Precise update to v3.8.13.18 stable release

[Joseph Salisbury]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The v3.8.13.18 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches are in the v3.8.13.18 stable release:
Linux 3.8.13.18
ip6tnl: fix double free of fb_tnl_dev on exit
Revert "ip6tnl: fix use after free of fb_tnl_dev"
sit: fix double free of fb_tunnel_dev on exit
xen-netfront: fix resource leak in netfront
net: Fix memory leak if TPROXY used with TCP early demux
fib_frontend: fix possible NULL pointer dereference
s390/bpf,jit: fix 32 bit divisions, use unsigned divide instructions
bpf: do not use reciprocal divide
tcp: metrics: Avoid duplicate entries with the same destination-IP
net,via-rhine: Fix tx_timeout handling
net: avoid reference counter overflows on fib_rules in multicast forwarding
ieee802154: Fix memory leak in ieee802154_add_iface()
inet_diag: fix inet_diag_dump_icsk() timewait socket state logic
bnx2x: fix DMA unmapping of TSO split BDs
e752x_edac: Fix pci_dev usage count
drm/nouveau/bios: fix offset calculation for BMPv1 bioses
hpfs: remember free space
alpha: fix broken network checksum
mm, oom: base root bonus on current usage
mm/mempolicy.c: fix mempolicy printing in numa_maps
target/iscsi: Fix network portal creation race
mm: numa: initialise numa balancing after jump label initialisation
mm/page-writeback.c: do not count anon pages as dirtyable memory
mm/page-writeback.c: fix dirty_balance_reserve subtraction from dirtyable memory
drm/radeon/DCE4+: clear bios scratch dpms bit (v2)
powerpc: Make sure "cache" directory is removed when offlining cpu
drm: ast,cirrus,mgag200: use drm_can_sleep
drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler
drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler
drm/ast: do not attempt to acquire a reservation while in an interrupt handler
ACPI / init: Flag use of ACPI and ACPI idioms for power supplies to regulator API
btrfs: restrict snapshotting to own subvolumes
Btrfs: handle EAGAIN case properly in btrfs_drop_snapshot()
vfs: Is mounted should be testing mnt_ns for NULL or error.
rtc: max8907: weekday encoding fixes
b43: fix the wrong assignment of status.freq in b43_rx()
drm/i915: VLV2 - Fix hotplug detect bits
ore: Fix wrong math in allocation of per device BIO
IB/qib: Fix QP check when looping back to/from QP1
drm/cirrus: correct register values for 16bpp
fuse: fix pipe_buf_operations
arch/sh/kernel/kgdb.c: add missing #include <linux/sched.h>
intel-iommu: fix off-by-one in pagetable freeing
ASoC: wm5110: Extend SYSCLK patch file for rev D
hp_accel: Add a new PnP ID HPQ6007 for new HP laptops
mfd: max77686: Fix regmap resource leak on driver remove
drm/radeon: set the full cache bit for fences on r7xx+
drm/radeon: fix surface sync in fence on cayman (v2)
nfs4: fix discover_server_trunking use after free
drm/radeon: disable ss on DP for DCE3.x
turbostat: Use GCC's CPUID functions to support PIC
turbostat: Don't put unprocessed uapi headers in the include path
mmc: sdhci: fix lockdep error in tuning routine
libata: disable LPM for some WD SATA-I devices
md/raid5: fix long-standing problem with bitmap handling on write failure.
ARM: mvebu: update the SATA compatible string for Armada 370/XP
arm: mvebu: fix length of SATA registers area in .dtsi
ata: sata_mv: fix disk hotplug for Armada 370/XP SoCs
ata: sata_mv: introduce compatible string "marvell, armada-370-sata"
KVM: x86: limit PIT timer frequency
dm sysfs: fix a module unload race
xtensa: xtfpga: fix definitions of platform devices
audit: correct a type mismatch in audit_syscall_exit()
audit: reset audit backlog wait time after error recovery
usb: ehci: add freescale imx28 special write register method
nfs4.1: properly handle ENOTSUP in SECINFO_NO_NAME
b43legacy: Fix unload oops if firmware is not available
b43: Fix unload oops if firmware is not available
b43: Fix lockdep splat
mwifiex: add missing endian conversion for fw_tsf
rtlwifi: rtl8192cu: Add new device ID
ftrace: Fix synchronization location disabling and freeing ftrace_ops
ftrace: Use schedule_on_each_cpu() as a heavy synchronize_sched()
ftrace: Fix function graph with loading of modules
ftrace: Check module functions being traced on reload
mmc: atmel-mci: fix timeout errors in SDIO mode when using DMA
[media] media: s5p_mfc: remove s5p_mfc_get_node_type() function
ALSA: Enable CONFIG_ZONE_DMA for smaller PCI DMA masks
staging: r8712u: Set device type to wlan
drm/radeon: skip colorbuffer checking if COLOR_INFO.FORMAT is set to INVALID
radeon/pm: Guard access to rdev->pm.power_state array
ASoC: adau1701: Fix ADAU1701_SEROCTL_WORD_LEN_16 constant
dm space map common: make sure new space is used during extend
dm: wait until embedded kobject is released before destroying a device
USB: ftdi_sio: added CS5 quirk for broken smartcard readers
ext4: avoid clearing beyond i_blocks when truncating an inline data file
USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED
drm/radeon: warn users when hw_i2c is enabled (v2)
SELinux: Fix memory leak upon loading policy
dm thin: fix set_pool_mode exposed pool operation races
dm thin: fix discard support to a previously shared block
dm thin: initialize dm_thin_new_mapping returned by get_next_mapping
tpm/tpm_ppi: Do not compare strcmp(a,b) == -1
sunrpc: Fix infinite loop in RPC state machine
SUNRPC: don't map EKEYEXPIRED to EACCES in call_refreshresult
ALSA: rme9652: fix a missing comma in channel_map_9636_ds[]
USB: cypress_m8: fix ring-indicator detection and reporting
USB: Nokia 502 is an unusual device
USB: serial: add support for iBall 3.5G connect usb modem
USB: pl2303: fix data corruption on termios updates
xen/pvhvm: If xen_platform_pci=0 is set don't blow up (v4).
mtd: mxc_nand: remove duplicated ecc_stats counting
slub: Fix calculation of cpu slabs
rtc-cmos: Add an alarm disable quirk
perf kvm: Fix kvm report without guestmount.
x86/efi: Fix off-by-one bug in EFI Boot Services reservation
[media] anysee: fix non-working E30 Combo Plus DVB-T
usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix()
serial: add support for 200 v3 series Titan card
[media] dib8000: make 32 bits read atomic
usb: option: add new zte 3g modem pids to option driver
[SCSI] bfa: Chinook quad port 16G FC HBA claim issue
staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning
parport: parport_pc: remove double PCI ID for NetMos
NFSv4: OPEN must handle the NFS4ERR_IO return code correctly
rtlwifi: rtl8192cu: Fix some code in RF handling
rtlwifi: rtl8192cu: Fix duplicate if test
rtlwifi: Set the link state
rtlwifi: rtl8192cu: Add new firmware
rtlwifi: rtl8192cu: Fix W=1 build warning
KVM: s390: fix diagnose code extraction
KVM: s390: Always store status during SIGP STOP_AND_STORE_STATUS
KVM: s390: kvm/sigp.c: fix memory leakage

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mathew Hodson (mhodson)]

This bug was fixed in the package https://launchpad.net/ubuntu/+source/linux-lts-raring/3.8.0-37.53~precise1

---------------
linux-lts-raring (3.8.0-37.53~precise1) precise; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1282210

  [ Upstream Kernel Changes ]

  * Revert "of/address: Handle #address-cells > 2 specially"
    - LP: #1278969
  * ath9k_htc: properly set MAC address and BSSID mask
    - LP: #1252422
    - CVE-2013-4579
  * aacraid: prevent invalid pointer dereference
    - LP: #1256083
    - CVE-2013-6380
  * net: clamp ->msg_namelen instead of returning an error
    - LP: #1269053
  * mmc: sdhci-pci: break out definitions to header file
    - LP: #1239938
  * mmc: sdhci-pci: add support of O2Micro/BayHubTech SD hosts
    - LP: #1239938
  * SELinux: Fix kernel BUG on empty security contexts.
    - CVE-2014-1874
  * xfs: add capability check to free eofblocks ioctl
    - LP: #1278969
  * staging: vt6656: [BUG] Fix for TX USB resets from vendors driver.
    - LP: #1278969
  * net: Fix "ip rule delete table 256"
    - LP: #1278969
  * ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcv
    - LP: #1278969
  * random32: fix off-by-one in seeding requirement
    - LP: #1278969
  * bonding: don't permit to use ARP monitoring in 802.3ad mode
    - LP: #1278969
  * usbnet: fix status interrupt urb handling
    - LP: #1278969
  * 6lowpan: Uncompression of traffic class field was incorrect
    - LP: #1278969
  * tuntap: limit head length of skb allocated
    - LP: #1278969
  * macvtap: limit head length of skb allocated
    - LP: #1278969
  * tcp: tsq: restore minimal amount of queueing
    - LP: #1278969
  * bonding: fix two race conditions in bond_store_updelay/downdelay
    - LP: #1278969
  * net-tcp: fix panic in tcp_fastopen_cache_set()
    - LP: #1278969
  * isdnloop: use strlcpy() instead of strcpy()
    - LP: #1278969
  * connector: improved unaligned access error fix
    - LP: #1278969
  * ipv4: fix possible seqlock deadlock
    - LP: #1278969
  * inet: prevent leakage of uninitialized memory to user in recv syscalls
    - LP: #1278969
  * net: rework recvmsg handler msg_name and msg_namelen logic
    - LP: #1278969
  * net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct
    sockaddr_storage)
    - LP: #1278969
  * inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu
    functions
    - LP: #1278969
  * ipv6: fix leaking uninitialized port number of offender sockaddr
    - LP: #1278969
  * ip6_output: fragment outgoing reassembled skb properly
    - LP: #1278969
  * xfrm: Release dst if this dst is improper for vti tunnel
    - LP: #1278969
  * atm: idt77252: fix dev refcnt leak
    - LP: #1278969
  * tcp: don't update snd_nxt, when a socket is switched from repair mode
    - LP: #1278969
  * ipv4: fix race in concurrent ip_route_input_slow()
    - LP: #1278969
  * net: core: Always propagate flag changes to interfaces
    - LP: #1278969
  * bridge: flush br's address entry in fdb when remove the bridge dev
    - LP: #1278969
  * packet: fix use after free race in send path...