This bug was fixed in the package linux-ec2 - 2.6.32-318.38

---------------
linux-ec2 (2.6.32-318.38) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to 2.6.32-34.76
  * Release Tracking Bug
    - LP: #837804

  [ Ubuntu: 2.6.32-34.76 ]

  * Revert "drm/nv50-nvc0: work around an evo channel hang that some people
    see"
  * Revert "eCryptfs: Handle failed metadata read in lookup"
  * Revert "tunnels: fix netns vs proto registration ordering"

  [ Ubuntu: 2.6.32-34.75 ]

  * drm/i915: Remove BUG_ON from i915_gem_evict_something
    - LP: #828550

linux-ec2 (2.6.32-318.37) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Release Tracking Bug
    - LP: #829162
  * XEN: exec: delay address limit change until point of no return
    - LP: #802383
  * Rebased to 2.6.32-34.74

  [ Ubuntu: 2.6.32-34.74 ]

  * proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020

  [ Ubuntu: 2.6.32-34.73 ]

  * SAUCE: rtl8192se: Force a build for a 2.6/3.0 kernel
    - LP: #805494
  * [Config] Add enic/fnic to udebs
    - LP: #801610
  * tty: icount changeover for other main devices, CVE-2010-4076,
    CVE-2010-4077
    - LP: #720189
    - CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
    oops
    - LP: #795418
    - CVE-2011-1577
  * ftrace: Only update the function code on write to filter files
    - LP: #802383
  * kmemleak: Do not return a pointer to an object that kmemleak did not
    get
    - LP: #802383
  * CPU hotplug, re-create sysfs directory and symlinks
    - LP: #802383
  * Fix memory leak in cpufreq_stat
    - LP: #802383
  * powerpc/kexec: Fix memory corruption from unallocated slaves
    - LP: #802383
  * powerpc/oprofile: Handle events that raise an exception without
    overflowing
    - LP: #802383
  * mtd: mtdconcat: fix NAND OOB write
    - LP: #802383
  * x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address
    limit
    - LP: #802383
  * ext3: Fix fs corruption when make_indexed_dir() fails
    - LP: #802383
  * jbd: Fix forever sleeping process in do_get_write_access()
    - LP: #802383
  * jbd: fix fsync() tid wraparound bug
    - LP: #802383
  * ext4: release page cache in ext4_mb_load_buddy error path
    - LP: #802383
  * Fix Ultrastor asm snippet
    - LP: #802383
  * x86, amd: Do not enable ARAT feature on AMD processors below family
    0x12
    - LP: #802383
  * x86, amd: Use _safe() msr access for GartTlbWlk disable code
    - LP: #802383
  * rcu: Fix unpaired rcu_irq_enter() from locking selftests
    - LP: #802383
  * staging: usbip: fix wrong endian conversion
    - LP: #802383
  * Fix for buffer overflow in ldm_frag_add not sufficient
    - LP: #802383
  * seqlock: Don't smp_rmb in seqlock reader spin loop
    - LP: #802383
  * ALSA: HDA: Use one dmic only for Dell Studio 1558
    - LP: #731706, #802383
  * ASoC: Ensure output PGA is enabled for line outputs in wm_hubs
    - LP: #802383
  * ASoC: Add some missing volume update bit sets for wm_hubs devices
    - LP: #802383
  * mm/page_alloc.c: prevent unending loop in __alloc_pages_slowpath()
    - LP: #802383
  * loop: limit 'max_part' module param to DISK_MAX_PARTS
    - LP: #802383
  * loop: handle on-demand devices correctly
    - LP: #802383
  * USB: CP210x Add 4 Device IDs for AC-Services Devices
    - LP: #802383
  * USB: moto_modem: Add USB identifier for the Motorola VE240.
    - LP: #802383
  * USB: serial: ftdi_sio: adding support for TavIR STK500
    - LP: #802383
  * USB: gamin_gps: Fix for data transfer problems in native mode
    - LP: #802383
  * usb/gadget: at91sam9g20 fix end point max packet size
    - LP: #802383
  * usb: gadget: rndis: don't test against req->length
    - LP: #802383
  * OHCI: fix regression caused by nVidia shutdown workaround
    - LP: #802383
  * p54usb: add zoom 4410 usbid
    - LP: #802383
  * eCryptfs: Allow 2 scatterlist entries for encrypted filenames
    - LP: #802383
  * UBIFS: fix a rare memory leak in ro to rw remounting path
    - LP: #802383
  * i8k: Avoid lahf in 64-bit code
    - LP: #802383
  * cpuidle: menu: fixed wrapping timers at 4.294 seconds
    - LP: #802383
