SRU Justification/Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from Linus' tree or in a minimally backported form of that patch. The 2.6.31.6 upstream stable patch set is now available. It should be included in the Ubuntu kernel as well.
The 2.6.31.6 Upstream Stable Kernel brings in the following 101 patches:
* fs: pipe.c null pointer dereference
* pci: increase alignment to make more space for hidden code
* libata: fix internal command failure handling
* libata: fix PMP initialization
* sata_nv: make sure link is brough up online when skipping hardreset
* nfs: Fix nfs_parse_mount_options() kfree() leak
* KVM: use proper hrtimer function to retrieve expiration time
* KVM: ignore reads from AMDs C1E enabled MSR
* futex: Handle spurious wake up
* futex: Check for NULL keys in match_futex
* futex: Move drop_futex_key_refs out of spinlock'ed region
* futex: Fix spurious wakeup for requeue_pi really
* ahci: revert "Restore SB600 sata controller 64 bit DMA"
* sparc64: Set IRQF_DISABLED on LDC channel IRQs.
* sparc: Kill PROM console driver.
* watchdog: Fix rio watchdog probe function
* Input: synaptics - add another Protege M300 to rate blacklist
* dm snapshot: free exception store on init failure
* dm snapshot: sort by chunk size to fix race
* dm log: userspace fix incorrect luid cast in userspace_ctr
* dm: add missing del_gendisk to alloc_dev error path
* dm: dec_pending needs locking to save error value
* dm exception store: fix failed set_chunk_size error path
* dm snapshot: lock snapshot while supplying status
* dm snapshot: require non zero chunk size by end of ctr
* dm snapshot: use unsigned integer chunk size
* ray_cs: Fix copy_from_user handling
* mbind(): fix leak of never putback pages
* do_mbind(): fix memory leak
* 8250_pci: add IBM Saturn serial card
* dpt_i2o: Fix up copy*user
* dpt_i2o: Fix typo of EINVAL
* hfsplus: refuse to mount volumes larger than 2TB
* Driver core: fix driver_register() return value
* tty: Mark generic_serial users as BROKEN
* param: fix lots of bugs with writing charp params from sysfs, by leaking mem.
* param: fix NULL comparison on oom
* param: fix setting arrays of bool
* USB: serial: sierra driver send_setup() autopm fix
* USB: option: Patch for Huawei Mobile Broadband E270+ Modem
* USB: option: Support for AIRPLUS MCD650 Datacard
* USB: option: TLAYTECH TUE800 support
* libertas if_usb: Fix crash on 64-bit machines
* cpuidle: always return with interrupts enabled
* virtio: order used ring after used index read
* CIFS: Fixing to avoid invalid kfree() in cifs_get_tcp_session()
* mac80211: fix for incorrect sequence number on hostapd injected frames
* mac80211: check interface is down before type change
* x86, UV: Fix information in __uv_hub_info structure
* x86, UV: Set DELIVERY_MODE=4 for vector=NMI_VECTOR in uv_hub_send_ipi()
* NOMMU: Don't pass NULL pointers to fput() in do_mmap_pgoff()
* mm: remove incorrect swap_count() from try_to_unuse()
* x86-64: Fix register leak in 32-bit syscall audting
* nilfs2: fix dirty page accounting leak causing hang at write
* drm/i915: Fix FDI M/N setting according with correct color depth
* drm/i915: fix to setup display reference clock control on Ironlake
* drm/i915: fix panel fitting filter coefficient select for Ironlake
* agp/intel: Add B43 chipset support
* drm/i915: add B43 chipset support
* xen/hvc: make sure console output is always emitted, with explicit polling
* xen: mask extended topology info in cpuid
* sgi-gru: decrapfiy options_write() function
* KVM: get_tss_base_addr() should return a gpa_t
* fuse: prevent fuse_put_request on invalid pointer
* fuse: fix kunmap in fuse_ioctl_copy_user
* x86/amd-iommu: Workaround for erratum 63
* fsnotify: do not set group for a mark before it is on the i_list
* mips: fix build of vmlinux.lds
* alpha: fix build after vmlinux.lds.S cleanup
* ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci_dev() (rev. 2)
* Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"
* KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases
* b43: Fix Bugzilla #14181 and the bug from the previous 'fix'
* pata_sc1200: Fix crash on boot
* AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621)
* ALSA: ice1724 - Make call to set hw params succeed on ESI Juli@
* bonding: fix a race condition in calls to slave MII ioctls
* hwmon: (it87) Fix VID reading on IT8718F/IT8720F
* netlink: fix typo in initialization (CVE-2009-3612)
* nfs: Avoid overrun when copying client IP address string
* nfs: Panic when commit fails
* NFSv4: Fix a bug when the server returns NFS4ERR_RESOURCE
* NFSv4: Fix two unbalanced put_rpccred() issues.
* NFSv4: Kill nfs4_renewd_prepare_shutdown()
* NFSv4: The link() operation should return any delegation on the file
* powerpc: Remove SMP warning from PowerMac cpufreq
* vmscan: limit VM_EXEC protection to file pages
* x86: mce: Clean up thermal throttling state tracking code
* x86: mce: Fix thermal throttling message storm
* iwlwifi: fix potential rx buffer loss
* iwlwifi: reduce noise when skb allocation fails
* x86/amd-iommu: Un__init function required on shutdown
* KVM: Prevent kvm_init from corrupting debugfs structures
* powerpc/pmac: Fix PowerSurge SMP IPI allocation
* powerpc/pmac: Fix issues with sleep on some powerbooks
* powerpc/pci: Fix regression in powerpc MSI-X
* powerpc: Fix some late PowerMac G5 with PCIe ATI graphics
* sata_via: Remove redundant device ID for VIA VT8261
* pata_via: extend the rev_max for VT6330
* PM / yenta: Split resume into early and late parts (rev. 4)
* Linux 2.6.31.6
==========
Fixes Bug 327499: "Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"
Fixes Bug 456264: " USB: option: TLAYTECH TUE800 support"
Fixes Bug 476154: "b43: Fix Bugzilla #14181 and the bug from the previous 'fix'"
SRU Justification/ Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from Linus' tree or in a minimally backported form of that patch. The 2.6.31.6 upstream stable patch set is now available. It should be included in the Ubuntu kernel as well.
TEST CASE: TBD
http:// kernel. org/pub/ linux/kernel/ v2.6/ChangeLog- 2.6.31. 6
http:// kernel. org/pub/ linux/kernel/ v2.6/patch- 2.6.31. 6.bz2
==========
The 2.6.31.6 Upstream Stable Kernel brings in the following 101 patches:
* fs: pipe.c null pointer dereference mount_options( ) kfree() leak tcp_session( ) copy_user on_keyring( ) should inc the keyring refcount in all cases prepare_ shutdown( )
* pci: increase alignment to make more space for hidden code
* libata: fix internal command failure handling
* libata: fix PMP initialization
* sata_nv: make sure link is brough up online when skipping hardreset
* nfs: Fix nfs_parse_
* KVM: use proper hrtimer function to retrieve expiration time
* KVM: ignore reads from AMDs C1E enabled MSR
* futex: Handle spurious wake up
* futex: Check for NULL keys in match_futex
* futex: Move drop_futex_key_refs out of spinlock'ed region
* futex: Fix spurious wakeup for requeue_pi really
* ahci: revert "Restore SB600 sata controller 64 bit DMA"
* sparc64: Set IRQF_DISABLED on LDC channel IRQs.
* sparc: Kill PROM console driver.
* watchdog: Fix rio watchdog probe function
* Input: synaptics - add another Protege M300 to rate blacklist
* dm snapshot: free exception store on init failure
* dm snapshot: sort by chunk size to fix race
* dm log: userspace fix incorrect luid cast in userspace_ctr
* dm: add missing del_gendisk to alloc_dev error path
* dm: dec_pending needs locking to save error value
* dm exception store: fix failed set_chunk_size error path
* dm snapshot: lock snapshot while supplying status
* dm snapshot: require non zero chunk size by end of ctr
* dm snapshot: use unsigned integer chunk size
* ray_cs: Fix copy_from_user handling
* mbind(): fix leak of never putback pages
* do_mbind(): fix memory leak
* 8250_pci: add IBM Saturn serial card
* dpt_i2o: Fix up copy*user
* dpt_i2o: Fix typo of EINVAL
* hfsplus: refuse to mount volumes larger than 2TB
* Driver core: fix driver_register() return value
* tty: Mark generic_serial users as BROKEN
* param: fix lots of bugs with writing charp params from sysfs, by leaking mem.
* param: fix NULL comparison on oom
* param: fix setting arrays of bool
* USB: serial: sierra driver send_setup() autopm fix
* USB: option: Patch for Huawei Mobile Broadband E270+ Modem
* USB: option: Support for AIRPLUS MCD650 Datacard
* USB: option: TLAYTECH TUE800 support
* libertas if_usb: Fix crash on 64-bit machines
* cpuidle: always return with interrupts enabled
* virtio: order used ring after used index read
* CIFS: Fixing to avoid invalid kfree() in cifs_get_
* mac80211: fix for incorrect sequence number on hostapd injected frames
* mac80211: check interface is down before type change
* x86, UV: Fix information in __uv_hub_info structure
* x86, UV: Set DELIVERY_MODE=4 for vector=NMI_VECTOR in uv_hub_send_ipi()
* NOMMU: Don't pass NULL pointers to fput() in do_mmap_pgoff()
* mm: remove incorrect swap_count() from try_to_unuse()
* x86-64: Fix register leak in 32-bit syscall audting
* nilfs2: fix dirty page accounting leak causing hang at write
* drm/i915: Fix FDI M/N setting according with correct color depth
* drm/i915: fix to setup display reference clock control on Ironlake
* drm/i915: fix panel fitting filter coefficient select for Ironlake
* agp/intel: Add B43 chipset support
* drm/i915: add B43 chipset support
* xen/hvc: make sure console output is always emitted, with explicit polling
* xen: mask extended topology info in cpuid
* sgi-gru: decrapfiy options_write() function
* KVM: get_tss_base_addr() should return a gpa_t
* fuse: prevent fuse_put_request on invalid pointer
* fuse: fix kunmap in fuse_ioctl_
* x86/amd-iommu: Workaround for erratum 63
* fsnotify: do not set group for a mark before it is on the i_list
* mips: fix build of vmlinux.lds
* alpha: fix build after vmlinux.lds.S cleanup
* ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci_dev() (rev. 2)
* Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"
* KEYS: get_instantiati
* b43: Fix Bugzilla #14181 and the bug from the previous 'fix'
* pata_sc1200: Fix crash on boot
* AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621)
* ALSA: ice1724 - Make call to set hw params succeed on ESI Juli@
* bonding: fix a race condition in calls to slave MII ioctls
* hwmon: (it87) Fix VID reading on IT8718F/IT8720F
* netlink: fix typo in initialization (CVE-2009-3612)
* nfs: Avoid overrun when copying client IP address string
* nfs: Panic when commit fails
* NFSv4: Fix a bug when the server returns NFS4ERR_RESOURCE
* NFSv4: Fix two unbalanced put_rpccred() issues.
* NFSv4: Kill nfs4_renewd_
* NFSv4: The link() operation should return any delegation on the file
* powerpc: Remove SMP warning from PowerMac cpufreq
* vmscan: limit VM_EXEC protection to file pages
* x86: mce: Clean up thermal throttling state tracking code
* x86: mce: Fix thermal throttling message storm
* iwlwifi: fix potential rx buffer loss
* iwlwifi: reduce noise when skb allocation fails
* x86/amd-iommu: Un__init function required on shutdown
* KVM: Prevent kvm_init from corrupting debugfs structures
* powerpc/pmac: Fix PowerSurge SMP IPI allocation
* powerpc/pmac: Fix issues with sleep on some powerbooks
* powerpc/pci: Fix regression in powerpc MSI-X
* powerpc: Fix some late PowerMac G5 with PCIe ATI graphics
* sata_via: Remove redundant device ID for VIA VT8261
* pata_via: extend the rev_max for VT6330
* PM / yenta: Split resume into early and late parts (rev. 4)
* Linux 2.6.31.6
==========
Fixes Bug 327499: "Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"
Fixes Bug 456264: " USB: option: TLAYTECH TUE800 support"
Fixes Bug 476154: "b43: Fix Bugzilla #14181 and the bug from the previous 'fix'"