[ubuntu/artful-security] linux 4.13.0-17.20 (Accepted)
Łukasz Zemczak
lukasz.zemczak at canonical.com
Tue Nov 21 11:43:05 UTC 2017
linux (4.13.0-17.20) artful; urgency=low
* linux: 4.13.0-17.20 -proposed tracker (LP: #1728927)
[ Seth Forshee ]
* thunderx2 ahci errata workaround needs additional delays (LP: #1724117)
- SAUCE: ahci: thunderx2: stop engine fix update
* usb 3-1: 2:1: cannot get freq at ep 0x1 (LP: #1708499)
- ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M
* Plantronics Blackwire C520-M - Cannot get freq at ep 0x1, 0x81
(LP: #1709282)
- ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M
* TSC_DEADLINE incorrectly disabled inside virtual guests (LP: #1724912)
- x86/apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on CPUs
without the feature
- x86/apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on
hypervisors
* x86/apic: Update TSC_DEADLINE quirk with additional SKX stepping
(LP: #1724612)
- x86/apic: Update TSC_DEADLINE quirk with additional SKX stepping
* [Artful] Add support for Dell/Wyse 3040 audio codec (LP: #1723916)
- SAUCE: ASoC: rt5670: Add support for Wyse 3040
* [Artful] Some Dell Monitors Doesn't Work Well with Dell/Wyse 3040
(LP: #1723915)
- SAUCE: drm/i915: Workaround for DP DPMS D3 on Dell monitor
* [Artful] Support headset mode for DELL WYSE (LP: #1723913)
- SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE
* Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
- SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
- SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
- SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280
* Artful update to v4.13.8 stable release (LP: #1724669)
- USB: dummy-hcd: Fix deadlock caused by disconnect detection
- MIPS: math-emu: Remove pr_err() calls from fpu_emu()
- MIPS: bpf: Fix uninitialised target compiler error
- mei: always use domain runtime pm callbacks.
- dmaengine: edma: Align the memcpy acnt array size with the transfer
- dmaengine: ti-dma-crossbar: Fix possible race condition with dma_inuse
- NFS: Fix uninitialized rpc_wait_queue
- nfs/filelayout: fix oops when freeing filelayout segment
- HID: usbhid: fix out-of-bounds bug
- crypto: skcipher - Fix crash on zero-length input
- crypto: shash - Fix zero-length shash ahash digest crash
- KVM: MMU: always terminate page walks at level 1
- KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
- usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
- pinctrl/amd: Fix build dependency on pinmux code
- iommu/amd: Finish TLB flush in amd_iommu_unmap()
- device property: Track owner device of device property
- Revert "vmalloc: back off when the current task is killed"
- fs/mpage.c: fix mpage_writepage() for pages with buffers
- ALSA: usb-audio: Kill stray URB at exiting
- ALSA: seq: Fix use-after-free at creating a port
- ALSA: seq: Fix copy_from_user() call inside lock
- ALSA: caiaq: Fix stray URB at probe error path
- ALSA: line6: Fix NULL dereference at podhd_disconnect()
- ALSA: line6: Fix missing initialization before error path
- ALSA: line6: Fix leftover URB at error-path during probe
- drm/atomic: Unref duplicated drm_atomic_state in drm_atomic_helper_resume()
- drm/i915/edp: Get the Panel Power Off timestamp after panel is off
- drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get()
- drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX
channel
- drm/i915: Use crtc_state_is_legacy_gamma in intel_color_check
- usb: gadget: configfs: Fix memory leak of interface directory data
- usb: gadget: composite: Fix use-after-free in
usb_composite_overwrite_options
- PCI: aardvark: Move to struct pci_host_bridge IRQ mapping functions
- Revert "PCI: tegra: Do not allocate MSI target memory"
- direct-io: Prevent NULL pointer access in submit_page_section
- fix unbalanced page refcounting in bio_map_user_iov
- more bio_map_user_iov() leak fixes
- bio_copy_user_iov(): don't ignore ->iov_offset
- perf script: Add missing separator for "-F ip,brstack" (and brstackoff)
- genirq/cpuhotplug: Enforce affinity setting on startup of managed irqs
- genirq/cpuhotplug: Add sanity check for effective affinity mask
- USB: serial: ftdi_sio: add id for Cypress WICED dev board
- USB: serial: cp210x: fix partnum regression
- USB: serial: cp210x: add support for ELV TFD500
- USB: serial: option: add support for TP-Link LTE module
- USB: serial: qcserial: add Dell DW5818, DW5819
- USB: serial: console: fix use-after-free on disconnect
- USB: serial: console: fix use-after-free after failed setup
- RAS/CEC: Use the right length for "cec_disable"
- x86/microcode: Do the family check first
- x86/alternatives: Fix alt_max_short macro to really be a max()
- KVM: nVMX: update last_nonleaf_level when initializing nested EPT
- Linux 4.13.8
* Artful update to v4.13.7 stable release (LP: #1724668)
- watchdog: Revert "iTCO_wdt: all versions count down twice"
- Linux 4.13.7
* libvirt - vnc port selection regression with newer kernels (LP: #1722702)
- net: set tb->fast_sk_family
- net: use inet6_rcv_saddr to compare sockets
- inet: fix improper empty comparison
* powerpc/64s: Add workaround for P9 vector CI load issue (LP: #1721070)
- powerpc/mce: Move 64-bit machine check code into mce.c
- powerpc/64s: Add workaround for P9 vector CI load issue
* Artful update to v4.13.6 stable release (LP: #1723145)
- imx-media-of: avoid uninitialized variable warning
- usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
- mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
- net: bonding: Fix transmit load balancing in balance-alb mode if specified
by sysfs
- openvswitch: Fix an error handling path in 'ovs_nla_init_match_and_action()'
- mlxsw: spectrum: Prevent mirred-related crash on removal
- net: bonding: fix tlb_dynamic_lb default value
- net_sched: gen_estimator: fix scaling error in bytes/packets samples
- net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
- sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
- tcp: update skb->skb_mstamp more carefully
- bpf/verifier: reject BPF_ALU64|BPF_END
- tcp: fix data delivery rate
- udpv6: Fix the checksum computation when HW checksum does not apply
- ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
- net: phy: Fix mask value write on gmii2rgmii converter speed register
- ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
- net/sched: cls_matchall: fix crash when used with classful qdisc
- 8139too: revisit napi_complete_done() usage
- bpf: do not disable/enable BH in bpf_map_free_id()
- tcp: fastopen: fix on syn-data transmit failure
- net: emac: Fix napi poll list corruption
- net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
- packet: hold bind lock when rebinding to fanout hook
- bpf: one perf event close won't free bpf program attached by another perf
event
- net: change skb->mac_header when Generic XDP calls adjust_head
- isdn/i4l: fetch the ppp_write buffer in one shot
- net_sched: always reset qdisc backlog in qdisc_reset()
- net: stmmac: Cocci spatch "of_table"
- net: qcom/emac: specify the correct size when mapping a DMA buffer
- vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
- l2tp: fix race condition in l2tp_tunnel_delete
- tun: bail out from tun_get_user() if the skb is empty
- net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
- net: dsa: Fix network device registration order
- packet: in packet_do_bind, test fanout with bind_lock held
- packet: only test po->has_vnet_hdr once in packet_snd
- net: dsa: mv88e6xxx: lock mutex when freeing IRQs
- net: Set sk_prot_creator when cloning sockets to the right proto
- net/mlx5e: IPoIB, Fix access to invalid memory address
- netlink: do not proceed if dump's start() errs
- ip6_gre: ip6gre_tap device should keep dst
- ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
- IPv4: early demux can return an error code
- tipc: use only positive error codes in messages
- l2tp: fix l2tp_eth module loading
- socket, bpf: fix possible use after free
- net: rtnetlink: fix info leak in RTM_GETSTATS call
- bpf: fix bpf_tail_call() x64 JIT
- usb: gadget: core: fix ->udc_set_speed() logic
- USB: gadgetfs: Fix crash caused by inadequate synchronization
- USB: gadgetfs: fix copy_to_user while holding spinlock
- usb: gadget: udc: atmel: set vbus irqflags explicitly
- usb: gadget: udc: renesas_usb3: fix for no-data control transfer
- usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
- usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
- usb-storage: unusual_devs entry to fix write-access regression for Seagate
external drives
- usb-storage: fix bogus hardware error messages for ATA pass-thru devices
- usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
- usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
- ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
- usb: pci-quirks.c: Corrected timeout values used in handshake
- USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
- USB: dummy-hcd: fix connection failures (wrong speed)
- USB: dummy-hcd: fix infinite-loop resubmission bug
- USB: dummy-hcd: Fix erroneous synchronization change
- USB: devio: Prevent integer overflow in proc_do_submiturb()
- USB: devio: Don't corrupt user memory
- USB: g_mass_storage: Fix deadlock when driver is unbound
- USB: uas: fix bug in handling of alternate settings
- USB: core: harden cdc_parse_cdc_header
- usb: Increase quirk delay for USB devices
- USB: fix out-of-bounds in usb_set_configuration
- usb: xhci: Free the right ring in xhci_add_endpoint()
- xhci: fix finding correct bus_state structure for USB 3.1 hosts
- xhci: fix wrong endpoint ESIT value shown in tracing
- usb: host: xhci-plat: allow sysdev to inherit from ACPI
- xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
- Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
- iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
- iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path
of 'twl4030_madc_probe()'
- iio: ad_sigma_delta: Implement a dedicated reset function
- staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma
from stack.
- iio: core: Return error for failed read_reg
- IIO: BME280: Updates to Humidity readings need ctrl_reg write!
- iio: trigger: stm32-timer: preset shouldn't be buffered
- iio: trigger: stm32-timer: fix a corner case to write preset
- iio: ad7793: Fix the serial interface reset
- iio: adc: stm32: fix bad error check on max_channels
- iio: adc: mcp320x: Fix readout of negative voltages
- iio: adc: mcp320x: Fix oops on module unload
- uwb: properly check kthread_run return value
- uwb: ensure that endpoint is interrupt
- staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
- ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
- mm, hugetlb, soft_offline: save compound page order before page migration
- mm, oom_reaper: skip mm structs with mmu notifiers
- mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
- mm: avoid marking swap cached page as lazyfree
- mm: fix data corruption caused by lazyfree page
- userfaultfd: non-cooperative: fix fork use after free
- lib/ratelimit.c: use deferred printk() version
- lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
- ALSA: compress: Remove unused variable
- Revert "ALSA: echoaudio: purge contradictions between dimension matrix
members and total number of members"
- ALSA: usx2y: Suppress kernel warning at page allocation failures
- powerpc/powernv: Increase memory block size to 1GB on radix
- powerpc: Fix action argument for cpufeatures-based TLB flush
- powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
- powerpc/tm: Fix illegal TM state in signal handler
- percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
- intel_th: pci: Add Lewisburg PCH support
- driver core: platform: Don't read past the end of "driver_override" buffer
- cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute()
returns
- Drivers: hv: fcopy: restore correct transfer length
- vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister()
- stm class: Fix a use-after-free
- auxdisplay: charlcd: properly restore atomic counter on error path
- ftrace: Fix kmemleak in unregister_ftrace_graph
- ovl: fix error value printed in ovl_lookup_index()
- ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
- ovl: fix dentry leak in ovl_indexdir_cleanup()
- ovl: fix missing unlock_rename() in ovl_do_copy_up()
- ovl: fix regression caused by exclusive upper/work dir protection
- arm64: dt marvell: Fix AP806 system controller size
- arm64: Ensure the instruction emulation is ready for userspace
- HID: rmi: Make sure the HID device is opened on resume
- HID: i2c-hid: allocate hid buffers for real worst case
- HID: wacom: leds: Don't try to control the EKR's read-only LEDs
- HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
- HID: wacom: Correct coordinate system of touchring and pen twist
- HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
- HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
- HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
- HID: wacom: bits shifted too much for 9th and 10th buttons
- btrfs: avoid overflow when sector_t is 32 bit
- Btrfs: fix overlap of fs_info::flags values
- rocker: fix rocker_tlv_put_* functions for KASAN
- netlink: fix nla_put_{u8,u16,u32} for KASAN
- dm crypt: reject sector_size feature if device length is not aligned to it
- dm ioctl: fix alignment of event number in the device list
- dm crypt: fix memory leak in crypt_ctr_cipher_old()
- KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
- kvm/x86: Avoid async PF preempting the kernel incorrectly
- iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
- scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
- scsi: sd: Do not override max_sectors_kb sysfs setting
- brcmfmac: add length check in brcmf_cfg80211_escan_handler()
- brcmfmac: setup passive scan if requested by user-space
- drm/i915: always update ELD connector type after get modes
- drm/i915/bios: ignore HDMI on port A
- bsg-lib: fix use-after-free under memory-pressure
- nvme-pci: Use PCI bus address for data/queues in CMB
- mmc: core: add driver strength selection when selecting hs400es
- nl80211: Define policy for packet pattern attributes
- clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
- udp: perform source validation for mcast early demux
- udp: fix bcast packet reception
- base: arch_topology: fix section mismatch build warnings
- Linux 4.13.6
* Artful update to v4.13.5 stable release (LP: #1721777)
- cifs: check rsp for NULL before dereferencing in SMB2_open
- cifs: release cifs root_cred after exit_cifs
- cifs: release auth_key.response for reconnect.
- nvme-pci: fix host memory buffer allocation fallback
- nvme-pci: use appropriate initial chunk size for HMB allocation
- nvme-pci: propagate (some) errors from host memory buffer setup
- dax: remove the pmem_dax_ops->flush abstraction
- dm integrity: do not check integrity for failed read operations
- mmc: block: Fix incorrectly initialized requests
- fs/proc: Report eip/esp in /prod/PID/stat for coredumping
- scsi: scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout
- SMB3: Add support for multidialect negotiate (SMB2.1 and later)
- mac80211: fix VLAN handling with TXQs
- mac80211_hwsim: Use proper TX power
- mac80211: flush hw_roc_start work before cancelling the ROC
- mac80211: fix deadlock in driver-managed RX BA session start
- genirq: Make sparse_irq_lock protect what it should protect
- genirq/msi: Fix populating multiple interrupts
- genirq: Fix cpumask check in __irq_startup_managed()
- KVM: PPC: Book3S HV: Hold kvm->lock around call to kvmppc_update_lpcr
- KVM: PPC: Book3S HV: Fix bug causing host SLB to be restored incorrectly
- KVM: PPC: Book3S HV: Don't access XIVE PIPR register using byte accesses
- tracing: Fix trace_pipe behavior for instance traces
- tracing: Erase irqsoff trace with empty write
- tracing: Remove RCU work arounds from stack tracer
- md/raid5: fix a race condition in stripe batch
- md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
- scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse
nlmsg properly
- scsi: aacraid: Fix 2T+ drives on SmartIOC-2000
- scsi: aacraid: Add a small delay after IOP reset
- drm/exynos: Fix locking in the suspend/resume paths
- drm/i915/gvt: Fix incorrect PCI BARs reporting
- Revert "drm/i915/bxt: Disable device ready before shutdown command"
- drm/amdgpu: revert tile table update for oland
- drm/radeon: disable hard reset in hibernate for APUs
- crypto: drbg - fix freeing of resources
- crypto: talitos - Don't provide setkey for non hmac hashing algs.
- crypto: talitos - fix sha224
- crypto: talitos - fix hashing
- security/keys: properly zero out sensitive key material in big_key
- security/keys: rewrite all of big_key crypto
- KEYS: fix writing past end of user-supplied buffer in keyring_read()
- KEYS: prevent creating a different user's keyrings
- KEYS: prevent KEYCTL_READ on negative key
- libnvdimm, namespace: fix btt claim class crash
- powerpc/eeh: Create PHB PEs after EEH is initialized
- powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
- powerpc/tm: Flush TM only if CPU has TM feature
- MIPS: Fix perf event init
- s390/perf: fix bug when creating per-thread event
- s390/mm: make pmdp_invalidate() do invalidation only
- s390/mm: fix write access check in gup_huge_pmd()
- PM: core: Fix device_pm_check_callbacks()
- Revert "IB/ipoib: Update broadcast object if PKey value was changed in index
0"
- Fix SMB3.1.1 guest authentication to Samba
- SMB3: Fix endian warning
- SMB3: Warn user if trying to sign connection that authenticated as guest
- SMB: Validate negotiate (to protect against downgrade) even if signing off
- SMB3: handle new statx fields
- SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags
- vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
- libceph: don't allow bidirectional swap of pg-upmap-items
- nl80211: check for the required netlink attributes presence
- brd: fix overflow in __brd_direct_access
- gfs2: Fix debugfs glocks dump
- bsg-lib: don't free job in bsg_prepare_job
- iw_cxgb4: drop listen destroy replies if no ep found
- iw_cxgb4: remove the stid on listen create failure
- iw_cxgb4: put ep reference in pass_accept_req()
- rcu: Allow for page faults in NMI handlers
- mmc: sdhci-pci: Fix voltage switch for some Intel host controllers
- extable: Consolidate *kernel_text_address() functions
- extable: Enable RCU if it is not watching in kernel_text_address()
- seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
- arm64: Make sure SPsel is always set
- arm64: fault: Route pte translation faults via do_translation_fault
- KVM: VMX: extract __pi_post_block
- KVM: VMX: avoid double list add with VT-d posted interrupts
- KVM: VMX: simplify and fix vmx_vcpu_pi_load
- KVM: nVMX: fix HOST_CR3/HOST_CR4 cache
- kvm/x86: Handle async PF in RCU read-side critical sections
- kvm: nVMX: Don't allow L2 to access the hardware CR8
- xfs: validate bdev support for DAX inode flag
- fix infoleak in waitid(2)
- sched/sysctl: Check user input value of sysctl_sched_time_avg
- irq/generic-chip: Don't replace domain's name
- mtd: Fix partition alignment check on multi-erasesize devices
- mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user
- etnaviv: fix submit error path
- etnaviv: fix gem object list corruption
- futex: Fix pi_state->owner serialization
- md: fix a race condition for flush request handling
- md: separate request handling
- PCI: Fix race condition with driver_override
- btrfs: fix NULL pointer dereference from free_reloc_roots()
- btrfs: clear ordered flag on cleaning up ordered extents
- btrfs: finish ordered extent cleaning if no progress is found
- btrfs: propagate error to btrfs_cmp_data_prepare caller
- btrfs: prevent to set invalid default subvolid
- platform/x86: fujitsu-laptop: Don't oops when FUJ02E3 is not presnt
- PM / OPP: Call notifier without holding opp_table->lock
- x86/mm: Fix fault error path using unsafe vma pointer
- x86/fpu: Don't let userspace set bogus xcomp_bv
- KVM: VMX: do not change SN bit in vmx_update_pi_irte()
- KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt
- KVM: VMX: use cmpxchg64
- video: fbdev: aty: do not leak uninitialized padding in clk to userspace
- Linux 4.13.5
- [Config] Update configs for v4.13.5
Date: 2017-11-06 10:00:21.779161+00:00
Changed-By: Khaled El Mously <khalid.elmously at canonical.com>
Signed-By: Łukasz Zemczak <lukasz.zemczak at canonical.com>
https://launchpad.net/ubuntu/+source/linux/4.13.0-17.20
-------------- next part --------------
Sorry, changesfile not available.
More information about the Artful-changes
mailing list