Wily update to v4.2.8-ckt5 stable release

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The v4.2.8-ckt5 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://kernel.ubuntu.com/ubuntu/linux.git

    TEST CASE: TBD

       The following patches from the v4.2.8-ckt5 stable release shall be applied:

Linux 4.2.8-ckt5
pipe: limit the per-user amount of pages allocated in pipes
netfilter: nfnetlink: correctly validate length of batch messages
net: phy: bcm7xxx: Fix 40nm EPHY features
net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
net: phy: Fix phy_mac_interrupt()
s390/oprofile: fix address range for asynchronous stack
net: phy: bcm7xxx: Fix bcm7xxx_config_init() check
bonding: don't use stale speed and duplex information
writeback: initialize inode members that track writeback history
net: phy: bcm7xxx: Fix shadow mode 2 disabling
net/mlx4_core: Fix potential corruption in counters database
[media] exynos4-is: fix a format string bug
MAINTAINERS: Remove stale entry for BCM33xx chips
s390/stacktrace: fix address ranges for asynchronous and panic stack
ARM: dts: kirkwood: use unique machine name for ds112
Input: xpad - remove unused function
netlink: not trim skb for mmaped socket when dump
af_unix: Don't set err in unix_stream_read_generic unless there was an error
batman-adv: Avoid endless loop in bat-on-bat netdevice check
s390/perf_event: fix address range for asynchronous stack
net/mlx4_core: Do not BUG_ON during reset when PCI is offline
sctp: Fix port hash table size computation
unix_diag: fix incorrect sign extension in unix_lookup_by_ino
rtnl: RTM_GETNETCONF: fix wrong return value
route: check and remove route cache when we get route
pppoe: fix reference counting in PPPoE proxy
l2tp: Fix error creating L2TP tunnels
net/mlx4_en: Avoid changing dev->features directly in run-time
net/mlx4_en: Choose time-stamping shift value according to HW frequency
net/mlx4_en: Count HW buffer overrun only once
qmi_wwan: add "4G LTE usb-modem U901"
af_unix: Guard against other == sk in unix_dgram_sendmsg
ipv4: fix memory leaks in ip_cmsg_send() callers
bonding: Fix ARP monitor validation
bpf: fix branch offset adjustment on backjumps after patching ctx expansion
net: Copy inner L3 and L4 headers as unaligned on GRE TEB
flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen
sctp: translate network order to host order when users get a hmacid
tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs
net:Add sysctl_max_skb_frags
unix: correctly track in-flight fds in sending process user_struct
ipv6: fix a lockdep splat
ipv6: addrconf: Fix recursive spin lock call
net/ipv6: add sysctl option accept_ra_min_hop_limit
ipv6/udp: use sticky pktinfo egress ifindex on connect()
ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail()
tcp: beware of alignments in tcp_get_info()
switchdev: Require RTNL mutex to be held when sending FDB notifications
sctp: allow setting SCTP_SACK_IMMEDIATELY by the application
pptp: fix illegal memory access caused by multiple bind()s
af_unix: fix struct pid memory leak
tcp: fix NULL deref in tcp_v4_send_ack()
net: dp83640: Fix tx timestamp overflow handling.
af_iucv: Validate socket address length in iucv_sock_bind()
do_last(): ELOOP failure exit should be done after leaving RCU mode
should_follow_link(): validate ->d_seq after having decided to follow
namei: ->d_inode of a pinned dentry is stable only for positives
do_last(): don't let a bogus return value from ->open() et.al. to confuse us
hpfs: don't truncate the file when delete fails
ocfs2: unlock inode if deleting inode from orphan fails
mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED
x86/mpx: Fix off-by-one comparison with nr_registers
ALSA: hda - Loop interrupt handling until really cleared
ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2
ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225
ALSA: hda/realtek - Support Dell headset mode for ALC225
KVM: x86: MMU: fix ubsan index-out-of-range warning
ALSA: hda - Fixing background noise on Dell Inspiron 3162
libceph: use the right footer size when skipping a message
libceph: don't bail early from try_read() when skipping a message
tracing: Fix showing function event in available_events
KVM: async_pf: do not warn on page allocation failures
KVM: x86: fix missed hardware breakpoints
ARCv2: SMP: Emulate IPI to self using software triggered interrupt
KVM: arm/arm64: vgic: Ensure bitmaps are long enough
sunrpc/cache: fix off-by-one in qword_get()
ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption
drm/amdgpu/pm: adjust display configuration after powerstate
s390/compat: correct restore of high gprs on signal return
dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths
can: ems_usb: Fix possible tx overflow
drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE
kernel/resource.c: fix muxed resource handling in __request_region()
hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook
nfit: fix multi-interface dimm handling, acpi6.1 compatibility
ext4: fix crashes in dioread_nolock mode
ext4: fix bh->b_state corruption
hwmon: (ads1015) Handle negative conversion values correctly
ipc/shm: handle removed segments gracefully in shm_mmap()
ipc: convert invalid scenarios to use WARN_ON
mm: fix regression in remap_file_pages() emulation
USB: option: add "4G LTE usb-modem U901"
USB: cp210x: add IDs for GE B650V3 and B850V3 boards
USB: option: add support for SIM7100E
ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream
x86/mm: Fix vmalloc_fault() to handle large pages properly
NFSv4: Fix a dentry leak on alias use
powerpc/ioda: Set "read" permission when "write" is set
usb: dwc3: Fix assignment of EP transfer resources
x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache()
x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable
drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2)
drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command
drm/radeon: use post-decrement in error handling
drm/amdgpu: use post-decrement in error handling
ALSA: seq: Fix double port list deletion
tracing: Fix freak link error caused by branch tracer
tracepoints: Do not trace when cpu is offline
dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer
ALSA: hda - Cancel probe work instead of flush at remove
ALSA: seq: Fix leak of pool buffer at concurrent writes
xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted.
xen/pciback: Save the number of MSI-X entries to be copied later.
xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY
powerpc/eeh: Fix stale cached primary bus
iwlwifi: mvm: don't allow sched scans without matches to be started
bio: return EINTR if copying to user space got interrupted
ext4: don't read blocks from disk after extents being swapped
ext4: fix potential integer overflow
scsi: fix soft lockup in scsi_remove_target() on module removal
irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1
btrfs: properly set the termination value of ctx->pos in readdir
ARM: 8519/1: ICST: try other dividends than 1
s390/dasd: fix refcount for PAV reassignment
s390/dasd: prevent incorrect length error under z/VM after PAV changes
cifs: fix erroneous return value
drm/amdgpu: fix issue with overlapping userptrs
drm/radeon: hold reference to fences in radeon_sa_bo_new
drm/amdgpu: remove unnecessary forward declaration
drm/amdgpu: fix s4 resume
workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup
ahci: Intel DNV device IDs SATA
drm/i915: fix error path in intel_setup_gmbus()
drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select()
phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload
phy: twl4030-usb: Relase usb phy on unload
phy: core: fix wrong err handle for phy_power_on
ALSA: timer: Fix race at concurrent reads
ALSA: hda - Fix bad dereference of jack object
ALSA: timer: Fix race between stop and interrupt
nfs: fix nfs_size_to_loff_t
xen/scsiback: correct frontend counting
ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
ALSA: timer: Fix wrong instance passed to slave callbacks
powerpc: Fix dedotify for binutils >= 2.26
drm/i915/dsi: don't pass arbitrary data to sideband
drm/i915/dsi: defend gpio table against out of bounds access
ALSA: dummy: Implement timer backend switching more safely
klist: fix starting point removed bug in klist iterators
ALSA: hda - Fix speaker output from VAIO AiO machines
pty: make sure super_block is still valid in final /dev/tty close
pty: fix possible use after free of tty->driver_data
tty: Add support for PCIe WCH382 2S multi-IO card
serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)
qla2xxx: Fix stale pointer access.
target: Fix race with SCF_SEND_DELAYED_TAS handling
crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
crypto: atmel-sha - fix atmel_sha_remove()
crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
crypto: user - lock crypto_alg_list on alg dump
radix-tree: fix oops after radix_tree_iter_retry
mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress
dump_stack: avoid potential deadlocks
target: Fix remote-port TMR ABORT + se_cmd fabric stop
Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
ALSA: hda - Fix static checker warning in patch_hdmi.c
drm/dp/mst: deallocate payload on port destruction
drm/dp/mst: Reverse order of MST enable and clearing VC payload table.
drm/dp/mst: Calculate MST PBN with 31.32 fixed point
drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
drm: fix missing reference counting decrease
SCSI: Add Marvell Console to VPD blacklist
scsi_dh_rdac: always retry MODE SELECT on command lock violation
Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl
ARM: nomadik: fix up SD/MMC DT settings
[media] saa7134-alsa: Only frees registered sound cards
ALSA: timer: Fix leftover link at closing
[media] tda1004x: only update the frontend properties if locked
target: Fix TAS handling for multi-session se_node_acls
target: Fix LUN_RESET active TMR descriptor handling
target: Fix LUN_RESET active I/O handling for ACK_KREF
target: Invoke release_cmd() callback without holding a spinlock
xhci: Fix list corruption in urb dequeue at host removal
usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
usb: xhci: set SSIC port unused only if xhci_suspend succeeds
usb: xhci: add a quirk bit for ssic port unused
usb: xhci: handle both SSIC ports in PME stuck quirk
Btrfs: fix page reading in extent_same ioctl leading to csum errors
Btrfs: fix invalid page accesses in extent_same (dedup) ioctl
btrfs: fix clone / extent-same deadlocks
drivers/hwspinlock: fix race between radix tree insertion and lookup
radix-tree: fix race in gang lookup
drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration
ALSA: seq: Fix lockdep warnings due to double mutex locks
ALSA: rawmidi: Fix race at copying & updating the position
ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
ALSA: hda - Add fixup for Mac Mini 7,1 model
module: wrapper for symbol name.
modules: fix modparam async_probe request
drm/amdgpu: drop topaz support from gmc8 module
drm/amdgpu: pull topaz gmc bits into gmc_v7
drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above
drm/amdgpu: iceland use CI based MC IP
drm/amdgpu: move gmc7 support out of CIK dependency
ASoC: dpcm: fix the BE state on hw_free
drm/amdgpu: mask out WC from BO on unsupported arches
drm/radeon: mask out WC from BO on unsupported arches
drm: add helper to check for wc memory support
cputime: Prevent 32bit overflow in time[val|spec]_to_cputime()
MIPS: Fix buffer overflow in syscall_get_arguments()
libata: fix sff host state machine locking while polling
ALSA: timer: Fix link corruption due to double start or stop
ALSA: timer: Code cleanup
ALSA: seq: Fix yet another races among ALSA timer accesses
ALSA: pcm: Fix potential deadlock in OSS emulation
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
ALSA: seq: Fix race at closing in virmidi driver
intel_scu_ipcutil: underflow in scu_reg_access()
iio: pressure: mpl115: fix temperature offset sign
iio: inkern: fix a NULL dereference on error
crypto: algif_hash - wait for crypto_ahash_init() to complete
target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
ALSA: usb-audio: Fix OPPO HA-1 vendor ID
drm/i915/dp: fall back to 18 bpp when sink capability is unknown
spi: atmel: fix gpio chip-select in case of non-DT platform
Input: vmmouse - fix absolute device registration
crypto: shash - Fix has_key setting
ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type
ARM: dts: at91: sama5d4ek: add phy address and IRQ for macb0
ARM: dts: at91: sama5d4: fix instance id of DBGU
rfkill: fix rfkill_fop_read wait_event usage
mac80211: Requeue work after scan complete for all VIF types.
libata: disable forced PORTS_IMPL for >= AHCI 1.3
ARM: dts: Fix wl12xx missing clocks that cause hangs
PCI/AER: Flush workqueue on device remove to avoid use-after-free
rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
ARM: OMAP2+: Fix ppa_zero_params and ppa_por_params for rodata
ARM: OMAP2+: Fix l2_inv_api_params for rodata
ARM: OMAP2+: Fix save_secure_ram_context for rodata
ARM: OMAP2+: Fix l2dis_3630 for rodata
ARM: OMAP2+: Fix wait_dll_lock_timed for rodata
cgroup: make sure a parent css isn't offlined before its children
ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2
ASoC: rt5645: fix the shift bit of IN1 boost
iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer.
iio: light: acpi-als: Report data as processed
iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
iio: dac: mcp4725: set iio name property in sysfs
iio: add HAS_IOMEM dependency to VF610_ADC
iio: add IIO_TRIGGER dependency to STK8BA50
iio-light: Use a signed return type for ltr501_match_samp_freq()
x86/entry/compat: Add missing CLAC to entry_INT80_32
Revert "workqueue: make sure delayed work run in local cpu"
vmstat: explicitly schedule per-cpu work on the CPU we need it to run on
EVM: Use crypto_memneq() for digest comparisons
iw_cxgb3: Fix incorrectly returning error on success
ASN.1: Fix non-match detection failure on data overrun
[media] usbvision: fix crash on detecting device with invalid configuration
[media] usbvision fix overflow of interfaces array

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.2.0-35.40

---------------
linux (4.2.0-35.40) wily; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1557706

  [ Upstream Kernel Changes ]

  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1556269
  * Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
    - LP: #1556269
  * KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
    - LP: #1552592
  * locking/qspinlock: Move __ARCH_SPIN_LOCK_UNLOCKED to qspinlock_types.h
    - LP: #1545330
  * [media] usbvision fix overflow of interfaces array
    - LP: #1556269
  * [media] usbvision: fix crash on detecting device with invalid
    configuration
    - LP: #1556269
  * ASN.1: Fix non-match detection failure on data overrun
    - LP: #1556269
  * iw_cxgb3: Fix incorrectly returning error on success
    - LP: #1556269
  * EVM: Use crypto_memneq() for digest comparisons
    - LP: #1556269
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1556269
  * x86/entry/compat: Add missing CLAC to entry_INT80_32
    - LP: #1556269
  * iio-light: Use a signed return type for ltr501_match_samp_freq()
    - LP: #1556269
  * iio: add IIO_TRIGGER dependency to STK8BA50
    - LP: #1556269
  * iio: add HAS_IOMEM dependency to VF610_ADC
    - LP: #1556269
  * iio: dac: mcp4725: set iio name property in sysfs
    - LP: #1556269
  * iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
    - LP: #1556269
  * iio: light: acpi-als: Report data as processed
    - LP: #1556269
  * iio:adc:ti_am335x_adc Fix buffered mode by identifying as software
    buffer.
    - LP: #1556269
  * ASoC: rt5645: fix the shift bit of IN1 boost
    - LP: #1556269
  * ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2
    - LP: #1556269
  * cgroup: make sure a parent css isn't offlined before its children
    - LP: #1556269
  * ARM: OMAP2+: Fix wait_dll_lock_timed for rodata
    - LP: #1556269
  * ARM: OMAP2+: Fix l2dis_3630 for rodata
    - LP: #1556269
  * ARM: OMAP2+: Fix save_secure_ram_context for rodata
    - LP: #1556269
  * ARM: OMAP2+: Fix l2_inv_api_params for rodata
    - LP: #1556269
  * ARM: OMAP2+: Fix ppa_zero_params and ppa_por_params for rodata
    - LP: #1556269
  * rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
    - LP: #1556269
  * PCI/AER: Flush workqueue on device remove to avoid use-after-free
    - LP: #1556269
  * ARM: dts: Fix wl12xx missing clocks that cause hangs
    - LP: #1556269
  * libata: disable forced PORTS_IMPL for >= AHCI 1.3
    - LP: #1556269
  * mac80211: Requeue work after scan complete for all VIF types.
    - LP: #1556269
  * rfkill: fix rfkill_fop_read wait_event usage
    - LP: #1556269
  * ARM: dts: at91: sama5d4: fix instance id of DBGU
    - LP: #1556269
  * ARM: dts: at91: sama5d4ek: add phy address and IRQ for macb0
    - LP: #1556269
  * ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type
    - LP: #1556269
  * crypto: shash - Fix has_key setting
    - LP: #1556269
  * Input: vmmouse - fix absolute device registration
    - LP: #1556269
  * spi: atmel: fix gpio chip-select in case of non-DT platform
    - LP: #1556269
  ...

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.