Trusty update to 3.19.8-ckt10 stable release

Bug #1520309 reported by Luis Henriques on 2015-11-26
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)

Bug Description

SRU Justification

       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 3.19.8-ckt10 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.



       The following patches are in the 3.19.8-ckt10 stable release:

isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
ppp, slip: Validate VJ compression slot parameters completely
[media] media/vivid-osd: fix info leak in ioctl
staging/dgnc: fix info leak in ioctl
tools lib traceevent: Fix string handling in heterogeneous arch environments
perf tools: Fix copying of /proc/kcore
m68k: Define asmlinkage_protect
UBI: Validate data_size
UBI: return ENOSPC if no enough space available
drm/radeon: Restore LCD backlight level on resume (>= R5xx)
drm/radeon: move bl encoder assignment into bl init
drm/radeon: fix dpms when driver backlight control is disabled
MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
MIPS: CPS: Stop dangling delay slot from has_mt.
MIPS: CPS: Don't include MT code in non-MT kernels.
x86/asm/entry: Create and use a 'TOP_OF_KERNEL_STACK_PADDING' macro
x86/process: Add proper bound checks in 64bit get_wchan()
drm/qxl: recreate the primary surface when the bo is not primary
genirq: Fix race in register_irq_proc()
x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
KVM: nSVM: Check for NRIPS support before updating control field
mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
drm/dp/mst: fixup handling hotplug on port removal.
drm/dp/mst: drop cancel work sync in the mstb destroy path (v2)
x86/kexec: Fix kexec crash in syscall kexec_file_load()
x86/mm: Set NX on gap between __ex_table and rodata
md/raid0: update queue parameter in a safer location.
md/raid0: apply base queue limits *before* disk_stack_limits
arm64: ftrace: fix function_graph tracer panic
clocksource: Fix abs() usage w/ 64bit values
dmaengine: dw: properly read DWC_PARAMS register
mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
regmap: debugfs: Ensure we don't underflow when printing access masks
regmap: debugfs: Don't bother actually printing when calculating max length
mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions
mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()
ARM: dts: fix usb pin control for imx-rex dts
ASoC: db1200: Fix DAI link format for db1300 and db1550
x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map
s390/boot/decompression: disable floating point in decompressor
svcrdma: handle rdma read with a non-zero initial page offset
ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe
dm: fix AB-BA deadlock in __dm_destroy()
[SMB3] Do not fall back to SMBWriteX in set_file_size error cases
clk: ti: fix dual-registration of uart4_ick
ASoC: dwc: correct irq clear method
dm raid: fix round up of default region size
ALSA: hda: Add dock support for ThinkPad T550
ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
USB: Add reset-resume quirk for two Plantronics usb headphones.
usb: Add device quirk for Logitech PTZ cameras
serial: 8250: add uart_config entry for PORT_RT2880
drivers/tty: require read access for controlling terminal
staging: speakup: fix speakup-r regression
ALSA: synth: Fix conflicting OSS device registration on AWE32
arm64: readahead: fault retry breaks mmap file read random detection
ASoC: tas2552: Correct the Speaker Driver Playback Volume (PGA_GAIN)
ASoC: tas2552: fix dBscale-min declaration
sched/core: Fix TASK_DEAD race in finish_task_switch()
dm cache: fix NULL pointer when switching from cleaner policy
3w-9xxx: don't unmap bounce buffered commands
workqueue: make sure delayed work run in local cpu
drm/radeon: add pm sysfs files late
cxl: Fix number of allocated pages in SPA
crypto: sparc - initialize blkcipher.ivsize
drm: Fix locking for sysfs dpms file
drm/nouveau/fbcon: take runpm reference when userspace has an open fd
crypto: ahash - ensure statesize is non-zero
dm thin: fix missing pool reference count decrement in pool_ctr error path
btrfs: check unsupported filters in balance arguments
btrfs: fix use after free iterating extrefs
drm/dp/mst: make mst i2c transfer code more robust.
i2c: rcar: enable RuntimePM before registering to the core
i2c: s3c2410: enable RuntimePM before registering to the core
i2c: designware-platdrv: enable RuntimePM before registering to the core
memcg: convert threshold to bytes
i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348
pinctrl: imx25: ensure that a pin with id i is at position i in the info array
l2tp: protect tunnel->del_work by ref_count
af_unix: Convert the unix_sk macro to an inline function for type safety
af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
net/unix: fix logic about sk_peek_offset
skbuff: Fix skb checksum flag on skb pull
skbuff: Fix skb checksum partial check.
net: add pfmemalloc check in sk_add_backlog()
ppp: don't override sk->sk_state in pppoe_flush_dev()
ovs: do not allocate memory from offline numa node
ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
netlink: Trim skb to alloc size to avoid MSG_TRUNC
ath9k: declare required extra tx headroom
iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
iwlwifi: dvm: fix D3 firmware PN programming
iwlwifi: mvm: fix D3 firmware PN programming
iwlwifi: mvm: clear csa countdown when AP is stopped
iwlwifi: fix firmware filename for 3160
iwlwifi: mvm: init card correctly on ctkill exit check
ARM: orion: Fix DSA platform device after mvmdio conversion
xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
iio: mxs-lradc: Fix temperature offset
ARM: dts: Fix audio card detection on Peach boards
ALSA: hda - Fix inverted internal mic on Lenovo G50-80
drm/i915: Flush pipecontrol post-sync writes
drm/i915: Restore lost DPLL register write on gen2-4
drm/i915: Deny wrapping an userptr into a framebuffer
iommu/vt-d: fix range computation when making room for large pages
x86/efi: Fix multiple GOP device support
ASoC: Add info callback for SX_TLV controls
xhci: don't finish a TD if we get a short transfer event mid TD
xhci: handle no ping response error properly
xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
ASoC: wm8904: Correct number of EQ registers
drm: fix mutex leak in drm_dp_get_mst_branch_device
drm/nouveau/gem: return only valid domain when there's only one
powerpc/rtas: Validate rtas.entry before calling enter_rtas()
[media] si2168: Bounds check firmware
mm: make sendfile(2) killable
fault-inject: fix inverted interval/probability values in printk
rbd: fix double free on rbd_dev->header_name
rbd: don't leak parent_spec in rbd_dev_probe_parent()
rbd: prevent kernel stack blow up on rbd map
dm btree remove: fix a bug when rebalancing nodes after removal
dm btree: fix leak of bufio-backed block in btree_split_beneath error path
bpf: fix panic in SO_GET_FILTER with native ebpf programs
ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on
IB/cm: Fix rb-tree duplicate free and use-after-free
module: Fix locking in symbol_put_addr()
PCI: Prevent out of bounds access in numa_node override
ovl: use O_LARGEFILE in ovl_copy_up()
ovl: fix dentry reference leak
crypto: api - Only abort operations on fatal signal
md/raid1: submit_bio_wait() returns 0 on success
md/raid10: submit_bio_wait() returns 0 on success
iommu/amd: Don't clear DTE flags when modifying it
i2c: mv64xxx: really allow I2C offloading
drm/radeon: don't try to recreate sysfs entries on resume
mvsas: Fix NULL pointer dereference in mvs_slot_task_free
arm64: compat: fix stxr failure case in SWP emulation
Revert "ARM64: unwind: Fix PC calculation"
rbd: require stable pages if message data CRCs are enabled
md/raid5: fix locking in handle_stripe_clean_event()
Revert "md: allow a partially recovered device to be hot-added to an array."
net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes
ipv6: Fix IPsec pre-encap fragmentation check
ipv6: gre: support SIT encapsulation
ppp: fix pppoe_dev deletion condition in pppoe_release()
Linux 3.19.8-ckt10

The following patches from 3.19.8-ckt10 were already present in the Vivid kernel:

Initialize msg/shm IPC objects before doing ipc_addid()
tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419
iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series

CVE References

Luis Henriques (henrix) on 2015-11-26
tags: added: kernel-stable-tracking-bug
Luis Henriques (henrix) on 2015-11-26
description: updated
Changed in linux (Ubuntu):
status: New → Invalid
Luis Henriques (henrix) on 2015-11-26
Changed in linux (Ubuntu Trusty):
status: New → Fix Committed
Luis Henriques (henrix) on 2015-12-04
Changed in linux (Ubuntu Vivid):
status: New → Fix Committed
Changed in linux (Ubuntu Trusty):
status: Fix Committed → Invalid
Launchpad Janitor (janitor) wrote :
Download full text (14.4 KiB)

This bug was fixed in the package linux - 3.19.0-41.46

linux (3.19.0-41.46) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522918

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.19.0-40.45) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522786

  [ Andy Whitcroft ]

  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    - LP: #1509029

  [ Luis Henriques ]

  * [Config] updateconfigs after 3.19.8-ckt10 stable update

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520309
  * Revert "md: allow a partially recovered device to be hot-added to an
    - LP: #1520309
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1512815
  * HID: rmi: Print the firmware id of the touchpad
    - LP: #1515503
  * HID: rmi: Add functions for writing to registers
    - LP: #1515503
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * be2net: log link status
    - LP: #1513980
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * Drivers: hv: hv_balloon: refuse to balloon below the floor
    - LP: #1294283
  * Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
    - LP: #1294283
  * Drivers: hv: balloon: check if ha_region_mutex was acquired in
    - LP: #1294283
  * mm: meminit: make __early_pfn_to_nid SMP-safe and introduce
    - LP: #1294283
  * mm: meminit: inline some helper functions
    - LP: #1294283
  * mm, meminit: allow early_pfn_to_nid to be used during runtime
    - LP: #1294283
  * mm: initialize hotplugged pages as reserved
    - LP: #1294283
  * gut proc_register() a bit
    - LP: #1519106
  * arm: factor out mmap ASLR into mmap_rnd
    - LP: #1518483
  * x86: standardize mmap_rnd() usage
    - LP: #1518483
  * arm64: standardize mmap_rnd() usage
    - LP: #1518483
  * mips: extract logic for mmap_rnd()
    - LP: #1518483
  * powerpc: standardize mmap_rnd() usage
    - LP: #1518483
  * s390: standardize mmap_rnd() usage
    - LP: #1518483
  * mm: expose arch_mmap_rnd when available
    - LP: #1518483
  * s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
    - LP: #1518483
  * mm: split ET_DYN ASLR from mmap ASLR
    - LP: #1518483
  * mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
    - LP: #1518483
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()

Changed in linux (Ubuntu Vivid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers