Changelog
linux (3.16.7-ckt2-1) unstable; urgency=high
* New upstream stable update:
http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt1
- drm/tilcdc: Fix the error path in tilcdc_load()
- usb: phy: return -ENODEV on failure of try_module_get
- PM / clk: Fix crash in clocks management code if !CONFIG_PM_RUNTIME
- rt2x00: support Ralink 5362.
- wireless: rt2x00: add new rt2800usb devices
- NFS: Fix /proc/fs/nfsfs/servers and /proc/fs/nfsfs/volumes
- nfs: fix duplicate proc entries
- mm: page_alloc: fix zone allocation fairness on UP
- ext4: check EA value offset when loading
- jbd2: free bh when descriptor block checksum fails
- ext4: don't check quota format when there are no quota files
- target: Fix queue full status NULL pointer for SCF_TRANSPORT_TASK_SENSE
- vfs: fix data corruption when blocksize < pagesize for mmaped data
- ext4: fix mmap data corruption when blocksize < pagesize
- ext4: grab missed write_count for EXT4_IOC_SWAP_BOOT
- qla_target: don't delete changed nacls
- target: Fix APTPL metadata handling for dynamic MappedLUNs
- iser-target: Disable TX completion interrupt coalescing
- ext4: don't orphan or truncate the boot loader inode
- ext4: add ext4_iget_normal() which is to be used for dir tree lookups
- ext4: fix reservation overflow in ext4_da_write_begin
- ext4: Replace open coded mdata csum feature to helper function
- ext4: move error report out of atomic context in ext4_init_block_bitmap()
- ext4: check s_chksum_driver when looking for bg csum presence
- drm/radeon: fix speaker allocation setup
- drm/radeon: use gart memory for DMA ring tests
- random: add and use memzero_explicit() for clearing data
- freezer: Do not freeze tasks killed by OOM killer
- OOM, PM: OOM killed task shouldn't escape PM suspend
- [mips*/loongson-2f] loongson2_cpufreq: Fix CPU clock rate setting mismerge
- drm/cirrus: bind also to qemu-xen-traditional
- cpufreq: intel_pstate: Fix setting max_perf_pct in performance policy
- cpufreq: expose scaling_cur_freq sysfs file for set_policy() drivers
- cpufreq: intel_pstate: Reflect current no_turbo state correctly
- [x86] intel_pstate: Don't lose sysfs settings during cpu offline
- [x86] intel_pstate: Fix BYT frequency reporting
- [x86] intel_pstate: Correct BYT VID values.
- [x86] kvm: don't kill guest on unknown exit reason
- kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
(CVE-2014-8369)
- vfs: be careful with nd->inode in path_init() and follow_dotdot_rcu()
- pstore: Fix duplicate {console,ftrace}-efi entries
- [x86] bpf_jit: fix two bugs in eBPF JIT compiler (regression in 3.16)
- vxlan: fix a use after free in vxlan_encap_bypass
- vxlan: using pskb_may_pull as early as possible
- vxlan: fix a free after use
- ipv4: dst_entry leak in ip_send_unicast_reply()
- ipv4: fix a potential use after free in ip_tunnel_core.c
(regression in 3.11)
- net: tso: fix unaligned access to crafted TCP header in helper API
- [x86] hyperv: Fix the total_data_buflen in send path
- tcp: md5: do not use alloc_percpu()
- macvlan: fix a race on port dismantle and possible skb leaks
(regression in 3.16)
- net/mlx4_en: Don't attempt to TX offload the outer UDP checksum for VXLAN
(regression in 3.14)
- gre: Use inner mac length when computing tunnel length
(regression in 3.14)
- [armhf] spi: pl022: Fix incorrect dma_unmap_sg
- mac80211: fix typo in starting baserate for rts_cts_rate_idx
- staging: comedi: (regression) channel list must be set for COMEDI_CMD
ioctl (regression in 3.15)
- nfsd4: fix response size estimation for OP_SEQUENCE (regression in 3.16)
- quota: Properly return errors from dquot_writeback_dquots()
- i3200_edac: Report CE events properly
- i82860_edac: Report CE events properly
- cpc925_edac: Report UE events properly
- e7xxx_edac: Report CE events properly
- scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND
- usb: serial: ftdi_sio: add "bricked" FTDI device PID
- [armhf] Revert "usb: dwc3: dwc3-omap: Disable/Enable only wrapper
interrupts in prepare/complete" (regression in 3.16)
- usb: gadget: f_fs: remove redundant ffs_data_get() (regression in 3.14)
- [armhf] usb: ffs: fix regression when quirk_ep_out_aligned_size flag is
set (regression in 3.15)
- [armhf] usb: musb: dsps: start OTG timer on resume again
(regression in 3.16.6)
- usb: gadget: udc: core: fix kernel oops with soft-connect
- nfsd4: fix crash on unknown operation number
- Revert "iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate"
(regression in 3.16.4)
- [armhf] usb: dwc3: gadget: Properly initialize LINK TRB
- posix-timers: Fix stack info leak in timer_create()
- futex: Fix a race condition between REQUEUE_PI and task death
- ALSA: bebob: Uninitialized id returned by saffirepro_both_clk_src_get
- PM / Sleep: fix async suspend_late/freeze_late error handling
(regression in 3.15)
- Revert "block: all blk-mq requests are tagged" (regression in 3.16)
- ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat mode
- zap_pte_range: update addr when forcing flush after TLB batching faiure
- staging: comedi: fix memory leak / bad pointer freeing for chanlist
(regression in 3.15)
- [x86] drm/i915: Ignore VBT backlight check on Macbook 2, 1
(regression in 3.15)
- [i386/686-pae] pageattr: Prevent overflow in slow_virt_to_phys() for
X86_PAE
- [x86] ACPI / EC: Fix regression due to conflicting firmware behavior
between Samsung and Acer. (regression in 3.16.3)
- mm: free compound page with correct order
- lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()
- ext4: fix overflow when updating superblock backups after resize
- ext4: fix oops when loading block bitmap failed
- ext4: enable journal checksum when metadata checksum feature enabled
- ext4: prevent bugon on race between write/fcntl
- ext4: bail out from make_indexed_dir() on first error
- PCI: Rename sysfs 'enabled' file back to 'enable' (regression in 3.13)
- fs: allow open(dir, O_TMPFILE|..., 0) with mode 0
- [arm*] tracing/syscalls: Ignore numbers outside NR_syscalls' range
- nfs: fix kernel warning when removing proc entry
http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt2
- rbd: Fix error recovery in rbd_obj_read_sync()
- regulator: max77693: Fix use of uninitialized regulator config
- xhci: no switching back on non-ULT Haswell (regression in 3.12)
- Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup
- ocfs2: fix breakage in o2net_send_tcp_msg() (regression in 3.15)
- [armhf] phy: omap-usb2: Enable runtime PM of omap-usb2 phy properly
(regression in 3.16)
- USB: cdc-acm: add quirk for control-line state requests
(regression in 3.16)
- sysfs: driver core: Fix glue dir race condition by gdp_mutex
- drm/nouveau: make sure display hardware is reinitialised on runtime
resume (regression in 3.15)
- drm/nv50/disp: fix dpms regression on certain boards
- drm/nouveau/bios: memset dcb struct to zero before parsing
- GFS2: Make rename not save dirent location (regression in 3.14)
- netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
- netfilter: nf_tables: check for NULL in nf_tables_newchain pcpu stats
allocation (regression in 3.16)
- netfilter: nfnetlink_log: fix maximum packet length logged to userspace
- netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops()
- mmc: core: sdio: Fix unconditional wake_up_process() on sdio thread
(regression in 3.16)
- mmc: don't request CD IRQ until mmc_start_host()
- fs: make cont_expand_zero interruptible
- UBIFS: fix a race condition
- [x86] fpu: __restore_xstate_sig()->math_state_restore() needs
preempt_disable()
- [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to
handle_signal()
- perf: Fix unclone_ctx() vs. locking
- evm: properly handle INTEGRITY_NOXATTRS EVM status
- [alpha] vfs: missing data dependency barrier in prepend_name()
- jffs2: kill wbuf_queued/wbuf_dwork_lock
- fix misuses of f_count() in ppp and netlink
- sched: Use dl_bw_of() under RCU read lock
- [s390*] topology: call set_sched_topology early
- [armhf] mfd: ti_am335x_tscadc: Fix TSC operation after ADC continouous
mode (regression in 3.14)
- [armhf] mfd: ti_am335x_tscadc: Fix TSC resume (regression in 3.14)
- selinux: fix inode security list corruption
- blk-mq: fix potential hang if rolling wakeup depth is too high
(regression in 3.16)
- block: fix alignment_offset math that assumes io_min is a power-of-2
- drm/nouveau/gpio: rename g92 class to g94 (regression in 3.16)
- [x86] drm/i915: Do not leak pages when freeing userptr objects
- media: v4l2-common: fix overflow in v4l_bound_align_image()
- sched: Use rq->rd in sched_setaffinity() under RCU read lock
- [powerpc*] use device_online/offline() instead of cpu_up/down()
(regression in 3.11)
- xen-blkback: fix leak on grant map error path
- net: skb_fclone_busy() needs to detect orphaned skb (regression in 3.16)
- rbd: avoid format-security warning inside alloc_workqueue()
- rbd: fix error return code in rbd_dev_device_setup()
- media: ttusb-dec: buffer overflow in ioctl (CVE-2014-8884)
- dm raid: ensure superblock's size matches device's logical block size
- ahci: disable MSI instead of NCQ on Samsung pci-e SSDs on macbooks
(Closes: #772435)
- mac80211: properly flush delayed scan work on interface removal
- [i386] microcode, AMD: Fix early ucode loading on 32-bit
(regression in 3.14)
- [armhf] mvebu: armada xp: Generalize use of i2c quirk
(regression in 3.12)
- mac80211: fix use-after-free in defragmentation
- iwlwifi: fix RFkill while calibrating (regression in 3.16)
- tun: Fix csum_start with VLAN acceleration (regression in 3.12)
- macvtap: Fix csum_start when VLAN tags are present
- dm thin: grab a virtual cell before looking up the mapping
- [x86] KVM: Fix uninitialized op->type for some immediate values
- [powerpc*] hwrng: pseries - port to new read API and fix stack corruption
- drm/radeon: set correct CE ram size for CIK
- drm/radeon: make sure mode init is complete in bandwidth_update
- cpufreq: Avoid crash in resume on SMP without OPP (regresion in 3.12)
- [i386] microcode, AMD: Fix ucode patch stashing on 32-bit
(regression in 3.14)
- [armhf] mfd: twl4030-power: Fix poweroff with PM configuration enabled
(regression in 3.16)
- [hppa] Use compat layer for msgctl, shmat, shmctl and semtimedop syscalls
- tracing: Do not busy wait in buffer splice (regresion in 3.16)
- param: fix crash on bad kernel arguments (regression in 3.16)
- audit: keep inode pinned
- drm/radeon: add locking around atombios scratch space usage
- nfs: fix pnfs direct write memory leak
- nfs: Fix use of uninitialized variable in nfs_getattr()
- NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired
- NFSv4.1: nfs41_clear_delegation_stateid shouldn't trust
NFS_DELEGATED_STATE
- NFSv4: Fix races between nfs_remove_bad_delegation() and delegation
return
- NFSv4: Ensure that we call FREE_STATEID when NFSv4.x stateids are revoked
- NFS: Don't try to reclaim delegation open state if recovery failed
- [arm64] efi: Fix stub cache maintenance
- [arm64] __clear_user: handle exceptions on strb (CVE-2014-7843)
- [arm64] Correct the race condition in aarch64_insn_patch_text_sync()
- Fix thinko in iov_iter_single_seg_count
- libceph: do not crash on large auth tickets
- [armel,armhf] 8191/1: decompressor: ensure I-side picks up relocated code
- zram: avoid kunmap_atomic() of a NULL pointer
- firewire: cdev: prevent kernel stack leaking into ioctl arguments
- md: Always set RECOVERY_NEEDED when clearing RECOVERY_FROZEN
(regression in 3.13)
- vxlan: Do not reuse sockets for a different address family
- net: sctp: fix NULL pointer dereference in af->from_addr_param on
malformed packet (CVE-2014-7841)
- net: sctp: fix memory leak in auth key management
- [armel,m68k] ipv6: fix IPV6_PKTINFO with v4 mapped (regression in 3.15)
- netlink: Properly unbind in error conditions. (regression in 3.16)
- smsc911x: power-up phydev before doing a software reset.
