Xenial update to v4.4.8 stable release

[Tim Gardner]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The v4.4.8 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches from the v4.4.8 stable release shall be applied:

hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
parisc: Avoid function pointers for kernel exception routines
parisc: Fix kernel crash with reversed copy_from_user()
parisc: Unbreak handling exceptions from kernel modules
ALSA: timer: Use mod_timer() for rearming the system timer
ALSA: hda - Asus N750JV external subwoofer fixup
ALSA: hda - Fix white noise on Asus N750JV headphone
ALSA: hda - Apply fix for white noise on Asus N550JV, too
mm: fix invalid node in alloc_migrate_target()
powerpc/mm: Fixup preempt underflow with huge pages
libnvdimm: fix smart data retrieval
libnvdimm, pfn: fix uuid validation
compiler-gcc: disable -ftracer for __noclone functions
arm64: opcodes.h: Add arm big-endian config options before including arm header
drm/dp: move hw_mutex up the call stack
drm/udl: Use unlocked gem unreferencing
drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
drm/radeon: add another R7 370 quirk
drm/radeon: add a dpm quirk for all R7 370 parts
drm/amdgpu/gmc: move vram type fetching into sw_init
drm/amdgpu/gmc: use proper register for vram type on Fiji
xen/events: Mask a moving irq
tcp: convert cached rtt from usec to jiffies when feeding initial rto
tunnel: Clear IPCB(skb)->opt before dst_link_failure called
net: jme: fix suspend/resume on JMC260
net: vrf: Remove direct access to skb->data
net: qca_spi: Don't clear IFF_BROADCAST
net: qca_spi: clear IFF_TX_SKB_SHARING
net: fix bridge multicast packet checksum validation
sctp: lack the check for ports in sctp_v6_cmp_addr
mld, igmp: Fix reserved tailroom calculation
tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain"
qmi_wwan: add Sierra Wireless EM74xx device ID
ipv6: re-enable fragment header matching in ipv6_find_hdr
vxlan: fix missing options_len update on RX with collect metadata
cdc_ncm: toggle altsetting to force reset before setup
udp6: fix UDP/IPv6 encap resubmit path
tcp: fix tcpi_segs_in after connection establishment
ppp: release rtnl mutex when interface creation fails
net: validate variable length ll headers
ax25: add link layer header validation function
packet: validate variable length ll headers
bpf: avoid copying junk bytes in bpf_get_current_comm()
sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
qlcnic: Remove unnecessary usage of atomic_t
qlcnic: Fix mailbox completion handling during spurious interrupt
macvtap: always pass ethernet header in linear
mlxsw: spectrum: Check requested ageing time is valid
rocker: set FDB cleanup timer according to lowest ageing time
bridge: allow zero ageing time
ipv4: Don't do expensive useless work during inetdev destroy.
net: Fix use after free in the recvmmsg exit path
mlx4: add missing braces in verify_qp_parameters
farsync: fix off-by-one bug in fst_add_one
ath9k: fix buffer overrun for ar9287
ppp: ensure file->private_data can't be overridden
tcp/dccp: remove obsolete WARN_ON() in icmp handlers
qlge: Fix receive packets drop.
net: bcmgenet: fix dma api length mismatch
bonding: fix bond_get_stats()
ipv4: fix broadcast packets reception
ipv4: initialize flowi4_flags before calling fib_lookup()
ppp: take reference on channels netns
xfrm: Fix crash observed during device unregistration and decryption
qmi_wwan: add "D-Link DWM-221 B1" device id
ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates
bridge: Allow set bridge ageing time when switchdev disabled
rtnl: fix msg size calculation in if_nlmsg_size()
tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter
tuntap: restore default qdisc
ipv4: l2tp: fix a potential issue in l2tp_ip_recv
ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
ip6_tunnel: set rtnl_link_ops before calling register_netdevice
ipv6: Count in extension headers in skb->network_header
mpls: find_outdev: check for err ptr in addition to NULL check
USB: uas: Limit qdepth at the scsi-host level
USB: uas: Add a new NO_REPORT_LUNS quirk
cdc-acm: fix NULL pointer reference
KVM: x86: Inject pending interrupt even if pending nmi exist
KVM: x86: reduce default value of halt_poll_ns parameter
MIPS: Fix MSA ld unaligned failure cases
pinctrl: pistachio: fix mfio84-89 function description and pinmux.
pinctrl: sh-pfc: only use dummy states for non-DT platforms
pinctrl: sunxi: Fix A33 external interrupts not working
pinctrl: nomadik: fix pull debug print inversion
pinctrl: freescale: imx: fix bogus check of of_iomap() return value
au0828: fix au0828_v4l2_close() dev_state race condition
au0828: Fix dev_state handling
coda: fix error path in case of missing pdata on non-DT platform
v4l: vsp1: Set the SRU CTRL0 register when starting the stream
pcmcia: db1xxx_ss: fix last irq_to_gpio user
rbd: use GFP_NOIO consistently for request allocations
virtio: virtio 1.0 cs04 spec compliance for reset
mac80211: properly deal with station hashtable insert errors
mac80211: avoid excessive stack usage in sta_info
mac80211: fix ibss scan parameters
mac80211: fix unnecessary frame drops in mesh fwding
mac80211: fix txq queue related crashes
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
iio: accel: bmc150: fix endianness when reading axes
iio: gyro: bmg160: fix buffer read values
iio: gyro: bmg160: fix endianness when reading axes
sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
fs: add file_dentry()
nfs: use file_dentry()
btrfs: fix crash/invalid memory access on fsync when using overlayfs
ext4: add lockdep annotations for i_data_sem
ext4: ignore quota mount options if the quota feature is enabled
iommu: Don't overwrite domain pointer when there is no default_domain
Btrfs: fix file/data loss caused by fsync after rename and new inode
arm64: replace read_lock to rcu lock in call_step_hook
perf: Do not double free
perf: Cure event->pending_disable race
mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers
ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225
ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2
ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
ALSA: usb-audio: Add a quirk for Plantronics BT300
ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
HID: wacom: fix Bamboo ONE oops
HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled"
Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed"
Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()"
staging: android: ion: Set the length of the DMA sg entries in buffer
usbvision: fix crash on detecting device with invalid configuration
Revert "usb: hub: do not clear BOS field during reset device"
Linux 4.4.8

[Kamal Mostafa (kamalmostafa)]

This bug was fixed in the package linux - 4.4.0-22.38

---------------
linux (4.4.0-22.38) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1573817

  * autoreconstruct: need to also generate extend-diff-ignore options for links
    (LP: #1574362)
    - [Packaging] autoreconstruct -- generate extend-diff-ignore for links

  * tipc: missing linearization of sk_buff (LP: #1567064)
    - tipc: move linearization of buffers to generic code

  * [Hyper-V] In-flight PCI Passthrough Patches (LP: #1570124)
    - SAUCE:(noup) drivers:hv: Lock access to hyperv_mmio resource tree
    - SAUCE:(noup) drivers:hv: Call vmbus_mmio_free() to reverse
      vmbus_mmio_allocate()
    - SAUCE:(noup) drivers:hv: Reverse order of resources in hyperv_mmio
    - SAUCE:(noup) drivers:hv: Track allocations of children of hv_vmbus in
      private resource tree
    - SAUCE:(noup) drivers:hv: Record MMIO range in use by frame buffer
    - SAUCE:(noup) drivers:hv: Separate out frame buffer logic when picking MMIO
      range

  * vbox: resync with 5.0.18-dfsg-2build1 (LP: #1571156)
    - ubuntu: vbox -- update to 5.0.18-dfsg-2build1

  * CONFIG_AUFS_XATTR is not set (LP: #1557776)
    - [Config] CONFIG_AUFS_XATTR=y

  * CVE-2016-3672 (LP: #1568523)
    - x86/mm/32: Enable full randomization on i386 and X86_32

  * CVE-2016-3955 (LP: #1572666)
    - USB: usbip: fix potential out-of-bounds write

  * Xenial update to v4.4.8 stable release (LP: #1573034)
    - hwmon: (max1111) Return -ENODEV from max1111_read_channel if not
      instantiated
    - PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
    - parisc: Avoid function pointers for kernel exception routines
    - parisc: Fix kernel crash with reversed copy_from_user()
    - parisc: Unbreak handling exceptions from kernel modules
    - ALSA: timer: Use mod_timer() for rearming the system timer
    - ALSA: hda - Asus N750JV external subwoofer fixup
    - ALSA: hda - Fix white noise on Asus N750JV headphone
    - ALSA: hda - Apply fix for white noise on Asus N550JV, too
    - mm: fix invalid node in alloc_migrate_target()
    - powerpc/mm: Fixup preempt underflow with huge pages
    - libnvdimm: fix smart data retrieval
    - libnvdimm, pfn: fix uuid validation
    - compiler-gcc: disable -ftracer for __noclone functions
    - arm64: opcodes.h: Add arm big-endian config options before including arm
      header
    - drm/dp: move hw_mutex up the call stack
    - drm/udl: Use unlocked gem unreferencing
    - drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
    - drm/radeon: add another R7 370 quirk
    - drm/radeon: add a dpm quirk for all R7 370 parts
    - drm/amdgpu/gmc: move vram type fetching into sw_init
    - drm/amdgpu/gmc: use proper register for vram type on Fiji
    - xen/events: Mask a moving irq
    - tcp: convert cached rtt from usec to jiffies when feeding initial rto
    - tunnel: Clear IPCB(skb)->opt before dst_link_failure called
    - net: jme: fix suspend/resume on JMC260
    - net: vrf: Remove direct access to skb->data
    - net: qca_spi: Don't clear IFF_BROADCAST
    - net: qca_spi: clear IFF_TX_SKB_SHARING
    - net: fix bridge multicas...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-22.39

---------------
linux (4.4.0-22.39) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1578721

  * LP: #1578705
    - bpf: fix double-fdput in replace_map_fd_with_map_ptr()

 -- Kamal Mostafa <email address hidden> Thu, 05 May 2016 09:30:58 -0700