kernel-packages team mailing list archive

Thread
Date
[Bug 1540412] Re: Trusty update to 3.16.7-ckt23 stable release

To: kernel-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1540412@xxxxxxxxxxxxxxxxxx>
Date: Mon, 22 Feb 2016 18:37:21 -0000
Reply-to: Bug 1540412 <1540412@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
This bug was fixed in the package linux-lts-utopic -
3.16.0-62.82~14.04.1

---------------
linux-lts-utopic (3.16.0-62.82~14.04.1) trusty; urgency=low

  [ Seth Forshee ]

  * SAUCE: cred: Add clone_cred() interface
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of selectively
    raising caps
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux-lts-utopic (3.16.0-61.81~14.04.1) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1541076

  [ Eric Dumazet ]

  * SAUCE: (no-up) udp: properly support MSG_PEEK with truncated buffers
    - LP: #1527902

  [ J. R. Okajima ]

  * SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

  [ Upstream Kernel Changes ]

  * Revert "[stable-only] net: add length argument to
    skb_copy_and_csum_datagram_iovec"
    - LP: #1540412
  * xfrm: dst_entries_init() per-net dst_ops
    - LP: #1486670
  * fuse: break infinite loop in fuse_fill_write_pages()
    - LP: #1540412
  * usb: gadget: pxa27x: fix suspend callback
    - LP: #1540412
  * iio: fix some warning messages
    - LP: #1540412
  * USB: cp210x: Remove CP2110 ID from compatibility list
    - LP: #1540412
  * USB: cdc_acm: Ignore Infineon Flash Loader utility
    - LP: #1540412
  * USB: serial: Another Infineon flash loader USB ID
    - LP: #1540412
  * ext4: Fix handling of extended tv_sec
    - LP: #1540412
  * jbd2: Fix unreclaimed pages after truncate in data=journal mode
    - LP: #1540412
  * drm/ttm: Fixed a read/write lock imbalance
    - LP: #1540412
  * AHCI: Fix softreset failed issue of Port Multiplier
    - LP: #1540412
  * sata_sil: disable trim
    - LP: #1540412
  * usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter
    JMicron
    - LP: #1540412
  * staging: lustre: echo_copy.._lsm() dereferences userland pointers
    directly
    - LP: #1540412
  * irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
    - LP: #1540412
  * usb: core : hub: Fix BOS 'NULL pointer' kernel panic
    - LP: #1540412
  * USB: whci-hcd: add check for dma mapping error
    - LP: #1540412
  * usb: Use the USB_SS_MULT() macro to decode burst multiplier for log
    message
    - LP: #1540412
  * dm btree: fix leak of bufio-backed block in btree_split_sibling error
    path
    - LP: #1540412
  * perf: Fix PERF_EVENT_IOC_PERIOD deadlock
    - LP: #1540412
  * usb: xhci: fix config fail of FS hub behind a HS hub with MTT
    - LP: #1540412
  * ALSA: rme96: Fix unexpected volume reset after rate changes
    - LP: #1540412
  * ALSA: hda - Add inverted dmic for Packard Bell DOTS
    - LP: #1523232, #1540412
  * virtio: fix memory leak of virtio ida cache layers
    - LP: #1540412
  * nfs4: limit callback decoding to received bytes
    - LP: #1540412
  * SUNRPC: Fix callback channel
    - LP: #1540412
  * IB/srp: Fix possible send queue overflow
    - LP: #1540412
  * ALSA: hda - Fixing speaker noise on the two latest thinkpad models
    - LP: #1523517, #1540412
  * 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
    - LP: #1540412
  * radeon/cik: Fix GFX IB test on Big-Endian
    - LP: #1540412
  * radeon: Fix VCE ring test for Big-Endian systems
    - LP: #1540412
  * radeon: Fix VCE IB test on Big-Endian systems
    - LP: #1540412
  * ALSA: hda - Fix noise problems on Thinkpad T440s
    - LP: #1540412
  * dm thin metadata: fix bug when taking a metadata snapshot
    - LP: #1540412
  * dm space map metadata: fix ref counting bug when bootstrapping a new
    space map
    - LP: #1540412
  * ipmi: move timer init to before irq is setup
    - LP: #1540412
  * dm btree: fix bufio buffer leaks in dm_btree_del() error path
    - LP: #1540412
  * vgaarb: fix signal handling in vga_get()
    - LP: #1540412
  * xhci: fix usb2 resume timing and races.
    - LP: #1540412
  * USB: add quirk for devices with broken LPM
    - LP: #1540412
  * parisc iommu: fix panic due to trying to allocate too large region
    - LP: #1540412
  * mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
    - LP: #1540412
  * mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't
    make any progress
    - LP: #1540412
  * mm: hugetlb: call huge_pte_alloc() only if ptep is null
    - LP: #1540412
  * drivers/base/memory.c: prohibit offlining of memory blocks with missing
    sections
    - LP: #1540412
  * ocfs2: fix SGID not inherited issue
    - LP: #1540412
  * sh64: fix __NR_fgetxattr
    - LP: #1540412
  * usb: musb: USB_TI_CPPI41_DMA requires dmaengine support
    - LP: #1540412
  * efi: Disable interrupts around EFI calls, not in the epilog/prolog
    calls
    - LP: #1540412