(regression in 3.14)
- [sparc*] sunvdc: limit each sg segment to a page
- [sparc*] vio: fix reuse of vio_dring slot
- drm/radeon: initialize sadb to NULL in the audio code
- [x86] KVM: Don't report guest userspace emulation error to userspace
- crypto: caam - remove duplicated sg copy functions
- audit: correct AUDIT_GET_FEATURE return message type
- memory-hotplug: Remove "weak" from memory_block_size_bytes() declaration
(regression in 3.14)
- [s390*] vmcore: Remove "weak" from function declarations
- [s390*] clocksource: Remove "weak" from clocksource_default_clock()
declaration
- IB/core: Clear AH attr variable to prevent garbage data
- [amd64] x32, audit: Fix x32's AUDIT_ARCH wrt audit
- [armhf] dts: am335x-evm: Fix 5th NAND partition's name
(regression in 3.15)
- dell-wmi: Fix access out of memory
[ Ben Hutchings ]
* [x86] Complete Thunderbolt support on Apple computers (Closes: #768653)
- PCI: Add pci_fixup_suspend_late quirk pass
- PCI: Suspend/resume quirks for Apple thunderbolt
- Enable THUNDERBOLT as module
* [amd64] traps: Stop using IST for #SS (CVE-2014-9090)
* [amd64] traps: Fix the espfix64 #DF fixup and rewrite it in C
* [amd64] traps: Rework bad_iret
* [amd64] asm/traps: Disable tracing and kprobes in fixup_bad_iret and
sync_regs
* Fix ABI changes in iovec, of, perf and truncate
* Ignore ABI changes in iwlwifi, KVM and spi-nor
* Revert "drivers/net: Disable UFO through virtio" in macvtap and tun.
This removes the need to shut down VMs if migrating to a patched
host.
[ Ian Campbell ]
* [xen] Backport various netback fixes (Closes: #767261).
* Backport fix for TSO with mv643xx_eth driver, replacing previous workaround
(#764162)
* [armhf] Increase Ethernet phy startup delay on Banana-Pi. Patch from
Karsten Merker (Closes: #767042)
* [armhf] Enable FB_SIMPLE, used on some Exynos platforms and elsewhere.
* [arm64] Backport various upstream fixes and improvements to the APM X-gene
Ethernet driver.
* Honour stdout-path from Device Tree, along with supporting any supplied
options. (Closes: #770212)
* [armhf] Add udeb modules to support video and keyboard for imx6. Patch from
Vagrant Cascadian (Closes: #770635)
* [device-tree] Reserve memreserve regions even if they partially overlap
with an existing reservation. Fixes boot on Midway.
* [arm64] Enable reboot on the Xgene platform.
-- Ben Hutchings <email address hidden> Mon, 08 Dec 2014 20:03:18 +0000
