This bug was fixed in the package linux - 2.6.32-32.62 --------------- linux (2.6.32-32.62) lucid-proposed; urgency=low [ Brad Figg ] * Release Tracking Bug - LP: #767370 [ Stefan Bader ] * (config) Disable CONFIG_NET_NS - LP: #720095 [ Upstream Kernel Changes ] * Revert "drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once." - LP: #736234 * Revert "drm/radeon: fall back to GTT if bo creation/validation in VRAM fails." - LP: #736234 * x86: pvclock: Move scale_delta into common header * KVM: x86: Fix a possible backwards warp of kvmclock * KVM: x86: Fix kvmclock bug * cpuset: add a missing unlock in cpuset_write_resmask() - LP: #736234 * keyboard: integer underflow bug - LP: #736234 * RxRPC: Fix v1 keys - LP: #736234 * ixgbe: fix for 82599 erratum on Header Splitting - LP: #736234 * mm: fix possible cause of a page_mapped BUG - LP: #736234 * powerpc/kdump: CPUs assume the context of the oopsing CPU - LP: #736234 * powerpc/kdump: Use chip->shutdown to disable IRQs - LP: #736234 * powerpc: Use more accurate limit for first segment memory allocations - LP: #736234 * powerpc/pseries: Add hcall to read 4 ptes at a time in real mode - LP: #736234 * powerpc/kexec: Speedup kexec hash PTE tear down - LP: #736234 * powerpc/crashdump: Do not fail on NULL pointer dereferencing - LP: #736234 * powerpc/kexec: Fix orphaned offline CPUs across kexec - LP: #736234 * netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values - LP: #736234 * nfsd: wrong index used in inner loop - LP: #736234 * r8169: use RxFIFO overflow workaround for 8168c chipset. - LP: #736234 * Staging: comedi: jr3_pci: Don't ioremap too much space. Check result. - LP: #736234 * net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules, CVE-2011-1019 - LP: #736234 - CVE-2011-1019 * ip6ip6: autoload ip6 tunnel - LP: #736234 * Linux 2.6.32.33 - LP: #736234 * drm/radeon: fall back to GTT if bo creation/validation in VRAM fails. - LP: #652934, #736234 * drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once. - LP: #652934, #736234 * drm: fix unsigned vs signed comparison issue in modeset ctl ioctl, CVE-2011-1013 - LP: #736234 - CVE-2011-1013 * Linux 2.6.32.33+drm33.15 - LP: #736234 * econet: Fix crash in aun_incoming(). CVE-2010-4342 - LP: #736394 - CVE-2010-4342 * igb: only use vlan_gro_receive if vlans are registered, CVE-2010-4263 - LP: #737024 - CVE-2010-4263 * irda: prevent integer underflow in IRLMP_ENUMDEVICES, CVE-2010-4529 - LP: #737823 - CVE-2010-4529 * hwmon/f71882fg: Set platform drvdata to NULL later - LP: #742056 * mtd: add "platform:" prefix for platform modalias - LP: #742056 * libata: no special completion processing for EH commands - LP: #742056 * MIPS: MTX-1: Make au1000_eth probe all PHY addresses - LP: #742056 * x86/mm: Handle mm_fault_error() in kernel space - LP: #742056 * ftrace: Fix memory leak with function graph and cpu hotplug - LP: #742056 * x86: Fix panic when handling "mem={invalid}" param - LP: #553464, #742056 * x86: Emit "mem=nopentium ignored" warning when not supported - LP: #553464, #742056 * ahci: AHCI and RAID mode SATA patch for Intel Patsburg DeviceIDs - LP: #742056 * ahci: AHCI mode SATA patch for Intel DH89xxCC DeviceIDs - LP: #742056 * ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller - LP: #742056 * RDMA/cma: Fix crash in request handlers - LP: #742056 * IB/cm: Bump reference count on cm_id before invoking callback - LP: #742056 * ath9k_hw: Fix incorrect macversion and macrev checks - LP: #742056 * USB: serial/kobil_sct, fix potential tty NULL dereference - LP: #742056 * USB: serial: ch341: add new id - LP: #742056 * xhci: Fix cycle bit calculation during stall handling. - LP: #742056 * ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs - LP: #742056 * PCI: remove quirk for pre-production systems - LP: #742056 * PCI: add more checking to ICH region quirks - LP: #742056 * PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH - LP: #742056 * PCI: sysfs: Fix failure path for addition of "vpd" attribute - LP: #742056 * ALSA: ctxfi - Fix incorrect SPDIF status bit mask - LP: #742056 * ALSA: ctxfi - Fix SPDIF status retrieval - LP: #742056 * ALSA: ctxfi - Clear input settings before initialization - LP: #742056 * SUNRPC: Ensure we always run the tk_callback before tk_action - LP: #742056 * perf, powerpc: Handle events that raise an exception without overflowing - LP: #742056 * ext3: Always set dx_node's fake_dirent explicitly. - LP: #742056 * call_function_many: fix list delete vs add race - LP: #742056 * call_function_many: add missing ordering - LP: #742056 * x86: Flush TLB if PGD entry is changed in i386 PAE mode - LP: #742056 * isdn: avoid calling tty_ldisc_flush() in atomic context - LP: #742056 * smp_call_function_many: handle concurrent clearing of mask - LP: #742056 * fix per-cpu flag problem in the cpu affinity checkers - LP: #742056 * i2c: Fix typo in instantiating-devices document - LP: #742056 * mmc: sdio: remember new card RCA when redetecting card - LP: #742056 * powerpc/kexec: Fix race in kexec shutdown - LP: #742056 * powerpc/kdump: Fix race in kdump shutdown - LP: #742056 * powerpc: rtas_flash needs to use rtas_data_buf - LP: #742056 * x86, binutils, xen: Fix another wrong size directive - LP: #742056 * hwmon: (sht15) Fix integer overflow in humidity calculation - LP: #742056 * Linux 2.6.32.34 - LP: #742056 * Linux 2.6.32.35 - LP: #742056 * aio: wake all waiters when destroying ctx - LP: #744921 * shmem: let shared anonymous be nonlinear again - LP: #744921 * PCI hotplug: acpiphp: set current_state to D0 in register_slot - LP: #744921 * xen: set max_pfn_mapped to the last pfn mapped - LP: #744921 * PCI: return correct value when writing to the "reset" attribute - LP: #744921 * Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code - LP: #744921 * ext3: skip orphan cleanup on rocompat fs - LP: #744921 * procfs: fix /proc//maps heap check - LP: #744921 * proc: protect mm start_code/end_code in /proc/pid/stat, CVE-2011-0726 - LP: #744921 - CVE-2011-0726 * fbcon: Bugfix soft cursor detection in Tile Blitting - LP: #744921 * nfsd41: modify the members value of nfsd4_op_flags - LP: #744921 * nfsd: wrong index used in inner loop - LP: #744921 * uvcvideo: Fix uvc_fixup_video_ctrl() format search - LP: #744921 * ehci-hcd: Bug fix: don't set a QH's Halt bit - LP: #744921 * USB: uss720 fixup refcount position - LP: #744921 * USB: cdc-acm: fix memory corruption / panic - LP: #744921 * USB: cdc-acm: fix potential null-pointer dereference - LP: #744921 * USB: cdc-acm: fix potential null-pointer dereference on disconnect - LP: #744921 * Input: xen-kbdfront - advertise either absolute or relative coordinates - LP: #744921 * SUNRPC: Never reuse the socket port after an xs_close() - LP: #744921 * fs: call security_d_instantiate in d_obtain_alias V2 - LP: #744921 * dcdbas: force SMI to happen when expected - LP: #744921 * Linux 2.6.32.36 - LP: #744921 * drm/radeon/kms: check AA resolve registers on r300, CVE-2011-1016 - LP: #745686 - CVE-2011-1016 * drm/radeon: fix regression with AA resolve checking, CVE-2011-1016 - LP: #745686 - CVE-2011-1016 * xen: events: do not unmask event channels on resume - LP: #681083 * drm/radeon/kms: check AA resolve registers on r300 - LP: #754584 * drm/radeon: fix regression with AA resolve checking - LP: #754584 * Linux 2.6.32.36+drm33.16 - LP: #754584 * ALSA: hda - Fix SPDIF out regression on ALC889 - LP: #764685 * ALSA: Fix yet another race in disconnection - LP: #764685 * perf: Better fit max unprivileged mlock pages for tools needs - LP: #764685 * myri10ge: fix rmmod crash - LP: #764685 * cciss: fix lost command issue - LP: #764685 * sound/oss/opl3: validate voice and channel indexes - LP: #764685 * mac80211: initialize sta->last_rx in sta_info_alloc - LP: #764685 * ses: show devices for enclosures with no page 7 - LP: #764685 * ses: Avoid kernel panic when lun 0 is not mapped - LP: #764685 * eCryptfs: Unlock page in write_begin error path - LP: #764685 * eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix - LP: #764685 * staging: usbip: bugfixes related to kthread conversion - LP: #764685 * staging: usbip: bugfix add number of packets for isochronous frames - LP: #764685 * staging: usbip: bugfix for isochronous packets and optimization - LP: #764685 * staging: hv: Fix GARP not sent after Quick Migration - LP: #764685 * staging: hv: use sync_bitops when interacting with the hypervisor - LP: #764685 * Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo - LP: #764685 * xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 - LP: #764685 * irda: validate peer name and attribute lengths - LP: #764685 * irda: prevent heap corruption on invalid nickname - LP: #764685 * nilfs2: fix data loss in mmap page write for hole blocks - LP: #764685 * ASoC: Explicitly say registerless widgets have no register - LP: #764685 * ALSA: ens1371: fix Creative Ectiva support - LP: #764685 * ROSE: prevent heap corruption with bad facilities - LP: #764685 * Btrfs: Fix uninitialized root flags for subvolumes - LP: #764685 * x86, mtrr, pat: Fix one cpu getting out of sync during resume - LP: #764685 * ath9k: fix a chip wakeup related crash in ath9k_start - LP: #764685 * UBIFS: do not read flash unnecessarily - LP: #764685 * UBIFS: fix oops on error path in read_pnode - LP: #764685 * UBIFS: fix debugging failure in dbg_check_space_info - LP: #764685 * quota: Don't write quota info in dquot_commit() - LP: #764685 * mm: avoid wrapping vm_pgoff in mremap() - LP: #764685 * p54usb: IDs for two new devices - LP: #764685 * b43: allocate receive buffers big enough for max frame len + offset - LP: #764685 * Bluetooth: sco: fix information leak to userspace - LP: #764685 * bridge: netfilter: fix information leak - LP: #764685 * Bluetooth: bnep: fix buffer overflow - LP: #764685 * Bluetooth: add support for Apple MacBook Pro 8,2 - LP: #764685 * Treat writes as new when holes span across page boundaries - LP: #764685 * char/tpm: Fix unitialized usage of data buffer - LP: #764685 * netfilter: ip_tables: fix infoleak to userspace - LP: #764685 * netfilter: arp_tables: fix infoleak to userspace - LP: #764685 * netfilter: ipt_CLUSTERIP: fix buffer overflow - LP: #764685 * ipv6: netfilter: ip6_tables: fix infoleak to userspace - LP: #764685 * mfd: ab3100: world-writable debugfs *_priv files - LP: #764685 * drivers/rtc/rtc-ds1511.c: world-writable sysfs nvram file - LP: #764685 * drivers/misc/ep93xx_pwm.c: world-writable sysfs files - LP: #764685 * econet: 4 byte infoleak to the network - LP: #764685 * sound/oss: remove offset from load_patch callbacks - LP: #764685 * sound: oss: midi_synth: check get_user() return value - LP: #764685 * repair gdbstub to match the gdbserial protocol specification - LP: #764685 * gro: Reset dev pointer on reuse - LP: #764685 * gro: reset skb_iif on reuse - LP: #764685 * x86, amd-ucode: Remove needless log messages - LP: #764685 * x86, microcode, AMD: Extend ucode size verification - LP: #764685 * powerpc/kexec: Add ifdef CONFIG_PPC_STD_MMU_64 to PPC64 code - LP: #764685 * powerpc: Fix default_machine_crash_shutdown #ifdef botch - LP: #764685 * Squashfs: handle corruption of directory structure - LP: #764685 * sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set - LP: #764685 * atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump - LP: #764685 * ext4: fix credits computing for indirect mapped files - LP: #764685 * nfsd: fix auth_domain reference leak on nlm operations - LP: #764685 * CAN: Use inode instead of kernel address for /proc file - LP: #764685 * exec: make argv/envp memory visible to oom-killer - LP: #764685 * exec: copy-and-paste the fixes into compat_do_execve() paths - LP: #764685 * xfs: zero proper structure size for geometry calls - LP: #764685 * Linux 2.6.32.37 - LP: #764685 * Linux 2.6.32.38 - LP: #764685 -- Brad Figg