Eoan update: upstream stable patchset 2020-02-06

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2020-02-06

                Ported from the following upstream stable releases:
                        v4.19.96, v5.4.12,
                        v4.19.97, v5.4.13

       from git://git.kernel.org/

chardev: Avoid potential use-after-free in 'chrdev_open()'
i2c: fix bus recovery stop mode timing
usb: chipidea: host: Disable port power only if previously enabled
ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
ALSA: hda/realtek - Add new codec supported for ALCS1200A
ALSA: hda/realtek - Set EAPD control to default for ALC222
ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen
kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
tracing: Change offset type to s32 in preempt/irq tracepoints
HID: Fix slab-out-of-bounds read in hid_field_extract
HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
HID: hid-input: clear unmapped usages
Input: add safety guards to input_set_keycode()
Input: input_event - fix struct padding on sparc64
drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model
drm/fb-helper: Round up bits_per_pixel if possible
drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
can: kvaser_usb: fix interface sanity check
can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
gpiolib: acpi: Add Terra Pad 1061 to the run_edge_events_on_boot_blacklist
gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
staging: vt6656: set usb_set_intfdata on driver fail.
USB: serial: option: add ZLP support for 0x1bc7/0x9010
usb: musb: fix idling for suspend after disconnect interrupt
usb: musb: Disable pullup at init
usb: musb: dma: Correct parameter passed to IRQ handler
staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
serdev: Don't claim unsupported ACPI serial devices
tty: link tty and port before configuring it as console
tty: always relink the port
mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
scsi: bfa: release allocated memory in case of error
rtl8xxxu: prevent leaking urb
HID: hiddev: fix mess in hiddev_open()
USB: Fix: Don't skip endpoint descriptors with maxpacket=0
phy: cpcap-usb: Fix error path when no host driver is loaded
phy: cpcap-usb: Fix flakey host idling and enumerating of devices
netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
netfilter: conntrack: dccp, sctp: handle null timeout argument
netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online()
tpm: Handle negative priv->response_len in tpm_common_read()
rtc: sun6i: Add support for RTC clocks on R40
drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl
drm/i915: Add Wa_1407352427:icl,ehl
IB/hfi1: Adjust flow PSN with the correct resync_psn
pstore/ram: Regularize prz label allocation lifetime
staging: vt6656: Fix non zero logical return of, usb_control_msg
usb: ohci-da8xx: ensure error return on variable error is set
USB-PD tcpm: bad warning+size, PPS adapters
staging: vt6656: correct return of vnt_init_registers.
staging: vt6656: limit reg output to block size
iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU
arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers
arm64: Implement copy_thread_tls
arm: Implement copy_thread_tls
parisc: Implement copy_thread_tls
riscv: Implement copy_thread_tls
xtensa: Implement copy_thread_tls
powerpc: convert to copy_thread_tls
clone3: ensure copy_thread_tls is implemented
um: Implement copy_thread_tls
staging: vt6656: remove bool from vnt_radio_power_on ret
rpmsg: char: release allocated memory
UBUNTU: upstream stable to v4.19.96, v5.4.12
hidraw: Return EPOLLOUT from hidraw_poll
HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
HID: hidraw, uhid: Always report EPOLLOUT
iwlwifi: dbg_ini: fix memory leak in alloc_sgtable
iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init
rtc: mt6397: fix alarm register overwrite
RDMA/bnxt_re: Avoid freeing MR resources if dereg fails
RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
ASoC: soc-core: Set dpcm_playback / dpcm_capture
ASoC: stm32: spdifrx: fix inconsistent lock state
ASoC: stm32: spdifrx: fix race condition in irq handler
mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy
gpio: zynq: Fix for bug in zynq_gpio_restore_context API
iommu: Remove device link to group on failure
gpio: Fix error message on out-of-range GPIO in lookup table
hsr: reset network header when supervision frame is created
s390/qeth: Fix vnicc_is_in_use if rx_bcast not set
cifs: Adjust indentation in smb2_open_file
afs: Fix missing cell comparison in afs_test_super()
btrfs: simplify inode locking for RWF_NOWAIT
RDMA/mlx5: Return proper error value
RDMA/srpt: Report the SCSI residual to the initiator
scsi: enclosure: Fix stale device oops with hot replug
scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI
platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0
platform/x86: GPD pocket fan: Use default values when wrong modparams are given
xprtrdma: Fix completion wait during device removal
crypto: virtio - implement missing support for output IVs
NFSv2: Fix a typo in encode_sattr()
NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn
iio: imu: adis16480: assign bias value only if operation succeeded
mei: fix modalias documentation
clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume
pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call
pinctrl: lewisburg: Update pin list according to v1.1v6
scsi: sd: enable compat ioctls for sed-opal
arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD
af_unix: add compat_ioctl support
compat_ioctl: handle SIOCOUTQNSD
PCI: dwc: Fix find_next_bit() usage
PCI/PTM: Remove spurious "d" from granularity message
powerpc/powernv: Disable native PCIe port management
tty: serial: imx: use the sg count from dma_map_sg
tty: serial: pch_uart: correct usage of dma_unmap_sg
media: ov6650: Fix incorrect use of JPEG colorspace
media: ov6650: Fix some format attributes not under control
media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
media: rcar-vin: Fix incorrect return statement in rvin_try_format()
media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()'
media: exynos4-is: Fix recursive locking in isp_video_release()
iommu/mediatek: Correct the flush_iotlb_all callback
mtd: spi-nor: fix silent truncation in spi_nor_read()
mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
spi: atmel: fix handling of cs_change set on non-last xfer
rtlwifi: Remove unnecessary NULL check in rtl_regd_init
f2fs: fix potential overflow
rtc: msm6242: Fix reading of 10-hour digit
rtc: brcmstb-waketimer: add missed clk_disable_unprepare
gpio: mpc8xxx: Add platform device to gpiochip->parent
scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
selftests: firmware: Fix it to do root uid check and skip
rseq/selftests: Turn off timeout setting
mips: cacheinfo: report shared CPU map
MIPS: Prevent link failure with kcov instrumentation
drm/arm/mali: make malidp_mw_connector_helper_funcs static
dmaengine: k3dma: Avoid null pointer traversal
ioat: ioat_alloc_ring() failure handling.
hexagon: parenthesize registers in asm predicates
hexagon: work around compiler crash
ocfs2: call journal flush to mark journal as empty after journal recovery when mount
phy: mapphone-mdm6600: Fix uninitialized status value regression
IB/hfi1: Don't cancel unused work item
mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus
i2c: bcm2835: Store pointer to bus clock
ASoC: stm32: spdifrx: fix input pin state management
pinctrl: lochnagar: select GPIOLIB
netfilter: nft_flow_offload: fix underflow in flowtable reference counter
pinctrl: meson: Fix wrong shift value when get drive-strength
selftests: loopback.sh: skip this test if the driver does not support
iommu/vt-d: Unlink device if failed to add to group
bpf: cgroup: prevent out-of-order release of cgroup bpf
fs: move guard_bio_eod() after bio_set_op_attrs
scsi: mpt3sas: Fix double free in attach error handling
PCI: amlogic: Fix probed clock names
drm/tegra: Fix ordering of cleanup code
hsr: add hsr root debugfs directory
hsr: rename debugfs file when interface name is changed
s390/qeth: fix qdio teardown after early init error
s390/qeth: vnicc Fix init to default
s390/qeth: fix initialization on old HW
scsi: smartpqi: Update attribute name to `driver_version`
MAINTAINERS: Append missed file to the database
dt-bindings: reset: Fix brcmstb-reset example
reset: brcmstb: Remove resource checks
perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description
syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0
syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn
syscalls/x86: Use the correct function type for sys_ni_syscall
syscalls/x86: Fix function types in COND_SYSCALL
hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()
netfilter: nf_tables_offload: release flow_rule on error from commit path
ASoC: dt-bindings: mt8183: add missing update
ASoC: simple_card_utils.h: Add missing include
ASoC: rsnd: fix DALIGN register for SSIU
RDMA/hns: remove a redundant le16_to_cpu
RDMA/hns: Modify return value of restrack functions
RDMA/counter: Prevent QP counter manual binding in auto mode
RDMA/siw: Fix port number endianness in a debug message
RDMA/hns: Fix build error again
UBUNTU: [Config] updateconfigs for INFINIBAND_HNS
RDMA/hns: Release qp resources when failed to destroy qp
xprtrdma: Add unique trace points for posting Local Invalidate WRs
xprtrdma: Connection becomes unstable after a reconnect
xprtrdma: Close window between waking RPC senders and posting Receives
RDMA/hns: Fix to support 64K page for srq
RDMA/hns: Bugfix for qpc/cqc timer configuration
rdma: Remove nes ABI header
uaccess: Add non-pagefault user-space write function
bpf: Make use of probe_user_write in probe write helper
bpf: skmsg, fix potential psock NULL pointer dereference
afs: Fix use-after-loss-of-ref
afs: Fix afs_lookup() to not clobber the version on a new dentry
keys: Fix request_key() cache
platform/mellanox: fix potential deadlock in the tmfifo driver
asm-generic/nds32: don't redefine cacheflush primitives
Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces
Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces
xprtrdma: Fix create_qp crash on device unload
dm: add dm-clone to the documentation index
scsi: ufs: Give an unique ID to each ufs-bsg
crypto: hisilicon - select NEED_SG_DMA_LENGTH in qm Kconfig
crypto: algif_skcipher - Use chunksize instead of blocksize
crypto: geode-aes - convert to skcipher API and make thread-safe
nfsd: v4 support requires CRYPTO_SHA256
NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()
clk: meson: axg-audio: fix regmap last register
clk: Fix memory leak in clk_unregister()
clk: imx: pll14xx: Fix quick switch of S/K parameter
affs: fix a memory leak in affs_remount
pinctrl: sh-pfc: Fix PINMUX_IPSR_PHYS() to set GPSR
pinctrl: sh-pfc: Do not use platform_get_irq() to count interrupts
PCI: aardvark: Use LTSSM state to build link training flag
PCI: aardvark: Fix PCI_EXP_RTCTL register configuration
PCI: Fix missing bridge dma_ranges resource list cleanup
PCI/PM: Clear PCIe PME Status even for legacy power management
tools: PCI: Fix fd leakage
MIPS: PCI: remember nasid changed by set interrupt affinity
MIPS: Loongson: Fix return value of loongson_hwmon_init
MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter
media: ov6650: Fix default format not applied on device probe
media: coda: fix deadlock between decoder picture run and start command
media: cedrus: Use correct H264 8x8 scaling list
media: aspeed-video: Fix memory leaks in aspeed_video_probe
ubifs: Fixed missed le64_to_cpu() in journal
ubifs: do_kill_orphans: Fix a memory leak bug
spi: sprd: Fix the incorrect SPI register
spi: pxa2xx: Set controller->max_transfer_size in dma mode
spi: lpspi: fix memory leak in fsl_lpspi_probe
iwlwifi: mvm: consider ieee80211 station max amsdu value
sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
NFSD fixing possible null pointer derefering in copy offload
rtc: bd70528: Add MODULE ALIAS to autoload module
scsi: target/iblock: Fix protection error with blocks greater than 512B
riscv: export flush_icache_all to modules
rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller
rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call()
rxrpc: Fix missing security check on incoming calls
s390/qeth: lock the card while changing its hsuid
drm/amdgpu: enable gfxoff for raven1 refresh
media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes
kbuild/deb-pkg: annotate libelf-dev dependency as :native
UBUNTU: upstream stable to v4.19.97, v5.4.13

