kernel-packages team mailing list archive

Thread
Date
[Bug 1335084] Re: Saucy update to 3.11.10.12 stable release

To: kernel-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1335084@xxxxxxxxxxxxxxxxxx>
Date: Wed, 16 Jul 2014 19:53:22 -0000
Reply-to: Bug 1335084 <1335084@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
This bug was fixed in the package linux - 3.11.0-26.45

---------------
linux (3.11.0-26.45) saucy; urgency=low

  [ Upstream Kernel Changes ]

  * l2tp: Privilege escalation in ppp over l2tp sockets
    - LP: #1341472
    - CVE-2014-4943

linux (3.11.0-26.44) saucy; urgency=low

  [ Luis Henriques ]

  * Merged back Ubuntu-3.11.0-24.42 security release
  * Revert "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)"
    - LP: #1337339
  * Release Tracking Bug
    - LP: #1338556

  [ Upstream Kernel Changes ]

  * ptrace,x86: force IRET path after a ptrace_stop()
    - LP: #1337339
    - CVE-2014-4699

linux (3.11.0-25.43) saucy; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1336203

  [ Upstream Kernel Changes ]

  * cfg80211: free sme on connection failures
    - LP: #1335084
  * sched: Sanitize irq accounting madness
    - LP: #1335084
  * sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
    - LP: #1335084
  * net: cpsw: fix null dereference at probe
    - LP: #1335084
  * mac80211: fix suspend vs. association race
    - LP: #1335084
  * mac80211: fix on-channel remain-on-channel
    - LP: #1335084
  * af_iucv: wrong mapping of sent and confirmed skbs
    - LP: #1335084
  * net: filter: s390: fix JIT address randomization
    - LP: #1335084
  * perf: Limit perf_event_attr::sample_period to 63 bits
    - LP: #1335084
  * perf: Prevent false warning in perf_swevent_add
    - LP: #1335084
  * drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
    - LP: #1335084
  * drm/radeon: also try GART for CPU accessed buffers
    - LP: #1335084
  * drm/radeon: handle non-VGA class pci devices with ATRM
    - LP: #1335084
  * drm/radeon: fix register typo on si
    - LP: #1335084
  * drm/radeon: avoid segfault on device open when accel is not working.
    - LP: #1335084
  * can: peak_pci: prevent use after free at netdev removal
    - LP: #1335084
  * nfsd4: remove lockowner when removing lock stateid
    - LP: #1335084
  * nfsd4: warn on finding lockowner without stateid's
    - LP: #1335084
  * hwpoison, hugetlb: lock_page/unlock_page does not match for handling a
    free hugepage
    - LP: #1335084
  * mm/memory-failure.c: fix memory leak by race between poison and
    unpoison
    - LP: #1335084
  * netfilter: ipv4: defrag: set local_df flag on defragmented skb
    - LP: #1335084
  * ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5
    on all OMAP3 platforms
    - LP: #1335084
  * dma: dw: allow shared interrupts
    - LP: #1335084
  * dmaengine: dw: went back to plain {request,free}_irq() calls
    - LP: #1335084
  * ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
    - LP: #1335084
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1335084
  * futex: Add another early deadlock detection check
    - LP: #1335084
  * futex: Prevent attaching to kernel threads
    - LP: #1335084
  * ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled
    - LP: #1335084
  * cpufreq: remove race while accessing cur_policy
    - LP: #1335084
  * cpufreq: cpu0: drop wrong devm usage
    - LP: #1335084
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1335084
  * ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets
    - LP: #1335084
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1335084
  * ARM: 8064/1: fix v7-M signal return
    - LP: #1335084
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1335084
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1335084
  * dm cache: always split discards on cache block boundaries
    - LP: #1335084
  * powerpc: Fix 64 bit builds with binutils 2.24
    - LP: #1335084
  * powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST
    mode
    - LP: #1335084
  * rtmutex: Fix deadlock detector for real
    - LP: #1335084
  * drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission
    - LP: #1335084
  * audit: restore order of tty and ses fields in log output
    - LP: #1335084
  * drm/nouveau/pm/fan: drop the fan lock in fan_update() before
    rescheduling
    - LP: #1335084
  * leds: leds-pwm: properly clean up after probe failure
    - LP: #1335084
  * clk: vexpress: NULL dereference on error path
