump: fix va_list corruption
gpu: host1x: handle the correct # of syncpt regs
topology: Fix compilation warning when not in SMP
drm/tegra: Remove gratuitous pad field
ipmi: Fix a race restarting the timer
ipmi: Reset the KCS timeout when starting error recovery
ath9k: fix ready time of the multicast buffer queue
Linux 3.11.10.9

The following patch was dropped as it breaks lttng:
blktrace: fix accounting of partially completed requests

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.11.0-23.40

---------------
linux (3.11.0-23.40) saucy; urgency=low

  [ Upstream Kernel Changes ]

  * futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr ==
    uaddr2 in futex_requeue(..., requeue_pi=1)
    - LP: #1326367
    - CVE-2014-3153
  * futex: Validate atomic acquisition in futex_lock_pi_atomic()
    - LP: #1326367
    - CVE-2014-3153
  * futex: Always cleanup owner tid in unlock_pi
    - LP: #1326367
    - CVE-2014-3153
  * futex: Make lookup_pi_state more robust
    - LP: #1326367
    - CVE-2014-3153
 -- Brad Figg <email address hidden> Wed, 04 Jun 2014 09:12:14 -0700