  * dm table: reject devices without request fns
    - LP: #802383
  * atm: expose ATM device index in sysfs
    - LP: #802383
  * brd: limit 'max_part' module param to DISK_MAX_PARTS
    - LP: #802383
  * brd: handle on-demand devices correctly
    - LP: #802383
  * SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change
    callback...
    - LP: #802383
  * PCI: Add quirk for setting valid class for TI816X Endpoint
    - LP: #802383
  * xen mmu: fix a race window causing leave_mm BUG()
    - LP: #802383
  * netfilter: nf_conntrack_reasm: properly handle packets fragmented into
    a single fragment
    - LP: #802383
  * fix memory leak in scsi_report_lun_scan
    - LP: #802383
  * fix refcounting bug in scsi_get_host_dev
    - LP: #802383
  * fix duplicate removal on error path in scsi_sysfs_add_sdev
    - LP: #802383
  * UBIFS: fix shrinker object count reports
    - LP: #802383
  * UBIFS: fix memory leak on error path
    - LP: #802383
  * nbd: limit module parameters to a sane value
    - LP: #802383
  * mm: fix ENOSPC returned by handle_mm_fault()
    - LP: #802383
  * PCI: Set PCIE maxpayload for card during hotplug insertion
    - LP: #802383
  * nl80211: fix check for valid SSID size in scan operations
    - LP: #802383
  * lockdep: Fix lock_is_held() on recursion
    - LP: #802383
  * drm/i915: Add a no lvds quirk for the Asus EeeBox PC EB1007
    - LP: #802383
  * drm/radeon/kms: fix for radeon on systems >4GB without hardware iommu
    - LP: #802383
  * fat: Fix corrupt inode flags when remove ATTR_SYS flag
    - LP: #802383
  * xen: off by one errors in multicalls.c
    - LP: #802383
  * x86/amd-iommu: Fix 3 possible endless loops
    - LP: #802383
  * USB: cdc-acm: Adding second ACM channel support for Nokia E7 and C7
    - LP: #802383
  * USB: core: Tolerate protocol stall during hub and port status read
    - LP: #802383
  * USB: serial: add another 4N-GALAXY.DE PID to ftdi_sio driver
    - LP: #802383
  * ALSA: hda: Fix quirk for Dell Inspiron 910
    - LP: #792712, #802383
  * oprofile, dcookies: Fix possible circular locking dependency
    - LP: #802383
  * CPUFREQ: Remove cpufreq_stats sysfs entries on module unload.
    - LP: #802383
  * md: check ->hot_remove_disk when removing disk
    - LP: #802383
  * md/raid5: fix raid5_set_bi_hw_segments
    - LP: #802383
  * md/raid5: fix FUA request handling in ops_run_io()
    - LP: #802383
  * ata: use pci_dev->revision
    - LP: #802383
  * pata_cmd64x: fix PIO setup
    - LP: #802383
  * pata_cmd64x: cmd648_bmdma_stop() fix
    - LP: #802383
  * pata_cmd64x: remove unused definitions
    - LP: #802383
  * pata_cm64x: fix boot crash on parisc
    - LP: #802383
  * ACPI: use _HID when supplied by root-level devices
    - LP: #802383
  * xfs: properly account for reclaimed inodes
    - LP: #802383
  * exec: delay address limit change until point of no return
    - LP: #802383
  * netfilter: IPv6: initialize TOS field in REJECT target module
    - LP: #802383
  * netfilter: IPv6: fix DSCP mangle code
    - LP: #802383
  * genirq: Add IRQF_FORCE_RESUME
    - LP: #802383
  * xen: Use IRQF_FORCE_RESUME
    - LP: #802383
  * time: Compensate for rounding on odd-frequency clocksources
    - LP: #802383
  * Linux 2.6.32.42
    - LP: #802383
  * taskstats: don't allow duplicate entries in listener mode,
    CVE-2011-2484
    - LP: #806390
    - CVE-2011-2484
  * drm_mm: extract check_free_mm_node
    - LP: #599017, #807508
  * drm: implement helper functions for scanning lru list
    - LP: #599017, #807508
  * drm/i915: prepare for fair lru eviction
    - LP: #599017, #807508
  * drm/i915: Move the eviction logic to its own file.
    - LP: #599017, #807508
  * drm/i915: Implement fair lru eviction across both rings. (v2)
    - LP: #599017, #807508
  * drm/i915: Maintain LRU order of inactive objects upon access by CPU
    (v2)
    - LP: #599017, #807508
  * drm/i915/evict: Ensure we completely cleanup on failure
    - LP: #599017, #807508
  * drm/i915: Periodically flush the active lists and requests
    - LP: #599017, #807508
  * Linux 2.6.32.42+drm33.19
    - LP: #807508
  * net: add limit for socket backlog CVE-2010-4251
    - LP: #807462
  * tcp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * ipv6: udp: Optimise multicast reception
    - LP: #807462
  * ipv4: udp: Optimise multicast reception
    - LP: #807462
  * udp: multicast RX should increment SNMP/sk_drops counter in allocation
    failures CVE-2010-4251
    - LP: #807462
  * udp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * llc: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * sctp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * tipc: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * x25: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * net: backlog functions rename CVE-2010-4251
    - LP: #807462
  * net: sk_add_backlog() take rmem_alloc into account CVE-2010-4805
    - LP: #809318
  * ksm: fix NULL pointer dereference in scan_get_next_rmap_item()
    - LP: #810425
  * migrate: don't account swapcache as shmem
    - LP: #810425
  * clocksource: Make watchdog robust vs. interruption
    - LP: #810425
  * TTY: ldisc, do not close until there are readers
    - LP: #810425
  * xhci: Reject double add of active endpoints.
    - LP: #810425
  * PM: Free memory bitmaps if opening /dev/snapshot fails
    - LP: #810425
  * ath5k: fix memory leak when fewer than N_PD_CURVES are in use
    - LP: #810425
  * mm: fix negative commitlimit when gigantic hugepages are allocated
    - LP: #810425
  * uvcvideo: Remove buffers from the queues when freeing
    - LP: #810425
  * watchdog: mtx1-wdt: request gpio before using it
    - LP: #810425
  * debugobjects: Fix boot crash when kmemleak and debugobjects enabled
    - LP: #810425
  * cfq-iosched: fix locking around ioc->ioc_data assignment
    - LP: #810425
  * cfq-iosched: fix a rcu warning
    - LP: #810425
  * i2c-taos-evm: Fix log messages
    - LP: #810425
  * md: avoid endless recovery loop when waiting for fail device to
    complete.
    - LP: #810425
  * SUNRPC: Ensure the RPC client only quits on fatal signals
    - LP: #810425
  * 6pack,mkiss: fix lock inconsistency
    - LP: #810425
  * USB: don't let errors prevent system sleep
    - LP: #810425
  * USB: don't let the hub driver prevent system sleep
    - LP: #810425
  * uml: fix CONFIG_STATIC_LINK=y build failure with newer glibc
    - LP: #810425
  * um: os-linux/mem.c needs sys/stat.h
    - LP: #810425
  * inet_diag: fix inet_diag_bc_audit()
    - LP: #810425
  * PM / Hibernate: Avoid hitting OOM during preallocation of memory
    - LP: #810425
  * PM / Hibernate: Fix free_unnecessary_pages()
    - LP: #810425
  * bug.h: Add WARN_RATELIMIT
    - LP: #810425
  * net: filter: Use WARN_RATELIMIT
    - LP: #810425
  * af_packet: prevent information leak
    - LP: #810425
  * net/ipv4: Check for mistakenly passed in non-IPv4 address
    - LP: #810425
  * ipv6/udp: Use the correct variable to determine non-blocking condition
    - LP: #810425
  * udp/recvmsg: Clear MSG_TRUNC flag when starting over for a new packet
    - LP: #810425
  * mm: prevent concurrent unmap_mapping_range() on the same inode
    - LP: #810425
  * xen: set max_pfn_mapped to the last pfn mapped
    - LP: #810425
  * xen: partially revert "xen: set max_pfn_mapped to the last pfn mapped"
    - LP: #810425
  * Linux 2.6.32.43
    - LP: #810425
  * eCryptfs: Handle failed metadata read in lookup
    - LP: #509180
  * pagemap: close races with suid execve, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * report errors in /proc/*/*map* sanely, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * close race in /proc/*/environ, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * auxv: require the target to be tracable (or yourself), CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC, CVE-2011-1493
    - LP: #816550
    - CVE-2011-1493
  * rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493
    - LP: #816550
    - CVE-2011-1493
  * Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.
    - LP: #819569
    - CVE-2011-2492
  * drm/nv50-nvc0: work around an evo channel hang that some people see
    - LP: #583760
  * ASoC: Fix Blackfin I2S _pointer() implementation return in bounds
    values
    - LP: #823296
  * v4l2-ioctl.c: prefill tuner type for g_frequency and g/s_tuner
    - LP: #823296
  * pvrusb2: fix g/s_tuner support
    - LP: #823296
  * bttv: fix s_tuner for radio
    - LP: #823296
  * gro: Only reset frag0 when skb can be pulled
    - LP: #823296
  * NFSv4.1: update nfs4_fattr_bitmap_maxsz
    - LP: #823296
  * SUNRPC: Fix a race between work-queue and rpc_killall_tasks
    - LP: #823296
  * SUNRPC: Fix use of static variable in rpcb_getport_async
    - LP: #823296
  * si4713-i2c: avoid potential buffer overflow on si4713
    - LP: #823296
  * hwmon: (max1111) Fix race condition causing NULL pointer exception
    - LP: #823296
  * bridge: send proper message_age in config BPDU
    - LP: #823296
  * davinci: DM365 EVM: fix video input mux bits
    - LP: #823296
  * libata: fix unexpectedly frozen port after ata_eh_reset()
    - LP: #823296
  * x86: Make Dell Latitude E5420 use reboot=pci
    - LP: #823296
  * USB: pl2303: add AdLink ND-6530 USB IDs
    - LP: #823296
  * USB: pl2303.h: checkpatch cleanups
    - LP: #823296
  * USB: serial: add IDs for WinChipHead USB->RS232 adapter
    - LP: #823296
  * staging: comedi: fix infoleak to userspace
    - LP: #823296
  * USB: OHCI: fix another regression for NVIDIA controllers
    - LP: #823296
  * usb: musb: restore INDEX register in resume path
    - LP: #823296
  * USB: dummy-hcd needs the has_tt flag
    - LP: #823296
  * ARM: pxa/cm-x300: fix V3020 RTC functionality
    - LP: #823296
  * jme: Fix unmap error (Causing system freeze)
    - LP: #823296
  * libsas: remove expander from dev list on error
    - LP: #823296
  * mac80211: Restart STA timers only on associated state
    - LP: #823296
  * Blacklist Traxdata CDR4120 and IOMEGA Zip drive to avoid lock ups.
    - LP: #823296
  * ses: requesting a fault indication
    - LP: #823296
  * pmcraid: reject negative request size
    - LP: #823296
  * kexec, x86: Fix incorrect jump back address if not preserving context
    - LP: #823296
  * powerpc/kdump: Fix timeout in crash_kexec_wait_realmode
    - LP: #823296
  * PCI: ARI is a PCIe v2 feature
    - LP: #823296
  * cciss: do not attempt to read from a write-only register
    - LP: #823296
  * xtensa: prevent arbitrary read in ptrace
    - LP: #823296
  * ext3: Fix oops in ext3_try_to_allocate_with_rsv()
    - LP: #823296
  * svcrpc: fix list-corrupting race on nfsd shutdown
    - LP: #823296
  * EHCI: only power off port if over-current is active
    - LP: #823296
  * EHCI: fix direction handling for interrupt data toggles
    - LP: #823296
  * powerpc/pseries/hvconsole: Fix dropped console output
    - LP: #823296
  * x86: Hpet: Avoid the comparator readback penalty
    - LP: #823296
  * x86: HPET: Chose a paranoid safe value for the ETIME check
    - LP: #823296
  * cifs: clean up cifs_find_smb_ses (try #2)
    - LP: #823296
  * cifs: fix NULL pointer dereference in cifs_find_smb_ses
    - LP: #823296
  * cifs: check for NULL session password
    - LP: #823296
  * gre: fix netns vs proto registration ordering
    - LP: #823296
  * netns xfrm: fixup xfrm6_tunnel error propagation
    - LP: #823296
  * tunnels: fix netns vs proto registration ordering
    - LP: #823296
  * alpha: fix several security issues
    - LP: #823296
  * proc: restrict access to /proc/PID/io
    - LP: #823296
  * ALSA: sound/core/pcm_compat.c: adjust array index
    - LP: #823296
  * dm mpath: fix potential NULL pointer in feature arg processing
    - LP: #823296
  * dm: fix idr leak on module removal
    - LP: #823296
  * perf: overflow/perf_count_sw_cpu_clock crashes recent kernels
    - LP: #823296
  * atm: [br2684] allow routed mode operation again
    - LP: #823296
  * Linux 2.6.32.44
    - LP: #823296

  [ Ubuntu: 2.6.32-33.72 ]

  * Revert "fix oops in scsi_run_queue()"
    - LP: #811745
  * Revert "put stricter guards on queue dead checks"
    - LP: #811745

  [ Ubuntu: 2.6.32-33.71 ]

  * splice: direct_splice_actor() should not use pos in sd
    - LP: #588861
 -- Stefan Bader <email address hidden>   Thu, 01 Sep 2011 16:20:32 +0200