Quantal update to 3.5.7.23 stable release

Bug #1241093 reported by Brad Figg
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Quantal
Fix Released
Undecided
Unassigned

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 3.5.7.23 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://kernel.ubuntu.com/ubuntu/linux.git

    TEST CASE: TBD

       The following patches are in the 3.5.7.23 stable release:
             Linux 3.5.7.23
             dmaengine: imx-dma: fix callback path in tasklet
             dma: fix comments
             dmaengine: imx-dma: fix lockdep issue between irqhandler and tasklet
             dmaengine: imx-dma: fix slow path issue in prep_dma_cyclic
             ext4: avoid hang when mounting non-journal filesystems with orphan list
             mwifiex: fix memory corruption when unsetting multicast list
             staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice
             Smack: Fix the bug smackcipso can't set CIPSO correctly
             ib_srpt: always set response for task management
             powerpc/vio: Fix modalias_show return values
             powerpc/iommu: Use GFP_KERNEL instead of GFP_ATOMIC in iommu_init_table()
             powerpc/sysfs: Disable writing to PURR in guest mode
             powerpc: Fix parameter clobber in csum_partial_copy_generic()
             ib_srpt: Destroy cm_id before destroying QP.
             USB: serial: option: Ignore card reader interface on Huawei E1750
             mwifiex: fix NULL pointer dereference in usb suspend handler
             mwifiex: fix hang issue for USB chipsets
             p54usb: add USB ID for Corega WLUSB2GTST USB adapter
             rtlwifi: Align private space in rtl_priv struct
             Bluetooth: Add support for BCM20702A0 [0b05, 17cb]
             Bluetooth: Fix encryption key size for peripheral role
             Bluetooth: Fix security level for peripheral role
             Bluetooth: Add a new PID/VID 0cf3/e005 for AR3012.
             ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
             ASoC: max98095: a couple array underflows
             sparc64: Fix off by one in trampoline TLB mapping installation loop.
             sparc64: Remove RWSEM export leftovers
             sparc64: Fix ITLB handler of null page
             esp_scsi: Fix tag state corruption when autosensing.
             sparc64: Fix not SRA'ed %o5 in 32-bit traced syscall
             sparc32: Fix exit flag passed from traced sys_sigreturn
             fanotify: dont merge permission events
             gianfar: Change default HW Tx queue scheduling mode
             ll_temac: Reset dma descriptors indexes on ndo_open
             dm9601: fix IFF_ALLMULTI handling
             ipv6 mcast: use in6_dev_put in timer handlers instead of __in6_dev_put
             ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put
             bonding: Fix broken promiscuity reference counting issue
             net: flow_dissector: fix thoff for IPPROTO_AH
             via-rhine: fix VLAN priority field (PCP, IEEE 802.1p)
             ipv6: udp packets following an UFO enqueued packet need also be handled by UFO
             netpoll: fix NULL pointer dereference in netpoll_cleanup
             ip: generate unique IP identificator if local fragmentation is allowed
             ip: use ip_hdr() in __ip_make_skb() to retrieve IP header
             bridge: Clamp forward_delay when enabling STP
             resubmit bridge: fix message_age_timer calculation
             net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
             net: sctp: fix smatch warning in sctp_send_asconf_del_ip
             caif: Add missing braces to multiline if in cfctrl_linkup_request
             usb: dwc3: pci: add support for BayTrail
             USB: Fix breakage in ffs_fs_mount()
             hwmon: (applesmc) Check key count before proceeding
             usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit
             USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
             staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
             drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
             xhci: Ensure a command structure points to the correct trb on the command ring
             xhci: Fix oops happening after address device timeout
             drm/radeon: disable tests/benchmarks if accel is disabled
             x86/reboot: Add quirk to make Dell C6100 use reboot=pci automatically
             dm-snapshot: fix performance degradation due to small hash size
             dm snapshot: workaround for a false positive lockdep warning
             ALSA: compress: Fix compress device unregister.
             x86, efi: Don't map Boot Services on i386
             serial: pch_uart: fix tty-kref leak in dma-rx path
             serial: pch_uart: fix tty-kref leak in rx-error path
             xhci: Fix race between ep halt and URB cancellation
             video: mxsfb: Add missing break
             mm, memcg: give exiting processes access to memory reserves
             cpqarray: fix info leak in ida_locked_ioctl()
             cciss: fix info leak in cciss_ioctl32_passthru()
             tg3: Expand led off fix to include 5720
             tg3: Don't turn off led on 5719 serdes port 0
             cgroup: fail if monitored file and event_control are in different cgroup
             workqueue: cond_resched() after processing each work item
             Revert "sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()"
             HID: usbhid: quirk for N-Trig DuoSense Touch Screen
             HID: Fix Speedlink VAD Cezanne support for some devices
             isofs: Refuse RW mount of the filesystem instead of making it RO
             perf tools: Handle JITed code in shared memory
             cfq: explicitly use 64bit divide operation for 64bit arguments
             perf: Fix perf_cgroup_switch for sw-events
             perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu
             sfc: Fix efx_rx_buf_offset() for recycled pages
             drm/ttm: fix the tt_populated check in ttm_tt_destroy()
             usb: gadget: fix a bug and a WARN_ON in dummy-hcd
             net: usb: cdc_ether: Use wwan interface for Telit modules
             drm/radeon: fix panel scaling with eDP and LVDS bridges
             HID: multitouch: validate indexes details
             HID: logitech-dj: validate output report details
             HID: validate feature and input report details
             HID: add usage_index in struct hid_usage.
             HID: LG: validate HID output report details
             HID: zeroplus: validate output report details
             HID: provide a helper for validating hid reports
             sched/fair: Fix small race where child->se.parent,cfs_rq might point to invalid ones
             drm/ast: fix the ast open key function
             drm/radeon/atom: workaround vbios bug in transmitter table on rs880 (v2)
             Linux 3.5.7.22
             kernel-doc: bugfix - multi-line macros
             Revert "zram: use zram->lock to protect zram_free_page() in swap free notify path"
             [SCSI] sd: Fix potential out-of-bounds access
             ASoC: mc13783: add spi errata fix
             ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist
             cifs: ensure that srv_mutex is held when dealing with ssocket pointer
             crypto: api - Fix race condition in larval lookup
             ARM: PCI: versatile: Fix SMAP register offsets
             ARM: PCI: versatile: Fix map_irq function to match hardware
             MIPS: ath79: Fix ar933x watchdog clock
             intel-iommu: Fix leaks in pagetable freeing
             memcg: fix multiple large threshold notifications
             mm: fix aio performance regression for database caused by THP
             mm/huge_memory.c: fix potential NULL pointer dereference
             ocfs2: fix the end cluster offset of FIEMAP
             powerpc: Default arch idle could cede processor on pseries
             drm/i915: try not to lose backlight CBLV precision
             HID: check for NULL field when setting values
             HID: picolcd_core: validate output report details
             HID: ntrig: validate feature report details
             HID: pantherlord: validate output report details
             libceph: use pg_num_mask instead of pgp_num_mask for pg.seed calc
             exynos4-is: Fix entity unregistration on error path
             exynos4-is: Fix fimc-lite bayer formats
             hdpvr: fix iteration over uninitialized lists in hdpvr_probe()
             v4l2: added missing mutex.h include to v4l2-ctrls.h
             DocBook: upgrade media_api DocBook version to 4.2
             s5p-g2d: Fix registration failure
             fuse: invalidate inode attributes on xattr modification
             fuse: postpone end_page_writeback() in fuse_writepage_locked()
             HID: battery: don't do DMA from stack
             HID: input: return ENODATA if reading battery attrs fails
             drm/radeon: fix init ordering for r600+
             radeon kms: fix uninitialised hotplug work usage in r100_irq_process()
             drm/radeon: fix handling of variable sized arrays for router objects
             drm/radeon: fix resume on some rs4xx boards (v2)
             drm/radeon: fix LCD record parsing
             drm/radeon: update line buffer allocation for dce6
             drm/radeon: update line buffer allocation for dce4.1/5
             drm/radeon: fix endian bugs in hw i2c atom routines
             drm/edid: add quirk for Medion MD30217PG
             of: Fix missing memory initialization on FDT unflattening
             HID: validate HID report id size
             mmc: tmio_mmc_dma: fix PIO fallback on SDHI
             brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()
             ath9k: avoid accessing MRC registers on single-chain devices
             ath9k: fix rx descriptor related race condition
             powerpc: Handle unaligned ldbrx/stdbrx
             libceph: unregister request in __map_request failed and nofail == false
             ath9k: always clear ps filter bit on new assoc
             net: ipv6: tcp: fix potential use after free in tcp_v6_do_rcv
             ipv6: Don't depend on per socket memory for neighbour discovery messages
             ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO
             net: bridge: convert MLDv2 Query MRC into msecs_to_jiffies for max_delay
             ipv6: drop packets with multiple fragmentation headers
             ipv6: remove max_addresses check from ipv6_create_tempaddr
             tun: signedness bug in tun_get_user()
             8139cp: Fix skb leak in rx_status_loop failure path.
             ipv6: don't stop backtracking in fib6_lookup_1 if subtree does not match
             macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS
             tcp: cubic: fix bug in bictcp_acked()
             tcp: cubic: fix overflow error in bictcp_update()
             fib_trie: remove potential out of bound access
             bonding: modify only neigh_parms owned by us
             neighbour: populate neigh_parms on alloc before calling ndo_neigh_setup
             net: check net.core.somaxconn sysctl values
             htb: fix sign extension bug
             tipc: fix lockdep warning during bearer initialization
             xen/events: mask events when changing their VCPU binding
             cifs: don't instantiate new dentries in readdir for inodes that need to be revalidated immediately
             Bluetooth: Add support for Atheros [0cf3:e003]
             Bluetooth: ath3k: Add support for ID 0x13d3/0x3402
             Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330]
             Bluetooth: Add support for Mediatek Bluetooth device [0e8d:763f]
             iwlwifi: dvm: don't send BT_CONFIG on devices w/o Bluetooth
             target: Fix trailing ASCII space usage in INQUIRY vendor+model
             regmap: silence GCC warning
             ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA
             USB: fix build error when CONFIG_PM_SLEEP isn't enabled
             ACPI / EC: Add ASUSTEK L4R to quirk list in order to validate ECDT
             ACPI / EC: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan
             USB: OHCI: Allow runtime PM without system sleep
             usb: xhci: Disable runtime PM suspend for quirky controllers
             usb: ehci-mxc: check for pdata before dereferencing
             staging: comedi: dt282x: dt282x_ai_insn_read() always fails
             USB: mos7720: fix big-endian control requests
             USB: mos7720: use GFP_ATOMIC under spinlock
             rculist: list_first_or_null_rcu() should use list_entry_rcu()
             ASoC: wm8960: Fix PLL register writes
             xhci-plat: Don't enable legacy PCI interrupts.
             USB: handle LPM errors during device suspend correctly
             USB: cdc-wdm: fix race between interrupt handler and tasklet
             usb: config->desc.bLength may not exceed amount of data returned by the device
             xen-gnt: prevent adding duplicate gnt callbacks
             [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal
             Bluetooth: Add support for Foxconn/Hon Hai [0489:e04d]
             ALSA: ak4xx-adda: info leak in ak4xxx_capture_source_info()
             drm/vmwgfx: Split GMR2_REMAP commands if they are to large
             drm/i915: ivb: fix edp voltage swing reg val
             SUNRPC: Fix memory corruption issue on 32-bit highmem systems
             ALSA: opti9xx: Fix conflicting driver object name
             ath9k_htc: Restore skb headroom when returning skb to mac80211
             iwl4965: fix rfkill set state regression

Brad Figg (brad-figg)
tags: added: kernel-stable-tracking-bug
Brad Figg (brad-figg)
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (19.1 KiB)

This bug was fixed in the package linux - 3.5.0-43.66

---------------
linux (3.5.0-43.66) quantal; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1242895

  [ Timo Aaltonen ]

  * SAUCE: ubuntu/i915: silence unclaimed register poking debug messages
    - LP: #1138787

  [ Upstream Kernel Changes ]

  * Revert "xfs: fix _xfs_buf_find oops on blocks beyond the filesystem
    end"
    - LP: #1236041
    - CVE-2013-1819 fix backport:
  * Revert "sctp: fix call to SCTP_CMD_PROCESS_SACK in
    sctp_cmd_interpreter()"
    - LP: #1241093
  * get rid of full-hash scan on detaching vfsmounts
    - LP: #1226726
  * Smack: Fix the bug smackcipso can't set CIPSO correctly
    - LP: #1236743
  * SAUCE: (no-up) Only let characters through when there are active
    readers.
    - LP: #1208740
  * usb: xhci: define port register names and use them instead of magic
    numbers
    - LP: #1229576
  * usb: xhci: add USB2 Link power management BESL support
    - LP: #1229576
  * iwl4965: fix rfkill set state regression
    - LP: #1241093
  * ath9k_htc: Restore skb headroom when returning skb to mac80211
    - LP: #1241093
  * ALSA: opti9xx: Fix conflicting driver object name
    - LP: #1241093
  * SUNRPC: Fix memory corruption issue on 32-bit highmem systems
    - LP: #1241093
  * drm/i915: ivb: fix edp voltage swing reg val
    - LP: #1241093
  * drm/vmwgfx: Split GMR2_REMAP commands if they are to large
    - LP: #1241093
  * ALSA: ak4xx-adda: info leak in ak4xxx_capture_source_info()
    - LP: #1241093
  * Bluetooth: Add support for Foxconn/Hon Hai [0489:e04d]
    - LP: #1241093
  * [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a
    signal
    - LP: #1241093
  * xen-gnt: prevent adding duplicate gnt callbacks
    - LP: #1241093
  * usb: config->desc.bLength may not exceed amount of data returned by the
    device
    - LP: #1241093
  * USB: cdc-wdm: fix race between interrupt handler and tasklet
    - LP: #1241093
  * xhci-plat: Don't enable legacy PCI interrupts.
    - LP: #1241093
  * ASoC: wm8960: Fix PLL register writes
    - LP: #1241093
  * rculist: list_first_or_null_rcu() should use list_entry_rcu()
    - LP: #1241093
  * USB: mos7720: use GFP_ATOMIC under spinlock
    - LP: #1241093
  * USB: mos7720: fix big-endian control requests
    - LP: #1241093
  * staging: comedi: dt282x: dt282x_ai_insn_read() always fails
    - LP: #1241093
  * usb: ehci-mxc: check for pdata before dereferencing
    - LP: #1241093
  * usb: xhci: Disable runtime PM suspend for quirky controllers
    - LP: #1241093
  * USB: OHCI: Allow runtime PM without system sleep
    - LP: #1241093
  * ACPI / EC: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan
    - LP: #1241093
  * ACPI / EC: Add ASUSTEK L4R to quirk list in order to validate ECDT
    - LP: #1241093
  * USB: fix build error when CONFIG_PM_SLEEP isn't enabled
    - LP: #1241093
  * ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA
    - LP: #1241093
  * regmap: silence GCC warning
    - LP: #1241093
  * target: Fix trailing ASCII space usage in INQUIRY vendor+model
    - LP: #1241093
  * iwlwifi: dvm: don't send BT_CONFIG on devices w/o Bluetooth
    - LP: #1...

Changed in linux (Ubuntu Quantal):
status: New → Fix Released
Changed in linux (Ubuntu):
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.