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.3.0-42.34

---------------
linux (5.3.0-42.34) eoan; urgency=medium

  * eoan/linux: 5.3.0-42.34 -proposed tracker (LP: #1865111)

  * CVE-2020-2732
    - KVM: nVMX: Don't emulate instructions in guest mode
    - KVM: nVMX: Refactor IO bitmap checks into helper function
    - KVM: nVMX: Check IO instruction VM-exit conditions

linux (5.3.0-41.33) eoan; urgency=medium

  * eoan/linux: 5.3.0-41.33 -proposed tracker (LP: #1863294)

  * CVE-2019-3016
    - x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
    - x86/kvm: Introduce kvm_(un)map_gfn()
    - x86/kvm: Cache gfn to pfn translation
    - x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
    - x86/KVM: Clean up host's steal time structure

  * Reduce s2idle power consumption when ethernet cable is connected on e1000e
    (LP: #1859126)
    - e1000e: Add support for S0ix

  * alsa/sof: let legacy hda driver and sof driver co-exist (LP: #1837828)
    - ASoC: Intel: Skylake: move NHLT header to common directory
    - ALSA: hda: move parts of NHLT code to new module
    - ALSA: hda: intel-nhlt: handle NHLT VENDOR_DEFINED DMIC geometry
    - ASoC: Intel: Skylake: use common NHLT module
    - ALSA: hda/intel: stop probe if DMICS are detected on Skylake+ platforms
    - [Config] Enable SND_HDA_INTEL_DETECT_DMIC

  * USB key cannot be detected by hotplug on Sunix USB Type-A 3.1 Gen 2 card
    [1b21:2142] (LP: #1858988)
    - SAUCE: PCI: Avoid ASMedia XHCI USB PME# from D0 defect

  * ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
    (LP: #1860969)
    - vti[6]: fix packet tx through bpf_redirect()
    - xfrm interface: fix packet tx through bpf_redirect()

  * peripheral devices on Dell WD19TB cannot be detected after suspend resume
    (LP: #1859407)
    - PCI: irq: Introduce rearm_wake_irq()
    - ACPICA: Return u32 from acpi_dispatch_gpe()
    - ACPI: EC: Return bool from acpi_ec_dispatch_gpe()
    - ACPI: PM: Set s2idle_wakeup earlier and clear it later
    - PM: sleep: Simplify suspend-to-idle control flow
    - ACPI: EC: Rework flushing of pending work

  * Dell XPS 13 (7390) Display Flickering - 19.10 (LP: #1849947)
    - SAUCE: drm/i915: Disable PSR by default on all platforms

  * Root can lift kernel lockdown via USB/IP (LP: #1861238)
    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel
      lockdown"

  * [CML-H] Add intel_thermal_pch driver support Comet Lake -H (LP: #1853219)
    - thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support

  * Eoan update: upstream stable patchset 2020-02-07 (LP: #1862429)
    - ARM: dts: meson8: fix the size of the PMU registers
    - clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs
    - dt-bindings: reset: meson8b: fix duplicate reset IDs
    - ARM: dts: imx6q-dhcom: fix rtc compatible
    - clk: Don't try to enable critical clocks if prepare failed
    - ASoC: msm8916-wcd-digital: Reset RX interpolation path after use
    - iio: buffer: align the size of scan bytes to size of the largest element
    - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
    - USB: serial: option: Add support for Quec...