Cosmic update to 4.18.10 stable release

Bug #1794597 reported by Thadeu Lima de Souza Cascardo on 2018-09-26
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)

Bug Description

    SRU Justification

       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The 4.18.10 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.



       The following patches from the 4.18.10 stable release shall be applied:

Linux 4.18.10
crypto: ccp - add timeout support in the SEV command
mei: bus: type promotion bug in mei_nfc_if_version()
clk: tegra: bpmp: Don't crash when a clock fails to register
pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
pinctrl: msm: Fix msm_config_group_get() to be compliant
blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()
blk-mq: only attempt to merge bio if there is rq in sw queue
IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlers
block/DAC960.c: fix defined but not used build warnings
staging: fsl-dpaa2/eth: Fix DMA mapping direction
dmaengine: sh: rcar-dmac: avoid to write CHCR.TE to 1 if TCR is set to 0
drm/amd/pp: Send khz clock values to DC for smu7/8
arm64: perf: Disable PMU while processing counter overflows
drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
ASoC: rt5651: Fix workqueue cancel vs irq free race on remove
selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress
remoteproc: qcom: q6v5-pil: fix modem hang on SDM845 after axis2 clk unvote
scsi: lpfc: Fix panic if driver unloaded when port is offline
scsi: lpfc: Fix NVME Target crash in defer rcv logic
scsi: libfc: fixup 'sleeping function called from invalid context'
ALSA: pcm: Fix snd_interval_refine first/last with open min/max
selftests/android: initialize heap_type to avoid compiling warning
selftests: vDSO - fix to return KSFT_SKIP when test couldn't be run
rtc: bq4802: add error handling for devm_ioremap
drm/amdkfd: Fix error codes in kfd_get_process
drm/amdkfd: Fix kernel queue 64 bit doorbell offset calculation
input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
rcutorture: Use monotonic timestamp for stall detection
net: mvpp2: make sure we use single queue mode on PPv2.1
net: gemini: Allow multiple ports to instantiate
gpiolib: Mark gpio_suffixes array with __maybe_unused
gpio: pxa: Fix potential NULL dereference
staging: bcm2835-audio: Don't leak workqueue if open fails
lightnvm: pblk: enable line minor version detection
lightnvm: pblk: assume that chunks are closed on 1.2 devices
ASoC: qdsp6: q6afe-dai: fix a range check in of_q6afe_parse_dai_data()
drm/amd/display: support access ddc for mst branch
tools/testing/nvdimm: Fix support for emulating controller temperature
f2fs: do checkpoint in kill_sb
coresight: ETM: Add support for Arm Cortex-A73 and Cortex-A35
coresight: tpiu: Fix disabling timeouts
coresight: Handle errors in finding input/output ports
sched/fair: Fix util_avg of new tasks for asymmetric systems
parport: sunbpp: fix error return code
tls: Fix zerocopy_from_iter iov handling
drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
drm/nouveau/debugfs: Wake up GPU before doing any reclocking
drm/nouveau: Fix runtime PM leak in drm_open()
mmc: sdhci: do not try to use 3.3V signaling if not supported
mmc: tegra: prevent HS200 on Tegra 3
mmc: sdhci-of-esdhc: set proper dma mask for ls104x chips
tty: fix termios input-speed encoding
tty: fix termios input-speed encoding when using BOTHER
serial: 8250: of: Correct of_platform_serial_setup() error handling
ASoC: hdmi-codec: fix routing
gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes
liquidio: fix hang when re-binding VF host drv after running DPDK VF driver
ARM: hisi: check of_iomap and fix missing of_node_put
net: hns3: Fix return value error in hns3_reset_notify_down_enet
ARM: hisi: fix error handling and missing of_node_put
ARM: hisi: handle of_iomap and fix missing of_node_put
net: hns3: Fix for reset_level default assignment probelm
net: hns3: Reset net device with rtnl_lock
efi/esrt: Only call efi_mem_reserve() for boot services memory
sched/core: Use smp_mb() in wake_woken_function()
arm64: dts: mt7622: update a clock property for UART0
pinctrl: rza1: Fix selector use for groups and functions