    - LP: #1335084
  * fix our current target reap infrastructure
    - LP: #1335084
  * dual scan thread bug fix
    - LP: #1335084
  * genirq: Provide irq_force_affinity fallback for non-SMP
    - LP: #1335084
  * i2c: designware: Mask all interrupts during i2c controller enable
    - LP: #1335084
  * crypto: s390 - fix aes,des ctr mode concurrency finding.
    - LP: #1335084
  * Staging: speakup: Move pasting into a work item
    - LP: #1335084
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1335084
  * can: only rename enabled led triggers when changing the netdev name
    - LP: #1335084
  * USB: io_ti: fix firmware download on big-endian machines (part 2)
    - LP: #1335084
  * USB: ftdi_sio: add NovaTech OrionLXm product ID
    - LP: #1335084
  * USB: serial: option: add support for Novatel E371 PCIe card
    - LP: #1335084
  * USB: cdc-wdm: properly include types.h
    - LP: #1335084
  * md: always set MD_RECOVERY_INTR when aborting a reshape or other
    "resync".
    - LP: #1335084
  * xhci: delete endpoints from bandwidth list before freeing whole device
    - LP: #1335084
  * md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
    - LP: #1335084
  * ALSA: hda/analog - Fix silent output on ASUS A8JN
    - LP: #1335084
  * ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
    - LP: #1335084
  * ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
    - LP: #1335084
  * iser-target: Add missing target_put_sess_cmd for ImmedateData failure
    - LP: #1335084
  * iscsi-target: Fix wrong buffer / buffer overrun in
    iscsi_change_param_value()
    - LP: #1335084
  * percpu-refcount: fix usage of this_cpu_ops
    - LP: #1335084
  * target: Fix alua_access_state attribute OOPs for un-configured devices
    - LP: #1335084
  * mm: rmap: fix use-after-free in __put_anon_vma
    - LP: #1335084
  * usb: cdc-wdm: export cdc-wdm uapi header
    - LP: #1335084
  * staging: comedi: ni_daq_700: add mux settling delay
    - LP: #1335084
  * kvm: free resources after canceling async_pf
    - LP: #1335084
  * kvm: remove .done from struct kvm_async_pf
    - LP: #1335084
  * KVM: async_pf: mm->mm_users can not pin apf->mm
    - LP: #1335084
  * mm/page-writeback.c: fix divide by zero in pos_ratio_polynom
    - LP: #1335084
  * dma: mv_xor: Flush descriptors before activating a channel
    - LP: #1335084
  * skbuff: skb_segment: orphan frags before copying
    - LP: #1335084
  * Target/iscsi,iser: Avoid accepting transport connections during stop
    stage
    - LP: #1335084
  * iser-target: Fix multi network portal shutdown regression
    - LP: #1335084
  * target: Allow READ_CAPACITY opcode in ALUA Standby access state
    - LP: #1335084
  * mm: compaction: reset cached scanner pfn's before reading them
    - LP: #1335084
  * mm: compaction: detect when scanners meet in isolate_freepages
    - LP: #1335084
  * MIPS: asm: thread_info: Add _TIF_SECCOMP flag
    - LP: #1335084
  * perf: Fix race in removing an event
    - LP: #1335084
  * hwmon: (ntc_thermistor) Fix dependencies
    - LP: #1335084
  * hwmon: (ntc_thermistor) Fix OF device ID mapping
    - LP: #1335084
  * fs,userns: Change inode_capable to capable_wrt_inode_uidgid
    - LP: #1335084
  * auditsc: audit_krule mask accesses need bounds checking
    - LP: #1335084
  * megaraid: Use resource_size_t for PCI resources, not long
    - LP: #1335084
  * Linux 3.11.10.12
    - LP: #1335084
  * lzo: properly check for overruns
    - LP: #1335313
    - CVE-2014-4608
  * lz4: ensure length does not wrap
    - LP: #1335314
    - CVE-2014-4611
 -- Luis Henriques <luis.henriques@xxxxxxxxxxxxx>   Mon, 14 Jul 2014 13:20:06 +0100

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1335084

Title:
  Saucy update to 3.11.10.12 stable release

Status in “linux” package in Ubuntu:
  New
Status in “linux” source package in Saucy:
  Fix Released

Bug description:
  SRU Justification

      Impact:
         The upstream process for stable tree updates is quite similar
         in scope to the Ubuntu SRU process, e.g., each patch has to
         demonstrably fix a bug, and each patch is vetted by upstream
         by originating either directly from Linus' tree or in a minimally
         backported form of that patch. The 3.11.10.12 upstream stable
         patch set is now available. It should be included in the Ubuntu
         kernel as well.

         git://git.kernel.org/

      TEST CASE: TBD

         The following patches are in the 3.11.10.12 stable release:

  Linux 3.11.10.12
  [SCSI] megaraid: Use resource_size_t for PCI resources, not long
  auditsc: audit_krule mask accesses need bounds checking
  fs,userns: Change inode_capable to capable_wrt_inode_uidgid
  hwmon: (ntc_thermistor) Fix OF device ID mapping
  hwmon: (ntc_thermistor) Fix dependencies
  perf: Fix race in removing an event
  MIPS: asm: thread_info: Add _TIF_SECCOMP flag
  mm: compaction: detect when scanners meet in isolate_freepages
  mm: compaction: reset cached scanner pfn's before reading them
  target: Allow READ_CAPACITY opcode in ALUA Standby access state
  iser-target: Fix multi network portal shutdown regression
  Target/iscsi,iser: Avoid accepting transport connections during stop stage
  skbuff: skb_segment: orphan frags before copying
  dma: mv_xor: Flush descriptors before activating a channel
  mm/page-writeback.c: fix divide by zero in pos_ratio_polynom
  KVM: async_pf: mm->mm_users can not pin apf->mm
  kvm: remove .done from struct kvm_async_pf
  kvm: free resources after canceling async_pf
  staging: comedi: ni_daq_700: add mux settling delay
  usb: cdc-wdm: export cdc-wdm uapi header
  mm: rmap: fix use-after-free in __put_anon_vma
  target: Fix alua_access_state attribute OOPs for un-configured devices
  percpu-refcount: fix usage of this_cpu_ops
  iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value()
  iser-target: Add missing target_put_sess_cmd for ImmedateData failure
  ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
  ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
  ALSA: hda/analog - Fix silent output on ASUS A8JN
  md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
  xhci: delete endpoints from bandwidth list before freeing whole device
  md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
  USB: cdc-wdm: properly include types.h
  USB: serial: option: add support for Novatel E371 PCIe card
  USB: ftdi_sio: add NovaTech OrionLXm product ID
  USB: io_ti: fix firmware download on big-endian machines (part 2)
  can: only rename enabled led triggers when changing the netdev name
  USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
  Staging: speakup: Move pasting into a work item
  crypto: s390 - fix aes,des ctr mode concurrency finding.
  i2c: designware: Mask all interrupts during i2c controller enable
  genirq: Provide irq_force_affinity fallback for non-SMP
  [SCSI] dual scan thread bug fix
  [SCSI] fix our current target reap infrastructure
  clk: vexpress: NULL dereference on error path
  leds: leds-pwm: properly clean up after probe failure
  drm/nouveau/pm/fan: drop the fan lock in fan_update() before rescheduling
  audit: restore order of tty and ses fields in log output
  drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission
  rtmutex: Fix deadlock detector for real
  powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode
  powerpc: Fix 64 bit builds with binutils 2.24
  dm cache: always split discards on cache block boundaries
  drm/i915: Only copy back the modified fields to userspace from execbuffer
  Input: synaptics - T540p - unify with other LEN0034 models
  ARM: 8064/1: fix v7-M signal return
  ARM: 8051/1: put_user: fix possible data corruption in put_user
  ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets
  ARM: imx: fix error handling in ipu device registration
  cpufreq: cpu0: drop wrong devm usage
  cpufreq: remove race while accessing cur_policy
  ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled
  futex: Prevent attaching to kernel threads
  futex: Add another early deadlock detection check
  Input: synaptics - add min/max quirk for the ThinkPad W540
  ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
  dmaengine: dw: went back to plain {request,free}_irq() calls
  dma: dw: allow shared interrupts
  ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5 on all OMAP3 platforms
  netfilter: ipv4: defrag: set local_df flag on defragmented skb
  mm/memory-failure.c: fix memory leak by race between poison and unpoison
  hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
  nfsd4: warn on finding lockowner without stateid's
  nfsd4: remove lockowner when removing lock stateid
  can: peak_pci: prevent use after free at netdev removal
  drm/radeon: avoid segfault on device open when accel is not working.
  drm/radeon: fix register typo on si
  drm/radeon: handle non-VGA class pci devices with ATRM
  drm/radeon: also try GART for CPU accessed buffers
  drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
  perf: Prevent false warning in perf_swevent_add
  perf: Limit perf_event_attr::sample_period to 63 bits
  net: filter: s390: fix JIT address randomization
  af_iucv: wrong mapping of sent and confirmed skbs
  mac80211: fix on-channel remain-on-channel
  mac80211: fix suspend vs. association race
  net: cpsw: fix null dereference at probe
  sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
  sched: Sanitize irq accounting madness
  cfg80211: free sme on connection failures

  The following patches from 3.11.10.12 were not applied as they were
  already present in the Saucy kernel:

  futex: Make lookup_pi_state more robust
  futex: Always cleanup owner tid in unlock_pi
  futex: Validate atomic acquisition in futex_lock_pi_atomic()
  futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1335084/+subscriptions
References

[Bug 1335084] [NEW] Saucy update to 3.11.10.12 stable release
From: Luis Henriques, 2014-06-27