  * MIPS: uaccess: Take EVA into account in __copy_from_user()
    - LP: #1540412
  * MIPS: uaccess: Take EVA into account in [__]clear_user
    - LP: #1540412
  * tools: Add a "make all" rule
    - LP: #1540412
  * i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
    - LP: #1540412
  * xen/events/fifo: Consume unprocessed events when a CPU dies
    - LP: #1540412
  * video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
    - LP: #1540412
  * crypto: skcipher - Copy iv from desc even for 0-len walks
    - LP: #1540412
  * rfkill: copy the name into the rfkill struct
    - LP: #1540412
  * ses: Fix problems with simple enclosures
    - LP: #1540412
  * ses: fix additional element traversal bug
    - LP: #1540412
  * powercap / RAPL: fix BIOS lock check
    - LP: #1540412
  * n_tty: Fix poll() after buffer-limited eof push read
    - LP: #1540412
  * tty: Fix GPF in flush_to_ldisc()
    - LP: #1540412
  * ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
    DragonFly
    - LP: #1540412
  * ARM: 8471/1: need to save/restore arm register(r11) when it is
    corrupted
    - LP: #1540412
  * ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd
    - LP: #1540412
  * spi: fix parent-device reference leak
    - LP: #1540412
  * dma-debug: Fix dma_debug_entry offset calculation
    - LP: #1540412
  * ARC: dw2 unwind: Reinstante unwinding out of modules
    - LP: #1540412
  * ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing
    - LP: #1540412
  * powerpc/powernv: Fix the overflow of OPAL message notifiers head array
    - LP: #1540412
  * powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type
    - LP: #1540412
  * USB: ipaq.c: fix a timeout loop
    - LP: #1540412
  * USB: fix invalid memory access in hub_activate()
    - LP: #1540412
  * pinctrl: bcm2835: Fix initial value for direction_output
    - LP: #1540412
  * net: phy: mdio-mux: Check return value of mdiobus_alloc()
    - LP: #1540412
  * sh_eth: fix TX buffer byte-swapping
    - LP: #1540412
  * mISDN: fix a loop count
    - LP: #1540412
  * amd-xgbe: fix a couple timeout loops
    - LP: #1540412
  * qlcnic: fix a timeout loop
    - LP: #1540412
  * ser_gigaset: fix deallocation of platform device structure
    - LP: #1540412
  * net: fix warnings in 'make htmldocs' by moving macro definition out of
    field declaration
    - LP: #1540412
  * include/linux/mmdebug.h: should include linux/bug.h
    - LP: #1540412
  * drm/i915: Fix SRC_COPY width on 830/845g
    - LP: #1540412
  * vmstat: allocate vmstat_wq before it is used
    - LP: #1540412
  * KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
    - LP: #1540412
  * ASoC: wm8974: set cache type for regmap
    - LP: #1540412
  * ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
    - LP: #1540412
  * scripts: recordmcount: break hardlinks
    - LP: #1540412
  * ftrace/scripts: Have recordmcount copy the object file
    - LP: #1540412
  * ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
    - LP: #1540412
  * s390/dis: Fix handling of format specifiers
    - LP: #1540412
  * parisc: Fix syscall restarts
    - LP: #1540412
  * ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
    - LP: #1540412
  * MIPS: uaccess: Fix strlen_user with EVA
    - LP: #1540412
  * arm: fix handling of F_OFD_... in oabi_fcntl64()
    - LP: #1540412
  * ocfs2: fix BUG when calculate new backup super
    - LP: #1540412
  * mm/memory_hotplug.c: check for missing sections in
    test_pages_in_a_zone()
    - LP: #1540412
  * net/mlx4_en: Remove dependency between timestamping capability and
    service_task
    - LP: #1540412
  * net/mlx4_en: Fix HW timestamp init issue upon system startup
    - LP: #1540412
  * ipv6/addrlabel: fix ip6addrlbl_get()
    - LP: #1540412
  * qlcnic: fix a loop exit condition better
    - LP: #1540412
  * genirq: Prevent chip buslock deadlock
    - LP: #1540412
  * ftrace/scripts: Fix incorrect use of sprintf in recordmcount
    - LP: #1540412
  * tracing: Fix setting of start_index in find_next()
    - LP: #1540412
  * dts: vt8500: Add SDHC node to DTS file for WM8650
    - LP: #1540412
  * x86/mce: Ensure offline CPUs don't participate in rendezvous process
    - LP: #1540412
  * ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
    - LP: #1540412
  * async_tx: use GFP_NOWAIT rather than GFP_IO
    - LP: #1540412
  * ftrace/module: Call clean up function when module init fails early
    - LP: #1540412
  * ASoC: Use nested lock for snd_soc_dapm_mutex_lock
    - LP: #1540412
  * net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
    - LP: #1540412
  * net: possible use after free in dst_release
    - LP: #1540412
  * kvm: x86: only channel 0 of the i8254 is linked to the HPET
    - LP: #1540412
  * firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
    - LP: #1540412
  * Linux 3.16.7-ckt23
    - LP: #1540412

 -- Luis Henriques <luis.henriques@xxxxxxxxxxxxx>  Fri, 19 Feb 2016
11:17:23 +0000

** Changed in: linux-lts-utopic (Ubuntu Trusty)
       Status: Fix Committed => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2016-1575

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2016-1576

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-lts-utopic in Ubuntu.
https://bugs.launchpad.net/bugs/1540412

Title:
  Trusty update to 3.16.7-ckt23 stable release

Status in linux-lts-utopic package in Ubuntu:
  New
Status in linux-lts-utopic source package in Trusty:
  Fix Released

Bug description:
  SRU Justification

      Impact:
         The upstream process for stable tree updates is quite similar
         in scope to the Ubuntu SRU process, e.g., each patch has to
         demonstrably fix a bug, and each patch is vetted by upstream
         by originating either directly from a mainline/stable Linux tree or
         a minimally backported form of that patch. The 3.16.7-ckt23 upstream stable
         patch set is now available. It should be included in the Ubuntu
         kernel as well.

         git://kernel.ubuntu.com/ubuntu/linux.git

      TEST CASE: TBD

         The following patches from the 3.16.7-ckt23 stable release
  shall be applied:

  fuse: break infinite loop in fuse_fill_write_pages()
  usb: gadget: pxa27x: fix suspend callback
  iio: fix some warning messages
  USB: cp210x: Remove CP2110 ID from compatibility list
  USB: cdc_acm: Ignore Infineon Flash Loader utility
  USB: serial: Another Infineon flash loader USB ID
  ext4: Fix handling of extended tv_sec
  jbd2: Fix unreclaimed pages after truncate in data=journal mode
  drm/ttm: Fixed a read/write lock imbalance
  AHCI: Fix softreset failed issue of Port Multiplier
  sata_sil: disable trim
  usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron
  staging: lustre: echo_copy.._lsm() dereferences userland pointers directly
  irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
  usb: core : hub: Fix BOS 'NULL pointer' kernel panic
  USB: whci-hcd: add check for dma mapping error
  usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message
  dm btree: fix leak of bufio-backed block in btree_split_sibling error path
  SCSI: Fix NULL pointer dereference in runtime PM
  perf: Fix PERF_EVENT_IOC_PERIOD deadlock
  usb: xhci: fix config fail of FS hub behind a HS hub with MTT
  ALSA: rme96: Fix unexpected volume reset after rate changes
  ALSA: hda - Add inverted dmic for Packard Bell DOTS
  virtio: fix memory leak of virtio ida cache layers
  nfs4: limit callback decoding to received bytes
  SUNRPC: Fix callback channel
  IB/srp: Fix possible send queue overflow
  ALSA: hda - Fixing speaker noise on the two latest thinkpad models
  9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
  radeon/cik: Fix GFX IB test on Big-Endian
  radeon: Fix VCE ring test for Big-Endian systems
  radeon: Fix VCE IB test on Big-Endian systems
  ALSA: hda - Fix noise problems on Thinkpad T440s
  dm thin metadata: fix bug when taking a metadata snapshot
  dm space map metadata: fix ref counting bug when bootstrapping a new space map
  ipmi: move timer init to before irq is setup
  dm btree: fix bufio buffer leaks in dm_btree_del() error path
  vgaarb: fix signal handling in vga_get()
  xhci: fix usb2 resume timing and races.
  USB: add quirk for devices with broken LPM
  parisc iommu: fix panic due to trying to allocate too large region
  mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
  mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
  mm: hugetlb: call huge_pte_alloc() only if ptep is null
  drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
  ocfs2: fix SGID not inherited issue
  sh64: fix __NR_fgetxattr
  usb: musb: USB_TI_CPPI41_DMA requires dmaengine support
  efi: Disable interrupts around EFI calls, not in the epilog/prolog calls
  MIPS: uaccess: Take EVA into account in __copy_from_user()
  MIPS: uaccess: Take EVA into account in [__]clear_user
  tools: Add a "make all" rule
  i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
  xen/events/fifo: Consume unprocessed events when a CPU dies
  video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
  crypto: skcipher - Copy iv from desc even for 0-len walks
  rfkill: copy the name into the rfkill struct
  ses: Fix problems with simple enclosures
  Revert "SCSI: Fix NULL pointer dereference in runtime PM"
  ses: fix additional element traversal bug
  powercap / RAPL: fix BIOS lock check
  n_tty: Fix poll() after buffer-limited eof push read
  tty: Fix GPF in flush_to_ldisc()
  ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly
  ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted
  ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd
  spi: fix parent-device reference leak
  dma-debug: Fix dma_debug_entry offset calculation
  ARC: dw2 unwind: Reinstante unwinding out of modules
  ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing
  powerpc/powernv: Fix the overflow of OPAL message notifiers head array
  powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type
  xen: Add RING_COPY_REQUEST()
  xen-netback: don't use last request to determine minimum Tx credit
  xen-netback: use RING_COPY_REQUEST() throughout
  xen-blkback: only read request operation from shared ring once
  xen-blkback: read from indirect descriptors only once
  xen/pciback: Save xen_pci_op commands before processing it
  xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled
  xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
  xen/pciback: Do not install an IRQ handler for MSI interrupts.
  xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled.
  xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.
  USB: ipaq.c: fix a timeout loop
  USB: fix invalid memory access in hub_activate()
  pinctrl: bcm2835: Fix initial value for direction_output
  net: phy: mdio-mux: Check return value of mdiobus_alloc()
  sh_eth: fix TX buffer byte-swapping
  mISDN: fix a loop count
  amd-xgbe: fix a couple timeout loops
  qlcnic: fix a timeout loop
  ser_gigaset: fix deallocation of platform device structure
  net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration
  include/linux/mmdebug.h: should include linux/bug.h
  drm/i915: Fix SRC_COPY width on 830/845g
  vmstat: allocate vmstat_wq before it is used
  KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
  ASoC: wm8974: set cache type for regmap
  ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
  scripts: recordmcount: break hardlinks
  ftrace/scripts: Have recordmcount copy the object file
  ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
  s390/dis: Fix handling of format specifiers
  parisc: Fix syscall restarts
  ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
  MIPS: uaccess: Fix strlen_user with EVA
  [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64()
  ocfs2: fix BUG when calculate new backup super
  mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()
  net/mlx4_en: Remove dependency between timestamping capability and service_task
  net/mlx4_en: Fix HW timestamp init issue upon system startup
  ipv6/addrlabel: fix ip6addrlbl_get()
  qlcnic: fix a loop exit condition better
  genirq: Prevent chip buslock deadlock
  ftrace/scripts: Fix incorrect use of sprintf in recordmcount
  tracing: Fix setting of start_index in find_next()
  dts: vt8500: Add SDHC node to DTS file for WM8650
  x86/mce: Ensure offline CPUs don't participate in rendezvous process
  ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
  async_tx: use GFP_NOWAIT rather than GFP_IO
  ftrace/module: Call clean up function when module init fails early
  ASoC: Use nested lock for snd_soc_dapm_mutex_lock
  net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
  net: possible use after free in dst_release
  kvm: x86: only channel 0 of the i8254 is linked to the HPET
  firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
  Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec"
  udp: properly support MSG_PEEK with truncated buffers
  KEYS: Fix keyring ref leak in join_session_keyring()
  Linux 3.16.7-ckt23

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-lts-utopic/+bug/1540412/+subscriptions
References

[Bug 1540412] [NEW] Trusty update to 3.16.7-ckt23 stable release
From: Luis Henriques, 2016-02-01