pinctrl: mt7622: Fix probe fail by misuse the selector
configfs: fix registered group removal
MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
KVM: PPC: Book3S: Fix matching of hardware and emulated TCE tables
PM / devfreq: use put_device() instead of kfree()
security: check for kstrdup() failure in lsm_append()
KVM: PPC: Book3S HV: Add of_node_put() in success path
evm: Don't deadlock if a crypto algorithm is unavailable
Bluetooth: Use lock_sock_nested in bt_accept_enqueue
spi: dw: fix possible race condition
bpf: fix rcu annotations in compute_effective_progs()
vfs: fix freeze protection in mnt_want_write_file() for overlayfs
mtdchar: fix overflows in adjustment of `count`
audit: fix use-after-free in audit_add_watch
arm64: dts: uniphier: Add missing cooling device properties for CPUs
net/mlx5: Add missing SET_DRIVER_VERSION command translation
binfmt_elf: Respect error return from `regset->active'
mmc: meson-mx-sdio: fix OF child-node lookup
of: add helper to lookup compatible child node
NFSv4.1 fix infinite loop on I/O.
NFSv4: Fix a tracepoint Oops in initiate_file_draining()
x86/EISA: Don't probe EISA bus for Xen PV guests
of: fix phandle cache creation for DTs with no phandles
perf tools: Fix maps__find_symbol_by_name()
perf/core: Force USER_DS when recording user stack data
xtensa: ISS: don't allocate memory in platform_setup
cifs: integer overflow in in SMB2_ioctl()
CIFS: fix wrapping bugs in num_entries()
cifs: prevent integer overflow in nxt_dir_entry()
Revert "cdc-acm: implement put_char() and flush_chars()"
usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()
USB: yurex: Fix buffer over-read in yurex_write()
USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
usb: misc: uss720: Fix two sleep-in-atomic-context bugs
USB: serial: io_ti: fix array underflow in completion handler
USB: net2280: Fix erroneous synchronization change
usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0
USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
usb: uas: add support for more quirk flags
USB: Add quirk to support DJI CineSSD
dm verity: fix crash on bufio buffer that was allocated with vmalloc
mei: bus: need to unlink client before freeing
mei: bus: fix hw module get/put balance
mei: ignore not found client in the enumeration
usb: mtu3: fix error of xhci port id when enable U3 dual role
usb: xhci: fix interrupt transfer error happened on MTK platforms
usb: Don't die twice if PCI xhci host is not responding in resume
xhci: Fix use after free for URB cancellation on a reallocated endpoint
misc: hmc6352: fix potential Spectre v1
misc: ibmvsm: Fix wrong assignment of return code
Tools: hv: Fix a bug in the key delete code
vmbus: don't return values for uninitalized channels
ovl: fix oopses in ovl_fill_super() failure paths
ipmi: Fix I2C client removal in the SSIF driver
ipmi: Move BT capabilities detection to the detect call
ipmi: Rework SMI registration failure
mmc: omap_hsmmc: fix wakeirq handling on removal
s390/crypto: Fix return code checking in cbc_paes_crypt()
IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
xen/netfront: fix waiting for xenbus state change
pstore: Fix incorrect persistent ram buffer mapping
RDMA/cma: Protect cma dev list with lock
xen-netfront: fix warn message as irq device name has '/'
PCI/AER: Honor "pcie_ports=native" even if HEST sets FIRMWARE_FIRST
x86/mm/pti: Add an overflow check to pti_clone_pmds()
x86/pti: Check the return value of pti_user_pagetable_walk_pmd()
x86/pti: Check the return value of pti_user_pagetable_walk_p4d()
crypto: sharah - Unregister correct algorithms for SAHARA 3
dmaengine: mv_xor_v2: kill the tasklets upon exit
iommu/ipmmu-vmsa: IMUCTRn.TTSEL needs a special usage on R-Car Gen3
regulator: qcom_spmi: Fix warning Bad of_node_put()
regulator: qcom_spmi: Use correct regmap when checking for error
drm/amd/pp: Set Max clock level to display by default
i2c: aspeed: Fix initial values of master and slave state
drivers/base: stop new probing during shutdown
KVM: arm/arm64: Fix vgic init race
platform/x86: toshiba_acpi: Fix defined but not used build warnings
s390/qeth: reset layer2 attribute on layer switch
s390/qeth: fix race in used-buffer accounting
soc: qcom: smem: Correct check for global partition
ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci
arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
xen-netfront: fix queue name setting
nfp: avoid buffer leak when FW communication fails
ALSA: usb-audio: Generic DSD detection for Thesycon-based implementations
efi/arm: preserve early mapping of UEFI memory map longer for BGRT
reset: imx7: Fix always writing bits as 0
arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc
Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets
mac80211: restrict delayed tailroom needed decrement
MIPS: jz4740: Bump zload address
ASoC: rt5514: Fix the issue of the delay volume applied
staging: bcm2835-camera: handle wait_for_completion_timeout return properly
staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout
perf script: Show correct offsets for DWARF-based unwinding
powerpc/powernv: opal_put_chars partial write fix
KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr()
nvme-rdma: unquiesce queues when deleting the controller
nvmet: fix file discard return status
perf powerpc: Fix callchain ip filtering
ARM: exynos: Clear global variable on init error path
omapfb: rename omap2 module to omap2fb.ko
fbdev: Distinguish between interlaced and progressive modes
video: fbdev: pxafb: clear allocated memory for video modes
perf powerpc: Fix callchain ip filtering when return address is in a register
fbdev/via: fix defined but not used warning
video: goldfishfb: fix memory leak on driver remove
perf tools: Fix struct comm_str removal crash
fbdev: omapfb: off by one in omapfb_register_client()
perf tests: Fix to ensure cleanups
perf tests: Fix when event exists
perf tests: Fix for powerpc64
perf tools: Synthesize GROUP_DESC feature in pipe mode
gfs2: Don't reject a supposedly full bitmap if we have blocks reserved
perf test: Fix subtest number when showing results
media: ov5645: Supported external clock is 24MHz
mtd/maps: fix solutionengine.c printk format warnings
IB/ipoib: Fix error return code in ipoib_dev_init()
block: allow max_discard_segments to be stacked
IB/rxe: Drop QP0 silently
media: videobuf2-core: check for q->error in vb2_core_qbuf()
MIPS: ath79: fix system restart
dmaengine: pl330: fix irq race with terminate_all
media: tw686x: Fix oops on buffer alloc failure
kbuild: do not update config when running install targets
kbuild: add .DELETE_ON_ERROR special target
clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure
clk: core: Potentially free connection id
Input: pxrc - fix freeing URB on device teardown
clk: mvebu: armada-37xx-periph: Fix wrong return value in get_parent
clk: imx6sll: fix missing of_node_put()
clk: imx6ul: fix missing of_node_put()
gfs2: Special-case rindex for gfs2_grow
iwlwifi: cancel the injective function between hw pointers to tfd entry index
nfp: don't fail probe on pci_sriov_set_totalvfs() errors
amd-xgbe: use dma_mapping_error to check map errors
xfrm: fix 'passing zero to ERR_PTR()' warning
ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
ALSA: usb-audio: Add support for Encore mDSD USB DAC
ALSA: msnd: Fix the default sample sizes
iommu/io-pgtable-arm: Fix pgtable allocation in selftest
iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE
iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
usb: dwc3: change stream event enable bit back to 13
net/mlx5: Use u16 for Work Queue buffer fragment size
net/mlx5: Fix possible deadlock from lockdep when adding fte to fg
net/mlx5: Fix not releasing read lock when adding flow rules
tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY
erspan: return PACKET_REJECT when the appropriate tunnel is not found
erspan: fix error handling for erspan tunnel
net/mlx5: Fix debugfs cleanup in the device init/remove flow
net/mlx5: Check for error in mlx5_attach_interface
net/tls: Set count of SG entries if sk_alloc_sg returns -ENOSPC
net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables
tipc: orphan sock in tipc_release()
rds: fix two RCU related problems
net: qca_spi: Fix race condition in spi transfers
net/mlx5: Fix use-after-free in self-healing flow
be2net: Fix memory leak in be_cmd_get_profile_config()

CVE References

tags: added: kernel-stable-tracking-bug
Changed in linux (Ubuntu Cosmic):
status: New → Fix Committed
Launchpad Janitor (janitor) wrote :
Download full text (60.2 KiB)

This bug was fixed in the package linux - 4.18.0-9.10

linux (4.18.0-9.10) cosmic; urgency=medium

  * linux: 4.18.0-9.10 -proposed tracker (LP: #1796346)

  * Cosmic update: v4.18.12 upstream stable release (LP: #1796139)
    - crypto: skcipher - Fix -Wstringop-truncation warnings
    - iio: adc: ina2xx: avoid kthread_stop() with stale task_struct
    - tsl2550: fix lux1_input error in low light
    - misc: ibmvmc: Use GFP_ATOMIC under spin lock
    - vmci: type promotion bug in qp_host_get_user_memory()
    - siox: don't create a thread without starting it
    - x86/numa_emulation: Fix emulated-to-physical node mapping
    - staging: rts5208: fix missing error check on call to rtsx_write_register
    - power: supply: axp288_charger: Fix initial constant_charge_current value
    - misc: sram: enable clock before registering regions
    - serial: sh-sci: Stop RX FIFO timer during port shutdown
    - uwb: hwa-rc: fix memory leak at probe
    - power: vexpress: fix corruption in notifier registration
    - iommu/amd: make sure TLB to be flushed before IOVA freed
    - Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
    - USB: serial: kobil_sct: fix modem-status error handling
    - 6lowpan: iphc: reset mac_header after decompress to fix panic
    - iommu/msm: Don't call iommu_device_{,un}link from atomic context
    - s390/mm: correct allocate_pgste proc_handler callback
    - power: remove possible deadlock when unregistering power_supply
    - drm/amd/display/dc/dce: Fix multiple potential integer overflows
    - drm/amd/display: fix use of uninitialized memory
    - md-cluster: clear another node's suspend_area after the copy is finished
    - cxgb4: Fix the condition to check if the card is T5
    - RDMA/bnxt_re: Fix a couple off by one bugs
    - RDMA/i40w: Hold read semaphore while looking after VMA
    - RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c
    - IB/core: type promotion bug in rdma_rw_init_one_mr()
    - media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
    - IB/mlx4: Test port number before querying type.
    - powerpc/kdump: Handle crashkernel memory reservation failure
    - media: fsl-viu: fix error handling in viu_of_probe()
    - vhost_net: Avoid tx vring kicks during busyloop
    - media: staging/imx: fill vb2_v4l2_buffer field entry
    - IB/mlx5: Fix GRE flow specification
    - include/rdma/opa_addr.h: Fix an endianness issue
    - x86/tsc: Add missing header to tsc_msr.c
    - ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled
    - x86/entry/64: Add two more instruction suffixes
    - ARM: dts: ls1021a: Add missing cooling device properties for CPUs
    - scsi: target/iscsi: Make iscsit_ta_authentication() respect the output
      buffer size
    - thermal: i.MX: Allow thermal probe to fail gracefully in case of bad
    - scsi: klist: Make it safe to use klists in atomic context
    - scsi: ibmvscsi: Improve strings handling
    - scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion
    - usb: wusbcore: security: cast sizeof to int for comparison
    - ath10k: sdio: use same endpoint id for all packets...

Changed in linux (Ubuntu Cosmic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers