Precise update to 3.2.61 stable release

Bug #1348572 reported by Luis Henriques on 2014-07-25
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Undecided
Unassigned
Precise
Undecided
Unassigned

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 3.2.61 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches are in the 3.2.61 stable release:

mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
bluetooth: hci_ldisc: fix deadlock condition
genirq: Sanitize spurious interrupt detection of threaded irqs
UBIFS: fix an mmap and fsync race condition
Input: synaptics - add min/max quirk for the ThinkPad W540
ACPI: Fix conflict between customized DSDT and DSDT local copy
HID: core: fix validation of report id 0
IB/srp: Fix a sporadic crash triggered by cable pulling
reiserfs: drop vmtruncate
reiserfs: call truncate_setsize under tailpack mutex
ARM: imx: fix error handling in ipu device registration
matroxfb: perform a dummy read of M_STATUS
USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
ARM: 8051/1: put_user: fix possible data corruption in put_user
Input: synaptics - T540p - unify with other LEN0034 models
mac80211: fix IBSS join by initializing last_scan_completed
drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
drm/i915: Only copy back the modified fields to userspace from execbuffer
ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
ext4: fix zeroing of page during writeback
ext4: fix wrong assert in ext4_mb_normalize_request()
IB/qib: Fix port in pkey change event
IB/ipath: Translate legacy diagpkt into newer extended diagpkt
USB: sierra: fix AA deadlock in open error path
USB: sierra: fix urb and memory leak in resume error path
USB: sierra: fix urb and memory leak on disconnect
USB: sierra: fix remote wakeup
USB: option: fix runtime PM handling
USB: usb_wwan: fix urb leak in write error path
USB: usb_wwan: fix race between write and resume
USB: usb_wwan: fix write and suspend race
USB: usb_wwan: fix urb leak at shutdown
USB: usb_wwan: fix potential blocked I/O after resume
USB: cdc-acm: fix write and suspend race
USB: cdc-acm: fix write and resume race
USB: cdc-acm: fix broken runtime suspend
USB: cdc-acm: fix runtime PM for control messages
USB: cdc-acm: fix potential urb leak and PM imbalance in write
USB: io_ti: fix firmware download on big-endian machines (part 2)
USB: ftdi_sio: add NovaTech OrionLXm product ID
USB: serial: option: add support for Novatel E371 PCIe card
usb: usbtest: fix unlink write error with pattern 1
powerpc: Fix 64 bit builds with binutils 2.24
md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
s390/lowcore: reserve 96 bytes for IRB in lowcore
mac80211: don't check netdev state for debugfs read/write
rtmutex: Fix deadlock detector for real
xhci: delete endpoints from bandwidth list before freeing whole device
IB/umad: Fix error handling
RDMA/cxgb4: Fix four byte info leak in c4iw_create_cq()
RDMA/cxgb4: Add missing padding at end of struct c4iw_create_cq_resp
nfsd: getattr for FATTR4_WORD0_FILES_AVAIL needs the statfs buffer
UBIFS: Remove incorrect assertion in shrink_tnc()
drm/radeon: fix typo in radeon_connector_is_dp12_capable()
drm/radeon/atom: fix dithering on certain panels
drm/radeon: only apply hdmi bpc pll flags when encoder mode is hdmi
ahci: Add Device ID for HighPoint RocketRaid 642L
nfsd4: use recall_lock for delegation hashing
mm: fix sleeping function warning from __put_anon_vma
powerpc/serial: Use saner flags when creating legacy ports
ALSA: hda/realtek - Add support of ALC891 codec
iscsi-target: Reject mutual authentication with reflected CHAP_C
mm: vmscan: clear kswapd's special reclaim powers before exiting
rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
ptrace: fix fork event messages across pid namespaces
idr: fix overflow bug during maximum ID calculation at maximum height
Input: elantech - deal with clickpads reporting right button events
Input: elantech - don't set bit 1 of reg_10 when the no_hw_res quirk is set
Input: synaptics - fix resolution for manually provided min/max
nfsd4: fix FREE_STATEID lockowner leak
Btrfs: fix double free in find_lock_delalloc_range
drm/radeon: stop poisoning the GART TLB
auditsc: audit_krule mask accesses need bounds checking
watchdog: ath79_wdt: avoid spurious restarts on AR934x
powerpc: Don't setup CPUs with bad status
evm: prohibit userspace writing 'security.evm' HMAC value
ALSA: hda - Add quirk for external mic on Lifebook U904
mm: rmap: fix use-after-free in __put_anon_vma
rtmutex: Handle deadlock detection smarter
rtmutex: Detect changes in the pi lock chain
rtmutex: Plug slow unlock race
USB: EHCI: avoid BIOS handover on the HASEE E200
ALSA: control: Protect user controls against concurrent access
ALSA: control: Fix replacing user controls
ALSA: control: Don't access controls outside of protected regions
ALSA: control: Handle numid overflow
ALSA: control: Make sure that id->index does not overflow
Bluetooth: Fix check for connection encryption
Bluetooth: Fix SSP acceptor just-works confirmation without MITM
rt2x00: disable TKIP on USB
b43: fix frequency reported on G-PHY with /new/ firmware
tracing: Fix syscall_*regfunc() vs copy_process() race
x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned entry
mm: revert 0def08e3 ("mm/mempolicy.c: check return code of check_range")
mm: fix crashes from mbind() merging vmas
drm: fix NULL pointer access by wrong ioctl
recordmcount/MIPS: Fix possible incorrect mcount_loc table entries in modules
MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region
target: Fix left-over se_lun->lun_sep pointer OOPs
Stop accepting SCSI requests before removing a device
fix our current target reap infrastructure
dual scan thread bug fix
perf: Fix race in removing an event
MIPS: Cleanup flags in syscall flags handlers.
MIPS: asm: thread_info: Add _TIF_SECCOMP flag
netlink: rate-limit leftover bytes warning and print process name
net: tunnels - enable module autoloading
net: fix inet_getid() and ipv6_select_ident() bugs
sctp: Fix sk_ack_backlog wrap-around problem
mlx4_core: Stash PCI ID driver_data in mlx4_priv structure
net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()
target: Explicitly clear ramdisk_mcp backend pages
Fix spurious request sense in error handling
megaraid: Use resource_size_t for PCI resources, not long
iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap()
ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr
Documentation: Update stable address in Chinese and Japanese translations
Linux 3.2.61

The following patches 3.2.61 stable release were already applied to the Precise kernel:

lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c
lib/lzo: Update LZO compression to current upstream version
lzo: properly check for overruns
ptrace,x86: force IRET path after a ptrace_stop()
skbuff: export skb_copy_ubufs
skbuff: add an api to orphan frags
skbuff: skb_segment: orphan frags before copying

CVE References

Luis Henriques (henrix) on 2014-07-25
tags: added: kernel-stable-tracking-bug
Luis Henriques (henrix) on 2014-07-25
description: updated
Luis Henriques (henrix) on 2014-07-25
description: updated
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in linux (Ubuntu Precise):
status: New → Confirmed
Changed in linux (Ubuntu):
status: New → Confirmed
Launchpad Janitor (janitor) wrote :
Download full text (16.6 KiB)

This bug was fixed in the package linux - 3.2.0-68.102

---------------
linux (3.2.0-68.102) precise; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1355387

  [ Joseph Salisbury ]

  * [Config] updateconfigs after Linux 3.2.62 update

  [ Upstream Kernel Changes ]

  * Revert "net: ipv4: ip_forward: fix inverted local_df test"
    - LP: #1337281
  * Revert "net: ip, ipv6: handle gso skbs in forwarding path"
    - LP: #1337281
  * Yama: handle 32-bit userspace prctl
    - LP: #1338883
  * mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    - LP: #1348572
  * bluetooth: hci_ldisc: fix deadlock condition
    - LP: #1348572
  * genirq: Sanitize spurious interrupt detection of threaded irqs
    - LP: #1348572
  * UBIFS: fix an mmap and fsync race condition
    - LP: #1348572
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1348572
  * ACPI: Fix conflict between customized DSDT and DSDT local copy
    - LP: #1348572
  * HID: core: fix validation of report id 0
    - LP: #1348572
  * IB/srp: Fix a sporadic crash triggered by cable pulling
    - LP: #1348572
  * reiserfs: drop vmtruncate
    - LP: #1348572
  * reiserfs: call truncate_setsize under tailpack mutex
    - LP: #1348572
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1348572
  * matroxfb: perform a dummy read of M_STATUS
    - LP: #1348572
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1348572
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1348572
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1348572
  * mac80211: fix IBSS join by initializing last_scan_completed
    - LP: #1348572
  * drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
    - LP: #1348572
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1348572
  * ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
    - LP: #1348572
  * ext4: fix zeroing of page during writeback
    - LP: #1348572
  * ext4: fix wrong assert in ext4_mb_normalize_request()
    - LP: #1348572
  * IB/qib: Fix port in pkey change event
    - LP: #1348572
  * IB/ipath: Translate legacy diagpkt into newer extended diagpkt
    - LP: #1348572
  * USB: sierra: fix AA deadlock in open error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak in resume error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak on disconnect
    - LP: #1348572
  * USB: sierra: fix remote wakeup
    - LP: #1348572
  * USB: option: fix runtime PM handling
    - LP: #1348572
  * USB: usb_wwan: fix urb leak in write error path
    - LP: #1348572
  * USB: usb_wwan: fix race between write and resume
    - LP: #1348572
  * USB: usb_wwan: fix write and suspend race
    - LP: #1348572
  * USB: usb_wwan: fix urb leak at shutdown
    - LP: #1348572
  * USB: usb_wwan: fix potential blocked I/O after resume
    - LP: #1348572
  * USB: cdc-acm: fix write and suspend race
    - LP: #1348572
  * USB: cdc-acm: fix write and resume race
    - LP: #1348572
  * USB: cdc-acm: fix broken runtime suspend
    - LP: #1348572
  * USB: ...

Changed in linux (Ubuntu Precise):
status: Confirmed → Fix Released
Changed in linux (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers