Trusty update to 3.19.8-ckt10 stable release

Bug #1520309 reported by Luis Henriques on 2015-11-26
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Undecided
Unassigned
Trusty
Undecided
Unassigned
Vivid
Undecided
Unassigned

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 3.19.8-ckt10 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://kernel.ubuntu.com/ubuntu/linux.git

    TEST CASE: TBD

       The following patches are in the 3.19.8-ckt10 stable release:

isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
ppp, slip: Validate VJ compression slot parameters completely
[media] media/vivid-osd: fix info leak in ioctl
staging/dgnc: fix info leak in ioctl
tools lib traceevent: Fix string handling in heterogeneous arch environments
perf tools: Fix copying of /proc/kcore
m68k: Define asmlinkage_protect
UBI: Validate data_size
UBI: return ENOSPC if no enough space available
drm/radeon: Restore LCD backlight level on resume (>= R5xx)
drm/radeon: move bl encoder assignment into bl init
drm/radeon: fix dpms when driver backlight control is disabled
MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
MIPS: CPS: Stop dangling delay slot from has_mt.
MIPS: CPS: Don't include MT code in non-MT kernels.
MIPS: CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT
x86/asm/entry: Create and use a 'TOP_OF_KERNEL_STACK_PADDING' macro
x86/process: Add proper bound checks in 64bit get_wchan()
drm/qxl: recreate the primary surface when the bo is not primary
genirq: Fix race in register_irq_proc()
x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
KVM: nSVM: Check for NRIPS support before updating control field
Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
drm/dp/mst: fixup handling hotplug on port removal.
drm/dp/mst: drop cancel work sync in the mstb destroy path (v2)
x86/kexec: Fix kexec crash in syscall kexec_file_load()
x86/mm: Set NX on gap between __ex_table and rodata
md/raid0: update queue parameter in a safer location.
md/raid0: apply base queue limits *before* disk_stack_limits
arm64: ftrace: fix function_graph tracer panic
clocksource: Fix abs() usage w/ 64bit values
dmaengine: dw: properly read DWC_PARAMS register
mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
regmap: debugfs: Ensure we don't underflow when printing access masks
regmap: debugfs: Don't bother actually printing when calculating max length
mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions
mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()
ARM: dts: fix usb pin control for imx-rex dts
ASoC: db1200: Fix DAI link format for db1300 and db1550
x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map
s390/boot/decompression: disable floating point in decompressor
svcrdma: handle rdma read with a non-zero initial page offset
ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe
dm: fix AB-BA deadlock in __dm_destroy()
[SMB3] Do not fall back to SMBWriteX in set_file_size error cases
clk: ti: fix dual-registration of uart4_ick
ASoC: dwc: correct irq clear method
dm raid: fix round up of default region size
ALSA: hda: Add dock support for ThinkPad T550
ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
USB: Add reset-resume quirk for two Plantronics usb headphones.
usb: Add device quirk for Logitech PTZ cameras
serial: 8250: add uart_config entry for PORT_RT2880
drivers/tty: require read access for controlling terminal
staging: speakup: fix speakup-r regression
ALSA: synth: Fix conflicting OSS device registration on AWE32
arm64: readahead: fault retry breaks mmap file read random detection
ASoC: tas2552: Correct the Speaker Driver Playback Volume (PGA_GAIN)
ASoC: tas2552: fix dBscale-min declaration
sched/core: Fix TASK_DEAD race in finish_task_switch()
dm cache: fix NULL pointer when switching from cleaner policy
3w-9xxx: don't unmap bounce buffered commands
workqueue: make sure delayed work run in local cpu
drm/radeon: add pm sysfs files late
cxl: Fix number of allocated pages in SPA
crypto: sparc - initialize blkcipher.ivsize
drm: Fix locking for sysfs dpms file
drm/nouveau/fbcon: take runpm reference when userspace has an open fd
crypto: ahash - ensure statesize is non-zero
dm thin: fix missing pool reference count decrement in pool_ctr error path
btrfs: check unsupported filters in balance arguments
btrfs: fix use after free iterating extrefs
drm/dp/mst: make mst i2c transfer code more robust.
i2c: rcar: enable RuntimePM before registering to the core
i2c: s3c2410: enable RuntimePM before registering to the core
i2c: designware-platdrv: enable RuntimePM before registering to the core
memcg: convert threshold to bytes
i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348
pinctrl: imx25: ensure that a pin with id i is at position i in the info array
l2tp: protect tunnel->del_work by ref_count
af_unix: Convert the unix_sk macro to an inline function for type safety
af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
net/unix: fix logic about sk_peek_offset
skbuff: Fix skb checksum flag on skb pull
skbuff: Fix skb checksum partial check.
net: add pfmemalloc check in sk_add_backlog()
ppp: don't override sk->sk_state in pppoe_flush_dev()
ovs: do not allocate memory from offline numa node
ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
netlink: Trim skb to alloc size to avoid MSG_TRUNC
ath9k: declare required extra tx headroom
iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
iwlwifi: dvm: fix D3 firmware PN programming
iwlwifi: mvm: fix D3 firmware PN programming
iwlwifi: mvm: clear csa countdown when AP is stopped
iwlwifi: fix firmware filename for 3160
iwlwifi: mvm: init card correctly on ctkill exit check
ARM: orion: Fix DSA platform device after mvmdio conversion
xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
iio: mxs-lradc: Fix temperature offset
ARM: dts: Fix audio card detection on Peach boards
ALSA: hda - Fix inverted internal mic on Lenovo G50-80
drm/i915: Flush pipecontrol post-sync writes
drm/i915: Restore lost DPLL register write on gen2-4
drm/i915: Deny wrapping an userptr into a framebuffer
iommu/vt-d: fix range computation when making room for large pages
x86/efi: Fix multiple GOP device support
ASoC: Add info callback for SX_TLV controls
xhci: don't finish a TD if we get a short transfer event mid TD
xhci: handle no ping response error properly
xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
ASoC: wm8904: Correct number of EQ registers
drm: fix mutex leak in drm_dp_get_mst_branch_device
drm/nouveau/gem: return only valid domain when there's only one
powerpc/rtas: Validate rtas.entry before calling enter_rtas()
[media] si2168: Bounds check firmware
mm: make sendfile(2) killable
fault-inject: fix inverted interval/probability values in printk
rbd: fix double free on rbd_dev->header_name
rbd: don't leak parent_spec in rbd_dev_probe_parent()
rbd: prevent kernel stack blow up on rbd map
dm btree remove: fix a bug when rebalancing nodes after removal
dm btree: fix leak of bufio-backed block in btree_split_beneath error path
bpf: fix panic in SO_GET_FILTER with native ebpf programs
ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on
IB/cm: Fix rb-tree duplicate free and use-after-free
module: Fix locking in symbol_put_addr()
PCI: Prevent out of bounds access in numa_node override
ovl: use O_LARGEFILE in ovl_copy_up()
ovl: fix dentry reference leak
crypto: api - Only abort operations on fatal signal
md/raid1: submit_bio_wait() returns 0 on success
md/raid10: submit_bio_wait() returns 0 on success
iommu/amd: Don't clear DTE flags when modifying it
i2c: mv64xxx: really allow I2C offloading
drm/radeon: don't try to recreate sysfs entries on resume
mvsas: Fix NULL pointer dereference in mvs_slot_task_free
arm64: compat: fix stxr failure case in SWP emulation
Revert "ARM64: unwind: Fix PC calculation"
rbd: require stable pages if message data CRCs are enabled
md/raid5: fix locking in handle_stripe_clean_event()
Revert "md: allow a partially recovered device to be hot-added to an array."
net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes
ipv6: Fix IPsec pre-encap fragmentation check
ipv6: gre: support SIT encapsulation
ppp: fix pppoe_dev deletion condition in pppoe_release()
Linux 3.19.8-ckt10

The following patches from 3.19.8-ckt10 were already present in the Vivid kernel:

Initialize msg/shm IPC objects before doing ipc_addid()
tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419
iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series

CVE References

Luis Henriques (henrix) on 2015-11-26
tags: added: kernel-stable-tracking-bug
Luis Henriques (henrix) on 2015-11-26
description: updated
Changed in linux (Ubuntu):
status: New → Invalid
Luis Henriques (henrix) on 2015-11-26
Changed in linux (Ubuntu Trusty):
status: New → Fix Committed
Luis Henriques (henrix) on 2015-12-04
Changed in linux (Ubuntu Vivid):
status: New → Fix Committed
Changed in linux (Ubuntu Trusty):
status: Fix Committed → Invalid
Launchpad Janitor (janitor) wrote :
Download full text (14.4 KiB)

This bug was fixed in the package linux - 3.19.0-41.46

---------------
linux (3.19.0-41.46) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522918

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.19.0-40.45) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522786

  [ Andy Whitcroft ]

  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Luis Henriques ]

  * [Config] updateconfigs after 3.19.8-ckt10 stable update

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520309
  * Revert "md: allow a partially recovered device to be hot-added to an
    array."
    - LP: #1520309
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1512815
  * HID: rmi: Print the firmware id of the touchpad
    - LP: #1515503
  * HID: rmi: Add functions for writing to registers
    - LP: #1515503
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * be2net: log link status
    - LP: #1513980
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * Drivers: hv: hv_balloon: refuse to balloon below the floor
    - LP: #1294283
  * Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
    - LP: #1294283
  * Drivers: hv: balloon: check if ha_region_mutex was acquired in
    MEM_CANCEL_ONLINE case
    - LP: #1294283
  * mm: meminit: make __early_pfn_to_nid SMP-safe and introduce
    meminit_pfn_in_nid
    - LP: #1294283
  * mm: meminit: inline some helper functions
    - LP: #1294283
  * mm, meminit: allow early_pfn_to_nid to be used during runtime
    - LP: #1294283
  * mm: initialize hotplugged pages as reserved
    - LP: #1294283
  * gut proc_register() a bit
    - LP: #1519106
  * arm: factor out mmap ASLR into mmap_rnd
    - LP: #1518483
  * x86: standardize mmap_rnd() usage
    - LP: #1518483
  * arm64: standardize mmap_rnd() usage
    - LP: #1518483
  * mips: extract logic for mmap_rnd()
    - LP: #1518483
  * powerpc: standardize mmap_rnd() usage
    - LP: #1518483
  * s390: standardize mmap_rnd() usage
    - LP: #1518483
  * mm: expose arch_mmap_rnd when available
    - LP: #1518483
  * s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
    - LP: #1518483
  * mm: split ET_DYN ASLR from mmap ASLR
    - LP: #1518483
  * mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
    - LP: #1518483
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
   ...

Changed in linux (Ubuntu Vivid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers