Xenial update to 4.4.76 stable release

[Stefan Bader]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The 4.4.76 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

The following patches from the 4.4.76 stable release shall be applied:
* ipv6: release dst on error in ip6_dst_lookup_tail
* net: don't call strlen on non-terminated string in dev_set_alias()
* decnet: dn_rtmsg: Improve input length sanitization in
  dnrmg_receive_user_skb
* net: Zero ifla_vf_info in rtnl_fill_vfinfo()
* af_unix: Add sockaddr length checks before accessing sa_family in bind and
  connect handlers
* Fix an intermittent pr_emerg warning about lo becoming free.
* net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
* igmp: acquire pmc lock for ip_mc_clear_src()
* igmp: add a missing spin_lock_init()
* ipv6: fix calling in6_ifa_hold incorrectly for dad work
* net/mlx5: Wait for FW readiness before initializing command interface
* decnet: always not take dst->__refcnt when inserting dst into hash table
* net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
* sfc: provide dummy definitions of vswitch functions
* ipv6: Do not leak throw route references
* rtnetlink: add IFLA_GROUP to ifla_policy
* netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
* netfilter: synproxy: fix conntrackd interaction
* NFSv4: fix a reference leak caused WARNING messages
* drm/ast: Handle configuration without P2A bridge
* mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
* MIPS: Avoid accidental raw backtrace
* MIPS: pm-cps: Drop manual cache-line alignment of ready_count
* MIPS: Fix IRQ tracing & lockdep when rescheduling
* ALSA: hda - Fix endless loop of codec configure
* ALSA: hda - set input_path bitmap to zero after moving it to new place
* drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
* usb: gadget: f_fs: Fix possibe deadlock
* sysctl: enable strict writes
* mm: numa: avoid waiting on freed migrated pages
* KVM: x86: fix fixing of hypercalls
* scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
* scsi: lpfc: Set elsiocb contexts to NULL after freeing it
* qla2xxx: Fix erroneous invalid handle message
* ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
* net: mvneta: Fix for_each_present_cpu usage
* MIPS: ath79: fix regression in PCI window initialization
* net: korina: Fix NAPI versus resources freeing
* MIPS: ralink: MT7688 pinmux fixes
* MIPS: ralink: fix USB frequency scaling
* MIPS: ralink: Fix invalid assignment of SoC type
* MIPS: ralink: fix MT7628 pinmux typos
* MIPS: ralink: fix MT7628 wled_an pinmux gpio
* mtd: bcm47xxpart: limit scanned flash area on BCM47XX (MIPS) only
* bgmac: fix a missing check for build_skb
* mtd: bcm47xxpart: don't fail because of bit-flips
* bgmac: Fix reversed test of build_skb() return value.
* net: bgmac: Fix SOF bit checking
* net: bgmac: Start transmit queue in bgmac_open
* net: bgmac: Remove superflous netif_carrier_on()
* powerpc/eeh: Enable IO path on permanent error
* gianfar: Do not reuse pages from emergency reserve
* Btrfs: fix truncate down when no_holes feature is enabled
* virtio_console: fix a crash in config_work_handler
* swiotlb-xen: update dev_addr after swapping pages
* xen-netfront: Fix Rx stall during network stress and OOM
* scsi: virtio_scsi: Reject commands when virtqueue is broken
* platform/x86: ideapad-laptop: handle ACPI event 1
* amd-xgbe: Check xgbe_init() return code
* net: dsa: Check return value of phy_connect_direct()
* drm/amdgpu: check ring being ready before using
* vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
* virtio_net: fix PAGE_SIZE > 64k
* vxlan: do not age static remote mac entries
* ibmveth: Add a proper check for the availability of the checksum features
* kernel/panic.c: add missing \n
* HID: i2c-hid: Add sleep between POWER ON and RESET
* scsi: lpfc: avoid double free of resource identifiers
* spi: davinci: use dma_mapping_error()
* mac80211: initialize SMPS field in HT capabilities
* x86/mpx: Use compatible types in comparison to fix sparse error
* coredump: Ensure proper size of sparse core files
* swiotlb: ensure that page-sized mappings are page-aligned
* s390/ctl_reg: make __ctl_load a full memory barrier
* be2net: fix status check in be_cmd_pmac_add()
* perf probe: Fix to show correct locations for events on modules
* net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
* sctp: check af before verify address in sctp_addr_id2transport
* ravb: Fix use-after-free on `ifconfig eth0 down`
* jump label: fix passing kbuild_cflags when checking for asm goto support
* xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
* xfrm: NULL dereference on allocation failure
* xfrm: Oops on error in pfkey_msg2xfrm_state()
* watchdog: bcm281xx: Fix use of uninitialized spinlock.
* sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
* ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
* ARM: 8685/1: ensure memblock-limit is pmd-aligned
* x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
* x86/mm: Fix flush_tlb_page() on Xen
* ocfs2: o2hb: revert hb threshold to keep compatible
* iommu/vt-d: Don't over-free page table directories
* iommu: Handle default domain attach failure
* iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
* cpufreq: s3c2416: double free on driver init error path
* KVM: x86: fix emulation of RSM and IRET instructions
* KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
* KVM: x86: zero base3 of unusable segments
* KVM: nVMX: Fix exception injection
* Linux 4.4.76

[Stefan Bader (smb)]

The following patch was skipped because it was already applied for bug #1683976 "Please backport fix to reference leak in cgroup blkio throttle":
* block: fix module reference leak on put_disk() call for cgroups throttle

To apply patch "platform/x86: ideapad-laptop: handle ACPI event 1", fuzz 1 had to be ignored.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-89.112

---------------
linux (4.4.0-89.112) xenial; urgency=low

  * CVE-2017-7533
    - dentry name snapshots

linux (4.4.0-88.111) xenial; urgency=low

  * linux: 4.4.0-88.111 -proposed tracker (LP: #1705270)

  * [Xenial] nvme: Quirks for PM1725 controllers (LP: #1704435)
    - nvme: Quirks for PM1725 controllers

  * Upgrade Redpine WLAN/BT driver to ver. 1.2 (production release)
    (LP: #1697829)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * ubuntu/rsi driver has several issues as picked up by static analysis
    (LP: #1694733)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * Redpine vendor driver - Switching to AP mode causes kernel panic
    (LP: #1700941)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * CVE-2017-10810
    - drm/virtio: don't leak bo on drm_gem_object_init failure

  * Ath10k to read different board data file if specify in SMBIOS (LP: #1666742)
    - ath10k: search SMBIOS for OEM board file extension

  * make snap-pkg support (LP: #1700747)
    - SAUCE: make snap-pkg support

  * ISST-LTE: Briggs:Stratton:UbuntuKVM: ics_opal_set_affinity on host kernel
    log using Intel X710 (i40e driver) (LP: #1703663)
    - i40e: use valid online CPU on q_vector initialization

  * Update snapcraft.yaml (LP: #1700480)
    - snapcraft.yaml: various improvements

  * Xenial update to 4.4.76 stable release (LP: #1702863)
    - ipv6: release dst on error in ip6_dst_lookup_tail
    - net: don't call strlen on non-terminated string in dev_set_alias()
    - decnet: dn_rtmsg: Improve input length sanitization in
      dnrmg_receive_user_skb
    - net: Zero ifla_vf_info in rtnl_fill_vfinfo()
    - af_unix: Add sockaddr length checks before accessing sa_family in bind and
      connect handlers
    - Fix an intermittent pr_emerg warning about lo becoming free.
    - net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
    - igmp: acquire pmc lock for ip_mc_clear_src()
    - igmp: add a missing spin_lock_init()
    - ipv6: fix calling in6_ifa_hold incorrectly for dad work
    - net/mlx5: Wait for FW readiness before initializing command interface
    - decnet: always not take dst->__refcnt when inserting dst into hash table
    - net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
    - sfc: provide dummy definitions of vswitch functions
    - ipv6: Do not leak throw route references
    - rtnetlink: add IFLA_GROUP to ifla_policy
    - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
    - netfilter: synproxy: fix conntrackd interaction
    - NFSv4: fix a reference leak caused WARNING messages
    - drm/ast: Handle configuration without P2A bridge
    - mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
    - MIPS: Avoid accidental raw backtrace
    - MIPS: pm-cps: Drop manual cache-line alignment of ready_count
    - MIPS: Fix IRQ tracing & lockdep when rescheduling
    - ALSA: hda - Fix endless loop of codec configure
    - ALSA: hda - set input_path bitmap to zero after moving it to new place
    - drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
    - usb: gadget: f_fs: Fix possi...