diff options
Diffstat (limited to 'debian/changelog')
| -rw-r--r-- | debian/changelog | 29625 |
1 files changed, 29625 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 000000000..4f4ec7ead --- /dev/null +++ b/debian/changelog @@ -0,0 +1,29625 @@ +linux (4.19.249-2) buster-security; urgency=medium + + * swiotlb: skip swiotlb_bounce when orig_addr is zero (regression in + 4.19.249) + + -- Ben Hutchings <benh@debian.org> Thu, 30 Jun 2022 14:52:02 +0200 + +linux (4.19.249-1) buster-security; urgency=high + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.236 + - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" + - xfrm: Check if_id in xfrm_migrate + - xfrm: Fix xfrm migrate issues when address family changes + - [x86] atm: firestream: check the return value of ioremap() in fs_init() + - nl80211: Update bss channel on channel switch for P2P_CLIENT + - tcp: make tcp_read_sock() more robust + - sfc: extend the locking on mcdi->seqno + - sched/topology: Make sched_init_numa() use a set for the deduplicating + sort + - sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa() + - cpuset: Fix unsafe lock order between cpuset lock and cpuslock + - mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping() + - fs: sysfs_emit: Remove PAGE_SIZE alignment check + - [arm64] Preparation for mitigating Spectre-BHB: + + Add part number for Arm Cortex-A77 + + Add Neoverse-N2, Cortex-A710 CPU part definition + + Add Cortex-X2 CPU part definition + + entry.S: Add ventry overflow sanity checks + - [arm64] Mitigate Spectre v2-type Branch History Buffer attacks + (CVE-2022-23960): + + entry: Make the trampoline cleanup optional + + entry: Free up another register on kpti's tramp_exit path + + entry: Move the trampoline data page before the text page + + entry: Allow tramp_alias to access symbols after the 4K boundary + + entry: Don't assume tramp_vectors is the start of the vectors + + entry: Move trampoline macros out of ifdef'd section + + entry: Make the kpti trampoline's kpti sequence optional + + entry: Allow the trampoline text to occupy multiple pages + + entry: Add non-kpti __bp_harden_el1_vectors for mitigations + + entry: Add vectors that have the bhb mitigation sequences + + entry: Add macro for reading symbol addresses from the trampoline + + Add percpu vectors for EL1 + + proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 + + KVM: arm64: Add templates for BHB mitigation sequences + + Mitigate spectre style branch history side channels + + KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated + + add ID_AA64ISAR2_EL1 sys register + + Use the clearbhb instruction in mitigations + - [arm64] crypto: qcom-rng - ensure buffer for generate is completely filled + - ocfs2: fix crash when initialize filecheck kobj fails + - efi: fix return value of __setup handlers + - net/packet: fix slab-out-of-bounds access in packet_recvmsg() + - atm: eni: Add check for dma_map_single + - [x86] hv_netvsc: Add check for kvmalloc_array + - [arm64,armhf] drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings + - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() + - [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_parse_of + - usb: gadget: rndis: prevent integer overflow in rndis_set_response() + - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver + - Input: aiptek - properly check endpoint type + - perf symbols: Fix symbol size calculation condition + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.237 + - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION + (CVE-2022-26490) + - net: ipv6: fix skb_over_panic in __ip6_append_data + - esp: Fix possible buffer overflow in ESP transformation (CVE-2022-27666) + - [x86] thermal: int340x: fix memory leak in int3400_notify() + - llc: fix netdevice reference leaks in llc_ui_bind() (CVE-2022-28356) + - ALSA: oss: Fix PCM OSS buffer allocation overflow + - ALSA: pcm: Add stream lock during PCM reset ioctl operations + - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB + - ALSA: cmipci: Restore aux vol on suspend/resume + - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec + - [arm64] drivers: net: xgene: Fix regression in CRC stripping + - netfilter: nf_tables: initialize registers in nft_do_chain() + (CVE-2022-1016) + - [x86] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board + - [x86] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 + - [x86] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU + - [x86] crypto: qat - disable registration of algorithms + - mac80211: fix potential double free on mesh join + - llc: only change llc->dev when bind() succeeds + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.238 + - USB: serial: pl2303: add IBM device IDs + - USB: serial: simple: add Nokia phone driver + - netdevice: add the case if dev is NULL + - xfrm: fix tunnel model fragmentation behavior + - virtio_console: break out of buf poll on remove + - ethernet: sun: Free the coherent when failing in probing + - spi: Fix invalid sgs value + - spi: Fix erroneous sgs value with min_t() + - af_key: add __GFP_ZERO flag for compose_sadb_supported in function + pfkey_register (CVE-2022-1353) + - fuse: fix pipe buffer lifetime for direct_io (CVE-2022-1011) + - tpm: fix reference counting for struct tpm_chip + - block: Add a helper to validate the block size + - virtio-blk: Use blk_validate_block_size() to validate block size + - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c + - xhci: make xhci_handshake timeout for xhci_reset() adjustable + - iio: inkern: apply consumer scale on IIO_VAL_INT cases + - iio: inkern: apply consumer scale when no channel scale is available + - iio: inkern: make a best effort on offset calculation + - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE + (CVE-2022-30594) + - Documentation: add link to stable release candidate tree + - Documentation: update stable tree link + - SUNRPC: avoid race between mod_timer() and del_timer_sync() + - NFSD: prevent underflow in nfssvc_decode_writeargs() + - NFSD: prevent integer overflow on 32 bit systems + - f2fs: fix to unlock page correctly in error path of is_alive() + - [armhf] pinctrl: samsung: drop pin banks references on error paths + - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error + path (CVE-2022-28390) + - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem + - jffs2: fix memory leak in jffs2_do_mount_fs + - jffs2: fix memory leak in jffs2_scan_medium + - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node + - mm: invalidate hwpoison page cache page in fault path + - mempolicy: mbind_range() set_policy() after vma_merge() + - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands + - qed: display VF trust config + - qed: validate and restrict untrusted VFs vlan promisc mode + - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" + - [i386] ALSA: cs4236: fix an incorrect NULL check on list iterator + - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 + - mm,hwpoison: unmap poisoned page before invalidation + - drbd: fix potential silent data corruption + - [powerpc*] kvm: Fix kvm_use_magic_page + - ACPI: properties: Consistently return -ENOENT if there are no more + references + - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() + (CVE-2022-1198) + - block: don't merge across cgroup boundaries if blkcg is enabled + - drm/edid: check basic audio support on CEA extension block + - [armhf] dts: exynos: add missing HDMI supplies on SMDK5250 + - [armhf] dts: exynos: add missing HDMI supplies on SMDK5420 + - carl9170: fix missing bit-wise or operator for tx_params + - [x86] thermal: int340x: Increase bitmap size + - brcmfmac: firmware: Allocate space for default boardrev in nvram + - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio + - PCI: pciehp: Clear cmd_busy bit in polling mode + - [arm64] regulator: qcom_smd: fix for_each_child.cocci warnings + - crypto: authenc - Fix sleep in atomic context in decrypt_tail + - [arm64,armhf] spi: tegra114: Add missing IRQ check in tegra_spi_probe + - [arm64] spi: pxa2xx-pci: Balance reference count for PCI DMA device + - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING + - block: don't delete queue kobject before its children + - PM: hibernate: fix __setup handler error handling + - PM: suspend: fix return value of __setup handler + - clocksource/drivers/timer-of: Check return value of of_iomap in + timer_of_base_init() + - ACPI: APEI: fix return value of __setup handlers + - [x86] crypto: ccp - ccp_dmaengine_unregister release dma channels + - [x86] clocksource: acpi_pm: fix return value of __setup handler + - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa + - perf/core: Fix address filter parser for multiple filters + - [x86] perf/x86/intel/pt: Fix address filter config for 32-bit kernel + - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() + - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() + - media: em28xx: initialize refcount before kref_get + - media: usb: go7007: s2250-board: fix leak in probe() + - [x86] ASoC: rt5663: check the return value of devm_kzalloc() in + rt5663_parse_dp() + - printk: fix return value of printk.devkmsg __setup handler + - [armhf] memory: emif: Add check for setup_interrupts + - [armhf] memory: emif: check the pointer temp in get_device_details() + - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction + - media: stk1160: If start stream fails, return buffers with + VB2_BUF_STATE_QUEUED + - [arm*] ASoC: dmaengine: do not use a NULL prepare_slave_config() callback + - [armhf] ASoC: imx-es8328: Fix error return code in imx_es8328_probe() + - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern + - Bluetooth: hci_serdev: call init_rwsem() before p->open() + - drm/edid: Don't clear formats if using deep color + - drm/amd/display: Fix a NULL pointer dereference in + amdgpu_dm_connector_add_common_modes() + - ath9k_htc: fix uninit value bugs + - [powerpc*] KVM: PPC: Fix vmx/vsx mixup in mmio emulation + - [x86] ray_cs: Check ioremap return value + - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports + - iwlwifi: Fix -EIO error code that is never returned + - scsi: pm8001: Fix command initialization in pm80XX_send_read_log() + - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() + - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() + - scsi: pm8001: Fix abort all task initialization + - TOMOYO: fix __setup handlers return values + - [arm64,armhf] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe + - [x86] power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong + false return + - [powerpc*] Makefile: Don't pass -mcpu=powerpc64 when building 32-bit + - [x86] KVM: x86: Fix emulation in writing cr8 + - [x86] KVM: x86/emulator: Defer not-present segment check in + __load_segment_descriptor() + - [x86] hv_balloon: rate-limit "Unhandled message" warning + - PCI: Reduce warnings on possible RW1C corruption + - [armhf] mfd: mc13xxx: Add check for mc13xxx_irq_request + - vxcan: enable local echo for sent CAN frames + - USB: storage: ums-realtek: fix error code in rts51x_read_mem() + - af_netlink: Fix shift out of bounds in group mask calculation + - tcp: ensure PMTU updates are processed during fastopen + - [x86] mxser: fix xmit_buf leak in activate when LSR == 0xff + - [x86] serial: 8250_mid: Balance reference count for PCI DMA device + - serial: 8250: Fix race condition in RTS-after-send handling + - [arm64] clk: qcom: clk-rcg2: Update the frac table for pixel clock + - [armhf] clk: tegra: tegra124-emc: Fix missing put_device() call in + emc_ensure_emc_driver + - NFS: remove unneeded check in decode_devicenotify_args() + - [arm64,armhf] pinctrl/rockchip: Add missing of_node_put() in + rockchip_pinctrl_probe + - [s390x] tty: hvc: fix return value of __setup handler + - jfs: fix divide error in dbNextAG + - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options + - xen: fix is_xen_pmu() + - net: phy: broadcom: Fix brcm_fet_config_init() + - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head + - selinux: use correct type for context length + - loop: use sysfs_emit() in the sysfs xxx show() + - Fix incorrect type in assignment of ipv6 port for audit + - bfq: fix use-after-free in bfq_dispatch_request + - ACPICA: Avoid walking the ACPI Namespace if it is not there + - Revert "Revert "block, bfq: honor already-setup queue merges"" + - ACPI/APEI: Limit printable size of BERT table data + - PM: core: keep irq flags in device_pm_check_callbacks() + - [arm64] spi: tegra20: Use of_device_get_match_data() + - ext4: don't BUG if someone dirty pages without asking ext4 first + - video: fbdev: cirrusfb: check pixclock to avoid divide by zero + - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit + - ASoC: soc-core: skip zero num_dai component in searching dai name + - media: cx88-mpeg: clear interrupt status register before streaming video + - media: Revert "media: em28xx: add missing em28xx_close_extension" + - media: hdpvr: initialize dev->worker at hdpvr_register_videodev + - mmc: host: Return an error when ->enable_sdio_irq() ops is missing + - [powerpc*] lib/sstep: Fix 'sthcx' instruction + - scsi: qla2xxx: Fix stuck session in gpdb + - scsi: qla2xxx: Fix warning for missing error code + - scsi: qla2xxx: Check for firmware dump already collected + - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() + - scsi: qla2xxx: Fix incorrect reporting of task management failure + - scsi: qla2xxx: Fix hang due to session stuck + - scsi: qla2xxx: Reduce false trigger to login + - scsi: qla2xxx: Use correct feature type field during RFF_ID processing + - KVM: Prevent module exit until all VMs are freed + - [x86] KVM: x86: fix sending PV IPI + - ubifs: rename_whiteout: Fix double free for whiteout_ui->data + - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback + - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout + - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned + - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() + - ubifs: rename_whiteout: correct old_dir size computing + - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error + path (CVE-2022-28389) + - can: mcba_usb: properly check endpoint type + - gfs2: Make sure FITRIM minlen is rounded up to fs block size + - pinctrl: pinconf-generic: Print arguments for bias-pull-* + - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl + - [amd64,arm64] ACPI: CPPC: Avoid out of bounds access when parsing _CPC + data + - mm/mmap: return 1 from stack_guard_gap __setup() handler + - mm/memcontrol: return 1 from cgroup.memory __setup() handler + - mm/usercopy: return 1 from hardened_usercopy __setup() handler + - bpf: Fix comment for helper bpf_current_task_under_cgroup() + - [x86] ASoC: topology: Allow TLV control to be either read or write + - openvswitch: Fixed nd target mask field in the flow dump. + - [x86] KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't + activated (CVE-2022-2153) + - ubifs: Rectify space amount budget for mkdir/tmpfile operations + - [x86] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs + - drm: Add orientation quirk for GPD Win Max + - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 + - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj + - ptp: replace snprintf with sysfs_emit + - scsi: mvsas: Replace snprintf() with sysfs_emit() + - scsi: bfa: Replace snprintf() with sysfs_emit() + - [arm64,armhf] power: supply: axp20x_battery: properly report current when + discharging + - [powerpc*] Set crashkernel offset to mid of RMA region + - [arm64] PCI: aardvark: Fix support for MSI interrupts + - [arm64] iommu/arm-smmu-v3: fix event handling soft lockup + - usb: ehci: add pci device support for Aspeed platforms + - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum + - ipv4: Invalidate neighbour for broadcast address upon address addition + - dm ioctl: prevent potential spectre v1 gadget + - scsi: pm8001: Fix pm8001_mpi_task_abort_resp() + - scsi: aha152x: Fix aha152x_setup() __setup handler return value + - net/smc: correct settings of RMB window update limit + - macvtap: advertise link netns via netlink + - bnxt_en: Eliminate unintended link toggle during FW reset + - [mips*] fix fortify panic when copying asm exception handlers + - scsi: libfc: Fix use after free in fc_exch_abts_resp() + - [armhf] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on + omap5evm + - Bluetooth: Fix use after free in hci_send_acl + - init/main.c: return 1 from handled __setup() functions + - minix: fix bug when opening a file with O_DIRECT + - w1: w1_therm: fixes w1_seq for ds28ea00 sensors + - NFSv4: Protect the state recovery thread against direct reclaim + - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 + - clk: Enforce that disjoints limits are invalid + - SUNRPC/call_alloc: async tasks mustn't block waiting for memory + - NFS: swap IO handling is slightly different for O_DIRECT IO + - NFS: swap-out must always use STABLE writes. + - [armhf] serial: samsung_tty: do not unlock port->lock for + uart_write_wakeup() + - virtio_console: eliminate anonymous module_init & module_exit + - jfs: prevent NULL deref in diFree + - net: add missing SOF_TIMESTAMPING_OPT_ID support + - mm: fix race between MADV_FREE reclaim and blkdev direct IO read + - [arm64] KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL + - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() + - [x86] Drivers: hv: vmbus: Fix potential crash on module unload + - [arm64,armhf] net: stmmac: Fix unset max_speed difference between DT and + non-DT platforms + - [armhf] drm/imx: Fix memory leak in imx_pd_connector_get_modes + - net: openvswitch: don't send internal clone attribute to the userspace. + - rxrpc: fix a race in rxrpc_exit_net() + - qede: confirm skb is allocated before using + - drbd: Fix five use after free bugs in get_initial_state + - [arm64] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" + - mmmremap.c: avoid pointless invalidate_range_start/end on + mremap(old_size=0) + - mm/mempolicy: fix mpol_new leak in shared_policy_replace + - [x86] pm: Save the MSR validity status at context setup + - [x86] speculation: Restore speculation related MSRs during S3 resume + - btrfs: fix qgroup reserve overflow the qgroup limit + - [arm64] patch_text: Fixup last cpu should be master + - [arm64] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator + - [arm64,armhf] irqchip/gic-v3: Fix GICR_CTLR.RWP polling + - mm: don't skip swap entry even if zap_details specified + - [arm64] module: remove (NOLOAD) from linker script + - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning + - cgroup: Use open-time credentials for process migraton perm checks + (CVE-2021-4197) + - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv + (CVE-2021-4197) + - cgroup: Use open-time cgroup namespace for process migration perm checks + (CVE-2021-4197) + - xfrm: policy: match with both mark and mask on user interfaces + - drm/amdgpu: Check if fd really is an amdgpu fd. + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.239 + - net/sched: flower: fix parsing of ethertype following VLAN header + - veth: Ensure eth header is in skb's linear part + - gpiolib: acpi: use correct format characters + - [armhf] net: ethernet: stmmac: fix altr_tse_pcs function when using a + fixed-link + - sctp: Initialize daddr on peeled off socket + - cifs: potential buffer overflow in handling symlinks + - drm/amd: Add USBC connector ID + - [amd64] drm/amdkfd: Check for potential null return of kmalloc_array() + - [x86] Drivers: hv: vmbus: Prevent load re-ordering when reading ring + buffer + - scsi: target: tcmu: Fix possible page UAF + - [powerpc*] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 + - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs + - [armhf] gpu: ipu-v3: Fix dev_dbg frequency output + - [arm64] alternatives: mark patch_alternative() as `noinstr` + - drm/amd/display: Fix allocate_mst_payload assert on resume + - scsi: mvsas: Add PCI ID of RocketRaid 2640 + - drivers: net: slip: fix NPD bug in sl_tx_timeout() + - mm, page_alloc: fix build_zonerefs_node() + - ALSA: hda/realtek: Add quirk for Clevo PD50PNT + - ALSA: pcm: Test for "silence" field in struct "pcm_format_data" + - ipv6: fix panic when forwarding a pkt with no in6 dev + - smp: Fix offline cpu check in flush_smp_call_function_queue() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.240 + - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead + - mm: page_alloc: fix building error on -Werror=array-compare + - tracing: Dump stacktrace trigger to the corresponding instance + - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error + path (CVE-2022-28388) + - dm integrity: fix memory corruption when tag_size is less than digest size + - gfs2: assign rgrp glock before compute_bitstructs + - ALSA: usb-audio: Clear MIDI port active flag after draining + - tcp: fix race condition when creating child sockets from syncookies + - tcp: Fix potential use-after-free due to double kfree() + - [armhf] dmaengine: imx-sdma: Fix error checking in sdma_event_remap + - rxrpc: Restore removed timer deletion + - net/packet: fix packet_sock xmit return value checking + - net/sched: cls_u32: fix possible leak in u32_init_knode() + - netlink: reset network and mac headers in netlink_dump() + - [x86] platform/x86: samsung-laptop: Fix an unsigned comparison which can + never be negative + - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the + constant + - vxlan: fix error return code in vxlan_fdb_append + - cifs: Check the IOCB_DIRECT flag, not O_DIRECT + - mt76: Fix undefined behavior due to shift overflowing the constant + - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the + constant + - [arm64] drm/msm/mdp5: check the return of kzalloc() + - [arm64] net: macb: Restart tx only if queue pointer is lagging + - stat: fix inconsistency between struct stat and struct compat_stat + - ata: pata_marvell: Check the 'bmdma_addr' beforing reading + - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not + initialised + - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Initialise the bridge in + prepare + - [powerpc*] perf: Fix power9 event alternatives + - openvswitch: fix OOB access in reserve_sfa_size() + - ASoC: soc-dapm: fix two incorrect uses of list iterator + - e1000e: Fix possible overflow in LTR decoding + - [arm*] arm_pmu: Validate single/group leader events + - ext4: fix symlink file size not match to file content + - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole + - ext4: fix overhead calculation to account for the reserved gdt blocks + - ext4: force overhead calculation if the s_overhead_cluster makes no sense + - block/compat_ioctl: fix range check in BLKGETSIZE + - ax25: add refcount in ax25_dev to avoid UAF bugs (CVE-2022-1204) + - ax25: fix reference count leaks of ax25_dev (CVE-2022-1204) + - ax25: fix UAF bugs of net_device caused by rebinding operation + (CVE-2022-1204) + - ax25: Fix refcount leaks caused by ax25_cb_del() + - ax25: fix UAF bug in ax25_send_control() (CVE-2022-1204) + - ax25: fix NPD bug in ax25_disconnect (CVE-2022-1199) + - ax25: Fix NULL pointer dereferences in ax25 timers (CVE-2022-1205) + - ax25: Fix UAF bugs in ax25 timers (CVE-2022-1205) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.241 + - floppy: disable FDRAWCMD by default (CVE-2022-33981) + - hamradio: defer 6pack kfree after unregister_netdev (CVE-2022-1195) + - hamradio: remove needs_free_netdev to avoid UAF (CVE-2022-1195) + - net/sched: cls_u32: fix netns refcount changes in u32_change() + (CVE-2022-29581) + - [powerpc*] 64/interrupt: Temporarily save PPR on stack to fix register + corruption due to SLB miss + - [powerpc*] 64s: Unmerge EX_LR and EX_DAR + - [armhf] Revert "net: ethernet: stmmac: fix altr_tse_pcs function when + using a fixed-link" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.242 + - USB: quirks: add a Realtek card reader + - USB: quirks: add STRING quirk for VCOM device + - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS + - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader + - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB + - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions + - xhci: stop polling roothubs after shutdown + - iio: dac: ad5446: Fix read_raw not returning set value + - [x86] iio: magnetometer: ak8975: Fix the error handling in + ak8975_power_on() + - usb: misc: fix improper handling of refcount in uss720_probe() + - usb: gadget: uvc: Fix crash when encoding data for usb request + - usb: gadget: configfs: clear deactivation flag in + configfs_composite_unbind() + - [arm64,armhf] usb: dwc3: core: Fix tx/rx threshold settings + - [arm64,armhf] usb: dwc3: gadget: Return proper request status + - [armhf] serial: imx: fix overrun interrupts in DMA mode + - serial: 8250: Also set sticky MCR bits in console restoration + - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device + - hex2bin: make the function hex_to_bin constant-time + - hex2bin: fix access beyond string end + - USB: Fix xhci event ring dequeue pointer ERDP update issue + - [armhf] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe + - [armhf] phy: samsung: exynos5250-sata: fix missing device put in probe + error paths + - [armhf] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init + - [armhf] dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 + - ipvs: correctly print the memory size of ip_vs_conn_tab + - tcp: md5: incorrect tcp_header_len for incoming connections + - sctp: check asoc strreset_chunk in sctp_generate_reconf_event + - [arm64] net: hns3: add validity check for message data length + - ip_gre: Make o_seqno start from 0 in native mode + - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT + - [arm64,armhf] bus: sunxi-rsb: Fix the return value of + sunxi_rsb_device_create() + - [arm64,armhf] clk: sunxi: sun9i-mmc: check return value after calling + platform_get_resource() + - bnx2x: fix napi API usage sequence + - ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() + - [amd64] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 + - cifs: destage any unwritten data to the server before calling + copychunk_write + - [x86] drivers: net: hippi: Fix deadlock in rr_close() + - [x86] cpu: Load microcode during restore_processor_state() + - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 + - tty: n_gsm: fix malformed counter for out of frame data + - netfilter: nft_socket: only do sk lookups when indev is available + - tty: n_gsm: fix insufficient txframe size + - tty: n_gsm: fix missing explicit ldisc flush + - tty: n_gsm: fix wrong command retry handling + - tty: n_gsm: fix wrong command frame length field encoding + - tty: n_gsm: fix incorrect UA handling + - drm/vgem: Close use-after-free race in vgem_gem_create (CVE-2022-1419) + - [mips*] Fix CP0 counter erratum detection for R4k CPUs + - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes + - gpiolib: of: fix bounds check for 'gpio-reserved-ranges' + - Revert "SUNRPC: attempt AF_LOCAL connect on setup" + - firewire: fix potential uaf in outbound_phy_packet_callback() + - firewire: remove check of list iterator against head past the loop body + - firewire: core: extend card->lock in fw_core_handle_bus_reset + - genirq: Synchronize interrupt thread startup + - nfc: replace improper check device_is_registered() in netlink related + functions (CVE-2022-1974) + - NFC: netlink: fix sleep in atomic bug when firmware download timeout + (CVE-2022-1975) + - hwmon: (adt7470) Fix warning on module removal + - [arm*] ASoC: dmaengine: Restore NULL prepare_slave_config() callback + - [arm64,armhf] net: stmmac: dwmac-sun8i: add missing of_node_put() in + sun8i_dwmac_register_mdio_mux() + - [arm64,armhf] smsc911x: allow using IRQ0 + - btrfs: always log symlinks in full mode + - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() + - [x86] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has + architectural PMU + - mm: fix unexpected zeroed page mapping with zram swap + - tcp: make sure treq->af_specific is initialized + - dm: fix mempool NULL pointer race when completing IO + - dm: interlock pending dm_io and dm_wait_for_bios_completion + - [arm64] PCI: aardvark: Clear all MSIs at setup + - [arm64] PCI: aardvark: Fix reading MSI interrupt number + - mmc: rtsx: add 74 Clocks in power on flow + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.243 + - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit + - nfp: bpf: silence bitwise vs. logical OR warning + - Bluetooth: Fix the creation of hdev->name + - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls + (CVE-2022-1048) + - ALSA: pcm: Fix races among concurrent read/write and buffer changes + (CVE-2022-1048) + - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls + (CVE-2022-1048) + - ALSA: pcm: Fix races among concurrent prealloc proc writes (CVE-2022-1048) + - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock + - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() + - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and + __mcopy_atomic() + - VFS: Fix memory leak caused by concurrently mounting fs with subtype + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.244 + - batman-adv: Don't skb_split skbuffs with frag_list + - hwmon: (tmp401) Add OF device ID table + - net: Fix features skip in for_each_netdev_feature() + - ipv4: drop dst in multicast routing path + - netlink: do not reset transport header in netlink_recvmsg() + - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection + - [s390x] ctcm: fix variable dereferenced before check + - [s390x] ctcm: fix potential memory leak + - [s390x] lcs: fix variable dereferenced before check + - net/sched: act_pedit: really ensure the skb is writable + - net/smc: non blocking recvmsg() return -EAGAIN when no data and + signal_pending + - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() + - gfs2: Fix filesystem block deallocation for short writes + - hwmon: (f71882fg) Fix negative temperature + - ASoC: max98090: Reject invalid values in custom control put() + - ASoC: max98090: Generate notifications on changes for custom control + - ASoC: ops: Validate input values in snd_soc_put_volsw_range() + - tcp: resalt the secret every 10 seconds (CVE-2022-1012) + - usb: cdc-wdm: fix reading stuck on device close + - USB: serial: pl2303: add device id for HP LM930 Display + - USB: serial: qcserial: add support for Sierra Wireless EM7590 + - USB: serial: option: add Fibocom L610 modem + - USB: serial: option: add Fibocom MA510 modem + - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() + - [x86] drm/vmwgfx: Initialize drm_mode_fb_cmd2 + - ping: fix address binding wrt vrf + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.245 + - floppy: use a statically allocated error counter (CVE-2022-1652) + - Input: add bounds checking to input_set_capability() + - drbd: remove usage of list iterator variable after loop + - nilfs2: fix lockdep warnings in page operations for btree nodes + - nilfs2: fix lockdep warnings during disk space reclamation + - [i386] ALSA: wavefront: Proper check of get_user() error + - perf: Fix sys_perf_event_open() race against self (CVE-2022-1729) + - Fix double fget() in vhost_net_set_backend() + - PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold + - [arm64] crypto: qcom-rng - fix infinite loop on requests not multiple of + WORD_SZ + - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() + - mmc: core: Cleanup BKOPS support + - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC + - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD + - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() + - [arm64] net: macb: Increment rx bd head after allocating skb and buffer + - net/sched: act_pedit: sanitize shift argument before usage + - [x86] net: vmxnet3: fix possible use-after-free bugs in + vmxnet3_rq_alloc_rx_buf() + - [x86] net: vmxnet3: fix possible NULL pointer dereference in + vmxnet3_rq_cleanup() + - net/qla3xxx: Fix a test in ql_reset_work() + - net/mlx5e: Properly block LRO when XDP is enabled + - [armhf] 9196/1: spectre-bhb: enable for Cortex-A15 + - [armel,armhf] 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 + - igb: skip phy status check where unavailable + - net: bridge: Clear offload_fwd_mark when passing frame up bridge + interface. + - [arm*] gpio: mvebu/pwm: Refuse requests with inverted polarity + - scsi: qla2xxx: Fix missed DMA unmap for aborted commands + - mac80211: fix rx reordering with non explicit / psmp ack policy + - ethernet: tulip: fix missing pci_disable_device() on error in + tulip_init_one() + - [amd64] net: atlantic: verify hw_head_ lies within TX buffer ring + - swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-0854) + - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" + (CVE-2022-0854) + - afs: Fix afs_getattr() to refetch file status if callback break occurred + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.246 + - [x86] pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests + (Closes: #1006346) + - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() + - tcp: change source port randomizarion at connect() time + - secure_seq: use the 64 bits of the siphash for port offset calculation + (CVE-2022-1012) + - ACPI: sysfs: Make sparse happy about address space in use + - ACPI: sysfs: Fix BERT error region memory mapping + - net: af_key: check encryption module availability consistency + - [x86] i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging + - [arm64] drivers: i2c: thunderx: Allow driver to work with ACPI defined + TWSI controllers + - assoc_array: Fix BUG_ON during garbage collect + - cfg80211: set custom regdomain after wiphy registration + - [x86] drm/i915: Fix -Wstringop-overflow warning in call to + intel_read_wm_latency() + - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern + (CVE-2022-0494) + - exec: Force single empty string when argv is empty + - netfilter: conntrack: re-fetch conntrack after insertion + - zsmalloc: fix races between asynchronous zspage free and page migration + - dm integrity: fix error code in dm_integrity_ctr() + - dm crypt: make printing of the key constant-time + - dm stats: add cond_resched when looping over entries + - dm verity: set DM_TARGET_IMMUTABLE feature flag + - HID: multitouch: Add support for Google Whiskers Touchpad + - tpm: Fix buffer access in tpm2_get_tpm_pt() + - NFSD: Fix possible sleep during nfsd4_release_lockowner() + - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.247 + - ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS + - USB: serial: option: add Quectel BG95 modem + - USB: new quirk for Dell Gen 2 devices + - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL + - btrfs: add "0x" prefix for unsupported optional features + - btrfs: repair super block num_devices automatically + - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes + - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue + - b43legacy: Fix assigning negative value to unsigned variable + - b43: Fix assigning negative value to unsigned variable + - ipw2x00: Fix potential NULL dereference in libipw_xmit() + - ipv6: fix locking issues with loops over idev->addr_list + - fbcon: Consistently protect deferred_takeover with console_lock() + - ACPICA: Avoid cache flush inside virtual machines + - ALSA: jack: Access input_dev under mutex + - drm/amd/pm: fix double free in si_parse_power_table() + - ath9k: fix QCA9561 PA bias level + - [arm64] media: venus: hfi: avoid null dereference in deinit + - media: pci: cx23885: Fix the error handling in cx23885_initdev() + - md/bitmap: don't set sb values if can't pass sanity check + - scsi: megaraid: Fix error check return value of register_chrdev() + - drm/plane: Move range check for format_count earlier + - drm/amd/pm: fix the compile warning + - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL + - ASoC: dapm: Don't fold register value changes into notifications + - ipmi:ssif: Check for NULL msg when handling events and messages + - rtlwifi: Use pr_warn instead of WARN_ONCE + - media: cec-adap.c: fix is_configuring state + - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags + - ASoC: rt5645: Fix errorenous cleanup order + - net: phy: micrel: Allow probing without .driver_data + - rxrpc: Return an error to sendmsg if call failed + - [arm64] PM / devfreq: rk3399_dmc: Disable edev on remove() + - fs: jfs: fix possible NULL pointer dereference in dbFree() + - fat: add ratelimit to fat*_ent_bread() + - [armhf] dts: exynos: add atmel,24c128 fallback to Samsung EEPROM + - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() + - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate + - [powerpc*] xics: fix refcount leak in icp_opal_init() + - [amd64] RDMA/hfi1: Prevent panic when SDMA is disabled + - drm: fix EDID struct for old ARM OABI format + - ath9k: fix ar9003_get_eepmisc + - drm/edid: fix invalid EDID extension block filtering + - [arm64] drm/bridge: adv7511: clean up CEC adapter when probe fails + - [x86] delay: Fix the wrong asm constraint in delay_loop() + - [arm*] drm/vc4: txp: Don't set TXP_VSTART_AT_EOF + - [arm*] drm/vc4: txp: Force alpha to be 0xff if it's disabled + - nl80211: show SSID for P2P_GO interfaces + - [armhf] spi: spi-ti-qspi: Fix return value handling of + wait_for_completion_timeout + - NFC: NULL out the dev->rfkill to prevent UAF + - efi: Add missing prototype for efi_capsule_setup_info + - HID: hid-led: fix maximum brightness for Dream Cheeky + - HID: elan: Fix potential double free in elan_input_configured + - ath9k_htc: fix potential out of bounds access with invalid + rxstatus->rs_keyix + - inotify: show inotify mask flags in proc fdinfo + - fsnotify: fix wrong lockdep annotations + - scsi: ufs: core: Exclude UECxx from SFR dump list + - [x86] pm: Fix false positive kmemleak report in msr_build_context() + - [x86] speculation: Add missing prototype for unpriv_ebpf_notify() + - [arm64] drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after + memory free during pm runtime resume + - [arm64] drm/msm/dsi: fix error checks and return values for DSI xmit + functions + - [arm64] drm/msm/hdmi: check return value after calling + platform_get_resource_byname() + - [arm64,armhf] drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() + - [x86] Fix return value of __setup handlers + - [x86] mm: Cleanup the control_va_addr_alignment() __setup handler + - [arm64] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock + is detected + - [arm64] drm/msm/mdp5: Return error code in mdp5_mixer_release when + deadlock is detected + - [arm64] drm/msm: return an error pointer in msm_gem_prime_get_sg_table() + - media: uvcvideo: Fix missing check to determine if element is found in + list + - [x86] perf/amd/ibs: Use interrupt regs ip for stack unwinding + - [armhf] regulator: pfuze100: Fix refcount leak in + pfuze_parse_regulators_dt + - scripts/faddr2line: Fix overlapping text section failures + - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init + - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout + - sctp: read sk->sk_bound_dev_if once in sctp_rcv() + - ext4: reject the 'commit' option on ext2 filesystems + - [arm64] drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() + - rxrpc: Fix listen() setting the bar too high for the prealloc rings + - rxrpc: Don't try to resend the request if we're receiving the reply + - [armel,armhf] dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT + - [armel,armhf] dts: bcm2835-rpi-b: Fix GPIO line names + - [arm*] crypto: marvell/cesa - ECB does not IV + - [arm64] pinctrl: mvebu: Fix irq_of_parse_and_map() return value + - drivers/base/node.c: fix compaction sysfs file leak + - dax: fix cache flush on PMD-mapped pages + - [powerpc*] idle: Fix return value of __setup() handler + - proc: fix dentry/inode overinstantiating under /proc/${pid}/net + - tty: fix deadlock caused by calling printk() under tty_port->lock + - [amd64] RDMA/hfi1: Prevent use of lock before it is initialized + - f2fs: fix dereference of stale list iterator after loop body + - NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout + - [arm64,armhf] video: fbdev: clcdfb: Fix refcount leak in + clcdfb_of_vram_setup + - [amd64] iommu/amd: Increase timeout waiting for GA log enablement + - f2fs: fix deadloop in foreground GC + - wifi: mac80211: fix use-after-free in chanctx code + - iwlwifi: mvm: fix assert 1F04 upon reconfig + - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped + pages + - netfilter: nf_tables: disallow non-stateful expression in sets earlier + (CVE-2022-32250) + - ext4: fix use-after-free in ext4_rename_dir_prepare + - ext4: fix bug_on in ext4_writepages + - ext4: verify dir block before splitting it (CVE-2022-1184) + - ext4: avoid cycles in directory h-tree (CVE-2022-1184) + - tracing: Fix potential double free in create_var_ref() + - PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 + - [arm64] PCI: qcom: Fix runtime PM imbalance on probe errors + - [arm64] PCI: qcom: Fix unbalanced PHY init on probe errors + - dlm: fix plock invalid read + - dlm: fix missing lkb refcount handling + - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock + - scsi: dc395x: Fix a missing check on list iterator + - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. + - drm/nouveau/clk: Fix an incorrect NULL check on list iterator + - [arm64,armhf] drm/bridge: analogix_dp: Grab runtime PM reference for + DP-AUX + - md: fix an incorrect NULL check in does_sb_need_changing + - md: fix an incorrect NULL check in md_reload_sb + - [amd64] RDMA/hfi1: Fix potential integer multiplication overflow errors + - [armhf] irqchip/armada-370-xp: Do not touch Performance Counter Overflow + on A375, A38x, A39x + - mac80211: upgrade passive scan to active scan on DFS channels after beacon + rx + - hugetlb: fix huge_pmd_unshare address update + - rtl818x: Prevent using not initialized queues + - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control + - carl9170: tx: fix an incorrect use of list iterator + - [x86] gma500: fix an incorrect NULL check on list iterator + - [arm64] phy: qcom-qmp: fix struct clk leak on probe errors + - blk-iolatency: Fix inflight count imbalances and IO hangs on offline + - [arm64] phy: qcom-qmp: fix reset-controller leak on probe errors + - RDMA/rxe: Generate a completion for unsupported/invalid opcode + - md: bcache: check the return value of kzalloc() in + detached_dev_do_request() + - usb: usbip: fix a refcount leak in stub_probe() + - usb: usbip: add missing device lock on tweak configuration cmd + - USB: storage: karma: fix rio_karma_init return + - [armhf] usb: musb: Fix missing of_node_put() in omap2430_probe + - [arm64] usb: dwc3: pci: Fix pm_runtime_get_sync() error checking + - [arm64,armhf] soc: rockchip: Fix refcount leak in rockchip_grf_init + - [arm64,armhf] serial: meson: acquire port->lock in startup() + - [x86] serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 + - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle + - [armhf] bus: ti-sysc: Fix warnings for unbind for serial + - [s390x] crypto: fix scatterwalk_unmap() callers in AES-GCM + - [arm64,armhf] net: dsa: mv88e6xxx: Fix refcount leak in + mv88e6xxx_mdios_register + - jffs2: fix memory leak in jffs2_do_fill_super + - ubi: ubi_create_volume: Fix use-after-free when volume creation failed + - nfp: only report pause frame configuration for physical device + - net/mlx5e: Update netdev features after changing XDP state + - tcp: tcp_rtx_synack() can be called from process context + - afs: Fix infinite loop found by xfstest generic/676 + - tipc: check attribute length for bearer name + - [mips*] cpc: Fix refcount leak in mips_cpc_default_phys_base + - tracing: Fix sleeping function called from invalid context on RT kernel + - tracing: Avoid adding tracer option before update_tracer_options + - NFSv4: Don't hold the layoutget locks across multiple RPC calls + - xprtrdma: treat all calls not a bcall when bc_serv is NULL + - [mips*/octeon] ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe + - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). + - [arm64] bpf, arm64: Clear prog->jited_len along prog->jited + - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure + - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() + - net: mdio: unexport __init-annotated mdio_bus_init() + - net: xfrm: unexport __init-annotated xfrm4_protocol_init() + - net: ipv6: unexport __init-annotated seg6_hmac_init() + - net/mlx5: Rearm the FW tracer after each tracer event + - ip_gre: test csum_start instead of transport header + - [x86] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() + - [x86] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() + - [x86] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() + - [mips*] USB: host: isp116x: check return value after calling + platform_get_resource() + - USB: hcd-pci: Fully suspend across freeze/thaw cycle + - [arm*] usb: dwc2: gadget: don't reset gadget's driver->bus + - misc: rtsx: set NULL intfdata when probe fails + - extcon: Modify extcon device to be created after driver data is set + - [arm*] clocksource/drivers/sp804: Avoid error on multiple instances + - staging: rtl8712: fix uninit-value in r871xu_drv_init() + - [arm64] serial: msm_serial: disable interrupts in __msm_console_write() + - kernfs: Separate kernfs_pr_cont_buf and rename_lock. + - md: protect md_unregister_thread from reentrancy + - ceph: allow ceph.dir.rctime xattr to be updatable + - drm/radeon: fix a possible null pointer dereference + - nbd: call genl_unregister_family() first in nbd_cleanup() + - nbd: fix race between nbd_alloc_config() and module removal + - nbd: fix io hung while disconnecting device + - nodemask: Fix return values to be unsigned + - [amd64] vringh: Fix loop descriptors check in the indirect cases + - ALSA: hda/conexant - Fix loopback issue with CX20632 + - cifs: return errors during session setup during reconnects + - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files + - mmc: block: Fix CQE recovery reset success + - ixgbe: fix bcast packets Rx on VF after promisc removal + - ixgbe: fix unexpected VLAN Rx in promisc mode on VF + - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag + - [powerpc*] 32: Fix overread/overwrite of thread_struct via ptrace + (CVE-2022-32981) + - md/raid0: Ignore RAID0 layout if the second zone has only one device + - mtd: cfi_cmdset_0002: Move and rename + chip_check/chip_ready/chip_good_for_write + - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N + - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.248 + - [x86] cpu: Add Elkhart Lake to Intel family + - cpu/speculation: Add prototype for cpu_show_srbds() + - [x86] cpu: Add Jasper Lake to Intel family + - [x86] cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to + Intel CPU family + - [x86] cpu: Add another Alder Lake CPU to the Intel family + - [x86] Mitigate Processor MMIO Stale Data vulnerabilities + (CVE-2022-21123, CVE-2022-21125, CVE-2022-21166): + + Documentation: Add documentation for Processor MMIO Stale Data + + x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug + + x86/speculation: Add a common function for MD_CLEAR mitigation update + + x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data + + x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations + + x86/speculation/mmio: Enable CPU Fill buffer clearing on idle + + x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data + + x86/speculation/srbds: Update SRBDS mitigation selection + + x86/speculation/mmio: Reuse SRBDS mitigation for SBDS + + KVM: x86/speculation: Disable Fill buffer clear within guests + + x86/speculation/mmio: Print SMT warning + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.249 + - 9p: missing chunk of "fs/9p: Don't update file type when updating file + attributes" + - crypto: blake2s - generic C library implementation and selftest + - lib/crypto: blake2s: move hmac construction into wireguard + - lib/crypto: sha1: re-roll loops to reduce code size + - random: Backport from 5.19, fixing several weaknesses and + peformance issues, including: + + fdt: add support for rng-seed + + random: add GRND_INSECURE to return best-effort non-cryptographic bytes + + random: ignore GRND_RANDOM in getentropy(2) + + random: make /dev/random be almost like /dev/urandom + + random: use BLAKE2s instead of SHA1 in extraction + + random: avoid superfluous call to RDRAND in CRNG extraction + + random: continually use hwgenerator randomness + + random: use computational hash for entropy extraction + + random: use RDSEED instead of RDRAND in entropy extraction + + random: do not xor RDRAND when writing into /dev/random + + random: absorb fast pool into input pool after fast load + + random: use hash function for crng_slow_load() + + random: zero buffer after reading entropy from userspace + + random: defer fast pool mixing to worker + + random: do crng pre-init loading in worker rather than irq + + random: don't let 644 read-only sysctls be written to + + random: use SipHash as interrupt entropy accumulator + + random: reseed more often immediately after booting + + random: check for signal and try earlier when generating entropy + + random: treat bootloader trust toggle the same way as cpu trust toggle + + random: do not allow user to keep crng key around on stack + + random: check for signal_pending() outside of need_resched() check + + random: check for signals every PAGE_SIZE chunk of /dev/[u]random + + init: call time_init() before rand_initialize() + + [ppc64el,s390x] define get_cycles macro for arch-override + + timekeeping: Add raw clock fallback for random_get_entropy() + + [armel,armhf,mips*] use fallback for random_get_entropy() instead of + just c0 random + + [x86] tsc: Use fallback for random_get_entropy() instead of zero + + random: do not use batches when !crng_ready() + + random: do not pretend to handle premature next security model + + random: do not use input pool from hard IRQs + + random: avoid initializing twice in credit race + + random: wire up fops->splice_{read,write}_iter() + + random: credit cpu and bootloader seeds by default + - crypto: drbg - add FIPS 140-2 CTRNG for noise source + - crypto: drbg - always seeded with SP800-90B compliant noise source + - crypto: drbg - prepare for more fine-grained tracking of seeding state + - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() + - crypto: drbg - move dynamic ->reseed_threshold adjustments to + __drbg_seed() + - crypto: drbg - always try to free Jitter RNG instance + - crypto: drbg - make reseeding from get_random_bytes() synchronous + - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() + - [armhf] ASoC: es8328: Fix event generation for deemphasis control + - [x86] scsi: vmw_pvscsi: Expand vcpuHint to 16 bits + - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology + - scsi: ipr: Fix missing/incorrect resource cleanup in error case + - scsi: pmcraid: Fix missing resource cleanup in error case + - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration + failed + - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg + - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE + - i40e: Fix adding ADQ filter to TC0 + - i40e: Fix call trace in setup_tx_descriptors + - [arm64] ftrace: fix branch range checks + - [arm64,armhf] irqchip/gic-v3: Fix refcount leak in + gic_populate_ppi_partitions + - [x86] comedi: vmk80xx: fix expression for tx buffer size + - USB: serial: option: add support for Cinterion MV31 with new baseline + - USB: serial: io_ti: add Agilent E5805A support + - [arm*] usb: dwc2: Fix memory leak in dwc2_hcd_init + - serial: 8250: Store to lsr_save_flags after lsr read + - ext4: fix bug_on ext4_mb_use_inode_pa + - ext4: make variable "count" signed + - ext4: add reserved GDT blocks check + - virtio-pci: Remove wrong address verification in vp_del_vqs() + - net: openvswitch: fix misuse of the cached connection on tuple changes + - net: openvswitch: fix leak of nested actions + - [s390x] mm: use non-quiescing sske for KVM switch to keyed guest + - usb: gadget: u_ether: fix regression in setting fixed MAC address + (regression in 4.19.223) + - xprtrdma: fix incorrect header size calculations + - tcp: Improve source port randomisation (CVE-2022-1012, CVE-2022-32296): + + tcp: add some entropy in __inet_hash_connect() + + tcp: use different parts of the port_offset for index and offset + + tcp: add small random increments to the source port + + tcp: dynamically allocate the perturb table used by source ports + + tcp: increase source port perturb table to 2^16 + + tcp: drop the hash_32() part from the index calculation + + [ Salvatore Bonaccorso ] + * Bump ABI to 21 + * [rt] Update to 4.19.237-rt107 + * Refresh "powerpc: Fix -mcpu= options for SPE-only compiler" + * [rt] Refresh "buffer_head: Replace bh_uptodate_lock for -rt" + * [rt] Update to 4.19.240-rt108 + * [rt] Update to 4.19.245-rt109 + * [rt] Update to 4.19.246-rt110: + - genirq: Add lost hunk to irq_forced_thread_fn(). (regression in + 4.19.184-rt75) + + [ Ben Hutchings ] + * [rt] Drop "random: Make it work on rt", since the upstream version is now + RT-aware + * random: Enable RANDOM_TRUST_BOOTLOADER. This can be reverted using the + kernel parameter: random.trust_bootloader=off + * [armhf] Enable KERNEL_MODE_NEON (Closes: #922204) + * [armel,armhf] crypto: Enable optimised implementations (see #922204): + - Enable ARM_CRYPTO + - Enable CRYPTO_SHA1_ARM, CRYPTO_SHA256_ARM, CRYPTO_SHA512_ARM, + CRYPTO_AES_ARM as modules + - [armhf] Enable SHA1_ARM_NEON, CRYPTO_SHA1_ARM_CE, CRYPTO_SHA2_ARM_CE, + CRYPTO_AES_ARM_BS, CRYPTO_AES_ARM_CE, CRYPTO_GHASH_ARM_CE, + CRYPTO_CRCT10DIF_ARM_CE, CRYPTO_CRC32_ARM_CE, CRYPTO_CHACHA20_NEON + as modules + + [ Diederik de Haas ] + * net_sched: let qdisc_put() accept NULL pointer (Closes: #1013299) + + -- Ben Hutchings <benh@debian.org> Wed, 29 Jun 2022 21:24:38 +0200 + +linux (4.19.235-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.233 + - mac80211_hwsim: report NOACK frames in tx_status + - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work + - [arm*] i2c: bcm2835: Avoid clock stretching timeouts + - [x86] ASoC: rt5682: do not block workqueue if card is unbound + - Input: clear BTN_RIGHT/MIDDLE on buttonpads + - cifs: fix double free race when mount fails in cifs_get_root() + - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 + - usb: gadget: don't release an existing dev->buf (CVE-2022-24958) + - usb: gadget: clear related members when goto fail (CVE-2022-24958) + - ata: pata_hpt37x: fix PCI clock detection + - [x86] ALSA: intel_hdmi: Fix reference to PCM buffer address + - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min + - xfrm: fix MTU regression + - netfilter: fix use-after-free in __nf_register_net_hook() + - xfrm: fix the if_id check in changelink + - xfrm: enforce validity of offload input flags + - netfilter: nf_queue: don't assume sk is full socket + - netfilter: nf_queue: fix possible use-after-free + - batman-adv: Request iflink once in batadv-on-batadv check + - batman-adv: Request iflink once in batadv_get_real_netdevice + - batman-adv: Don't expect inter-netns unique iflink indices + - net: dcb: flush lingering app table entries for unregistered devices + - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client + - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server + - block: Fix fsync always failed if once failed + - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault + - xen/netfront: destroy queues before real_num_tx_queues is zeroed + - mac80211: fix forwarded mesh frames AC & queue selection + - [arm64,armhf] net: stmmac: fix return value of __setup handler + - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() + - efivars: Respect "block" flag in efivar_entry_set_safe() + - can: gs_usb: change active_channels's type from atomic_t to u8 + - [armel,armhf] 9182/1: mmu: fix returns from early_param() and __setup() + functions + - net: chelsio: cxgb3: check the return value of pci_find_capability() + - nl80211: Handle nla_memdup failures in handle_nan_filter + - Input: elan_i2c - move regulator_[en|dis]able() out of + elan_[en|dis]able_power() + - Input: elan_i2c - fix regulator enable count imbalance after + suspend/resume + - HID: add mapping for KEY_ALL_APPLICATIONS + - memfd: fix F_SEAL_WRITE after shmem huge page allocated + - tracing/histogram: Fix sorting on old "cpu" value + - btrfs: add missing run of delayed items after unlink during log replay + - net: dcb: disable softirqs in dcbnl_flush_dev() + - hamradio: fix macro redefine warning + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.234 + - [arm*] Provide a wrapper for SMCCC 1.1 calls + - [arm64,armhf] smccc/psci: add arm_smccc_1_1_get_conduit() + - [armhf] report Spectre v2 status through sysfs + - [armel,armhf] early traps initialisation + - [armel,armhf] use LOADADDR() to get load address of sections + - [armel,armhf] Spectre-BHB workaround + - [armel,armhf] include unprivileged BPF status in Spectre V2 reporting + - [armel,armhf] fix build error when BPF_SYSCALL is disabled + - [armel,armhf] fix co-processor register typo + - [armel,armhf] Do not use NOCROSSREFS directive with ld.lld + - [armhf] fix build warning in proc-v7-bugs.c + - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case + (CVE-2022-23040, XSA-396) + - xen/grant-table: add gnttab_try_end_foreign_access() (CVE-2022-23036, + CVE-2022-23038, XSA-396) + - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status + (CVE-2022-23036, XSA-396) + - xen/netfront: don't use gnttab_query_foreign_access() for mapped status + (CVE-2022-23037, XSA-396) + - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status + (CVE-2022-23038, XSA-396) + - xen/gntalloc: don't use gnttab_query_foreign_access() (CVE-2022-23039, + XSA-396) + - xen: remove gnttab_query_foreign_access() + - xen/9p: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396) + - xen/pvcalls: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396) + - xen/gnttab: fix gnttab_end_foreign_access() without page specified + (CVE-2022-23041, XSA-396) + - xen/netfront: react properly to failing gnttab_end_foreign_access_ref() + (CVE-2022-23042, XSA-396) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.235 + - net: qlogic: check the return value of dma_alloc_coherent() in + qed_vf_hw_prepare() + - qed: return status of qed_iov_get_link + - ax25: Fix NULL pointer dereference in ax25_kill_by_device + - net/mlx5: Fix size field in bufferx_reg struct + - NFC: port100: fix use-after-free in port100_send_complete + - net: phy: DP83822: clear MISR2 register to disable interrupts + - sctp: fix kernel-infoleak for SCTP sockets + - net-sysfs: add check for netdevice being present to speed_show + - Revert "xen-netback: remove 'hotplug-status' once it has served its + purpose" + - Revert "xen-netback: Check for hotplug-status existence before watching" + - tracing: Ensure trace buffer is at least 4096 bytes large + - [arm64] net: macb: Fix lost RX packet wakeup race in NAPI receive + - virtio: unexport virtio_finalize_features + - virtio: acknowledge all features before access + - [armel,armhf] fix Thumb2 regression with Spectre BHB + - ext4: add check to prevent attempting to resize an fs with sparse_super2 + - btrfs: unlock newly allocated extent buffer after error (CVE-2021-4149) + + [ Salvatore Bonaccorso ] + * [rt] Add new signing key for Daniel Wagner + * [rt] Update to 4.19.233-rt105 + * Bump ABI to 20 + * sctp: fix the processing for INIT chunk (CVE-2021-3772) + * sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772) + + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 17 Mar 2022 20:48:39 +0100 + +linux (4.19.232-1) buster-security; urgency=high + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.209 + - ocfs2: drop acl cache for directories too + - [arm*] usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA + - [armhf] usb: musb: tusb6010: uninitialized data in + tusb_fifo_write_unaligned() + - cifs: fix incorrect check for null pointer in header_assemble + - [x86] xen/x86: fix PV trap handling on secondary processors + - USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter + - USB: cdc-acm: fix minor-number release + - Re-enable UAS for LaCie Rugged USB3-FW with fk quirk + - USB: serial: mos7840: remove duplicated 0xac24 device ID + - USB: serial: option: add Telit LN920 compositions + - USB: serial: option: remove duplicate USB device ID + - USB: serial: option: add device id for Foxconn T99W265 + - [arm64] serial: mvebu-uart: fix driver's tx_empty callback + - net: hso: fix muxed tty registration + - bnxt_en: Fix TX timeout when TX ring size is set to the smallest + - net/smc: add missing error check in smc_clc_prfx_set() + - net/mlx4_en: Don't allow aRFS for encapsulated packets + - scsi: iscsi: Adjust iface sysfs attr detection + - [x86] tty: synclink_gt, drop unneeded forward declarations + - [x86] tty: synclink_gt: rename a conflicting function name + - thermal/core: Potential buffer overflow in + thermal_build_list_of_policies() + - [arm64,armhf] irqchip/gic-v3-its: Fix potential VPE leak on error + - md: fix a lock order reversal in md_alloc + - blktrace: Fix uaf in blk_trace access after removing by sysfs + - [arm64,armhf] net: stmmac: allow CSR clock of 300MHz + - xen/balloon: use a kernel thread instead a workqueue + - nvme-multipath: fix ANA state updates when a namespace is not present + - qnx4: avoid stringop-overread errors + - [arm64] Mark __stack_chk_guard as __ro_after_init + - net: 6pack: Fix tx timeout and slot time + - [arm64] PCI: aardvark: Fix checking for PIO status + - tcp: address problems caused by EDT misshaps + - tcp: always set retrans_stamp on recovery + - tcp: create a helper to model exponential backoff + - tcp: adjust rto_base in retransmits_timed_out() + - xen/balloon: fix balloon kthread freezing + - tty: Fix out-of-bound vmalloc access in imageblit + - cpufreq: schedutil: Use kobject release() method to free sugov_tunables + - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory + - mac80211: fix use-after-free in CCMP/GCMP RX + - [x86] kvmclock: Move this_cpu_pvti into kvmclock.h + - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 + - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug + - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap + - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb + - hwmon: (tmp421) Replace S_<PERMS> with octal values + - hwmon: (tmp421) report /PVLD condition as fault + - hwmon: (tmp421) fix rounding for negative values + - e100: fix length calculation in e100_get_regs_len + - e100: fix buffer overrun in e100_get_regs + - Revert "block, bfq: honor already-setup queue merges" + - scsi: csiostor: Add module softdep on cxgb4 + - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses + (CVE-2021-4203) + - elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings + - ext4: fix potential infinite loop in ext4_dx_readdir() + - net: udp: annotate data race around udp_sk(sk)->corkflag + - [armel,armhf] 9077/1: PLT: Move struct plt_entries definition to header + - [armel,armhf] 9078/1: Add warn suppress parameter to arm_gen_branch_link() + - [armel,armhf] 9079/1: ftrace: Add MODULE_PLTS support + - [armel,armhf] 9098/1: ftrace: MODULE_PLT: Fix build problem without + DYNAMIC_FTRACE + - [x86] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() + (CVE-2021-3744, CVE-2021-3764) + - HID: betop: fix slab-out-of-bounds Write in betop_probe + - netfilter: ipset: Fix oversized kvmalloc() calls + - HID: usbhid: free raw_report buffers in usbhid_stop + - cred: allow get_cred() and put_cred() to be given NULL. + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.210 + - net: mdio: introduce a shutdown method to mdio device drivers + - xen-netback: correct success/error reporting for the SKB-with-fraglist + case + - scsi: sd: Free scsi_disk device via put_device() + - [arm*] usb: dwc2: check return value after calling platform_get_resource() + - scsi: ses: Retry failed Send/Receive Diagnostic commands + - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. + - lib/timerqueue: Rely on rbtree semantics for next timer (CVE-2021-20317) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.211 + - USB: cdc-acm: fix racy tty buffer accesses + - USB: cdc-acm: fix break reporting + - xen/privcmd: fix error handling in mmap-resource processing + - ovl: fix missing negative dentry check in ovl_rename() (CVE-2021-20321) + - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero + - xen/balloon: fix cancelled balloon action + - [armhf] dts: omap3430-sdp: Fix NAND device node + - [mips,mipsel] bpf, mips: Validate conditional branch offsets + (CVE-2021-38300) + - [armel,armhf] bpf, arm: Fix register clobbering in div/mod implementation + - bpf: Fix integer overflow in prealloc_elems_and_freelist() + (CVE-2021-41864) + - phy: mdio: fix memory leak + - net_sched: fix NULL deref in fifo_set_limit() + - [i386] ptp_pch: Load module automatically if ID matches + - [armhf] imx6: disable the GIC CPU interface before calling stby-poweroff + sequence + - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() + - [arm64,armhf] net: sfp: Fix typo in state machine debug string + - netlink: annotate data races around nlk->bound + - drm/nouveau/debugfs: fix file release memory leak + - rtnetlink: fix if_nlmsg_stats_size() under estimation + - i40e: fix endless loop under rtnl + - i40e: Fix freeing of uninitialized misc IRQ vector + - i2c: acpi: fix resource leak in reconfiguration device addition + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.212 + - [armhf] net: phy: bcm7xxx: Fixed indirect MMD operations + - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS + - netfilter: ip6_tables: zero-initialize fragment offset + - mac80211: Drop frames from invalid MAC address in ad-hoc mode + - net: prevent user from passing illegal stab size + - mac80211: check return value of rhashtable_init + - scsi: ses: Fix unsigned comparison with less than zero + - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" + - [x86] perf/x86: Reset destroy callback on event init failure + - sched: Always inline is_percpu_thread() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.213 + - ALSA: seq: Fix a potential UAF by wrong private_free call order + - ALSA: hda/realtek: Complete partial device name to avoid ambiguity + - ALSA: hda/realtek: Add quirk for Clevo X170KM-G + - ALSA: hda/realtek - ALC236 headset MIC recording issue + - [s390x] fix strrchr() implementation + - btrfs: deal with errors when replaying dir entry during log replay + - btrfs: deal with errors when adding inode reference during log replay + - btrfs: check for error when looking up inode during dir entry replay + - [x86] mei: me: add Ice Lake-N device id. + - xhci: guard accesses to ep_state in xhci_endpoint_reset() + - xhci: Fix command ring pointer corruption while aborting a command + - xhci: Enable trust tx length quirk for Fresco FL11 USB controller + - cb710: avoid NULL pointer subtraction + - [arm64,x86] efi/cper: use stack buffer for error record decoding + - efi: Change down_interruptible() in virt_efi_reset_system() to + down_trylock() + - [armhf] usb: musb: dsps: Fix the probe error path + - Input: xpad - add support for another USB ID of Nacon GC-100 + - USB: serial: qcserial: add EM9191 QDL support + - USB: serial: option: add Quectel EC200S-CN module support + - USB: serial: option: add Telit LE910Cx composition 0x1204 + - USB: serial: option: add prod. id for Quectel EG91 + - virtio: write back F_VERSION_1 before validate + - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells + - sctp: account stream padding length for reconf chunk (CVE-2022-0322) + - ethernet: s2io: fix setting mac address during resume + - nfc: fix error handling of nfc_proto_register() + - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() + - NFC: digital: fix possible memory leak in digital_in_send_sdd_req() + - [i386] pata_legacy: fix a couple uninitialized variable bugs + - [arm64] drm/msm: Fix null pointer dereference on pointer edp + - [arm64] drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() + - [arm64] drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling + - [arm64] acpi/arm64: fix next_platform_timer() section mismatch error + - mqprio: Correct stats in mqprio_dump_class_stats(). + - qed: Fix missing error code in qed_slowpath_start() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.214 + - NFSD: Keep existing listeners on portlist error + - netfilter: ipvs: make global sysctl readonly in non-init netns + - [arm64] net: hns3: add limit ets dwrr bandwidth cannot be 0 + - [arm64] net: hns3: disable sriov before unload hclge layer + - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state + notification + - can: peak_pci: peak_pci_remove(): fix UAF + - ocfs2: fix data corruption after conversion from inline format + - ocfs2: mount fails with buffer overflow in strlen + - vfs: check fd has read access in kernel_read_file_from_fd() + (CVE-2022-0644) + - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset + - ALSA: hda/realtek: Add quirk for Clevo PC50HS + - ASoC: DAPM: Fix missing kctl change notifications + - mm, slub: fix mismatch between reconstructed freelist depth and cnt + - nfc: nci: fix the UAF of rf_conn_info object (CVE-2021-3760) + - isdn: cpai: check ctr->cnr to avoid array index out of bound + (CVE-2021-43389) + - btrfs: deal with errors when checking if a dir entry exists during log + replay + - [arm64,armhf] net: stmmac: add support for dwmac 3.40a + - isdn: mISDN: Fix sleeping function called from invalid context + - ALSA: hda: avoid write to STATESTS if controller is in reset + - scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() + - net: mdiobus: Fix memory leak in __mdiobus_register + - tracing: Have all levels of checks prevent recursion + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.215 + - [armel,armhf] 9139/1: kprobes: fix arch_init_kprobes() prototype + - [powerpc*] bpf: Fix BPF_MOD when imm == 1 + - [arm64] Avoid premature usercopy failure + - usbnet: sanity check for maxpacket + - usbnet: fix error return code in usbnet_probe() + - ata: sata_mv: Fix the error handling of mv_chip_id() + - nfc: port100: fix using -ERRNO as command type mask + - Revert "net: mdiobus: Fix memory leak in __mdiobus_register" + - ipv4: use siphash instead of Jenkins in fnhe_hashfun() (CVE-2021-20322) + - ipv6: use siphash in rt6_exception_hash() (CVE-2021-20322) + - ipv6: make exception cache less predictible (CVE-2021-20322) + - mmc: vub300: fix control-message timeouts + - mmc: cqhci: clear HALT state after CQE enable + - [armhf] mmc: dw_mmc: exynos: fix the finding clock sample value + - mmc: sdhci: Map more voltage level to SDHCI_POWER_330 + - [armhf] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset + standard tuning circuit + - net: lan78xx: fix division by zero in send path + - RDMA/mlx5: Set user priority for DCT + - [arm64] dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node + - regmap: Fix possible double-free in regcache_rbtree_exit() + - net: batman-adv: fix error handling + - net: Prevent infinite while loop in skb_tx_hash() + - net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume + fails + - net: ethernet: microchip: lan743x: Fix dma allocation failure by using + dma_set_mask_and_coherent + - sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772) + - sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772) + - sctp: add vtag check in sctp_sf_violation (CVE-2021-3772) + - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772) + - sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.216 + - scsi: core: Put LLD module refcnt after SCSI device is released + - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() + (CVE-2021-42739) + - IB/qib: Use struct_size() helper + - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields + - sfc: Fix reading non-legacy supported link modes + - arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed + - [armel,armhf] 9120/1: Revert "amba: make use of -1 IRQs warn" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.217 + - [x86] Revert "x86/kvm: fix vcpu-id indexed array sizes" + - usb: ehci: handshake CMD_RUN instead of STS_HALT + - [arm64,armhf] usb: musb: Balance list entry in musb_gadget_queue + - usb-storage: Add compatibility quirk flags for iODD 2531/2541 + - printk/console: Allow to disable console output by using console="" or + console=null + - isofs: Fix out of bound access for corrupted isofs image + - [x86] comedi: dt9812: fix DMA buffers on stack + - [x86] comedi: ni_usb6501: fix NULL-deref in command paths + - [x86] comedi: vmk80xx: fix transfer-buffer overflows + - [x86] comedi: vmk80xx: fix bulk-buffer overflow + - [x86] comedi: vmk80xx: fix bulk and interrupt message timeouts + - staging: r8712u: fix control-message timeout + - [x86] staging: rtl8192u: fix control-message timeouts + - rsi: fix control-message timeout + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.218 + - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good + delay + - binder: use euid from cred instead of using task + - binder: use cred instead of task for selinux checks + - Input: elantench - fix misreporting trackpoint coordinates + (Closes: #989285) + - libata: fix read log timeout value + - ocfs2: fix data corruption on truncate + - [arm64,armhf] mmc: dw_mmc: Dont wait for DRTO on Write RSP error + - tpm: Check for integer overflow in tpm2_map_response_body() + - [x86] media: ite-cir: IR receiver stop working after receive overflow + - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers + (Closes: #994050) + - ALSA: hda/realtek: Add quirk for Clevo PC70HS + - ALSA: ua101: fix division by zero at probe + - ALSA: 6fire: fix control and bulk message timeouts + - ALSA: line6: fix control and interrupt message timeouts + - ALSA: usb-audio: Add registration quirk for JBL Quantum 400 + - ALSA: synth: missing check for possible NULL after the call to kstrdup + - ALSA: timer: Fix use-after-free problem + - ALSA: timer: Unconditionally unlink slave instances, too + - [x86] irq: Ensure PI wakeup handler is unregistered before module unload + - [arm64] cavium: Return negative value when pci_alloc_irq_vectors() fails + - scsi: qla2xxx: Fix unmap of already freed sgl + - [arm64] cavium: Fix return values of the probe function + - sfc: Don't use netif_info before net_device setup + - [x86] hyperv/vmbus: include linux/bitops.h + - drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 + - bpf: Prevent increasing bpf_jit_limit above max + - xen/netfront: stop tx queues during live migration + - [armhf] spi: spl022: fix Microwire full duplex mode + - [armhf] watchdog: Fix OMAP watchdog early handling + - [x86] vmxnet3: do not stop tx queues after netif_device_detach() + - btrfs: clear MISSING device status bit in btrfs_close_one_device + - btrfs: fix lost error handling when replaying directory deletes + - btrfs: call btrfs_check_rw_degradable only if there is a missing device + - [armhf] regulator: s5m8767: do not use reset value as DVS voltage if GPIO + DVS is disabled + - [armhf] regulator: dt-bindings: samsung,s5m8767: correct + s5m8767,pmic-buck-default-dvs-idx property + - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell + - [x86] mwifiex: fix division by zero in fw download path + - ath6kl: fix division by zero in send path + - ath6kl: fix control-message timeout + - ath10k: fix control-message timeout + - ath10k: fix division by zero in send path + - PCI: Mark Atheros QCA6174 to avoid bus reset + - rtl8187: fix control-message timeouts + - [arm64] wcn36xx: Fix HT40 capability for 2Ghz band + - mwifiex: Read a PCI register after writing the TX ring write pointer + - libata: fix checking of DMA state + - [arm64] wcn36xx: handle connection loss indication + - rsi: fix occasional initialisation failure with BT coex + - rsi: fix key enabled check causing unwanted encryption for vap_id > 0 + - rsi: fix rate mask set leading to P2P failure + - rsi: Fix module dev_oper_mode parameter description + - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP + - signal: Remove the bogus sigkill_pending in ptrace_stop + - [mips*] signal/mips: Update (_save|_restore)_fp_context to fail with + -EFAULT + - [x86] power: supply: max17042_battery: Prevent int underflow in + set_soc_threshold + - [x86] power: supply: max17042_battery: use VFSOC for capacity when no rsns + - serial: core: Fix initializing and restoring termios speed + - ALSA: mixer: oss: Fix racy access to slots + - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume + - xen/balloon: add late_initcall_sync() for initial ballooning done + - [arm64] PCI: aardvark: Do not clear status bits of masked interrupts + - [arm64] PCI: aardvark: Do not unmask unused interrupts + - [arm64] PCI: aardvark: Fix return value of MSI domain .alloc() method + - [arm64] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG + - quota: check block number when reading the block in quota file + - quota: correct error number in free_dqentry() + - pinctrl: core: fix possible memory leak in pinctrl_enable() + - iio: dac: ad5446: Fix ad5622_write() return value + - USB: serial: keyspan: fix memleak on probe errors + - USB: iowarrior: fix control-message timeouts + - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 + - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() + (CVE-2021-3640) + - Bluetooth: fix use-after-free error in lock_sock_nested() (CVE-2021-3752) + - [x86] platform/x86: wmi: do not fail if disabling fails + - locking/lockdep: Avoid RCU-induced noinstr fail + - net: sched: update default qdisc visibility after Tx queue cnt changes + - [x86] Increase exception stack sizes + - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type + - mwifiex: Properly initialize private structure on interface type changes + - media: netup_unidvb: handle interrupt properly according to the firmware + - media: uvcvideo: Set capability in s_param + - media: uvcvideo: Return -EIO for control errors + - media: mceusb: return without resubmitting URB in case of -EPROTO error. + - ACPICA: Avoid evaluating methods too early during system resume + - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() + - tracefs: Have tracefs directories not set OTH permission bits by default + - ath: dfs_pattern_detector: Fix possible null-pointer dereference in + channel_detector_create() + - [x86] ACPI: battery: Accept charges over the design capacity as full + - memstick: r592: Fix a UAF bug when removing the driver + - lib/xz: Avoid overlapping memcpy() with invalid input with in-place + decompression + - lib/xz: Validate the value before assigning it to an enum variable + - workqueue: make sysfs of unbound kworker cpumask more clever + - mwl8k: Fix use-after-free in mwl8k_fw_state_machine() + - PM: hibernate: Get block device exclusively in swsusp_check() + - iwlwifi: mvm: disable RX-diversity in powersave + - gre/sit: Don't generate link-local addr if addr_gen_mode is + IN6_ADDR_GEN_MODE_NONE + - [x86] hyperv: Protect set_hv_tscchange_cb() against getting preempted + - task_stack: Fix end_of_stack() for architectures with upwards-growing + stack + - Bluetooth: fix init and cleanup of sco_conn.timeout_work + - cgroup: Make rebind_subsystems() disable v2 controllers all at once + - drm/amdgpu: fix warning for overflow check + - media: em28xx: add missing em28xx_close_extension + - media: dvb-usb: fix ununit-value in az6027_rc_query + - media: si470x: Avoid card name truncation + - media: cx23885: Fix snd_card_free call on null card pointer + - cpuidle: Fix kobject memory leaks in error paths + - media: em28xx: Don't use ops->suspend if it is NULL + - ath9k: Fix potential interrupt storm on queue reset + - [x86] crypto: qat - detect PFVF collision after ACK + - [x86] crypto: qat - disregard spurious PFVF interrupts + - b43legacy: fix a lower bounds test + - b43: fix a lower bounds test + - [armhf] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not + configured + - memstick: jmb38x_ms: use appropriate free function in + jmb38x_ms_alloc_host() + - hwmon: Fix possible memleak in __hwmon_device_register() + - ath10k: fix max antenna gain unit + - [arm64] drm/msm: uninitialized variable in msm_gem_import() + - net: stream: don't purge sk_error_queue in sk_stream_kill_queues() + - [x86] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning + - rsi: stop thread firstly in rsi_91x_init() error handling + - mwifiex: Send DELBA requests according to spec + - phy: micrel: ksz8041nl: do not use power down mode + - nvme-rdma: fix error code in nvme_rdma_setup_ctrl + - PM: hibernate: fix sparse warnings + - [arm64] drm/msm: Fix potential NULL dereference in DPU SSPP + - [s390x] gmap: don't unconditionally call pte_unmap_unlock() in + __gmap_zap() + - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() + - [s390x] KVM: s390: Fix handle_sske page fault handling + - libertas_tf: Fix possible memory leak in probe and disconnect + - libertas: Fix possible memory leak in probe and disconnect + - [arm64] wcn36xx: add proper DMA memory barriers in rx path + - [amd64,arm64] net: amd-xgbe: Toggle PLL settings during rate change + - [arm64,armhf] net: phylink: avoid mvneta warning when setting pause + parameters + - crypto: pcrypt - Delay write to padata->info + - RDMA/rxe: Fix wrong port_cap_flags + - scsi: dc395: Fix error case unwinding + - JFS: fix memleak in jfs_mount + - ALSA: hda: Reduce udelay() at SKL+ position reporting + - [arm64,armhf] soc/tegra: Fix an error handling path in + tegra_powergate_power_up() + - serial: 8250_dw: Drop wrong use of ACPI_PTR() + - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() + - RDMA/mlx4: Return missed an error if device doesn't support steering + - [arm64] phy: qcom-qusb2: Fix a memory leak on probe + - [arm64] serial: xilinx_uartps: Fix race condition causing stuck TX + - [mips*] cm: Convert to bitfield API to fix out-of-bounds access + - apparmor: fix error check + - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined + - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds + - drm/plane-helper: fix uninitialized variable reference + - [arm64] PCI: aardvark: Don't spam about PIO Response Status + - NFS: Fix deadlocks in nfs_scan_commit_list() + - fs: orangefs: fix error return code of orangefs_revalidate_lookup() + - [arm64] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() + - netfilter: nfnetlink_queue: fix OOB when mac header was cleared + - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` + - [x86] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT + - scsi: qla2xxx: Fix gnl list corruption + - scsi: qla2xxx: Turn off target reset during issue_lip + - xen-pciback: Fix return in pm_ctrl_init() + - [armhf] net: davinci_emac: Fix interrupt pacing disable + - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed + - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and + zs_unregister_migration() + - zram: off by one in read_block_state() + - llc: fix out-of-bound array index in llc_sk_dev_hash() + - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails + - [arm64] pgtable: make __pte_to_phys/__phys_to_pte_val inline functions + - vsock: prevent unnecessary refcnt inc for nonblocking connect + - cxgb4: fix eeprom len when diagnostics not implemented + - [arm64,armhf] USB: chipidea: fix interrupt deadlock + - [armel,armhf] 9155/1: fix early early_iounmap() + - f2fs: should use GFP_NOFS for directory inodes + - 9p/net: fix missing error check in p9_check_errors + - [powerpc*] lib: Add helper to check if offset is within conditional branch + range + - [powerpc*] bpf: Validate branch ranges + - [powerpc*] bpf: Fix BPF_SUB when imm == 0x80000000 + - [powerpc*] security: Add a helper to query stf_barrier type + - [powerpc*] bpf: Emit stf barrier instruction sequences for BPF_NOSPEC + - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks + - mm, oom: do not trigger out_of_memory from the #PF + - [armhf] backlight: gpio-backlight: Correct initial power state handling + - video: backlight: Drop maximum brightness override for brightness zero + - [s390x] cio: check the subchannel validity for dev_busid + - [s390x] tape: fix timer initialization in tape_std_assign() + - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros + - fuse: truncate pagecache on atomic_o_trunc + - [x86] cpu: Fix migration safety with X86_BUG_NULL_SEL + - ext4: fix lazy initialization next schedule time computation in more + granular unit + - PCI/MSI: Destroy sysfs before freeing entries + - PCI/MSI: Deal with devices lying about their MSI mask capability + - PCI: Add MSI masking quirk for Nvidia ION AHCI + - [arm64] zynqmp: Do not duplicate flash partition label property + - [arm64] zynqmp: Fix serial compatible string + - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() + - [armhf] usb: musb: tusb6010: check return value after calling + platform_get_resource() + - [x86] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read + - [x86] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect + - scsi: advansys: Fix kernel pointer leak + - firmware_loader: fix pre-allocated buf built-in firmware use + - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc + - scsi: target: Fix ordered tag handling + - scsi: target: Fix alua_tg_pt_gps_count tracking + - [i386] ALSA: gus: fix null pointer dereference on pointer block + - f2fs: fix up f2fs_lookup tracepoints + - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() + - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame + - iavf: check for null in iavf_fix_features + - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset + - [x86] platform/x86: hp_accel: Fix an error handling path in + 'lis3lv02d_probe()' + - net: virtio_net_hdr_to_skb: count transport header in UFO + - i40e: Fix correct max_pkt_size on VF RX queue + - i40e: Fix NULL ptr dereference on VSI filter sync + - i40e: Fix changing previously set num_queue_pairs for PFs + - i40e: Fix display error code in dmesg + - NFC: reorganize the functions in nci_request + - [x86] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake + Server + - [x86] perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server + - tun: fix bonding active backup with arp monitoring + - ipc: WARN if trying to remove ipc object which is absent + - [x86] hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup + fails + - udf: Fix crash after seekdir + - btrfs: fix memory ordering between normal and ordered work functions + - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type + - drm/udl: fix control-message timeout + - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga + and dvi connectors + - perf/core: Avoid put_page() when GUP fails + - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN + - batman-adv: Consider fragmentation for needed_headroom + - batman-adv: Reserve needed_*room for fragments + - batman-adv: Don't always reallocate the fragmentation skb head + - RDMA/netlink: Add __maybe_unused to static inline in C file + - ASoC: DAPM: Cover regression by kctl change notification fix + - [arm64,armhf] soc/tegra: pmc: Fix imbalanced clock disabling in error code + path + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.219 + - USB: serial: option: add Telit LE910S1 0x9200 composition + - USB: serial: option: add Fibocom FM101-GL variants + - [arm*] usb: dwc2: hcd_queue: Fix use of floating point literal + - usb: hub: Fix usb enumeration issue due to address0 race + - usb: hub: Fix locking issues with address0_mutex + - [arm*] binder: fix test regression due to sender_euid change + - ALSA: ctxfi: Fix out-of-range access + - media: cec: copy sequence field for the reply + - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts + - [x86] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() + - fuse: fix page stealing + - xen: don't continue xenstore initialization in case of errors + - xen: detect uninitialized xenbus in xenbus_init + - tracing: Fix pid filtering when triggers are attached + - proc/vmcore: fix clearing user buffer by properly using clear_user() + - [arm64] PCI: aardvark: Fix a leaked reference by adding missing + of_node_put() + - [arm64] PCI: aardvark: Wait for endpoint to be ready before training link + - [arm64] PCI: aardvark: Train link immediately after enabling training + - [arm64] PCI: aardvark: Improve link training + - [arm64] PCI: aardvark: Issue PERST via GPIO + - [arm64] PCI: aardvark: Replace custom macros by standard linux/pci_regs.h + macros + - [arm64] PCI: aardvark: Indicate error in 'val' when config read fails + - [arm64] PCI: aardvark: Don't touch PCIe registers if no card connected + - [arm64] PCI: aardvark: Fix compilation on s390 + - [arm64] PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() + - [arm64] PCI: aardvark: Update comment about disabling link training + - [arm64] PCI: aardvark: Configure PCIe resources from 'ranges' DT property + - [arm64] PCI: aardvark: Fix PCIe Max Payload Size setting + - [arm64] PCI: aardvark: Fix link training + - [arm64] PCI: aardvark: Fix checking for link up via LTSSM state + - [arm64] pinctrl: armada-37xx: Correct mpp definitions + - [arm64] pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup + - [arm64] pinctrl: armada-37xx: Correct PWM pins definitions + - [arm64] dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function + - netfilter: ipvs: Fix reuse connection if RS weight is 0 + - [x86] ASoC: topology: Add missing rwsem around snd_ctl_remove() calls + - net: ieee802154: handle iftypes as u32 + - NFSv42: Don't fail clone() unless the OP_CLONE operation failed + - [armhf] socfpga: Fix crash with CONFIG_FORTIRY_SOURCE + - scsi: mpt3sas: Fix kernel panic during drive powercycle test + - [arm*] drm/vc4: fix error code in vc4_create_object() + - ipv6: fix typos in __ip6_finish_output() + - net/smc: Ensure the active closing peer first closes clcsock + - PM: hibernate: use correct mode for swsusp_close() + - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited + flows + - net/smc: Don't call clcsock shutdown twice when smc shutdown + - [arm64] net: hns3: fix VF RSS failed problem after PF enable multi-TCs + - vhost/vsock: fix incorrect used length reported to the guest + - tracing: Check pid filtering when creating events + - [s390x] mm: validate VMA in PGSTE manipulation functions + - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (CVE-2021-4002) + - NFC: add NCI_UNREG flag to eliminate the race + - fuse: release pipe buf after last use + - xen: sync include/xen/interface/io/ring.h with Xen's newest version + - xen/blkfront: read response from backend only once + - xen/blkfront: don't take local copy of a request from the ring page + - xen/blkfront: don't trust the backend response data blindly + - xen/netfront: read response from backend only once + - xen/netfront: don't read data from request on the ring page + - xen/netfront: disentangle tx_skb_freelist + - xen/netfront: don't trust the backend response data blindly + - tty: hvc: replace BUG_ON() with negative return value + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.220 + - shm: extend forced shm destroy to support objects from several IPC nses + - NFSv42: Fix pagecache invalidation after COPY/CLONE + - gfs2: Fix length of holes reported at end-of-file + - [amd64] atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait + (CVE-2021-43975) + - net: return correct error code + - [x86] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 + deep + - [s390x] setup: avoid using memblock_enforce_memory_limit + - btrfs: check-integrity: fix a warning on write caching disabled disk + - thermal: core: Reset previous low and high trip during thermal zone init + - scsi: iscsi: Unblock session then wake up error handler + - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile + - [arm64] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array + overflow in hns_dsaf_ge_srst_by_port() + - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit + - kprobes: Limit max data_size of the kretprobe instances + - ipmi: Move remove_work to dedicated workqueue + - fs: add fget_many() and fput_many() + - fget: check that the fd still exists after getting a ref to it + (CVE-2021-4083) + - net: qlogic: qlcnic: Fix a NULL pointer dereference in + qlcnic_83xx_add_rings() + - net: mpls: Fix notifications when deleting a device + - siphash: use _unaligned version by default + - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() + - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() + - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no + IRQ is available + - net: annotate data-races on txq->xmit_lock_owner + - net/rds: correct socket tunable error in rds_tcp_tune() + - net/smc: Keep smc_close_final rc during active close + - [arm64] drm/msm: Do hw_init() before capturing GPU state + - vgacon: Propagate console boot parameters before calling `vc_resize' + - xhci: Fix commad ring abort, write all 64 bits to CRCR register. + - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub + - [x86] usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect + - [amd64] mm: Map all kernel memory into trampoline_pgd + - [arm64] tty: serial: msm_serial: Deactivate RX DMA for polling support + - [arm64] serial: pl011: Add ACPI SBSA UART match id + - serial: core: fix transmit-buffer reset and memleak + - ipmi: msghandler: Make symbol 'remove_work_wq' static + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.221 + - HID: add hid_is_usb() function to make it simpler for USB detection + - HID: wacom: fix problems when device is not a valid USB device + - HID: check for valid USB device for many HID drivers + - can: kvaser_usb: get CAN clock frequency from device + - [x86] can: sja1000: fix use after free in ems_pcmcia_add_card() + - net: core: netlink: add helper refcount dec and lock function + - net: sched: rename qdisc_destroy() to qdisc_put() + - net: sched: extend Qdisc with rcu + - net: sched: add helper function to take reference to Qdisc + - net: sched: use Qdisc rcu API instead of relying on rtnl lock + - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done + - bpf: Fix the off-by-two error in range markings + - ice: ignore dropped packets during init + - bonding: make tx_rebalance_counter an atomic + - nfp: Fix memory leak in nfp_cpp_area_cache_add() + - seg6: fix the iif in the IPv6 socket control block + - udp: using datalen to cap max gso segments + - [amd64] IB/hfi1: Correct guard on eager buffer deallocation + - mm: bdi: initialize bdi_min_ratio when bdi is unregistered + - ALSA: ctl: Fix copy of updated id with element read/write + - ALSA: pcm: oss: Fix negative period/buffer sizes + - ALSA: pcm: oss: Limit the period size to 16MB + - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() + - tracefs: Have new files inherit the ownership of their parent + - [arm64] clk: qcom: regmap-mux: fix parent clock lookup + - [i386] can: pch_can: pch_can_rx_normal: fix use after free + - libata: add horkage for ASMedia 1092 + - wait: add wake_up_pollfree() + - binder: use wake_up_pollfree() + - signalfd: use wake_up_pollfree() + - aio: keep poll requests on waitqueue until completed + - aio: fix use-after-free due to missing POLLFREE handling + - tracefs: Set all files to the same group ownership as the mount option + - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) + - qede: validate non LSO skb length + - i40e: Fix pre-set max number of queues for VF + - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero + - [armhf] net: fec: only clear interrupt of handling queue in + fec_enet_rx_queue() + - net, neigh: clear whole pneigh_entry at alloc time + - net/qla3xxx: fix an error code in ql_adapter_up() + - USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685) + - USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685) + - usb: core: config: fix validation of wMaxPacketValue entries + - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime + suspending + - usb: core: config: using bit mask instead of individual bits + - xhci: avoid race between disable slot command and host runtime suspend + - iio: trigger: Fix reference counting + - [armhf] iio: mma8452: Fix trigger reference couting + - [arm64,armhf] iio: adc: axp20x_adc: fix charging current reporting on + AXP22x + - [x86] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove + - [armhf] irqchip/armada-370-xp: Fix return value of + armada_370_xp_msi_alloc() + - [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts + - [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing + INVALL + - net_sched: fix a crash in tc_new_tfilter() + - net: sched: make function qdisc_free_cb() static + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.222 + - stable: clamp SUBLEVEL in 4.19 + - nfc: fix segfault in nfc_genl_dump_devices_done + - [arm64] drm/msm/dsi: set default num_data_lanes + - net/mlx4_en: Update reported link modes for 1/10G + - [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt flag + - net: netlink: af_netlink: Prevent empty skb by adding a check on len. + - tracing: Fix a kmemleak false positive in tracing_map + - [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error + - mac80211: send ADDBA requests using the tid/queue of the aggregation + session + - dm btree remove: fix use after free in rebalance_children() + - audit: improve robustness of the audit queue handling + - nfsd: fix use-after-free due to delegation race (Closes: #988044) + - [x86] sme: Explicitly map new EFI memmap table as encrypted + - mac80211: track only QoS data frames for admission control + - [armhf] socfpga: dts: fix qspi node compatible + - sch_cake: do not call cake_destroy() from cake_init() + - rds: memory leak in __rds_conn_create() (CVE-2021-45480) + - [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning + - igb: Fix removal of unicast MAC filters of VFs + - igbvf: fix double free in `igbvf_probe` + - ixgbe: set X550 MDIO speed before talking to PHY + - netdevsim: Zero-initialize memory for new map's value in function + nsim_bpf_map_alloc (CVE-2021-4135) + - net/packet: rx_owner_map depends on pg_vec (CVE-2021-22600) + - sit: do not call ipip6_dev_free() from sit_init_net() + - USB: gadget: bRequestType is a bitfield, not a enum + - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) + - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error + - PCI/MSI: Mask MSI-X vectors only on success + - USB: serial: cp210x: fix CP2105 GPIO registration + - USB: serial: option: add Telit FN990 compositions + - timekeeping: Really make sure wall_to_monotonic isn't positive + - libata: if T_LENGTH is zero, dma direction should be DMA_NONE + - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE + - mac80211: validate extended element ID is present + - [armel] 8805/2: remove unneeded naked function usage + - mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO + - Input: touchscreen - avoid bitwise vs logical OR warning + - media: mxl111sf: change mutex_init() location + - fuse: annotate lock in fuse_reverse_inval_entry() + - ovl: fix warning in ovl_create_real() + - scsi: scsi_debug: Sanity check block descriptor length in + resp_mode_select() + - xen/blkfront: harden blkfront against event channel storms + (CVE-2021-28711) + - xen/netfront: harden netfront against event channel storms + (CVE-2021-28712) + - xen/console: harden hvc_xen against event channel storms (CVE-2021-28713) + - xen/netback: fix rx queue stall detection (CVE-2021-28714) + - xen/netback: don't queue unlimited number of packages (CVE-2021-28715) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.223 + - net: usb: lan78xx: add Allied Telesis AT29M2-AF + - block, bfq: improve asymmetric scenarios detection + - block, bfq: fix asymmetric scenarios detection + - block, bfq: fix decrement of num_active_groups + - block, bfq: fix queue removal from weights tree + - block, bfq: fix use after free in bfq_bfqq_expire + - HID: holtek: fix mouse probing + - [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode + - [arm64] spi: change clk_disable_unprepare to clk_unprepare + - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() + - netfilter: fix regression in looped (broad|multi)cast's MAC handling + - qlcnic: potential dereference null pointer of rx_queue->page_ring + - net: accept UFOv6 packages in virtio_net_hdr_to_skb + - net: skip virtio_net_hdr_set_proto if protocol already set + - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module + - bonding: fix ad_actor_system option setting to default + - [amd64] fjes: Check for error irq + - [armhf] drivers: net: smc911x: Check for error irq + - sfc: falcon: Check null pointer of rx_queue->page_ring + - hwmon: (lm90) Fix usage of CONFIG2 register in detect function + - ALSA: jack: Check the return value of kstrdup() + - ALSA: drivers: opl3: Fix incorrect use of vp->state + - Input: atmel_mxt_ts - fix double free in mxt_read_info_block + - ipmi: bail out if init_srcu_struct fails + - ipmi: fix initialization when workqueue allocation fails + - [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT + - [armel,armhf] 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling + - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() + (CVE-2021-45469) + - usb: gadget: u_ether: fix race in setting MAC address in setup phase + - [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state + - hwmon: (lm90) Do not report 'busy' status bit as alarm + - ax25: NPD bug when detaching AX25 device + - hamradio: defer ax25 kfree after unregister_netdev + - hamradio: improve the incomplete fix to avoid NPD + - phonet/pep: refuse to enable an unbound pipe + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.224 + - [arm64] tee: handle lookup of shm with reference count 0 (CVE-2021-44733) + - Input: i8042 - add deferred probe support + - [x86] Input: i8042 - enable deferred probe quirk for ASUS UM325UA + - [x86] platform/x86: apple-gmux: use resource_size() with res + - selinux: initialize proto variable in selinux_ip_postroute_compat() + - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() + - udp: using datalen to cap ipv6 udp max gso segments + - sctp: use call_rcu to free endpoint + - net: usb: pegasus: Do not drop long Ethernet frames + - net/mlx5e: Fix wrong features assignment in case of error + - i2c: validate user data in compat ioctl + - nfc: uapi: use kernel size_t to fix user-space builds + - uapi: fix linux/nfc.h userspace compilation errors + - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. + - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. + - [arm*] binder: fix async_free_space accounting for empty parcels + - [x86] scsi: vmw_pvscsi: Set residual data length conditionally + - Input: appletouch - initialize work before device registration + - Input: spaceball - fix parsing of movement data packets + - net: fix use-after-free in tw_timer_handler + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.225 + - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() + - tracing: Tag trace_percpu_buffer as a percpu pointer + - ieee802154: atusb: fix uninit value in atusb_set_extended_addr + - RDMA/core: Don't infoleak GRH fields + - mac80211: initialize variable have_higher_than_11mbit + - i40e: fix use-after-free in i40e_sync_filters_subtask() + - i40e: Fix incorrect netdev's real number of RX/TX queues + - ipv6: Check attribute length for RTA_GATEWAY in multipath route + - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route + - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc + - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate + (CVE-2021-4155) + - rndis_host: support Hytera digital radios + - phonet: refcount leak in pep_sock_accep (CVE-2021-45095) + - ipv6: Continue processing multipath route even if gateway attribute is + invalid + - ipv6: Do cleanup if attribute validation fails in multipath route + - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() + - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate + - net: udp: fix alignment problem in udp4_seq_show() + - mISDN: change function names to avoid conflicts + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.226 + - Bluetooth: bfusb: fix division by zero in send path + - USB: core: Fix bug in resuming hub's handling of wakeup requests + - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status + - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet + - veth: Do not record rx queue hint in veth_xmit + - [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() + - can: gs_usb: fix use of uninitialized variable, detach device on reception + of invalid USB data + - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} + - random: fix data race on crng_node_pool + - random: fix data race on crng init time + - [x86] drm/i915: Avoid bitwise vs logical OR warning in + snb_wm_latency_quirk() + - kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test + - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() + - [s390x] KVM: s390: Clarify SIGP orders versus STOP/RESTART + - media: uvcvideo: fix division by zero at stream start + - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with + interrupts enabled + - firmware: qemu_fw_cfg: fix sysfs information leak + - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries + - firmware: qemu_fw_cfg: fix kobject leak in probe error path + - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after + reboot from Windows + - HID: uhid: Fix worker destroying device without any protection + - HID: wacom: Reset expected and received contact counts at the same time + - HID: wacom: Ignore the confidence flag when a touch is removed + - HID: wacom: Avoid using stale array indicies to read contact count + - f2fs: fix to do sanity check in is_alive() + - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed + bind() + - [armhf] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for + i.MX6 + - [x86] gpu: Reserve stolen memory for first integrated Intel GPU + - rtc: cmos: take rtc_lock while reading from CMOS + - media: flexcop-usb: fix control-message timeouts + - media: mceusb: fix control-message timeouts + - media: em28xx: fix control-message timeouts + - media: cpia2: fix control-message timeouts + - media: s2255: fix control-message timeouts + - media: dib0700: fix undefined behavior in tuner shutdown + - media: redrat3: fix control-message timeouts + - media: pvrusb2: fix control-message timeouts + - media: stk1160: fix control-message timeouts + - [x86] can: softing_cs: softingcs_probe(): fix memleak on registration + failure + - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller + - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode + - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails + - [arm*] clk: bcm-2835: Pick the closest clock rate + - [arm*] clk: bcm-2835: Remove rounding up the dividers + - [arm64] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND + - [arm64] wcn36xx: Release DMA channel descriptor allocations + - media: videobuf2: Fix the size printk format + - media: em28xx: fix memory leak in em28xx_init_dev + - Bluetooth: stop proccessing malicious adv data + - [arm64] tee: fix put order in teedev_close_context() + - media: dmxdev: fix UAF when dvb_register_device() fails + - [arm64] crypto: qce - fix uaf on qce_ahash_register_one + - netfilter: bridge: add support for pppoe filtering + - drm/amdgpu: Fix a NULL pointer dereference in + amdgpu_connector_lcd_native_mode() + - drm/radeon/radeon_kms: Fix a NULL pointer dereference in + radeon_driver_open_kms() + - [arm*] serial: amba-pl011: do not request memory region twice + - floppy: Fix hang in watchdog when disk is ejected + - media: dib8000: Fix a memleak in dib8000_init() + - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() + - media: si2157: Fix "warm" tuner state detection + - sched/rt: Try to restart rt period timer when rt runtime exceeded + - xfrm: fix a small bug in xfrm_sa_len() + - media: dw2102: Fix use after free + - media: msi001: fix possible null-ptr-deref in msi001_probe() + - [arm64] drm/msm/dpu: fix safe status debugfs file + - xfrm: interface with if_id 0 should return error + - xfrm: state and policy should fail if XFRMA_IF_ID 0 + - usb: ftdi-elan: fix memory leak on device disconnect + - [armhf] mmc: meson-mx-sdio: add IRQ check + - [x86] mce/inject: Avoid out-of-bounds write when setting flags + - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in + __nonstatic_find_io_region() + - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in + nonstatic_find_mem_region() + - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() + - ppp: ensure minimum packet size in ppp_write() + - Bluetooth: hci_bcm: Check for error irq + - [arm64,armhf] spi: spi-meson-spifc: Add missing pm_runtime_disable() in + meson_spifc_probe + - tpm: add request_locality before write TPM_INT_ENABLE + - can: softing: softing_startstop(): fix set but not used variable warning + - pcmcia: fix setting of kthread task states + - net: mcs7830: handle usb read errors properly + - ext4: avoid trim error on fs with small groups + - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls + - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls + - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls + - [arm64] RDMA/hns: Validate the pkey index + - [powerpc*] prom_init: Fix improper check of prom_getprop() + - ALSA: oss: fix compile error when OSS_DEBUG is enabled + - [arm64,armhf] iommu/io-pgtable-arm: Fix table descriptor paddr formatting + - scsi: ufs: Fix race conditions related to driver data + - RDMA/core: Let ib_find_gid() continue search even after empty entry + - [x86] ASoC: rt5663: Handle device_property_read_u32_array error codes + - [arm*] iommu/iova: Fix race between FQ timeout and teardown + - RDMA/cxgb4: Set queue pair state when being queried + - Bluetooth: Fix debugfs entry leak in hci_register_dev() + - fs: dlm: filter user dlm messages for kernel locks + - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply + - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR + - usb: gadget: f_fs: Use stream_open() for endpoint files + - HID: apple: Do not reset quirks when the Fn key is not found + - media: b2c2: Add missing check in flexcop_pci_isr: + - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use + - [armhf] HSI: core: Fix return freed object in hsi_new_client + - [x86] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (CVE-2021-43976) + - rsi: Fix out-of-bounds read in rsi_read_pkt() + - floppy: Add max size check for user space request + - media: saa7146: hexium_orion: Fix a NULL pointer dereference in + hexium_attach() + - media: m920x: don't use stack on USB reads + - iwlwifi: mvm: synchronize with FW after multicast commands + - ath10k: Fix tx hanging + - net-sysfs: update the queue counts in the unregistration path + - [x86] mce: Mark mce_panic() noinstr + - [x86] mce: Mark mce_end() noinstr + - [x86] mce: Mark mce_read_aux() noinstr + - net: bonding: debug: avoid printing debug logs when bond is not notifying + peers + - bpf: Do not WARN in bpf_warn_invalid_xdp_action() + - HID: quirks: Allow inverting the absolute X/Y values + - media: igorplugusb: receiver overflow should be reported + - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in + hexium_attach() + - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO + - audit: ensure userspace is penalized the same as the kernel when under + pressure + - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 + - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream + - iwlwifi: fix leaks/bad data after failed firmware load + - iwlwifi: remove module loading failure message + - iwlwifi: mvm: Fix calculation of frame length + - jffs2: GC deadlock reading a page that is used in jffs2_write_begin() + - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions + - ACPICA: Utilities: Avoid deleting the same object twice in a row + - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() + - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 + - drm/amdgpu: fixup bad vram size on gmc v8 + - [x86] ACPI: battery: Add the ThinkPad "Not Charging" quirk + - btrfs: remove BUG_ON() in find_parent_nodes() + - btrfs: remove BUG_ON(!eie) in find_parent_nodes + - net: mdio: Demote probed message to debug print + - mac80211: allow non-standard VHT MCS-10/11 + - dm btree: add a defensive bounds check to insert_at() + - dm space map common: add bounds check to sm_ll_lookup_bitmap() + - net: phy: marvell: configure RGMII delays for 88E1118 + - [arm64] regulator: qcom_smd: Align probe function with rpmh-regulator + - [arm64,armhf] serial: pl010: Drop CR register reset on set_termios + - serial: core: Keep mctrl register state and cached copy in sync + - [powerpc*] powernv: add missing of_node_put + - [powerpc*] btext: add missing of_node_put + - [powerpc*] watchdog: Fix missed watchdog reset due to memory ordering race + - [x86] i2c: i801: Don't silently correct invalid transfer size + - [powerpc*] smp: Move setup_profiling_timer() under CONFIG_PROFILING + - [powerpc*] i2c: mpc: Correct I2C reset procedure + - w1: Misuse of get_user()/put_user() reported by sparse + - ALSA: seq: Set upper limit of processed events + - [powerpc*] handle kdump appropriately with crash_kexec_post_notifiers + option + - [mips*] OCTEON: add put_device() after of_find_device_by_node() + - [x86] i2c: designware-pci: Fix to change data types of hcnt and lcnt + parameters + - scsi: sr: Don't use GFP_DMA + - [arm64] rpmsg: core: Clean up resources on announce_create failure. + - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write + buffers + - serial: Fix incorrect rs485 polarity on uart open + - cputime, cpuacct: Include guest time in user time in cpuacct.stat + - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds + - [s390x] mm: fix 2KB pgtable release race + - [armhf] drm/etnaviv: limit submit sizes + - ext4: make sure to reset inode lockdep class when quota enabling fails + - ext4: make sure quota gets properly shutdown on error + - ext4: set csum seed in tmp inode while migrating to extents + - ext4: Fix BUG_ON in ext4_bread when write quota data + - ext4: don't use the orphan list when migrating an inode + - ASoC: dpcm: prevent snd_soc_dpcm use after free + - regulator: core: Let boot-on regulators be powered off + - drm/radeon: fix error handling in radeon_driver_open_kms + - [arm64] RDMA/hns: Modify the mapping attribute of doorbell to device + - RDMA/rxe: Fix a typo in opcode name + - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress + - netns: add schedule point in ops_exit_list() + - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() + - net_sched: restore "mpu xxx" handling + - [mips*,s390x] gup: Work around the "COW can break either way" issue + (CVE-2020-29374) + - fuse: fix bad inode (CVE-2020-36322) + - fuse: fix live lock in fuse_iget() (CVE-2021-28950) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.227 + - [x86] drm/i915: Flush TLBs before releasing backing store (CVE-2022-0330) + - net: bridge: clear bridge's private skb space on xmit + - select: Fix indefinitely sleeping task in poll_schedule_timeout() + - [x86] drm/vmwgfx: Fix stale file descriptors on failed usercopy + (CVE-2022-22942) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.228 + - Bluetooth: refactor malicious adv data check + - [s390x] hypfs: include z/VM guests with access control group set + - [s390x] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV + FCP devices + - udf: Restore i_lenAlloc when inode expansion fails (CVE-2022-0617) + - udf: Fix NULL ptr deref when converting from inline format (CVE-2022-0617) + - [armhf] drm/etnaviv: relax submit size limits + - netfilter: nft_payload: do not update layer 4 checksum when mangling + fragments + - serial: 8250: of: Fix mapped region size when using reg-offset property + - tty: n_gsm: fix SW flow control encoding/handling + - tty: Add support for Brainboxes UC cards. + - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge + - [arm64,armhf] usb: common: ulpi: Fix crash in ulpi_match() + - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS + - USB: core: Fix hang in usb_kill_urb by adding memory barriers + - [x86] usb: typec: tcpm: Do not disconnect while receiving VBUS off + - [arm64,armhf] net: sfp: ignore disabled SFP node + - i40e: Increase delay to 1 s after global EMP reset + - i40e: Fix issue when maximum queues is exceeded + - i40e: Fix queues reservation for XDP + - i40e: fix unsigned stat widths + - scsi: bnx2fc: Flush destroy_work queue before calling + bnx2fc_interface_put() + - ipv6_tunnel: Rate limit warning messages + - net: fix information leakage in /proc/net/ptype + - ping: fix the sk_bound_dev_if match in ping_lookup + - ipv4: avoid using shared IP generator for connected sockets + - hwmon: (lm90) Reduce maximum conversion rate for G781 + - NFSv4: Handle case where the lookup of a directory fails (CVE-2022-24448) + - NFSv4: nfs_atomic_open() can race when looking up a non-regular file + - net-procfs: show net devices bound packet types + - [arm64] drm/msm: Fix wrong size calculation + - [arm64] drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable + - ipv6: annotate accesses to fn->fn_sernum + - NFS: Ensure the server has an up to date ctime before hardlinking + - NFS: Ensure the server has an up to date ctime before renaming + - phylib: fix potential use-after-free + - yam: fix a memory leak in yam_siocdevprivate() (CVE-2022-24959) + - ipv4: raw: lock the socket in raw_bind() + - ipv4: tcp: send zero IPID in SYNACK messages + - netfilter: nat: remove l4 protocol port rovers + - netfilter: nat: limit port clash resolution attempts + - tcp: fix possible socket leaks in internal pacing mode + - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback + - [amd64,arm64] net: amd-xgbe: ensure to reset the tx_timer_active flag + - [amd64,arm64] net: amd-xgbe: Fix skb data length underflow + - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() + - af_packet: fix data-race in packet_setsockopt / packet_setsockopt + - audit: improve audit queue handling when "audit=1" on cmdline + - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() + - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() + - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() + - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 + quirks + - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer + chipset) + - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after + reboot from Windows + - drm/nouveau: fix off by one in BIOS boundary checking + - block: bio-integrity: Advance seed correctly for larger interval sizes + - RDMA/mlx4: Don't continue event handler after memory allocation failure + - [amd64] iommu/vt-d: Fix potential memory leak in + intel_setup_irq_remapping() + - [amd64] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() + - [armhf] spi: meson-spicc: add IRQ check in meson_spicc_probe + - net: ieee802154: hwsim: Ensure proper channel selection at probe time + - net: ieee802154: Return meaningful error codes from the netlink helpers + - net: macsec: Verify that send_sci is on when setting Tx sci explicitly + - [arm64,armhf] net: stmmac: ensure PTP time register reads are consistent + - [x86] drm/i915/overlay: Prevent divide by zero bugs in scaling + - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe + - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. + - rtc: cmos: Evaluate century appropriate + - [arm64] EDAC/xgene: Fix deferred probing + - ext4: fix error handling in ext4_restore_inline_data() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.229 + - cgroup-v1: Require capabilities to set release_agent (CVE-2022-0492) + - moxart: fix potential use-after-free on remove path (CVE-2022-0487) + - tipc: improve size validations for received domain records (CVE-2022-0435) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.230 + - integrity: check the return value of audit_log_start() + - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs + - NFS: Fix initialisation of nfs_client cl_flags field + - NFSD: Clamp WRITE offsets + - NFSD: Fix offset type in I/O trace points + - NFSv4 only print the label when its queried + - nfs: nfs4clinet: check the return value of kstrdup() + - NFSv4.1: Fix uninitialised variable in devicenotify + - NFSv4 remove zero number of fs_locations entries error check + - NFSv4 expose nfs_parse_server_name function + - net: sched: Clarify error message when qdisc kind is unknown + - scsi: target: iscsi: Make sure the np under each tpg is unique + - [arm*] usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend + - [arm64,armhf] net: stmmac: dwmac-sun8i: use return val of + readl_poll_timeout() + - bpf: Add kconfig knob for disabling unpriv bpf by default + - net: bridge: fix stale eth hdr pointer in br_dev_xmit + - usb: f_fs: Fix use-after-free for epfile + - ixgbevf: Require large buffers for build_skb on 82599VF + - bonding: pair enable_port with slave_arr_updates + - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure + path + - net: do not keep the dst cache when uncloning an skb dst and its metadata + - net: fix a memleak when uncloning an skb dst and its metadata + - veth: fix races around rq->rx_notify_masked + - tipc: rate limit warning for received illegal binding update + - [amd64,arm64] net: amd-xgbe: disable interrupts during pci removal + - vt_ioctl: fix array_index_nospec in vt_setactivate + - vt_ioctl: add array_index_nospec to VT_ACTIVATE + - n_tty: wake up poll(POLLRDNORM) on receiving data + - [arm64,armhf] usb: ulpi: Move of_node_put to ulpi_dev_release + - [arm64,armhf] usb: ulpi: Call of_node_put correctly + - [arm64,armhf] usb: dwc3: gadget: Prevent core from processing stale TRBs + - USB: gadget: validate interface OS descriptor requests (CVE-2022-25258) + - usb: gadget: rndis: check size of RNDIS_MSG_SET command (CVE-2022-25375) + - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 + - USB: serial: option: add ZTE MF286D modem + - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices + - USB: serial: cp210x: add NCR Retail IO box id + - USB: serial: cp210x: add CPI Bulk Coin Recycler id + - seccomp: Invalidate seccomp mode to catch death failures + - [x86] hwmon: (dell-smm) Speed up setting of fan speed + - perf: Fix list corruption in perf_cgroup_switch() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.231 + - Makefile.extrawarn: Move -Wunaligned-access to W=1 + - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup + - btrfs: send: in case of IO error log it + - net: ieee802154: at86rf230: Stop leaking skb's + - ax25: improve the incomplete fix to avoid UAF and NPD bugs + - vfs: make freeze_super abort when sync_filesystem returns error + - quota: make dquot_quota_sync return errors from ->sync_fs + - nvme: fix a possible use-after-free in controller reset during load + - nvme-rdma: fix possible use-after-free in transport error_recovery work + - Revert "module, async: async_synchronize_full() on module init iff async + is used" + - iwlwifi: fix use-after-free + - drm/radeon: Fix backlight control on iMac 12,1 + - xfrm: Don't accidentally set RTO_ONLINK in decode_session4() + - taskstats: Cleanup the use of task->exit_code + - mmc: block: fix read single on recovery logic + - vsock: remove vsock from connected table when connect is interrupted by a + signal + - iwlwifi: pcie: fix locking when "HW not ready" + - iwlwifi: pcie: gen2: fix locking when "HW not ready" + - ping: fix the dif and sdif check in ping_lookup + - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit + - bonding: fix data-races around agg_select_timer + - libsubcmd: Fix use-after-free for realloc(..., 0) + - ALSA: hda: Fix regression on forced probe mask option + - ALSA: hda: Fix missing codec probe on Shenker Dock 15 + - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() + - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() + - [powerpc*] lib/sstep: fix 'ptesync' build error + - ext4: check for out-of-order index extents in ext4_valid_extent_entries() + - block/wbt: fix negative inflight counter when remove scsi device + - NFS: LOOKUP_DIRECTORY is also ok with symlinks + - NFS: Do not report writeback errors in nfs_getattr() + - EDAC: Fix calculation of returned address and next offset in + edac_align_ptr() + - net: sched: limit TC_ACT_REPEAT loops + - lib/iov_iter: initialize "flags" in new pipe_buffer + - [x86] Drivers: hv: vmbus: Expose monitor data only when monitor pages are + used + - [x86] Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj + - [x86] KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW + - [armhf] OMAP2+: hwmod: Add of_node_put() before break + - netfilter: conntrack: don't refresh sctp entries in closed state + - kconfig: let 'shell' return enough output for deep path names + - ata: libata-core: Disable TRIM on M88V29 + - tracing: Fix tp_printk option related with tp_printk_stop_on_boot + - net: usb: qmi_wwan: Add support for Dell DW5829e + - [arm64] net: macb: Align the dma and coherent dma masks + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.232 + - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug + - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing + - sr9700: sanity check for packet length + - USB: zaurus: support another broken Zaurus + - ping: remove pr_err from ping_lookup + - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends + - tipc: Fix end of loop tests for list_for_each_entry() + - gso: do not skip outer ip header in case of ipip and net_failover + - openvswitch: Fix setting ipv6 fields causing hw csum failure + - drm/edid: Always set RGB444 + - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure + - configfs: fix a race in configfs_{,un}register_subsystem() + - RDMA/ib_srp: Fix a deadlock + - tty: n_gsm: fix proper link termination after failed open + - Revert "drm/nouveau/pmu/gm200-: avoid touching PMU outside of + DEVINIT/PREOS/ACR" + - memblock: use kfree() to release kmalloced memblock regions + - fget: clarify and improve __fget_files() implementation + - tracing: Have traceon and traceoff trigger honor the instance + - ata: pata_hpt37x: disable primary channel on HPT371 + - Revert "USB: serial: ch341: add new Product ID for CH341A" + - usb: gadget: rndis: add spinlock for rndis response list + - tracefs: Set the group ownership in apply_options() not parse_options() + - USB: serial: option: add support for DW5829e + - USB: serial: option: add Telit LE910R1 compositions + - [arm64] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings + - [arm64,armhf] usb: dwc3: gadget: Let the interrupt handler disable bottom + halves. + - xhci: re-initialize the HC during resume if HCE was set + - xhci: Prevent futile URB re-submissions due to incorrect return value. + - tty: n_gsm: fix encoding of control signal octet bit DV + + [ Salvatore Bonaccorso ] + * Bump ABI to 19 + * [rt] Update to 4.19.210-rt90 + * [rt] Update to 4.19.211-rt91 + * [rt] Update to 4.19.212-rt92 + * [rt] Update to 4.19.214-rt93 + * [rt] Update to 4.19.215-rt94 + - fscache: fix initialisation of cookie hash table raw spinlocks + * [rt] Update to 4.19.217-rt95 + * Refresh "Export symbols needed by Android drivers" + * liblockdep: Stop build liblockdep packages + * [rt] Update to 4.19.218-rt96 + * [rt] Update to 4.19.219-rt97 + * [rt] Refresh "net: move xmit_recursion to per-task variable on -RT" + * Refresh "Export symbols needed by Android drivers" + * [rt] Update to 4.19.225-rt101 + * Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for + out-of-tree modules"" + * [rt] Update to 4.19.227-rt102 + * [rt] Update to 4.19.230-rt103 + * init: Enable BPF_UNPRIV_DEFAULT_OFF (Closes: #990411) + * Mitigate Spectre v2-type Branch History Buffer attacks (CVE-2022-0001, + CVE-2022-0002) + - [x86] speculation: Merge one test in spectre_v2_user_select_mitigation() + - [x86] bugs: Unconditionally allow spectre_v2=retpoline,amd + - [x86] speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE + - [x86] speculation: Add eIBRS + Retpoline options + - Documentation/hw-vuln: Update spectre doc + - [x86] speculation: Include unprivileged eBPF status in Spectre v2 + mitigation reporting + - [x86] speculation: Use generic retpoline by default on AMD + - [x86] speculation: Update link to AMD speculation whitepaper + - [x86] speculation: Warn about Spectre v2 LFENCE mitigation + - [x86] speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT + + -- Salvatore Bonaccorso <carnil@debian.org> Mon, 07 Mar 2022 22:13:16 +0100 + +linux (4.19.208-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.195 + - perf/core: Fix endless multiplex timer + - net/nfc/rawsock.c: fix a permission check bug + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L + tablet + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 + tablet + - bonding: init notify_work earlier to avoid uninitialized use + - netlink: disable IRQs for netlink_lock_table() + - net: mdiobus: get rid of a BUG_ON() + - cgroup: disable controllers at parse time + - wq: handle VM suspension in stall detection + - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock + - RDS tcp loopback connection can hang + - scsi: bnx2fc: Return failure if io_req is already in ABTS processing + - [x86] scsi: vmw_pvscsi: Set correct residual data length + - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal + - [arm64] net: macb: ensure the device is available before accessing GEMGXL + control registers + - nvme-fabrics: decode host pathing error for connect + - [mips*] Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER + - bnx2x: Fix missing error code in bnx2x_iov_init_one() + - [powerpc*] i2c: mpc: Make use of i2c_recover_bus() + - [powerpc*] i2c: mpc: implement erratum A-004447 workaround + - drm: Fix use-after-free read in drm_getunique() + - drm: Lock pointer access in drm_master_release() + - kvm: avoid speculation-based attacks from out-of-range memslot accesses + - [arm64,x86] staging: rtl8723bs: Fix uninitialized variables + - btrfs: return value from btrfs_mark_extent_written() in case of error + - cgroup1: don't allow '\n' in renaming + - USB: f_ncm: ncm_bitrate (speed) is unsigned + - usb: f_ncm: only first packet of aggregate needs to start timer + - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms + - [arm64,armhf] usb: dwc3: ep0: fix NULL pointer exception + - [x86] usb: typec: ucsi: Clear PPM capability data in ucsi_init() error + path + - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind + - USB: serial: ftdi_sio: add NovaTech OrionMX product ID + - USB: serial: omninet: add device id for Zyxel Omni 56K Plus + - USB: serial: quatech2: fix control-request directions + - USB: serial: cp210x: fix alternate function for CP2102N QFN20 + - usb: gadget: eem: fix wrong eem header operation + - usb: fix various gadgets null ptr deref on 10gbps cabling. + - usb: fix various gadget panics on 10gbps cabling + - regulator: core: resolve supply for boot-on/always-on regulators + - [arm64] regulator: max77620: Use device_set_of_node_from_dev() + - RDMA/mlx4: Do not map the core_clock page to user space unless enabled + - perf: Fix data race between pin_count increment/decrement + - sched/fair: Make sure to update tg contrib for blocked load + - IB/mlx5: Fix initializing CQ fragments buffer + - NFS: Fix a potential NULL dereference in nfs_get_client() + - NFSv4: Fix deadlock between nfs4_evict_inode() and + nfs4_opendata_get_inode() + - perf session: Correct buffer copying when peeking events + - kvm: fix previous commit for 32-bit builds + - NFS: Fix use-after-free in nfs4_init_client() + - NFSv4: Fix second deadlock in nfs4_evict_inode() + - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error. + - scsi: core: Fix error handling of scsi_host_alloc() + - scsi: core: Put .shost_dev in failure path if host state changes to + RUNNING + - scsi: core: Only put parent device if host state differs from + SHOST_CREATED + - ftrace: Do not blindly read the ip address in ftrace_bug() + - tracing: Correct the length check which causes memory corruption + - proc: only require mm_struct for writing + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.196 + - net: ieee802154: fix null deref in parse dev addr + - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 + - HID: hid-sensor-hub: Return error for hid_set_field() failure + - HID: Add BUS_VIRTUAL to hid_connect logging + - HID: usbhid: fix info leak in hid_submit_ctrl + - gfs2: Prevent direct-I/O write fallback errors from getting lost + - gfs2: Fix use-after-free in gfs2_glock_shrink_scan + - scsi: target: core: Fix warning on realtime kernels + - ethernet: myri10ge: Fix missing error code in myri10ge_probe() + - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V + - net: ipconfig: Don't override command-line hostnames or domains + - rtnetlink: Fix missing error code in rtnl_bridge_notify() + - net: Return the correct errno code + - fib: Return the correct errno code + - afs: Fix an IS_ERR() vs NULL check + - mm/memory-failure: make sure wait for page writeback in memory_failure + - batman-adv: Avoid WARN_ON timing related checks + - net: ipv4: fix memory leak in netlbl_cipsov4_add_std + - net: rds: fix memory leak in rds_recvmsg + - udp: fix race between close() and udp_abort() + - rtnetlink: Fix regression in bridge VLAN configuration + - net/mlx5e: Block offload of outer header csum for UDP tunnels + - netfilter: synproxy: Fix out of bounds when parsing TCP options + - sch_cake: Fix out of bounds when parsing TCP options and header + - alx: Fix an error handling path in 'alx_probe()' + - net: stmmac: dwmac1000: Fix extended MAC address registers definition + - net: add documentation to socket.c + - net: make get_net_ns return error if NET_NS is disabled + - qlcnic: Fix an error handling path in 'qlcnic_probe()' + - netxen_nic: Fix an error handling path in 'netxen_nic_probe()' + - ptp: ptp_clock: Publish scaled_ppm_to_ppb + - ptp: improve max_adj check against unreasonable values + - net: cdc_ncm: switch to eth%d interface naming + - net: usb: fix possible use-after-free in smsc75xx_bind + - [armhf] net: fec_ptp: fix issue caused by refactor the fec_devtype + - net: ipv4: fix memory leak in ip_mc_add1_src + - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock + - be2net: Fix an error handling path in 'be_probe()' + - net: hamradio: fix memory leak in mkiss_close + - net: cdc_eem: fix tx fixup skb leak + - icmp: don't send out ICMP messages with a source address of 0.0.0.0 + - radeon: use memcpy_to/fromio for UVD fw upload + - hwmon: (scpi-hwmon) shows the negative temperature properly + - can: mcba_usb: fix memory leak in mcba_usb + - usb: core: hub: Disable autosuspend for Cypress CY7C65632 + - tracing: Do not stop recording cmdlines when tracing is off + - tracing: Do not stop recording comms if the trace file is being read + - tracing: Do no increment trace_clock_global() by one + - PCI: Mark TI C667X to avoid bus reset + - PCI: Mark some NVIDIA GPUs to avoid bus reset + - PCI: Add ACS quirk for Broadcom BCM57414 NIC + - PCI: Work around Huawei Intelligent NIC VF FLR erratum + - [arm64,armhf] dmaengine: pl330: fix wrong usage of spinlock flags in + dma_cyclc + - net: bridge: fix vlan tunnel dst null pointer dereference + - net: bridge: fix vlan tunnel dst refcnt when egressing + - mm/slub: clarify verification reporting + - mm/slub.c: include swab.h + - [armhf] net: fec_ptp: add clock rate zero check + - [arm64,armhf] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read + - can: bcm/raw/isotp: use per module netdevice notifier + - inet: use bigger hash table for IP ID generation + - [arm64,armhf] usb: dwc3: debugfs: Add and remove endpoint dirs dynamically + - [arm64,armhf] usb: dwc3: core: fix kernel panic when do reboot + - [x86] fpu: Reset state for all signal restore failures + - module: limit enabling module.sig_enforce (CVE-2021-35039) + - drm/nouveau: wait for moving fence after pinning v2 + - drm/radeon: wait for moving fence after pinning + - Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" + - mac80211: remove warning in ieee80211_get_sband() + - cfg80211: call cfg80211_leave_ocb when switching away from OCB + - mac80211: drop multicast fragments + - net: ethtool: clear heap allocations for ethtool function + - ping: Check return value of function 'ping_queue_rcv_skb' + - inet: annotate date races around sk->sk_txhash + - net/packet: annotate accesses to po->bind + - net/packet: annotate accesses to po->ifindex + - r8152: Avoid memcpy() over-reading of ETH_SS_STATS + - r8169: Avoid memcpy() over-reading of ETH_SS_STATS + - net: qed: Fix memcpy() overflow of qed_dcbx_params() + - [x86] PCI: Add AMD RS690 quirk to enable 64-bit DMA + - nilfs2: fix memory leak in nilfs_sysfs_delete_device_group + - i2c: robotfuzz-osif: fix control-request directions + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.197 + - mm: add VM_WARN_ON_ONCE_PAGE() macro + - mm/rmap: remove unneeded semicolon in page_not_mapped() + - mm/rmap: use page_not_mapped in try_to_unmap() + - mm/thp: fix __split_huge_pmd_locked() on shmem migration entry + - mm/thp: make is_huge_zero_pmd() safe and quicker + - mm/thp: try_to_unmap() use TTU_SYNC for safe splitting + - mm/thp: fix vma_address() if virtual address below file offset + - mm/thp: fix page_address_in_vma() on file THP tails + - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() + - mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split + - mm: page_vma_mapped_walk(): use page for pvmw->page + - mm: page_vma_mapped_walk(): settle PageHuge on entry + - mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd + - mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block + - mm: page_vma_mapped_walk(): crossing page table boundary + - mm: page_vma_mapped_walk(): add a level of indentation + - mm: page_vma_mapped_walk(): use goto instead of while (1) + - mm: page_vma_mapped_walk(): get vma_address_end() earlier + - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes + - mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() + - mm, futex: fix shared futex pgoff on shmem huge page + - scsi: sr: Return appropriate error code when disk is ejected + - drm/nouveau: fix dma_address check for CPU/GPU sync + - ext4: eliminate bogus error in ext4_data_block_valid_rcu() + - kthread_worker: split code for canceling the delayed work timer + - kthread: prevent deadlock when kthread_mod_delayed_work() races with + kthread_cancel_delayed_work_sync() + - xen/events: reset active flag for lateeoi events later + - [x86] KVM: SVM: Call SEV Guest Decommission if ASID binding fails + - [armhf] OMAP: replace setup_irq() by request_irq() + - [armhf] clocksource/drivers/timer-ti-dm: Add clockevent and clocksource + support + - [armhf] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap + issue + - [armhf] clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata + i940 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.198 + - scsi: core: Retry I/O for Notify (Enable Spinup) Required error + - ALSA: usb-audio: fix rate on Ozone Z90 USB headset + - ALSA: usb-audio: Fix OOB access at proc output + - media: dvb-usb: fix wrong definition + - Input: usbtouchscreen - fix control-request directions + - net: can: ems_usb: fix use-after-free in ems_usb_disconnect() + - usb: gadget: eem: fix echo command packet response issue + - USB: cdc-acm: blacklist Heimann USB Appset device + - [arm64,armhf] usb: dwc3: Fix debugfs creation flow + - [x86] usb: typec: Add the missed altmode_id_remove() in + typec_register_altmode() + - xhci: solve a double free problem while doing s4 + - iov_iter_fault_in_readable() should do nothing in xarray case + - Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl + (CVE-2021-3612) + - [armel,armhf] arm_pmu: Fix write counter incorrect in ARMv7 big-endian + mode + - btrfs: send: fix invalid path for unlink operations after parent + orphanization + - btrfs: clear defrag status of a root if starting transaction fails + - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a + transaction handle + - ext4: fix kernel infoleak via ext4_extent_header + - ext4: return error code when ext4_fill_flex_info() fails + - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit + - ext4: remove check for zero nr_to_scan in ext4_es_scan() + - ext4: fix avefreec in find_group_orlov + - ext4: use ext4_grp_locked_error in mb_find_extent + - can: gw: synchronize rcu operations before removing gw job entry + - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue + in TX path + - SUNRPC: Fix the batch tasks count wraparound. + - SUNRPC: Should wake up the privileged task firstly. + - [s390x] cio: dont call css_wait_for_slow_path() inside a lock + - [x86] serial_cs: Add Option International GSM-Ready 56K/ISDN modem + - [x86] serial_cs: remove wrong GLOBETROTTER.cis entry + - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() + - ssb: sdio: Don't overwrite const buffer if block_write fails + - rsi: Assign beacon rate settings to the correct rate_info descriptor field + - rsi: fix AP mode with WPA failure due to encrypted EAPOL + - tracing/histograms: Fix parsing of "sym-offset" modifier + - tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing + - seq_buf: Make trace_seq_putmem_hex() support data longer than 8 + - [powerpc*] stacktrace: Fix spurious "stale" traces in + raise_backtrace_ipi() + - fuse: check connected before queueing on fpq->io + - spi: Make of_register_spi_device also set the fwnode + - [i386] spi: spi-topcliff-pch: Fix potential double free in + pch_spi_process_messages() + - media: cpia2: fix memory leak in cpia2_usb_probe + - media: pvrusb2: fix warning in pvr2_i2c_core_done + - [x86] crypto: qat - check return code of qat_hal_rd_rel_reg() + - [x86] crypto: qat - remove unused macro in FW loader + - sched/fair: Fix ascii art by relpacing tabs + - media: em28xx: Fix possible memory leak of em28xx struct + - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release + - media: bt8xx: Fix a missing check bug in bt878_probe + - media: dvd_usb: memory leak in cinergyt2_fe_attach + - mmc: via-sdmmc: add a check against NULL pointer dereference + - crypto: shash - avoid comparing pointers to exported functions under CFI + - media: dvb_net: avoid speculation from net slot + - media: siano: fix device register error path + - btrfs: fix error handling in __btrfs_update_delayed_inode + - btrfs: abort transaction if we fail to update the delayed inode + - btrfs: disable build on platforms having page size 256K + - [armhf] regulator: da9052: Ensure enough delay time for + .set_voltage_time_sel + - HID: do not use down_interruptible() when unbinding devices + - ACPI: processor idle: Fix up C-state latency if not ordered + - [x86] hv_utils: Fix passing zero to 'PTR_ERR' warning + - lib: vsprintf: Fix handling of number field widths in vsscanf + - ACPI: EC: Make more Asus laptops use ECDT _GPE + - block_dump: remove block_dump feature in mark_inode_dirty() + - fs: dlm: cancel work sync othercon + - random32: Fix implicit truncation warning in prandom_seed_state() + - fs: dlm: fix memory leak when fenced + - ACPICA: Fix memory leak caused by _CID repair function + - ACPI: bus: Call kobject_put() in acpi_init() error path + - [x86] platform/x86: toshiba_acpi: Fix missing error code in + toshiba_acpi_setup_keyboard() + - clocksource: Retry clock read if long delays detected + - HID: wacom: Correct base usage for capacitive ExpressKey status bits + - [armhf] sata_highbank: fix deferred probing + - [mips*] pata_octeon_cf: avoid WARN_ON() in ata_host_activate() + - [x86] crypto: ccp - Fix a resource leak in an error handling path + - media: rc: i2c: Fix an error message + - media: gspca/gl860: fix zero-length control requests + - media: siano: Fix out-of-bounds warnings in + smscore_load_firmware_family2() + - btrfs: clear log tree recovering status if starting transaction fails + - [armhf] spi: spi-sun6i: Fix chipselect/clock bug + - ACPI: sysfs: Fix a buffer overrun problem with description_show() + - blk-wbt: introduce a new disable state to prevent false positive by + rwb_enabled() + - blk-wbt: make sure throttle is enabled properly + - ocfs2: fix snprintf() checking + - [arm64,armhf] net: mvpp2: Put fwnode in error case during ->probe() + - [i386] net: pch_gbe: Propagate error from devm_gpio_request_one() + - [arm64] drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on + error in cdn_dp_grf_write() + - RDMA/rxe: Fix failure during driver load + - drm: qxl: ensure surf.data is ininitialized + - ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others + - [arm64] wcn36xx: Move hal_buf allocation to devm_kmalloc in probe + - ssb: Fix error return code in ssb_bus_scan() + - brcmfmac: fix setting of station info chains bitmask + - brcmfmac: correctly report average RSSI in station info + - brcmsmac: mac80211_if: Fix a resource leak in an error handling path + - ath10k: Fix an error code in ath10k_add_interface() + - RDMA/mlx5: Don't add slave port to unaffiliated list + - netfilter: nft_exthdr: check for IPv6 packet before further processing + - netfilter: nft_osf: check for TCP packet before further processing + - netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols + - RDMA/rxe: Fix qp reference counting for atomic ops + - pkt_sched: sch_qfq: fix qfq_change_class() error path + - vxlan: add missing rcu_read_lock() in neigh_reduce() + - net/ipv4: swap flow ports when validating source + - ieee802154: hwsim: Fix memory leak in hwsim_add_one + - ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() + - mac80211: remove iwlwifi specific workaround NDPs of null_response + - ipv6: exthdrs: do not blindly use init_net + - bpf: Do not change gso_size during bpf_skb_change_proto() + - i40e: Fix error handling in i40e_vsi_open + - i40e: Fix autoneg disabling for non-10GBaseT links + - ipv6: fix out-of-bound access in ip6_parse_tlv() + - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid + - Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event + - writeback: fix obtain a reference to a freeing memcg css + - net: lwtunnel: handle MTU calculation in forwading + - net: sched: fix warning in tcindex_alloc_perfect_hash + - RDMA/mlx5: Don't access NULL-cleared mpi pointer + - tty: nozomi: Fix a resource leak in an error handling function + - mwifiex: re-fix for unaligned accesses + - [arm64] ASoC: hisilicon: fix missing clk_disable_unprepare() on error in + hi6210_i2s_startup() + - [x86] char: pcmcia: error out if 'num_bytes_read' is greater than 4 in + set_protocol() + - tty: nozomi: Fix the error handling path of 'nozomi_card_init()' + - scsi: FlashPoint: Rename si_flags field + - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates + - of: Fix truncation of memory sizes on 32-bit platforms + - [armhf] mtd: rawnand: marvell: add missing clk_disable_unprepare() on + error in marvell_nfc_resume() + - scsi: mpt3sas: Fix error return value in _scsih_expander_add() + - configfs: fix memleak in configfs_release_bin_file + - [powerpc*] Offline CPU in stop_this_cpu() + - [arm64] serial: mvebu-uart: correctly calculate minimal possible baudrate + - vfio/pci: Handle concurrent vma faults + - mm/huge_memory.c: don't discard hugepage if other processes are mapping it + - mmc: block: Disable CMDQ on the ioctl path + - mmc: vub3000: fix control-request direction + - drm/amd/amdgpu/sriov disable all ip hw status by default + - [i386] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() + - hugetlb: clear huge pte during flush function on mips platform + - atm: iphase: fix possible use-after-free in ia_module_exit() + - mISDN: fix possible use-after-free in HFC_cleanup() + - atm: nicstar: Fix possible use-after-free in nicstar_cleanup() + - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT + - reiserfs: add check for invalid 1st journal block + - drm/virtio: Fix double free on probe failure + - udf: Fix NULL pointer dereference in udf_symlink function + - e100: handle eeprom as little endian + - [arm64,armhf] clk: tegra: Ensure that PLLU configuration is applied + properly + - ipv6: use prandom_u32() for ID generation + - RDMA/cxgb4: Fix missing error code in create_qp() + - dm space maps: don't reset space map allocation cursor when committing + - [armhf] pinctrl: mcp23s08: fix race condition in irq handler + - ice: set the value of global config lock timeout longer + - virtio_net: Remove BUG() to avoid machine dead + - [arm64,armhf] net: mvpp2: check return value after calling + platform_get_resource() + - [amd64] fjes: check return value after calling platform_get_resource() + - selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC + - xfrm: Fix error reporting in xfrm_state_construct. + - [arm64,armhf] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP + - [arm64,armhf] wl1251: Fix possible buffer overflow in wl1251_cmd_scan + - net: fix mistake path for netdev_features_strings + - rtl8xxxu: Fix device info for RTL8192EU devices + - atm: nicstar: use 'dma_free_coherent' instead of 'kfree' + - atm: nicstar: register the interrupt handler in the right place + - vsock: notify server to shutdown when client has pending signal + - RDMA/rxe: Don't overwrite errno from ib_umem_get() + - iwlwifi: mvm: don't change band on bound PHY contexts + - iwlwifi: pcie: free IML DMA memory allocation + - sfc: avoid double pci_remove of VFs + - sfc: error code if SRIOV cannot be disabled + - wireless: wext-spy: Fix out-of-bounds warning + - net: ip: avoid OOM kills with large UDP sends over loopback + - RDMA/cma: Fix rdma_resolve_route() memory leak + - Bluetooth: Fix the HCI to MGMT status conversion table + - Bluetooth: Shutdown controller after workqueues are flushed or cancelled + - Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. + - sctp: validate from_addr_param return (CVE-2021-3655) + - sctp: add size validation when walking chunks (CVE-2021-3655) + - fscrypt: don't ignore minor_hash when hash is 0 + - bdi: Do not use freezable workqueue + - [arm64] serial: mvebu-uart: clarify the baud rate derivation + - [arm64] serial: mvebu-uart: fix calculation of clock divisor + - fuse: reject internal errno + - [powerpc*] barrier: Avoid collision with clang's __lwsync macro + - usb: gadget: f_fs: Fix setting of device and driver data cross-references + - drm/radeon: Add the missed drm_gem_object_put() in + radeon_user_framebuffer_create() + - pinctrl/amd: Add device HID for new AMD GPIO controller + - [arm64] drm/msm/mdp4: Fix modifier support enabling + - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode + - mmc: core: clear flags before allowing to retune + - mmc: core: Allow UHS-I voltage switch for SDSC cards if supported + - [armhf] ata: ahci_sunxi: Disable DIPM + - cpu/hotplug: Cure the cpusets trainwreck + - [arm64,armhf] clocksource/arm_arch_timer: Improve Allwinner A64 timer + workaround + - [arm64,armhf] ASoC: tegra: Set driver_name=tegra for all machine drivers + - qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute + - ipmi/watchdog: Stop watchdog timer when the current action is 'none' + - seq_buf: Fix overflow in seq_buf_putmem_hex() + - tracing: Simplify & fix saved_tgids logic + - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT + - dm btree remove: assign new_root only when removal succeeds + - PCI: Leave Apple Thunderbolt controllers on for s2idle or standby + - [arm64] PCI: aardvark: Fix checking for PIO Non-posted Request + - media: subdev: disallow ioctl for saa6588/davinci + - media: dtv5100: fix control-request directions + - media: zr364xx: fix memory leak in zr364xx_start_readpipe + - media: gspca/sq905: fix control-request direction + - media: gspca/sunplus: fix zero-length control requests + - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K + - [armhf] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() + - jfs: fix GPF in diFree + - [x86] KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is + enabled + - [x86] KVM: X86: Disable hardware breakpoints unconditionally before + kvm_x86->run() + - scsi: core: Fix bad pointer dereference when ehandler kthread is invalid + - tracing: Do not reference char * as a string in histograms + - [arm64] PCI: aardvark: Don't rely on jiffies while holding spinlock + - [arm64] PCI: aardvark: Fix kernel panic during PIO transfer + - [x86] misc/libmasm/module: Fix two use after free in ibmasm_init_one + - Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" + - w1: ds2438: fixing bug that would always get page0 + - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology + - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the + SGLs + - scsi: core: Cap scsi_host cmd_per_lun at can_queue + - [x86] tty: serial: 8250: serial_cs: Fix a memory leak in error handling + path + - scsi: scsi_dh_alua: Check for negative result value + - fs/jfs: Fix missing error code in lmLogInit() + - scsi: iscsi: Add iscsi_cls_conn refcount helpers + - scsi: iscsi: Fix conn use after free during resets + - scsi: iscsi: Fix shost->max_id use + - scsi: qedi: Fix null ref during abort handling + - [armhf] mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE + - [s390x] sclp_vt220: fix console name to match device (Closes: #961056) + - [i386] ALSA: sb: Fix potential double-free of CSP mixer elements + - [powerpc*] ps3: Add dma_mask to ps3_dma_region + - [arm64] gpio: zynq: Check return value of pm_runtime_get_sync + - [arm64,armhf] gpio: pca953x: Add support for the On Semi pca9655 + - ASoC: soc-core: Fix the error return code in + snd_soc_of_parse_audio_routing() + - ALSA: bebob: add support for ToneWeal FW66 + - usb: gadget: f_hid: fix endianness issue with descriptors + - [powerpc*] boot: Fixup device-tree on little endian + - [arm64,armhf] ALSA: hda: Add IRQ check for platform_get_irq() + - [x86] intel_th: Wait until port is in reset before programming it + - i2c: core: Disable client irq on reboot/shutdown + - lib/decompress_unlz4.c: correctly handle zero-padding around initrds. + - [x86] power: supply: max17042: Do not enforce (incorrect) interrupt + trigger type + - [armel,armhf] power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE + - [x86] watchdog: Fix possible use-after-free in wdt_startup() + - [x86] watchdog: Fix possible use-after-free by calling del_timer_sync() + - [x86] watchdog: iTCO_wdt: Account for rebooting on second timeout + - [x86] fpu: Return proper error codes from user access functions + - [arm64,armhf] PCI: tegra: Add missing MODULE_DEVICE_TABLE + - orangefs: fix orangefs df output. + - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty + - NFS: nfs_find_open_context() may only select open files + - [arm64,armhf] pwm: tegra: Don't modify HW state in .remove callback + - [arm64] ACPI: AMBA: Fix resource name in /proc/iomem + - [x86] ACPI: video: Add quirk for the Dell Vostro 3350 + - virtio-blk: Fix memory leak among suspend/resume procedure + - virtio_net: Fix error handling in virtnet_restore() + - virtio_console: Assure used length from device is limited (CVE-2021-38160) + - f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs + - PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun + - NFSv4: Initialise connection to the server in nfs4_alloc_client() + (CVE-2021-38199) + - nfs: fix acl memory leak of posix_acl_create() + - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode + - [x86] fpu: Limit xstate copy size in xstateregs_set() + - virtio_net: move tx vq operation under tx queue lock + - [i386] ALSA: isa: Fix error return code in snd_cmi8330_probe() + - NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times + - rtc: fix snprintf() checking in is_rtc_hctosys() + - [arm64,armhf] reset: bail if try_module_get() fails + - [armhf] dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema + - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() + - net: bridge: multicast: fix PIM hello router port marking race + - scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.199 + - [armhf] dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and + rk3288 + - [armhf] imx: pm-imx5: Fix references to imx5_cpu_suspend_info + - [armhf] dts: rockchip: fix supply properties in io-domains nodes + - [arm64,armhf] soc/tegra: fuse: Fix Tegra234-only builds + - thermal/core: Correct function name thermal_zone_device_unregister() + - [arm64,armhf] rtc: max77686: Do not enforce (incorrect) interrupt trigger + type + - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 + - scsi: libsas: Add LUN number check in .slave_alloc callback + - scsi: libfc: Fix array index out of bound exception + - sched/fair: Fix CFS bandwidth hrtimer expiry type + - mm: slab: fix kmem_cache_create failed when sysfs node not destroyed + - dm writecache: return the exact table values that were set + - dm writecache: fix writing beyond end of underlying device when shrinking + - [arm64,armhf] net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz + - net: ipv6: fix return value of ip6_skb_dst_mtu + - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo + - net: bridge: sync fdb to new unicast-filtering ports + - [arm64] net: qcom/emac: fix UAF in emac_remove + - net: ti: fix UAF in tlan_remove_one + - net: send SYNACK packet with accepted fwmark + - net: validate lwtstate->data before returning from skb_tunnel_info() + - dma-buf/sync_file: Don't leak fences on merge failure + - tcp: annotate data races around tp->mtu_info + - ipv6: tcp: drop silly ICMPv6 packet too big messages + - udp: annotate data races around unix_sk(sk)->gso_size + - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices + - igb: Fix use-after-free error during reset + - ixgbe: Fix an error handling path in 'ixgbe_probe()' + - igb: Fix an error handling path in 'igb_probe()' + - e1000e: Fix an error handling path in 'e1000_probe()' + - iavf: Fix an error handling path in 'iavf_probe()' + - igb: Check if num of q_vectors is smaller than max before array access + - igb: Fix position of assignment to *ring + - ipv6: fix 'disable_policy' for fwd packets + - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove + - liquidio: Fix unintentional sign extension issue on left shift of u16 + - net: fix uninit-value in caif_seqpkt_sendmsg + - net: decnet: Fix sleeping inside in af_decnet + - [powerpc*] KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak + - netrom: Decrease sock refcount when sock timers expire + - scsi: iscsi: Fix iface sysfs attr detection + - scsi: target: Fix protect handling in WRITE SAME(32) + - net/tcp_fastopen: fix data races around tfo_active_disable_stamp + - net/sched: act_skbmod: Skip non-Ethernet packets + - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING + - Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" + - sctp: update active_key for asoc when old key is being replaced + - net: sched: cls_api: Fix the the wrong parameter + - [arm64,armhf] drm/panel: raspberrypi-touchscreen: Prevent double-free + - proc: Avoid mixing integer types in mem_rw() + - [s390x] ftrace: fix ftrace_update_ftrace_func implementation + - ALSA: usb-audio: Add registration quirk for JBL Quantum headsets + - [i386] ALSA: sb: Fix potential ABBA deadlock in CSP driver + - xhci: Fix lost USB 2 remote wake + - [powerpc*] KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow + (CVE-2021-37576) + - usb: hub: Disable USB 3 device initiated lpm if exit latency is too high + - usb: hub: Fix link power management max exit latency (MEL) calculations + - USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS + - USB: serial: option: add support for u-blox LARA-R6 family + - USB: serial: cp210x: fix comments for GE CS1000 + - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick + - [arm*] usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. + - tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. + (CVE-2021-3679) + - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() + - ixgbe: Fix packet corruption due to missing DMA sync + - drm: Return -ENOTTY for non-drm ioctls + - KVM: do not assume PTE is writable after follow_pfn + - KVM: do not allow mapping valid but non-reference-counted pages + (CVE-2021-22543) + - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() + - [arm64,armhf] net: dsa: mv88e6xxx: use correct .stats_set_histogram() on + Topaz + - btrfs: compression: don't try to compress if we don't have enough pages + - PCI: Mark AMD Navi14 GPU ATS as broken + - xhci: add xhci_get_virt_ep() helper + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.200 + - [x86] KVM: determine if an exception has an error code only when injecting + it. + - net: split out functions related to registering inflight socket files + - af_unix: fix garbage collect vs MSG_PEEK + - workqueue: fix UAF in pwq_unbound_release_workfn() + - net/802/mrp: fix memleak in mrp_request_join() + - net/802/garp: fix memleak in garp_request_join() + - net: annotate data race around sk_ll_usec + - sctp: move 198 addresses from unusable to private scope + - hfs: add missing clean-up in hfs_fill_super + - hfs: fix high memory mapping in hfs_bnode_read + - hfs: add lock nesting notation to hfs_find_init + - cifs: fix the out of range assignment to bit fields in + parse_server_interfaces + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.201 + - virtio_net: Do not pull payload in skb->head + - gro: ensure frag0 meets IP header alignment + - [x86] asm: Ensure asm/proto.h can be included stand-alone + - btrfs: fix rw device counting in __btrfs_free_extra_devids + - [x86] kvm: fix vcpu-id indexed array sizes + - ocfs2: fix zero out valid data + - ocfs2: issue zeroout to EOF blocks + - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF + - can: mcba_usb_start(): add missing urb->transfer_dma initialization + - can: usb_8dev: fix memory leak + - can: ems_usb: fix memory leak + - can: esd_usb2: fix memory leak + - NIU: fix incorrect error return, missed in previous revert + - nfc: nfcsim: fix use after free during module unload + - cfg80211: Fix possible memory leak in function cfg80211_bss_update + - netfilter: conntrack: adjust stop timestamp to real expiry value + - netfilter: nft_nat: allow to specify layer 4 protocol NAT only + - i40e: Fix logic of disabling queues + - i40e: Fix log TC creation failure when max num of queues is exceeded + - tipc: fix sleeping in tipc accept routine + - mlx4: Fix missing error code in mlx4_load_one() + - net: llc: fix skb_over_panic + - net/mlx5: Fix flow table chaining + - sctp: fix return value check in __sctp_rcv_asconf_lookup + - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove + - sis900: Fix missing pci_disable_device() in probe and remove + - [powerpc*] pseries: Fix regression while building external modules + - i40e: Add additional info to PHY type error + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.202 + - btrfs: mark compressed range uptodate only if all bio succeed + - r8152: Fix potential PM refcount imbalance + - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() + - net: Fix zero-copy head len calculation. + - bdi: move bdi_dev_name out of line + - bdi: use bdi_dev_name() to get device name + - bdi: add a ->dev_name field to struct backing_dev_info + - Revert "Bluetooth: Shutdown controller after workqueues are flushed or + cancelled" + - [x86] Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" + - padata: validate cpumask without removed CPU during offline + - padata: add separate cpuhp node for CPUHP_PADATA_DEAD + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.203 + - Revert "ACPICA: Fix memory leak caused by _CID repair function" + - ALSA: seq: Fix racy deletion of subscriber + - [armhf] imx: add missing iounmap() + - ALSA: usb-audio: fix incorrect clock source setting + - scsi: sr: Return correct event when media event code is 3 + - media: videobuf2-core: dequeue if start_streaming fails + - net: natsemi: Fix missing pci_disable_device() in probe and remove + - sctp: move the active_key update after sh_keys is added + - nfp: update ethtool reporting of pauseframe control + - net: ipv6: fix returned variable type in ip6_skb_dst_mtu + - bnx2x: fix an error code in bnx2x_nic_load() + - net: pegasus: fix uninit-value in get_interrupt_interval + - [armhf] net: fec: fix use-after-free in fec_drv_remove + - net: vxge: fix use-after-free in vxge_device_unregister + - Bluetooth: defer cleanup of resources in hci_unregister_dev() + - USB: usbtmc: Fix RCU stall warning + - USB: serial: option: add Telit FD980 composition 0x1056 + - USB: serial: ch341: fix character loss at high transfer rates + - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 + - firmware_loader: use -ETIMEDOUT instead of -EAGAIN in + fw_load_sysfs_fallback + - firmware_loader: fix use-after-free in firmware_fallback_sysfs + - ALSA: usb-audio: Add registration quirk for JBL Quantum 600 + - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers + - usb: gadget: f_hid: fixed NULL pointer dereference + - usb: gadget: f_hid: idle uses the highest byte for duration + - tracing/histogram: Rename "cpu" to "common_cpu" + - [arm64] optee: Clear stale cache entries during initialization + - staging: rtl8723bs: Fix a resource leak in sd_int_dpc + - media: rtl28xxu: fix zero-length control request + - pipe: increase minimum default pipe size to 2 pages + - ext4: fix potential htree corruption when growing large_dir directories + - serial: 8250: Mask out floating 16/32-bit bus bits + - [mips*] Malta: Do not byte-swap accesses to the CBUS UART + - [x86] pcmcia: i82092: fix a null pointer dereference bug + - [x86] KVM: accept userspace interrupt only if no event is injected + - [x86] KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds + - [armhf] spi: meson-spicc: fix memory leak in meson_spicc_remove + - qmi_wwan: add network device usage statistics for qmimux devices + - libata: fix ata_pio_sector for CONFIG_HIGHMEM + - reiserfs: add check for root_inode in reiserfs_fill_super + - reiserfs: check directory items on read from disk + - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and + ql_adapter_reset + - [armhf] imx: add mmdc ipg clock operation for mmdc + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.204 + - [x86] KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB + - bpf: Inherit expanded/patched seen count from old aux data + (CVE-2021-33624) + - bpf: Do not mark insn as seen under speculative path verification + (CVE-2021-33624) + - bpf: Fix leakage under speculation on mispredicted branches + (CVE-2021-33624) + - [x86] KVM: MMU: Use the correct inherited permissions to get shadow page + (CVE-2021-38198) + - USB:ehci:fix Kunpeng920 ehci hardware problem + - ppp: Fix generating ppp unit id when ifname is not specified + - ovl: prevent private clone if bind mount is not allowed CVE-2021-3732) + - net: xilinx_emaclite: Do not print real IOMEM pointer (CVE-2021-38205) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.205 + - [x86] ASoC: intel: atom: Fix reference to PCM buffer address + - i2c: dev: zero out array used for i2c reads from userspace + - [amd64,arm64] ACPI: NFIT: Fix support for virtual SPA ranges + - ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi + - ieee802154: hwsim: fix GPF in hwsim_new_edge_nl + - ppp: Fix generating ifname when empty IFLA_IFNAME is specified + - net: Fix memory leak in ieee802154_raw_deliver + - net: igmp: fix data-race in igmp_ifc_timer_expire() + - net: bridge: fix memleak in br_add_if() + - tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B + packets + - net: igmp: increase size of mr_ifc_count + - xen/events: Fix race in set_evtchn_to_irq + - vsock/virtio: avoid potential deadlock when vsock device remove + - [powerpc*] kprobes: Fix kprobe Oops happens in booke + - genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP + - [x86] msi: Force affinity setup before startup + - [x86] ioapic: Force affinity setup before startup + - genirq/msi: Ensure deactivation on teardown + - PCI/MSI: Enable and mask MSI-X early + - PCI/MSI: Do not set invalid bits in MSI mask + - PCI/MSI: Correct misleading comments + - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() + - PCI/MSI: Protect msi_desc::masked for multi-MSI + - PCI/MSI: Mask all unused MSI-X entries + - PCI/MSI: Enforce that MSI-X table entry is masked for update + - PCI/MSI: Enforce MSI[X] entry updates to be visible + - [amd64] iommu/vt-d: Fix agaw for a supported 48 bit guest address width + - mac80211: drop data frames without key on encrypted links + - [x86] KVM: nSVM: always intercept VMLOAD/VMSAVE when nested + (CVE-2021-3656) + - [x86] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl + (CVE-2021-3653) + - [x86] fpu: Make init_fpstate correct with optimized XSAVE + - ath: Use safer key clearing with key cache entries (CVE-2020-3702) + - ath9k: Clear key cache explicitly on disabling hardware (CVE-2020-3702) + - ath: Export ath_hw_keysetmac() (CVE-2020-3702) + - ath: Modify ath_key_delete() to not need full key entry (CVE-2020-3702) + - ath9k: Postpone key cache entry deletion for TXQ frames reference it + (CVE-2020-3702) + - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is + not yet available + - scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() + - scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() + - scsi: core: Avoid printing an error if target_alloc() returns -ENXIO + - net: usb: lan78xx: don't modify phy_device state concurrently + - Bluetooth: hidp: use correct wait queue when removing ctrl_wait + - [arm64] cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant + - vhost: Fix the calculation in vhost_overflow() + - bnxt: don't lock the tx queue from napi poll + - bnxt: disable napi before canceling DIM + - net: 6pack: fix slab-out-of-bounds in decode_data + - net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 + - [arm64,armhf] net: mdio-mux: Don't ignore memory allocation errors + - [arm64,armhf] net: mdio-mux: Handle -EPROBE_DEFER correctly + - [arm64,armhf] mmc: dw_mmc: Fix hang on data CRC error + - ALSA: hda - fix the 'Capture Switch' value change notifications + - btrfs: prevent rename2 from exchanging a subvol with a directory from + different parents + - PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI + - [x86] ASoC: intel: atom: Fix breakage for PCM buffer address setup + - locks: print a warning when mount fails due to lack of "mand" support + - fs: warn about impending deprecation of mandatory locks + - netfilter: nft_exthdr: fix endianness of tcp option cast + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.206 + - net: qrtr: fix another OOB Read in qrtr_endpoint_post (CVE-2021-3743) + - bpf: Do not use ax register in interpreter on div/mod + - bpf: Fix 32 bit src register truncation on div/mod (CVE-2021-3600) + - bpf: Fix truncation handling for mod32 dst reg wrt zero (CVE-2021-3444) + - netfilter: conntrack: collect all entries in one cycle + - once: Fix panic when module unload + - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX + and TX error counters + - Revert "USB: serial: ch341: fix character loss at high transfer rates" + - USB: serial: option: add new VID/PID to support Fibocom FG150 + - [arm64,armhf] usb: dwc3: gadget: Fix dwc3_calc_trbs_left() + - [arm64,armhf] usb: dwc3: gadget: Stop EP0 transfers during pullup disable + - [amd64] IB/hfi1: Fix possible null-pointer dereference in + _extend_sdma_tx_descs() + - e1000e: Fix the max snoop/no-snoop latency for 10M + - ip_gre: add validation for csum_start + - [arm64] xgene-v2: Fix a resource leak in the error handling path of + 'xge_probe()' + - [arm64,armhf] net: marvell: fix MVNETA_TX_IN_PRGRS bit number + - [arm64] net: hns3: fix get wrong pfc_en when query PFC configuration + - usb: gadget: u_audio: fix race condition on endpoint stop + - opp: remove WARN when no valid OPPs remain + - virtio: Improve vq->broken access to avoid any compiler optimization + - virtio_pci: Support surprise removal of virtio pci device + - [amd64] vringh: Use wiov->used to check for read/write desc order + - qed: qed ll2 race condition fixes + - qed: Fix null-pointer dereference in qed_rdma_create_qp() + - drm: Copy drm_wait_vblank to user before returning + - drm/nouveau/disp: power down unused DP links during init + - net/rds: dma_map_sg is entitled to merge entries + - vt_kdsetmode: extend console locking (CVE-2021-3753) + - fbmem: add margin check to fb_check_caps() + - [x86] KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow + MMUs + - Revert "floppy: reintroduce O_NDELAY fix" + - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.207 + - ext4: fix race writing to an inline_data file while its xattrs are + changing (CVE-2021-40490) + - [armhf] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar + U/V formats + - qed: Fix the VF msix vectors flow + - [arm64] net: macb: Add a NULL check on desc_ptp + - qede: Fix memset corruption + - [x86] perf/x86/intel/pt: Fix mask of num_address_ranges + - [x86] perf/x86/amd/ibs: Work around erratum #1197 + - [armel,armhf] 8918/2: only build return_address() if needed + - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl + - clk: fix build warning for orphan_list + - media: stkwebcam: fix memory leak in stk_camera_probe + - [armhf] imx: add missing clk_disable_unprepare() + - [armhf] imx: fix missing 3rd argument in macro imx_mmdc_perf_init + - igmp: Add ip_mc_list lock in ip_check_mc_rcu + - ipv4/icmp: l3mdev: Perform icmp error route lookup on source device + routing table (v2) + - SUNRPC/nfs: Fix return value for nfs4_callback_compound() + - [powerpc*] module64: Fix comment in R_PPC64_ENTRY handling + - [powerpc*] boot: Delete unneeded .globl _zimage_start + - mm/page_alloc: speed up the iteration of max_order + - Revert "btrfs: compression: don't try to compress if we don't have enough + pages" + - ALSA: usb-audio: Add registration quirk for JBL Quantum 800 + - [x86] reboot: Limit Dell Optiplex 990 quirk to early BIOS versions + - PCI: Call Max Payload Size-related fixup quirks early + - locking/mutex: Fix HANDOFF condition + - regmap: fix the offset of register error log + - sched/deadline: Fix reset_on_fork reporting of DL tasks + - power: supply: axp288_fuel_gauge: Report register-address on readb / + writeb errors + - sched/deadline: Fix missing clock update in migrate_task_rq_dl() + - hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() + - udf: Check LVID earlier + - isofs: joliet: Fix iocharset=utf8 mount option + - bcache: add proper error unwinding in bcache_device_init + - nvme-rdma: don't update queue count when failing to set io queues + - [x86] power: supply: max17042_battery: fix typo in MAx17042_TOFF + - [s390x] cio: add dev_busid sysfs entry for each subchannel + - libata: fix ata_host_start() + - [x86] crypto: qat - do not ignore errors from enable_vf2pf_comms() + - [x86] crypto: qat - handle both source of interrupt in VF ISR + - [x86] crypto: qat - fix reuse of completion variable + - [x86] crypto: qat - fix naming for init/shutdown VF to PF notifications + - [x86] crypto: qat - do not export adf_iov_putmsg() + - fcntl: fix potential deadlock for &fasync_struct.fa_lock + - udf_get_extendedattr() had no boundary checks. + - lib/mpi: use kcalloc in mpi_resize + - [x86] crypto: qat - use proper type for vf_mask + - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init + - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr + - media: go7007: remove redundant initialization + - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() + - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos + - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect + - [arm64] media: venus: venc: Fix potential null pointer dereference on + pointer fmt + - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently + - PCI: PM: Enable PME if it can be signaled from D3cold + - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow + - [arm64] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary + LMs + - Bluetooth: fix repeated calls to sco_sock_kill + - [arm64] drm/msm/dsi: Fix some reference counted resource leaks + - [armhf] usb: phy: twl6030: add IRQ checks + - Bluetooth: Move shutdown callback before flushing tx and rx queue + - mac80211: Fix insufficient headroom issue for AMSDU + - Bluetooth: add timeout sanity check to hci_inquiry + - [armhf] i2c: s3c2410: fix IRQ check + - [arm64,armhf] mmc: dw_mmc: Fix issue with uninitialized dma_slave_config + - CIFS: Fix a potencially linear read overflow + - [arm*] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe + - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() + - bcma: Fix memory leak for internally-handled cores + - ipv4: make exception cache less predictible + - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed + - ipv4: fix endianness issue in inet_rtm_getroute_build_skb() + - netns: protect netns ID lookups with RCU + - fscrypt: add fscrypt_symlink_getattr() for computing st_size + - ext4: report correct st_size for encrypted symlinks + - f2fs: report correct st_size for encrypted symlinks + - ubifs: report correct st_size for encrypted symlinks + - tty: Fix data race between tiocsti() and flush_to_ldisc() + - [x86] KVM: Update vCPU's hv_clock before back to guest when tsc_offset is + adjusted + - fbmem: don't allow too huge resolutions + - [arm64,armhf] backlight: pwm_bl: Improve bootloader/kernel device handover + - [armel] clk: kirkwood: Fix a clocking boot regression + - btrfs: reset replace target device to allocation state on close + - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN + - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN + - PCI/MSI: Skip masking MSI-X on Xen PV + - [powerpc*] perf/hv-gpci: Fix counter value parsing + - xen: fix setting of max_pfn in shared_info + - 9p/xen: Fix end of loop tests for list_for_each_entry + - bpf/verifier: per-register parent pointers + - bpf: correct slot_type marking logic to allow more stack slot sharing + - bpf: Support variable offset stack access from helpers + - bpf: Reject indirect var_off stack access in raw mode + - bpf: Reject indirect var_off stack access in unpriv mode + - bpf: Sanity check max value for var_off stack access + - bpf: track spill/fill of constants + - bpf: Introduce BPF nospec instruction for mitigating Spectre v4 + (CVE-2021-34556, CVE-2021-35477) + - bpf: Fix leakage due to insufficient speculative store bypass mitigation + (CVE-2021-34556, CVE-2021-35477) + - bpf: verifier: Allocate idmap scratch in verifier env + - bpf: Fix pointer arithmetic mask tightening under state pruning + - [arm64] head: avoid over-mapping in map_memory + - block: bfq: fix bfq_set_next_ioprio_data() + - [x86] power: supply: max17042: handle fails of reading status register + - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() + - [x86] VMCI: fix NULL pointer dereference when unmapping queue pair + - media: uvc: don't do DMA on stack + - media: rc-loopback: return number of emitters rather than error + - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs + - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported + - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure + - [arm64] PCI: xilinx-nwl: Enable the clock through CCF + - [arm64] PCI: aardvark: Increase polling delay to 1.5s while waiting for + PIO response + - [arm64] PCI: aardvark: Fix masking and unmasking legacy INTx interrupts + - HID: input: do not report stylus battery state as "full" + - RDMA/iwcm: Release resources if iw_cm module initialization fails + - docs: Fix infiniband uverbs minor number + - [armhf] pinctrl: samsung: Fix pinctrl bank pin count + - [powerpc*] stacktrace: Include linux/delay.h + - [arm64,armhf] pinctrl: single: Fix error return code in + pcs_parse_bits_in_pinctrl_entry() + - scsi: qedi: Fix error codes in qedi_alloc_global_queues() + - [x86] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from + run_smbios_call + - fscache: Fix cookie key hashing + - f2fs: fix to account missing .skipped_gc_rwsem + - f2fs: fix to unmap pages from userspace process in punch_hole() + - [mips*] Malta: fix alignment of the devicetree buffer + - userfaultfd: prevent concurrent API initialization + - media: dib8000: rewrite the init prbs logic + - PCI: Use pci_update_current_state() in pci_enable_device_flags() + - tipc: keep the skb in rcv queue until the whole data is read + - video: fbdev: kyro: fix a DoS bug by restricting user input + - netlink: Deal with ESRCH error in nlmsg_notify() + - usb: gadget: u_ether: fix a potential null pointer dereference + - usb: gadget: composite: Allow bMaxPower=0 if self-powered + - tty: serial: jsm: hold port lock when reporting modem line changes + - video: fbdev: kyro: Error out if 'pixclock' equals zero + - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() + - flow_dissector: Fix out-of-bounds warnings + - [s390x] jump_label: print real address in a case of a jump label bug + - serial: 8250: Define RX trigger levels for OxSemi 950 devices + - serial: 8250_pci: make setup_port() parameters explicitly unsigned + - Bluetooth: skip invalid hci_sync_conn_complete_evt + - bonding: 3ad: fix the concurrency between __bond_release_one() and + bond_3ad_state_machine_handler() + - [x86] ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps + for the matching in-/output + - media: v4l2-dv-timings.c: fix wrong condition in two for-loops + - [armhf] dts: imx53-ppd: Fix ACHC entry + - [arm64] dts: qcom: sdm660: use reg value for memory node + - [arm64] net: ethernet: stmmac: Do not use unreachable() in + ipq806x_gmac_probe() + - Bluetooth: schedule SCO timeouts with delayed_work + - Bluetooth: avoid circular locks in sco_sock_connect + - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable + access in amdgpu_i2c_router_select_ddc_port() + - Bluetooth: Fix handling of LE Enhanced Connection Complete + - tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD + - rpc: fix gss_svc_init cleanup on failure + - [x86] staging: rts5208: Fix get_ms_information() heap buffer size + - gfs2: Don't call dlm after protocol is unmounted + - of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS + - [arm64] mmc: sdhci-of-arasan: Check return value of non-void funtions + - mmc: rtsx_pci: Fix long reads when clock is prescaled + - mmc: core: Return correct emmc response in case of ioctl error + - cifs: fix wrong release in sess_alloc_buffer() failed path + - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST + quirk set" + - [armhf] usb: musb: musb_dsps: request_irq() after initializing musb + - usbip: give back URBs for unsent unlink requests during cleanup + - usbip:vhci_hcd USB port can get stuck in the disabled state + - [arm64,armhf] ASoC: rockchip: i2s: Fix regmap_ops hang + - [arm64,armhf] ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B + - parport: remove non-zero check on count + - ath9k: fix OOB read ar9300_eeprom_restore_internal + - ath9k: fix sleeping in atomic context + - ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() + - [x86] scsi: BusLogic: Fix missing pr_cont() use + - scsi: qla2xxx: Sync queue idx with queue_pair_map idx + - [powerpc*] cpufreq: powernv: Fix init_chip_info initialization in numa=off + - mm/hugetlb: initialize hugetlb_usage in mm_init + - memcg: enable accounting for pids in nested pid namespaces + - [arm64,armhf] platform/chrome: cros_ec_proto: Send command again when + timeout occurs + - drm/amdgpu: Fix BUG_ON assert + - dm thin metadata: Fix use-after-free in dm_bm_set_read_only + - [x86] xen: reset legacy rtc flag for PV domU + - bnx2x: Fix enabling network interfaces without VFs + - [arm64] sve: Use correct size when reinitialising SVE state + - PM: base: power: don't try to use non-existing RTC for storing data + - PCI: Add AMD GPU multi-function power dependencies + - [x86] mm: Fix kern_addr_valid() to cope with existing but not present + entries + - tipc: fix an use-after-free issue in tipc_recvmsg + - dccp: don't duplicate ccid when cloning dccp sock (CVE-2020-16119) + - net/l2tp: Fix reference count leak in l2tp_udp_recv_core + - r6040: Restore MDIO clock frequency after MAC reset + - tipc: increase timeout in tipc_sk_enqueue() + - net/mlx5: Fix potential sleeping in atomic context + - events: Reuse value read using READ_ONCE instead of re-reading it + - net/af_unix: fix a data-race in unix_dgram_poll + - [arm64,armhf] net: dsa: destroy the phylink instance on any error in + dsa_slave_phy_setup + - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() + - qed: Handle management FW error + - [arm64] net: hns3: pad the short tunnel frame before sending to hardware + - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() + - [s390x] KVM: index kvm->arch.idle_mask by vcpu_idx + - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation + - [armhf] mfd: Don't use irq_create_mapping() to resolve a mapping + - PCI: Add ACS quirks for Cavium multi-function devices + - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 + - block, bfq: honor already-setup queue merges + - ethtool: Fix an error code in cxgb2.c + - mfd: axp20x: Update AXP288 volatile ranges + - PCI: Fix pci_dev_str_match_path() alloc while atomic bug + - [arm64] KVM: Handle PSCI resets before userspace touches vCPU state + - mtd: rawnand: cafe: Fix a resource leak in the error handling path of + 'cafe_nand_probe()' + - [armhf] net: dsa: b53: Fix calculating number of switch ports + - netfilter: socket: icmp6: fix use-after-scope + - fq_codel: reject silly quantum parameters + - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom + - ip_gre: validate csum_start only on pull + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.208 + - [s390x] bpf: Fix optimizing out zero-extensions + - KVM: remember position in kvm->vcpus array + - rcu: Fix missed wakeup of exp_wq waiters + - apparmor: remove duplicate macro list_entry_is_head() + - tracing/kprobe: Fix kprobe_on_func_entry() modification + - sctp: validate chunk size in __rcv_asconf_lookup (CVE-2021-3655) + - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY (CVE-2021-3655) + - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ + - [armhf] thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() + - 9p/trans_virtio: Remove sysfs file on probe failure + - prctl: allow to setup brk for et_dyn executables + - nilfs2: use refcount_dec_and_lock() to fix potential UAF + - profiling: fix shift-out-of-bounds bugs + - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() + - ceph: lockdep annotations for try_nonblocking_invalidate + - nilfs2: fix memory leak in nilfs_sysfs_create_device_group + - nilfs2: fix NULL pointer in nilfs_##name##_attr_release + - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group + - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group + - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group + - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group + - [arm64,armhf] pwm: rockchip: Don't modify HW state in .remove() callback + - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() + - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.195-rt82 + * [rt] Update to 4.19.196-rt83 + * Bump ABI to 18 + * [rt] Update to 4.19.197-rt84 + * Refresh "fs: Add MODULE_SOFTDEP declarations for hard-coded crypto drivers" + * [rt] Update to 4.19.198-rt85 + * Refresh "scsi: hisi_sas: Create separate host attributes per HBA" + * [rt] Update to 4.19.199-rt86 + * [rt] Update to 4.19.206-rt87 + * [rt] Update to 4.19.207-rt88 + * hso: fix bailout in error case of probe + * usb: hso: fix error handling code of hso_create_net_device (CVE-2021-37159) + * usb: hso: remove the bailout parameter + + -- Salvatore Bonaccorso <carnil@debian.org> Wed, 29 Sep 2021 20:53:57 +0200 + +linux (4.19.194-3) buster-security; urgency=high + + * [x86] KVM: SVM: Periodically schedule when unregistering regions on destroy + (CVE-2020-36311) + * can: bcm: fix infoleak in struct bcm_msg_head (CVE-2021-34693) + * can: bcm: delay release of struct bcm_op after synchronize_rcu() + (CVE-2021-3609) + * seq_file: Disallow extremely large seq buffer allocations (CVE-2021-33909) + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 18 Jul 2021 08:52:00 +0200 + +linux (4.19.194-2) buster; urgency=medium + + * proc: Track /proc/$pid/attr/ opener mm_struct (Closes: #990072) + + -- Salvatore Bonaccorso <carnil@debian.org> Mon, 21 Jun 2021 10:46:20 +0200 + +linux (4.19.194-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.182 + - [arm64] KVM: nvhe: Save the SPE context early + - [armhf] net: dsa: b53: Support setting learning on port + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.183 + - ALSA: hda: generic: Fix the micmute led init state + - Revert "PM: runtime: Update device status before letting suppliers + suspend" + - vmlinux.lds.h: Create section for protection against instrumentation + - btrfs: fix race when cloning extent buffer during rewind of an old root + (CVE-2021-28964) + - btrfs: fix slab cache flags for free space tree bitmap + - [armhf] ASoC: fsl_ssi: Fix TDM slot setup for I2S mode + - nvmet: don't check iosqes,iocqes for discovery controllers + - NFSD: Repair misuse of sv_lock in 5.10.16-rt30. + - svcrdma: disable timeouts on rdma backchannel + - sunrpc: fix refcount leak for rpc auth modules + - scsi: lpfc: Fix some error codes in debugfs + - nvme-rdma: fix possible hang when failing to set io queues + - [powerpc*] Force inlining of cpu_has_feature() to avoid build failure + - usb-storage: Add quirk to defeat Kindle's automatic unload + - usbip: Fix incorrect double assignment to udc->ud.tcp_rx + - USB: replace hardcode maximum usb string length by definition + - usb: gadget: configfs: Fix KASAN use-after-free + - [arm64] iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID + channel + - iio: hid-sensor-prox: Fix scale not correct issue + - [powerpc*] PCI: rpadlpar: Fix potential drc_name corruption in store + functions (CVE-2021-28972) + - [x86] perf/x86/intel: Fix a crash caused by zero PEBS status + (CVE-2021-28971) + - [x86] ioapic: Ignore IRQ2 again + - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() + - [x86] Move TS_COMPAT back to asm/thread_info.h + - [x86] Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall() + - ext4: find old entry again if failed to rename whiteout + - ext4: do not try to set xattr into ea_inode if value is empty + - ext4: fix potential error in ext4_do_update_inode + - genirq: Disable interrupts for force threaded handlers + - [x86] apic/of: Fix CPU devicetree-node lookups + - cifs: Fix preauth hash corruption + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.184 + - [armhf] net: fec: ptp: avoid register access when ipg clock is disabled + - [powerpc*] 4xx: Fix build errors from mfdcr() + - atm: eni: dont release is never initialized + - atm: lanai: dont run lanai_dev_close if not open + - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" + - ixgbe: Fix memleak in ixgbe_configure_clsu32 + - net: tehuti: fix error return code in bdx_probe() + - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count + - gianfar: fix jumbo packets+napi+rx overrun crash (CVE-2021-29264) + - gpiolib: acpi: Add missing IRQF_ONESHOT + - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default + - NFS: Correct size calculation for create reply length + - [arm64] net: hisilicon: hns: fix error return code of + hns_nic_clear_all_rx_fetch() + - [x86] atm: uPD98402: fix incorrect allocation + - atm: idt77252: fix null-ptr-dereference + - u64_stats,lockdep: Fix u64_stats_init() vs lockdep + - nfs: we don't support removing system.nfs4_acl + - block: Suppress uevent for hidden device when removed + - [arm64] netsec: restore phy power state after controller reset + - [x86] platform/x86: intel-vbtn: Stop reporting SW_DOCK events + - squashfs: fix inode lookup sanity checks + - squashfs: fix xattr id and id lookup sanity checks + - dm ioctl: fix out of bounds array access when no devices + (CVE-2021-31916) + - [armhf] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD + - veth: Store queue_mapping independently of XDP prog presence + - libbpf: Fix INSTALL flag order + - macvlan: macvlan_count_rx() needs to be aware of preemption + - [armhf] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port + - e1000e: add rtnl_lock() to e1000_reset_task + - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 + - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template + - netfilter: ctnetlink: fix dump of the expect mask attribute + - can: peak_usb: add forgotten supported devices + - [armhf] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing + bitrate + - mac80211: fix rate mask reset + - net: cdc-phonet: fix data-interface release on probe failure + - [arm64,armhf] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes + - [arm64] drm/msm: fix shutdown hook in case GPU components failed to bind + - net/mlx5e: Fix error path for ethtool set-priv-flag + - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening + server + - bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs + - Revert "netfilter: x_tables: Switch synchronization to RCU" + - netfilter: x_tables: Use correct memory barriers. (CVE-2021-29650) + - Revert "netfilter: x_tables: Update remaining dereference to RCU" + - ACPI: scan: Rearrange memory allocation in acpi_device_add() + - ACPI: scan: Use unique number for instance_no + - dm verity: add root hash pkcs#7 signature verification + - scsi: qedi: Fix error return code of qedi_alloc_global_queues() + - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() + - locking/mutex: Fix non debug version of mutex_lock_io_nested() + - can: dev: Move device back to init netns on owning netns delete + - net: sched: validate stab values + - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() (CVE-2021-29647) + - mac80211: fix double free in ibss_leave + - ext4: add reclaim checks to xattr code + - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" + - xen-blkback: don't leak persistent grants from xen_blkbk_map() + (CVE-2021-28688) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.185 + - selinux: vsock: Set SID for socket returned by accept() + - tcp: relookup sock for RST+ACK packets handled by obsolete req sock + - ipv6: weaken the v4mapped source check + - ext4: fix bh ref count on error paths + - rpc: fix NULL dereference on kmalloc failure + - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 + - [x86] ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor + of 10 + - [armhf] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value + on probe + - [x86] ASoC: es8316: Simplify adc_pga_gain_tlv table + - vhost: Fix vhost_vq_reset() + - scsi: st: Fix a use after free in st_open() + - scsi: qla2xxx: Fix broken #endif placement + - [x86] staging: comedi: cb_pcidas: fix request_irq() warn + - [x86] staging: comedi: cb_pcidas64: fix request_irq() warn + - thermal/core: Add NULL pointer check before using cooling device stats + - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling + - ext4: do not iput inode under running transaction in ext4_rename() + - brcmfmac: clear EAP/association status bits on linkdown events + - ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr() + - [amd64] net: ethernet: aquantia: Handle error cleanup of start on open + - appletalk: Fix skb allocation size in loopback case + - [x86] net: wan/lmc: unregister device when no matching device is found + - bpf: Remove MTU check in __bpf_skb_max_len + - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect + - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO + - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook + - PM: runtime: Fix race getting/putting suppliers at probe + - PM: runtime: Fix ordering in pm_runtime_get_suppliers() + - tracing: Fix stack trace event size + - mm: fix race by making init_zero_pfn() early_initcall + - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings() + - drm/amdgpu: check alignment on CPU page for bo map + - reiserfs: update reiserfs_xattrs_initialized() condition + - [arm64,armhf] pinctrl: rockchip: fix restore error in resume + - extcon: Add stubs for extcon_register_notifier_all() functions + - extcon: Fix error handling in extcon_dev_register + - firewire: nosy: Fix a use-after-free bug in nosy_ioctl() (CVE-2021-3483) + - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control() + - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem + - [arm64,armhf] usb: musb: Fix suspend with devices connected for a64 + - cdc-acm: fix BREAK rx code path adding necessary calls + - USB: cdc-acm: untangle a circular dependency between callback and softint + - USB: cdc-acm: downgrade message to debug + - USB: cdc-acm: fix double free on probe failure + - USB: cdc-acm: fix use-after-free after probe failure + - [i386] usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference + - [arm*] usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board. + - [x86] staging: rtl8192e: Fix incorrect source in memcpy() + - staging: rtl8192e: Change state information from u16 to u8 + - drivers: video: fbcon: fix NULL dereference in fbcon_cursor() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.186 + - [armhf] bus: ti-sysc: Fix warning on unbind if reset is not deasserted + - [x86] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2 + - mISDN: fix crash in fritzpci + - mac80211: choose first enabled channel for monitor + - [arm64] drm/msm: Ratelimit invalid-fence message + - [x86] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state + - scsi: target: pscsi: Clean up after failure in pscsi_map_sg() + - cifs: revalidate mapping when we open files for SMB1 POSIX + - cifs: Silently ignore unknown oplock break handle + - [amd64] bpf, x86: Validate computation of branch displacements for x86-64 + (CVE-2021-29154) + - [i386] bpf, x86: Validate computation of branch displacements for x86-32 + (CVE-2021-29154) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.187 + - ALSA: aloop: Fix initialization of controls + - [x86] ASoC: intel: atom: Stop advertising non working S24LE support + - nfc: fix refcount leak in llcp_sock_bind() (CVE-2020-25670) + - nfc: fix refcount leak in llcp_sock_connect() (CVE-2020-25671) + - nfc: fix memory leak in llcp_sock_connect() (CVE-2020-25672) + - nfc: Avoid endless loops caused by repeated llcp_sock_connect() + - xen/evtchn: Change irq_info lock to raw_spinlock_t + - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh + - ocfs2: fix deadlock between setattr and dio_end_io_write + - fs: direct-io: fix missing sdio->boundary + - [armhf] dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin + - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field + - ice: Increase control queue timeout + - net: hso: fix null-ptr-deref during tty device unregistration + - net: ensure mac header is set in virtio_net_hdr_to_skb() + - net: sched: sch_teql: fix null-pointer dereference + - net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() + - usbip: add sysfs_lock to synchronize sysfs code paths + - usbip: stub-dev synchronize sysfs code paths + - usbip: vudc synchronize sysfs code paths + - usbip: synchronize event handler with sysfs code paths + - i2c: turn recovery error on init to debug + - virtio_net: Add XDP meta data support + - xfrm: interface: fix ipv4 pmtu check to honor ip header df + - net: xfrm: Localize sequence counter per network namespace + - i40e: Added Asym_Pause to supported link modes + - i40e: Fix kernel oops when i40e driver removes VF's + - sch_red: fix off-by-one checks in red_check_params() + - cxgb4: avoid collecting SGE_QBASE regs during traffic + - net:tipc: Fix a double free in tipc_sk_mcast_rcv + - [armhf] ASoC: sunxi: sun4i-codec: fill ASoC card owner + - clk: fix invalid usage of list cursor in register + - clk: fix invalid usage of list cursor in unregister + - workqueue: Move the position of debug_work_activate() in __queue_work() + - [s390x] cpcmd: fix inline assembly register clobbering + - net/mlx5: Fix placement of log_max_flow_counter + - net/mlx5: Fix PBMC register mapping + - RDMA/cxgb4: check for ipv6 address properly while destroying listener + - [armhf] clk: socfpga: fix iomem pointer cast on 64-bit + - net: sched: bump refcount for new action in ACT replace mode + - cfg80211: remove WARN_ON() in cfg80211_sme_connect + - net: tun: set tun->dev->addr_len during TUNSETLINK processing + - drivers: net: fix memory leak in atusb_probe + - drivers: net: fix memory leak in peak_usb_create_dev + - net: mac802154: Fix general protection fault + - net: ieee802154: nl-mac: fix check on panid + - net: ieee802154: fix nl802154 del llsec key + - net: ieee802154: fix nl802154 del llsec dev + - net: ieee802154: fix nl802154 add llsec key + - net: ieee802154: fix nl802154 del llsec devkey + - net: ieee802154: forbid monitor for set llsec params + - net: ieee802154: forbid monitor for del llsec seclevel + - net: ieee802154: stop dump llsec params for monitors + - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting + cifs_sb->prepath." (Closes: #988352) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.188 + - [arm64] KVM: Hide system instruction access to Trace registers + - [arm64] KVM: Disable guest access to trace filter controls + - [armhf] drm/imx: imx-ldb: fix out of bounds array access warning + - gfs2: report "already frozen/thawed" errors + - [arm64,armhf] drm/tegra: dc: Don't set PLL clock to 0Hz + - block: only update parent bi_status when bio fail + - net: phy: broadcom: Only advertise EEE for supported modes + - staging: m57621-mmc: delete driver from the tree. (Closes: #986949) + - netfilter: x_tables: fix compat match/target pad out-of-bound write + - driver core: Fix locking bug in deferred_probe_timeout_work_func() + - xen/events: fix setting irq affinity + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.189 + - net/sctp: fix race condition in sctp_destroy_sock + - gpio: sysfs: Obey valid_mask + - neighbour: Disregard DEAD dst in neigh_update + - [arm64] drm/msm: Fix a5xx/a6xx timestamps + - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state + - net: ieee802154: stop dump llsec keys for monitors + - net: ieee802154: stop dump llsec devs for monitors + - net: ieee802154: forbid monitor for add llsec dev + - net: ieee802154: stop dump llsec devkeys for monitors + - net: ieee802154: forbid monitor for add llsec devkey + - net: ieee802154: stop dump llsec seclevels for monitors + - net: ieee802154: forbid monitor for add llsec seclevel + - pcnet32: Use pci_resource_len to validate PCI resource + - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN + - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices + - readdir: make sure to verify directory entry for legacy interfaces too + - [arm64] fix inline asm in load_unaligned_zeropad() + - [arm64] alternatives: Move length validation in alternative_{insn, endif} + - scsi: libsas: Reset num_scatter if libata marks qc as NODATA + - netfilter: conntrack: do not print icmpv6 as unknown via /proc + - netfilter: nft_limit: avoid possible divide error in nft_limit_init + - net: sit: Unregister catch-all devices + - net: ip6_tunnel: Unregister catch-all devices + - i40e: fix the panic when running bpf in xdpdrv mode + - [armel,armhf] 9071/1: uprobes: Don't hook on thumb instructions + - net: phy: marvell: fix detection of PHY on Topaz switches + - gup: document and work around "COW can break either way" issue + (CVE-2020-29374) + - [x86] pinctrl: lewisburg: Update number of pins in community + - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() + - [x86] perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 + - HID: alps: fix error return code in alps_input_configured() + - HID: wacom: Assign boolean values to a bool variable + - net: geneve: check skb is large enough for IPv4/IPv6 header + - [s390x] entry: save the caller of psw_idle + - xen-netback: Check for hotplug-status existence before watching + - [x86] crash: Fix crash_setup_memmap_entries() out-of-bounds access + - net: hso: fix NULL-deref on disconnect regression + - USB: CDC-ACM: fix poison/unpoison imbalance + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.190 + - [x86] ACPI: tables: x86: Reserve memory occupied by ACPI tables + - [x86] ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade() + - net: usb: ax88179_178a: initialize local variables before use + - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() + - [mips*] Do not include hi and lo in clobber list for R6 + - bpf: Fix masking negation logic upon negative dst register + (CVE-2021-31829) + - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd() + - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX + - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet + - USB: Add reset-resume quirk for WD19's Realtek Hub + - [x86] platform/x86: thinkpad_acpi: Correct thermal sensor allocation + - ovl: allow upperdir inside lowerdir + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.191 + - [s390x] disassembler: increase ebpf disasm buffer size + - ftrace: Handle commands when closing set_ftrace_filter file + - ecryptfs: fix kernel panic with null dev_name + - [armhf] spi: spi-ti-qspi: Free DMA resources + - scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() + - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based + controllers + - mmc: block: Update ext_csd.cache_ctrl if it was written + - mmc: block: Issue a cache flush only when it's enabled + - mmc: core: Do a power cycle when the CMD11 fails + - mmc: core: Set read only for SD cards with permanent write protect bit + - cifs: Return correct error code from smb2_get_enc_key + - btrfs: fix metadata extent leak after failure to create subvolume + - [x86] intel_th: pci: Add Rocket Lake CPU support + - fbdev: zero-fill colormap in fbcmap.c + - staging: wimax/i2400m: fix byte-order issue + - crypto: api - check for ERR pointers in crypto_destroy_tfm() + - usb: gadget: uvc: add bInterval checking for HS mode + - [x86] genirq/matrix: Prevent allocation counter corruption + - usb: gadget: f_uac1: validate input parameters + - [arm64,armhf] usb: dwc3: gadget: Ignore EP queue requests during bus reset + - usb: xhci: Fix port minor revision + - PCI: PM: Do not read power state in pci_enable_device_flags() + - [arm64] tee: optee: do not check memref size on return from Secure World + - [arm*] perf/arm_pmu_platform: Fix error handling + - xhci: check control context is valid before dereferencing it. + - xhci: fix potential array out of bounds with several interrupters + - [x86] intel_th: Consistency and off-by-one fix + - [armhf] phy: phy-twl4030-usb: Fix possible use-after-free in + twl4030_usb_remove() + - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s + - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe + - scsi: lpfc: Fix pt2pt connection does not recover after LOGO + - scsi: target: pscsi: Fix warning in pscsi_complete_cmd() + - [x86] media: ite-cir: check for receive overflow + - power: supply: bq27xxx: fix power_avg for newer ICs + - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs + - media: gspca/sq905.c: fix uninitialized variable + - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f + - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() + - scsi: qla2xxx: Fix use after free in bsg + - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() + - media: em28xx: fix memory leak + - media: vivid: update EDID + - [armhf] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error + return + - media: dvb-usb: fix memory leak in dvb_usb_adapter_init + - media: gscpa/stv06xx: fix memory leak + - [arm64] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal + - drm/amdgpu: fix NULL pointer dereference + - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO + response + - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic + - scsi: libfc: Fix a format specifier + - [s390x] archrandom: add parameter check for s390_arch_random_generate + - [i386] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer + - ALSA: hda/conexant: Re-order CX5066 quirk table entries + - [i386] ALSA: sb: Fix two use after free in snd_sb_qsound_build + - ALSA: usb-audio: Explicitly set up the clock selector + - ALSA: usb-audio: More constifications + - ALSA: usb-audio: Add dB range mapping for Sennheiser Communications + Headset PC 8 + - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx + - btrfs: fix race when picking most recent mod log operation for an old root + - [arm64] vdso: Discard .note.gnu.property sections in vDSO + - ubifs: Only check replay with inode type to judge if inode linked + - f2fs: fix to avoid out-of-bounds memory access (CVE-2021-3506) + - openvswitch: fix stack OOB read while fragmenting IPv4 packets + - [arm64] ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe + failure + - NFS: Don't discard pNFS layout segments that are marked for return + - NFSv4: Don't discard segments marked for return in _pnfs_return_layout() + - jffs2: Fix kasan slab-out-of-bounds problem + - [powerpc*] eeh: Fix EEH handling for hugepages in ioremap space. + - [x86] intel_th: pci: Add Alder Lake-M support + - [arm64,x86] tpm: vtpm_proxy: Avoid reading host log when using a virtual + device + - md/raid1: properly indicate failure when ending a failed write request + - dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload + sequences + - security: commoncap: fix -Wstringop-overread warning + - jffs2: check the validity of dstlen in jffs2_zlib_compress() + - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT + op") + - posix-timers: Preserve return value in clock_adjtime32() + - [arm64] vdso: remove commas between macro name and arguments + - ext4: fix check to prevent false positive report of incorrect used inodes + - ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() + - ext4: fix error code in ext4_commit_super + - media: dvbdev: Fix memory leak in dvb_media_device_free() + - usb: gadget: Fix double free of device descriptor pointers + - usb: gadget/function/f_fs string table fix for multiple languages + - [arm64,armhf] usb: dwc3: gadget: Fix START_TRANSFER link state check + - [arm*] usb: dwc2: Fix session request interrupt handler + - tty: fix memory leak in vc_deallocate + - tracing: Map all PIDs to command lines + - tracing: Restructure trace_clock_global() to never block + - dm space map common: fix division bug in sm_ll_find_free_block() + - dm rq: fix double free of blk_mq_tag_set in dev remove after table load + fails + - modules: mark ref_module static + - modules: mark find_symbol static + - modules: mark each_symbol_section static + - modules: unexport __module_text_address + - modules: unexport __module_address + - modules: rename the licence field in struct symsearch to license + - modules: return licensing information from find_symbol + - modules: inherit TAINT_PROPRIETARY_MODULE + - Bluetooth: verify AMP hci_chan before amp_destroy (CVE-2021-33034) + - bluetooth: eliminate the potential race condition when removing the HCI + controller (CVE-2021-32399) + - net/nfc: fix use-after-free llcp_sock_bind/connect (CVE-2021-23134) + - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR + - misc: lis3lv02d: Fix false-positive WARN on various HP models + - [x86] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct + - [x86] misc: vmw_vmci: explicitly initialize vmci_datagram payload + - md/bitmap: wait for external bitmap writes to complete during tear down + - md-cluster: fix use-after-free issue when removing rdev + - md: split mddev_find + - md: factor out a mddev_find_locked helper from mddev_find + - md: md_open returns -EBUSY when entering racing area + - md: Fix missing unused status line of /proc/mdstat + - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() + - cfg80211: scan: drop entry from hidden_list on overflow + - drm/radeon: fix copy of uninitialized variable back to userspace + - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries + - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries + - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries + - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries + - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries + - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries + - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries + - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices + - [x86] cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported + - [s390x] KVM: split kvm_s390_logical_to_effective + - [s390x] KVM: fix guarded storage control register handling + - [s390x] KVM: split kvm_s390_real_to_abs + - ovl: fix missing revert_creds() on error path + - [x86] usb: gadget: pch_udc: Revert d3cb25a12138 completely + - [armhf] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] + - [armhf] dts: exynos: correct PMIC interrupt trigger level on SMDK5250 + - regmap: set debugfs_name to NULL after it is freed + - mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() + - [x86] microcode: Check for offline CPUs before requesting new microcode + - [x86] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() + - [x86] usb: gadget: pch_udc: Check if driver is present before calling + ->setup() + - [x86] usb: gadget: pch_udc: Check for DMA mapping error + - [x86] crypto: qat - don't release uninitialized resources + - [x86] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init + - mtd: require write permissions for locking and badblock ioctls + - [arm64] bus: qcom: Put child node before return + - [x86] crypto: qat - fix error path in adf_isr_resource_alloc() + - [armhf] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init + - [arm64,armhf] irqchip/gic-v3: Fix OF_BAD_ADDR error handling + - [x86] staging: rtl8192u: Fix potential infinite loop + - spi: Fix use-after-free with devm_spi_alloc_* + - [arm64] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz + - [arm64] soc: qcom: mdt_loader: Detect truncated read of segments + - [amd64,arm64] ACPI: CPPC: Replace cppc_attr with kobj_attribute + - [x86] crypto: qat - Fix a double free in adf_create_ring + - [arm64] cpufreq: armada-37xx: Fix setting TBG parent for load levels + - [arm64] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU + PM clock + - [arm64] cpufreq: armada-37xx: Fix the AVS value for load L1 + - [arm64] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 + Mhz to 1 GHz + - [arm64] clk: mvebu: armada-37xx-periph: Fix workaround for switching from + L1 to L0 + - [arm64] cpufreq: armada-37xx: Fix driver cleanup when registration failed + - [arm64] cpufreq: armada-37xx: Fix determining base CPU frequency + - USB: cdc-acm: fix unprivileged TIOCCSERIAL + - tty: actually undefine superseded ASYNC flags + - tty: fix return value for unsupported ioctls + - usbip: vudc: fix missing unlock on error in usbip_sockfd_store() + - [x86] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail + boards with critclk_systems DMI table + - [x86] Drivers: hv: vmbus: Increase wait time for VMbus unload + - [arm*] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. + - [arm*] usb: dwc2: Fix hibernation between host and device modes. + - ttyprintk: Add TTY hangup callback. + - media: vivid: fix assignment of dev->fbuf_out_flags + - media: m88rs6000t: avoid potential out-of-bounds reads on arrays + - [x86] kprobes: Fix to check non boostable prefixes correctly + - sata_mv: add IRQ checks + - ata: libahci_platform: fix IRQ check + - nvme: retrigger ANA log update if group descriptor isn't found + - [arm64] clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE + - [powerpc*] scsi: ibmvfc: Fix invalid state machine BUG_ON() + - [armhf] HSI: core: fix resource leaks in hsi_add_client_from_dt() + - [amd64] x86/events/amd/iommu: Fix sysfs type mismatch + - sched/debug: Fix cgroup_path[] serialization + - drivers/block/null_blk/main: Fix a double free in null_init. + - HID: plantronics: Workaround for double volume key presses + - [powerpc*] prom: Mark identical_pvr_fixup as __init + - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect + - bug: Remove redundant condition check in report_bug + - nfc: pn533: prevent potential memory corruption + - [arm64] net: hns3: Limiting the scope of vector_ring_chain variable + - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls + - [powerpc*] 64s: Fix pte update for kernel memory on radix + - [powerpc*] perf: Fix PMU constraint check for EBB events + - mac80211: bail out if cipher schemes are invalid + - mt7601u: fix always true expression + - [amd64] IB/hfi1: Fix error return code in parse_platform_config() + - [arm64] net: thunderx: Fix unintentional sign extension issue + - RDMA/srpt: Fix error return code in srpt_cm_req_recv() + - [mips*] pci-legacy: stop using of_pci_range_to_resource + - [powerpc*] pseries: extract host bridge from pci_bus prior to bus removal + - rtlwifi: 8821ae: upgrade PHY and RF parameters + - mwl8k: Fix a double Free in mwl8k_probe_hw + - [x86] vsock/vmci: log once the failed queue pair allocation + - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails + - ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails + - [armhf] net: davinci_emac: Fix incorrect masking of tx and rx error + channel + - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices + - ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock + - bnxt_en: fix ternary sign extension bug in bnxt_show_temp() + - net: geneve: modify IP header check in geneve6_xmit_skb and + geneve_xmit_skb + - [arm64] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send + - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req + - mm/sparse: add the missing sparse_buffer_fini() in error branch + - mm/memory-failure: unnecessary amount of unmapping + - net: Only allow init netns to set default tcp cong to a restricted algo + - smp: Fix smp_call_function_single_async prototype + - Revert "net/sctp: fix race condition in sctp_destroy_sock" + - sctp: delay auto_asconf init until binding the first addr (CVE-2021-23133) + - Revert "of/fdt: Make sure no-map does not remove already reserved regions" + - Revert "fdt: Properly handle "no-map" field in the memory region" + - [arm64,x86] tpm: fix error return code in tpm2_get_cc_attrs_tbl() + - fs: dlm: fix debugfs dump + - tipc: convert dest node's address to network order + - [x86] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus + T100TAF + - [arm64] net: stmmac: Set FIFO sizes for ipq806x + - i2c: bail out early when RDWR parameters are wrong + - ALSA: hdsp: don't disable if not enabled + - ALSA: hdspm: don't disable if not enabled + - ALSA: rme9652: don't disable if not enabled + - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default + - Bluetooth: initialize skb_queue_head at l2cap_chan_create() + - net: bridge: when suppression is enabled exclude RARP packets + - Bluetooth: check for zapped sk before connecting + - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet + - i2c: Add I2C_AQ_NO_REP_START adapter quirk + - mac80211: clear the beacon's CRC after channel switch + - [armhf] pinctrl: samsung: use 'int' for register masks in Exynos + - cuse: prevent clone + - sctp: Fix out-of-bounds warning in sctp_process_asconf_param() + - [powerpc*] smp: Set numa node before updating mask + - [x86] ASoC: rt286: Generalize support for ALC3263 codec + - ethtool: ioctl: Fix out-of-bounds warning in + store_link_ksettings_for_user() + - [powerpc*] pseries: Stop calling printk in rtas_stop_self() + - [x86] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt + - [x86] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join + - [powerpc*] iommu: Annotate nested lock for lockdep + - [x86] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable + - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs + - PCI: Release OF node in pci_scan_device()'s error path + - [armel,armhf] 9064/1: hw_breakpoint: Do not directly check the event's + overflow_handler hook + - [arm64] rpmsg: qcom_glink_native: fix error return code of + qcom_glink_rx_data() + - NFSv4.2: Always flush out writes in nfs42_proc_fallocate() + - NFS: Deal correctly with attribute generation counter overflow + - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() + - NFSv4.2 fix handling of sr_eof in SEEK's reply + - rtc: ds1307: Fix wday settings for rx8130 + - [arm64] net: hns3: disable phy loopback setting in hclge_mac_start_phy + - sctp: do asoc update earlier in sctp_sf_do_dupcook_a + - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit + - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b + - netfilter: xt_SECMARK: add new revision to fix structure layout + - drm/radeon: Fix off-by-one power_state index heap overwrite + - drm/radeon: Avoid power table parsing memory leaks + - khugepaged: fix wrong result value for + trace_mm_collapse_huge_page_isolate() + - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() + - ksm: fix potential missing rmap_item for stable_node + - net: fix nla_strcmp to handle more then one trailing null character + - smc: disallow TCP_ULP in smc_setsockopt() + - netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check + - sched/fair: Fix unfairness caused by missing load decay + - [amd64] kernel: kexec_file: fix error return code of + kexec_calculate_store_digests() + - netfilter: nftables: avoid overflows in nft_hash_buckets() + - i40e: Fix use-after-free in i40e_client_subtask() + - [powerpc*] 64s: Fix crashes when toggling stf barrier + - [powerpc*] 64s: Fix crashes when toggling entry flush barrier + - hfsplus: prevent corruption in shrinking truncate + - squashfs: fix divide error in calculate_skip() + - userfaultfd: release page in error path to avoid BUG_ON + - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors + are connected + - [arm64,x86] ACPI: scan: Fix a memory leak in an error handling path + - blk-mq: Swap two calls in blk_mq_exit_queue() + - [armhf] usb: dwc3: omap: improve extcon initialization + - [arm64] usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel + Merrifield + - [arm*] usb: dwc2: Fix gadget DMA unmap direction + - usb: core: hub: fix race condition about TRSMRCY of resume + - [arm64,armhf] usb: dwc3: gadget: Return success always for kick transfer + in ep queue + - xhci: Do not use GFP_KERNEL in (potentially) atomic context + - xhci: Add reset resume quirk for AMD xhci controller. + - [x86] iio: tsl2583: Fix division by a zero lux_val + - cdc-wdm: untangle a circular dependency between callback and softint + - [x86] KVM: Cancel pvclock_gtod_work on module removal + - thermal/core/fair share: Lock the thermal zone while looping over + instances + - kobject_uevent: remove warning in init_uevent_argv() + - netfilter: conntrack: Make global sysctls readonly in non-init netns + - nvme: do not try to reconfigure APST when the controller is not live + - [x86] msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes + - usb: sl811-hcd: improve misleading indentation + - cxgb4: Fix the -Wmisleading-indentation warning + - isdn: capi: fix mismatched prototypes + - [arm64] PCI: thunder: Fix compile testing + - [armel,armhf] 9066/1: ftrace: pause/unpause function graph tracer in + cpu_suspend() + - [arm64,x86] ACPI / hotplug / PCI: Fix reference count leak in + enable_slot() + - [arm64] Input: elants_i2c - do not bind to i2c-hid compatible ACPI + instantiated devices + - [armel,armhf] 9075/1: kernel: Fix interrupted SMC calls + - ceph: fix fscache invalidation + - scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not + found + - [arm64,x86] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 + Pro 5055 + - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP + - block: reexpand iov_iter after read/write + - [arm64,armhf] net: stmmac: Do not enable RX FIFO overflow interrupts + - ip6_gre: proper dev_{hold|put} in ndo_[un]init methods + - sit: proper dev_{hold|put} in ndo_[un]init methods + - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods + - ipv6: remove extra dev_hold() for fallback tunnels + - iomap: fix sub-page uptodate handling + - [arm64] KVM: Initialize VCPU mdcr_el2 before loading it + - tweewide: Fix most Shebang lines + - scripts: switch explicitly to Python 3 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.192 + - RDMA/rxe: Clear all QP fields if creation failed + - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() + - RDMA/mlx5: Recover from fatal event in dual port mode + - [x86] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios + - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly + - nvmet: seset ns->file when open fails + - locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal + - cifs: fix memory leak in smb2_copychunk_range + - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high + sampling transfer frequency + - ALSA: line6: Fix racy initialization of LINE6 MIDI + - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 + - ALSA: usb-audio: Validate MS endpoint descriptors + - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro + - [i386] Revert "ALSA: sb8: add a check for request_region" + - ALSA: hda/realtek: reset eapd coeff to default value for alc287 + - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 + - [arm64] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer + dereference" + - [x86] xen-pciback: reconfigure also from backend watch handler + - dm snapshot: fix crash with transient storage and zero chunk size + - [x86] Revert "video: hgafb: fix potential NULL pointer dereference" + - [arm64,armhf] Revert "net: stmicro: fix a missing check of clk_prepare" + - [armhf] Revert "leds: lp5523: fix a missing check of return value of + lp55xx_read" + - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" + - Revert "ecryptfs: replace BUG_ON with error handling code" + - Revert "rtlwifi: fix a potential NULL pointer dereference" + - Revert "qlcnic: Avoid potential NULL pointer dereference" + - Revert "niu: fix missing checks of niu_pci_eeprom_read" + - ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() + - [arm64,armhf] net: stmicro: handle clk_prepare() failure during init + - net: rtlwifi: properly check for alloc_workqueue() failure + - [armhf] leds: lp5523: check return value of lp5xx_read and jump to cleanup + code + - qlcnic: Add null check after calling netdev_alloc_skb + - [x86] video: hgafb: fix potential NULL pointer dereference + - vgacon: Record video mode changes with VT_RESIZEX + - vt: Fix character height handling with VT_RESIZEX + - tty: vt: always invoke vc->vc_sw->con_resize callback + - [x86] video: hgafb: correctly handle card detect failure during probe + - Bluetooth: SMP: Fail if remote and local public keys are identical + (CVE-2020-26558, CVE-2021-0129) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.193 + - mm, vmstat: drop zone->lock in /proc/pagetypeinfo + - [arm64,armhf] usb: dwc3: gadget: Enable suspend events + - NFC: nci: fix memory leak in nci_allocate_device + - cifs: set server->cipher_type to AES-128-CCM for SMB3.0 + - NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() + - [amd64] iommu/vt-d: Fix sysfs leak in alloc_iommu() + - proc: Check /proc/$pid/attr/ writes against file opener + - net: hso: fix control-request directions + - mac80211: assure all fragments are encrypted (CVE-2020-26147) + - mac80211: prevent mixed key and fragment cache attacks (CVE-2020-24586, + CVE-2020-24587) + - mac80211: properly handle A-MSDUs that start with an RFC 1042 header + - cfg80211: mitigate A-MSDU aggregation attacks (CVE-2020-24588) + - mac80211: drop A-MSDUs on old ciphers (CVE-2020-24588) + - mac80211: add fragment cache to sta_info + - mac80211: check defrag PN against current frame + - mac80211: prevent attacks on TKIP/WEP as well + - mac80211: do not accept/forward invalid EAPOL frames (CVE-2020-26139) + - mac80211: extend protection against mixed key and fragment cache attacks + (CVE-2020-24586, CVE-2020-24587) + - ath10k: Validate first subframe of A-MSDU before processing the list + - dm snapshot: properly fix a crash when an origin has no snapshots + - misc/uss720: fix memory leak in uss720_probe + - [x86] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue + - [x86] mei: request autosuspend after sending rx flow control + - USB: trancevibrator: fix control-request direction + - USB: usbfs: Don't WARN about excessively large memory allocations + - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' + - USB: serial: ti_usb_3410_5052: add startech.com device id + - USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 + - USB: serial: ftdi_sio: add IDs for IDS GmbH Products + - USB: serial: pl2303: add device id for ADLINK ND-6530 GC + - [arm64,armhf] usb: dwc3: gadget: Properly track pending and queued SG + - net: usb: fix memory leak in smsc75xx_bind + - bpf: extend is_branch_taken to registers + - bpf: Test_verifier, bpf_get_stack return value add <0 + - bpf, test_verifier: switch bpf_get_stack's 0 s> r8 test + - bpf: Move off_reg into sanitize_ptr_alu (CVE-2021-29155) + - bpf: Ensure off_reg has no mixed signed bounds for all types + (CVE-2021-29155) + - bpf: Rework ptr_limit into alu_limit and add common error path + (CVE-2021-29155) + - bpf: Improve verifier error messages for users (CVE-2021-29155) + - bpf: Refactor and streamline bounds check into helper (CVE-2021-29155) + - bpf: Move sanitize_val_alu out of op switch (CVE-2021-29155) + - bpf: Tighten speculative pointer arithmetic mask (CVE-2021-29155) + - bpf: Update selftests to reflect new error states + - bpf: Fix leakage of uninitialized bpf stack under speculation + (CVE-2021-31829) + - bpf: Wrap aux data inside bpf_sanitize_info container + - bpf: Fix mask direction swap upon off reg sign change + - bpf: No need to simulate speculative domain for immediates + - [armhf] spi: gpio: Don't leak SPI master in probe error path + - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails + - NFS: fix an incorrect limit in filelayout_decode_layout() + - NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() + - NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config + - [arm64] drm/meson: fix shutdown crash when component not probed + - net/mlx4: Fix EEPROM dump support + - Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" + - tipc: skb_linearize the head skb when reassembling msgs + - [arm64,armhf] net: dsa: fix a crash if ->get_sset_count() fails + - [armhf] i2c: s3c2410: fix possible NULL pointer deref on read message + after write + - [x86] i2c: i801: Don't generate an interrupt on bus reset + - [x86] platform/x86: hp_accel: Avoid invoking _INI to speed up resume + - [x86] net: fujitsu: fix potential null-ptr-deref + - [x86] char: hpet: add checks after calling ioremap + - isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io + - [arm64] dmaengine: qcom_hidma: comment platform_driver_register call + - libertas: register sysfs groups properly + - media: dvb: Add check on sp8870_readreg return + - media: gspca: properly check for errors in po1030_probe() + - [x86] scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic + - btrfs: do not BUG_ON in link_to_fixup_dir + - [x86] platform/x86: hp-wireless: add AMD's hardware id to the supported + list + - SMB3: incorrect file id in requests compounded with open + - drm/amd/amdgpu: fix refcount leak + - drm/amdgpu: Fix a use-after-free + - [arm64,armhf] net: dsa: fix error code getting shifted with 4 in + dsa_slave_get_sset_count + - [armhf] net: fec: fix the potential memory leak in fec_enet_init() + - [arm64] net: mdio: thunder: Fix a double free issue in the .remove + function + - [mips*] net: mdio: octeon: Fix some double free issues + - openvswitch: meter: fix race when getting now_ms. + - net: bnx2: Fix error return code in bnx2_init_board() + - mld: fix panic in mld_newpack() + - bpf: Set mac_len in bpf_skb_change_head + - ixgbe: fix large MTU request from VF + - scsi: libsas: Use _safe() loop in sas_resume_port() + - ipv6: record frag_max_size in atomic fragments in input path + - sch_dsmark: fix a NULL deref in qdisc_reset() + - hugetlbfs: hugetlb_fault_mutex_hash() cleanup + - drivers/net/ethernet: clean up unused assignments + - [arm64] net: hns3: check the return of skb_checksum_help() + - usb: core: reduce power-on-good delay time of root hub + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.194 + - net: usb: cdc_ncm: don't spew notifications (Closes: #989451) + - ALSA: usb: update old-style static const declaration + - nl80211: validate key indexes for cfg80211_registered_device + - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared + - [arm64,x86] efi: cper: fix snprintf() use in cper_dimm_err_location() + - vfio/pci: Fix error return code in vfio_ecap_init() + - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service + - HID: pidff: fix error return code in hid_pidff_init() + - [arm64,x86] HID: i2c-hid: fix format string mismatch + - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches + - ieee802154: fix error return code in ieee802154_add_iface() + - ieee802154: fix error return code in ieee802154_llsec_getparams() + - ixgbevf: add correct exception tracing for XDP + - tipc: add extack messages for bearer/media failure + - tipc: fix unique bearer names sanity check + - Bluetooth: fix the erroneous flush_work() order (CVE-2021-3564) + - Bluetooth: use correct lock to prevent UAF of hdev object (CVE-2021-3573) + - HID: multitouch: require Finger field to mark Win8 reports as MT + - ALSA: timer: Fix master timer notification + - ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx + - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed + - [arm*] usb: dwc2: Fix build in periphal-only mode + - pid: take a reference when initializing `cad_pid` + - ocfs2: fix data corruption by fallocate + - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect + (CVE-2021-3587) + - [x86] apic: Mark _all_ legacy interrupts when IO/APIC is missing + - btrfs: mark ordered extent and inode with error if we fail to finish + - btrfs: fix error handling in btrfs_del_csums + - btrfs: return errors from btrfs_del_csums in cleanup_ref_head + - btrfs: fixup error handling in fixup_inode_link_counts + - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY + - bpf: Add BPF_F_ANY_ALIGNMENT. + - bnxt_en: Remove the setting of dev_port. + - perf/cgroups: Don't rotate events for cgroups unnecessarily + - perf/core: Fix corner case in perf_rotate_context() + - btrfs: fix unmountable seed device after fstrim + - [x86] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode + - [arm64] KVM: Fix debug register indexing + - [arm64,x86] ACPI: probe ECDT before loading AML tables regardless of + module-level code flag + - [arm64,x86] ACPI: EC: Look for ECDT EC after calling acpi_load_tables() + - sched/fair: Optimize select_idle_cpu + - [x86] xen-pciback: redo VF placement in the virtual topology + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.182-rt74 + * [rt] Add new signing key for Clark Williams + * [rt] Update to 4.19.184-rt75 + * Bump ABI to 17 + * [rt] Refresh "workqueue: Use normal rcu" + * [rt] Refresh "workqueue: Use local irq lock instead of irq disable" + * [rt] Refresh "workqueue: rework" + * [rt] Update to 4.19.188-rt77 + * [rt] Update to 4.19.190-rt79 + * [rt] Refresh "ptrace: fix ptrace vs tasklist_lock race" + * [rt] Update to 4.19.193-rt81 + * [rt] Refresh "kernel: sched: Provide a pointer to the valid CPU mask" + + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 10 Jun 2021 20:49:34 +0200 + +linux (4.19.181-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.178 + - HID: make arrays usage and value to be the same + - USB: quirks: sort quirk entries + - usb: quirks: add quirk to start video capture on ELMO L-12F document + camera reliable + - block: add helper for checking if queue is registered + - block: split .sysfs_lock into two locks + - block: fix race between switching elevator and removing queues + - block: don't release queue's sysfs lock during switching elevator + - NET: usb: qmi_wwan: Adding support for Cinterion MV31 + - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath. + - jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() + operations + - locking/static_key: Fix false positive warnings on concurrent dec/inc + - vmlinux.lds.h: add DWARF v5 sections + - [arm64] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 + - bfq: Avoid false bfq queue merging + - ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode + - [mips*] vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section + - random: fix the RNDRESEEDCRNG ioctl + - [arm64] Bluetooth: btqcomsmd: Fix a resource leak in error handling + paths in the probe function + - Bluetooth: Fix initializing response id after clearing struct + - [armhf] dts: exynos: correct PMIC interrupt trigger level on Spring + - [armhf] dts: exynos: correct PMIC interrupt trigger level on Arndale Octa + - bpf: Avoid warning when re-casting __bpf_call_base into + __bpf_call_base_args + - [arm64] dts: allwinner: A64: properly connect USB PHY to port 0 + - [arm64] dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz + - ACPICA: Fix exception code class checks + - usb: gadget: u_audio: Free requests only after callback + - Bluetooth: drop HCI device reference before return + - Bluetooth: Put HCI device if inquiry procedure interrupts + - [arm*] usb: dwc2: Do not update data length if it is 0 on inbound + transfers + - [arm*] usb: dwc2: Abort transaction after errors with unknown reason + - [arm*] usb: dwc2: Make "trimming xfer length" a debug message + - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory + rules + - [armhf] dts: armada388-helios4: assign pinctrl to LEDs + - [armhf] dts: armada388-helios4: assign pinctrl to each fan + - bpf_lru_list: Read double-checked variable once without lock + - bnxt_en: reverse order of TX disable and carrier off + - xen/netback: fix spurious event detection for common event case + - mac80211: fix potential overflow when multiplying to u32 integers + - bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx + - tcp: fix SO_RCVLOWAT related hangs under mem pressure + - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in + cxgb4 and ulds + - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case + - [amd64,arm64] net: amd-xgbe: Reset the PHY rx data path when mailbox + command timeout + - [amd64,arm64] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout + warning + - [amd64,arm64] net: amd-xgbe: Reset link when the link never comes back + - [amd64,arm64] net: amd-xgbe: Fix network fluctuations when using 1G + BELFUSE SFP + - [arm64,armhf] net: mvneta: Remove per-cpu queue mapping for Armada 3700 + - [x86] drm/gma500: Fix error return code in psb_driver_load() + - [x86] gma500: clean up error handling in init + - [armhf] crypto: sun4i-ss - fix kmap usage + - [mips*] c-r4k: Fix section mismatch for loongson2_sc_init + - media: em28xx: Fix use-after-free in em28xx_alloc_urbs + - media: media/pci: Fix memleak in empress_init + - [x86] media: tm6000: Fix memleak in tm6000_start_stream + - media: lmedm04: Fix misuse of comma + - media: qm1d1c0042: fix error return code in qm1d1c0042_init() + - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values + - f2fs: fix to avoid inconsistent quota data + - drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() + - [x86] Drivers: hv: vmbus: Avoid use-after-free in + vmbus_onoffer_rescind() + - btrfs: clarify error returns values in __load_free_space_cache + - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() + - fs/jfs: fix potential integer overflow on shift of a int + - jffs2: fix use after free in jffs2_sum_write_data() + - capabilities: Don't allow writing ambiguous v3 file capabilities + - [arm64,armhf] clk: meson: clk-pll: fix initializing the old rate + (fallback) for a PLL + - quota: Fix memory leak when handling corrupted quota file + - [arm64] clk: sunxi-ng: h6: Fix CEC clock + - HID: core: detect and skip invalid inputs to snto32() + - fdt: Properly handle "no-map" field in the memory region + - of/fdt: Make sure no-map does not remove already reserved regions + - RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation + - [arm64] clk: sunxi-ng: h6: Fix clock divider range on some clocks + - [arm64,armhf] regulator: axp20x: Fix reference cout leak + - certs: Fix blacklist flag type confusion + - [armhf] regulator: s5m8767: Drop regulators OF node reference + - isofs: release buffer head before return + - IB/umad: Return EIO in case of when device disassociated + - IB/umad: Return EPOLLERR in case of when device disassociated + - [ppc64el] KVM: Make the VMX instruction emulation routines static + - [armel,armhf] 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ + cores + - [arm*] amba: Fix resource leak for drivers without .remove + - tracepoint: Do not fail unregistering a probe due to memory failure + - perf tools: Fix DSO filtering when not finding a map for a sampled + address + - RDMA/rxe: Fix coding error in rxe_recv.c + - RDMA/rxe: Correct skb on loopback path + - [powerpc*] pseries/dlpar: handle ibm, configure-connector delay status + - [amd64] spi: pxa2xx: Fix the controller numbering for Wildcat Point + - Input: sur40 - fix an error code in sur40_probe() + - perf intel-pt: Fix missing CYC processing in PSB + - Input: elo - fix an error code in elo_connect() + - [arm64,armhf] pwm: rockchip: rockchip_pwm_probe(): Remove superfluous + clk_unprepare() + - [x86] VMCI: Use set_page_dirty_lock() when unregistering guest memory + - PCI: Align checking of syscall user config accessors + - [arm64] drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) + - ext4: fix potential htree index checksum corruption + - i40e: Fix flow for IPv6 next header (extension header) + - i40e: Add zero-initialization of AQ command structures + - i40e: Fix overwriting flow control settings during driver loading + - i40e: Fix VFs not created + - i40e: Fix add TC filter for IPv6 + - net/mlx4_core: Add missed mlx4_free_cmd_mailbox() + - vxlan: move debug check after netdev unregister + - ocfs2: fix a use after free on error + - mm/memory.c: fix potential pte_unmap_unlock pte error + - mm/hugetlb: fix potential double free in hugetlb_register_node() error + path + - r8169: fix jumbo packet handling on RTL8168e + - [arm64] Add missing ISB after invalidating TLB in __primary_switch + - mm/rmap: fix potential pte_unmap on an not mapped pte + - blk-settings: align max_sectors on "logical_block_size" boundary + - ACPI: property: Fix fwnode string properties matching + - HID: wacom: Ignore attempts to overwrite the touch_max value from HID + - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox + Series X|S + - Input: joydev - prevent potential read overflow in ioctl + - USB: serial: option: update interface mapping for ZTE P685M + - [arm64,armhf] usb: musb: Fix runtime PM race in musb_queue_resume_work + - [arm64,armhf] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 + - [arm64,armhf] usb: dwc3: gadget: Fix dep->interval for fullspeed + interrupt + - USB: serial: ftdi_sio: fix FTX sub-integer prescaler + - USB: serial: mos7840: fix error code in mos7840_write() + - USB: serial: mos7720: fix error code in mos7720_write() + - ALSA: hda/realtek: modify EAPD in the ALC886 + - tpm_tis: Fix check_locality for correct locality acquisition + - tpm_tis: Clean up locality release + - KEYS: trusted: Fix migratable=1 failing + - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root + - btrfs: fix reloc root leak with 0 ref reloc roots on recovery + - btrfs: fix extent buffer leak on failure to copy root + - [arm64] crypto: arm64/sha - add missing module aliases + - [armhf] crypto: sun4i-ss - checking sg length is not sufficient + - [armhf] crypto: sun4i-ss - handle BigEndian for cipher + - seccomp: Add missing return in non-void function + - misc: rtsx: init of rts522a add OCP power off when no card is present + - [x86] drivers/misc/vmw_vmci: restrict too big queue size in + qp_host_alloc_queue + - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table + - [x86] reboot: Force all cpus to exit VMX root if VMX is supported + - floppy: reintroduce O_NDELAY fix + - [arm64] uprobe: Return EOPNOTSUPP for AARCH32 instruction probing + - [x86] watchdog: mei_wdt: request stop on unregister + - [arm64] mtd: spi-nor: hisi-sfc: Put child node np on error path + - fs/affs: release old buffer head on error path + - seq_file: document how per-entry resources are managed. + - [x86] fix seq_file iteration for pat/memtype.c + - hugetlb: fix copy_huge_page_from_user contig page struct assumption + - libnvdimm/dimm: Avoid race between probe and available_slots_show() + - [arm64] Extend workaround for erratum 1024718 to all versions of + Cortex-A55 + - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols + - [armhf] mmc: sdhci-esdhc-imx: fix kernel panic when remove module + - [armhf] gpio: pcf857x: Fix missing first interrupt + - printk: fix deadlock when kernel panic + - [x86] cpufreq: intel_pstate: Get per-CPU max freq via + MSR_HWP_CAPABILITIES if available + - f2fs: fix out-of-repair __setattr_copy() + - gfs2: Don't skip dlm unlock if glock has an lvb + - dm: fix deadlock when swapping to encrypted device + - dm era: Recover committed writeset after crash + - dm era: Verify the data block size hasn't changed + - dm era: Fix bitset memory leaks + - dm era: Use correct value size in equality function of writeset tree + - dm era: Reinitialize bitset cache before digesting a new writeset + - dm era: only resize metadata in preresume + - icmp: introduce helper for nat'd source address in network device + context + - icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n + - gtp: use icmp_ndo_send helper + - xfrm: interface: use icmp_ndo_send helper + - ipv6: icmp6: avoid indirect call for icmpv6_send() + - ipv6: silence compilation warning for non-IPV6 builds + - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending + - dm era: Update in-core bitset after committing the metadata + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.179 + - net: usb: qmi_wwan: support ZTE P685M modem + - hugetlb: fix update_and_free_page contig page struct assumption + - drm/virtio: use kvmalloc for large allocations + - [s390x] virtio/s390: implement virtio-ccw revision 2 correctly + - [arm64] module: set plt* section addresses to 0x0 + - [arm64] Avoid redundant type conversions in xchg() and cmpxchg() + - [arm64] cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint + - [arm64] Use correct ll/sc atomic constraints + - JFS: more checks for invalid superblock + - udlfb: Fix memory leak in dlfb_usb_probe + - media: mceusb: sanity check for prescaler value + - xfs: Fix assert failure in xfs_setattr_size() + - net: fix up truesize of cloned skb in skb_prepare_for_shift() + - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing + - net: bridge: use switchdev for port flags set through sysfs too + - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ + - rsi: Fix TX EAPOL packet handling against iwlwifi AP + - rsi: Move card interrupt handling to RX thread + - [x86] reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk + - vt/consolemap: do font sum unsigned + - [arm64,armhf] wlcore: Fix command execute failure 19 for wl12xx + - Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl + - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() + - ath10k: fix wmi mgmt tx queue full due to race condition + - [x86] build: Treat R_386_PLT32 relocation as R_386_PC32 + - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data + - crypto: tcrypt - avoid signed overflow in byte count + - PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse + - media: uvcvideo: Allow entities with no pads + - f2fs: handle unallocated section and zone on pinned/atgc + - f2fs: fix to set/clear I_LINKABLE under i_lock + - btrfs: fix error handling in commit_fs_roots + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID + 7316R tablet + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 + tablet + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet + - scsi: iscsi: Restrict sessions and handles to admin capabilities + (CVE-2021-27363, CVE-2021-27364) + - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output + - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE + (CVE-2021-27365) + - scsi: iscsi: Verify lengths on passthrough PDUs (CVE-2021-27365) + - Xen/gnttab: handle p2m update errors on a per-slot basis + (CVE-2021-28038) + - xen-netback: respect gnttab_map_refs()'s return value (CVE-2021-28038) + - zsmalloc: account the number of compacted pages correctly + - swap: fix swapfile read/write offset + - media: v4l: ioctl: Fix memory leak in video_usercopy + - ALSA: hda/realtek: Add quirk for Clevo NH55RZQ + - ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.180 + - btrfs: raid56: simplify tracking of Q stripe presence + - btrfs: fix raid6 qstripe kmap + - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl + - btrfs: free correct amount of space in + btrfs_delayed_inode_reserve_metadata + - btrfs: unlock extents in btrfs_zero_range in case of quota reservation + errors + - PM: runtime: Update device status before letting suppliers suspend + - dm bufio: subtract the number of initial sectors in + dm_bufio_get_device_size + - drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie + - usbip: tools: fix build error for multiple definition + - Revert "zram: close udev startup race condition as default groups" + - block: genhd: add 'groups' argument to device_add_disk + - nvme: register ns_id attributes as default sysfs groups + - aoe: register default groups with device_add_disk() + - zram: register default groups with device_add_disk() + - virtio-blk: modernize sysfs attribute creation + - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits + - rsxx: Return -EFAULT if copy_to_user() fails + - r8169: fix resuming from suspend on RTL8105e if machine runs on battery + - [arm64,armhf] net: dsa: add GRO support via gro_cells + - dm table: fix iterate_devices based device capability checks + - dm table: fix DAX iterate_devices based device capability checks + - dm table: fix zoned iterate_devices based device capability checks + - [amd64] iommu/amd: Fix sleeping in atomic in increase_address_space() + - mwifiex: pcie: skip cancel_work_sync() on reset failure path + - [x86] platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines + - [x86] platform/x86: acer-wmi: Cleanup accelerometer device handling + - [x86] platform/x86: acer-wmi: Add new force_caps module parameter + - [x86] platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability + flag + - [x86] platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch + devices + - [x86] platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire + Switch 10E SW3-016 + - HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube + Adapter + - media: cx23885: add more quirks for reset DMA on some AMD IOMMU + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 + - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller + - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom + - [arm64] drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.181 + - uapi: nfnetlink_cthelper.h: fix userspace compilation error + - ethernet: alx: fix order of calls on resume (Closes: #983595) + - ath9k: fix transmitting to stations in dynamic SMPS mode + - net: Fix gro aggregation for udp encaps with zero csum + - net: Introduce parse_protocol header_ops callback + - can: skb: can_skb_set_owner(): fix ref counting if socket was closed + before setting skb ownership + - [armhf] can: flexcan: assert FRZ bit in flexcan_chip_freeze() + - [armhf] can: flexcan: enable RX FIFO after FRZ/HALT valid + - netfilter: x_tables: gpf inside xt_find_revision() + - mt76: dma: do not report truncated frames to mac80211 + - tcp: annotate tp->copied_seq lockless reads + - tcp: annotate tp->write_seq lockless reads + - tcp: add sanity tests to TCP_QUEUE_SEQ + - cifs: return proper error code in statfs(2) + - scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section + names + - Revert "mm, slub: consider rest of partial list if acquire_slab() fails" + - net: check if protocol extracted by virtio_net_hdr_set_proto is correct + - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 + - net/mlx4_en: update moderation when config reset + - [arm64,armhf] net: stmmac: fix incorrect DMA channel intr enable setting + of EQoS v4.10 + - net: sched: avoid duplicates in classes dump + - net: usb: qmi_wwan: allow qmimux add/del with master up + - [arm64,armhf] net: stmmac: stop each tx channel independently + - [arm64,armhf] net: stmmac: fix watchdog timeout during suspend/resume + stress test + - drm/compat: Clear bounce structures + - [arm64] drm: meson_drv add shutdown function + - media: usbtv: Fix deadlock on suspend + - net: phy: fix save wrong speed and duplex problem if autoneg is on + - udf: fix silent AED tagLocation corruption + - [powerpc*] pci: Add ppc_md.discover_phbs() + - [powerpc*] improve handling of unrecoverable system reset + - [powerpc*] perf: Record counter overflow always if SAMPLE_IP is unset + - [arm64] PCI: xgene-msi: Fix race in installing chained irq handler + - PCI: Fix pci_register_io_range() memory leak + - i40e: Fix memory leak in i40e_probe + - [s390x] smp: __smp_rescan_cpus() - move cpumask away from stack + - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling + - scsi: target: core: Add cmd length set before cmd complete + - scsi: target: core: Prevent underflow for service actions + - ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk + - ALSA: hda/hdmi: Cancel pending works before suspend + - ALSA: hda: Drop the BATCH workaround for AMD controllers + - ALSA: hda: Avoid spurious unsol event handling during S3/S4 + - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar + - ALSA: usb-audio: Apply the control quirk to Plantronics headsets + - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file + capabilities") + - [s390x] dasd: fix hanging DASD driver unbind + - [s390x] dasd: fix hanging IO request during DASD driver unbind + - mmc: core: Fix partition switch time for eMMC + - mmc: cqhci: Fix random crash when remove mmc module/card + - Goodix Fingerprint device is not a modem + - USB: gadget: u_ether: Fix a configfs return code + - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio + slot + - usb: gadget: f_uac1: stop playback on function disable + - [arm64] usb: dwc3: qcom: Honor wakeup enabled/disabled state + - USB: usblp: fix a hang in poll() if disconnected + - xhci: Improve detection of device initiated wake signal. + - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing + - USB: serial: io_edgeport: fix memory leak in edge_startup + - USB: serial: ch341: add new Product ID + - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter + - USB: serial: cp210x: add some more GE USB IDs + - usbip: fix stub_dev to check for stream socket + - usbip: fix vhci_hcd to check for stream socket + - usbip: fix vudc to check for stream socket + - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf + - usbip: fix vhci_hcd attach_store() races leading to gpf + - usbip: fix vudc usbip_sockfd_store races leading to gpf + - [x86] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() + - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() + (CVE-2021-28660) + - staging: rtl8712: unterminated string leads to read overflow + - staging: rtl8188eu: fix potential memory corruption in + rtw_check_beacon_data() + - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd + - [x86] staging: rtl8192e: Fix possible buffer overflow in + _rtl92e_wx_set_scan + - [x86] staging: comedi: addi_apci_1032: Fix endian problem for COS sample + - [x86] staging: comedi: addi_apci_1500: Fix endian problem for command + sample + - [x86] staging: comedi: adv_pci1710: Fix endian problem for AI command data + - [i386] staging: comedi: das6402: Fix endian problem for AI command data + - [i386] staging: comedi: das800: Fix endian problem for AI command data + - [i386] staging: comedi: dmm32at: Fix endian problem for AI command data + - [x86] staging: comedi: me4000: Fix endian problem for AI command data + - [i386] staging: comedi: pcl711: Fix endian problem for AI command data + - [i386] staging: comedi: pcl818: Fix endian problem for AI command data + - NFSv4.2: fix return value of _nfs4_get_security_label() + - block: rsxx: fix error return code of rsxx_pci_probe() + - configfs: fix a use-after-free in __configfs_open_file + - hrtimer: Update softirq_expires_next correctly after + __hrtimer_get_next_event() + - stop_machine: mark helpers __always_inline + - include/linux/sched/mm.h: use rcu_dereference in in_vfork() + - [powerpc*] 64s: Fix instruction encoding for lis in ppc_function_entry() + - binfmt_misc: fix possible deadlock in bm_register_write + - [amd64] x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2 + - hwmon: (lm90) Fix max6658 sporadic wrong temperature reading + - [arm64] KVM: Fix exclusive limit for IPA size + - xen/events: reset affinity of 2-level event when tearing it down + - xen/events: don't unmask an event channel when an eoi is pending + - xen/events: avoid handling the same event on two cpus at the same time + + [ Salvatore Bonaccorso ] + * Bump ABI to 16 + * ext4: check journal inode extents more carefully (CVE-2021-3428) + * bpf: Prohibit alu ops for pointer types not defining ptr_limit + (CVE-2020-27170) + * bpf: Fix off-by-one for area size in creating mask to left + (CVE-2020-27171) + * bpf: Simplify alu_limit masking for pointer arithmetic + * bpf: Add sanity check for upper ptr_limit + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 19 Mar 2021 15:29:57 +0100 + +linux (4.19.177-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.172 + - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions + - dm integrity: conditionally disable "recalculate" feature + - writeback: Drop I_DIRTY_TIME_EXPIRE + - fs: fix lazytime expiration handling in __writeback_single_inode() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.173 + - nbd: freeze the queue while we're adding connections (CVE-2021-3348) + - ACPI: sysfs: Prefer "compatible" modalias + - kernel: kexec: remove the lock operation of system_transition_mutex + - xen/privcmd: allow fetching resource sizes + - ALSA: hda/via: Apply the workaround generically for Clevo machines + - media: rc: ensure that uevent can be read directly after rc device + register + - wext: fix NULL-ptr-dereference with cfg80211's lack of commit() + - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem + family + - PM: hibernate: flush swap writer after marking + - [x86] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in + intel_arch_events[] + - [x86] KVM: get smi pending status correctly + - leds: trigger: fix potential deadlock with libata + - mt7601u: fix kernel crash unplugging the device + - mt7601u: fix rx buffer refcounting + - xen-blkfront: allow discard-* nodes to be optional + - [armhf] imx: build suspend-imx6.S with arm instruction set + - netfilter: nft_dynset: add timeout extension to template + - xfrm: Fix oops in xfrm_replay_advance_bmp + - xfrm: fix disable_xfrm sysctl when used on xfrm interfaces + - RDMA/cxgb4: Fix the reported max_recv_sge value + - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() + - iwlwifi: pcie: use jiffies for memory read spin time limit + - iwlwifi: pcie: reschedule in long-running memory reads + - mac80211: pause TX while changing interface type + - net/mlx5: Fix memory leak on flow table creation error flow + - can: dev: prevent potential information leak in can_fill_info() + - [amd64] iommu/vt-d: Gracefully handle DMAR units with no supported + address widths + - [amd64] iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not + built + - rxrpc: Fix memory leak in rxrpc_lookup_local + - NFC: fix resource leak when target index is invalid + - NFC: fix possible resource leak + - team: protect features update by RCU to avoid deadlock + - tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.174 + - [armhf] net: dsa: bcm_sf2: put device node before return + - ACPI: thermal: Do not call acpi_thermal_check() directly + - sysctl: handle overflow in proc_get_long + - net_sched: gen_estimator: support large ewma log + - [x86] platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron + 7352 + - [x86] __always_inline __{rd,wr}msr() + - scsi: scsi_transport_srp: Don't block target in failfast state + - scsi: libfc: Avoid invoking response handler twice if ep is already + completed + - mac80211: fix fast-rx encryption check + - [ppc64el] scsi: ibmvfc: Set default timeout to avoid crash during + migration + - objtool: Don't fail on missing symbol table + - kthread: Extract KTHREAD_IS_PER_CPU + - workqueue: Restrict affinity change to rescuer + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.175 + - USB: serial: cp210x: add pid/vid for WSDA-200-USB + - USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 + - USB: serial: option: Adding support for Cinterion MV31 + - Input: i8042 - unbreak Pegatron C15B + - rxrpc: Fix deadlock around release of dst cached on udp tunnel + - net: lapb: Copy the skb before sending a packet + - [arm64,armhf] net: mvpp2: TCAM entry enable should be written after SRAM + data + - memblock: do not start bottom-up allocations with kernel_end + - USB: gadget: legacy: fix an error code in eth_bind() + - USB: usblp: don't call usb_set_interface if there's a single alt + - [arm*] usb: dwc2: Fix endpoint direction check in ep_from_windex + - [arm64,armhf] usb: dwc3: fix clock issue during resume in OTG mode + - ovl: fix dentry leak in ovl_get_redirect + - mac80211: fix station rate table updates on assoc + - kretprobe: Avoid re-registration of the same kretprobe earlier + - genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set + - xhci: fix bounce buffer usage for non-sg list case + - cifs: report error instead of invalid when revalidating a dentry fails + - smb3: Fix out-of-bounds bug in SMB2_negotiate() + - mmc: core: Limit retries when analyse of SDIO tuples fails + - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs + - [x86] KVM: SVM: Treat SVM as unsupported when running as an SEV guest + - mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page + - mm: hugetlb: fix a race between freeing and dissolving the page + - mm: hugetlb: fix a race between isolating and freeing page + - mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active + - mm: thp: fix MADV_REMOVE deadlock on shmem THP + - [x86] build: Disable CET instrumentation in the kernel + - [x86] apic: Add extra serialization for non-serializing MSRs + - Input: xpad - sync supported devices with fork on GitHub + - [amd64] iommu/vt-d: Do not use flush-queue when caching-mode is on + - md: Set prev_flush_start and flush_bio in an atomic way + - net: ip_tunnel: fix mtu calculation + - [arm64,armhf] net: dsa: mv88e6xxx: override existent unicast portvec in + port_fdb_add + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.176 + - tracing/kprobe: Fix to support kretprobe events on unloaded modules + - block: fix NULL pointer dereference in register_disk + - fgraph: Initialize tracing_graph_pause at task creation + - af_key: relax availability checks for skb size calculation + - regulator: core: avoid regulator_resolve_supply() race condition + - pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() + - iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap + - iwlwifi: pcie: fix context info memory leak + - iwlwifi: mvm: guard against device removal in reprobe + - SUNRPC: Move simple_get_bytes and simple_get_netobj into private header + - SUNRPC: Handle 0 length opaque XDR object data properly + - lib/string: Add strscpy_pad() function + - include/trace/events/writeback.h: fix -Wstringop-truncation warnings + - memcg: fix a crash in wb_workfn when a device disappears + - [x86] Fix unsynchronized access to sev members through + svm_register_enc_region + - block: don't hold q->sysfs_lock in elevator_init_mq + - blk-mq: don't hold q->sysfs_lock in blk_mq_map_swqueue + - squashfs: add more sanity checks in id lookup + - squashfs: add more sanity checks in inode lookup + - squashfs: add more sanity checks in xattr id lookup + - regulator: core: enable power when setting up constraints + - regulator: core: Clean enabling always-on regulators + their supplies + - regulator: Fix lockdep warning resolving supplies + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.177 + - tracing: Do not count ftrace events in top level enable output + - tracing: Check length before giving out the filter buffer + - [armhf] xen: Don't probe xenbus as part of an early initcall + - [x86] platform/x86: hp-wmi: Disable tablet-mode reporting by default + - ovl: perform vfs_getxattr() with mounter creds + - cap: fix conversions on getxattr + - ovl: skip getxattr of security labels + - bfq-iosched: Revert "bfq: Fix computation of shallow depth" + - [armel,armhf] ensure the signal page contains defined contents + - [armel,armhf] kexec: fix oops after TLB are invalidated + - mt76: dma: fix a possible memory leak in mt76_add_fragment() + - bpf: Check for integer overflow when using roundup_pow_of_two() + - netfilter: xt_recent: Fix attempt to update deleted entry + - netfilter: flowtable: fix tcp and udp header checksum update + - xen/netback: avoid race in xenvif_rx_ring_slots_available() + - [arm64,armhf] net: stmmac: set TxQ mode back to DCB after disabling CBS + - netfilter: conntrack: skip identical origin tuple in same zone only + - [arm64] net: hns3: add a check for queue_id in hclge_reset_vf_queue() + - [arm64] usb: dwc3: ulpi: fix checkpatch warning + - [arm64] usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based + one + - net: fix iteration for sctp transport seq_files + - net/vmw_vsock: improve locking in vsock_connect_timeout() + - net: watchdog: hold device global xmit lock during tx disable + - vsock/virtio: update credit only if socket is not closed + - vsock: fix locking in vsock_shutdown() + - net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS + - ovl: expand warning in ovl_d_real() + - [x86] KVM: SEV: fix double locking due to incorrect backport + - [x86] Xen/x86: don't bail early from clear_foreign_p2m_mapping() + (CVE-2021-26932) + - [x86] Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() + (CVE-2021-26932) + - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() + (CVE-2021-26932) + - Xen/gntdev: correct error checking in gntdev_map_grant_pages() + (CVE-2021-26932) + - [armhf] xen/arm: don't ignore return errors from set_phys_to_machine + (CVE-2021-26932) + - xen-blkback: don't "handle" error by BUG() (CVE-2021-26931) + - xen-netback: don't "handle" error by BUG() (CVE-2021-26931) + - xen-scsiback: don't "handle" error by BUG() (CVE-2021-26931) + - xen-blkback: fix error handling in xen_blkbk_map() (CVE-2021-26930) + - scsi: qla2xxx: Fix crash during driver load on big endian machines + - kvm: check tlbs_dirty directly + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.173-rt72 + * certs: Rotate to use the "Debian Secure Boot Signer 2021 - linux" + certificate + * Bump ABI to 15 + + -- Salvatore Bonaccorso <carnil@debian.org> Wed, 03 Mar 2021 13:48:46 +0100 + +linux (4.19.171-2) buster-security; urgency=high + + * xen: Fix XenStore initialisation for XS_LOCAL + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 30 Jan 2021 10:35:46 +0100 + +linux (4.19.171-1) buster-security; urgency=high + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.161 + - perf event: Check ref_reloc_sym before using it + - netfilter: clear skb->next in NF_HOOK_LIST() (CVE-2021-20177) + - btrfs: don't access possibly stale fs_info data for printing duplicate + device + - btrfs: fix lockdep splat when reading qgroup config on mount + - wireless: Use linux/stddef.h instead of stddef.h + - [arm64] KVM: vgic-v3: Drop the reporting of GICR_TYPER.Last for + userspace + - [x86] KVM: handle !lapic_in_kernel case in kvm_cpu_*_extint + - [x86] KVM: Fix split-irqchip vs interrupt injection window request + - [arm64] pgtable: Fix pte_accessible() + - [arm64] pgtable: Ensure dirty bit is preserved across pte_wrprotect() + (Closes: #977615) + - drm/atomic_helper: Stop modesets on unregistered connectors harder + - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close + - HID: cypress: Support Varmilo Keyboards' media hotkeys + - HID: add support for Sega Saturn + - Input: i8042 - allow insmod to succeed on devices without an i8042 + controller + - HID: hid-sensor-hub: Fix issue with devices with no report ID + - HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices + - [x86] xen: don't unbind uninitialized lock_kicker_irq + - HID: Add Logitech Dinovo Edge battery quirk + - proc: don't allow async path resolution of /proc/self components + - nvme: free sq/cq dbbuf pointers when dbbuf set fails + - [arm64,armhf] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size + - scsi: libiscsi: Fix NOP race condition + - scsi: target: iscsi: Fix cmd abort fabric stop race + - [x86] perf/x86: fix sysfs type mismatches + - [arm64,armhf] phy: tegra: xusb: Fix dangling pointer on probe failure + - scsi: ufs: Fix race between shutdown and runtime resume flow + - bnxt_en: fix error return code in bnxt_init_one() + - bnxt_en: fix error return code in bnxt_init_board() + - [x86] video: hyperv_fb: Fix the cache type when mapping the VRAM + - bnxt_en: Release PCI regions when DMA mask setup fails during probe. + - cxgb4: fix the panic caused by non smac rewrite + - [s390x] qeth: fix tear down of async TX buffers + - IB/mthca: fix return value of error branch in mthca_init_cq() + - net: ena: set initial DMA width to avoid intel iommu issue + - [arm64] optee: add writeback to valid memory type + - [arm64,armhf,x86] efivarfs: revert "fix memory leak in + efivarfs_create()" (Closes: #977048) + - can: gs_usb: fix endianess problem with candleLight firmware + - [x86] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup + time + - [x86] platform/x86: toshiba_acpi: Fix the wrong variable assignment + - USB: core: Change %pK for __user pointers to %px + - usb: gadget: f_midi: Fix memleak in f_midi_alloc + - USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO + built-in usb-audio card + - usb: gadget: Fix memleak in gadgetfs_fill_super + - [x86] speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb + - USB: core: Fix regression in Hercules audio card + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.162 + - ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init + - [s390x] net/af_iucv: set correct sk_protocol for child sockets + - rose: Fix Null pointer dereference in rose_send_frame() + - sock: set sk_err to ee_errno on dequeue from errq + - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control + - tun: honor IOCB_NOWAIT flag + - i40e: Fix removing driver while bare-metal VFs pass traffic + - bonding: wait for sysfs kobject destruction before freeing struct slave + - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING + traversal + - ipv4: Fix tos mask in inet_rtm_getroute() + - geneve: pull IP header before ECN decapsulation + - net: ip6_gre: set dev->hard_header_len when using header_ops + - cxgb3: fix error return code in t3_sge_alloc_qset() + - [arm64,armhf] net: mvpp2: Fix error return code in mvpp2_open() + - net/mlx5: Fix wrong address reclaim when command interface is down + - dt-bindings: net: correct interrupt flags in examples + - ALSA: usb-audio: US16x08: fix value count for level meters + - Input: xpad - support Ardwiino Controllers + - Input: i8042 - add ByteSpeed touchpad to noloop table + - tracing: Remove WARN_ON in start_thread() + - RDMA/i40iw: Address an mmap handler exploit in i40iw + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.163 + - [x86] pinctrl: baytrail: Replace WARN with dev_info_once when setting + direct-irq pin to output + - [x86] pinctrl: baytrail: Fix pin being driven low for a while on + gpiod_get(..., GPIOD_OUT_HIGH) + - usb: gadget: f_fs: Use local copy of descriptors for userspace copy + - USB: serial: kl5kusb105: fix memleak on open + - USB: serial: ch341: add new Product ID for CH341A + - USB: serial: ch341: sort device-id entries + - USB: serial: option: add Fibocom NL668 variants + - USB: serial: option: add support for Thales Cinterion EXS82 + - USB: serial: option: fix Quectel BG96 matching + - tty: Fix ->pgrp locking in tiocspgrp() (CVE-2020-29661) + - tty: Fix ->session locking (CVE-2020-29660) + - ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model + - ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 + - ALSA: hda/realtek - Add new codec supported for ALC897 + - ALSA: hda/generic: Add option to enforce preferred_dacs pairs + - ftrace: Fix updating FTRACE_FL_TRAMP + - cifs: fix potential use-after-free in cifs_echo_request() + - [armhf] i2c: imx: Don't generate STOP condition if arbitration has been + lost + - scsi: mpt3sas: Fix ioctl timeout + - dm writecache: fix the maximum number of arguments + - dm: remove invalid sparse __acquires and __releases annotations + - mm: list_lru: set shrinker map bit when child nr_items is not zero + - mm/swapfile: do not sleep with a spin lock held + - [x86] uprobes: Do not use prefixes.nbytes when looping over + prefixes.bytes + - [armhf] i2c: imx: Fix reset of I2SR_IAL flag + - [armhf] i2c: imx: Check for I2SR_IAL after every byte + - speakup: Reject setting the speakup line discipline outside of speakup + (CVE-2020-27830) + - [amd64] iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs + - spi: Introduce device-managed SPI controller allocation + - [arm*] spi: bcm2835: Fix use-after-free on unbind + - [arm*] spi: bcm2835: Release the DMA channel if probe fails after + dma_init + - tracing: Fix userstacktrace option for instances + - gfs2: check for empty rgrp tree in gfs2_ri_update + - [arm64] i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() + - dm writecache: remove BUG() and fail gracefully instead + - Input: i8042 - fix error return code in i8042_setup_aux() + - netfilter: nf_tables: avoid false-postive lockdep splat + - [x86] insn-eval: Use new for_each_insn_prefix() macro to loop over + prefixes bytes + - Revert "geneve: pull IP header before ECN decapsulation" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.164 + - [x86] lib: Change .weak to SYM_FUNC_START_WEAK for + arch/x86/lib/mem*_64.S + - [arm*] spi: bcm2835aux: Fix use-after-free on unbind + - [arm*] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe + - iwlwifi: pcie: limit memory read spin time + - iwlwifi: mvm: fix kernel panic in case of assert during CSA + - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE + - [arm64,armhf] irqchip/gic-v3-its: Unconditionally save/restore the ITS + state on suspend + - [x86] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga + 11e + - [x86] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for + Thinkpad Yoga 11e 4th gen + - [x86] platform/x86: acer-wmi: add automatic keyboard background light + toggle key as KEY_LIGHTS_TOGGLE + - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion + 13 x360 PC + - Input: cm109 - do not stomp on control URB + - Input: i8042 - add Acer laptops to the i8042 reset list + - pinctrl: amd: remove debounce filter setting in IRQ type setting + - mmc: block: Fixup condition for CMD13 polling for RPMB requests + - kbuild: avoid static_assert for genksyms + - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" + - [x86] membarrier: Get rid of a dubious optimization + - [x86] apic/vector: Fix ordering in vector assignment + - [arm64] PCI: qcom: Add missing reset for ipq806x + - mac80211: mesh: fix mesh_pathtbl_init() error path + - [arm64,armhf] net: stmmac: free tx skb buffer in stmmac_resume() + - tcp: select sane initial rcvq_space.space for big MSS + - tcp: fix cwnd-limited bug for TSO deferral where we send nothing + - net/mlx4_en: Avoid scheduling restart task if it is already running + - lan743x: fix for potential NULL pointer dereference with bare card + - net/mlx4_en: Handle TX error CQE + - [arm64,armhf] net: stmmac: delete the eee_ctrl_timer after napi disabled + - [arm64,armhf] net: stmmac: dwmac-meson8b: fix mask definition of the + m250_sel mux + - net: bridge: vlan: fix error return code in __vlan_add() + - USB: add RESET_RESUME quirk for Snapscan 1212 + - ALSA: usb-audio: Fix potential out-of-bounds shift + - ALSA: usb-audio: Fix control 'access overflow' errors from chmap + - xhci: Give USB2 ports time to enter U3 in bus suspend + - USB: UAS: introduce a quirk to set no_write_same + - ALSA: pcm: oss: Fix potential out-of-bounds shift + - [x86] drm/xen-front: Fix misused IS_ERR_OR_NULL checks + - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi + - [x86] pinctrl: baytrail: Avoid clearing debounce value when turning it + off + - [arm*] gpio: mvebu: fix potential user-after-free on probe + - scsi: bnx2i: Requires MMU + - xsk: Fix xsk_poll()'s return type + - can: softing: softing_netdev_open(): fix error handling + - block: factor out requeue handling from dispatch code + - netfilter: x_tables: Switch synchronization to RCU + - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait + - ixgbe: avoid premature Rx buffer reuse + - [arm64,armhf] drm/tegra: replace idr_init() by idr_init_base() + - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling + - [arm64,armhf] drm/tegra: sor: Disable clocks on error in + tegra_sor_init() + - [arm64] syscall: exit userspace before unmasking exceptions + - vxlan: Add needed_headroom for lower device + - vxlan: Copy needed_tailroom from lowerdev + - scsi: mpt3sas: Increase IOCInit request timeout to 30s + - dm table: Remove BUG_ON(in_interrupt()) + - [arm64] soc/tegra: fuse: Fix index bug in get_process_id + - USB: serial: option: add interface-number sanity check to flag handling + - USB: gadget: f_acm: add support for SuperSpeed Plus + - USB: gadget: f_midi: setup SuperSpeed Plus descriptors + - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus + - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above + - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING + flag to imx6ul + - [armhf] dts: exynos: fix roles of USB 3.0 ports on Odroid XU + - [armhf] dts: exynos: fix USB 3.0 pins supply being turned off on Odroid + XU + - scsi: megaraid_sas: Check user-provided offsets + - HID: i2c-hid: add Vero K147 to descriptor override + - serial_core: Check for port state when tty is in error state + - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() + - quota: Sanity-check quota file headers on load + - media: msi2500: assign SPI bus number dynamically + - crypto: af_alg - avoid undefined behavior accessing salg_name + - md: fix a warning caused by a race between concurrent md_ioctl()s + - perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata + - perf cs-etm: Move definition of 'traceid_list' global variable from + header file + - [x86] drm/gma500: fix double free of gma_connector + - selinux: fix error initialization in inode_doinit_with_dentry() + - RDMA/rxe: Compute PSN windows correctly + - [x86] mm/ident_map: Check for errors from ident_pud_init() + - [armel,armhf] p2v: fix handling of LPAE translation in BE mode + - [x86] apic: Fix x2apic enablement without interrupt remapping + - sched/deadline: Fix sched_dl_global_validate() + - sched: Reenable interrupts in do_sched_yield() + - [arm64] crypto: inside-secure - Fix sizeof() mismatch + - [powerpc*] 64: Set up a kernel stack for secondaries before + cpu_restore() + - [arm64] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state + - ASoC: pcm: DRAIN support reactivation + - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling + - Bluetooth: Fix null pointer dereference in hci_event_packet() + - Bluetooth: hci_h5: fix memory leak in h5_close + - [armhf] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup + - [arm64] spi: tegra20-slink: fix reference leak in slink ops of tegra20 + - [arm64,armhf] spi: tegra20-sflash: fix reference leak in + tegra_sflash_resume + - [arm64,armhf] spi: tegra114: fix reference leak in tegra spi ops + - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure + - RDMa/mthca: Work around -Wenum-conversion warning + - [x86] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() + - [x86] media: tm6000: Fix sizeof() mismatches + - scsi: core: Fix VPD LUN ID designator priorities + - media: solo6x10: fix missing snd_card_free in error handling case + - [armhf] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() + - Input: ads7846 - fix race that causes missing releases + - Input: ads7846 - fix integer overflow on Rt calculation + - Input: ads7846 - fix unaligned access on 7845 + - spi: fix resource leak for drivers without .remove callback + - [armhf] Input: omap4-keypad - fix runtime PM error handling + - RDMA/cxgb4: Validate the number of CQEs + - memstick: fix a double-free bug in memstick_check + - orinoco: Move context allocation after processing the skb + - [arm64] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() + - media: siano: fix memory leak of debugfs members in smsdvb_hotplug + - [armhf] HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() + - [arm64] dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc + - [x86] power: supply: bq24190_charger: fix reference leak + - genirq/irqdomain: Don't try to free an interrupt that has no mapping + - PCI: Bounds-check command-line resource alignment requests + - PCI: Fix overflow in command-line resource alignment requests + - [arm64] dts: meson: fix spi-max-frequency on Khadas VIM2 + - [x86] platform/x86: dell-smbios-base: Fix error return code in + dell_smbios_init + - ath10k: Fix the parsing error in service available event + - ath10k: Fix an error handling path + - ath10k: Release some resources in an error handling path + - NFSv4.2: condition READDIR's mask for security label based on LSM state + - SUNRPC: xprt_load_transport() needs to support the netid "rdma6" + - lockd: don't use interval-based rebinding over TCP + - NFS: switch nfsiod to be an UNBOUND workqueue. + - vfio-pci: Use io_remap_pfn_range() for PCI IO memory + - media: saa7146: fix array overflow in vidioc_s_audio() + - memstick: r592: Fix error return in r592_probe() + - net/mlx5: Properly convey driver version to firmware + - dm ioctl: fix error return code in target_message + - [arm64,armhf] clocksource/drivers/arm_arch_timer: Correct fault + programming of CNTKCTL_EL1.EVNTI + - [armhf] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE + - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe + - scsi: pm80xx: Fix error return in pm8001_pci_probe() + - seq_buf: Avoid type mismatch for seq_buf_init + - [x86] scsi: fnic: Fix error return code in fnic_probe() + - [powerpc*] pseries/hibernation: drop pseries_suspend_begin() from + suspend ops + - [powerpc*] pseries/hibernation: remove redundant cacheinfo update + - [armhf] usb: ehci-omap: Fix PM disable depth umbalance in + ehci_hcd_omap_probe + - speakup: fix uninitialized flush_lock + - nfsd: Fix message level for normal termination + - nfs_common: need lock during iterate through the list + - [x86] kprobes: Restore BTF if the single-stepping is cancelled + - [arm64,armhf] clk: tegra: Fix duplicated SE clock entry + - mac80211: don't set set TDLS STA bandwidth wider than possible + - watchdog: Fix potential dereferencing of null pointer + - [armhf] net: allwinner: Fix some resources leak in the error handling + path of the probe and in the remove function + - [arm64,x86] libnvdimm/label: Return -ENXIO for no slot in + __blk_label_update + - [arm64] watchdog: qcom: Avoid context switch in restart handler + - [armhf] clk: ti: Fix memleak in ti_fapll_synth_setup + - qlcnic: Fix error code in probe + - [armhf] clk: s2mps11: Fix a resource leak in error handling paths in the + probe function + - [arm64,armhf] clk: sunxi-ng: Make sure divider tables have sentinel + - [armhf] sunxi: Add machine match for the Allwinner V3 SoC + - cfg80211: initialize rekey_data + - lwt: Disable BH too in run_lwt_bpf() + - [arm64,armhf] Input: cros_ec_keyb - send 'scancodes' in addition to key + events + - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet + - media: gspca: Fix memory leak in probe + - [armhf] media: sunxi-cir: ensure IR is handled when it is continuous + - media: netup_unidvb: Don't leak SPI master in probe error path + - [x86] Input: cyapa_gen6 - fix out-of-bounds stack access + - ALSA: hda/ca0132 - Change Input Source enum strings. + - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() + - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources + walks" + - ACPI: PNP: compare the string length in the matching_id() + - ALSA: hda: Fix regressions on clear and reconfig sysfs + - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 + - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 + - ALSA: pcm: oss: Fix a few more UBSAN fixes + - ALSA: hda/realtek: Add quirk for MSI-GP73 + - ALSA: hda/realtek: Apply jack fixup for Quanta NL3 + - ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO + devices + - ALSA: usb-audio: Disable sample read check if firmware doesn't give back + - [s390x] smp: perform initial CPU reset also for SMT siblings + - [s390x] dasd: fix hanging device offline processing + - [s390x] dasd: prevent inconsistent LCU device data + - [s390x] dasd: fix list corruption of pavgroup group list + - [s390x] dasd: fix list corruption of lcu list + - [x86] staging: comedi: mf6x4: Fix AI end-of-conversion detection + - [powerpc*] perf: Exclude kernel samples while counting events in user + space. + - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() + - [x86] EDAC/amd64: Fix PCI component registration + - USB: serial: mos7720: fix parallel-port state restore + - USB: serial: digi_acceleport: fix write-wakeup deadlocks + - USB: serial: keyspan_pda: fix dropped unthrottle interrupts + - USB: serial: keyspan_pda: fix write deadlock + - USB: serial: keyspan_pda: fix stalled writes + - USB: serial: keyspan_pda: fix write-wakeup use-after-free + - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free + - USB: serial: keyspan_pda: fix write unthrottling + - ext4: fix a memory leak of ext4_free_data + - ext4: fix deadlock with fs freezing and EA inodes + - [arm64] KVM: Introduce handling of AArch32 TTBCR2 traps + - [armhf] dts: pandaboard: fix pinmux for gpio user button of Pandaboard + ES + - [powerpc*] Fix incorrect stw{, ux, u, x} instructions in __set_pte_at + - [powerpc*] rtas: Fix typo of ibm,open-errinjct in RTAS filter + - [powerpc*] xmon: Change printk() to pr_cont() + - ceph: fix race in concurrent __ceph_remove_cap invocations + - SMB3: avoid confusing warning message on mount to Azure + - SMB3.1.1: do not log warning message if server doesn't populate salt + - ubifs: wbuf: Don't leak kernel memory to flash + - jffs2: Fix GC exit abnormally + - jfs: Fix array index bounds check in dbAdjTree (CVE-2020-27815) + - drm/dp_aux_dev: check aux_dev before use in + drm_dp_aux_dev_get_by_minor() + - [armel] mtd: parser: cmdline: Fix parsing of part-names with colons + - scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() + - scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() + - iio: buffer: Fix demux update + - [arm64,armhf] iio: adc: rockchip_saradc: fix missing + clk_disable_unprepare() on error in rockchip_saradc_resume + - md/cluster: block reshape with remote resync job + - md/cluster: fix deadlock when node is doing resync job + - [arm64,armhf] pinctrl: sunxi: Always call chained_irq_{enter, exit} in + sunxi_pinctrl_irq_handler + - [arm64] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 + - xen-blkback: set ring->xenblkd to NULL after kthread_stop() + (CVE-2020-29569) + - xen/xenbus: Allow watches discard events before queueing + (CVE-2020-29568) + - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() + (CVE-2020-29568) + - xen/xenbus/xen_bus_type: Support will_handle watch callback + (CVE-2020-29568) + - xen/xenbus: Count pending messages for each watch (CVE-2020-29568) + - xenbus/xenbus_backend: Disallow pending watch messages (CVE-2020-29568) + - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace + labels + - [x86] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha + 12 + - PCI: Fix pci_slot_release() NULL pointer dereference + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.165 + - md/raid10: initialize r10_bio->read_slot before use. + - fscrypt: add fscrypt_is_nokey_name() + - ext4: prevent creating duplicate encrypted filenames + - f2fs: prevent creating duplicate encrypted filenames + - ubifs: prevent creating duplicate encrypted filenames + - vfio/pci: Move dummy_resources_list init in vfio_pci_probe() + - ext4: don't remount read-only with errors=continue on reboot + - uapi: move constants from <linux/kernel.h> to <linux/const.h> + - [x86] KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL + accesses + - [x86] KVM: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits + - [powerpc*] bitops: Fix possible undefined behaviour with fls() and + fls64() + - xen/gntdev.c: Mark pages as dirty + - null_blk: Fix zone size initialization + - of: fix linker-section match-table corruption + - Bluetooth: hci_h5: close serdev device and free hu in h5_close + - reiserfs: add check for an invalid ih_entry_count + - [x86] misc: vmw_vmci: fix kernel info-leak by initializing dbells in + vmci_ctx_get_chkpt_doorbells() + - media: gp8psk: initialize stats at power control logic + - ALSA: seq: Use bool for snd_seq_queue internal flags + - ALSA: rawmidi: Access runtime->avail always in spinlock + - fcntl: Fix potential deadlock in send_sig{io, urg}() + - [arm64,armhf] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init + - module: set MODULE_STATE_GOING state when a module fails to load + - quota: Don't overflow quota file offsets + - NFSv4: Fix a pNFS layout related use-after-free race when freeing the + inode + - module: delay kobject uevent until after module init call + - ALSA: pcm: Clear the full allocated memory at hw_params + - dm verity: skip verity work if I/O error when system is shutting down + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.166 + - kdev_t: always inline major/minor helper functions + - mwifiex: Fix possible buffer overflows in + mwifiex_cmd_802_11_ad_hoc_start (CVE-2020-36158) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.167 + - workqueue: Kick a worker based on the actual activation of delayed works + - scsi: ufs: Fix wrong print message in dev_err() + - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for + suspend-to-disk ->poweroff() + - scsi: scsi_transport_spi: Set RQF_PM for domain validation commands + - lib/genalloc: fix the overflow when size is too big + - proc: change ->nlink under proc_subdir_lock + - proc: fix lookup in /proc/net subdirectories after setns(2) + - i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs + - [arm64,armhf] net: mvpp2: Add TCAM entry to drop flow control pause + frames + - [arm64,armhf] net: mvpp2: prs: fix PPPoE with ipv6 packet parse + - atm: idt77252: call pci_disable_device() on error path + - [arm64,armhf] net: mvpp2: Fix GoP port 3 Networking Complex Control + configurations + - qede: fix offload for IPIP tunnel packets + - virtio_net: Fix recursive call to cpus_read_lock() + - net-sysfs: take the rtnl lock when storing xps_cpus + - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc + - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS + - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() + - [arm64] net: hns: fix return value check in __lb_other_process() + - erspan: fix version 1 check in gre_parse_header() + - net: hdlc_ppp: Fix issues when mod_timer is called while timer is + running + - CDC-NCM: remove "connected" log message + - net: usb: qmi_wwan: add Quectel EM160R-GL + - r8169: work around power-saving bug on some chip versions + - vhost_net: fix ubuf refcount incorrectly when sendmsg fails + - net: sched: prevent invalid Scell_log shift count + - net-sysfs: take the rtnl lock when storing xps_rxqs + - net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc + - Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close + - [x86] video: hyperv_fb: Fix the mmap() regression for v5.4.y and older + - crypto: ecdh - avoid buffer overflow in ecdh_set_secret() + - usb: gadget: enable super speed plus + - USB: cdc-acm: blacklist another IR Droid device + - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt(). + - [arm64] usb: dwc3: ulpi: Use VStsDone to detect PHY regs access + completion + - [arm64,armhf] usb: chipidea: ci_hdrc_imx: add missing put_device() call + in usbmisc_get_init_data() + - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk + set + - usb: usbip: vhci_hcd: protect shift size + - USB: serial: iuu_phoenix: fix DMA from stack + - USB: serial: option: add LongSung M5710 module support + - USB: serial: option: add Quectel EM160R-GL + - USB: yurex: fix control-URB timeout handling + - USB: usblp: fix DMA to stack + - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks + - usb: gadget: f_uac2: reset wMaxPacketSize + - usb: gadget: function: printer: Fix a memory leak for interface + descriptor + - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size + - usb: gadget: Fix spinlock lockup on usb_function_deactivate + - usb: gadget: configfs: Preserve function ordering after bind failure + - usb: gadget: configfs: Fix use-after-free issue with udc_name + - USB: serial: keyspan_pda: remove unused variable + - [x86] mm: Fix leak of pmd ptlock + - ALSA: hda/via: Fix runtime PM for Clevo W35xSS + - ALSA: hda/conexant: add a new hda codec CX11970 + - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 + - btrfs: send: fix wrong file path when there is an inode with a pending + rmdir + - Revert "device property: Keep secondary firmware node secondary by type" + - [x86] xen/pvh: correctly setup the PV EFI interface for dom0 + - netfilter: x_tables: Update remaining dereference to RCU + - netfilter: ipset: fix shift-out-of-bounds in htable_bits() + - netfilter: xt_RATEEST: reject non-null terminated string from userspace + - [x86] mtrr: Correct the range check before performing MTRR type lookups + - scsi: target: Fix XCOPY NAA identifier lookup (CVE-2020-28374) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.168 + - net: cdc_ncm: correct overhead in delayed_ndp_size (Closes: #970736) + - [arm64] net: hns3: fix the number of queues actually used by ARQ + - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY resource + references + - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY power + - net: vlan: avoid leaks on register_vlan_dev() failures + - net: ip: always refragment ip defragmented packets + - net: fix pmtu check in nopmtudisc mode + - net: ipv6: fib: flush exceptions when purging route + - vmlinux.lds.h: Add PGO and AutoFDO input sections + - [x86] drm/i915: Fix mismatch between misplaced vma check and vma insert + - [amd64] spi: pxa2xx: Fix use-after-free on unbind + - HID: wacom: Fix memory leakage caused by kfifo_alloc + - [armhf] OMAP2+: omap_device: fix idling of devices during probe + - [x86] cpufreq: powernow-k8: pass policy rather than use + cpufreq_cpu_get() + - [amd64] iommu/intel: Fix memleak in intel_irq_remapping_alloc + - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups + - net/mlx5e: Fix two double free cases + - regmap: debugfs: Fix a memory leak when calling regmap_attach_dev + - [arm64] KVM: Don't access PMCR_EL0 when no PMU is available + - block: fix use-after-free in disk_part_iter_next + - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of + trimmed packet + - regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.169 + - ASoC: dapm: remove widget from dirty list on free + - [x86] hyperv: check cpu mask after interrupt has been disabled + - [mips*] boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB + - ACPI: scan: Harden acpi_device_add() against device ID overflows + - mm/hugetlb: fix potential missing huge page size info + - dm snapshot: flush merged data before committing metadata + - dm integrity: fix the maximum number of arguments + - r8152: Add Lenovo Powered USB-C Travel Hub + - ext4: fix bug for rename with RENAME_WHITEOUT + - btrfs: fix transaction leak and crash after RO remount caused by qgroup + rescan + - bfq: Fix computation of shallow depth + - [arm64] drm/msm: Call msm_init_vram before binding the gpu + - dump_common_audit_data(): fix racy accesses to ->d_name + - [x86] ASoC: Intel: fix error code cnl_set_dsp_D0() + - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock + - pNFS: Mark layout for return if return-on-close was not sent + - NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter + - NFS: nfs_igrab_and_active must first reference the superblock + - ext4: fix superblock checksum failure when setting password salt + - [amd64] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp + - RDMA/mlx5: Fix wrong free of blue flame register on error + - mm, slub: consider rest of partial list if acquire_slab() fails + - net: sunrpc: interpret the return value of kstrtou32 correctly + - dm: eliminate potential source of excessive kernel log noise + - ALSA: firewire-tascam: Fix integer overflow in midi_port_work() + - ALSA: fireface: Fix integer overflow in transmit_midi_msg() + - netfilter: conntrack: fix reading nf_conntrack_buckets + - netfilter: nf_nat: Fix memleak in nf_nat_init + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.170 + - usb: ohci: Make distrust_firmware param default to false + - dm integrity: fix flush with external metadata device + - nfsd4: readdirplus shouldn't return parent of export (CVE-2021-3178) + - udp: Prevent reuseport_select_sock from reading uninitialized socks + - netxen_nic: fix MSI/MSI-x interrupts + - [arm64,armhf] net: mvpp2: Remove Pause and Asym_Pause support + - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request + - esp: avoid unneeded kmap_atomic call + - net: dcb: Validate netlink message in DCB handler + - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands + - rxrpc: Call state should be read with READ_ONCE() under some + circumstances + - [arm64,armhf] net: stmmac: Fixed mtu channged by cache aligned + - net: sit: unregister_netdevice on newlink's error path + - net: avoid 32 x truesize under-estimation for tiny skbs + - rxrpc: Fix handling of an unsupported token type in rxrpc_read() + - tipc: fix NULL deref in tipc_link_xmit() + - net: introduce skb_list_walk_safe for skb segment walking + - net: skbuff: disambiguate argument and member for skb_list_walk_safe + helper + - net: ipv6: Validate GSO SKB before finish IPv6 processing + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.171 + - ALSA: hda/via: Add minimum mute flag + - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error + - btrfs: fix lockdep splat in btrfs_recover_relocation + - mmc: core: don't initialize block size from ext_csd if not present + - [arm64] mmc: sdhci-xenon: fix 1.8v regulator stabilization + - dm: avoid filesystem lookup in dm_get_dev_t() + - dm integrity: fix a crash if "recalculate" used without "internal_hash" + - drm/atomic: put state on error path + - [x86] ASoC: Intel: haswell: Add missing pm_ops + - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback + - scsi: qedi: Correct max length of CHAP secret + - HID: Ignore battery for Elan touchscreen on ASUS UX550 + - xen: Fix event channel callback via INTX/GSI + - drm/nouveau/bios: fix issue shadowing expansion ROMs + - drm/nouveau/privring: ack interrupts the same way as RM + - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields + - drm/nouveau/mmu: fix vram heap sizing + - drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 + - scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression + - i2c: octeon: check correct size of maximum RECV_LEN packet + - [x86] platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 + from allow-list + - can: dev: can_restart: fix use after free bug + - can: vxcan: vxcan_xmit: fix use after free bug + - can: peak_usb: fix use after free bugs + - [mips*] irqchip/mips-cpu: Set IPI domain parent chip + - [x86] intel_th: pci: Add Alder Lake-P support + - [arm64] serial: mvebu-uart: fix tx lost characters at power off + - ehci: fix EHCI host controller initialization sequence + - usb: udc: core: Use lock when write to soft_connect + - xhci: make sure TRB is fully written before giving it to the controller + - [arm64,armhf] xhci: tegra: Delay for disabling LFPS detector + - driver core: Extend device_is_dependent() + - netfilter: rpfilter: mask ecn bits before fib lookup + - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too + - udp: mask TOS bits in udp_v4_early_demux() + - ipv6: create multicast route with RTPROT_KERNEL + - net_sched: avoid shift-out-of-bounds in tcindex_set_parms() + - net_sched: reject silly cell_log in qdisc_get_rtab() + - ipv6: set multicast flag on the multicast route + - net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled + - [armhf] net: dsa: b53: fix an off by one in checking "vlan->vid" + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.165-rt70 + * Bump ABI to 14 + * [rt] Refresh "net/core: protect users of napi_alloc_cache against + reentrance" + * futex: Move futex exit handling into futex code + * futex: Replace PF_EXITPIDONE with a state + * exit/exec: Seperate mm_release() + * futex: Split futex_mm_release() for exit/exec + * futex: Set task::futex_state to DEAD right after handling futex exit + * futex: Mark the begin of futex exit explicitly + * futex: Sanitize exit state handling + * futex: Provide state handling for exec() as well + * futex: Add mutex around futex exit + * futex: Provide distinct return value when owner is exiting + * futex: Prevent exit livelock + * [rt] Refresh "softirq: Split softirq locks" + * [arm*] gpio: mvebu: fix pwm .get_state period calculation + * Revert "mm/slub: fix a memory leak in sysfs_slab_add()" + * futex: Ensure the correct return value from futex_lock_pi() + * futex: Replace pointless printk in fixup_owner() + * futex: Provide and use pi_state_update_owner() + * rtmutex: Remove unused argument from rt_mutex_proxy_unlock() + * futex: Use pi_state_update_owner() in put_pi_state() + * futex: Simplify fixup_pi_state_owner() + * futex: Handle faults correctly for PI futexes + * [rt] Refresh "rtmutex: Handle the various new futex race conditions" + * [rt] Refresh "rtmutex: add sleeping lock implementation" + * [rt] Refresh "Revert "rtmutex: Handle the various new futex race + conditions"" + * [rt] Refresh "futex: Make the futex_hash_bucket lock raw" + * [rt] Refresh "futex: Delay deallocation of pi_state" + * [rt] Refresh "futex: Make the futex_hash_bucket spinlock_t again and bring + back its old state" + * HID: wacom: Correct NULL dereference on AES pen proximity + * tracing: Fix race in trace_open and buffer resize call (CVE-2020-27825) + + [ Uwe Kleine-König ] + * [arm64] Enable support for NXP's PCF85063 RTC (Closes: #972345) + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 29 Jan 2021 23:03:16 +0100 + +linux (4.19.160-2) buster; urgency=medium + + * net: Disable MLX5_ESWITCH on mips and mipsel (Fixes FTBFS) + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 28 Nov 2020 08:47:24 +0100 + +linux (4.19.160-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.153 + - [ppc64el] ibmveth: Switch order of ibmveth_helper calls. + - [ppc64el] ibmveth: Identify ingress large send packets. + - ipv4: Restore flowi4_oif update before call to xfrm_lookup_route + - mlx4: handle non-napi callers to napi_poll + - [armhf] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() + - [armhf] net: fec: Fix PHY init after phy_reset_after_clk_enable() + - net: fix pos incrementment in ipv6_route_seq_next + - net/smc: fix valid DMBE buffer sizes + - net: usb: qmi_wwan: add Cellient MPL200 card + - tipc: fix the skb_unshare() in tipc_buf_append() + - net/ipv4: always honour route mtu during forwarding + - r8169: fix data corruption issue on RTL8402 + - [arm*] binder: fix UAF when releasing todo list (CVE-2020-0423) + - ALSA: bebob: potential info leak in hwdep_read() + - net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device + - [x86,ppc64el] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after + calling ether_setup + - net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels + - nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in + nfc_genl_fw_download() + - tcp: fix to update snd_wl1 in bulk receiver fast path + - r8169: fix operation under forced interrupt threading + - icmp: randomize the global rate limiter (CVE-2020-25705) + - ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 + - cifs: remove bogus debug code + - cifs: Return the error from crypt_message when enc/dec key not found. + - [x86] KVM: x86/mmu: Commit zap of remaining invalid pages when + recovering lpages + - [x86] KVM: SVM: Initialize prev_ga_tag before use + - crypto: algif_aead - Do not set MAY_BACKLOG on the async path + - [x86] EDAC/i5100: Fix error handling order in i5100_init_one() + - [x86] fpu: Allow multiple bits in clearcpuid= parameter + - [arm64] drivers/perf: xgene_pmu: Fix uninitialized resource struct + - [x86] nmi: Fix nmi_handle() duration miscalculation + - [amd64] x86/events/amd/iommu: Fix sizeof mismatch + - crypto: algif_skcipher - EBUSY on aio should be an error + - media: tuner-simple: fix regression in simple_set_radio_freq + - media: uvcvideo: Set media controller entity functions + - media: uvcvideo: Silence shift-out-of-bounds warning + - [armhf] media: omap3isp: Fix memleak in isp_probe + - [armhf] media: ti-vpe: Fix a missing check and reference count leak + - regulator: resolve supply after creating regulator + - ath10k: provide survey info as accumulated data + - Bluetooth: hci_uart: Cancel init work before unregistering + - ath6kl: prevent potential array overflow in ath6kl_add_new_sta() + - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() + - ath10k: Fix the size used in a 'dma_free_coherent()' call in an error + handling path + - [arm64] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 + - [arm64] ASoC: qcom: lpass-platform: fix memory leak + - [arm64] ASoC: qcom: lpass-cpu: fix concurrency issue + - brcmfmac: check ndev pointer + - mwifiex: Do not use GFP_KERNEL in atomic context + - [x86] staging: rtl8192u: Do not use GFP_KERNEL in atomic context + - [x86] drm/gma500: fix error check + - scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' + - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() + - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() + - [x86] VMCI: check return value of get_user_pages_fast() for errors + - [ppc64el] tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() + - pty: do tty_flip_buffer_push without port->lock in pty_write + - [x86] pwm: lpss: Fix off by one error in base_unit math in + pwm_lpss_prepare() + - [x86] pwm: lpss: Add range limit check for the base_unit register value + - [x86] video: fbdev: vga16fb: fix setting of pixclock because a + pass-by-value error + - video: fbdev: sis: fix null ptr dereference + - video: fbdev: radeon: Fix memleak in radeonfb_pci_register + - HID: roccat: add bounds checking in kone_sysfs_write_settings() + - [armhf] pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser + - [armhf] pinctrl: mcp23s08: Fix mcp23x17 precious range + - net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow + - [arm64,armhf] net: stmmac: use netif_tx_start|stop_all_queues() function + - [arm64] cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE + - ath6kl: wmi: prevent a shift wrapping bug in + ath6kl_wmi_delete_pstream_cmd() + - [amd64] misc: mic: scif: Fix error handling path + - [arm*] usb: dwc2: Fix parameter type in function pointer prototype + - quota: clear padding in v2r1_mem2diskdqb() + - HID: hid-input: fix stylus battery reporting + - net: enic: Cure the enic api locking trainwreck + - [mips*] mfd: sm501: Fix leaks in probe() + - iwlwifi: mvm: split a print to avoid a WARNING in ROC + - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. + - usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well + - nl80211: fix non-split wiphy information + - [arm*] usb: dwc2: Fix INTR OUT transfers in DDMA mode. + - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized + - scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() + - mwifiex: fix double free + - ipvs: clear skb->tstamp in forwarding path + - netfilter: nf_log: missing vlan offload tag and proto + - mm/memcg: fix device private memcg accounting + - mm, oom_adj: don't loop through tasks in __set_oom_adj when not + necessary + - IB/mlx4: Fix starvation in paravirt mux/demux + - IB/mlx4: Adjust delayed work when a dup is observed + - [powerpc*] pseries: Fix missing of_node_put() in rng_init() + - [powerpc*] icp-hv: Fix missing of_node_put() in success path + - RDMA/ucma: Fix locking for ctx->events_reported + - RDMA/ucma: Add missing locking around rdma_leave_multicast() + - [powerpc*] pseries: explicitly reschedule during drmem_lmb list + traversal + - mtd: mtdoops: Don't write panic data twice + - [armel,armhf] ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL + using DT values + - xfs: limit entries returned when counting fsmap records + - xfs: fix high key handling in the rt allocator's query_range function + - RDMA/qedr: Fix use of uninitialized field + - RDMA/qedr: Fix inline size returned for iWARP + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.154 + - [powerpc*] 64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm + - RDMA/cma: Remove dead code for kernel rdmacm multicast + - RDMA/cma: Consolidate the destruction of a cma_multicast in one place + - [arm64] RDMA/hns: Set the unsupported wr opcode + - [arm64] RDMA/hns: Fix missing sq_sig_type when querying QP + - overflow: Include header file with SIZE_MAX declaration + - [powerpc*] perf: Exclude pmc5/6 from the irrelevant PMU group + constraints + - [poerpc*] cpufreq: powernv: Fix frame-size-overflow in + powernv_cpufreq_reboot_notifier + - IB/rdmavt: Fix sizeof mismatch + - f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info + - lib/crc32.c: fix trivial typo in preprocessor condition + - rapidio: fix error handling path + - rapidio: fix the missed put_device() for rio_mport_add_riodev + - mailbox: avoid timer start from callback + - [arm64,armhf] clk: rockchip: Initialize hw to error to avoid undefined + behavior + - [arm*] clk: bcm2835: add missing release if devm_clk_hw_register fails + - watchdog: Fix memleak in watchdog_cdev_register + - watchdog: Use put_device on error + - svcrdma: fix bounce buffers for unaligned offsets and multiple pages + - ext4: limit entries returned when counting fsmap records + - vfio/pci: Clear token on bypass registration failure + - [amd64,arm64] vfio iommu type1: Fix memory leak in + vfio_iommu_type1_pin_pages + - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() + - [armhf] Input: omap4-keypad - fix handling of platform_get_irq() error + - [armhf] Input: twl4030_keypad - fix handling of platform_get_irq() error + - [armhf] Input: sun4i-ps2 - fix handling of platform_get_irq() error + - [x86] KVM: emulating RDPID failure shall return #UD rather than #GP + - netfilter: conntrack: connection timeout after re-register + - netfilter: nf_fwd_netdev: clear timestamp in forwarding path + - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator + - [armhf] memory: omap-gpmc: Fix a couple off by ones + - [powerpc*] powernv/dump: Fix race while processing OPAL dump + - nvmet: fix uninitialized work for zero kato + - [x86,arm64] i2c: core: Restore acpi_walk_dep_device_list() getting + called after registering the ACPI i2c devs + - block: ratelimit handle_bad_sector() message + - [x86] crypto: ccp - fix error handling + - media: firewire: fix memory leak + - media: ati_remote: sanity check for both endpoints + - media: media/pci: prevent memory leak in bttv_probe + - media: uvcvideo: Ensure all probed info is returned to v4l2 + - mmc: sdio: Check for CISTPL_VERS_1 buffer size + - media: saa7134: avoid a shift overflow + - fs: dlm: fix configfs memory leak + - [arm64] media: venus: core: Fix runtime PM imbalance in venus_probe + - ip_gre: set dev->hard_header_len and dev->needed_headroom properly + - mac80211: handle lack of sband->bitrates in rates + - PM: hibernate: remove the bogus call to get_gendisk() in + software_resume() + - scsi: mvumi: Fix error return in mvumi_io_attach() + - scsi: target: core: Add CONTROL field for trace events + - [amd64] mic: vop: copy data to kernel space then write to io memory + - [amd64] misc: vop: add round_up(x,4) for vring_size to avoid kernel + panic + - usb: gadget: function: printer: fix use-after-free in __lock_acquire + - udf: Limit sparing table size + - udf: Avoid accessing uninitialized data on failed inode read + - USB: cdc-acm: handle broken union descriptors + - [arm64,armhf] usb: dwc3: simple: add support for Hikey 970 + - [armhf] can: flexcan: flexcan_chip_stop(): add error handling and + propagate error value + - ath9k: hif_usb: fix race condition between usb_get_urb() and + usb_kill_anchored_urbs() + - misc: rtsx: Fix memory leak in rtsx_pci_probe + - reiserfs: only call unlock_new_inode() if I_NEW + - xfs: make sure the rt allocator doesn't run off the end + - usb: ohci: Default to per-port over-current protection + - Bluetooth: Only mark socket zapped after unlocking + - [ppc64el] scsi: ibmvfc: Fix error return in ibmvfc_probe() + - brcmsmac: fix memory leak in wlc_phy_attach_lcnphy + - rtl8xxxu: prevent potential memory leak + - Fix use after free in get_capset_info callback. + - scsi: qedi: Protect active command list to avoid list corruption + - scsi: qedi: Fix list_del corruption while removing active I/O + - [x86] tty: ipwireless: fix error handling + - ipvs: Fix uninit-value in do_ip_vs_set_ctl() + - reiserfs: Fix memory leak in reiserfs_parse_options() + - mwifiex: don't call del_timer_sync() on uninitialized timer + - brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach + - usb: core: Solve race condition in anchor cleanup functions + - ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() + - usb: cdc-acm: add quirk to blacklist ETAS ES58X devices + - USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). + - eeprom: at25: set minimum read/write access stride to 1 + - usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets. + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.155 + - scripts/setlocalversion: make git describe output more reliable + - [arm64] Run ARCH_WORKAROUND_1 enabling code on all CPUs + - [arm64] link with -z norelro regardless of CONFIG_RELOCATABLE + - [x86,arm64,armhf] efivarfs: Replace invalid slashes with exclamation + marks in dentries. + - gtp: fix an use-before-init in gtp_newlink() + - netem: fix zero division in tabledist + - tcp: Prevent low rmem stalls with SO_RCVLOWAT. + - tipc: fix memory leak caused by tipc_buf_append() + - r8169: fix issue with forced threading in combination with shared + interrupts + - cxgb4: set up filter action after rewrites + - [x86] arch/x86/amd/ibs: Fix re-arming IBS Fetch + - [x86] xen: disable Firmware First mode for correctable memory errors + - fuse: fix page dereference after free + - bpf: Fix comment for helper bpf_current_task_under_cgroup() + - p54: avoid accessing the data mapped to streaming DMA + - [powerpc*] cxl: Rework error message for incompatible slots + - RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() + - mtd: lpddr: Fix bad logic in print_drs_error + - [arm*] serial: pl011: Fix lockdep splat when handling magic-sysrq + interrupt + - fscrypt: return -EXDEV for incompatible rename or link into encrypted + dir + - fscrypt: clean up and improve dentry revalidation + - fscrypt: fix race allowing rename() and link() of ciphertext dentries + - fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory + - fscrypt: only set dentry_operations on ciphertext dentries + - fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext + - Revert "block: ratelimit handle_bad_sector() message" + - xen/events: don't use chip_data for legacy IRQs + - xen/events: avoid removing an event channel while handling it + (CVE-2020-27675) + - xen/events: add a proper barrier to 2-level uevent unmasking + (CVE-2020-27673) + - xen/events: fix race in evtchn_fifo_unmask() (CVE-2020-27673) + - xen/events: add a new "late EOI" evtchn framework (CVE-2020-27673) + - xen/blkback: use lateeoi irq binding (CVE-2020-27673) + - xen/netback: use lateeoi irq binding (CVE-2020-27673) + - xen/scsiback: use lateeoi irq binding (CVE-2020-27673) + - xen/pvcallsback: use lateeoi irq binding (CVE-2020-27673) + - xen/pciback: use lateeoi irq binding (CVE-2020-27673) + - xen/events: switch user event channels to lateeoi model (CVE-2020-27673) + - xen/events: use a common cpu hotplug hook for event channels + (CVE-2020-27673) + - xen/events: defer eoi in case of excessive number of events + (CVE-2020-27673) + - xen/events: block rogue events for some time (CVE-2020-27673) + - RDMA/qedr: Fix memory leak in iWARP CM + - ata: sata_nv: Fix retrieving of active qcs + - futex: Fix incorrect should_fail_futex() handling + - [powerpc*] powernv/smp: Fix spurious DBG() warning + - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race + - [powerpc*] select ARCH_WANT_IRQS_OFF_ACTIVATE_MM + - f2fs: add trace exit in exception path + - f2fs: fix uninit-value in f2fs_lookup + - f2fs: fix to check segment boundary during SIT page readahead + - [armel,armhf] 8997/2: hw_breakpoint: Handle inexact watchpoint addresses + - power: supply: bq27xxx: report "not charging" on all types + - xfs: fix realtime bitmap/summary file truncation when growing rt volume + - ath10k: fix VHT NSS calculation when STBC is enabled + - media: videodev2.h: RGB BT2020 and HSV are always full range + - [x86] usb: typec: tcpm: During PR_SWAP, source caps should be sent only + after tSwapSourceStart + - media: tw5864: check status of tw5864_frameinterval_get + - mmc: via-sdmmc: Fix data race bug + - [arm64] topology: Stop using MPIDR for topology information + - media: uvcvideo: Fix dereference of out-of-bound list iterator + - USB: adutux: fix debugging + - uio: free uio id after uio file node is freed + - usb: xhci: omit duplicate actions when suspending a runtime suspended + host. + - [arm64] mm: return cpu_all_mask when node is NUMA_NO_NODE + - xfs: don't free rt blocks when we're doing a REMAP bunmapi call + - ACPI: Add out of bounds and numa_off protections to pxm_to_node() + - drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values + - btrfs: fix replace of seed device + - md/bitmap: md_bitmap_get_counter returns wrong blocks + - bnxt_en: Log unknown link speed appropriately. + - [arm64] rpmsg: glink: Use complete_all for open states + - [armhf] clk: ti: clockdomain: fix static checker warning + - net: 9p: initialize sun_server.sun_path to have addr's value only when + addr is valid + - ext4: Detect already used quota file early + - gfs2: add validation checks for size of superblock + - cifs: handle -EINTR in cifs_setattr + - [armhf] memory: emif: Remove bogus debugfs error handling + - nbd: make the config put is called before the notifying the waiter + - sgl_alloc_order: fix memory leak + - nvme-rdma: fix crash when connect rejected + - md/raid5: fix oops during stripe resizing + - [x86,arm64] mmc: sdhci-acpi: AMDI0040: Set + SDHCI_QUIRK2_PRESET_VALUE_BROKEN + - [x86] perf/x86/amd/ibs: Don't include randomized bits in + get_ibs_op_count() + - [x86] perf/x86/amd/ibs: Fix raw sample data accumulation + - media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect + - fs: Don't invalidate page buffers in block_write_full_page() + - NFS: fix nfs_path in case of a rename retry + - ACPI: button: fix handling lid state changes when input device closed + - [x86] ACPI / extlog: Check for RDMSR failure (Closes: #971058) + - [x86] ACPI: video: use ACPI backlight for HP 635 Notebook + - [x86] acpi-cpufreq: Honor _PSD table setting on new AMD CPUs + - scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() + - scsi: qla2xxx: Fix crash on session cleanup with unload + - btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode + - btrfs: improve device scanning messages + - btrfs: reschedule if necessary when logging directory items + - btrfs: send, recompute reference path after orphanization of a directory + - btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send() + - btrfs: cleanup cow block on error + - btrfs: fix use-after-free on readahead extent after failure to create it + - usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC + - [arm64,armhf] usb: dwc3: ep0: Fix ZLP for OUT ep0 requests + - [arm64,armhf] usb: dwc3: gadget: Check MPS of the request length + - [arm64,armhf] usb: dwc3: core: add phy cleanup for probe error handling + - [arm64,armhf] usb: dwc3: core: don't trigger runtime pm when remove + driver + - usb: cdc-acm: fix cooldown mechanism + - [x86] usb: typec: tcpm: reset hard_reset_count for any disconnect + - [x86] drm/i915: Force VT'd workarounds when running as a guest OS + - vt: keyboard, simplify vt_kdgkbsent + - vt: keyboard, extend func_buf_lock to readers (CVE-2020-25656) + - HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery + - udf: Fix memory leak when mounting + - [powerpc*] drmem: Make lmb_size 64 bit + - [s390x] stp: add locking to sysfs functions + - [powerpc*] rtas: Restrict RTAS requests from userspace (CVE-2020-27777) + - [powerpc*] Warn about use of smt_snooze_delay + - [powerpc*] powernv/elog: Fix race while processing OPAL error log event. + - [powerpc*] Fix undetected data corruption with P9N DD2.1 VSX CI load + emulation + - NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag + - NFSD: Add missing NFSv2 .pc_func methods + - ubifs: dent: Fix some potential memory leaks while iterating entries + - perf python scripting: Fix printable strings in python3 scripts + - ubi: check kthread_should_stop() after the setting of task state + - [armhf] i2c: imx: Fix external abort on interrupt in exit paths + - drm/amdgpu: don't map BO in reserved region + - ceph: promote to unsigned long long before shifting + - libceph: clear con->out_msg on Policy::stateful_server faults + - 9P: Cast to loff_t before multiplying + - ring-buffer: Return 0 on success from ring_buffer_resize() + - [amd64] vringh: fix __vringh_iov() when riov and wiov are different + - ext4: fix leaking sysfs kobject after failed mount + - ext4: fix error handling code in add_new_gdb + - ext4: fix invalid inode checksum + - drm/ttm: fix eviction valuable range check. + - tty: make FONTX ioctl use the tty pointer they were actually passed + (CVE-2020-25668) + - cachefiles: Handle readpage error correctly + - device property: Keep secondary firmware node secondary by type + - device property: Don't clear secondary pointer for shared primary + firmware node + - [arm64] KVM: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR + - [x86] staging: comedi: cb_pcidas: Allow 2-channel commands for AO + subdevice + - [mips*] staging: octeon: repair "fixed-link" support + - [mips*] staging: octeon: Drop on uncorrectable alignment or FCS error + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.156 + - [x86] drm/i915: Break up error capture compression loops with + cond_resched() + - tipc: fix use-after-free in tipc_bcast_get_mode + - ptrace: fix task_join_group_stop() for the case when current is traced + - [arm64] cadence: force nonlinear buffers to be cloned + - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition + - sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms + - [arm64,armhf] sfp: Fix error handing in sfp_probe() + - blktrace: fix debugfs use after free (CVE-2019-19770) + - btrfs: extent_io: Kill the forward declaration of flush_write_bio + - btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up + - Revert "btrfs: flush write bio if we loop in extent_write_cache_pages" + - btrfs: flush write bio if we loop in extent_write_cache_pages + - btrfs: extent_io: Handle errors better in extent_write_full_page() + - btrfs: extent_io: Handle errors better in btree_write_cache_pages() + - btrfs: extent_io: add proper error handling to + lock_extent_buffer_for_io() + - Btrfs: fix unwritten extent buffers and hangs on future writeback + attempts + - btrfs: Don't submit any btree write bio if the fs has errors + (CVE-2019-19039, CVE-2019-19377) + - btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it + - btrfs: tree-checker: Make chunk item checker messages more readable + - btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN + instead of EIO + - btrfs: tree-checker: Check chunk item at tree block read time + - btrfs: tree-checker: Verify dev item + - btrfs: tree-checker: Fix wrong check on max devid + - btrfs: tree-checker: Enhance chunk checker to validate chunk profile + (CVE-2019-19816) + - btrfs: tree-checker: Verify inode item + - btrfs: tree-checker: fix the error message for transid error + - Fonts: Replace discarded const qualifier + - ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 + - ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices + - ALSA: usb-audio: Add implicit feedback quirk for Qu-16 + - ALSA: usb-audio: Add implicit feedback quirk for MODX + - mm: mempolicy: fix potential pte_unmap_unlock pte error + - kthread_worker: prevent queuing delayed work from timer_fn when it is + being canceled + - mm: always have io_remap_pfn_range() set pgprot_decrypted() + - gfs2: Wake up when sd_glock_disposal becomes zero + - ring-buffer: Fix recursion protection transitions between interrupt + context + - ftrace: Fix recursion check for NMI test + - ftrace: Handle tracing when switching between context + - tracing: Fix out of bounds write in get_trace_buf + - futex: Handle transient "ownerless" rtmutex state correctly + - [amd64] x86/kexec: Use up-to-dated screen_info copy to fill boot params + - of: Fix reserved-memory overlap detection + - blk-cgroup: Fix memleak on error path + - blk-cgroup: Pre-allocate tree node on blkg_conf_prep + - scsi: core: Don't start concurrent async scan on same host + - vsock: use ns_capable_noaudit() on socket create + - [arm*] drm/vc4: drv: Add error handding for bind + - [amd64,arm64] ACPI: NFIT: Fix comparison to '-ENXIO' + - vt: Disable KD_FONT_OP_COPY (CVE-2020-28974) + - fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent + - USB: serial: cyberjack: fix write-URB completion race + - USB: serial: option: add Quectel EC200T module support + - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 + - USB: serial: option: add Telit FN980 composition 0x1055 + - USB: Add NO_LPM quirk for Kingston flash drive + - PM: runtime: Resume the device earlier in __device_release_driver() + - perf/core: Fix a memory leak in perf_event_parse_addr_filter() + (CVE-2020-25704) + - tools: perf: Fix build error in v4.19.y + - [arm64,armhf] net: dsa: read mac address from DT for slave device + - [arm64] dts: marvell: espressobin: Add ethernet switch aliases + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.157 + - [x86] powercap: restrict energy meter to root access (CVE-2020-8694) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.158 + - regulator: defer probe when trying to get voltage from unresolved supply + - time: Prevent undefined behaviour in timespec64_to_ns() + - nbd: don't update block size after device is started + - [arm64,armhf] usb: dwc3: gadget: Continue to process pending requests + - [arm64,armhf] usb: dwc3: gadget: Reclaim extra TRBs after request + completion + - btrfs: sysfs: init devices outside of the chunk_mutex + - btrfs: reschedule when cloning lots of extents + - [x86] hv_balloon: disable warning when floor reached + - net: xfrm: fix a race condition during allocing spi + - xfs: set xefi_discard when creating a deferred agfl free log intent item + - netfilter: ipset: Update byte and packet counters regardless of whether + they match + - perf tools: Add missing swap for ino_generation + - [x86] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() + - can: rx-offload: don't call kfree_skb() from IRQ context + - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ + context + - can: dev: __can_get_echo_skb(): fix real payload length return value for + RTR frames + - can: can_create_echo_skb(): fix echo skb generation: always use + skb_clone() + - can: peak_usb: add range checking in decode operations + - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping + - can: peak_canfd: pucan_handle_can_rx(): fix echo management when + loopback is on + - [armhf] can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for + LS1021A + - xfs: flush new eof page on truncate to avoid post-eof corruption + - [arm64,x86] tpm: efi: Don't create binary_bios_measurements file for an + empty log + - Btrfs: fix missing error return if writeback for extent buffer never + started + - ath9k_htc: Use appropriate rs_datalen type + - netfilter: use actual socket sk rather than skb sk when routing harder + - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free + - gfs2: Add missing truncate_inode_pages_final for sd_aspace + - gfs2: check for live vs. read-only file system in gfs2_fitrim + - scsi: hpsa: Fix memory leak in hpsa_init_one() + - drm/amdgpu: perform srbm soft reset always on SDMA resume + - mac80211: fix use of skb payload instead of header + - cfg80211: regulatory: Fix inconsistent format argument + - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() + - [s390x] smp: move rcu_cpu_starting() earlier + - [x86] tpm_tis: Disable interrupts on ThinkPad T490s + - tick/common: Touch watchdog in tick_unfreeze() on all CPUs + - [x86] pinctrl: intel: Set default bias in case no particular value given + - [armel,armhf] 9019/1: kprobes: Avoid fortify_panic() when copying + optprobe template + - nbd: fix a block_device refcount leak in nbd_release + - xfs: fix flags argument to rmap lookup when converting shared file rmaps + - xfs: fix rmap key and record comparison functions + - lan743x: fix "BUG: invalid wait context" when setting rx mode + - xfs: fix a missing unlock on error in xfs_fs_map_blocks + - of/address: Fix of_node memory leak in of_dma_is_coherent + - [i386] cosa: Add missing kfree in error path of cosa_write + - perf: Fix get_recursion_context() + - ext4: correctly report "not supported" for {usr,grp}jquota when + !CONFIG_QUOTA + - ext4: unlock xattr_sem properly in ext4_inline_data_truncate() + - btrfs: dev-replace: fail mount if we don't have replace item with target + device + - [x86] thunderbolt: Fix memory leak if ida_simple_get() fails in + enumerate_services() + - [x86] thunderbolt: Add the missed ida_simple_remove() in + ring_request_msix() + - uio: Fix use-after-free in uio_unregister_device() + - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode + - futex: Don't enable IRQs unconditionally in put_pi_state() + - ocfs2: initialize ip_next_orphan + - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch + - selinux: Fix error return code in sel_ib_pkey_sid_slow() + - gpio: pcie-idio-24: Fix irq mask when masking + - gpio: pcie-idio-24: Fix IRQ Enable Register value + - gpio: pcie-idio-24: Enable PEX8311 interrupts + - don't dump the threads that had been already exiting when zapped. + - [x86] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] + - pinctrl: amd: use higher precision for 512 RtcClk + - pinctrl: amd: fix incorrect way to disable debounce filter + - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" + - IPv6: Set SIT tunnel hard_header_len to zero + - [s390x] net/af_iucv: fix null pointer dereference on shutdown + - net: Update window_clamp if SOCK_RCVBUF is set + - tipc: fix memory leak in tipc_topsrv_start() + - vrf: Fix fast path output packet handling with async Netfilter rules + - r8169: fix potential skb double free in an error path + - random32: make prandom_u32() output unpredictable + - [x86] speculation: Allow IBPB to be conditionally enabled on CPUs with + always-on STIBP + - perf/core: Fix race in the perf_mmap_close() function (CVE-2020-14351) + - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" + - reboot: fix overflow parsing reboot cpu number + - net: sch_generic: fix the missing new qdisc assignment bug + - Convert trailing spaces and periods in path components + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.159 + - [powerpc*] 64s: move some exception handlers out of line + - [powerpc*] 64s: flush L1D on kernel entry (CVE-2020-4788) + - [powerpc*] Add a framework for user access tracking + - [powerpc*] Implement user_access_begin and friends + - [powerpc*] Fix __clear_user() with KUAP enabled + - [powerpc*] uaccess: Evaluate macro arguments once, before user access is + allowed + - [powerpc*] 64s: flush L1D after user accesses (CVE-2020-4788) + - Revert "perf cs-etm: Move definition of 'traceid_list' global variable + from header file" + - Input: sunkbd - avoid use-after-free in teardown paths (CVE-2020-25669) + - mac80211: always wind down STA state + - can: proc: can_remove_proc(): silence remove_proc_entry warning + - [x86] KVM: x86: clflushopt should be treated as a no-op by emulation + - [arm64] ACPI: GED: fix -Wformat + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.160 + - ah6: fix error return code in ah6_input() + - atm: nicstar: Unmap DMA on send error + - bnxt_en: read EEPROM A2h address using page 0 + - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() + - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() + - lan743x: fix issue causing intermittent kernel log warnings + - lan743x: prevent entire kernel HANG on open, for some platforms + - net: b44: fix error return code in b44_init_one() + - net: bridge: add missing counters to ndo_get_stats64 callback + - [arm64,armhf] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 + - net: Have netpoll bring-up DSA management interface + - net/mlx4_core: Fix init_hca fields offset + - page_frag: Recover from memory pressure + - qed: fix error return code in qed_iwarp_ll2_start() + - qlcnic: fix error return code in qlcnic_83xx_restart_hw() + - sctp: change to hold/put transport for proto_unreach_timer + - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate + - [arm64,armhf] net/mlx5: Disable QoS when min_rates on all VFs are zero + - net: usb: qmi_wwan: Set DTR quirk for MR400 + - [arm64,armhf] pinctrl: rockchip: enable gpio pclk for + rockchip_gpio_to_irq + - scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() + - [x86] ACPI: button: Add DMI quirk for Medion Akoya E2228T + - [arm64] psci: Avoid printing in cpu_psci_cpu_die() + - vfs: remove lockdep bogosity in __sb_start_write + - [arm64] dts: allwinner: a64: Pine64 Plus: Fix ethernet node + - [arm64] dts: allwinner: h5: OrangePi PC2: Fix ethernet node + - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node + - [armhf] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to + active high" + - [armhf] dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on + Ethernet PHY + - [armhf] dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY + - [arm64] dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on + PHY + - [mips*] export has_transparent_hugepage() for modules + - [arm64] dts: allwinner: h5: OrangePi Prime: Fix ethernet node + - perf lock: Don't free "lock_seq_stat" if read_count isn't zero + - ip_tunnels: Set tunnel option flag when tunnel metadata is present + - can: af_can: prevent potential access of uninitialized member in + can_rcv() + - can: af_can: prevent potential access of uninitialized member in + canfd_rcv() + - can: dev: can_restart(): post buffer from the right context + - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to + can_put_echo_skb() + - can: peak_usb: fix potential integer overflow on shift of a int + - [arm64] ASoC: qcom: lpass-platform: Fix memory leak + - [arm64,armhf] drm/sun4i: dw-hdmi: fix error return code in + sun8i_dw_hdmi_bind() + - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits + - [armhf] regulator: ti-abb: Fix array out of bound read access on the + first transition + - xfs: revert "xfs: fix rmap key and record comparison functions" + - [amd64] efi/x86: Free efi_pgd with free_pages() + - libfs: fix error cast of negative value in simple_attr_write() + - speakup: Do not let the line discipline be used several times + (CVE-2020-28941) + - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() + - ALSA: usb-audio: Add delay quirk for all Logitech USB devices + - ALSA: ctl: fix error path at adding user-defined element set + - ALSA: mixart: Fix mutex deadlock + - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) + - [armhf] tty: serial: imx: keep console clocks always on + - [arm64,armhf,x86] efivarfs: fix memory leak in efivarfs_create() + - [arm64,x86] staging: rtl8723bs: Add 024c:0627 to the list of SDIO + device-ids + - ext4: fix bogus warning in ext4_update_dx_flag() + - [x86] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type + enum + - [x86] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for + setting tablet-mode + - [armhf] regulator: pfuze100: limit pfuze-support-disable-sw to + pfuze{100,200} + - regulator: fix memory leak with repeated set_machine_constraints() + - regulator: avoid resolve_supply() infinite recursion + - regulator: workaround self-referent regulators + - mac80211: minstrel: remove deferred sampling code + - mac80211: minstrel: fix tx status processing corner case + - mac80211: free sta in sta_info_insert_finish() on errors + - [s390x] cpum_sf.c: fix file permission for cpum_sfb_size + - [s390x] dasd: fix null pointer dereference for ERP requests + - ptrace: Set PF_SUPERPRIV when checking capability + - seccomp: Set PF_SUPERPRIV when checking capability + - [x86] microcode/intel: Check patch signature before saving microcode for + early loading + - mm/userfaultfd: do not access vma->vm_mm after calling + handle_userfault() + + [ Salvatore Bonaccorso ] + * net: Enable NET_SWITCHDEV; disable on armel/marvell (Closes: #949863) + * Bump ABI to 13 + * [rt] Update to 4.19.152-rt65 + * [rt] Refresh "mm: Protect activate_mm() by preempt_[disable&enable]_rt()" + * [rt] Refresh "kthread: convert worker lock to raw spinlock" + * [rt] Refresh "signals: Allow rt tasks to cache one sigqueue struct" + * [rt] Refresh "tpm_tis: fix stall after iowrite*()s" + * [rt] Refresh "futex: Delay deallocation of pi_state" + * [rt] Refresh "futex: Make the futex_hash_bucket spinlock_t again" + * [rt] Update to 4.19.152-rt66 + - mm/memcontrol: Disable preemption in __mod_memcg_lruvec_state() + - ptrace: fix ptrace_unfreeze_traced() race with rt-lock + * [rt] Update to 4.19.160-rt69 + + [ Noah Meyerhans ] + * Backport upstream fix for PCI bridge firmware configuration preservation + (Closes: #968623) + + [ John L. Villalovos ] + * Backport support for USB Host Controllers with local memory to avoid + crashes. In particular the Renesas USB 3.0 controller (PD720201/PD720202) + which is used on the Ampere's Mt Jade platform which is part of their + Altra product line: + - lib/genalloc: add gen_pool_dma_zalloc() for zeroed DMA allocations + - USB: use genalloc for USB HCs with local memory + - USB: drop HCD_LOCAL_MEM flag + - usb: don't create dma pools for HCDs with a localmem_pool + - usb: add a hcd_uses_dma helper + - usb: host: ohci-sm501: init genalloc for local memory + - usb/hcd: Fix a NULL vs IS_ERR() bug in usb_hcd_setup_local_mem() + * [arm64] config/arm64/config: Set NODES_SHIFT to 4 + + [ Yves-Alexis Perez ] + * usbnet: ipheth: fix connectivity with iOS 14 + + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 26 Nov 2020 21:23:20 +0100 + +linux (4.19.152-1) buster-security; urgency=high + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.147 + - [arm64,armhf] dsa: Allow forwarding of redirected IGMP traffic + - scsi: qla2xxx: Update rscn_rcvd field to more meaningful scan_needed + - scsi: qla2xxx: Move rport registration out of internal work_list + - scsi: qla2xxx: Reduce holding sess_lock to prevent CPU lock-up + - net: handle the return value of pskb_carve_frag_list() correctly + - [x86] hv_netvsc: Remove "unlikely" from netvsc_select_queue + - NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation + recall + - scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort + - scsi: libfc: Fix for double free() + - scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery + - [arm64] regulator: pwm: Fix machine constraints application + - NFS: Zero-stateid SETATTR should first return delegation + - SUNRPC: stop printk reading past end of string + - nvme-fc: cancel async events before freeing event struct + - nvme-rdma: cancel async events before freeing event struct + - f2fs: fix indefinite loop scanning for free nid + - f2fs: Return EOF on unaligned end of file DIO read + - i2c: algo: pca: Reapply i2c bus settings after reset + - spi: Fix memory leak on splited transfers + - [arm64,armhf] clk: rockchip: Fix initialization of mux_pll_src_4plls_p + - [arm64] ASoC: qcom: Set card->owner to avoid warnings + - [x86] Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload + - fbcon: Fix user font detection test at fbcon_resize(). + - USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin + notebook + - USB: UAS: fix disconnect by unplugging a hub + - usblp: fix race between disconnect() and read() + - [x86] i2c: i801: Fix resume bug + - Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI + X570-A PRO" + - percpu: fix first chunk size calculation for populated bitmap + - Input: trackpoint - add new trackpoint variant IDs + - serial: 8250_pci: Add Realtek 816a and 816b + - ehci-hcd: Move include to keep CRC stable + - [powerpc*] dma: Fix dma_map_ops::get_required_mask + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.148 + - af_key: pfkey_dump needs parameter validation + - KVM: fix memory leak in kvm_io_bus_unregister_dev() + - kprobes: fix kill kprobe which has been marked as gone + - mm/thp: fix __split_huge_pmd_locked() for migration PMD + - cxgb4: Fix offset when clearing filter byte counters + - geneve: add transport ports in route lookup for geneve (CVE-2020-25645) + - [x86,ppc64el] hdlc_ppp: add range checks in ppp_cp_parse_cr() + (CVE-2020-25643) + - ip: fix tos reflection in ack and reset packets + - ipv6: avoid lockdep issue in fib6_del() + - net: DCB: Validate DCB_ATTR_DCB_BUFFER argument + - net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC + - net: sch_generic: aviod concurrent reset and enqueue op for lockless + qdisc + - nfp: use correct define to return NONE fec + - tipc: Fix memory leak in tipc_group_create_member() + - tipc: fix shutdown() of connection oriented socket + - tipc: use skb_unshare() instead in tipc_buf_append() + - bnxt_en: return proper error codes in bnxt_show_temp + - bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex. + - net: phy: Avoid NPD upon phy_detach() when driver is unbound + - net: add __must_check to skb_put_padto() + - ipv4: Update exception handling for multipath routes via same device + - kbuild: add OBJSIZE variable for the size tool + - mm: memcg: fix memcg reclaim soft lockup + - tcp_bbr: refactor bbr_target_cwnd() for general inflight provisioning + - tcp_bbr: adapt cwnd based on ack aggregation estimation + - serial: 8250: Avoid error message on reprobe + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.149 + - selinux: allow labeling before policy is loaded + - media: mc-device.c: fix memleak in media_device_register_entity + - dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling) + - ath10k: fix array out-of-bounds access + - ath10k: fix memory leak for tpc_stats_final + - mm: fix double page fault on arm64 if PTE_AF is cleared + - scsi: aacraid: fix illegal IO beyond last LBA + - [x86] gma/gma500: fix a memory disclosure bug due to uninitialized bytes + - [armel,armhf] ASoC: kirkwood: fix IRQ error handling + - [amd64] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache + writeback + - [x86] ioapic: Unbreak check_timer() + - ALSA: usb-audio: Add delay quirk for H570e USB headsets + - ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged + - ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation + P520 + - lib/string.c: implement stpcpy + - [armhf] PM / devfreq: tegra30: Fix integer overflow on CPU's freq max + out + - [x86] scsi: fnic: fix use after free + - scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port + bounce + - net: silence data-races on sk_backlog.tail + - [armhf] clk/ti/adpll: allocate room for terminating null + - mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of + cfi_amdstd_setup() + - mfd: mfd-core: Protect against NULL call-back function pointer + - [x86] tpm_crb: fix fTPM on AMD Zen+ CPUs + - tracing: Adding NULL checks for trace_array descriptor pointer + - bcache: fix a lost wake-up problem caused by mca_cannibalize_lock + - RDMA/qedr: Fix potential use after free + - RDMA/i40iw: Fix potential use after free + - fix dget_parent() fastpath race + - xfs: fix attr leaf header freemap.size underflow + - RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()' + - ubi: Fix producing anchor PEBs + - mmc: core: Fix size overflow for mmc partitions + - gfs2: clean up iopen glock mess in gfs2_create_inode + - scsi: pm80xx: Cleanup command when a reset times out + - CIFS: Properly process SMB3 lease breaks + - ASoC: max98090: remove msleep in PLL unlocked workaround + - kernel/sys.c: avoid copying possible padding bytes in copy_to_user + - [arm64,armhf] KVM: vgic: Fix potential double free dist->spis in + __kvm_vgic_destroy() + - xfs: fix log reservation overflows when allocating large rt extents + - neigh_stat_seq_next() should increase position index + - rt_cpu_seq_next should increase position index + - ipv6_route_seq_next should increase position index + - seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier + - sctp: move trace_sctp_probe_path into sctp_outq_sack + - [arm64,x86] ACPI: EC: Reference count query handlers under lock + - scsi: ufs: Make ufshcd_add_command_trace() easier to read + - scsi: ufs: Fix a race condition in the tracing code + - [s390x] /cpum_sf: Use kzalloc and minor changes + - [powerpc*] eeh: Only dump stack once if an MMIO loop is detected + - Bluetooth: btrtl: Use kvmalloc for FW allocations + - [armel,armhf] ARM: 8948/1: Prevent OOB access in stacktrace + - ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter + - ceph: ensure we have a new cap before continuing in fill_inode + - Bluetooth: Fix refcount use-after-free issue + - mm/swapfile.c: swap_next should increase position index + - mm: pagewalk: fix termination condition in walk_pte_range() + - Bluetooth: prefetch channel before killing sock + - KVM: fix overflow of zero page refcount with ksm running + - ALSA: hda: Clear RIRB status before reading WP + - skbuff: fix a data race in skb_queue_len() + - audit: CONFIG_CHANGE don't log internal bookkeeping as an event + - selinux: sel_avc_get_stat_idx should increase position index + - scsi: lpfc: Fix RQ buffer leakage when no IOCBs available + - scsi: lpfc: Fix coverity errors in fmdi attribute handling + - [armhf] drm/omap: fix possible object reference leak + - crypto: chelsio - This fixes the kernel panic which occurs during a + libkcapi test + - mt76: clear skb pointers from rx aggregation reorder buffer during + cleanup + - ALSA: usb-audio: Don't create a mixer element with bogus volume range + - [s390x] perf test: Fix test trace+probe_vfs_getname.sh on s390 + - RDMA/rxe: Fix configuration of atomic queue pair attributes + - [x86] KVM: x86: fix incorrect comparison in trace event + - [x86] pkeys: Add check for pkey "overflow" + - bpf: Remove recursion prevention from rcu free callback + - [arm64,armhf] dmaengine: tegra-apb: Prevent race conditions on channel's + freeing + - random: fix data races at timer_rand_state + - [arm64] bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free + in host removal + - media: go7007: Fix URB type for interrupt handling + - Bluetooth: guard against controllers sending zero'd events + - timekeeping: Prevent 32bit truncation in scale64_check_overflow() + - ext4: fix a data race at inode->i_disksize + - mm: avoid data corruption on CoW fault into PFN-mapped VMA + - drm/amdgpu: increase atombios cmd timeout + - ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read + - scsi: aacraid: Disabling TM path and only processing IOP reset + - Bluetooth: L2CAP: handle l2cap config request during open state + - media: tda10071: fix unsigned sign extension overflow + - xfs: don't ever return a stale pointer from __xfs_dir3_free_read + - xfs: mark dir corrupt when lookup-by-hash fails + - ext4: mark block bitmap corrupted when found instead of BUGON + - nfsd: Don't add locks to closed or closing open stateids + - RDMA/cm: Remove a race freeing timewait_info + - [powerpc*] KVM: PPC: Book3S HV: Treat TM-related invalid form + instructions on P9 like the valid ones + - [arm64] drm/msm: fix leaks if initialization fails + - [arm64] drm/msm/a5xx: Always set an OPP supported hardware value + - serial: 8250_port: Don't service RX FIFO if throttled + - [powerpc*] cpufreq: powernv: Fix frame-size-overflow in + powernv_cpufreq_work_fn + - nvme-multipath: do not reset on unknown status + - nvme: Fix controller creation races with teardown flow + - RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices + - scsi: hpsa: correct race condition in offload enabled + - SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()' + - svcrdma: Fix leak of transport addresses + - PCI: Use ioremap(), not phys_to_virt() for platform ROM + - ubifs: Fix out-of-bounds memory access caused by abnormal value of + node_len + - ALSA: usb-audio: Fix case when USB MIDI interface has more than one + extra endpoint descriptor + - PCI: pciehp: Fix MSI interrupt race + - NFS: Fix races nfs_page_group_destroy() vs + nfs_destroy_unlinked_subrequests() + - mm/kmemleak.c: use address-of operator on section symbols + - mm/filemap.c: clear page error before actual read + - mm/vmscan.c: fix data races using kswapd_classzone_idx + - nvmet-rdma: fix double free of rdma queue + - mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area + - scsi: qedi: Fix termination timeouts in session logout + - [arm64] serial: uartps: Wait for tx_empty in console setup + - [x86] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race + - bdev: Reduce time holding bd_mutex in sync in blkdev_close() + - [x86] drivers: char: tlclk.c: Avoid data race between init and interrupt + handler + - [arm64] KVM: vgic-its: Fix memory leak on the error path of + vgic_add_lpi() + - net: openvswitch: use u64 for meter bucket + - scsi: aacraid: Fix error handling paths in aac_probe_one() + - staging:r8188eu: avoid skb_clone for amsdu to msdu conversion + - [arm64] cpufeature: Relax checks for AArch32 support at EL[0-2] + - dt-bindings: sound: wm8994: Correct required supplies based on actual + implementaion + - atm: fix a memory leak of vcc->user_back + - Bluetooth: Handle Inquiry Cancel error after Inquiry Complete + - tipc: fix memory leak in service subscripting + - [armhf] tty: serial: samsung: Correct clock selection logic + - ALSA: hda: Fix potential race in unsol event handler + - [powerpc*] traps: Make unrecoverable NMIs die instead of panic + - fuse: don't check refcount after stealing page + - [powerpc*] scsi: cxlflash: Fix error return code in cxlflash_probe() + - [arm64] cpufeature: Drop TraceFilt feature exposure from ID_DFR0 + register + - e1000: Do not perform reset in reset_task if we are already down + - drm/nouveau/debugfs: fix runtime pm imbalance on error + - drm/nouveau: fix runtime pm imbalance on error + - drm/nouveau/dispnv50: fix runtime pm imbalance on error + - printk: handle blank console arguments passed in. + - [arm64,armhf] usb: dwc3: Increase timeout for CmdAct cleared by device + controller + - btrfs: don't force read-only after error in drop snapshot + - vfio/pci: fix memory leaks of eventfd ctx + - perf trace: Fix the selection for architectures to generate the errno + name tables + - [arm64,armhf] wlcore: fix runtime pm imbalance in wl1271_tx_work + - [arm64,armhf] wlcore: fix runtime pm imbalance in + wlcore_regdomain_config + - [arm64,armhf] PCI: tegra: Fix runtime PM imbalance on error + - ceph: fix potential race in ceph_check_caps + - mm/swap_state: fix a data race in swapin_nr_pages + - [armel] mtd: parser: cmdline: Support MTD names containing one or more + colons + - [x86] speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline + - vfio/pci: Clear error and request eventfd ctx after releasing + - cifs: Fix double add page to memcg when cifs_readpages + - nvme: fix possible deadlock when I/O is blocked + - scsi: libfc: Handling of extra kref + - scsi: libfc: Skip additional kref updating work event + - vfio/pci: fix racy on error and request eventfd ctx + - btrfs: qgroup: fix data leak caused by race between writeback and + truncate + - net: openvswitch: use div_u64() for 64-by-32 divisions + - nvme: explicitly update mpath disk capacity on revalidation + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 + - [s390x] init: add missing __init annotations + - lockdep: fix order in trace_hardirqs_off_caller() + - [amd64] drm/amdkfd: fix a memory leak issue + - i2c: core: Call i2c_acpi_install_space_handler() before + i2c_acpi_register_devices() + - mwifiex: Increase AES key storage size to 256 bits + - batman-adv: bla: fix type misuse for backbone_gw hash indexing + - atm: eni: fix the missed pci_disable_device() for eni_init_one() + - batman-adv: mcast/TT: fix wrongly dropped or rerouted packets + - mac802154: tx: fix use-after-free + - bpf: Fix clobbering of r2 in bpf_gen_ld_abs + - [arm*] drm/vc4/vc4_hdmi: fill ASoC card owner + - net: qed: RDMA personality shouldn't fail VF load + - batman-adv: Add missing include for in_interrupt() + - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh + - batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh + - bpf: Fix a rcu warning for bpffs map pretty-print + - [x86] ALSA: asihpi: fix iounmap in error handler + - regmap: fix page selection for noinc reads + - [x86] KVM: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE + - [x86] KVM: SVM: Add a dedicated INVD intercept routine + - tracing: fix double free + - [s390x] dasd: Fix zero write for FBA devices + - kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() + - mm, THP, swap: fix allocating cluster for swapfile by mistake + - [s390x] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl + - ata: define AC_ERR_OK + - ata: make qc_prep return ata_completion_errors + - ata: sata_mv, avoid trigerrable BUG_ON + - [arm64] KVM: Assume write fault on S1PTW permission fault on instruction + fetch + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.150 + - mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS + models + - USB: gadget: f_ncm: Fix NDP16 datagram validation + - vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock + - vsock/virtio: stop workers during the .remove() + - vsock/virtio: add transport parameter to the + virtio_transport_reset_no_sock() + - net: virtio_vsock: Enhance connection semantics + - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 + - ftrace: Move RCU is watching check after recursion check + - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config + - drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices + - [armhf] drm/sun4i: mixer: Extend regmap max_register + - net: dec: de2104x: Increase receive ring size for Tulip + - rndis_host: increase sleep time in the query-response loop + - nvme-core: get/put ctrl and transport module in nvme_dev_open/release() + - [x86,ppc64el] drivers/net/wan/hdlc: Set skb->protocol before + transmitting + - mac80211: do not allow bigger VHT MPDUs than the hardware supports + - nvme-fc: fail new connections to a deleted host or remote port + - [armhf] pinctrl: mvebu: Fix i2c sda definition for 98DX3236 + - nfs: Fix security label length not being reset + - [armhf] clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED + - Input: trackpoint - enable Synaptics trackpoints + - random32: Restore __latent_entropy attribute on net_rand_state + - mm: replace memmap_context by meminit_context + - mm: don't rely on system state to detect hot-plug operations + - epoll: do not insert into poll queues until all sanity checks are done + - epoll: replace ->visited/visited_list with generation count + - epoll: EPOLL_CTL_ADD: close the race in decision to take fast path + - ep_create_wakeup_source(): dentry name can change under you... + - netfilter: ctnetlink: add a range check for l3/l4 protonum + (CVE-2020-25211) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.151 + - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h + - Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts + - fbcon: Fix global-out-of-bounds read in fbcon_get_font() + - net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() + - drm/nouveau/mem: guard against NULL pointer access in mem_del + - usermodehelper: reset umask to default before executing user process + - [x86] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on + the HP Pavilion 11 x360 + - [x86] platform/x86: thinkpad_acpi: initialize tp_nvram_state variable + - [x86] platform/x86: intel-vbtn: Switch to an allow-list for + SW_TABLET_MODE reporting + - [x86] platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when + reuse + - driver core: Fix probe_count imbalance in really_probe() + - [x86] i2c: i801: Exclude device from suspend direct complete + optimization + - [armhf] mtd: rawnand: sunxi: Fix the probe error path + - nvme-core: put ctrl ref when module ref get fail + - macsec: avoid use-after-free in macsec_handle_frame() + - mm/khugepaged: fix filemap page_to_pgoff(page) != offset + - xfrmi: drop ignore_df check before updating pmtu + - cifs: Fix incomplete memory allocation on setxattr path + - [arm64,armhf] i2c: meson: fix clock setting overwrite + - [arm64,armhf] i2c: meson: fixup rate calculation with filter delay + - sctp: fix sctp_auth_init_hmacs() error path + - team: set dev->needed_headroom in team_setup_by_port() + - net: team: fix memory leak in __team_options_register + - openvswitch: handle DNAT tuple collision + - drm/amdgpu: prevent double kfree ttm->sg + - xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate + - xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate + - xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate + - xfrm: clone whole liftime_cur structure in xfrm_do_migrate + - [arm64,armhf] net: stmmac: removed enabling eee in EEE set callback + - xfrm: Use correct address family in xfrm_state_find + - bonding: set dev->needed_headroom in bond_setup_by_slave() + - net: usb: ax88179_178a: fix missing stop entry in driver_info + - net/mlx5e: Fix VLAN cleanup flow + - net/mlx5e: Fix VLAN create flow + - rxrpc: Fix rxkad token xdr encoding + - rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() + - rxrpc: Fix some missing _bh annotations on locking conn->state_lock + - rxrpc: Fix server keyring leak + - perf: Fix task_function_call() error handling + - mmc: core: don't set limits.discard_granularity as 0 + - mm: khugepaged: recalculate min_free_kbytes after memory hotplug as + expected by khugepaged + - net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.152 + - Bluetooth: A2MP: Fix not initializing all members (CVE-2020-12352) + - Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel + (CVE-2020-12351) + - Bluetooth: MGMT: Fix not checking if BT_HS is enabled + - Bluetooth: Consolidate encryption handling in hci_encrypt_cfm + - Bluetooth: Fix update of connection state in `hci_encrypt_cfm` + - Bluetooth: Disconnect if E0 is used for Level 4 + - media: usbtv: Fix refcounting mixup + - USB: serial: option: add Cellient MPL200 card + - USB: serial: option: Add Telit FT980-KS composition + - [x86] staging: comedi: check validity of wMaxPacketSize of usb endpoints + found + - USB: serial: pl2303: add device-id for HP GC device + - USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters + - reiserfs: Initialize inode keys properly + - reiserfs: Fix oops during mount + - [arm*] drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case + (Closes: #908712) + - [x86] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.148-rt64 + * Bump ABI to 12 + * Revert "perf cs-etm: Move definition of 'traceid_list' global variable + from header file" + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 18 Oct 2020 10:43:18 +0200 + +linux (4.19.146-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.133 + - [s390x] KVM: s390: reduce number of IO pins to 1 + - regmap: fix alignment issue + - [arm64,armhf] drm/tegra: hub: Do not enable orphaned window group + - [arm64,armhf] gpu: host1x: Detach driver on unregister + - spi: spidev: fix a race between spidev_release and spidev_remove + - spi: spidev: fix a potential use-after-free in spidev_release() + - ixgbe: protect ring accesses with READ- and WRITE_ONCE + - i40e: protect ring accesses with READ- and WRITE_ONCE + - [x86] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel + - [x86] drm: panel-orientation-quirks: Use generic orientation-data for + Acer S1003 + - cifs: update ctime and mtime during truncate + - [armhf] imx6: add missing put_device() call in imx6q_suspend_init() + - scsi: mptscsih: Fix read sense data size + - [arm64] usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work + - block: release bip in a right way in error path + - nvme-rdma: assign completion vector correctly + - [x86] entry: Increase entry_stack size to a full page + - net: cxgb4: fix return error value in t4_prep_fw + - smsc95xx: check return value of smsc95xx_reset + - smsc95xx: avoid memory leak in smsc95xx_bind + - [arm64] net: hns3: fix use-after-free when doing self test + - [x86] ALSA: compress: fix partial_drain completion state + - nbd: Fix memory leak in nbd_add_socket + - cxgb4: fix all-mask IP address comparison + - bnxt_en: fix NULL dereference in case SR-IOV configuration fails + - [arm64] net: macb: mark device wake capable when "magic-packet" property + present + - ALSA: opl3: fix infoleak in opl3 + - ALSA: hda - let hs_mic be picked ahead of hp_mic + - ALSA: usb-audio: add quirk for MacroSilicon MS2109 + - [arm64] KVM: Fix definition of PAGE_HYP_DEVICE + - [arm64] KVM: Stop clobbering x0 for HVC_SOFT_RESTART + - [x86] KVM: bit 8 of non-leaf PDPEs is not reserved + - [x86] KVM: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit + mode + - [x86] KVM: Mark CR4.TSD as being possibly owned by the guest + - kallsyms: Refactor kallsyms_show_value() to take cred + - kernel: module: Use struct_size() helper + - module: Refactor section attr into bin attribute + - module: Do not expose section addresses to non-CAP_SYSLOG + - kprobes: Do not expose probe addresses to non-CAP_SYSLOG + - bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() + - btrfs: fix fatal extent_buffer readahead vs releasepage race + - drm/radeon: fix double free + - dm: use noio when sending kobject event + - [s390x] mm: fix huge pte soft dirty copying + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.134 + - perf: Make perf able to build with latest libbfd + - genetlink: remove genl_bind + - ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg + - l2tp: remove skb_dst_set() from l2tp_xmit_skb() + - llc: make sure applications use ARPHRD_ETHER + - net: Added pointer check for dst->ops->neigh_lookup in + dst_neigh_lookup_skb + - net_sched: fix a memory leak in atm_tc_init() + - net: usb: qmi_wwan: add support for Quectel EG95 LTE modem + - tcp: fix SO_RCVLOWAT possible hangs under high mem pressure + - tcp: make sure listeners don't initialize congestion-control state + - tcp: md5: add missing memory barriers in + tcp_md5_do_add()/tcp_md5_hash_key() + - tcp: md5: do not send silly options in SYNCOOKIES + - tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers + - tcp: md5: allow changing MD5 keys in all socket states + - cgroup: fix cgroup_sk_alloc() for sk_clone_lock() (CVE-2020-14356) + (Closes: #966846) + - cgroup: Fix sock_cgroup_data on big-endian. + - sched: consistently handle layer3 header accesses in the presence of + VLANs + - vlan: consolidate VLAN parsing code and limit max parsing depth + - [arm64] drm/msm: fix potential memleak in error branch + - [arm64] alternatives: use subsections for replacement sequences + - [arm64,x86] tpm_tis: extra chip->ops check on error path in + tpm_tis_core_init + - gfs2: read-only mounts should grab the sd_freeze_gl glock + - [i386] i2c: eg20t: Load module automatically if ID matches + - [arm64] alternatives: don't patch up internal branches + - [armhf] iio: mma8452: Add missed iio_device_unregister() call in + mma8452_probe() + - [armhf] net: dsa: bcm_sf2: Fix node reference count + - of: of_mdio: Correct loop scanning logic + - Revert "usb/ohci-platform: Fix a warning when hibernating" + - [arm64,armhf] Revert "usb/xhci-plat: Set PM runtime as active on resume" + - Revert "usb/ehci-platform: Set PM runtime as active on resume" + - [arm64,armhf] net: sfp: add support for module quirks + - [arm64,armhf] net: sfp: add some quirks for GPON modules + - HID: quirks: Remove ITE 8595 entry from hid_have_special_driver + - ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp + (0951:16d8) + - mmc: sdhci: do not enable card detect interrupt for gpio cd type + - ALSA: usb-audio: Rewrite registration quirk handling + - [x86] ACPI: video: Use native backlight on Acer Aspire 5783z + - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha + S + - [x86] ACPI: video: Use native backlight on Acer TravelMate 5735Z + - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight + S + - [arm64,armhf] phy: sun4i-usb: fix dereference of pointer phy0 before it + is null checked + - [armhf] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock + rate + - [x86] staging: comedi: verify array index is correct before using it + - regmap: debugfs: Don't sleep while atomic for fast_io regmaps + - [x86] copy_xstate_to_kernel: Fix typo which caused GDB regression + - apparmor: ensure that dfa state tables have entries + - perf stat: Zero all the 'ena' and 'run' array slot stats for interval + mode + - [armhf] mtd: rawnand: marvell: Use nand_cleanup() when the device is not + yet registered + - [armhf] mtd: rawnand: marvell: Fix probe error path + - mtd: rawnand: timings: Fix default tR_max and tCCS_min timings + - HID: magicmouse: do not set up autorepeat + - HID: quirks: Always poll Obins Anne Pro 2 keyboard + - HID: quirks: Ignore Simply Automated UPB PIM + - ALSA: line6: Perform sanity check for each URB creation + - ALSA: line6: Sync the pending work cancel at disconnection + - ALSA: usb-audio: Fix race against the error recovery URB submission + - [x86] ALSA: hda/realtek - change to suitable link model for ASUS platform + - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 + - [arm*] usb: dwc2: Fix shutdown callback in platform + - [arm64,armhf] usb: chipidea: core: add wakeup support for extcon + - USB: serial: iuu_phoenix: fix memory corruption + - USB: serial: cypress_m8: enable Simply Automated UPB PIM + - USB: serial: ch341: add new Product ID for CH340 + - USB: serial: option: add GosunCn GM500 series + - USB: serial: option: add Quectel EG95 LTE modem + - [x86] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers + to match upstream + - [x86] virt: vbox: Fix guest capabilities mask check + - [arm64] virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for + rproc serial + - ovl: inode reference leak in ovl_is_inuse true case. + - ovl: relax WARN_ON() when decoding lower directory file handle + - ovl: fix unneeded call to ovl_change_flags() + - fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS + - Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" + (CVE-2020-10781) + - [x86] mei: bus: don't clean driver pointer + - timer: Prevent base->clk from moving backward + - timer: Fix wheel index calculation on last level + - [mips*] Fix build for LTS kernel caused by backporting lpj adjustment + - hwmon: (emc2103) fix unable to change fan pwm1_enable attribute + - [powerpc*] book3s64/pkeys: Fix pkey_access_permitted() for execute + disable pkey + - [x86] intel_th: pci: Add Jasper Lake CPU support + - [x86] intel_th: pci: Add Tiger Lake PCH-H support + - [x86] intel_th: pci: Add Emmitsburg PCH support + - [x86] intel_th: Fix a NULL dereference when hub driver is not loaded + - [arm*] thermal/drivers/cpufreq_cooling: Fix wrong frequency converted + from power + - [arm64] ptrace: Override SPSR.SS when single-stepping is enabled + - [arm64] ptrace: Consistently use pseudo-singlestep exceptions + - [arm64] compat: Ensure upper 32 bits of x0 are zero on syscall return + - sched: Fix unreliable rseq cpu_id for new tasks + - sched/fair: handle case of task_h_load() returning 0 + - genirq/affinity: Handle affinity setting on inactive interrupts + correctly + - printk: queue wake_up_klogd irq_work only if per-CPU areas are ready + - libceph: don't omit recovery_deletes in target_copy() + - rxrpc: Fix trace string + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.135 + - mac80211: allow rx of mesh eapol frames with default rx key + - scsi: scsi_transport_spi: Fix function pointer check + - net: sky2: initialize return of gm_phy_read + - drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout + - fuse: fix weird page warning + - [x86] irqdomain/treewide: Keep firmware node unconditionally allocated + - SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct + IO compeletion") + - tipc: clean up skb list lock handling on send path + - IB/umem: fix reference count leak in ib_umem_odp_get() + - uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to + fix GDB regression + - ALSA: info: Drop WARN_ON() from buffer NULL sanity check + - btrfs: fix double free on ulist after backref resolution failure + - btrfs: fix mount failure caused by race with umount + - btrfs: fix page leaks after failure to lock page for delalloc + - bnxt_en: Fix race when modifying pause settings. + - [x86] hippi: Fix a size used in a 'pci_free_consistent()' in an error + handling path + - ax88172a: fix ax88172a_unbind() failures + - ieee802154: fix one possible memleak in adf7242_probe + - [arm64,armhf] drm: sun4i: hdmi: Fix inverted HPD result + - [arm64,armhf] net: smc91x: Fix possible memory leak in smc_drv_probe() + - bonding: check error value of register_netdevice() immediately + - qed: suppress "don't support RoCE & iWARP" flooding on HW init + - ipvs: fix the connection sync failed in some cases + - bonding: check return value of register_netdevice() in bond_newlink() + - serial: exar: Fix GPIO configuration for Sealevel cards based on + XR17V35X + - [arm64,x86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor + override + - HID: alps: support devices with report id 2 + - HID: steam: fixes race in handling device list. + - HID: apple: Disable Fn-key key-re-mapping on clone keyboards + - [arm64] dmaengine: tegra210-adma: Fix runtime PM imbalance on error + - Input: add `SW_MACHINE_COVER` + - regmap: dev_get_regmap_match(): fix string comparison + - hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow + - [amd64] dmaengine: ioat setting ioat timeout as module parameter + - [x86] Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen + - [arm64] Use test_tsk_thread_flag() for checking TIF_SINGLESTEP + - [arm*] binder: Don't use mmput() from shrinker function. + - usb: xhci: Fix ASM2142/ASM3142 DMA addressing + - Revert "cifs: Fix the target file was deleted when rename failed." + (Closes: #966917) + - [x86] staging: wlan-ng: properly check endpoint types + - [x86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG + shift + - [x86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support + - [x86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG + shift + - [x86] staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG + shift + - serial: 8250: fix null-ptr-deref in serial8250_start_tx() + - fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. + - vt: Reject zero-sized screen buffer size. + - mm/memcg: fix refcount error while moving and swapping + - mm: memcg/slab: synchronize access to kmem_cache dying flag using a + spinlock + - mm: memcg/slab: fix memory leak at non-root kmem_cache destroy + - io-mapping: indicate mapping failure + - drm/amdgpu: Fix NULL dereference in dpm sysfs handlers + - [x86] vmlinux.lds: Page-align end of ..page_aligned sections + - [x86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on + the Lenovo Miix 2 10 + - dm integrity: fix integrity recalculation that is improperly skipped + - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb + - ath9k: Fix regression with Atheros 9271 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.136 + - AX.25: Fix out-of-bounds read in ax25_connect() + - AX.25: Prevent out-of-bounds read in ax25_sendmsg() + - dev: Defer free of skbs in flush_backlog + - ip6_gre: fix null-ptr-deref in ip6gre_init_net() + - net-sysfs: add a newline when printing 'tx_timeout' by sysfs + - net: udp: Fix wrong clean up for IS_UDPLITE macro + - rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA + - tcp: allow at most one TLP probe per flight + - AX.25: Prevent integer overflows in connect and sendmsg + - sctp: shrink stream outq only when new outcnt < old outcnt + - sctp: shrink stream outq when fails to do addstream reconf + - udp: Copy has_conns in reuseport_grow(). + - udp: Improve load balancing for SO_REUSEPORT. + - rtnetlink: Fix memory(net_device) leak when ->newlink fails + - regmap: debugfs: check count when read regmap file + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.137 + - [x86] crypto: ccp - Release all allocated memory if sha type is invalid + (CVE-2019-18808) + - media: rc: prevent memory leak in cx23888_ir_probe (CVE-2019-19054) + - iio: imu: adis16400: fix memory leak (CVE-2019-19061) + - [x86] drm/amdgpu: fix multiple memory leaks in acp_hw_init + (CVE-2019-19067) + - tracing: Have error path in predicate_parse() free its allocated memory + (CVE-2019-19072) + - ath9k_htc: release allocated buffer if timed out (CVE-2019-19073) + - ath9k: release allocated buffer if timed out (CVE-2019-19074) + - drm/amd/display: prevent memory leak (CVE-2019-19082) + - btrfs: inode: Verify inode mode to avoid NULL pointer dereference + (CVE-2019-19813, CVE-2019-19816) + - sctp: implement memory accounting on tx path (CVE-2019-3874) + - Btrfs: fix selftests failure due to uninitialized i_mode in test inodes + - PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge + - 9p/trans_fd: Fix concurrency del of req_list in + p9_fd_cancelled/p9_read_work + - wireless: Use offsetof instead of custom macro. + - [armel,armhf] 8986/1: hw_breakpoint: Don't invoke overflow handler on + uaccess watchpoints + - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" + - drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() + - drm: hold gem reference until object is no longer accessed + - rds: Prevent kernel-infoleak in rds_notify_queue_get() + - xfs: fix missed wakeup on l_flush_wait + - xfrm: Fix crash when the hold queue is used. + - net/mlx5: Verify Hardware supports requested ptp function on a given pin + - net: lan78xx: add missing endpoint sanity check + - net: lan78xx: fix transfer-buffer memory leak + - mlx4: disable device on shutdown + - bpf: Fix map leak in HASH_OF_MAPS map + - mac80211: mesh: Free ie data when leaving mesh + - mac80211: mesh: Free pending skb when destroying a mpath + - [arm64] alternatives: move length validation inside the subsection + - [arm64] csum: Fix handling of bad packets + - Bluetooth: fix kernel oops in store_pending_adv_report + - net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq + - qed: Disable "MFW indication via attention" SPAM every 5 minutes + - [amd64] x86/unwind/orc: Fix ORC for newly forked tasks + - cxgb4: add missing release on skb in uld_send() + - xen-netfront: fix potential deadlock in xennet_remove() + - [x86] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is + hw disabled + - [x86] i8259: Use printk_deferred() to prevent deadlock + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.138 + - random32: update the net random state on interrupt and activity + (CVE-2020-16166) + - [armel] ARM: percpu.h: fix build error + - random: fix circular include dependency on arm64 after addition of + percpu.h + - random32: remove net_rand_state from the latent entropy gcc plugin + - random32: move the pseudo-random 32-bit definitions to prandom.h + - ext4: fix direct I/O read error + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.139 + - USB: serial: qcserial: add EM7305 QDL product ID + - USB: iowarrior: fix up report size handling for some devices + - usb: xhci: define IDs for various ASMedia host controllers + - usb: xhci: Fix ASMedia ASM1142 DMA addressing + - Revert "ALSA: hda: call runtime_allow() for all hda controllers" + - [arm*] staging: android: ashmem: Fix lockdep warning for write operation + - Bluetooth: Fix slab-out-of-bounds read in + hci_extended_inquiry_result_evt() + - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() + - Bluetooth: Prevent out-of-bounds read in + hci_inquiry_result_with_rssi_evt() + - [arm*] binder: Prevent context manager from incrementing ref 0 + - vgacon: Fix for missing check in scrollback handling (CVE-2020-14331) + - mtd: properly check all write ioctls for permissions + - net/9p: validate fds in p9_fd_open + - drm/nouveau/fbcon: fix module unload when fbcon init has failed for some + reason + - drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure + - usb: hso: check for return value in hso_serial_common_create() + - firmware: Fix a reference count leak. + - cfg80211: check vendor command doit pointer before use + - igb: reinit_locked() should be called with rtnl_lock + - atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent + - tools lib traceevent: Fix memory leak in process_dynamic_array_len + - [x86] Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) + - xattr: break delegations in {set,remove}xattr + - ipv4: Silence suspicious RCU usage warning + - ipv6: fix memory leaks on IPV6_ADDRFORM path + - vxlan: Ensure FDB dump is performed under RCU + - net: lan78xx: replace bogus endpoint lookup + - [x86] hv_netvsc: do not use VF device if link is down + - net: gre: recompute gre csum for sctp over gre tunnels + - [arm64] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() + - openvswitch: Prevent kernel-infoleak in ovs_ct_put_key() + - Revert "vxlan: fix tos value before xmit" + - rxrpc: Fix race between recvmsg and sendmsg on immediate call failure + - i40e: add num_vectors checker in iwarp handler + - i40e: Wrong truncation from u16 to u8 + - i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c + - i40e: Memory leak in i40e_config_iwarp_qvlist + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140 + - tracepoint: Mark __tracepoint_string's __used + - HID: input: Fix devices that return multiple bytes in battery report + - cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone() + - [x86] mce/inject: Fix a wrong assignment of i_mce.status + - sched/fair: Fix NOHZ next idle balance + - sched: correct SD_flags returned by tl->sd_flags() + - EDAC: Fix reference count leaks + - [x86] platform/x86: intel-hid: Fix return value check in + check_acpi_dev() + - [x86] platform/x86: intel-vbtn: Fix return value check in + check_acpi_dev() + - [armhf] drm/tilcdc: fix leak & null ref in panel_connector_get_modes + - Bluetooth: add a mutex lock to avoid UAF in do_enale_set + - loop: be paranoid on exit and prevent new additions / removals + - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls + - drm/amdgpu: avoid dereferencing a NULL pointer + - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync + - [x86] crypto: aesni - Fix build with LLVM_IAS=1 + - video: fbdev: neofb: fix memory leak in neo_scan_monitor() + - md-cluster: fix wild pointer of unlock_all_bitmaps() + - [arm64] dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT + binding + - [armhf] drm/etnaviv: fix ref count leak via pm_runtime_get_sync + - drm/nouveau: fix multiple instances of reference count leaks + - drm/debugfs: fix plain echo to connector "force" attribute + - drm/radeon: disable AGP by default + - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls + - brcmfmac: keep SDIO watchdog running when console_interval is non-zero + - brcmfmac: To fix Bss Info flag definition Bug + - brcmfmac: set state of hanger slot to FREE when flushing PSQ + - iwlegacy: Check the return value of pcie_capability_read_*() + - [arm64,armhf] gpu: host1x: debug: Fix multiple channels emitting + messages simultaneously + - usb: gadget: net2280: fix memory leak on probe error handling paths + - dyndbg: fix a BUG_ON in ddebug_describe_flags + - bcache: fix super block seq numbers comparision in register_cache_set() + - [arm64,x86] ACPICA: Do not increment operation_region reference counts + for field units + - [arm64] drm/msm: ratelimit crtc event overflow error + - [x86] agp/intel: Fix a memory leak on module initialisation failure + - ath10k: Acquire tx_lock in tx error paths + - [armhf] drm/etnaviv: Fix error path on failure to enable bus clk + - [arm64] drm/arm: fix unintentional integer overflow on left shift + - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline + - [powerpc*] cxl: Fix kobject memleak + - drm/radeon: fix array out-of-bounds read and write issues + - ipvs: allow connection reuse for unconfirmed conntrack + - xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork + - xfs: fix reflink quota reservation accounting error + - RDMA/rxe: Skip dgid check in loopback mode + - PCI: Fix pci_cfg_wait queue locking problem + - leds: core: Flush scheduled work for system suspend + - [arm64,armhf] drm: panel: simple: Fix bpc for LG LB070WV8 panel + - [armhf] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY + - scsi: scsi_debug: Add check for sdebug_max_queue during module init + - mwifiex: Prevent memory corruption handling keys + - [powerpc*] vdso: Fix vdso cpu truncation + - RDMA/qedr: SRQ's bug fixes + - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send + queue + - [x86] staging: rtl8192u: fix a dubious looking mask before a shift + - PCI/ASPM: Add missing newline in sysfs 'policy' + - [powerpc*] book3s64/pkeys: Use PVR check instead of cpu feature + - USB: serial: iuu_phoenix: fix led-activity helpers + - usb: core: fix quirks_param_set() writing to a const pointer + - [armhf] thermal: ti-soc-thermal: Fix reversed condition in + ti_thermal_expose_sensor() + - [mips*] OCTEON: add missing put_device() call in + dwc3_octeon_device_init() + - [arm*] usb: dwc2: Fix error path in gadget registration + - [arm64,armhf] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo + configuration + - RDMA/core: Fix return error value in _ib_modify_qp() to negative + - Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags + - Bluetooth: hci_serdev: Only unregister device if it was registered + - [x86] PCI: Release IVRS table in AMD ACS quirk + - [s390x] qeth: don't process empty bridge port events + - [arm64,armhf] wl1251: fix always return 0 error + - [amd64] net: ethernet: aquantia: Fix wrong return value + - liquidio: Fix wrong return value in cn23xx_get_pf_num() + - dlm: Fix kobject memleak + - ocfs2: fix unbalanced locking + - [arm64,armhf] pinctrl-single: fix pcs_parse_pinconf() return value + - svcrdma: Fix page leak in svc_rdma_recv_read_chunk() + - [x86] fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task + - [amd64] crypto: aesni - add compatibility with IAS + - af_packet: TPACKET_V3: fix fill status rwlock imbalance + - net/nfc/rawsock.c: add CAP_NET_RAW check. + - net: Set fput_needed iff FDPUT_FPUT is set + - net: refactor bind_bucket fastreuse into helper + - net: initialize fastreuse on inet_inherit_port + - USB: serial: cp210x: re-enable auto-RTS on open + - USB: serial: cp210x: enable usb generic throttle/unthrottle + - [x86] ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO + - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support + - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 + - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 + - [x86] crypto: qat - fix double free in qat_uclo_create_batch_init_list + - [x86] crypto: ccp - Fix use of merged scatterlists + - [arm64] crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not + specified + - bitfield.h: don't compile-time validate _val in FIELD_FIT + - fs/minix: check return value of sb_getblk() + - fs/minix: don't allow getting deleted inodes + - fs/minix: reject too-large maximum file size + - ALSA: usb-audio: add quirk for Pioneer DDJ-RB + - 9p: Fix memory leak in v9fs_mount + - drm/ttm/nouveau: don't call tt destroy callback on alloc failure. + - NFS: Don't move layouts to plh_return_segs list while in use + - NFS: Don't return layout segments that are in use + - [arm64] cpufreq: dt: fix oops on armada37xx + - include/asm-generic/vmlinux.lds.h: align ro_after_init + - spi: spidev: Align buffers for DMA + - [x86] irqdomain/treewide: Free firmware node after domain removal + - xen/balloon: fix accounting in alloc_xenballooned_pages error path + - xen/balloon: make the balloon wait interruptible + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.141 + - smb3: warn on confusing error scenario with sec=krb5 + - genirq/affinity: Make affinity setting if activated opt-in + - [arm64,x86] PCI: hotplug: ACPI: Fix context refcounting in + acpiphp_grab_context() + - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken + - PCI: Add device even if driver attach failed + - [arm64] PCI: qcom: Define some PARF params needed for ipq8064 SoC + - [arm64] PCI: qcom: Add support for tx term offset for rev 2.1.0 + - PCI: Probe bridge window attributes once at enumeration-time + - btrfs: free anon block device right after subvolume deletion + - btrfs: don't allocate anonymous block device for user invisible roots + - btrfs: ref-verify: fix memory leak in add_block_entry + - btrfs: don't traverse into the seed devices in show_devname + - btrfs: open device without device_list_mutex + - btrfs: fix messages after changing compression level by remount + - btrfs: only search for left_info if there is no right_info in + try_merge_free_space (CVE-2019-19448) + - btrfs: fix memory leaks after failure to lookup checksums during inode + logging + - btrfs: fix return value mixup in btrfs_get_extent + - cifs: Fix leak when handling lease break for cached root fid + - [powerpc*] Allow 4224 bytes of stack expansion for the signal frame + - [powerpc*] Fix circular dependency between percpu.h and mmu.h + - [arm64] net: ethernet: stmmac: Disable hardware multicast filter + - [arm64,armhf] net: stmmac: dwmac1000: provide multicast filter fallback + - net/compat: Add missing sock updates for SCM_RIGHTS + - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 + - bcache: allocate meta data pages as compound pages + - bcache: fix overflow in offset_to_stripe() + - mac80211: fix misplaced while instead of if + - driver core: Avoid binding drivers to dead devices + - [mips*] CPU#0 is not hotpluggable + - ocfs2: change slot number type s16 to u16 + - mm/page_counter.c: fix protection usage propagation + - ftrace: Setup correct FTRACE_FL_REGS flags for module + - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler + - tracing/hwlat: Honor the tracing_cpumask + - tracing: Use trace_sched_process_free() instead of exit() for pid + tracing + - [x86] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in + watchdog_info.options + - [x86] watchdog: f71808e_wdt: remove use of wrong watchdog_info option + - [x86] watchdog: f71808e_wdt: clear watchdog timeout occurred flag + - [powerpc*] pseries: Fix 64 bit logical memory block panic + - module: Correctly truncate sysfs sections output + - [armhf] drm/imx: imx-ldb: Disable both channels for split mode in + enc->disable() + - RDMA/ipoib: Return void from ipoib_ib_dev_stop() + - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() + - USB: serial: ftdi_sio: make process-packet buffer unsigned + - USB: serial: ftdi_sio: clean up receive processing + - [armhf] gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq + handlers + - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() + - [amd64] iommu/vt-d: Enforce PASID devTLB field mask + - scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying + targetport + - watchdog: initialize device before misc_register + - Input: sentelic - fix error return when fsp_reg_write fails + - [x86] drm/vmwgfx: Use correct vmw_legacy_display_unit pointer + - [x86] drm/vmwgfx: Fix two list_for_each loop exit tests + - [arm64] net: qcom/emac: add missed clk_disable_unprepare in error path + of emac_clks_phase1_init + - nfs: Fix getxattr kernel panic and memory overflow (CVE-2020-25212) + - fs/minix: set s_maxbytes correctly + - fs/minix: fix block limit check for V1 filesystems + - fs/minix: remove expected error message in block_to_path() + - fs/ufs: avoid potential u32 multiplication overflow + - khugepaged: retract_page_tables() remember to test exit + - [arm64] dts: marvell: espressobin: add ethernet alias + - [x86] drm: Added orientation quirk for ASUS tablet model T103HAF + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.142 + - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() + - perf probe: Fix memory leakage when the probe point is not found + - khugepaged: khugepaged_test_exit() check mmget_still_valid() + - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() + - btrfs: export helpers for subvolume name/id resolution + - btrfs: don't show full path of bind mounts in subvol= + - btrfs: Move free_pages_out label in inline extent handling branch in + compress_file_range + - btrfs: inode: fix NULL pointer dereference if inode doesn't need + compression + - btrfs: sysfs: use NOFS for device creation + - romfs: fix uninitialized memory leak in romfs_dev_read() + - kernel/relay.c: fix memleak on destroy relay channel + - mm: include CMA pages in lowmem_reserve at boot + - mm, page_alloc: fix core hung in free_pcppages_bulk() + - ext4: fix checking of directory entry validity for inline directories + - jbd2: add the missing unlock_buffer() in the error path of + jbd2_write_superblock() + - [s390x] scsi: zfcp: Fix use-after-free in request timeout handlers + - kthread: Do not preempt current task if it is going to call schedule() + - spi: Prevent adding devices below an unregistering controller + - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices + - [arm*] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM + - media: budget-core: Improve exception handling in budget_register() + - Input: psmouse - add a newline when printing 'proto' by sysfs + - svcrdma: Fix another Receive buffer leak + - xfs: fix inode quota reservation checks + - jffs2: fix UAF problem + - ceph: fix use-after-free for fsc->mdsc + - [x86] cpufreq: intel_pstate: Fix cpuinfo_max_freq when + MSR_TURBO_RATIO_LIMIT is 0 + - scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases + - virtio_ring: Avoid loop when vq is broken in virtqueue_poll + - xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init + - fs/signalfd.c: fix inconsistent return codes for signalfd4 + - ext4: fix potential negative array index in do_split() (CVE-2020-14314) + - ext4: don't allow overlapping system zones + - i40e: Set RX_ONLY mode for unicast promiscuous on VLAN + - i40e: Fix crash during removing i40e driver + - [armhf] net: fec: correct the error path for regulator disable in probe + - bonding: show saner speed for broadcast mode + - bonding: fix a potential double-unregister + - [s390x] runtime_instrumentation: fix storage key handling + - [s390x] ptrace: fix storage key handling + - [x86] ASoC: intel: Fix memleak in sst_media_open + - [amd64,arm64] vfio/type1: Add proper error unwind for + vfio_iommu_replay() + - [x86] kvm: Toggling CR4.SMAP does not load PDPTEs in PAE mode + - [x86] kvm: Toggling CR4.PKE does not load PDPTEs in PAE mode + - efi: avoid error message when booting under Xen + - afs: Fix NULL deref in afs_dynroot_depopulate() + - bonding: fix active-backup failover for current ARP slave + - net: ena: Prevent reset after device destruction + - [x86] hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() + - [armhf] net: dsa: b53: check for timeout + - [powerpc*] pseries: Do not initiate shutdown when system is running on + UPS + - efi: add missed destroy_workqueue when efisubsys_init fails + - epoll: Keep a reference on files added to the check list + - do_epoll_ctl(): clean the failure exits up a bit + - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible + - xen: don't reschedule in preemption off sections + - clk: Evict unregistered clks from parent caches + - KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() + - [arm64] KVM: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.143 + - [powerpc*] 64s: Don't init FSCR_DSCR in __init_FSCR() + - gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY + - net: Fix potential wrong skb->protocol in skb_vlan_untag() + - net/smc: Prevent kernel-infoleak in __smc_diag_dump() + - tipc: fix uninit skb->data in tipc_nl_compat_dumpit() + - net: ena: Make missed_tx stat incremental + - ipvlan: fix device features + - [x86] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs + - [powerpc*] xive: Ignore kmemleak false positives + - media: pci: ttpci: av7110: fix possible buffer overflow caused by bad + DMA value in debiirq() + - blktrace: ensure our debugfs dir exists + - scsi: target: tcmu: Fix crash on ARM during cmd completion + - [arm*] iommu/iova: Don't BUG on invalid PFNs + - [amd64] drm/amdkfd: Fix reference count leaks. + - drm/radeon: fix multiple reference count leak + - drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms + - drm/amd/display: fix ref count leak in amdgpu_drm_ioctl + - drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config + - drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails + - scsi: lpfc: Fix shost refcount mismatch when deleting vport + - xfs: Don't allow logging of XFS_ISTALE inodes + - f2fs: fix error path in do_recover_data() + - PCI: Fix pci_create_slot() reference count leak + - rtlwifi: rtl8192cu: Prevent leaking urb + - [mips*] vdso: Fix resource leaks in genvdso.c + - cec-api: prevent leaking memory through hole in structure + - HID: quirks: add NOGET quirk for Logitech GROUP + - f2fs: fix use-after-free issue + - drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open + - drm/nouveau: fix reference count leak in nv50_disp_atomic_commit + - drm/nouveau: Fix reference count leak in nouveau_connector_detect + - btrfs: file: reserve qgroup space after the hole punch range is locked + - scsi: iscsi: Do not put host in iscsi_set_flashnode_param() + - ceph: fix potential mdsc use-after-free crash + - scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() + - [x86] EDAC/ie31200: Fallback if host bridge device is already + initialized + - [arm64] KVM: Fix symbol dependency in __hyp_call_panic_nvhe + - USB: sisusbvga: Fix a potential UB casued by left shifting a negative + value + - [arm64] drm/msm/adreno: fix updating ring fence + - nvme-fc: Fix wrong return value in __nvme_fc_init_request() + - null_blk: fix passing of REQ_FUA flag in null_handle_rq + - jbd2: make sure jh have b_transaction set in refile/unfile_buffer + - ext4: don't BUG on inconsistent journal feature + - ext4: handle read only external journal device + - jbd2: abort journal if free a async write error metadata buffer + - ext4: handle option set by mount flags correctly + - ext4: handle error of ext4_setup_system_zone() on remount + - ext4: correctly restore system zone info when remount fails + - fs: prevent BUG_ON in submit_bh_wbc() + - [s390x] cio: add cond_resched() in the slow_eval_known_fn() loop + - scsi: fcoe: Fix I/O path allocation + - scsi: ufs: Fix possible infinite loop in ufshcd_hold + - scsi: ufs: Improve interrupt handling for shared interrupts + - scsi: ufs: Clean up completed request without interrupt notification + - scsi: qla2xxx: Check if FW supports MQ before enabling + - scsi: qla2xxx: Fix null pointer access during disconnect from subsystem + - Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" + - macvlan: validate setting of multiple remote source MAC addresses + - [powerpc*] perf: Fix soft lockups due to missed interrupt accounting + - block: loop: set discard granularity and alignment for block device + backed loop + - [arm64,x86] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON + commands + - blk-mq: order adding requests to hctx->dispatch and checking + SCHED_RESTART + - btrfs: reset compression level for lzo on remount + - btrfs: fix space cache memory leak after transaction abort + - fbcon: prevent user font height or width change from causing potential + out-of-bounds access + - vt: defer kfree() of vc_screenbuf in vc_do_resize() + - vt_ioctl: change VT_RESIZEX ioctl to check for error return from + vc_resize() + - [armhf] serial: samsung: Removes the IRQ not found warning + - [arm*] serial: pl011: Fix oops on -EPROBE_DEFER + - [arm*] serial: pl011: Don't leak amba_ports entry on driver register + error + - serial: 8250_exar: Fix number of ports for Commtech PCIe cards + - serial: 8250: change lock order in serial8250_do_startup() + - writeback: Protect inode->i_io_list with inode->i_lock + - writeback: Avoid skipping inode writeback + - writeback: Fix sync livelock due to b_dirty_time processing + - XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt + XEN data pointer which contains XEN specific information. + - usb: host: xhci: fix ep context print mismatch in debugfs + - xhci: Do warm-reset when both CAS and XDEV_RESUME are set + - xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed + - PM: sleep: core: Fix the handling of pending runtime resume requests + - device property: Fix the secondary firmware node handling in + set_primary_fwnode() + - [x86] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP + - drm/amdgpu: Fix buffer overflow in INFO ioctl + - USB: yurex: Fix bad gfp argument + - USB: quirks: Add no-lpm quirk for another Raydium touchscreen + - USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D + - [armhf] usb: host: ohci-exynos: Fix error handling in + exynos_ohci_probe() + - USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() + - USB: cdc-acm: rework notification_buffer resizing + - btrfs: check the right error variable in btrfs_del_dir_entries_in_log + - [arm64,armhf] usb: dwc3: gadget: Don't setup more than requested + - [arm64,armhf] usb: dwc3: gadget: Fix handling ZLP + - [arm64,armhf] usb: dwc3: gadget: Handle ZLP for sg requests + - [arm64,x86] tpm: Unify the mismatching TPM space buffer sizes + - HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.144 + - HID: core: Correctly handle ReportSize being zero + - HID: core: Sanitize event code and type when mapping input + - scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range + - scsi: target: tcmu: Optimize use of flush_dcache_page + - [arm64] drm/msm: add shutdown support for display platform_driver + - [x86] hwmon: (applesmc) check status earlier. + - nvmet: Disable keep-alive timer when kato is cleared to 0h + - [arm64] drm/msm/a6xx: fix gmu start on newer firmware + - ceph: don't allow setlease on cephfs + - cpuidle: Fixup IRQ state + - [s390x] don't trace preemption in percpu macros + - xen/xenbus: Fix granting of vmalloc'd memory + - dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling + - batman-adv: Avoid uninitialized chaddr when handling DHCP + - batman-adv: bla: use netif_rx_ni when not in interrupt context + - [mips*] mm: BMIPS5000 has inclusive physical caches + - netfilter: nf_tables: add NFTA_SET_USERDATA if not null + - netfilter: nf_tables: incorrect enum nft_list_attributes definition + - netfilter: nf_tables: fix destination register zeroing + - [arm64] net: hns: Fix memleak in hns_nic_dev_probe + - [arm64,armhf] dmaengine: pl330: Fix burst length if burst size is + smaller than bus width + - gtp: add GTPA_LINK info to msg sent to userspace + - bnxt_en: Don't query FW when netif_running() is false. + - bnxt_en: Check for zero dir entries in NVRAM. + - bnxt_en: Fix PCI AER error recovery flow + - bnxt_en: fix HWRM error when querying VF temperature + - xfs: fix boundary test in xfs_attr_shortform_verify (CVE-2020-14385) + - bnxt: don't enable NAPI until rings are ready + - netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of + ENOBUFS + - nvmet-fc: Fix a missed _irqsave version of spin_lock in + 'nvmet_fc_fod_op_done()' + - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() + - fix regression in "epoll: Keep a reference on files added to the check + list" + - xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt + files + - tg3: Fix soft lockup when tg3_reset_task() fails. + - [amd64] x86, fakenuma: Fix invalid starting node ID + - [amd64] iommu/vt-d: Serialize IOMMU GCMD register modifications + - [armhf] thermal: ti-soc-thermal: Fix bogus thermal shutdowns for + omap4430 + - xfs: don't update mtime on COW faults + - btrfs: drop path before adding new uuid tree entry + - vfio/type1: Support faulting PFNMAP vmas + - vfio-pci: Fault mmaps to enable vma tracking + - vfio-pci: Invalidate mmaps and block MMIO access on disabled memory + (CVE-2020-12888) + - btrfs: Remove redundant extent_buffer_get in get_old_root + - btrfs: Remove extraneous extent_buffer_get from tree_mod_log_rewind + - btrfs: set the lockdep class for log tree extent buffers + - uaccess: Add non-pagefault user-space read functions + - uaccess: Add non-pagefault user-space write function + - btrfs: fix potential deadlock in the search ioctl + - net: usb: qmi_wwan: add Telit 0x1050 composition + - usb: qmi_wwan: add D-Link DWM-222 A2 device ID + - ALSA: ca0106: fix error code handling + - ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check + - [x86] ALSA: hda/hdmi: always check pin power status in i915 pin fixup + - ALSA: firewire-digi00x: exclude Avid Adrenaline from detection + - [x86] ALSA: hda - Fix silent audio output and corrupted input on MSI + X570-A PRO + - media: rc: do not access device via sysfs after rc_unregister_device() + - media: rc: uevent sysfs file races with rc_unregister_device() + - affs: fix basic permission bits to actually work + - block: allow for_each_bvec to support zero len bvec + - libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks + - dm writecache: handle DAX to partitions on persistent memory correctly + - dm cache metadata: Avoid returning cmd->bm wild pointer on error + - dm thin metadata: Avoid returning cmd->bm wild pointer on error + - mm: slub: fix conversion of freelist_corrupted() + - [arm64] KVM: Add kvm_extable for vaxorcism code + - [arm64] KVM: Defer guest entry when an asynchronous exception is pending + - [arm64] KVM: Survive synchronous exceptions caused by AT instructions + - [arm64] KVM: Set HCR_EL2.PTW to prevent AT taking synchronous exception + - vfio/pci: Fix SR-IOV VF handling with MMIO blocking + - checkpatch: fix the usage of capture group ( ... ) + - mm/hugetlb: fix a race between hugetlb sysctl handlers (CVE-2020-25285) + - cfg80211: regulatory: reject invalid hints + - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.145 + - ALSA; firewire-tascam: exclude Tascam FE-8 from detection + - block: ensure bdi->io_pages is always initialized + - net: usb: dm9601: Add USB ID of Keenetic Plus DSL + - sctp: not disable bh in the whole sctp_get_port_local() + - tipc: fix shutdown() of connectionless socket + - net: disable netpoll on fresh napis + - [arm64,armhf] net/mlx5e: Don't support phys switch id if not in + switchdev mode + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.146 + - RDMA/rxe: Fix memleak in rxe_mem_init_user + - RDMA/rxe: Drop pointless checks in rxe_init_ports + - [armhf] drm/sun4i: Fix dsi dcs long write function + - scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA + - RDMA/core: Fix reported speed and width + - [arm64] mmc: sdhci-msm: Add retries when all tuning phases are found + valid + - [arm64,x86] dmaengine: acpi: Put the CSRT table after using it + - netfilter: conntrack: allow sctp hearbeat after connection re-use + - [x86] firestream: Fix memleak in fs_open + - [arm64,armhf] ALSA: hda: Fix 2 channel swapping for Tegra + - xfs: initialize the shortform attr header padding entry + - nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance + - nvme-rdma: serialize controller teardown sequences + - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices + - [ppc64el,x86] drivers/net/wan/hdlc_cisco: Add hard_header_len + - HID: elan: Fix memleak in elan_input_configured + - [x86] cpufreq: intel_pstate: Refuse to turn off with HWP enabled + - [x86] cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo + disabled + - ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled + - [amd64] iommu/amd: Do not use IOMMUv2 functionality when SME is active + - [x86] iio:accel:bmc150-accel: Fix timestamp alignment and prevent data + leak. + - [x86] iio:magnetometer:ak8975 Fix alignment and data leak issues. + - [armhf] iio:accel:mma8452: Fix timestamp alignment and prevent data + leak. + - [x86] staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() + - btrfs: require only sector size alignment for parent eb bytenr + - btrfs: fix lockdep splat in add_missing_dev + - btrfs: fix wrong address when faulting in pages in the search ioctl + - regulator: push allocation in set_consumer_device_supply() out of lock + - scsi: target: iscsi: Fix data digest calculation + - scsi: target: iscsi: Fix hang in iscsit_access_np() when getting + tpg->np_login_sem + - [arm64] drm/msm: Disable preemption on all 5xx targets + - rbd: require global CAP_SYS_ADMIN for mapping and unmapping + (CVE-2020-25284) + - RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars + - vgacon: remove software scrollback support + - fbcon: remove soft scrollback code (CVE-2020-14390) + - fbcon: remove now unusued 'softback_lines' cursor() argument + - [x86] KVM: VMX: Don't freeze guest when event delivery causes an + APIC-access exit + - [x86] video: fbdev: fix OOB read in vga_8planes_imageblit() + - [arm64] phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init + - usb: core: fix slab-out-of-bounds Read in read_descriptors + - USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter + - USB: serial: option: support dynamic Quectel USB compositions + - USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules + - usb: Fix out of sync data toggle if a configured device is reconfigured + - [x86] usb: typec: ucsi: acpi: Check the _DEP dependencies + + [ Salvatore Bonaccorso ] + * Bump ABI to 11 + * Drop 'Revert "mips: Add udelay lpj numbers adjustment"' + * [rt] Update to 4.19.135-rt60 + * [rt] Refresh "net: Use skbufhead with raw lock" for context changes in + 4.19.136 + * [rt] Refresh "timers: Prepare for full preemption" for context changes in + 4.19.138 + * [rt] Refresh "timers: Redo the notification of canceling timers on -RT" + for context changes in 4.19.138 + * [rt] Refresh "watchdog: prevent deferral of watchdogd wakeup on RT" for + context changes in 4.19.141 + * Refresh "net: ena: fix crash during ena_remove()" for context changes in + 4.19.142 + * [rt] Refresh "Split IRQ-off and zone->lock while freeing pages from PCP + list #1" for context changes in 4.19.142 + * ACPI: configfs: Disallow loading ACPI tables when locked down + (CVE-2020-15780) + * [rt] Update to 4.19.142-rt63 + * net/packet: fix overflow in tpacket_rcv (CVE-2020-14386) + * debian/tests/python: pycodestyle: Increase max-line-length to 100. + * gfs2: initialize transaction tr_ailX_lists earlier (Closes: #968567) + + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 17 Sep 2020 23:42:03 +0200 + +linux (4.19.132-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.132 + - btrfs: fix a block group ref counter leak after failure to remove block + group + - mm: fix swap cache node allocation mask + - [x86] EDAC/amd64: Read back the scrub rate PCI register on F15h + - usbnet: smsc95xx: Fix use-after-free after removal + - mm/slub.c: fix corrupted freechain in deactivate_slab() + - mm/slub: fix stack overruns with SLUB_STATS + - [s390x] debug: avoid kernel warning on too large number of pages + - nvme-multipath: set bdi capabilities once + - nvme-multipath: fix deadlock between ana_work and scan_work + - crypto: af_alg - fix use-after-free in af_alg_accept() due to + bh_lock_sock() + - [arm64] drm/msm/dpu: fix error return code in dpu_encoder_init + - cxgb4: use unaligned conversion for fetching timestamp + - cxgb4: parse TC-U32 key values and masks natively + - cxgb4: use correct type for all-mask IP address comparison + - cxgb4: fix SGE queue dump destination buffer context + - [x86] hwmon: (acpi_power_meter) Fix potential memory leak in + acpi_power_meter_add() + - [arm64,armhf] drm: sun4i: hdmi: Remove extra HPD polling + - virtio-blk: free vblk-vqs in error path of virtblk_probe() + - SMB3: Honor 'posix' flag for multiuser mounts + - nvme: fix a crash in nvme_mpath_add_disk + - i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 + - Revert "ALSA: usb-audio: Improve frames size computation" + - SMB3: Honor 'seal' flag for multiuser mounts + - SMB3: Honor persistent/resilient handle flags for multiuser mounts + - SMB3: Honor lease disabling for multiuser mounts + - cifs: Fix the target file was deleted when rename failed. + - [mips*] Add missing EHB in mtc0 -> mfc0 sequence for DSPen + - [arm64,armhf] irqchip/gic: Atomically update affinity + - dm zoned: assign max_io_len correctly + - efi: Make it possible to disable efivar_ssdt entirely + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.19.132-rt59 + * Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb" + (Closes: #964153, #964480) + * efi: Restrict efivar_ssdt_load when the kernel is locked down + (CVE-2019-20908) + * certs: Rotate to use the Debian Secure Boot Signer 2020 certificate + * e1000e: Add support for Comet Lake (Closes: #965365) + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 24 Jul 2020 20:46:18 +0200 + +linux (4.19.131-2) buster; urgency=medium + + [ Aurelien Jarno ] + * Revert "mips: Add udelay lpj numbers adjustment", since it causes the + build to fail with CONFIG_CPU_FREQ=y. + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 11 Jul 2020 15:44:13 +0200 + +linux (4.19.131-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.119 + - ext4: fix extent_status fragmentation for plain files + - [arm64] drm/msm: Use the correct dma_sync calls harder + - vti4: removed duplicate log message. + - [arm64] Add part number for Neoverse N1 + - [arm64] errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 + #1542419 + - [arm64] Fake the IminLine size on systems affected by Neoverse-N1 + #1542419 + - [arm64] compat: Workaround Neoverse-N1 #1542419 for compat user-space + - watchdog: reset last_hw_keepalive time at start + - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login + - scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG + - ceph: return ceph_mdsc_do_request() errors from __get_parent() + - ceph: don't skip updating wanted caps when cap is stale + - scsi: iscsi: Report unbind session event when the target has been + removed + - [x86] ASoC: Intel: atom: Take the drv->lock mutex before calling + sst_send_slot_map() + - nvme: fix deadlock caused by ANA update wrong locking + - ipc/util.c: sysvipc_find_ipc() should increase position index + - [s390x] cio: avoid duplicated 'ADD' uevents + - loop: Better discard support for block devices + - [powerpc*] Revert "powerpc/64: irq_work avoid interrupt when called with + hardware irqs enabled" + - [arm*] pwm: bcm2835: Dynamically allocate base + - perf/core: Disable page faults when getting phys address + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet + - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3 + - virtio-blk: improve virtqueue error to BLK_STS + - scsi: smartpqi: fix call trace in device discovery + - PCI/ASPM: Allow re-enabling Clock PM + - [x86] KVM: VMX: Zero out *all* general purpose registers after VM-Exit + - cxgb4: fix adapter crash due to wrong MC size + - cxgb4: fix large delays in PTP synchronization + - ipv6: fix restrict IPV6_ADDRFORM operation + - macsec: avoid to set wrong mtu + - macvlan: fix null dereference in macvlan_device_event() + - net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node + - [arm64,armhf] net: stmmac: dwmac-meson8b: Add missing boundary to RGMII + TX clock array + - sched: etf: do not assume all sockets are full blown + - tcp: cache line align MAX_TCP_HEADER + - team: fix hang in team_mode_get() + - vrf: Fix IPv6 with qdisc and xfrm + - [armhf] net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled + - [armhf] net: dsa: b53: Fix ARL register definitions + - [armhf] net: dsa: b53: Rework ARL bin logic + - [armhf] net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL + - xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish + - vrf: Check skb for XFRM_TRANSFORMED flag + - KEYS: Avoid false positive ENOMEM error on key read + - ALSA: hda: Remove ASUS ROG Zenith from the blacklist + - ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos + - ALSA: usb-audio: Add connector notifier delegation + - [armhf] iio: st_sensors: rely on odr mask to know if odr can be set + - USB: sisusbvga: Change port variable from signed to unsigned + - USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair + K70 RGB RAPIDFIRE + - USB: early: Handle AMD's spec-compliant identifiers, too + - USB: hub: Fix handling of connect changes during sleep + - vmalloc: fix remap_vmalloc_range() bounds checks + - mm/hugetlb: fix a addressing exception caused by huge_pte_offset + - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled + - ALSA: hda/realtek - Fix unexpected init_amp override + - ALSA: hda/realtek - Add new codec supported for ALC245 + - ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif + - ALSA: usb-audio: Filter out unsupported sample rates on Focusrite + devices + - tpm/tpm_tis: Free IRQ if probing fails + - [s390x] KVM: Return last valid slot if approx index is out-of-bounds + - KVM: Check validity of resolved slot when searching memslots + - [x86] KVM: VMX: Enable machine check support for 32bit targets + - tty: hvc: fix buffer overflow during hvc_alloc(). + - [x86] tty: rocket, avoid OOB access + - usb-storage: Add unusual_devs entry for JMicron JMS566 + - audit: check the length of userspace generated audit records + - ASoC: dapm: fixup dapm kcontrol widget + - iwlwifi: pcie: actually release queue memory in TVQM + - iwlwifi: mvm: beacon statistics shouldn't go backwards + - [armel,armhf] ARM: imx: provide v7_cpu_resume() only on + ARM_CPU_SUSPEND=y + - [powerpc*] setup_64: Set cache-line-size based on cache-block-size + - [i386] staging: comedi: dt2815: fix writing hi byte of analog output + - [x86] staging: comedi: Fix comedi_device refcnt leak in comedi_open + - vt: don't hardcode the mem allocation upper bound + - vt: don't use kmalloc() for the unicode screen buffer + - [x86] staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by + default. + - [x86] staging: vt6656: Fix calling conditions of vnt_set_bss_mode + - [x86] staging: vt6656: Fix drivers TBTT timing counter. + - [x86] staging: vt6656: Fix pairwise key entry save. + - [x86] staging: vt6656: Power save stop wake_up_count wrap around. + - cdc-acm: close race betrween suspend() and acm_softint + - cdc-acm: introduce a cool down + - UAS: no use logging any details in case of ENODEV + - UAS: fix deadlock in error handling and PM flushing work + - [arm64,armhf] usb: dwc3: gadget: Fix request completion check + - usb: f_fs: Clear OS Extended descriptor counts to zero in + ffs_data_reset() + - xhci: prevent bus suspend if a roothub port detected a over-current + condition + - xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.120 + - mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer + - [arm*] binder: take read mode of mmap_sem in binder_alloc_free_page() + - [arm64,armhf] usb: dwc3: gadget: Do link recovery for SS and SSP + - nfsd: memory corruption in nfsd4_lock() + - rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket + - net/cxgb4: Check the return from t4_query_params properly + - xfs: acquire superblock freeze protection on eofblocks scans + - svcrdma: Fix trace point use-after-free race + - svcrdma: Fix leak of svc_rdma_recv_ctxt objects + - PCI: Avoid ASMedia XHCI USB PME# from D0 defect + - [s390x] net/mlx5: Fix failing fw tracer allocation on s390 + - perf/core: fix parent pid/tid in task exit events + - [i386] bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension + - mm: shmem: disable interrupt when acquiring info->lock in + userfaultfd_copy path + - xfs: clear PF_MEMALLOC before exiting xfsaild thread + - [x86] bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B + - [armhf] net: fec: set GPR bit on suspend by DT configuration. + - [x86] hyperv: report value of misc_features + - xfs: fix partially uninitialized structure in xfs_reflink_remap_extent + - ALSA: hda: Keep the controller initialization even if no codecs found + - ALSA: hda: Explicitly permit using autosuspend if runtime PM is + supported + - scsi: target: fix PR IN / READ FULL STATUS for FC + - scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN + - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status + - ALSA: hda: call runtime_allow() for all hda controllers + - [arm64] Delete the space separator in __emit_inst + - ext4: use matching invalidatepage in ext4_writepage + - ext4: increase wait time needed before reuse of deleted inode numbers + - ext4: convert BUG_ON's to WARN_ON's in mballoc.c + - hwmon: (jc42) Fix name to have no illegal characters + - [i386] bpf, x86_32: Fix clobbering of dst for BPF_JSET + - qed: Fix use after free in qed_chain_free + - ext4: check for non-zero journal inum in ext4_calculate_overhead + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.121 + - drm/edid: Fix off-by-one in DispID DTD pixel clock + - drm/qxl: qxl_release leak in qxl_draw_dirty_fb() + - drm/qxl: qxl_release leak in qxl_hw_surface_alloc() + - drm/qxl: qxl_release use after free + - btrfs: fix block group leak when removing fails + - ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter + - ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID + - ALSA: hda/hdmi: fix without unlocked before return + - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly + (Closes: #960493) + - PM: ACPI: Output correct message on target power state + - PM: hibernate: Freeze kernel threads in software_resume() + - dm writecache: fix data corruption when reloading the target + - dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath + - scsi: qla2xxx: set UNLOADING before waiting for session deletion + - scsi: qla2xxx: check UNLOADING before posting async work + - RDMA/mlx5: Set GRH fields in query QP on RoCE + - RDMA/mlx4: Initialize ib_spec on the stack + - RDMA/core: Prevent mixed use of FDs between shared ufiles + - RDMA/core: Fix race between destroy and release FD object + - [amd64,arm64] vfio: avoid possible overflow in + vfio_iommu_type1_pin_pages + - [amd64,arm64] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in + vaddr_get_pfn() + - [arm64] iommu/qcom: Fix local_base status check + - scsi: target/iblock: fix WRITE SAME zeroing + - [amd64] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled + system + - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl + - btrfs: fix partial loss of prealloc extent past i_size after fsync + - btrfs: transaction: Avoid deadlock due to bad initialization timing of + fs_info::journal_info + - mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout + loop + - [arm64] mmc: sdhci-xenon: fix annoying 1.8V regulator warning + - mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers + - [arm64] mmc: sdhci-msm: Enable host capabilities pertains to R1b + response + - [armhf] mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY + - [armhf] mmc: meson-mx-sdio: remove the broken ->card_busy() op + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.122 + - vhost: vsock: kick send_pkt worker once device is started + - [powerpc*] pci/of: Parse unassigned resources + - [x86] ASoC: topology: Check return value of pcm_new_ver + - [armhf] ASoC: sgtl5000: Fix VAG power-on handling + - [arm64,armhf] usb: dwc3: gadget: Properly set maxpacket limit + - [x86] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry + - wimax/i2400m: Fix potential urb refcnt leak + - [armhf] net: stmmac: fix enabling socfpga's ptp_ref_clock + - [armhf] net: stmmac: Fix sub-second increment + - cifs: protect updating server->dstaddr with a spinlock + - [s390x] ftrace: fix potential crashes when switching tracers + - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case + - drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event + - lib: devres: add a helper function for ioremap_uc + - [x86] mfd: intel-lpss: Use devm_ioremap_uc for MMIO + - ALSA: hda: Match both PCI ID and SSID for driver blacklist + - [x86] platform: GPD pocket fan: Fix error message when temp-limits are + out of range + - mac80211: add ieee80211_is_any_nullfunc() + - cgroup, netclassid: remove double cond_resched + - drm/atomic: Take the atomic toys away from X + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.123 + - USB: serial: qcserial: Add DW5816e support + - tracing/kprobes: Fix a double initialization typo + - vt: fix unicode console freeing with a common interface + - fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks + - net: macsec: preserve ingress frame ordering + - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc() + - net_sched: sch_skbprio: add message validation to skbprio_change() + - net: usb: qmi_wwan: add support for DW5816e + - sch_choke: avoid potential panic in choke_reset() + - sch_sfq: validate silly quantum values + - tipc: fix partial topology connection closure + - bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features(). + - net/mlx5: Fix forced completion access non initialized command entry + - net/mlx5: Fix command entry leak in Internal Error State + - bnxt_en: Improve AER slot reset. + - bnxt_en: Fix VF anti-spoof filter setup. + - net: stricter validation of untrusted gso packets + - HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices + - sctp: Fix bundling of SHUTDOWN with COOKIE-ACK + - HID: usbhid: Fix race between usbhid_close() and usbhid_stop() + - USB: uas: add quirk for LaCie 2Big Quadra + - USB: serial: garmin_gps: add sanity checking for data length + - tracing: Add a vmalloc_sync_mappings() for safe measure + - [arm64,armhf] KVM: vgic: Fix limit condition when writing to + GICD_I[CS]ACTIVER + - [arm64] KVM: Fix 32bit PC wrap-around + - [arm64] hugetlb: avoid potential NULL dereference + - mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous() + - [x86] KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm + blobs + - [x86] KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu_run()'s + asm blob + - batman-adv: fix batadv_nc_random_weight_tq + - batman-adv: Fix refcnt leak in batadv_show_throughput_override + - batman-adv: Fix refcnt leak in batadv_store_throughput_override + - batman-adv: Fix refcnt leak in batadv_v_ogm_process + - [amd64] x86/entry/64: Fix unwind hints in register clearing code + - [amd64] x86/entry/64: Fix unwind hints in kernel exit path + - [amd64] x86/entry/64: Fix unwind hints in rewind_stack_do_exit() + - [amd64] x86/unwind/orc: Don't skip the first frame for inactive tasks + - [amd64] x86/unwind/orc: Prevent unwinding before ORC initialization + - [amd64] x86/unwind/orc: Fix error path for bad ORC entry type + - [amd64] x86/unwind/orc: Fix premature unwind stoppage due to IRET frames + - netfilter: nat: never update the UDP checksum when it's 0 + - netfilter: nf_osf: avoid passing pointer to local var + - scripts/decodecode: fix trapping instruction formatting + - ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.124 + - [arm64,armhf] net: dsa: Do not make user port errors fatal + - shmem: fix possible deadlocks on shmlock_user_lock + - virtio-blk: handle block_device_operations callbacks after hot unplug + - mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040 + - net: fix a potential recursive NETDEV_FEAT_CHANGE + - net: phy: fix aneg restart in phy_ethtool_set_eee + - pppoe: only process PADT targeted at local interfaces + - Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu" + - tcp: fix error recovery in tcp_zerocopy_receive() + - virtio_net: fix lockdep warning on 32 bit + - [x86,arm64] hinic: fix a bug of ndo_stop + - net: ipv4: really enforce backoff for redirects + - netprio_cgroup: Fix unlimited memory leak of v2 cgroups + - net: tcp: fix rx timestamp behavior for tcp_recvmsg + - tcp: fix SO_RCVLOWAT hangs with fat skbs + - [i386] dmaengine: pch_dma.c: Avoid data race between probe and irq + handler + - [x86] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode + once + - ALSA: hda/hdmi: fix race in monitor detection during probe + - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() + - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index + - ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse + - gfs2: Another gfs2_walk_metadata fix + - [x86] pinctrl: baytrail: Enable pin configuration setting for GPIO chip + - [x86] pinctrl: cherryview: Add missing spinlock usage in + chv_gpio_irq_handler + - i40iw: Fix error handling in i40iw_manage_arp_cache() + - mmc: core: Check request type before completing the request + - mmc: block: Fix request completion in the CQE timeout path + - NFS: Fix fscache super_cookie index_key from changing after umount + - nfs: fscache: use timespec64 in inode auxdata + - NFSv4: Fix fscache cookie aux_data to ensure change_attr is included + - [arm64] fix the flush_icache_range arguments in machine_kexec + - netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() + - IB/mlx4: Test return value of calls to ib_get_cached_pkey + - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 + - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses + - ALSA: usb-audio: Add control message quirk delay for Kingston HyperX + headset + - usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B + - [arm64,armhf] usb: host: xhci-plat: keep runtime active when removing + host + - usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg + list + - cifs: fix leaked reference on requeued write + - exec: Move would_dump into flush_old_exec + - [arm64,armhf] clk: rockchip: fix incorrect configuration of rk3228 + aclk_gpu* clocks + - [arm64,armhf] dwc3: Remove check for HWO flag in + dwc3_gadget_ep_reclaim_trb_sg() + - Revert "ALSA: hda/realtek: Fix pop noise on ALC225" + - clk: Unlink clock if failed to prepare or enable + - [arm64] dts: rockchip: Replace RK805 PMIC node name with "pmic" on + rk3328 boards + - [x86] KVM: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.125 + - i2c: dev: Fix the race between the release of i2c_dev and cdev + - fix multiplication overflow in copy_fdtable() + - ubifs: remove broken lazytime support + - [amd64] iommu/amd: Fix over-read of ACPI UID from IVRS table + - ubi: Fix seq_file usage in detailed_erase_block_info debugfs file + - HID: multitouch: add eGalaxTouch P80H84 support + - HID: alps: Add AUI1657 device ID + - HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead + - scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV + - scsi: qla2xxx: Delete all sessions before unregister local nvme port + - configfs: fix config_item refcnt leak in configfs_rmdir() + - vhost/vsock: fix packet delivery order to monitoring devices + - [amd64] aquantia: Fix the media type of AQC100 ethernet controller in + the driver + - component: Silence bind error on -EPROBE_DEFER + - [ppc64el] scsi: ibmvscsi: Fix WARN_ON during event pool release + - HID: i2c-hid: reset Synaptics SYNA2393 on resume + - [x86] apic: Move TSC deadline timer debug printk + - gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() + - HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A + keyboard-dock + - ceph: fix double unlock in handle_cap_export() + - [arm64,armhf] stmmac: fix pointer check after utilization in + stmmac_interrupt + - USB: core: Fix misleading driver bug report + - [x86] platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA + - padata: Replace delayed timer with immediate workqueue in padata_reorder + - padata: initialize pd->cpu with effective cpumask + - padata: purge get_cpu and reorder_via_wq from padata_do_serial + - ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio + option + - ALSA: pcm: fix incorrect hw_base increase + - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme + - ALSA: hda/realtek - Add more fixup entries for Clevo machines + - [armhf] drm/etnaviv: fix perfmon domain interation + - apparmor: Fix use-after-free in aa_audit_rule_init + - apparmor: fix potential label refcnt leak in aa_change_profile + - apparmor: Fix aa_label refcnt leak in policy_update + - [arm64] dmaengine: tegra210-adma: Fix an error handling path in + 'tegra_adma_probe()' + - [powerpc*] Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE + - [powerpc*] 64s: Disable STRICT_KERNEL_RWX + - [amd64,arm64] nfit: Add Hyper-V NVDIMM DSM command set to white list + - [x86,arm64] libnvdimm/btt: Remove unnecessary code in btt_freelist_init + - [x86,arm64] libnvdimm/btt: Fix LBA masking during 'free list' population + - [x86] thunderbolt: Drop duplicated get_switch_at_route() + - cxgb4: free mac_hlist properly + - cxgb4/cxgb4vf: Fix mac_hlist initialization and free + - brcmfmac: abort and release host after error + - Revert "gfs2: Don't demote a glock until its revokes are written" + - misc: rtsx: Add short delay after exit from ASPM + - [x86] mei: release me_cl object reference + - rxrpc: Fix a memory leak in rxkad_verify_response() + - rxrpc: Trace discarded ACKs + - rxrpc: Fix ack discard + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126 + - ax25: fix setsockopt(SO_BINDTODEVICE) + - __netif_receive_skb_core: pass skb by reference + - net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* + - net: ipip: fix wrong address family in init error path + - net/mlx5: Add command entry handling completion + - net: revert "net: get rid of an signed integer overflow in + ip_idents_reserve()" + - net sched: fix reporting the first-time use timestamp + - r8152: support additional Microsoft Surface Ethernet Adapter variant + - sctp: Don't add the shutdown timer if its already been added + - sctp: Start shutdown on association restart if in SHUTDOWN-SENT state + and socket is closed + - net/mlx5e: Update netdev txq on completions during closure + - net/mlx5: Annotate mutex destroy for root ns + - net: sun: fix missing release regions in cas_init_one(). + - net/mlx4_core: fix a memory leak bug. + - [armhf] dts: rockchip: fix phy nodename for rk3228-evb + - [arm64] dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts + - [arm64,armhf] gpio: tegra: mask GPIO IRQs during IRQ shutdown + - ALSA: usb-audio: add mapping for ASRock TRX40 Creator + - gfs2: move privileged user check to gfs2_quota_lock_check + - cachefiles: Fix race between read_waiter and read_copier involving + op->to_do + - [arm64] usb: dwc3: pci: Enable extcon driver for Intel Merrifield + - usb: gadget: legacy: fix redundant initialization warnings + - IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() + - cifs: Fix null pointer check in cifs_read + - Input: usbtouchscreen - add support for BonXeon TP + - Input: evdev - call input_flush_device() on release(), not flush() + - Input: xpad - add custom init packet for Xbox One S controllers + - Input: i8042 - add ThinkPad S230u to i8042 reset list + - Input: synaptics-rmi4 - really fix attn_data use-after-free + - Input: synaptics-rmi4 - fix error return code in rmi_driver_probe() + - [armel,armhf] 8970/1: decompressor: increase tag size + - [arm*] 8843/1: use unified assembler in headers + - gpio: exar: Fix bad handling for ida_simple_get error path + - IB/qib: Call kobject_put() when kobject_init_and_add() fails + - [armhf] dts/imx6q-bx50v3: Set display interface clock parents + - [armel,armhf] dts: bcm2835-rpi-zero-w: Fix led polarity + - mmc: block: Fix use-after-free issue for rpmb + - ALSA: hwdep: fix a left shifting 1 by 31 UB bug + - ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround + - ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC + - exec: Always set cap_ambient in cap_bprm_set_creds + - ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio + - ALSA: hda/realtek - Add new codec supported for ALC287 + - libceph: ignore pool overlay and cache logic on redirects + - IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode + - mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() + - include/asm-generic/topology.h: guard cpumask_of_node() macro argument + - iommu: Fix reference count leak in iommu_group_alloc. + - mmc: core: Fix recursive locking issue in CQE recovery path + - RDMA/core: Fix double destruction of uobject + - mac80211: mesh: fix discovery timer re-arming issue / crash + - [x86] dma: Fix max PFN arithmetic overflow on 32 bit systems + - [x86] copy_xstate_to_kernel(): don't leave parts of destination + uninitialized + - xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input + - xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output + - xfrm interface: fix oops when deleting a x-netns interface + - xfrm: fix a warning in xfrm_policy_insert_list + - xfrm: fix a NULL-ptr deref in xfrm_local_error + - xfrm: fix error in comment + - vti4: eliminated some duplicate code. + - ip_vti: receive ipip packet by calling ip_tunnel_rcv + - netfilter: nft_reject_bridge: enable reject with bridge vlan + - netfilter: ipset: Fix subcounter update skip + - netfilter: nfnetlink_cthelper: unbreak userspace helper support + - netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code + - esp6: get the right proto for transport mode in esp6_gso_encap + - bnxt_en: Fix accumulation of bp->net_stats_prev. + - xsk: Add overflow check for u64 division, stored into u32 + - qlcnic: fix missing release in qlcnic_83xx_interrupt_test. + - bonding: Fix reference count leak in bond_sysfs_slave_add. + - netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build + - mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.127 + - Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race + window" + - libnvdimm: Fix endian conversion issues + - HID: sony: Fix for broken buttons on DS3 USB dongles + - HID: i2c-hid: add Schneider SCL142ALM to descriptor override + - p54usb: add AirVasT USB stick device-id + - mmc: fix compilation of user API + - scsi: ufs: Release clock if DMA map fails + - airo: Fix read overflows sending packets + - [x86] drm/i915: fix port checks for MST support on gen >= 11 + - [arm64] scsi: hisi_sas: Check sas_port before using it + - [powerpc*] powernv: Avoid re-registration of imc debugfs directory + - [s390x] ftrace: save traced function caller + - drm/edid: Add Oculus Rift S to non-desktop list + - [s390x] mm: fix set_huge_pte_at() for empty ptes + - null_blk: return error for invalid zone size + - [arm64] net: ethernet: stmmac: Enable interface clocks on probe for + IPQ806x + - [arm64,armhf] net: smsc911x: Fix runtime PM imbalance on error + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.128 + - devinet: fix memleak in inetdev_init() + - l2tp: add sk_family checks to l2tp_validate_socket + - l2tp: do not use inet_hash()/inet_unhash() + - net: usb: qmi_wwan: add Telit LE910C1-EUX composition + - vsock: fix timeout in vsock_accept() + - net: check untrusted gso_size at kernel entry + - USB: serial: qcserial: add DW5816e QDL support + - USB: serial: usb_wwan: do not resubmit rx urb on fatal errors + - USB: serial: option: add Telit LE910C1-EUX compositions + - [arm64,armhf] usb: musb: start session in resume for host port + - [arm64,armhf] usb: musb: Fix runtime PM imbalance on error + - vt: keyboard: avoid signed integer overflow in k_ascii (CVE-2020-13974) + - tty: hvc_console, fix crashes on parallel open/close + - staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK + - CDC-ACM: heed quirk also in error handling + - [arm64] nvmem: qfprom: remove incorrect write support + - uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly + aligned + - Revert "net/mlx5: Annotate mutex destroy for root ns" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.129 + - ipv6: fix IPV6_ADDRFORM operation logic + - net_failover: fixed rollback in net_failover_open() + - bridge: Avoid infinite loop when suppressing NS messages with invalid + options + - vxlan: Avoid infinite loop when suppressing NS messages with invalid + options + - tun: correct header offsets in napi frags mode + - make 'user_access_begin()' do 'access_ok()' (CVE-2018-20669) + - [x86] uaccess: Inhibit speculation past access_ok() in + user_access_begin() + - lib: Reduce user_access_begin() boundaries in strncpy_from_user() and + strnlen_user() + - btrfs: merge btrfs_find_device and find_device (CVE-2019-18885) + - btrfs: Detect unbalanced tree with empty leaf before crashing btree + operations + - [armel,armhf] 8977/1: ptrace: Fix mask for thumb breakpoint hook + - sched/fair: Don't NUMA balance for kthreads + - Input: synaptics - add a second working PNP_ID for Lenovo T470s + - [powerpc*] xive: Clear the page tables for the ESB IO mapping + - ath9k_htc: Silence undersized packet warnings + - RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated + - [x86] cpu/amd: Make erratum #1054 a legacy erratum + - perf probe: Accept the instance number of kretprobe event + - mm: add kvfree_sensitive() for freeing sensitive data objects + - aio: fix async fsync creds + - btrfs: tree-checker: Check level for leaves and nodes + - [x86] Fix jiffies ODR violation + - [x86] PCI: Mark Intel C620 MROMs as having non-compliant BARs + - [x86] speculation: Prevent rogue cross-process SSBD shutdown + (CVE-2020-10766) + - [x86] reboot/quirks: Add MacBook6,1 reboot quirk + - efi/efivars: Add missing kobject_put() in sysfs entry creation error + path + - [i386] ALSA: es1688: Add the missed snd_card_free() + - ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines + - ALSA: usb-audio: Fix inconsistent card PM state after resume + - ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt + Dock + - [arm64,x86] ACPI: sysfs: Fix reference count leak in + acpi_sysfs_add_hotplug_profile() + - [amd64,arm64] ACPI: CPPC: Fix reference count leak in + acpi_cppc_processor_probe() + - [arm64] ACPI: GED: add support for _Exx / _Lxx handler methods + - [arm64,x86] ACPI: PM: Avoid using power resources if there are none for + D0 + - cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages + - nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() + - [arm*] spi: bcm2835aux: Fix controller unregister order + - PM: runtime: clk: Fix clk_pm_runtime_get() error path + - [arm64] crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when + ndevlist is fully iterated + - ALSA: pcm: disallow linking stream to itself + - [x86] {mce,mm}: Unmap the entire page if the whole page is affected and + poisoned + - [x86] KVM: Fix APIC page invalidation race + - [x86] kvm: Fix L1TF mitigation for shadow MMU + - [x86] KVM: x86/mmu: Consolidate "is MMIO SPTE" code + - [x86] KVM: only do L1TF workaround on affected processors + - [x86] speculation: Change misspelled STIPB to STIBP + - [x86] speculation: Add support for STIBP always-on preferred mode + - [x86] speculation: Avoid force-disabling IBPB based on STIBP and + enhanced IBRS. (CVE-2020-10767) + - [x86] speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect + branches. (CVE-2020-10768) + - spi: No need to assign dummy value in spi_unregister_controller() + - spi: Fix controller unregister order + - [amd64] spi: pxa2xx: Fix controller unregister order + - [arm*] spi: bcm2835: Fix controller unregister order + - [amd64] spi: pxa2xx: Balance runtime PM enable/disable on error + - [amd64] spi: pxa2xx: Fix runtime PM ref imbalance on probe error + - crypto: virtio: Fix use-after-free in + virtio_crypto_skcipher_finalize_req() + - crypto: virtio: Fix src/dst scatterlist calculation in + __virtio_crypto_skcipher_do_req() + - crypto: virtio: Fix dest length calculation in + __virtio_crypto_skcipher_do_req() + - ovl: initialize error in ovl_copy_xattr + - proc: Use new_inode not new_inode_pseudo + - [x86] KVM: nSVM: fix condition for filtering async PF + - [x86] KVM: nSVM: leave ASID aside in copy_vmcb_control_area + - [x86] KVM: nVMX: Consult only the "basic" exit reason when routing + nested exit + - [arm64] KVM: Make vcpu_cp1x() work on Big Endian hosts + - scsi: megaraid_sas: TM command refire leads to controller firmware crash + - ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx + - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg + - ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb + - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb + - mm/slub: fix a memory leak in sysfs_slab_add() + - fat: don't allow to mount if the FAT length == 0 + - perf: Add cond_resched() to task_function_call() + - [x86] agp/intel: Reinforce the barrier after GTT updates + - [arm64] mmc: sdhci-msm: Clear tuning done flag while hs400 tuning + - mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card() + - xen/pvcalls-back: test for errors when calling backend_connect() + - [arm64] KVM: Synchronize sysreg state on injecting an AArch32 exception + - [arm64] ACPI: GED: use correct trigger type field in _Exx / _Lxx + handling + - [arm64] drm: bridge: adv7511: Extend list of audio sample rates + - [x86] crypto: ccp -- don't "select" CONFIG_DMADEVICES + - media: si2157: Better check for running tuner in init + - [amd64] spi: pxa2xx: Apply CS clk quirk to BXT + - [amd64] net: atlantic: make hw_get_regs optional + - net: ena: fix error returning in ena_com_get_hash_function() + - [arm64] insn: Fix two bugs in encoding 32-bit logical immediates + - ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K + - Bluetooth: Add SCO fallback for invalid LMP parameters error + - [armhf] clocksource: dw_apb_timer: Make CPU-affiliation being optional + - [armhf] clocksource: dw_apb_timer_of: Fix missing clockevent timers + - btrfs: do not ignore error from btrfs_next_leaf() when inserting + checksums + - batman-adv: Revert "disable ethtool link speed detection when auto + negotiation off" + - [armhf] mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC + error + - [x86] kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit + - [x86] net: vmxnet3: fix possible buffer overflow caused by bad DMA value + in vmxnet3_get_rss() + - brcmfmac: fix wrong location to get firmware feature + - e1000: Distribute switch variables for initialization + - dt-bindings: display: mediatek: control dpi pins mode to avoid leakage + - audit: fix a net reference leak in audit_send_reply() + - media: dvb: return -EREMOTEIO on i2c transfer failure. + - [mips*] Make sparse_init() using top-down allocation + - Bluetooth: btbcm: Add 2 missing models to subver tables + - audit: fix a net reference leak in audit_list_rules_send() + - netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported + - exit: Move preemption fixup up, move blocking operations down + - sched/core: Fix illegal RCU from offline CPUs + - drivers/perf: hisi: Fix typo in events attribute array + - [armhf] net: allwinner: Fix use correct return type for ndo_start_xmit() + - xfs: clean up the error handling in xfs_swap_extents + - Crypto/chcr: fix for ccm(aes) failed test + - [mips*] cm: Fix an invalid error code of INTVN_*_ERR + - xfs: reset buffer write failure state on successful completion + - xfs: fix duplicate verification from xfs_qm_dqflush() + - [x86] platform/x86: intel-vbtn: Use acpi_evaluate_integer() + - [x86] platform/x86: intel-vbtn: Split keymap into buttons and switches + parts + - [x86] platform/x86: intel-vbtn: Do not advertise switches to userspace + if they are not there + - [x86] platform/x86: intel-vbtn: Also handle tablet-mode switch on + "Detachable" and "Portable" chassis-types + - nvme: refine the Qemu Identify CNS quirk + - ath10k: Remove msdu from idr when management pkt send fails + - [arm64] wcn36xx: Fix error handling path in 'wcn36xx_probe()' + - net: qed*: Reduce RX and TX default ring count when running inside kdump + kernel + - mt76: avoid rx reorder buffer overflow + - md: don't flush workqueue unconditionally in md_open + - veth: Adjust hard_start offset on redirect XDP frames + - net/mlx5e: IPoIB, Drop multicast packets that this interface sent + - rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() + - mwifiex: Fix memory corruption in dump_station + - [x86] boot: Correct relocation destination on old linkers + - [x86] mm: Stop printing BRK addresses + - btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a + new qgroup + - macvlan: Skip loopback packets in RX handler + - PCI: Don't disable decoding when mmio_always_on is set + - [mips*] Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() + - bcache: fix refcount underflow in bcache_device_free() + - [arm64] mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk + - mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core + - ixgbe: fix signed-integer-overflow warning + - [armhf] mmc: sdhci-esdhc-imx: fix the mask for tuning start point + - cpuidle: Fix three reference count leaks + - [x86] platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32() + - [x86] platform/x86: intel-hid: Add a quirk to support HP Spectre X2 + (2015) + - [x86] platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / + "Laptop" chasis-type + - btrfs: include non-missing as a qualifier for the latest_bdev + - btrfs: send: emit file capabilities after chown + - mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() + - mm: initialize deferred pages with interrupts enabled + - ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max + - ext4: fix error pointer dereference + - ext4: fix race between ext4_sync_parent() and rename() + - PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect + - PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 + - PCI: Avoid FLR for AMD Starship USB 3.0 + - PCI: Add ACS quirk for iProc PAXB + - PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints + - PCI: Remove unused NFP32xx IDs + - [x86] hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs + - [x86] amd_nb: Add PCI device IDs for family 17h, model 30h + - PCI: add USR vendor id and use it in r8169 and w6692 driver + - PCI: Move Synopsys HAPS platform device IDs + - PCI: Move Rohm Vendor ID to generic list + - misc: pci_endpoint_test: Add the layerscape EP device support + - misc: pci_endpoint_test: Add support to test PCI EP in AM654x + - PCI: Add Synopsys endpoint EDDA Device ID + - PCI: Add NVIDIA GPU multi-function power dependencies + - PCI: Enable NVIDIA HDA controllers + - [x86] amd_nb: Add PCI device IDs for family 17h, model 70h + - ALSA: lx6464es - add support for LX6464ESe pci express variant + - PCI: Add Genesys Logic, Inc. Vendor ID + - PCI: Add Amazon's Annapurna Labs vendor ID + - PCI: vmd: Add device id for VMD device 8086:9A0B + - [x86] amd_nb: Add Family 19h PCI IDs + - PCI: Add Loongson vendor ID + - serial: 8250_pci: Move Pericom IDs to pci_ids.h + - PCI: Make ACS quirk implementations more uniform + - PCI: Unify ACS quirk desired vs provided checking + - PCI: Generalize multi-function power dependency device links + - btrfs: fix error handling when submitting direct I/O bio + - btrfs: fix wrong file range cleanup after an error filling dealloc range + - PCI: Program MPS for RCiEP devices + - e1000e: Disable TSO for buffer overrun workaround + - e1000e: Relax condition to trigger reset for ME workaround + - carl9170: remove P2P_GO support + - media: go7007: fix a miss of snd_card_free (CVE-2019-20810) + - Bluetooth: hci_bcm: fix freeing not-requested IRQ + - b43legacy: Fix case where channel status is corrupted + - b43: Fix connection problem with WPA3 + - b43_legacy: Fix connection problem with WPA3 + - igb: Report speed and duplex as unknown when device is runtime suspended + - [arm64,armhf] power: vexpress: add suppress_bind_attrs to true + - [armhf] pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210 + - [armhf] pinctrl: samsung: Save/restore eint_mask over suspend for + EINT_TYPE GPIOs + - gnss: sirf: fix error return code in sirf_probe() + - dm crypt: avoid truncating the logical block size + - kernel/cpu_pm: Fix uninitted local in cpu_pm + - [armhf] tegra: Correct PL310 Auxiliary Control Register initialization + - [powerpc*] 64s: Don't let DT CPU features set FSCR_DSCR + - [powerpc*] 64s: Save FSCR to init_task.thread.fscr after feature init + - sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate + registrations. + - sunrpc: clean up properly in gss_mech_unregister() + - [armhf] w1: omap-hdq: cleanup to add missing newline for some dev_dbg + - perf probe: Do not show the skipped events + - perf probe: Fix to check blacklist address correctly + - perf probe: Check address correctness by map instead of _etext + - perf symbols: Fix debuginfo search for Ubuntu + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.130 + - [arm64,armhf] clk: sunxi: Fix incorrect usage of round_down() + - [arm64,armhf] ASoC: tegra: tegra_wm8903: Support nvidia, headset + property + - i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets + - [x86] iio: pressure: bmp280: Tolerate IRQ before registering + - [arm64] clk: qcom: msm8916: Fix the address location of pll->config_reg + - [arm64] backlight: lp855x: Ensure regulators are disabled on probe + failure + - [armhf] ASoC: davinci-mcasp: Fix dma_chan refcnt leak when getting dma + type + - [armel] integrator: Add some Kconfig selections + - scsi: qedi: Check for buffer overflow in qedi_set_path() + - ALSA: hda/realtek - Introduce polarity for micmute LED GPIO + - [i386] ALSA: isa/wavefront: prevent out of bounds write in ioctl + - PCI: Allow pci_resize_resource() for devices on root bus + - scsi: qla2xxx: Fix issue with adapter's stopping state + - [x86] iio: bmp280: fix compensation of humidity + - f2fs: report delalloc reserve as non-free in statfs for project quota + - [x86] i2c: pxa: clear all master action bits in i2c_pxa_stop_message() + - [armhf] clk: samsung: Mark top ISP and CAM clocks on Exynos542x as + critical + - usblp: poison URBs upon disconnect + - serial: 8250: Fix max baud limit in generic 8250 port + - dm mpath: switch paths in dm_blk_ioctl() code path + - [arm64] PCI: aardvark: Don't blindly enable ASPM L0s and don't write to + read-only register + - vfio/pci: fix memory leaks in alloc_perm_bits() + - RDMA/mlx5: Add init2init as a modify command + - scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event + - [powerpc*] perf/hv-24x7: Fix inconsistent output values incase multiple + hv-24x7 events run + - nfsd: Fix svc_xprt refcnt leak when setup callback client failed + - [amd64] PCI: vmd: Filter resource type bits from shadow register + - [powerpc*] crashkernel: Take "mem=" option into account + - yam: fix possible memory leak in yam_init_driver + - apparmor: fix introspection of of task mode for unconfined tasks + - apparmor: check/put label on apparmor_sk_clone_security() + - scsi: sr: Fix sr_probe() missing deallocate of device minor + - [powerpc*] scsi: ibmvscsi: Don't send host info in adapter info MAD + after LPM + - apparmor: fix nnp subset test for unconfined + - [x86] purgatory: Disable various profiling and sanitizing options + - scsi: qedi: Do not flush offload work if ARP not resolved + - [armhf] dts: sun8i-h2-plus-bananapi-m2-zero: Fix led polarity + - scsi: qedf: Fix crash when MFW calls for protocol stats while function + is still probing + - [arm64] firmware: qcom_scm: fix bogous abuse of dma-direct internals + - ALSA: usb-audio: Improve frames size computation + - ALSA: usb-audio: Fix racy list management in output queue + - [s390x] qdio: put thinint indicator after early error + - tty: hvc: Fix data abort due to race in hvc_open + - [armhf] thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR + - [arm64,armhf] usb: dwc3: gadget: Properly handle failed kick_transfer + - [mips64el,mipsel] staging: sm750fb: add missing case while setting + FB_VISUAL + - [arm64,i386] i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output + - [arm*] serial: amba-pl011: Make sure we initialize the port.lock + spinlock + - drivers: base: Fix NULL pointer exception in __platform_driver_probe() + if a driver developer is foolish + - PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges + - scsi: qla2xxx: Fix warning after FC target reset + - scsi: mpt3sas: Fix double free warnings + - [arm64,armhf] pinctrl: rockchip: fix memleak in rockchip_dt_node_to_map + - [armhf] clk: ti: composite: fix memory leak + - PCI: Fix pci_register_host_bridge() device_register() error handling + - [powerpc*] Don't initialise init_task->thread.regs + - tty: n_gsm: Fix SOF skipping + - tty: n_gsm: Fix waking up upper tty layer when room available + - HID: Add quirks for Trust Panora Graphic Tablet + - ipmi: use vzalloc instead of kmalloc for user creation + - [powerpc*] pseries/ras: Fix FWNMI_VALID off by one + - vfio-pci: Mask cap zero + - usb/ohci-platform: Fix a warning when hibernating + - [arm64] drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms + allocation + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT8-A + tablet + - [armhf] USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() + - tty: n_gsm: Fix bogus i++ in gsm_data_kick + - scsi: target: tcmu: Userspace must not complete queued commands + - [powerpc*] 64s/pgtable: fix an undefined behaviour + - dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone + - PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port + - [arm64,armhf] PCI: dwc: Fix inner MSI IRQ domain registration + - IB/cma: Fix ports memory leak in cma_configfs + - [arm*] usb: dwc2: gadget: move gadget resume after the core is in L0 + state + - usb: gadget: Fix issue with config_ep_by_speed function + - RDMA/iw_cxgb4: cleanup device debugfs entries on ULD remove + - [x86] apic: Make TSC deadline timer detection message visible + - scsi: target: tcmu: Fix a use after free in + tcmu_check_expired_queue_cmd() + - [arm*] clk: bcm2835: Fix return type of bcm2835_register_gate + - [ppc64el] KVM: Book3S HV: Ignore kmemleak false positives + - net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' + - NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION + - of: Fix a refcounting bug in __of_attach_node_sysfs() + - rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not + user_ID + - gfs2: Allow lock_nolock mount to specify jid=X + - scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj + - scsi: ufs: Don't update urgent bkops level when toggling auto bkops + - [armhf] pinctrl: freescale: imx: Fix an error handling path in + 'imx_pinctrl_probe()' + - geneve: change from tx_error to tx_dropped on missing metadata + - lib/zlib: remove outdated and incorrect pre-increment optimization + - blktrace: use errno instead of bi_status + - blktrace: fix endianness in get_pdu_int() + - blktrace: fix endianness for blk_log_remap() + - gfs2: fix use-after-free on transaction ail lists + - drivers/perf: hisi: Fix wrong value for all counters enable + - afs: Fix memory leak in afs_put_sysnames() + - ASoC: core: only convert non DPCM link to DPCM link + - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT10-A + tablet + - ASoC: rt5645: Add platform-data for Asus T101HA + - [arm64,armhf] drm/sun4i: hdmi ddc clk: Fix size of m divider + - [x86] idt: Keep spurious entries unset in system_vectors + - net/filter: Permit reading NET in load_bytes_relative when MAC not set + - xdp: Fix xsk_generic_xmit errno + - [arm64,armhf] usb/xhci-plat: Set PM runtime as active on resume + - usb: host: ehci-platform: add a quirk to avoid stuck + - usb/ehci-platform: Set PM runtime as active on resume + - perf report: Fix NULL pointer dereference in + hists__fprintf_nr_sample_events() + - ext4: stop overwrite the errcode in ext4_setup_super + - bcache: fix potential deadlock problem in btree_gc_coalesce + (CVE-2020-12771) + - afs: Fix non-setting of mtime when writing into mmap + - afs: afs_write_end() should change i_size under the right lock + - block: Fix use-after-free in blkdev_get() + - [arm64] hw_breakpoint: Don't invoke overflow handler on uaccess + watchpoints + - libata: Use per port sync for detach + - drm: encoder_slave: fix refcouting error for modules + - drm/dp_mst: Reformat drm_dp_check_act_status() a bit + - drm/qxl: Use correct notify port address when creating cursor ring + - selinux: fix double free + - ext4: fix partial cluster initialization when splitting extent + - ext4: avoid race conditions when remounting with options that change dax + - drm/dp_mst: Increase ACT retry timeout to 3s + - block: nr_sects_write(): Disable preemption on seqcount write + - mtd: rawnand: Pass a nand_chip object to nand_scan() + - mtd: rawnand: Pass a nand_chip object to nand_release() + - mtd: rawnand: diskonchip: Fix the probe error path + - [armel,armhf] mtd: rawnand: orion: Fix the probe error path + - [s390x] fix syscall_get_error for compat processes + - [x86] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser + - [x86] drm/i915/icl+: Fix hotplug interrupt disabling after storm + detection + - crypto: algif_skcipher - Cap recv SG list at ctx->used + - crypto: algboss - don't wait during notifier callback + - kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex + - e1000e: Do not wake up the system via WOL if device wakeup is disabled + - [mips*] net: octeon: mgmt: Repair filling of RX ring + - kretprobe: Prevent triggering kretprobe from within kprobe_flush_task + - sched/rt, net: Use CONFIG_PREEMPTION.patch + - net: core: device_rename: Use rwsem instead of a seqcount + - md: add feature flag MD_FEATURE_RAID0_LAYOUT + - [x86] kvm: Move kvm_set_mmio_spte_mask() from x86.c to mmu.c + - [x86] kvm: Fix reserved bits related calculation errors caused by MKTME + - [x86] KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be + generated + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.131 + - net: be more gentle about silly gso requests coming from user + - block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed + - fanotify: fix ignore mask logic for events on child and on dir + - [armhf] mtd: rawnand: marvell: Fix the condition on a return code + - net: sched: export __netdev_watchdog_up() + - [x86] EDAC/amd64: Add Family 17h Model 30h PCI IDs + - [arm64,armhf] i2c: tegra: Cleanup kerneldoc comments + - [arm64,armhf] i2c: tegra: Add missing kerneldoc for some fields + - [arm64,armhf] i2c: tegra: Fix Maximum transfer size + - ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 + - ALSA: hda/realtek: Enable mute LED on an HP system + - ALSA: hda/realtek - Enable micmute LED on and HP system + - apparmor: don't try to replace stale label in ptraceme check + (Closes: #963493) + - [ppc64el] ibmveth: Fix max MTU limit + - mld: fix memory leak in ipv6_mc_destroy_dev() + - net: bridge: enfore alignment for ethernet address + - net: fix memleak in register_netdevice() + - net: place xmit recursion in softnet data + - net: use correct this_cpu primitive in dev_recursion_level + - net: increment xmit_recursion level in dev_direct_xmit() + - net: usb: ax88179_178a: fix packet alignment padding + - rxrpc: Fix notification call on completion of discarded calls + - sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket + - tcp: don't ignore ECN CWR on pure ACK + - tcp: grow window for OOO packets only for SACK flows + - tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes + - ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() + - net: phy: Check harder for errors in get_phy_id() + - ip_tunnel: fix use-after-free in ip_tunnel_lookup() + - sch_cake: don't try to reallocate or unshare skb unconditionally + - sch_cake: fix a few style nits + - tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT + - sch_cake: don't call diffserv parsing code when it is not needed + - net: Fix the arp error in some cases + - net: Do not clear the sock TX queue in sk_set_socket() + - net: core: reduce recursion limit value + - [arm*] usb: dwc2: Postponed gadget registration to the udc class driver + - usb: add USB_QUIRK_DELAY_INIT for Logitech C922 + - USB: ehci: reopen solution for Synopsys HC bug + - xhci: Poll for U0 after disabling USB2 LPM + - [armhf] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() + - ALSA: usb-audio: add quirk for Denon DCD-1500RE + - ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG) + - ALSA: usb-audio: Fix OOB access of mixer element list + - [s390x] scsi: zfcp: Fix panic on ERP timeout for previously dismissed + ERP action + - xhci: Fix incorrect EP_STATE_MASK + - xhci: Fix enumeration issue when setting max packet size for FS devices. + - xhci: Return if xHCI doesn't support LPM + - cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip + - loop: replace kill_bdev with invalidate_bdev + - IB/mad: Fix use after free when destroying MAD agent + - cifs/smb3: Fix data inconsistent when punch hole + - cifs/smb3: Fix data inconsistent when zero file range + - xfrm: Fix double ESP trailer insertion in IPsec crypto offload. + - efi/esrt: Fix reference count leak in esre_create_sysfs_entry. + - [armhf] regualtor: pfuze100: correct sw1a/sw2 on pfuze3000 + - [armhf] ASoC: fsl_ssi: Fix bclk calculation for mono channel + - [armhf] dts: Fix duovero smsc interrupt for suspend + - regmap: Fix memory leak from regmap_register_patch + - rxrpc: Fix handling of rwind from an ACK packet + - RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 + - RDMA/cma: Protect bind_list and listen_list while finding matching cm id + - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() + - net: qed: fix left elements count calculation + - net: qed: fix NVMe login fails over VFs + - net: qed: fix excessive QM ILT lines consumption + - cxgb4: move handling L2T ARP failures to caller + - [armhf] imx5: add missing put_device() call in imx_suspend_alloc_ocram() + - netfilter: ipset: fix unaligned atomic access + - i2c: core: check returned size of emulated smbus block read + - sched/deadline: Initialize ->dl_boosted + - sched/core: Fix PI boosting between RT and DEADLINE tasks + - ata/libata: Fix usage of page address by page_address in + ata_scsi_mode_select_xlat function + - net: alx: fix race condition in alx_remove + - [s390x] ptrace: fix setting syscall number + - [s390x] vdso: fix vDSO clock_getres() + - kbuild: improve cc-option to clean up all temporary files + - blktrace: break out of blktrace setup on concurrent calls + - ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table + - ALSA: hda/realtek - Add quirk for MSI GE63 laptop + - [x86,arm64] ACPI: sysfs: Fix pm_profile_attr type + - [x86] KVM: Fix MSR range of APIC registers in X2APIC mode + - [x86] KVM: nVMX: Plumb L2 GPA through to PML emulation + - [amd64] x86/asm/64: Align start of __clear_user() loop to 16-bytes + - btrfs: fix data block group relocation failure due to concurrent scrub + - btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof + - mm/slab: use memzero_explicit() in kzfree() + - ocfs2: avoid inode removal while nfsd is accessing it + - ocfs2: load global_inode_alloc + - ocfs2: fix value of OCFS2_INVALID_SLOT + - ocfs2: fix panic on nfs server over ocfs2 + - [arm64] perf: Report the PC value in REGS_ABI_32 mode + - tracing: Fix event trigger to accept redundant spaces + - ring-buffer: Zero out time extend if it is nested and not absolute + - drm/radeon: fix fb_div check in ni_init_smc_spll_table() + - [x86,arm64] Staging: rtl8723bs: prevent buffer overflow in + update_sta_support_rate() + - sunrpc: fixed rollback in rpc_gssd_dummy_populate() + - SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() + - pNFS/flexfiles: Fix list corruption if the mirror count changes + - NFSv4 fix CLOSE not waiting for direct IO compeletion + - dm writecache: correct uncommitted_block when discarding uncommitted + entry + - dm writecache: add cond_resched to loop in persistent_memory_claim() + - xfs: add agf freeblocks verify in xfs_agf_verify (CVE-2020-12655) + - Revert "tty: hvc: Fix data abort due to race in hvc_open" + + [ Salvatore Bonaccorso ] + * [rt] Add new signing key for Tom Zanussi + * nfsd: apply umask on fs without ACL support (Closes: #962254) + * [rt] Update to 4.19.120-rt52: + - tasklet: Address a race resulting in double-enqueue + - hrtimer: fix logic for when grabbing softirq_expiry_lock can be elided + * [rt] Update to 4.19.124-rt53 + * [rt] Update to 4.19.127-rt55: + - fs/dcache: Include swait.h header + - mm: slub: Always flush the delayed empty slubs in flush_all() + - tasklet: Fix UP case for tasklet CHAINED state + * usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect + (CVE-2020-15393) + + [ Ben Hutchings ] + * [rt] Update "net: move xmit_recursion to per-task variable on -RT" to + apply on top of "net: place xmit recursion in softnet data" + * [rt] Drop "net: Add a mutex around devnet_rename_seq", redundant with + "net: Introduce net_rwsem to protect net_namespace_list" + * [rt] Drop idle task related parts of "sched: Move mmdrop to RCU on RT", + redundant with "sched/core: Fix illegal RCU from offline CPUs" + * Bump ABI to 10 + + [ YunQiang Su ] + * [mips*]: Do not enable MIPS_O32_FP64_SUPPORT, since golang hasn't been + migrated to FPXX yet and this breaks the golang packages on Octeon + hardware. In turns this disables MSA on 32-bit kernels. + + [ Luca Boccassi ] + * [cloud] Enable INFINIBAND configs for HyperV/Azure (Closes: #958300) + + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 09 Jul 2020 04:45:56 +0200 + +linux (4.19.118-2+deb10u1) buster-security; urgency=high + + [ Salvatore Bonaccorso ] + * selinux: properly handle multiple messages in selinux_netlink_send() + (CVE-2020-10751) + * fs/namespace.c: fix mountpoint reference counter race (CVE-2020-12114) + * USB: core: Fix free-while-in-use bug in the USB S-Glibrary + (CVE-2020-12464) + * [x86] KVM: SVM: Fix potential memory leak in svm_cpu_init() + (CVE-2020-12768) + * scsi: sg: add sg_remove_request in sg_write (CVE-2020-12770) + * USB: gadget: fix illegal array access in binding with UDC (CVE-2020-13143) + * netlabel: cope with NULL catmap (CVE-2020-10711) + * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() + (CVE-2020-10732) + * kernel/relay.c: handle alloc_percpu returning NULL in relay_open + (CVE-2019-19462) + * mm: Fix mremap not considering huge pmd devmap (CVE-2020-10757) + * [x86] KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01 + * KVM: Introduce a new guest mapping API + * [arm64] kvm: fix compilation on aarch64 + * [s390x] kvm: fix compilation on s390 + * [s390x] kvm: fix compile on s390 part 2 + * KVM: Properly check if "page" is valid in kvm_vcpu_unmap + * [x86] kvm: Introduce kvm_(un)map_gfn() (CVE-2019-3016) + * [x86] kvm: Cache gfn to pfn translation (CVE-2019-3016) + * [x86] KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed (CVE-2019-3016) + * [x86] KVM: Clean up host's steal time structure (CVE-2019-3016) + * include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for + swap (Closes: #960271) + + [ Ben Hutchings ] + * propagate_one(): mnt_set_mountpoint() needs mount_lock + * [x86] Add support for mitigation of Special Register Buffer Data Sampling + (SRBDS) (CVE-2020-0543): + - x86/cpu: Add 'table' argument to cpu_matches() + - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) + mitigation + - x86/speculation: Add SRBDS vulnerability and mitigation documentation + - x86/speculation: Add Ivy Bridge to affected list + * [x86] speculation: Do not match steppings, to avoid an ABI change + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 07 Jun 2020 17:42:22 +0200 + +linux (4.19.118-2) buster; urgency=medium + + * Merge changes from 4.19.67-2+deb10u2 to include all security fixes from + DSA 4667-1. + + -- Salvatore Bonaccorso <carnil@debian.org> Wed, 29 Apr 2020 11:38:41 +0200 + +linux (4.19.118-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99 + - Revert "efi: Fix debugobjects warning on 'efi_rts_work'" + - xfs: Sanity check flags of Q_XQUOTARM call + - [x86] mfd: intel-lpss: Add default I2C device properties for Gemini Lake + - SUNRPC: Fix svcauth_gss_proxy_init() + - [powerpc*] pseries: Enable support for ibm,drc-info property + - tipc: update mon's self addr when node addr generated + - tipc: fix wrong timeout input for tipc_wait_for_cond() + - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready + - [armhf] crypto: sun4i-ss - fix big endian issues + - perf map: No need to adjust the long name of modules + - ipmi: Fix memory leak in __ipmi_bmc_register (CVE-2019-19046) + - ixgbe: don't clear IPsec sa counters on HW clearing + - drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() + - iio: fix position relative kernel version + - apparmor: Fix network performance issue in aa_label_sk_perm + - ALSA: hda: fix unused variable warning + - apparmor: don't try to replace stale label in ptrace access check + - firmware: coreboot: Let OF core populate platform device + - bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER + - [arm64] drm/hisilicon: hibmc: Don't overwrite fb helper surface depth + - IB/rxe: replace kvfree with vfree + - [amd64] IB/hfi1: Add mtu check for operational data VLs + - genirq/debugfs: Reinstate full OF path for domain name + - [arm64] usb: dwc3: add EXTCON dependency for qcom + - cfg80211: regulatory: make initialization more robust + - [x86] mei: replace POLL* with EPOLL* for write queues. + - [arm64] drm/msm: fix unsigned comparison with less than zero + - ALSA: usb-audio: update quirk for B&W PX to remove microphone + - iwlwifi: nvm: get num of hw addresses from firmware + - netfilter: nft_osf: usage from output path is not valid + - [x86] pwm: lpss: Release runtime-pm reference from the driver's remove + callback + - [powerpc*] pseries/memory-hotplug: Fix return value type of + find_aa_index + - rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic + version + - netfilter: nf_flow_table: do not remove offload when other netns's + interface is down + - tipc: eliminate message disordering during binding table update + - [arm64] net: socionext: Add dummy PHY register read in phy_write() + - [arm64,armhf] drm/sun4i: hdmi: Fix double flag assignation + - [arm64] net: hns3: add error handler for hns3_nic_init_vector_data() + - pcrypt: use format specifier in kobject_add + - [armhf] ASoC: sun8i-codec: add missing route for ADC + - [arm64] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins + - [armhf] bus: ti-sysc: Add mcasp optional clocks flag + - exportfs: fix 'passing zero to ERR_PTR()' warning + - net: always initialize pagedlen + - net: phy: Fix not to call phy_resume() if PHY is not attached + - [amd64] IB/hfi1: Correctly process FECN and BECN in packets + - IB/rxe: Fix incorrect cache cleanup in error flow + - ipv6: add missing tx timestamping on IPPROTO_RAW + - [arm64] net: hns3: fix error handling int the hns3_get_vector_ring_chain + - vxlan: changelink: Fix handling of default remotes + - fork,memcg: fix crash in free_thread_stack on memcg charge fail + - [armhf] clk: highbank: fix refcount leak in hb_clk_init() + - [armhf] clk: ti: fix refcount leak in ti_dt_clocks_register() + - [armhf] clk: socfpga: fix refcount leak + - [armhf] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() + - [armhf] clk: imx6q: fix refcount leak in imx6q_clocks_init() + - [armhf] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() + - [armhf] clk: armada-370: fix refcount leak in a370_clk_init() + - [armel] clk: kirkwood: fix refcount leak in kirkwood_clk_init() + - [armhf] clk: armada-xp: fix refcount leak in axp_clk_init() + - [armhf] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() + - [armhf] clk: dove: fix refcount leak in dove_clk_init() + - drm: Fix error handling in drm_legacy_addctx + - [armhf] drm/etnaviv: fix some off by one bugs + - drm/fb-helper: generic: Fix setup error path + - fork, memcg: fix cached_stacks case + - [amd64] IB/usnic: Fix out of bounds index check in query pkey + - RDMA/ocrdma: Fix out of bounds index check in query pkey + - RDMA/qedr: Fix out of bounds index check in query pkey + - RDMA/iw_cxgb4: Fix the unchecked ep dereference + - net: phy: micrel: set soft_reset callback to genphy_soft_reset for + KSZ9031 + - [armhf] memory: tegra: Don't invoke Tegra30+ specific memory timing setup + on Tegra20 + - [armhf] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() + - kbuild: mark prepare0 as PHONY to fix external module build + - crypto: tgr192 - fix unaligned memory access + - [armhf] ASoC: imx-sgtl5000: put of nodes if finding codec fails + - IB/iser: Pass the correct number of entries for dma mapped SGL + - [arm64] net: hns3: fix wrong combined count returned by ethtool -l + - IB/mlx5: Don't override existing ip_protocol + - rtc: cmos: ignore bogus century byte + - [i386] spi/topcliff_pch: Fix potential NULL dereference on allocation + error + - [arm64] net: hns3: fix bug of ethtool_ops.get_channels for VF + - [armhf] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it + - iwlwifi: mvm: avoid possible access out of array. + - net/mlx5: Take lock with IRQs disabled to avoid deadlock + - ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit + - iwlwifi: mvm: fix A-MPDU reference assignment + - [armhf] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() + - [x86] tty: ipwireless: Fix potential NULL pointer dereference + - driver: uio: fix possible memory leak in __uio_register_device + - driver: uio: fix possible use-after-free in __uio_register_device + - driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling + - driver core: Avoid careless re-use of existing device links + - driver core: Do not resume suppliers under device_links_write_lock() + - driver core: Fix handling of runtime PM flags in device_link_add() + - driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link() + - drm/xen-front: Fix mmap attributes for display buffers + - iwlwifi: mvm: fix RSS config command + - [mips*] rtc: ds1672: fix unintended sign extension + - ath10k: fix dma unmap direction for management frames + - net: phy: fixed_phy: Fix fixed_phy not checking GPIO + - rtc: ds1307: rx8130: Fix alarm handling + - net/smc: original socket family in inet_sock_diag + - [arm64] rtc: pm8xxx: fix unintended sign extension + - iw_cxgb4: use tos when importing the endpoint + - iw_cxgb4: use tos when finding ipv6 routes + - xsk: add missing smp_rmb() in xsk_mmap + - [armhf] drm/etnaviv: potential NULL dereference + - RDMA/mlx5: Fix memory leak in case we fail to add an IB device + - driver core: Fix possible supplier PM-usage counter imbalance + - [armhf] usb: phy: twl6030-usb: fix possible use-after-free on remove + - block: don't use bio->bi_vcnt to figure out segment number + - keys: Timestamp new keys + - [armhf] net: dsa: b53: Fix default VLAN ID + - [armhf] net: dsa: b53: Properly account for VLAN filtering + - [armhf] net: dsa: b53: Do not program CPU port's PVID + - mt76: usb: fix possible memory leak in mt76u_buf_free + - vfio_pci: Enable memory accesses before calling pci_map_rom + - mdio_bus: Fix PTR_ERR() usage after initialization to constant + - [powerpc*] KVM: Release all hardware TCE tables attached to a group + - [x86] staging: r8822be: check kzalloc return or bail + - [arm*] dmaengine: mv_xor: Use correct device for DMA API + - cdc-wdm: pass return value of recover_from_urb_loss + - brcmfmac: create debugfs files for bus-specific layer + - net/mlx5: Delete unused FPGA QPN variable + - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON + - drm/nouveau/pmu: don't print reply values if exec is false + - drm/nouveau: fix missing break in switch statement + - driver core: Fix PM-runtime for links added during consumer probe + - [arm64] ASoC: qcom: Fix of-node refcount unbalance in + apq8016_sbc_parse_of() + - [arm64,armhf] net: dsa: fix unintended change of bridge interface STP + state + - fs/nfs: Fix nfs_parse_devname to not modify it's argument + - [x86] staging: rtlwifi: Use proper enum for return in + halmac_parse_psd_data_88xx + - [ppc64el] 64s: Fix logic when handling unknown CPU features + - NFS: Fix a soft lockup in the delegation recovery code + - perf: Copy parent's address filter offsets on clone + - perf, pt, coresight: Fix address filters for vmas with non-zero offset + - [armhf] clocksource/drivers/sun5i: Fail gracefully when clock rate is + unavailable + - [armhf] clocksource/drivers/exynos_mct: Fix error path in timer + resources initialization + - [x86] platform/x86: wmi: fix potential null pointer dereference + - NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount + - ath10k: Fix length of wmi tlv command for protected mgmt frames + - netfilter: nft_set_hash: fix lookups with fixed size hash on big endian + - netfilter: nft_set_hash: bogus element self comparison from deactivation + path + - net: sched: act_csum: Fix csum calc for tagged packets + - [arm*] hwrng: bcm2835 - fix probe as platform device + - [amd64] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() + - NFS: Add missing encode / decode sequence_maxsz to v4.2 operations + - NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() + - [amd64] net: aquantia: fixed instack structure overflow + - media: dvb/earth-pt1: fix wrong initialization for demod blocks + - rbd: clear ->xferred on error from rbd_obj_issue_copyup() + - PCI: Fix "try" semantics of bus and slot reset + - scsi: megaraid_sas: reduce module load time + - xen, cpu_hotplug: Prevent an out of bounds access + - net/mlx5: Fix multiple updates of steering rules in parallel + - net/mlx5e: IPoIB, Fix RX checksum statistics update + - [arm64,armhf] soc: amlogic: gx-socinfo: Add mask for each SoC packages + - media: ivtv: update *pos correctly in ivtv_read_pos() + - media: cx18: update *pos correctly in cx18_read_pos() + - [armhf] media: wl128x: Fix an error code in fm_download_firmware() + - media: cx23885: check allocation return + - jfs: fix bogus variable self-initialization + - [armhf] dts: sun9i: optimus: Fix fixed-regulators + - net: phy: don't clear BMCR in genphy_soft_reset + - [armhf] OMAP2+: Fix potentially uninitialized return value for + _setup_reset() + - [arm64,armhf] net: dsa: Avoid null pointer when failing to connect to + PHY + - media: tw5864: Fix possible NULL pointer dereference in + tw5864_handle_frame + - [arm64,armhf] spi: tegra114: clear packed bit for unpacked mode + - [arm64,armhf] spi: tegra114: fix for unpacked mode transfers + - [arm64,armhf] spi: tegra114: terminate dma and reset on transfer timeout + - [arm64,armhf] spi: tegra114: flush fifos + - [arm64,armhf] spi: tegra114: configure dma burst size to fifo trig level + - [armhf] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been + allocated + - [arm*] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios + - drm/fb-helper: generic: Call drm_client_add() after setup is done + - [arm64] vdso: don't leak kernel addresses + - rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900 + - bpf: Add missed newline in verifier verbose log + - [x86] drm/vmwgfx: Remove set but not used variable 'restart' + - scsi: qla2xxx: Unregister chrdev if module initialization fails + - net/sched: cbs: fix port_rate miscalculation + - ACPI: button: reinitialize button state upon resume + - [arm64,armhf] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check + - rxrpc: Fix detection of out of order acks + - scsi: target/core: Fix a race condition in the LUN lookup code + - brcmfmac: fix leak of mypkt on error return path + - [arm64] net: hns3: fix for vport->bw_limit overflow problem + - [x86] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses + - perf/core: Fix the address filtering fix + - [arm64,armhf] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register + bitmask + - [x86] platform/x86: alienware-wmi: fix kfree on potentially + uninitialized pointer + - tipc: set sysctl_tipc_rmem and named_timeout right range + - usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs + - [arm64] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info() + - 6lowpan: Off by one handling ->nexthdr + - ALSA: usb-audio: Handle the error from + snd_usb_mixer_apply_create_quirk() + - afs: Fix AFS file locking to allow fine grained locks + - afs: Further fix file locking + - NFS: Don't interrupt file writeout due to fatal errors + - scsi: qla2xxx: Fix a format specifier + - scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd() + - scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory + - [ppc64el] KVM: PPC: Book3S HV: Fix lockdep warning when entering the + guest + - netfilter: nft_flow_offload: add entry to flowtable after confirmation + - packet: in recvmsg msg_name return at least sizeof sockaddr_ll + - ASoC: fix valid stream condition + - [arm*] dwc2: gadget: Fix completed transfer size calculation in DDMA + - IB/mlx5: Add missing XRC options to QP optional params mask + - RDMA/rxe: Consider skb reserve space based on netdev of GID + - [amd64] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU + - [arm64] dmaengine: tegra210-adma: restore channel status + - mmc: core: fix possible use after free of host + - ath10k: Fix encoding for protected management frames + - afs: Fix the afs.cell and afs.volume xattr handlers + - l2tp: Fix possible NULL pointer dereference + - [x86] platform/x86: alienware-wmi: printing the wrong error code + - netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule + - [arm64,armhf] pwm: meson: Consider 128 a valid pre-divider + - [arm64,armhf] pwm: meson: Don't disable PWM when setting duty repeatedly + - nfp: bpf: fix static check error through tightening shift amount + adjustment + - netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value + - [arm*] thermal: cpu_cooling: Actually trace CPU load in + thermal_power_cpu_get_power + - EDAC/mc: Fix edac_mc_find() in case no device is found + - afs: Fix key leak in afs_release() and afs_evict_inode() + - afs: Don't invalidate callback if AFS_VNODE_DIR_VALID not set + - afs: Fix lock-wait/callback-break double locking + - afs: Fix double inc of vnode->cb_break + - [armhf] dts: sun8i-h3: Fix wifi in Beelink X2 DT + - [arm64] clk: meson: gxbb: no spread spectrum on mpll0 + - [arm64] clk: meson: axg: spread spectrum is on mpll2 + - [arm64] dmaengine: tegra210-adma: Fix crash during probe + - [arm64] dts: meson: libretech-cc: set eMMC as removable + - RDMA/qedr: Fix incorrect device rate. + - [x86] crypto: ccp - fix AES CFB error exposed by new test vectors + - [x86] crypto: ccp - Fix 3DES complaint from ccp-crypto module + - iommu: Add missing new line for dma type + - iommu: Use right function to get group for device + - signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of + force_sig + - inet: frags: call inet_frags_fini() after unregister_pernet_subsys() + - [arm64] net: hns3: fix a memory leak issue for + hclge_map_unmap_ring_to_vf_vector + - [x86] netvsc: unshare skb in VF rx handler + - net: core: support XDP generic on stacked devices. + - RDMA/uverbs: check for allocation failure in uapi_add_elm() + - net: don't clear sock->sk early to avoid trouble in strparser + - [arm64] phy: qcom-qusb2: fix missing assignment of ret when calling + clk_prepare_enable + - [arm64] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register + - media: vivid: fix incorrect assignment operation when setting video mode + - [arm64] crypto: inside-secure - fix zeroing of the request in + ahash_exit_inv + - [arm64] crypto: inside-secure - fix queued len computation + - mpls: fix warning with multi-label encap + - [arm64] dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node + - [arm64] dts: meson-gxm-khadas-vim2: fix Bluetooth support + - [amd64] iommu/vt-d: Duplicate iommu_resv_region objects per device list + - qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state + - qed: iWARP - fix uninitialized callback + - [powerpc*] cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild + - [powerpc*] pseries/mobility: rebuild cacheinfo hierarchy post-migration + - bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup + - [amd64] IB/hfi1: Handle port down properly in pio + - [arm64] drm/msm/mdp5: Fix mdp5_cfg_init error return + - net: netem: fix backlog accounting for corrupted GSO frames + - net/udp_gso: Allow TX timestamp with UDP GSO + - [s390x] net/af_iucv: build proper skbs for HiperTransport + - [s390x] net/af_iucv: always register net_device notifier + - [armhf] ASoC: ti: davinci-mcasp: Fix slot mask settings when using + multiple AXRs + - rtc: pcf8563: Fix interrupt trigger method + - rtc: pcf8563: Clear event flags and disable interrupts before requesting + irq + - net/sched: cbs: Fix error path of cbs_module_init + - [arm64] drm/msm/a3xx: remove TPL1 regs from snapshot + - ip6_fib: Don't discard nodes with valid routing information in + fib6_locate_1() + - perf/ioctl: Add check for the sample_period value + - [x86] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" + - tools: bpftool: use correct argument in cgroup errors + - fork,memcg: alloc_thread_stack_node needs to set tsk->stack + - bnxt_en: Fix ethtool selftest crash under error conditions. + - bnxt_en: Suppress error messages when querying DSCP DCB capabilities. + - [amd64] iommu: Make iommu_disable safer + - [x86] mfd: intel-lpss: Release IDA resources + - rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() + - xprtrdma: Fix use-after-free in rpcrdma_post_recvs + - PM: ACPI/PCI: Resume all devices during hibernation + - ACPI: PM: Simplify and fix PM domain hibernation callbacks + - ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS + - devres: allow const resource arguments + - [arm64] RDMA/hns: Fixs hw access invalid dma memory error + - ceph: fix "ceph.dir.rctime" vxattr value + - xdp: fix possible cq entry leak + - scsi: libfc: fix null pointer dereference on a null lport + - xfrm interface: ifname may be wrong in logs + - [armhf] clk: sunxi-ng: v3s: add the missing PLL_DDR1 + - PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() + - libertas_tf: Use correct channel range in lbtf_geo_init + - qed: reduce maximum stack frame size + - usb: host: xhci-hub: fix extra endianness conversion + - [x86] crypto: ccp - Reduce maximum stack usage + - tipc: reduce risk of wakeup queue starvation + - net/mlx5: Fix mlx5_ifc_query_lag_out_bits + - cifs: fix rmmod regression in cifs.ko caused by force_sig changes + - net: fix bpf_xdp_adjust_head regression for generic-XDP + - cxgb4: smt: Add lock for atomic_dec_and_test + - ext4: set error return correctly when ext4_htree_store_dirent fails + - [arm64] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 + driver + - [arm64] RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 + driver + - net/rds: Add a few missing rds_stat_names entries + - tools: bpftool: fix arguments for p_err() in do_event_pipe() + - tools: bpftool: fix format strings and arguments for jsonw_printf() + - bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails + - signal: Allow cifs and drbd to receive their terminating signals + - [ppc64el] 64s/radix: Fix memory hot-unplug page table split + - [x86] dmaengine: dw: platform: Switch to acpi_dma_controller_register() + - mac80211: minstrel_ht: fix per-group max throughput rate initialization + - i40e: reduce stack usage in i40e_set_fc + - [armhf] 8896/1: VDSO: Don't leak kernel addresses + - [mips*] avoid explicit UB in assignment of mips_io_port_base + - media: em28xx: Fix exception handling in em28xx_alloc_urbs() + - ahci: Do not export local variable ahci_em_messages + - rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up + - Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" + - hwmon: (lm75) Fix write operations for negative temperatures + - net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate + - power: supply: Init device wakeup after device_add() + - [x86] perf: Fix the dependency of the x86 insn decoder selftest + - irqdomain: Add the missing assignment of domain->fwnode for named fwnode + - bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA + - bcache: Fix an error code in bch_dump_read() + - netfilter: ctnetlink: honor IPS_OFFLOAD flag + - [arm64] wcn36xx: use dynamic allocation for large variables + - xsk: avoid store-tearing when assigning queues + - xsk: avoid store-tearing when assigning umem + - led: triggers: Fix dereferencing of null pointer + - [arm64] net: hns3: fix error VF index when setting VLAN offload + - rtlwifi: Fix file release memory leak + - f2fs: fix wrong error injection path in inc_valid_block_count() + - f2fs: fix error path of f2fs_convert_inline_page() + - [x86] scsi: fnic: fix msix interrupt allocation + - Btrfs: fix hang when loading existing inode cache off disk + - Btrfs: fix inode cache waiters hanging on failure to start caching + thread + - Btrfs: fix inode cache waiters hanging on path allocation failure + - btrfs: use correct count in btrfs_file_write_iter() + - ixgbe: sync the first fragment unconditionally + - ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet + - RDMA/cma: Fix false error message + - net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' + - bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands + - f2fs: fix to avoid accessing uninitialized field of inode page in + is_alive() + - [powerpc*] mm/mce: Keep irqs disabled during lockless page table walk + - bpf: fix BTF limits + - [amd64] iommu: Wait for completion of IOTLB flush in attach_device + - [amd64] net: aquantia: Fix aq_vec_isr_legacy() return value + - cxgb4: Signedness bug in init_one() + - [arm64] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() + - [arm64] net: netsec: Fix signedness bug in netsec_probe() + - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix signedness bug in probe + - of: mdio: Fix a signedness bug in of_phy_get_and_connect() + - [arm64] net: ethernet: stmmac: Fix signedness bug in + ipq806x_gmac_of_parse() + - net: sched: cbs: Avoid division by zero when calculating the port rate + - nvme: retain split access workaround for capability reads + - [arm64,armhf] net: stmmac: gmac4+: Not all Unicast addresses may be + available + - rxrpc: Fix trace-after-put looking at the put connection record + - mac80211: accept deauth frames in IBSS mode + - llc: fix another potential sk_buff leak in llc_ui_sendmsg() + - llc: fix sk_buff refcounting in llc_conn_state_process() + - ip6erspan: remove the incorrect mtu limit for ip6erspan + - [arm64,armhf] net: stmmac: fix length of PTP clock's name string + - [arm64,armhf] net: stmmac: fix disabling flexible PPS output + - sctp: add chunks to sk_backlog when the newsk sk_socket is not set + - [s390x] qeth: Fix error handling during VNICC initialization + - [s390x] qeth: Fix initialization of vnicc cmd masks during set online + - act_mirred: Fix mirred_init_module error handling + - net: avoid possible false sharing in sk_leave_memory_pressure() + - net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head + - tcp: annotate lockless access to tcp_memory_pressure + - net/smc: receive returns without data + - net/smc: receive pending data after RCV_SHUTDOWN + - [arm64] drm/msm/dsi: Implement reset correctly + - [armhf] dmaengine: imx-sdma: fix size check for sdma script_number + - [arm64] hibernate: check pgd table allocation + - net: netem: fix error path for corrupted GSO frames + - net: netem: correct the parent's backlog when corrupted packet was + dropped + - xsk: Fix registration of Rx-only sockets + - bpf, offload: Unlock on error in bpf_offload_dev_create() + - afs: Fix missing timeout reset + - [x86] hv_netvsc: Fix offset usage in netvsc_send_table() + - [x86] hv_netvsc: Fix send_table offset in case of a host bug + - afs: Fix large file support + - [armhf] hwrng: omap3-rom - Fix missing clock by probing with device tree + - [mips64el,mipsel] Loongson: Fix return value of loongson_hwmon_init + - [x86] hv_netvsc: flag software created hash value + - net: neigh: use long type to store jiffies delta + - packet: fix data-race in fanout_flow_is_huge() + - affs: fix a memory leak in affs_remount + - afs: Remove set but not used variables 'before', 'after' + - [armhf] dmaengine: ti: edma: fix missed failure handling + - drm/radeon: fix bad DMA from INTERRUPT_CNTL2 + - [arm64] dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.100 + - can, slip: Protect tty->disc_data in write_wakeup and close with RCU + - [x86] firestream: fix memory leaks + - gtp: make sure only SOCK_DGRAM UDP sockets are accepted + - ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions + - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM + - net: ip6_gre: fix moving ip6gre between namespaces + - net, ip6_tunnel: fix namespaces move + - net, ip_tunnel: fix namespaces move + - net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link() + - net_sched: fix datalen for ematch + - net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject + - net-sysfs: fix netdev_queue_add_kobject() breakage + - net-sysfs: Call dev_hold always in netdev_queue_add_kobject + - net-sysfs: Call dev_hold always in rx_queue_add_kobject + - net-sysfs: Fix reference count leak + - net: usb: lan78xx: Add .ndo_features_check + - Revert "udp: do rmem bulk free even if the rx sk queue is empty" + - tcp_bbr: improve arithmetic division in bbr_update_bw() + - tcp: do not leave dangling pointers in tp->highest_sack + - tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() + - afs: Fix characters allowed into cell names + - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input + - hwmon: (core) Do not use device managed functions for memory allocations + - PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken + - tracing: trigger: Replace unneeded RCU-list traversals + - Input: keyspan-remote - fix control-message timeouts + - [x86] Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus + transfers" + - [arm64,armhf] mmc: tegra: fix SDR50 tuning override + - mmc: sdhci: fix minimum clock rate for v3 controller + - [arm64] Documentation: Document arm64 kpti control + - Input: sur40 - fix interface sanity checks + - Input: gtco - fix endpoint sanity check + - Input: aiptek - fix endpoint sanity check + - Input: pegasus_notetaker - fix endpoint sanity check + - [armhf] Input: sun4i-ts - add a check for + devm_thermal_zone_of_sensor_register + - netfilter: nft_osf: add missing check for DREG attribute + - hwmon: (nct7802) Fix voltage limits to wrong registers + - do_last(): fetch directory ->i_mode and ->i_uid before it's too late + (CVE-2020-8428) + - sd: Fix REQ_OP_ZONE_REPORT completion handling + - [i386] crypto: geode-aes - switch to skcipher for cbc(aes) fallback + - media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT + - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func + - netfilter: ipset: use bitmap infrastructure completely + - netfilter: nf_tables: add __nft_chain_type_get() + - mm/memory_hotplug: make remove_memory() take the device_hotplug_lock + - mm, sparse: drop pgdat_resize_lock in sparse_add/remove_one_section() + - mm, sparse: pass nid instead of pgdat to sparse_add_one_section() + - drivers/base/memory.c: remove an unnecessary check on NR_MEM_SECTIONS + - mm, memory_hotplug: add nid parameter to arch_remove_memory + - mm/memory_hotplug: release memory resource after arch_remove_memory() + - drivers/base/memory.c: clean up relics in function parameters + - mm, memory_hotplug: update a comment in unregister_memory() + - mm/memory_hotplug: make unregister_memory_section() never fail + - mm/memory_hotplug: make __remove_section() never fail + - [powerpc*] mm: Fix section mismatch warning + - mm/memory_hotplug: make __remove_pages() and arch_remove_memory() never + fail + - [s390x] mm: implement arch_remove_memory() + - mm/memory_hotplug: allow arch_remove_memory() without + CONFIG_MEMORY_HOTREMOVE + - drivers/base/memory: pass a block_id to init_memory_block() + - mm/memory_hotplug: create memory block devices after arch_add_memory() + - mm/memory_hotplug: remove memory block devices before + arch_remove_memory() + - mm/memory_hotplug: make unregister_memory_block_under_nodes() never fail + - mm/memory_hotplug: remove "zone" parameter from + sparse_remove_one_section + - mm/hotplug: kill is_dev_zone() usage in __remove_pages() + - drivers/base/node.c: simplify unregister_memory_block_under_nodes() + - mm/memunmap: don't access uninitialized memmap in memunmap_pages() + - mm/memory_hotplug: fix try_offline_node() + - mm/memory_hotplug: shrink zones when offlining memory + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.101 + - orinoco_usb: fix interface sanity check + - rsi_91x_usb: fix interface sanity check + - USB: serial: ir-usb: add missing endpoint sanity check + - USB: serial: ir-usb: fix link-speed handling + - USB: serial: ir-usb: fix IrLAP framing + - [arm64,armhf] usb: dwc3: turn off VBUS when leaving host mode + - staging: wlan-ng: ensure error return is actually returned + - [x86] staging: vt6656: correct packet types for CTS protect, mode. + - [x86] staging: vt6656: use NULLFUCTION stack on mac80211 + - [x86] staging: vt6656: Fix false Tx excessive retries reporting. + - [arm64,armel] serial: 8250_bcm2835aux: Fix line mismatch on driver + unbind + - component: do not dereference opaque pointer in debugfs + - [x86] mei: me: add comet point (lake) H device ids + - crypto: chelsio - fix writing tfm flags to wrong place + - cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() + - ath9k: fix storage endpoint lookup + - brcmfmac: fix interface sanity check + - rtl8xxxu: fix interface sanity check + - zd1211rw: fix storage endpoint lookup + - net_sched: ematch: reject invalid TCF_EM_SIMPLE + - net_sched: fix ops->bind_class() implementations + - HID: multitouch: Add LG MELF0410 I2C touchscreen support + - HID: Add quirk for Xin-Mo Dual Controller + - HID: ite: Add USB id match for Acer SW5-012 keyboard dock + - [x86] HID: Add quirk for incorrect input length on Lenovo Y720 + - drivers/hid/hid-multitouch.c: fix a possible null pointer access. + - [arm64] phy: qcom-qmp: Increase PHY ready timeout + - drivers/net/b44: Change to non-atomic bit operations on pwol_mask + - [i386] net: wan: sdla: Fix cast from pointer to integer of different + size + - [arm64] gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP + - atm: eni: fix uninitialized variable warning + - HID: steam: Fix input device disappearing + - [x86] platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx + - [amd64] PCI: Add DMA alias quirk for Intel VCA NTB + - [amd64] iommu: Support multiple PCI DMA aliases in IRQ Remapping + - usb-storage: Disable UAS on JMicron SATA enclosure + - sched/fair: Add tmp_alone_branch assertion + - sched/fair: Fix insertion in rq->leaf_cfs_rq_list + - rsi: fix use-after-free on probe errors + - rsi: fix memory leak on failed URB submission + - rsi: fix non-atomic allocation in completion handler + - crypto: af_alg - Use bh_lock_sock in sk_destruct + - block: cleanup __blkdev_issue_discard() + - block: fix 32 bit overflow in __blkdev_issue_discard() + - [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.102 + - vfs: fix do_last() regression + - crypto: pcrypt - Fix user-after-free on module unload + - perf c2c: Fix return type for histogram sorting comparision functions + - PM / devfreq: Add new name attribute for sysfs + - tools lib: Fix builds when glibc contains strlcpy() + - ext4: validate the debug_want_extra_isize mount option at parse time + - mm/mempolicy.c: fix out of bounds write in mpol_parse_str() + - reiserfs: Fix memory leak of journal device string + - media: digitv: don't continue if remote control state can't be read + - media: af9005: uninitialized variable printked + - media: vp7045: do not read uninitialized values if usb transfer fails + - media: gspca: zero usb_buf + - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 + - tomoyo: Use atomic_t for statistics counter + - ttyprintk: fix a potential deadlock in interrupt context issue + - Bluetooth: Fix race condition in hci_release_sock() + - cgroup: Prevent double killing of css when enabling threaded cgroup + - [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity + - [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint + dt nodes + - [armhf] dts: beagle-x15-common: Model 5V0 regulator + - [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order + - mac80211: mesh: restrict airtime metric to peered established plinks + - ASoC: rt5640: Fix NULL dereference on module unload + - ixgbevf: Remove limit of 10 entries for unicast filter list + - ixgbe: Fix calculation of queue with VFs and flow director on interface + flap + - igb: Fix SGMII SFP module discovery for 100FX/LX. + - [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher + temperature limits + - qmi_wwan: Add support for Quectel RM500Q + - wireless: fix enabling channel 12 for custom regulatory domain + - cfg80211: Fix radar event during another phy CAC + - mac80211: Fix TKIP replay protection immediately after key setup + - netfilter: nft_tunnel: ERSPAN_VERSION must not be null + - [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec + - bnxt_en: Fix ipv6 RFS filter matching logic. + - iwlwifi: Don't ignore the cap field upon mcc update + - [armhf] dts: am335x-boneblack-common: fix memory size + - vti[6]: fix packet tx through bpf_redirect() + - xfrm interface: fix packet tx through bpf_redirect() + - xfrm: interface: do not confirm neighbor when do pmtu update + - scsi: fnic: do not queue commands during fwreset + - [armhf] 8955/1: virt: Relax arch timer version check during early boot + - [arm64] tee: optee: Fix compilation issue with nommu + - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE + - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE + - r8152: get default setting of WOL before initializing + - qlcnic: Fix CPU soft lockup while collecting firmware dump + - seq_tab_next() should increase position index + - l2t_seq_next should increase position index + - net: Fix skb->csum update in inet_proto_csum_replace16(). + - btrfs: do not zero f_bavail if we have available space + - perf report: Fix no libunwind compiled warning break s390 issue + - mm/migrate.c: also overwrite error when it is bigger than zero + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.103 + - [armhf] Revert "drm/sun4i: dsi: Change the start delay calculation" + - ovl: fix lseek overflow on 32bit + - kernel/module: Fix memleak in module_add_modinfo_attrs() + - media: iguanair: fix endpoint sanity check + - ocfs2: fix oops when writing cloned file + - [x86] cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR + - udf: Allow writing to 'Rewritable' partitions + - printk: fix exclusive_console replaying + - iwlwifi: mvm: fix NVM check for 3168 devices + - gtp: use __GFP_NOWARN to avoid memalloc warning + - l2tp: Allow duplicate session creation with UDP + - net_sched: fix an OOB access in cls_tcindex + - [arm64,armhf] net: stmmac: Delete txtimer in suspend() + - bnxt_en: Fix TC queue mapping. + - tcp: clear tp->total_retrans in tcp_disconnect() + - tcp: clear tp->delivered in tcp_disconnect() + - tcp: clear tp->data_segs{in|out} in tcp_disconnect() + - tcp: clear tp->segs_{in|out} in tcp_disconnect() + - rxrpc: Fix use-after-free in rxrpc_put_local() + - rxrpc: Fix insufficient receive notification generation + - rxrpc: Fix missing active use pinning of rxrpc_local object + - rxrpc: Fix NULL pointer deref due to call->conn being cleared on + disconnect + - media: uvcvideo: Avoid cyclic entity chains due to malformed USB + descriptors + - ipc/msg.c: consolidate all xxxctl_down() functions + - tracing: Fix sched switch start/stop refcount racy updates + - rcu: Avoid data-race in rcu_gp_fqs_check_wake() + - brcmfmac: Fix memory leak in brcmf_usbdev_qinit + - usb: gadget: f_ncm: Use atomic_t to track in-flight request + - usb: gadget: f_ecm: Use atomic_t to track in-flight request + - ALSA: usb-audio: Fix endianess in descriptor validation + - ALSA: dummy: Fix PCM format loop in proc output + - mm/memory_hotplug: fix remove_memory() lockdep splat + - mm: move_pages: report the number of non-attempted pages + - media/v4l2-core: set pages dirty upon releasing DMA buffers + - media: v4l2-core: compat: ignore native command codes + - media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments + - irqdomain: Fix a memory leak in irq_domain_push_irq() + - [x86] platform/x86: intel_scu_ipc: Fix interrupt support + - [x86] ALSA: hda: Add Clevo W65_67SB the power_save blacklist + - [arm64] KVM: Correct PSTATE on exception entry + - [arm64,armhf] KVM: Correct CPSR on exception entry + - [arm64,armhf] KVM: Correct AArch32 SPSR on exception entry + - [arm64] KVM: Only sign-extend MMIO up to register width + - [s390x] mm: fix dynamic pagetable upgrade for hugetlbfs + - [powerpc*] pseries: Advance pfn if section is not present in + lmb_is_removable() + - smb3: fix signing verification of large reads + - [arm64,armhf] PCI: tegra: Fix return value check of + pm_runtime_get_sync() + - [arm64,armhf] mmc: spi: Toggle SPI polarity, do not hardcode it + - [x86] ACPI: video: Do not export a non working backlight interface on MSI + MS-7721 boards + - [x86] ACPI / battery: Deal with design or full capacity being reported + as -1 + - [x86] ACPI / battery: Use design-cap for capacity calculations if + full-cap is not available + - [x86] ACPI / battery: Deal better with neither design nor full capacity + not being reported + - alarmtimer: Unregister wakeup source when module get fails + - ubifs: Reject unsupported ioctl flags explicitly + - ubifs: don't trigger assertion on invalid no-key filename + - ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag + - ubifs: Fix deadlock in concurrent bulk-read and writepage + - [i386] crypto: geode-aes - convert to skcipher API and make thread-safe + - [x86] hv_balloon: Balloon up according to request page number + - mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile + - crypto: api - Check spawn->alg under lock in crypto_drop_spawn + - scsi: qla2xxx: Fix mtcp dump collection failure + - ovl: fix wrong WARN_ON() in ovl_cache_update_ino() + - f2fs: choose hardlimit when softlimit is larger than hardlimit in + f2fs_statfs_project() + - f2fs: fix miscounted block limit in f2fs_statfs_project() + - f2fs: code cleanup for f2fs_statfs_project() + - PM: core: Fix handling of devices deleted during system-wide resume + - dm zoned: support zone sizes smaller than 128MiB + - dm space map common: fix to ensure new block isn't already in use + - dm crypt: fix benbi IV constructor crash if used in authenticated mode + - dm: fix potential for q->make_request_fn NULL pointer + - dm writecache: fix incorrect flush sequence when doing SSD mode commit + - padata: Remove broken queue flushing + - tracing: Annotate ftrace_graph_hash pointer with __rcu + - tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu + - ftrace: Add comment to why rcu_dereference_sched() is open coded + - ftrace: Protect ftrace_graph_hash with ftrace_sync + - [x86] crypto: ccp - set max RSA modulus size for v3 platform devices as + well + - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request + - crypto: api - Fix race condition in crypto_spawn_alg + - scsi: qla2xxx: Fix unbound NVME response length + - NFS: Fix memory leaks and corruption in readdir + - NFS: Directory page cache pages need to be locked when read + - jbd2_seq_info_next should increase position index + - Btrfs: fix missing hole after hole punching and fsync when using + NO_HOLES + - btrfs: set trans->drity in btrfs_commit_transaction + - Btrfs: fix race between adding and putting tree mod seq elements and + nodes + - [armhf] tegra: Enable PLLP bypass during Tegra124 LP1 + - iwlwifi: don't throw error when trying to remove IGTK + - mwifiex: fix unbalanced locking in mwifiex_process_country_ie() + - sunrpc: expiry_time should be seconds not timeval + - gfs2: move setting current->backing_dev_info + - gfs2: fix O_SYNC write handling + - drm/rect: Avoid division by zero + - media: rc: ensure lirc is initialized before registering input device + - xen/balloon: Support xend-based toolstack take two + - watchdog: fix UAF in reboot notifier handling in watchdog core code + - bcache: add readahead cache policy options via sysfs interface + - eventfd: track eventfd_signal() recursion depth + - aio: prevent potential eventfd recursion on poll + - [x86] KVM: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks + - [x86] KVM: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks + - [x86] KVM: Protect pmu_intel.c from Spectre-v1/L1TF attacks + - [x86] KVM: Protect DR-based index computations from Spectre-v1/L1TF + attacks + - [x86] KVM: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks + - [x86] KVM: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF + attacks + - [x86] KVM: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks + - [x86] KVM: Protect MSR-based index computations in pmu.h from + Spectre-v1/L1TF attacks + - [x86] KVM: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks + - [x86] KVM: Protect MSR-based index computations from Spectre-v1/L1TF + attacks in x86.c + - [x86] KVM: Protect x86_decode_insn from Spectre-v1/L1TF attacks + - [x86] KVM: Protect MSR-based index computations in + fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks + - [x86] KVM: Fix potential put_fpu() w/o load_fpu() on MPX platform + - [ppc64el] KVM: Book3S HV: Uninit vCPU if vcore creation fails + - [ppc64el] KVM: Book3S PR: Free shared page if mmu initialization fails + - [x86] kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit + (CVE-2019-3016) + - [x86] KVM: Don't let userspace set host-reserved cr4 bits + - [x86] KVM: Free wbinvd_dirty_mask if vCPU creation fails + - [s390x] KVM: do not clobber registers during guest reset/store status + - [arm64,armhf] clk: tegra: Mark fuse clock as critical + - percpu: Separate decrypted varaibles anytime encryption can be enabled + - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return + type + - scsi: csiostor: Adjust indentation in csio_device_reset + - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free + - scsi: ufs: Recheck bkops level if bkops is disabled + - [arm64] phy: qualcomm: Adjust indentation in read_poll_timeout + - ext2: Adjust indentation in ext2_fill_super + - [arm64] drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable + - IB/mlx5: Fix outstanding_pi index for GSI qps + - IB/core: Fix ODP get user pages flow + - nfsd: fix delay timer on 32-bit architectures + - nfsd: fix jiffies/time_t mixup in LRU list + - nfsd: Return the correct number of bytes written to the file + - ubi: fastmap: Fix inverted logic in seen selfcheck + - ubi: Fix an error pointer dereference in error handling code + - bonding/alb: properly access headers in bond_alb_xmit() + - [armhf] net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port + - [arm64,armhf] net: mvneta: move rx_dropped and rx_errors in per-cpu + stats + - net_sched: fix a resource leak in tcindex_set_parms() + - net/mlx5: IPsec, Fix esp modify function attribute + - net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx + - [arm64] net: macb: Remove unnecessary alignment check for TSO + - [arm64] net: macb: Limit maximum GEM TX length in TSO + - [armhf] net: dsa: b53: Always use dev->vlan_enabled in + b53_configure_vlan() + - ext4: fix deadlock allocating crypto bounce page from mempool + - btrfs: use bool argument in free_root_pointers() + - btrfs: free block groups after free'ing fs trees + - btrfs: flush write bio if we loop in extent_write_cache_pages + - [x86] KVM: mmu: Apply max PA check for MMIO sptes to 32-bit KVM + - [x86] KVM: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM + - [x86] KVM: nVMX: vmread should not set rflags to specify success in case + of #PF + - KVM: Use vcpu-specific gva->hva translation when querying host page size + - KVM: Play nice with read-only memslots when querying host page size + - mm: zero remaining unavailable struct pages + - mm: return zero_resv_unavail optimization + - mm/page_alloc.c: fix uninitialized memmaps on a partially populated last + section + - cifs: fail i/o on soft mounts if sessionsetup errors out + - [x86] apic/msi: Plug non-maskable MSI affinity race + - clocksource: Prevent double add_timer_on() for watchdog_timer + - perf/core: Fix mlock accounting in perf_mmap() + - rxrpc: Fix service call disconnection + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.104 + - ASoC: pcm: update FE/BE trigger order based on the command + - [x86] hv_sock: Remove the accept port restriction + - IB/mlx4: Fix memory leak in add_gid error flow + - RDMA/netlink: Do not always generate an ACK for some netlink operations + - RDMA/core: Fix locking in ib_uverbs_event_read + - scsi: ufs: Fix ufshcd_probe_hba() reture value in case + ufshcd_scsi_add_wlus() fails + - PCI/IOV: Fix memory leak in pci_iov_add_virtfn() + - ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe + - PCI: Don't disable bridge BARs when assigning bus resources + - nfs: NFS_SWAP should depend on SWAP + - NFS: Revalidate the file size on a fatal write error + - NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes() + - NFSv4: try lease recovery on NFS4ERR_EXPIRED + - [arm64] serial: uartps: Add a timeout to the tx empty wait + - [arm64] gpio: zynq: Report gpio direction at boot + - spi: spi-mem: Add extra sanity checks on the op param + - spi: spi-mem: Fix inverted logic in op sanity check + - rtc: cmos: Stop using shared IRQ + - [x86] platform/x86: intel_mid_powerbtn: Take a copy of ddata + - [powerpc*] pseries/vio: Fix iommu_table use-after-free refcount warning + - [powerpc*] pseries: Allow not having ibm, + hypertas-functions::hcall-multi-tce for DDW + - [arm64] iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA + - [arm64,armhf] KVM: vgic-its: Fix restoration of unmapped collections + - [armel,armhf] 8949/1: mm: mark free_memmap as __init + - [arm64] cpufeature: Fix the type of no FP/SIMD capability + - [arm64] ptrace: nofpsimd: Fail FP/SIMD regset operations + - [arm64,armhf] KVM: Fix young bit from mmu notifier + - [arm64,armhf] KVM: Fix DFSR setting for non-LPAE aarch32 guests + - [arm64,armhf] KVM: Make inject_abt32() inject an external abort instead + - [arm64] KVM: pmu: Don't increment SW_INCR if PMCR.E is unset + - mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock + - mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() + - mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() + - libertas: don't exit from lbs_ibss_join_existing() with RCU read lock + held + - libertas: make lbs_ibss_join_existing() return error code on rates + overflow + - scsi: megaraid_sas: Do not initiate OCR if controller is not in ready + state + - [x86] stackframe: Move ENCODE_FRAME_POINTER to asm/frame.h + - [x86] x86/stackframe, x86/ftrace: Add pt_regs frame annotations + - [arm64] serial: uartps: Move the spinlock after the read of the tx empty + - padata: fix null pointer deref of pd->pinst + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.105 + - Input: synaptics - switch T470s to RMI4 by default + - Input: synaptics - enable SMBus on ThinkPad L470 + - Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list + - ALSA: usb-audio: Fix UAC2/3 effect unit parsing + - ALSA: hda/realtek - Fix silent output on MSI-GL73 + - ALSA: usb-audio: Apply sample rate quirk for Audioengine D1 + - [arm64] cpufeature: Set the FP/SIMD compat HWCAP bits properly + - [arm64] nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly + - ALSA: usb-audio: sound: usb: usb true/false for bool return type + - ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 + - ext4: don't assume that mmp_nodename/bdevname have NUL + - ext4: fix support for inode sizes > 1024 bytes + - ext4: fix checksum errors with indexed dirs + - ext4: add cond_resched() to ext4_protect_reserved_inode (CVE-2020-8992) + - ext4: improve explanation of a mount failure caused by a misconfigured + kernel + - Btrfs: fix race between using extent maps and merging them + - btrfs: ref-verify: fix memory leaks + - btrfs: print message when tree-log replay starts + - btrfs: log message when rw remount is attempted with unclean tree-log + - [arm64] ssbs: Fix context-switch when SSBS is present on all CPUs + - [x86] perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's + event map + - nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info + - [amd64] IB/hfi1: Acquire lock to release TID entries when user file is + closed + - [amd64] IB/hfi1: Close window for pq and request coliding + - IB/rdmavt: Reset all QPs when the device is shut down + - RDMA/core: Fix invalid memory access in spec_filter_size + - [amd64] RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create + - RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq + - RDMA/core: Fix protection fault in get_pkey_idx_qp_list + - [s390x] time: Fix clk type in get_tod_clock + - [x86] perf/x86/intel: Fix inaccurate period in context switch for auto- + reload + - NFSv4.1 make cachethis=no for writes + - jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() + - jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer + - [x86] KVM: mmu: Fix struct guest_walker arrays for 5-level paging + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.106 + - core: Don't skip generic XDP program execution for cloned SKBs + - enic: prevent waking up stopped tx queues over watchdog reset + - net/smc: fix leak of kernel memory to user space + - net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS + - net/sched: flower: add missing validation of TCA_FLOWER_FLAGS + - [x86] KVM: nVMX: Use correct root level for nested EPT shadow page + tables + - [x86] drm/gma500: Fixup fbdev stolen size usage evaluation + - cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order + - brcmfmac: Fix use after free in brcmf_sdio_readframes() + - ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT + - ALSA: ctl: allow TLV read operation for callback type of element in + locked case + - [powerpc*] powernv/iov: Ensure the pdn for VFs always contains a valid + PE number + - [amd64] iommu/vt-d: Fix off-by-one in PASID allocation + - [x86] pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled + pins + - [x86] efi: Map the entire EFI vendor string before copying it + - [mips64el,mipsel] Loongson: Fix potential NULL dereference in + loongson3_platform_init() + - [arm*] usb: dwc2: Fix IN FIFO allocation + - [armel,armhf] clocksource/drivers/bcm2835_timer: Fix memory leak of + timer + - jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info + when load journal + - [armhf] pwm: omap-dmtimer: Simplify error handling + - [s390x] pci: Fix possible deadlock in recover_store() + - [powerpc*] iov: Move VF pdev fixup into pcibios_fixup_iov() + - tracing: Fix tracing_stat return values in error handling paths + - tracing: Fix very unlikely race of registering two stat tracers + - ext4, jbd2: ensure panic when aborting with zero errno + - ath10k: Correct the DMA direction for management tx buffers + - nbd: add a flush_workqueue in nbd_start_device + - [s390x] KVM: ENOTSUPP -> EOPNOTSUPP fixups + - [arm64] clk: qcom: rcg2: Don't crash if our parent can't be found; + return an error + - drm/amdgpu: remove 4 set but not used variable in + amdgpu_atombios_get_connector_info_from_object_table + - [arm64,armhf] regulator: rk808: Lower log level on optional GPIOs being + not available + - NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use + le16_add_cpu(). + - selinux: fall back to ref-walk if audit is required + - selinux: ensure we cleanup the internal AVC counters on error in + avc_insert() + - media: cx23885: Add support for AVerMedia CE310B + - PCI: Add generic quirk for increasing D3hot delay + - PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers + - media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in + v4l2_device macros + - reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling + - fore200e: Fix incorrect checks of NULL pointer dereference + - netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy + - ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status + - orinoco: avoid assertion in case of NULL pointer + - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 + - scsi: ufs: Complete pending requests in host reset and restore path + - scsi: aic7xxx: Adjust indentation in ahc_find_syncrate + - selinux: ensure we cleanup the internal AVC counters on error in + avc_update() + - dmaengine: Store module owner in dma_device struct + - [arm64] clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock + - tools lib api fs: Fix gcc9 stringop-truncation compilation error + - [x86] ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 + lid switch + - mlx5: work around high stack usage with gcc + - drm: remove the newline for CRC source name. + - usbip: Fix unsafe unaligned pointer usage + - udf: Fix free space reporting for metadata and virtual partitions + - staging: rtl8188: avoid excessive stack usage + - [amd64] IB/hfi1: Add software counter for ctxt0 seq drop + - [armhf] soc/tegra: fuse: Correct straps' address for older Tegra124 + device trees + - [x86] efi: Don't panic or BUG() on non-critical error conditions + - rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls + - [x86] nmi: Remove irq_work from the long duration NMI handler + - driver core: platform: Prevent resouce overflow from causing infinite + loops + - driver core: Print device when resources present in really_probe() + - bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map + - drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new() + - drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from + fw + - drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler + - drm/nouveau/fault/gv100-: fix memory leak on module unload + - [x86] drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add + - [armhf] usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue + - [arm64] iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an + STE + - f2fs: set I_LINKABLE early to avoid wrong access by vfs + - f2fs: free sysfs kobject + - scsi: iscsi: Don't destroy session if there are outstanding connections + - watchdog/softlockup: Enforce that timestamp is valid on boot + - f2fs: fix memleak of kobject + - [x86] mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd + - [armhf] pwm: omap-dmtimer: Remove PWM chip in .remove before making it + unfunctional + - btrfs: fix possible NULL-pointer dereference in integrity checks + - btrfs: safely advance counter when looking up bio csums + - btrfs: device stats, log when stats are zeroed + - module: avoid setting info->name early in case we can fall back to + info->mod->name + - ALSA: hda/hdmi - add retry logic to parse_intel_hdmi() + - driver core: platform: fix u32 greater or equal to zero comparison + - ALSA: hda - Add docking station support for Lenovo Thinkpad T420s + - drm/nouveau/mmu: fix comptag memory leak + - [powerpc*] sriov: Remove VF eeh_dev state when disabling SR-IOV + - bcache: cached_dev_free needs to put the sb page + - [amd64] iommu/vt-d: Remove unnecessary WARN_ON_ONCE() + - jbd2: switch to use jbd2_journal_abort() when failed to submit the + commit record + - jbd2: make sure ESHUTDOWN to be recorded in the journal superblock + - iwlegacy: ensure loop counter addr does not wrap and cause an infinite + loop + - cifs: fix NULL dereference in match_prepath + - bpf: map_seq_next should always increase position index + - ceph: check availability of mds cluster on mount after wait timeout + - [arm64,armhf] irqchip/gic-v3: Only provision redistributors that are + enabled in ACPI + - drm/nouveau/disp/nv50-: prevent oops when no channel method map provided + - ftrace: fpid_next() should increase position index + - trigger_next should increase position index + - radeon: insert 10ms sleep in dce5_crtc_load_lut + - ocfs2: fix a NULL pointer dereference when call + ocfs2_update_inode_fsync_trans() + - reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() + - bcache: explicity type cast in bset_bkey_last() + - [arm64,armhf] irqchip/gic-v3-its: Reference to its_invall_cmd descriptor + when building INVALL + - iwlwifi: mvm: Fix thermal zone registration + - brd: check and limit max_part par + - NFS: Fix memory leaks + - help_next should increase position index + - cifs: log warning message (once) if out of disk space + - virtio_balloon: prevent pfn array overflow + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.107 + - [arm64] iommu/qcom: Fix bogus detach logic + - ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs + - [x86] ALSA: hda/realtek - Apply quirk for MSI GP63, too + - [x86] ALSA: hda/realtek - Apply quirk for yet another MSI laptop + - [armhf] ASoC: sun8i-codec: Fix setting DAI data format + - ecryptfs: fix a memory leak bug in parse_tag_1_packet() + - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() + - [x86] thunderbolt: Prevent crash if non-active NVMem file is read + - USB: misc: iowarrior: add support for 2 OEMed devices + - USB: misc: iowarrior: add support for the 28 and 28L devices + - USB: misc: iowarrior: add support for the 100 device + - floppy: check FDC index for errors before assigning it (CVE-2020-9383) + - vt: fix scrollback flushing on background consoles + - vt: selection, handle pending signals in paste_selection + - vt: vt_ioctl: fix race in VT_RESIZEX + - [arm*] staging: android: ashmem: Disallow ashmem memory from being + remapped (CVE-2020-0009) + - [x86] staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. + - xhci: Force Maximum Packet size for Full-speed bulk devices to valid + range. + - xhci: fix runtime pm enabling for quirky Intel hosts + - xhci: Fix memory leak when caching protocol extended capability PSI + tables - take 2 + - usb: host: xhci: update event ring dequeue pointer on purpose + - USB: core: add endpoint-blacklist quirk + - USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 + - usb: uas: fix a plug & unplug racing + - USB: Fix novation SourceControl XL after suspend + - USB: hub: Don't record a connect-change event during reset-resume + - USB: hub: Fix the broken detection of USB3 device in SMSC hub + - [arm*] usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows + - [arm64,armhf] usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl + fields + - staging: rtl8188eu: Fix potential security hole + - staging: rtl8188eu: Fix potential overuse of kernel memory + - staging: rtl8723bs: Fix potential security hole + - staging: rtl8723bs: Fix potential overuse of kernel memory + - [powerpc*] tm: Fix clearing MSR[TS] in current when reclaiming on signal + delivery + - jbd2: fix ocfs2 corrupt when clearing block group bits + - [x86] mce/amd: Publish the bank pointer only after setup has succeeded + - [x86] mce/amd: Fix kobject lifetime + - [x86] cpu/amd: Enable the fixed Instructions Retired counter IRPERF + - serial: 8250: Check UPF_IRQ_SHARED in advance + - [armhf] tty: serial: imx: setup the correct sg entry for tx dma + - serdev: ttyport: restore client ops on deregistration + - Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" + - mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps() + - nvme-multipath: Fix memory leak with ana_log_buf + - genirq/irqdomain: Make sure all irq domain flags are distinct + - mm/vmscan.c: don't round up scan size for online memory cgroup + - drm/amdgpu/soc15: fix xclk for raven + - [x86] xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms + - [x86] KVM: nVMX: Don't emulate instructions in guest mode + (CVE-2020-2732) + - [x86] KVM: don't notify userspace IOAPIC on edge-triggered interrupt EOI + - drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets + - ext4: fix a data race in EXT4_I(inode)->i_disksize + - ext4: add cond_resched() to __ext4_find_entry() + - ext4: fix potential race between online resizing and write operations + - ext4: fix potential race between s_group_info online resizing and access + - ext4: fix potential race between s_flex_groups online resizing and + access + - ext4: fix mount failure with quota configured as module + - ext4: rename s_journal_flag_rwsem to s_writepages_rwsem + - ext4: fix race between writepages and enabling EXT4_EXTENTS_FL + - [x86] KVM: nVMX: Refactor IO bitmap checks into helper function + - [x86] KVM: nVMX: Check IO instruction VM-exit conditions + - [x86] KVM: nVMX: handle nested posted interrupts when apicv is disabled + for L1 + - [x86] KVM: apic: avoid calculating pending eoi from an uninitialized val + - btrfs: fix bytes_may_use underflow in prealloc error condtition + - btrfs: reset fs_root to NULL on error in open_ctree + - btrfs: do not check delayed items are empty for single transaction + cleanup + - Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered + extents + - scsi: Revert "target: iscsi: Wait for all commands to finish before + freeing a session" + - usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus + - [arm*] usb: dwc2: Fix in ISOC request length checking + - staging: rtl8723bs: fix copy of overlapping memory + - ecryptfs: replace BUG_ON with error handling code + - genirq/proc: Reject invalid affinity masks (again) + - bpf, offload: Replace bitwise AND by logical AND in + bpf_prog_offload_info_fill + - ALSA: seq: Avoid concurrent access to queue flags + - ALSA: seq: Fix concurrent access to queue current tick/time + - netfilter: xt_hashlimit: limit the max size of hashtable + - rxrpc: Fix call RCU cleanup using non-bh-safe locks + - ata: ahci: Add shutdown to freeze hardware resources of ahci + - xen: Enable interrupts when calling _cond_resched() + - [s390x] mm: Explicitly compare PAGE_DEFAULT_KEY against zero in + storage_key_init_range + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.108 + - [arm64,armhf] irqchip/gic-v3-its: Fix misuse of GENMASK macro + - iwlwifi: pcie: fix rb_allocator workqueue allocation + - ipmi:ssif: Handle a possible NULL pointer reference + - [arm64] drm/msm: Set dma maximum segment size for mdss + - dax: pass NOWAIT flag to iomap_apply + - mac80211: consider more elements in parsing CRC + - cfg80211: check wiphy driver existence for drvinfo report + - [s390x] zcrypt: fix card and queue total counter wrap + - qmi_wwan: re-add DW5821e pre-production variant + - qmi_wwan: unconditionally reject 2 ep interfaces + - [arm64] soc/tegra: fuse: Fix build with Tegra194 configuration + - net: ena: fix potential crash when rxfh key is NULL + - net: ena: fix uses of round_jiffies() + - net: ena: add missing ethtool TX timestamping indication + - net: ena: fix incorrect default RSS key + - net: ena: rss: fix failure to get indirection table + - net: ena: rss: store hash function as values and not bits + - net: ena: fix incorrectly saving queue numbers when setting RSS + indirection table + - net: ena: ethtool: use correct value for crc32 hash + - net: ena: ena-com.c: prevent NULL pointer dereference + - cifs: Fix mode output in debugging statements + - cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE + - sysrq: Restore original console_loglevel when sysrq disabled + - sysrq: Remove duplicated sysrq message + - net: fib_rules: Correctly set table field when table number exceeds 8 + bits + - net: sched: correct flower port blocking + - sctp: move the format error check out of __sctp_sf_do_9_1_abort + - ipv6: Fix route replacement with dev-only route + - ipv6: Fix nlmsg_flags when splitting a multipath route + - qede: Fix race between rdma destroy workqueue and link change event + - ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() + - audit: fix error handling in audit_data_to_entry() + - ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro + - [arm64,x86] ACPI: watchdog: Fix gas->access_width usage + - [x86] KVM: VMX: check descriptor table exits on instruction emulation + - HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard + dock + - HID: core: fix off-by-one memset in hid_report_raw_event() + - HID: core: increase HID report buffer size to 8KiB + - tracing: Disable trace_printk() on post poned tests + - Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" + - amdgpu/gmc_v9: save/restore sdpif regs during S3 + - vhost: Check docket sk_family instead of call getname (CVE-2020-10942) + - HID: alps: Fix an error handling path in 'alps_input_configured()' + - HID: hiddev: Fix race in in hiddev_disconnect() + - [x86] hv_netvsc: Fix unwanted wakeup in netvsc_attach() + - [s390x] qeth: vnicc Fix EOPNOTSUPP precedence + - net: netlink: cap max groups which will be considered in netlink_bind() + - [amd64] net: atlantic: fix use after free kasan warn + - [amd64] net: atlantic: fix potential error handling + - net/smc: no peer ID in CLC decline for SMCD + - net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE + - namei: only return -ECHILD from follow_dotdot_rcu() + - mwifiex: drop most magic numbers from + mwifiex_process_tdls_action_frame() + - [x86] KVM: SVM: Override default MMIO mask if memory encryption is + enabled + - KVM: Check for a bad hva before dropping into the ghc slow path + - sched/fair: Optimize update_blocked_averages() + - sched/fair: Fix O(nr_cgroups) in the load balancing path + - perf stat: Use perf_evsel__is_clocki() for clock events + - perf stat: Fix shadow stats for clock events + - [arm64] drivers: net: xgene: Fix the order of the arguments of + 'alloc_etherdev_mqs()' + - kprobes: Set unoptimized flag after unoptimizing code + - [armhf] pwm: omap-dmtimer: put_device() after of_find_device_by_node() + - perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc + - [x86] KVM: Remove spurious kvm_mmu_unload() from vcpu destruction path + - [x86] KVM: Remove spurious clearing of async #PF MSR + - netfilter: nft_tunnel: no need to call htons() when dumping ports + - mm/huge_memory.c: use head to check huge zero page + - mm, thp: fix defrag setting if newline is not used + - audit: always check the netlink payload length in audit_receive_msg() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.109 + - [x86] EDAC/amd64: Set grain per DIMM + - ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 + - [armhf] net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec + - kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic + - [x86] ALSA: hda: do not override bus codec_mask in link_get() + - usb: gadget: composite: Support more than 500mA MaxPower + - usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags + - usb: gadget: serial: fix Tx stall after buffer overflow + - [arm64] drm/msm/mdp5: rate limit pp done timeout warnings + - [arm64] drm: msm: Fix return type of dsi_mgr_connector_mode_valid for + kCFI + - scsi: megaraid_sas: silence a warning + - [arm64] drm/msm/dsi: save pll state before dsi host is powered off + - [arm64] drm/msm/dsi/pll: call vco set rate explicitly + - [armhf] net: dsa: b53: Ensure the default VID is untagged + - [s390x] cio: cio_ignore_proc_seq_next should increase position index + - [s390x] qdio: fill SL with absolute addresses + - ice: Don't tell the OS that link is going down + - [arm64] net: thunderx: workaround BGX TX Underflow issue + - ALSA: hda/realtek - Add Headset Mic supported + - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master + - cifs: don't leak -EAGAIN for stat() during reconnect + - usb: storage: Add quirk for Samsung Fit flash + - usb: quirks: add NO_LPM quirk for Logitech Screen Share + - [arm64,armhf] usb: dwc3: gadget: Update chain bit correctly when using + sg list + - usb: core: hub: fix unhandled return by employing a void function + - usb: core: hub: do error out if usb_autopm_get_interface() fails + - usb: core: port: do error out if usb_autopm_get_interface() fails + - vgacon: Fix a UAF in vgacon_invert_region (CVE-2020-8647, CVE-2020-8649) + - mm, numa: fix bad pmd by atomically check for pmd_trans_huge when + marking page tables prot_numa + - mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() + - fat: fix uninit-memory access for partial initialized inode + - [arm64] tty:serial:mvebu-uart:fix a wrong return + - serial: 8250_exar: add support for ACCES cards + - vt: selection, close sel_buffer race (CVE-2020-8648) + - vt: selection, push console lock down + - vt: selection, push sel_lock up + - [arm64,armhf] media: v4l2-mem2mem.c: fix broken links + - [x86] pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes + - [arm64,armhf] dmaengine: tegra-apb: Fix use-after-free + - [arm64,armhf] dmaengine: tegra-apb: Prevent race conditions of tasklet + vs free list + - dm cache: fix a crash due to incorrect work item cancelling + - dm: report suspended device during destroy + - dm writecache: verify watermark during resume + - [x86] ASoC: topology: Fix memleak in soc_tplg_link_elems_load() + - [x86] ASoC: topology: Fix memleak in soc_tplg_manifest_load() + - [x86] ASoC: intel: skl: Fix pin debug prints + - [x86] ASoC: intel: skl: Fix possible buffer overflow in debug outputs + - [armhf] dmaengine: imx-sdma: remove dma_slave_config direction usage and + leave sdma_event_enable() + - ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output + - ASoC: dapm: Correct DAPM handling of active widgets during shutdown + - [armhf] drm/sun4i: Fix DE2 VI layer format support + - [armhf] drm/sun4i: de2/de3: Remove unsupported VI layer formats + - RDMA/iwcm: Fix iwcm work deallocation + - RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() + - [amd64] IB/hfi1, qib: Ensure RCU is locked when accessing list + - [armhf] ARM: imx: build v7_cpu_resume() unconditionally + - hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() + - [powerpc*] fix hardware PMU exception bug on PowerVM compatibility mode + systems + - [amd64] efi/x86: Align GUIDs to their size in the mixed mode runtime + wrapper + - [amd64] efi/x86: Handle by-ref arguments covering multiple pages in + mixed mode + - dm integrity: fix a deadlock due to offloading to an incorrect workqueue + - scsi: pm80xx: Fixed kernel panic during error recovery for SATA drive + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.110 + - [x86] KVM: SVM: fix up incorrect backport + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.111 + - phy: Revert toggling reset changes. + - net: phy: Avoid multiple suspends + - cgroup, netclassid: periodically release file_lock on classid updating + - gre: fix uninit-value in __iptunnel_pull_header + - inet_diag: return classid for all socket types + - ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface + - ipvlan: add cond_resched_rcu() while processing muticast backlog + - ipvlan: do not add hardware address of master to its unicast filter list + - ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() + - ipvlan: don't deref eth hdr before checking it's set + - net/ipv6: use configured metric when add peer route + - netlink: Use netlink header as base to calculate bad attribute offset + - net: macsec: update SCI upon MAC address change. + - net: nfc: fix bounds checking bugs on "pipe" + - net/packet: tpacket_rcv: do not increment ring index on drop + - [arm64,armhf] net: stmmac: dwmac1000: Disable ACS if enhanced descs are + not used + - r8152: check disconnect status after long sleep + - sfc: detach from cb_page in efx_copy_channel() + - bnxt_en: reinitialize IRQs when MTU is modified + - cgroup: memcg: net: do not associate sock with unrelated cgroup + - net: memcg: late association of sock to memcg + - net: memcg: fix lockdep splat in inet_csk_accept() + - devlink: validate length of param values + - nl802154: add missing attribute validation + - nl802154: add missing attribute validation for dev_type + - can: add missing attribute validation for termination + - macsec: add missing attribute validation for port + - net: fq: add missing attribute validation for orphan mask + - team: add missing attribute validation for port ifindex + - team: add missing attribute validation for array index + - nfc: add missing attribute validation for SE API + - nfc: add missing attribute validation for deactivate target + - nfc: add missing attribute validation for vendor subcommand + - net: phy: fix MDIO bus PM PHY resuming + - net/ipv6: need update peer route when modify metric + - net/ipv6: remove the old peer route if change it to a new one + - tipc: add missing attribute validation for MTU property + - devlink: validate length of region addr/len + - bonding/alb: make sure arp header is pulled before accessing it + - slip: make slhc_compress() more robust against malicious packets + - [armhf] net: fec: validate the new settings in fec_enet_set_coalesce() + - macvlan: add cond_resched() during multicast processing + - cgroup: cgroup_procs_next should increase position index + - cgroup: Iterate tasks that did not finish do_exit() + - iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices + - virtio-blk: fix hw_queue stopped on arbitrary error + - [amd64] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with + pr_warn + add_taint + - netfilter: nf_conntrack: ct_cpu_seq_next should increase position index + - netfilter: synproxy: synproxy_cpu_seq_next should increase position + index + - netfilter: xt_recent: recent_seq_next should increase position index + - netfilter: x_tables: xt_mttg_seq_next should increase position index + - workqueue: don't use wq_select_unbound_cpu() for bound works + - drm/amd/display: remove duplicated assignment to grph_obj_type + - cifs_atomic_open(): fix double-put on late allocation failure + - gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache + - [x86] KVM: clear stale x86_emulate_ctxt->intercept value + - efi: Fix a race and a buffer overflow while reading efivars via sysfs + - efi: Make efi_rts_work accessible to efi page fault handler + - mt76: fix array overflow on receiving too many fragments for a packet + - [x86] mce: Fix logic and comments around MSR_PPIN_CTL + - [arm64] iommu/dma: Fix MSI reservation allocation + - [amd64] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint + - [amd64] iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge + page + - batman-adv: Don't schedule OGM for disabled interface + - [arm64] pinctrl: meson-gxl: fix GPIOX sdio pins + - pinctrl: core: Remove extra kref_get which blocks hogs being freed + - [arm64,armhf] i2c: gpio: suppress error on probe defer + - nl80211: add missing attribute validation for critical protocol + indication + - nl80211: add missing attribute validation for beacon report scanning + - nl80211: add missing attribute validation for channel switch + - perf bench futex-wake: Restore thread count default to online CPU count + - netfilter: cthelper: add missing attribute validation for cthelper + - netfilter: nft_payload: add missing attribute validation for payload + csum flags + - netfilter: nft_tunnel: add missing attribute validation for tunnels + - [amd64] iommu/vt-d: Fix the wrong printing in RHSA parsing + - [amd64] iommu/vt-d: Ignore devices with out-of-spec domain number + - [arm64,x86] i2c: acpi: put device when verifying client fails + - ipv6: restrict IPV6_ADDRFORM operation + - net/smc: check for valid ib_client_data + - net/smc: cancel event worker during device removal + - efi: Add a sanity check to efivar_store_raw() + - batman-adv: Avoid free/alloc race when handling OGM2 buffer + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.112 + - [x86] perf/amd/uncore: Replace manual sampling check with + CAP_NO_INTERRUPT flag + - [armhf] mmc: sdhci-omap: Add platform specific reset callback + - [armhf] mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning + failures (i929) + - ACPI: watchdog: Allow disabling WDAT at boot + - HID: apple: Add support for recent firmware on Magic Keyboards + - [x86] HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override + - cfg80211: check reg_rule for NULL in handle_channel_custom() + - scsi: libfc: free response frame from GPN_ID + - net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch + - mac80211: rx: avoid RCU list traversal under mutex + - signal: avoid double atomic counter increments for user accounting + - slip: not call free_netdev before rtnl_unlock in slip_open + - [x86,arm64] hinic: fix a irq affinity bug + - [x86,arm64] hinic: fix a bug of setting hw_ioctxt + - sfc: fix timestamp reconstruction at 16-bit rollover points + - jbd2: fix data races at struct journal_head + - [armhf] mmc: sdhci-omap: Don't finish_mrq() on a command error during + tuning + - [armhf] mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C + - driver core: Remove the link if there is no driver with AUTO flag + - driver core: Fix adding device links to probing suppliers + - driver core: Make driver core own stateful device links + - driver core: Add device link flag DL_FLAG_AUTOPROBE_CONSUMER + - driver core: Remove device link creation limitation + - driver core: Fix creation of device links with PM-runtime flags + - mm: slub: add missing TID bump in kmem_cache_alloc_bulk() + - efi: Fix debugobjects warning on 'efi_rts_work' + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.113 + - [arm64] spi: qup: call spi_qup_pm_resume_runtime before suspending + - [amd64] spi: pxa2xx: Add CS control clock quirk + - [armhf] drm/exynos: dsi: fix workaround for the legacy clock name + - [arm64] drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc + pointer + - dm bio record: save/restore bi_end_io and bi_integrity + - dm integrity: use dm_bio_record and dm_bio_restore + - xenbus: req->body should be updated before req->state + - xenbus: req->err should be updated before req->state + - block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() + - USB: Disable LPM on WD19's Realtek Hub + - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters + - USB: serial: option: add ME910G1 ECM composition 0x110b + - [arm64,armhf] usb: host: xhci-plat: add a shutdown + - USB: serial: pl2303: add device-id for HP LD381 + - [x86] usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller + 1022:145c + - ALSA: line6: Fix endless MIDI read loop + - ALSA: seq: virmidi: Fix running status after receiving sysex + - ALSA: seq: oss: Fix running status after receiving sysex + - ALSA: pcm: oss: Avoid plugin buffer overflow + - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks + - [armhf] iio: st_sensors: remap SMO8840 to LIS2DH12 + - mmc: rtsx_pci: Fix support for speed-modes that relies on tuning + - staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 + - staging/speakup: fix get_word non-space look-ahead + - [x86] intel_th: Fix user-visible error codes + - [x86] intel_th: pci: Add Elkhart Lake CPU support + - xhci: Do not open code __print_symbolic() in xhci trace events + - btrfs: fix log context list corruption after rename whiteout error + - drm/amd/amdgpu: Fix GPR read from debugfs (v2) + - drm/lease: fix WARNING in idr_destroy + - memcg: fix NULL pointer dereference in + __mem_cgroup_usage_unregister_event + - mm: slub: be more careful about the double cmpxchg of freelist + - mm, slub: prevent kmalloc_node crashes and memory leaks + - page-flags: fix a crash at SetPageError(THP_SWAP) + - [x86] mm: split vmalloc_sync_all() (Closes: #953017) + - USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL + - USB: cdc-acm: fix rounding error in TIOCSSERIAL + - futex: Fix inode life-time issue + - futex: Unbreak futex hashing + - Revert "vrf: mark skb for multicast or link-local as enslaved to VRF" + - Revert "ipv6: Fix handling of LLA with VRF and sockets bound to VRF" + - ALSA: hda/realtek: Fix pop noise on ALC225 + - [arm64] smp: fix smp_send_stop() behaviour + - [arm64] smp: fix crash_smp_send_stop() behaviour + - [arm64,armhf] drm/bridge: dw-hdmi: fix AVI frame colorimetry + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.114 + - mmc: core: Allow host controllers to require R1B for CMD6 + - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard + - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command + - [armhf] mmc: sdhci-omap: Fix busy detection by enabling + MMC_CAP_NEED_RSP_BUSY + - [arm64,armhf] mmc: sdhci-tegra: Fix busy detection by enabling + MMC_CAP_NEED_RSP_BUSY + - geneve: move debug check after netdev unregister + - macsec: restrict to ethernet devices + - net: cbs: Fix software cbs to consider packet sending time + - [armhf] net: dsa: Fix duplicate frames flooded by learning + - [arm64,armhf] net: mvneta: Fix the case where the last poll did not + process all rx + - net/packet: tpacket_rcv: avoid a producer race condition + - net: qmi_wwan: add support for ASKEY WWHC050 + - net_sched: cls_route: remove the right filter from hashtable + - net_sched: keep alloc_hash updated after hash allocation + - [arm64,armhf] net: stmmac: dwmac-rk: fix error path in rk_gmac_probe + - slcan: not call free_netdev before rtnl_unlock in slcan_open + - bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets() + - bnxt_en: Reset rings if ring reservation fails during open() + - net: ip_gre: Separate ERSPAN newlink / changelink callbacks + - net: ip_gre: Accept IFLA_INFO_DATA-less configuration + - r8169: re-enable MSI on RTL8168c + - tcp: repair: fix TCP_QUEUE_SEQ implementation + - vxlan: check return value of gro_cells_init() + - cgroup-v1: cgroup_pidlist_next should update position index + - nfs: add minor version to nfs_server_key for fscache + - drivers/of/of_mdio.c:fix of_mdiobus_register() + - cgroup1: don't call release_agent when it is "" + - [s390x] qeth: handle error when backing RX buffer + - scsi: ipr: Fix softlockup when rescanning devices in petitboot + - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled + - [x86] ftrace: Anotate text_mutex split between + ftrace_arch_code_modify_post_process() and + ftrace_arch_code_modify_prepare() + - [x86] Input: synaptics - enable RMI on HP Envy 13-ad105ng + - Input: avoid BIT() macro usage in the serio.h UAPI header + - ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL + - perf probe: Do not depend on dwfl_module_addrsym() + - scsi: sd: Fix optimal I/O size for devices that change reported values + - nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type + - mac80211: mark station unauthorized before key removal + - [x86] gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk + - gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option + - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + + AXP288 model + - genirq: Fix reference leaks on irq affinity notifiers + - xfrm: handle NETDEV_UNREGISTER for xfrm device + - vti[6]: fix packet tx through bpf_redirect() in XinY cases + - RDMA/mlx5: Block delay drop to unprivileged users + - xfrm: fix uctx len check in verify_sec_ctx_len + - xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire + - xfrm: policy: Fix doulbe free in xfrm_policy_timer + - afs: Fix some tracing details + - netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6} + - netfilter: nft_fwd_netdev: validate family and chain type + - bpf/btf: Fix BTF verification of enum members in struct/union + - vti6: Fix memory leak of skb if input policy check fails + - mac80211: add option for setting control flags + - mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX + - USB: serial: option: add support for ASKEY WWHC050 + - USB: serial: option: add BroadMobi BM806U + - USB: serial: option: add Wistron Neweb D19Q1 + - USB: cdc-acm: restore capability check order + - USB: serial: io_edgeport: fix slab-out-of-bounds read in + edge_interrupt_callback + - [arm64,armhf] usb: musb: fix crash with highmen PIO and usbmon + - media: flexcop-usb: fix endpoint sanity check + - media: usbtv: fix control-message timeouts + - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table + - [x86] ahci: Add Intel Comet Lake H RAID PCI ID + - libfs: fix infoleak in simple_attr_read() + - media: ov519: add missing endpoint sanity checks (CVE-2020-11608) + - media: dib0700: fix rc endpoint lookup + - media: stv06xx: add missing descriptor sanity checks (CVE-2020-11609) + - media: xirlink_cit: add missing descriptor sanity checks + (CVE-2020-11668) + - mac80211: Check port authorization in the ieee80211_tx_dequeue() case + - mac80211: fix authentication with iwlwifi/mvm + - vt: selection, introduce vc_is_sel + - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines + - vt: switch vt_dont_switch to bool + - vt: vt_ioctl: remove unnecessary console allocation checks + - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console + - vt: vt_ioctl: fix use-after-free in vt_in_use() + - [x86] platform: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table + - bpf: Explicitly memset the bpf_attr structure + - bpf: Explicitly memset some bpf info structures declared on the stack + - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + + AXP288 model + - perf map: Fix off by one in strncpy() size argument + - [armel] bcm2835-rpi-zero-w: Add missing pinctrl name + - [armhf] dts: N900: fix onenand timings + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.115 + - ipv4: fix a RCU-list lock in fib_triestat_seq_show + - net, ip_tunnel: fix interface lookup with no key + - sctp: fix refcount bug in sctp_wfree + - sctp: fix possibly using a bad saddr with a given dst + - nvme-rdma: Avoid double freeing of async event data + - drm/bochs: downgrade pci_request_region failure from error to warning + - drm/amdgpu: fix typo for vcn1 idle check + - [x86] tools/power turbostat: Fix gcc build warnings + - [x86] tools/power turbostat: Fix missing SYS_LPI counter on some + Chromebooks + - [armhf] drm/etnaviv: replace MMU flush marker with flush sequence + - media: rc: IR signal for Panasonic air conditioner too long + - misc: rtsx: set correct pcr_ops for rts522A + - [x86] mei: me: add cedar fork device ids + - ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA + X99 Classified motherboard + - rxrpc: Fix sendmsg(MSG_WAITALL) handling + - net: Fix Tx hash bound checking + - padata: always acquire cpu_hotplug_lock before pinst->lock + - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED + (CVE-2020-11565) + - ipv6: don't auto-add link-local address to lag ports + - [armhf] net: dsa: bcm_sf2: Do not register slave MDIO bus with OF + - [armhf] net: dsa: bcm_sf2: Ensure correct sub-node is parsed + - net: phy: micrel: kszphy_resume(): add delay after genphy_resume() + before accessing PHY registers + - [arm64,armhf] net: stmmac: dwmac1000: fix out-of-bounds mac address reg + setting + - slcan: Don't transmit uninitialized stack data in padding + (CVE-2020-11494) + - random: always use batched entropy for get_random_u{32,64} + - [arm64,armhf] usb: dwc3: gadget: Wrap around when skip TRBs + - [armhf] hwrng: imx-rngc - fix an error path + - [amd64] IB/hfi1: Call kobject_put() when kobject_init_and_add() fails + - [amd64] IB/hfi1: Fix memory leaks in sysfs registration and + unregistration + - ceph: remove the extra slashes in the server path + - ceph: canonicalize server path in place + - RDMA/ucma: Put a lock around every call to the rdma_cm layer + - RDMA/cma: Teach lockdep about the order of rtnl and lock + - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl + - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow + - fbcon: fix null-ptr-deref in fbcon_switch + - [arm64] clk: qcom: rcg: Return failure for RCG update + - [arm64] drm/msm: stop abusing dma_map/unmap for cache + - [arm64] Fix size of __early_cpu_boot_status + - [arm64] rpmsg: glink: Remove chunk size word align warning + - [arm64,armhf] usb: dwc3: don't set gadget->is_otg flag + - drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() + - [arm64] drm/msm: Use the correct dma_sync calls in msm_gem + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.116 + - [armhf] dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high + voltage + - [arm64,armhf] bus: sunxi-rsb: Return correct data when mixing 16-bit and + 8-bit reads + - [x86,arm64] hinic: fix a bug of waitting for IO stopped + - [x86,arm64] hinic: fix wrong para of wait_for_completion_timeout + - cxgb4/ptp: pass the sign of offset delta in FW CMD + - qlcnic: Fix bad kzalloc null test + - [armhf] cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL + - [arm64] media: venus: hfi_parser: Ignore HEVC encoding for V1 + - null_blk: Fix the null_add_dev() error path + - null_blk: Handle null_add_dev() failures properly + - null_blk: fix spurious IO errors after failed past-wp access + - xhci: bail out early if driver can't accress host in resume + - [x86] Don't let pgprot_modify() change the page encryption bit + - block: keep bdi->io_pages in sync with max_sectors_kb for stacked + devices + - sched: Avoid scale real weight down to zero + - libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() + - [amd64,x86] pstore/platform: fix potential mem leak if pstore_init_fs + failed + - gfs2: Don't demote a glock until its revokes are written + - [i386] efi/x86: Ignore the memory attributes table on i386 + - genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy() + - block: Fix use-after-free issue accessing struct io_cq + - [arm64,armhf] usb: dwc3: core: add support for disabling SS instances in + park mode + - [arm64,armhf] irqchip/gic-v4: Provide irq_retrigger to avoid circular + locking dependency + - md: check arrays is suspended in mddev_detach before call quiesce + operations + - firmware: fix a double abort case with fw_load_sysfs_fallback + - block, bfq: fix use-after-free in bfq_idle_slice_timer_body + - btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker + is at least queued + - btrfs: remove a BUG_ON() from merge_reloc_roots() + - btrfs: track reloc roots based on their commit root bytenr + - IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads + - uapi: rename ext2_swab() to swab() and share globally in swab.h + - slub: improve bit diffusion for freelist ptr obfuscation + - ASoC: fix regwmask + - ASoC: dapm: connect virtual mux with default value + - ASoC: dpcm: allow start or stop during pause for backend + - [x86] ASoC: topology: use name_prefix for new kcontrol + - usb: gadget: f_fs: Fix use after free issue as part of queue failure + - usb: gadget: composite: Inform controller driver of self-powered + - ALSA: hda: Add driver blacklist + - ALSA: hda: Fix potential access overflow in beep helper + - ALSA: ice1724: Fix invalid access for enumerated ctl items + - ALSA: pcm: oss: Fix regression by buffer overflow fix + - ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256 + - ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 + - [x86] ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise + fixups + - [x86] ALSA: hda/realtek - Add quirk for MSI GL63 + - [x86] acpi: ignore unspecified bit positions in the ACPI global lock + field + - nvme-fc: Revert "add module to ops template to allow module references" + - nvme: Treat discovery subsystems as unique subsystems + - PCI: pciehp: Fix indefinite wait on sysfs requests + - PCI/ASPM: Clear the correct bits when enabling L1 substates + - PCI: Add boot interrupt quirk mechanism for Xeon chipsets + - tpm: Don't make log failures fatal + - tpm: tpm1_bios_measurements_next should increase position index + - tpm: tpm2_bios_measurements_next should increase position index + - KEYS: reaching the keys quotas correctly + - [amd64,x86] pstore: pstore_ftrace_seq_next should increase position + index + - [mips*el] tlbex: Fix LDDIR usage in setup_pw() for Loongson-3 + - [mips*/octeon] irq: Fix potential NULL pointer dereference + - ath9k: Handle txpower changes even when TPC is disabled + - signal: Extend exec_id to 64bits + - [i386] x86/entry/32: Add missing ASM_CLAC to general_protection entry + - [x86] KVM: nVMX: Properly handle userspace interrupt window request + - [s390x] KVM: vsie: Fix region 1 ASCE sanity shadow address checks + - [s390x] KVM: vsie: Fix delivery of addressing exceptions + - [x86] KVM: Allocate new rmap and large page tracking when moving memslot + - [x86] KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec + support + - [x86] KVM: Gracefully handle __vmalloc() failure during VM allocation + - [x86] KVM: VMX: fix crash cleanup when KVM wasn't used + - CIFS: Fix bug which the return value by asynchronous read is error + - Btrfs: fix crash during unmount due to race with delayed inode workers + - btrfs: set update the uuid generation as soon as possible + - btrfs: drop block from cache on error in relocation + - btrfs: fix missing file extent item for hole after ranged fsync + - btrfs: fix missing semaphore unlock in btrfs_sync_file + - [powerpc*] pseries: Drop pointless static qualifier in + vpa_debugfs_init() + - [x86] speculation: Remove redundant arch_smt_update() invocation + - mm: Use fixed constant in page_frag_alloc instead of size + 1 + - dm writecache: add cond_resched to avoid CPU hangs + - [s390x] scsi: zfcp: fix missing erp_lock in port recovery trigger for + point-to-point + - [arm64] armv8_deprecated: Fix undef_hook mask for thumb setend + - [armhf] drm/etnaviv: rework perfmon query infrastructure + - [powerpc*] pseries: Avoid NULL pointer dereference when drmem is + unavailable + - NFS: Fix a page leak in nfs_destroy_unlinked_subrequests() + - ext4: fix a data race at inode->i_blocks + - fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() + - ocfs2: no need try to truncate file beyond i_size + - [s390x] diag: fix display of diagnose call statistics + - [x86] Input: i8042 - add Acer Aspire 5738z to nomux list + - kmod: make request_module() return an error when autoloading is disabled + - [powerpc*] cpufreq: powernv: Fix use-after-free + - hfsplus: fix crash and filesystem corruption when deleting files + - libata: Return correct status in sata_pmp_eh_recover_pm() when + ATA_DFLAG_DETACH is set + - ipmi: fix hung processes in __get_guid() + - xen/blkfront: fix memory allocation flags in blkfront_setup_indirect() + - [powerpc*] powernv/idle: Restore AMR/UAMOR/AMOR after idle + (CVE-2020-11669) + - [powerpc*] 64/tm: Don't let userspace set regs->trap via sigreturn + - [powerpc*] hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge + devmap PTE entries + - [powerpc*] xive: Use XIVE_BAD_IRQ instead of zero to catch non + configured IPIs + - [powerpc*] kprobes: Ignore traps that happened in real mode + - scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug + - [powerpc*] Add attributes for setjmp/longjmp + - [powerpc*] Make setjmp/longjmp signature standard + - btrfs: use nofs allocations for running delayed items + - dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone() + - drm/dp_mst: Fix clearing payload state on topology disable + - drm: Remove PageReserved manipulation from drm_pci_alloc + - ftrace/kprobe: Show the maxactive number on kprobe_events + - [armhf] etnaviv: perfmon: fix total and idle HI cyleces readout + - [amd64] efi/x86: Fix the deletion of variables in mixed mode + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.117 + - [amd64,arm64] amd-xgbe: Use __napi_schedule() in BH context + - net: ipv6: do not consider routes via gateways for anycast address check + - net: revert default NAPI poll timeout to 2 jiffies + - [arm64,armhf] net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes + - ovl: fix value of i_ino for lower hardlink corner case + - scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic + - jbd2: improve comments about freeing data buffers whose page mapping is + NULL + - ext4: fix incorrect group count in ext4_fill_super error message + - ext4: fix incorrect inodes per group in error message + - [x86] ASoC: Intel: mrfld: fix incorrect check on p->sink + - [x86] ASoC: Intel: mrfld: return error codes when an error occurs + - ALSA: usb-audio: Filter error from connector kctl ops, too + - ALSA: usb-audio: Don't override ignore_ctl_error value from the map + - ALSA: usb-audio: Don't create jack controls for PCM terminals + - ALSA: usb-audio: Check mapping at creating connector controls, too + - keys: Fix proc_keys_next to increase position index + - tracing: Fix the race between registering 'snapshot' event trigger and + triggering 'snapshot' operation + - btrfs: check commit root generation in should_ignore_root + - mac80211_hwsim: Use kstrndup() in place of kasprintf() + - [arm64,armhf] usb: dwc3: gadget: don't enable interrupt when disabling + endpoint + - [arm64,armhf] usb: dwc3: gadget: Don't clear flags before transfer ended + - ext4: do not zeroout extents beyond i_disksize + - [x86] kvm: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD + - scsi: target: fix hang when multiple threads try to destroy the same + iscsi session + - [x86] microcode/AMD: Increase microcode PATCH_MAX_SIZE + - wil6210: check rx_buff_mgmt before accessing it + - wil6210: ignore HALP ICR if already handled + - wil6210: add general initialization/size checks + - wil6210: make sure Rx ring sizes are correlated + - wil6210: remove reset file from debugfs + - mm/vmalloc.c: move 'area->pages' after if statement + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.118 + - [armel,armhf] bpf: Fix offset overflow for BPF_MEM BPF_DW + - scsi: sg: add sg_remove_request in sg_common_write + - ext4: use non-movable memory for superblock readahead + - [arm64,armhf] watchdog: sp805: fix restart handler + - [armel,armhf] arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0 + - netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type + - [arm64] irqchip/mbigen: Free msi_desc on device teardown + - ALSA: hda: Don't release card at firmware loading error + - of: overlay: kmemleak in dup_and_fixup_symbol_prop() + - [x86] Hyper-V: Report crash register data or kmsg before running crash + kernel + - rbd: avoid a deadlock on header_rwsem when flushing notifies + - rbd: call rbd_dev_unprobe() after unwatching and flushing notifies + - xsk: Add missing check on user supplied headroom size + - [x86] Hyper-V: Unload vmbus channel in hv panic callback + - [x86] Hyper-V: Free hv_panic_page when fail to register kmsg dump + - [x86] Hyper-V: Trigger crash enlightenment only once during system + crash. + - [x86] Hyper-V: Report crash register data when sysctl_record_panic_msg + is not set + - [x86] Hyper-V: Report crash data in die() when panic_on_oops is set + - power: supply: bq27xxx_battery: Silence deferred-probe error + - [arm64,armhf] clk: tegra: Fix Tegra PMC clock out parents + - [armhf] soc: imx: gpc: fix power up sequencing + - NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid() + - NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails + - [s390x] cpuinfo: fix wrong output when CPU0 is offline + - [s390x] cpum_sf: Fix wrong page count in error message + - ext4: do not commit super on read-only bdev + - cifs: Allocate encryption header through kmalloc + - include/linux/swapops.h: correct guards for non_swap_entry() + - percpu_counter: fix a data race at vm_committed_as + - [s390x] KVM: vsie: Fix possible race when shadowing region 3 tables + - [x86] ACPI: fix CPU hotplug deadlock + - [amd64] drm/amdkfd: kfree the wrong pointer + - NFS: Fix memory leaks in nfs_pageio_stop_mirroring() + - f2fs: fix NULL pointer dereference in f2fs_write_begin() + - [arm*] drm/vc4: Fix HDMI mode validation + - [amd64] iommu/vt-d: Fix mm reference leak + - power: supply: axp288_fuel_gauge: Broaden vendor check for Intel Compute + Sticks. + - libnvdimm: Out of bounds read in __nd_ioctl() + - f2fs: fix to wait all node page writeback + - [armhf] net: dsa: bcm_sf2: Fix overflow checks + - fbdev: potential information leak in do_fb_ioctl() + - mtd: lpddr: Fix a double free in probe() + - mtd: phram: fix a double free issue in error path + - KEYS: Don't write out to userspace while holding key semaphore + - bpf: fix buggy r0 retval refinement for tracing helpers + + [ Salvatore Bonaccorso ] + * Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for + out-of-tree modules"" for context changes in 4.19.99 + * Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context + changes in 4.19.99 + * Drop "tools/lib/api/fs/fs.c: Fix misuse of strncpy()" + * Refresh "net: ena: add MAX_QUEUES_EXT get feature admin command" for + context changes in 4.19.108 + * [rt] Update to 4.19.115-rt48: + - Revert "genirq: Do not invoke the affinity callback via a workqueue on + RT" + * [rt] Refresh "pci/switchtec: Don't use completion's wait queue" for + context changes in 4.19.116 + * Refresh "firmware: Remove redundant log messages from drivers" for context + changes in 4.19.118 + * f2fs: fix to avoid memory leakage in f2fs_listxattr (CVE-2020-0067) + * net: ipv6: add net argument to ip6_dst_lookup_flow + * net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup + (CVE-2020-1749) + * blktrace: Protect q->blk_trace with RCU (CVE-2019-19768) + * blktrace: fix dereference after null check + + [ Ben Hutchings ] + * [x86] Drop "Add a SysRq option to lift kernel lockdown" (Closes: #947021) + - This patch allowed remotely disabling lockdown using usbip + - Lockdown can be disabled by running "mokutil --disable-validation", + rebooting, and confirming the change when prompted + * debian/README.source: Refer to upload checklist in kernel-team.git + * Bump ABI to 9 + + [ YunQiang Su ] + * [mips*] enable CONFIG_MIPS_O32_FP64_SUPPORT. + * [mips*] enable CONFIG_CPU_HAS_MSA except octeon. + + [ Steve McIntyre ] + * [arm64] Include the Hisilicon Hibmc drm driver in fb-modules + (Closes: #951274) + + [ Noah Meyerhans ] + * [cloud] Enable CONFIG_KSM + (Closes: #955366) + + -- Ben Hutchings <benh@debian.org> Sun, 26 Apr 2020 14:04:11 +0100 + +linux (4.19.98-1+deb10u1) buster-security; urgency=high + + * [x86] KVM: nVMX: Don't emulate instructions in guest mode (CVE-2020-2732) + * do_last(): fetch directory ->i_mode and ->i_uid before it's too late + (CVE-2020-8428) + * vfs: fix do_last() regression + * vhost: Check docket sk_family instead of call getname (CVE-2020-10942) + * mm: mempolicy: require at least one nodeid for MPOL_PREFERRED + (CVE-2020-11565) + * [s390x] mm: fix page table upgrade vs 2ndary address mode accesses + (CVE-2020-11884) + + -- Salvatore Bonaccorso <carnil@debian.org> Mon, 27 Apr 2020 07:05:39 +0200 + +linux (4.19.98-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.88 + - [arm64] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate + - ASoC: compress: fix unsigned integer overflow check + - reset: Fix memory leak in reset_control_array_put() + - [armhf] clk: samsung: exynos5433: Fix error paths + - [armel/marvell,armhf] ASoC: kirkwood: fix external clock probe defer + - [armel/marvell,armhf] ASoC: kirkwood: fix device remove ordering + - [armhf] clk: samsung: exynos5420: Preserve PLL configuration during + suspend/resume + - [x86] pinctrl: cherryview: Allocate IRQ chip dynamic + - [armhf] dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts + - reset: fix reset_control_ops kerneldoc comment + - [armhf,arm64] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup + - [armhf] clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 + - [armhf] dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend + - [ppc64el] bpf: Fix tail call implementation + - idr: Fix integer overflow in idr_for_each_entry + - idr: Fix idr_alloc_u32 on 32-bit systems + - [x86] resctrl: Prevent NULL pointer dereference when reading mondata + - [armhf] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call + - [armhf] clk: ti: clkctrl: Fix failed to enable error with double udelay + timeout + - bridge: ebtables: don't crash when using dnat target in output chains + - can: peak_usb: report bus recovery as well + - can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid + skb mem leak + - can: rx-offload: can_rx_offload_offload_one(): do not increase the + skb_queue beyond skb_queue_len_max + - can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors + on queue overflow or OOM + - can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to + propagate error value in case of errors + - can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on + error + - can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error + - [armhf] can: flexcan: increase error counters if skb enqueueing via + can_rx_offload_queue_sorted() fails + - [arm64] watchdog: meson: Fix the wrong value of left time + - ceph: return -EINVAL if given fsc mount option on kernel w/o support + - net/fq_impl: Switch to kvmalloc() for memory allocation + - mac80211: fix station inactive_time shortly after boot + - block: drbd: remove a stray unlock in __drbd_send_protocol() + - scsi: target/tcmu: Fix queue_cmd_ring() declaration + - scsi: lpfc: Fix kernel Oops due to null pring pointers + - scsi: lpfc: Fix dif and first burst use in write commands + - tracing: Lock event_mutex before synth_event_mutex + - [armhf] dts: imx*: Fix memory node duplication + - [armhf] dts: Fix hsi gdd range for omap4 + - [arm64] mm: Prevent mismatched 52-bit VA support + - [arm64] smp: Handle errors reported by the firmware + - [armhf] bus: ti-sysc: Check for no-reset and no-idle flags at the child + level + - [arm64] RDMA/hns: Fix the bug while use multi-hop of pbl + - [x86] RDMA/vmw_pvrdma: Use atomic memory allocation in create AH + - [armhf] PM / AVS: SmartReflex: NULL check before some freeing functions + is not needed + - xfs: zero length symlinks are not valid + - ACPI / LPSS: Ignore acpi_device_fix_up_power() return value + - scsi: lpfc: Enable Management features for IF_TYPE=6 + - scsi: qla2xxx: Fix NPIV handling for FC-NVMe + - scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port + - nvme: provide fallback for discard alloc failure + - [s390x] zcrypt: make sysfs reset attribute trigger queue reset + - crypto: user - support incremental algorithm dumps + - mwifiex: fix potential NULL dereference and use after free + - mwifiex: debugfs: correct histogram spacing, formatting + - brcmfmac: set F2 watermark to 256 for 4373 + - brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373 + - rtl818x: fix potential use after free + - bcache: do not check if debug dentry is ERR or NULL explicitly on remove + - bcache: do not mark writeback_running too early + - xfs: require both realtime inodes to mount + - nvme: fix kernel paging oops + - ubifs: Fix default compression selection in ubifs + - ubi: Put MTD device after it is not used + - ubi: Do not drop UBI device reference before using + - iwlwifi: move iwl_nvm_check_version() into dvm + - iwlwifi: mvm: force TCM re-evaluation on TCM resume + - iwlwifi: pcie: fix erroneous print + - iwlwifi: pcie: set cmd_len in the correct place + - [armhf,arm64] gpio: pca953x: Fix AI overflow on PCAL6524 + - gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB + - [x86] kvm: vmx: Set IA32_TSC_AUX for legacy mode guests + - [x86] Revert "KVM: nVMX: reset cache/shadows when switching loaded VMCS" + - [x86] Revert "KVM: nVMX: move check_vmentry_postreqs() call to + nested_vmx_enter_non_root_mode()" + - VSOCK: bind to random port for VMADDR_PORT_ANY + - [amd64] mmc: meson-gx: make sure the descriptor is stopped on errors + - [armhf] mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET + - [armhf] usb: ehci-omap: Fix deferred probe for phy handling + - btrfs: Check for missing device before bio submission in btrfs_map_bio + - btrfs: fix ncopies raid_attr for RAID56 + - btrfs: dev-replace: set result code of cancel by status of scrub + - Btrfs: allow clear_extent_dirty() to receive a cached extent state + record + - btrfs: only track ref_heads in delayed_ref_updates + - [x86] HID: intel-ish-hid: fixes incorrect error handling + - serial: 8250: Rate limit serial port rx interrupts during input overruns + - [x86] kprobes/xen: blacklist non-attachable xen interrupt functions + - xen/pciback: Check dev_data before using it + - kprobes: Blacklist symbols in arch-defined prohibited area + - [amd64] kprobes: Show x86-64 specific blacklisted symbols correctly + - [armhf] memory: omap-gpmc: Get the header of the enum + - net/mlx5: Continue driver initialization despite debugfs failure + - netfilter: nf_nat_sip: fix RTP/RTCP source port translations + - exofs_mount(): fix leaks on failure exits + - bnxt_en: Return linux standard errors in bnxt_ethtool.c + - bnxt_en: Save ring statistics before reset. + - bnxt_en: query force speeds before disabling autoneg mode. + - [s390x] KVM: unregister debug feature on failing arch init + - dm flakey: Properly corrupt multi-page bios. + - gfs2: take jdata unstuff into account in do_grow + - dm raid: fix false -EBUSY when handling check/repair message + - xfs: Align compat attrlist_by_handle with native implementation. + - xfs: Fix bulkstat compat ioctls on x32 userspace. + - IB/qib: Fix an error code in qib_sdma_verbs_send() + - vxlan: Fix error path in __vxlan_dev_create() + - [ppc64el] xmon: fix dump_segments() + - drivers/regulator: fix a missing check of return value + - Bluetooth: hci_bcm: Handle specific unknown packets after firmware + loading + - RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer + - scsi: qla2xxx: deadlock by configfs_depend_item + - scsi: csiostor: fix incorrect dma device in case of vport + - brcmfmac: Fix access point mode + - ath6kl: Only use match sets when firmware supports it + - ath6kl: Fix off by one error in scan completion + - [ppc64el] perf: Fix unit_sel/cache_sel checks + - [ppc64el] prom: fix early DEBUG messages + - [ppc64el] mm: Make NULL pointer deferences explicit on bad page faults. + - [ppc64el] vfio/spapr_tce: Get rid of possible infinite loop + - [ppc64el] powernv/eeh/npu: Fix uninitialized variables in + opal_pci_eeh_freeze_status + - drbd: ignore "all zero" peer volume sizes in handshake + - drbd: reject attach of unsuitable uuids even if connected + - drbd: do not block when adjusting "disk-options" while IO is frozen + - drbd: fix print_st_err()'s prototype to match the definition + - IB/rxe: Make counters thread safe + - bpf/cpumap: make sure frame_size for build_skb is aligned if headroom + isn't + - [armhf] regulator: tps65910: fix a missing check of return value + - [ppc64el] powerpc/pseries: Fix node leak in + update_lmb_associativity_index() + - net/netlink_compat: Fix a missing check of nla_parse_nested + - net/net_namespace: Check the return value of register_pernet_subsys() + - f2fs: fix block address for __check_sit_bitmap + - f2fs: fix to dirty inode synchronously + - [armhf] net: dsa: bcm_sf2: Propagate error value from mdio_write + - atl1e: checking the status of atl1e_write_phy_reg + - tipc: fix a missing check of genlmsg_put + - net: marvell: fix a missing check of acpi_match_device + - ocfs2: clear journal dirty flag after shutdown journal + - vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is + n + - mm/page_alloc.c: free order-0 pages through PCP in page_frag_free() + - mm/page_alloc.c: use a single function to free page + - mm/page_alloc.c: deduplicate __memblock_free_early() and memblock_free() + - netfilter: nf_tables: fix a missing check of nla_put_failure + - xprtrdma: Prevent leak of rpcrdma_rep objects + - infiniband/qedr: Potential null ptr dereference of qp + - lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk + - lib/genalloc.c: use vzalloc_node() to allocate the bitmap + - drivers/base/platform.c: kmemleak ignore a known leak + - lib/genalloc.c: include vmalloc.h + - mtd: Check add_mtd_device() ret code + - tipc: fix memory leak in tipc_nl_compat_publ_dump + - net/core/neighbour: tell kmemleak about hash tables + - [armhf,arm64] ata: ahci: mvebu: do Armada 38x configuration only on + relevant SoCs + - PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() + - net/core/neighbour: fix kmemleak minimal reference count for hash tables + - serial: 8250: Fix serial8250 initialization crash + - [armhf] gpu: ipu-v3: pre: don't trigger update if buffer address doesn't + change + - sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe + - ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel + - decnet: fix DN_IFREQ_SIZE + - net/smc: prevent races between smc_lgr_terminate() and smc_conn_free() + - net/smc: don't wait for send buffer space when data was already sent + - mm/hotplug: invalid PFNs from pfn_to_online_page() + - xfs: end sync buffer I/O properly on shutdown error + - net/smc: fix sender_free computation + - blktrace: Show requests without sector + - net/smc: fix byte_order for rx_curs_confirmed + - tipc: fix skb may be leaky in tipc_link_input + - sfc: initialise found bitmap in efx_ef10_mtd_probe + - geneve: change NET_UDP_TUNNEL dependency to select + - net: fix possible overflow in __sk_mem_raise_allocated() + - net: ip_gre: do not report erspan_ver for gre or gretap + - net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap + - sctp: don't compare hb_timer expire date before starting it + - bpf: decrease usercnt if bpf_map_new_fd() fails in + bpf_map_get_fd_by_id() + - mmc: core: align max segment size with logical block size + - net: dev: Use unsigned integer as an argument to left-shift + - kvm: properly check debugfs dentry before using it + - bpf: drop refcount if bpf_map_new_fd() fails in map_create() + - [arm64] net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED + - [arm64] net: hns3: fix PFC not setting problem for DCB module + - [arm64] net: hns3: fix an issue for hclgevf_ae_get_hdev + - [arm64] net: hns3: fix an issue for hns3_update_new_int_gl + - [x86] iommu/amd: Fix NULL dereference bug in match_hid_uid + - apparmor: delete the dentry in aafs_remove() to avoid a leak + - scsi: libsas: Support SATA PHY connection rate unmatch fixing during + discovery + - ACPI / APEI: Don't wait to serialise with oops messages when panic()ing + - ACPI / APEI: Switch estatus pool to use vmalloc memory + - [arm64] scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned + - scsi: libsas: Check SMP PHY control function result + - [arm64] RDMA/hns: Fix the bug with updating rq head pointer when flush cqe + - [arm64] RDMA/hns: Bugfix for the scene without receiver queue + - [arm64] RDMA/hns: Fix the state of rereg mr + - [arm64] RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp + - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board + - [ppc64el] pseries/dlpar: Fix a missing check in dlpar_parse_cc_property() + (CVE-2019-12614) + - xdp: fix cpumap redirect SKB creation bug + - mtd: Remove a debug trace in mtdpart.c + - [s390x] mm, gup: add missing refcount overflow checks on s390 + - [armhf,arm64] usb: dwc2: use a longer core rest timeout in + dwc2_core_reset() + - staging: rtl8192e: fix potential use after free + - staging: rtl8723bs: Drop ACPI device ids + - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids + - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P + - [x86] mei: bus: prefix device names on bus with the bus name + - [x86] mei: me: add comet point V device id + - thunderbolt: Power cycle the router if NVM authentication fails + - xfrm: Fix memleak on xfrm state destroy + - media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE + - [arm64] net: macb: fix error format in dev_err() + - pwm: Clear chip_data in pwm_put() + - macvlan: schedule bc_work even if error + - net: psample: fix skb_over_panic + - openvswitch: fix flow command message size + - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook + - slip: Fix use-after-free Read in slip_open + - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() + - openvswitch: remove another BUG_ON() + - tipc: fix link name length check + - sctp: cache netns in sctp_ep_common + - net: sched: fix `tc -s class show` no bstats on class with nolock + subqueues + - [arm64] net: macb: add missed tasklet_kill + - ext4: add more paranoia checking in ext4_expand_extra_isize handling + (CVE-2019-19767) + - [arm64] net: macb: Fix SUBNS increment and increase resolution + - [arm64] net: macb driver, check for SKBTX_HW_TSTAMP + - mtd: spi-nor: cast to u64 to avoid uint overflows + - tcp: exit if nothing to retransmit on RTO timeout + - HID: core: check whether Usage Page item is after Usage ID items + - [x86] platform: hp-wmi: Fix ACPI errors caused by too small buffer + - [x86] platform: hp-wmi: Fix ACPI errors caused by passing 0 as input size + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.89 + - rsi: release skb if rsi_prepare_beacon fails (CVE-2019-19071) + - [arm64] tegra: Fix 'active-low' warning for Jetson TX1 regulator + - usb: gadget: u_serial: add missing port entry locking + - [arm64] tty: serial: msm_serial: Fix flow control + - [armhf,arm64] serial: pl011: Fix DMA ->flush_buffer() + - serial: serial_core: Perform NULL checks for break_ctl ops + - autofs: fix a leak in autofs_expire_indirect() + - [arm64] RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN + - iwlwifi: pcie: don't consider IV len in A-MSDU + - exportfs_decode_fh(): negative pinned may become positive without the + parent locked + - audit_get_nd(): don't unlock parent too early + - xfrm: release device reference for invalid state + - sched/core: Avoid spurious lock dependencies + - perf/core: Consistently fail fork on allocation failures + - ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() + - [armhf,arm64] drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. + - rsxx: add missed destroy_workqueue calls in remove + - i2c: core: fix use after free in of_i2c_notify + - serial: core: Allow processing sysrq at port unlock time + - cxgb4vf: fix memleak in mac_hlist initialization + - iwlwifi: mvm: synchronize TID queue removal + - iwlwifi: trans: Clear persistence bit when starting the FW + - iwlwifi: mvm: Send non offchannel traffic via AP sta + - [armhf] 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ + - audit: Embed key into chunk + - netfilter: nf_tables: don't use position attribute on rule replacement + - net/mlx5: Release resource on error flow + - [arm64] clk: sunxi-ng: a64: Fix gate bit of DSI DPHY + - ice: Fix NVM mask defines + - dlm: fix possible call to kfree() for non-initialized pointer + - [armhf] dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1 + - [armhf,arm64] rtc: max77686: Fix the returned value in case of error in + 'max77686_rtc_read_time()' + - i40e: don't restart nway if autoneg not supported + - virtchnl: Fix off by one error + - [armhf] clk: rockchip: fix rk3188 sclk_smc gate data + - [armhf] clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering + - [armhf] dts: rockchip: Fix rk3288-rock2 vcc_flash name + - dlm: fix missing idr_destroy for recover_idr + - [armhf,arm64] net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing + MII_PHYSID2 + - [s390x] scsi: zfcp: update kernel message for invalid FCP_CMND length, + it's not the CDB + - [s390x] scsi: zfcp: drop default switch case which might paper over + missing case + - [armhf] bus: ti-sysc: Fix getting optional clocks in clock_roles + - [armhf] dts: imx6: RDU2: fix eGalax touchscreen node + - crypto: ecc - check for invalid values in the key verification test + - crypto: bcm - fix normal/non key hash algorithm failure + - [arm64] dts: zynqmp: Fix node names which contain "_" + - [arm64] pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues + - [arm*] firmware: raspberrypi: Fix firmware calls with large buffers + - mm/vmstat.c: fix NUMA statistics updates + - [arm64] clk: rockchip: fix I2S1 clock gate register for rk3328 + - [arm64] clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 + - sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit + - regulator: Fix return value of _set_load() stub + - USB: serial: f81534: fix reading old/new IC config + - xfs: extent shifting doesn't fully invalidate page cache + - net-next/hinic:fix a bug in set mac address + - net-next/hinic: fix a bug in rx data flow + - ice: Fix return value from NAPI poll + - ice: Fix possible NULL pointer de-reference + - iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents + - iomap: sub-block dio needs to zeroout beyond EOF + - iomap: dio data corruption and spurious errors when pipes fill + - iomap: readpages doesn't zero page tail beyond EOF + - iw_cxgb4: only reconnect with MPAv1 if the peer aborts + - [mips*/octeon] octeon-platform: fix typing + - net/smc: use after free fix in smc_wr_tx_put_slot() + - [armhf] dts: exynos: Use Samsung SoC specific compatible for DWC2 module + - media: pulse8-cec: return 0 when invalidating the logical address + - media: cec: report Vendor ID after initialization + - iwlwifi: fix cfg structs for 22000 with different RF modules + - net/ipv6: re-do dad when interface has IFF_NOARP flag change + - [x86] dmaengine: dw-dmac: implement dma protection control setting + - [armhf,arm64] usb: dwc3: debugfs: Properly print/set link state for HS + - [armhf,arm64] usb: dwc3: don't log probe deferrals; but do log other + error codes + - ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() + - f2fs: fix to account preflush command for noflush_merge mode + - f2fs: fix count of seg_freed to make sec_freed correct + - f2fs: change segment to section in f2fs_ioc_gc_range + - [armhf] dts: rockchip: Fix the PMU interrupt number for rv1108 + - [armhf] dts: rockchip: Assign the proper GPIO clocks for rv1108 + - f2fs: fix to allow node segment for GC by ioctl path + - nvme: Free ctrl device name on init failure + - dma-mapping: fix return type of dma_set_max_seg_size() + - [armhf] serial: imx: fix error handling in console_setup + - [armhf] i2c: imx: don't print error message on probe defer + - [arm64] clk: meson: Fix GXL HDMI PLL fractional bits width + - [armhf,arm64] gpu: host1x: Fix syncpoint ID field size on Tegra186 + - lockd: fix decoding of TEST results + - sctp: increase sk_wmem_alloc when head->truesize is increased + - [x86] iommu/amd: Fix line-break in error log reporting + - [armhf] dts: sun8i: a23/a33: Fix OPP DTC warnings + - [armhf] dts: sun8i: v3s: Change pinctrl nodes to avoid warning + - nfsd: fix a warning in __cld_pipe_upcall() + - bpf: btf: implement btf_name_valid_identifier() + - bpf: btf: check name validity for various types + - [armhf] OMAP1/2: fix SoC name printing + - [arm64] dts: meson-gxl-libretech-cc: fix GPIO lines names + - [arm64] dts: meson-gxbb-nanopi-k2: fix GPIO lines names + - [arm64] dts: meson-gxbb-odroidc2: fix GPIO lines names + - [arm64] dts: meson-gxl-khadas-vim: fix GPIO lines names + - net/x25: fix called/calling length calculation in x25_parse_address_block + - net/x25: fix null_x25_address handling + - tcp: make tcp_space() aware of socket backlog + - tcp: fix off-by-one bug on aborting window-probing socket + - tcp: fix SNMP under-estimation on failed retransmission + - tcp: fix SNMP TCP timeout under-estimation + - kbuild: fix single target build for external module + - mtd: fix mtd_oobavail() incoherent returned value + - [arm64] clk: meson: meson8b: fix the offset of vid_pll_dco's N value + - [armhf,arm64] clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent + - [arm64] clk: qcom: Fix MSM8998 resets + - dlm: fix invalid cluster name warning + - net/mlx4_core: Fix return codes of unsupported operations + - pstore/ram: Avoid NULL deref in ftrace merging failure path + - [mips*/octeon] cvmx_pko_mem_debug8: use oldest forward compatible + definition + - nfsd: Return EPERM, not EACCES, in some SETATTR cases + - media: uvcvideo: Abstract streaming object lifetime + - [armhf] dts: sun8i: h3: Fix the system-control register range + - tty: Don't block on IO when ldisc change is pending + - media: stkwebcam: Bugfix for wrong return values + - sctp: frag_point sanity check + - IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state + - IB/hfi1: Close VNIC sdma_progress sleep window + - mlx4: Use snprintf instead of complicated strcpy + - [armhf] dts: sunxi: Fix PMU compatible strings + - [armhf] dts: am335x-pdu001: Fix polarity of card detection input + - net: aquantia: fix RSS table and key sizes + - sched/fair: Scale bandwidth quota and period without losing quota/period + ratio precision + - fuse: verify nlink + - fuse: verify attributes + - [x86] ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC + - [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop + - [x86] ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 + - ALSA: pcm: oss: Avoid potential buffer overflows + - [x86] ALSA: hda - Add mute led support for HP ProBook 645 G4 + - [x86] Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus + - [x86] Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash + - [x86] Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers + - [x86] Input: goodix - add upside-down quirk for Teclast X89 tablet + - Input: Fix memory leak in psxpad_spi_probe + - [i386] mm: Sync only to VMALLOC_END in vmalloc_sync_all() + - [x86] PCI: Avoid AMD FCH XHCI USB PME# from D0 defect + - xfrm interface: fix memory leak on creation + - xfrm interface: avoid corruption on changelink + - xfrm interface: fix list corruption for x-netns + - xfrm interface: fix management of phydev + - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks + - CIFS: Fix SMB2 oplock break processing + - tty: vt: keyboard: reject invalid keycodes + - can: slcan: Fix use-after-free Read in slcan_open + - kernfs: fix ino wrap-around detection + - jbd2: Fix possible overflow in jbd2_log_space_left() + - [arm64] drm/msm: fix memleak on release + - [i386] drm/i810: Prevent underflow in ioctl + - [armhf,arm64] KVM: vgic: Don't rely on the wrong pending table + - [x86] KVM: do not modify masked bits of shared MSRs + - [x86] KVM: fix presentation of TSX feature in ARCH_CAPABILITIES + - [x86] KVM: Grab KVM's srcu lock when setting nested state + - crypto: af_alg - cast ki_complete ternary op to int + - [x86] crypto: ccp - fix uninitialized list head + - crypto: ecdh - fix big endian bug in ECC library + - crypto: user - fix memory leak in crypto_report (CVE-2019-19062) + - mwifiex: update set_mac_address logic + - can: ucan: fix non-atomic allocation in completion handler + - RDMA/qib: Validate ->show()/store() callbacks before calling them + - iomap: Fix pipe page leakage during splicing + - thermal: Fix deadlock in thermal thermal_zone_device_check + - vcs: prevent write access to vcsu devices (CVE-2019-19252) + - binder: Fix race between mmap() and binder_alloc_print_pages() + - binder: Handle start==NULL in binder_update_page_range() + - ALSA: hda - Fix pending unsol events at shutdown + - perf script: Fix invalid LBR/binary mismatch error + - splice: don't read more than available pipe space + - iomap: partially revert 4721a601099 (simulated directio short read on + EFAULT) + - xfs: add missing error check in xfs_prepare_shift() + - ASoC: rsnd: fixup MIX kctrl registration + - [x86] KVM: fix out-of-bounds write in KVM_GET_EMULATED_CPUID + (CVE-2019-19332) + - net: qrtr: fix memort leak in qrtr_tun_write_iter (CVE-2019-19079) + - appletalk: Fix potential NULL pointer dereference in + unregister_snap_client (CVE-2019-19227) + - appletalk: Set error code if register_snap_client failed + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.90 + - usb: gadget: configfs: Fix missing spin_lock_init() + - [x86] usb: gadget: pch_udc: fix use after free + - scsi: qla2xxx: Fix driver unload hang + - [arm64] media: venus: remove invalid compat_ioctl32 handler + - USB: uas: honor flag to avoid CAPACITY16 + - USB: uas: heed CAPACITY_HEURISTICS + - usb: Allow USB device to be warm reset in suspended state + - staging: rtl8188eu: fix interface sanity check + - staging: rtl8712: fix interface sanity check + - staging: gigaset: fix general protection fault on probe + - staging: gigaset: fix illegal free on probe errors + - staging: gigaset: add endpoint-type sanity check + - usb: xhci: only set D3hot for pci device + - xhci: Fix memory leak in xhci_add_in_port() + - xhci: Increase STS_HALT timeout in xhci_suspend() + - xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. + - [armhf] dts: pandora-common: define wl1251 as child node of mmc3 + - [x86] iio: imu: inv_mpu6050: fix temperature reporting using bad unit + - USB: atm: ueagle-atm: add missing endpoint check + - USB: idmouse: fix interface sanity checks + - USB: serial: io_edgeport: fix epic endpoint lookup + - usb: roles: fix a potential use after free + - USB: adutux: fix interface sanity check + - usb: core: urb: fix URB structure initialization function + - usb: mon: Fix a deadlock in usbmon between mmap and read + - tpm: add check after commands attribs tab allocation + - virtio-balloon: fix managed page counts when migrating pages between + zones + - [armhf,arm64] usb: dwc3: gadget: Fix logical condition + - [armhf,arm64] usb: dwc3: ep0: Clear started flag on completion + - btrfs: check page->mapping when loading free space cache + - btrfs: use refcount_inc_not_zero in kill_all_nodes + - Btrfs: fix metadata space leak on fixup worker failure to set range as + delalloc + - Btrfs: fix negative subv_writers counter and data space leak after + buffered write + - btrfs: Avoid getting stuck during cyclic writebacks + - btrfs: Remove btrfs_bio::flags member + - Btrfs: send, skip backreference walking for extents with many references + - btrfs: record all roots for rename exchange on a subvol + - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address + - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of + buffer + - rtlwifi: rtl8192de: Fix missing enable interrupt flag + - ovl: fix corner case of non-unique st_dev;st_ino + - ovl: relax WARN_ON() on rename to self + - [armhf] hwrng: omap - Fix RNG wait loop timeout + - dm writecache: handle REQ_FUA + - dm zoned: reduce overhead of backing device checks + - workqueue: Fix spurious sanity check failures in destroy_workqueue() + - workqueue: Fix pwq ref leak in rescuer_thread() + - ASoC: rt5645: Fixed buddy jack support. + - ASoC: rt5645: Fixed typo for buddy jack support. + - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report + - md: improve handling of bio with REQ_PREFLUSH in md_flush_request() + - blk-mq: avoid sysfs buffer overflow with too many CPU cores + - cgroup: pids: use atomic64_t for pids->limit + - ar5523: check NULL before memcpy() in ar5523_cmd() + - [s390x] mm: properly clear _PAGE_NOEXEC bit when it is not supported + - media: cec.h: CEC_OP_REC_FLAG_ values were swapped + - cpuidle: Do not unset the driver if it is there already + - erofs: zero out when listxattr is called with no xattr + - [x86] intel_th: Fix a double put_device() in error path + - [x86] intel_th: pci: Add Ice Lake CPU support + - [x86] intel_th: pci: Add Tiger Lake CPU support + - PM / devfreq: Lock devfreq in trans_stat_show + - [ppc64el] cpufreq: powernv: fix stack bloat and hard limit on number of + CPUs + - ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug + bridge + - ACPI: OSL: only free map once in osl.c + - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() + - ACPI: PM: Avoid attaching ACPI PM domain to certain devices + - [arm64] pinctrl: armada-37xx: Fix irq mask access in + armada_37xx_irq_set_type() + - [armhf] pinctrl: samsung: Add of_node_put() before return in error path + - [armhf] pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup + controller init + - [armhf] pinctrl: samsung: Fix device node refcount leaks in init code + - [armhf] mmc: host: omap_hsmmc: add code for special init of wl1251 to get + rid of pandora_wl1251_init_card + - [armhf] dts: omap3-tao3530: Fix incorrect MMC card detection GPIO + polarity + - ppdev: fix PPGETTIME/PPSETTIME ioctls + - [ppc64el] Allow 64bit VDSO __kernel_sync_dicache to work across ranges + >4GB + - [ppc64el] xive: Prevent page fault issues in the machine crash handler + - [ppc64el] Allow flush_icache_range to work across ranges >4GB + - [ppc64el] xive: Skip ioremap() of ESB pages for LSI interrupts + - video/hdmi: Fix AVI bar unpack + - quota: Check that quota is not dirty before release + - ext2: check err when partial != NULL + - quota: fix livelock in dquot_writeback_dquots + - ext4: Fix credit estimate for final inode freeing + - reiserfs: fix extended attributes on the root directory + - block: fix single range discard merge + - [s390x] scsi: zfcp: trace channel log even for FCP command responses + - scsi: qla2xxx: Fix DMA unmap leak + - scsi: qla2xxx: Fix hang in fcport delete path + - scsi: qla2xxx: Fix session lookup in qlt_abort_work() + - scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() + - scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value + - scsi: qla2xxx: Fix message indicating vectors used by driver + - scsi: qla2xxx: Fix SRB leak on switch command timeout + - xhci: make sure interrupts are restored to correct state + - usb: typec: fix use after free in typec_register_port() + - [armhf] omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 + - scsi: lpfc: Cap NPIV vports to 256 + - scsi: lpfc: Correct code setting non existent bits in sli4 ABORT WQE + - scsi: lpfc: Correct topology type reporting on G7 adapters + - sch_cake: Correctly update parent qlen when splitting GSO packets + - net/smc: do not wait under send_lock + - [arm64] net: hns3: clear pci private data when unload hns3 driver + - [arm64] net: hns3: change hnae3_register_ae_dev() to int + - [arm64] net: hns3: Check variable is valid before assigning it to another + - [arm64] scsi: hisi_sas: send primitive NOTIFY to SSP situation only + - [arm64] scsi: hisi_sas: Reject setting programmed minimum linkrate > 1.5G + - [x86] MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models + - [x86] MCE/AMD: Carve out the MC4_MISC thresholding quirk + - ath10k: fix fw crash by moving chip reset after napi disabled + - [ppc64el] Fix vDSO clock_getres() + - ext4: work around deleting a file with i_nlink == 0 safely + (CVE-2019-19447) + - mm/shmem.c: cast the type of unmap_start to u64 + - rtc: disable uie before setting time and enable after + - splice: only read in as much information as there is pipe buffer space + - ext4: fix a bug in ext4_wait_for_tail_page_commit + - [armhf,arm64] mfd: rk808: Fix RK818 ID template + - mm, thp, proc: report THP eligibility for each vma + - [s390x] smp,vdso: fix ASCE handling + - blk-mq: make sure that line break can be printed + - workqueue: Fix missing kfree(rescuer) in destroy_workqueue() + - perf callchain: Fix segfault in thread__resolve_callchain_sample() + - gre: refetch erspan header from skb->data after pskb_may_pull() + - sunrpc: fix crash when cache_head become valid before update + - net/mlx5e: Fix SFF 8472 eeprom length + - leds: trigger: netdev: fix handling on interface rename + - gfs2: fix glock reference problem in gfs2_trans_remove_revoke + - of: overlay: add_changeset_property() memory leak + - kernel/module.c: wakeup processes in module_wq on module unload + - cifs: Fix potential softlockups while refreshing DFS cache + - [x86] gpiolib: acpi: Add Terra Pad 1061 to the + run_edge_events_on_boot_blacklist + - raid5: need to set STRIPE_HANDLE for batch head + - scsi: qla2xxx: Change discovery state before PLOGI + - [x86] iio: imu: mpu6050: add missing available scan masks + - idr: Fix idr_get_next_ul race with idr_remove + - of: unittest: fix memory leak in attach_node_and_children + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.91 + - inet: protect against too small mtu values. + - mqprio: Fix out-of-bounds access in mqprio_dump + - net: bridge: deny dev_set_mac_address() when unregistering + - net: dsa: fix flow dissection on Tx path + - net: ethernet: ti: cpsw: fix extra rx interrupt + - net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues + - [arm64] net: thunderx: start phy before starting autonegotiation + - openvswitch: support asymmetric conntrack + - tcp: md5: fix potential overestimation of TCP option space + - tipc: fix ordering of tipc module init and exit routine + - net/mlx5e: Query global pause state before setting prio2buffer + - tcp: fix rejected syncookies due to stale timestamps + - tcp: tighten acceptance of ACKs not matching a child socket + - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() + - [arm64] Revert "arm64: preempt: Fix big-endian when checking preempt + count in assembly" + - mmc: block: Make card_busy_detect() a bit more generic + - mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response + - PCI/PM: Always return devices to D0 when thawing + - PCI: pciehp: Avoid returning prematurely from sysfs requests + - [x86] PCI: Fix Intel ACS quirk UPDCR register address + - PCI/MSI: Fix incorrect MSI-X masking on resume + - [arm64] PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3 + - [arm64] rpmsg: glink: Set tail pointer to 0 at end of FIFO + - [arm64] rpmsg: glink: Fix reuse intents memory leak issue + - [arm64] rpmsg: glink: Fix use after free in open_ack TIMEOUT case + - [arm64] rpmsg: glink: Put an extra reference during cleanup + - [arm64] rpmsg: glink: Fix rpmsg_register_device err handling + - [arm64] rpmsg: glink: Don't send pending rx_done during remove + - [arm64] rpmsg: glink: Free pending deferred work on remove + - cifs: smbd: Return -EAGAIN when transport is reconnecting + - cifs: smbd: Add messages on RDMA session destroy and reconnection + - cifs: smbd: Return -EINVAL when the number of iovs exceeds + SMBDIRECT_MAX_SGE + - cifs: Don't display RDMA transport on reconnect + - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect + - CIFS: Close open handle after interrupted close + - [armhf] tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() + - vfio/pci: call irq_bypass_unregister_producer() before freeing irq + - dma-buf: Fix memory leak in sync_file_merge() + - [arm64] drm: meson: venc: cvbs: fix CVBS mode matching + - dm mpath: remove harmful bio-based optimization + - dm btree: increase rebalance threshold in __rebalance2() + - scsi: iscsi: Fix a potential deadlock in the timeout handler + - scsi: qla2xxx: Change discovery state before PLOGI + - drm/radeon: fix r1xx/r2xx register checker for POT textures + - xhci: fix USB3 device initiated resume race with roothub autosuspend + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.92 + - af_packet: set defaule value for tmo + - [amd64] fjes: fix missed check in fjes_acpi_add + - [arm64] net: hisilicon: Fix a BUG trigered by wrong bytes_compl + - net: qlogic: Fix error paths in ql_alloc_large_buffers() + - net: usb: lan78xx: Fix suspend/resume PHY register access error + - qede: Disable hardware gro when xdp prog is installed + - qede: Fix multicast mac configuration + - sctp: fully initialize v4 addr in some functions + - btrfs: don't double lock the subvol_sem for rename exchange + - btrfs: do not call synchronize_srcu() in inode_tree_del + - Btrfs: fix missing data checksums after replaying a log tree + - btrfs: send: remove WARN_ON for readonly mount + - btrfs: abort transaction after failed inode updates in create_subvol + - btrfs: skip log replay on orphaned roots + - btrfs: do not leak reloc root if we fail to read the fs root + - btrfs: handle ENOENT in btrfs_uuid_tree_iterate + - Btrfs: fix removal logic of the tree mod log that leads to + use-after-free issues + - ALSA: pcm: Avoid possible info leaks from PCM stream buffers + - ALSA: hda/ca0132 - Keep power on during processing DSP response + - ALSA: hda/ca0132 - Avoid endless loop + - ALSA: hda/ca0132 - Fix work handling in delayed HP detection + - [arm64,armhf] drm/panel: Add missing drm_panel_init() in panel drivers + - drm/amdgpu: grab the id mgr lock while accessing passid_mapping + - spi: Add call to spi_slave_abort() function when spidev driver is + released + - [x86] staging: rtl8192u: fix multiple memory leaks on error path + - staging: rtl8188eu: fix possible null dereference + - rtlwifi: prevent memory leak in rtl_usb_probe (CVE-2019-19063) + - libertas: fix a potential NULL pointer dereference + - ath10k: fix backtrace on coredump + - IB/iser: bound protection_sg size by data_sg size + - [arm64] media: venus: core: Fix msm8996 frequency table + - ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq + - pinctrl: devicetree: Avoid taking direct reference to device name string + - [amd64] drm/amdkfd: fix a potential NULL pointer dereference + - [arm64] media: venus: Fix occasionally failures to suspend + - [armhf] hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if + not idled + - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() + - [arm64,armhf] drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the + internal I2C controller + - block: Fix writeback throttling W=1 compiler warnings + - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring + (CVE-2019-19057) + - drm/drm_vblank: Change EINVAL by the correct errno + - media: cx88: Fix some error handling path in 'cx8800_initdev()' + - [armhf] media: ti-vpe: vpe: Fix Motion Vector vpdma stride + - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid + pixel format + - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about frame + sequence number + - [armhf] media: ti-vpe: vpe: Make sure YUYV is set as default format + - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a + kernel panic + - [armhf] media: ti-vpe: vpe: ensure buffers are cleaned up properly in + abort cases + - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid + sizeimage + - [x86] syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 + - [x86] mm: Use the correct function type for native_set_fixmap() + - ath10k: Correct error handling of dma_map_single() + - [arm64,armhf] drm/bridge: dw-hdmi: Restore audio when setting a mode + - perf report: Add warning when libunwind not compiled in + - usb: usbfs: Suppress problematic bind and unbind uevents. + - Bluetooth: missed cpu_to_le16 conversion in hci_init4_req + - Bluetooth: Workaround directed advertising bug in Broadcom controllers + - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL + - [x86] mce: Lower throttling MCE messages' priority to warning + - [x86] drm/gma500: fix memory disclosures due to uninitialized bytes + - rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot + - ipmi: Don't allow device module unload when in use + - [x86] ioapic: Prevent inconsistent state when moving an interrupt + - md/bitmap: avoid race window between md_bitmap_resize and + bitmap_file_clear_bit + - [arm64] psci: Reduce the waiting time for cpu_psci_cpu_kill() + - i40e: initialize ITRN registers with correct values + - net: phy: dp83867: enable robust auto-mdix + - [arm64,armhf] drm/tegra: sor: Use correct SOR index on Tegra210 + - ACPI: button: Add DMI quirk for Medion Akoya E2215T + - RDMA/qedr: Fix memory leak in user qp and mr + - [arm64,armhf] gpu: host1x: Allocate gather copy for host1x + - [arm64,armhf] net: dsa: LAN9303: select REGMAP when LAN9303 enable + - [arm64] phy: qcom-usb-hs: Fix extcon double register after power cycle + - [s390x] time: ensure get_clock_monotonic() returns monotonic values + - [s390x] mm: add mm_pxd_folded() checks to pxd_free() + - [arm64] net: hns3: add struct netdev_queue debug info for TX timeout + - libata: Ensure ata_port probe has completed before detach + - loop: fix no-unmap write-zeroes request behavior + - Bluetooth: Fix advertising duplicated flags + - pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() + - ixgbe: protect TX timestamping from API misuse + - media: rcar_drif: fix a memory disclosure (CVE-2019-18786) + - media: v4l2-core: fix touch support in v4l_g_fmt + - rfkill: allocate static minor + - bnx2x: Fix PF-VF communication over multi-cos queues. + - ALSA: timer: Limit max amount of slave instances + - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() + - perf probe: Fix to find range-only function instance + - perf probe: Fix to list probe event with correct line number + - perf jevents: Fix resource leak in process_mapfile() and main() + - perf probe: Walk function lines in lexical blocks + - perf probe: Fix to probe an inline function which has no entry pc + - perf probe: Fix to show ranges of variables in functions without + entry_pc + - perf probe: Fix to show inlined function callsite without entry_pc + - perf probe: Fix to probe a function which has no entry pc + - perf tools: Splice events onto evlist even on error + - perf parse: If pmu configuration fails free terms + - perf probe: Skip overlapped location on searching variables + - perf probe: Return a better scope DIE if there is no best scope + - perf probe: Fix to show calling lines of inlined functions + - perf probe: Skip end-of-sequence and non statement lines + - perf probe: Filter out instances except for inlined subroutine and + subprogram + - ath10k: fix get invalid tx rate for Mesh metric + - media: pvrusb2: Fix oops on tear-down when radio support is not present + - ice: delay less + - [amd64] spi: pxa2xx: Add missed security checks + - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile + - iio: dac: ad5446: Add support for new AD5600 DAC + - [x86] ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format + constraint + - [s390x] disassembler: don't hide instruction addresses + - nvme: Discard workaround for non-conformant devices + - parport: load lowlevel driver if ports not found + - bcache: fix static checker warning in bcache_device_free() + - cpufreq: Register drivers only after CPU devices have been registered + - tracing: use kvcalloc for tgid_map array allocation + - tracing/kprobe: Check whether the non-suffixed symbol is notrace + - bcache: fix deadlock in bcache_allocator + - iwlwifi: mvm: fix unaligned read of rx_pkt_status + - [arm64] spi: tegra20-slink: add missed clk_unprepare + - tun: fix data-race in gro_normal_list() + - crypto: virtio - deal with unsupported input sizes + - btrfs: don't prematurely free work in end_workqueue_fn() + - btrfs: don't prematurely free work in run_ordered_work() + - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 + 2-in-1 + - [x86] insn: Add some Intel instructions to the opcode map + - brcmfmac: remove monitor interface when detaching + - iwlwifi: check kasprintf() return value + - [armhf] net: ethernet: ti: ale: clean ale tbl on init and intf restart + - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings + - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c + - mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED + - net: phy: initialise phydev speed and duplex sanely + - btrfs: don't prematurely free work in reada_start_machine_worker() + - btrfs: don't prematurely free work in scrub_missing_raid56_worker() + - Revert "mmc: sdhci: Fix incorrect switch to HS mode" + - can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices + (CVE-2019-19947) + - usb: xhci: Fix build warning seen with CONFIG_PM=n + - [s390x] ftrace: fix endless recursion in function_graph tracer + - btrfs: return error pointer from alloc_test_extent_buffer + - usbip: Fix receive error in vhci-hcd when using scatter-gather + - usbip: Fix error path of vhci_recv_ret_submit() + - cpufreq: Avoid leaving stale IRQ work items during CPU offline + - [x86] intel_th: pci: Add Comet Lake PCH-V support + - [x86] intel_th: pci: Add Elkhart Lake SOC support + - [x86] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 + bytes + - [x86] staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value + - ext4: fix ext4_empty_dir() for directories with holes (CVE-2019-19037) + - ext4: check for directory entries too close to block end + - ext4: unlock on error in ext4_expand_extra_isize() + - [arm64] KVM: Ensure 'params' is initialised when looking up sys register + - [x86] MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() + - [x86] MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] + - [powerpc*] irq: fix stack overflow verification + - [arm64] mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG + register + - mmc: sdhci: Update the tuning failed messages to pr_debug level + - mmc: sdhci: Workaround broken command queuing on Intel GLK + - mmc: sdhci: Add a quirk for broken command queuing + - nbd: fix shutdown and recv work deadlock + - perf probe: Fix to show function entry line as probe-able + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.93 + - scsi: lpfc: Fix discovery failures when target device connectivity + bounces + - scsi: mpt3sas: Fix clear pending bit in ioctl status + - scsi: lpfc: Fix locking on mailbox command completion + - Input: atmel_mxt_ts - disable IRQ across suspend + - f2fs: fix to update time in lazytime mode + - [arm64,armhf] iommu: rockchip: Free domain on .domain_free + - [arm64,armhf] iommu/tegra-smmu: Fix page tables in > 4 GiB memory + - scsi: target: compare full CHAP_A Algorithm strings + - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices + - scsi: csiostor: Don't enable IRQs too early + - [arm64] scsi: hisi_sas: Replace in_softirq() check in + hisi_sas_task_exec() + - [ppc64el] pseries: Mark accumulate_stolen_time() as notrace + - [ppc64el] pseries: Don't fail hash page table insert for bolted mapping + - clocksource/drivers/timer-of: Use unique device name instead of timer + - [ppc64el] security/book3s64: Report L1TF status in sysfs + - [ppc64el] book3s64/hash: Add cond_resched to avoid soft lockup warning + - ext4: update direct I/O read lock pattern for IOCB_NOWAIT + - ext4: iomap that extends beyond EOF should be marked dirty + - jbd2: Fix statistics for the number of logged blocks + - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and + WRITE(6) + - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow + - f2fs: fix to update dir's i_pino during cross_rename + - [arm64] clk: qcom: Allow constant ratio freq tables for rcg + - clk: clk-gpio: propagate rate change to parent + - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned + long + - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer + dereferences + - [ppc64el] PCI: rpaphp: Fix up pointer to first drc-info entry + - scsi: ufs: fix potential bug which ends in system hang + - [ppc64el] PCI: rpaphp: Don't rely on firmware feature to imply drc-info + support + - [ppc64el] PCI: rpaphp: Annotate and correctly byte swap DRC properties + - [ppc64el] PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name + when using drc-info + - [ppc64el] powerpc/security: Fix wrong message when RFI Flush is disable + - bcache: at least try to shrink 1 node in bch_mca_scan() + - HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse + - HID: logitech-hidpp: Silence intermittent get_battery_capacity errors + - [armhf] 8937/1: spectre-v2: remove Brahma-B53 from hardening + - libnvdimm/btt: fix variable 'rc' set but not used + - HID: Improve Windows Precision Touchpad detection. + - HID: rmi: Check that the RMI_STARTED bit is set before unregistering the + RMI transport device + - watchdog: Fix the race between the release of watchdog_core_data and + cdev + - scsi: pm80xx: Fix for SATA device discovery + - scsi: ufs: Fix error handing during hibern8 enter + - scsi: scsi_debug: num_tgts must be >= 0 + - scsi: iscsi: Don't send data to unbound connection + - scsi: target: iscsi: Wait for all commands to finish before freeing a + session + - apparmor: fix unsigned len comparison with less than zero + - scripts/kallsyms: fix definitely-lost memory leak + - cdrom: respect device capabilities during opening action + - perf script: Fix brstackinsn for AUXTRACE + - perf regs: Make perf_reg_name() return "unknown" instead of NULL + - [s390x] zcrypt: handle new reply code FILTERED_BY_HYPERVISOR + - [s390x] cpum_sf: Check for SDBT and SDB consistency + - ocfs2: fix passing zero to 'PTR_ERR' warning + - kernel: sysctl: make drop_caches write-only + - userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK + - [x86] mce: Fix possibly incorrect severity calculation on AMD + - net, sysctl: Fix compiler warning when only cBPF is present + - netfilter: nf_queue: enqueue skbs with NULL dst + - ALSA: hda - Downgrade error message for single-cmd fallback + - bonding: fix active-backup transition after link failure + - perf strbuf: Remove redundant va_end() in strbuf_addv() + - Make filldir[64]() verify the directory entry filename is valid + (CVE-2019-10220) + - filldir[64]: remove WARN_ON_ONCE() for bad directory entries + (CVE-2019-10220) + - netfilter: ebtables: compat: reject all padding in matches/watchers + - 6pack,mkiss: fix possible deadlock + - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() + - inetpeer: fix data-race in inet_putpeer / inet_putpeer + - net: add a READ_ONCE() in skb_peek_tail() + - net: icmp: fix data-race in cmp_global_allow() + - hrtimer: Annotate lockless access to timer->state + - net: ena: fix napi handler misbehavior when the napi budget is zero + - net/mlxfw: Fix out-of-memory error in mfa2 flash burning + - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on + Meson8b/8m2 SoCs + - ptp: fix the race between the release of ptp_clock and cdev + - tcp: Fix highest_sack and highest_sack_seq + - udp: fix integer overflow while computing available space in sk_rcvbuf + - vhost/vsock: accept only packets with the right dst_cid + - net: add bool confirm_neigh parameter for dst_ops.update_pmtu + - ip6_gre: do not confirm neighbor when do pmtu update + - gtp: do not confirm neighbor when do pmtu update + - net/dst: add new function skb_dst_update_pmtu_no_confirm + - tunnel: do not confirm neighbor when do pmtu update + - vti: do not confirm neighbor when do pmtu update + - sit: do not confirm neighbor when do pmtu update + - net/dst: do not confirm neighbor for vxlan and geneve pmtu update + - gtp: do not allow adding duplicate tid and ms_addr pdp context + - [arm64,armhf] net: marvell: mvpp2: phylink requires the link interrupt + - tcp/dccp: fix possible race __inet_lookup_established() + - tcp: do not send empty skb from tcp_write_xmit() + - gtp: fix wrong condition in gtp_genl_dump_pdp() + - gtp: fix an use-after-free in ipv4_pdp_find() + - gtp: avoid zero size hashtable + - [arm64,armhf] pinctrl: baytrail: Really serialize all register accesses + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.94 + - nvme_fc: add module to ops template to allow module references + - nvme-fc: fix double-free scenarios on hw queues + - drm/amdgpu: add check before enabling/disabling broadcast mode + - drm/amdgpu: add cache flush workaround to gfx8 emit_fence + - PM / devfreq: Fix devfreq_notifier_call returning errno + - PM / devfreq: Set scaling_max_freq to max on OPP notifier error + - PM / devfreq: Don't fail devfreq_dev_release if not in list + - afs: Fix afs_find_server lookups for ipv4 peers + - afs: Fix SELinux setting security label on /afs + - RDMA/cma: add missed unregister_pernet_subsys in init failure + - rxe: correctly calculate iCRC for unaligned payloads + - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func + - scsi: qla2xxx: Drop superfluous INIT_WORK of del_work + - scsi: qla2xxx: Don't call qlt_async_event twice + - scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length + - scsi: qla2xxx: Configure local loop for N2N target + - scsi: qla2xxx: Send Notify ACK after N2N PLOGI + - scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI + - scsi: iscsi: qla4xxx: fix double free in probe + - scsi: libsas: stop discovering if oob mode is disconnected + (CVE-2019-19965) + - drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit + - usb: gadget: fix wrong endpoint desc + - net: make socket read/write_iter() honor IOCB_NOWAIT + - afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP + - md: raid1: check rdev before reference in raid1_sync_request func + - [s390x] cpum_sf: Adjust sampling interval to avoid hitting sample limits + - [s390x] cpum_sf: Avoid SBD overflow condition in irq handler + - IB/mlx4: Follow mirror sequence of device add during device removal + - IB/mlx5: Fix steering rule of drop and count + - xen-blkback: prevent premature module unload + - xen/balloon: fix ballooned page accounting without hotplug enabled + - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation + - ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker + - ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC + - ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen + - xfs: fix mount failure crash on invalid iclog memory access + - taskstats: fix data-race + - drm: limit to INT_MAX in create_blob ioctl + - netfilter: nft_tproxy: Fix port selector on Big Endian + - ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code + - ALSA: usb-audio: fix set_format altsetting sanity check + - ALSA: usb-audio: set the interface format after resume on Dell WD19 + - ALSA: hda/realtek - Add headset Mic no shutup for ALC283 + - [arm64,armhf] drm/sun4i: hdmi: Remove duplicate cleanup calls + - [mips*] Avoid VDSO ABI breakage due to global register variable + - media: pulse8-cec: fix lost cec_transmit_attempt_done() call + - media: cec: CEC 2.0-only bcast messages were ignored + - media: cec: avoid decrementing transmit_queue_sz if it is 0 + - media: cec: check 'transmit_in_progress', not 'transmitting' + - mm/zsmalloc.c: fix the migrated zspage statistics. + - memcg: account security cred as well to kmemcg + - mm: move_pages: return valid node id in status if the page is already on + the target node + - [x86,arm64] pstore/ram: Write new dumps to start of recycled zones + - locks: print unsigned ino in /proc/locks + - compat_ioctl: block: handle Persistent Reservations + - compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE + - ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() + - libata: Fix retrieving of active qcs + - gpiolib: fix up emulated open drain outputs + - tracing: Fix lock inversion in trace_event_enable_tgid_record() + - tracing: Avoid memory leak in process_system_preds() + - tracing: Have the histogram compare functions convert to u64 first + - tracing: Fix endianness bug in histogram trigger + - apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock + - [i386] ALSA: cs4236: fix error return comparison of an unsigned integer + - ALSA: firewire-motu: Correct a typo in the clock proc string + - exit: panic before exit_mm() on global init exit + - [arm64] Revert support for execute-only user mappings + - ftrace: Avoid potential division by zero in function profiler + - [arm64] drm/msm: include linux/sched/task.h + - PM / devfreq: Check NULL governor in available_governors_show + - nfsd4: fix up replay_matches_cache() + - [x86,arm64] HID: i2c-hid: Reset ALPS touchpads on resume + - ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 + - xfs: don't check for AG deadlock for realtime files in bunmapi + - [x86] platform/x86: pmc_atom: Add Siemens CONNECT X300 to + critclk_systems DMI table + - Bluetooth: btusb: fix PM leak in error case of setup + - Bluetooth: delete a stray unlock + - Bluetooth: Fix memory leak in hci_connect_le_scan + - media: flexcop-usb: ensure -EIO is returned on error condition + - media: usb: fix memory leak in af9005_identify_state (CVE-2019-18809) + - [arm64] dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed + warning + - [arm64] tty: serial: msm_serial: Fix lockup for sysrq and oops + - fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP + - bdev: Factor out bdev revalidation into a common helper + - bdev: Refresh bdev size for disks without partitioning + - scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails + - drm/mst: Fix MST sideband up-reply failure handling + - [ppc64el] pseries/hvconsole: Fix stack overread via udbg + - [ppc64el] KVM: PPC: Book3S HV: use smp_mb() when setting/clearing + host_ipi flag + - rxrpc: Fix possible NULL pointer access in ICMP handling + - tcp: annotate tp->rcv_nxt lockless reads + - net: core: limit nested device depth + - ath9k_htc: Modify byte order for an error message + - ath9k_htc: Discard undersized packets + - xfs: periodically yield scrub threads to the scheduler + - net: add annotations on hh->hh_len lockless accesses + - ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps + - [s390x] smp: fix physical to logical CPU map for SMT + - xen/blkback: Avoid unmapping unmapped grant pages + - [x86] perf/x86/intel/bts: Fix the use of page_private() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.95 + - bpf: Fix passing modified ctx to ld/abs/ind instruction + - regulator: fix use after free issue + - ASoC: max98090: fix possible race conditions + - netfilter: ctnetlink: netns exit must wait for callbacks + - mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() + (CVE-2019-14901) + - [x86] efi: Update e820 with reserved EFI boot services data to fix kexec + breakage + - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 + - efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs + - efi/gop: Return EFI_SUCCESS if a usable GOP was found + - efi/gop: Fix memory leak in __gop_query32/64() + - netfilter: uapi: Avoid undefined left-shift in xt_sctp.h + - netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in + named sets + - netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END + - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() + - [arm64] spi: spi-cavium-thunderx: Add missing pci_release_regions() + - ASoC: topology: Check return value for soc_tplg_pcm_create() + - bnxt_en: Return error if FW returns more data than dump length + - [mips*] bpf, mips: Limit to 33 tail calls + - [armhf] spi: spi-ti-qspi: Fix a bug when accessing non default CS + - [powerpc*] Ensure that swiotlb buffer is allocated from low memory + - btrfs: Fix error messages in qgroup_rescan_init + - bpf: Clear skb->tstamp in bpf_redirect when necessary + - bnx2x: Do not handle requests from VFs after parity + - bnx2x: Fix logic to get total no. of PFs per engine + - cxgb4: Fix kernel panic while accessing sge_info + - net: usb: lan78xx: Fix error message format specifier + - rfkill: Fix incorrect check to avoid NULL pointer dereference + - iommu/iova: Init the struct iova to fix the possible memleak + - [x86] perf/x86/intel: Fix PT PMI handling + - fs: avoid softlockups in s_inodes iterators + - [arm64,armhf] net: stmmac: Do not accept invalid MTU values + - [arm64,armhf] net: stmmac: xgmac: Clear previous RX buffer size + - [arm64,armhf] net: stmmac: RX buffer size must be 16 byte aligned + - [arm64,armhf] net: stmmac: Always arm TX Timer at end of transmission + start + - [s390x] dasd/cio: Interpret ccw_device_get_mdc return value correctly + - [s390x] dasd: fix memleak in path handling error case + - block: fix memleak when __blk_rq_map_user_iov() is failed + - llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and + _test_c) + - [x86] hv_netvsc: Fix unwanted rx_table reset + - [powerpc*] vcpu: Assume dedicated processors as non-preempt + - [powerpc*] spinlocks: Include correct header for static key + - [armhf] cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull + - gtp: fix bad unlock balance in gtp_encap_enable_socket + - macvlan: do not assume mac_header is set in macvlan_broadcast() + - [arm64,armhf] net: dsa: mv88e6xxx: Preserve priority when setting CPU + port. + - [arm64,armhf] net: stmmac: dwmac-sun8i: Allow all RGMII modes + - [arm64,armhf] net: stmmac: dwmac-sunxi: Allow all RGMII modes + - net: usb: lan78xx: fix possible skb leak + - pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM + - sch_cake: avoid possible divide by zero in cake_enqueue() + - sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY + - tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK + - vxlan: fix tos value before xmit + - vlan: fix memory leak in vlan_dev_set_egress_priority + - vlan: vlan_changelink() should propagate errors + - net: sch_prio: When ungrafting, replace with FIFO + - [arm64,armhf] usb: dwc3: gadget: Fix request complete check + - USB: core: fix check for duplicate endpoints + - USB: serial: option: add Telit ME910G1 0x110a composition + - usb: missing parentheses in USE_NEW_SCHEME + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.96 + - chardev: Avoid potential use-after-free in 'chrdev_open()' + - i2c: fix bus recovery stop mode timing + - [arm64,armhf] usb: chipidea: host: Disable port power only if previously + enabled + - ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5 + - ALSA: hda/realtek - Add new codec supported for ALCS1200A + - ALSA: hda/realtek - Set EAPD control to default for ALC222 + - [x86] ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga + X1 7th gen + - kernel/trace: Fix do not unregister tracepoints when register + sched_migrate_task fail + - tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined + - tracing: Change offset type to s32 in preempt/irq tracepoints + - HID: Fix slab-out-of-bounds read in hid_field_extract + - HID: uhid: Fix returning EPOLLOUT from uhid_char_poll + - HID: hid-input: clear unmapped usages + - Input: add safety guards to input_set_keycode() + - [arm64,armhf] drm/sun4i: tcon: Set RGB DCLK min. divider based on + hardware model + - drm/fb-helper: Round up bits_per_pixel if possible + - drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ + - can: kvaser_usb: fix interface sanity check + - can: gs_usb: gs_usb_probe(): use descriptors of current altsetting + - can: can_dropped_invalid_skb(): ensure an initialized headroom in + outgoing CAN sk_buffs + - gpiolib: acpi: Turn dmi_system_id table into a generic quirk table + - gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism + - [x86] staging: vt6656: set usb_set_intfdata on driver fail. + - USB: serial: option: add ZLP support for 0x1bc7/0x9010 + - [arm64,armhf] usb: musb: fix idling for suspend after disconnect + interrupt + - [arm64,armhf] usb: musb: Disable pullup at init + - [arm64,armhf] usb: musb: dma: Correct parameter passed to IRQ handler + - [x86] staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713 + - staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 + - serdev: Don't claim unsupported ACPI serial devices + - tty: link tty and port before configuring it as console + - tty: always relink the port + - mwifiex: fix possible heap overflow in mwifiex_process_country_ie() + (CVE-2019-14895) + - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf + (CVE-2019-19056) + - scsi: bfa: release allocated memory in case of error (CVE-2019-19066) + - rtl8xxxu: prevent leaking urb (CVE-2019-19068) + - ath10k: fix memory leak (CVE-2019-19078) + - HID: hiddev: fix mess in hiddev_open() + - USB: Fix: Don't skip endpoint descriptors with maxpacket=0 + - netfilter: arp_tables: init netns pointer in xt_tgchk_param struct + - netfilter: conntrack: dccp, sctp: handle null timeout argument + - netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present + - [x86] drm/i915/gen9: Clear residual context state on context switch + (CVE-2019-14615) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.97 + - hidraw: Return EPOLLOUT from hidraw_poll + - HID: hidraw: Fix returning EPOLLOUT from hidraw_poll + - HID: hidraw, uhid: Always report EPOLLOUT + - cfg80211/mac80211: make ieee80211_send_layer2_update a public function + - mac80211: Do not send Layer 2 Update frame before authorization + (CVE-2019-5108) + - f2fs: Move err variable to function scope in f2fs_fill_dentries() + - f2fs: check memory boundary by insane namelen + - f2fs: check if file namelen exceeds max value (CVE-2019-9445) + - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in + zr364xx_vidioc_querycap (CVE-2019-15217) + - iwlwifi: dbg_ini: fix memory leak in alloc_sgtable (CVE-2019-19058) + - iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init + (CVE-2019-19059) + - RDMA: Fix goto target to release the allocated memory (CVE-2019-19077) + - dccp: Fix memleak in __feat_register_sp (CVE-2019-20096) + - [x86] drm/i915: Fix use-after-free when destroying GEM context + - ASoC: soc-core: Set dpcm_playback / dpcm_capture + - [armhf] mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy + - [arm64] gpio: zynq: Fix for bug in zynq_gpio_restore_context API + - iommu: Remove device link to group on failure + - gpio: Fix error message on out-of-range GPIO in lookup table + - [s390x] qeth: fix false reporting of VNIC CHAR config failure + - [s390x] qeth: Fix vnicc_is_in_use if rx_bcast not set + - cifs: Adjust indentation in smb2_open_file + - afs: Fix missing cell comparison in afs_test_super() + - drm/ttm: fix start page for huge page check in ttm_put_pages() + (CVE-2019-19927) + - drm/ttm: fix incrementing the page pointer for huge pages + (CVE-2019-19927) + - btrfs: simplify inode locking for RWF_NOWAIT + - RDMA/mlx5: Return proper error value + - RDMA/srpt: Report the SCSI residual to the initiator + - scsi: enclosure: Fix stale device oops with hot replug + - scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI + - [x86] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 + - [x86] platform/x86: GPD pocket fan: Use default values when wrong + modparams are given + - xprtrdma: Fix completion wait during device removal + - crypto: virtio - implement missing support for output IVs + - NFSv2: Fix a typo in encode_sattr() + - NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for + layoutreturn + - mei: fix modalias documentation + - [armhf] clk: samsung: exynos5420: Preserve CPU clocks configuration + during suspend/resume + - [armhf] pinctl: ti: iodelay: fix error checking on + pinctrl_count_index_with_args call + - [x86] pinctrl: lewisburg: Update pin list according to v1.1v6 + - scsi: sd: enable compat ioctls for sed-opal + - af_unix: add compat_ioctl support + - compat_ioctl: handle SIOCOUTQNSD + - [arm64,armhf] PCI: dwc: Fix find_next_bit() usage + - PCI/PTM: Remove spurious "d" from granularity message + - [powerpc*] powernv: Disable native PCIe port management + - [armhf] tty: serial: imx: use the sg count from dma_map_sg + - [i386] tty: serial: pch_uart: correct usage of dma_unmap_sg + - mtd: spi-nor: fix silent truncation in spi_nor_read() + - mtd: spi-nor: fix silent truncation in spi_nor_read_raw() + - rtlwifi: Remove unnecessary NULL check in rtl_regd_init + - f2fs: fix potential overflow + - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() + - [mips*] cacheinfo: report shared CPU map + - [arm64] drm/arm/mali: make malidp_mw_connector_helper_funcs static + - [arm64] dmaengine: k3dma: Avoid null pointer traversal + - [amd64] ioat: ioat_alloc_ring() failure handling. + - ocfs2: call journal flush to mark journal as empty after journal + recovery when mount + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.98 + - clk: Don't try to enable critical clocks if prepare failed + - iio: buffer: align the size of scan bytes to size of the largest element + - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx + - USB: serial: option: Add support for Quectel RM500Q + - USB: serial: opticon: fix control-message timeouts + - USB: serial: option: add support for Quectel RM500Q in QDL mode + - USB: serial: suppress driver bind attributes + - USB: serial: ch341: handle unbound port at reset_resume + - USB: serial: io_edgeport: handle unbound ports on URB completion + - USB: serial: io_edgeport: add missing active-port sanity check + - USB: serial: keyspan: handle unbound ports + - USB: serial: quatech2: handle unbound ports + - [x86] scsi: fnic: fix invalid stack access + - scsi: mptfusion: Fix double fetch bug in ioctl + - [armhf] dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection + - ALSA: dice: fix fallback from protocol extension into limited + functionality + - ALSA: seq: Fix racy access for queue timer in proc read + - ALSA: usb-audio: fix sync-ep altsetting sanity check + - [arm64] dts: allwinner: a64: olinuxino: Fix SDIO supply regulator + - block: fix an integer overflow in logical block size + - [armhf] dts: am571x-idk: Fix gpios property to have the correct gpio + number + - LSM: generalize flag passing to security_capable + - ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() + - usb: core: hub: Improved device recognition on remote wakeup + - [x86] resctrl: Fix an imbalance in domain_remove_cpu() + - [x86] CPU/AMD: Ensure clearing of SME/SEV features is maintained + - [amd64] x86/efistub: Disable paging at mixed mode entry + - [x86] resctrl: Fix potential memory leak + - perf hists: Fix variable name's inconsistency in hists__for_each() macro + - perf report: Fix incorrectly added dimensions as switch perf data file + - mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD + alignment + - mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is + valid + - btrfs: rework arguments of btrfs_unlink_subvol + - btrfs: fix invalid removal of root ref + - btrfs: do not delete mismatched root refs + - btrfs: fix memory leak in qgroup accounting + - mm/page-writeback.c: avoid potential division by zero in + wb_min_max_ratio() + - [armhf] dts: imx6qdl: Add Engicam i.Core 1.5 MX6 + - [armhf] dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL + - [arm64,armhf] net: stmmac: 16KB buffer must be 16 byte aligned + - [arm64,armhf] net: stmmac: Enable 16KB buffer size + - mm/huge_memory.c: make __thp_get_unmapped_area static + - mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD + alignment + - bpf: Fix incorrect verifier simulation of ARSH under ALU32 + - cfg80211: fix deadlocks in autodisconnect work + - cfg80211: fix memory leak in cfg80211_cqm_rssi_update + - cfg80211: fix page refcount issue in A-MSDU decap + - netfilter: fix a use-after-free in mtype_destroy() + - netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct + - netfilter: nft_tunnel: fix null-attribute check + - netfilter: nf_tables: remove WARN and add NLA_STRING upper limits + - netfilter: nf_tables: store transaction list locally while requesting + module + - netfilter: nf_tables: fix flowtable list del corruption + - NFC: pn533: fix bulk-message timeout + - batman-adv: Fix DAT candidate selection on little endian systems + - macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() + - [x86] hv_netvsc: Fix memory leak when removing rndis device + - [arm64] net: hns: fix soft lockup when there is not enough memory + - net: usb: lan78xx: limit size of local TSO packets + - ptp: free ptp device pin descriptors properly + - r8152: add missing endpoint sanity check + - tcp: fix marked lost packets not being retransmitted + - xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk + - tcp: refine rule to allow EPOLLOUT generation under mem pressure + - [arm64] dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node + - cfg80211: check for set_wiphy_params + - tick/sched: Annotate lockless access to last_jiffies_update + - drm/nouveau/bar/nv50: check bar1 vmm return value + - drm/nouveau/bar/gf100: ensure BAR is mapped + - drm/nouveau/mmu: qualify vmm during dtor + - reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr + - scsi: esas2r: unlock on error in esas2r_nvram_read_direct() + - scsi: qla4xxx: fix double free bug + - scsi: bnx2i: fix potential use after free + - scsi: target: core: Fix a pr_debug() argument + - scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI + - scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan + - scsi: core: scsi_trace: Use get_unaligned_be*() + - perf probe: Fix wrong address verification + + [ Joe Richey ] + * [cloud-amd64] tpm: Enable TPM drivers for Cloud (Closes: #946237) + + [ Salvatore Bonaccorso ] + * Refresh powerpc-fix-mcpu-options-for-spe-only-compiler.patch (Context + changes in 4.19.88) + * Drop 0027-RDMA-hns-Fix-the-bug-with-updating-rq-head-pointer-w.patch + * Drop 0028-RDMA-hns-Bugfix-for-the-scene-without-receiver-queue.patch + * [rt] Refresh 0199-net-move-xmit_recursion-to-per-task-variable-on-RT.patch + (Context changes in 4.19.88) + * [rt] Update to 4.19.90-rt35: + - Update "workqueue: rework" for workqueue changes in 4.19.90 + * [rt] Drop 0245-Revert-arm64-preempt-Fix-big-endian-when-checking-pr.patch + * Refresh 0013-scsi-hisi_sas-Relocate-some-codes-to-avoid-an-unused.patch + for context changes in 4.19.93. + * [rt] Refresh + 0253-watchdog-prevent-deferral-of-watchdogd-wakeup-on-RT.patch (Context + changes in 4.19.93) + * [rt] Refresh 0199-net-move-xmit_recursion-to-per-task-variable-on-RT.patch + (Context changes in 4.19.97) + + [ Ben Hutchings ] + * [rt] Update to 4.19.94-rt38: + - Refresh "x86/ioapic: Don't let setaffinity unmask threaded EOI interrupt + too early" which was partly included in 4.19.92 + * aufs: Update support patchset to aufs4.19.63+ 20200113; no functional + changes + * Bump ABI to 8 + * libertas: Fix two buffer overflows at parsing bss descriptor + (CVE-2019-14896, CVE-2019-14897) + * wimax: i2400: fix memory leak (CVE-2019-19051) + * wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle + (CVE-2019-19051) + * [amd64/cloud-amd64] hwrandom: Enable HW_RANDOM_VIRTIO (Closes: #914511) + + [ Noah Meyerhans ] + * random: try to actively add entropy rather than passively wait for it + (Closes: #948519) + + [ Aurelien Jarno ] + * [mips*/malta] Enable POWER_RESET_PIIX4_POWEROFF. + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 26 Jan 2020 21:01:13 +0100 + +linux (4.19.87-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.68 + - seq_file: fix problem when seeking mid-record + - mm/hmm: fix bad subpage pointer in try_to_unmap_one + - mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and + MPOL_MF_STRICT were specified + - mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind + - mm/memcontrol.c: fix use after free in mem_cgroup_iter() + - mm/usercopy: use memory range to be accessed for wraparound check + - Revert "pwm: Set class for exported channels in sysfs" + - cpufreq: schedutil: Don't skip freq update when limits change + - [x86] ALSA: hda/realtek - Add quirk for HP Envy x360 + - ALSA: hda - Apply workaround for another AMD chip 1022:1487 + - ALSA: hda - Fix a memory leak bug + - ALSA: hda - Add a generic reboot_notify + - ALSA: hda - Let all conexant codec enter D3 when rebooting + - HID: holtek: test for sanity of intfdata + - HID: hiddev: avoid opening a disconnected device + - HID: hiddev: do cleanup in failure of opening a device + - Input: kbtab - sanity check for endpoint type + - Input: iforce - add sanity checks + - net: usb: pegasus: fix improper read if get_registers() fail + - netfilter: ebtables: also count base chain policies + - xen/pciback: remove set but not used variable 'old_state' + - [armhf,arm64] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe + table fail + - perf header: Fix divide by zero error if f_header.attr_size==0 + - perf header: Fix use of unitialized value warning + - libata: zpodd: Fix small read overflow in zpodd_get_mech_type() + - Btrfs: fix deadlock between fiemap and transaction commits + - scsi: hpsa: correct scsi command status issue after reset + - scsi: qla2xxx: Fix possible fcport null-pointer dereferences + - drm/amdgpu: fix a potential information leaking bug + - ata: libahci: do not complain in case of deferred probe + - kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules + - [arm64] efi: fix variable 'si' set but not used + - [arm64] unwind: Prohibit probing on return_address() + - [arm64] mm: fix variable 'pud' set but not used + - IB/core: Add mitigation for Spectre V1 + - IB/mlx5: Fix MR registration flow to use UMR properly + - IB/mad: Fix use-after-free in ib mad completion handling + - [arm64] drm: msm: Fix add_gpu_components + - [armhf] drm/exynos: fix missing decrement of retry counter + - ocfs2: remove set but not used variable 'last_hash' + - asm-generic: fix -Wtype-limits compiler warnings + - [arm64] KVM: regmap: Fix unexpected switch fall-through + - [armhf,arm64] KVM: Sync ICH_VMCR_EL2 back when about to block + - [x86] staging: comedi: dt3000: Fix signed integer overflow 'divider * + base' + - [x86] staging: comedi: dt3000: Fix rounding up of timer divisor + - USB: core: Fix races in character device registration and deregistraion + - usb: cdc-acm: make sure a refcount is taken early enough + - USB: CDC: fix sanity checks in CDC union parser + - USB: serial: option: add D-Link DWM-222 device ID + - USB: serial: option: Add support for ZTE MF871A + - USB: serial: option: add the BroadMobi BM818 card + - USB: serial: option: Add Motorola modem UARTs + - [x86] drm/i915/cfl: Add a new CFL PCI ID. + - [arm64] ftrace: Ensure module ftrace trampoline is coherent with I-side + - Input: psmouse - fix build error of multiple definition + - bnx2x: Fix VF's VLAN reconfiguration in reload. + - bonding: Add vlan tx offload to hw_enc_features + - net: dsa: Check existence of .port_mdb_add callback before calling it + - net/mlx4_en: fix a memory leak bug + - net/packet: fix race in tpacket_snd() + - sctp: fix memleak in sctp_send_reset_streams + - sctp: fix the transport error_count check + - team: Add vlan tx offload to hw_enc_features + - tipc: initialise addr_trail_end when setting node addresses + - xen/netback: Reset nr_frags before freeing skb + - net/mlx5e: Only support tx/rx pause setting for port owner + - net/mlx5e: Use flow keys dissector to parse packets for ARFS + - [arm64] mmc: sdhci-of-arasan: Do now show error message in case of + deffered probe + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.69 + - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT + - [mips*] kernel: only use i8253 clocksource with periodic clockevent + - [mips*] fix cacheinfo + - netfilter: ebtables: fix a memory leak bug in compat + - ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks + - bonding: Force slave speed check after link state recovery for 802.3ad + - [armhf,arm64] net: mvpp2: Don't check for 3 consecutive Idle frames for + 10G links + - can: dev: call netif_carrier_off() in register_candev() + - can: gw: Fix error path of cgw_module_init + - [armhf,arm64] ASoC: rockchip: Fix mono capture + - [armhf] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint + - net: usb: qmi_wwan: Add the BroadMobi BM818 card + - qed: RDMA - Fix the hw_ver returned in device attributes + - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in + start_isoc_chain() + - mac80211_hwsim: Fix possible null-pointer dereferences in + hwsim_dump_radio_nl() + - netfilter: ipset: Actually allow destination MAC address for hash:ip,mac + sets too + - netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and + hash:ip,mac sets + - netfilter: ipset: Fix rename concurrency with listing + - rxrpc: Fix potential deadlock + - rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet + - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the + stack + - net: phy: phy_led_triggers: Fix a possible null-pointer dereference in + phy_led_trigger_change_speed() + - can: sja1000: force the string buffer NULL-terminated + - can: peak_usb: force the string buffer NULL-terminated + - net/ethernet/qlogic/qed: force the string buffer NULL-terminated + - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() + - NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts + - HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 + - HID: input: fix a4tech horizontal wheel custom usage + - [armhf,arm64] drm/rockchip: Suspend DP late + - SMB3: Fix potential memory leak when processing compound chain + - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL + - [s390x] put _stext and _etext into .text section + - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' + - [armhf,arm64] net: stmmac: Fix issues when number of Queues >= 4 + - [armhf,arm64] net: stmmac: tc: Do not return a fragment entry + - [arm64] net: hisilicon: make hip04_tx_reclaim non-reentrant + - [arm64] net: hisilicon: fix hip04-xmit never return TX_BUSY + - [arm64] net: hisilicon: Fix dma_map_single failed on arm64 + - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests + - libata: add SG safety checks in SFF pio transfers + - [x86] lib/cpu: Address missing prototypes warning + - [x86] drm/vmwgfx: fix memory leak when too many retries have occurred + - block, bfq: handle NULL return value by bfq_init_rq() + - perf ftrace: Fix failure to set cpumask when only one cpu is present + - perf cpumap: Fix writing to illegal memory in handling cpumap mask + - perf pmu-events: Fix missing "cpu_clk_unhalted.core" event + - [arm64] KVM: Don't write junk to sysregs on reset + - [armhf] KVM: Don't write junk to CP15 registers on reset + - HID: wacom: correct misreported EKR ring values + - HID: wacom: Correct distance scale for 2nd-gen Intuos devices + - Revert "dm bufio: fix deadlock with loop device" (regression in 4.19.61) + - ceph: clear page dirty before invalidate page + - ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply + - libceph: fix PG split vs OSD (re)connect race + - drm/nouveau: Don't retry infinitely when receiving no data on i2c over + AUX + - gpiolib: never report open-drain/source lines as 'input' to user-space + - [x86] Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE + - userfaultfd_release: always remove uffd flags and clear + vm_userfaultfd_ctx + - [i386] retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 + - [x86] apic: Handle missing global clockevent gracefully + - [x86] CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h + - [x86] boot: Save fields explicitly, zero out everything else + - [x86] boot: Fix boot regression caused by bootparam sanitizing + - dm kcopyd: always complete failed jobs + - dm btree: fix order of block initialization in btree_split_beneath + - dm integrity: fix a crash due to BUG_ON in __journal_read_write() + - dm raid: add missing cleanup in raid_ctr() + - dm space map metadata: fix missing store of apply_bops() return value + - dm table: fix invalid memory accesses with too high sector number + - dm zoned: improve error handling in reclaim + - dm zoned: improve error handling in i/o map code + - dm zoned: properly handle backing device failure + - genirq: Properly pair kobject_del() with kobject_add() + - mm, page_owner: handle THP splits correctly + - mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely + - mm/zsmalloc.c: fix race condition in zs_destroy_pool + - xfs: don't trip over uninitialized buffer on extent read of corrupted + inode + - xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h + - xfs: Add helper function xfs_attr_try_sf_addname + - xfs: Add attibute set and helper functions + - xfs: Add attibute remove and helper functions + - xfs: always rejoin held resources during defer roll + - dm zoned: fix potential NULL dereference in dmz_do_reclaim() + - [ppc64el] Allow flush_(inval_)dcache_range to work across ranges >4GB + - rxrpc: Fix local endpoint refcounting + - rxrpc: Fix read-after-free in rxrpc_queue_local() + - rxrpc: Fix local endpoint replacement + - rxrpc: Fix local refcounting + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.70 + - nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns + - afs: Fix the CB.ProbeUuid service handler to reply correctly + - afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u() + - fs: afs: Fix a possible null-pointer dereference in afs_put_read() + - afs: Only update d_fsdata if different in afs_d_revalidate() + - nvmet-loop: Flush nvme_delete_wq when removing the port + - nvme: fix a possible deadlock when passthru commands sent to a multipath + device + - nvme-pci: Fix async probe remove race + - [armhf] omap-dma/omap_vout_vrfb: fix off-by-one fi value + - iommu/dma: Handle SG length overflow better + - usb: gadget: composite: Clear "suspended" on reset/disconnect + - usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt + - xen/blkback: fix memory leaks + - [arm64] cpufeature: Don't treat granule sizes as strict + - drm/ast: Fixed reboot test may cause system hanged + - [x86] tools: hv: fix KVP and VSS daemons exit code + - [x86] drm/i915: fix broadwell EU computation + - [arm*] watchdog: bcm2835_wdt: Fix module autoload + - scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value + - [armhf] drm/tilcdc: Register cpufreq notifier after we have initialized + crtc + - ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set + - ipv6: Default fib6_type to RTN_UNICAST when not set + - net/smc: make sure EPOLLOUT is raised + - tcp: make sure EPOLLOUT wont be missed + - ipv4/icmp: fix rt dst dev null pointer dereference + - mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n + - ALSA: usb-audio: Check mixer unit bitmap yet more strictly + - ALSA: line6: Fix memory leak at line6_init_pcm() error path + - ALSA: hda - Fixes inverted Conexant GPIO mic mute led + - ALSA: seq: Fix potential concurrent access to the deleted pool + - ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() + - ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604 + - [x86] kvm: skip populating logical dest map if apic is not sw enabled + - [x86] KVM: Don't update RIP or do single-step on faulting emulation + - [amd64] uprobes: Fix detection of 32-bit user mode + - [x86] apic: Do not initialize LDR and DFR for bigsmp + - ftrace: Fix NULL pointer dereference in t_probe_next() + - ftrace: Check for successful allocation of hash + - ftrace: Check for empty hash and comment the race with registering probes + - usb-storage: Add new JMS567 revision to unusual_devs + - USB: cdc-wdm: fix race between write and disconnect due to flag abuse + - usb: hcd: use managed device resources + - [armhf,arm64] usb: chipidea: udc: don't do hardware access if gadget has + stopped + - usb: host: ohci: fix a race condition between shutdown and irq + - usb: host: xhci: rcar: Fix typo in compatible string matching + - USB: storage: ums-realtek: Update module parameter description for + auto_delink_en + - USB: storage: ums-realtek: Whitelist auto-delink support + - [x86] mei: me: add Tiger Lake point LP device ID + - mmc: core: Fix init of SD cards reporting an invalid VDD range + - stm class: Fix a double free of stm_source_device + - [x86] intel_th: pci: Add support for another Lewisburg PCH + - [x86] intel_th: pci: Add Tiger Lake support + - [x86] typec: tcpm: fix a typo in the comparison of pdo_max_voltage + - lib: logic_pio: Fix RCU usage + - lib: logic_pio: Avoid possible overlap for unregistering regions + - lib: logic_pio: Add logic_pio_unregister_range() + - [x86] drm/amdgpu: Add APTX quirk for Dell Latitude 5495 + - [x86] drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest + - [x86] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() + - [arm64] bus: hisi_lpc: Unregister logical PIO range to avoid potential + use-after-free + - [arm64] bus: hisi_lpc: Add .remove method to avoid driver unbind crash + - [x86] VMCI: Release resource if the work is already queued + - [x86] crypto: ccp - Ignore unconfigured CCP device on suspend/resume + - Revert "cfg80211: fix processing world regdomain when non modular" + - mac80211: fix possible sta leak + - mac80211: Don't memset RXCB prior to PAE intercept + - mac80211: Correctly set noencrypt for PAE frames + - [ppc64el] KVM: Book3S: Fix incorrect guest-to-user-translation error + handling + - [armhf,arm64] KVM: vgic: Fix potential deadlock when ap_list is long + - [armhf,arm64] KVM: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI + - NFS: Clean up list moves of struct nfs_page + - NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() + - NFS: Pass error information to the pgio error cleanup routine + - NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 + - [x86] i2c: piix4: Fix port selection for AMD Family 16h Model 30h + - mt76: mt76x0u: do not reset radio on resume + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.71 + - Revert "Input: elantech - enable SMBus on new (2018+) systems" + (regression in 4.19.67) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.72 + - mld: fix memory leak in mld_del_delrec() + - net: fix skb use after free in netpoll + - net: sched: act_sample: fix psample group handling on overwrite + - net_sched: fix a NULL pointer deref in ipt action + - [armhf,arm64] net: stmmac: dwmac-rk: Don't fail if phy regulator is + absent + - tcp: inherit timestamp on mtu probe + - tcp: remove empty skb from write queue in error cases + - net/rds: Fix info leak in rds6_inc_info_copy() (CVE-2019-16714) + - [x86] boot: Preserve boot_params.secure_boot from sanitizing + - [arm*] spi: bcm2835aux: unifying code between polling and interrupt + driven code + - [arm*] spi: bcm2835aux: remove dangerous uncontrolled read of fifo + - [arm*] spi: bcm2835aux: fix corruptions for longer spi transfers + - netfilter: nf_tables: use-after-free in failing rule with bound set + - [x86] hv_netvsc: Fix a warning of suspicious RCU usage + - Bluetooth: btqca: Add a short delay before downloading the NVM + - [ppc64el] ibmveth: Convert multicast list size for little-endian system + - gpio: Fix build error of function redefinition + - netfilter: nft_flow_offload: skip tcp rst and fin packets + - scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure + - scsi: target: tcmu: avoid use-after-free after command timeout + - cxgb4: fix a memory leak bug + - liquidio: add cleanup in octeon_setup_iq() + - net: myri10ge: fix memory leaks + - lan78xx: Fix memory leaks + - vfs: fix page locking deadlocks when deduping files + - cx82310_eth: fix a memory leak bug + - net: kalmia: fix memory leaks + - net: cavium: fix driver name + - wimax/i2400m: fix a memory leak bug + - kprobes: Fix potential deadlock in kprobe_optimizer() + - HID: cp2112: prevent sleeping function called from invalid context + - [amd64] boot/compressed: Fix boot on machines with broken E820 table + - [x86] Input: hyperv-keyboard: Use in-place iterator API in the channel + callback + - [x86] Tools: hv: kvp: eliminate 'may be used uninitialized' warning + - nvme-multipath: fix possible I/O hang when paths are updated + - IB/mlx4: Fix memory leaks + - infiniband: hfi1: fix a memory leak bug + - infiniband: hfi1: fix memory leaks + - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() + - ceph: fix buffer free while holding i_ceph_lock in + __ceph_build_xattrs_blob() + - ceph: fix buffer free while holding i_ceph_lock in fill_inode() + - [armhf,arm64] KVM: Only skip MMIO insn once + - afs: Fix leak in afs_lookup_cell_rcu() + - [armhf,arm64] KVM: VGIC: Properly initialise private IRQ affinity + - [amd64] boot/compressed: Fix missing initialization in + find_trampoline_placement() + - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.73 + - ALSA: hda - Fix potential endless loop at applying quirks + - ALSA: hda/realtek - Fix overridden device-specific initialization + - [x86] ALSA: hda/realtek - Add quirk for HP Pavilion 15 + - [x86] ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS + UX431FL + - [x86] ALSA: hda/realtek - Fix the problem of two front mics on a + ThinkCentre + - sched/fair: Don't assign runtime for throttled cfs_rq + - [x86] drm/vmwgfx: Fix double free in vmw_recv_msg() + - [ppc64el] tm: Fix FP/VMX unavailable exceptions inside a transaction + (CVE-2019-15030) + - batman-adv: fix uninit-value in batadv_netlink_get_ifindex() + - batman-adv: Only read OGM tvlv_len after buffer len check + - [x86] hv_sock: Fix hang when a connection is closed + - Blk-iolatency: warn on negative inflight IO counter + - blk-iolatency: fix STS_AGAIN handling + - {nl,mac}80211: fix interface combinations on crypto controlled devices + - timekeeping: Use proper ktime_add when adding nsecs in coarse offset + - selftests: fib_rule_tests: use pre-defined DEV_ADDR + - [x86] ftrace: Fix warning and considate ftrace_jmp_replace() and + ftrace_call_replace() + - [ppc64el] mark start_here_multiplatform as __ref + - [arm64] dts: rockchip: enable usb-host regulators at boot on + rk3328-rock64 + - nvme-fc: use separate work queue to avoid warning + - [armhf] clk: s2mps11: Add used attribute to s2mps11_dt_match + - [arm64] remoteproc: qcom: q6v5: shore up resource probe handling + - modules: always page-align module section allocations + - kernel/module: Fix mem leak in module_add_modinfo_attrs + - [x86] drm/i915: Re-apply "Perform link quality check, unconditionally + during long pulse" + - scsi: qla2xxx: Move log messages before issuing command to firmware + - keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h + - [x86] Drivers: hv: kvp: Fix two "this statement may fall through" + warnings + - [x86] hibernate: Fix nosave_regions setup for hibernation + - [arm64] remoteproc: qcom: q6v5-mss: add SCM probe dependency + - drm/amdgpu/gfx9: Update gfx9 golden settings. + - drm/amdgpu: Update gc_9_0 golden settings. + - [x86] KVM: hyperv: enforce vp_index < KVM_MAX_VCPUS + - [x86] KVM: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' + variables + - [x86] KVM: hyperv: keep track of mismatched VP indexes + - [x86] KVM: hyperv: define VP assist page helpers + - [x86] kvm/lapic: preserve gfn_to_hva_cache len on cache reinit + - [x86] drm/i915: Fix intel_dp_mst_best_encoder() + - [x86] drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE + - [x86] drm/i915/gen9+: Fix initial readout for Y tiled framebuffers + - drm/atomic_helper: Disallow new modesets on unregistered connectors + - [x86] Drivers: hv: kvp: Fix the recent regression caused by incorrect + clean-up + - powerplay: Respect units on max dcfclk watermark + - drm/amd/pp: Fix truncated clock value when set watermark + - drm/amd/dm: Understand why attaching path/tile properties are needed + - [s390x] zcrypt: reinit ap queue state machine during device probe + - [x86] drm/i915: Restore sane defaults for KMS on GEM error load + - [x86] drm/i915: Cleanup gt powerstate from gem + - [ppc64el] KVM: Book3S HV: Fix race between kvm_unmap_hva_range and MMU + mode switch + - Btrfs: clean up scrub is_dev_replace parameter + - Btrfs: fix deadlock with memory reclaim during scrub + - btrfs: Remove extent_io_ops::fill_delalloc + - btrfs: Fix error handling in btrfs_cleanup_ordered_extents + - scsi: megaraid_sas: Fix combined reply queue mode detection + - scsi: megaraid_sas: Add check for reset adapter bit + - scsi: megaraid_sas: Use 63-bit DMA addressing + - [ppc64el] pkeys: Fix handling of pkey state across fork() + - btrfs: volumes: Make sure no dev extent is beyond device boundary + - btrfs: Use real device structure to verify dev extent + - IB/uverbs: Fix OOPs upon device disassociation + - drm/vblank: Allow dynamic per-crtc max_vblank_count + - [x86] drm/i915/ilk: Fix warning when reading emon_status with no output + - tpm: Fix some name collisions with drivers/char/tpm.h + - bcache: replace hard coded number with BUCKET_GC_GEN_MAX + - bcache: treat stale && dirty keys as bad keys + - [x86] KVM: VMX: Compare only a single byte for VMCS' "launched" in + vCPU-run + - [armhf] iio: adc: exynos-adc: Add S5PV210 variant + - [armhf] iio: adc: exynos-adc: Use proper number of channels for + Exynos4x12 + - mt76: fix corrupted software generated tx CCMP PN + - drm/nouveau: Don't WARN_ON VCPI allocation failures + - iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules + - iwlwifi: add new card for 9260 series + - spi: spi-gpio: fix SPI_CS_HIGH capability + - [ppc64el] kvm: Save and restore host AMR/IAMR/UAMOR + - btrfs: scrub: pass fs_info to scrub_setup_ctx + - btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex + - btrfs: scrub: fix circular locking dependency warning + - btrfs: init csum_list before possible free + - [arm64] PCI: qcom: Fix error handling in runtime PM support + - [arm64] PCI: qcom: Don't deassert reset GPIO during probe + - CIFS: Fix error paths in writeback code + - CIFS: Fix leaking locked VFS cache pages in writeback retry + - [x86] drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC + set + - [x86] drm/i915: Sanity check mmap length against object size + - [x86] usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 + source-caps + - IB/mlx5: Reset access mask when looping inside page fault handler + - kvm: mmu: Fix overflow on kvm mmu page limit calculation + - [x86] kvm: move kvm_load/put_guest_xcr0 into atomic context + - [x86] KVM: Always use 32-bit SMRAM save state for 32-bit kernels + - cifs: Fix lease buffer length error (CVE-2019-15918) + - ext4: protect journal inode's blocks using block_validity + - [x86] PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary + - dm mpath: fix missing call of path selector type->end_io + - blk-mq: free hw queue's resource in hctx's release handler + - mmc: sdhci-pci: Add support for Intel CML + - PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code + - cifs: smbd: take an array of reqeusts when sending upper layer data + - dm crypt: move detailed message into debug level + - [x86] drm/amdkfd: Add missing Polaris10 ID + - kvm: Check irqchip mode before assign irqfd + - drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2) + - drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc + - Btrfs: fix race between block group removal and block group allocation + - cifs: add spinlock for the openFileList to cifsInodeInfo + - [arm64] clk: tegra: Fix maximum audio sync clock for Tegra124/210 + - [arm64] clk: tegra210: Fix default rates for HDA clocks + - IB/hfi1: Avoid hardlockup with flushlist_lock + - apparmor: reset pos on failure to unpack for various functions + - scsi: target/core: Use the SECTOR_SHIFT constant + - scsi: target/iblock: Fix overrun in WRITE SAME emulation + - [s390x] scsi: zfcp: fix request object use-after-free in send path + causing wrong traces + - cifs: Properly handle auto disabling of serverino option + - [x86] ALSA: hda - Don't resume forcibly i915 HDMI/DP codec + - [x86] KVM: optimize check for valid PAT value + - [x86] KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad + value + - [x86] KVM: VMX: Fix handling of #MC that occurs during VM-Entry + - [x86] KVM: VMX: check CPUID before allowing read/write of IA32_XSS + - [ppc64el] KVM: Use ccr field in pt_regs struct embedded in vcpu struct + - [ppc64el] KVM: Book3S HV: Fix CR0 setting in TM emulation + - RDMA/srp: Document srp_parse_in() arguments + - RDMA/srp: Accept again source addresses that do not have a port number + - btrfs: correctly validate compression type + - resource: Include resource end in walk_*() interfaces + - resource: Fix find_next_iomem_res() iteration issue + - resource: fix locking in find_next_iomem_res() + - pstore: Fix double-free in pstore_mkfile() failure path + - dm thin metadata: check if in fail_io mode when setting needs_check + - [armhf,arm64] drm/panel: Add support for Armadeus ST0700 Adapt + - [x86] ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips + - [ppc64el] mm: Limit rma_size to 1TB when running without HV mode + - iommu/iova: Remove stale cached32_node + - gpio: don't WARN() on NULL descs if gpiolib is disabled + - mm/migrate.c: initialize pud_entry in migrate_vma() + - NFSv4: Fix delegation state recovery + - bcache: only clear BTREE_NODE_dirty bit when it is set + - bcache: add comments for mutex_lock(&b->write_lock) + - bcache: fix race in btree_flush_write() + - [x86] drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV + - [s390x] virtio: fix race on airq_areas[] + - drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors + - ext4: don't perform block validity checks on the journal inode + - ext4: fix block validity checks for journal inodes using indirect blocks + - ext4: unsigned int compared against zero + - [x86] PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround + - [ppc64el] tm: Remove msr_tm_active() + - [ppc64el] tm: Fix restoring FP/VMX facility incorrectly on interrupts + (CVE-2019-15031) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.74 + - bridge/mdb: remove wrong use of NLM_F_MULTI + - cdc_ether: fix rndis support for Mediatek based smartphones + - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' + - isdn/capi: check message length in capi_write() + - net: Fix null de-reference of device refcount + - net: gso: Fix skb_segment splat when splitting gso_size mangled skb + having linear-headed frag_list + - net: phylink: Fix flow control resolution + - net: sched: fix reordering issues + - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero + - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' + - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike + - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR + - tipc: add NULL pointer check before calling kfree_rcu + - tun: fix use-after-free when register netdev failed + - gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and + blacklist + - gpio: fix line flag validation in linehandle_create + - Btrfs: fix assertion failure during fsync and use of stale transaction + - ixgbe: Prevent u8 wrapping of ITR value to something less than 10us + - genirq: Prevent NULL pointer dereference in resend_irqs() + - [s390x] KVM: kvm_s390_vm_start_migration: check dirty_bitmap before using + it as target for memset() + - [s390x] KVM: Do not leak kernel stack data in the KVM_S390_INTERRUPT + ioctl + - [x86] KVM: work around leak of uninitialized stack contents + - [x86] KVM: nVMX: handle page fault in vmread + - [x86] purgatory: Change compiler flags from -mcmodel=kernel to + -mcmodel=large to fix kexec relocation errors + - [ppc64el] Add barrier_nospec to raw_copy_in_user() + - [arm64] drm/meson: Add support for XBGR8888 & ABGR8888 formats + - [armhf,arm64] clk: rockchip: Don't yell about bad mmc phases when getting + - PCI: Always allow probing with driver_override + - gpio: fix line flag validation in lineevent_create + - ubifs: Correctly use tnc_next() in search_dh_cookie() + - driver core: Fix use-after-free and double free on glue directory + - firmware: ti_sci: Always request response from firmware + - [x86] drm: panel-orientation-quirks: Add extra quirk table entry for + GPD MicroPC + - Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" + - modules: fix BUG when load module with rodata=n + - rsi: fix a double free bug in rsi_91x_deinit() (CVE-2019-15504) + - nvmem: Use the same permissions for eeprom as for nvmem + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.75 + - netfilter: nf_flow_table: set default timeout after successful insertion + - HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report + - RDMA/restrack: Release task struct which was hold by CM_ID object + - [x86] Input: elan_i2c - remove Lenovo Legion Y7000 PnpID + - [ppc64el] mm/radix: Use the right page size for vmemmap mapping + - USB: usbcore: Fix slab-out-of-bounds bug during device reset + - media: tm6000: double free if usb disconnect while streaming + - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit + - udp: correct reuseport selection with connected sockets + - xen-netfront: do not assume sk_buff_head list is empty in error handling + - net_sched: let qdisc_put() accept NULL pointer + - mwifiex: Fix three heap overflow at parsing element in + cfg80211_ap_settings (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816) + - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds + - ieee802154: hwsim: Fix error handle path in hwsim_init_module + - ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails + - [armhf] dts: am57xx: Disable voltage switching for SD card + - [armhf] OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss + - [armhf] bus: ti-sysc: Fix using configured sysc mask value + - [s390x] bpf: fix lcgr instruction encoding + - [armhf] OMAP2+: Fix omap4 errata warning on other SoCs + - [armhf] dts: dra74x: Fix iodelay configuration for mmc3 + - [armhf] bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() + - [s390x] bpf: use 32-bit index for tail calls + - netfilter: ebtables: Fix argument order to ADD_COUNTER + - netfilter: nft_flow_offload: missing netlink attribute policy + - netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info + - NFSv4: Fix return values for nfs4_file_open() + - NFSv4: Fix return value in nfs_finish_open() + - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup + - xdp: unpin xdp umem pages in error path + - qed: Add cleanup in qed_slowpath_start() + - [armel,armhf] 8874/1: mm: only adjust sections of valid mm structures + - batman-adv: Only read OGM2 tvlv_len after buffer len check + - bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0 + - r8152: Set memory to all 0xFFs on failed reg reads + - [x86] apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines + - netfilter: xt_physdev: Fix spurious error message in physdev_mt_check + - netfilter: nf_conntrack_ftp: Fix debug output + - NFSv2: Fix eof handling + - NFSv2: Fix write regression + - kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the + first symbol + - cifs: set domainName when a domain-key is used in multiuser + - cifs: Use kzfree() to zero out the password + - [armhf,arm64] usb: host: xhci-tegra: Set DMA mask correctly + - [armel,armhf] 8901/1: add a criteria for pfn_valid of arm + - sky2: Disable MSI on yet another ASUS boards (P6Xxxx) + - i2c: designware: Synchronize IRQs when unregistering slave client + - [x86] perf/intel: Restrict period on Nehalem + - [x86] perf/amd/ibs: Fix sample bias for dispatched micro-ops + - amd-xgbe: Fix error path in xgbe_mod_init() + - [x86] tools/power x86_energy_perf_policy: Fix argument parsing + - [x86] tools/power turbostat: fix buffer overrun + - net: aquantia: fix out of memory condition on rx side + - [armhf] dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() + - [x86] uaccess: Don't leak the AC flags into __get_user() argument + evaluation + - [x86] hyper-v: Fix overflow bug in fill_gva_list() + - keys: Fix missing null pointer check in request_key_auth_describe() + - [x86] iommu/amd: Flush old domains in kdump kernel + - [x86] iommu/amd: Fix race in increase_address_space() + - [arm64] PCI: kirin: Fix section mismatch warning + - ovl: fix regression caused by overlapping layers detection + - floppy: fix usercopy direction + - binfmt_elf: move brk out of mmap when doing direct loader exec + - [arm64] kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field + - media: technisat-usb2: break out of loop at end of buffer + (CVE-2019-15505) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.76 + - Revert "Bluetooth: validate BLE connection interval updates" + - RDMA/restrack: Protect from reentry to resource return path + - [ppc64el] xive: Fix bogus error code returned by OPAL + - IB/core: Add an unbound WQ type to the new CQ API + - HID: prodikeys: Fix general protection fault during probe + - HID: sony: Fix memory corruption issue on cleanup. + - HID: logitech: Fix general protection fault caused by Logitech driver + - HID: hidraw: Fix invalid read in hidraw_ioctl + - HID: Add quirk for HP X500 PIXART OEM mouse + - mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() + - CIFS: fix deadlock in cached root handling + - net/mlx5e: Set ECN for received packets using CQE indication + - net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets + - mlx5: fix get_ip_proto() + - net/mlx5e: Allow reporting of checksum unnecessary + - net/mlx5e: XDP, Avoid checksum complete when XDP prog is loaded + - net/mlx5e: Rx, Fixup skb checksum for packets with tail padding + - net/mlx5e: Rx, Check ip headers sanity + - iwlwifi: mvm: send BCAST management frames to the right station + - iwlwifi: mvm: always init rs_fw with 20MHz bandwidth rates + - media: tvp5150: fix switch exit in set control handler + - [x86] ASoC: Intel: cht_bsw_max98090_ti: Enable codec clock once and keep + it enabled + - ALSA: usb-audio: Add Hiby device family to quirks for native DSD support + - ALSA: usb-audio: Add DSD support for EVGA NU Audio + - ALSA: dice: fix wrong packet parameter for Alesis iO26 + - [x86] ALSA: hda - Add laptop imic fixup for ASUS M9V laptop + - [x86] ALSA: hda - Apply AMD controller workaround for Raven platform + - objtool: Clobber user CFLAGS variable + - power: supply: sysfs: ratelimit property read error message + - scsi: qla2xxx: Turn off IOCB timeout timer on IOCB completion + - scsi: qla2xxx: Remove all rports if fabric scan retry fails + - scsi: qla2xxx: Return switch command on a timeout + - Revert "drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD" + - bpf: libbpf: retry loading program on EAGAIN + - [armhf,arm64] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices + - f2fs: check all the data segments against all node ones + - [x86] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it + - bcache: remove redundant LIST_HEAD(journal) from run_cache_set() + - initramfs: don't free a non-existent initrd + - blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs + - blk-mq: move cancel of requeue_work to the front of blk_exit_queue + - Revert "f2fs: avoid out-of-range memory access" + - dm zoned: fix invalid memory access + - f2fs: fix to do sanity check on segment bitmap of LFS curseg + - drm: Flush output polling on shutdown + - net: don't warn in inet diag when IPV6 is disabled + - Bluetooth: btrtl: HCI reset on close for Realtek BT chip + - [x86] ACPI: video: Add new hw_changes_brightness quirk, set it on + PB Easynote MZ35 + - drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling + - xfs: don't crash on null attr fork xfs_bmapi_read + - netfilter: nft_socket: fix erroneous socket assignment + - Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices + - net_sched: check cops->tcf_block in tc_bind_tclass() + - net/rds: An rds_sock is added too early to the hash table + - net/rds: Check laddr_check before calling it + - f2fs: use generic EFSBADCRC/EFSCORRUPTED + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.77 + - arcnet: provide a buffer big enough to actually receive packets + - cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize + - macsec: drop skb sk before calling gro_cells_receive + - net/phy: fix DP83865 10 Mbps HDX loopback disable function + - net/sched: act_sample: don't push mac header on ip6gre ingress + - net_sched: add max len check for TCA_KIND + - nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs + (CVE-2019-19081) + - openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC + - ppp: Fix memory leak in ppp_write + - sch_netem: fix a divide by zero in tabledist() + - skge: fix checksum byte order + - usbnet: ignore endpoints with invalid wMaxPacketSize + - usbnet: sanity checking of packet sizes and device mtu + - net: sched: fix possible crash in tcf_action_destroy() + - tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state + - net/mlx5: Add device ID of upcoming BlueField-2 + - mISDN: enforce CAP_NET_RAW for raw sockets (CVE-2019-17055) + - appletalk: enforce CAP_NET_RAW for raw sockets (CVE-2019-17054) + - ax25: enforce CAP_NET_RAW for raw sockets (CVE-2019-17052) + - ieee802154: enforce CAP_NET_RAW for raw sockets (CVE-2019-17053) + - nfc: enforce CAP_NET_RAW for raw sockets (CVE-2019-17056) + - nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs + (CVE-2019-19080) + - ALSA: hda: Flush interrupts on disabling + - [armhf] ASoC: sgtl5000: Fix of unmute outputs on probe + - [armhf] ASoC: sgtl5000: Fix charge pump source assignment + - [arm*] dmaengine: bcm2835: Print error in case setting DMA mask fails + - media: dib0700: fix link error for dibx000_i2c_set_speed + - media: hdpvr: Add device num check and handling + - time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint + - sched/fair: Fix imbalance due to CPU affinity + - sched/core: Fix CPU controller for !RT_GROUP_SCHED + - [x86] apic: Make apic_pending_intr_clear() more robust + - sched/deadline: Fix bandwidth accounting at all levels after offline + migration + - [x86] reboot: Always use NMI fallback when shutdown via reboot vector IPI + fails + - [x86] apic: Soft disable APIC before initializing it + - ALSA: hda - Show the fatal CORB/RIRB error more clearly + - ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in + build_adc_controls() + - EDAC/mc: Fix grain_bits calculation + - media: iguanair: add sanity checks + - base: soc: Export soc_device_register/unregister APIs + - ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid + - [arm64] prefetch: fix a -Wtype-limits warning + - md/raid1: end bio when the device faulty + - md: don't call spare_active in md_reap_sync_thread if all member devices + can't work + - md: don't set In_sync if array is frozen + - ACPI / processor: don't print errors for processorIDs == 0xff + - loop: Add LOOP_SET_DIRECT_IO to compat ioctl + - [x86] EDAC, pnd2: Fix ioremap() size in dnv_rd_reg() + - efi: cper: print AER info of PCIe fatal error + - sched/fair: Use rq_lock/unlock in online_fair_sched_group + - idle: Prevent late-arriving interrupts from disrupting offline + - media: gspca: zero usb_buf on error + - perf config: Honour $PERF_CONFIG env var to specify alternate .perfconfig + - perf test vfs_getname: Disable ~/.perfconfig to get default output + - media: em28xx: modules workqueue not inited for 2nd device + - media: rc: imon: Allow iMON RC protocol for ffdc 7e device + - [arm64] perf record: Support aarch64 random socket_id assignment + - [armhf] media: omap3isp: Don't set streaming state on random subdevs + - media: radio/si470x: kill urb on error + - media: hdpvr: add terminating 0 at end of string + - led: triggers: Fix a memory leak bug + - nbd: add missing config put + - media: mceusb: fix (eliminate) TX IR signal length limit + - media: dvb-frontends: use ida for pll number + - posix-cpu-timers: Sanitize bogus WARNONS + - media: dvb-core: fix a memory leak bug + - libperf: Fix alignment trap with xyarray contents in 'perf stat' + - [amd64] EDAC/amd64: Recognize DRAM device type ECC capability + - [amd64] EDAC/amd64: Decode syndrome before translating address + - PM / devfreq: passive: Use non-devm notifiers + - PM / devfreq: exynos-bus: Correct clock enable sequence + - media: cec-notifier: clear cec_adap in cec_notifier_unregister + - media: saa7146: add cleanup in hexium_attach() + - media: cpia2_usb: fix memory leaks + - media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() + - perf trace beauty ioctl: Fix off-by-one error in cmd->string table + - [x86] ASoC: es8316: fix headphone mixer volume table + - ACPI / CPPC: do not require the _PSD method + - sched/cpufreq: Align trace event behavior of fast switching + - [x86] apic/vector: Warn when vector space exhaustion breaks affinity + - [arm64] kpti: ensure patched kernel text is fetched from PoU + - [x86] mm/pti: Do not invoke PTI functions when PTI is disabled + - [x86] mm/pti: Handle unaligned address gracefully in + pti_clone_pagetable() + - nvmet: fix data units read and written counters in SMART log + - nvme-multipath: fix ana log nsid lookup when nsid is not found + - ALSA: firewire-motu: add support for MOTU 4pre + - iommu/amd: Silence warnings under memory pressure + - libata/ahci: Drop PCS quirk for Denverton and beyond + - iommu/iova: Avoid false sharing on fq_timer_on + - libtraceevent: Change users plugin directory + - [armhf] dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks + - ACPI: custom_method: fix memory leaks + - ACPI / PCI: fix acpi_pci_irq_enable() memory leak + - closures: fix a race on wakeup from closure_sync + - hwmon: (acpi_power_meter) Change log level for 'unsafe software power + cap' + - md/raid1: fail run raid1 array when active disk less than one + - dmaengine: ti: edma: Do not reset reserved paRAM slots + - kprobes: Prohibit probing on BUG() and WARN() address + - [s390x] crypto: xts-aes-s390 fix extra run-time crypto self tests finding + - [x86] cpu: Add Tiger Lake to Intel family + - [x86] platform: intel_pmc_core: Do not ioremap RAM + - ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not + set + - raid5: don't set STRIPE_HANDLE to stripe which is in batch list + - mmc: core: Clarify sdio_irq_pending flag for MMC_CAP2_SDIO_IRQ_NOTHREAD + - mmc: sdhci: Fix incorrect switch to HS mode + - mmc: core: Add helper function to indicate if SDIO IRQs is enabled + - [armhf,arm64] mmc: dw_mmc: Re-store SDIO IRQs mask at system resume + - raid5: don't increment read_errors on EILSEQ return + - libertas: Add missing sentinel at end of if_usb.c fw_table + - e1000e: add workaround for possible stalled packet + - ALSA: hda - Drop unsol event handler for Intel HDMI codecs + - drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) + - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() + - [x86] ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 + - [x86] iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems + - btrfs: extent-tree: Make sure we only allocate extents from block groups + with the same type + - [armhf] media: omap3isp: Set device on omap3isp subdevs + - PM / devfreq: passive: fix compiler warning + - iwlwifi: fw: don't send GEO_TX_POWER_LIMIT command to FW version 36 + - ALSA: firewire-tascam: handle error code when getting current source of + clock + - ALSA: firewire-tascam: check intermediate state of clock status and retry + - scsi: scsi_dh_rdac: zero cdb in send_mode_select() + - scsi: qla2xxx: Fix Relogin to prevent modifying scan_state flag + - printk: Do not lose last line in kmsg buffer dump + - IB/mlx5: Free mpi in mp_slave mode + - IB/hfi1: Define variables as unsigned long to fix KASAN warning + - randstruct: Check member structs in is_pure_ops_struct() + - ceph: use ceph_evict_inode to cleanup inode's resource + - [x86] ALSA: hda/realtek - PCI quirk for Medion E4254 + - blk-mq: add callback of .cleanup_rq + - scsi: implement .cleanup_rq callback + - [ppc64el] imc: Dont create debugfs files for cpu-less nodes + - fuse: fix missing unlock_page in fuse_writepage() + - [x86] KVM: always stop emulation on page fault + - [x86] KVM: set ctxt->have_exception in x86_decode_insn() + - [x86] KVM: Manually calculate reserved bits when loading PDPTRS + - [x86] media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table + - media: don't drop front-end reference count for ->detach + - binfmt_elf: Do not move brk for INTERP-less ET_EXEC + - [x86] ASoC: Intel: NHLT: Fix debug print format + - [x86] ASoC: Intel: Skylake: Use correct function to access iomem space + - [x86] ASoC: Intel: Fix use of potentially uninitialized variable + - [arm64] Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}" + - [arm64] tlb: Ensure we execute an ISB following walk cache invalidation + - [arm64] dts: rockchip: limit clock rate of MMC controllers for RK3328 + - alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP + - regulator: Defer init completion for a while after late_initcall + - efifb: BGRT: Improve efifb_bgrt_sanity_check + - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps + - memcg, oom: don't require __GFP_FS when invoking memcg OOM killer + - memcg, kmem: do not fail __GFP_NOFAIL charges + - i40e: check __I40E_VF_DISABLE bit in i40e_sync_filters_subtask + - block: fix null pointer dereference in blk_mq_rq_timed_out() + - smb3: allow disabling requesting leases + - ovl: Fix dereferencing possible ERR_PTR() + - ovl: filter of trusted xattr results in audit + - btrfs: fix allocation of free space cache v1 bitmap pages + - Btrfs: fix use-after-free when using the tree modification log + - btrfs: Relinquish CPUs in btrfs_compare_trees + - btrfs: qgroup: Fix the wrong target io_tree when freeing reserved data + space + - btrfs: qgroup: Fix reserved data space leak if we have multiple reserve + calls + - Btrfs: fix race setting up and completing qgroup rescan workers + - md/raid6: Set R5_ReadError when there is read failure on parity disk + - md: don't report active array_state until after revalidate_disk() + completes. + - md: only call set_in_sync() when it is expected to succeed. + - cfg80211: Purge frame registrations on iftype change + - /dev/mem: Bail out upon SIGKILL. + - ext4: fix warning inside ext4_convert_unwritten_extents_endio + - ext4: fix punch hole for inline_data file systems + - quota: fix wrong condition in is_quota_modification() + - hwrng: core - don't wait on add_early_randomness() + - CIFS: fix max ea value size + - CIFS: Fix oplock handling for SMB 2.1+ protocols + - md/raid0: avoid RAID0 data corruption due to layout confusion. + - fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock + - mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new + zone + - drm/amd/display: Restore backlight brightness after system resume + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.78 + - tpm: use tpm_try_get_ops() in tpm-sysfs.c. + - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations + - [armhf,arm64] drm/panel: simple: fix AUO g185han01 horizontal blanking + - [armhf,arm64] drm/panel: check failure cases in the probe func + - [armhf,arm64] drm/rockchip: Check for fast link training before enabling + psr + - gpu: drm: radeon: Fix a possible null-pointer dereference in + radeon_connector_set_property() + - [ppc64el] PCI: rpaphp: Avoid a sometimes-uninitialized warning + - ipmi_si: Only schedule continuously in the thread in maintenance mode + - [armhf,arm64] clk: sunxi-ng: v3s: add missing clock slices for MMC2 + module clocks + - drm/amd/display: fix issue where 252-255 values are clipped + - drm/amd/display: reprogram VM config when system resume + - [ppc64el] powernv/ioda2: Allocate TCE table levels on demand for default + DMA window + - [ppc64el] xmon: Check for HV mode when dumping XIVE info from OPAL + - [ppc64el] rtas: use device model APIs and serialization during LPM + - [ppc64el] futex: Fix warning: 'oldval' may be used uninitialized in this + function + - [ppc64el] pseries/mobility: use cond_resched when updating device tree + - [armhf,arm64] pinctrl: tegra: Fix write barrier placement in pmx_writel + - [ppc64el] eeh: Clear stale EEH_DEV_NO_HANDLER flag + - vfio_pci: Restore original state on release + - drm/nouveau/volt: Fix for some cards having 0 maximum voltage + - [x86] pinctrl: amd: disable spurious-firing GPIO IRQs + - drm/amd/display: support spdif + - drm/amdgpu/si: fix ASIC tests + - [ppc64el] exception: machine check use correct cfar for late handler + - pstore: fs superblock limits + - [ppc64el] pseries: correctly track irq state in default idle + - [arm64] pinctrl: meson-gxbb: Fix wrong pinning definition for uart_c + - [ppc64el] dump kernel log before carrying out fadump or kdump + - [arm64] mbox: qcom: add APCS child device for QCS404 + - scsi: core: Reduce memory required for SCSI logging + - dma-buf/sw_sync: Synchronize signal vs syncpt free + - ext4: fix potential use after free after remounting with noblock_validity + - [mips*] tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean + - [x86] i2c-cht-wc: Fix lockdep warning + - [x86] mfd: intel-lpss: Remove D3cold delay + - HID: wacom: Fix several minor compiler warnings + - [armel,armhf] 8898/1: mm: Don't treat faults reported from cache + maintenance as writes + - [armhf] rtc: snvs: fix possible race condition + - HID: apple: Fix stuck function keys when using FN + - [arm64] PCI: rockchip: Propagate errors for optional regulators + - [armhf] PCI: imx6: Propagate errors for optional regulators + - [armel,armhf] 8903/1: ensure that usable memory in bank 0 starts from a + PMD-aligned address + - fat: work around race with userspace's read via blockdev while mounting + - pktcdvd: remove warning on attempting to register non-passthrough dev + - [s390x] hypfs: Fix error number left in struct pointer member + - ocfs2: wait for recovering done after direct unlock request + - [arm64] consider stack randomization for mmap base only when necessary + - [mips*] properly account for stack randomization and stack guard gap + - [armel,armhf] properly account for stack randomization and stack guard + gap + - [armel,armhf] use STACK_TOP when computing mmap base address + - block: mq-deadline: Fix queue restart handling + - bpf: fix use after free in prog symbol exposure + - cxgb4:Fix out-of-bounds MSI-X info array access + - erspan: remove the incorrect mtu limit for erspan + - hso: fix NULL-deref on tty open + - ipv6: drop incoming packets having a v4mapped source address + - ipv6: Handle missing host route in __ipv6_ifa_notify + - net: ipv4: avoid mixed n_redirects and rate_tokens usage + - net: qlogic: Fix memory leak in ql_alloc_large_buffers + - net: Unpublish sk from sk_reuseport_cb before call_rcu + - nfc: fix memory leak in llcp_sock_bind() + - qmi_wwan: add support for Cinterion CLS8 devices + - rxrpc: Fix rxrpc_recvmsg tracepoint + - sch_dsmark: fix potential NULL deref in dsmark_init() + - udp: fix gso_segs calculations + - vsock: Fix a lockdep warning in __vsock_release() + - udp: only do GSO if # of segs > 1 + - net/rds: Fix error handling in rds_ib_add_one() + - xen-netfront: do not use ~0U as error return value for + xennet_fill_frags() + - tipc: fix unlimited bundling of small messages + - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash + - NFC: fix attrs checks in netlink interface + - kexec: bail out upon SIGKILL when allocating memory. + - 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.79 + - [s390x] process: avoid potential reading of freed stack + - [s390x] KVM: Test for bad access register and size at the start of + S390_MEM_OP + - [s390x] topology: avoid firing events before kobjs are created + - [s390x] cio: exclude subchannels with no parent from pseudo check + - [ppc64el] KVM: Book3S HV: Fix race in re-enabling XIVE escalation + interrupts + - [ppc64el] KVM: Book3S HV: Check for MMU ready on piggybacked virtual + cores + - [ppc64el] KVM: Book3S HV: Don't lose pending doorbell request on + migration on P9 + - [x86] KVM: Fix userspace set invalid CR4 + - [x86] KVM: nVMX: handle page fault in vmread fix + - nbd: fix max number of supported devs + - PM / devfreq: tegra: Fix kHz to Hz conversion + - ASoC: Define a set of DAPM pre/post-up events + - [armhf] ASoC: sgtl5000: Improve VAG power and mute control + - [ppc64el] mce: Fix MCE handling for huge pages + - [ppc64el] mce: Schedule work from irq_work + - [ppc64el] powernv: Restrict OPAL symbol map to only be readable by root + - [ppc64el] powernv/ioda: Fix race in TCE level allocation + - [ppc64el] book3s64/mm: Don't do tlbie fixup for some hardware revisions + - tools lib traceevent: Fix "robust" test of do_generate_dynamic_list_file + - [x86] crypto: qat - Silence smp_processor_id() warning + - crypto: skcipher - Unmap pages after an external error + - [mips*el/loongson-3] Treat Loongson Extensions as ASEs + - power: supply: sbs-battery: use correct flags field + - power: supply: sbs-battery: only return health when battery present + - tracing: Make sure variable reference alias has correct var_ref_idx + - usercopy: Avoid HIGHMEM pfn warning + - timer: Read jiffies once when forwarding base clk + - [x86] PCI: vmd: Fix shadow offsets to reflect spec changes + - PCI: Restore Resizable BAR size bits correctly for 1MB BARs + - [armhf] watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout + - perf stat: Fix a segmentation fault when using repeat forever + - [armhf] drm/omap: fix max fclk divider for omap36xx + - [arm64] drm/msm/dsi: Fix return value check for clk_get_parent + - drm/nouveau/kms/nv50-: Don't create MSTMs for eDP connectors + - [x86] drm/i915/gvt: update vgpu workload head pointer correctly + - mmc: sdhci: improve ADMA error reporting + - Revert "locking/pvqspinlock: Don't wait if vCPU is preempted" + - xen/xenbus: fix self-deadlock after killing user process + - ieee802154: atusb: fix use-after-free at disconnect + - [s390x] cio: avoid calling strlen on null pointer + - cfg80211: initialize on-stack chandefs + - [arm64] cpufeature: Detect SSBS and advertise to userspace + - ima: always return negative code for error + - ima: fix freeing ongoing ahash_request + - fs: nfs: Fix possible null-pointer dereferences in encode_attrs() + - 9p: Transport error uninitialized + - 9p: avoid attaching writeback_fid on mmap with type PRIVATE + - xen/pci: reserve MCFG areas earlier + - ceph: fix directories inode i_blkbits initialization + - ceph: reconnect connection if session hang in opening state + - watchdog: aspeed: Add support for AST2600 + - netfilter: nf_tables: allow lookups in dynamic sets + - drm/amdgpu: Fix KFD-related kernel oops on Hawaii + - drm/amdgpu: Check for valid number of registers to read + - pNFS: Ensure we do clear the return-on-close layout stateid on fatal + errors + - [x86] purgatory: Disable the stackleak GCC plugin for the purgatory + - ntb: point to right memory window index + - thermal: Fix use-after-free when unregistering thermal zone device + - thermal_hwmon: Sanitize thermal_zone type + - libnvdimm/region: Initialize bad block for volatile namespaces + - fuse: fix memleak in cuse_channel_open + - libnvdimm/nfit_test: Fix acpi_handle redefinition + - sched/membarrier: Call sync_core only before usermode for same mm + - sched/membarrier: Fix private expedited registration check + - sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() + - kernel/elfcore.c: include proper prototypes + - nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs + - drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed + - [ppc64el] KVM: HV: XIVE: Free escalation interrupts before disabling the + VP + - [x86] KVM: nVMX: Fix consistency check on injected exception error code + - nbd: fix crash when the blksize is zero + - [ppc64el] pseries: Fix cpu_hotplug_lock acquisition in resize_hpt() + - [ppc64el] radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag + - tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on + failure + - tick: broadcast-hrtimer: Fix a race in bc_set_next + - perf tools: Fix segfault in cpu_cache_level__read() + - perf stat: Reset previous counts on repeat with interval + - [arm64] ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 + - [arm64] KVM: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe + - [arm64] docs: Document SSBS HWCAP + - [arm64] fix SSBS sanitization + - [arm64] Add sysfs vulnerability show for spectre-v1 + - [arm64] add sysfs vulnerability show for meltdown + - [arm64] enable generic CPU vulnerabilites support + - [arm64] Always enable ssb vulnerability detection + - [arm64] Provide a command line to disable spectre_v2 mitigation + - [arm64] Advertise mitigation of Spectre-v2, or lack thereof + - [arm64] Always enable spectre-v2 vulnerability detection + - [arm64] add sysfs vulnerability show for spectre-v2 + - [arm64] add sysfs vulnerability show for speculative store bypass + - [arm64] ssbs: Don't treat CPUs with SSBS as unaffected by SSB + - [arm64] Force SSBS on context switch + - [arm64] Use firmware to detect CPUs that are not affected by Spectre-v2 + - [arm64] speculation: Support 'mitigations=' cmdline option + - vfs: Fix EOVERFLOW testing in put_compat_statfs64 + - cfg80211: add and use strongly typed element iteration macros + - cfg80211: Use const more consistently in for_each_element macros + - nl80211: validate beacon head (CVE-2019-16746) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.80 + - panic: ensure preemption is disabled during panic() + - f2fs: use EINVAL for superblock with invalid magic + - USB: rio500: Remove Rio 500 kernel driver + - USB: yurex: Don't retry on unexpected errors + - USB: yurex: fix NULL-derefs on disconnect + - USB: usb-skeleton: fix runtime PM after driver unbind + - USB: usb-skeleton: fix NULL-deref on disconnect + - xhci: Fix false warning message about wrong bounce buffer write length + - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long + - xhci: Check all endpoints for LPM timeout + - xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts + - usb: xhci: wait for CNR controller not ready bit in xhci resume + - xhci: Prevent deadlock when xhci adapter breaks during init + - xhci: Increase STS_SAVE timeout in xhci_suspend() + - USB: adutux: fix use-after-free on disconnect + - USB: adutux: fix NULL-derefs on disconnect + - USB: adutux: fix use-after-free on release + - USB: iowarrior: fix use-after-free on disconnect + - USB: iowarrior: fix use-after-free on release + - USB: iowarrior: fix use-after-free after driver unbind + - USB: usblp: fix runtime PM after driver unbind + - USB: chaoskey: fix use-after-free on release + - USB: ldusb: fix NULL-derefs on driver unbind + - serial: uartlite: fix exit path null pointer + - USB: serial: keyspan: fix NULL-derefs on open() and write() + - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 + - USB: serial: option: add Telit FN980 compositions + - USB: serial: option: add support for Cinterion CLS8 devices + - USB: serial: fix runtime PM after driver unbind + - USB: usblcd: fix I/O after disconnect + - USB: microtek: fix info-leak at probe + - USB: dummy-hcd: fix power budget for SuperSpeed mode + - USB: legousbtower: fix slab info leak at probe + - USB: legousbtower: fix deadlock on disconnect + - USB: legousbtower: fix potential NULL-deref on disconnect + - USB: legousbtower: fix open after failed reset request + - USB: legousbtower: fix use-after-free on release + - [x86] mei: me: add comet point (lake) LP device ids + - [x86] mei: avoid FW version request on Ibex Peak and earlier + - [armhf,arm64] iio: adc: axp288: Override TS pin bias current for some + models + - efivar/ssdt: Don't iterate over EFI vars if no SSDT override was + specified + - perf llvm: Don't access out-of-scope array + - perf inject jit: Fix JIT_CODE_MOVE filename + - blk-wbt: fix performance regression in wbt scale_up/scale_down + - CIFS: Gracefully handle QueryInfo errors during open + - CIFS: Force revalidate inode when dentry is stale + - CIFS: Force reval dentry if LOOKUP_REVAL flag is set + - kernel/sysctl.c: do not override max_threads provided by userspace + - mm/vmpressure.c: fix a signedness bug in vmpressure_register_event() + - gpiolib: don't clear FLAG_IS_OUT when emulating open-drain/open-source + - cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic + - btrfs: fix incorrect updating of log root tree + - btrfs: fix uninitialized ret in ref-verify + - NFS: Fix O_DIRECT accounting of number of bytes read/written + - [mips*] elf_hwcap: Export userspace ASEs + - ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags + - ACPI/PPTT: Add support for ACPI 6.3 thread flag + - [arm64] topology: Use PPTT to determine if PE is a thread + - vfs: Fix the locking in dcache_readdir() and friends + - media: stkwebcam: fix runtime PM after driver unbind + - [arm64] sve: Fix wrong free for task->thread.sve_state + - [rt] tracing/hwlat: Report total time spent in all NMIs during the sample + - [rt] tracing/hwlat: Don't ignore outer-loop duration when calculating + max_latency + - ftrace: Get a reference counter for the trace_array on filter files + - tracing: Get trace_array reference for available_tracers files + - hwmon: Fix HWMON_P_MIN_ALARM mask + - [x86] asm: Fix MWAITX C-state hint value + - [x86] PCI: vmd: Fix config addressing when using bus offsets + - perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.81 + - nvme-pci: Fix a race in controller removal + - scsi: ufs: skip shutdown if hba is not powered + - scsi: megaraid: disable device when probe failed after enabled device + - scsi: qla2xxx: Fix unbound sleep in fcport delete path. + - [armhf] OMAP2+: Fix missing reset done flag for am3 and am43 + - [armhf] OMAP2+: Fix warnings with broken omap2_set_init_voltage() + - xen/efi: Set nonblocking callbacks + - nl80211: fix null pointer dereference + - mac80211: fix txq null pointer dereference + - netfilter: nft_connlimit: disable bh on garbage collection + - [mips*el/loongson-3] Fix the link time qualifier of 'serial_exit()' + - [arm64] net: hisilicon: Fix usage of uninitialized variable in function + mdio_sc_cfg_reg_write() + - lib: textsearch: fix escapes in example code + - r8152: Set macpassthru in reset_resume callback + - libata/ahci: Fix PCS quirk application + - md/raid0: fix warning message for parameter default_layout + - ocfs2: fix panic due to ocfs2_wq is null + - ipv4: fix race condition between route lookup and invalidation + - net: avoid potential infinite loop in tc_ctl_action() + - net: ipv6: fix listify ip6_rcv_finish in case of forwarding + - [armhf,arm64] net: stmmac: disable/enable ptp_ref_clk in suspend/resume + flow + - sctp: change sctp_prot .no_autobind with true + - memfd: Fix locking when tagging pins + - USB: legousbtower: fix memleak on disconnect + - ALSA: hda/realtek - Add support for ALC711 + - [x86] ALSA: hda/realtek - Enable headset mic on Asus MJ401TA + - ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers + - ALSA: hda - Force runtime PM on Nvidia HDMI codecs + - USB: serial: ti_usb_3410_5052: fix port-close races + - USB: ldusb: fix memleak on disconnect + - USB: usblp: fix use-after-free on disconnect + - USB: ldusb: fix read info leaks + - [mips*] tlbex: Fix build_restore_pagemask KScratch restore + - staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS + - [s390x] scsi: zfcp: fix reaction on bit error threshold notification + - scsi: sd: Ignore a failure to sync cache due to lack of authorization + - scsi: core: save/restore command resid for error handling + - scsi: core: try to get module before removing device + - scsi: ch: Make it possible to open a ch device multiple times again + - Input: synaptics-rmi4 - avoid processing unknown IRQs + - ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() + - cfg80211: wext: avoid copying malformed SSIDs (CVE-2019-17133) + - mac80211: Reject malformed SSID elements + - [x86] drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 + - drm/ttm: Restore ttm prefaulting + - drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1 + - drivers/base/memory.c: don't access uninitialized memmaps in + soft_offline_page_store() + - fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c + - mm/memory-failure.c: don't access uninitialized memmaps in + memory_failure() + - mm/slub: fix a deadlock in show_slab_objects() + - mm/page_owner: don't access uninitialized memmaps when reading + /proc/pagetypeinfo + - hugetlbfs: don't access uninitialized memmaps in + pfn_range_valid_gigantic() + - mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if + mmaped more than once + - EDAC/ghes: Fix Use after free in ghes_edac remove path + - [arm64] Enable workaround for Cavium TX2 erratum 219 when running SMT + - CIFS: avoid using MID 0xFFFF + - CIFS: Fix use after free of file info structures + - perf/aux: Fix AUX output stopping + - tracing: Fix race in perf_trace_buf initialization + - dm cache: fix bugs when a GFP_NOWAIT allocation fails + - [amd64] boot: Make level2_kernel_pgt pages invalid outside kernel area + - [x86] apic/x2apic: Fix a NULL pointer deref when handling a dying cpu + - [x86] pinctrl: cherryview: restore Strago DMI workaround for all versions + - [arm64] pinctrl: armada-37xx: fix control of pins 32 and up + - [arm64] pinctrl: armada-37xx: swap polarity on LED group + - btrfs: block-group: Fix a memory leak due to missing + btrfs_put_block_group() + - Btrfs: add missing extents release on file extent cluster relocation + error + - Btrfs: check for the full sync flag while holding the inode lock during + fsync + - btrfs: tracepoints: Fix bad entry members of qgroup events + - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' + - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown + - xen/netback: fix error path of xenvif_connect_data() + - PCI: PM: Fix pci_power_up() + - blk-rq-qos: fix first node deletion of rq_qos_del() + - RDMA/cxgb4: Do not dma memory off of the stack (CVE-2019-17075) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.82 + - zram: fix race between backing_dev_show and backing_dev_store + - dm snapshot: introduce account_start_copy() and account_end_copy() + - dm snapshot: rework COW throttling to fix deadlock + - Btrfs: fix inode cache block reserve leak on failure to allocate data + space + - Btrfs: fix memory leak due to concurrent append writes with fiemap + - btrfs: qgroup: Always free PREALLOC META reserve in + btrfs_delalloc_release_extents() + - btrfs: tracepoints: Fix wrong parameter order for qgroup events + - wil6210: fix freeing of rx buffers in EDMA mode + - f2fs: flush quota blocks after turnning it off + - scsi: lpfc: Fix a duplicate 0711 log message number. + - f2fs: fix to recover inode's i_gc_failures during POR + - f2fs: fix to recover inode->i_flags of inode block during POR + - [x86] HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override + - [arm64,armel,armhf] usb: dwc2: fix unbalanced use of external + vbus-supply + - [x86] tools/power turbostat: fix goldmont C-state limit decoding + - [x86] cpu: Add Atom Tremont (Jacobsville) + - [arm64] drm/msm/dpu: handle failures while initializing displays + - bcache: fix input overflow to writeback_rate_minimum + - PCI: Fix Switchtec DMA aliasing quirk dmesg noise + - Btrfs: fix deadlock on tree root leaf when finding free extent + - netfilter: ipset: Make invalid MAC address checks consistent + - HID: i2c-hid: Disable runtime PM for LG touchscreen + - HID: i2c-hid: Ignore input report if there's no data present on Elan + touchpanels + - HID: i2c-hid: Add Odys Winbook 13 to descriptor override + - [x86] platform/x86: Add the VLV ISP PCI ID to atomisp2_pm + - [x86] platform/x86: Fix config space access for intel_atomisp2_pm + - ath10k: assign 'n_cipher_suites = 11' for WCN3990 to enable WPA3 + - HID: Add ASUS T100CHI keyboard dock battery quirks + - NFSv4: Ensure that the state manager exits the loop on SIGKILL + - HID: steam: fix boot loop with bluetooth firmware + - HID: steam: fix deadlock with input devices. + - [arm64,armhf] usb: dwc3: gadget: early giveback if End Transfer already + completed + - [arm64,armhf] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd + complete + - ALSA: usb-audio: Cleanup DSD whitelist + - usb: handle warm-reset port requests on hub resume + - [armhf] rtc: pcf8523: set xtal load capacitance from DT + - [arm64] Add MIDR encoding for HiSilicon Taishan CPUs + - [arm64] kpti: Whitelist HiSilicon Taishan v110 CPUs + - scsi: lpfc: Correct localport timeout duration error + - CIFS: Respect SMB2 hdr preamble size in read responses + - cifs: add credits from unmatched responses/messages + - ALSA: hda/realtek - Apply ALC294 hp init also for S4 resume + - ext4: disallow files with EXT4_JOURNAL_DATA_FL from EXT4_IOC_SWAP_BOOT + - exec: load_script: Do not exec truncated interpreter path + - [arm64,armhf] net: dsa: mv88e6xxx: Release lock while requesting IRQ + - PCI/PME: Fix possible use-after-free on remove + - [arm64,armhf] iio: adc: meson_saradc: Fix memory allocation order + - [x86] iio: fix center temperature of bmc150-accel-core + - perf map: Fix overlapped map handling + - perf script brstackinsn: Fix recovery from LBR/binary mismatch + - perf jevents: Fix period for Intel fixed counters + - perf tools: Propagate get_cpuid() error + - perf annotate: Propagate perf_env__arch() error + - perf annotate: Fix the signedness of failure returns + - perf annotate: Propagate the symbol__annotate() error return + - perf annotate: Return appropriate error code for allocation failures + - staging: rtl8188eu: fix null dereference when kzalloc fails + - RDMA/hfi1: Prevent memory leak in sdma_init (CVE-2019-19065) + - RDMA/iwcm: Fix a lock inversion issue + - [x86] HID: hyperv: Use in-place iterator API in the channel callback + - nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request + - [arm64] ftrace: Ensure synchronisation in PLT setup for Neoverse-N1 + - [arm64] gpio: max77620: Use correct unit for debounce times + - fs: cifs: mute -Wunused-const-variable message + - [armhf] serial: mctrl_gpio: Check for NULL pointer + - efi/cper: Fix endianness of PCIe class code + - [x86] efi/x86: Do not clean dummy variable in kexec path + - [x86] xen: Return from panic notifier + - ocfs2: clear zero in unaligned direct IO + - fs: ocfs2: fix possible null-pointer dereferences in + ocfs2_xa_prepare_entry() + - fs: ocfs2: fix a possible null-pointer dereference in + ocfs2_write_end_nolock() + - fs: ocfs2: fix a possible null-pointer dereference in + ocfs2_info_scan_inode_alloc() + - [arm64] armv8_deprecated: Checking return value for memory allocation + - [x86] cpu: Add Comet Lake to the Intel CPU models header + - sched/vtime: Fix guest/system mis-accounting on task switch + - [x86] perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp + - drm/amdgpu: fix memory leak + - iio: imu: adis16400: release allocated memory on failure + (CVE-2019-19060) + - [x86] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr + (CVE-2019-19048) + - NFSv4: Fix leak of clp->cl_acceptor string + - tracing: Initialize iter->seq after zeroing in tracing_read_pipe() + - ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 + - iwlwifi: exclude GEO SAR support for 3168 + - nbd: verify socket is supported during setup + - USB: legousbtower: fix a signedness bug in tower_probe() + - [x86] thunderbolt: Use 32-bit writes when writing ring producer/consumer + - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() + (CVE-2019-15098) + - fuse: flush dirty data/metadata before non-truncate setattr + - fuse: truncate pending writes on O_TRUNC + - ALSA: bebob: Fix prototype of helper function to return negative value + - ALSA: hda/realtek - Fix 2 front mics of codec 0x623 + - ALSA: hda/realtek - Add support for ALC623 + - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather + segments") + - USB: gadget: Reject endpoints with 0 maxpacket value + - usb-storage: Revert commit 747668dbc061 ("usb-storage: Set + virt_boundary_mask to avoid SG overflows") + - USB: ldusb: fix ring-buffer locking + - USB: ldusb: fix control-message timeout + - usb: xhci: fix __le32/__le64 accessors in debugfs code + - USB: serial: whiteheat: fix potential slab corruption + - USB: serial: whiteheat: fix line-speed endianness + - scsi: target: cxgbit: Fix cxgbit_fw4_ack() + - HID: i2c-hid: add Trekstor Primebook C11B to descriptor override + - HID: Fix assumption that devices have inputs + - HID: fix error message in hid_open_report() + - nl80211: fix validation of mesh path nexthop + - [s390x] cmm: fix information leak in cmm_timeout_handler() + - [s390x] idle: fix cpu idle time calculation + - [arm64] Ensure VM_WRITE|VM_SHARED ptes are clean by default + - rtlwifi: Fix potential overflow on P2P code (CVE-2019-17666) + - [arm64] dmaengine: qcom: bam_dma: Fix resource leak + - [armhf] dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle + - NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid() + - batman-adv: Avoid free/alloc race when handling OGM buffer + - llc: fix sk_buff leak in llc_sap_state_process() + - llc: fix sk_buff leak in llc_conn_service() + - rxrpc: Fix call ref leak + - rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record + - rxrpc: Fix trace-after-put looking at the put peer record + - NFC: pn533: fix use-after-free and memleaks + - bonding: fix potential NULL deref in bond_update_slave_arr + - net: usb: sr9800: fix uninitialized local variable + - sch_netem: fix rcu splat in netem_enqueue() + - ALSA: timer: Simplify error path in snd_timer_open() + - ALSA: timer: Fix mutex deadlock at releasing card + - ALSA: usb-audio: DSD auto-detection for Playback Designs + - ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel + - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface + - [ppc64el] powerpc/powernv: Fix CPU idle to be called with IRQs disabled + - Revert "ALSA: hda: Flush interrupts on disabling" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.83 + - regulator: of: fix suspend-min/max-voltage parsing + - [arm64] dts: allwinner: a64: pine64-plus: Add PHY regulator delay + - [arm64] arm64: dts: allwinner: a64: sopine-baseboard: Add PHY regulator + delay + - [armhf] regulator: ti-abb: Fix timeout in + ti_abb_wait_txdone/ti_abb_clear_all_txdone + - [x86] ASoC: rt5682: add NULL handler to set_jack function + - [armhf] regulator: pfuze100-regulator: Variable "val" in + pfuze100_regulator_probe() could be uninitialized + - [arm64,armhf] ASoc: rockchip: i2s: Fix RPM imbalance + - [armel,armhf] mm: fix alignment handler faults under memory pressure + - scsi: qla2xxx: fix a potential NULL pointer dereference + - scsi: scsi_dh_alua: handle RTPG sense code correctly during state + transitions + - drm/amdgpu: fix potential VM faults + - scsi: target: core: Do not overwrite CDB byte 1 + - tracing: Fix "gfp_t" format for synthetic events + - of: unittest: fix memory leak in unittest_data_add (CVE-2019-19049) + - [arm64,armhf] irqchip/gic-v3-its: Use the exact ITSList for VMOVP + - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs + - nbd: protect cmd->status with cmd->lock + - nbd: handle racing with error'ed out commands + - cxgb4: fix panic when attaching to ULD fail + - dccp: do not leak jiffies on the wire + - erspan: fix the tun_info options_len check for erspan + - inet: stop leaking jiffies on the wire + - net: annotate accesses to sk->sk_incoming_cpu + - net: annotate lockless accesses to sk->sk_napi_id + - [armhf] net: dsa: bcm_sf2: Fix IMP setup for port different than 8 + - net: fix sk_page_frag() recursion from memory reclaim + - [arm64] net: hisilicon: Fix ping latency when deal with high throughput + - net/mlx4_core: Dynamically set guaranteed amount of counters per VF + - netns: fix GFP flags in rtnl_net_notifyid() + - net: usb: lan78xx: Disable interrupts before calling + generic_handle_irq() + - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() + - udp: fix data-race in udp_set_dev_scratch() + - vxlan: check tun_info options_len properly + - net: add skb_queue_empty_lockless() + - udp: use skb_queue_empty_lockless() + - net: use skb_queue_empty_lockless() in poll() handlers + - net: use skb_queue_empty_lockless() in busy poll contexts + - net: add READ_ONCE() annotation in __skb_wait_for_more_packets() + - ipv4: fix route update on metric change. + - net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget + - r8169: fix wrong PHY ID issue with RTL8168dp + - net/mlx5e: Fix ethtool self test: link speed + - [armhf] net: dsa: b53: Do not clear existing mirrored port mask + - [armhf] net: phy: bcm7xxx: define soft_reset for 40nm EPHY + - net: usb: lan78xx: Connect PHY before registering MAC + - [arm64,armhf] net: dsa: fix switch tree list + - r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2 + - net/flow_dissector: switch to siphash + - wireless: Skip directory when generating certificates + - [x86] platform/x86: pmc_atom: Add Siemens SIMATIC IPC227E to + critclk_systems DMI table + - [ppc64el] powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on + POWER9 + - usb: gadget: udc: core: Fix segfault if udc_bind_to_driver() for pending + driver fails + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.84 + - bonding: fix state transition issue in link monitoring + - CDC-NCM: handle incomplete transfer of MTU + - ipv4: Fix table id reference in fib_sync_down_addr + - [mips*] net: ethernet: octeon_mgmt: Account for second possible VLAN + header + - net: fix data-race in neigh_event_send() + - net: usb: qmi_wwan: add support for DW5821e with eSIM support + - nfc: netlink: fix double device reference drop + - qede: fix NULL pointer deref in __qede_remove() + - ipv6: fixes rt6_probe() and fib6_nh->last_probe init + - [arm64] net: hns: Fix the stray netpoll locks causing deadlock in NAPI + path + - ALSA: timer: Fix incorrectly assigned timer instance + - ALSA: bebob: fix to detect configured source of sampling clock for + Focusrite Saffire Pro i/o series + - ALSA: hda/ca0132 - Fix possible workqueue stall + - mm: memcontrol: fix network errors from failing __GFP_ATOMIC charges + - mm, meminit: recalculate pcpu batch and high limits after init completes + - mm: thp: handle page cache THP correctly in PageTransCompoundMap + - mm, vmstat: hide /proc/pagetypeinfo from normal users + - dump_stack: avoid the livelock of the dump_lock + - perf tools: Fix time sorting + - drm/radeon: fix si_enable_smc_cac() failed issue + - HID: wacom: generic: Treat serial number and related fields as unsigned + - [arm64] Do not mask out PTE_RDONLY in pte_same() + - ceph: fix use-after-free in __ceph_remove_cap() + - ceph: add missing check in d_revalidate snapdir handling + - [armhf] sunxi: Fix CPU powerdown on A83T + - netfilter: nf_tables: Align nft_expr private data to 64-bit + - netfilter: ipset: Fix an error code in ip_set_sockfn_get() + - [x86] intel_th: pci: Add Comet Lake PCH support + - [x86] intel_th: pci: Add Jasper Lake PCH support + - [x86] apic/32: Avoid bogus LDR warnings + - SMB3: Fix persistent handles reconnect + - can: usb_8dev: fix use-after-free on disconnect + - [armhf] can: flexcan: disable completely the ECC mechanism + - can: peak_usb: fix a potential out-of-sync while decoding packets + - can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, + avoid skb mem leak + - can: gs_usb: gs_can_open(): prevent memory leak (CVE-2019-19052) + - can: dev: add missing of_node_put() after calling of_get_child_by_name() + - can: mcba_usb: fix use-after-free on disconnect + - can: peak_usb: fix slab info leak + - configfs: stash the data we need into configfs_buffer at open time + - configfs_register_group() shouldn't be (and isn't) called in rmdirable + parts + - configfs: new object reprsenting tree fragments + - configfs: provide exclusion between IO and removals + - configfs: fix a deadlock in configfs_symlink() + - ALSA: usb-audio: More validations of descriptor units + - ALSA: usb-audio: Simplify parse_audio_unit() + - ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects + - ALSA: usb-audio: Remove superfluous bLength checks + - ALSA: usb-audio: Clean up check_input_term() + - ALSA: usb-audio: Fix possible NULL dereference at + create_yamaha_midi_quirk() + - ALSA: usb-audio: remove some dead code + - ALSA: usb-audio: Fix copy&paste error in the validator + - sched/fair: Fix low cpu usage with high throttling by removing + expiration of cpu-local slices + - sched/fair: Fix -Wunused-but-set-variable warnings + - usbip: Fix vhci_urb_enqueue() URB null transfer buffer error path + - usbip: Implement SG support to vhci-hcd and stub driver + - [arm64,armhf] PCI: tegra: Enable Relaxed Ordering only for Tegra20 & + Tegra30 + - [amd64] HID: intel-ish-hid: fix wrong error handling in + ishtp_cl_alloc_tx_ring() + - RDMA/mlx5: Clear old rate limit when closing QP + - iw_cxgb4: fix ECN check on the passive accept + - RDMA/qedr: Fix reported firmware version + - net/mlx5e: TX, Fix consumer index of error cqe dump + - net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq + (CVE-2019-19045) + - scsi: qla2xxx: fixup incorrect usage of host_byte + - RDMA/uverbs: Prevent potential underflow + - net: openvswitch: free vport unless register_netdevice() succeeds + - scsi: lpfc: Honor module parameter lpfc_use_adisc + - scsi: qla2xxx: Initialized mailbox to prevent driver load failure + - netfilter: nf_flow_table: set timeout before insertion into hashes + - ipvs: don't ignore errors in case refcounting ip_vs module fails + - ipvs: move old_secure_tcp into struct netns_ipvs + - bonding: fix unexpected IFF_BONDING bit unset + - macsec: fix refcnt leak in module exit routine + - usb: gadget: composite: Fix possible double free memory bug + - [arm64] usb: dwc3: pci: prevent memory leak in dwc3_pci_probe + (CVE-2019-18813) + - usb: gadget: configfs: fix concurrent issue between composite APIs + - [arm64,armhf] usb: dwc3: remove the call trace of USBx_GFLADJ + - [x86] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus + precise RIP validity + - [x86] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU + family (10h) + - [x86] perf/x86/uncore: Fix event group support + - USB: Skip endpoints with 0 maxpacket length + - USB: ldusb: use unsigned size format specifiers + - usbip: tools: Fix read_usb_vudc_device() error path handling + - RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case + - [arm64] RDMA/hns: Prevent memory leaks of eq->buf_list + - scsi: qla2xxx: stop timer in shutdown path + - nvme-multipath: fix possible io hang after ctrl reconnect + - [amd64] fjes: Handle workqueue allocation failure + - [arm64] net: hisilicon: Fix "Trying to free already-free IRQ" + - drm/amdgpu: If amdgpu_ib_schedule fails return back the error. + - [x86] hv_netvsc: Fix error handling in netvsc_attach() + - [arm64,armhf] usb: dwc3: gadget: fix race when disabling ep with + cancelled xfers + - NFSv4: Don't allow a cached open with a revoked delegation + - igb: Fix constant media auto sense switching when no cable is connected + - e1000: fix memory leaks + - [x86] pinctrl: intel: Avoid potential glitches if pin is in GPIO mode + - ocfs2: protect extent tree in ocfs2_prepare_inode_for_write() + - [x86] pinctrl: cherryview: Fix irq_valid_mask calculation + - blkcg: make blkcg_print_stat() print stats only for online blkgs + - [x86] iio: imu: mpu6050: Add support for the ICM 20602 IMU + - [x86] iio: imu: inv_mpu6050: fix no data on MPU6050 + - mm/filemap.c: don't initiate writeback if mapping has no dirty pages + - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg + is dead + - usbip: Fix free of unallocated memory in vhci tx + - netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets + - net: prevent load/store tearing on sk->sk_stamp + - [x86] iio: imu: mpu6050: Fix FIFO layout for ICM20602 + - vsock/virtio: fix sock refcnt holding during the shutdown + - x86/cpu: Add Tremont to the cpu vulnerability whitelist + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.85 + - scsi: core: Handle drivers which set sg_tablesize to zero + - ax88172a: fix information leak on short answers + - ipmr: Fix skb headroom in ipmr_get_route(). + - net: gemini: add missed free_netdev + - net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules + - slip: Fix memory leak in slip_open error path + - ALSA: usb-audio: Fix missing error check at mixer resolution test + - ALSA: usb-audio: not submit urb for stopped endpoint + - ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() + - ALSA: usb-audio: Fix incorrect size check for processing/extension units + - Btrfs: fix log context list corruption after rename exchange operation + - Input: ff-memless - kill timer in destroy() + - Input: synaptics-rmi4 - fix video buffer size + - Input: synaptics-rmi4 - disable the relative position IRQ in the F12 + driver + - Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) + - Input: synaptics-rmi4 - clear IRQ enables for F54 + - Input: synaptics-rmi4 - destroy F54 poller workqueue when removing + - IB/hfi1: Ensure full Gen3 speed in a Gen4 system + - IB/hfi1: Use a common pad buffer for 9B and 16B packets + - i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present + - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable + - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either + - [armhf] net: ethernet: dwmac-sun8i: Use the correct function in exit path + - [x86] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros + - mm: mempolicy: fix the wrong return value and potential pages leak of + mbind + - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() + - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() + - iio: adc: max9611: explicitly cast gain_selectors + - tee: optee: take DT status property into account + - ath10k: fix kernel panic by moving pci flush after napi_disable + - clk: sunxi-ng: h6: fix PWM gate/reset offset + - soundwire: Initialize completion for defer messages + - [x86] soundwire: intel: Fix uninitialized adev deref + - [arm64] dts: allwinner: a64: Orange Pi Win: Fix SD card node + - [arm64] dts: allwinner: a64: Olinuxino: fix DRAM voltage + - [arm64] dts: allwinner: a64: NanoPi-A64: Fix DCDC1 voltage + - ALSA: pcm: signedness bug in snd_pcm_plug_alloc() + - [arm64] soc/tegra: pmc: Fix pad voltage configuration for Tegra186 + - [arm64] dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply + - y2038: make do_gettimeofday() and get_seconds() inline + - rtc: sysfs: fix NULL check in rtc_add_groups() + - remoteproc/davinci: Use %zx for formating size_t + - extcon: cht-wc: Return from default case to avoid warnings + - cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set + - ALSA: seq: Do error checks at creating system ports + - ath10k: skip resetting rx filter for WCN3990 + - ath9k: fix tx99 with monitor mode interface + - wil6210: drop Rx multicast packets that are looped-back to STA + - wil6210: set edma variables only for Talyn-MB devices + - wil6210: prevent usage of tx ring 0 for eDMA + - wil6210: fix invalid memory access for rx_buff_mgmt debugfs + - ath10k: limit available channels via DT ieee80211-freq-limit + - ice: Update request resource command to latest specification + - ice: Prevent control queue operations during reset + - gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated + - ice: Fix and update driver version string + - ASoC: dapm: Don't fail creating new DAPM control on NULL pinctrl + - ASoC: dpcm: Properly initialise hw->rate_max + - ASoC: meson: axg-fifo: report interrupt request failure + - ASoC: AMD: Change MCLK to 48Mhz + - pinctrl: ingenic: Probe driver at subsys_initcall + - [armhf] dts: exynos: Use i2c-gpio for HDMI-DDC on Arndale + - [armhf] dts: exynos: Fix HDMI-HPD line handling on Arndale + - [armhf] dts: exynos: Fix sound in Snow-rev5 Chromebook + - liquidio: fix race condition in instruction completion processing + - [arm64] dts: stratix10: i2c clock running out of spec + - [armhf] dts: exynos: Fix regulators configuration on Peach Pi/Pit + Chromebooks + - i40evf: Validate the number of queues a PF sends + - i40e: use correct length for strncpy + - i40evf: set IFF_UNICAST_FLT flag for the VF + - i40e: Check and correct speed values for link on open + - i40evf: Don't enable vlan stripping when rx offload is turned on + - i40e: hold the rtnl lock on clearing interrupt scheme + - i40evf: cancel workqueue sync for adminq when a VF is removed + - i40e: Prevent deleting MAC address from VF when set by PF + - IB/rxe: avoid back-to-back retries + - IB/rxe: fixes for rdma read retry + - iwlwifi: drop packets with bad status in CD + - iwlwifi: don't WARN on trying to dump dead firmware + - iwlwifi: mvm: avoid sending too many BARs + - media: vicodec: fix out-of-range values when decoding + - media: i2c: Fix pm_runtime_get_if_in_use() usage in sensor drivers + - media: ov772x: Disable clk on error path + - rtl8187: Fix warning generated when strncpy() destination length matches + the sixe argument + - mwifiex: do no submit URB in suspended state + - mwifex: free rx_cmd skb in suspended state + - brcmfmac: fix wrong strnchr usage + - mt76: Fix comparisons with invalid hardware key index + - soc: imx: gpc: fix PDN delay + - ASoC: rsnd: ssi: Fix issue in dma data address assignment + - net: hns3: Fix for multicast failure + - net: hns3: Fix error of checking used vlan id + - net: hns3: Fix for loopback selftest failed problem + - net: hns3: Change the dst mac addr of loopback packet + - net/mlx5: Fix atomic_mode enum values + - net: phy: mscc: read 'vsc8531,vddmac' as an u32 + - net: phy: mscc: read 'vsc8531, edge-slowdown' as an u32 + - [armhf] dts: meson8: fix the clock controller register size + - [armhf] dts: meson8b: fix the clock controller register size + - mtd: rawnand: marvell: use regmap_update_bits() for syscon access + - mtd: rawnand: fsl_ifc: check result of SRAM initialization + - mtd: rawnand: fsl_ifc: fixup SRAM init for newer ctrl versions + - mtd: rawnand: qcom: don't include dma-direct.h + - IB/mlx5: Change TX affinity assignment in RoCE LAG mode + - qxl: fix null-pointer crash during suspend + - mac80211: fix saving a few HE values + - cfg80211: validate wmm rule when setting + - f2fs: avoid wrong decrypted data from disk + - net: lan78xx: Bail out if lan78xx_get_endpoints fails + - rtnetlink: move type calculation out of loop + - ASoC: sgtl5000: avoid division by zero if lo_vag is zero + - ath10k: avoid possible memory access violation + - [armhf] dts: exynos: Disable pull control for S5M8767 PMIC + - ath10k: wmi: disable softirq's while calling ieee80211_rx + - i2c: mediatek: Use DMA safe buffers for i2c transactions + - IB/mlx5: Don't hold spin lock while checking device state + - IB/ipoib: Ensure that MTU isn't less than minimum permitted + - RDMA/core: Rate limit MAD error messages + - RDMA/core: Follow correct unregister order between sysfs and cgroup + - udf: Fix crash during mount + - ASoC: dapm: Avoid uninitialised variable warning + - [x86] ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation + - ata: Disable AHCI ALPM feature for Ampere Computing eMAG SATA + - [powerpc] make PowerMac cache node search conditional on CONFIG_PPC_PMAC + - [armhf] dts: omap3-gta04: give spi_lcd node a label so that we can + overwrite in other DTS files + - [armhf] dts: omap3-gta04: fixes for tvout / venc + - [armhf] dts: omap3-gta04: tvout: enable as display1 alias + - [armhf] dts: omap3-gta04: fix touchscreen tsc2007 + - [armhf] dts: omap3-gta04: make NAND partitions compatible with recent + U-Boot + - [armhf] dts: omap3-gta04: keep vpll2 always on + - f2fs: submit bio after shutdown + - failover: Fix error return code in net_failover_create + - sched/debug: Explicitly cast sched_feat() to bool + - sched/debug: Use symbolic names for task state constants + - firmware: arm_scmi: use strlcpy to ensure NULL-terminated strings + - [arm64] dts: rockchip: Fix VCC5V0_HOST_EN on rk3399-sapphire + - [armhf] dts: exynos: Disable pull control for PMIC IRQ line on Artik5 + board + - usb: mtu3: disable vbus rise/fall interrupts of ltssm + - EDAC, sb_edac: Return early on ADDRV bit and address type test + - [armhf] rtc: pl030: fix possible race condition + - ath9k: add back support for using active monitor interfaces for tx99 + - dmaengine: at_xdmac: remove a stray bottom half unlock + - RDMA/hns: Fix an error code in hns_roce_v2_init_eq_table() + - IB/hfi1: Missing return value in error path for user sdma + - signal: Always ignore SIGKILL and SIGSTOP sent to the global init + - signal: Properly deliver SIGILL from uprobes + - signal: Properly deliver SIGSEGV from x86 uprobes + - f2fs: fix memory leak of write_io in fill_super() + - f2fs: fix memory leak of percpu counter in fill_super() + - f2fs: fix setattr project check upon fssetxattr ioctl + - scsi: qla2xxx: Use correct qpair for ABTS/CMD + - scsi: qla2xxx: Fix iIDMA error + - scsi: qla2xxx: Defer chip reset until target mode is enabled + - scsi: qla2xxx: Terminate Plogi/PRLI if WWN is 0 + - scsi: qla2xxx: Fix deadlock between ATIO and HW lock + - scsi: qla2xxx: Increase abort timeout value + - scsi: qla2xxx: Check for Register disconnect + - scsi: qla2xxx: Fix port speed display on chip reset + - scsi: qla2xxx: Fix dropped srb resource. + - scsi: qla2xxx: Fix duplicate switch's Nport ID entries + - scsi: lpfc: Fix GFT_ID and PRLI logic for RSCN + - scsi: lpfc: Correct invalid EQ doorbell write on if_type=6 + - scsi: lpfc: Fix errors in log messages. + - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() + - [armhf] imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" + is set + - scsi: pm80xx: Corrected dma_unmap_sg() parameter + - scsi: pm80xx: Fixed system hang issue during kexec boot + - kprobes: Don't call BUG_ON() if there is a kprobe in use on free list + - net: aquantia: fix hw_atl_utils_fw_upload_dwords + - Drivers: hv: vmbus: Fix synic per-cpu context initialization + - nvmem: core: return error code instead of NULL from nvmem_device_get + - media: dt-bindings: adv748x: Fix decimal unit addresses + - [x86] ALSA: hda: Fix implicit definition of pci_iomap() on SH + - media: fix: media: pci: meye: validate offset to avoid arbitrary access + - media: dvb: fix compat ioctl translation + - net: bcmgenet: Fix speed selection for reverse MII + - [arm64] dts: meson: libretech: update board model + - [arm64] dts: meson-axg: use the proper compatible for ethmac + - [x86] ALSA: intel8x0m: Register irq handler after register initializations + - [arm64] dts: renesas: salvator-common: adv748x: Override secondary + addresses + - [arm64] dts: renesas: r8a77965: Attach the SYS-DMAC to the IPMMU + - [arm64] dts: renesas: r8a77965: Fix HS-USB compatible + - [arm64] dts: renesas: r8a77965: Fix clock/reset for usb2_phy1 + - pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map() + - llc: avoid blocking in llc_sap_close() + - [armhf] dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value + - [arm64] soc: qcom: wcnss_ctrl: Avoid string overflow + - [arm64] dts: broadcom: Fix I2C and SPI bus warnings + - [armhf] dts: bcm: Fix SPI bus warnings + - [armhf] dts: aspeed: Fix I2C bus warnings + - [ppc64el,powerpc*] powerpc/vdso: Correct call frame information + - [armhf] dts: socfpga: Fix I2C bus unit-address error + - [armhf] dts: sunxi: Fix I2C bus warnings + - [armhf] dts: sun9i: Fix I2C bus warnings + - android: binder: no outgoing transaction when thread todo has transaction + - cxgb4: Fix endianness issue in t4_fwcache() + - [arm64] fix for bad_mode() handler to always result in panic + - block, bfq: inject other-queue I/O into seeky idle queues on NCQ flash + - blok, bfq: do not plug I/O if all queues are weight-raised + - [arm64] dts: meson: Fix erroneous SPI bus warnings + - power: supply: ab8500_fg: silence uninitialized variable warnings + - component: fix loop condition to call unbind() if bind() fails + - kernfs: Fix range checks in kernfs_get_target_path + - ip_gre: fix parsing gre header in ipgre_err + - scsi: ufshcd: Fix NULL pointer dereference for in ufshcd_init + - [armhf] dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036 + - [arm64] dts: rockchip: Fix I2C bus unit-address error on + rk3399-puma-haikou + - [x86] ACPI / LPSS: Exclude I2C busses shared with PUNIT from + pmc_atom_d3_mask + - netfilter: nf_tables: avoid BUG_ON usage + - ath9k: Fix a locking bug in ath9k_add_interface() + - [s390x] qeth: uninstall IRQ handler on device removal + - [s390x] qeth: invoke softirqs after napi_schedule() + - media: vsp1: Fix vsp1_regs.h license header + - media: vsp1: Fix YCbCr planar formats pitch calculation + - media: ov2680: don't register the v4l2 subdevice before checking chip ID + - PCI/ACPI: Correct error message for ASPM disabling + - net: socionext: Fix two sleep-in-atomic-context bugs in ave_rxfifo_reset() + - PCI: mediatek: Fix unchecked return value + - [armhf] dts: xilinx: Fix I2C and SPI bus warnings + - serial: uartps: Fix suspend functionality + - serial: samsung: Enable baud clock for UART reset procedure in resume + - serial: mxs-auart: Fix potential infinite loop + - tty: serial: qcom_geni_serial: Fix serial when not used as console + - [arm64] dts: ti: k3-am65: Change #address-cells and #size-cells of + interconnect to 2 + - samples/bpf: fix a compilation failure + - spi: mediatek: Don't modify spi_transfer when transfer. + - ASoC: rt5682: Fix the boost volume at the begining of playback + - ipmi_si_pci: fix NULL device in ipmi_si error message + - ipmi_si: fix potential integer overflow on large shift + - ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address + - ipmi: fix return value of ipmi_set_my_LUN + - net: hns3: fix return type of ndo_start_xmit function + - net: cavium: fix return type of ndo_start_xmit function + - net: ibm: fix return type of ndo_start_xmit function + - [ppc64el,powerpc*] iommu: Avoid derefence before pointer check + - [ppc64el,powerpc*] selftests: Do not fail with reschedule + - [ppc64el,powerpc64] hash: Fix stab_rr off by one initialization + - [ppc64el,powerpc64] pseries/memory-hotplug: Only update DT once per memory + DLPAR request + - [ppc64el,powerpc64] pseries: Disable CPU hotplug across migrations + - [ppc64el,powerpc*] Fix duplicate const clang warning in user access code + - RDMA/i40iw: Fix incorrect iterator type + - OPP: Protect dev_list with opp_table lock + - of/unittest: Fix I2C bus unit-address error + - libfdt: Ensure INT_MAX is defined in libfdt_env.h + - power: supply: twl4030_charger: fix charging current out-of-bounds + - power: supply: twl4030_charger: disable eoc interrupt on linear charge + - net: mvpp2: fix the number of queues per cpu for PPv2.2 + - net: marvell: fix return type of ndo_start_xmit function + - net: toshiba: fix return type of ndo_start_xmit function + - net: xilinx: fix return type of ndo_start_xmit function + - net: broadcom: fix return type of ndo_start_xmit function + - net: amd: fix return type of ndo_start_xmit function + - net: sun: fix return type of ndo_start_xmit function + - net: hns3: Fix for setting speed for phy failed problem + - net: hns3: Fix cmdq registers initialization issue for vf + - net: hns3: Clear client pointer when initialize client failed or + unintialize finished + - net: hns3: Fix client initialize state issue when roce client + initialize failed + - net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg() + - nfp: provide a better warning when ring allocation fails + - usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is + already started + - usb: chipidea: Fix otg event handler + - usb: usbtmc: Fix ioctl USBTMC_IOCTL_ABORT_BULK_OUT + - [s390x] zcrypt: enable AP bus scan without a valid default domain + - [s390x] vdso: avoid 64-bit vdso mapping for compat tasks + - [s390x] vdso: correct CFI annotations of vDSO functions + - brcmfmac: increase buffer for obtaining firmware capabilities + - brcmsmac: Use kvmalloc() for ucode allocations + - mlxsw: spectrum: Init shaper for TCs 8..15 + - PCI: portdrv: Initialize service drivers directly + - [armhf] dts: am335x-evm: fix number of cpsw + - [armhf] dts: ti: Fix SPI and I2C bus warnings + - f2fs: avoid infinite loop in f2fs_alloc_nid + - f2fs: fix to recover inode's uid/gid during POR + - [armhf] dts: ux500: Correct SCU unit address + - [armhf] dts: ux500: Fix LCDA clock line muxing + - [armhf] dts: ste: Fix SPI controller node names + - spi: pic32: Use proper enum in dmaengine_prep_slave_rg + - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) + - cpufeature: avoid warning when compiling with clang + - [armhf] crypto: crc32 - avoid warning when compiling with Clang + - [armel] dts: marvell: Fix SPI and I2C bus warnings + - [x86] mce-inject: Reset injection struct after injection + - [armhf,arm64] dts: clearfog: fix sdhci supply property name + - bnx2x: Ignore bandwidth attention in single function mode + - PCI/AER: Take reference on error devices + - PCI/AER: Don't read upstream ports below fatal errors + - PCI/ERR: Use slot reset if available + - samples/bpf: fix compilation failure + - net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider + - net: micrel: fix return type of ndo_start_xmit function + - net: freescale: fix return type of ndo_start_xmit function + - [x86] CPU: Use correct macros for Cyrix calls + - [x86] CPU: Change query logic so CPUID is enabled before testing + - EDAC: Correct DIMM capacity unit symbol + - [mips*] kexec: Relax memory restriction + - [arm64] dts: rockchip: Fix microSD in rk3399 sapphire board + - mlxsw: Make MLXSW_SP1_FWREV_MINOR a hard requirement + - media: imx: work around false-positive warning, again + - media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init() + - media: au0828: Fix incorrect error messages + - media: davinci: Fix implicit enum conversion warning + - [armhf] dts: rockchip: explicitly set vcc_sd0 pin to gpio on + rk3188-radxarock + - usb: gadget: uvc: configfs: Drop leaked references to config items + - usb: gadget: uvc: configfs: Prevent format changes after linking header + - usb: gadget: uvc: configfs: Sort frame intervals upon writing + - [armhf] dts: exynos: Correct audio subsystem parent clock on Peach + Chromebooks + - i2c: aspeed: fix invalid clock parameters for very large divisors + - gpiolib: Fix gpio_direction_* for single direction GPIOs + - phy: brcm-sata: allow PHY_BRCM_SATA driver to be built for DSL SoCs + - phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs + - phy: phy-twl4030-usb: fix denied runtime access + - [armhf] dts: imx6ull: update vdd_soc voltage for 900MHz operating point + - usb: gadget: uvc: Factor out video USB request queueing + - usb: gadget: uvc: Only halt video streaming endpoint in bulk mode + - coresight: Use ERR_CAST instead of ERR_PTR + - coresight: Fix handling of sinks + - coresight: perf: Fix per cpu path management + - coresight: perf: Disable trace path upon source error + - coresight: tmc-etr: Handle driver mode specific ETR buffers + - coresight: etm4x: Configure EL2 exception level when kernel is running + in HYP + - coresight: tmc: Fix byte-address alignment for RRP + - coresight: dynamic-replicator: Handle multiple connections + - slimbus: ngd: register ngd driver only once. + - slimbus: ngd: return proper error code instead of zero + - silmbus: ngd: register controller after power up. + - misc: kgdbts: Fix restrict error + - misc: genwqe: should return proper error value. + - vmbus: keep pointer to ring buffer page + - vfio/pci: Fix potential memory leak in vfio_msi_cap_len + - vfio/pci: Mask buggy SR-IOV VF INTx support + - iw_cxgb4: Use proper enumerated type in c4iw_bar2_addrs + - scsi: libsas: always unregister the old device if going to discover new + - f2fs: fix remount problem of option io_bits + - phy: lantiq: Fix compile warning + - [arm64] dts: fsl: Fix I2C and SPI bus warnings + - [armhf] dts: imx51-zii-rdu1: Fix the rtc compatible string + - [arm64] tegra: I2C on Tegra194 is not compatible with Tegra114 + - [armhf] dts: tegra30: fix xcvr-setup-use-fuses + - [armhf] dts: tegra20: restore address order + - [armhf] tegra: apalis_t30: fix mmc1 cmd pull-up + - [armhf] tegra: apalis_t30: fix mcp2515 can controller interrupt polarity + - [armhf] tegra: colibri_t30: fix mcp2515 can controller interrupt polarity + - [armhf] dts: paz00: fix wakeup gpio keycode + - net: smsc: fix return type of ndo_start_xmit function + - net: faraday: fix return type of ndo_start_xmit function + - PCI/ERR: Run error recovery callbacks for all affected devices + - f2fs: update i_size after DIO completion + - f2fs: fix to recover inode's project id during POR + - f2fs: mark inode dirty explicitly in recover_inode() + - RDMA: Fix dependencies for rdma_user_mmap_io + - EDAC: Raise the maximum number of memory controllers + - firmware: dell_rbu: Make payload memory uncachable + - Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing proto + races + - Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS + - Bluetooth: btrsi: fix bt tx timeout issue + - [x86] hyperv: Suppress "PCI: Fatal: No config space access function found" + - crypto: s5p-sss: Fix race in error handling + - crypto: s5p-sss: Fix Fix argument list alignment + - crypto: fix a memory leak in rsa-kcs1pad's encryption mode + - iwlwifi: dbg: don't crash if the firmware crashes in the middle of a + debug dump + - iwlwifi: fix non_shared_ant for 22000 devices + - iwlwifi: pcie: read correct prph address for newer devices + - iwlwifi: api: annotate compressed BA notif array sizes + - iwlwifi: pcie: gen2: build A-MSDU only for GSO + - iwlwifi: pcie: fit reclaim msg to MAX_MSG_LEN + - iwlwifi: mvm: use correct FIFO length + - iwlwifi: mvm: Allow TKIP for AP mode + - scsi: NCR5380: Clear all unissued commands on host reset + - scsi: NCR5380: Have NCR5380_select() return a bool + - scsi: NCR5380: Withhold disconnect privilege for REQUEST SENSE + - scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data + - scsi: NCR5380: Check for invalid reselection target + - scsi: NCR5380: Don't clear busy flag when abort fails + - scsi: NCR5380: Don't call dsprintk() following reselection interrupt + - scsi: NCR5380: Handle BUS FREE during reselection + - scsi: NCR5380: Check for bus reset + - [arm64] dts: amd: Fix SPI bus warnings + - [arm64] dts: lg: Fix SPI controller node names + - rtc: isl1208: avoid possible sysfs race + - rtc: tx4939: fixup nvmem name and register size + - rtc: armada38x: fix possible race condition + - netfilter: masquerade: don't flush all conntracks if only one address + deleted on device + - usb: xhci-mtk: fix ISOC error when interval is zero + - usb: usbtmc: uninitialized symbol 'actual' in usbtmc_ioctl_clear + - fuse: use READ_ONCE on congestion_threshold and max_background + - IB/iser: Fix possible NULL deref at iser_inv_desc() + - media: ov2680: fix null dereference at power on + - [s390x] vdso: correct vdso mapping for compat tasks + - net: phy: mdio-bcm-unimac: mark PM functions as __maybe_unused + - memfd: Use radix_tree_deref_slot_protected to avoid the warning. + - slcan: Fix memory leak in error path + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.86 + - spi: mediatek: use correct mata->xfer_len when in fifo transfer + - i2c: mediatek: modify threshold passed to i2c_get_dma_safe_msg_buf() + - tee: optee: add missing of_node_put after of_device_is_available + - Revert "OPP: Protect dev_list with opp_table lock" + - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() + - idr: Fix idr_get_next race with idr_remove + - mm/memory_hotplug: don't access uninitialized memmaps in + shrink_pgdat_span() + - mm/memory_hotplug: fix updating the node span + - [arm64] uaccess: Ensure PAN is re-enabled after unhandled uaccess fault + - fbdev: Ditch fb_edid_add_monspecs + - [i386] bpf, x32: Fix bug for BPF_ALU64 | BPF_NEG + - [i386] bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_X shift by 0 + - [i386] bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_K shift by 0 + - [i386] bpf, x32: Fix bug for BPF_JMP | {BPF_JSGT, BPF_JSLE, BPF_JSLT, + BPF_JSGE} + - net: ovs: fix return type of ndo_start_xmit function + - net: xen-netback: fix return type of ndo_start_xmit function + - [armhf] dts: dra7: Enable workaround for errata i870 in PCIe host mode + - [armhf] dts: omap5: enable OTG role for DWC3 controller + - [arm64] net: hns3: Fix for netdev not up problem when setting mtu + - [arm64] net: hns3: Fix loss of coal configuration while doing reset + - f2fs: return correct errno in f2fs_gc + - [armhf] dts: sun8i: h3-h5: ir register size should be the whole memory + block + - [armhf] dts: sun8i: h3: bpi-m2-plus: Fix address for external RGMII + Ethernet PHY + - tcp: up initial rmem to 128KB and SYN rwin to around 64KB + - SUNRPC: Fix priority queue fairness + - ACPI / LPSS: Make acpi_lpss_find_device() also find PCI devices + - ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq + - f2fs: keep lazytime on remount + - IB/hfi1: Error path MAD response size is incorrect + - IB/hfi1: Ensure ucast_dlid access doesnt exceed bounds + - mt76x2: fix tx power configuration for VHT mcs 9 + - mt76x2: disable WLAN core before probe + - mt76: fix handling ps-poll frames + - [arm64,armhf] iommu/io-pgtable-arm: Fix race handling in split_blk_unmap() + - [arm64,armhf] iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout + - [arm64,armhf] kvm: Fix stage2_flush_memslot for 4 level page table + - [arm64] numa: Report correct memblock range for the dummy node + - ath10k: fix vdev-start timeout on error + - rtlwifi: btcoex: Use proper enumerated types for Wi-Fi only interface + - ata: ahci_brcm: Allow using driver or DSL SoCs + - PM / devfreq: Fix devfreq_add_device() when drivers are built as modules. + - PM / devfreq: Fix handling of min/max_freq == 0 + - PM / devfreq: stopping the governor before device_unregister() + - ath9k: fix reporting calculated new FFT upper max + - selftests/tls: Fix recv(MSG_PEEK) & splice() test cases + - usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in + fotg210_get_status() + - usb: dwc3: gadget: Check ENBLSLPM before sending ep command + - nl80211: Fix a GET_KEY reply attribute + - [arm64,armhf] irqchip/irq-mvebu-icu: Fix wrong private data retrieval + - watchdog: core: fix null pointer dereference when releasing cdev + - watchdog: w83627hf_wdt: Support NCT6796D, NCT6797D, NCT6798D + - [ppc64el,powerpc64] Inform the userspace about TCE update failures + - printk: Do not miss new messages when replaying the log + - printk: CON_PRINTBUFFER console registration is a bit racy + - dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction + - dmaengine: timb_dma: Use proper enum in td_prep_slave_sg + - [x86] ALSA: hda: Fix mismatch for register mask and value in ext + controller. + - ext4: fix build error when DX_DEBUG is defined + - clk: keystone: Enable TISCI clocks if K3_ARCH + - sunrpc: Fix connect metrics + - [x86] PCI: Apply VMD's AERSID fixup generically + - mei: samples: fix a signedness bug in amt_host_if_call() + - cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update + - cxgb4: Use proper enum in IEEE_FAUX_SYNC + - [ppc64el,powerpc*] Fix DTL buffer registration + - [ppc64el,powerpc*] Fix how we iterate over the DTL entries + - [ppc64el,powerpc*] xive: Move a dereference below a NULL test + - mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer + - PM / hibernate: Check the success of generating md5 digest before + hibernation + - tools: PCI: Fix compilation warnings + - ice: Fix forward to queue group logic + - md: allow metadata updates while suspending an array - fix + - ixgbe: Fix ixgbe TX hangs with XDP_TX beyond queue limit + - i40e: Use proper enum in i40e_ndo_set_vf_link_state + - ixgbe: Fix crash with VFs and flow director on interface flap + - IB/mthca: Fix error return code in __mthca_init_one() + - IB/rxe: avoid srq memory leak + - RDMA/hns: Bugfix for reserved qp number + - RDMA/hns: Submit bad wr when post send wr exception + - RDMA/hns: Bugfix for CM test + - RDMA/hns: Limit the size of extend sge of sq + - IB/mlx4: Avoid implicit enumerated type conversion + - rpmsg: glink: smem: Support rx peak for size less than 4 bytes + - msm/gpu/a6xx: Force of_dma_configure to setup DMA for GMU + - OPP: Return error on error from dev_pm_opp_get_opp_count() + - ACPICA: Never run _REG on system_memory and system_IO + - cpuidle: menu: Fix wakeup statistics updates for polling state + - ASoC: qdsp6: q6asm-dai: checking NULL vs IS_ERR() + - [ppc64el,powerpc*] time: Use clockevents_register_device(), fixing an + issue with large decrementer + - [ppc64el,powerpc64] radix: Explicitly flush ERAT with local LPID + invalidation + - ata: ep93xx: Use proper enums for directions + - qed: Avoid implicit enum conversion in qed_ooo_submit_tx_buffers + - media: rc: ir-rc6-decoder: enable toggle bit for Kathrein RCU-676 remote + - media: pxa_camera: Fix check for pdev->dev.of_node + - media: rcar-vin: fix redeclaration of symbol + - media: i2c: adv748x: Support probing a single output + - [x86] ALSA: hda/sigmatel - Disable automute for Elo VuPoint + - bnxt_en: return proper error when FW returns + HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED + - [ppc64el,powerpc64] Book3S PR: Exiting split hack mode needs to fixup both + PC and LR + - USB: serial: cypress_m8: fix interrupt-out transfer length + - usb: dwc2: disable power_down on rockchip devices + - mtd: physmap_of: Release resources on error + - cpu/SMT: State SMT is disabled even with nosmt and without "=force" + - brcmfmac: reduce timeout for action frame scan + - brcmfmac: fix full timeout waiting for action frame on-channel tx + - qtnfmac: request userspace to do OBSS scanning if FW can not + - qtnfmac: pass sgi rate info flag to wireless core + - qtnfmac: inform wireless core about supported extended capabilities + - qtnfmac: drop error reports for out-of-bounds key indexes + - [armhf] clk: samsung: Use NOIRQ stage for Exynos5433 clocks suspend/resume + - [armhf] clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or + Exynos5420 + - [armhf] clk: samsung: Use clk_hw API for calling clk framework from + clk notifiers + - printk: Correct wrong casting + - NFSv4.x: fix lock recovery during delegation recall + - dmaengine: ioat: fix prototype of ioat_enumerate_channels + - media: ov5640: fix framerate update + - media: cec-gpio: select correct Signal Free Time + - gfs2: slow the deluge of io error messages + - i2c: omap: use core to detect 'no zero length' quirk + - i2c: qup: use core to detect 'no zero length' quirk + - i2c: tegra: use core to detect 'no zero length' quirk + - i2c: zx2967: use core to detect 'no zero length' quirk + - Input: st1232 - set INPUT_PROP_DIRECT property + - Input: silead - try firmware reload after unsuccessful resume + - soc: fsl: bman_portals: defer probe after bman's probe + - net: hns3: Fix for rx vlan id handle to support Rev 0x21 hardware + - tc-testing: fix build of eBPF programs + - remoteproc: Check for NULL firmwares in sysfs interface + - remoteproc: qcom: q6v5: Fix a race condition on fatal crash + - kexec: Allocate decrypted control pages for kdump if SME is enabled + - [x86] olpc: Fix build error with CONFIG_MFD_CS5535=m + - dmaengine: rcar-dmac: set scatter/gather max segment size + - xfrm: use correct size to initialise sp->ovec + - ACPI / SBS: Fix rare oops when removing modules + - iwlwifi: mvm: don't send keys when entering D3 + - xsk: proper AF_XDP socket teardown ordering + - [amd64] fsgsbase: Fix ptrace() to read the FS/GS base accurately + - mmc: renesas_sdhi_internal_dmac: Whitelist r8a774a1 + - mmc: tmio: Fix SCC error detection + - mmc: renesas_sdhi_internal_dmac: set scatter/gather max segment size + - fbdev: sbuslib: use checked version of put_user() + - fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() + - fbdev: fix broken menu dependencies + - reset: Fix potential use-after-free in __of_reset_control_get() + - bcache: account size of buckets used in uuid write to + ca->meta_sectors_written + - bcache: recal cached_dev_sectors on detach + - [x86] platform: mlx-platform: Properly use mlxplat_mlxcpld_msn201x_items + - media: dw9714: Fix error handling in probe function + - media: dw9807-vcm: Fix probe error handling + - media: cx18: Don't check for address of video_dev + - mtd: spi-nor: cadence-quadspi: Use proper enum for dma_[un]map_single + - mtd: devices: m25p80: Make sure WRITE_EN is issued before each write + - [x86] intel_rdt: Introduce utility to obtain CDP peer + - [x86] intel_rdt: CBM overlap should also check for overlap with CDP peer + - mmc: mmci: expand startbiterr to irqmask and error check + - [s390x] kasan: avoid vdso instrumentation + - [s390x] kasan: avoid instrumentation of early C code + - [s390x] kasan: avoid user access code instrumentation + - [i386] proc/vmcore: Fix i386 build error of missing + copy_oldmem_page_encrypted() + - backlight: lm3639: Unconditionally call led_classdev_unregister + - mfd: ti_am335x_tscadc: Keep ADC interface on if child is wakeup capable + - printk: Give error on attempt to set log buffer length to over 2G + - media: isif: fix a NULL pointer dereference bug + - GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads + - media: cx231xx: fix potential sign-extension overflow on large shift + - media: venus: vdec: fix decoded data size + - [x86] ALSA: hda/ca0132 - Fix input effect controls for desktop cards + - lightnvm: pblk: fix rqd.error return value in pblk_blk_erase_sync + - lightnvm: pblk: fix incorrect min_write_pgs + - lightnvm: pblk: guarantee emeta on line close + - lightnvm: pblk: fix write amplificiation calculation + - lightnvm: pblk: guarantee mw_cunits on read buffer + - lightnvm: do no update csecs and sos on 1.2 + - lightnvm: pblk: fix error handling of pblk_lines_init() + - lightnvm: pblk: consider max hw sectors supported for max_write_pgs + - [x86] kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error + - bpf: btf: Fix a missing check bug + - net: fix generic XDP to handle if eth header was mangled + - gpio: syscon: Fix possible NULL ptr usage + - spi: fsl-lpspi: Prevent FIFO under/overrun by default + - pinctrl: gemini: Mask and set properly + - spi: spidev: Fix OF tree warning logic + - [armel,armhf] 8802/1: Call syscall_trace_exit even when system call + skipped + - [x86] mm: Do not warn about PCI BIOS W+X mappings + - orangefs: rate limit the client not running info message + - pinctrl: gemini: Fix up TVC clock group + - scsi: arcmsr: clean up clang warning on extraneous parentheses + - [x86] hwmon: (k10temp) Support all Family 15h Model 6xh and Model 7xh + processors + - hwmon: (nct6775) Fix names of DIMM temperature sources + - hwmon: (pwm-fan) Silence error on probe deferral + - hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros + - hwmon: (npcm-750-pwm-fan) Change initial pwm target to 255 + - selftests: forwarding: Have lldpad_app_wait_set() wait for unknown, too + - net: sched: avoid writing on noop_qdisc + - netfilter: nft_compat: do not dump private area + - misc: cxl: Fix possible null pointer dereference + - mac80211: minstrel: fix using short preamble CCK rates on HT clients + - mac80211: minstrel: fix CCK rate group streams value + - mac80211: minstrel: fix sampling/reporting of CCK rates in HT mode + - spi: rockchip: initialize dma_slave_config properly + - mlxsw: spectrum_switchdev: Check notification relevance based on upper + device + - [armhf] dts: omap5: Fix dual-role mode on Super-Speed port + - tcp: start receiver buffer autotuning sooner + - ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for + hibernate + - PM / devfreq: Fix static checker warning in try_then_request_governor + - tools: PCI: Fix broken pcitest compilation + - [ppc64el,powerpc*] time: Fix clockevent_decrementer initalisation for + PR KVM + - mmc: tmio: fix SCC error handling to avoid false positive CRC error + - [x86] resctrl: Fix rdt_find_domain() return value and checks + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.87 + - mlxsw: spectrum_router: Fix determining underlay for a GRE tunnel + - net/mlx4_en: fix mlx4 ethtool -N insertion + - net/mlx4_en: Fix wrong limitation for number of TX rings + - net: rtnetlink: prevent underflows in do_setvfinfo() + - net/sched: act_pedit: fix WARN() in the traffic path + - net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key + - sfc: Only cancel the PPS workqueue if it exists + - net/mlx5e: Fix set vf link state error flow + - net/mlxfw: Verify FSM error code translation doesn't exceed array size + - net/mlx5: Fix auto group size calculation + - vhost/vsock: split packets to send using multiple buffers + - gpio: max77620: Fixup debounce delays + - tools: gpio: Correctly add make dependencies for gpio_utils + - nbd:fix memory leak in nbd_get_socket() + - virtio_console: allocate inbufs in add_port() only if it is needed + - Revert "fs: ocfs2: fix possible null-pointer dereferences in + ocfs2_xa_prepare_entry()" + - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() + - [x86] drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported + ASICs + - [x86] drm/i915/pmu: "Frequency" is reported as accumulated cycles + - [x86] drm/i915/userptr: Try to acquire the page lock around + set_page_dirty() + - mwifiex: Fix NL80211_TX_POWER_LIMITED + - ALSA: isight: fix leak of reference to firewire unit in error path of + .probe callback + - crypto: testmgr - fix sizeof() on COMP_BUF_SIZE + - printk: lock/unlock console only for new logbuf entries + - printk: fix integer overflow in setup_log_buf() + - pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux + - PCI: cadence: Write MSI data with 32bits + - gfs2: Fix marking bitmaps non-full + - pty: fix compat ioctls + - synclink_gt(): fix compat_ioctl() + - [ppc64] Fix signedness bug in update_flash_db() + - [powerpc] boot: Fix opal console in boot wrapper + - [ppc64*,powerpc] boot: Disable vector instructions + - [ppc64*,powerpc] eeh: Fix null deref for devices removed during EEH + - [ppc64*,powerpc] eeh: Fix use of EEH_PE_KEEP on wrong field + - EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() + - mt76: do not store aggregation sequence number for null-data frames + - mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc + - brcmsmac: AP mode: update beacon when TIM changes + - ath10k: set probe request oui during driver start + - ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem + - skd: fixup usage of legacy IO API + - cdrom: don't attempt to fiddle with cdo->capability + - spi: sh-msiof: fix deferred probing + - mmc: mediatek: fill the actual clock for mmc debugfs + - mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail + - PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI + - btrfs: defrag: use btrfs_mod_outstanding_extents in + cluster_pages_for_defrag + - btrfs: handle error of get_old_root + - gsmi: Fix bug in append_to_eventlog sysfs handler + - misc: mic: fix a DMA pool free failure + - w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u + for unsigned, count for max size). + - [m68k] fix command-line parsing when passed from u-boot + - RDMA/bnxt_re: Avoid NULL check after accessing the pointer + - RDMA/bnxt_re: Fix qp async event reporting + - RDMA/bnxt_re: Avoid resource leak in case the NQ registration fails + - pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' + - pwm: lpss: Only set update bit if we are actually changing the settings + - amiflop: clean up on errors during setup + - qed: Align local and global PTT to propagate through the APIs. + - scsi: ips: fix missing break in switch + - nfp: bpf: protect against mis-initializing atomic counters + - [x86] KVM: nVMX: reset cache/shadows when switching loaded VMCS + - [x86] KVM: nVMX: move check_vmentry_postreqs() call to + nested_vmx_enter_non_root_mode() + - [x86] KVM: Fix invvpid and invept register operand size in 64-bit mode + - clk: tegra: Fixes for MBIST work around + - scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler + - scsi: isci: Change sci_controller_start_task's return type to sci_status + - scsi: bfa: Avoid implicit enum conversion in bfad_im_post_vendor_event + - scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param + - nvmet: avoid integer overflow in the discard code + - nvmet-fcloop: suppress a compiler warning + - nvme-pci: fix hot removal during error handling + - PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks + - clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk + - ASoC: tegra_sgtl5000: fix device_node refcounting + - scsi: dc395x: fix dma API usage in srb_done + - scsi: dc395x: fix DMA API usage in sg_update_list + - scsi: zorro_esp: Limit DMA transfers to 65535 bytes + - net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed + - net: fix warning in af_unix + - xfs: fix use-after-free race in xfs_buf_rele + - xfs: clear ail delwri queued bufs on unmount of shutdown fs + - kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on + bad stack + - ACPI / scan: Create platform device for INT33FE ACPI nodes + - PM / Domains: Deal with multiple states but no governor in genpd + - ALSA: i2c/cs8427: Fix int to char conversion + - macintosh/windfarm_smu_sat: Fix debug output + - PCI: vmd: Detach resources after stopping root bus + - USB: misc: appledisplay: fix backlight update_status return code + - usbip: tools: fix atoi() on non-null terminated string + - sctp: use sk_wmem_queued to check for writable space + - dm raid: avoid bitmap with raid4/5/6 journal device + - selftests/bpf: fix file resource leak in load_kallsyms + - SUNRPC: Fix a compile warning for cmpxchg64() + - sunrpc: safely reallow resvport min/max inversion + - atm: zatm: Fix empty body Clang warnings + - [s390x] perf: Return error when debug_register fails + - swiotlb: do not panic on mapping failures + - spi: omap2-mcspi: Set FIFO DMA trigger level to word length + - [x86] intel_rdt: Prevent pseudo-locking from using stale pointers + - sparc: Fix parport build warnings. + - [ppc64*,powerpc] pseries: Export raw per-CPU VPA data via debugfs + - [ppc64*,powerpc] mm/radix: Fix off-by-one in split mapping logic + - [ppc64*,powerpc] mm/radix: Fix overuse of small pages in splitting logic + - [ppc64*,powerpc] mm/radix: Fix small page at boundary when splitting + - [ppc64*] radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd + - selftests/bpf: fix return value comparison for tests in test_libbpf.sh + - tools: bpftool: fix completion for "bpftool map update" + - ceph: fix dentry leak in ceph_readdir_prepopulate + - ceph: only allow punch hole mode in fallocate + - thermal: armada: fix a test in probe() + - f2fs: fix to spread clear_cold_data() + - f2fs: spread f2fs_set_inode_flags() + - mISDN: Fix type of switch control variable in ctrl_teimanager + - qlcnic: fix a return in qlcnic_dcb_get_capability() + - net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode + - mfd: arizona: Correct calling of runtime_put_sync + - mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values + - [x86] mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well + - mfd: max8997: Enale irq-wakeup unconditionally + - net: socionext: Stop PHY before resetting netsec + - fs/cifs: fix uninitialised variable warnings + - spi: uniphier: fix incorrect property items + - selftests/ftrace: Fix to test kprobe $comm arg only if available + - selftests: watchdog: fix message when /dev/watchdog open fails + - selftests: watchdog: Fix error message. + - selftests: kvm: Fix -Wformat warnings + - selftests: fix warning: "_GNU_SOURCE" redefined + - net: ethernet: cadence: fix socket buffer corruption problem + - bpf: devmap: fix wrong interface selection in notifier_call + - bpf, btf: fix a missing check bug in btf_parse + - [sparc64] Rework xchg() definition to avoid warnings. + - [arm64] lib: use C string functions with KASAN enabled + - fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in + dlm_print_one_mle() + - mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock + - tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage + - mm: thp: fix MADV_DONTNEED vs + migrate_misplaced_transhuge_page race condition + - macsec: update operstate when lower device changes + - macsec: let the administrator set UP state even if lowerdev is down + - block: fix the DISCARD request merge + - i2c: uniphier-f: make driver robust against concurrency + - i2c: uniphier-f: fix occasional timeout error + - i2c: uniphier-f: fix race condition when IRQ is cleared + - um: Make line/tty semantics use true write IRQ + - vfs: avoid problematic remapping requests into partial EOF block + - ipv4/igmp: fix v1/v2 switchback timeout based on rfc3376, 8.12 + - [ppc64*,powerpc] xmon: Relax frame size for clang + - [ppc64*,powerpc] selftests/ptrace: Fix out-of-tree build + - [ppc64*,powerpc] selftests/signal: Fix out-of-tree build + - [ppc64*,powerpc] selftests/switch_endian: Fix out-of-tree build + - [ppc64*,powerpc] selftests/cache_shape: Fix out-of-tree build + - block: call rq_qos_exit() after queue is frozen + - mm/gup_benchmark.c: prevent integer overflow in ioctl + - linux/bitmap.h: handle constant zero-size bitmaps correctly + - linux/bitmap.h: fix type of nbits in bitmap_shift_right() + - lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf + - hfsplus: fix BUG on bnode parent update + - hfs: fix BUG on bnode parent update + - hfsplus: prevent btree data loss on ENOSPC + - hfs: prevent btree data loss on ENOSPC + - hfsplus: fix return value of hfsplus_get_block() + - hfs: fix return value of hfs_get_block() + - hfsplus: update timestamps on truncate() + - hfs: update timestamp on truncate() + - fs/hfs/extent.c: fix array out of bounds read of array extent + - kernel/panic.c: do not append newline to the stack protector panic string + - mm/memory_hotplug: make add_memory() take the device_hotplug_lock + - mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock + - [ppc64*,powerprc] powerpc/powernv: hold device_hotplug_lock when calling + device_online() + - igb: shorten maximum PHC timecounter update interval + - fm10k: ensure completer aborts are marked as non-fatal after a resume + - [arm64] net: hns3: bugfix for buffer not free problem during resetting + - [arm64] net: hns3: bugfix for reporting unknown vector0 interrupt repeatly + problem + - [arm64] net: hns3: bugfix for is_valid_csq_clean_head() + - [arm64] net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read + - ntb_netdev: fix sleep time mismatch + - [x86] ntb: intel: fix return value for ndev_vec_mask() + - irq/matrix: Fix memory overallocation + - nvme-pci: fix conflicting p2p resource adds + - [arm64] makefile fix build of .i file in external module case + - [x86] tools/power turbosat: fix AMD APIC-id output + - mm: handle no memcg case in memcg_kmem_charge() properly + - ocfs2: without quota support, avoid calling quota recovery + - ocfs2: don't use iocb when EIOCBQUEUED returns + - ocfs2: don't put and assigning null to bh allocated outside + - ocfs2: fix clusters leak in ocfs2_defrag_extent() + - net: do not abort bulk send on BQL status + - sched/topology: Fix off by one bug + - sched/fair: Don't increase sd->balance_interval on newidle balance + - openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS + - [armhf] dts: imx6sx-sdb: Fix enet phy regulator + - [arm64] sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock + - soc: bcm: brcmstb: Fix re-entry point with a THUMB2_KERNEL + - audit: print empty EXECVE args + - sock_diag: fix autoloading of the raw_diag module + - net: bpfilter: fix iptables failure if bpfilter_umh is disabled + - nds32: Fix bug in bitfield.h + - media: ov13858: Check for possible null pointer + - btrfs: avoid link error with CONFIG_NO_AUTO_INLINE + - wil6210: fix debugfs memory access alignment + - wil6210: fix L2 RX status handling + - wil6210: fix RGF_CAF_ICR address for Talyn-MB + - wil6210: fix locking in wmi_call + - ath10k: snoc: fix unbalanced clock error handling + - wlcore: Fix the return value in case of error in + 'wlcore_vendor_cmd_smart_config_start()' + - rtl8xxxu: Fix missing break in switch + - brcmsmac: never log "tid x is not agg'able" by default + - wireless: airo: potential buffer overflow in sprintf() + - rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information + - net: dsa: bcm_sf2: Turn on PHY to allow successful registration + - scsi: mpt3sas: Fix Sync cache command failure during driver unload + - scsi: mpt3sas: Don't modify EEDPTagMode field setting on SAS3.5 HBA + devices + - scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing + page11 + - scsi: megaraid_sas: Fix msleep granularity + - scsi: megaraid_sas: Fix goto labels in error handling + - scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces + - scsi: lpfc: Fix odd recovery in duplicate FLOGIs in point-to-point + - scsi: lpfc: Correct loss of fc4 type on remote port address change + - usb: typec: tcpm: charge current handling for sink during hard reset + - dlm: fix invalid free + - dlm: don't leak kernel pointer to userspace + - vrf: mark skb for multicast or link-local as enslaved to VRF + - clk: tegra20: Turn EMC clock gate into divider + - ACPICA: Use %d for signed int print formatting instead of %u + - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down + - of: unittest: allow base devicetree to have symbol metadata + - of: unittest: initialize args before calling of_*parse_*() + - tools: bpftool: pass an argument to silence open_obj_pinned() + - cfg80211: Prevent regulatory restore during STA disconnect in concurrent + interfaces + - pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues + - pinctrl: bcm2835: Use define directive for BCM2835_PINCONF_PARAM_PULL + - pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT + - pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD + - PCI: keystone: Use quirk to limit MRRS for K2G + - nvme-pci: fix surprise removal + - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch + - i2c: uniphier-f: fix timeout error after reading 8 bytes + - mm/memory_hotplug: Do not unlock when fails to take the + device_hotplug_lock + - ipv6: Fix handling of LLA with VRF and sockets bound to VRF + - cfg80211: call disconnect_wk when AP stops + - mm/page_io.c: do not free shared swap slots + - Bluetooth: Fix invalid-free in bcsp_close() + - KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved + - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe + - ath9k_hw: fix uninitialized variable data + - md/raid10: prevent access of uninitialized resync_pages offset + - mm/memory_hotplug: don't access uninitialized memmaps in + shrink_zone_span() + - net: phy: dp83867: fix speed 10 in sgmii mode + - net: phy: dp83867: increase SGMII autoneg timer duration + - ocfs2: remove ocfs2_is_o2cb_active() + - [arm*] 8904/1: skip nomap memblocks while finding the + lowmem/highmem boundary + - ARC: perf: Accommodate big-endian CPU + - [x86] insn: Fix awk regexp warnings + - [x86] speculation: Fix incorrect MDS/TAA mitigation status + - [x86] speculation: Fix redundant MDS mitigation message + - nbd: prevent memory leak + - y2038: futex: Move compat implementation into futex.c + - futex: Prevent robust futex exit race + - ALSA: usb-audio: Fix NULL dereference at parsing BADD + - nfc: port100: handle command failure cleanly + - media: vivid: Set vid_cap_streaming and vid_out_streaming to true + - media: vivid: Fix wrong locking that causes race conditions on streaming + stop (CVE-2019-18683) + - media: usbvision: Fix races among open, close, and disconnect + - cpufreq: Add NULL checks to show() and store() methods of cpufreq + - media: uvcvideo: Fix error path in control parsing failure + - media: b2c2-flexcop-usb: add sanity checking + - media: cxusb: detect cxusb_ctrl_msg error in query + - media: imon: invalid dereference in imon_touch_event + - virtio_ring: fix return code on DMA mapping fails + - USBIP: add config dependency for SGL_ALLOC + - usbip: tools: fix fd leakage in the function of read_attr_usbip_status + - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() + - usb-serial: cp201x: support Mark-10 digital force gauge + - USB: chaoskey: fix error case of a timeout + - appledisplay: fix error handling in the scheduled work + - USB: serial: mos7840: add USB ID to support Moxa UPort 2210 + - USB: serial: mos7720: fix remote wakeup + - USB: serial: mos7840: fix remote wakeup + - USB: serial: option: add support for DW5821e with eSIM support + - USB: serial: option: add support for Foxconn T77W968 LTE modules + - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error + - [ppc64*] support nospectre_v2 cmdline option + - [ppc64*] book3s: Fix link stack flush on context switch (CVE-2019-18660) + - [ppc64*, powerpc] PPC: Book3S HV: Flush link stack on guest exit to host + kernel + - PM / devfreq: Fix kernel oops on governor module load + + [ Romain Perier ] + * [armel/rpi] Enable CONFIG_BRCMFMAC_SDIO (Closes: #940530) + * [armhf, arm64] Backport devicetree for enabling support for the + Raspberry PI 3 A+ + + [ Salvatore Bonaccorso ] + * ixgbe: Fix secpath usage for IPsec TX offload (Closes: #930443) + * ipv4: Return -ENETUNREACH if we can't create route but saddr is valid + (Closes: #945023) + * [x86] KVM: x86: introduce is_pae_paging (Regression in 4.19.77) + * [rt] Refresh 0011-sched-fair-Robustify-CFS-bandwidth-timer-locking.patch + (context changes in 4.19.84) + + [ Bastian Blank ] + * [amd64/cloud-amd64] Re-enable RTC drivers. (closes: #931341) + + [ Noah Meyerhans ] + * drivers/net/ethernet/amazon: Backport driver fixes from Linux 5.4 + (Closes: #941291) + * Bump ABI to 7 + + [ Ben Hutchings ] + * debian/bin/genpatch-rt: Fix series generation from git + * [rt] Update to 4.19.82-rt30: + - Drop changes in "fs/dcache: disable preemption on i_dir_seq's write side" + that conflict with "Fix the locking in dcache_readdir() and friends" + - Rewrite "fs/aio: simple simple work" using kthread_work + - Rewrite "thermal: Defer thermal wakups to threads" using kthread_work + - Rewrite "block: blk-mq: move blk_queue_usage_counter_release() into + process context" using kthread_work + - workqueue: rework + + [ Benjamin Poirier ] + * tools/perf: Add python3 support to scripts (Closes: #944641) + + [ Aurelien Jarno ] + * [rt] Refresh 0025-NFSv4-replace-seqcount_t-with-a-seqlock_t.patch (context + changes in 4.19.86) + * [rt] Refresh 0202-net-Qdisc-use-a-seqlock-instead-seqcount.patch (context + changes in 4.19.86) + * [rt] Refresh 0057-printk-Add-a-printk-kill-switch.patch (context changes + in 4.19.87) + * [rt] Refresh 0207-printk-Make-rt-aware.patch (context changes in 4.19.87) + + -- Salvatore Bonaccorso <carnil@debian.org> Tue, 03 Dec 2019 06:58:41 +0100 + +linux (4.19.67-2+deb10u2) buster-security; urgency=high + + * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135): + - KVM: x86: use Intel speculation bugs and features as derived in generic + x86 code + - x86/msr: Add the IA32_TSX_CTRL MSR + - x86/cpu: Add a helper function x86_read_arch_cap_msr() + - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default + - x86/speculation/taa: Add mitigation for TSX Async Abort + - x86/speculation/taa: Add sysfs reporting for TSX Async Abort + - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled + - x86/tsx: Add "auto" option to the tsx= cmdline parameter + - x86/speculation/taa: Add documentation for TSX Async Abort + - x86/tsx: Add config options to set tsx=on|off|auto + - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs + TSX is now disabled by default; see + Documentation/admin-guide/hw-vuln/tsx_async_abort.rst + * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change + (aka iTLB multi-hit, CVE-2018-12207): + - kvm: Convert kvm_lock to a mutex + - kvm: x86: Do not release the page inside mmu_set_spte() + - KVM: x86: make FNAME(fetch) and __direct_map more similar + - KVM: x86: remove now unneeded hugepage gfn adjustment + - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON + - KVM: x86: add tracepoints around __direct_map and FNAME(fetch) + - kvm: x86, powerpc: do not allow clearing largepages debugfs entry + - KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active + - x86/bugs: Add ITLB_MULTIHIT bug infrastructure + - cpu/speculation: Uninline and export CPU mitigations helpers + - kvm: mmu: ITLB_MULTIHIT mitigation + - kvm: Add helper function for creating VM worker threads + - kvm: x86: mmu: Recovery of shattered NX large pages + - Documentation: Add ITLB_MULTIHIT documentation + * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155): + - drm/i915: Rename gen7 cmdparser tables + - drm/i915: Disable Secure Batches for gen6+ + - drm/i915: Remove Master tables from cmdparser + - drm/i915: Add support for mandatory cmdparsing + - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers + - drm/i915: Allow parsing of unsized batches + - drm/i915: Add gen9 BCS cmdparsing + - drm/i915/cmdparser: Use explicit goto for error paths + - drm/i915/cmdparser: Add support for backward jumps + - drm/i915/cmdparser: Ignore Length operands during command matching + - drm/i915/cmdparser: Fix jump whitelist clearing + * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154): + - drm/i915: Lower RM timeout to avoid DSI hard hangs + - drm/i915/gen8+: Add RC6 CTX corruption WA + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 11 Nov 2019 00:30:56 +0000 + +linux (4.19.67-2+deb10u1) buster-security; urgency=high + + [ Romain Perier ] + * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) + * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term + (CVE-2019-15118) + + [ Salvatore Bonaccorso ] + * vhost: make sure log_num < in_num (CVE-2019-14835) + * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) + * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 20 Sep 2019 12:51:55 +0200 + +linux (4.19.67-2) buster; urgency=medium + + [ Salvatore Bonaccorso ] + * dm: disable DISCARD if the underlying storage no longer supports it + (Closes: #934331) + * xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT + (CVE-2019-15538) + + [ Ben Hutchings ] + * KVM: Ignore ABI changes + * [ppc64el] Disable PPC_TRANSACTIONAL_MEM (Closes: #866122) + * [ppc64el] Avoid ABI change for disabling TM + * netfilter: conntrack: Use consistent ct id hash calculation + (fixes regression in 4.19.44) + + [ Cyril Brulebois ] + * [arm] Backport DTB support for Rasperry Pi Compute Module 3. + * [arm64] Backport DTB support for Rasperry Pi Compute Module 3. + + -- Salvatore Bonaccorso <carnil@debian.org> Wed, 28 Aug 2019 06:20:22 +0200 + +linux (4.19.67-1) buster; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.38 + - netfilter: nft_compat: use refcnt_t type for nft_xt reference count + - netfilter: nft_compat: make lists per netns + - netfilter: nf_tables: split set destruction in deactivate and destroy + phase + - netfilter: nft_compat: destroy function must not have side effects + - netfilter: nf_tables: warn when expr implements only one of + activate/deactivate + - netfilter: nf_tables: unbind set in rule from commit path + - netfilter: nft_compat: don't use refcount_inc on newly allocated entry + - netfilter: nft_compat: use .release_ops and remove list of extension + - netfilter: nf_tables: fix set double-free in abort path + - netfilter: nf_tables: bogus EBUSY when deleting set after flush + - netfilter: nf_tables: bogus EBUSY in helper removal from transaction + - net/ibmvnic: Fix RTNL deadlock during device reset + - net: mvpp2: fix validate for PPv2.1 + - ext4: fix some error pointer dereferences + - tipc: handle the err returned from cmd header function + - loop: do not print warn message if partition scan is successful + - [armhf,arm64] drm/rockchip: fix for mailbox read validation. + - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock + - ipvs: fix warning on unused variable + - [ppc64el] vdso32: fix CLOCK_MONOTONIC on PPC64 + - [armhf,arm64] net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init + to probe for new DSA framework + - cifs: fix memory leak in SMB2_read + - cifs: do not attempt cifs operation on smb2+ rename error + - tracing: Fix a memory leak by early error exit in trace_pid_write() + - zram: pass down the bvec we need to read into in the work struct + - trace: Fix preempt_enable_no_resched() abuse + - IB/rdmavt: Fix frwr memory registration + - RDMA/mlx5: Do not allow the user to write to the clock page + - sched/numa: Fix a possible divide-by-zero + - ceph: only use d_name directly when parent is locked + - ceph: ensure d_name stability in ceph_dentry_hash() + - ceph: fix ci->i_head_snapc leak + - nfsd: Don't release the callback slot unless it was actually held + - sunrpc: don't mark uninitialised items as VALID. + - [x86] perf/intel: Update KBL Package C-state events to also include + PC8/PC9/PC10 counters + - Input: synaptics-rmi4 - write config register values to the right offset + - [armhf] 8857/1: efi: enable CP15 DMB instructions before cleaning the + cache + - [ppc64el] mm/radix: Make Radix require HUGETLB_PAGE + - [arm*] drm/vc4: Fix memory leak during gpu reset. + - [x86] Revert "drm/i915/fbdev: Actually configure untiled displays" + - USB: Add new USB LPM helpers + - USB: Consolidate LPM checks to avoid enabling LPM twice + - slip: make slhc_free() silently accept an error pointer + - [x86] intel_th: gth: Fix an off-by-one in output unassigning + - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference + - workqueue: Try to catch flush_work() without INIT_WORK(). + - sched/deadline: Correctly handle active 0-lag timers + - NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family. + - netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON + - fm10k: Fix a potential NULL pointer dereference + - tipc: check bearer name with right length in tipc_nl_compat_bearer_enable + - tipc: check link name with right length in tipc_nl_compat_link_set + - net: netrom: Fix error cleanup path of nr_proto_init + - net/rds: Check address length before reading address family + - rxrpc: fix race condition in rxrpc_input_packet() + - [x86] retpolines: Raise limit for generating indirect calls from + switch-case + - [x86] retpolines: Disable switch jump tables when retpolines are enabled + - mm: Fix warning in insert_pfn() + - [x86] fpu: Don't export __kernel_fpu_{begin,end}() + - ipv4: add sanity checks in ipv4_link_failure() + - ipv4: set the tcp_min_rtt_wlen range from 0 to one day + - net/mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query + - net: rds: exchange of 8K and 1M pool + - net/rose: fix unbound loop in rose_loopback_timer() + - [armhf,arm64] net: stmmac: move stmmac_check_ether_addr() to driver probe + - team: fix possible recursive locking when add slaves + - [arm64] net: hns: Fix WARNING when hns modules installed + - net/mlx5e: Fix the max MTU check in case of XDP + - net/mlx5e: Fix use-after-free after xdp_return_frame + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.39 + - selinux: use kernel linux/socket.h for genheaders and mdp + - Revert "ACPICA: Clear status of GPEs before enabling them" + - [arm*] dts: bcm283x: Fix hdmi hpd gpio pull + - [s390x] limit brk randomization to 32MB + - net: ieee802154: fix a potential NULL pointer dereference + - ieee802154: hwsim: propagate genlmsg_reply return code + - [armhf,arm64] net: stmmac: don't set own bit too early for jumbo frames + - qlcnic: Avoid potential NULL pointer dereference + - xsk: fix umem memory leak on cleanup + - netfilter: nft_set_rbtree: check for inactive element after flag mismatch + - netfilter: bridge: set skb transport_header before entering + NF_INET_PRE_ROUTING + - netfilter: fix NETFILTER_XT_TARGET_TEE dependencies + - netfilter: ip6t_srh: fix NULL pointer dereferences + - [s390x] qeth: fix race when initializing the IP address table + - [armhf] imx51: fix a leaked reference by adding missing of_node_put + - [arm64] KVM: Reset the PMU in preemptible context + - [armhf,arm64] KVM: vgic-its: Take the srcu lock when writing to guest + memory + - [armhf,arm64] KVM: vgic-its: Take the srcu lock when parsing the memslots + - [x86] usb: dwc3: pci: add support for Comet Lake PCH ID + - usb: gadget: net2280: Fix overrun of OUT messages + - usb: gadget: net2280: Fix net2280_dequeue() + - [x86] i2c: i801: Add support for Intel Comet Lake + - staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc + - staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer + dereference + - staging: rtl8712: uninitialized memory in read_bbreg_hdl() + - staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc + - [arm64] net: macb: Add null check for PCLK and HCLK + - net/sched: don't dereference a->goto_chain to read the chain index + - [armhf] dts: imx6qdl: Fix typo in imx6qdl-icore-rqs.dtsi + - [armhf,arm64] drm/tegra: hub: Fix dereference before check + - NFS: Fix a typo in nfs_init_timeout_values() + - drm: Fix drm_release() and device unplug + - [arm64] drm/meson: Fix invalid pointer in meson_drv_unbind() + - [arm64] drm/meson: Uninstall IRQ handler + - scsi: mpt3sas: Fix kernel panic during expander reset + - scsi: aacraid: Insure we don't access PCIe space during AER/EEH + - scsi: qla4xxx: fix a potential NULL pointer dereference + - leds: trigger: netdev: fix refcnt leak on interface rename + - [x86] realmode: Don't leak the trampoline kernel address + - usb: u132-hcd: fix resource leak + - ceph: fix use-after-free on symlink traversal + - [s390x] scsi: zfcp: reduce flood of fcrscn1 trace records on multi- + element RSCN + - [x86] mm: Don't exceed the valid physical address space + - libata: fix using DMA buffers on stack + - gpio: of: Fix of_gpiochip_add() error path + - nvme-multipath: relax ANA state check + - perf machine: Update kernel map address and re-order properly + - [x86] iommu/amd: Reserve exclusion range in iova-domain + - ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK + - leds: trigger: netdev: use memcpy in device_name_store + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.40 + - ipv4: ip_do_fragment: Preserve skb_iif during fragmentation + - ipv6: A few fixes on dereferencing rt->from + - ipv6: fix races in ip6_dst_destroy() + - ipv6/flowlabel: wait rcu grace period before put_pid() + - ipv6: invert flowlabel sharing check in process and user mode + - l2ip: fix possible use-after-free + - l2tp: use rcu_dereference_sk_user_data() in l2tp_udp_encap_recv() + - [armhf] net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc + - net: phy: marvell: Fix buffer overrun with stats counters + - rxrpc: Fix net namespace cleanup + - sctp: avoid running the sctp state machine recursively + - packet: validate msg_namelen in send directly + - bnxt_en: Improve multicast address setup logic. + - bnxt_en: Free short FW command HWRM memory in error path in + bnxt_init_one() + - bnxt_en: Fix uninitialized variable usage in bnxt_rx_pkt(). + - [x86] KVM: Whitelist port 0x7e for pre-incrementing %rip + - [x86] KVM: nVMX: Fix size checks in vmx_set_nested_state + - ALSA: line6: use dynamic buffers + - ath10k: Drop WARN_ON()s that always trigger during system resume + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.41 + - iwlwifi: fix driver operation for 5350 + - mwifiex: Make resume actually do something useful again on SDIO cards + - mac80211: don't attempt to rename ERR_PTR() debugfs dirs + - [armhf] i2c: imx: correct the method of getting private data in + notifier_call + - i2c: Remove unnecessary call to irq_find_mapping + - i2c: Clear client->irq in i2c_device_remove + - i2c: Allow recovery of the initial IRQ by an I2C client device. + - i2c: Prevent runtime suspend of adapter when Host Notify is required + - [x86] ALSA: hda/realtek - Add new Dell platform for headset mode + - [x86] ALSA: hda/realtek - Fixed Dell AIO speaker noise + - [x86] ALSA: hda/realtek - Apply the fixup for ASUS Q325UAR + - USB: yurex: Fix protection fault after device removal (CVE-2019-15216) + - USB: w1 ds2490: Fix bug caused by improper use of altsetting array + - USB: dummy-hcd: Fix failure to give back unlinked URBs + - usb: usbip: fix isoc packet num validation in get_pipe + - USB: core: Fix unterminated string returned by usb_string() + - USB: core: Fix bug caused by duplicate interface PM usage counter + - nvme-loop: init nvmet_ctrl fatal_err_work when allocate + - [arm64] dts: rockchip: fix rk3328-roc-cc gmac2io tx/rx_delay + - HID: logitech: check the return value of create_singlethread_workqueue + - HID: debug: fix race condition with between rdesc_show() and device + removal + - rtc: cros-ec: Fail suspend/resume if wake IRQ can't be configured + - batman-adv: Reduce claim hash refcnt only for removed entry + - batman-adv: Reduce tt_local hash refcnt only for removed entry + - batman-adv: Reduce tt_global hash refcnt only for removed entry + - batman-adv: fix warning in function batadv_v_elp_get_throughput + - [armhf] dts: rockchip: Fix gpu opp node names for rk3288 + - [arm64] reset: meson-audio-arb: Fix missing .owner setting of + reset_controller_dev + - igb: Fix WARN_ONCE on runtime suspend + - HID: quirks: Fix keyboard + touchpad on Lenovo Miix 630 + - net/mlx5: E-Switch, Fix esw manager vport indication for more vport + commands + - bonding: show full hw address in sysfs for slave entries + - [armhf,arm64] net: stmmac: use correct DMA buffer size in the RX + descriptor + - [armhf,arm64] net: stmmac: ratelimit RX error logs + - [armhf,arm64] net: stmmac: don't stop NAPI processing when dropping a + packet + - [armhf,arm64] net: stmmac: don't overwrite discard_frame status + - [armhf,arm64] net: stmmac: fix dropping of multi-descriptor RX frames + - [armhf,arm64] net: stmmac: don't log oversized frames + - jffs2: fix use-after-free on symlink traversal + - debugfs: fix use-after-free on symlink traversal + - [armhf] mfd: twl-core: Disable IRQ while suspended + - block: use blk_free_flush_queue() to free hctx->fq in blk_mq_init_hctx + - HID: input: add mapping for Assistant key + - vfio/pci: use correct format characters + - scsi: core: add new RDAC LENOVO/DE_Series device + - [x86] scsi: storvsc: Fix calculation of sub-channel count + - [arm64] fix wrong check of on_sdei_stack in nmi context + - [arm64] net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw() + - [arm64] net: hns: Use NAPI_POLL_WEIGHT for hns driver + - [arm64] net: hns: Fix probabilistic memory overwrite when HNS driver + initialized + - [arm64] net: hns: fix ICMP6 neighbor solicitation messages discard + problem + - [arm64] net: hns: Fix WARNING when remove HNS driver with SMMU enabled + - libcxgb: fix incorrect ppmax calculation + - [x86] KVM: SVM: prevent DBG_DECRYPT and DBG_ENCRYPT overflow + - hugetlbfs: fix memory leak for resv_map + - fs: stream_open - opener for stream-like files so that read and write can + run simultaneously without deadlock + - [armel] orion: don't use using 64-bit DMA masks + - block: pass no-op callback to INIT_WORK(). + - [x86] perf/amd: Update generic hardware cache events for Family 17h + - Bluetooth: btusb: request wake pin with NOAUTOEN + - Bluetooth: mediatek: fix up an error path to restore bdev->tx_state + - [arm64] clk: qcom: Add missing freq for usb30_master_clk on 8998 + - scsi: RDMA/srpt: Fix a credit leak for aborted commands + - [x86] ASoC: Intel: bytcr_rt5651: Revert "Fix DMIC map headsetmic mapping" + - [x86] platform: intel_pmc_core: Fix PCH IP name + - [x86] platform: intel_pmc_core: Handle CFL regmap properly + - IB/core: Unregister notifier before freeing MAD security + - IB/core: Fix potential memory leak while creating MAD agents + - IB/core: Destroy QP if XRC QP fails + - selinux: avoid silent denials in permissive mode under RCU walk + - selinux: never allow relabeling on context mounts + - mac80211: Honor SW_CRYPTO_CONTROL for unicast keys in AP VLAN mode + - [ppc64el] mm/hash: Handle mmap_min_addr correctly in get_unmapped_area + topdown search + - [x86] mce: Improve error message when kernel cannot recover, p2 + - [x86] clk: Add system specific quirk to mark clocks as critical + - [x86] mm/KASLR: Fix the size of the direct mapping section + - [x86] mm: Fix a crash with kmemleak_scan() + - [x86] mm/tlb: Revert "x86/mm: Align TLB invalidation info" + - media: v4l2: i2c: ov7670: Fix PLL bypass register values + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.42 + - [armhf,arm64] net: stmmac: Use bfsize1 in ndesc_init_rx_desc + - [x86] Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in + hv_synic_cleanup() + - ASoC: hdmi-codec: fix S/PDIF DAI + - ASoC:soc-pcm:fix a codec fixup issue in TDM case + - [x86] ASoC:intel:skl:fix a simultaneous playback & capture issue on hda + platform + - [arm64] clk: meson-gxbb: round the vdec dividers to closest + - ASoC: dapm: Fix NULL pointer dereference in snd_soc_dapm_free_kcontrol + - [armhf] drm/omap: hdmi4_cec: Fix CEC clock handling for PM + - IB/hfi1: Eliminate opcode tests on mr deref + - IB/hfi1: Fix the allocation of RSM table + - [x86] perf/intel: Fix handling of wakeup_events for multi-entry PEBS + - [x86] perf/intel: Initialize TFA MSR + - linux/kernel.h: Use parentheses around argument in u64_to_user_ptr() + - drm/amd/display: fix cursor black issue + - objtool: Add rewind_stack_do_exit() to the noreturn list + - slab: fix a crash by reading /proc/slab_allocators + - [armhf,arm64] drm/sun4i: tcon top: Fix NULL/invalid pointer dereference + in sun8i_tcon_top_un/bind + - virtio_pci: fix a NULL pointer reference in vp_del_vqs + - [x86] RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove + - [arm64] RDMA/hns: Fix bug that caused srq creation to fail + - scsi: csiostor: fix missing data copy in csio_scsi_err_handler() + - [x86] ASoC: Intel: kbl: fix wrong number of channels + - virtio-blk: limit number of hw queues by nr_cpu_ids + - nvme-fc: correct csn initialization and increments on error + - [x86] platform: pmc_atom: Drop __initconst on dmi table + - perf/core: Fix perf_event_disable_inatomic() race + - [x86] iommu/amd: Set exclusion range correctly + - genirq: Prevent use-after-free and work list corruption + - usb: dwc3: Fix default lpm_nyet_threshold value + - USB: serial: f81232: fix interrupt worker not stop + - USB: cdc-acm: fix unthrottle races + - usb-storage: Set virt_boundary_mask to avoid SG overflows + - [x86] intel_th: pci: Add Comet Lake support + - [arm64] cpufreq: armada-37xx: fix frequency calculation for opp + - scsi: lpfc: change snprintf to scnprintf for possible overflow + - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines + - scsi: qla2xxx: Fix device staying in blocked state + - UAS: fix alignment of scatter/gather segments + - [x86] ASoC: Intel: avoid Oops if DMA setup fails + - locking/futex: Allow low-level atomic operations to return -EAGAIN + - [arm64] futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.43 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.44 + - bfq: update internal depth state when queue depth changes + - [x86] platform: sony-laptop: Fix unintentional fall-through + - [x86] platform: thinkpad_acpi: Disable Bluetooth for some machines + - [x86] platform: dell-laptop: fix rfkill functionality + - hwmon: (pwm-fan) Disable PWM if fetching cooling data fails + - kernfs: fix barrier usage in __kernfs_new_node() + - [x86] virt: vbox: Sanity-check parameter types for hgcm-calls coming from + userspace + - USB: serial: fix unthrottle races + - acpi/nfit: Always dump _DSM output payload + - libnvdimm/namespace: Fix a potential NULL pointer dereference + - HID: input: add mapping for Expose/Overview key + - HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys + - HID: input: add mapping for "Toggle Display" key + - libnvdimm/btt: Fix a kmemdup failure check + - [s390x] dasd: Fix capacity calculation for large volumes + - mac80211: fix unaligned access in mesh table hash function + - mac80211: Increase MAX_MSG_LEN + - cfg80211: Handle WMM rules in regulatory domain intersection + - mac80211: fix memory accounting with A-MSDU aggregation + - nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands + - libnvdimm/pmem: fix a possible OOB access when read and write pmem + - [s390x] 3270: fix lockdep false positive on view->lock + - drm/amd/display: extending AUX SW Timeout + - mISDN: Check address length before reading address family + - vxge: fix return of a free'd memblock on a failed dma mapping + - qede: fix write to free'd pointer error and double free of ptp + - afs: Unlock pages for __pagevec_release() + - drm/amd/display: If one stream full updates, full update all planes + - [s390x] pkey: add one more argument space for debug feature entry + - [x86] reboot, efi: Use EFI reboot for Acer TravelMate X514-51T + - [x86] KVM: fix spectrev1 gadgets + - [x86] KVM: avoid misreporting level-triggered irqs as edge-triggered in + tracing + - tools lib traceevent: Fix missing equality check for strcmp + - ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash + - scsi: aic7xxx: fix EISA support + - mm: fix inactive list balancing between NUMA nodes and cgroups + - init: initialize jump labels before command line option parsing + - ipvs: do not schedule icmp errors from tunnels + - netfilter: ctnetlink: don't use conntrack/expect object addresses as id + - netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook() + - [s390x] ctcm: fix ctcm_new_device error return code + - [armhf,arm64] drm/sun4i: Set device driver data at bind time for use in + unbind + - [armhf,arm64] drm/sun4i: Fix component unbinding and component master + deletion + - netfilter: fix nf_l4proto_log_invalid to log invalid packets + - [armhf] gpu: ipu-v3: dp: fix CSC handling + - [armhf] drm/imx: don't skip DP channel disable for background plane + - [armhf,arm64] drm/sun4i: Unbind components before releasing DRM and + memory + - Input: synaptics-rmi4 - fix possible double free + - [arm64] RDMA/hns: Bugfix for mapping user db + - mm/memory_hotplug.c: drop memory device reference after + find_memory_block() + - [ppc64el] smp: Fix NMI IPI timeout + - [ppc64el] smp: Fix NMI IPI xmon timeout + - [armhf,arm64] net: dsa: mv88e6xxx: fix few issues in + mv88e6390x_port_set_cmode + - mm/memory.c: fix modifying of page protection by insert_pfn() + - usb: typec: Fix unchecked return value + - netfilter: nf_tables: use-after-free in dynamic operations + - netfilter: nf_tables: add missing ->release_ops() in error path of + newrule() (Closes: #934168) + - net: fec: manage ahb clock in runtime pm + - net: strparser: partially revert "strparser: Call skb_unclone + conditionally" + - NFC: nci: Add some bounds checking in nci_hci_cmd_received() + - nfc: nci: Potential off by one in ->pipes[] array + - [x86] kprobes: Avoid kretprobe recursion bug + - mwl8k: Fix rate_idx underflow + - rtlwifi: rtl8723ae: Fix missing break in switch statement + - bonding: fix arp_validate toggling in active-backup mode + - bridge: Fix error path for kobject_init_and_add() + - ipv4: Fix raw socket lookup for local traffic + - net: dsa: Fix error cleanup path in dsa_init_module + - [armhf] net: ethernet: stmmac: dwmac-sun8i: enable support of unicast + filtering + - [arm64] net: macb: Change interrupt and napi enable order in open + - packet: Fix error path in packet_init + - selinux: do not report error on connect(AF_UNSPEC) + - vlan: disable SIOCSHWTSTAMP in container + - vrf: sit mtu should not be updated when vrf netdev is the link + - tuntap: fix dividing by zero in ebpf queue selection + - tuntap: synchronize through tfiles array instead of tun->numqueues + - isdn: bas_gigaset: use usb_fill_int_urb() properly + - tipc: fix hanging clients using poll with EPOLLOUT flag + - [ppc64el] book3s/64: check for NULL pointer in pgd_alloc() + - [ppc64el] powernv/idle: Restore IAMR after idle + - [x86] PCI: hv: Fix a memory leak in hv_eject_device_work() + - [x86] PCI: hv: Add hv_pci_remove_slots() when we unload the driver + - [x86] PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if + necessary + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.45 + - locking/rwsem: Prevent decrement of reader count before increment + - [x86] speculation/mds: Revert CPU buffer clear on double fault exit + - [x86] speculation/mds: Improve CPU buffer clear documentation + - objtool: Fix function fallthrough detection + - [arm64] dts: rockchip: Disable DCMDs on RK3399's eMMC controller. + - [armhf] dts: exynos: Fix interrupt for shared EINTs on Exynos5260 + - [armhf] dts: exynos: Fix audio (microphone) routing on Odroid XU3 + - [arm64] mmc: sdhci-of-arasan: Add DTS property to disable DCMDs. + - [armhf] exynos: Fix a leaked reference by adding missing of_node_put + - [armhf] power: supply: axp288_charger: Fix unchecked return value + - [armhf,arm64] power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini + PCs to the blacklist + - [arm64] mmap: Ensure file offset is treated as unsigned + - [arm64] arch_timer: Ensure counter register reads occur with seqlock held + - [arm64] compat: Reduce address limit + - [arm64] Clear OSDLR_EL1 on CPU boot + - [arm64] Save and restore OSDLR_EL1 across suspend/resume + - [x96] sched: Save [ER]FLAGS on context switch + - crypto: salsa20 - don't access already-freed walk.iv + - crypto: chacha20poly1305 - set cra_name correctly + - [x86] crypto: ccp - Do not free psp_master when PLATFORM_INIT fails + - [ppc64el] crypto: vmx - fix copy-paste error in CTR mode + - crypto: skcipher - don't WARN on unprocessed data after slow walk step + - crypto: crct10dif-generic - fix use via crypto_shash_digest() + - [x86] crypto: crct10dif-pcl - fix use via crypto_shash_digest() + - [arm64] crypto: gcm-aes-ce - fix no-NEON fallback code + - crypto: gcm - fix incompatibility between "gcm" and "gcm_base" + - [armhf,arm64] crypto: aes-neonbs - don't access already-freed walk.iv + - mmc: core: Fix tag set memory leak + - ALSA: line6: toneport: Fix broken usage of timer for delayed execution + - ALSA: usb-audio: Fix a memory leak bug + - ALSA: hda/hdmi - Read the pin sense from register when repolling + - ALSA: hda/hdmi - Consider eld_valid when reporting jack event + - ALSA: hda/realtek - EAPD turn on later + - ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14) + - [armhf,arm64] ASoC: max98090: Fix restore of DAPM Muxes + - ASoC: codec: hdac_hdmi add device_link to card device + - [arm64] bpf: remove prefetch insn in xadd mapping + - mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned + addresses + - mm/hugetlb.c: don't put_page in lock of hugetlb_lock + - hugetlb: use same fault hash key for shared and private mappings + - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget + - userfaultfd: use RCU to free the task struct when fork fails + - ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle + - [arm64] mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values + - mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write + - tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0 + - tty/vt: fix write/write race in ioctl(KDSKBSENT) handler + - jbd2: check superblock mapped prior to committing + - ext4: make sanity check in mballoc more strict + - ext4: ignore e_value_offs for xattrs with value-in-ea-inode + - ext4: avoid drop reference to iloc.bh twice + - ext4: fix use-after-free race with debug_want_extra_isize + - ext4: actually request zeroing of inode table after grow + - ext4: fix ext4_show_options for file systems w/o journal + - btrfs: Check the first key and level for cached extent buffer + - btrfs: Correctly free extent buffer in case + btree_read_extent_buffer_pages fails + - Btrfs: send, flush dellaloc in order to avoid data loss + - Btrfs: do not start a transaction during fiemap + - Btrfs: do not start a transaction at iterate_extent_inodes() + - bcache: fix a race between cache register and cacheset unregister + - bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim() + - ipmi:ssif: compare block number correctly for multi-part return messages + - crypto: ccm - fix incompatibility between "ccm" and "ccm_base" + - fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going + into workqueue when umount + - ext4: fix data corruption caused by overlapping unaligned and aligned IO + - ext4: fix use-after-free in dx_release() + - ext4: avoid panic during forced reboot due to aborted journal + - [x86] ALSA: hda/realtek - Corrected fixup for System76 Gazelle (gaze14) + - ALSA: hda/realtek - Fixup headphone noise via runtime suspend + - [x86] ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal + microphone bug + - jbd2: fix potential double free + - [x86] KVM: Skip EFER vs. guest CPUID checks for host-initiated writes + - [x86] KVM: lapic: Busy wait for timer to expire when using hv_timer + - xen/pvh: set xen_domain_type to HVM in xen_pvh_init + - libnvdimm/namespace: Fix label tracking error + - iov_iter: optimize page_copy_sane() + - pstore: Centralize init/exit routines + - pstore: Allocate compression during late_initcall() + - pstore: Refactor compression initialization + - ext4: don't update s_rev_level if not required + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.46 + - ipv6: fix src addr routing with the exception table + - ipv6: prevent possible fib6 leaks + - net: Always descend into dsa/ + - net: avoid weird emergency message + - net/mlx4_core: Change the error print to info print + - net: test nouarg before dereferencing zerocopy pointers + - net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions + - nfp: flower: add rcu locks when accessing netdev for tunnels + - ppp: deflate: Fix possible crash in deflate_init + - rtnetlink: always put IFLA_LINK for links with a link-netnsid + - tipc: switch order of device registration to fix a crash + - vsock/virtio: free packets during the socket release + - vsock/virtio: Initialize core virtio vsock before registering the driver + - net/mlx5: Imply MLXFW in mlx5_core + - net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled + - stm class: Fix channel free in stm output free path + - stm class: Fix channel bitmap on 32-bit systems + - brd: re-enable __GFP_HIGHMEM in brd_insert_page() + - proc: prevent changes to overridden credentials + - Revert "MD: fix lock contention for flush bios" + - md: batch flush requests. + - md: add mddev->pers to avoid potential NULL pointer dereference + - dcache: sort the freeing-without-RCU-delay mess for good. + - [x86] intel_th: msu: Fix single mode with IOMMU + - p54: drop device reference count if fails to enable device + - of: fix clang -Wunsequenced for be32_to_cpu() + - cifs: fix strcat buffer overflow and reduce raciness in + smb21_set_oplock_level() + - [armhf] phy: ti-pipe3: fix missing bit-wise or operator when assigning + val + - NFS4: Fix v4.0 client state corruption when mount + - PNFS fallback to MDS if no deviceid found + - [arm64] clk: hi3660: Mark clk_gate_ufs_subsys as critical + - [armhf,arm64] clk: tegra: Fix PLLM programming on Tegra124+ when PMC + overrides divider + - [arm64] clk: rockchip: fix wrong clock definitions for rk3328 + - udlfb: delete the unused parameter for dlfb_handle_damage + - udlfb: fix sleeping inside spinlock + - udlfb: introduce a rendering mutex + - fuse: fix writepages on 32bit + - fuse: honor RLIMIT_FSIZE in fuse_file_fallocate + - ovl: fix missing upper fs freeze protection on copy up for ioctl + - [armhf] iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 + - ceph: flush dirty inodes before proceeding with remount + - [amd64] Add gap to int3 to allow for call emulation + - [amd64] Allow breakpoints to emulate call instructions + - [amd64] ftrace: Emulate call function while updating in breakpoint + handler + - tracing: Fix partial reading of trace event's id file + - [armhf,arm64] memory: tegra: Fix integer overflow on tick value + calculation + - [x86] perf intel-pt: Fix instructions sampling rate + - [x86] perf intel-pt: Fix improved sample timestamp + - [x86] perf intel-pt: Fix sample timestamp wrt non-taken branches + - fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types + - PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken + - PCI: Mark Atheros AR9462 to avoid bus reset + - PCI: Init PCIe feature bits for managed host bridge alloc + - PCI/AER: Change pci_aer_init() stub to return void + - PCI: Factor out pcie_retrain_link() function + - PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum + - dm cache metadata: Fix loading discard bitset + - dm zoned: Fix zone report handling + - dm delay: fix a crash when invalid device is specified + - dm integrity: correctly calculate the size of metadata area + - dm mpath: always free attached_handler_name in parse_path() + - fuse: Add FOPEN_STREAM to use stream_open() + - xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink + - xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module + - vti4: ipip tunnel deregistration fixes. + - xfrm: clean up xfrm protocol checks + - esp4: add length check for UDP encapsulation + - xfrm: Honor original L3 slave device in xfrmi policy lookup + - xfrm4: Fix uninitialized memory read in _decode_session4 + - [armhf,arm64] clk: sunxi-ng: nkmp: Avoid GENMASK(-1, 0) + - securityfs: fix use-after-free on symlink traversal + - apparmorfs: fix use-after-free on symlink traversal + - PCI: Fix issue with "pci=disable_acs_redir" parameter being ignored + - [x86] kvm: hyper-v: deal with buggy TLB flush requests from WS2012 + - mac80211: Fix kernel panic due to use of txq after free + - net: ieee802154: fix missing checks for regmap_update_bits + - [armhf,arm64] KVM: Ensure vcpu target is unset on reset failure + - bpf: Fix preempt_enable_no_resched() abuse + - qmi_wwan: new Wistron, ZTE and D-Link devices + - iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb() + - sched/cpufreq: Fix kobject memleak + - [x86] mm/mem_encrypt: Disable all instrumentation for early SME setup + - ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour + - perf bench numa: Add define for RUSAGE_THREAD if not present + - [x86] perf/intel: Fix race in intel_pmu_disable_event() + - md/raid: raid5 preserve the writeback action after the parity check + - driver core: Postpone DMA tear-down until after devres release for probe + failure + - bpf: relax inode permission check for retrieving bpf program + - bpf: add map_lookup_elem_sys_only for lookups from syscall side + - bpf, lru: avoid messing with eviction heuristics upon syscall lookup + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.47 + - [x86] Hide the int3_emulate_call/jmp functions from UML + - ext4: do not delete unlinked inode from orphan list on failed truncate + - ext4: wait for outstanding dio during truncate in nojournal mode + - f2fs: Fix use of number of devices + - [x86] KVM: fix return value for reserved EFER + - bio: fix improper use of smp_mb__before_atomic() + - sbitmap: fix improper use of smp_mb__before_atomic() + - Revert "scsi: sd: Keep disk read-only when re-reading partition" + - [ppc64el] crypto: vmx - CTR: always increment IV as quadword + - [arm*] mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold + time problem + - [arm*] mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time + problem + - [x86] kvm: svm/avic: fix off-by-one in checking host APIC ID + - libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead + - [arm64] kernel: kaslr: reduce module randomization range to 2 GB + - [arm64] iommu: handle non-remapped addresses in ->mmap and ->get_sgtable + - gfs2: Fix sign extension bug in gfs2_update_stats + - btrfs: don't double unlock on error in btrfs_punch_hole + - Btrfs: do not abort transaction at btrfs_update_root() after failure to + COW path + - Btrfs: avoid fallback to transaction commit during fsync of files with + holes + - Btrfs: fix race between ranged fsync and writeback of adjacent ranges + - btrfs: sysfs: Fix error path kobject memory leak + - btrfs: sysfs: don't leak memory when failing add fsid + - udlfb: fix some inconsistent NULL checking + - fbdev: fix divide error in fb_var_to_videomode + - NFSv4.2 fix unnecessary retry in nfs4_copy_file_range + - NFSv4.1 fix incorrect return value in copy_file_range + - bpf: add bpf_jit_limit knob to restrict unpriv allocations + - [arm64] errata: Add workaround for Cortex-A76 erratum #1463225 + - btrfs: honor path->skip_locking in backref code + - ovl: relax WARN_ON() for overlapping layers use case + - fbdev: fix WARNING in __alloc_pages_nodemask bug + - media: cpia2: Fix use-after-free in cpia2_exit + - media: serial_ir: Fix use-after-free in serial_ir_init_module + - media: vb2: add waiting_in_dqbuf flag + - media: vivid: use vfree() instead of kfree() for dev->bitmap_cap + - ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit + - bpf: devmap: fix use-after-free Read in __dev_map_entry_free + - batman-adv: mcast: fix multicast tt/tvlv worker locking + - at76c50x-usb: Don't register led_trigger if usb_register_driver failed + - acct_on(): don't mess with freeze protection + - gfs2: Fix lru_count going negative + - cxgb4: Fix error path in cxgb4_init_module + - NFS: make nfs_match_client killable + - IB/hfi1: Fix WQ_MEM_RECLAIM warning + - gfs2: Fix occasional glock use-after-free + - mmc: core: Verify SD bus width + - [arm64] dmaengine: tegra210-dma: free dma controller in remove() + - net: ena: gcc 8: fix compilation warning + - [x86] hv_netvsc: fix race that may miss tx queue wakeup + - Bluetooth: Ignore CC events not matching the last HCI command + - [x86] ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE + - [armhf,arm64] usb: dwc2: gadget: Increase descriptors count for ISOC's + - [armhf,arm64] usb: dwc3: move synchronize_irq() out of the spinlock + protected block + - ASoC: hdmi-codec: unlock the device on startup errors + - [ppc64el] perf: Return accordingly on invalid chip-id in + - [ppc64el] boot: Fix missing check of lseek() return value + - [ppc64el] perf: Fix loop exit condition in nest_imc_event_init + - [armhf] ASoC: imx: fix fiq dependencies + - [amd64] spi: pxa2xx: fix SCR (divisor) calculation + - brcm80211: potential NULL dereference in + brcmf_cfg80211_vndr_cmds_dcmd_handler() + - ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() + - drm/nouveau/bar/nv50: ensure BAR is mapped + - [armel,armhf] vdso: Remove dependency with the arch_timer driver + internals + - [ppc64el] watchdog: Use hrtimers for per-CPU heartbeat + - sched/cpufreq: Fix kobject memleak + - scsi: qla2xxx: Fix a qla24xx_enable_msix() error path + - scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() + - scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in + tcm_qla2xxx_close_session() + - scsi: qla2xxx: Fix hardirq-unsafe locking + - [x86] modules: Avoid breaking W^X while loading modules + - Btrfs: fix data bytes_may_use underflow with fallocate due to failed + quota reserve + - btrfs: fix panic during relocation after ENOSPC before writeback happens + - btrfs: Don't panic when we can't find a root key + - iwlwifi: pcie: don't crash on invalid RX interrupt + - scsi: qedi: Abort ep termination if offload not scheduled + - [s390x] kexec_file: Fix detection of text segment in ELF loader + - sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs + - w1: fix the resume command API + - [s390x] qeth: address type mismatch warning + - [armhf,arm64] dmaengine: pl330: _stop: clear interrupt status + - mac80211/cfg80211: update bss channel on channel switch + - mwifiex: prevent an array overflow + - rsi: Fix NULL pointer dereference in kmalloc + - nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE + - nvme-rdma: fix a NULL deref when an admin connect times out + - [armhf,arm64] crypto: sun4i-ss - Fix invalid calculation of hash end + - bcache: avoid potential memleak of list of journal_replay(s) in the + CACHE_SYNC branch of run_cache_set + - bcache: return error immediately in bch_journal_replay() + - bcache: fix failure in journal relplay + - bcache: add failure check to run_cache_set() for journal replay + - bcache: avoid clang -Wunintialized warning + - RDMA/cma: Consider scope_id while binding to ipv6 ll address + - vfio-ccw: Do not call flush_workqueue while holding the spinlock + - vfio-ccw: Release any channel program when releasing/removing vfio-ccw + mdev + - [x86] mm: Remove in_nmi() warning from 64-bit implementation of + vmalloc_fault() + - mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC + versions + - Bluetooth: hci_qca: Give enough time to ROME controller to bootup. + - HID: logitech-hidpp: use RAP instead of FAP to get the protocol version + - [armhf] pinctrl: samsung: fix leaked of_node references + - [armhf] clk: rockchip: undo several noc and special clocks as critical on + rk3288 + - [arm64] perf/arm-cci: Remove broken race mitigation + - media: au0828: stop video streaming only when last user stops + - audit: fix a memory leak bug + - media: au0828: Fix NULL pointer dereference in + au0828_analog_stream_enable() + - media: pvrusb2: Prevent a buffer overflow + - block: fix use-after-free on gendisk + - [ppc64el] numa: improve control of topology updates + - [ppc64el] Fix booting large kernels with STRICT_KERNEL_RWX + - random: fix CRNG initialization when random.trust_cpu=1 + - random: add a spinlock_t to struct batched_entropy + - cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock + - sched/core: Check quota and period overflow at usec to nsec conversion + - sched/rt: Check integer overflow at usec to nsec conversion + - sched/core: Handle overflow in cpu_shares_write_u64 + - [arm*] staging: vc04_services: handle kzalloc failure + - [arm64] drm/msm: a5xx: fix possible object reference leak + - irq_work: Do not raise an IPI when queueing work on the local CPU + - [x86] thunderbolt: Take domain lock in switch sysfs attribute callbacks + - [s390x] qeth: handle error from qeth_update_from_chp_desc() + - USB: core: Don't unbind interfaces following device reset failure + - [amd64] irq: Limit IST stack overflow check to #DB stack + - [armhf] drm: etnaviv: avoid DMA API warning when importing buffers + - [armhf,arm64] phy: sun4i-usb: Make sure to disable PHY0 passby for + peripheral mode + - i40e: Able to add up to 16 MAC filters on an untrusted VF + - i40e: don't allow changes to HW VLAN stripping on active port VLANs + - ACPI/IORT: Reject platform device creation on NUMA node mapping failure + - [arm64] vdso: Fix clock_getres() for CLOCK_REALTIME + - RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure + - [x86] perf/msr: Add Icelake support + - [x86] perf/intel/rapl: Add Icelake support + - [x86] perf/intel/cstate: Add Icelake support + - hwmon: (vt1211) Use request_muxed_region for Super-IO accesses + - hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses + - hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses + - hwmon: (pc87427) Use request_muxed_region for Super-IO accesses + - hwmon: (f71805f) Use request_muxed_region for Super-IO accesses + - scsi: libsas: Do discovery on empty PHY to update PHY info + - mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers + - [armhf,arm64] mmc_spi: add a status check for spi_sync_locked + - drm/amdgpu: fix old fence check in amdgpu_fence_emit + - PM / core: Propagate dev->power.wakeup_path when no callbacks + - [armhf] clk: rockchip: Fix video codec clocks on rk3288 + - [armhf] clk: rockchip: Make rkpwm a critical clock on rk3288 + - [s390x] zcrypt: initialize variables before_use + - [x86] microcode: Fix the ancient deprecated microcode loading method + - [s390x] mm: silence compiler warning when compiling without CONFIG_PGSTE + - [s390x] cio: fix cio_irb declaration + - qmi_wwan: Add quirk for Quectel dynamic config + - block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR + - rtlwifi: fix a potential NULL pointer dereference + - mwifiex: Fix mem leak in mwifiex_tm_cmd + - brcmfmac: fix missing checks for kmemdup + - b43: shut up clang -Wuninitialized variable warning + - brcmfmac: convert dev_init_lock mutex to completion + - brcmfmac: fix WARNING during USB disconnect in case of unempty psq + - brcmfmac: fix race during disconnect when USB completion is in progress + - brcmfmac: fix Oops when bringing up interface during USB disconnect + - [arm64] rtc: xgene: fix possible race condition + - rtlwifi: fix potential NULL pointer dereference + - scsi: ufs: Fix regulator load and icc-level configuration + - scsi: ufs: Avoid configuring regulator with undefined voltage range + - [arm64] cpu_ops: fix a leaked reference by adding missing of_node_put + - wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext + - [x86] uaccess, signal: Fix AC=1 bloat + - [amd64] ia32: Fix ia32_restore_sigcontext() AC leak + - [x86] uaccess: Fix up the fixup + - chardev: add additional check for minor range overlap + - [arm64] RDMA/hns: Fix bad endianess of port_pd variable + - HID: core: move Usage Page concatenation to Main item + - [armhf] ASoC: eukrea-tlv320: fix a leaked reference by adding missing + of_node_put + - cxgb3/l2t: Fix undefined behaviour + - HID: logitech-hidpp: change low battery level threshold from 31 to 30 + percent + - [armhf] spi: tegra114: reset controller on probe + - kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. + - [armhf] media: wl128x: prevent two potential buffer overflows + - media: gspca: Kill URBs on USB device disconnect + - efifb: Omit memory map check on legacy boot + - [x86] thunderbolt: property: Fix a missing check of kzalloc + - [x86] thunderbolt: Fix to check the return value of kmemdup + - timekeeping: Force upper bound for setting CLOCK_REALTIME + - scsi: qedf: Add missing return in qedf_post_io_req() in the fcport + offload check + - virtio_console: initialize vtermno value for ports + - tty: ipwireless: fix missing checks for ioremap + - overflow: Fix -Wtype-limits compilation warnings + - [x86] mce: Fix machine_check_poll() tests for error types + - rcutorture: Fix cleanup path for invalid torture_type strings + - [x86] mce: Handle varying MCA bank counts + - rcuperf: Fix cleanup path for invalid perf_type strings + - usb: core: Add PM runtime calls to usb_hcd_platform_shutdown + - scsi: qla4xxx: avoid freeing unallocated dma memory + - scsi: lpfc: avoid uninitialized variable warning + - selinux: avoid uninitialized variable warning + - batman-adv: allow updating DAT entry timeouts on incoming ARP Replies + - dmaengine: tegra210-adma: use devm_clk_*() helpers + - [armhf] hwrng: omap - Set default quality + - [x86] thunderbolt: Fix to check return value of ida_simple_get + - [x86] thunderbolt: Fix to check for kmemdup failure + - drm/amd/display: fix releasing planes when exiting odm + - [x86] thunderbolt: property: Fix a NULL pointer dereference + - e1000e: Disable runtime PM on CNP+ + - igb: Exclude device from suspend direct complete optimization + - media: dvbsky: Avoid leaking dvb frontend + - drm/amd/display: Fix Divide by 0 in memory calculations + - drm/amd/display: Set stream->mode_changed when connectors change + - scsi: ufs: fix a missing check of devm_reset_control_get + - media: gspca: do not resubmit URBs when streaming has stopped + - media: go7007: avoid clang frame overflow warning with KASAN + - scsi: lpfc: Fix FDMI manufacturer attribute value + - scsi: lpfc: Fix fc4type information for FDMI + - media: saa7146: avoid high stack usage with clang + - scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices + - [i386] spi : spi-topcliff-pch: Fix to handle empty DMA buffers + - [armhf] drm/omap: dsi: Fix PM for display blank with paired dss_pll calls + - [armhf] spi: imx: stop buffer overflow in RX FIFO flush + - spi: Fix zero length xfer bug + - [armhf] ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM + - drm/drv: Hold ref on parent device during drm_device lifetime + - drm: Wake up next in drm_read() chain if we are forced to putback the + event + - [s390x] vfio-ccw: Prevent quiesce function going into an infinite loop + - NFS: Fix a double unlock from nfs_match,get_client + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.48 + - bonding/802.3ad: fix slave link initialization transition states + - cxgb4: offload VLAN flows regardless of VLAN ethtype + - ipv4/igmp: fix another memory leak in igmpv3_del_delrec() + - ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST + - ipv6: Consider sk_bound_dev_if when binding a raw socket to an address + - ipv6: Fix redirect with VRF + - llc: fix skb leak in llc_build_and_send_ui_pkt() + - [armhf,arm64] net: dsa: mv88e6xxx: fix handling of upper half of + STATS_TYPE_PORT + - net-gro: fix use-after-free read in napi_gro_frags() + - [armhf,arm64] net: mvneta: Fix err code path of probe + - [armhf,arm64] net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue + value + - net: phy: marvell10g: report if the PHY fails to boot firmware + - net: sched: don't use tc_action->order during action dump + - [armhf,arm64] net: stmmac: fix reset gpio free missing + - usbnet: fix kernel crash after disconnect + - net/mlx5: Avoid double free in fs init error unwinding path + - tipc: Avoid copying bytes beyond the supplied data + - net/mlx5: Allocate root ns memory using kzalloc to match kfree + - net/mlx5e: Disable rxhash when CQE compress is enabled + - [armhf,arm64] net: stmmac: dma channel control register need to be init + first + - bnxt_en: Fix aggregation buffer leak under OOM condition. + - [ppc64el] crypto: vmx - ghash: do nosimd fallback manually + - include/linux/compiler*.h: define asm_volatile_goto + - compiler.h: give up __compiletime_assert_fallback() + - jump_label: move 'asm goto' support test to Kconfig + - tipc: fix modprobe tipc failed after switch order of device registration + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.49 + - include/linux/bitops.h: sanitize rotate primitives + - xhci: update bounce buffer with correct sg num + - xhci: Use %zu for printing size_t type + - xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic() + - usb: xhci: avoid null pointer deref when bos field is NULL + - usbip: usbip_host: fix BUG: sleeping function called from invalid context + - usbip: usbip_host: fix stub_dev lock context imbalance regression + - USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor + - USB: sisusbvga: fix oops in error path of sisusb_probe (CVE-2019-15219) + - USB: Add LPM quirk for Surface Dock GigE adapter + - USB: rio500: refuse more than one device at a time (CVE-2019-15212) + - USB: rio500: fix memory leak in close after disconnect + - media: usb: siano: Fix general protection fault in smsusb + (CVE-2019-15218) + - media: usb: siano: Fix false-positive "uninitialized variable" warning + - media: smsusb: better handle optional alignment + - brcmfmac: fix NULL pointer derefence during USB disconnect + - [s390x] scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from + port_remove + - [s390x] scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs + (only sdevs) + - tracing: Avoid memory leak in predicate_parse() + - Btrfs: fix wrong ctime and mtime of a directory after log replay + - Btrfs: fix race updating log root item during fsync + - Btrfs: fix fsync not persisting changed attributes of a directory + - Btrfs: incremental send, fix file corruption when no-holes feature is + enabled + - [s390x] crypto: fix gcm-aes-s390 selftest failures + - [s390x] crypto: fix possible sleep during spinlock aquired + - [ppc64el] KVM: Book3S HV: XIVE: Do not clear IRQ data of passthrough + interrupts + - [ppc64el] perf: Fix MMCRA corruption by bhrb_filter + - ALSA: line6: Assure canceling delayed work at disconnection + (CVE-2019-15223) + - ALSA: hda/realtek - Set default power save node to 0 + - [s390x] KVM: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID + - drm/nouveau/i2c: Disable i2c bus access after ->fini() + - [arm64] tty: serial: msm_serial: Fix XON/XOFF + - memcg: make it work on sparse non-0-node systems + - kernel/signal.c: trace_signal_deliver when signal_group_exit + - [arm64] Fix the arm64_personality() syscall wrapper redirection + - vt/fbcon: deinitialize resources in visual_init() after failed memory + allocation + - [arm*] staging: vc04_services: prevent integer overflow in + create_pagelist() + - [x86] staging: wlan-ng: fix adapter initialization failure + - cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case + - CIFS: cifs_read_allocate_pages: don't iterate through whole page array on + ENOMEM + - Revert "lockd: Show pid of lockd for remote locks" + - [armhf,arm64] drm/tegra: gem: Fix CPU-cache maintenance for BO's + allocated using get_pages() + - [x86] drm/vmwgfx: Don't send drm sysfs hotplug events on initial master + set + - [armhf,arm64] drm/sun4i: Fix sun8i HDMI PHY clock initialization + - [armhf,arm64] drm/sun4i: Fix sun8i HDMI PHY configuration for > 148.5 MHz + - [armhf,arm64] drm/rockchip: shutdown drm subsystem on shutdown + - drm/lease: Make sure implicit planes are leased + - [x86] ftrace: Do not call function graph from dynamic trampolines + - [x86] ftrace: Set trampoline pages as executable + - [x86] kprobes: Set instruction page as executable + - scsi: lpfc: Fix backport of faf5a744f4f8 ("scsi: lpfc: avoid + uninitialized variable warning") + - media: uvcvideo: Fix uvc_alloc_entity() allocation alignment + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.50 + - ethtool: fix potential userspace buffer overflow + - Fix memory leak in sctp_process_init + - ipv4: not do cache for local delivery if bc_forwarding is enabled + - ipv6: fix the check before getting the cookie in rt6_get_cookie + - neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit + - [armhf] net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set + - net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query + - [armhf,arm64] net: mvpp2: Use strscpy to handle stat strings + - net: rds: fix memory leak in rds_ib_flush_mr_pool + - net: sfp: read eeprom in maximum 16 byte increments + - packet: unconditionally free po->rollover + - pktgen: do not sleep with the thread lock held. + - ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 + - ipv6: fix EFAULT on sendto with icmpv6 and hdrincl + - rcu: locking and unlocking need to always be at least barriers + - NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter + - NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled + - fuse: fallocate: fix return with locked inode + - pstore: Remove needless lock during console writes + - pstore: Convert buf_lock to semaphore + - pstore: Set tfm to NULL on free_buf_for_compression + - pstore/ram: Run without kernel crash dump region + - [x86] power: Fix 'nosmt' vs hibernation triple fault during resume + - [s390x] mm: fix address space detection in exception handling + - xen-blkfront: switch kcalloc to kvcalloc for large array allocation + - [ppc64el] genwqe: Prevent an integer overflow in the ioctl + - test_firmware: Use correct snprintf() limit + - [x86] drm/gma500/cdv: Check vbt config bits when detecting lvds panels + - [arm64] drm/msm: fix fb references in async update + - drm: add non-desktop quirk for Valve HMDs + - drm: add non-desktop quirks to Sensics and OSVR headsets. + - drm/amdgpu/psp: move psp version specific function pointers to early_init + - drm/radeon: prefer lower reference dividers + - drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in + - [x86] drm/i915: Fix I915_EXEC_RING_MASK + - [x86] drm/i915/fbc: disable framebuffer compression on GeminiLake + - [x86] drm/i915: Maintain consistent documentation subsection ordering + - drm: don't block fb changes for async plane updates + - [x86] drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack + - TTY: serial_core, add ->install + - ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled + - ethtool: check the return value of get_regs_len + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.51 + - fs/fat/file.c: issue flush after the writeback of FAT + - sysctl: return -EINVAL if val violates minmax + - ipc: prevent lockup on alloc_msg and free_msg + - [armhf] prevent tracing IPI_CPU_BACKTRACE + - hugetlbfs: on restore reserve error path retain subpool reservation + - mem-hotplug: fix node spanned pages when we have a node with only + ZONE_MOVABLE + - mm/cma.c: fix crash on CMA allocation if bitmap allocation fails + - initramfs: free initrd memory if opening /initrd.image fails + - mm/cma.c: fix the bitmap status to show failed allocation reason + - mm: page_mkclean vs MADV_DONTNEED race + - mm/cma_debug.c: fix the break condition in cma_maxchunk_get() + - mm/slab.c: fix an infinite loop in leaks_show() + - kernel/sys.c: prctl: fix false positive in validate_prctl_map() + - drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER + - [x86] mfd: intel-lpss: Set the device in reset state when init + - drm/nouveau/disp/dp: respect sink limits when selecting failsafe link + configuration + - [armhf] mfd: twl6040: Fix device init errors for ACCCTL register + - [x86] perf/intel: Allow PEBS multi-entry in watermark mode + - drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd + when encoders change + - [arm64] drm/bridge: adv7511: Fix low refresh rate selection + - objtool: Don't use ignore flag for fake jumps + - drm/nouveau/kms/gv100-: fix spurious window immediate interlocks + - bpf: fix undefined behavior in narrow load handling + - [arm64] pwm: meson: Use the spin-lock only to protect register + modifications + - ntp: Allow TAI-UTC offset to be set to zero + - f2fs: fix to avoid panic in do_recover_data() + - f2fs: fix to avoid panic in f2fs_inplace_write_data() + - f2fs: fix to avoid panic in f2fs_remove_inode_page() + - f2fs: fix to do sanity check on free nid + - f2fs: fix to clear dirty inode in error path of f2fs_iget() + - f2fs: fix to avoid panic in dec_valid_block_count() + - f2fs: fix to use inline space only if inline_xattr is enable + - f2fs: fix to do sanity check on valid block count of segment + - f2fs: fix to do checksum even if inode page is uptodate + - percpu: remove spurious lock dependency between percpu and sched + - configfs: fix possible use-after-free in configfs_register_group + - [armhf,arm64] PCI: dwc: Free MSI in dw_pcie_host_init() error path + - [armhf,arm64] PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi() + - ovl: do not generate duplicate fsnotify events for "fake" path + - mmc: mmci: Prevent polling for busy detection in IRQ context + - netfilter: nf_flow_table: fix missing error check for + rhashtable_insert_fast + - netfilter: nf_conntrack_h323: restore boundary check correctness + - [mips*] Make sure dt memory regions are valid + - netfilter: nf_tables: fix base chain stat rcu_dereference usage + - [armhf] watchdog: imx2_wdt: Fix set_timeout for big timeout values + - watchdog: fix compile time error of pretimeout governors + - blk-mq: move cancel of requeue_work into blk_mq_release + - [x86] iommu/vt-d: Set intel_iommu_gfx_mapped correctly + - nvme-pci: unquiesce admin queue on shutdown + - nvme-pci: shutdown on timeout during deletion + - netfilter: nf_flow_table: check ttl value in flow offload data path + - netfilter: nf_flow_table: fix netdev refcnt leak + - ALSA: hda - Register irq handler after the chip initialization + - nvmem: core: fix read buffer in place + - [armhf,arm64] nvmem: sunxi_sid: Support SID on A83T and H5 + - fuse: retrieve: cap requested size to negotiated max_write + - nfsd: allow fh_want_write to be called twice + - nfsd: avoid uninitialized variable warning + - vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING" + - [armhf,arm64] iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel + - [x86] net: thunderbolt: Unregister ThunderboltIP protocol handler when + suspending + - [x86] PCI: Fix PCI IRQ routing table memory leak + - i40e: Queues are reserved despite "Invalid argument" error + - platform/chrome: cros_ec_proto: check for NULL transfer function + - [armhf] clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288 + - [armhf] soc: rockchip: Set the proper PWM for rk3288 + - [armhf] dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA + - [armhf] dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA + - [armhf] dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA + - [armhf] dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA + - [armhf] dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA + - [armhf] dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA + - [armhf] dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA + - [armhf] dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA + - [ppc64el] PCI: rpadlpar: Fix leaked device_node references in add/remove + paths + - drm/amd/display: Use plane->color_space for dpp if specified + - [armhf] OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using + it + - [x86] platform: intel_pmc_ipc: adding error handling + - [arm64] net: hns3: return 0 and print warning when hit duplicate MAC + - scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags + - [x86] video: hgafb: fix potential NULL pointer dereference + - block, bfq: increase idling for weight-raised queues + - [arm64] PCI: xilinx: Check for __get_free_pages() failure + - ice: Add missing case in print_link_msg for printing flow control + - [x86] dmaengine: idma64: Use actual device for DMA transfers + - [armhf] pwm: tiehrpwm: Update shadow register for disabling PWMs + - [armhf] dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 + regulators on Arndale Octa + - pwm: Fix deadlock warning when removing PWM device + - [armhf] exynos: Fix undefined instruction during Exynos5422 resume + - [x86] usb: typec: fusb302: Check vconn is off when we start toggling + - soc: renesas: Identify R-Car M3-W ES1.3 + - percpu: do not search past bitmap when allocating an area + - ovl: check the capability before cred overridden + - ovl: support stacked SEEK_HOLE/SEEK_DATA + - [arm*] drm/vc4: fix fb references in async update + - ALSA: seq: Cover unsubscribe_port() in list_mutex + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.52 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.53 + - drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3) + - nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled + - HID: multitouch: handle faulty Elo touch device + - HID: wacom: Don't set tool type until we're in range + - HID: wacom: Don't report anything prior to the tool entering range + - HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact + - HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth + - HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary + - ALSA: oxfw: allow PCM capture for Stanton SCS.1m + - ALSA: hda/realtek - Update headset mode for ALC256 + - ALSA: firewire-motu: fix destruction of data for isochronous resources + - libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk + - mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node + - fs/ocfs2: fix race in ocfs2_dentry_attach_lock() + - mm/vmscan.c: fix trying to reclaim unevictable LRU page + - signal/ptrace: Don't leak unitialized kernel memory with + PTRACE_PEEK_SIGINFO + - ptrace: restore smp_rmb() in __ptrace_may_access() + - [armhf,arm64] iommu/arm-smmu: Avoid constant zero in TLBI writes + - bcache: fix stack corruption by PRECEDING_KEY() + - bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached + - cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css() + - [x86] drm/i915/sdvo: Implement proper HDMI audio support for SDVO + - ALSA: seq: Fix race of get-subscription call vs port-delete ioctls + - Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var + - f2fs: fix to avoid accessing xattr across the boundary + - scsi: qedi: remove memset/memcpy to nfunc and use func instead + (CVE-2019-15090) + - scsi: qedi: remove set but not used variables 'cdev' and 'udev' + - scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show + - scsi: lpfc: add check for loss of ndlp when sending RRQ + - [arm64] mm: Inhibit huge-vmap with ptdump + - nvme: fix srcu locking on error return in nvme_get_ns_from_disk + - nvme: remove the ifdef around nvme_nvm_ioctl + - nvme: merge nvme_ns_ioctl into nvme_ioctl + - nvme: release namespace SRCU protection before performing controller + ioctls + - nvme: fix memory leak for power latency tolerance + - [x86] platform: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems + DMI table + - [x86] platform: pmc_atom: Add several Beckhoff Automation boards to + critclk_systems DMI table + - scsi: bnx2fc: fix incorrect cast to u64 on shift operation + - libnvdimm: Fix compilation warnings with W=1 + - tracing: Prevent hist_field_var_ref() from accessing NULL tracing_map_elts + - usbnet: ipheth: fix racing condition + - [armhf,arm64] KVM: Move cc/it checks under hyp's Makefile to avoid + instrumentation + - [x86] KVM: pmu: mask the result of rdpmc according to the width of the + counters + - [x86] KVM: pmu: do not mask the value that is written to fixed PMUs + - [s390x] KVM: fix memory slot handling for KVM_SET_USER_MEMORY_REGION + - [x86] drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to + an invalid read + - [x86] drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define() + - [armhf,arm64] usb: dwc2: Fix DMA cache alignment issues + - [armhf,arm64] usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam + regression) + - USB: Fix chipmunk-like voice when using Logitech C270 for recording + audio. + - USB: usb-storage: Add new ID to ums-realtek + - USB: serial: pl2303: add Allied Telesis VT-Kit3 + - USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode + - USB: serial: option: add Telit 0x1260 and 0x1261 compositions + - timekeeping: Repair ktime_get_coarse*() granularity + - [x86] microcode, cpuhotplug: Add a microcode loader CPU hotplug callback + - [x86] mm/KASLR: Compute the size of the vmemmap section properly + - [x86] resctrl: Prevent NULL pointer dereference when local MBM is disabled + - drm/edid: abstract override/firmware EDID retrieval + - drm: add fallback override/firmware EDID modes workaround + - [armhf] rtc: pcf8523: don't return invalid date when battery is low + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.54 + - ax25: fix inconsistent lock state in ax25_destroy_timer + - be2net: Fix number of Rx queues used for flow hashing + - [x86] hv_netvsc: Set probe mode to sync + - ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero + - lapb: fixed leak of control-blocks. + - neigh: fix use-after-free read in pneigh_get_next + - net: openvswitch: do not free vport if register_netdevice() is failed. + - sctp: Free cookie before we memdup a new one + - tipc: purge deferredq list for each grp member in tipc_group_delete + - vsock/virtio: set SOCK_DONE on peer shutdown + - net/mlx5: Avoid reloading already removed devices + - [armhf,arm64] net: mvpp2: prs: Fix parser range for VID filtering + - [armhf,arm64] net: mvpp2: prs: Use the correct helpers when removing all + VID filters + - [arm*] Staging: vc04_services: Fix a couple error codes + - [x86] perf/intel/ds: Fix EVENT vs. UEVENT PEBS constraints + - netfilter: nf_queue: fix reinject verdict handling + - ipvs: Fix use-after-free in ip_vs_in + - [armhf] clk: ti: clkctrl: Fix clkdm_clk handling + - [ppc64el] powernv: Return for invalid IMC domain + - usb: xhci: Fix a potential null pointer dereference in + xhci_debugfs_create_endpoint() + - mISDN: make sure device name is NUL terminated + - [x86] CPU/AMD: Don't force the CPB cap when running under a hypervisor + - perf/ring_buffer: Fix exposing a temporarily decreased data_head + - perf/ring_buffer: Add ordering to rb->nest increment + - perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page data + - [armhf,arm64] net: stmmac: update rx tail pointer register to fix rx dma + hang issue. + - ACPI/PCI: PM: Add missing wakeup.flags.valid checks + - [armhf] drm/etnaviv: lock MMU while dumping core + - net: aquantia: tx clean budget logic error + - net: aquantia: fix LRO with FCS error + - i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr + - ALSA: hda - Force polling mode on CNL for fixing codec communication + - configfs: Fix use-after-free when accessing sd->s_dentry + - perf data: Fix 'strncat may truncate' build failure with recent gcc + - perf namespace: Protect reading thread's namespace + - [s390x] perf record: Fix s390 missing module symbol and warning for + non-root users + - xenbus: Avoid deadlock during suspend due to open transactions + - [ppc64el] KVM: Book3S: Use new mutex to synchronize access to rtas token + list + - [ppc64el] KVM: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu + - [arm64] fix syscall_fn_t type + - [arm64] use the correct function type in SYSCALL_DEFINE0 + - [arm64] use the correct function type for __arm64_sys_ni_syscall + - net: phylink: ensure consistent phy interface mode + - net: phy: dp83867: Set up RGMII TX delay + - scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() + - scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask + - scsi: scsi_dh_alua: Fix possible null-ptr-deref + - scsi: libsas: delete sas port if expander discover failed + - ocfs2: fix error path kobject memory leak + - coredump: fix race condition between collapse_huge_page() and core dumping + - Abort file_remove_privs() for non-reg. files + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.55 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.56 + - tracing: Silence GCC 9 array bounds warning + - objtool: Support per-function rodata sections + - ovl: support the FS_IOC_FS[SG]ETXATTR ioctls + - ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls + - ovl: make i_ino consistent with st_ino in more cases + - ovl: detect overlapping layers + - ovl: don't fail with disconnected lower NFS + - ovl: fix bogus -Wmaybe-unitialized warning + - [s390x] jump_label: Use "jdd" constraint on gcc9 + - [s390x] ap: rework assembler functions to use unions for in/out register + variables + - mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning + - mmc: core: API to temporarily disable retuning for SDIO CRC errors + - mmc: core: Add sdio_retune_hold_now() and sdio_retune_release() + - mmc: core: Prevent processing SDIO IRQs when the card is suspended + - scsi: ufs: Avoid runtime suspend possibly being blocked forever + - [armhf,arm64] usb: chipidea: udc: workaround for endpoint conflict issue + - xhci: detect USB 3.2 capable host controllers correctly + - usb: xhci: Don't try to recover an endpoint if port is in error state. + - IB/hfi1: Validate fault injection opcode user input + - IB/hfi1: Silence txreq allocation warnings + - [x86] Input: synaptics - enable SMBus on ThinkPad E480 and E580 + - Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD + - [x86] Input: silead - add MSSL0017 to acpi_device_id + - apparmor: fix PROFILE_MEDIATES for untrusted input + - apparmor: enforce nullbyte at end of tag string + - brcmfmac: sdio: Disable auto-tuning around commands expected to fail + - brcmfmac: sdio: Don't tune while the card is off + - parport: Fix mem leak in parport_register_dev_model + - IB/rdmavt: Fix alloc_qpn() WARN_ON() + - IB/hfi1: Insure freeze_work work_struct is canceled on shutdown + - IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value + - IB/hfi1: Validate page aligned for a given virtual address + - [mips*] uprobes: remove set but not used variable 'epc' + - [armhf,arm64] net: dsa: mv88e6xxx: avoid error message on remove from + VLAN 0 + - [arm64] net: hns: Fix loopback test failed at copper ports + - mdesc: fix a missing-check bug in get_vdev_port_node_info() + - [arm64] drm/arm/mali-dp: Add a loop around the second set CVAL and try 5 + times + - [arm64] drm/arm/hdlcd: Actually validate CRTC modes + - [arm64] drm/arm/hdlcd: Allow a bit of clock tolerance + - nvmet: fix data_len to 0 for bdev-backed write_zeroes + - scsi: ufs: Check that space was properly alloced in copy_query_response + - scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous() + - net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set + - [s390x] qeth: fix VLAN attribute in bridge_hostnotify udev event + - hwmon: (core) add thermal sensors only if dev->of_node is present + - hwmon: (pmbus/core) Treat parameters as paged if on multiple pages + - nvme: Fix u32 overflow in the number of namespace list calculation + - btrfs: start readahead also in seed devices + - [armhf] can: flexcan: fix timeout when set small bitrate + - can: purge socket error queue on sock destruct + - [ppc64el] bpf: use unsigned division instruction for 64-bit operations + - [armhf] imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX + - [armhf] dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values + - [armhf] dts: am57xx-idk: Remove support for voltage switching for SD card + - [arm64] sve: <uapi/asm/ptrace.h> should not depend on + <uapi/linux/prctl.h> + - [arm64] ssbd: explicitly depend on <linux/prctl.h> + - [x86] drm/vmwgfx: Use the backdoor port if the HB port is not available + - Bluetooth: Align minimum encryption key size for LE and BR/EDR + connections (CVE-2019-9506) + - Bluetooth: Fix regression with minimum encryption key size alignment + - SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write + - cfg80211: fix memory leak of wiphy device name + - mac80211: drop robust management frames from unknown TA + - {nl,mac}80211: allow 4addr AP operation on crypto controlled devices + - mac80211: handle deauthentication/disassociation from TDLS peer + - nl80211: fix station_info pertid memory leak + - mac80211: Do not use stack memory with scatterlist for GMAC + - [x86] resctrl: Don't stop walking closids when a locksetup group is found + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.57 + - perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit + set nul + - perf help: Remove needless use of strncpy() + - perf header: Fix unchecked usage of strncpy() + - [arm64] Don't unconditionally add -Wno-psabi to KBUILD_CFLAGS + - IB/hfi1: Close PSM sdma_progress sleep window + - 9p/xen: fix check for xenbus_read error in front_probe + - 9p: Use a slab for allocating requests + - 9p: embed fcall in req to round down buffer allocs + - 9p: add a per-client fcall kmem_cache + - 9p: rename p9_free_req() function + - 9p: Add refcount to p9_req_t + - 9p/rdma: do not disconnect on down_interruptible EAGAIN + - 9p: Rename req to rreq in trans_fd + - 9p: acl: fix uninitialized iattr access + - 9p/rdma: remove useless check in cm_event_handler + - 9p: p9dirent_read: check network-provided name length + - 9p: potential NULL dereference + - 9p/trans_fd: abort p9_read_work if req status changed + - 9p/trans_fd: put worker reqs on destroy + - net/9p: include trans_common.h to fix missing prototype warning. + - qmi_wwan: Fix out-of-bounds read + - [armhf,arm64] Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag + on cleanup" + - [armhf,arm64] usb: dwc3: gadget: combine unaligned and zero flags + - [armhf,arm64] usb: dwc3: gadget: track number of TRBs per request + - [armhf,arm64] usb: dwc3: gadget: use num_trbs when skipping TRBs on + ->dequeue() + - [armhf,arm64] usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs() + - [armhf,arm64] usb: dwc3: gadget: introduce cancelled_list + - [armhf,arm64] usb: dwc3: gadget: move requests to cancelled_list + - [armhf,arm64] usb: dwc3: gadget: remove wait_end_transfer + - [armhf,arm64] usb: dwc3: gadget: Clear req->needs_extra_trb flag on + cleanup + - fs/proc/array.c: allow reporting eip/esp for all coredumping threads + - mm/mempolicy.c: fix an incorrect rebind node in mpol_rebind_nodemask + - fs/binfmt_flat.c: make load_flat_shared_library() work + - [armhf] clk: socfpga: stratix10: fix divider entry for the emac clocks + - mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails + - mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on + !PageHuge + - mm/page_idle.c: fix oops because end_pfn is larger than max_pfn + - dm log writes: make sure super sector log updates are written in order + - [x86] scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() + - [x86] speculation: Allow guests to use SSBD even if host does not + - [x86] microcode: Fix the microcode load on CPU hotplug for real + - [x86] resctrl: Prevent possible overrun during bitmap operations + - [x86] KVM: mmu: Allocate PAE root array when using SVM's 32-bit NPT + - NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O + - cpu/speculation: Warn on unsupported mitigations= parameter + - SUNRPC: Clean up initialisation of the struct rpc_rqst + - [mips*] irqchip/mips-gic: Use the correct local interrupt map registers + - eeprom: at24: fix unexpected timeout under high load + - af_packet: Block execution of tasks waiting for transmit to complete in + AF_PACKET + - bonding: Always enable vlan tx offload + - ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while + loop + - net/packet: fix memory leak in packet_set_ring() + - net: remove duplicate fetch in sock_getsockopt + - [armhf,arm64] net: stmmac: fixed new system time seconds value + calculation + - [armhf,arm64] net: stmmac: set IC bit when transmitting frames with HW + timestamp + - sctp: change to hold sk after auth shkey is created successfully + - team: Always enable vlan tx offload + - tipc: change to use register_pernet_device + - tipc: check msg->req data len in tipc_nl_compat_bearer_disable + - tun: wake up waitqueues after IFF_UP is set + - bpf: simplify definition of BPF_FIB_LOOKUP related flags + - bpf: lpm_trie: check left child of last leftmost node for NULL + - bpf: fix nested bpf tracepoints with per-cpu data + - bpf: fix unconnected udp hooks + - bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro + - bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err + - [arm64] futex: Avoid copying out uninitialised stack in failed cmpxchg() + - [arm64] bpf: use more scalable stadd over ldxr / stxr loop in xadd + - futex: Update comments and docs about return values of arch futex code + - RDMA: Directly cast the sockaddr union to sockaddr + - tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb + - [armhf,arm64] usb: dwc3: Reset num_trbs after skipping + - [arm64] insn: Fix ldadd instruction encoding + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.58 + - Bluetooth: Fix faulty expression for minimum encryption key size check + - block: Fix a NULL pointer dereference in generic_make_request() + - md/raid0: Do not bypass blocking queue entered for raid0 bios + - netfilter: nf_flow_table: ignore DF bit setting + - netfilter: nft_flow_offload: set liberal tracking mode for tcp + - netfilter: nft_flow_offload: don't offload when sequence numbers need + adjustment + - netfilter: nft_flow_offload: IPCB is only valid for ipv4 family + - ASoC: soc-pcm: BE dai needs prepare when pause release after resume + - spi: bitbang: Fix NULL pointer dereference in spi_unregister_master + - [armhf,arm64] ASoC: max98090: remove 24-bit format support if RJ is 0 + - [x86] CPU: Add more Icelake model numbers + - ALSA: hdac: fix memory release for SST and SOF drivers + - scsi: hpsa: correct ioaccel2 chaining + - [x86] drm: panel-orientation-quirks: Add quirk for GPD pocket2 + - [x86] drm: panel-orientation-quirks: Add quirk for GPD MicroPC + - [x86] platform: asus-wmi: Only Tell EC the OS will handle display hotkeys + from asus_nb_wmi + - [x86] platform: intel-vbtn: Report switch events when event wakes device + - [x86] platform: mlx-platform: Fix parent device in i2c-mux-reg device + registration + - i2c: pca-platform: Fix GPIO lookup code + - cpuset: restore sanity to cpuset_cpus_allowed_fallback() + - mm/mlock.c: change count_mm_mlocked_page_nr return type + - tracing: avoid build warning with HAVE_NOP_MCOUNT + - module: Fix livepatch/ftrace module text permissions race + - ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() + - [x86] drm/i915/dmc: protect against reading random memory + - crypto: user - prevent operating on larval algorithms + - crypto: cryptd - Fix skcipher instance memory leak + - ALSA: seq: fix incorrect order of dest_client/dest_ports arguments + - ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages + - ALSA: line6: Fix write on zero-sized buffer (CVE-2019-15221) + - ALSA: usb-audio: fix sign unintended sign extension on left shifts + - [x86] ALSA: hda/realtek: Add quirks for several Clevo notebook barebones + - [x86] ALSA: hda/realtek - Change front mic location for Lenovo M710q + - lib/mpi: Fix karactx leak in mpi_powm + - fs/userfaultfd.c: disable irqs for fault_pending and event locks + - tracing/snapshot: Resize spare buffer if size changed + - [armhf] dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node + - drm/amd/powerplay: use hardware fan control if no powerplay fan table + - drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE + - [armhf] drm/etnaviv: add missing failure path to destroy suballoc + - [armhf] drm/imx: notify drm core before sending event during crtc disable + - drm/imx: only send event on crtc disable if kept disabled + - [x86] ftrace: Remove possible deadlock between register_kprobe() and + ftrace_run_update_code() + - mm/vmscan.c: prevent useless kswapd loops + - btrfs: Ensure replaced device doesn't have pending chunk allocation + - tty: rocket: fix incorrect forward declaration of 'rp_init()' + - net/smc: move unhash before release of clcsock + - drm/fb-helper: generic: Don't take module ref for fbcon + - f2fs: don't access node/meta inode mapping after iput + - mac80211: mesh: fix missing unlock on error in table_path_del() + - scsi: tcmu: fix use after free + - [amd64] boot/compressed: Do not corrupt EDX on EFER.LME=1 setting + - [arm64] net: hns: Fixes the missing put_device in positive leg for roce + reset + - ALSA: hda: Initialize power_state field properly + - rds: Fix warning. + - ip6: fix skb leak in ip6frag_expire_frag_queue() + - netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments + - [arm64] net: hns: fix unsigned comparison to less than zero + - bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K + - netfilter: ipv6: nf_defrag: accept duplicate fragments again + - [x86] KVM: degrade WARN to pr_warn_ratelimited + - [x86] KVM: LAPIC: Fix pending interrupt in IRR blocked by software + disable LAPIC + - nfsd: Fix overflow causing non-working mounts on 1 TB machines + - svcrdma: Ignore source port when computing DRC hash + - [mips*] Fix bounds check virt_addr_valid + - [mips*] Add missing EHB in mtc0 -> mfc0 sequence. + - [arm64] dmaengine: qcom: bam_dma: Fix completed descriptors count + - [armhf] dmaengine: imx-sdma: remove BD_INTR for channel0 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.59 + - [x86] Input: elantech - enable middle button support on 2 ThinkPads + - mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he() + - bpf: sockmap, fix use after free from sleep in psock backlog workqueue + - mac80211: mesh: fix RCU warning + - mac80211: free peer keys before vif down in mesh + - iwlwifi: Fix double-free problems in iwl_req_fw_callback() + - can: af_can: Fix error path of can_init() + - net: phy: rename Asix Electronics PHY driver + - [armhf] dts: am335x phytec boards: Fix cd-gpios active level + - [s390x] boot: disable address-of-packed-member warning + - [x86] drm/vmwgfx: Honor the sg list segment size limitation + - [x86] drm/vmwgfx: fix a warning due to missing dma_parms + - [armhf] Input: imx_keypad - make sure keyboard can always wake up system + - [armhf,arm64] KVM: vgic: Fix kvm_device leak in vgic_its_destroy + - mac80211: only warn once on chanctx_conf being NULL + - mac80211: do not start any work during reconfigure flow + - bpf, devmap: Fix premature entry free on destroying map + - bpf, devmap: Add missing bulk queue free + - bpf, devmap: Add missing RCU read lock on flush + - [amd64] bpf: fix stack layout of JITed bpf code + - qmi_wwan: add support for QMAP padding in the RX path + - qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode + - qmi_wwan: extend permitted QMAP mux_id value range + - mmc: core: complete HS400 before checking status + - md: fix for divide error in status_resync + - bnx2x: Check if transceiver implements DDM before access + - drm: return -EFAULT if copy_to_user() fails + - ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL + - net: lio_core: fix potential sign-extension overflow on large shift + - scsi: qedi: Check targetname while finding boot target information + - quota: fix a problem about transfer quota + - [armhf,arm64] net: dsa: mv88e6xxx: fix shift of FID bits in + mv88e6185_g1_vtu_loadpurge() + - NFS4: Only set creation opendata if O_CREAT + - net :sunrpc :clnt :Fix xps refcount imbalance on the error path + - fscrypt: don't set policy for a dead directory + - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length + - media: stv0297: fix frequency range limit + - ALSA: usb-audio: Fix parse of UAC2 Extension Units + - ALSA: hda/realtek - Headphone Mic can't record after S3 + - block, bfq: NULL out the bic when it's no longer valid + - [arm64] perf pmu: Fix uncore PMU alias list for ARM64 + - [x86] ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() + - [x86] tls: Fix possible spectre-v1 in do_get_thread_area() + - USB: serial: ftdi_sio: add ID for isodebug v1 + - USB: serial: option: add support for GosunCn ME3630 RNDIS mode + - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled" + - p54usb: Fix race between disconnect and firmware loading + (CVE-2019-15220) + - usb: gadget: ether: Fix race between gether_disconnect and rx_submit + - [armhf,arm64] usb: dwc2: use a longer AHB idle timeout in + dwc2_core_reset() + - [x86] drivers/usb/typec/tps6598x.c: fix portinfo width + - [x86] drivers/usb/typec/tps6598x.c: fix 4CC cmd write + - [i386] staging: comedi: dt282x: fix a null pointer deref on interrupt + - [x86] staging: comedi: amplc_pci230: fix null pointer deref on interrupt + - HID: Add another Primax PIXART OEM mouse quirk + - binder: fix memory leak in error path + - carl9170: fix misuse of device driver API + - [x86] VMCI: Fix integer overflow in VMCI handle arrays + - staging: rtl8712: reduce stack usage, again + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.60 + - Revert "e1000e: fix cyclic resets at link up with active tx" + - e1000e: start network tx queue only when link is up + - [x86] Input: synaptics - enable SMBUS on T480 thinkpad trackpad + - nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header + - drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel + RDT + - firmware: improve LSM/IMA security behaviour + - [armhf,arm64] irqchip/gic-v3-its: Fix command queue pointer comparison + bug + - [armhf] clk: ti: clkctrl: Fix returning uninitialized data + - [amd64,arm64] efi/bgrt: Drop BGRT status field reserved bits check + - perf/core: Fix perf_sample_regs_user() mm check + - [armhf] omap2: remove incorrect __init annotation + - afs: Fix uninitialised spinlock afs_volume::cb_break_lock + - [x86] apic: Fix integer overflow on 10 bit left shift of cpu_khz + - be2net: fix link failure after ethtool offline test + - ppp: mppe: Add softdep to arc4 + - sis900: fix TX completion + - [armhf] dts: imx6ul: fix PWM[1-4] interrupts + - [armhf] pinctrl: mcp23s08: Fix add_data and irqchip_add_nested call order + - dm table: don't copy from a NULL pointer in realloc_argv() + - dm verity: use message limit for data block corruption message + - [amd64] boot: Fix crash if kernel image crosses page table boundary + - [amd64] boot: Add missing fixup_pointer() for next_early_pgt access + - HID: chicony: add another quirk for PixArt mouse + - HID: multitouch: Add pointstick support for ALPS Touchpad + - cpu/hotplug: Fix out-of-bounds read when setting fail state + - linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL + - genirq: Delay deactivation in free_irq() + - genirq: Fix misleading synchronize_irq() documentation + - genirq: Add optional hardware synchronization for shutdown + - [x86] ioapic: Implement irq_get_irqchip_state() callback + - [x86] irq: Handle spurious interrupt after shutdown gracefully + - [x86] irq: Seperate unused system vectors from spurious entry again + - [s390x] fix stfle zero padding + - [s390x] qdio: (re-)initialize tiqdio list entries + - [s390x] qdio: don't touch the dsci in tiqdio_add_input_queues() + - regmap-irq: do not write mask register if mask_base is zero + - drm/udl: introduce a macro to convert dev to udl. + - drm/udl: Replace drm_dev_unref with drm_dev_put + - drm/udl: move to embedding drm device inside udl device. + - [i386] entry: Fix ENDPROC of common_spurious + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.61 + - [arm64] efi: Mark __efistub_stext_offset as an absolute symbol explicitly + - scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not + supported + - [armhf] dmaengine: imx-sdma: fix use-after-free on probe error path + - wil6210: fix potential out-of-bounds read + - ath10k: Do not send probe response template for mesh + - ath9k: Check for errors when reading SREV register + - ath6kl: add some bounds checking + - ath10k: add peer id check in ath10k_peer_find_by_id + - wil6210: fix spurious interrupts in 3-msi + - ath: DFS JP domain W56 fixed pulse type 3 RADAR detection + - regmap: debugfs: Fix memory leak in regmap_debugfs_init + - batman-adv: fix for leaked TVLV handler. + - media: dvb: usb: fix use after free in dvb_usb_device_exit + - media: marvell-ccic: fix DMA s/g desc number calculation + - media: media_device_enum_links32: clean a reserved field + - [armhf,arm64] net: stmmac: dwmac1000: Clear unused address entries + - [armhf,arm64] net: stmmac: dwmac4/5: Clear unused address entries + - qed: Set the doorbell address correctly + - signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig + - af_key: fix leaks in key_pol_get_resp and dump_sp. + - xfrm: Fix xfrm sel prefix length validation + - fscrypt: clean up some BUG_ON()s in block encryption/decryption + - perf annotate TUI browser: Do not use member from variable within its own + initialization + - media: mc-device.c: don't memset __user pointer contents + - media: saa7164: fix remove_proc_entry warning + - net: phy: Check against net_device being NULL + - tua6100: Avoid build warnings. + - batman-adv: Fix duplicated OGMs on NETDEV_UP + - [armhf] media: wl128x: Fix some error handling in + fm_v4l2_init_video_device() + - [arm64] net: hns3: set ops to null when unregister ad_dev + - cpupower : frequency-set -r option misses the last cpu in related cpu + list + - [armhf,arm64] net: stmmac: dwmac4: fix flow control issue + - [armhf,arm64] net: stmmac: modify default value of tx-frames + - [arm64] crypto: inside-secure - do not rely on the hardware last bit for + result descriptors + - [s390x] qdio: handle PENDING state for QEBSM devices + - net: sfp: add mutex to prevent concurrent state checks + - ipset: Fix memory accounting for hash types on resize + - perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode + - [s390x] perf report: Fix OOM error in TUI mode on s390 + - [arm64] irqchip/meson-gpio: Add support for Meson-G12A SoC + - media: uvcvideo: Fix access to uninitialized fields on probe error + - iommu: Fix a leak in iommu_insert_resv_region + - [armhf] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 + - [armhf] gpio: omap: ensure irq is enabled before wakeup + - regmap: fix bulk writes on paged registers + - bpf: silence warning messages in core + - selinux: fix empty write to keycreate file + - [x86] cpu: Add Ice Lake NNPI to Intel family + - [arm64] ASoC: meson: axg-tdm: fix sample clock inversion + - rcu: Force inlining of rcu_read_lock() + - [x86] cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS + - qed: iWARP - Fix tc for MPA ll2 connection + - [arm64] net: hns3: fix for skb leak when doing selftest + - block: null_blk: fix race condition for null_del_dev + - blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership + arbitration + - xfrm: fix sa selector validation + - sched/core: Add __sched tag for io_schedule() + - sched/fair: Fix "runnable_avg_yN_inv" not used warnings + - [x86] perf/intel/uncore: Handle invalid event coding for free-running + counter + - [x86] atomic: Fix smp_mb__{before,after}_atomic() + - perf evsel: Make perf_evsel__name() accept a NULL argument + - vhost_net: disable zerocopy by default + - ipoib: correcly show a VF hardware address + - [x86] cacheinfo: Fix a -Wtype-limits warning + - blk-iolatency: only account submitted bios + - ACPICA: Clear status of GPEs on first direct enable + - EDAC/sysfs: Fix memory leak when creating a csrow object + - nvme: fix possible io failures when removing multipathed ns + - nvme-pci: properly report state change failure in nvme_reset_work + - nvme-pci: set the errno on ctrl state change error + - lightnvm: pblk: fix freeing of merged pages + - [arm64] Do not enable IRQs for ct_user_exit + - ipsec: select crypto ciphers for xfrm_algo + - ipvs: defer hook registration to avoid leaks + - media: i2c: fix warning same module names + - ntp: Limit TAI-UTC offset + - timer_list: Guard procfs specific code + - [arm64] acpi: ignore 5.1 FADTs that are reported as 5.0 + - media: hdpvr: fix locking and a missing msleep + - [armhf] net: stmmac: sun8i: force select external PHY when no internal + one + - rtlwifi: rtl8192cu: fix error handle when usb probe failed + - mt7601u: do not schedule rx_tasklet when the device has been disconnected + - mt7601u: fix possible memory leak when the device is disconnected + - ipvs: fix tinfo memory leak in start_sync_thread + - ath10k: add missing error handling + - ath10k: fix PCIE device wake up failed + - perf tools: Increase MAX_NR_CPUS and MAX_CACHES + - [x86] ASoC: Intel: hdac_hdmi: Set ops to NULL on remove + - libata: don't request sense data on !ZAC ATA devices + - [armhf] clocksource/drivers/exynos_mct: Increase priority over ARM arch + timer + - xsk: Properly terminate assignment in xskq_produce_flush_desc + - rslib: Fix decoding of shortened codes + - rslib: Fix handling of of caller provided syndrome + - ixgbe: Check DDM existence in transceiver before access + - crypto: serpent - mark __serpent_setkey_sbox noinline + - wil6210: drop old event after wmi_call timeout + - EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec + - bcache: check CACHE_SET_IO_DISABLE in allocator code + - bcache: check CACHE_SET_IO_DISABLE bit in bch_journal() + - bcache: acquire bch_register_lock later in cached_dev_free() + - bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() + - bcache: fix potential deadlock in cached_def_free() + - [arm64] net: hns3: fix a -Wformat-nonliteral compile warning + - [arm64] net: hns3: add some error checking in hclge_tm module + - ath10k: destroy sdio workqueue while remove sdio module + - [armhf,arm64] net: mvpp2: prs: Don't override the sign bit in SRAM parser + shift + - igb: clear out skb->tstamp after reading the txtime + - iwlwifi: mvm: Drop large non sta frames + - perf stat: Make metric event lookup more robust + - perf stat: Fix group lookup for metric group + - bnx2x: Prevent ptp_task to be rescheduled indefinitely + - net: usb: asix: init MAC address buffers + - rxrpc: Fix oops in tracepoint + - bpf, libbpf, smatch: Fix potential NULL pointer dereference + - bonding: validate ip header before check IPPROTO_IGMP + - gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants + - [ppc64el] tools: bpftool: Fix json dump crash on powerpc + - Bluetooth: hci_bcsp: Fix memory leak in rx_skb + - Bluetooth: Add new 13d3:3491 QCA_ROME device + - Bluetooth: Add new 13d3:3501 QCA_ROME device + - Bluetooth: 6lowpan: search for destination address in all peers + - [ppc64el] perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64 + - Bluetooth: Check state in l2cap_disconnect_rsp + - gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() + - Bluetooth: validate BLE connection interval updates + - gtp: fix suspicious RCU usage + - gtp: fix Illegal context switch in RCU read-side critical section. + - gtp: fix use-after-free in gtp_encap_destroy() + - gtp: fix use-after-free in gtp_newlink() + - [armel/marvell,armhf] net: mvmdio: defer probe of orion-mdio if a clock + is not ready + - iavf: fix dereference of null rx_buffer pointer + - floppy: fix out-of-bounds read in next_valid_format + - floppy: fix invalid pointer dereference in drive_name + - xen: let alloc_xenballooned_pages() fail if not enough memory free + - scsi: core: Fix race on creating sense cache + - scsi: megaraid_sas: Fix calculation of target ID + - crypto: ghash - fix unaligned memory access in ghash_setkey() + - [x86] crypto: ccp - Validate the the error value used to index error + messages + - [arm64] crypto: sha1-ce - correct digest for empty data in finup + - [arm64] crypto: sha2-ce - correct digest for empty data in finup + - crypto: chacha20poly1305 - fix atomic sleep when using async algorithm + - [x86] crypto: ccp - memset structure fields to zero before reuse + - [x86] crypto: ccp/gcm - use const time tag comparison. + - Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()" + - bcache: Revert "bcache: fix high CPU occupancy during journal" + - bcache: Revert "bcache: free heap cache_set->flush_btree in + bch_journal_free" + - bcache: ignore read-ahead request failure on backing device + - bcache: fix mistaken sysfs entry for io_error counter + - bcache: destroy dc->writeback_write_wq if failed to create + dc->writeback_thread + - Input: alps - don't handle ALPS cs19 trackpoint-only device + - [x86] Input: synaptics - whitelist Lenovo T580 SMBus intertouch + - Input: alps - fix a mismatch between a condition check and its comment + - [armhf] regulator: s2mps11: Fix buck7 and buck8 wrong voltages + - [arm64] tegra: Update Jetson TX1 GPU regulator timings + - iwlwifi: pcie: don't service an interrupt that was masked + - iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X + - iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill + - iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices + - NFSv4: Handle the special Linux file open access mode + - pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error + - pNFS: Fix a typo in pnfs_update_layout + - pnfs: Fix a problem where we gratuitously start doing I/O through the MDS + - lib/scatterlist: Fix mapping iterator when sg->offset is greater than + PAGE_SIZE + - ASoC: dapm: Adapt for debugfs API change + - raid5-cache: Need to do start() part job after adding journal device + - ALSA: seq: Break too long mutex context in the write loop + - [x86] ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell + platform + - [x86] ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine + - media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() + - media: videobuf2-core: Prevent size alignment wrapping buffer size to 0 + - media: videobuf2-dma-sg: Prevent size from overflowing + - [x86] KVM: vPMU: refine kvm_pmu err msg when event creation failed + - [arm64] tegra: Fix AGIC register range + - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys + inodes. + - kconfig: fix missing choice values in auto.conf + - drm/nouveau/i2c: Enable i2c pads & busses during preinit + - padata: use smp_mb in padata_reorder to avoid orphaned padata jobs + - dm zoned: fix zone state management race + - xen/events: fix binding user event channels to cpus + - 9p/xen: Add cleanup path in p9_trans_xen_init + - 9p/virtio: Add cleanup path in p9_virtio_init + - [x86] boot: Fix memory leak in default_get_smp_config() + - [x86] perf/intel: Fix spurious NMI on fixed counter + - [x86] perf/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 + PMCs + - [x86] perf/amd/uncore: Set the thread mask for F17h L3 PMCs + - drm/edid: parse CEA blocks embedded in DisplayID + - [x86] intel_th: pci: Add Ice Lake NNPI support + - [x86] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() + - PCI: Do not poll for PME if the device is in D3cold + - [arm64] PCI: qcom: Ensure that PERST is asserted for at least 100 ms + - Btrfs: fix data loss after inode eviction, renaming it, and fsync it + - Btrfs: fix fsync not persisting dentry deletions due to inode evictions + - Btrfs: add missing inode version, ctime and mtime updates when punching + hole + - IB/mlx5: Report correctly tag matching rendezvous capability + - HID: wacom: generic: only switch the mode on devices with LEDs + - HID: wacom: generic: Correct pad syncing + - HID: wacom: correct touch resolution x/y typo + - libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields + - coda: pass the host file in vma->vm_file on mmap + - include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT + architectures + - xfs: fix pagecache truncation prior to reflink + - xfs: flush removing page cache in xfs_reflink_remap_prep + - xfs: don't overflow xattr listent buffer + - xfs: rename m_inotbt_nores to m_finobt_nores + - xfs: don't ever put nlink > 0 inodes on the unlinked list + - xfs: reserve blocks for ifree transaction during log recovery + - xfs: fix reporting supported extra file attributes for statx() + - xfs: serialize unaligned dio writes against all other dio writes + - xfs: abort unaligned nowait directio early + - [ppc64el] watchpoint: Restore NV GPRs while returning from exception + - [ppc64el] powernv/npu: Fix reference leak + - [ppc64el] pseries: Fix oops in hotplug memory notifier + - [arm64] mmc: sdhci-msm: fix mutex while in spinlock + - eCryptfs: fix a couple type promotion bugs + - [x86] intel_th: msu: Fix single mode with disabled IOMMU + - Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug + - usb: Handle USB3 remote wakeup for LPM enabled devices correctly + - blk-throttle: fix zero wait time for iops throttled group + - blk-iolatency: clear use_delay when io.latency is set to zero + - blkcg: update blkcg_print_stat() to handle larger outputs + - [armel/marvell,armhf] net: mvmdio: allow up to four clocks to be + specified for orion-mdio + - dm bufio: fix deadlock with loop device + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.62 + - bnx2x: Prevent load reordering in tx completion processing + - [x86] hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() + - igmp: fix memory leak in igmpv3_del_delrec() + - ipv4: don't set IPv6 only flags to IPv4 addresses + - ipv6: rt6_check should return NULL if 'from' is NULL + - ipv6: Unlink sibling route in case of failure + - [armhf,arm64] net: dsa: mv88e6xxx: wait after reset deactivation + - net: make skb_dst_force return true when dst is refcounted + - net: neigh: fix multiple neigh timer scheduling + - net: openvswitch: fix csum updates for MPLS actions + - net: phy: sfp: hwmon: Fix scaling of RX power + - [armhf,arm64] net: stmmac: Re-work the queue selection for TSO packets + - nfc: fix potential illegal memory access + - r8169: fix issue with confused RX unit after PHY power-down on RTL8411b + - rxrpc: Fix send on a connected, but unbound socket + - sctp: fix error handling on stream scheduler initialization + - [x86] sky2: Disable MSI on ASUS P6T + - tcp: be more careful in tcp_fragment() + - tcp: fix tcp_set_congestion_control() use from bpf hook + - tcp: Reset bytes_acked and bytes_received when disconnecting + - vrf: make sure skb->data contains ip header to make routing + - net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn + - macsec: fix use-after-free of skb during RX + - macsec: fix checksumming after decryption + - netrom: fix a memory leak in nr_rx_frame() + - netrom: hold sock when setting skb->destructor + - net_sched: unset TCQ_F_CAN_BYPASS when adding filters + - sctp: not bind the socket in sctp_connect + - net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling + - net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query + - net: bridge: don't cache ether dest pointer on input + - net: bridge: stp: don't cache eth dest pointer before skb pull + - dma-buf: balance refcount inbalance + - dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc + - perf/core: Fix exclusive events' grouping + - perf/core: Fix race between close() and fork() + - ext4: don't allow any modifications to an immutable file + - ext4: enforce the immutable flag on open files + - mm: add filemap_fdatawait_range_keep_errors() + - jbd2: introduce jbd2_inode dirty range scoping + - ext4: use jbd2_inode dirty range scoping + - ext4: allow directory holes + - [x86] KVM: nVMX: do not use dangling shadow VMCS after guest reset + - [x86] KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving + nested + - mm: vmscan: scan anonymous pages on file refaults + - net: sched: verify that q!=NULL before setting q->flags + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.63 + - [x86] hvsock: fix epollout hang from race condition + - [armhf,arm64] drm/panel: simple: Fix panel_simple_dsi_probe + - [x86] staging: vt6656: use meaningful error code during buffer allocation + - usb: core: hub: Disable hub-initiated U1/U2 + - [armhf,arm64] pinctrl: rockchip: fix leaked of_node references + - drm/amd/display: Fill prescale_params->scale for RGB565 + - drm/amdgpu/sriov: Need to initialize the HDP_NONSURFACE_BAStE + - drm/amd/display: Disable ABM before destroy ABM struct + - drm/amdkfd: Fix a potential memory leak + - drm/amdkfd: Fix sdma queue map issue + - drm/edid: Fix a missing-check bug in drm_load_edid_firmware() + - PCI: Return error if cannot probe VF + - [armhf,arm64] gpu: host1x: Increase maximum DMA segment size + - drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry + - drm/crc-debugfs: Also sprinkle irqrestore over early exits + - memstick: Fix error cleanup path of memstick_init + - [arm64] tty: serial: msm_serial: avoid system lockup condition + - serial: 8250: Fix TX interrupt handling condition + - drm/amd/display: Always allocate initial connector state state + - drm/virtio: Add memory barriers for capset cache. + - drm/amd/display: fix compilation error + - [ppc64el] pseries/mobility: prevent cpu hotplug during DT update + - [armhf,arm64] drm/rockchip: Properly adjust to a true clock in + adjusted_mode + - [armhf] serial: imx: fix locking in set_termios() + - tty: serial_core: Set port active bit in uart_port_activate + - usb: gadget: Zero ffs_io_data + - mmc: sdhci: sdhci-pci-o2micro: Check if controller supports 8-bit width + - [ppc64el] pci/of: Fix OF flags parsing for 64bit BARs + - [arm64] drm/msm: Depopulate platform on probe failure + - [arm64] PCI: xilinx-nwl: Fix Multi MSI data programming + - iio: iio-utils: Fix possible incorrect mask calculation + - [ppc64el] cacheflush: fix variable set but not used + - [ppc64el] xmon: Fix disabling tracing while in xmon + - [ppc64el] recordmcount: Fix spurious mcount entries on powerpc + - mfd: core: Set fwnode for created devices + - [arm64] mfd: hi655x-pmic: Fix missing return value check for + devm_regmap_init_mmio_clk + - mm/swap: fix release_pages() when releasing devmap pages + - RDMA/i40iw: Set queue pair state when being queried + - IB/mlx5: Fixed reporting counters on 2nd port for Dual port RoCE + - [ppc64el] mm: Handle page table allocation failures + - IB/ipoib: Add child to parent list only if device initialized + - [arm64] assembler: Switch ESB-instruction with a vanilla nop if + !ARM64_HAS_RAS + - perf stat: Fix use-after-freed pointer detected by the smatch tool + - perf top: Fix potential NULL pointer dereference detected by the smatch + tool + - perf session: Fix potential NULL pointer dereference found by the smatch + tool + - perf annotate: Fix dereferencing freed memory found by the smatch tool + - perf hists browser: Fix potential NULL pointer dereference found by the + smatch tool + - RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM + - [armhf] PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB + - [ppc64el] boot: add {get, put}_unaligned_be32 to xz_config.h + - block: init flush rq ref count to 1 + - f2fs: avoid out-of-range memory access + - mailbox: handle failed named mailbox channel request + - dlm: check if workqueues are NULL before flushing/destroying + - [ppc64el] eeh: Handle hugepages in ioremap space + - block/bio-integrity: fix a memory leak bug + - 9p: pass the correct prototype to read_cache_page + - mm/gup.c: mark undo_dev_pagemap as __maybe_unused + - mm/gup.c: remove some BUG_ONs from get_gate_page() + - memcg, fsnotify: no oom-kill for remote memcg charging + - mm/mmu_notifier: use hlist_add_head_rcu() + - proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup + - proc: use down_read_killable mmap_sem for /proc/pid/pagemap + - proc: use down_read_killable mmap_sem for /proc/pid/clear_refs + - proc: use down_read_killable mmap_sem for /proc/pid/map_files + - cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() + - proc: use down_read_killable mmap_sem for /proc/pid/maps + - locking/lockdep: Fix lock used or unused stats error + - mm: use down_read_killable for locking mmap_sem in access_remote_vm + - locking/lockdep: Hide unused 'class' variable + - usb: wusbcore: fix unbalanced get/put cluster_id + - [x86] usb: pci-quirks: Correct AMD PLL quirk detection + - btrfs: inode: Don't compress if NODATASUM or NODATACOW set + - [x86] sysfb_efi: Add quirks for some devices with swapped width and + height + - [x86] speculation/mds: Apply more accurate check on hypervisor platform + - binder: prevent transactions to context manager from its own process. + - fpga-manager: altera-ps-spi: Fix build error + - [x86] mei: me: add mule creek canyon (EHL) device ids + - [x86] hpet: Fix division by zero in hpet_time_div() + - ALSA: ac97: Fix double free of ac97_codec_device + - ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 + - ALSA: hda - Add a conexant codec entry to let mute led work + - [ppc64el] xive: Fix loop exit-condition in xive_find_target_in_mask() + - libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl() + - access: avoid the RCU grace period for the temporary subjective + credentials + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.64 + - [x86] hv_sock: Add support for delayed close + - vsock: correct removal of socket from the list + - NFS: Fix dentry revalidation on NFSv4 lookup + - NFS: Refactor nfs_lookup_revalidate() + - NFSv4: Fix lookup revalidate of regular files + - [armhf,arm64] usb: dwc2: Disable all EP's on disconnect + - [armhf,arm64] usb: dwc2: Fix disable all EP's on disconnect + - [arm64] compat: Provide definition for COMPAT_SIGMINSTKSZ + (Closes: #904385). + - binder: fix possible UAF when freeing buffer + - ISDN: hfcsusb: checking idx of ep configuration + - media: au0828: fix null dereference in error path + - ath10k: Change the warning message string + - media: cpia2_usb: first wake up, then free in disconnect + (CVE-2019-15215) + - media: pvrusb2: use a different format for warnings + - NFS: Cleanup if nfs_match_client is interrupted + - media: radio-raremono: change devm_k*alloc to k*alloc (CVE-2019-15211) + - [x86] iommu/vt-d: Don't queue_iova() if there is no flush queue + - vhost: introduce vhost_exceeds_weight() + - vhost_net: fix possible infinite loop (CVE-2019-3900) + - vhost: vsock: add weight support + - vhost: scsi: add weight support (CVE-2019-3900) + - sched/fair: Don't free p->numa_faults with concurrent readers + - sched/fair: Use RCU accessors consistently for ->numa_group + - /proc/<pid>/cmdline: remove all the special cases + - /proc/<pid>/cmdline: add back the setproctitle() special case + - drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl + - Fix allyesconfig output. + - ceph: hold i_ceph_lock when removing caps for freeing inode + - block, scsi: Change the preempt-only flag into a counter + - scsi: core: Avoid that a kernel warning appears during system resume + - ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.65 + - [armhf] dts: rockchip: Make rk3288-veyron-minnie run at hs200 + - [armhf] dts: rockchip: Make rk3288-veyron-mickey's emmc work again + - [armhf] dts: rockchip: Mark that the rk3288 timer might stop in suspend + - ftrace: Enable trampoline when rec count returns back to one + - [armhf,arm64] dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag + is unset + - [arm64] dts: rockchip: fix isp iommu clocks and power domain + - kernel/module.c: Only return -EEXIST for modules that have finished + loading + - [arm64] clk: tegra210: fix PLLU and PLLU_OUT1 + - fs/adfs: super: fix use-after-free bug + - btrfs: fix minimum number of chunk errors for DUP + - btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit() + - cifs: Fix a race condition with cifs_echo_request + - ceph: fix improper use of smp_mb__before_atomic() + - ceph: return -ERANGE if virtual xattr value didn't fit in buffer + - ACPI: blacklist: fix clang warning for unused DMI table + - [s390x] scsi: zfcp: fix GCC compiler warning emitted with + -Wmaybe-uninitialized + - perf version: Fix segfault due to missing OPT_END() + - [x86] kvm: avoid constant-conversion warning + - ACPI: fix false-positive -Wuninitialized warning + - be2net: Signal that the device cannot transmit during reconfiguration + - [x86] apic: Silence -Wtype-limits compiler warnings + - mm/cma.c: fail if fixed declaration can't be honored + - lib/test_overflow.c: avoid tainting the kernel and fix wrap size + - lib/test_string.c: avoid masking memset16/32/64 failures + - coda: add error handling for fget + - coda: fix build using bare-metal toolchain + - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side + headers + - drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings + - ipc/mqueue.c: only perform resource calculation if user valid + - [x86] xen/pv: Fix a boot up hang revealed by int3 self test + - [x86] kvm: Don't call kvm_spurious_fault() from .fixup + - [x86] paravirt: Fix callee-saved function ELF sizes + - [x86] boot: Remove multiple copy of static function sanitize_boot_params() + - drm/nouveau: fix memory leak in nouveau_conn_reset() + - kconfig: Clear "written" flag to avoid data loss + - Btrfs: fix incremental send failure after deduplication + - Btrfs: fix race leading to fs corruption after transaction abort + - [armhf,arm64] mmc: dw_mmc: Fix occasional hang after tuning on eMMC + - [arm64] mmc: meson-mx-sdio: Fix misuse of GENMASK macro + - gpiolib: fix incorrect IRQ requesting of an active-low lineevent + - IB/hfi1: Fix Spectre v1 vulnerability + - mtd: rawnand: micron: handle on-die "ECC-off" devices correctly + - selinux: fix memory leak in policydb_init() + - ALSA: hda: Fix 1-minute detection delay when i915 module is not available + (Closes: #931507) + - mm: vmscan: check if mem cgroup is disabled or not before calling memcg + slab shrinker + - [s390x] dasd: fix endless loop after read unit address configuration + - [arm*] drivers/perf: arm_pmu: Fix failure path in PM notifier + - [arm64] compat: Allow single-byte watchpoints on all addresses + - [arm64] cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} + - nbd: replace kill_bdev() with __invalidate_device() again + - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() + - IB/mlx5: Fix unreg_umr to ignore the mkey state + - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure + - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache + - IB/mlx5: Fix clean_mr() to work in the expected order + - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification + - IB/hfi1: Check for error on call to alloc_rsm_map_table + - [x86] drm/i915/gvt: fix incorrect cache entry for guest page mapping + - eeprom: at24: make spd world-readable again + - objtool: Support GCC 9 cold subfunction naming scheme + - gcc-9: properly declare the {pv,hv}clock_page storage + - [x86] vdso: Prevent segfaults due to hoisted vclock reads + - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.66 + - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure + - gcc-9: don't warn about uninitialized variable + - driver core: Establish order of operations for device_add and device_del + via bitflag + - drivers/base: Introduce kill_device() + - libnvdimm/bus: Prevent duplicate device_unregister() calls + - libnvdimm/region: Register badblocks before namespaces + - libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant + - libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock + - HID: wacom: fix bit shift for Cintiq Companion 2 + - HID: Add quirk for HP X1200 PIXART OEM mouse + - IB: directly cast the sockaddr union to aockaddr + - atm: iphase: Fix Spectre v1 vulnerability + - bnx2x: Disable multi-cos feature. + - ife: error out when nla attributes are empty + - ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6 + - ip6_tunnel: fix possible use-after-free on xmit + - ipip: validate header length in ipip_tunnel_xmit + - [armhf,arm64] mvpp2: fix panic on module removal + - [armhf,arm64] mvpp2: refactor MTU change code + - net: bridge: delete local fdb on device init failure + - net: bridge: mcast: don't delete permanent entries when fast leave is + enabled + - net: fix ifindex collision during namespace removal + - net/mlx5e: always initialize frag->last_in_page + - net/mlx5: Use reversed order when unregister devices + - net: phylink: Fix flow control for fixed-link + - net: sched: Fix a possible null-pointer dereference in dequeue_func() + - net sched: update vlan action for batched events operations + - net: sched: use temporary variable for actions indexes + - net/smc: do not schedule tx_work in SMC_CLOSED state + - tipc: compat: allow tipc commands without arguments + - tun: mark small packets as owned by the tap sock + - net/mlx5: Fix modify_cq_in alignment + - net/mlx5e: Prevent encap flow counter update async to user query + - r8169: don't use MSI before RTL8168d + - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling + - cgroup: Call cgroup_release() before __exit_signal() + - cgroup: Implement css_task_iter_skip() + - cgroup: Include dying leaders with live threads in PROCS iterations + - cgroup: css_task_iter_skip()'d iterators must be advanced before accessed + - cgroup: Fix css_task_iter_advance_css_set() cset skip condition + - [arm*] spi: bcm2835: Fix 3-wire mode if DMA is enabled + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.67 + - [x86] crypto: ccp - Fix oops by properly managing allocated structures + - [x86] crypto: ccp - Add support for valid authsize values less than 16 + - [x86] crypto: ccp - Ignore tag length when decrypting GCM ciphertext + - usb: usbfs: fix double-free of usb memory upon submiturb error + - usb: iowarrior: fix deadlock on disconnect + - sound: fix a memory leak bug + - [arm64,mips*/octeon] mmc: cavium: Set the correct dma max segment size + for mmc_host + - [arm64,mips*/octeon] mmc: cavium: Add the missing dma unmap when the dma + has finished. + - loop: set PF_MEMALLOC_NOIO for the worker thread + - Input: usbtouchscreen - initialize PM mutex before using it + - [x86] Input: elantech - enable SMBus on new (2018+) systems + - [x86] Input: synaptics - enable RMI mode for HP Spectre X360 + - [x86] mm: Check for pfn instead of page in vmalloc_sync_one() + - [x86] mm: Sync also unmappings in vmalloc_sync_all() + - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() + - [s390x] perf annotate: Fix s390 gap between kernel end and module start + - perf db-export: Fix thread__exec_comm() + - [s390x] perf record: Fix module size on s390 + - [x86] purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS + - gfs2: gfs2_walk_metadata fix + - usb: yurex: Fix use-after-free in yurex_delete + - [x86] usb: typec: tcpm: free log buf memory when remove debug file + - [x86] usb: typec: tcpm: remove tcpm dir if no children + - [x86] usb: typec: tcpm: Add NULL check before dereferencing config + - [x86] usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests + - can: peak_usb: fix potential double kfree_skb() + - netfilter: nfnetlink: avoid deadlock due to synchronous request_module + - [s390x] vfio-ccw: Set pa_nr to 0 if memory allocation fails for + pa_iova_pfn + - netfilter: Fix rpfilter dropping vrf packets by mistake + - netfilter: conntrack: always store window size un-scaled + - netfilter: nft_hash: fix symhash with modulus one + - drm/amd/display: Wait for backlight programming completion in set + backlight level + - drm/amd/display: use encoder's engine id to find matched free audio + device + - drm/amd/display: Fix dc_create failure handling and 666 color depths + - drm/amd/display: Only enable audio if speaker allocation exists + - drm/amd/display: Increase size of audios array + - [x86] iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of + ISCSI_IBFT_FIND + - nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN + - mac80211: don't warn about CW params when not using them + - allocate_flower_entry: should check for null deref + - hwmon: (nct6775) Fix register address and added missed tolerance for + nct6106 + - drm: silence variable 'conn' set but not used + - [s390x] qdio: add sanity checks to the fast-requeue path + - ALSA: compress: Fix regression on compressed capture streams + - ALSA: compress: Prevent bypasses of set_params + - ALSA: compress: Don't allow paritial drain operations on capture streams + - ALSA: compress: Be more restrictive about when a drain is allowed + - perf tools: Fix proper buffer size for feature processing + - perf probe: Avoid calling freeing routine multiple times for same pointer + - drbd: dynamically allocate shash descriptor + - ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() + - nvme: fix multipath crash when ANA is deactivated + - scsi: megaraid_sas: fix panic on loading firmware crashdump + - [ppc64el] scsi: ibmvfc: fix WARN_ON during event pool release + - scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG + - test_firmware: fix a memory leak bug + - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop + - perf/core: Fix creating kernel counters for PMUs that override event->cpu + - [s390x] dma: provide proper ARCH_ZONE_DMA_BITS value + - HID: sony: Fix race condition between rumble and device remove. + - [x86] purgatory: Do not use __builtin_memcpy and __builtin_memset + - ALSA: usb-audio: fix a memory leak bug + - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices + - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices + - hwmon: (nct7802) Fix wrong detection of in4 presence + - [x86] drm/i915: Fix wrong escape clock divisor init for GLK + - ALSA: firewire: fix a memory leak bug + - ALSA: hiface: fix multiple memory leak bugs + - ALSA: hda - Don't override global PCM hw info flag + - [x86] ALSA: hda - Workaround for crackled sound on AMD controller + (1022:1457) + - mac80211: don't WARN on short WMM parameters from AP + - dax: dax_layout_busy_page() should not unmap cow pages + - SMB3: Fix deadlock in validate negotiate hits reconnect + - smb3: send CAP_DFS capability during session setup + - NFSv4: Fix an Oops in nfs4_do_setattr + - [x86] KVM: Fix leak vCPU's VMCS value into other pCPU + - mwifiex: fix 802.11n/WPA detection + - iwlwifi: don't unmap as page memory that was mapped as single + - iwlwifi: mvm: fix an out-of-bound access + - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41 + - iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support + + [ Steve McIntyre ] + * [arm64] Improve support for the Huawei TaiShan server platform + (Closes: #930554): + - Enable the HNS/ROCE Infiniband driver + - Backport fixes from 4.20 and 4.21 for HNS3 networking, hisi_sas SAS + and HNS/ROCE Infiniband + - Add module:drivers/scsi/hisi_sas/* to the ABI ignore list + + [ Uwe Kleine-König ] + * [armhf] Add support for all i.MX6 variants. + * rtc-s35390a: backport fix to make hwclock able to read the time + (Closes: #932845) + + [ Ben Hutchings ] + * [rt] Update to 4.19.59-rt24: + - Fix build failure after "genirq: Prevent use-after-free and work + list corruption": + + Update "genirq: Do not invoke the affinity callback via a workqueue on + RT" + + kthread: add a global worker thread. + + genirq: Do not invoke the affinity callback via a workqueue on RT + + genirq: Handle missing work_struct in irq_set_affinity_notifier() + - Update "irqwork: push most work into softirq context" to resolve + conflict with "irq_work: Do not raise an IPI when queueing work on the + local CPU" + - Drop "random: avoid preempt_disable()ed section" + - arm: imx6: cpuidle: Use raw_spinlock_t + - rcu: Don't allow to change rcu_normal_after_boot on RT + - sched/core: Drop a preempt_disable_rt() statement + - timers: Redo the notification of canceling timers on -RT + - Fix futex regression in 4.19.21: + + Revert "futex: Ensure lock/unlock symetry versus pi_lock and hash + bucket lock" + + Revert "futex: Fix bug on when a requeued RT task times out" + + Revert "rtmutex: Handle the various new futex race conditions" + + Revert "futex: workaround migrate_disable/enable in different context" + + futex: Make the futex_hash_bucket lock raw + + futex: Delay deallocation of pi_state + - mm/zswap: Do not disable preemption in zswap_frontswap_store() + * Bump ABI to 6 + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 21 Aug 2019 17:44:57 +0100 + +linux (4.19.37-5+deb10u2) buster-security; urgency=high + + [ Romain Perier ] + * [x86] x86/insn-eval: Fix use-after-free access to LDT entry (CVE-2019-13233) + * [powerpc*] mm/64s/hash: Reallocate context ids on fork (CVE-2019-12817) + * nfc: Ensure presence of required attributes in the deactivate_target handler + (CVE-2019-12984) + * binder: fix race between munmap() and direct reclaim (CVE-2019-1999) + * scsi: libsas: fix a race condition when smp task timeout (CVE-2018-20836) + * Input: gtco - bounds check collection indent level (CVE-2019-13631) + * floppy: fix out-of-bounds read in copy_buffer (CVE-2019-14283) + * inet: switch IP ID generator to siphash (CVE-2019-10638) + * floppy: fix div-by-zero in setup_format_params (CVE-2019-14284) + * Bluetooth: hci_uart: check for missing tty operations (CVE-2019-10207) + * [powerpc/tm] Fix oops on sigreturn on systems without TM (CVE-2019-13648) + + [ Salvatore Bonaccorso ] + * [x86] cpufeatures: Carve out CQM features retrieval + * [x86] cpufeatures: Combine word 11 and 12 into a new scattered features + word + * [x86] speculation: Prepare entry code for Spectre v1 swapgs mitigations + * [x86] speculation: Enable Spectre v1 swapgs mitigations (CVE-2019-1125) + * [amd64] entry: Use JMP instead of JMPQ + * [x86] speculation/swapgs: Exclude ATOMs from speculation through SWAPGS + * Documentation: Add section about CPU vulnerabilities for Spectre + * Documentation: Add swapgs description to the Spectre v1 documentation + + [ Ben Hutchings ] + * [x86] cpufeatures: Avoid ABI change for swapgs mitigations: + - Move swapgs feature bits to existing scattered words + - Revert "x86/cpufeatures: Combine word 11 and 12 into a new scattered + features word" + * inet: Avoid ABI change for IP ID hash change + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 08 Aug 2019 03:02:38 +0100 + +linux (4.19.37-5+deb10u1) buster-security; urgency=high + + * tcp: refine memory limit test in tcp_fragment() (Closes: #930904) + * ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (CVE-2019-13272) + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 19 Jul 2019 10:45:17 +0200 + +linux (4.19.37-5) unstable; urgency=medium + + [ Romain Perier ] + * [sparc64] Fix device naming inconsistency between sunhv_console and + sunhv_reg (Closes: #926539) + + [ Ben Hutchings ] + * tcp: Avoid ABI change for DoS fixes (Closes: #930743) + * Add ABI reference for 4.19.0-5 + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 19 Jun 2019 23:16:58 +0100 + +linux (4.19.37-4) unstable; urgency=high + + [ Ben Hutchings ] + * libbpf: Fix various build bugs: + - Drop unnecessary changes from "libbpf: add SONAME to shared object" + - libbpf: Use only 2 components in soversion, matching package name + (Closes: #929187) + - libbpf: Build out-of-tree + * README.source: Document the various makefiles and use of out-of-tree builds + * [x86] lockdown,sysrq: Enable ALLOW_LOCKDOWN_LIFT_BY_SYSRQ (Closes: #929583) + * mwifiex: Fix possible buffer overflows at parsing bss descriptor + (CVE-2019-3846) + * mwifiex: Abort at too short BSS descriptor element + * mwifiex: Don't abort on small, spec-compliant vendor IEs + * mm/mincore.c: make mincore() more conservative (CVE-2019-5489) + * mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() + (CVE-2019-10126) + * tcp: limit payload size of sacked skbs (CVE-2019-11477) + * tcp: tcp_fragment() should apply sane memory limits (CVE-2019-11478) + * tcp: add tcp_min_snd_mss sysctl (CVE-2019-11479) + * tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() + + [ Romain Perier ] + * [rt] Update to 4.19.37-rt20: + - powerpc/pseries/iommu: Use a locallock instead local_irq_save() + - powerpc: reshuffle TIF bits + - tty/sysrq: Convert show_lock to raw_spinlock_t + - drm/i915: Don't disable interrupts independently of the lock + - sched/completion: Fix a lockup in wait_for_completion() + + [ Salvatore Bonaccorso ] + * brcmfmac: assure SSID length from firmware is limited (CVE-2019-9500) + * brcmfmac: add subtype check for event handling in data path + (CVE-2019-9503) + * ext4: zero out the unused memory region in the extent tree block + (CVE-2019-11833) + * Bluetooth: hidp: fix buffer overflow (CVE-2019-11884) + + [ Aurelien Jarno ] + * [mips] Correctly bounds check virt_addr_valid (Closes: #929366) + + [ John Paul Adrian Glaubitz ] + * [sparc64] udeb: Disable suffix for kernel-image + + [ Alper Nebi Yasak ] + * udeb: input-modules: Include all keyboard driver modules + * [arm64] udeb: kernel-image: Include cros_ec_spi and SPI drivers + * [arm64] udeb: kernel-image: Include phy-rockchip-pcie + * [arm64] udeb: usb-modules: Include phy-rockchip-typec, extcon-usbc-cros-ec + * [arm64] udeb: mmc-modules: Include phy-rockchip-emmc + * [arm64] udeb: fb-modules: Include rockchipdrm, panel-simple, pwm_bl and + pwm-cros-ec + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 17 Jun 2019 20:00:22 +0100 + +linux (4.19.37-3) unstable; urgency=medium + + * [powerpc*] 64s: Include cpu header (fixes FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 15 May 2019 23:07:16 +0100 + +linux (4.19.37-2) unstable; urgency=high + + * debian/bin: Fix Python static checker regressions (Closes: #928618) + * Clean up speculation mitigations: + - Documentation/l1tf: Fix small spelling typo + - x86/cpu: Sanitize FAM6_ATOM naming + - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID + - x86/msr-index: Cleanup bit defines + - x86/speculation: Consolidate CPU whitelists + - Documentation: Move L1TF to separate directory + - cpu/speculation: Add 'mitigations=' cmdline option + - x86/speculation: Support 'mitigations=' cmdline option + - powerpc/speculation: Support 'mitigations=' cmdline option + - s390/speculation: Support 'mitigations=' cmdline option + - x86/speculation/mds: Add 'mitigations=' support for MDS + * [x86] Mitigate Microarchitectural Data Sampling (MDS) vulnerabilities + (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091): + - x86/speculation/mds: Add basic bug infrastructure for MDS + - x86/speculation/mds: Add BUG_MSBDS_ONLY + - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests + - x86/speculation/mds: Add mds_clear_cpu_buffers() + - x86/speculation/mds: Clear CPU buffers on exit to user + - x86/kvm/vmx: Add MDS protection when L1D Flush is not active + - x86/speculation/mds: Conditionally clear CPU buffers on idle entry + - x86/speculation/mds: Add mitigation control for MDS + - x86/speculation/mds: Add sysfs reporting for MDS + - x86/speculation/mds: Add mitigation mode VMWERV + - Documentation: Add MDS vulnerability documentation + - x86/speculation/mds: Add mds=full,nosmt cmdline option + - x86/speculation: Move arch_smt_update() call to after mitigation decisions + - x86/speculation/mds: Add SMT warning message + - x86/speculation/mds: Fix comment + - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off + - x86/mds: Add MDSUM variant to the MDS documentation + - Documentation: Correct the possible MDS sysfs values + - x86/speculation/mds: Fix documentation typo + * [x86] linux-cpupower: Update CPPFLAGS for change in <asm/msr-index.h> + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 14 May 2019 17:34:37 +0100 + +linux (4.19.37-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.29 + - media: uvcvideo: Fix 'type' check leading to overflow + - vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel + - perf script: Fix crash with printing mixed trace point and other events + - perf core: Fix perf_proc_update_handler() bug + - perf tools: Handle TOPOLOGY headers with no CPU + - perf script: Fix crash when processing recorded stat data + - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM + - [amd64] iommu/amd: Call free_iova_fast with pfn in map_sg + - [amd64] iommu/amd: Unmap all mapped pages in error path of map_sg + - [riscv64] fixup max_low_pfn with PFN_DOWN. + - ipvs: Fix signed integer overflow when setsockopt timeout + - [amd64] iommu/amd: Fix IOMMU page flush when detach device from a domain + - [armhf] clk: ti: Fix error handling in ti_clk_parse_divider_data() + - [arm64] clk: qcom: gcc: Use active only source for CPUSS clocks + - [riscv64] Adjust mmap base address at a third of task size + - IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start + - iomap: get/put the page in iomap_page_create/release() + - iomap: fix a use after free in iomap_dio_rw + - [arm64] net: hns: Fix for missing of_node_put() after of_parse_phandle() + - [arm64] net: hns: Restart autoneg need return failed when autoneg off + - [arm64] net: hns: Fix wrong read accesses via Clause 45 MDIO protocol + - [armhf,arm64] net: stmmac: dwmac-rk: fix error handling in + rk_gmac_powerup() + - netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are + present + - nfs: Fix NULL pointer dereference of dev_name + - qed: Fix bug in tx promiscuous mode settings + - qed: Fix LACP pdu drops for VFs + - qed: Fix VF probe failure while FLR + - qed: Fix system crash in ll2 xmit + - qed: Fix stack out of bounds bug + - scsi: libfc: free skb when receiving invalid flogi resp + - scsi: scsi_debug: fix write_same with virtual_gb problem + - scsi: bnx2fc: Fix error handling in probe() + - scsi: 53c700: pass correct "dev" to dma_alloc_attrs() + - net: macb: Apply RXUBR workaround only to versions with errata + - [amd64] boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before + returning to long mode + - cifs: fix computation for MAX_SMB2_HDR_SIZE + - [x86] microcode/amd: Don't falsely trick the late loading mechanism + - [arm64] kprobe: Always blacklist the KVM world-switch code + - apparmor: Fix aa_label_build() error handling for failed merges + - [x86] kexec: Don't setup EFI info if EFI runtime is not enabled + - proc: fix /proc/net/* after setns(2) + - mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone + - mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone + - fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() + - autofs: drop dentry reference only when it is never used + - autofs: fix error return in autofs_fill_super() + - mm, memory_hotplug: fix off-by-one in is_pageblock_removable + - [armhf] OMAP: dts: N950/N9: fix onenand timings + - [armhf] dts: omap4-droid4: Fix typo in cpcap IRQ flags + - [armhf] dts: sun8i: h3: Add ethernet0 alias to Beelink X2 + - [arm64] dts: meson: Fix IRQ trigger type for macirq + - [arm64] dts: meson8b: odroidc1: mark the SD card detection GPIO + active-low + - [arm64] dts: meson8m2: mxiii-plus: mark the SD card detection GPIO + active-low + - [arm64] dts: imx6sx: correct backward compatible of gpt + - [armhf] pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 + - wlcore: sdio: Fixup power on/off sequence + - bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt() + - [arm64] dts: add msm8996 compatible to gicv3 + - batman-adv: release station info tidstats + - [armhf,arm64] irqchip/gic-v4: Fix occasional VLPI drop + - [armhf,arm64] irqchip/gic-v3-its: Gracefully fail on LPI exhaustion + - drm/amdgpu: Add missing power attribute to APU check + - drm/radeon: check if device is root before getting pci speed caps + - drm/amdgpu: Transfer fences to dmabuf importer + - [armhf,arm64] net: stmmac: Fallback to Platform Data clock in Watchdog + conversion + - [armhf,arm64] net: stmmac: Disable EEE mode earlier in XMIT callback + - [armhf,arm64] irqchip/gic-v3-its: Fix ITT_entry_size accessor + - relay: check return of create_buf_file() properly + - bpf: fix potential deadlock in bpf_prog_register + - bpf: Fix syscall's stackmap lookup potential deadlock + - [armhf,arm64] drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at + init + - vsock/virtio: fix kernel panic after device hot-unplug + - vsock/virtio: reset connected sockets on device removal + - netfilter: nf_nat: skip nat clash resolution for same-origin entries + - [s390x] qeth: release cmd buffer in error paths + - [s390x] qeth: fix use-after-free in error path + - [s390x] qeth: cancel close_dev work before removing a card + - perf symbols: Filter out hidden symbols from labels + - perf trace: Support multiple "vfs_getname" probes + - [mips*] Remove function size check in get_frame_info() + - Revert "scsi: libfc: Add WARN_ON() when deleting rports" + - [armhf] i2c: omap: Use noirq system sleep pm ops to idle device for + suspend + - drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr + - nvme: lock NS list changes while handling command effects + - nvme-pci: fix rapid add remove sequence + - fs: ratelimit __find_get_block_slow() failure message. + - qed: Fix EQ full firmware assert. + - qed: Consider TX tcs while deriving the max num_queues for PF. + - qede: Fix system crash on configuring channels. + - blk-iolatency: fix IO hang due to negative inflight counter + - nvme-pci: add missing unlock for reset error + - Input: wacom_serial4 - add support for Wacom ArtPad II tablet + - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 + - [x86] iscsi_ibft: Fix missing break in switch statement + - scsi: aacraid: Fix missing break in switch statement + - [x86] PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub + - [arm64] dts: zcu100-revC: Give wifi some time after power-on + - [arm64] dts: hikey: Give wifi some time after power-on + - [arm64] dts: hikey: Revert "Enable HS200 mode on eMMC" + - [armhf] dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid + X2/U3 + - [armhf] dts: exynos: Add minimal clkout parameters to Exynos3250 PMU + - [armhf] dts: exynos: Fix max voltage for buck8 regulator on Odroid + XU3/XU4 + - drm: disable uncached DMA optimization for ARM and arm64 + (Closes: #923723) + - netfilter: xt_TEE: fix wrong interface selection + - netfilter: xt_TEE: add missing code to get interface index in checkentry. + - gfs2: Fix missed wakeups in find_insert_glock + - cifs: allow calling SMB2_xxx_free(NULL) (Closes: #919290) + - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom + - driver core: Postpone DMA tear-down until after devres release + - [x86] perf/intel: Make cpuc allocations consistent + - [x86] perf/intel: Generalize dynamic constraint creation + - [x86] Add TSX Force Abort CPUID/MSR + - [x86] perf/intel: Implement support for TSX Force Abort + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.30 + - connector: fix unsafe usage of ->real_parent + - gro_cells: make sure device is up in gro_cells_receive() + - ipv4/route: fail early when inet dev is missing + - l2tp: fix infoleak in l2tp_ip6_recvmsg() + - lan743x: Fix RX Kernel Panic + - lan743x: Fix TX Stall Issue + - net: sit: fix UBSAN Undefined behaviour in check_6rd + - net/x25: fix use-after-free in x25_device_event() + - net/x25: reset state in x25_connect() + - pptp: dst_release sk_dst_cache in pptp_sock_destruct + - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race + - rxrpc: Fix client call queueing, waiting for channel + - sctp: remove sched init from sctp_stream_init + - tcp: do not report TCP_CM_INQ of 0 for closed connections + - tcp: Don't access TCP_SKB_CB before initializing it + - tcp: handle inet_csk_reqsk_queue_add() failures + - vxlan: Fix GRO cells race condition between receive and link delete + - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() + - net/mlx4_core: Fix reset flow when in command polling mode + - net/mlx4_core: Fix locking in SRIOV mode when switching between events + and polling + - net/mlx4_core: Fix qp mtt size calculation + - net/x25: fix a race in x25_bind() + - mdio_bus: Fix use-after-free on device_register fails + - net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 + - ipv6: route: purge exception on removal + - team: use operstate consistently for linkup + - ipvlan: disallow userns cap_net_admin to change global mode/flags + - ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt() + - ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink() + - bonding: fix PACKET_ORIGDEV regression + - net/smc: fix smc_poll in SMC_INIT state + - af_unix: missing barriers in some of unix_sock ->addr and ->path accesses + - net: sched: flower: insert new filter to idr after setting its mask + - f2fs: wait on atomic writes to count F2FS_CP_WB_DATA + - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against + Liquid Saffire 56 + - ALSA: firewire-motu: fix construction of PCM frame for capture direction + - [x86] ALSA: hda: Extend i915 component bind timeout + - [x86] ALSA: hda - add more quirks for HP Z2 G4 and HP Z240 + - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 + - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone + - ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with + ALC255 + - [x86] perf/intel: Fix memory corruption + - [x86] perf/intel: Make dev_attr_allow_tsx_force_abort static + - md: It's wrong to add len to sector_nr in raid10 reshape twice + - drm: Block fb changes for async plane updates + - i40e: report correct statistics when XDP is enabled + - vhost/vsock: fix vhost vsock cid hashing inconsistent + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.31 + - media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() + - 9p: use inode->i_lock to protect i_size_write() under 32-bit + - 9p/net: fix memory leak in p9_client_create + - [armhf] iio: adc: exynos-adc: Fix NULL pointer exception on unbind + - [x86] mei: hbm: clean the feature flags on link reset + - [x86] mei: bus: move hw module get/put to probe/release + - crypto: cfb - add missing 'chunksize' property + - crypto: cfb - remove bogus memcpy() with src == dest + - crypto: ahash - fix another early termination in hash walk + - [armhf] drm/imx: ignore plane updates on disabled crtcs + - [armhf] drm/imx: imx-ldb: add missing of_node_puts + - [x86] ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA + filter + - [armhf] clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck + reparenting + - [armhf,arm64] KVM: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock + - [arm64] dts: rockchip: fix graph_port warning on rk3399 bob kevin and + excavator + - [s390x] dasd: fix using offset into zero size array error + - Input: pwm-vibra - prevent unbalanced regulator + - Input: pwm-vibra - stop regulator after disabling pwm, not before + - [armhf] dts: Configure clock parent for pwm vibra + - [armhf] OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be + uninitialized + - ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables + - [armhf,arm64] KVM: Reset the VCPU without preemption and vcpu state + loaded + - [armhf,arm64] KVM: Allow a VCPU to fully reset itself + - [armhf,arm64] KVM: Don't panic on failure to properly reset system + registers + - [armhf,arm64] KVM: vgic: Always initialize the group of private IRQs + - [arm64] KVM: Forbid kprobing of the VHE world-switch code + - [armhf] OMAP2+: fix lack of timer interrupts on CPU1 after hotplug + - mac80211: call drv_ibss_join() on restart + - mac80211: Fix Tx aggregation session tear down with ITXQs + - netfilter: compat: initialize all fields in xt_init + - blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue + - ipvs: fix dependency on nf_defrag_ipv6 + - floppy: check_events callback should not return a negative number + - xprtrdma: Make sure Send CQ is allocated on an existing compvec + - NFS: Don't use page_file_mapping after removing the page + - mm/gup: fix gup_pmd_range() for dax + - Revert "mm: use early_pfn_to_nid in page_ext_init" + - scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd + - [armhf] net: dsa: bcm_sf2: potential array overflow in + bcm_sf2_sw_suspend() + - [x86] CPU: Add Icelake model number + - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs + - [arm64] net: hns: Fix object reference leaks in hns_dsaf_roce_reset() + - [arm*] i2c: bcm2835: Clear current buffer pointers and counts after a + transfer + - [armhf] clk: sunxi-ng: v3s: Fix TCON reset de-assert bit + - kallsyms: Handle too long symbols in kallsyms.c + - [armhf] clk: sunxi: A31: Fix wrong AHB gate number + - esp: Skip TX bytes accounting when sending from a request socket + - [armhf] 8824/1: fix a migrating irq bug when hotplug cpu + - bpf: only adjust gso_size on bytestream protocols + - bpf: fix lockdep false positive in stackmap + - af_key: unconditionally clone on broadcast + - [armhf] 8835/1: dma-mapping: Clear DMA ops on teardown + - assoc_array: Fix shortcut creation + - keys: Fix dependency loop between construction record and auth key + - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task + - [armhf] net: dsa: bcm_sf2: Do not assume DSA master supports WoL + - [arm64] pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins + - qmi_wwan: apply SET_DTR quirk to Sierra WP7607 + - net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() + - xfrm: Fix inbound traffic via XFRM interfaces across network namespaces + - ASoC: topology: free created components in tplg load error + - qed: Fix iWARP buffer size provided for syn packet processing. + - qed: Fix iWARP syn packet mac address validation. + - [armhf] dts: armada-xp: fix Armada XP boards NAND description + - [arm64] Relax GIC version check during early boot + - [armhf] tegra: Restore DT ABI on Tegra124 Chromebooks + - [armhf,arm64] net: marvell: mvneta: fix DMA debug warning + - mm: handle lru_add_drain_all for UP properly + - tmpfs: fix link accounting when a tmpfile is linked in + - ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN + - phonet: fix building with clang + - mac80211_hwsim: propagate genlmsg_reply return code + - bpf, lpm: fix lookup bug in map_delete_elem + - [arm64] net: thunderx: make CFG_DONE message to run through generic + send-ack sequence + - [arm64] net: thunderx: add nicvf_send_msg_to_pf result check for + set_rx_mode_task + - nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K + - nfp: bpf: fix ALU32 high bits clearance bug + - bnxt_en: Fix typo in firmware message timeout logic. + - bnxt_en: Wait longer for the firmware message response to complete. + - net: set static variable an initial value in atl2_probe() + - tmpfs: fix uninitialized return value in shmem_link + - stm class: Prevent division by zero + - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place + - acpi/nfit: Fix bus command validation + - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot + - nfit/ars: Attempt short-ARS even in the no_init_ars case + - [amd64] libnvdimm/label: Clear 'updating' flag after label-set update + - [amd64] libnvdimm, pfn: Fix over-trim in trim_pfn_device() + - [amd64] libnvdimm/pmem: Honor force_raw for legacy pmem regions + - [amd64] libnvdimm: Fix altmap reservation size calculation + - cgroupfs: fix cgroup_do_mount() handling of failure exits + - crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails + - crypto: aegis - fix handling chunked inputs + - [arm64] crypto: aes-neonbs - fix returning final keystream block + - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails + - crypto: morus - fix handling chunked inputs + - crypto: pcbc - remove bogus memcpy()s with src == dest + - crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails + - crypto: testmgr - skip crc32c context test for ahash algorithms + - [x86] crypto: aegis - fix handling chunked inputs and MAY_SLEEP + - [x86] crypto: aesni-gcm - fix crash on empty plaintext + - [x86] crypto: morus - fix handling chunked inputs and MAY_SLEEP + - [arm64] crypto: aes-ccm - fix logical bug in AAD MAC handling + - [arm64] crypto: aes-ccm - fix bugs in non-NEON fallback routine + - CIFS: Do not reset lease state to NONE on lease break + - CIFS: Do not skip SMB2 message IDs on send failures + - CIFS: Fix read after write for files with read caching + - tracing: Use strncpy instead of memcpy for string keys in hist triggers + - tracing: Do not free iter->trace in fail path of tracing_open_pipe() + - tracing/perf: Use strndup_user() instead of buggy open-coded version + - xen: fix dom0 boot on huge systems + - ACPI / device_sysfs: Avoid OF modalias creation for removed device + - [armhf] mmc: sdhci-esdhc-imx: fix HS400 timing issue + - mmc:fix a bug when max_discard is 0 + - netfilter: ipt_CLUSTERIP: fix warning unused variable cn + - [armhf] spi: ti-qspi: Fix mmap read when more than one CS in use + - [amd64] spi: pxa2xx: Setup maximum supported DMA transfer length + - [armhf] regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 + - [arm64] regulator: max77620: Initialize values for DT properties + - [armhf] regulator: s2mpa01: Fix step values for some LDOs + - [armhf] clocksource/drivers/exynos_mct: Move one-shot check from tick + clear to ISR + - [armhf] clocksource/drivers/exynos_mct: Clear timer interrupt when + shutdown + - [arm64] clocksource/drivers/arch_timer: Workaround for Allwinner A64 + timer instability (Closes: #928457) + - [s390x] setup: fix early warning messages + - [s390x] virtio: handle find on invalid queue gracefully + - scsi: virtio_scsi: don't send sc payload with tmfs + - scsi: aacraid: Fix performance issue on logical drives + - scsi: sd: Optimal I/O size should be a multiple of physical block size + - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock + - scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by + firmware + - fs/devpts: always delete dcache dentry-s in dput() + - splice: don't merge into linked buffers + - ovl: During copy up, first copy up data and then xattrs + - ovl: Do not lose security.capability xattr over metadata file copy-up + - Btrfs: setup a nofs context for memory allocation at btrfs_create_tree() + - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl + - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes + - Btrfs: fix corruption reading shared and compressed extents after hole + punching + - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer + - [armhf,arm64] irqchip/gic-v3-its: Avoid parsing _indirect_ twice for + Device table + - [x86] kprobes: Prohibit probing on optprobe template code + - [armhf,arm64] cpufreq: tegra124: add missing of_node_put() + - ext4: fix check of inode in swap_inode_boot_loader + - ext4: cleanup pagecache before swap i_data + - ext4: update quota information while swapping boot loader inode + - ext4: add mask of ext4 flags to swap + - ext4: fix crash during online resizing + - PCI/ASPM: Use LTR if already enabled by platform + - PCI/DPC: Fix print AER status in DPC event handling + - [armhf,arm64] PCI: dwc: skip MSI init if MSIs have been explicitly + disabled + - IB/hfi1: Close race condition on user context disable and close + - [armhf] clk: clk-twl6040: Fix imprecise external abort for pdmclk + - [armhf] clk: samsung: exynos5: Fix possible NULL pointer exception on + platform_device_alloc() failure + - [armhf] clk: samsung: exynos5: Fix kfree() of const memory on setting + driver_override + - [armhf,arm64] usb: chipidea: tegra: Fix missed ci_hdrc_remove_device() + - [x86] usb: typec: tps6598x: handle block writes separately with plain-I2C + adapters + - mm: hwpoison: fix thp split handing in soft_offline_in_use_page() + - mm/vmalloc: fix size check for remap_vmalloc_range_partial() + - mm/memory.c: do_fault: avoid usage of stale vm_area_struct + - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv + - device property: Fix the length used in PROPERTY_ENTRY_STRING() + - [x86] intel_th: Don't reference unassigned outputs + - parport_pc: fix find_superio io compare code, should use equal test. + - [armhf,arm64] i2c: tegra: fix maximum transfer size + - [armhf,arm64] gpio: pca953x: Fix dereference of irq data in shutdown + - [armhf] can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument + - [x86] drm/i915: Relax mmap VMA check + - bpf: only test gso type on gso packets + - [arm64] serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO + - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart + - serial: 8250_pci: Fix number of ports for ACCES serial cards + - serial: 8250_pci: Have ACCES cards that use the four port Pericom + PI7C9X7954 chip use the pci_pericom_setup() + - jbd2: clear dirty flag when revoking a buffer from an older transaction + - jbd2: fix compile warning when using JBUFFER_TRACE + - selinux: add the missing walk_size + len check in + selinux_sctp_bind_connect + - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock + - [powerpc*] powerpc/32: Clear on-stack exception marker upon exception + return + - [powerpc*] powernv: Make opal log only readable by root + - [powerpc*] powernv: Don't reprogram SLW image on every KVM guest + entry/exit + - [powerpc*] Fix 32-bit KVM-PR lockup and host crash with MacOS guest + - [powerpc*] ptrace: Simplify vr_get/set() to avoid GCC warning + - [powerpc*] hugetlb: Don't do runtime allocation of 16G pages in LPAR + configuration + - [powerpc*] traps: fix recoverability of machine check handling on + book3s/32 + - [powerpc*] traps: Fix the message printed when stack overflows + - [arm64] Fix HCR.TGE status for NMI contexts + - [arm64] debug: Ensure debug handlers check triggering exception level + - [arm64] KVM: Fix architecturally invalid reset value for FPEXC32_EL2 + - ipmi_si: fix use-after-free of resource->name + - dm: fix to_sector() for 32bit + - dm integrity: limit the rate of error messages + - mfd: sm501: Fix potential NULL pointer dereference + - NFS: Fix I/O request leakages + - NFS: Fix an I/O request leakage in nfs_do_recoalesce + - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() + - nfsd: fix performance-limiting session calculation + - nfsd: fix memory corruption caused by readdir + - nfsd: fix wrong check in write_v4_end_grace() + - NFSv4.1: Reinitialise sequence results before retransmitting a request + - svcrpc: fix UDP on servers with lots of threads + - PM / wakeup: Rework wakeup source timer cancellation + - bcache: never writeback a discard operation + - vt: perform safe console erase in the right order + - [x86] unwind/orc: Fix ORC unwind table alignment + - [x86] perf intel-pt: Fix CYC timestamp calculation after OVF + - perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols + - perf auxtrace: Define auxtrace record alignment + - [x86] perf intel-pt: Fix overlap calculation for padding + - [x86] perf/intel/uncore: Fix client IMC events return huge result + - [x86] perf intel-pt: Fix divide by zero when TSC is not available + - md: Fix failed allocation of md_register_thread + - [x86] tpm/tpm_crb: Avoid unaligned reads in crb_recv() + - tpm: Unify the send callback behaviour + - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt + - media: lgdt330x: fix lock status reporting + - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming + - drm/fb-helper: generic: Fix drm_fbdev_client_restore() + - drm/radeon/evergreen_cs: fix missing break in switch statement + - drm/amd/powerplay: correct power reading on fiji + - drm/amd/display: don't call dm_pp_ function from an fpu block + - KVM: Call kvm_arch_memslots_updated() before updating memslots + - [x86] KVM: mmu: Detect MMIO generation wrap in any address space + - [x86] KVM: mmu: Do not cache MMIO accesses while memslots are in flux + - [x86] KVM: nVMX: Sign extend displacements of VMX instr's mem operands + - [x86] KVM: nVMX: Apply addr size mask to effective address for VMX + instructions + - [x86] KVM: nVMX: Ignore limit checks on VMX instructions using flat + segments + - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata + - [s390x] setup: fix boot crash for machine without EDAT-1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.32 + - [x86] ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist + - ALSA: firewire-motu: use 'version' field of unit directory to identify + model + - [x86] drm/vmwgfx: Don't double-free the mode stored in par->set_mode + - [x86] drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's + - [amd64] iommu/amd: fix sg->dma_address for sg->offset bigger than + PAGE_SIZE + - libceph: wait for latest osdmap in ceph_monc_blacklist_add() + - udf: Fix crash on IO error during truncate + - [mips64*/loongson-3] lemote-2f: Add IRQF_NO_SUSPEND to "cascade" + irqaction. + - [mips*] Ensure ELF appended dtb is relocated + - [mips*r6] Fix kernel crash for R6 in jump label branch function + - [powerpc*] vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 + - [powerpc*] scsi: ibmvscsi: Protect ibmvscsi_head from concurrent + modificaiton + - [powerpc*] scsi: ibmvscsi: Fix empty event pool access during host + removal + - futex: Ensure that futex address is aligned in handle_futex_death() + - cifs: allow guest mounts to work for smb3.11 + - perf probe: Fix getting the kernel map + - [x86] objtool: Move objtool_file struct off the stack + - [armhf,arm64] irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp + - SMB3: Fix SMB3.1.1 guest mounts to Samba + - [x86] ALSA: Fix runtime PM for hdmi-lpe-audio + - ALSA: hda/ca0132 - make pci_iounmap() call conditional + - ALSA: ac97: Fix of-node refcount unbalance + - ext4: fix NULL pointer dereference while journal is aborted + - ext4: fix data corruption caused by unaligned direct AIO + - ext4: brelse all indirect buffer in ext4_ind_remove_space() + - media: v4l2-ctrls.c/uvc: zero v4l2_event + - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() + - Bluetooth: Fix decrementing reference count twice in releasing socket + - Bluetooth: hci_ldisc: Initialize hci_dev before open() + - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in + hci_uart_set_proto() + - drm: Reorder set_property_atomic to avoid returning with an active ww_ctx + - RDMA/cma: Rollback source IP address if failing to acquire device + - f2fs: fix to avoid deadlock of atomic file operations + - netfilter: ebtables: remove BUGPRINT messages + - loop: access lo_backing_file only when the loop device is Lo_bound + - [x86] unwind: Handle NULL pointer calls better in frame unwinder + - [x86] unwind: Add hardcoded ORC entry for NULL + - ALSA: hda - Record the current power state before suspend/resume calls + - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec + - power: supply: charger-manager: Fix incorrect return value + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.33 + - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt + (CVE-2019-3460) + - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer + (CVE-2019-3459) + - ipmi_si: Fix crash when using hard-coded device + - dccp: do not use ipv6 header for ipv4 flow + - genetlink: Fix a memory leak on error path + - ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL + - mac8390: Fix mmio access size probe + - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S + - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6 + - net: datagram: fix unbounded loop in __skb_try_recv_datagram() + - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec + - [arm64] net: phy: meson-gxl: fix interrupt support + - net: rose: fix a possible stack overflow + - [armhf,arm64] net: stmmac: fix memory corruption with large MTUs + - net-sysfs: call dev_hold if kobject_init_and_add success + - packets: Always register packet sk in the same order + - rhashtable: Still do rehash when we get EEXIST + - sctp: get sctphdr by offset in sctp_compute_cksum + - sctp: use memdup_user instead of vmemdup_user + - tcp: do not use ipv6 header for ipv4 flow + - tipc: allow service ranges to be connect()'ed on RDM/DGRAM + - tipc: change to check tipc_own_id to return in tipc_net_stop + - tipc: fix cancellation of topology subscriptions + - tun: properly test for IFF_UP + - vrf: prevent adding upper devices + - vxlan: Don't call gro_cells_destroy() before device is unregistered + - ila: Fix rhashtable walker list corruption + - net: sched: fix cleanup NULL pointer exception in act_mirr + - [arm64] thunderx: enable page recycling for non-XDP case + - [arm64] thunderx: eliminate extra calls to put_page() for pages held for + recycling + - tun: add a missing rcu_read_unlock() in error path + - [powerpcspe] fsl: Add infrastructure to fixup branch predictor flush + - [powerpcspe] fsl: Add macro to flush the branch predictor + - [powerpcspe] fsl: Emulate SPRN_BUCSR register + - [powerpcspe] fsl: Add nospectre_v2 command line argument + - [powerpcspe] fsl: Flush the branch predictor at each kernel entry (32 bit) + - [powerpcspe] fsl: Enable runtime patching if nospectre_v2 boot arg is used + - [powerpcspe] fsl: Update Spectre v2 reporting + - [powerpcspe] fsl: Fixed warning: orphan section `__btb_flush_fixup' + - [powerpc*] security: Fix spectre_v2 reporting + - Btrfs: fix incorrect file size after shrinking truncate and fsync + - btrfs: remove WARN_ON in log_dir_items + - btrfs: don't report readahead errors and don't update statistics + - btrfs: raid56: properly unmap parity page in finish_parity_scrub() + - btrfs: Avoid possible qgroup_rsv_size overflow in + btrfs_calculate_inode_block_rsv_size + - Btrfs: fix assertion failure on fsync with NO_HOLES enabled + - [armhf] imx6q: cpuidle: fix bug that CPU might not wake up at expected + time + - [powerpc*] bpf: Fix generation of load/store DW instructions + - [s390x] vfio: ccw: only free cp on final interrupt + - NFS: fix mount/umount race in nlmclnt. + - NFSv4.1 don't free interrupted slot on open + - ALSA: rawmidi: Fix potential Spectre v1 vulnerability + - ALSA: seq: oss: Fix Spectre v1 vulnerability + - ALSA: pcm: Fix possible OOB access in PCM oss plugins + - ALSA: pcm: Don't suspend stream in unrecoverable PCM state + - [x86] ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO + - [x86] ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB + - [x86] ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286 + - [x86] ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with + ALC286 + - [x86] ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 + headset mic + - [x86] ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with + ALC256 + - [x86] ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 + - [x86] ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK + with ALC256 + - [x86] ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen + laptops + - kbuild: modversions: Fix relative CRC byte order interpretation + - fs/open.c: allow opening only regular files during execve() + - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock + - scsi: sd: Fix a race between closing an sd device and sd I/O + - scsi: sd: Quiesce warning if device does not report optimal I/O size + - [s390x] scsi: zfcp: fix rport unblock if deleted SCSI devices on + Scsi_Host + - [s390x] scsi: zfcp: fix scsi_eh host reset with port_forced ERP for + non-NPIV FCP devices + - [armhf,arm64] drm/rockchip: vop: reset scale mode when win is disabled + - [x86] staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest + - staging: speakup_soft: Fix alternate speech with other synths + - staging: vt6655: Remove vif check from vnt_interrupt + - staging: vt6655: Fix interrupt race condition on device start up. + - [arm64] serial: mvebu-uart: Fix to avoid a potential NULL pointer + dereference + - [sh4] serial: sh-sci: Fix setting SCSCR_TIE while transferring data + - USB: serial: cp210x: add new device id + - USB: serial: ftdi_sio: add additional NovaTech products + - USB: serial: mos7720: fix mos_parport refcount imbalance on error path + - USB: serial: option: set driver_info for SIM5218 and compatibles + - USB: serial: option: add support for Quectel EM12 + - USB: serial: option: add Olicard 600 + - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links + - drm/vgem: fix use-after-free when drm_gem_handle_create() fails + - [x86] drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check + - gpio: exar: add a check for the return value of ida_simple_get fails + - [armhf,arm64] phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG + PHYs + - USB: gadget: f_hid: fix deadlock in f_hidg_write() + - usb: common: Consider only available nodes for dr_mode + - xhci: Fix port resume done detection for SS ports with LPM enabled + - usb: xhci: dbc: Don't free all memory with spinlock held + - xhci: Don't let USB3 ports stuck in polling state prevent suspend + - usb: cdc-acm: fix race during wakeup blocking TX traffic + - mm: add support for kmem caches in DMA32 zone + - [armhf,arm64] iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve + debugging + - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified + - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate + - perf pmu: Fix parser error for uncore event alias + - [x86] perf intel-pt: Fix TSC slip + - [x86] objtool: Query pkg-config for libelf location + - [powerpc*] pseries/energy: Use OF accessor functions to read + ibm,drc-indexes + - [powerpc*] powerpc/64: Fix memcmp reading past the end of src/dest + - watchdog: Respect watchdog cpumask on CPU hotplug + - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n + - KVM: Reject device ioctls from processes other than the VM's creator + - [x86] KVM: update %rip after emulating IO + - [x86] KVM: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts + - bpf: do not restore dst_reg when cur_state is freed + - [x86] platform: intel_cht_int33fe: Register all connections at once + - [x86] platform: intel_cht_int33fe: Add connection for the DP alt mode + - [x86] platform: intel_cht_int33fe: Add connections for the USB Type-C port + - usb: typec: class: Don't use port parent for getting mux handles + - [x86] platform: intel_cht_int33fe: Remove the old connections for the + muxes + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.34 + - [arm64] debug: Don't propagate UNKNOWN FAR into si_code for debug signals + - ext4: cleanup bh release code in ext4_ind_remove_space() + - CIFS: fix POSIX lock leak and invalid ptr deref + - f2fs: fix to adapt small inline xattr space in __find_inline_xattr() + - f2fs: fix to avoid deadlock in f2fs_read_inline_dir() + - tracing: kdb: Fix ftdump to not sleep + - net/mlx5: Avoid panic when setting vport rate + - net/mlx5: Avoid panic when setting vport mac, getting vport config + - [armhf] gpio: gpio-omap: fix level interrupt idling + - sysctl: handle overflow for file-max + - [armhf,arm64] net: stmmac: Avoid sometimes uninitialized Clang warnings + - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK + - [arm64] scsi: hisi_sas: Set PHY linkrate when disconnected + - [arm64] scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO + - iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver + - [x86] hyperv: Fix kernel panic when kexec on HyperV + - perf c2c: Fix c2c report for empty numa node + - mm/sparse: fix a bad comparison + - mm/cma.c: cma_declare_contiguous: correct err handling + - mm/page_ext.c: fix an imbalance with kmemleak + - mm, swap: bounds check swap_info array accesses to avoid NULL derefs + - mm,oom: don't kill global init via memory.oom.group + - memcg: killed threads should not invoke memcg OOM killer + - mm, mempolicy: fix uninit memory access + - mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! + - mm/slab.c: kmemleak no scan alien caches + - ocfs2: fix a panic problem caused by o2cb_ctl + - f2fs: do not use mutex lock in atomic context + - fs/file.c: initialize init_files.resize_wait + - page_poison: play nicely with KASAN + - cifs: use correct format characters + - dm thin: add sanity checks to thin-pool and external snapshot creation + - f2fs: fix to check inline_xattr_size boundary correctly + - cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED + - cifs: Fix NULL pointer dereference of devname + - netfilter: nf_tables: check the result of dereferencing base_chain->stats + - netfilter: conntrack: tcp: only close if RST matches exact sequence + - jbd2: fix invalid descriptor block checksum + - fs: fix guard_bio_eod to check for real EOD errors + - tools lib traceevent: Fix buffer overflow in arg_eval + - PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() + - wil6210: check null pointer in _wil_cfg80211_merge_extra_ies + - mt76: fix a leaked reference by adding a missing of_node_put + - [armhf,arm64] usb: chipidea: Grab the (legacy) USB PHY by phandle first + - [powerpc*] powernv/ioda: Fix locked_vm counting for memory used by IOMMU + tables + - scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c + - [powerpc*] xmon: Fix opcode being uninitialized in print_insn_powerpc + - [armhf,arm64] coresight: etm4x: Add support to enable ETMv4.2 + - [armhf] 8840/1: use a raw_spinlock_t in unwind + - [armhf,arm64] iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables + - [powerpc*] hugetlb: Handle mmap_min_addr correctly in get_unmapped_area + callback + - btrfs: qgroup: Make qgroup async transaction commit more aggressive + - [armhf] mmc: omap: fix the maximum timeout setting + - [armhf.arm64] net: dsa: mv88e6xxx: Add lockdep classes to fix false + positive splat + - e1000e: Fix -Wformat-truncation warnings + - [x86] platform: ideapad-laptop: Fix no_hw_rfkill_list for Lenovo RESCUER + R720-15IKBN + - loop: set GENHD_FL_NO_PART_SCAN after blkdev_reread_part() + - IB/mlx4: Increase the timeout for CM cache + - clk: fractional-divider: check parent rate only if flag is set + - perf annotate: Fix getting source line failure + - [arm64] ASoC: qcom: Fix of-node refcount unbalance in qcom_snd_parse_of() + - cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies + - efi: cper: Fix possible out-of-bounds access + - [s390x] ism: ignore some errors during deregistration + - scsi: megaraid_sas: return error when create DMA pool failed + - scsi: fcoe: make use of fip_mode enum complete + - drm/amd/display: Clear stream->mode_changed after commit + - [s390x] perf test: Fix failure of 'evsel-tp-sched' test on s390 + - mwifiex: don't advertise IBSS features without FW support + - perf report: Don't shadow inlined symbol with different addr range + - [armhf] SoC: imx-sgtl5000: add missing put_device() + - mt76: usb: do not run mt76u_queues_deinit twice + - xen/gntdev: Do not destroy context while dma-bufs are in use + - vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1 + - [x86] HID: intel-ish-hid: avoid binding wrong ishtp_cl_device + - cgroup, rstat: Don't flush subtree root unless necessary + - jbd2: fix race when writing superblock + - [s390x] perf report: Add s390 diagnosic sampling descriptor size + - iwlwifi: pcie: fix emergency path + - ACPI / video: Refactor and fix dmi_is_desktop() + - kprobes: Prohibit probing on bsearch() + - kprobes: Prohibit probing on RCU debug routine + - netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in + __nf_conntrack_confirm + - [armhf] 8833/1: Ensure that NEON code always compiles with Clang + - ALSA: PCM: check if ops are defined before suspending PCM + - ath10k: fix shadow register implementation for WCN3990 + - usb: f_fs: Avoid crash due to out-of-scope stack ptr access + - sched/topology: Fix percpu data types in struct sd_data & struct s_data + - bcache: fix input overflow to cache set sysfs file io_error_halflife + - bcache: fix input overflow to sequential_cutoff + - bcache: fix potential div-zero error of writeback_rate_i_term_inverse + - bcache: improve sysfs_strtoul_clamp() + - genirq: Avoid summation loops for /proc/stat + - [armhf,arm64] net: marvell: mvpp2: fix stuck in-band SGMII negotiation + - iw_cxgb4: fix srqidx leak during connection abort + - net: phy: consider latched link-down status in polling mode + - fbdev: fbmem: fix memory access if logo is bigger than the screen + - cdrom: Fix race condition in cdrom_sysctl_register + - drm: rcar-du: add missing of_node_put + - drm/amd/display: Don't re-program planes for DPMS changes + - drm/amd/display: Disconnect mpcc when changing tg + - perf/aux: Make perf_event accessible to setup_aux() + - e1000e: fix cyclic resets at link up with active tx + - e1000e: Exclude device from suspend direct complete optimization + - [x86] platform: intel_pmc_core: Fix PCH IP sts reading + - i2c: of: Try to find an I2C adapter matching the parent + - iwlwifi: mvm: fix RFH config command with >=10 CPUs + - sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK + - efi/memattr: Don't bail on zero VA if it equals the region's PA + - sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/ + task_rq_lock() + - drm/vkms: Bugfix extra vblank frame + - [armhf] dts: lpc32xx: Remove leading 0x and 0s from bindings notation + - [armhf,arm64] efi: Allow SetVirtualAddressMap() to be omitted + - [arm64] soc: qcom: gsbi: Fix error handling in gsbi_probe() + - mt7601u: bump supported EEPROM version + - [armhf] 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care + of + - [armhf] avoid Cortex-A9 livelock on tight dmb loops + - block, bfq: fix in-service-queue check for queue merging + - [powerpc*] 64s: Clear on-stack exception marker upon exception return + - cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to + fix the accounting + - [armhf,arm64] backlight: pwm_bl: Use gpiod_get_value_cansleep() to get + initial state + - tty: increase the default flip buffer limit to 2*640K + - [powerpc*] pseries: Perform full re-add of CPU for topology update + post-migration + - drm/amd/display: Enable vblank interrupt during CRC capture + - ALSA: dice: add support for Solid State Logic Duende Classic/Mini + - [armhf,arm64] usb: dwc3: gadget: Fix OTG events when gadget driver isn't + loaded + - [x86] platform: intel-hid: Missing power button release on some Dell + models + - perf script python: Use PyBytes for attr in trace-event-python + - perf script python: Add trace_context extension module to sys.modules + - hwrng: virtio - Avoid repeated init of completion + - [armhf,arm64] soc/tegra: fuse: Fix illegal free of IO base address + - [x86] HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR + busy_clear bit + - f2fs: UBSAN: set boolean value iostat_enable correctly + - hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable + - [armhf] dmaengine: imx-dma: fix warning comparison of distinct pointer + types + - [arm64] dmaengine: qcom_hidma: assign channel cookie correctly + - [arm64] dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_* + - netfilter: physdev: relax br_netfilter dependency + - [armhf] regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting + - [arm64] pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins + - drm: Auto-set allow_fb_modifiers when given modifiers at plane init + - drm/nouveau: Stop using drm_crtc_force_disable + - selinux: do not override context on context mounts + - brcmfmac: Use firmware_request_nowarn for the clm_blob + - [armhf,arm64] wlcore: Fix memory leak in case wl12xx_fetch_firmware + failure + - drm/fb-helper: fix leaks in error path of drm_fb_helper_fbdev_setup + - [arm64] clk: rockchip: fix frac settings of GPLL clock for rk3328 + - [armhf,arm64] dmaengine: tegra: avoid overflow of byte tracking + - [x86] Input: soc_button_array - fix mapping of the 5th GPIO in a PNP0C40 + device + - drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers + - ACPI / video: Extend chassis-type detection with a "Lunch Box" check + - bcache: fix potential div-zero error of writeback_rate_p_term_inverse + - [x86] kprobes: Blacklist non-attachable interrupt functions + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.35 + - [x86] kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 + from HLT + - [powerpc*] tm: Limit TM code inside PPC_TRANSACTIONAL_MEM + - [x86] hv_netvsc: Fix unwanted wakeup after tx_disable + - ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type + - ipv6: Fix dangling pointer when ipv6 fragment + - ipv6: sit: reset ip header pointer in ipip6_rcv + - net: ethtool: not call vzalloc for zero sized memory request + - net-gro: Fix GRO flush when receiving a GSO packet. + - net/mlx5: Decrease default mr cache size + - netns: provide pure entropy for net_hash_mix() + - net: rds: force to destroy connection if t_sock is NULL in + rds_tcp_kill_sock(). + - net/sched: act_sample: fix divide by zero in the traffic path + - net/sched: fix ->get helper of the matchall cls + - openvswitch: fix flow actions reallocation + - qmi_wwan: add Olicard 600 + - r8169: disable ASPM again + - sctp: initialize _pad of sockaddr_in before copying to user memory + - tcp: Ensure DCTCP reacts to losses + - tcp: fix a potential NULL pointer dereference in tcp_sk_exit + - vrf: check accept_source_route on the original netdevice + - net/mlx5e: Fix error handling when refreshing TIRs + - net/mlx5e: Add a lock on tir list + - nfp: validate the return code from dev_queue_xmit() + - nfp: disable netpoll on representors + - bnxt_en: Improve RX consumer index validity check. + - bnxt_en: Reset device on RX buffer errors. + - net: ip_gre: fix possible use-after-free in erspan_rcv + - net: ip6_gre: fix possible use-after-free in ip6erspan_rcv + - net: core: netif_receive_skb_list: unlist skb before passing to pt->func + - r8169: disable default rx interrupt coalescing on RTL8168 + (Closes: #925496) + - net: mlx5: Add a missing check on idr_find, free buf + - net/mlx5e: Update xoff formula + - net/mlx5e: Update xon formula + - kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used + - netfilter: nfnetlink_cttimeout: pass default timeout policy to + obj_to_nlattr + - netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too + - [arm64] kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region + - [x86] tty: mark Siemens R3964 line discipline as BROKEN (CVE-2019-11486) + - tty: ldisc: add sysctl to prevent autoloading of ldiscs + - ACPICA: Clear status of GPEs before enabling them + - ACPICA: Namespace: remove address node from global list after method + termination + - ALSA: seq: Fix OOB-reads from strlcpy + - [x86] ALSA: hda/realtek: Enable headset MIC of Acer TravelMate B114-21 + with ALC233 + - [x86] ALSA: hda/realtek - Add quirk for Tuxedo XC 1509 + - [x86] ALSA: hda - Add two more machines to the power_save_blacklist + - mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd() + - [arm64] dts: rockchip: fix rk3328 sdmmc0 write errors + - [hppa] Detect QEMU earlier in boot process + - [hppa] regs_return_value() should return gpr28 + - [hppa] also set iaoq_b in instruction_pointer_set() + - alarmtimer: Return correct remaining time + - drm/udl: add a release method and delay modeset teardown + - [x86] kvm: svm: fix potential get_num_contig_pages overflow + - include/linux/bitrev.h: fix constant bitrev + - mm: writeback: use exact memcg dirty counts + - [x86] ASoC: intel: Fix crash at suspend/resume after failed codec + registration + - Btrfs: do not allow trimming when a fs is mounted with the nologreplay + option + - btrfs: prop: fix zstd compression parameter validation + - btrfs: prop: fix vanished compression property after failed set + - [riscv64] Fix syscall_get_arguments() and syscall_set_arguments() + - block: do not leak memory in bio_copy_user_iov() + - block: fix the return errno for direct IO + - genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent() + - genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n + - virtio: Honour 'may_reduce_num' in vring_create_virtqueue + - [armhf] dts: rockchip: fix rk3288 cpu opp node reference + - [armhf] dts: am335x-evmsk: Correct the regulators for the audio codec + - [armhf] dts: am335x-evm: Correct the regulators for the audio codec + - [arm64] futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value + - [arm64] dts: rockchip: fix rk3328 rgmii high tx error rate + - [arm64] backtrace: Don't bother trying to unwind the userspace stack + - xen: Prevent buffer overflow in privcmd ioctl + - sched/fair: Do not re-read ->h_load_next during hierarchical load + calculation + - [x86] asm: Use stricter assembly constraints in bitops + - [x86] perf/amd: Resolve race condition when disabling PMC + - [x86] perf/amd: Resolve NMI latency issues for active PMCs + - [x86] perf/amd: Remove need to check "running" bit in NMI handler + - PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller + - PCI: pciehp: Ignore Link State Changes after powering off a slot + - dm integrity: change memcmp to strncmp in dm_integrity_ctr + - dm: revert 8f50e358153d ("dm: limit the max bio size as BIO_MAX_PAGES * + PAGE_SIZE") + - dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors + - dm integrity: fix deadlock with overlapping I/O + - [arm64] dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64 + - [arm64] dts: rockchip: Fix vcc_host1_5v GPIO polarity on rk3328-rock64 + - ACPICA: AML interpreter: add region addresses in global list during + initialization + - [x86] KVM: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) + - [x86] KVM: nVMX: fix x2APIC VTPR read intercept + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.36 + - inotify: Fix fsnotify_mark refcount leak in + inotify_update_existing_watch() (CVE-2019-9857) + - perf/core: Restore mmap record type correctly + - ext4: avoid panic during forced reboot + - ext4: add missing brelse() in add_new_gdb_meta_bg() + - ext4: report real fs size after failed resize + - ALSA: echoaudio: add a check for ioremap_nocache + - [i386,alpha] ALSA: sb8: add a check for request_region + - drm/udl: use drm_gem_object_put_unlocked. + - IB/mlx4: Fix race condition between catas error reset and aliasguid flows + - i40iw: Avoid panic when handling the inetdev event + - [i386,alpha] ALSA: opl3: fix mismatch between snd_opl3_drum_switch + definition and declaration + - [x86] thermal/intel_powerclamp: fix __percpu declaration of worker_data + - [arm*] thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs + - [x86] thermal/int340x_thermal: Add additional UUIDs + - [x86] thermal/int340x_thermal: fix mode setting + - [x86] thermal/intel_powerclamp: fix truncated kthread name + - scsi: iscsi: flush running unbind operations when removing a session + - sched/cpufreq: Fix 32-bit math overflow + - sched/core: Fix buffer overflow in cgroup2 property cpu.max + - [x86] mm: Don't leak kernel addresses + - [x86] tools/power turbostat: return the exit status of a command + - perf list: Don't forget to drop the reference to the allocated thread_map + - perf config: Fix an error in the config template documentation + - perf config: Fix a memory leak in collect_config() + - perf build-id: Fix memory leak in print_sdt_events() + - perf top: Fix error handling in cmd_top() + - perf hist: Add missing map__put() in error case + - perf evsel: Free evsel->counts in perf_evsel__exit() + - ACPI / utils: Drop reference in test for device presence + - PM / Domains: Avoid a potential deadlock + - [armhf] drm/exynos/mixer: fix MIXER shadow registry synchronisation code + - [arm64] irqchip/mbigen: Don't clear eventid when freeing an MSI + - [x86] hpet: Prevent potential NULL pointer dereference + - [x86] hyperv: Prevent potential NULL pointer dereference + - [i386] cpu/cyrix: Use correct macros for Cyrix calls on Geode processors + - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure + - [x86] iommu/vt-d: Check capability before disabling protected memory + - [x86] hw_breakpoints: Make default case in hw_breakpoint_arch_parse() + return an error + - fix incorrect error code mapping for OBJECTID_NOT_FOUND + - [x86] gart: Exclude GART aperture from kcore + - ext4: prohibit fstrim in norecovery mode + - drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up + - rsi: improve kernel thread handling to fix kernel panic + - f2fs: fix to avoid NULL pointer dereference on se->discard_map + - 9p: do not trust pdu content for stat item size + - 9p locks: add mount option for lock retry interval + - ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx() + - f2fs: fix to do sanity check with current segment number + - netfilter: xt_cgroup: shrink size of v2 path + - [arm64] serial: uartps: console_setup() can't be placed to init section + - [powerpc*] pseries: Remove prrn_work workqueue + - media: au0828: cannot kfree dev before usb disconnect + - Bluetooth: Fix debugfs NULL pointer dereference + - HID: i2c-hid: override HID descriptors for certain devices + - pinctrl: core: make sure strcmp() doesn't get a null parameter + - usbip: fix vhci_hcd controller counting + - [x86] ACPI / SBS: Fix GPE storm on recent MacBookPro's + - HID: usbhid: Add quirk for Redragon/Dragonrise Seymur 2 + - [x86] KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail + - netfilter: nf_flow_table: remove flowtable hook flush routine in netns + exit routine + - f2fs: cleanup dirty pages if recover failed + - [armhf,arm64] net: stmmac: Set OWN bit for jumbo frames + - cifs: fallback to older infolevels on findfirst queryinfo retry + - kernel: hung_task.c: disable on suspend + - drm/ttm: Fix bo_global and mem_global kfree error + - [x86] ALSA: hda: fix front speakers on Huawei MBXP + - ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle + - net/rds: fix warn in rds_message_alloc_sgs + - xfrm: destroy xfrm_state synchronously on net exit path + - net: ip6_gre: fix possible NULL pointer dereference in + ip6erspan_set_version + - [x86] iommu/dmar: Fix buffer overflow during PCI bus notification + - scsi: core: Avoid that system resume triggers a kernel warning + - [armhf,arm64] soc/tegra: pmc: Drop locking from + tegra_powergate_is_powered() + - Revert "ACPI / EC: Remove old CLEAR_ON_RESUME quirk" + - [arm64] coresight: cpu-debug: Support for CA73 CPUs + - [x86] PCI: Blacklist power management of Gigabyte X299 DESIGNARE EX PCIe + ports + - drm/nouveau/volt/gf117: fix speedo readout register + - [armel,armhf] 8839/1: kprobe: make patch_lock a raw_spinlock_t + - [x86] drm/amdkfd: use init_mqd function to allocate object for hid_mqd + (CI) + - appletalk: Fix use-after-free in atalk_proc_exit + - lib/div64.c: off by one in shift + - rxrpc: Fix client call connect/disconnect race + - f2fs: fix to dirty inode for i_mode recovery + - include/linux/swap.h: use offsetof() instead of custom __swapoffset macro + - bpf: fix use after free in bpf_evict_inode + - IB/hfi1: Failed to drain send queue when QP is put into error state + - mm: hide incomplete nr_indirectly_reclaimable in /proc/zoneinfo + - mm: hide incomplete nr_indirectly_reclaimable in sysfs + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37 + - bonding: fix event handling for stacked bonds + - failover: allow name change on IFF_UP slave interfaces + - net: atm: Fix potential Spectre v1 vulnerabilities (CVE-2017-5715) + - net: bridge: fix per-port af_packet sockets + - net: bridge: multicast: use rcu to access port list from + br_multicast_start_querier + - net: Fix missing meta data in skb with vlan packet + - net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv + - tcp: tcp_grow_window() needs to respect tcp_space() + - team: set slave to promisc if team is already in promisc mode + - tipc: missing entries in name table of publications + - vhost: reject zero size iova range + - ipv4: recompile ip options in ipv4_link_failure + - ipv4: ensure rcu_read_lock() in ipv4_link_failure() + - [arm64] net: thunderx: raise XDP MTU to 1508 + - [arm64] net: thunderx: don't allow jumbo frames with XDP + - net/mlx5: FPGA, tls, hold rcu read lock a bit longer + - net/mlx5: FPGA, tls, idr remove on flow delete + - route: Avoid crash from dereferencing NULL rt->from + - sch_cake: Use tc_skb_protocol() helper for getting packet protocol + - sch_cake: Make sure we can write the IP header before changing DSCP bits + - nfp: flower: replace CFI with vlan present + - nfp: flower: remove vlan CFI bit from push vlan action + - sch_cake: Simplify logic in cake_select_tin() + - net: IP defrag: encapsulate rbtree defrag code into callable functions + - net: IP6 defrag: use rbtrees for IPv6 defrag + - net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c + - CIFS: keep FileInfo handle live during oplock break + - cifs: Fix use-after-free in SMB2_write + - cifs: Fix use-after-free in SMB2_read + - cifs: fix handle leak in smb2_query_symlink() + - [x86] KVM: Don't clear EFER during SMM transitions for 32-bit vCPU + - [x86] KVM: svm: make sure NMI is injected after nmi_singlestep + - [x86] iio/gyro/bmg160: Use millidegrees for temperature scale + - iio: Fix scan mask selection + - iio: core: fix a possible circular locking dependency + - [x86] iio: accel: kxcjk-1013: restore the range after resume. + - [x86] staging: comedi: vmk80xx: Fix use of uninitialized semaphore + - [x86] staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf + - [x86] staging: comedi: ni_usb6501: Fix use of uninitialized mutex + - [x86] staging: comedi: ni_usb6501: Fix possible double-free of + ->usb_rx_buf + - [x86] ALSA: hda/realtek - add two more pin configuration sets to quirk + table + - ALSA: core: Fix card races between register and disconnect + - [x86] Input: elan_i2c - add hardware ID for multiple Lenovo laptops + - vt: fix cursor when clearing the screen + - scsi: core: set result when the command cannot be dispatched + - Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO" + - [x86] Revert "svm: Fix AVIC incomplete IPI emulation" + - coredump: fix race condition between mmget_not_zero()/get_task_mm() and + core dumping (CVE-2019-11599) + - ipmi: fix sleep-in-atomic in free_user at cleanup SRCU + user->release_barrier + - [x86] crypto: poly1305 - fix overflow during partial reduction + - drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 + - [arm64] futex: Restore oldval initialization to work around buggy + compilers + - [x86] kprobes: Verify stack frame on kretprobe + - kprobes: Mark ftrace mcount handler functions nokprobe + - kprobes: Fix error check when reusing optimized probes + - rt2x00: do not increment sequence number while re-transmitting + - mac80211: do not call driver wake_tx_queue op during reconfig + - drm/amdgpu/gmc9: fix VM_L2_CNTL3 programming + - [x86] perf/amd: Add event map for AMD Family 17h + - [x86] cpu/bugs: Use __initconst for 'const' init data + - [x86] perf: Fix incorrect PEBS_REGS + - [x86] speculation: Prevent deadlock on ssb_state::lock + - timers/sched_clock: Prevent generic sched_clock wrap caused by + tick_freeze() + - nfit/ars: Remove ars_start_flags + - nfit/ars: Introduce scrub_flags + - nfit/ars: Allow root to busy-poll the ARS state machine + - nfit/ars: Avoid stale ARS results + - mmc: sdhci: Fix data command CRC error handling + - mmc: sdhci: Handle auto-command errors + - modpost: file2alias: go back to simple devtable lookup + - modpost: file2alias: check prototype of handler + - [x86] tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete + - tpm: Fix the type of the return value in calc_tpm2_event_size() + - sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup + - device_cgroup: fix RCU imbalance in error case + - ALSA: info: Fix racy addition/deletion of nodes + - [armhf] ASoC: rockchip: add missing INTERLEAVED PCM attribute + - i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array + - kernel/sysctl.c: fix out-of-bounds access when setting file-max + + [ Ben Hutchings ] + * debian/bin/abiupdate.py: Automatically select the correct archive to fetch + from + * debian/bin/abiupdate.py: Change default URLs to use https: scheme + * [powerpc*] vdso: Make vdso32 installation conditional in vdso_install + (Closes: #785065) + * Bump ABI to 5 + * [rt] Add new signing subkey for Steven Rostedt + * [rt] Update to 4.19.31-rt18 (no functional change) + * [armhf,arm64] Revert "net: stmmac: Send TSO packets always from Queue 0" + * [riscv64] linux-image-dbg: Include vdso debug symbols + * [ia64] linux-image: Recommend grub-efi-ia64 instead of (removed) elilo + * [armel/marvell] Disable HW_RANDOM as no HWRNG drivers are usable here + * udeb: Add all HWRNG drivers to kernel-image (see #923675) + * lockdown: Refer to Debian wiki until manual page exists + * [sparc64] linux-image: Recommend grub-ieee1275 instead of (removed) silo + * [sparc64] linux-image: Install uncompressed kernel image + * [powerpc,ppc64,ppc64el] linux-image: Recommend grub-ieee1275 + * [i386] Add grub-efi-ia32 as an alternate recommended bootloader + * linux-source: Recommend bison and flex, always needed to build the kernel + * [armel/marvell,sh4] linux-image: Recommend apparmor, like all other configs + * udeb: Drop unused ntfs-modules packages + * ntfs: Disable NTFS_FS due to lack of upstream security support + (CVE-2018-12929, CVE-2018-12930, CVE-2018-12931) + * [x86] platform: Enable INTEL_ATOMISP2_PM as module + * drivers/firmware/google: Adjust configuration for 4.19 + * MODSIGN: Make shash allocation failure fatal + * aio: Apply fixes from 4.19.38: + - aio: clear IOCB_HIPRI + - aio: use assigned completion handler + - aio: separate out ring reservation from req allocation + - aio: don't zero entire aio_kiocb aio_get_req() + - aio: use iocb_put() instead of open coding it + - aio: split out iocb copy from io_submit_one() + - aio: abstract out io_event filler helper + - aio: initialize kiocb private in case any filesystems expect it. + - aio: simplify - and fix - fget/fput for io_submit() (CVE-2019-10125) + - pin iocb through aio. + - aio: fold lookup_kiocb() into its sole caller + - aio: keep io_event in aio_kiocb + - aio: store event at final iocb_put() + - Fix aio_poll() races + * tracing: Fix buffer_ref pipe ops + * mm,fs: Prevent page refcount overflow (CVE-2019-11487): + - mm: make page ref count overflow check tighter and more explicit + - mm: add 'try_get_page()' helper function + - mm: prevent get_user_pages() from overflowing page refcount + - fs: prevent page refcount overflow in pipe_buf_get + + [ YunQiang Su ] + * [mips*r6] Re-enable CONFIG_JUMP_LABEL, which has been fixed in upstream. + + [ Stefan Fritsch ] + * [armhf] Enable SND_SOC_SPDIF for Cubietruck (Closes: #884562) + + [ Luca Boccassi ] + * libbpf-dev: generate pkg-config file for libbpf by backporting + libbpf-generate-pkg-config.patch from bpf-next. + * Import patches to enable loading keys from UEFI db and MOK from + http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git to + allow kernel modules built by users (eg: by dkms) to be verified, and + to load dbx and MOKX for the equivalent blacklisting functionality. + + [ Bastian Blank ] + * Don't longer recommend irqbalance. (closes: #926967) + + [ Salvatore Bonaccorso ] + * xen/pciback: Don't disable PCI_COMMAND on PCI device reset. + (CVE-2015-8553) + * [x86] Disable R3964 due to lack of security support + * [amd64,arm64] vfio/type1: Limit DMA mappings per container (CVE-2019-3882) + + [ Aurelien Jarno ] + * [mips] Fix indirect syscall tracing & seccomp filtering for big endian + MIPS64 kernels with 32-bit userland. + + [ Romain Perier ] + * [rt] Update to 4.19.37-rt19 + * Enable coreboot memconsole (Closes: #872069) + + [ Uwe Kleine-König ] + * [armhf] Disable MVNETA_BM_ENABLE again as it break networking on + DB-MV784MP-GP. Thanks to Steve McIntyre for providing access such a + machine for testing. (Closes: #927825) + + [ Alper Nebi Yasak ] + * [arm64] Enable configs for Samsung Chromebook Plus (v1) and other + rk3399-gru based devices: + - Enable PL330_DMA, CROS_EC_SPI, SPI_ROCKCHIP as modules. + - Enable EXTCON_USBC_CROS_EC, PHY_ROCKCHIP_TYPEC, PHY_ROCKCHIP_USB as + modules. + - Enable KEYBOARD_CROS_EC as module. + - Enable PWM_CROS_EC, PHY_ROCKCHIP_DP as modules and enable ROCKCHIP_CDN_DP + - Enable SND_SOC_ROCKCHIP, SND_SOC_ROCKCHIP_I2S, SND_SOC_ROCKCHIP_SPDIF, + SND_SOC_ROCKCHIP_RT5645, SND_SOC_RK3399_GRU_SOUND as modules. + - Enable INPUT_TOUCHSCREEN, enable TOUCHSCREEN_ATMEL_MXT as module, and + enable TOUCHSCREEN_ATMEL_MXT_T37. + - Enable TOUCHSCREEN_ELAN, MOUSE_ELAN_I2C as modules. + - Enable I2C_HID as module. + - Enable MWIFIEX, MWIFIEX_PCIE as modules. + - Enable TCG_TPM, TCG_TIS_I2C_INFINEON as modules. + - Enable PM_DEVFREQ_EVENT, enable DEVFREQ_EVENT_ROCKCHIP_DFI and + ARM_RK3399_DMC_DEVFREQ as modules. + - Enable REGULATOR_VCTRL as module. + - Enable MFD_CROS_EC_CHARDEV, IIO_CROS_EC_ACCEL_LEGACY, + IIO_CROS_EC_SENSORS_CORE, IIO_CROS_EC_SENSORS, IIO_CROS_EC_LIGHT_PROX, + IIO_CROS_EC_BARO, RTC_DRV_CROS_EC as modules. + - Enable BATTERY_SBS, CHARGER_CROS_USBPD as modules. + + [ Vagrant Cascadian ] + * debian/bin/gencontrol_signed.py: Sort list of modules before adding to + .json file, fixing reproducibility issues. + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 05 May 2019 19:32:32 +0100 + +linux (4.19.28-2) unstable; urgency=medium + + [ Ben Hutchings ] + * [x86,alpha,m68k] binfmt: Disable BINFMT_AOUT, IA32_AOUT, OSF4_COMPAT + * [x86] Drop fix for #865303, which no longer affects Debian's OpenJDK + * udeb: Make serial_cs optional in serial-modules + * [ppc64el] Disable PCMCIA (fixes FTBFS) + + [ Vagrant Cascadian ] + * [arm64] Enable DRM_SUN4I and DRM_SUN8I_DW_HDMI as modules. + * [arm64] Enable I2C_GPIO as a module. + * [arm64] Enable MESON_EFUSE as a module. + + [ Yves-Alexis Perez ] + * certs: include both root CA and direct signing certificate. + closes: #924545 + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 15 Mar 2019 02:16:04 +0000 + +linux (4.19.28-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 + - devres: Align data[] to ARCH_KMALLOC_MINALIGN + - drm/bufs: Fix Spectre v1 vulnerability + - drm/vgem: Fix vgem_init to get drm device available. + - [arm*] pinctrl: bcm2835: Use raw spinlock for RT compatibility + - [x86] ASoC: Intel: mrfld: fix uninitialized variable access + - gpiolib: Fix possible use after free on label + - [armhf] drm/sun4i: Initialize registers in tcon-top driver + - genirq/affinity: Spread IRQs to all available NUMA nodes + - [armhf] gpu: ipu-v3: image-convert: Prevent race between run and + unprepare + - wil6210: fix reset flow for Talyn-mb + - wil6210: fix memory leak in wil_find_tx_bcast_2 + - ath10k: assign 'n_cipher_suites' for WCN3990 + - ath9k: dynack: use authentication messages for 'late' ack + - scsi: lpfc: Correct LCB RJT handling + - scsi: mpt3sas: Call sas_remove_host before removing the target devices + - scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event + - [armhf] 8808/1: kexec:offline panic_smp_self_stop CPU + - [mips] clk: boston: fix possible memory leak in clk_boston_setup() + - dlm: Don't swamp the CPU with callbacks queued during recovery + - [x86] PCI: Fix Broadcom CNB20LE unintended sign extension (redux) + - [powerpc] pseries: add of_node_put() in dlpar_detach_node() + - [arm*] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE + - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl + - [mips] Boston: Disable EG20T prefetch + - iwlwifi: fw: do not set sgi bits for HE connection + - fpga: altera-cvp: Fix registration for CvP incapable devices + - [x86] fpga: altera-cvp: fix 'bad IO access' on x86_64 + - [x86] vbox: fix link error with 'gcc -Og' + - platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup + - i40e: prevent overlapping tx_timeout recover + - scsi: hisi_sas: change the time of SAS SSP connection + - usbnet: smsc95xx: fix rx packet alignment + - [armhf,arm64] drm/rockchip: fix for mailbox read size + - [arm*] OMAP2+: hwmod: Fix some section annotations + - drm/amd/display: fix gamma not being applied correctly + - drm/amd/display: calculate stream->phy_pix_clk before clock mapping + - bpf: libbpf: retry map creation without the name + - net/mlx5: EQ, Use the right place to store/read IRQ affinity hint + - modpost: validate symbol names also in find_elf_symbol + - perf tools: Add Hygon Dhyana support + - [armhf] soc/tegra: Don't leak device tree node reference + - media: rc: ensure close() is called on rc_unregister_device + - media: video-i2c: avoid accessing released memory area when removing + driver + - [armhf] media: mtk-vcodec: Release device nodes in + mtk_vcodec_init_enc_pm() + - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register + - dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll + - [powerpc] 32: Add .data..Lubsan_data*/.data..Lubsan_type* sections + explicitly + - media: adv*/tc358743/ths8200: fill in min width/height/pixelclock + - ACPI: SPCR: Consider baud rate 0 as preconfigured state + - f2fs: move dir data flush to write checkpoint process + - f2fs: fix race between write_checkpoint and write_begin + - f2fs: fix wrong return value of f2fs_acl_create + - [arm64] io: Ensure calls to delay routines are ordered against prior + readX() + - net: aquantia: return 'err' if set MPI_DEINIT state fails + - [sparc*] sunvdc: Do not spin in an infinite loop when vio_ldc_send() + returns EAGAIN + - nfsd4: fix crash on writing v4_end_grace before nfsd startup + - drm: Clear state->acquire_ctx before leaving + drm_atomic_helper_commit_duplicated_state() + - [arm64] io: Ensure value passed to __iormb() is held in a 64-bit register + - Thermal: do not clear passive state during system sleep + - thermal: Fix locking in cooling device sysfs update cur_state + - firmware/efi: Add NULL pointer checks in efivars API functions + - [s390] zcrypt: improve special ap message cmd handling + - [arm64] ftrace: don't adjust the LR value + - [x86] fpu: Add might_fault() to user_insn() + - usb: dwc3: Correct the logic for checking TRB full in + __dwc3_prepare_one_trb() + - usb: dwc2: Disable power down feature on Samsung SoCs + - usb: hub: delay hub autosuspend if USB3 port is still link training + - timekeeping: Use proper seqcount initializer + - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) + - [armhf] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module + clocks + - media: imx274: select REGMAP_I2C + - drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) + - tipc: fix node keep alive interval calculation + - driver core: Move async_synchronize_full call + - kobject: return error code if writing /sys/.../uevent fails + - IB/hfi1: Unreserve a reserved request when it is completed + - usb: dwc3: trace: add missing break statement to make compiler happy + - [mips] gpio: mt7621: report failure of devm_kasprintf() + - [mips] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack + - [x86] iommu/amd: Fix amd_iommu=force_isolation + - [armhf] dts: Fix OMAP4430 SDP Ethernet startup + - [mips] bpf: fix encoding bug for mm_srlv32_op + - media: coda: fix H.264 deblocking filter controls + - [armel] dts: Fix up the D-Link DIR-685 MTD partition info + - watchdog: renesas_wdt: don't set divider while watchdog is running + - [armhf] dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 + - usb: dwc3: gadget: Disable CSP for stream OUT ep + - [arm64] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI + payloads + - [arm64] iommu/arm-smmu: Add support for qcom,smmu-v2 variant + - [arm64] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer + - [armhf] clk: imx6sl: ensure MMDC CH0 handshake is bypassed + - OPP: Use opp_table->regulators to verify no regulator case + - [arm64] tee: optee: avoid possible double list_del() + - [arm64] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver + - [arm64] drm/msm: dpu: Only check flush register against pending flushes + - lightnvm: pblk: fix resubmission of overwritten write err lbas + - lightnvm: pblk: add lock protection to list operations + - i2c-axxia: check for error conditions first + - [armhf] phy: sun4i-usb: add support for missing USB PHY index + - udf: Fix BUG on corrupted inode + - selftests/bpf: use __bpf_constant_htons in test_prog.c + - [armel] pxa: avoid section mismatch warning + - [armhf] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M + - [powerpc] KVM: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv + machines + - [arm*] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD + - [arm*] mmc: bcm2835: reset host on timeout + - memstick: Prevent memstick host from getting runtime suspended during + card detection + - [arm64] mmc: sdhci-xenon: Fix timeout checks + - btrfs: harden agaist duplicate fsid on scanned devices + - serial: sh-sci: Fix locking in sci_submit_rx() + - serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure + - tty: serial: samsung: Properly set flags in autoCTS mode + - perf test: Fix perf_event_attr test failure + - perf dso: Fix unchecked usage of strncpy() + - perf header: Fix unchecked usage of strncpy() + - btrfs: use tagged writepage to mitigate livelock of snapshot + - perf probe: Fix unchecked usage of strncpy() + - i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) + - bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings. + - [x86] tools/power/x86/intel_pstate_tracer: Fix non root execution for + post processing a trace file + - livepatch: check kzalloc return values + - [arm64] KVM: Skip MMIO insn after emulation + - usb: musb: dsps: fix otg state machine + - usb: musb: dsps: fix runtime pm for peripheral mode + - perf header: Fix up argument to ctime() + - perf tools: Cast off_t to s64 to avoid warning on bionic libc + - percpu: convert spin_lock_irq to spin_lock_irqsave. + - [arm64] net: hns3: fix incomplete uninitialization of IRQ in the + hns3_nic_uninit_vector_data() + - drm/amd/display: Add retry to read ddc_clock pin + - Bluetooth: hci_bcm: Handle deferred probing for the clock supply + - drm/amd/display: fix YCbCr420 blank color + - [powerpc] uaccess: fix warning/error with access_ok() + - mac80211: fix radiotap vendor presence bitmap handling + - xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi + - scsi: smartpqi: correct host serial num for ssa + - scsi: smartpqi: correct volume status + - scsi: smartpqi: increase fw status register read timeout + - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() + - [arm64] net: hns3: add max vector number check for pf + - [powerpc] perf: Fix thresholding counter data for unknown type + - iwlwifi: mvm: fix setting HE ppe FW config + - [powerpc] powernv/ioda: Allocate indirect TCE levels of cached userspace + addresses on demand + - mlx5: update timecounter at least twice per counter overflow + - drbd: narrow rcu_read_lock in drbd_sync_handshake + - drbd: disconnect, if the wrong UUIDs are attached on a connected peer + - drbd: skip spurious timeout (ping-timeo) when failing promote + - drbd: Avoid Clang warning about pointless switch statment + - drm/amd/display: validate extended dongle caps + - md: fix raid10 hang issue caused by barrier + - fbdev: fbmem: behave better with small rotated displays and many CPUs + - i40e: define proper net_device::neigh_priv_len + - ice: Do not enable NAPI on q_vectors that have no rings + - igb: Fix an issue that PME is not enabled during runtime suspend + - ACPI/APEI: Clear GHES block_status before panic() + - fbdev: fbcon: Fix unregister crash when more than one framebuffer + - [powerpc] mm: Fix reporting of kernel execute faults on the 8xx + - [x86] KVM: svm: report MSR_IA32_MCG_EXT_CTL as unsupported + - [powerpc] fadump: Do not allow hot-remove memory from fadump reserved + area. + - kvm: Change offset in kvm_write_guest_offset_cached to unsigned + - NFS: nfs_compare_mount_options always compare auth flavors. + - perf build: Don't unconditionally link the libbfd feature test to + -liberty and -lz + - hwmon: (lm80) fix a missing check of the status of SMBus read + - hwmon: (lm80) fix a missing check of bus read in lm80 probe + - seq_buf: Make seq_buf_puts() null-terminate the buffer + - cifs: check ntwrk_buf_start for NULL before dereferencing it + - f2fs: fix use-after-free issue when accessing sbi->stat_info + - niu: fix missing checks of niu_pci_eeprom_read + - f2fs: fix sbi->extent_list corruption issue + - cgroup: fix parsing empty mount option string + - perf python: Do not force closing original perf descriptor in + evlist.get_pollfd() + - scripts/decode_stacktrace: only strip base path when a prefix of the path + - arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning + - ocfs2: don't clear bh uptodate for block read + - ocfs2: improve ocfs2 Makefile + - mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init + - zram: fix lockdep warning of free block handling + - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in + HFCPCI_l1hw() + - [m68k] block/swim3: Fix -EBUSY error when re-opening device after unmount + - [arm*] thermal: bcm2835: enable hwmon explicitly + - [armhf] PCI: imx: Enable MSI from downstream components + - thermal: generic-adc: Fix adc to temp interpolation + - [arm64] sve: ptrace: Fix SVE_PT_REGS_OFFSET definition + - kernel/hung_task.c: break RCU locks based on jiffies + - proc/sysctl: fix return error for proc_doulongvec_minmax() + - kernel/hung_task.c: force console verbose before panic + - fs/epoll: drop ovflist branch prediction + - exec: load_script: don't blindly truncate shebang string + - xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat + - xfs: cancel COW blocks before swapext + - xfs: Fix error code in 'xfs_ioc_getbmap()' + - xfs: fix overflow in xfs_attr3_leaf_verify + - xfs: fix shared extent data corruption due to missing cow reservation + - xfs: fix transient reference count error in + xfs_buf_resubmit_failed_buffers + - xfs: delalloc -> unwritten COW fork allocation can go wrong + - fs/xfs: fix f_ffree value for statfs when project quota is set + - xfs: fix PAGE_MASK usage in xfs_free_file_space + - xfs: fix inverted return from xfs_btree_sblock_verify_crc + - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set + - dccp: fool proof ccid_hc_[rt]x_parse_options() + - enic: fix checksum validation for IPv6 + - lib/test_rhashtable: Make test_insert_dup() allocate its hash table + dynamically + - net: dsa: Fix lockdep false positive splat + - net: dsa: Fix NULL checking in dsa_slave_set_eee() + - [armhf,arm64] net: dsa: mv88e6xxx: Fix counting of ATU violations + - net: dsa: slave: Don't propagate flag changes on down slave interfaces + - net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames + - rds: fix refcount bug in rds_sock_addref + - Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for + 88e151x" + - rxrpc: bad unlock balance in rxrpc_recvmsg + - sctp: check and update stream->out_curr when allocating stream_out + - sctp: walk the list of asoc safely (CVE-2019-8956) + - skge: potential memory corruption in skge_get_regs() + - virtio_net: Account for tx bytes and packets on sending xdp_frames + - net/mlx5e: FPGA, fix Innova IPsec TX offload data path performance + - xfs: eof trim writeback mapping as soon as it is cached + - ALSA: compress: Fix stop handling on compressed capture streams + - ALSA: usb-audio: Add support for new T+A USB DAC + - ALSA: hda - Serialize codec registrations + - ALSA: hda/realtek - Fix lose hp_pins for disable auto mute + - ALSA: hda/realtek - Use a common helper for hp pin reference + - ALSA: hda/realtek - Headset microphone support for System76 darp5 + - fuse: call pipe_buf_release() under pipe lock + - fuse: decrement NR_WRITEBACK_TEMP on the right page + - fuse: handle zero sized retrieve correctly + - [arm*] dmaengine: bcm2835: Fix interrupt race on RT + - [arm*] dmaengine: bcm2835: Fix abort of transactions + - [armhf] dmaengine: imx-dma: fix wrong callback invoke + - futex: Handle early deadlock return correctly + - [arm64] irqchip/gic-v3-its: Plug allocation race for devices sharing a + DevID + - [armhf] usb: phy: am335x: fix race condition in _probe + - usb: dwc3: gadget: Handle 0 xfer length for OUT EP + - usb: gadget: udc: net2272: Fix bitwise and boolean operations + - usb: gadget: musb: fix short isoc packets with inventra dma + - staging: speakup: fix tty-operation NULL derefs + - scsi: cxlflash: Prevent deadlock when adapter probe fails + - scsi: aic94xx: fix module loading + - cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM + - [x86] perf/x86/intel/uncore: Add Node ID mask + - [x86] MCE: Initialize mce.bank in the case of a fatal error in + mce_no_way_out() + - perf/core: Don't WARN() for impossible ring-buffer sizes + - perf tests evsel-tp-sched: Fix bitwise operator + - serial: fix race between flush_to_ldisc and tty_open + - serial: 8250_pci: Make PCI class test non fatal + - serial: sh-sci: Do not free irqs that have already been freed + - cacheinfo: Keep the old value if of_property_read_u32 fails + - IB/hfi1: Add limit test for RC/UC send via loopback + - [x86] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() + - ath9k: dynack: make ewma estimation faster + - ath9k: dynack: check da->enabled first in sampling routines + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.22 + - mtd: Make sure mtd->erasesize is valid even if the partition is of size 0 + - mtd: rawnand: gpmi: fix MX28 bus master lockup problem + - libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD + - [armhf, arm64] iio: adc: axp288: Fix TS-pin handling + - signal: Always notice exiting tasks + - signal: Better detection of synchronous signals + - [armhf, arm64] misc: vexpress: Off by one in vexpress_syscfg_exec() + - [x86] mei: me: add ice lake point device id. + - debugfs: fix debugfs_rename parameter checking + - [arm64] pinctrl: sunxi: Correct number of IRQ banks on H6 main pin + controller + - [x86] pinctrl: cherryview: fix Strago DMI workaround + - tracing: uprobes: Fix typo in pr_fmt string + - [mips*] cm: reprime error cause + - [mips*] OCTEON: don't set octeon_dma_bar_type if PCI is disabled + - [mips*] VDSO: Use same -m%-float cflag as the kernel proper + - [mips*] loongson64: remove unreachable(), fix loongson_poweroff(). + - [mips*] VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds + - [arm64] firmware: arm_scmi: provide the mandatory device release callback + - [powerpc*] radix: Fix kernel crash with mremap() + - [amd64] mic: vop: Fix use-after-free on remove + - mac80211: ensure that mgmt tx skbs have tailroom for encryption + - drm/modes: Prevent division by zero htotal + - drm/amd/powerplay: Fix missing break in switch + - [x86] drm/i915: always return something on DDI clock selection + - [x86] drm/vmwgfx: Fix setting of dma masks + - [x86] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user + - SUNRPC: Always drop the XPRT_LOCK on XPRT_CLOSE_WAIT + - xfrm: Make set-mark default behavior backward compatible + - Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal" + - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() + - xfrm: refine validation of template and selector families + - batman-adv: Avoid WARN on net_device without parent in netns + - batman-adv: Force mac header to start of data on xmit + - svcrdma: Reduce max_send_sges + - svcrdma: Remove max_sge check at connect time + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.23 + - Revert "exec: load_script: don't blindly truncate shebang string" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.24 + - dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string + - eeprom: at24: add support for 24c2048 + - blk-mq: fix a hung issue when fsync (Closes: #913119, #913138) + - [armel, armhf] 8789/1: signal: copy registers using __copy_to_user() + - [armel, armhf] 8790/1: signal: always use __copy_to_user to save iwmmxt + context + - [armel, armhf] 8791/1: vfp: use __copy_to_user() when saving VFP state + - [armel, armhf] 8792/1: oabi-compat: copy oabi events using + __copy_to_user() + - [armel, armhf] 8793/1: signal: replace __put_user_error with __put_user + - [armel, armhf] 8794/1: uaccess: Prevent speculative use of the current + addr_limit + - [armel, armhf] 8795/1: spectre-v1.1: use put_user() for __put_user() + - [armel, armhf] 8796/1: spectre-v1,v1.1: provide helpers for address + sanitization + - [armel, armhf] 8797/1: spectre-v1.1: harden __copy_to_user + - [armel, armhf] 8810/1: vfp: Fix wrong assignement to ufp_exc + - [armel, armhfl armhf] make lookup_processor_type() non-__init + - [armel, armhf] split out processor lookup + - [armel, armhf] clean up per-processor check_bugs method call + - [armel, armhf] add PROC_VTABLE and PROC_TABLE macros + - [armel, armhf] spectre-v2: per-CPU vtables to work around big.Little + systems + - [armel, armhf] ensure that processor vtables is not lost after boot + - [armel, armhf] fix the cockup in the previous patch + - drm/amdgpu/sriov:Correct pfvf exchange logic + - [i386] ACPI: NUMA: Use correct type for printing addresses on i386-PAE + - perf report: Fix wrong iteration count in --branch-history + - perf test shell: Use a fallback to get the pathname in vfs_getname + - [riscv64] riscv: fix trace_sys_exit hook + - cpufreq: check if policy is inactive early in __cpufreq_get() + - nvme-pci: use the same attributes when freeing host_mem_desc_bufs. + - nvme-pci: fix out of bounds access in nvme_cqe_pending + - nvme-multipath: zero out ANA log buffer + - nvme: pad fake subsys NQN vid and ssvid with zeros + - drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang + - [armel] dts: kirkwood: Fix polarity of GPIO fan lines + - [armel, armhf] gpio: pl061: handle failed allocations + - drm/nouveau: Don't disable polling in fallback mode + - drm/nouveau/falcon: avoid touching registers if engine is off + - cifs: Limit memory used by lock request calls to a page + - [x86] kvm: sev: Fail KVM_SEV_INIT if already initialized + - CIFS: Do not assume one credit for async responses + - [arm*] gpio: mxc: move gpio noirq suspend/resume to syscore phase + - [x86] Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire + F5-573G" + - [x86] Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK + - [armhf] OMAP5+: Fix inverted nirq pin interrupts with irq_set_type + - perf/core: Fix impossible ring-buffer sizes warning + - [x86] perf: Add check_period PMU callback + - [x86] ALSA: hda - Add quirk for HP EliteBook 840 G5 + - ALSA: usb-audio: Fix implicit fb endpoint setup by quirk + - ASoC: hdmi-codec: fix oops on re-probe + - [alpha] tools uapi: fix Alpha support + - [riscv64] Add pte bit to distinguish swap from invalid + - [x86] kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is + available + - [x86] kvm: vmx: Fix entry number check for add_atomic_switch_msr() + - [arm*] mmc: sunxi: Filter out unsupported modes declared in the device + tree + - mmc: block: handle complete_work on separate workqueue + - [x86] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 + - Revert "nfsd4: return default lease period" + - Revert "mm: don't reclaim inodes with many attached pages" + - Revert "mm: slowly shrink slabs with a relatively small number of + objects" + - [alpha] fix page fault handling for r16-r18 targets + - [alpha] Fix Eiger NR_IRQS to 128 + - [s390*] zcrypt: fix specification exception on z196 during ap probe + - tracing/uprobes: Fix output for multiple string arguments + - [x86] platform/UV: Use efi_runtime_lock to serialise BIOS calls + - scsi: sd: fix entropy gathering for most rotational disks + - signal: Restore the stop PTRACE_EVENT_EXIT + - md/raid1: don't clear bitmap bits on interrupted recovery. + - [x86] a.out: Clear the dump structure initially + - dm crypt: don't overallocate the integrity tag space + - dm thin: fix bug where bio that overwrites thin block ignores FUA + - drm: Use array_size() when creating lease + - [x86] drm/i915: Block fbdev HPD processing during suspend + - [x86] drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set + - mm: proc: smaps_rollup: fix pss_locked calculation + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.25 + - af_packet: fix raw sockets over 6in4 tunnel + - [arm64, armhf] dsa: mv88e6xxx: Ensure all pending interrupts are handled + prior to exit + - net: crypto set sk to NULL when af_alg_release. (CVE-2019-8912) + - net: Fix for_each_netdev_feature on Big endian + - net: fix IPv6 prefix route residue + - net: ip6_gre: initialize erspan_ver just for erspan tunnels + - net: ipv4: use a dedicated counter for icmp_v4 redirect packets + - net: phy: xgmiitorgmii: Support generic PHY status read + - net: stmmac: Fix a race in EEE enable callback + - net: stmmac: handle endianness in dwmac4_get_timestamp + - sky2: Increase D3 delay again + - vhost: correctly check the return value of translate_desc() in log_used() + - vsock: cope with memory allocation failure at socket creation time + - vxlan: test dev->flags & IFF_UP before calling netif_rx() + - net: Add header for usage of fls64() + - tcp: clear icsk_backoff in tcp_write_queue_purge() + - tcp: tcp_v4_err() should be more careful + - net: Do not allocate page fragments that are not skb aligned + - hwmon: (lm80) Fix missing unlock on error in set_fan_div() + - scsi: target/core: Use kmem_cache_free() instead of kfree() + - PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter + - sunrpc: fix 4 more call sites that were using stack memory with a + scatterlist + - netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs + (CVE-2019-9162) + - net/x25: do not hold the cpu too long in x25_new_lci() + - ax25: fix possible use-after-free + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.26 + - [armel armhf] 8834/1: Fix: kprobes: optimized kprobes illegal instruction + - tracing: Fix number of entries in trace header + - [mips*] eBPF: Always return sign extended 32b values + - mac80211: Restore vif beacon interval if start ap fails + - mac80211: Use linked list instead of rhashtable walk for mesh tables + - mac80211: Free mpath object when rhashtable insertion fails + - libceph: handle an empty authorize reply + - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list + - numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES + - proc, oom: do not report alien mms when setting oom_score_adj + - [x86] ALSA: hda/realtek - Headset microphone and internal speaker + support for System76 oryp5 + - [x86] ALSA: hda/realtek: Disable PC beep in passthrough on alc285 + - KEYS: allow reaching the keys quotas exactly + - [armhf,arm64] backlight: pwm_bl: Fix devicetree parsing with auto- + generated brightness tables + - [armhf] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering + mfd cells + - [armhf] mfd: twl-core: Fix section annotations on {,un}protect_pm_master + - [arm64] mfd: qcom_rpm: write fw_version to CTRL_REG + - mfd: axp20x: Add AC power supply cell for AXP813 + - mfd: axp20x: Re-align MFD cell entries + - mfd: axp20x: Add supported cells for AXP803 + - mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove + probe() + - [armhf] mfd: mc13xxx: Fix a missing check of a register-read failure + - qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page + count + - qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory + barrier + - [arm64] net: hns: Fix use after free identified by SLUB debug + - bpf: Fix [::] -> [::1] rewrite in sys_sendmsg + - selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in + test_sock_addr + - net/mlx4: Get rid of page operation after dma_alloc_coherent + - xprtrdma: Double free in rpcrdma_sendctxs_create() + - selftests: forwarding: Add a test for VLAN deletion + - netfilter: nf_tables: fix leaking object reference count + - scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param + - scsi: isci: initialize shost fully before calling scsi_add_host() + - include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR + - netfilter: nft_flow_offload: Fix reverse route lookup + - bpf: correctly set initial window on active Fast Open sender + - bpf: fix panic in stack_map_get_build_id() on i386 and arm32 + - netfilter: nft_flow_offload: fix interaction with vrf slave device + - RDMA/mthca: Clear QP objects during their allocation + - [powerpcspe] 8xx: fix setting of pagetable for Abatron BDI debug tool. + - acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() + - net: stmmac: Fix PCI module removal leak + - net: stmmac: dwxgmac2: Only clear interrupts that are active + - net: stmmac: Check if CBS is supported before configuring + - net: stmmac: Fix the logic of checking if RX Watchdog must be enabled + - net: stmmac: Prevent RX starvation in stmmac_napi_poll() + - scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes + - scsi: ufs: Fix system suspend status + - scsi: qedi: Add ep_state for login completion on un-reachable targets + - scsi: ufs: Fix geometry descriptor size + - scsi: cxgb4i: add wait_for_completion() + - netfilter: nft_flow_offload: fix checking method of conntrack helper + - always clear the X2APIC_ENABLE bit for PV guest + - [armhf, arm64] drm/meson: add missing of_node_put + - drm/amdkfd: Don't assign dGPUs to APU topology devices + - drm/amd/display: fix PME notification not working in RV desktop + - vhost: return EINVAL if iovecs size does not match the message size + - [armhf, arm64] drm/sun4i: backend: add missing of_node_puts + - bpf: don't assume build-id length is always 20 bytes + - bpf: zero out build_id for BPF_STACK_BUILD_ID_IP + - atm: he: fix sign-extension overflow on large shift + - hwmon: (tmp421) Correct the misspelling of the tmp442 compatible + attribute in OF device ID table + - [armhf] leds: lp5523: fix a missing check of return value of lp55xx_read + - bpf: bpf_setsockopt: reset sock dst on SO_MARK changes + - net: bridge: Mark FDB entries that were added by user as such + - net/mlx5e: Fix wrong (zero) TX drop counter indication for representor + - isdn: avm: Fix string plus integer warning from Clang + - batman-adv: fix uninit-value in batadv_interface_tx() + - inet_diag: fix reporting cgroup classid and fallback to priority + - ipv6: propagate genlmsg_reply return code + - net: ena: fix race between link up and device initalization + - net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames + - net/mlx5e: Don't overwrite pedit action when multiple pedit used + - net/packet: fix 4gb buffer limit due to overflow check + - net: sfp: do not probe SFP module before we're attached + - sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment + - sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate + - team: avoid complex list operations in team_nl_cmd_options_set() + - Revert "socket: fix struct ifreq size in compat ioctl" + - Revert "kill dev_ifsioc()" + - net: socket: fix SIOCGIFNAME in compat + - net: socket: make bond ioctls go through compat_ifreq_ioctl() + - geneve: should not call rt6_lookup() when ipv6 was disabled + - sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() + - net_sched: fix a race condition in tcindex_destroy() (Closes: #921542) + - net_sched: fix a memory leak in cls_tcindex + - net_sched: fix two more memory leaks in cls_tcindex + - net/mlx5e: XDP, fix redirect resources availability check + - RDMA/srp: Rework SCSI device reset handling + - KEYS: user: Align the payload buffer + - KEYS: always initialize keyring_index_key::desc_len + - drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime + - gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime + - [x86] drm/i915/fbdev: Actually configure untiled displays + - drm/amd/display: Fix MST reboot/poweroff sequence + - mac80211: allocate tailroom for forwarded mesh packets + - [x86] kvm: Return LA57 feature based on hardware capability + - net: validate untrusted gso packets without csum offload + - net: avoid false positives in untrusted gso validation + - Revert "bridge: do not add port to router list when receives query with + source 0.0.0.0" + - netfilter: nf_tables: fix flush after rule deletion in the same batch + - netfilter: nft_compat: use-after-free when deleting targets + - netfilter: ipv6: Don't preserve original oif for loopback address + - netfilter: nfnetlink_osf: add missing fmatch check + - netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in + clusterip_config_entry_put() + - udlfb: handle unplug properly + - [armhf arm64] pinctrl: max77620: Use define directive for + max77620_pinconf_param values + - net: phylink: avoid resolving link state too early + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.27 + - irq/matrix: Split out the CPU selection code into a helper + - irq/matrix: Spread managed interrupts on allocation + - genirq/matrix: Improve target CPU selection for managed interrupts + (Closes: #922182) + - mac80211: Change default tx_sk_pacing_shift to 7 + - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached + - [arm64] drm/msm: Unblock writer if reader closes file + - [x86] ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field + - [armhf] clk: tegra: dfll: Fix a potential Oop in remove() + - [x86] thermal: int340x_thermal: Fix a NULL vs IS_ERR() check + - [arm64, armhf] usb: dwc3: gadget: synchronize_irq dwc irq in suspend + - [arm64, armhf] usb: dwc3: gadget: Fix the uninitialized link_state when + udc starts + - genirq: Make sure the initial affinity is not empty + - [arm64, armel, x86, armhf] ASoC: dapm: change snprintf to scnprintf for + possible overflow + - [x86] drivers: thermal: int340x_thermal: Fix sysfs race condition + - mac80211: fix miscounting of ttl-dropped frames + - sched/wait: Fix rcuwait_wake_up() ordering + - sched/wake_q: Fix wakeup ordering for wake_q + - futex: Fix (possible) missed wakeup + - drm/amd/powerplay: OD setting fix on Vega10 + - [armhf] drm/sun4i: hdmi: Fix usage of TMDS clock + - direct-io: allow direct writes to empty inodes + - writeback: synchronize sync(2) against cgroup writeback membership + switches + - scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport + - scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport + - scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() + - [x86] hv_netvsc: Fix ethtool change hash key error + - [x86] hv_netvsc: Refactor assignments of struct netvsc_device_info + - [x86] hv_netvsc: Fix hash key value reset after other ops + - nvme-rdma: fix timeout handler + - nvme-multipath: drop optimization for static ANA group IDs + - [arm64] drm/msm: Fix A6XX support for opp-level + - net: usb: asix: ax88772_bind return error when hw_reset fail + - net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP + - [powerpc*] ibmveth: Do not process frames after calling napi_reschedule + - mac80211: don't initiate TDLS connection if station is not associated to + AP + - mac80211: Add attribute aligned(2) to struct 'action' + - cfg80211: extend range deviation for DMG + - [x86] svm: Fix AVIC incomplete IPI emulation + - [x86] KVM: nSVM: clear events pending from svm_complete_interrupts() when + exiting to L1 + - [arm64, armhf] mmc: spi: Fix card detection during probe + - mmc: core: Fix NULL ptr crash from mmc_should_fail_request + - [armhf] mmc: sdhci-esdhc-imx: correct the fix of ERR004536 + - mm: enforce min addr even if capable() in expand_downwards() + (CVE-2019-9213) + - hugetlbfs: fix races and page leaks during migration + - [mips*] fix truncation in __cmpxchg_small for short values + - [x86] uaccess: Don't leak the AC flag into __put_user() value evaluation + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.28 + - cpufreq: Use struct kobj_attribute instead of struct global_attr + - staging: erofs: fix mis-acted TAIL merging behavior + - USB: serial: option: add Telit ME910 ECM composition + - USB: serial: cp210x: add ID for Ingenico 3070 + - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 + - [x86] staging: comedi: ni_660x: fix missing break in switch statement + - [x86, arm64, armhf] staging: android: ashmem: Don't call fallocate() with + ashmem_mutex held. + - [x86, arm64, armhf] staging: android: ashmem: Avoid range_alloc() + allocation with ashmem_mutex held. + - ip6mr: Do not call __IP6_INC_STATS() from preemptible context + - [arm64, armhf] net: dsa: mv88e6xxx: handle unknown duplex modes gracefully + in mv88e6xxx_port_set_duplex + - [arm64, armhf] net: dsa: mv88e6xxx: fix number of internal PHYs for + 88E6x90 family + - net: sched: put back q.qlen into a single location + - net-sysfs: Fix mem leak in netdev_register_kobject + - qmi_wwan: Add support for Quectel EG12/EM12 + - sctp: call iov_iter_revert() after sending ABORT + - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 + - team: Free BPF filter when unregistering netdev + - tipc: fix RDM/DGRAM connect() regression + - bnxt_en: Drop oversize TX packets to prevent errors. + - geneve: correctly handle ipv6.disable module parameter + - [x86] hv_netvsc: Fix IP header checksum for coalesced packets + - ipv4: Add ICMPv6 support when parse route ipproto + - lan743x: Fix TX Stall Issue + - [arm64, armhf] net: dsa: mv88e6xxx: Fix statistics on mv88e6161 + - [arm64, armhf] net: dsa: mv88e6xxx: Fix u64 statistics + - net: netem: fix skb length BUG_ON in __skb_to_sgvec + - net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails + - net: phy: Micrel KSZ8061: link failure after cable connect + - [arm64, armhf] net: phy: phylink: fix uninitialized variable in + phylink_get_mac_state + - net: sit: fix memory leak in sit_init_net() + - net: socket: set sock->sk to NULL after calling proto_ops::release() + - tipc: fix race condition causing hung sendto + - tun: fix blocking read + - [x86, arm64, armhf] xen-netback: don't populate the hash cache on XenBus + disconnect + - [x86, arm64, armhf] xen-netback: fix occasional leak of grant ref mappings + under memory pressure + - tun: remove unnecessary memory barrier + - net: Add __icmp_send helper. + - ipv4: Return error for RTA_VIA attribute + - ipv6: Return error for RTA_VIA attribute + - mpls: Return error for RTA_GATEWAY attribute + - ipv4: Pass original device to ip_rcv_finish_core + - [arm64, armhf] net: dsa: mv88e6xxx: power serdes on/off for 10G interfaces + on 6390X + - [arm64, armhf] net: dsa: mv88e6xxx: prevent interrupt storm caused by + mv88e6390x_port_set_cmode + - net/sched: act_ipt: fix refcount leak when replace fails + - net/sched: act_skbedit: fix refcount leak when replace fails + - net: sched: act_tunnel_key: fix NULL pointer dereference during init + - [x86] CPU/AMD: Set the CPB bit unconditionally on F17h + - [x86] boot/compressed/64: Do not read legacy ROM on EFI system + - tracing: Fix event filters and triggers to handle negative numbers + - usb: xhci: Fix for Enabling USB ROLE SWITCH QUIRK on + INTEL_SUNRISEPOINT_LP_XHCI + - [x86, powerpc*] applicom: Fix potential Spectre v1 vulnerabilities + - [mips*] irq: Allocate accurate order pages for irq stack + - aio: Fix locking in aio_poll() + - xtensa: fix get_wchan + - gnss: sirf: fix premature wakeup interrupt enable + - USB: serial: cp210x: fix GPIO in autosuspend + - Bluetooth: btrtl: Restore old logic to assume firmware is already loaded + - Bluetooth: Fix locking in bt_accept_enqueue() for BH context + - exec: Fix mem leak in kernel_read_file (CVE-2019-8980) + - scsi: core: reset host byte in DID_NEXUS_FAILURE case + - bpf: fix sanitation rewrite in case of non-pointers + + [ Ben Hutchings ] + * [sparc64] udeb: Use standard module list in nic-modules; add i2c-modules + and nic-shared-modules to avoid duplication + * mt76: Use the correct hweight8() function (fixes FTBFS on ia64) + * [armel] udeb: Add mmc-core-modules + * udeb: Make nic-wireless-modules depend on mmc-core-modules, not + mmc-modules; move crc7 to crc-modules to avoid duplication + * [powerpc*] udeb: Add i2c-modules, mmc-core-modules, nic-wireless-modules + * [arm64,armhf] udeb: Add mmc-core-modules to Provides of kernel-image + * udeb: Add fb-modules and include drm and drm_kms_helper on most + architectures + * udeb: Move basic PV modules from {hyperv,virtio}-modules to kernel-image + * udeb: Move drivers from {hyperv,virtio}-modules to + {fb,input,nic,scsi}-modules + * debian/bin/gencontrol.py: Add rules to build debian/build/config.* + * certs: Replace test signing certificate with production signing certificate + * debian/bin/gencontrol_signed.py: Put all files.json fields under "packages" + * Bump ABI to 4 + + [ Wookey ] + * linux-perf: Enable coresight trace (libopencsd) support in perf + (Closes: #895131) + + [ Vagrant Cascadian ] + * [armhf] Add patch from upstream fixing stability issues when cpufreq + is enabled on Orange Pi Plus. + * [armhf] Enable REGULATOR_SY8106A as module. + * [arm64] Add patch working around A64 timer issues. + + [ dann frazier ] + * arm64: lockdown: Move init_lockdown() call after uefi_init() + + [ Salvatore Bonaccorso ] + * Btrfs: fix corruption reading shared and compressed extents after hole + punching (Closes: #922306) + + [ Vagrant Cascadian ] + * [arm64] Add patch from v4.20 to enable device-tree for Pine64-LTS. + + [ Romain Perier ] + * [rt] Update to 4.19.25-rt16: + - Add zram_slot_trylock() to "drivers/block/zram: Replace bit spinlocks + with rtmutex for -rt" + - Refresh "futex: workaround migrate_disable/enable in different context" + - softirq: Avoid "local_softirq_pending" messages if ksoftirqd is blocked + - softirq: Avoid "local_softirq_pending" messages if task is in cpu_chill() + - hrtimer: Don't lose state in cpu_chill() + - hrtimer: cpu_chill(): save task state in ->saved_state() + - [x86] lazy-preempt: properly check against preempt-mask + - [i386] lazy-preempt: use proper return label on 32bit-x86 + * [armel/rpi] Add flavour for Raspberry Pi and Raspberry Pi Zero + * [armel, armhf] Enable CRASH_DUMP + * Enable STRICT_MODULE_RWX + + [ Marcin Juszkiewicz ] + * [arm64] udeb: Use generic ata-modules + * [arm64] udeb: Remove redundant lines from nic-modules + + [ YunQiang Su ] + * [mips r6] Disable JUMP_LABEL for now: it will cause Reserved Instruction. + Enable SERIAL_OF_PLATFORM, if not, userland shows nothing. + Enable CPU_HAS_MSA, HIGHMEM, CRYPTO_CRC32_MIPS, and NR_CPUS to 16. + Support some boston drivers: IMG_ASCII_LCD, I2C_EG20T, PCH_PHUB, MMC, + PCIE_XILINX, RTC_DRV_M41T80, SPI_TOPCLIFF_PCH. + * [mipsel/mips64el] Backport MIPS: Loongson: Introduce and use + loongson_llsc_mb() + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 12 Mar 2019 05:06:28 +0000 + +linux (4.19.20-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.17 + - tty/ldsem: Wake up readers after timed out down_write() + - tty: Hold tty_ldisc_lock() during tty_reopen() + - tty: Simplify tty->count math in tty_reopen() + - tty: Don't hold ldisc lock in tty_reopen() if ldisc present + - can: gw: ensure DLC boundaries after CAN frame modification + (CVE-2019-3701) + - netfilter: nf_conncount: don't skip eviction when age is negative + - netfilter: nf_conncount: split gc in two phases + - netfilter: nf_conncount: restart search when nodes have been erased + (Closes: #921616) + - netfilter: nf_conncount: merge lookup and add functions + - netfilter: nf_conncount: move all list iterations under spinlock + - netfilter: nf_conncount: speculative garbage collection on empty lists + - netfilter: nf_conncount: fix argument order to find_next_bit + - [arm64] mmc: sdhci-msm: Disable CDR function on TX + - Revert "scsi: target: iscsi: cxgbit: fix csk leak" + - scsi: target: iscsi: cxgbit: fix csk leak + - scsi: target: iscsi: cxgbit: fix csk leak + - [arm64] kvm: consistently handle host HCR_EL2 flags + - [arm64] Don't trap host pointer auth use to EL2 + - ipv6: fix kernel-infoleak in ipv6_local_error() + - net: bridge: fix a bug on using a neighbour cache entry without checking + its state + - packet: Do not leak dev refcounts on error exit + - tcp: change txhash on SYN-data timeout + - tun: publish tfile after it's fully initialized + - r8169: don't try to read counters if chip is in a PCI power-save state + - bonding: update nest level on unlink + - ip: on queued skb use skb_header_pointer instead of pskb_may_pull + - r8169: load Realtek PHY driver module before r8169 + - crypto: authencesn - Avoid twice completion call in decrypt path + - crypto: authenc - fix parsing key with misaligned rta_len + - [x86] xen: Fix x86 sched_clock() interface for xen + - Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" + - btrfs: wait on ordered extents on abort cleanup + - Yama: Check for pid death before checking ancestry + - scsi: core: Synchronize request queue PM status only on successful resume + - [x86] scsi: sd: Fix cache_type_store() + - [mips*] fix n32 compat_ipc_parse_version + - [mips*] BCM47XX: Setup struct device for the SoC + - [mips*] lantiq: Fix IPI interrupt handling + - of: properties: add missing of_node_put + - RDMA/nldev: Don't expose unsafe global rkey to regular user + - [arm64] kaslr: ensure randomized quantities are clean to the PoC + - [arm64] dts: marvell: armada-ap806: reserve PSCI area + - [mips*] Disable MSI also when pcie-octeon.pcie_disable on + - fix int_sqrt64() for very large numbers + - media: vivid: fix error handling of kthread_run + - media: vivid: set min width/height to a value > 0 + - bpf: in __bpf_redirect_no_mac pull mac only if present + - ipv6: make icmp6_send() robust against null skb->dev + - LSM: Check for NULL cred-security on free + - netfilter: ebtables: account ebt_table_info to kmemcg + - block: use rcu_work instead of call_rcu to avoid sleep in softirq + - selinux: fix GPF on invalid policy + - blockdev: Fix livelocks on loop device + - sctp: allocate sctp_sockaddr_entry with kzalloc + - tipc: fix uninit-value in in tipc_conn_rcv_sub + - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats + - tipc: fix uninit-value in tipc_nl_compat_bearer_enable + - tipc: fix uninit-value in tipc_nl_compat_link_set + - tipc: fix uninit-value in tipc_nl_compat_name_table_dump + - tipc: fix uninit-value in tipc_nl_compat_doit + - block/loop: Don't grab "struct file" for vfs_getattr() operation. + - block/loop: Use global lock for ioctl() operation. + - loop: Fold __loop_release into loop_release + - loop: Get rid of loop_index_mutex + - loop: Push lo_ctl_mutex down into individual ioctls + - loop: Split setting of lo_state from loop_clr_fd + - loop: Push loop_ctl_mutex down into loop_clr_fd() + - loop: Push loop_ctl_mutex down to loop_get_status() + - loop: Push loop_ctl_mutex down to loop_set_status() + - loop: Push loop_ctl_mutex down to loop_set_fd() + - loop: Push loop_ctl_mutex down to loop_change_fd() + - loop: Move special partition reread handling in loop_clr_fd() + - loop: Move loop_reread_partitions() out of loop_ctl_mutex + - loop: Fix deadlock when calling blkdev_reread_part() + - loop: Avoid circular locking dependency between loop_ctl_mutex and + bd_mutex + - loop: Get rid of 'nested' acquisition of loop_ctl_mutex + - loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() + - loop: drop caches if offset or block_size are changed + - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock + - nbd: Use set_blocksize() to set device blocksize + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.18 + - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped + address + - [armhf, arm64 net: dsa: mv88x6xxx: mv88e6390 errata + - net, skbuff: do not prefer skb allocation fails early + - qmi_wwan: add MTU default to qmap network interface + - r8169: Add support for new Realtek Ethernet + - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses + - net: clear skb->tstamp in bridge forwarding path + - netfilter: ipset: Allow matching on destination MAC address for mac and + ipmac sets + - [arm64] gpio: pl061: Move irq_chip definition inside struct pl061 + - drm/amd/display: Guard against null stream_state in set_crc_source + - [x86] drm/amdkfd: fix interrupt spin lock + - ixgbe: allow IPsec Tx offload in VEPA mode + - [x86] platform: asus-wmi: Tell the EC the OS will handle the display + off hotkey + - e1000e: allow non-monotonic SYSTIM readings + - [x86] usb: typec: tcpm: Do not disconnect link for self powered devices + - of: overlay: add missing of_node_put() after add new node to changeset + - writeback: don't decrement wb->refcnt if !wb->bdi + - serial: set suppress_bind_attrs flag only if builtin + - bpf: Allow narrow loads with offset > 0 + - ALSA: oxfw: add support for APOGEE duet FireWire + - [x86] mce: Fix -Wmissing-prototypes warnings + - [mips] SiByte: Enable swiotlb for SWARM, LittleSur and BigSur + - [arm64] perf: set suppress_bind_attrs flag to true + - drm/atomic-helper: Complete fake_commit->flip_done potentially earlier + - [arm64] clk: meson: meson8b: fix incorrect divider mapping in + cpu_scale_table + - samples: bpf: fix: error handling regarding kprobe_events + - usb: gadget: udc: renesas_usb3: add a safety connection way for + forced_b_device + - fpga: altera-cvp: fix probing for multiple FPGAs on the bus + - selinux: always allow mounting submounts + - ASoC: pcm3168a: Don't disable pcm3168a when CONFIG_PM defined + - scsi: qedi: Check for session online before getting iSCSI TLV data. + - drm/amdgpu: Reorder uvd ring init before uvd resume + - rxe: IB_WR_REG_MR does not capture MR's iova field + - efi/libstub: Disable some warnings for x86{,_64} + - jffs2: Fix use of uninitialized delayed_work, lockdep breakage + - clk: imx: make mux parent strings const + - pstore/ram: Do not treat empty buffers as valid + - media: uvcvideo: Refactor teardown of uvc on USB disconnect + - powerpc/xmon: Fix invocation inside lock region + - powerpc/pseries/cpuidle: Fix preempt warning + - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info + - ASoC: use dma_ops of parent device for acp_audio_dma + - media: venus: core: Set dma maximum segment size + - staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io' + - net: call sk_dst_reset when set SO_DONTROUTE + - scsi: target: use consistent left-aligned ASCII INQUIRY data + - scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long + enough + - [arm64] kasan: Increase stack size for KASAN_EXTRA + - clk: imx6q: reset exclusive gates on init + - [arm64] Fix minor issues with the dcache_by_line_op macro + - bpf: relax verifier restriction on BPF_MOV | BPF_ALU + - mmc: atmel-mci: do not assume idle after atmci_request_end + - btrfs: volumes: Make sure there is no overlap of dev extents at mount + time + - btrfs: alloc_chunk: fix more DUP stripe size handling + - btrfs: fix use-after-free due to race between replace start and cancel + - btrfs: improve error handling of btrfs_add_link + - tty/serial: do not free trasnmit buffer page under port lock + - perf intel-pt: Fix error with config term "pt=0" + - perf tests ARM: Disable breakpoint tests 32-bit + - perf svghelper: Fix unchecked usage of strncpy() + - perf parse-events: Fix unchecked usage of strncpy() + - perf vendor events intel: Fix Load_Miss_Real_Latency on SKL/SKX + - netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set + - netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE in netns exit routine + - netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine + - [x86] topology: Use total_cpus for max logical packages calculation + - dm crypt: use u64 instead of sector_t to store iv_offset + - dm kcopyd: Fix bug causing workqueue stalls + - perf stat: Avoid segfaults caused by negated options + - tools lib subcmd: Don't add the kernel sources to the include path + - dm snapshot: Fix excessive memory usage and workqueue stalls + - perf cs-etm: Correct packets swapping in cs_etm__flush() + - perf tools: Add missing sigqueue() prototype for systems lacking it + - perf tools: Add missing open_memstream() prototype for systems lacking it + - quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls. + - clocksource/drivers/integrator-ap: Add missing of_node_put() + - dm: Check for device sector overflow if CONFIG_LBDAF is not set + - Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029 + - ALSA: bebob: fix model-id of unit for Apogee Ensemble + - sysfs: Disable lockdep for driver bind/unbind files + - IB/usnic: Fix potential deadlock + - scsi: mpt3sas: fix memory ordering on 64bit writes + - scsi: smartpqi: correct lun reset issues + - ath10k: fix peer stats null pointer dereference + - scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() + - scsi: megaraid: fix out-of-bound array accesses + - iomap: don't search past page end in iomap_is_partially_uptodate + - ocfs2: fix panic due to unrecovered local alloc + - mm/page-writeback.c: don't break integrity writeback on ->writepage() + error + - mm/swap: use nr_node_ids for avail_lists in swap_info_struct + - userfaultfd: clear flag if remap event not enabled + - mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps + - iwlwifi: mvm: Send LQ command as async when necessary + - Bluetooth: Fix unnecessary error message for HCI request completion + - ipmi: fix use-after-free of user->release_barrier.rda + - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities + - ipmi: Prevent use-after-free in deliver_response + - ipmi:ssif: Fix handling of multi-part return messages + - ipmi: Don't initialize anything in the core until something uses it + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.19 + - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs + - net: bridge: Fix ethernet header pointer before check skb forwardable + - net: Fix usage of pskb_trim_rcsum + - net: phy: marvell: Errata for mv88e6390 internal PHYs + - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error + handling + - net/sched: act_tunnel_key: fix memory leak in case of action replace + - net_sched: refetch skb protocol for each filter + - openvswitch: Avoid OOB read when parsing flow nlattrs + - vhost: log dirty page correctly + - net: ipv4: Fix memory leak in network namespace dismantle + - net/sched: cls_flower: allocate mask dynamically in fl_change() + - udp: with udp_segment release on error path + - ip6_gre: fix tunnel list corruption for x-netns + - erspan: build the header with the right proto according to erspan_ver + - net: phy: marvell: Fix deadlock from wrong locking + - ip6_gre: update version related info when changing link + - tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state + - mei: me: mark LBG devices as having dma support + - mei: me: add denverton innovation engine device IDs + - USB: leds: fix regression in usbport led trigger + - USB: serial: simple: add Motorola Tetra TPG2200 device id + - USB: serial: pl2303: add new PID to support PL2303TB + - ceph: clear inode pointer when snap realm gets dropped by its inode + - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages + - ASoC: rt5514-spi: Fix potential NULL pointer dereference + - ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode + - clk: socfpga: stratix10: fix rate calculation for pll clocks + - clk: socfpga: stratix10: fix naming convention for the fixed-clocks + - inotify: Fix fd refcount leak in inotify_add_watch(). + - ALSA: hda/realtek - Fix typo for ALC225 model + - ALSA: hda - Add mute LED support for HP ProBook 470 G5 + - ARCv2: lib: memeset: fix doing prefetchw outside of buffer + - ARC: adjust memblock_reserve of kernel memory + - ARC: perf: map generic branches to correct hardware condition + - s390/mm: always force a load of the primary ASCE on context switch + - s390/early: improve machine detection + - s390/smp: fix CPU hotplug deadlock with CPU rescan + - misc: ibmvsm: Fix potential NULL pointer dereference + - char/mwave: fix potential Spectre v1 vulnerability + - [arm64] mmc: dw_mmc-bluefield: : Fix the license information + - [arm64] mmc: meson-gx: Free irq in release() callback + - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 + - tty: Handle problem if line discipline does not have receive_buf + - uart: Fix crash in uart_write and uart_put_char + - tty/n_hdlc: fix __might_sleep warning + - hv_balloon: avoid touching uninitialized struct page during tail onlining + - Drivers: hv: vmbus: Check for ring when getting debug info + - vgacon: unconfuse vc_origin when using soft scrollback + - CIFS: Fix possible hang during async MTU reads and writes + - CIFS: Fix credits calculations for reads with errors + - CIFS: Fix credit calculation for encrypted reads with errors + - CIFS: Do not reconnect TCP session in add_credits() + - smb3: add credits we receive from oplock/break PDUs + - Input: xpad - add support for SteelSeries Stratus Duo + - Input: input_event - provide override for sparc64 + - Input: uinput - fix undefined behavior in uinput_validate_absinfo() + - acpi/nfit: Block function zero DSMs + - acpi/nfit: Fix command-supported detection + - scsi: ufs: Use explicit access size in ufshcd_dump_regs + - dm thin: fix passdown_double_checking_shared_status() + - dm crypt: fix parsing of extended IV arguments + - [x86] drm/amdgpu: Add APTX quirk for Lenovo laptop + - [x86] KVM: Fix single-step debugging + - [x86] KVM: Fix PV IPIs for 32-bit KVM host + - [x86] KVM: WARN_ONCE if sending a PV IPI returns a fatal error + - [x86] kvm: vmx: Use kzalloc for cached_vmcs12 + - [x86] KVM/nVMX: Do not validate that posted_intr_desc_addr is page + aligned + - [x86] pkeys: Properly copy pkey state at fork() + - [x86] selftests/pkeys: Fork() to check for state being preserved + - [x86] kaslr: Fix incorrect i8254 outb() parameters + - [x86] entry/64/compat: Fix stack switching for XEN PV + - [arm64] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size + - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by + removing it + - can: bcm: check timer values before ktime conversion + - can: flexcan: fix NULL pointer exception during bringup + - vt: make vt_console_print() compatible with the unicode screen buffer + - vt: always call notifier with the console lock held + - vt: invoke notifier on screen size change + - [arm64] drm/meson: Fix atomic mode switching regression + - bpf: improve verifier branch analysis + - bpf: add per-insn complexity limit + - bpf: move {prev_,}insn_idx into verifier env + - bpf: move tmp variable into ax register in interpreter + - bpf: enable access to ax register also from verifier rewrite + - bpf: restrict map value pointer arithmetic for unprivileged + - bpf: restrict stack pointer arithmetic for unprivileged + - bpf: restrict unknown scalars of mixed signed bounds for unprivileged + - bpf: fix check_map_access smin_value test when pointer contains offset + - bpf: prevent out of bounds speculation on pointer arithmetic + (CVE-2019-7308) + - bpf: fix sanitation of alu op with pointer / scalar type from different + paths (CVE-2019-7308) + - bpf: fix inner map masking to prevent oob under speculation + - [s390*] smp: Fix calling smp_call_ipl_cpu() from ipl CPU + - nvmet-rdma: Add unlikely for response allocated check + - nvmet-rdma: fix null dereference under heavy load + - Revert "mm, memory_hotplug: initialize struct pages for the full memory + section" + - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup + - ide: fix a typo in the settings proc file name + - Input: input_event - fix the CONFIG_SPARC64 mixup + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.20 + - Fix "net: ipv4: do not handle duplicate fragments as overlapping" + - ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation + - ipvlan, l3mdev: fix broken l3s mode wrt local routes + - l2tp: copy 4 more bytes to linear part if necessary + - l2tp: fix reading optional fields of L2TPv3 + - net: ip_gre: always reports o_key to userspace + - net: ip_gre: use erspan key field for tunnel lookup + - net/mlx4_core: Add masking for a few queries on HCA caps + - netrom: switch to sock timer API + - net/rose: fix NULL ax25_cb kernel panic + - net: set default network namespace in init_dummy_netdev() + - sctp: improve the events for sctp stream reset + - tun: move the call to tun_set_real_num_queues + - vhost: fix OOB in get_rx_bufs() + (CVE-2018-16880) + - net: ip6_gre: always reports o_key to userspace + - sctp: improve the events for sctp stream adding + - net/mlx5e: Allow MAC invalidation while spoofchk is ON + - ip6mr: Fix notifiers call on mroute_clean_tables() + - sctp: set chunk transport correctly when it's a new asoc + - sctp: set flow sport from saddr only when it's 0 + - virtio_net: Don't enable NAPI when interface is down + - virtio_net: Don't call free_old_xmit_skbs for xdp_frames + - virtio_net: Fix not restoring real_num_rx_queues + - virtio_net: Fix out of bounds access of sq + - virtio_net: Don't process redirected XDP frames when XDP is disabled + - virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs + - virtio_net: Differentiate sk_buff and xdp_frame on freeing + - CIFS: Do not count -ENODATA as failure for query directory + - CIFS: Fix trace command logging for SMB2 reads and writes + - CIFS: Do not consider -ENODATA as stat failure for reads + - fs/dcache: Fix incorrect nr_dentry_unused accounting in + shrink_dcache_sb() + - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() + - NFS: Fix up return value on fatal errors in nfs_page_async_flush() + - [arm64] kaslr: ensure randomized quantities are clean also when kaslr is + off + - [arm64] Do not issue IPIs for user executable ptes + - [arm64] hyp-stub: Forbid kprobing of the hyp-stub + - [arm64] hibernate: Clean the __hyp_text to PoC after resume + - gpiolib: fix line event timestamps for nested irqs + - gpio: pcf857x: Fix interrupts on multiple instances + - gfs2: Revert "Fix loop in gfs2_rbm_find" + - [arm*] mmc: bcm2835: Fix DMA channel leak on probe error + - mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay + - ALSA: usb-audio: Add Opus #3 to quirks for native DSD support + - ALSA: hda/realtek - Fixed hp_pin no value + - IB/hfi1: Remove overly conservative VM_EXEC flag check + - [x86] platform: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK + - [x86] platform: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes + - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe + - Btrfs: fix deadlock when allocating tree block during leaf/node split + - btrfs: On error always free subvol_name in btrfs_mount + - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes + - mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT + - oom, oom_reaper: do not enqueue same task twice + - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages + - mm, oom: fix use-after-free in oom_kill_process + - mm: hwpoison: use do_send_sig_info() instead of force_sig() + - mm: migrate: don't rely on __PageMovable() of newpage after unlocking it + - of: Convert to using %pOFn instead of device_node.name + - of: overlay: add tests to validate kfrees from overlay removal + - of: overlay: add missing of_node_get() in __of_attach_node_sysfs + - of: overlay: use prop add changeset entry for property in new nodes + - of: overlay: do not duplicate properties from overlay for new nodes + - md/raid5: fix 'out of memory' during raid cache recovery + - cifs: Always resolve hostname before reconnecting + + [ Luca Boccassi ] + * Do not generate linux-source-$ver stanza in debian/control if + source is set to disabled in debian/config/defines. + * linux-perf: explicitly disable the jvmti feature and shared library. + * Document pkg.linux.nosource in debian/README.source. + * [amd64] enable UIO_HV_GENERIC for Azure's VMBus access. + * [cloud-amd64] enable UIO for Azure's VMBus access, and VFIO for guests + running on an hypervisor that exposes a vIOMMU. + + [ Ben Hutchings ] + * debian/rules.d, debian/rules.real: Restore build of userland headers for + tools + * debian/rules.d: Delete now-unused recursive makefiles + * debian/rules.d/tools/perf/Makefile: Delete redundant arch/profile checks + * debian/control: Add !pkg.linux.nokernel to qualification for compiler + build-deps + * [i386] debian/control: Fix cross-compiler build-dependency + * debian/README.source: Document how to run kconfigeditor2 + * [armhf,arm64] serial: 8250: Disable SERIAL_8250_DEPRECATED_OPTIONS + * percpu: convert spin_lock_irq to spin_lock_irqsave (fixes boot failure with + alpha-generic flavour) + * debian/tests/python: Fix spurious failure due to misuse of stderr + * Update "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for ..." + to not duplicate the conditional warning/error + * Bump ABI to 3 + * drivers/firmware: Enable FW_CFG_SYSFS as module (Closes: #882208) + * [arm64,armhf,ia64,riscv64,sparc64] udeb: Add usb-serial-modules + (Closes: #903824) + * [powerpc*,sparc64] udeb: Add nic-usb-modules + * [armhf,riscv64,s390x] udeb: Add cdrom-core-modules + * 9p: Enable NET_9P_XEN as module + * ACPI: Enable ACPI_TAD as module + * amd-xgbe: Enable AMD_XGBE_DCB + * ath9k: Enable ATH9K_CHANNEL_CONTEXT + * block: Enable BLK_DEV_ZONED (except armel/marvell) + * bluetooth: Enable BT_HCIUART_RTL; BT_HCIUART_NOKIA, BT_MTKUART as modules + * bnxt: Enable BNXT_DCB + * ethernet: Enable HINIC, ICE, LAN743X, LIQUIDIO_VF as modules + * can: Enable CAN_VXCAN, CAN_MCBA_USB, CAN_UCAN as modules + * dm: Enable DM_UNSTRIPED, DM_WRITECACHE, DM_ZONED as modules + * [arm64,armhf] drm: Enable DRM_PANEL_RASPBERRYPI_TOUCHSCREEN as module + * dvb-usb-v2: Enable DVB_USB_ZD1301 as module + * gnss: Enable GNSS, GNSS_SIRF_SERIAL, GNSS_UBX_SERIAL as modules + * gpio: Enable GPIO_EXAR, GPIO_PCI_IDIO_16, GPIO_PCIE_IDIO_24 as modules + * HID: Enable HID_ACCUTOUCH, HID_COUGAR, HID_ELAN, HID_ITE, HID_JABRA, + HID_MAYFLASH, HID_REDRAGON, HID_RETRODE, HID_STEAM, HID_UDRAW_PS3 as + modules + * [x86] i2c: Enable I2C_DESIGNWARE_BAYTRAIL + * IB: Enable CGROUP_RDMA (except armel/marvell) + * ieee802154: Enable IEEE802154_HWSIM as module + * inet: Enable INET_RAW_DIAG as module + * input: Enable INPUT_AXP20X_PEK as module + * IPMI: Enable IPMI_SSIF as module + * joystick: Enable JOYSTICK_PXRC as module + * media/rc: Enable IR_IMON_DECODER, IR_IMON_RAW as modules + * [x86] mfd: Enable INTEL_SOC_PMIC_BXTWC, INTEL_SOC_PMIC_CHTDC_TI as modules + * mlx5: Enable MLX5_FPGA, MLX5_CORE_IPOIB; MLXFW as module + * net: Enable BPF_STREAM_PARSER, XDP_SOCKETS (except armel/marvell) + (Closes: #908860); NET_FAILOVER, SMC, SMC_DIAG, VSOCKMON as modules + * net/phy: Enable LED_TRIGGER_PHY; CORTINA_PHY, DP83822_PHY, DP83TC811_PHY, + MARVELL_10G_PHY, MICROCHIP_T1_PHY, RENESAS_PHY, ROCKCHIP_PHY as modules + * net/sched: Enable NET_SCH_CBS, NET_SCH_ETF, NET_SCH_SKBPRIO, NET_EMATCH_IPT + as modules + * PCMCIA: Enable SCR24X as module + * [x86] pinctrl: Enable PINCTRL_CANNONLAKE, PINCTRL_CEDARFORK, + PINCTRL_DENVERTON, PINCTRL_GEMINILAKE, PINCTRL_ICELAKE, PINCTRL_LEWISBURG + * [x86] rmi4: Re-enable RMI4_CORE, RMI4_SMB as modules (Closes: #875621); + RMI4_F03, RMI4_F11, RMI4_F12, RMI4_F30, RMI4_F34, RMI4_F55 + * xfrm: Enable XFRM_INTERFACE as module + * PCI: Enable PCI_PF_STUB as module + * ptp: Change PTP_1588_CLOCK_KVM from built-in to module + * random: Enable RANDOM_TRUST_CPU. This can be reverted using the kernel + parameter: random.trust_cpu=off + * SCSI: Enable QEDF, QEDI as modules + * serial: Enable SERIAL_8250_EXAR, USB_SERIAL_F8153X, USB_SERIAL_UPD78F0730 + as modules + * sound: Enable SND_FIREWIRE_MOTU, SND_FIREFACE, SND_XEN_FRONTEND as modules + * [x86] sound: Enable SND_SOC_AMD_CZ_DA7219MX98357_MACH, + SND_SOC_AMD_CZ_RT5645_MACH, SND_SOC_INTEL_CHT_BSW_NAU8824_MACH, + SND_SOC_INTEL_BYT_CHT_DA7213_MACH, SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH, + SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH, + SND_SOC_INTEL_KBL_DA7219_MAX98357A_MACH, + SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH as modules + * thermal: Enable DEVFREQ_THERMAL, THERMAL_STATISTICS + * tpm: Enable TCG_TIS_SPI, TCG_VTPM_PROXY as modules + * usbtouchscreen: Enable TOUCHSCREEN_USB_EASYTOUCH + * watchdog: Enable WATCHDOG_PRETIMEOUT_GOV, WATCHDOG_PRETIMEOUT_GOV_NOOP, + WATCHDOG_PRETIMEOUT_DEFAULT_GOV_NOOP; WATCHDOG_PRETIMEOUT_GOV_PANIC, + WDAT_WDT as modules + * [x86] watchdog: Enable INTEL_MEI_WDT, NI903X_WDT, NIC7018_WDT as modules + * wireless: Enable MT76x0U, MT76x2E, MT76x2U, QTNFMAC_PEARL_PCIE as modules + (Closes: #918331) + * zram: Enable ZRAM_WRITEBACK, ZRAM_MEMORY_TRACKING + * udeb: Add scsi-nic-modules containing Chelsio and Qlogic iSCSI/FC drivers + + [ Marcin Juszkiewicz ] + * [arm64] enable ARM_CCI_PMU so ARM_CCI400_PMU and ARM_CCI5xx_PMU options + get really enabled. + * [arm64] enable PCI_PRI, PCI_PASID as PCI can be behind IOMMU in servers. + * udeb: Add virtio-gpu into d-i to get graphical output in VM instances. + * [arm64] Enable ARM64_ERRATUM_843419 (Closes: #920866) + + [ Salvatore Bonaccorso ] + * [x86] kvmclock: set offset for kvm unstable clock (Closes: #918036) + * kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) + * [x86] KVM: work around leak of uninitialized stack contents + (CVE-2019-7222) + * [x86] KVM: nVMX: unconditionally cancel preemption timer in free_nested + (CVE-2019-7221) + * HID: debug: fix the ring buffer implementation (CVE-2019-3819) + + [ Hideki Yamane ] + * [x86] Enable Touchpad support on Gemini Lake via CONFIG_PINCTRL_GEMINILAKE + (Closes: #917388) + * [x86] Enable SND_SOC_ES8316 and Baytrail & Cherrytrail with ES8316 codec, + too (Closes: #918589) + * hwmon: Enable CONFIG_SENSORS_NCT7802,NCT7904,NPCM7XX,ASPEED and W83773G + to use HWMON hardware (Closes: #912597) + * net: can: Enable CONFIG_CAN_PEAK_PCIEFD for a PCI express CAN Bus adapter + (Closes: #920809) + * [armhf] Enable CONFIG_SENSORS_LM75 for armhf (Closes: #918114) + * [armhf] Enable CONFIG_IMX_THERMAL for armhf (Closes: #883023) + * [arm64] Enable CONFIG_ARM_ARMADA_37XX_CPUFREQ for arm64 (Closes: #917939) + + [ Vagrant Cascadian ] + * [armhf] Enable CONFIG_MMC_SDHCI_OMAP=m, used on DRA7 and related SoCs. + + [ Uwe Kleine-König ] + * [armel] add spi-orion to mtd.udeb to be able to access spi flash on e.g. + qnap ts-21x. (Closes: #920607) + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 11 Feb 2019 16:55:59 +0000 + +linux (4.19.16-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.14 + - ax25: fix a use-after-free in ax25_fillin_cb() + - gro_cell: add napi_disable in gro_cells_destroy + - ip6mr: Fix potential Spectre v1 vulnerability + - ipv4: Fix potential Spectre v1 vulnerability + - ipv6: explicitly initialize udp6_addr in udp_sock_create6() + - ipv6: tunnels: fix two use-after-free + - ip: validate header length on virtual device xmit + - isdn: fix kernel-infoleak in capi_unlocked_ioctl + - net/wan: fix a double free in x25_asy_open_tty() + - packet: validate address length + - packet: validate address length if non-zero + - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() + - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event + - tipc: compare remote and local protocols in tipc_udp_enable() + - tipc: fix a double free in tipc_enable_bearer() + - tipc: fix a double kfree_skb() + - ipv6: frags: Fix bogus skb->sk in reassembled packets + - ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() + error + - ALSA: rme9652: Fix potential Spectre v1 vulnerability + - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities + - ALSA: pcm: Fix potential Spectre v1 vulnerability + - ALSA: emux: Fix potential Spectre v1 vulnerabilities + - powerpc/fsl: Fix spectre_v2 mitigations reporting + - usb: r8a66597: Fix a possible concurrency use-after-free bug in + r8a66597_endpoint_disable() + - [s390x] s390/pci: fix sleeping in atomic during hotplug + - [x86] x86/speculation/l1tf: Drop the swap storage limit restriction when + l1tf=off + - [x86] x86/mm: Drop usage of __flush_tlb_all() in + kernel_physical_mapping_init() + - [x86] KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup + - [arm64] arm64: KVM: Make VHE Stage-2 TLB invalidation operations + non-interruptible + - perf pmu: Suppress potential format-truncation warning + - perf env: Also consider env->arch == NULL as local operation + - ext4: fix possible use after free in ext4_quota_enable + - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data() + - ext4: include terminating u32 in size of xattr entries when expanding + inodes + - ext4: force inode writes when nfsd calls commit_metadata() + - ext4: check for shutdown and r/o file system in ext4_write_inode() + - [armhf,arm64] spi: bcm2835: Fix race on DMA termination + - [armhf,arm64] spi: bcm2835: Fix book-keeping of DMA termination + - [armhf,arm64] spi: bcm2835: Avoid finishing transfer prematurely in IRQ + mode + - btrfs: dev-replace: go back to suspended state if target device is missing + - btrfs: dev-replace: go back to suspend state if another EXCL_OP is running + - btrfs: skip file_extent generation check for free_space_inode in + run_delalloc_nocow + - Btrfs: fix fsync of files with multiple hard links in new directories + - btrfs: run delayed items before dropping the snapshot + - Btrfs: send, fix race with transaction commits that create snapshots + - brcmfmac: Fix out of bounds memory access during fw load + - dax: Don't access a freed inode + - f2fs: read page index before freeing + - f2fs: sanity check of xattr entry size + - media: imx274: fix stack corruption in imx274_read_reg + - media: v4l2-tpg: array index could become negative + - tools lib traceevent: Fix processing of dereferenced args in bprintk + events + - [mips*] MIPS: math-emu: Write-protect delay slot emulation pages + - [mips*] MIPS: Ensure pmd_present() returns false after pmd_mknotpresent() + - [mips*] MIPS: Align kernel load address to 64KB + - [mips*] MIPS: Expand MIPS32 ASIDs to 64 bits + - CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock + problem + - smb3: fix large reads on encrypted connections + - [arm*] KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum + - [arm*] KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring + state + - [arm*] KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.15 + - IB/core: Fix oops in netdev_next_upper_dev_rcu() + - xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force + clears the dst_entry. + - ieee802154: hwsim: fix off-by-one in parse nested + - netfilter: seqadj: re-load tcp header pointer after possible head + reallocation + - scsi: bnx2fc: Fix NULL dereference in error handling + - [ppc64el] ibmvnic: Convert reset work item mutex to spin lock + - [ppc64el] ibmvnic: Fix non-atomic memory allocation in IRQ context + - [x86] x86/mm: Fix guard hole handling + - i40e: fix mac filter delete when setting mac address + - ixgbe: Fix race when the VF driver does a reset + - netfilter: nat: can't use dst_hold on noref dst + - bnx2x: Clear fip MAC when fcoe offload support is disabled + - bnx2x: Remove configured vlans as part of unload sequence. + - bnx2x: Send update-svid ramrod with retry/poll flags enabled + - mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues + - [x86] x86, hyperv: remove PCI dependency + - [arm64] net: hns: All ports can not work when insmod hns ko after rmmod. + - [arm64] net: hns: Fixed bug that netdev was opened twice + - [arm64] net: hns: Clean rx fbd when ae stopped. + - [arm64] net: hns: Avoid net reset caused by pause frames storm + - [arm64] net: hns: Add mac pcs config when enable|disable mac + - [arm64] net: hns: Fix ping failed when use net bridge and send multicast + - mac80211: fix a kernel panic when TXing after TXQ teardown + - [arm64,riscv64] net: macb: fix random memory corruption on RX with + 64-bit DMA + - [arm64.risvv64] net: macb: fix dropped RX frames due to a race + - lan78xx: Resolve issue with changing MAC address + - [s390x] scsi: zfcp: fix posting too many status read buffers leading to + adapter shutdown + - fork: record start_time late + - zram: fix double free backing device + - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined + - mm, devm_memremap_pages: kill mapping "System RAM" support + - memcg, oom: notify on oom killer invocation from the charge path + - mt76x0: init hw capabilities + - [amd64] media: cx23885: only reset DMA on problematic CPUs + - ALSA: cs46xx: Potential NULL dereference in probe + - ALSA: usb-audio: Avoid access before bLength check in + build_audio_procunit() + - ALSA: usb-audio: Check mixer unit descriptors more strictly + - ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks + - ALSA: usb-audio: Always check descriptor sizes in parser code + - Fix failure path in alloc_pid() + - block: deactivate blk_stat timer in wbt_disable_default() + - gfs2: Get rid of potential double-freeing in gfs2_create_inode + - gfs2: Fix loop in gfs2_rbm_find + - b43: Fix error in cordic routine + - nfsd4: zero-length WRITE should succeed + - [ppc*] powerpc/tm: Set MSR[TS] just prior to recheckpoint + - RDMA/srpt: Fix a use-after-free in the channel release code + - sched/fair: Fix infinite loop in update_blocked_averages() by reverting + a9e7f6544b9c + - [s390x] genwqe: Fix size check + - [x86] intel_th: msu: Fix an off-by-one in attribute store + - [armhf,arm64] drm/rockchip: psr: do not dereference encoder before it is + null checked. + - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16 + - Btrfs: fix deadlock when using free space tree due to block group + creation + - staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption + - staging: rtl8188eu: Fix module loading from tasklet for WEP encryption + - cpufreq: scmi: Fix frequency invariance in slow path + - [x86] modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE + - ALSA: hda/realtek - Support Dell headset mode for New AIO platform + - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode + for ALC225 + - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 + - CIFS: Fix adjustment of credits for MTU requests + - CIFS: Do not set credits to 1 if the server didn't grant anything + - CIFS: Do not hide EINTR after sending network packets + - CIFS: Fix credit computation for compounded requests + - cifs: Fix potential OOB access of lock element array + - usb: cdc-acm: send ZLP for Telit 3G Intel based modems + - USB: storage: don't insert sane sense for SPC3+ when bad sense specified + - USB: storage: add quirk for SMI SM3350 + - USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB + - slab: alien caches must not be initialized if the allocation of the alien + cache failed + - mm/usercopy.c: no check page span for stack objects + - mm, memcg: fix reclaim deadlock with writeback + - ACPI: power: Skip duplicate power resource references in _PRx + - ACPI / PMIC: xpower: Fix TS-pin current-source handling + - ACPI/IORT: Fix rc_dma_get_range() + - i2c: dev: prevent adapter retries and timeout being set as minus value + - vfio/type1: Fix unmap overflow off-by-one + - drm/amdgpu: Add new VegaM pci id + - PCI: dwc: Use interrupt masking instead of disabling + - PCI: dwc: Take lock when ACKing an interrupt + - PCI: dwc: Move interrupt acking into the proper callback + - drm/amd/display: Fix MST dp_blank REG_WAIT timeout + - drm/fb_helper: Allow leaking fbdev smem_start + - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 + - [x86] drm/i915: Unwind failure on pinning the gen7 ppgtt + - drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume() + - drm/amdgpu: Don't fail resume process if resuming atomic state fails + - rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set + - ext4: make sure enough credits are reserved for dioread_nolock writes + - ext4: fix a potential fiemap/page fault deadlock w/ inline_data + - ext4: avoid kernel warning when writing the superblock to a dead device + - ext4: use ext4_write_inode() when fsyncing w/o a journal + - ext4: track writeback errors using the generic tracking infrastructure + - ext4: fix special inode number checks in __ext4_iget() + - mm: page_mapped: don't assume compound page is huge or THP + - sunrpc: use-after-free in svc_process_common() + - [armhf,arm64] KVM: Fix VMID alloc race by reverting to lock-less + - [arm64] compat: Don't pull syscall number from regs in arm_compat_syscall + - Btrfs: fix access to available allocation bits when starting balance + - Btrfs: fix deadlock when enabling quotas due to concurrent snapshot + creation + - Btrfs: use nofs context when initializing security xattrs to avoid + deadlock + + [ John Paul Adrian Glaubitz ] + * [m68k] Add patch to build with -ffreestanding to fix FTBFS + + [ Ben Hutchings ] + * [ia64,m68k] libbpf: Really don't build on architectures without perf events + * Use dh_listpackages to determine which packages to build + * Add pkg.linux.nokernel build profile that excludes kernel image and header + packages + + [ Yves-Alexis Perez ] + * Bump ABI to 2 because of changes in struct sock_common from 60f05dddf1eb + * [rt] Update to 4.19.15-rt12 + - rtmutex/rwlock: preserve state like a sleeping lock + + [ Salvatore Bonaccorso ] + * ipv6: Consider sk_bound_dev_if when binding a socket to an address + (Closes: #918103) + * posix-cpu-timers: Unbreak timer rearming (Closes: #919019, #919049) + + [ Michal Simek ] + * [arm64] Enable Xilinx ZynqMP SoC and drivers + + [ YunQiang Su ] + * [mipsel, mips64el] Enable DRM_AST and FB_SM750 for loongson-3 + install ast and sm750fb to loongson-3's fb-modules + + [ Romain Perier ] + * [rt] Update to 4.19.13-rt10 + + [ Luigi Baldoni ] + * [x86] Enable LEDS_APU to support leds on PC Engines + APU SBC series + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 17 Jan 2019 18:56:17 +0000 + +linux (4.19.13-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.13 + - Revert "vfs: Allow userns root to call mknod on owned filesystems." + - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data + (CVE-2018-19985) + - xhci: Don't prevent USB2 bus suspend in state check intended for USB3 + only + - USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd + - USB: serial: option: add GosunCn ZTE WeLink ME3630 + - USB: serial: option: add HP lt4132 + - USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) + - USB: serial: option: add Fibocom NL668 series + - USB: serial: option: add Telit LN940 series + - ubifs: Handle re-linking of inodes correctly while recovery + - scsi: t10-pi: Return correct ref tag when queue has no integrity profile + - scsi: sd: use mempool for discard special page + - mmc: core: Reset HPI enabled state during re-init and in case of errors + - mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support + - mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl + - [armhf] mmc: omap_hsmmc: fix DMA API warning + - gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers + - posix-timers: Fix division by zero bug + - [x86] KVM: Fix NULL deref in vcpu_scan_ioapic + - [x86] kvm: Add AMD's EX_CFG to the list of ignored MSRs + - [x86] KVM: Fix UAF in nested posted interrupt processing + - [x86] Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened + channels + - futex: Cure exit race + - [x86] mtrr: Don't copy uninitialized gentry fields back to userspace + - [x86] mm: Fix decoy address handling vs 32-bit builds (Closes: #917569) + - [x86] vdso: Pass --eh-frame-hdr to the linker + - panic: avoid deadlocks in re-entrant console drivers + - mm: add mm_pxd_folded checks to pgtable_bytes accounting functions + - mm: make the __PAGETABLE_PxD_FOLDED defines non-empty + - mm: introduce mm_[p4d|pud|pmd]_folded + - xfrm_user: fix freeing of xfrm states on acquire + - rtlwifi: Fix leak of skb when processing C2H_BT_INFO + - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares + - Revert "mwifiex: restructure rx_reorder_tbl_lock usage" + - iwlwifi: add new cards for 9560, 9462, 9461 and killer series + - mm, memory_hotplug: initialize struct pages for the full memory section + - mm: thp: fix flags for pmd migration when split + - mm, page_alloc: fix has_unmovable_pages for HugePages + - mm: don't miss the last page because of round-off error + - Input: elantech - disable elan-i2c for P52 and P72 + - proc/sysctl: don't return ENOMEM on lookup when a table is unregistering + - drm/ioctl: Fix Spectre v1 vulnerabilities + + [ Uwe Kleine-König ] + * [armhf] enable some kconfig items for Allwinner SoCs (SUNXI_CCU=y, + SUN8I_DE2_CCU=y, DRM_SUN8I_DW_HDMI=m, SND_SUN8I_CODEC=m, + SND_SUN8I_CODEC_ANALOG=m). (Closes: #915899) + + [ Ben Hutchings ] + * linux-image-*-unsigned: Remove Provides field (Closes: #916927) + * [ia64,m68k] libbpf: Don't build on architectures without performance events + * [riscv64] tools uapi: fix RISC-V 64-bit support + * [powerpc,powerpcspe,ppc64] linux-config: Eliminate config.*_bootwrapper.gz + files + * [powerpcspe] Fix -mcpu= options for SPE-only compiler + * debian/lib/python/debian_linux/debian.py: Fix deprecated import of + MutableSet + * Fix pycodestyle "line break after binary operator" warnings + * Fix pycodestyle "inalid escape sequence" warnings + + [ Romain Perier ] + * [rt] Update to 4.19.10-rt8 + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 30 Dec 2018 10:04:03 +0100 + +linux (4.19.12-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.10 + - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes + - ipv6: Check available headroom in ip6_xmit() even without options + - ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output + - [arm64, hppa, powerpc, x86, alpha, armhf, mips*] net: 8139cp: fix a BUG + triggered by changing mtu with network traffic + - net: phy: don't allow __set_phy_supported to add unsupported modes + - net: Prevent invalid access to skb->prev in __qdisc_drop_all + - net: use skb_list_del_init() to remove from RX sublists + - Revert "net/ibm/emac: wrong bit is used for STA control" + - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices + - sctp: kfree_rcu asoc + - tcp: Do not underestimate rwnd_limited + - tcp: fix NULL ref in tail loss probe + - tun: forbid iface creation with rtnl ops + - virtio-net: keep vnet header zeroed after processing XDP + - net: phy: sfp: correct store of detected link modes + - sctp: update frag_point when stream_interleave is set + - net: restore call to netdev_queue_numa_node_write when resetting XPS + - net: fix XPS static_key accounting + - [armhf] OMAP2+: prm44xx: Fix section annotation on + omap44xx_prm_enable_io_wakeup + - [arm64, x86] staging: rtl8723bs: Fix the return value in case of error in + 'rtw_wx_read32()' + - [armhf] dts: am3517: Fix pinmuxing for CD on MMC1 + - [armhf] dts: LogicPD Torpedo: Fix mmc3_dat1 interrupt + - [armhf] dts: logicpd-somlv: Fix interrupt on mmc3_dat1 + - [armhf] dts: am3517-som: Fix WL127x Wifi interrupt + - tools: bpftool: prevent infinite loop in get_fdinfo() + - [arm64] dts: sdm845-mtp: Reserve reserved gpios + - sysv: return 'err' instead of 0 in __sysv_write_inode + - netfilter: nf_tables: don't skip inactive chains during update + - perf tools: Fix crash on synthesizing the unit + - netfilter: xt_RATEEST: remove netns exit routine + - netfilter: nf_tables: fix use-after-free when deleting compat expressions + - [armhf] ASoC: rockchip: add missing slave_config setting for I2S + - s390/cpum_cf: Reject request for sampling in event initialization + - [arm64, armel, x86, armhf] ASoC: dapm: Recalculate audio map forcely when + card instantiated + - [armhf] spi: omap2-mcspi: Add missing suspend and resume calls + - bpf: allocate local storage buffers using GFP_ATOMIC + - aio: fix failure to put the file pointer + - netfilter: xt_hashlimit: fix a possible memory leak in htable_create() + - hwmon: (w83795) temp4_type has writable permission + - perf tools: Restore proper cwd on return from mnt namespace + - [armhf] PCI: imx6: Fix link training status detection in link up check + - objtool: Fix double-free in .cold detection error path + - objtool: Fix segfault in .cold detection with -ffunction-sections + - [arm64] phy: qcom-qusb2: Use HSTX_TRIM fused value as is + - [arm64] phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845 + - Btrfs: send, fix infinite loop due to directory rename dependencies + - RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR + - RDMA/core: Add GIDs while changing MAC addr only for registered ndev + - RDMA/rdmavt: Fix rvt_create_ah function signature + - tools: bpftool: fix potential NULL pointer dereference in do_load + - ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf + - [x86] thunderbolt: Prevent root port runtime suspend during NVM upgrade + - [arm64] drm/meson: add support for 1080p25 mode + - netfilter: ipv6: Preserve link scope traffic original oif + - IB/mlx5: Fix page fault handling for MW + - netfilter: add missing error handling code for register functions + - [x86] KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA + changes + - [x86] kvm/vmx: fix old-style function declaration + - [arm64] net: thunderx: fix NULL pointer dereference in nic_remove + - netfilter: nf_tables: deactivate expressions in rule replecement routine + - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock + - cachefiles: Fix an assertion failure when trying to update a failed object + - fscache: Fix race in fscache_op_complete() due to split atomic_sub & read + - cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is + active + - igb: fix uninitialized variables + - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps + - [arm64] net: hisilicon: remove unexpected free_netdev + - drm/amdgpu: Add delay after enable RLC ucode + - [arm64, powerpc, x86] drm/ast: fixed reading monitor EDID not stable issue + - Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" + - afs: Fix validation/callback interaction + - fscache: fix race between enablement and dropping of object + - cachefiles: Explicitly cast enumerated type in put_object + - fscache, cachefiles: remove redundant variable 'cache' + - nvme: warn when finding multi-port subsystems without multipathing enabled + - ocfs2: fix deadlock caused by ocfs2_defrag_extent() + - mm/page_alloc.c: fix calculation of pgdat->nr_zones + - hfs: do not free node before using + - hfsplus: do not free node before using + - initramfs: clean old path before creating a hardlink + - ocfs2: fix potential use after free + - dax: Check page->mapping isn't NULL + - ALSA: hda/realtek - Fixed headphone issue for ALC700 + - ALSA: hda/realtek: ALC294 mic and headset-mode fixups for ASUS X542UN + - ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294 + - ALSA: hda/realtek: Enable audio jacks of ASUS UX433FN/UX333FA with ALC294 + - ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon + - IB/hfi1: Fix an out-of-bounds access in get_hw_stats + - bpf: fix off-by-one error in adjust_subprog_starts + - tcp: lack of available data can also cause TSO defer + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.11 + - sched/pelt: Fix warning and clean up IRQ PELT config + - scsi: raid_attrs: fix unused variable warning + - [i386] staging: olpc_dcon: add a missing dependency + - [arm64] dts: qcom-apq8064-arrow-sd-600eval fix graph_endpoint warning + - [arm64] drm/msm: fix address space warning + - aio: fix spectre gadget in lookup_ioctx + - fs/iomap.c: get/put the page in iomap_page_create/release() + - userfaultfd: check VM_MAYWRITE was set after verifying the uffd is + registered + - [arm64] dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing + - block/bio: Do not zero user pages + - ovl: fix decode of dir file handle with multi lower layers + - ovl: fix missing override creds in link of a metacopy upper + - [armhf] MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 + - mmc: core: use mrq->sbc when sending CMD23 for RPMB + - mmc: sdhci: fix the timeout check window for clock and reset + - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS + - [arm] mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt + - [arm] dts: bcm2837: Fix polarity of wifi reset GPIOs (Closes: #911443) + - dm thin: send event about thin-pool state change _after_ making it + - dm cache metadata: verify cache has blocks in + blocks_are_clean_separate_dirty() + - dm: call blk_queue_split() to impose device limits on bios + - tracing: Fix memory leak of instance function hash filters + - [powerpc*] msi: Fix NULL pointer access in teardown code + - drm/nouveau/kms: Fix memory leak in nv50_mstm_del() + - drm/nouveau/kms/nv50-: also flush fb writes when rewinding push buffer + - Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" + - [x86] drm/i915/execlists: Apply a full mb before execution for Braswell + - [amd64] drm/amdkfd: add new vega10 pci ids + - drm/amdgpu: add some additional vega10 pci ids + - drm/amdgpu: update smu firmware images for VI variants (v2) + - drm/amdgpu: update SMC firmware image for polaris10 variants + - [x86] build: Fix compiler support check for CONFIG_RETPOLINE + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.12 + - locking/qspinlock: Re-order code + - [x86] locking/qspinlock, x86: Provide liveness guarantee + - [amd64] IB/hfi1: Remove race conditions in user_sdma send path + - mac80211_hwsim: fix module init error paths for netlink + - [x86] Input: hyper-v - fix wakeup from suspend-to-idle + - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset + - [x86] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to + free_irq during unload + - [x86] earlyprintk/efi: Fix infinite loop on some screen widths + - [arm64] drm/msm: Fix task dump in gpu recovery + - [arm64] drm/msm/gpu: Fix a couple memory leaks in debugfs + - [arm64] drm/msm: fix handling of cmdstream offset + - [arm64] drm/msm/dsi: configure VCO rate for 10nm PLL driver + - [arm64] drm/msm: Grab a vblank reference when waiting for commit_done + - drm/ttm: fix LRU handling in ttm_buffer_object_transfer + - drm/amdgpu: wait for IB test on first device open + - [arm64,armhf] net: stmmac: Move debugfs init/exit to + ->probe()/->remove() + - [amd64] net: aquantia: fix rx checksum offload bits + - bonding: fix 802.3ad state sent to partner when unbinding slave + - liquidio: read sc->iq_no before release sc + - nfs: don't dirty kernel pages read by direct-io + - SUNRPC: Fix a potential race in xprt_connect() + - [sparc64] sbus: char: add of_node_put() + - [sparc64] drivers/sbus/char: add of_node_put() + - [sparc64] drivers/tty: add missing of_node_put() + - [arm64] drm/msm/hdmi: Enable HPD after HDMI IRQ is set up + - [amr64] drm/msm: dpu: Don't set legacy plane->crtc pointer + - [arm64] drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated + data" + - [arm64] drm/msm: Fix error return checking + - [arm64] clk: mvebu: Off by one bugs in cp110_of_clk_get() + - Input: synaptics - enable SMBus for HP 15-ay000 + - [armhf] Input: omap-keypad - fix keyboard debounce configuration + - libata: whitelist all SAMSUNG MZ7KM* solid-state disks + - macvlan: return correct error value + - [arm64,armhf] mv88e6060: disable hardware level MAC learning + - net/mlx4_en: Fix build break when CONFIG_INET is off + - bpf: check pending signals while verifying programs + - [arm*] 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address + handling + - [arm*] 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart + - [arm*] 8816/1: dma-mapping: fix potential uninitialized return + - [arm64,armhf] thermal: armada: fix legacy validity test sense + - [arm64,armhf] net: mvpp2: fix detection of 10G SFP modules + - [arm64,armhf] net: mvpp2: fix phylink handling of invalid PHY modes + - drm/amdgpu/vcn: Update vcn.cur_state during suspend + - [amd64,arm64] acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather + than "ARS-short" + - drm/ast: Fix connector leak during driver unload + - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure + cifs) + - vhost/vsock: fix reset orphans race with close timeout + - [x86] i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI + device node + - nvme: validate controller state before rescheduling keep alive + - nvmet-rdma: fix response use after free + - Btrfs: fix missing delayed iputs on unmount + + [ Uwe Kleine-König ] + * [arm] Fix probing of 3rd gpio device on Armada 370. + + [ Ben Hutchings ] + * linux-perf: Fix build-time check for unversioned files + * linux-perf: Fix installation directories for BPF headers and examples + (Closes: #916774) + + [ Noah Meyerhans ] + * drivers/net/ethernet/amazon: Backport v2.0.2 from Linux 4.20 + + [ Bastian Blank ] + * Ignore various ABI changes. + + [ Salvatore Bonaccorso ] + * iomap: Revert "fs/iomap.c: get/put the page in + iomap_page_create/release()" + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 22 Dec 2018 09:06:45 +0100 + +linux (4.19.9-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.6 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.7 + - [x86] KVM: LAPIC: Fix pv ipis use-before-initialization (CVE-2018-19406) + - mm: cleancache: fix corruption on missed inode invalidation + (CVE-2018-16862) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.8 + - blk-mq: fix corruption with direct issue (Closes: #915666) + - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails + (CVE-2018-18397) + - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem + (CVE-2018-18397) + - userfaultfd: shmem: add i_size checks (CVE-2018-18397) + - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not + set (CVE-2018-18397) + - blk-mq: punt failed direct issue to dispatch list + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9 + - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in + card.c (CVE-2018-19824) + - vhost/vsock: fix use-after-free in network stack callers + (CVE-2018-14625) + + [ Marcin Juszkiewicz ] + * [arm64] Enable ACPI IMPI + * [arm64] Enable IPMI watchdog and power off support + * [arm64] Enable PCI Express hotplug + * [arm64] Enable PMU for several server cpus + * [arm64] Enable HiSilicon LPC for serial/ipmi access + + [ Romain Perier ] + * [x86] Enable support for error detection and correction on the Intel + Pondicherry2 Integrated Memory Controller (Closes: #914946) + * [rt] Update to 4.19.8-rt6 + + [ Uwe Kleine-König ] + * Enable usb support for ATH10K (Closes: #915083) + + [ Luca Boccassi ] + * debian/rules.real: Split the rules so that the [un]versioned_tools + knobs can be used to avoid building them. Fixes FTBFS with unversioned + tools disabled. + * perf: do not ship python2-only call-graph-from-sql script. + * Override Lintian warning dbg-package-missing-depends in source too. + + [ Ben Hutchings ] + * debian/rules.real: Mark most targets as phony + * debian/rules: Mark more targets as phony + * libcpupower: Hide private function and drop it from .symbols file + * integrity: Disable INTEGRITY_TRUSTED_KEYRING (Closes: #865277) + + [ Vagrant Cascadian ] + * debian/config/config: Enable Z3FOLD as a module. + + [ Salvatore Bonaccorso ] + * Set ABI to 1 + + [ Nicolas Schier ] + * ovl: permit overlayfs mounts in user namespaces (Closes: #913880) + + [ Hilko Bengen ] + * Add patches to build libbpf.so with SONAME, link against libelf + * Add versioned libbpf, libbpf-dev package (Closes: #914428) + + [ Hans van Kranenburg ] + * [x86] Add patch to repair booting as Xen dom0 (Closes: #914951) + * [x86] Add patches to support booting a Xen PVH guest via Grub2 + + [ Christoph Anton Mitterer ] + * crypto: Enable MORUS and AEGIS AEAD ciphers (Closes: #914136) + * [amd64]: Enable AES-NI/SSE2/AVX2 optimised implementations of the MORUS + and AEGIS AEAD ciphers + + [ Bastian Blank ] + * Enable NFT_CONNLIMIT, NFT_TUNNEL, NFT_SOCKET, NFT_OSF, NFT_TPROXY, + IP_VS_MH. + * Enable netfilter flow table support. + * [x86] Enable DRM_XEN_FRONTEND. + * Enable EFI_BOOTLOADER_CONTROL, EFI_CAPSULE_LOADER. + + -- Bastian Blank <waldi@debian.org> Sun, 16 Dec 2018 19:45:54 +0100 + +linux (4.19.5-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.19 + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.3 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.4 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.5 + + [ Ben Hutchings ] + * linux-perf: Enable verbose output for build-time feature detection + * udeb: Define mtd-core-modules package to contain MTD core if not built-in + * udeb: Move MTD core from nic-modules to mtd-core-modules + * debian/changelog: Move older entries to changelog.old + * debian/rules: Checksum only the source name and version from + debian/changelog + * Move generation of CONFIG_BUILD_SALT to gencontrol.py + * [x86] hyperv-daemons: Make all services conditional on device existence + * debian/rules.real: Fix build failure with pkg.linux.nosource profile + * debian/source/options: Delete redundant compression setting; satisfy + lintian + * Documentation/media: uapi: Explicitly say there are no Invariant Sections + (Closes: #698668) + + [ Karsten Merker ] + * [riscv64] Build a kernel image and udebs for riscv64 (Closes: #908161) + + [ Uwe Kleine-König ] + * [armhf,arm64] enable SND_BCM2835 as a module (Closes: #911121) + * Enable Orange filesystem (Closes: #911743) + * [arm64] Enable hns3 network driver as a module. (Closes: #914422) + + [ Noah Meyerhans ] + * [cloud-amd64] Enable Amazon ENA ethernet driver (Closes: #910049) + + [ Romain Perier ] + * [rt] Update to 4.19.1-rt3 + * [rt] Update patch arm-disable-NEON-in-kernel-mode.patch, so it can be + applied onto 4.19.2 + * [rt] Update patch + irq-allow-disabling-of-softirq-processing-in-irq-thread-context.patch, so + it can be applied onto 4.19.2 + * [amd64] Enable AMD pinctrl driver (Closes: #908954) + * Enable Diffie-Hellman operations on retained keys (Closes: #911998) + * Update patch features/all/lockdown/enable-cold-boot-attack-mitigation.patch, + so it can be applied onto 4.19.2 + * [x86] Enable DisplayPort CEC-Tunneling-over-AUX HDMI support + (Closes: #913199) + + -- Bastian Blank <waldi@debian.org> Tue, 27 Nov 2018 20:06:42 +0100 + +linux (4.19~rc7-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Uwe Kleine-König ] + * [armhf] enable MVNETA_BM_ENABLE and CAN_FLEXCAN as a module + * enable NET_SCH_CAKE as a module (Closes: #908709) + * enable HID_NTI as a module (Closes: #910260) + + [ Ben Hutchings ] + * linux-kbuild: Include scripts/subarch.include (Closes: #910348) + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 07 Oct 2018 23:48:27 +0100 + +linux (4.19~rc6-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [ppc64el] udeb: Fix relative #include filenames in kernel-image module + list (really fixes FTBFS?) + * debian/bin, debian/lib/python: Fix most errors reported by pycodestyle + * debian/bin, debian/rules.real: Add symlink to Python package directory + instead of editing path + * debian/bin, debian/lib/python: Clean up imports based on pyflakes report + * debian/bin, debian/lib/python: Delete write-only vars reported by pyflakes + * debian/lib/python/debian_linux/gencontrol.py: Delete broken methods + * debian/lib/python/debian_linux/config.py: Fix undefined exception type + * Add Python static checks and unit tests to autopkgtest tests + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 03 Oct 2018 18:57:08 +0100 + +linux (4.19~rc4-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * debian/control: Add arch-qualification to build-dependencies for linux-perf + (Closes: #908519) + * debian/control: Build-depend on libunwind-dev instead of libunwind8-dev + * [hppa,mips*,powerpc*,sh4] debian/control: Build-depend on libunwind-dev for + linux-perf + * debian/control: Build-depend on libnuma-dev for linux-perf on all arches + * debian/control: Remove "cross" from profiles for build-dep on libssl-dev + * [mips64*] debian/control: Build-depend on gcc-multilib for linux-perf + * debian/lib/python: Use raw strings for all regexes + * debian/control: Fix restrictions for build-deps on asciidoctor and + patchutils + * Add support for specifying build-dependencies in binary package templates + * debian/templates: Move various build-dependencies to binary package + templates + * linux-perf: Fix generation of Perl and Python interpreter dependencies + (Closes: #908547) + * lockdep, lib{cpupower,lockdep}-dev: Remove bogus deps on ${shlibs:Depends} + * debian/rules.d/tools/power/linux-cpupower: Add "+" to recursive make + commands + * tools: x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2 + * tools: turbostat: Add checks for failure of fgets() and fscanf() + * debian/control: Build-depend on texlive-latex-{base,extra}, dvipng for + linux-doc + * debian/rules{,.real}: Use /usr/share/dpkg/architecture.mk + * debian/signing_templates/rules: Use /usr/share/dpkg/architecture.mk + * linux-image-*-signed-template: Add ${misc:Depends} to Depends + * linux-image-*-signed-template: Include changelog and copyright files + * linux-image-*-signed-template: Depend on dpkg-dev + * linux-image-*-signed-template: Override lintian warnings about non- + executable scripts + * [ia64] udeb: Fix priority of sn-modules + * Revert "Revert "net: increase fragment memory usage limits"", as 4.19 + includes a better fix for CVE-2018-5391 + * debian/patches: Add Forwarded fields to several patches + * [ppc64el] udeb: Fix relative #include filenames in module lists (fixes + FTBFS) + * [ppc64] udeb: Revert accidental change to nic-pcmcia-modules dependencies + (fixes FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 18 Sep 2018 15:52:02 +0100 + +linux (4.19~rc3-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [s390x] linux-image: Install compressed kernel image (fixes FTBFS) + * [powerpc*] boot: Fix missing crc32poly.h when building with KERNEL_XZ + (fixes FTBFS) + * [x86] boot: Fix EFI stub alignment + * wireless: Update "wireless: Disable regulatory.db direct loading" for + 4.19-rc3 + * aufs: Update support patchset to aufs4.x-rcN 20180910 + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 10 Sep 2018 20:13:55 +0100 + +linux (4.19~rc2-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * aufs: Disable until it is updated for Linux 4.19 + * debian/rules.d: Update for move of bin2c back up to scripts + * locking/lockdep: Delete unnecesary #include (fixes liblockdep build) + * [hppa] debian/control: Simplify build-dependencies for 64-bit toolchain + * Compile with gcc-8 on all architectures + * udeb: Merge configuration directories and files across architectures + * [alpha,hppa] udeb: Remove incorrect dependency overrides + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 03 Sep 2018 21:34:41 +0100 + +linux (4.18.20-2) unstable; urgency=medium + + * linux-kbuild: Include scripts/subarch.include (Closes: #910348) + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 23 Nov 2018 19:15:55 +0000 + +linux (4.18.20-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.11 + - gso_segment: Reset skb->mac_len after modifying network header + - ipv6: fix possible use-after-free in ip6_xmit() + - net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT + - [alpha, hppa, x86] net: hp100: fix always-true check for link up state + - pppoe: fix reception of frames with no mac header + - qmi_wwan: set DTR for modems in forced USB2 mode + - udp4: fix IP_CMSG_CHECKSUM for connected sockets + - neighbour: confirm neigh entries when ARP packet is received + - udp6: add missing checks on edumux packet processing + - net/sched: act_sample: fix NULL dereference in the data path + - hv_netvsc: fix schedule in RCU context + - [arm64, armhf] net: dsa: mv88e6xxx: Fix ATU Miss Violation + - socket: fix struct ifreq size in compat ioctl + - bnxt_en: Fix VF mac address regression. + - ipv6: use rt6_info members when dst is set in rt6_fill_node + - net/ipv6: do not copy dst flags on rt init + - [arm64, armhf] net: mvpp2: let phylink manage the carrier state + - net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags + - NFC: Fix possible memory corruption when handling SHDLC I-Frame commands + - NFC: Fix the number of pipes + - ASoC: uapi: fix sound/skl-tplg-interface.h userspace compilation errors + - ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at + error path + - ALSA: bebob: use address returned by kmalloc() instead of kernel stack for + streaming DMA mapping + - [powerpc*, mips*, x86, alpha, sparc*] ALSA: emu10k1: fix possible info + leak to userspace on SNDRV_EMU10K1_IOCTL_INFO + - ALSA: firewire-digi00x: fix memory leak of private data + - ALSA: firewire-tascam: fix memory leak of private data + - ALSA: fireworks: fix memory leak of response buffer at error path + - ALSA: oxfw: fix memory leak for model-dependent data at error path + - ALSA: oxfw: fix memory leak of discovered stream formats at error path + - ALSA: oxfw: fix memory leak of private data + - mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able + - [x86] platform: dell-smbios-wmi: Correct a memory leak + - [x86] platform: alienware-wmi: Correct a memory leak + - xen/netfront: don't bug in case of too many frags + - Revert "PCI: Add ACS quirk for Intel 300 series" + - crypto: x86/aegis,morus - Do not require OSXSAVE for SSE2 + - fork: report pid exhaustion correctly + - mm: disable deferred struct page for 32-bit arches + - mm: shmem.c: Correctly annotate new inodes for lockdep + - bpf/verifier: disallow pointer subtraction + - Revert "ubifs: xattr: Don't operate on deleted inodes" + - libata: mask swap internal and hardware tag + - ocfs2: fix ocfs2 read block panic + - drm/i915/bdw: Increase IPS disable timeout to 100ms + - drm/nouveau: Reset MST branching unit before enabling + - drm/nouveau: Only write DP_MSTM_CTRL when needed + - drm/nouveau: Remove duplicate poll_enable() in pmops_runtime_suspend() + - drm/nouveau: Fix deadlocks in nouveau_connector_detect() + - drm/nouveau/drm/nouveau: Don't forget to cancel hpd_work on suspend/unload + - drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement + - drm/nouveau/drm/nouveau: Fix deadlock with fb_helper with async RPM + requests + - drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in + connector_detect() + - drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early + - drm/vc4: Fix the "no scaling" case on multi-planar YUV formats + - drm: udl: Destroy framebuffer only if it was initialized + - drm/amdgpu: add new polaris pci id + - tty: vt_ioctl: fix potential Spectre v1 + - ext4: check to make sure the rename(2)'s destination is not freed + - ext4: avoid divide by zero fault when deleting corrupted inline + directories + - ext4: avoid arithemetic overflow that can trigger a BUG + - ext4: recalucate superblock checksum after updating free blocks/inodes + - ext4: fix online resize's handling of a too-small final block group + - ext4: fix online resizing for bigalloc file systems with a 1k block size + - ext4: don't mark mmp buffer head dirty + - ext4: show test_dummy_encryption mount option in /proc/mounts + - ext4, dax: add ext4_bmap to ext4_dax_aops + - ext4, dax: set ext4_dax_aops for dax files + - sched/fair: Fix vruntime_normalized() for remote non-migration wakeup + - [x86] vmw_balloon: include asm/io.h + - iw_cxgb4: only allow 1 flush on user qps + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.12 + - tsl2550: fix lux1_input error in low light + - vmci: type promotion bug in qp_host_get_user_memory() + - [x86] numa_emulation: Fix emulated-to-physical node mapping + - staging: rts5208: fix missing error check on call to rtsx_write_register + - [armhf] power: supply: axp288_charger: Fix initial + constant_charge_current value + - [sh4] serial: sh-sci: Stop RX FIFO timer during port shutdown + - [arm64] power: vexpress: fix corruption in notifier registration + - [x86] iommu/amd: make sure TLB to be flushed before IOVA freed + - Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 + - USB: serial: kobil_sct: fix modem-status error handling + - 6lowpan: iphc: reset mac_header after decompress to fix panic + - [s390x] mm: correct allocate_pgste proc_handler callback + - power: remove possible deadlock when unregistering power_supply + - cxgb4: Fix the condition to check if the card is T5 + - RDMA/bnxt_re: Fix a couple off by one bugs + - RDMA/i40w: Hold read semaphore while looking after VMA + - RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c + - IB/core: type promotion bug in rdma_rw_init_one_mr() + - IB/mlx4: Test port number before querying type. + - vhost_net: Avoid tx vring kicks during busyloop + - IB/mlx5: Fix GRE flow specification + - include/rdma/opa_addr.h: Fix an endianness issue + - x86/tsc: Add missing header to tsc_msr.c + - ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled + - [x86] entry/64: Add two more instruction suffixes + - scsi: target/iscsi: Make iscsit_ta_authentication() respect the output + buffer size + - scsi: klist: Make it safe to use klists in atomic context + - [powerpc*] scsi: ibmvscsi: Improve strings handling + - scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion + - usb: wusbcore: security: cast sizeof to int for comparison + - ath10k: sdio: use same endpoint id for all packets in a bundle + - ath10k: sdio: set skb len for all rx packets + - [powerpc*] powerpc/powernv/ioda2: Reduce upper limit for DMA window size + - [x86] platform/x86: asus-wireless: Fix uninitialized symbol usage + - [x86] ACPI / button: increment wakeup count only when notified + - alarmtimer: Prevent overflow for relative nanosleep (CVE-2018-13053) + - [s390x] s390/dasd: correct numa_node in dasd_alloc_queue + - [s390x] s390/scm_blk: correct numa_node in scm_blk_dev_setup + - posix-timers: Make forward callback return s64 + - posix-timers: Sanitize overrun handling (CVE-2018-12896) + - [powerpc*] ALSA: snd-aoa: add of_node_put() in error path + - ath10k: use locked skb_dequeue for rx completions + - [armhf] media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial + data + - staging: android: ashmem: Fix mmap size validation + - staging: mt7621-eth: Fix memory leak in mtk_add_mac() error path + - [powerpc*, x86, alpha, m68k, hppa] drivers/tty: add error handling for + pcmcia_loop_config + - [arm64] dts: renesas: salvator-common: Fix adv7482 decimal unit addresses + - [x86] media: tm6000: add error handling for dvb_register_adapter + - [powerpc*, mips*, arm64, x86, alpha] ALSA: hda: Add AZX_DCAPS_PM_RUNTIME + for AMD Raven Ridge + - ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock + - [armhf] drm/sun4i: Enable DW HDMI PHY clock + - [armhf] drm/sun4i: Fix releasing node when enumerating enpoints + - ath10k: transmit queued frames after processing rx packets + - mt76x2: fix mrr idx/count estimation in mt76x2_mac_fill_tx_status() + - rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() + - brcmsmac: fix wrap around in conversion from constant to s16 + - bitfield: fix *_encode_bits() + - [arm64]wlcore: Add missing PM call for + wlcore_cmd_wait_for_event_or_timeout() + - [armhf] drm/omap: gem: Fix mm_list locking + - [armhf] mvebu: declare asm symbols as character arrays in pmsu.c + - RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR + - HID: hid-ntrig: add error handling for sysfs_create_group + - [x86] HID: i2c-hid: Use devm to allocate i2c_hid struct + - [arm64] dts: renesas: Fix VSPD registers range + - drm/v3d: Take a lock across GPU scheduler job creation and queuing. + - scsi: bnx2i: add error handling for ioremap_nocache + - [arm64] scsi: hisi_sas: Fix the conflict between dev gone and host reset + - [armhf] spi: orion: fix CS GPIO handling again + - scsi: megaraid_sas: Update controller info during resume + - [x86] ASoC: Intel: bytcr_rt5640: Fix Acer Iconia 8 over-current detect + threshold + - [x86] EDAC, i7core: Fix memleaks and use-after-free on probe and remove + - [x86, arm64, armhf] ASoC: dapm: Fix potential DAI widget pointer deref + when linking DAIs + - module: exclude SHN_UNDEF symbols from kallsyms api + - nfsd: fix corrupted reply to badly ordered compound + - [mips*, arm64, x86] EDAC: Fix memleak in module init error path + - ath10k: fix incorrect size of dma_free_coherent in + ath10k_ce_alloc_src_ring_64 + - ath10k: snoc: use correct bus-specific pointer in RX retry + - fs/lock: skip lock owner pid translation in case we are in init_pid_ns + - ath10k: fix memory leak of tpc_stats + - Input: xen-kbdfront - fix multi-touch XenStore node's locations + - drm/vc4: Add missing formats to vc4_format_mod_supported(). + - [armhf] ARM: dts: dra7: fix DCAN node addresses + - drm/vc4: plane: Expand the lower bits by repeating the higher bits + - block: fix deadline elevator drain for zoned block devices + - [x86] mm: Expand static page table for fixmap space + - [armhf] serial: imx: restore handshaking irq for imx1 + - [arm64] serial: mvebu-uart: Fix reporting of effective CSIZE to userspace + - [x86] intel_th: Fix device removal logic + - [x86] intel_th: Fix resource handling for ACPI glue layer + - spi: tegra20-slink: explicitly enable/disable clock + - [mips*, 'arm64', x86, armhf] regulator: fix crash caused by null driver + data + - [mips*, 'arm64', x86, armhf] regulator: Fix 'do-nothing' value for + regulators without suspend state + - USB: fix error handling in usb_driver_claim_interface() + - USB: handle NULL config in usb_find_alt_setting() + - usb: core: safely deal with the dynamic quirk lists + - [armhf] usb: musb: dsps: do not disable CPPI41 irq in driver teardown + - USB: usbdevfs: sanitize flags more + - USB: usbdevfs: restore warning for nonsensical flags + - Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in + service_outstanding_interrupt()" + - USB: remove LPM management from usb_driver_claim_interface() + - uaccess: Fix is_source param for check_copy_size() in + copy_to_iter_mcsafe() + - filesystem-dax: Fix use of zero page + - Input: elantech - enable middle button of touchpad on ThinkPad P72 + - IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop + - IB/hfi1: Fix SL array bounds check + - IB/hfi1: Invalid user input can result in crash + - IB/hfi1: Fix context recovery when PBC has an UnsupportedVL + - IB/hfi1: Fix destroy_qp hang after a link down + - [x86] ACPI / hotplug / PCI: Don't scan for non-hotplug bridges if slot + is not bridge + - RDMA/uverbs: Atomically flush and mark closed the comp event queue + - ARM: OMAP2+: Fix null hwmod for ti-sysc debug + - ARM: OMAP2+: Fix module address for modules using mpu_rt_idx + - bus: ti-sysc: Fix module register ioremap for larger offsets + - qed: Wait for ready indication before rereading the shmem + - qed: Wait for MCP halt and resume commands to take place + - qed: Prevent a possible deadlock during driver load and unload + - qed: Avoid sending mailbox commands when MFW is not responsive + - thermal: of-thermal: disable passive polling when thermal zone is disabled + - isofs: reject hardware sector size > 2048 bytes + - mmc: atmel-mci: fix bad logic of sg_copy_{from,to}_buffer conversion + - mmc: android-goldfish: fix bad logic of sg_copy_{from,to}_buffer + conversion + - bus: ti-sysc: Fix no_console_suspend handling + - [armhf] dts: omap4-droid4: fix vibrations on Droid 4 + - bpf, sockmap: fix sock_hash_alloc and reject zero-sized keys + - bpf, sockmap: fix sock hash count in alloc_sock_hash_elem + - tls: possible hang when do_tcp_sendpages hits sndbuf is full case + - bpf: sockmap: write_space events need to be passed to TCP handler + - drm/amdgpu: fix VM clearing for the root PD + - drm/amdgpu: fix preamble handling + - amdgpu: fix multi-process hang issue + - net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler + - tcp_bbr: add bbr_check_probe_rtt_done() helper + - tcp_bbr: in restart from idle, see if we should exit PROBE_RTT + - net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES + - net: hns: fix skb->truesize underestimation + - tools: bpftool: return from do_event_pipe() on bad arguments + - e1000: check on netif_running() before calling e1000_up() + - e1000: ensure to free old tx/rx rings in set_ringparam() + - ixgbe: fix driver behaviour after issuing VFLR + - i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled + - i40e: fix condition of WARN_ONCE for stat strings + - [arm64] crypto: cavium/nitrox - fix for command corruption in queue full + case with backlog submissions. + - hwmon: (ina2xx) fix sysfs shunt resistor read access + - hwmon: (adt7475) Make adt7475_read_word() return errors + - Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping" + - drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode + - drm/amdgpu: Update power state at the end of smu hw_init. + - ata: ftide010: Add a quirk for SQ201 + - nvme-fcloop: Fix dropped LS's to removed target port + - [armhf] dts: omap4-droid4: Fix emmc errors seen on some devices + - drm/amdgpu: Need to set moved to true when evict bo + - [arm64, armhf] smccc-1.1: Make return values unsigned long + - [arm64, armhf] smccc-1.1: Handle function result as parameters + - i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus + - clk: x86: Set default parent to 48Mhz + - [x86] pti: Fix section mismatch warning/error + - [powerpc*] KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM + workarounds + - [powerpc*] fix csum_ipv6_magic() on little endian platforms + - [powerpc*] pkeys: Fix reading of ibm, processor-storage-keys property + - [powerpc*] pseries: Fix unitialized timer reset on migration + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13 + - mac80211: Run TXQ teardown code before de-registering interfaces + - mac80211_hwsim: require at least one channel + - Btrfs: fix unexpected failure of nocow buffered writes after snapshotting + when low on space + - [powerpc*] KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate + function + - cfg80211: remove division by size of sizeof(struct ieee80211_wmm_rule) + - btrfs: btrfs_shrink_device should call commit transaction at the end + - scsi: csiostor: add a check for NULL pointer after kmalloc() + - scsi: csiostor: fix incorrect port capabilities + - scsi: libata: Add missing newline at end of file + - scsi: aacraid: fix a signedness bug + - bpf, sockmap: fix potential use after free in bpf_tcp_close + - bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg + - bpf: sockmap, decrement copied count correctly in redirect error case + - mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X + - mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X + - cfg80211: make wmm_rule part of the reg_rule structure + - mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom + - nl80211: Fix nla_put_u8 to u16 for NL80211_WMMR_TXOP + - nl80211: Pass center frequency in kHz instead of MHz + - bpf: fix several offset tests in bpf_msg_pull_data + - mac80211: mesh: fix HWMP sequence numbering to follow standard + - mac80211: avoid kernel panic when building AMSDU from non-linear SKB + - bpf: fix msg->data/data_end after sg shift repair in bpf_msg_pull_data + - bpf: fix shift upon scatterlist ring wrap-around in bpf_msg_pull_data + - bpf: fix sg shift repair start offset in bpf_msg_pull_data + - [arm64] net: hns: add the code for cleaning pkt in chip + - [arm64] net: hns: add netif_carrier_off before change speed and duplex + - [arm64, armhf] net: mvpp2: initialize port of_node pointer + - cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE + - mac80211: do not convert to A-MSDU if frag/subframe limited + - mac80211: always account for A-MSDU header changes + - Revert "blk-throttle: fix race between blkcg_bio_issue_check() and + cgroup_rmdir()" + - md/raid5-cache: disable reshape completely + - RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0 + - bpf: Fix bpf_msg_pull_data() + - bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP + - fs/cifs: don't translate SFM_SLASH (U+F026) to backslash + - mac80211: fix an off-by-one issue in A-MSDU max_subframe computation + - cfg80211: fix a type issue in ieee80211_chandef_to_operating_class() + - mac80211: fix WMM TXOP calculation + - mac80211: fix a race between restart and CSA flows + - mac80211: Fix station bandwidth setting after channel switch + - mac80211: don't Tx a deauth frame if the AP forbade Tx + - mac80211: shorten the IBSS debug messages + - [powerpc*] net/ibm/emac: wrong emac_calc_base call was used by typo + - ceph: avoid a use-after-free in ceph_destroy_options() + - firmware: arm_scmi: fix divide by zero when sustained_perf_level is zero + - afs: Fix cell specification to permit an empty address list + - mm: madvise(MADV_DODUMP): allow hugetlbfs pages + - bpf: 32-bit RSH verification must truncate input before the ALU op + (CVE-2018-18445) + - netfilter: xt_cluster: add dependency on conntrack module + - [x86] HID: intel-ish-hid: Enable Sunrise Point-H ish driver + - HID: add support for Apple Magic Keyboards + - HID: hid-saitek: Add device ID for RAT 7 Contagion + - scsi: iscsi: target: Set conn->sess to NULL when + iscsi_login_set_conn_values fails + - scsi: iscsi: target: Fix conn_ops double free + - perf annotate: Properly interpret indirect call + - perf evsel: Fix potential null pointer dereference in + perf_evsel__new_idx() + - perf util: Fix bad memory access in trace info. + - [powerpc*] perf probe: Ignore SyS symbols irrespective of endianness + - [arm64] perf annotate: Fix parsing aarch64 branch instructions after + objdump update + - netfilter: nf_tables: release chain in flushing set + - HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub + report + - USB: yurex: Check for truncation in yurex_read() + - nvmet-rdma: fix possible bogus dereference under heavy load + - net/mlx5: Consider PCI domain in search for next dev + - [x86] HID: i2c-hid: Don't reset device upon system resume + - dm raid: fix reshape race on small devices + - drm/nouveau: fix oops in client init failure path + - drm/nouveau/mmu: don't attempt to dereference vmm without valid instance + pointer + - drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS + - drm/nouveau/disp: fix DP disable race + - drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for + LVDS/eDP panels + - dm raid: fix stripe adding reshape deadlock + - dm raid: fix rebuild of specific devices by updating superblock + - dm raid: fix RAID leg rebuild errors + - r8169: set TxConfig register after TX / RX is enabled, just like RxConfig + - fs/cifs: suppress a string overflow warning + - net: ena: fix surprise unplug NULL dereference kernel crash + - net: ena: fix driver when PAGE_SIZE == 64kB + - net: ena: fix device destruction to gracefully free resources + - net: ena: fix potential double ena_destroy_device() + - net: ena: fix missing lock during device destruction + - net: ena: fix missing calls to READ_ONCE + - sched/topology: Set correct NUMA topology type + - dm thin metadata: try to avoid ever aborting transactions + - netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for + NF_REPEAT + - netfilter: xt_hashlimit: use s->file instead of s->private + - drm/amdgpu: Fix SDMA hang in prt mode v2 + - drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk + - r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED + - [s390x] qeth: use vzalloc for QUERY OAT buffer + - [s390x] qeth: don't dump past end of unknown HW header + - cifs: read overflow in is_valid_oplock_break() + - asm-generic: io: Fix ioport_map() for !CONFIG_GENERIC_IOMAP && + CONFIG_INDIRECT_PIO + - xen/manage: don't complain about an empty value in control/sysrq node + - [mips*, x86, s390x] xen: avoid crash in disable_hotplug_cpu + - new primitive: discard_new_inode() + - vfs: don't evict uninitialized inode + - ovl: set I_CREATING on inode being created + - ovl: fix access beyond unterminated strings + - ovl: fix memory leak on unlink of indexed file + - ovl: fix format of setxattr debug + - sysfs: Do not return POSIX ACL xattrs via listxattr + - b43: fix DMA error related regression with proprietary firmware + - firmware: Fix security issue with request_firmware_into_buf() + - firmware: Always initialize the fw_priv list object + - smb2: fix missing files in root share directory listing + - [x86] iommu/amd: Clear memory encryption mask from physical address + - ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 + - [x86] crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe() + - crypto: chelsio - Fix memory corruption in DMA Mapped buffers. + - [arm64, armhf, x86, powerpc*] gpiolib: Free the last requested descriptor + - [x86] Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect() + - proc: restrict kernel stack dumps to root (CVE-2018-17972) + - ocfs2: fix locking for res->tracking and dlm->tracking_list + - [x86] HID: i2c-hid: disable runtime PM operations on hantick touchpad + - ixgbe: check return value of napi_complete_done() + - dm thin metadata: fix __udivdi3 undefined on 32-bit + - Revert "drm/amd/pp: Send khz clock values to DC for smu7/8" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.14 + - perf/core: Add sanity check to deal with pinned event failure + - mm: migration: fix migration of huge PMD shared pages + - mm, thp: fix mlocking THP page with migration enabled + - mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly + - [x86] KVM: fix L1TF's MMIO GFN calculation + - [x86] KVM: VMX: check for existence of secondary exec controls before + accessing + - blk-mq: I/O and timer unplugs are inverted in blktrace + - [powerpc*, mips*, arm64, x86, alpha, armhf] mmc: core: Fix debounce time + to use microseconds + - [powerpc*, mips*, arm64, x86, alpha, armhf] mmc: slot-gpio: Fix debounce + time to use miliseconds again + - mac80211: allocate TXQs for active monitor interfaces + - drm/amdgpu: Fix vce work queue was not cancelled when suspend + - [x86] vdso: Fix asm constraints on vDSO syscall fallbacks + - [x86] vdso: Only enable vDSO retpolines when enabled and supported + - [x86] vdso: Fix vDSO syscall fallback asm constraint regression + - [powerpc*, mips*, arm64, x86, s390x, armhf, sparc, hppa] PCI: Reprogram + bridge prefetch registers on resume + - mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys + - dm mpath: fix attached_handler_name leak and dangling hw_handler_name + pointer + - dm cache metadata: ignore hints array being too small during resize + - dm cache: fix resize crash if user doesn't reload cache table + - USB: serial: simple: add Motorola Tetra MTP6550 id + - USB: serial: option: improve Quectel EP06 detection + - USB: serial: option: add two-endpoints device-id flag + - usb: cdc_acm: Do not leak URB buffers + - tty: Drop tty->count on tty_reopen() failure + - [powerpc*] Avoid code patching freed init sections + - [powerpc*] lib: fix book3s/32 boot failure due to code patching + - f2fs: fix invalid memory access + - tipc: call start and done ops directly in __tipc_nl_compat_dumpit() + - ubifs: Check for name being NULL while mounting + - rds: rds_ib_recv_alloc_cache() should call alloc_percpu_gfp() instead + - ath10k: fix scan crash due to incorrect length calculation + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.15 + - bnxt_en: Fix TX timeout during netpoll. + - bnxt_en: free hwrm resources, if driver probe fails. + - bonding: avoid possible dead-lock + - ip6_tunnel: be careful when accessing the inner header + - ip_tunnel: be careful when accessing the inner header + - ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() + - ipv6: take rcu lock in rawv6_send_hdrinc() + - [armhf] net: dsa: bcm_sf2: Call setup during switch resume + - [arm64] net: hns: fix for unmapping problem when SMMU is on + - net: ipv4: update fnhe_pmtu when first hop's MTU changes + - net/ipv6: Display all addresses in output of /proc/net/if_inet6 + - netlabel: check for IPV4MASK in addrinfo_get + - [armhf,arm64] net: mvpp2: Extract the correct ethtype from the skb for + tx csum offload + - [armhf,arm64] net: mvpp2: fix a txq_done race condition + - net: sched: Add policy validation for tc attributes + - net: sched: cls_u32: fix hnode refcounting + - net/usb: cancel pending work when unbinding smsc75xx + - qlcnic: fix Tx descriptor corruption on 82xx devices + - qmi_wwan: Added support for Gemalto's Cinterion ALASxx WWAN interface + - rtnetlink: fix rtnl_fdb_dump() for ndmsg header + - rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096 + - sctp: update dst pmtu with the correct daddr + - team: Forbid enslaving team device to itself + - tipc: fix flow control accounting for implicit connect + - udp: Unbreak modules that rely on external __skb_recv_udp() availability + - tun: remove unused parameters + - tun: initialize napi_mutex unconditionally + - tun: napi flags belong to tfile + - [armhf,arm64] net: stmmac: Fixup the tail addr setting in xmit path + - net/packet: fix packet drop as of virtio gso + - [armhf] net: dsa: bcm_sf2: Fix unbind ordering + - net/mlx5e: Set vlan masks for all offloaded TC rules + - net: aquantia: memory corruption on jumbo frames + - net/mlx5: E-Switch, Fix out of bound access when setting vport rate + - bonding: pass link-local packets to bonding master also. + - bonding: fix warning message + - [armhf,arm64] net: stmmac: Rework coalesce timer and fix multi-queue + races + - nfp: avoid soft lockups under control message storm + - bnxt_en: don't try to offload VLAN 'modify' action + - net-ethtool: ETHTOOL_GUFO did not and should not require CAP_NET_ADMIN + - net: phy: phylink: fix SFP interface autodetection + - sfp: fix oops with ethtool -m + - tcp/dccp: fix lockdep issue when SYN is backlogged + - inet: make sure to grab rcu_read_lock before using ireq->ireq_opt + - [armhf] net: dsa: b53: Keep CPU port as tagged in all VLANs + - rtnetlink: Fail dump if target netnsid is invalid + - bnxt_en: Fix VNIC reservations on the PF. + - net: ipv4: don't let PMTU updates increase route MTU + - net/mlx5: Check for SQ and not RQ state when modifying hairpin SQ + - bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request + - bnxt_en: get the reduced max_irqs by the ones used by RDMA + - net/ipv6: Remove extra call to ip6_convert_metrics for multipath case + - net/ipv6: stop leaking percpu memory in fib6 info + - qed: Fix shmem structure inconsistency between driver and the mfw. + - r8169: fix network stalls due to missing bit TXCFG_AUTO_FIFO + - r8169: set RX_MULTI_EN bit in RxConfig for 8168F-family chips + - vxlan: fill ttl inherit info + - ASoC: dapm: Fix NULL pointer deference on CODEC to CODEC DAIs + - hwmon: (nct6775) Fix access to fan pulse registers + - [x86] ASoC: AMD: Ensure reset bit is cleared before configuring + - Bluetooth: SMP: Fix trying to use non-existent local OOB data + - Bluetooth: Use correct tfm to generate OOB data + - Bluetooth: hci_ldisc: Free rw_semaphore on close + - [armhf] mfd: omap-usb-host: Fix dts probe of children + - [powerpc*] KVM: Book3S HV: Don't use compound_order to determine host + mapping size + - scsi: iscsi: target: Don't use stack buffer for scatterlist + - scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted() + - sound: enable interrupt after dma buffer initialization + - sound: don't call skl_init_chip() to reset intel skl soc + - bpf: btf: Fix end boundary calculation for type section + - bpf: use __GFP_COMP while allocating page + - hwmon: (nct6775) Fix virtual temperature sources for NCT6796D + - hwmon: (nct6775) Fix RPM output for fan7 on NCT6796D + - [armhf,arm64] stmmac: fix valid numbers of unicast filter entries + - hwmon: (nct6775) Use different register to get fan RPM for fan7 + - [x86] PCI: hv: support reporting serial number as slot information + - [x86] clk: add "ether_clk" alias for Bay Trail / Cherry Trail + - [x86] clk: Stop marking clocks as CLK_IS_CRITICAL + - [x86] pinctrl: cannonlake: Fix gpio base for GPP-E + - [x86] kvm/lapic: always disable MMIO interface in x2APIC mode + - drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 + - drm/amdkfd: Change the control stack MTYPE from UC to NC on GFX9 + - drm/amdkfd: Fix ATS capablity was not reported correctly on some APUs + - mm/vmstat.c: fix outdated vmstat_text + - afs: Fix afs_server struct leak + - afs: Fix clearance of reply + - [mips*] Fix CONFIG_CMDLINE handling + - [mips*] VDSO: Always map near top of user memory + - [sparc64] mach64: detect the dot clock divider correctly on sparc + - vsprintf: Fix off-by-one bug in bstr_printf() processing dereferenced + pointers + - percpu: stop leaking bitmap metadata blocks + - perf script python: Fix export-to-postgresql.py occasional failure + - perf script python: Fix export-to-sqlite.py sample columns + - [s390x] cio: Fix how vfio-ccw checks pinned pages + - dm cache: destroy migration_cache if cache target registration failed + - dm: fix report zone remapping to account for partition offset + - dm linear: eliminate linear_end_io call if CONFIG_DM_ZONED disabled + - dm linear: fix linear_end_io conditional definition + - cgroup: Fix dom_cgrp propagation when enabling threaded mode + - drm/nouveau/drm/nouveau: Grab runtime PM ref in nv50_mstc_detect() + - mmc: block: avoid multiblock reads for the last sector in SPI mode + - [armhf] pinctrl: mcp23s08: fix irq and irqchip setup order + - [arm64] perf: Reject stand-alone CHAIN events for PMUv3 + - mm/mmap.c: don't clobber partially overlapping VMA with + MAP_FIXED_NOREPLACE + - mm/thp: fix call to mmu_notifier in set_pmd_migration_entry() v2 + - filesystem-dax: Fix dax_layout_busy_page() livelock + - mm: Preserve _PAGE_DEVMAP across mprotect() calls + - [x86] i2c: i2c-scmi: fix for i2c_smbus_write_block_data + - [powerpc*] KVM: Book3S HV: Avoid crash from THP collapse during radix + page fault + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16 + - media: af9035: prevent buffer overflow on write + - spi: gpio: Fix copy-and-paste error + - batman-adv: Avoid probe ELP information leak + - batman-adv: Fix segfault when writing to throughput_override + - batman-adv: Fix segfault when writing to sysfs elp_interval + - batman-adv: Prevent duplicated gateway_node entry + - batman-adv: Prevent duplicated nc_node entry + - batman-adv: Prevent duplicated softif_vlan entry + - batman-adv: Prevent duplicated global TT entry + - batman-adv: Prevent duplicated tvlv handler + - batman-adv: fix backbone_gw refcount on queue_work() failure + - batman-adv: fix hardif_neigh refcount on queue_work() failure + - cxgb4: fix abort_req_rss6 struct + - [armhf] clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag + for non-am43 SoCs + - [powerpc*] scsi: ibmvscsis: Fix a stringop-overflow warning + - [powerpc*] scsi: ibmvscsis: Ensure partition name is properly NUL + terminated + - [x86] intel_th: pci: Add Ice Lake PCH support + - [m68k] Input: atakbd - fix Atari keymap + - [m68k] Input: atakbd - fix Atari CapsLock behaviour + - [powerpc*] net: emac: fix fixed-link setup for the RTL8363SB switch + - qed: Fix populating the invalid stag value in multi function mode. + - qed: Do not add VLAN 0 tag to untagged frames in multi-function mode. + - [armhf,arm64] PCI: dwc: Fix scheduling while atomic issues + - RDMA/uverbs: Fix validity check for modify QP + - scsi: lpfc: Synchronize access to remoteport via rport + - [arm64] drm: mali-dp: Call drm_crtc_vblank_reset on device init + - scsi: ipr: System hung while dlpar adding primary ipr adapter back + - scsi: sd: don't crash the host on invalid commands + - bpf: sockmap only allow ESTABLISHED sock state + - bpf: sockmap, fix transition through disconnect without close + - bpf: test_maps, only support ESTABLISHED socks + - net/mlx4: Use cpumask_available for eq->affinity_mask + - clocksource/drivers/fttmr010: Fix set_next_event handler + - RDMA/bnxt_re: Fix system crash during RDMA resource initialization + - [armhf,arm64] iommu/rockchip: Free irqs in shutdown handler + - [x86] pinctrl/amd: poll InterruptEnable bits in amd_gpio_irq_set_type + - [powerpc*] tm: Fix userspace r13 corruption + - [powerpc*] tm: Avoid possible userspace r1 corruption on reclaim + - [powerpc*] numa: Use associativity if VPHN hcall is successful + - [x86] iommu/amd: Return devid as alias for ACPI HID devices + - [x86] boot: Fix kexec booting failure in the SEV bit detection code + - Revert "vfs: fix freeze protection in mnt_want_write_file() for + overlayfs" + - mremap: properly flush TLB before releasing the page + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.17 + - xfrm: Validate address prefix lengths in the xfrm selector. + - xfrm6: call kfree_skb when skb is toobig + - xfrm: reset transport header back to network header after all input + transforms ahave been applied + - xfrm: reset crypto_done when iterating over multiple input xfrms + - mac80211: Always report TX status + - cfg80211: reg: Init wiphy_idx in regulatory_hint_core() + - mac80211: fix pending queue hang due to TX_DROP + - cfg80211: Address some corner cases in scan result channel updating + - mac80211: TDLS: fix skb queue/priority assignment + - mac80211: fix TX status reporting for ieee80211s + - xfrm: Fix NULL pointer dereference when skb_dst_force clears the + dst_entry. + - [armel,armhf] 8799/1: mm: fix pci_ioremap_io() offset check + - xfrm: validate template mode + - netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev + - netfilter: conntrack: get rid of double sizeof + - [arm64] hugetlb: Fix handling of young ptes + - nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT + - mac80211_hwsim: fix locking when iterating radios during ns exit + - mac80211_hwsim: fix race in radio destruction from netlink notifier + - mac80211_hwsim: do not omit multicast announce of first added radio + - Bluetooth: SMP: fix crash in unpairing + - qed: Avoid implicit enum conversion in qed_set_tunn_cls_info + - qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv + - qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor + - qed: Avoid constant logical operation warning in qed_vf_pf_acquire + - qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt + - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds + - scsi: qedi: Initialize the stats mutex lock + - rxrpc: Fix checks as to whether we should set up a new call + - rxrpc: Fix RTT gathering + - rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket + - rxrpc: Fix error distribution + - netfilter: nft_set_rbtree: add missing rb_erase() in GC routine + - netfilter: avoid erronous array bounds warning + - asix: Check for supported Wake-on-LAN modes + - ax88179_178a: Check for supported Wake-on-LAN modes + - lan78xx: Check for supported Wake-on-LAN modes + - sr9800: Check for supported Wake-on-LAN modes + - r8152: Check for supported Wake-on-LAN Modes + - smsc75xx: Check for Wake-on-LAN modes + - smsc95xx: Check for Wake-on-LAN modes + - cfg80211: fix use-after-free in reg_process_hint() + - [x86] KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled + - [x86] KVM: Do not use kvm_x86_ops->mpx_supported() directly + - [x86] KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS + - perf/core: Fix perf_pmu_unregister() locking + - [x86] perf/intel/uncore: Use boot_cpu_data.phys_proc_id instead of + hardcorded physical package ID 0 + - perf/ring_buffer: Prevent concurent ring buffer access + - [x86] perf/intel/uncore: Fix PCI BDF address of M3UPI on SKX + - [x86] perf/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf + events + - thunderbolt: Do not handle ICM events after domain is stopped + - thunderbolt: Initialize after IOMMUs + - Revert "serial: 8250_dw: Fix runtime PM handling" + - locking/ww_mutex: Fix runtime warning in the WW mutex selftest + - drm/amd/display: Signal hw_done() after waiting for flip_done() + - be2net: don't flip hw_features when VXLANs are added/deleted + - [powerpc*] numa: Skip onlining a offline node in kdump path + - net: cxgb3_main: fix a missing-check bug + - yam: fix a missing-check bug + - ocfs2: fix crash in ocfs2_duplicate_clusters_by_page() + - mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl + - mm/migrate.c: split only transparent huge pages when allocation fails + - [x86] paravirt: Fix some warning messages + - [arm64] clk: mvebu: armada-37xx-periph: Remove unused var num_parents + - libertas: call into generic suspend code before turning off power + - perf report: Don't try to map ip to invalid map + - HID: i2c-hid: Remove RESEND_REPORT_DESCR quirk and its handling + - [armhf] dts: imx53-qsb: disable 1.2GHz OPP + - perf record: Use unmapped IP for inline callchain cursors + - rxrpc: Don't check RXRPC_CALL_TX_LAST after calling + rxrpc_rotate_tx_window() + - rxrpc: Carry call state out of locked section in rxrpc_rotate_tx_window() + - rxrpc: Only take the rwind and mtu values from latest ACK + - rxrpc: Fix connection-level abort handling + - [x86] net: ena: fix warning in rmmod caused by double iounmap + - [x86] net: ena: fix rare bug when failed restart/resume is followed by + driver removal + - [x86] net: ena: fix NULL dereference due to untimely napi initialization + - gpio: Assign gpio_irq_chip::parents to non-stack pointer + - IB/mlx5: Unmap DMA addr from HCA before IOMMU + - rds: RDS (tcp) hangs on sendto() to unresponding address + - afs: Fix cell proc list + - fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() + - Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing" + - bridge: do not add port to router list when receives query with source + 0.0.0.0 + - ipv6: mcast: fix a use-after-free in inet6_mc_check + - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are + called + - ipv6: rate-limit probes for neighbourless routes + - llc: set SOCK_RCU_FREE in llc_sap_add_socket() + - net: fec: don't dump RX FIFO register when not available + - net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs + - net/mlx5e: fix csum adjustments caused by RXFCS + - net: sched: gred: pass the right attribute to gred_change_table_def() + - net: socket: fix a missing-check bug + - [armhf,arm64] net: stmmac: Fix stmmac_mdio_reset() when building stmmac + as modules + - net: udp: fix handling of CHECKSUM_COMPLETE packets + - r8169: fix NAPI handling under high load + - rtnetlink: Disallow FDB configuration for non-Ethernet device + - sctp: fix race on sctp_id2asoc + - tipc: fix unsafe rcu locking when accessing publication list + - udp6: fix encap return code for resubmitting + - vhost: Fix Spectre V1 vulnerability + - virtio_net: avoid using netif_tx_disable() for serializing tx routine + - ethtool: fix a privilege escalation bug + - bonding: fix length of actor system + - ip6_tunnel: Fix encapsulation layout + - openvswitch: Fix push/pop ethernet validation + - net: ipmr: fix unresolved entry dumps + - net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type + - net: sched: Fix for duplicate class dump + - net/sched: cls_api: add missing validation of netlink attributes + - net/ipv6: Allow onlink routes to have a device mismatch if it is the + default route + - sctp: fix the data size calculation in sctp_data_size + - sctp: not free the new asoc when sctp_wait_for_connect returns err + - net/mlx5: Fix memory leak when setting fpga ipsec caps + - net: bpfilter: use get_pid_task instead of pid_task + - net: drop skb on failure in ip_check_defrag() + - net: fix pskb_trim_rcsum_slow() with odd trim offset + - net/mlx5: WQ, fixes for fragmented WQ buffers API + - [sparc64] Make corrupted user stacks more debuggable. + - [sparc64] Set %l4 properly on trap return after handling signals. + - [sparc64] Wire up compat getpeername and getsockname. + - [sparc64] Fix single-pcr perf event counter management. + - [sparc64] Fix syscall fallback bugs in VDSO. + - [sparc64] Throttle perf events properly. + - net: bridge: remove ipv6 zero address check in mcast queries + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.18 + - vfs: swap names of {do,vfs}_clone_file_range() + - bpf: fix partial copy of map_ptr when dst is scalar + - [armhf,arm64] clk: sunxi-ng: sun4i: Set VCO and PLL bias current to + lowest setting + - fscache: Fix incomplete initialisation of inline key space + - cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) + - fscache: Fix out of bound read in long cookie keys + - ptp: fix Spectre v1 vulnerability + - drm/edid: VSDB yCBCr420 Deep Color mode bit definitions + - drm: fb-helper: Reject all pixel format changing requests + - RDMA/ucma: Fix Spectre v1 vulnerability (CVE-2017-5753) + - IB/ucm: Fix Spectre v1 vulnerability (CVE-2017-5753) + - cdc-acm: do not reset notification buffer index upon urb unlinking + - cdc-acm: correct counting of UART states in serial state notification + - cdc-acm: fix race between reset and control messaging + - usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() + - usb: gadget: storage: Fix Spectre v1 vulnerability + - usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable + - usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms + - USB: fix the usbfs flag sanitization for control transfers + - tracing: Fix synthetic event to accept unsigned modifier + - tracing: Fix synthetic event to allow semicolon at end + - [armhf] drm/sun4i: Fix an ulong overflow in the dotclock driver + - sched/fair: Fix throttle_list starvation with low CFS quota + - [x86] tsc: Force inlining of cyc2ns bits + - [x86] hibernate: Fix nosave_regions setup for hibernation + - [x86] percpu: Fix this_cpu_read() + - [x86] time: Correct the attribute on jiffies' definition + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19 + - [armhf] mtd: rawnand: marvell: fix the IRQ handler complete() condition + - spi: spi-mem: Adjust op len based on message/transfer size limitations + - bcache: trace missed reading by cache_missed + - bcache: correct dirty data statistics + - bcache: fix miss key refill->end in writeback + - hwmon: (pmbus) Fix page count auto-detection. + - jffs2: free jffs2_sb_info through jffs2_kill_sb() + - block: setup bounce bio_sets properly + - block: don't deal with discard limit in blkdev_issue_discard() + - block: make sure discard bio is aligned with logical block size + - block: make sure writesame bio is aligned with logical block size + - cpufreq: conservative: Take limits changes into account properly + - dma-mapping: fix panic caused by passing empty cma command line argument + - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges + - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer() + - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended + opcodes + - [x86] kprobes: Use preempt_enable() in optimized_callback() + - ipmi: Fix timer race with module unload + - acpi, nfit: Fix Address Range Scrub completion tracking + - [hppa] Fix address in HPMC IVA + - [hppa] Fix map_pages() to not overwrite existing pte entries + - [hppa] Fix exported address of os_hpmc handler + - [x86] ALSA: hda - Add quirk for ASUS G751 laptop + - [x86] ALSA: hda - Fix headphone pin config for ASUS G751 + - [x86] ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo + M715 + - [x86] ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) + - ALSA: hda: Add 2 more models to the power_save blacklist + - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops + - [x86] speculation: Enable cross-hyperthread spectre v2 STIBP mitigation + (CVE-2017-5715) + - [x86] xen: Fix boot loader version reported for PVH guests + - [x86] corruption-check: Fix panic in memory_corruption_check() when boot + option without value is provided + - [x86] mm/pat: Disable preemption around __flush_tlb_all() + - [x86] speculation: Support Enhanced IBRS on future CPUs (CVE-2017-5715) + - [armhf] dts: exynos: Disable pull control for MAX8997 interrupts on + Origen + - drm: fix use of freed memory in drm_mode_setcrtc + - bpf: do not blindly change rlimit in reuseport net selftest + - nvme: remove ns sibling before clearing path + - Revert "perf tools: Fix PMU term format max value calculation" + - xsk: do not call synchronize_net() under RCU read lock + - xfrm: policy: use hlist rcu variants on insert + - [x86] perf vendor events intel: Fix wrong filter_band* values for uncore + events + - r8169: Enable MSI-X on RTL8106e + - nfp: flower: fix pedit set actions for multiple partial masks + - nfp: flower: use offsets provided by pedit instead of index for ipv6 + - sched/fair: Fix the min_vruntime update logic in dequeue_entity() + - perf evsel: Store ids for events with their own cpus + perf_event__synthesize_event_update_cpus + - perf tools: Fix use of alternatives to find JDIR + - perf cpu_map: Align cpu map synthesized events properly. + - perf report: Don't crash on invalid inline debug information + - [x86] fpu: Remove second definition of fpu in __fpu__restore_sig() + - net: qla3xxx: Remove overflowing shift statement + - r8169: re-enable MSI-X on RTL8168g + - drm: Get ref on CRTC commit object when waiting for flip_done + - [arm64] net: socionext: Reset tx queue in ndo_stop + - netfilter: xt_nat: fix DNAT target for shifted portmap ranges + - [m68k] ataflop: fix error handling during setup + - [m68k] swim: fix cleanup on setup error + - [arm64] cpufeature: ctr: Fix cpu capability check for late CPUs + - nfp: devlink port split support for 1x100G CXP NIC + - tun: Consistently configure generic netdev params via rtnetlink + - [s390x] sthyi: Fix machine name validity indication + - hwmon: (pwm-fan) Set fan speed to 0 on suspend + - lightnvm: pblk: fix race on sysfs line state + - lightnvm: pblk: fix two sleep-in-atomic-context bugs + - lightnvm: pblk: fix race condition on metadata I/O + - perf tools: Free temporary 'sys' string in read_event_files() + - perf tools: Cleanup trace-event-info 'tdata' leak + - perf strbuf: Match va_{add,copy} with va_end + - [x86] cpupower: Fix coredump on VMWare + - bcache: Populate writeback_rate_minimum attribute + - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 + - sdhci: acpi: add free_slot callback + - iwlwifi: pcie: avoid empty free RB queue + - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface + - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI + - [i386] olpc: Indicate that legacy PC XO-1 platform should not register + RTC + - ACPI/PPTT: Handle architecturally unknown cache types + - ACPI / PM: LPIT: Register sysfs attributes based on FADT + - ACPI / processor: Fix the return value of acpi_processor_ids_walk() + - cpufreq: dt: Try freeing static OPPs only if we have added them + - [x86] intel_rdt: Show missing resctrl mount options + - [arm64] signal: Introduce COMPAT_SIGMINSTKSZ for use in + compat_sys_sigaltstack + - [arm64] net: hns3: Fix for packet buffer setting bug + - [x86] boot: Fix EFI stub alignment + - [arm64] net: hns3: Add nic state check before calling netif_tx_wake_queue + - [arm64] net: hns3: Fix ets validate issue + - [armhf,arm64] pinctrl: sunxi: fix 'pctrl->functions' allocation in + sunxi_pinctrl_build_state + - [arm64] pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux + - brcmfmac: fix for proper support of 160MHz bandwidth + - [arm64] net: hns3: Check hdev state when getting link status + - [arm64] net: hns3: Set STATE_DOWN bit of hdev state when stopping net + - net: phy: phylink: ensure the carrier is off when starting phylink + - block, bfq: correctly charge and reset entity service in all cases + - [arm64] entry: Allow handling of undefined instructions from EL1 + - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() + - spi: gpio: No MISO does not imply no RX + - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers + - [arm64] pinctrl: qcom: spmi-mpp: Fix drive strength setting + - bpf/verifier: fix verifier instability + - failover: Add missing check to validate 'slave_dev' in + net_failover_slave_unregister + - perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo + - [arm64] pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant + - [arm64] pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant + - [arm64] net: hns3: Preserve vlan 0 in hardware table + - [arm64] net: hns3: Fix ping exited problem when doing lp selftest + - [arm64] net: hns3: Fix for vf vlan delete failed problem + - [armhf,arm64] net: dsa: mv88e6xxx: Fix writing to a PHY page. + - rsi: fix memory alignment issue in ARM32 platforms + - iwlwifi: mvm: fix BAR seq ctrl reporting + - ixgbe: disallow IPsec Tx offload when in SR-IOV mode + - ixgbevf: VF2VF TCP RSS + - ath10k: schedule hardware restart if WMI command times out + - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 + - cgroup, netclassid: add a preemption point to write_classid + - [armhf,arm64] net: stmmac: dwmac-sun8i: fix OF child-node lookup + - f2fs: fix to account IO correctly for cgroup writeback + - MD: Memory leak when flush bio size is zero + - md: fix memleak for mempool + - scsi: esp_scsi: Track residual for PIO transfers + - scsi: ufs: Schedule clk gating work on correct queue + - UAPI: ndctl: Fix g++-unsupported initialisation in headers + - [x86] KVM: nVMX: Clear reserved bits of #DB exit qualification + - scsi: megaraid_sas: fix a missing-check bug + - RDMA/core: Do not expose unsupported counters + - IB/ipoib: Clear IPCB before icmp_send + - usb: host: ohci-at91: fix request of irq for optional gpio + - usb: typec: tcpm: Report back negotiated PPS voltage and current + - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/ + deactivated + - f2fs: clear PageError on the read path + - [x86] Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask + - [x86] VMCI: Resource wildcard match fixed + - PCI / ACPI: Enable wake automatically for power managed bridges + - xprtrdma: Reset credit grant properly after a disconnect + - irqchip/pdc: Setup all edge interrupts as rising edge at GIC + - [armhf,arm64] usb: dwc2: fix a race with external vbus supply + - ext4: fix argument checking in EXT4_IOC_MOVE_EXT + - MD: fix invalid stored role for a disk + - nvmem: check the return value of nvmem_add_cells() + - xhci: Avoid USB autosuspend when resuming USB2 ports. + - f2fs: fix to recover inode's crtime during POR + - f2fs: fix to recover inode's i_flags during POR + - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice + - [armhf.arm64] usb: chipidea: Prevent unbalanced IRQ disable + - [x86] driver/dma/ioat: Call del_timer_sync() without holding prep_lock + - IB/mlx5: Allow transition of DCI QP to reset + - uio: ensure class is registered before devices + - scsi: lpfc: Correct soft lockup when running mds diagnostics + - scsi: lpfc: Correct race with abort on completion path + - f2fs: avoid sleeping under spin_lock + - f2fs: report error if quota off error during umount + - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid + namespace init + - IB/rxe: fix for duplicate request processing and ack psns + - ALSA: hda: Check the non-cached stream buffers more explicitly + - [x86] cpupower: Fix AMD Family 0x17 msr_pstate size + - Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()" + - f2fs: fix to recover cold bit of inode block during POR + - f2fs: fix to account IO correctly + - OPP: Free OPP table properly on performance state irregularities + - [armhf] dts: exynos: Add missing cooling device properties for CPUs + - [armhf] dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings + - [armhf] dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250 + - xen-swiotlb: use actually allocated size on check physical continuous + - tpm: Restore functionality to xen vtpm driver. + - xen/blkfront: avoid NULL blkfront_info dereference on device removal + - xen/balloon: Support xend-based toolstack + - xen: fix race in xen_qlock_wait() + - xen: make xen_qlock_wait() nestable + - xen/pvh: increase early stack size + - xen/pvh: don't try to unplug emulated devices + - libertas: don't set URB_ZERO_PACKET on IN USB transfer + - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten + - usb: typec: tcpm: Fix APDO PPS order checking to be based on voltage + - mt76: mt76x2: fix multi-interface beacon configuration + - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate() + - net/ipv4: defensive cipso option parsing + - libnvdimm: Hold reference on parent while scheduling async init + - libnvdimm, region: Fail badblocks listing for inactive regions + - libnvdimm, pmem: Fix badblocks population for 'raw' namespaces + - [x86] ASoC: intel: skylake: Add missing break in skl_tplg_get_token() + - IB/mlx5: Fix MR cache initialization + - IB/rxe: Revise the ib_wr_opcode enum + - jbd2: fix use after free in jbd2_log_do_checkpoint() + - gfs2_meta: ->mount() can get NULL dev_name + - ext4: fix EXT4_IOC_SWAP_BOOT + - ext4: initialize retries variable in ext4_da_write_inline_data_begin() + - ext4: fix setattr project check in fssetxattr ioctl + - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR + - ext4: fix use-after-free race in ext4_remount()'s error path + - selinux: fix mounting of cgroup2 under older policies + - HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452 + - HID: hiddev: fix potential Spectre v1 + - [x86] EDAC, amd64: Add Family 17h, models 10h-2fh support + - [x86] EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting + - [x86] EDAC, skx_edac: Fix logical channel intermediate decoding + - PCI/ASPM: Fix link_state teardown on device removal + - [x86] PCI: vmd: White list for fast interrupt handlers + - [powerpc*] signal/GenWQE: Fix sending of SIGKILL + - signal: Guard against negative signal numbers in copy_siginfo_from_user32 + - crypto: lrw - Fix out-of bounds access on counter overflow + - crypto: tcrypt - fix ghash-generic speed test + - [x86] crypto: aesni - don't use GFP_ATOMIC allocation if the request + doesn't cross a page in gcm + - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range() + - ima: fix showing large 'violations' or 'runtime_measurements_count' + - hugetlbfs: dirty pages as they are added to pagecache + - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly + - mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback + - [armhf,arm64] KVM: Ensure only THP is candidate for adjustment + - [arm64] KVM: Fix caching of host MDCR_EL2 value + - [armhf] w1: omap-hdq: fix missing bus unregister at removal + - smb3: allow stats which track session and share reconnects to be reset + - smb3: do not attempt cifs operation in smb3 query info error path + - smb3: on kerberos mount if server doesn't specify auth type use krb5 + - printk: Fix panic caused by passing log_buf_len to command line + - genirq: Fix race on spurious interrupt detection + - NFSv4.1: Fix the r/wsize checking + - nfs: Fix a missed page unlock after pg_doio() + - nfsd: correctly decrement odstate refcount in error path + - nfsd: Fix an Oops in free_session() + - lockd: fix access beyond unterminated strings in prints + - dm ioctl: harden copy_params()'s copy_from_user() from malicious users + - dm zoned: fix metadata block ref counting + - dm zoned: fix various dmz_get_mblock() issues + - media: ov7670: make "xclk" clock optional + - fsnotify: Fix busy inodes during unmount + - [powerpc*] msi: Fix compile error on mpc83xx + - [powerpc*] tm: Fix HFSCR bit for no suspend case + - [powerpc*] 4s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9 + - [mips*] memset: Fix CPU_DADDI_WORKAROUNDS `small_fixup' regression + - [mips*/octeon] fix out of bounds array access on CN68XX + - rtc: ds1307: fix ds1339 wakealarm support + - rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt' + - rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI + - [armhf] power: supply: twl4030-charger: fix OF sibling-node lookup + - [armhf,arm64] iommu/arm-smmu: Ensure that page-table updates are visible + before TLBI + - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD + - Revert "media: dvbsky: use just one mutex for serializing device R/W ops" + - media: cec: make cec_get_edid_spa_location() an inline function + - media: cec: integrate cec_validate_phys_addr() in cec-api.c + - xen: fix xen_qlock_wait() + - xen: remove size limit of privcmd-buf mapping interface + - xen-blkfront: fix kernel panic with negotiate_mq error path + - media: cec: add new tx/rx status bits to detect aborts/timeouts + - media: cec: fix the Signal Free Time calculation + - media: cec: forgot to cancel delayed work + - media: em28xx: use a default format if TRY_FMT fails + - media: tvp5150: avoid going past array on v4l2_querymenu() + - media: em28xx: fix input name for Terratec AV 350 + - media: em28xx: make v4l2-compliance happier by starting sequence on zero + - media: em28xx: fix handler for vidioc_s_input() + - media: media colorspaces*.rst: rename AdobeRGB to opRGB + - media: replace ADOBERGB by OPRGB + - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC + - [arm64] lse: remove -fcall-used-x0 flag + - [arm64] rpmsg: smd: fix memory leak on channel create + - Cramfs: fix abad comparison when wrap-arounds occur + - [armhf,arm64] soc/tegra: pmc: Fix child-node lookup + - tracing: Return -ENOENT if there is no target synthetic event + - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled + - btrfs: Handle owner mismatch gracefully when walking up tree + - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid + deadlock + - btrfs: fix error handling in free_log_tree + - btrfs: fix error handling in btrfs_dev_replace_start + - btrfs: Enhance btrfs_trim_fs function to handle error better + - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem + - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list + - btrfs: don't attempt to trim devices that don't support it + - btrfs: keep trim from interfering with transaction commits + - btrfs: wait on caching when putting the bg cache + - Btrfs: don't clean dirty pages during buffered writes + - btrfs: release metadata before running delayed refs + - btrfs: protect space cache inode alloc with GFP_NOFS + - btrfs: reset max_extent_size on clear in a bitmap + - btrfs: make sure we create all new block groups + - Btrfs: fix warning when replaying log after fsync of a tmpfile + - Btrfs: fix wrong dentries after fsync of file that got its parent + replaced + - btrfs: qgroup: Dirty all qgroups before rescan + - Btrfs: fix null pointer dereference on compressed write path error + - Btrfs: fix assertion on fsync of regular file when using no-holes feature + - Btrfs: fix deadlock when writing out free space caches + - btrfs: reset max_extent_size properly + - btrfs: set max_extent_size properly + - btrfs: don't use ctl->free_space for max_extent_size + - btrfs: only free reserved extent if we didn't insert it + - btrfs: fix insert_reserved error handling + - btrfs: don't run delayed_iputs in commit + - btrfs: move the dio_sem higher up the callchain + - Btrfs: fix use-after-free during inode eviction + - Btrfs: fix use-after-free when dumping free space + - net: sched: Remove TCA_OPTIONS from policy + - userns: also map extents in the reverse map to kernel IDs + - bpf: wait for running BPF programs when updating map-in-map + - MD: fix invalid stored role for a disk - try2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.20 + - [powerpc*] traps: restore recoverability of machine_check interrupts + - [powerpc*] 64/module: REL32 relocation range check + - [powerpc*] mm: Fix page table dump to work on Radix + - [powerpc*] mm: fix always true/false warning in slice.c + - drm/amd/display: fix bug of accessing invalid memory + - Input: wm97xx-ts - fix exit path + - [powerpc*] eeh: Fix possible null deref in eeh_dump_dev_log() + - tty: check name length in tty_find_polling_driver() + - tracing/kprobes: Check the probe on unloaded module correctly + - drm/amdgpu/powerplay: fix missing break in switch statements + - [powerpc*] nohash: fix undefined behaviour when testing page size support + - [powerpc*] mm: Don't report hugepage tables as memory leaks when using + kmemleak + - [armhf] drm/omap: fix memory barrier bug in DMM driver + - drm/amd/display: fix gamma not being applied + - [arm64] drm/hisilicon: hibmc: Do not carry error code in HiBMC + framebuffer pointer + - media: pci: cx23885: handle adding to list failure + - [mips*] kexec: Mark CPU offline before disabling local IRQ + - [powerpc*] memtrace: Remove memory in chunks + - [mips*] PCI: Call pcie_bus_configure_settings() to set MPS/MRRS + - media: tvp5150: fix width alignment during set_selection() + - drm/amdgpu: Fix SDMA TO after GPU reset v3 + - 9p locks: fix glock.client_id leak in do_lock + - udf: Prevent write-unsupported filesystem to be remounted read-write + - 9p: clear dangling pointers in p9stat_free + - cdrom: fix improper type cast, which can leat to information leak. + - ovl: fix error handling in ovl_verify_set_fh() + - ovl: check whiteout in ovl_create_over_whiteout() + - [sh4] serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout + - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters + - scsi: qla2xxx: Fix process response queue for ISP26XX and above + - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx + - scsi: qla2xxx: shutdown chip if reset fail + - scsi: qla2xxx: Fix duplicate switch database entries + - scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured + - fuse: Fix use-after-free in fuse_dev_do_read() + - fuse: Fix use-after-free in fuse_dev_do_write() + - fuse: fix blocked_waitq wakeup + - fuse: set FR_SENT while locked + - ovl: fix recursive oi->lock in ovl_link() + - scsi: qla2xxx: Fix re-using LoopID when handle is in use + - scsi: qla2xxx: Fix NVMe session hang on unload + - [arm64] clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL + - [arm64] clk: meson: axg: mark fdiv2 and fdiv3 as critical + - zram: close udev startup race condition as default groups + - [mips*el/loonsgon-3] Fix CPU UART irq delivery problem + - [mips*el/loongson-3] Fix BRIDGE irq delivery problem + - [armhf] clk: s2mps11: Fix matching when built as module and DT node + contains compatible + - [armhf,arm64] clk: sunxi-ng: h6: fix bus clocks' divider position + - [arm64] clk: rockchip: fix wrong mmc sample phase shift for rk3328 + - [armhf,arm64] clk: rockchip: Fix static checker warning in + rockchip_ddrclk_get_parent call + - libceph: bump CEPH_MSG_MAX_DATA_LEN + - Revert "ceph: fix dentry leak in splice_dentry()" + - thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs + - mach64: fix display corruption on big endian machines + - mach64: fix image corruption due to reading accelerator registers + - acpi/nfit, x86/mce: Handle only uncorrectable machine checks + - acpi/nfit, x86/mce: Validate a MCE's address before using it + - acpi, nfit: Fix ARS overflow continuation + - [arm64] reset: hisilicon: fix potential NULL pointer dereference + - vhost/scsi: truncate T10 PI iov_iter to prot_bytes + - scsi: qla2xxx: Initialize port speed to avoid setting lower speed + - SCSI: fix queue cleanup race before queue initialization is done + - [powerpc*] Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED + for CONFIG_SWAP" + - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry + - ocfs2: free up write context when direct IO failed + - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings + - memory_hotplug: cond_resched in __remove_pages + - netfilter: conntrack: fix calculation of next bucket number in early_drop + - [armhf] 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm + - bonding/802.3ad: fix link_failure_count tracking + - mtd: nand: Fix nanddev_neraseblocks() + - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option + - hwmon: (core) Fix double-free in __hwmon_device_register() + - perf stat: Handle different PMU names with common prefix + - of, numa: Validate some distance map rules + - [x86] hyper-v: Enable PIT shutdown quirk + - termios, tty/tty_baudrate.c: fix buffer overrun + - watchdog/core: Add missing prototypes for weak functions + - btrfs: fix pinned underflow after transaction aborted + - Btrfs: fix cur_offset in the error case for nocow + - Btrfs: fix infinite loop on inode eviction after deduplication of eof + block + - Btrfs: fix data corruption due to cloning of eof block + - clockevents/drivers/i8253: Add support for PIT shutdown quirk + - ext4: add missing brelse() update_backups()'s error path + - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path + - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path + - ext4: avoid potential extra brelse in setup_new_flex_group_blocks() + - ext4: missing !bh check in ext4_xattr_inode_write() + - ext4: fix possible inode leak in the retry loop of ext4_resize_fs() + - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty() + - ext4: avoid buffer leak in ext4_orphan_add() after prior errors + - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while + resizing + - ext4: avoid possible double brelse() in add_new_gdb() on error path + - ext4: fix possible leak of sbi->s_group_desc_leak in error path + - ext4: fix possible leak of s_journal_flag_rwsem in error path + - ext4: fix buffer leak in ext4_xattr_get_block() on error path + - ext4: release bs.bh before re-using in ext4_xattr_block_find() + - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path + - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path + - ext4: fix buffer leak in __ext4_read_dirblock() on error path + - mount: Retest MNT_LOCKED in do_umount + - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts + - mount: Prevent MNT_DETACH from disconnecting locked mounts + - mnt: fix __detach_mounts infinite loop + - sunrpc: correct the computation for page_ptr when truncating + - NFSv4: Don't exit the state manager without clearing + NFS4CLNT_MANAGER_RUNNING + - nfsd: COPY and CLONE operations require the saved filehandle to be set + - rtc: hctosys: Add missing range error reporting + - fuse: fix use-after-free in fuse_direct_IO() + - fuse: fix leaked notify reply + - selinux: check length properly in SCTP bind hook + - configfs: replace strncpy with memcpy + - gfs2: Put bitmap buffers in put_super + - gfs2: Fix metadata read-ahead during truncate (2) + - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD + - crypto: user - fix leaking uninitialized memory to userspace + - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! + - mm/swapfile.c: use kvzalloc for swap_info_struct allocation + - [armhf,arm64] efi/libstub: Pack FDT after populating it + - [armhf,arm64] drm/rockchip: Allow driver to be shutdown on reboot/kexec + - [arm64] drm/msm: fix OF child-node lookup + - drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init + - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type + - drm/nouveau: Check backlight IDs are >= 0, not > 0 + - drm/nouveau: Fix nv50_mstc->best_encoder() + - drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD + - [armhf] drm/etnaviv: fix bogus fence complete check in timeout handler + - drm/dp_mst: Check if primary mstb is null + - drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003) + - [x86] drm/i915/dp: Link train Fallback on eDP only if fallback link BW + can fit panel's native mode + - [x86] drm/i915: Restore vblank interrupts earlier + - [x86] drm/i915: Don't unset intel_connector->mst_port + - [x86] drm/i915: Skip vcpi allocation for MSTB ports that are gone + - [x86] drm/i915: Large page offsets for pread/pwrite + - [x86] drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse() + - [x86] drm/i915/dp: Restrict link retrain workaround to external monitors + - [x86] drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values + - [x86] drm/i915: Fix error handling for the NV12 fb dimensions check + - [x86] drm/i915: Fix ilk+ watermarks when disabling pipes + - [x86] drm/i915: Compare user's 64b GTT offset even on 32b + - [x86] drm/i915: Don't oops during modeset shutdown after lpe audio deinit + - [x86] drm/i915: Mark pin flags as u64 + - [x86] drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5 + - [x86] drm/i915/execlists: Force write serialisation into context image vs + execution + - [x86] drm/i915: Fix possible race in intel_dp_add_mst_connector() + - [armhf,arm64] CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM + + [ Ben Hutchings ] + * linux-perf: Fix BPF feature detection + * [rt] Update to 4.18.16-rt9: + - Revert "rcu: Use cpus_read_lock() while looking at cpu_online_mask" + - EXP rcu: Revert expedited GP parallelization cleverness + + [ Romain Perier ] + * [rt] Update to 4.18.12-rt7 + * Fixed FTBFS caused by wireless-disable-regulatory.db-direct-loading.patch, + due to conflicting types for 'reg_query_regdb_wmm' + + [ Vagrant Cascadian ] + * [arm64] Update pinebook/teres-i device-tree patches to 4.19.x: + - Enables the lid to wakeup from suspend. + + [ Salvatore Bonaccorso ] + * [x86] swiotlb: Enable swiotlb for > 4GiG RAM on 32-bit kernels + (Closes: #908924) + * mremap: properly flush TLB before releasing the page (CVE-2018-18281) + * cdrom: fix improper type cast, which can leat to information leak + (CVE-2018-18710) + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 21 Nov 2018 20:55:46 +0000 + +linux (4.18.10-2) unstable; urgency=medium + + [ Ben Hutchings ] + * [rt][arm64,armhf] Fix build failure after rebasing onto 4.18.10 + * xen-netback: fix input validation in xenvif_set_hash_mapping() + (CVE-2018-15471) + * Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct + member name" (Closes: #909813) + + [ Salvatore Bonaccorso ] + * [arm64] KVM: Tighten guest core register access from userspace + (CVE-2018-18021) + * [arm64] KVM: Sanitize PSTATE.M when being set from userspace + (CVE-2018-18021) + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 07 Oct 2018 21:57:06 +0100 + +linux (4.18.10-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.9 + - i2c: xiic: Make the start and the byte count write atomic + - i2c: i801: fix DNV's SMBCTRL register offset + - HID: multitouch: fix Elan panels with 2 input modes declaration + - HID: core: fix grouping by application + - HID: i2c-hid: Fix flooded incomplete report after S3 on Rayd touchscreen + - HID: input: fix leaking custom input node name + - mm/hugetlb: filter out hugetlb pages if HUGEPAGE migration is not + supported. + - mac80211: don't update the PM state of a peer upon a multicast frame + - scsi: lpfc: Correct MDS diag and nvmet configuration + - nbd: don't allow invalid blocksize settings + - block: don't warn when doing fsync on read-only devices + - block: bfq: swap puts in bfqg_and_blkg_put + - android: binder: fix the race mmap and alloc_new_buf_locked + - [mips*] VDSO: Match data page cache colouring when D$ aliases + - smb3: Backup intent flag missing for directory opens with backupuid mounts + - smb3: check for and properly advertise directory lease support + - cifs: connect to servername instead of IP for IPC$ share + - btrfs: fix qgroup_free wrong num_bytes in btrfs_subvolume_reserve_metadata + - btrfs: fix data corruption when deduplicating between different files + - [arm64] KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD + - [armhf, arm64] KVM: Clean dcache to PoC when changing PTE due to CoW + - [[powerpc*] KVM: Book3S HV: Use correct pagesize in kvm_unmap_radix() + - [s390x] KVM: vsie: copy wrapping keys to right place + - [x86] KVM: SVM: Set EMULTYPE_NO_REEXECUTE for RSM emulation + - [x86] KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO + instr + - [x86] KVM: Invert emulation re-execute behavior to make it opt-in + - [x86] KVM: Merge EMULTYPE_RETRY and EMULTYPE_ALLOW_REEXECUTE + - [x86] KVM: Default to not allowing emulation retry in kvm_mmu_page_fault + - [x86] KVM: Do not re-{try,execute} after failed emulation in L2 + - ACPI / LPSS: Force LPSS quirks on boot + - memory: ti-aemif: fix a potential NULL-pointer dereference + - ALSA: hda - Fix cancel_work_sync() stall from jackpoll work + - cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun() + - cpu/hotplug: Prevent state corruption on error rollback + - [x86] microcode: Make sure boot_cpu_data.microcode is up-to-date + - [x86] microcode: Update the new microcode revision unconditionally + - [x86] process: Don't mix user/kernel regs in 64bit __show_regs() + - [x86] apic/vector: Make error return value negative + - switchtec: Fix Spectre v1 vulnerability + - misc: mic: SCIF Fix scif_get_new_port() error handling + - ALSA: hda/realtek - Add mute LED quirk for HP Spectre x360 + - ethtool: Remove trailing semicolon for static inline + - i2c: aspeed: Add an explicit type casting for *get_clk_reg_val + - Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV + - gpio: tegra: Move driver registration to subsys_init level + - [powerpc*] powernv: Fix concurrency issue with npu->mmio_atsd_usage + - [powerpc*] 4xx: Fix error return path in ppc4xx_msi_probe() + - media: davinci: vpif_display: Mix memory leak on probe error path + - media: dw2102: Fix memleak on sequence of probes + - net: phy: Fix the register offsets in Broadcom iProc mdio mux driver + - scsi: qla2xxx: Fix unintended Logout + - scsi: qla2xxx: Fix session state stuck in Get Port DB + - scsi: qla2xxx: Silent erroneous message + - clk: scmi: Fix the rounding of clock rate + - blk-mq: fix updating tags depth + - scsi: lpfc: Fix driver crash when re-registering NVME rports. + - scsi: target: fix __transport_register_session locking + - md/raid5: fix data corruption of replacements after originals dropped + - timers: Clear timer_base::must_forward_clk with timer_base::lock held + - gpu: ipu-v3: default to id 0 on missing OF alias + - misc: ti-st: Fix memory leak in the error path of probe() + - uio: potential double frees if __uio_register_device() fails + - firmware: vpd: Fix section enabled flag on vpd_section_destroy + - [x86] Drivers: hv: vmbus: Cleanup synic memory free path + - tty: rocket: Fix possible buffer overwrite on register_PCI + - uio: fix possible circular locking dependency + - iwlwifi: pcie: don't access periphery registers when not available + - IB/IPoIB: Set ah valid flag in multicast send flow + - f2fs: fix to active page in lru list for read path + - f2fs: do not set free of current section + - f2fs: Keep alloc_valid_block_count in sync + - f2fs: issue discard align to section in LFS mode + - f2fs: fix defined but not used build warnings + - f2fs: fix to detect looped node chain correctly + - ASoC: soc-pcm: Use delay set in component pointer function + - perf tools: Allow overriding MAX_NR_CPUS at compile time + - device-dax: avoid hang on error before devm_memremap_pages() + - NFSv4.0 fix client reference leak in callback + - perf c2c report: Fix crash for empty browser + - perf evlist: Fix error out while applying initial delay and LBR + - [powerpc*] pseries: fix EEH recovery of some IOV devices + - [powerpc*] macintosh/via-pmu: Add missing mmio accessors + - ath9k: report tx status on EOSP + - ath9k_hw: fix channel maximum power level test + - ath10k: prevent active scans on potential unusable channels + - wlcore: Set rx_status boottime_ns field on rx + - rpmsg: core: add support to power domains for devices + - mtd: rawnand: make subop helpers return unsigned values + - scsi: tcmu: do not set max_blocks if data_bitmap has been setup + - [mips*] Fix ISA virt/bus conversion for non-zero PHYS_OFFSET + - ata: libahci: Allow reconfigure of DEVSLP register + - ata: libahci: Correct setting of DEVSLP register + - nfs: Referrals not inheriting proto setting from parent + - scsi: 3ware: fix return 0 on the error path of probe + - tools/testing/nvdimm: kaddr and pfn can be NULL to ->direct_access() + - ath10k: disable bundle mgmt tx completion event support + - media: em28xx: explicitly disable TS packet filter + - PCI: mobiveil: Fix struct mobiveil_pcie.pcie_reg_base address type + - [powerpc*] mm: Don't report PUDs as memory leaks when using kmemleak + - Bluetooth: hidp: Fix handling of strncpy for hid->name information + - [x86] mm: Remove in_nmi() warning from vmalloc_fault() + - [armhf] pinctrl: imx: off by one in imx_pinconf_group_dbg_show() + - gpio: pxa: disable pinctrl calls for PXA3xx + - gpio: ml-ioh: Fix buffer underwrite on probe error path + - [x86, arm64] pinctrl/amd: only handle irq if it is pending and unmasked + - [armhf, arm64] net: mvneta: fix mtu change on port without link + - f2fs: try grabbing node page lock aggressively in sync scenario + - pktcdvd: Fix possible Spectre-v1 for pkt_devs + - f2fs: fix to skip GC if type in SSA and SIT is inconsistent + - [x86] tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) + - f2fs: fix to do sanity check with reserved blkaddr of inline inode + (CVE-2018-13099) + - [mips*] Octeon: add missing of_node_put() + - [mips*] generic: fix missing of_node_put() + - thermal: rcar_thermal: avoid NULL dereference in absence of IRQ resources + - thermal_hwmon: Sanitize attribute name passed to hwmon + - net: dcb: For wild-card lookups, use priority -1, not 0 + - dm cache: only allow a single io_mode cache feature to be requested + - Input: atmel_mxt_ts - only use first T9 instance + - [powerpc*] partitions/aix: append null character to print data from disk + - [powerpc*] partitions/aix: fix usage of uninitialized lv_info and lvname + structures + - drm/amd/display: Prevent PSR from being enabled if initialization fails + - media: em28xx: Fix dual transport stream operation + - [arm64] iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in + kdump kernel + - f2fs: fix to wait on page writeback before updating page + - f2fs: Fix uninitialized return in f2fs_ioc_shutdown() + - media: em28xx: Fix DualHD disconnect oops + - f2fs: avoid potential deadlock in f2fs_sbi_store + - f2fs: fix to do sanity check with secs_per_zone (CVE-2018-13100) + - [armhf] mfd: ti_am335x_tscadc: Fix struct clk memory leak + - f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize + - f2fs: fix to propagate return value of scan_nat_page() + - f2fs: fix to do sanity check with extra_attr feature (CVE-2018-13098) + - RDMA/hns: Add illegal hop_num judgement + - NFSv4.1: Fix a potential layoutget/layoutrecall deadlock + - RDMA/hns: Update the data type of immediate data + - [mips*] WARN_ON invalid DMA cache maintenance, not BUG_ON + - [mips*] mscc: ocelot: fix length of memory address space for MIIM + - RDMA/cma: Do not ignore net namespace for unbound cm_id + - clocksource: Revert "Remove kthread" + - autofs: fix autofs_sbi() does not check super block type + - mm: get rid of vmacache_flush_all() entirely (CVE-2018-17182) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.10 + - be2net: Fix memory leak in be_cmd_get_profile_config() + - net/mlx5: Fix use-after-free in self-healing flow + - rds: fix two RCU related problems + - tipc: orphan sock in tipc_release() + - net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB + tables + - net/tls: Set count of SG entries if sk_alloc_sg returns -ENOSPC + - net/mlx5: Check for error in mlx5_attach_interface + - net/mlx5: Fix debugfs cleanup in the device init/remove flow + - erspan: fix error handling for erspan tunnel + - erspan: return PACKET_REJECT when the appropriate tunnel is not found + - tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY + - net/mlx5: Fix not releasing read lock when adding flow rules + - net/mlx5: Fix possible deadlock from lockdep when adding fte to fg + - net/mlx5: Use u16 for Work Queue buffer fragment size + - [armhf, arm64] usb: dwc3: change stream event enable bit back to 13 + - [arm64] iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register + - [armhf] iommu/io-pgtable-arm-v7s: Abort allocation when table address + overflows the PTE + - [armhf] iommu/io-pgtable-arm: Fix pgtable allocation in selftest + - ALSA: msnd: Fix the default sample sizes + - ALSA: usb-audio: Add support for Encore mDSD USB DAC + - ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro + - xfrm: fix 'passing zero to ERR_PTR()' warning + - [amd64, arm64] amd-xgbe: use dma_mapping_error to check map errors + - nfp: don't fail probe on pci_sriov_set_totalvfs() errors + - iwlwifi: cancel the injective function between hw pointers to tfd entry + index + - gfs2: Special-case rindex for gfs2_grow + - [armhf] clk: imx6ul: fix missing of_node_put() + - [armhf] clk: imx6sll: fix missing of_node_put() + - [arm64] clk: mvebu: armada-37xx-periph: Fix wrong return value in + get_parent + - Input: pxrc - fix freeing URB on device teardown + - clk: core: Potentially free connection id + - clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure + - media: tw686x: Fix oops on buffer alloc failure + - [armhf] dmaengine: pl330: fix irq race with terminate_all + - [mips*] ath79: fix system restart + - media: videobuf2-core: check for q->error in vb2_core_qbuf() + - IB/rxe: Drop QP0 silently + - block: allow max_discard_segments to be stacked + - IB/ipoib: Fix error return code in ipoib_dev_init() + - mtd/maps: fix solutionengine.c printk format warnings + - gfs2: Don't reject a supposedly full bitmap if we have blocks reserved + - perf tools: Synthesize GROUP_DESC feature in pipe mode + - perf tools: Fix struct comm_str removal crash + - [powerpc*] perf: Fix callchain ip filtering when return address is in a + register + - fbdev: Distinguish between interlaced and progressive modes + - [armhf] exynos: Clear global variable on init error path + - [powerpc*] perf: Fix callchain ip filtering + - nvmet: fix file discard return status + - nvme-rdma: unquiesce queues when deleting the controller + - [armhf, arm64] KVM: vgic: Fix possible spectre-v1 write in + vgic_mmio_write_apr() + - [powerpc*] powerpc/powernv: opal_put_chars partial write fix + - perf script: Show correct offsets for DWARF-based unwinding + - ASoC: rt5514: Fix the issue of the delay volume applied + - [mips*] jz4740: Bump zload address + - mac80211: restrict delayed tailroom needed decrement + - Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets + - wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of + qe_muram_alloc + - [arm64] fix possible spectre-v1 write in ptrace_hbp_set_event() + - reset: imx7: Fix always writing bits as 0 + - efi/arm: preserve early mapping of UEFI memory map longer for BGRT + - ALSA: usb-audio: Generic DSD detection for Thesycon-based implementations + - nfp: avoid buffer leak when FW communication fails + - xen-netfront: fix queue name setting + - [arm64] dts: qcom: db410c: Fix Bluetooth LED trigger + - ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci + - soc: qcom: smem: Correct check for global partition + - [s390x] qeth: fix race in used-buffer accounting + - [s390x] qeth: reset layer2 attribute on layer switch + - platform/x86: toshiba_acpi: Fix defined but not used build warnings + - KVM: arm/arm64: Fix vgic init race + - drivers/base: stop new probing during shutdown + - i2c: aspeed: Fix initial values of master and slave state + - drm/amd/pp: Set Max clock level to display by default + - regulator: qcom_spmi: Use correct regmap when checking for error + - regulator: qcom_spmi: Fix warning Bad of_node_put() + - iommu/ipmmu-vmsa: IMUCTRn.TTSEL needs a special usage on R-Car Gen3 + - dmaengine: mv_xor_v2: kill the tasklets upon exit + - crypto: sharah - Unregister correct algorithms for SAHARA 3 + - [x86] pti: Check the return value of pti_user_pagetable_walk_p4d() + - [x86] pti: Check the return value of pti_user_pagetable_walk_pmd() + - [x86} mm/pti: Add an overflow check to pti_clone_pmds() + - PCI/AER: Honor "pcie_ports=native" even if HEST sets FIRMWARE_FIRST + - xen-netfront: fix warn message as irq device name has '/' + - RDMA/cma: Protect cma dev list with lock + - pstore: Fix incorrect persistent ram buffer mapping + - xen/netfront: fix waiting for xenbus state change + - IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler + - [s390x] crypto: Fix return code checking in cbc_paes_crypt() + - [armhf] mmc: omap_hsmmc: fix wakeirq handling on removal + - ipmi: Rework SMI registration failure + - ipmi: Move BT capabilities detection to the detect call + - ipmi: Fix I2C client removal in the SSIF driver + - ovl: fix oopses in ovl_fill_super() failure paths + - vmbus: don't return values for uninitalized channels + - tools: hv: Fix a bug in the key delete code + - misc: ibmvsm: Fix wrong assignment of return code + - misc: hmc6352: fix potential Spectre v1 + - xhci: Fix use after free for URB cancellation on a reallocated endpoint + - usb: Don't die twice if PCI xhci host is not responding in resume + - usb: xhci: fix interrupt transfer error happened on MTK platforms + - usb: mtu3: fix error of xhci port id when enable U3 dual role + - mei: ignore not found client in the enumeration + - mei: bus: fix hw module get/put balance + - mei: bus: need to unlink client before freeing + - dm verity: fix crash on bufio buffer that was allocated with vmalloc + - usb: Add quirk to support DJI CineSSD + - usb: uas: add support for more quirk flags + - usb: Avoid use-after-free by flushing endpoints early in + usb_set_interface() + - usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() + - usb: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB + controller + - usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0 + - usb: net2280: Fix erroneous synchronization change + - usb: serial: io_ti: fix array underflow in completion handler + - usb: misc: uss720: Fix two sleep-in-atomic-context bugs + - usb: serial: ti_usb_3410_5052: fix array underflow in completion handler + - usb: yurex: Fix buffer over-read in yurex_write() + - usb: cdc-wdm: Fix a sleep-in-atomic-context bug in + service_outstanding_interrupt() + - Revert "cdc-acm: implement put_char() and flush_chars()" + - cifs: prevent integer overflow in nxt_dir_entry() + - CIFS: fix wrapping bugs in num_entries() + - cifs: integer overflow in in SMB2_ioctl() + - xtensa: ISS: don't allocate memory in platform_setup + - perf/core: Force USER_DS when recording user stack data + - perf tools: Fix maps__find_symbol_by_name() + - of: fix phandle cache creation for DTs with no phandles + - x86/EISA: Don't probe EISA bus for Xen PV guests + - NFSv4: Fix a tracepoint Oops in initiate_file_draining() + - NFSv4.1 fix infinite loop on I/O. + - of: add helper to lookup compatible child node + - mmc: meson-mx-sdio: fix OF child-node lookup + - binfmt_elf: Respect error return from `regset->active' + - net/mlx5: Add missing SET_DRIVER_VERSION command translation + - audit: fix use-after-free in audit_add_watch + - mtdchar: fix overflows in adjustment of `count` + - vfs: fix freeze protection in mnt_want_write_file() for overlayfs + - bpf: fix rcu annotations in compute_effective_progs() + - spi: dw: fix possible race condition + - Bluetooth: Use lock_sock_nested in bt_accept_enqueue + - evm: Don't deadlock if a crypto algorithm is unavailable + - [powerpc*] KVM: Book3S HV: Add of_node_put() in success path + - security: check for kstrdup() failure in lsm_append() + - PM / devfreq: use put_device() instead of kfree() + - [powerpc*] KVM: Book3S: Fix matching of hardware and emulated TCE tables + - configfs: fix registered group removal + - sched/core: Use smp_mb() in wake_woken_function() + - efi/esrt: Only call efi_mem_reserve() for boot services memory + - [arm64] net: hns3: Reset net device with rtnl_lock + - [arm64] net: hns3: Fix for reset_level default assignment probelm + - [arm64] hisi: handle of_iomap and fix missing of_node_put + - [arm64] hisi: fix error handling and missing of_node_put + - [arm64] net: hns3: Fix return value error in hns3_reset_notify_down_enet + - [arm64] hisi: check of_iomap and fix missing of_node_put + - liquidio: fix hang when re-binding VF host drv after running DPDK VF + driver + - [armhf] gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes + - ASoC: hdmi-codec: fix routing + - serial: 8250: of: Correct of_platform_serial_setup() error handling + - tty: fix termios input-speed encoding when using BOTHER + - tty: fix termios input-speed encoding + - [armhf, arm64] mmc: tegra: prevent HS200 on Tegra 3 + - mmc: sdhci: do not try to use 3.3V signaling if not supported + - drm/nouveau: Fix runtime PM leak in drm_open() + - drm/nouveau/debugfs: Wake up GPU before doing any reclocking + - [armhf, arm64] drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping + - tls: Fix zerocopy_from_iter iov handling + - parport: sunbpp: fix error return code + - sched/fair: Fix util_avg of new tasks for asymmetric systems + - f2fs: do checkpoint in kill_sb + - drm/amd/display: support access ddc for mst branch + - gpiolib: Mark gpio_suffixes array with __maybe_unused + - [armhf, arm64] net: mvpp2: make sure we use single queue mode on PPv2.1 + - mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) + - input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) + - [x86] drm/amdkfd: Fix kernel queue 64 bit doorbell offset calculation + - [x86] drm/amdkfd: Fix error codes in kfd_get_process + - ALSA: pcm: Fix snd_interval_refine first/last with open min/max + - scsi: libfc: fixup 'sleeping function called from invalid context' + - scsi: lpfc: Fix NVME Target crash in defer rcv logic + - scsi: lpfc: Fix panic if driver unloaded when port is offline + - [arm64] perf: Disable PMU while processing counter overflows + - drm/amd/pp: Send khz clock values to DC for smu7/8 + - IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlers + - blk-mq: only attempt to merge bio if there is rq in sw queue + - blk-mq: avoid to synchronize rcu inside blk_cleanup_queue() + - [arm64] pinctrl: msm: Fix msm_config_group_get() to be compliant + - [arm64] pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be + compliant + - [armhf, arm64] clk: tegra: bpmp: Don't crash when a clock fails to + register + - [x86] mei: bus: type promotion bug in mei_nfc_if_version() + - [x86] crypto: ccp - add timeout support in the SEV command + + [ Vagrant Cascadian ] + * debian/rules.real: Generate linux-source tarball with root user and + group specified, to fix reproducibility issues. + + [ Ben Hutchings ] + * drivers/net/ethernet: Ignore ABI changes + * [arm64] ACPI: Change ACPI_NFIT from built-in to module + * [i386/686] Enable MGEODE_LX instead of M686 (regression in 4.16) + - x86-32: Disable 3D-Now in generic config + * Bump ABI to 2 + + [ Yves-Alexis Perez ] + * [x86] enable PINCTRL_AMD for touchpad support on Lenovo IdeaPad. + (closes: #876141) + + [ Geoff Levand ] + * [arm64] Add support for new server hardware (Closes: #900581): + - Enable SCHED_SMT for hardware multithreading processors + - Enable ARM64_LSE_ATOMICS for v8.1 processors + - ACPI: Enable ACPI_PCI_SLOT, ACPI_HED, ACPI_BGRT, ACPI_APEI, + ACPI_APEI_GHES, ACPI_APEI_PCIEAER, ACPI_APEI_SEA, + ACPI_APEI_MEMORY_FAILURE as built-in; + ACPI_APEI_EINJ, WDAT_WDT as modules + * [arm64] acpi: Add fixup for HPE m400 quirks + + [ Salvatore Bonaccorso ] + * floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl + (CVE-2018-7755) + * scsi: target: iscsi: Use hex2bin instead of a re-implementation + (CVE-2018-14633) + * scsi: target: iscsi: Use bin2hex instead of a re-implementation + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 30 Sep 2018 18:02:51 +0100 + +linux (4.18.8-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7 + - rcu: Make expedited GPs handle CPU 0 being offline + - net: 6lowpan: fix reserved space for single frames + - net: mac802154: tx: expand tailroom if necessary + - 9p/net: Fix zero-copy path in the 9p virtio transport + - spi: pxa2xx: Add support for Intel Ice Lake + - mmc: block: Fix unsupported parallel dispatch of requests + - readahead: stricter check for bdi io_pages + - block: fix infinite loop if the device loses discard capability + - block: blk_init_allocated_queue() set q->fq as NULL in the fail case + - block: really disable runtime-pm for blk-mq + - blkcg: Introduce blkg_root_lookup() + - block: Introduce blk_exit_queue() + - block: Ensure that a request queue is dissociated from the cgroup + controller + - apparmor: fix bad debug check in apparmor_secid_to_secctx() + - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace + - libertas: fix suspend and resume for SDIO connected cards + - media: Revert "[media] tvp5150: fix pad format frame height" + - [arm64] mailbox: xgene-slimpro: Fix potential NULL pointer dereference + - Replace magic for trusting the secondary keyring with #define + - Fix kexec forbidding kernels signed with keys in the secondary keyring to + boot + - [powerpc*] fadump: handle crash memory ranges array index overflow + - [powerpc*] 64s: Fix page table fragment refcount race vs speculative + references + - [powerpc*] pseries: Fix endianness while restoring of r3 in MCE handler. + - [powerpc*] pkeys: Give all threads control of their key permissions + - [powerpc*] pkeys: Deny read/write/execute by default + - [powerpc*] pkeys: key allocation/deallocation must not change pkey + registers + - [powerpc*] pkeys: Save the pkey registers before fork + - [powerpc*] pkeys: Fix calculation of total pkeys. + - [powerpc*] pkeys: Preallocate execute-only key + - [powerpc*] nohash: fix pte_access_permitted() + - [powerpc64] ftrace: Include ftrace.h needed for enable/disable calls + - [powerpc*] powernv/pci: Work around races in PCI bridge enabling + - cxl: Fix wrong comparison in cxl_adapter_context_get() + - ocxl: Fix page fault handler in case of fault on dying process + - IB/mlx5: Honor cnt_set_id_valid flag instead of set_id + - IB/mlx5: Fix leaking stack memory to userspace + - IB/srpt: Fix srpt_cm_req_recv() error path (1/2) + - IB/srpt: Fix srpt_cm_req_recv() error path (2/2) + - IB/srpt: Support HCAs with more than two ports + - RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq + - ib_srpt: Fix a use-after-free in srpt_close_ch() + - ib_srpt: Fix a use-after-free in __srpt_close_all_ch() + - RDMA/rxe: Set wqe->status correctly if an unexpected response is received + - 9p: fix multiple NULL-pointer-dereferences + - fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr + failed + - 9p/virtio: fix off-by-one error in sg list bounds check + - net/9p/client.c: version pointer uninitialized + - net/9p/trans_fd.c: fix race-condition by flushing workqueue before the + kfree() + - dm integrity: change 'suspending' variable from bool to int + - dm thin: stop no_space_timeout worker when switching to write-mode + - dm cache metadata: save in-core policy_hint_size to on-disk superblock + - dm cache metadata: set dirty on all cache blocks after a crash + - dm crypt: don't decrease device limits + - dm writecache: fix a crash due to reading past end of dirty_bitmap + - uart: fix race between uart_put_char() and uart_shutdown() + - [x86] Drivers: hv: vmbus: Fix the offer_in_progress in + vmbus_process_offer() + - [x86] Drivers: hv: vmbus: Reset the channel callback in + vmbus_onoffer_rescind() + - extcon: Release locking when sending the notification of connector state + - [x86] vmw_balloon: fix inflation of 64-bit GFNs + - [x86] vmw_balloon: do not use 2MB without batching + - [x86] vmw_balloon: VMCI_DOORBELL_SET does not check status + - [x86] vmw_balloon: fix VMCI use when balloon built into kernel + - [armhf] rtc: omap: fix resource leak in registration error path + - [armhf] rtc: omap: fix potential crash on power off + - tracing: Do not call start/stop() functions when tracing_on does not + change + - tracing/blktrace: Fix to allow setting same value + - printk/tracing: Do not trace printk_nmi_enter() + - uprobes: Use synchronize_rcu() not synchronize_sched() + - mfd: hi655x: Fix regmap area declared size for hi655x + - ovl: fix wrong use of impure dir cache in ovl_iterate() + - ACPICA: AML Parser: skip opcodes that open a scope upon parse failure + - ACPICA: Clear status of all events when entering sleep states + - drivers/block/zram/zram_drv.c: fix bug storing backing_dev + - sched: idle: Avoid retaining the tick when it has been stopped + - cpuidle: menu: Handle stopped tick more aggressively + - cpufreq: governor: Avoid accessing invalid governor_data + - PM / sleep: wakeup: Fix build error caused by missing SRCU support + - ALSA: ac97: fix device initialization in the compat layer + - ALSA: ac97: fix check of pm_runtime_get_sync failure + - ALSA: ac97: fix unbalanced pm_runtime_enable + - [x86, arm64] i2c: designware: Re-init controllers with pm_disabled set on + resume + - [x86] KVM: VMX: fixes for vmentry_l1d_flush module parameter + - [powerpc*] KVM: Book3S: Fix guest DMA when guest partially backed by + THP pages + - block, bfq: return nbytes and not zero from struct cftype .write() method + - pnfs/blocklayout: off by one in bl_map_stripe() + - nfsd: fix leaked file lock with nfs exported overlayfs + - NFSv4 client live hangs after live data migration recovery + - NFSv4: Fix locking in pnfs_generic_recover_commit_reqs + - NFSv4: Fix a sleep in atomic context in nfs4_callback_sequence() + - [armhf] ARM: dts: am57xx-idk: Enable dual role for USB2 port + - [armhf] pwm: omap-dmtimer: Return -EPROBE_DEFER if no dmtimer platform + data + - mm/tlb: Remove tlb_remove_table() non-concurrent condition + - [x86] iommu/vt-d: Add definitions for PFSID + - [x86] iommu/vt-d: Fix dev iotlb pfsid use + - sys: don't hold uts_sem while accessing userspace memory + - ubifs: Fix memory leak in lprobs self-check + - Revert "UBIFS: Fix potential integer overflow in allocation" + - ubifs: Check data node size before truncate + - ubifs: xattr: Don't operate on deleted inodes + - ubifs: Fix directory size calculation for symlinks + - ubifs: Fix synced_i_size calculation for xattr inodes + - [armhf] pwm: tiehrpwm: Don't use emulation mode bits to control PWM output + - [armhf] pwm: tiehrpwm: Fix disabling of output of PWMs + - fb: fix lost console when the user unplugs a USB adapter + - udlfb: fix semaphore value leak + - udlfb: fix display corruption of the last line + - udlfb: don't switch if we are switching to the same videomode + - udlfb: set optimal write delay + - udlfb: make a local copy of fb_ops + - udlfb: handle allocation failure + - udlfb: set line_length in dlfb_ops_set_par + - getxattr: use correct xattr length + - libnvdimm: Use max contiguous area for namespace size + - libnvdimm: fix ars_status output length calculation + - bcache: release dc->writeback_lock properly in bch_writeback_thread() + - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias() + - mm, dev_pagemap: Do not clear ->mapping on final put + - perf auxtrace: Fix queue resize + - [x86] crypto: vmx - Fix sleep-in-atomic bugs + - [x86] crypto: aesni - Use unaligned loads from gcm_context_data + - [arm64] crypto: arm64/sm4-ce - check for the right CPU feature bit + - fs/quota: Fix spectre gadget in do_quotactl + - udf: Fix mounting of Win7 created UDF filesystems + - cpuidle: menu: Retain tick when shallow state is selected + - [arm64] mm: always enable CONFIG_HOLES_IN_ZONE + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.8 + - act_ife: fix a potential use-after-free + - ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT + state + - net: sched: Fix memory exposure from short TCA_U32_SEL + - qlge: Fix netdev features configuration. + - r8152: disable RX aggregation on new Dell TB16 dock + - tcp: do not restart timewait timer on rst reception + - vti6: remove !skb->ignore_df check from vti6_xmit() + - act_ife: move tcfa_lock down to where necessary + - act_ife: fix a potential deadlock + - net: sched: action_ife: take reference to meta module + - bnxt_en: Clean up unused functions. + - bnxt_en: Do not adjust max_cp_rings by the ones used by RDMA. + - net/sched: act_pedit: fix dump of extended layered op + - tipc: fix a missing rhashtable_walk_exit() + - [x86] hv_netvsc: Fix a deadlock by getting rtnl lock earlier in + netvsc_probe() + - tipc: fix the big/little endian issue in tipc_dest + - sctp: remove useless start_fail from sctp_ht_iter in proc + - erspan: set erspan_ver to 1 by default when adding an erspan dev + - ipv6: don't get lwtstate twice in ip6_rt_copy_init() + - net/ipv6: init ip6 anycast rt->dst.input as ip6_input + - net/ipv6: Only update MTU metric if it set + - net/ipv6: Put lwtstate when destroying fib6_info + - net/mlx5: Fix SQ offset in QPs with small RQ + - r8169: set RxConfig after tx/rx is enabled for RTL8169sb/8110sb devices + - [armhf,arm64] Revert "net: stmmac: Do not keep rearming the coalesce + timer in stmmac_xmit" + - ip6_vti: fix creating fallback tunnel device for vti6 + - ip6_vti: fix a null pointer deference when destroy vti6 tunnel + - nfp: wait for posted reconfigs when disabling the device + - sctp: hold transport before accessing its asoc in sctp_transport_get_next + - vhost: correctly check the iova range when waking virtqueue + - [x86] hv_netvsc: ignore devices that are not PCI + - cifs: check if SMB2 PDU size has been padded and suppress the warning + - hfsplus: don't return 0 when fill_super() failed + - hfs: prevent crash on exit from failed search + - sunrpc: Don't use stack buffer with scatterlist + - fork: don't copy inconsistent signal handler state to child + - fs/proc/vmcore.c: hide vmcoredd_mmap_dumps() for nommu builds + - reiserfs: change j_timestamp type to time64_t + - [armhf,arm64] iommu/rockchip: Handle errors returned from PM framework + - hfsplus: fix NULL dereference in hfsplus_lookup() (CVE-2018-14617) + - [armhf,arm64] iommu/rockchip: Move irq request past pm_runtime_enable + - fs/proc/kcore.c: use __pa_symbol() for KCORE_TEXT list entries + - fat: validate ->i_start before using + - workqueue: skip lockdep wq dependency in cancel_work_sync() + - workqueue: re-add lockdep dependencies for flushing + - scripts: modpost: check memory allocation results + - apparmor: fix an error code in __aa_create_ns() + - virtio: pci-legacy: Validate queue pfn + - [x86] mce: Add notifier_block forward declaration + - i2c: core: ACPI: Make acpi_gsb_i2c_read_bytes() check i2c_transfer return + value + - IB/hfi1: Invalid NUMA node information can cause a divide by zero + - [armhf,arm64] pwm: meson: Fix mux clock names + - [powerpc*] topology: Get topology for shared processors at boot + - mm/fadvise.c: fix signed overflow UBSAN complaint + - mm: make DEFERRED_STRUCT_PAGE_INIT explicitly depend on SPARSEMEM + - fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot() + - [x86] platform: intel_punit_ipc: fix build errors + - bpf, sockmap: fix map elem deletion race with smap_stop_sock + - tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach + - bpf, sockmap: fix sock_map_ctx_update_elem race with exist/noexist + - net/xdp: Fix suspicious RCU usage warning + - bpf, sockmap: fix leakage of smap_psock_map_entry + - netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses + - [s390x] kdump: Fix memleak in nt_vmcoreinfo + - ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest() + - mfd: sm501: Set coherent_dma_mask when creating subdevices + - netfilter: x_tables: do not fail xt_alloc_table_info too easilly + - [x86] platform: asus-nb-wmi: Add keymap entry for lid flip action on + UX360 + - netfilter: fix memory leaks on netlink_dump_start error + - tcp, ulp: add alias for all ulp modules + - ubi: Initialize Fastmap checkmapping correctly + - ACPICA: ACPICA: add status check for acpi_hw_read before assigning return + value + - [arm*] perf arm spe: Fix uninitialized record error variable + - [arm64] net: hns3: Fix for command format parsing error in + hclge_is_all_function_id_zero + - block: don't warn for flush on read-only device + - [arm64] net: hns3: Fix for phy link issue when using marvell phy driver + - PCI: Match Root Port's MPS to endpoint's MPSS as necessary + - drm/amd/display: Guard against null crtc in CRC IRQ + - perf tools: Check for null when copying nsinfo. + - f2fs: avoid race between zero_range and background GC + - f2fs: fix avoid race between truncate and background GC + - net/9p/trans_fd.c: fix race by holding the lock + - net/9p: fix error path of p9_virtio_probe + - f2fs: fix to clear PG_checked flag in set_page_dirty() + - [armhf,arm64] pinctrl: axp209: Fix NULL pointer dereference after + allocation + - bpf: fix bpffs non-array map seq_show issue + - [powerpc*] uaccess: Enable get_user(u64, *p) on 32-bit + - [powerpc*] Fix size calculation using resource_size() + - [powerpc*] perf probe powerpc: Fix trace event post-processing + - block: bvec_nr_vecs() returns value for wrong slab + - brcmfmac: fix brcmf_wiphy_wowl_params() NULL pointer dereference + - [s390x] dasd: fix hanging offline processing due to canceled worker + - [s390x] dasd: fix panic for failed online processing + - ACPI / scan: Initialize status to ACPI_STA_DEFAULT + - blk-mq: count the hctx as active before allocating tag + - scsi: aic94xx: fix an error code in aic94xx_init() + - NFSv4: Fix error handling in nfs4_sp4_select_mode() + - Input: do not use WARN() in input_alloc_absinfo() + - xen/balloon: fix balloon initialization for PVH Dom0 + - [armhf] PCI: mvebu: Fix I/O space end address calculation + - dm kcopyd: avoid softlockup in run_complete_job + - [x86] staging: comedi: ni_mio_common: fix subdevice flags for PFI + subdevice + - ASoC: rt5677: Fix initialization of rt5677_of_match.data + - [armhf] iommu/omap: Fix cache flushes on L2 table entries + - selinux: cleanup dentry and inodes on error in selinuxfs + - RDS: IB: fix 'passing zero to ERR_PTR()' warning + - cfq: Suppress compiler warnings about comparisons + - smb3: fix reset of bytes read and written stats + - CIFS: fix memory leak and remove dead code + - SMB3: Number of requests sent should be displayed for SMB3 not just CIFS + - smb3: if server does not support posix do not allow posix mount option + - [powerpcspe] platforms/85xx: fix t1042rdb_diu.c build errors & warning + - [powerpc*] 64s: Make rfi_flush_fallback a little more robust + - [powerpc*] pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX. + - [armhf,arm64] clk: rockchip: Add pclk_rkpwm_pmu to PMU critical clocks in + rk3399 + - drm/amd/display: Read back max backlight value at boot + - [x86] KVM: vmx: track host_state.loaded using a loaded_vmcs pointer + - [x86] kvm: nVMX: Fix fault vector for VMX operation at CPL > 0 + - [armhf] drm/etnaviv: fix crash in GPU suspend when init failed due to + buffer placement + - btrfs: Exit gracefully when chunk map cannot be inserted to the tree + - btrfs: replace: Reset on-disk dev stats value after replace + - btrfs: fix in-memory value of total_devices after seed device deletion + - btrfs: relocation: Only remove reloc rb_trees if reloc control has been + initialized (CVE-2018-14609) + - btrfs: tree-checker: Detect invalid and empty essential trees + (CVE-2018-14612) + - btrfs: check-integrity: Fix NULL pointer dereference for degraded mount + - btrfs: lift uuid_mutex to callers of btrfs_open_devices + - btrfs: Don't remove block group that still has pinned down bytes + - btrfs: Fix a C compliance issue + - [armhf,arm64] rockchip: Force CONFIG_PM on Rockchip systems + - btrfs: do btrfs_free_stale_devices outside of device_list_add + - btrfs: extend locked section when adding a new device in device_list_add + - btrfs: rename local devices for fs_devices in btrfs_free_stale_devices( + - btrfs: use device_list_mutex when removing stale devices + - btrfs: lift uuid_mutex to callers of btrfs_scan_one_device + - btrfs: lift uuid_mutex to callers of btrfs_parse_early_options + - btrfs: reorder initialization before the mount locks uuid_mutex + - btrfs: fix mount and ioctl device scan ioctl race + - [x86] drm/i915/lpe: Mark LPE audio runtime pm as "no callbacks" + - [x86] drm/i915: Nuke the LVDS lid notifier + - [x86] drm/i915: Increase LSPCON timeout + - [x86] drm/i915: Free write_buf that we allocated with kzalloc. + - drm/amdgpu: update uvd_v6_0_ring_vm_funcs to use new nop packet + - drm/amdgpu: fix a reversed condition + - drm/amdgpu: Fix RLC safe mode test in gfx_v9_0_enter_rlc_safe_mode + - drm/amd/pp: Convert voltage unit in mV*4 to mV on CZ/ST + - drm/amd/powerplay: fixed uninitialized value + - drm/amd/pp/Polaris12: Fix a chunk of registers missed to program + - drm/edid: Quirk Vive Pro VR headset non-desktop. + - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo B50-80 + - drm/amd/display: fix type of variable + - drm/amd/display: Don't share clk source between DP and HDMI + - drm/amd/display: update clk for various HDMI color depths + - drm/amd/display: Use requested HDMI aspect ratio + - drm/amd/display: Report non-DP display as disconnected without EDID + - [armhf,arm64] drm/rockchip: lvds: add missing of_node_put + - [armhf,arm64] drm/rockchip: vop: split out core clock enablement into + separate functions + - [armhf,arm64] drm/rockchip: vop: fix irq disabled after vop driver probed + - drm/amd/display: Pass connector id when executing VBIOS CT + - drm/amd/display: Check if clock source in use before disabling + - drm/amdgpu: update tmr mc address + - drm/amdgpu:add tmr mc address into amdgpu_firmware_info + - drm/amdgpu:add new firmware id for VCN + - drm/amdgpu:add VCN support in PSP driver + - drm/amdgpu:add VCN booting with firmware loaded by PSP + - drm/amdgpu: fix incorrect use of fcheck + - drm/amdgpu: fix incorrect use of drm_file->pid + - [x86] drm/i915: Re-apply "Perform link quality check, unconditionally + during long pulse" + - uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member + name + - mm: respect arch_dup_mmap() return value + - [x86] drm/i915: set DP Main Stream Attribute for color range on DDI + platforms + - [i386] tsc: Prevent result truncation on 32bit + - drm/amdgpu: Keep track of amount of pinned CPU visible VRAM + - drm/amdgpu: Make pin_size values atomic + - drm/amdgpu: Warn and update pin_size values when destroying a pinned BO + - drm/amdgpu: Don't warn on destroying a pinned BO + - debugobjects: Make stack check warning more informative + - [i386] pae: use 64 bit atomic xchg function in native_ptep_get_and_clear + - [x86] xen: don't write ptes directly in 32-bit PV guests + - [x86] kvm: Set highest physical address bits in non-present/reserved SPTEs + - [x86] kvm: avoid unused variable warning + - HID: redragon: fix num lock and caps lock LEDs + + [ Ben Hutchings ] + * [x86] wireless: Enable R8822BE as module (Closes: #908330) + * Move all patch generation scripts to debian/bin + * [rt] genpatch-rt: Store patches and series file in debian/patches-rt + * linux-headers: Stop linking the doc directory, which is not binNMU-safe + * debian/copyright: Simplify exclusions to work with mk-origtargz + * debian/{watch,bin/uscan-hook}: Drop uscan hook in favour of uupdate + * debian/watch: Add options for signature validation + * README.Debian: Update URLs that were pointing to Alioth + * README.Debian: Describe where to find patches for a specific version + * Revert "i40e: Add kconfig dependency to ensure cmpxchg64() is available" + + [ Salvatore Bonaccorso ] + * mac80211: don't update the PM state of a peer upon a multicast frame + (Closes: #887045, #886292) + + [ Romain Perier ] + * [x86] Enable TI TPS6598x USB Power Delivery controller family + * [x86] crypto: ccp: add timeout support in the SEV command (Closes: #908248) + * [rt] Update to 4.18.7-rt5 + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 18 Sep 2018 03:05:01 +0100 + +linux (4.18.6-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.6 + - scsi: libsas: dynamically allocate and free ata host + - xprtrdma: Fix disconnect regression + - mei: don't update offset in write + - cifs: add missing support for ACLs in SMB 3.11 + - cifs: fix uninitialized ptr deref in smb2 signing + - cifs: add missing debug entries for kconfig options + - cifs: use a refcount to protect open/closing the cached file handle + - cifs: check kmalloc before use + - smb3: enumerating snapshots was leaving part of the data off end + - smb3: Do not send SMB3 SET_INFO if nothing changed + - smb3: don't request leases in symlink creation and query + - smb3: fill in statfs fsid and correct namelen + - btrfs: use correct compare function of dirty_metadata_bytes + - btrfs: don't leak ret from do_chunk_alloc + - Btrfs: fix mount failure after fsync due to hard link recreation + - Btrfs: fix btrfs_write_inode vs delayed iput deadlock + - Btrfs: fix send failure when root has deleted files still open + - Btrfs: send, fix incorrect file layout after hole punching beyond eof + - hwmon: (k10temp) 27C Offset needed for Threadripper2 + - [armhf] bpf: fix stack var offset in jit + - [armhf, arm64] iommu/arm-smmu: Error out only if not enough context + interrupts + - printk: Split the code for storing a message into the log buffer + - printk: Create helper function to queue deferred console handling + - printk/nmi: Prevent deadlock when accessing the main log buffer in NMI + - [arm64] kprobes: Fix %p uses in error messages + - [arm64] Fix mismatched cache line size detection + - [arm64] Handle mismatched cache type + - [arm64] mm: check for upper PAGE_SHIFT bits in pfn_valid() + - [arm64] dts: rockchip: corrected uart1 clock-names for rk3328 + - [armhf, arm64] KVM: Fix potential loss of ptimer interrupts + - [armhf, arm64] KVM: Fix lost IRQs from emulated physcial timer when + blocked + - [armhf, arm64] KVM: Skip updating PMD entry if no change + - [armhf, arm64] KVM: Skip updating PTE entry if no change + - [s390x] kvm: fix deadlock when killed by oom + - [s390x] perf kvm: Fix subcommands on s390 + - stop_machine: Reflow cpu_stop_queue_two_works() + - stop_machine: Atomically queue and wake stopper threads + - ext4: check for NUL characters in extended attribute's name + - ext4: use ext4_warning() for sb_getblk failure + - ext4: sysfs: print ext4_super_block fields as little-endian + - ext4: reset error code in ext4_find_entry in fallback + - ext4: fix race when setting the bitmap corrupted flag + - nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event + - [x86] gpu: reserve ICL's graphics stolen memory + - [x86] platform: wmi: Do not mix pages and kmalloc + - [x86] platform: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too + - mm: move tlb_table_flush to tlb_flush_mmu_free + - [x86] mm/tlb, mm: Support invalidating TLB caches for RCU_TABLE_FREE + - [x86] speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit + - [x86] speculation/l1tf: Fix off-by-one error when warning that system has + too much RAM (Closes: #907581) + - [x86] speculation/l1tf: Suggest what to do on systems with too much RAM + - [x86] vdso: Fix vDSO build if a retpoline is emitted + - [x86] process: Re-export start_thread() + - [x86] KVM: ensure all MSRs can always be KVM_GET/SET_MSR'd + - [x86] KVM: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts + disabled + - fuse: Don't access pipe->buffers without pipe_lock() + - fuse: fix initial parallel dirops + - fuse: fix double request_end() + - fuse: fix unlocked access to processing queue + - fuse: umount should wait for all requests + - fuse: Fix oops at process_init_reply() + - fuse: Add missed unlock_page() to fuse_readpages_fill() + - lib/vsprintf: Do not handle %pO[^F] as %px + - udl-kms: change down_interruptible to down + - udl-kms: handle allocation failure + - udl-kms: fix crash due to uninitialized memory + - udl-kms: avoid division + - b43legacy/leds: Ensure NUL-termination of LED name string + - b43/leds: Ensure NUL-termination of LED name string + - ASoC: dpcm: don't merge format from invalid codec dai + - ASoC: zte: Fix incorrect PCM format bit usages + - ASoC: sirf: Fix potential NULL pointer dereference + - ASoC: wm_adsp: Correct DSP pointer for preloader control + - [armhf] pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show() + - scsi: qla2xxx: Fix stalled relogin + - [x86] vdso: Fix lsl operand order + - [x86 ]nmi: Fix NMI uaccess race against CR3 switching + - [x86] irqflags: Mark native_restore_fl extern inline + - [x86] spectre: Add missing family 6 check to microcode check + - [x86] speculation/l1tf: Increase l1tf memory limit for Nehalem+ + (Closes: #907581) + - hwmon: (nct6775) Fix potential Spectre v1 + - [x86] entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit() + - [x86] Allow generating user-space headers without a compiler + - [s390x] mm: fix addressing exception after suspend/resume + - [s390x] lib: use expoline for all bcr instructions + - [s390x] fix br_r1_trampoline for machines without exrl + - [s390x] qdio: reset old sbal_state flags + - [s390x] numa: move initial setup of node_to_cpumask_map + - [s390x] pci: fix out of bounds access during irq setup + - [s390x] purgatory: Fix crash with expoline enabled + - [s390x] purgatory: Add missing FORCE to Makefile targets + - kprobes: Show blacklist addresses as same as kallsyms does + - kprobes: Replace %p with other pointer types + - kprobes/arm: Fix %p uses in error messages + - kprobes: Make list and blacklist root user read only + - [mips*] Correct the 64-bit DSP accumulator register size + - [mips*] memset.S: Fix byte_fixup for MIPSr6 + - [mips*] Always use -march=<arch>, not -<arch> shortcuts + - [mips*] Change definition of cpu_relax() for Loongson-3 + - [mips*] lib: Provide MIPS64r6 __multi3() for GCC < 7 + - tpm: Return the actual size when receiving an unsupported command + - tpm: separate cmd_ready/go_idle from runtime_pm + - scsi: mpt3sas: Fix calltrace observed while running IO & reset + - scsi: mpt3sas: Fix _transport_smp_handler() error path + - scsi: sysfs: Introduce sysfs_{un,}break_active_protection() + - scsi: core: Avoid that SCSI device removal through sysfs triggers a + deadlock + - iscsi target: fix session creation failure handling + - mtd: rawnand: hynix: Use ->exec_op() in hynix_nand_reg_write_op() + - mtd: rawnand: fsmc: Stop using chip->read_buf() + - mtd: rawnand: marvell: add suspend and resume hooks + - mtd: rawnand: qcom: wait for desc completion in all BAM channels + - [arm64] clk: rockchip: fix clk_i2sout parent selection bits on rk3399 + - PM / clk: signedness bug in of_pm_clk_add_clks() + - power: generic-adc-battery: fix out-of-bounds write when copying channel + properties + - power: generic-adc-battery: check for duplicate properties copied from + iio channels + - watchdog: Mark watchdog touch functions as notrace + - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status + - [x86] dumpstack: Don't dump kernel memory based on usermode RIP + + [ Ben Hutchings ] + * Set ABI to 1 + * [x86,arm64] Disable code signing for upload to unstable + * [rt] Re-enable PREEMPT_RT + * aufs: Update support patchset to aufs4.18-20180827 (no functional change) + * netfilter: Enable NF_TABLES_SET as module, replacing the multiple set + type modules that were enabled before 4.18 + * [powerpc,powerpcspe,ppc64] Build-Depend on updated kernel-wedge to fix + broken symlinks in kernel-image udeb + + [ Romain Perier ] + * [rt] Update to 4.18.5-rt3 + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 06 Sep 2018 15:32:14 +0100 + +linux (4.18.5-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.18 + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.1 + - [x86] paravirt: Fix spectre-v2 mitigations for paravirt guests + - [x86] speculation: Protect against userspace-userspace spectreRSB + - [x86] kprobes: Fix %p uses in error messages + - [x86] irqflags: Provide a declaration for native_save_fl + - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT + - [x86] speculation/l1tf: Change order of offset/type in swap entry + - [x86] speculation/l1tf: Protect swap entries against L1TF + - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation + - [x86] speculation/l1tf: Make sure the first page is always reserved + - [x86] speculation/l1tf: Add sysfs reporting for l1tf + - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE + mappings + - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 + - [x86] Move the l1tf function and define pr_fmt properly + - sched/smt: Update sched_smt_present at runtime + - [x86] smp: Provide topology_is_primary_thread() + - [x86] topology: Provide topology_smt_supported() + - cpu/hotplug: Make bringup/teardown of smp threads symmetric + - cpu/hotplug: Split do_cpu_down() + - cpu/hotplug: Provide knobs to control SMT + - [x86] cpu: Remove the pointless CPU printout + - [x86] cpu/AMD: Remove the pointless detect_ht() call + - [x86] cpu/common: Provide detect_ht_early() + - [x86] cpu/topology: Provide detect_extended_topology_early() + - [x86] cpu/intel: Evaluate smp_num_siblings early + - [x86] cpu/AMD: Do not check CPUID max ext level before parsing SMP info + - [x86] cpu/AMD: Evaluate smp_num_siblings early + - [x86] apic: Ignore secondary threads if nosmt=force + - [x86] speculation/l1tf: Extend 64bit swap file size limit + - [x86] cpufeatures: Add detection of L1D cache flush support. + - [x86] cpu/AMD: Move TOPOEXT reenablement before reading smp_num_siblings + - [x86] speculation/l1tf: Protect PAE swap entries against L1TF + - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE + - Revert "x86/apic: Ignore secondary threads if nosmt=force" + - cpu/hotplug: Boot HT siblings at least once + - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present + - [x86] KVM/VMX: Add module argument for L1TF mitigation + - [x86] KVM/VMX: Add L1D flush algorithm + - [x86] KVM/VMX: Add L1D MSR based flush + - [x86] KVM/VMX: Add L1D flush logic + - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest + numbers + - [x86] KVM/VMX: Add find_msr() helper function + - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting + - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs + - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required + - cpu/hotplug: Online siblings when SMT control is turned on + - [x86] litf: Introduce vmx status variable + - [x86] kvm: Drop L1TF MSR list approach + - [x86] l1tf: Handle EPT disabled state proper + - [x86] kvm: Move l1tf setup function + - [x86] kvm: Add static key for flush always + - [x86] kvm: Serialize L1D flush parameter setter + - [x86] kvm: Allow runtime control of L1D flush + - cpu/hotplug: Expose SMT control init function + - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early + - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations + - [x86] speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED + architectures + - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content + - cpu/hotplug: detect SMT disabled by BIOS + - [x86] KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush() + - [x86] KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond' + - [x86] KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() + - [x86] irq: Demote irq_cpustat_t::__softirq_pending to u16 + - [x86] KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d + - [x86] Don't include linux/irq.h from asm/hardirq.h + - [x86] irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d + - [x86] KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr() + - [x86] speculation: Simplify sysfs report of VMX L1TF vulnerability + - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry + - [x86] KVM/VMX: Tell the nested hypervisor to skip L1D flush on vmentry + - cpu/hotplug: Fix SMT supported evaluation + - [x86] speculation/l1tf: Invert all not present mappings + - [x86] speculation/l1tf: Make pmd/pud_mknotpresent() invert + - [x86] mm/pat: Make set_memory_np() L1TF safe + - [x86] mm/kmmio: Make the tracer robust against L1TF + - tools headers: Synchronise x86 cpufeatures.h for L1TF additions + - [x86] microcode: Allow late microcode loading with SMT disabled + - cpu/hotplug: Non-SMP machines do not make use of booted_once + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.2 + - [x86] l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled + - [x86] hyper-v: Check for VP_INVAL in hyperv_flush_tlb_others() + - [x86] platform/UV: Mark memblock related init code and data correctly + - [x86] mm/pti: Clear Global bit more aggressively + - [x86] xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits + - [x86] mm: Disable ioremap free page handling on x86-PAE + - crypto: ccp - Check for NULL PSP pointer at module unload + - crypto: ccp - Fix command completion detection race + - [x86] crypto: x86/sha256-mb - fix digest copy in + sha256_mb_mgr_get_comp_job_avx2() + - crypto: vmac - require a block cipher with 128-bit block size + - crypto: vmac - separate tfm and request context + - Bluetooth: hidp: buffer overflow in hidp_process_report (CVE-2018-9363) + - ioremap: Update pgtable free interfaces with addr + - [x86] mm: Add TLB purge to free pmd/pte page interfaces + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.3 + - [x86] speculation/l1tf: Exempt zeroed PTEs from inversion + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.4 + - l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache + - net_sched: fix NULL pointer dereference when delete tcindex filter + - net_sched: Fix missing res info when create new tc_index filter + - r8169: don't use MSI-X on RTL8168g + - ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs + - ALSA: hda - Turn CX8200 into D3 as well upon reboot + - ALSA: vx222: Fix invalid endian conversions + - ALSA: cs5535audio: Fix invalid endian conversion + - ALSA: dice: fix wrong copy to rx parameters for Alesis iO26 + - ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry + - ALSA: memalloc: Don't exceed over the requested size + - ALSA: vxpocket: Fix invalid endian conversions + - ALSA: seq: Fix poll() error return + - media: gl861: fix probe of dvb_usb_gl861 + - USB: serial: sierra: fix potential deadlock at close + - USB: serial: pl2303: add a new device id for ATEN + - USB: option: add support for DW5821e + - [x86] ACPI / PM: save NVS memory for ASUS 1025C laptop + - tty: serial: 8250: Revert NXP SC16C2552 workaround + - serial: 8250_exar: Read INT0 from slave device, too + - [x86, armhf, arm64] serial: 8250_dw: always set baud rate in + dw8250_set_termios + - [armhf, arm64] serial: 8250_dw: Add ACPI support for uart on Broadcom SoC + - uio: fix wrong return value from uio_mmap() + - Revert "uio: use request_threaded_irq instead" + - Bluetooth: avoid killing an already killed socket + - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() + - [x86] hv/netvsc: Fix NULL dereference at single queue mode fallback + - r8169: don't use MSI-X on RTL8106e + - ip_vti: fix a null pointer deferrence when create vti fallback tunnel + - [arm64] net: ethernet: mvneta: Fix napi structure mixup on armada 3700 + - [arm64] net: mvneta: fix mvneta_config_rss on armada 3700 + - cls_matchall: fix tcf_unbind_filter missing + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.5 + - [mips*, x86] EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] + - pty: fix O_CLOEXEC for TIOCGPTPEER + - mm: Allow non-direct-map arguments to free_reserved_area() + - [x86] mm/init: Pass unconverted symbol addresses to free_init_pages() + - [x86] mm/init: Add helper for freeing kernel image pages + - [x86] mm/init: Remove freed kernel image areas from alias mapping + - [powerpc64] Show ori31 availability in spectre_v1 sysfs file not v2 + - ext4: fix spectre gadget in ext4_mb_regular_allocator() + - [x86] drm/i915/kvmgt: Fix potential Spectre v1 + - drm/amdgpu/pm: Fix potential Spectre v1 + - [hppa/parisc] Remove unnecessary barriers from spinlock.h + - [hppa/parisc] Remove ordered stores from syscall.S + - PCI: Restore resized BAR state on resume + - PCI/ACPI/PM: Resume all bridges on suspend-to-RAM + - PCI: hotplug: Don't leak pci_slot on registration failure + - [arm64] PCI: aardvark: Size bridges before resources allocation + - PCI: Skip MPS logic for Virtual Functions (VFs) + - PCI: pciehp: Fix use-after-free on unplug + - PCI: pciehp: Fix unprotected list iteration in IRQ handler + - i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes + - [armhf] i2c: imx: Fix race condition in dma read + - reiserfs: fix broken xattr handling (heap corruption, bad retval) + + [ Uwe Kleine-König ] + * [arm64] enable RTC_DRV_PCF8563 for Odroid-C2 + + [ Romain Perier ] + * [armhf, arm64] add the rt featureset, which adds support for + PREEMPT_RT (Closes #719547) + * spi: Enable CONFIG_SPI_SPIDEV (Closes: #904043) + + [ Ben Hutchings ] + * certs: Remove certificate for my personal signing key + * Update policy version to 4.2.0: + - linux-kbuild: Change "#!/usr/bin/env perl" to "#!/usr/bin/perl" + - Build with KBUILD_VERBOSE=1 by default + - objtool, usbip: Build with V=1 by default + * cpupower: Fix handling of noopt and nostrip build options + * debian/bin/gencontrol_signed.py: Add certificate fingerprints to template + metadata + * scripts/kernel-doc: Escape all literal braces in regexes (Closes: #905116) + * debian/bin/genorig.py: Add support for debian/copyright Files-Excluded + field + * Move file exclusion from d/p/debian/dfsg/files-1 to d/copyright + * Move disabling of broken features from d/p/series-orig to d/p/series + * Remove our private patch system, which is no longer needed + * debian/bin: Change "#!/usr/bin/env python3" to "#!/usr/bin/python3" + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 26 Aug 2018 20:52:17 +0100 + +linux (4.18~rc5-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ John Paul Adrian Glaubitz ] + * [m68k] net: Enable CONFIG_XSURF100 as module. + * [m68k] udeb: Remove individual modules from nic-modules. + * [m68k] scsi: Enable CONFIG_SCSI_ZORRO_ESP as module. + * [m68k] udeb: Add zorro_esp module to scsi-modules. + + [ Ben Hutchings ] + * [powerpcspe] powerpc/Makefile: Assemble with -me500 when building for E500 + (fixes FTBFS) (thanks to James Clarke) + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 19 Jul 2018 16:16:23 +0100 + +linux (4.18~rc4-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * Remove remaining Python 2 (build-)dependencies: + - Build docs using Python 3 version of Sphinx + - linux-perf: Build docs using asciidoctor + - linux-perf: Use Python 3 for scripts + * autofs: rename 'autofs' module back to 'autofs4' (Closes: #902946) + * udeb: Move of_mdio to nic-shared-modules (Closes: #903587) + * [armhf] mm: Export __sync_icache_dcache() for xen-privcmd (fixes FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 12 Jul 2018 05:12:50 +0100 + +linux (4.18~rc3-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * aufs: Update to aufs4.x-rcN 20180702 + * netfilter: ipvs: Fix invalid bytes in IP_VS_MH_TAB_INDEX help text + * Update config for 4.18 using kconfigeditor2 + - [x86,arm64] PCI: HOTPLUG_PCI_SHPC is now built-in + * Move config files from linux-source-<version> to an arch-dependent + linux-config-<version> package + * lockdep: Stub task_struct::state + * [sh4] udeb: Add nic-shared-modules package + * udeb: Moved fixed_phy to nic-shared-modules + + [ YunQiang Su ] + * [mips*r6*] Enable dtb building for boston. + * [mips*r6*/mipsn32*] build linux-perf in rules.real. + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 03 Jul 2018 17:26:05 +0100 + +linux (4.17.17-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.16 + - [x86] platform/UV: Mark memblock related init code and data correctly + - [x86] mm/pti: Clear Global bit more aggressively + - [x86] xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits + - [x86] mm: Disable ioremap free page handling on x86-PAE + - kbuild: verify that $DEPMOD is installed + - [x86] crypto: ccp - Check for NULL PSP pointer at module unload + - [x86] crypto: ccp - Fix command completion detection race + - crypto: vmac - require a block cipher with 128-bit block size + - crypto: vmac - separate tfm and request context + - crypto: blkcipher - fix crash flushing dcache in error path + - crypto: ablkcipher - fix crash flushing dcache in error path + - crypto: skcipher - fix aligning block size in skcipher_copy_iv() + - crypto: skcipher - fix crash flushing dcache in error path + - ioremap: Update pgtable free interfaces with addr + - [x86] mm: Add TLB purge to free pmd/pte page interfaces + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.17 + - [x86] speculation/l1tf: Exempt zeroed PTEs from inversion + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 18 Aug 2018 14:02:58 +0200 + +linux (4.17.15-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.15 + - [hppa/parisc] Enable CONFIG_MLONGCALLS by default + - [hppa/parisc] Define mb() and add memory barriers to assembler unlock + sequences + - Mark HI and TASKLET softirq synchronous + - stop_machine: Disable preemption after queueing stopper threads + - sched/deadline: Update rq_clock of later_rq when pushing a task + - zram: remove BD_CAP_SYNCHRONOUS_IO with writeback feature + - xen/netfront: don't cache skb_shinfo() + - bpf, sockmap: fix leak in bpf_tcp_sendmsg wait for mem path + - bpf, sockmap: fix bpf_tcp_sendmsg sock error handling + - scsi: sr: Avoid that opening a CD-ROM hangs with runtime power + management enabled + - scsi: qla2xxx: Fix memory leak for allocating abort IOCB + - init: rename and re-order boot_cpu_state_init() + - root dentries need RCU-delayed freeing + - make sure that __dentry_kill() always invalidates d_seq, unhashed or not + - fix mntput/mntput race + - fix __legitimize_mnt()/mntput() race + - [armhf] dts: imx6sx: fix irq for pcie bridge + - [x86] paravirt: Fix spectre-v2 mitigations for paravirt guests + - [x86] speculation: Protect against userspace-userspace spectreRSB + - [x86] kprobes/x86: Fix %p uses in error messages + - [x86] irqflags: Provide a declaration for native_save_fl + - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT + - [x86] speculation/l1tf: Change order of offset/type in swap entry + - [x86] speculation/l1tf: Protect swap entries against L1TF + - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation + - [x86] speculation/l1tf: Make sure the first page is always reserved + - [x86] speculation/l1tf: Add sysfs reporting for l1tf + - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE + mappings + - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 + - [x86] bugs: Move the l1tf function and define pr_fmt properly + - sched/smt: Update sched_smt_present at runtime + - [x86] smp: Provide topology_is_primary_thread() + - [x86] topology: Provide topology_smt_supported() + - cpu/hotplug: Make bringup/teardown of smp threads symmetric + - cpu/hotplug: Split do_cpu_down() + - cpu/hotplug: Provide knobs to control SMT + - [x86] cpu: Remove the pointless CPU printout + - [x86] cpu/AMD: Remove the pointless detect_ht() call + - [x86] cpu/common: Provide detect_ht_early() + - [x86] cpu/topology: Provide detect_extended_topology_early() + - [x86] cpu/intel: Evaluate smp_num_siblings early + - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info + - [x86] cpu/AMD: Evaluate smp_num_siblings early + - [x86] apic: Ignore secondary threads if nosmt=force + - [x86] speculation/l1tf: Extend 64bit swap file size limit + - [x86] cpufeatures: Add detection of L1D cache flush support. + - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings + - [x86] speculation/l1tf: Protect PAE swap entries against L1TF + - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE + - Revert "[x86] apic: Ignore secondary threads if nosmt=force" + - cpu/hotplug: Boot HT siblings at least once + - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present + - [x86] KVM/VMX: Add module argument for L1TF mitigation + - [x86] KVM/VMX: Add L1D flush algorithm + - [x86] KVM/VMX: Add L1D MSR based flush + - [x86] KVM/VMX: Add L1D flush logic + - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest + numbers + - [x86] KVM/VMX: Add find_msr() helper function + - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting + - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs + - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required + - cpu/hotplug: Online siblings when SMT control is turned on + - [x86] litf: Introduce vmx status variable + - [x86] kvm: Drop L1TF MSR list approach + - [x86] l1tf: Handle EPT disabled state proper + - [x86] kvm: Move l1tf setup function + - [x86] kvm: Add static key for flush always + - [x86] kvm: Serialize L1D flush parameter setter + - [x86] kvm: Allow runtime control of L1D flush + - cpu/hotplug: Expose SMT control init function + - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early + - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations + - Documentation: Add section about CPU vulnerabilities + - [x86] speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED + architectures + - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content + - Documentation/l1tf: Fix typos + - cpu/hotplug: detect SMT disabled by BIOS + - [x86] KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush() + - [x86] KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond' + - [x86] KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() + - [x86] irq: Demote irq_cpustat_t::__softirq_pending to u16 + - [x86] KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d + - [x86] Don't include linux/irq.h from asm/hardirq.h + - [x86] irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d + - [x86] KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr() + - Documentation/l1tf: Remove Yonah processors from not vulnerable list + - [x86] speculation: Simplify sysfs report of VMX L1TF vulnerability + - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry + - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry + - cpu/hotplug: Fix SMT supported evaluation + - [x86] speculation/l1tf: Invert all not present mappings + - [x86] speculation/l1tf: Make pmd/pud_mknotpresent() invert + - [x86] mm/pat: Make set_memory_np() L1TF safe + - [x86] mm/kmmio: Make the tracer robust against L1TF + - tools headers: Synchronize prctl.h ABI header + - tools headers: Synchronise x86 cpufeatures.h for L1TF additions + - [x86] microcode: Allow late microcode loading with SMT disabled + - [x86] smp: fix non-SMP broken build due to redefinition of + apic_id_is_primary_thread + - cpu/hotplug: Non-SMP machines do not make use of booted_once + - [x86] init: fix build with CONFIG_SWAP=n + - [x86] CPU/AMD: Have smp_num_siblings and cpu_llc_id always be present + + [ Ben Hutchings ] + * serdev: Enable SERIAL_DEV_BUS, SERIAL_DEV_CTRL_TTYPORT as built-in + (except on armel) + - bluetooth: Re-enable BT_HCIUART_{BCM,LL} (Closes: #906048) + * drivers/net/phy: Enable SFP as module (Closes: #906054) + * Revert "net: increase fragment memory usage limits" (CVE-2018-5391) + + [ Salvatore Bonaccorso ] + * [x86] l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled + * [x86] i8259: Add missing include file + * Bluetooth: hidp: buffer overflow in hidp_process_report (CVE-2018-9363) + * Bump ABI to 3 + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 17 Aug 2018 05:11:43 +0200 + +linux (4.17.14-1) unstable; urgency=high + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.9 + - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations + - [x86] asm: Add _ASM_ARG* constants for argument registers to <asm/asm.h> + - [x86] paravirt: Make native_save_fl() extern inline + - alx: take rtnl before calling __alx_open from resume + - atm: Preserve value of skb->truesize when accounting to vcc + - atm: zatm: Fix potential Spectre v1 + - [x86] hv_netvsc: split sub-channel setup into async and sync + - ipv6: sr: fix passing wrong flags to crypto_alloc_shash() + - ipvlan: fix IFLA_MTU ignored on NEWLINK + - ixgbe: split XDP_TX tail and XDP_REDIRECT map flushing + - net: dccp: avoid crash in ccid3_hc_rx_send_feedback() + - net: dccp: switch rx_tstamp_last_feedback to monotonic clock + - net: fix use-after-free in GRO with ESP + - net/mlx5e: Avoid dealing with vport representors if not being e-switch + manager + - net/mlx5e: Don't attempt to dereference the ppriv struct if not being + eswitch manager + - net/mlx5: E-Switch, Avoid setup attempt if not being e-switch manager + - net/mlx5: Fix command interface race in polling mode + - net/mlx5: Fix incorrect raw command length parsing + - net/mlx5: Fix required capability for manipulating MPFS + - net/mlx5: Fix wrong size allocation for QoS ETC TC regitster + - [armhf, arm64] net: mvneta: fix the Rx desc DMA address in the Rx path + - net/packet: fix use-after-free + - net/sched: act_ife: fix recursive lock and idr leak + - net/sched: act_ife: preserve the action control in case of error + - net_sched: blackhole: tell upper qdisc about dropped packets + - net: sungem: fix rx checksum support + - net/tcp: Fix socket lookups with SO_BINDTODEVICE + - qede: Adverstise software timestamp caps when PHC is not available. + - qed: Fix setting of incorrect eswitch mode. + - qed: Fix use of incorrect size in memcpy call. + - qed: Limit msix vectors in kdump kernel to the minimum required count. + - qmi_wwan: add support for the Dell Wireless 5821e module + - r8152: napi hangup fix after disconnect + - [s390x] qeth: don't clobber buffer on async TX completion + - [armhf, arm64] stmmac: fix DMA channel hang in half-duplex mode + - tcp: fix Fast Open key endianness + - tcp: prevent bogus FRTO undos with non-SACK flows + - vhost_net: validate sock before trying to put its fd + - VSOCK: fix loopback on big-endian systems + - nfp: flower: fix mpls ether type detection + - net: use dev_change_tx_queue_len() for SIOCSIFTXQLEN + - nfp: reject binding to shared blocks + - xen-netfront: Fix mismatched rtnl_unlock + - xen-netfront: Update features after registering netdev + - enic: do not overwrite error code + - i40e: split XDP_TX tail and XDP_REDIRECT map flushing + - IB/mlx5: Avoid dealing with vport representors if not being e-switch + manager + - [s390x] Revert "s390/qeth: use Read device to query hypervisor for MAC" + - [s390x] qeth: avoid using is_multicast_ether_addr_64bits on (u8 *)[6] + - [s390x] qeth: fix race when setting MAC address + - sfc: correctly initialise filter rwsem for farch + - virtio_net: split XDP_TX kick and XDP_REDIRECT map flushing + - [x86] kvm/Kconfig: Ensure CRYPTO_DEV_CCP_DD state at minimum matches + KVM_AMD + - net: cxgb3_main: fix potential Spectre v1 + - net: lan78xx: Fix race in tx pending skb size calculation + - [x86] PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg() + - netfilter: ebtables: reject non-bridge targets + - reiserfs: fix buffer overflow with long warning messages + - KEYS: DNS: fix parsing multiple options + - tls: Stricter error checking in zerocopy sendmsg path + - autofs: fix slab out of bounds read in getname_kernel() + - netfilter: ipv6: nf_defrag: drop skb dst before queueing + - bpf: reject any prog that failed read-only lock + - rds: avoid unenecessary cong_update in loop transport + - block: don't use blocking queue entered for recursive bio submits + - bpf: sockmap, fix crash when ipv6 sock is added + - bpf: sockmap, consume_skb in close path + - bpf: don't leave partial mangled prog in jit_subprogs error path + - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. + - ipvs: initialize tbl->entries after allocation + - ipvs: initialize tbl->entries in ip_vs_lblc_init_svc() + - [armhf, arm64] smccc: Add SMCCC-specific return codes + - [arm64] Add 'ssbd' command-line option + - [arm64] ssbd: Add global mitigation state accessor + - [arm64] ssbd: Skip apply_ssbd if not using dynamic mitigation + - [arm64] ssbd: Restore mitigation status on CPU resume + - [arm64] ssbd: Introduce thread flag to control userspace mitigation + - [arm64] ssbd: Add prctl interface for per-thread mitigation + - [arm64] KVM: Add HYP per-cpu accessors + ARCH_FEATURES_FUNC_ID + - bpf: enforce correct alignment for instructions + - [armhf] bpf: fix to use bpf_jit_binary_lock_ro api + - bpf: undo prog rejection on read-only lock failure + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.10 + - scsi: sd_zbc: Fix variable type and bogus comment + - scsi: qla2xxx: Fix inconsistent DMA mem alloc/free + - scsi: qla2xxx: Fix kernel crash due to late workqueue allocation + - scsi: qla2xxx: Fix NULL pointer dereference for fcport search + - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in + parallel. + - KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer + - [x86] KVM: VMX: Mark VMXArea with revision_id of physical CPU even when + eVMCS enabled + - [x86] kvm/vmx: don't read current->thread.{fs,gs}base of legacy tasks + - [x86] kvmclock: set pvti_cpu0_va after enabling kvmclock + - [x86] apm: Don't access __preempt_count with zeroed fs + - [x86] events/intel/ds: Fix bts_interrupt_threshold alignment + - [x86] MCE: Remove min interval polling limitation + - fat: fix memory allocation failure handling of match_strdup() + - ALSA: rawmidi: Change resized buffers atomically + - [x86] ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk + - [x86] ALSA: hda/realtek - Yet another Clevo P950 quirk entry + - [x86] ALSA: hda: add mute led support for HP ProBook 455 G5 + - mm: memcg: fix use after free in mem_cgroup_iter() + - mm/huge_memory.c: fix data loss when splitting a file pmd + - [x86] cpufreq: intel_pstate: Register when ACPI PCCH is present + - [x86, arm64, powerpc*] vfio/pci: Fix potential Spectre v1 + - stop_machine: Disable preemption when waking two stopper threads + - [powerpc*] powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from + stop (idle) + - drm/amdgpu: Reserve VM root shared fence slot for command submission (v3) + - [x86] drm/i915: Fix hotplug irq ack on i965/g4x + - Revert "drm/amd/display: Don't return ddc result and read_bytes in same + return value" + - [x86] drm/nouveau: Remove bogus crtc check in pmops_runtime_idle + - [x86] drm/nouveau: Use drm_connector_list_iter_* for iterating connectors + - [x86] drm/nouveau: Avoid looping through fake MST connectors + - gen_stats: Fix netlink stats dumping in the presence of padding + - ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns + - ipv6: fix useless rol32 call on hash + - ipv6: ila: select CONFIG_DST_CACHE + - lib/rhashtable: consider param->min_size when setting initial table size + - net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort + - net: Don't copy pfmemalloc flag in __copy_skb_header() + - skbuff: Unconditionally copy pfmemalloc in __skb_clone() + - net/ipv4: Set oif in fib_compute_spec_dst + - net/ipv6: Do not allow device only routes via the multipath API + - net: phy: fix flag masking in __set_phy_supported + - qmi_wwan: add support for Quectel EG91 + - rhashtable: add restart routine in rhashtable_free_and_destroy() + - sch_fq_codel: zero q->flows_cnt when fq_codel_init fails + - tg3: Add higher cpu clock for 5762. + - net: ip6_gre: get ipv6hdr after skb_cow_head() + - sctp: introduce sctp_dst_mtu + - sctp: fix the issue that pathmtu may be set lower than MINSEGMENT + - [x86] hv_netvsc: Fix napi reschedule while receive completion is busy + - net: aquantia: vlan unicast address list correct handling + - net/mlx4_en: Don't reuse RX page when XDP is set + - ipv6: make DAD fail with enhanced DAD when nonce length differs + - net: usb: asix: replace mii_nway_restart in resume path + - [alpha] fix osf_wait4() breakage + - drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open() + - xhci: Fix perceived dead host due to runtime suspend race with event + handler + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.11 + - [x86] KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR + - [x86] Revert "iommu/intel-iommu: Enable CONFIG_DMA_DIRECT_OPS=y and clean + up intel_{alloc,free}_coherent()" + - [mips*] Fix off-by-one in pci_resource_to_user() + - [arm64] clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz + to 1.2GHz + - [x86] xen/PVH: Set up GS segment for stack canary + - [x86] drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit() + - [x86] drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs + - [arm64] clk: meson-gxbb: set fclk_div2 as CLK_IS_CRITICAL + - bonding: set default miimon value for non-arp modes if not set + - ip: hash fragments consistently + - ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull + - net: dsa: mv88e6xxx: fix races between lock and irq freeing + - net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper + - net-next/hinic: fix a problem in hinic_xmit_frame() + - net: skb_segment() should not return NULL + - tcp: fix dctcp delayed ACK schedule + - tcp: helpers to send special DCTCP ack + - tcp: do not cancel delay-AcK on DCTCP special ACK + - tcp: do not delay ACK in DCTCP upon CE status change + - net/mlx5: E-Switch, UBSAN fix undefined behavior in mlx5_eswitch_mode + - r8169: restore previous behavior to accept BIOS WoL settings + - tls: check RCV_SHUTDOWN in tls_wait_data + - net/mlx5e: Add ingress/egress indication for offloaded TC flows + - net/mlx5e: Only allow offloading decap egress (egdev) flows + - net/mlx5e: Refine ets validation function + - nfp: flower: ensure dead neighbour entries are not offloaded + - sock: fix sg page frag coalescing in sk_alloc_sg + - net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv + - multicast: do not restore deleted record source filter mode to new one + - net/ipv6: Fix linklocal to global address with VRF + - net/mlx5e: Don't allow aRFS for encapsulated packets + - net/mlx5e: Fix quota counting in aRFS expire flow + - net/mlx5: Adjust clock overflow work period + - rtnetlink: add rtnl_link_state check in rtnl_configure_link + - vxlan: add new fdb alloc and create helpers + - vxlan: make netlink notify in vxlan_fdb_destroy optional + - vxlan: fix default fdb entry netlink notify ordering during netdev create + - tcp: free batches of packets in tcp_prune_ofo_queue() + CVE-2018-5390 + - tcp: avoid collapses in tcp_prune_queue() if possible + - tcp: detect malicious patterns in tcp_collapse_ofo_queue() + - tcp: call tcp_drop() from tcp_data_queue_ofo() + - tcp: add tcp_ooo_try_coalesce() helper + - Revert "staging:r8188eu: Use lib80211 to support TKIP" + - staging: speakup: fix wraparound in uaccess length check + - usb: cdc_acm: Add quirk for Castles VEGA3000 + - usb: core: handle hub C_PORT_OVER_CURRENT condition + - [armhf, arm64] usb: dwc2: Fix DMA alignment to start at allocated boundary + - [armhf, arm64] usb: xhci: Fix memory leak in xhci_endpoint_reset() + - [x86, arm64] ACPICA: AML Parser: ignore dispatcher error status during + table load + - driver core: Partially revert "driver core: correct device's shutdown + order" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.12 + - Input: elan_i2c - add ACPI ID for lenovo ideapad 330 + - Input: i8042 - add Lenovo LaVie Z to the i8042 reset list + - Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST + - mm: disallow mappings that conflict for devm_memremap_pages() + - kvm, mm: account shadow page tables to kmemcg + - delayacct: fix crash in delayacct_blkio_end() after delayacct init failure + - tracing: Fix double free of event_trigger_data + - tracing: Fix possible double free in event_enable_trigger_func() + - kthread, tracing: Don't expose half-written comm when creating kthreads + - tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure + - tracing: Quiet gcc warning about maybe unused link variable + - [arm64] fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups + - [x86] drm/i915/glk: Add Quirk for GLK NUC HDMI port issues. + - kcov: ensure irq code sees a valid area + - mm: check for SIGKILL inside dup_mmap() loop + - drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2) + - xen/netfront: raise max number of slots in xennet_get_responses() + - [x86] hv_netvsc: fix network namespace issues with VF support + - skip LAYOUTRETURN if layout is invalid + - ixgbe: Fix setting of TC configuration for macvlan case + - ALSA: emu10k1: add error handling for snd_ctl_add + - ALSA: fm801: add error handling for snd_ctl_add + - NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY + - nfsd: fix error handling in nfs4_set_delegation() + - nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo + - vfio: platform: Fix reset module leak in error path + - vfio/mdev: Check globally for duplicate devices + - vfio/type1: Fix task tracking for QEMU vCPU hotplug + - kernel/hung_task.c: show all hung tasks before panic + - mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the + same cacheline + - mm: /proc/pid/pagemap: hide swap entries from unprivileged users + - mm: vmalloc: avoid racy handling of debugobjects in vunmap + - mm/slub.c: add __printf verification to slab_err() + - rtc: ensure rtc_set_alarm fails when alarms are not supported + - rxrpc: Fix terminal retransmission connection ID to include the channel + - [arm64] net: hns3: Fix for VF mailbox cannot receiving PF response + - perf tools: Fix pmu events parsing rule + - netfilter: ipset: forbid family for hash:mac sets + - netfilter: ipset: List timing out entries with "timeout 1" instead of zero + - printk: drop in_nmi check from printk_safe_flush_on_panic() + - [armhf] bpf: fix inconsistent naming about emit_a32_lsr_{r64,i64} + - ceph: fix alignment of rasize + - ceph: fix use-after-free in ceph_statfs() + - e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes + - infiniband: fix a possible use-after-free bug (CVE-2018-14734) + - [powerpc*] lib: Adjust .balign inside string functions for PPC32 + - [powerpc*] 64s: Add barrier_nospec + - [powerpc*] eeh: Fix use-after-release of EEH driver + - [powerpc*] 64s: Fix compiler store ordering to SLB shadow area + - [arm64] net: hns3: Fix for phy not link up problem after resetting + - [arm64] net: hns3: Fix for service_task not running problem after + resetting + - RDMA/mad: Convert BUG_ONs to error flows + - lightnvm: fix partial read error path + - lightnvm: proper error handling for pblk_bio_add_pages + - lightnvm: pblk: warn in case of corrupted write buffer + - netfilter: nf_tables: check msg_type before nft_trans_set(trans) + - pnfs: Don't release the sequence slot until we've processed layoutget on + open + - NFS: Fix up nfs_post_op_update_inode() to force ctime updates + - disable loading f2fs module on PAGE_SIZE > 4KB + - f2fs: fix error path of move_data_page + - f2fs: don't drop dentry pages after fs shutdown + - f2fs: fix to don't trigger writeback during recovery + - f2fs: fix to wait page writeback during revoking atomic write + - f2fs: Fix deadlock in shutdown ioctl + - f2fs: fix missing clear FI_NO_PREALLOC in some error case + - f2fs: fix to detect failure of dquot_initialize + - f2fs: fix race in between GC and atomic open + - block, bfq: remove wrong lock in bfq_requests_merged + - usbip: usbip_detach: Fix memory, udev context and udev leak + - usbip: dynamically allocate idev by nports found in sysfs + - [x86] perf/x86/intel/uncore: Correct fixed counter index check in + generic code + - [x86] perf/x86/intel/uncore: Correct fixed counter index check for NHM + - PCI: Fix devm_pci_alloc_host_bridge() memory leak + - btrfs: balance dirty metadata pages in btrfs_finish_ordered_io + - iwlwifi: pcie: fix race in Rx buffer allocator + - iwlwifi: mvm: open BA session only when sta is authorized + - Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning + - drm/amd/display: Do not program interrupt status on disabled crtc + - Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 + - ASoC: dpcm: fix BE dai not hw_free and shutdown + - mfd: cros_ec: Fail early if we cannot identify the EC + - mwifiex: handle race during mwifiex_usb_disconnect + - wlcore: sdio: check for valid platform device data before suspend + - [arm64] net: hns3: Fixes initalization of RoCE handle and makes it + conditional + - [arm64] net: hns3: Fixes the init of the VALID BD info in the descriptor + - media: tw686x: Fix incorrect vb2_mem_ops GFP flags + - media: cec-pin-error-inj: avoid a false-positive Spectre detection + - media: videobuf2-core: don't call memop 'finish' when queueing + - Btrfs: don't return ino to ino cache if inode item removal fails + - Btrfs: don't BUG_ON() in btrfs_truncate_inode_items() + - btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups + - btrfs: qgroup: Finish rescan when hit the last leaf of extent tree + - [x86] microcode: Make the late update update_lock a raw lock for RT + - PM / wakeup: Make s2idle_lock a RAW_SPINLOCK + - PCI: Prevent sysfs disable of device while driver is attached + - [arm64] soc: qcom: qmi: fix a buffer sizing bug + - [arm64] soc: qcom: smem: fix qcom_smem_set_global_partition() + - [arm64] soc: qcom: smem: byte swap values properly + - nvme-rdma: stop admin queue before freeing it + - nvme-pci: Fix AER reset handling + - ath: Add regulatory mapping for : FCC3_ETSIC, ETSI8_WORLD, APL13_WORLD, + APL2_FCCA, Uganda, Tanzania, Serbia, Bermuda and Bahamas + - sched/cpufreq: Modify aggregate utilization to always include blocked FAIR + utilization + - [powerpc*] Add a missing include header + - [powerpc*] chrp/time: Make some functions static, add missing header + include + - [powerpc*] powermac: Add missing prototype for note_bootable_part() + - [powerpc*] powermac: Mark variable x as unused + - powerpc: Add __printf verification to prom_printf + - [x86] KVM: prevent integer overflows in KVM_MEMORY_ENCRYPT_REG_REGION + - [powerpc*] 8xx: fix invalid register expression in head_8xx.S + - [arm64] pinctrl: msm: fix gpio-hog related boot issues + - bpf: fix multi-function JITed dump obtained via syscall + - [powerpc*] bpf: pad function address loads with NOPs + - PCI: pciehp: Request control of native hotplug only if supported + - mwifiex: correct histogram data with appropriate index + - ima: based on policy verify firmware signatures (pre-allocated buffer) + - spi: Add missing pm_runtime_put_noidle() after failed get + - [arm64] net: hns3: Fix for CMDQ and Misc. interrupt init order problem + - [arm64] net: hns3: Fix the missing client list node initialization + - [arm64] net: hns3: Fix for hns3 module is loaded multiple times problem + - fscrypt: use unbound workqueue for decryption + - [armhf, arm64] net: mvpp2: Add missing VLAN tag detection + - scsi: ufs: ufshcd: fix possible unclocked register access + - scsi: ufs: fix exception event handling + - [s390x] scsi: zfcp: assert that the ERP lock is held when tracing a + recovery trigger + - drm/nouveau: remove fence wait code from deferred client work handler + - drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl + - drm/nouveau/fifo/gk104-: poll for runlist update completion + - Bluetooth: btusb: add ID for LiteOn 04ca:301a + - rtc: tps6586x: fix possible race condition + - rtc: vr41xx: fix possible race condition + - rtc: tps65910: fix possible race condition + - ALSA: emu10k1: Rate-limit error messages about page errors + - regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops + - md/raid1: add error handling of read error from FailFast device + - md: fix NULL dereference of mddev->pers in remove_and_add_spares() + - ixgbevf: fix MAC address changes through ixgbevf_set_mac() + - gpu: host1x: Acquire a reference to the IOVA cache + - media: smiapp: fix timeout checking in smiapp_read_nvm + - PCI/DPC: Clear interrupt status in interrupt handler top half + - clocksource: Move inline keyword to the beginning of function declarations + - net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value + - ALSA: usb-audio: Apply rate limit to warning messages in URB complete + callback + - [arm64] net: hns3: Fix for fiber link up problem + - media: atomisp: ov2680: don't declare unused vars + - media: staging: atomisp: Comment out several unused sensor resolutions + - [arm64] cmpwait: Clear event register before arming exclusive monitor + - HID: hid-plantronics: Re-resend Update to map button for PTT products + - drm/amd/display: remove need of modeset flag for overlay planes (V2) + - drm/radeon: fix mode_valid's return type + - drm/amdgpu: Remove VRAM from shared bo domains. + - drm/amd/display: Fix dim display on DCE11 + - IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS + - [powerpc*] embedded6xx/hlwd-pic: Prevent interrupts from being handled by + Starlet + - HID: i2c-hid: check if device is there before really probing + - rsi: Add null check for virtual interfaces in wowlan config + - nvmem: properly handle returned value nvmem_reg_read + - [armhf] ARM: dts: imx53: Fix LDB OF graph warning + - i40e: free the skb after clearing the bitlock + - tty: Fix data race in tty_insert_flip_string_fixed_flag + - dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA + - net: phy: phylink: Release link GPIO + - media: rcar_jpu: Add missing clk_disable_unprepare() on error in + jpu_open() + - libata: Fix command retry decision + - ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 + - media: media-device: fix ioctl function types + - media: saa7164: Fix driver name in debug output + - media: em28xx: Fix DualHD broken second tuner + - mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter + pages + - brcmfmac: Add support for bcm43364 wireless chipset + - [s390x] cpum_sf: Add data entry sizes to sampling trailer entry + - perf: fix invalid bit in diagnostic entry + - net: phy: sfp: handle cases where neither BR, min nor BR, max is given + - bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only. + - bnxt_en: Always forward VF MAC address to the PF. + - mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is + enabled + - staging: most: cdev: fix chrdev_region leak + - scsi: 3w-9xxx: fix a missing-check bug + - scsi: 3w-xxxx: fix a missing-check bug + - scsi: megaraid: silence a static checker bug + - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw + - soc/tegra: pmc: Don't allocate struct tegra_powergate on stack + - scsi: qedf: Set the UNLOADING flag when removing a vport + - dma-direct: try reallocation with GFP_DMA32 if possible + - staging: lustre: o2iblnd: fix race at kiblnd_connect_peer + - staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5 + - thermal: exynos: fix setting rising_threshold for Exynos5433 + - regulator: add dummy function of_find_regulator_by_node + - bpf: fix references to free_bpf_prog_info() in comments + - f2fs: avoid fsync() failure caused by EAGAIN in writepage() + - media: em28xx: fix a regression with HVR-950 + - media: siano: get rid of __le32/__le16 cast warnings + - mt76x2: fix avg_rssi estimation + - drm/atomic: Handling the case when setting old crtc for plane + - mmc: sdhci-omap: Fix when capabilities are obtained from + SDHCI_CAPABILITIES reg + - f2fs: check cap_resource only for data blocks + - mlxsw: spectrum_router: Return an error for non-default FIB rules + - ALSA: hda/ca0132: fix build failure when a local macro is defined + - mmc: dw_mmc: update actual clock for mmc debugfs + - mmc: pwrseq: Use kmalloc_array instead of stack VLA + - [arm64] dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC + - [armhf] spi: meson-spicc: Fix error handling in meson_spicc_probe() + - [arm64] net: hns3: Fixes the out of bounds access in hclge_map_tqp + - dt-bindings: net: meson-dwmac: new compatible name for AXG SoC + - i40e: Add advertising 10G LR mode + - i40e: avoid overflow in i40e_ptp_adjfreq() + - mt76: add rcu locking around tx scheduling + - backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction + - stop_machine: Use raw spinlocks + - delayacct: Use raw_spinlocks + - ath10k: fix kernel panic while reading tpc_stats + - memory: tegra: Do not handle spurious interrupts + - memory: tegra: Apply interrupts mask per SoC + - nvme: lightnvm: add granby support + - ASoC: fsl_ssi: Use u32 variable type when using regmap_read() + - ASoC: compress: Only call free for components which have been opened + - igb: Fix queue selection on MAC filters on i210 + - qtnfmac: pearl: pcie: fix memory leak in qtnf_fw_work_handler + - drm/gma500: fix psb_intel_lvds_mode_valid()'s return type + - ipconfig: Correctly initialise ic_nameservers + - rsi: Fix 'invalid vdd' warning in mmc + - rsi: fix nommu_map_sg overflow kernel panic + - audit: allow not equal op for audit by executable + - [armhf, arm64] drm/rockchip: analogix_dp: Do not call Analogix code before + bind + - [x86] platform/x86: dell-smbios: Match on www.dell.com in OEM strings too + - staging: vchiq_core: Fix missing semaphore release in error case + - staging: lustre: llite: correct removexattr detection + - staging: lustre: ldlm: free resource when ldlm_lock_create() fails. + - staging: ks7010: fix error handling in ks7010_upload_firmware + - serial: core: Make sure compiler barfs for 16-byte earlycon names + - soc: imx: gpcv2: Do not pass static memory as platform data + - microblaze: Fix simpleImage format generation + - usb: hub: Don't wait for connect state at resume for powered-off ports + - crypto: authencesn - don't leak pointers to authenc keys + - crypto: authenc - don't leak pointers to authenc keys + - y2038: ipc: Use ktime_get_real_seconds consistently + - media: rc: mce_kbd decoder: low timeout values cause double keydowns + - media: omap3isp: fix unbalanced dma_iommu_mapping + - regulator: Don't return or expect -errno from of_map_mode() + - ath10k: search all IEs for variant before falling back + - drm/stm: ltdc: fix warning in ltdc_crtc_update_clut() + - scsi: scsi_dh: replace too broad "TP9" string with the exact models + - scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs + - scsi: cxlflash: Synchronize reset and remove ops + - scsi: cxlflash: Avoid clobbering context control register value + - PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR + - media: atomisp: compat32: fix __user annotations + - media: cec: fix smatch error + - media: si470x: fix __be16 annotations + - net: socionext: reset hardware in ndo_stop + - ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format() + - ASoC: topology: Add missing clock gating parameter when parsing hw_configs + - [armhf] ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl + - drm: Add DP PSR2 sink enable bit + - drm/atomic-helper: Drop plane->fb references only for + drm_atomic_helper_shutdown() + - drm/dp/mst: Fix off-by-one typo when dump payload table + - drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier + - block: bio_iov_iter_get_pages: fix size of last iovec + - blkdev: __blkdev_direct_IO_simple: fix leak in error case + - block: reset bi_iter.bi_done after splitting bio + - nvmet-fc: fix target sgl list on large transfers + - i2c: rcar: handle RXDMA HW behaviour on Gen3 + - random: mix rdrand with entropy sent in from userspace + - squashfs: be more careful about metadata corruption + - ext4: fix false negatives *and* false positives in + ext4_check_descriptors() + - ext4: fix inline data updates with checksums enabled + - ext4: check for allocation block validity with block group locked + - ext4: fix check to prevent initializing reserved inodes + - gpio: of: Handle fixed regulator flags properly + - gpio: uniphier: set legitimate irq trigger type in .to_irq hook + - RDMA/uverbs: Protect from attempts to create flows on unsupported QP + - net: dsa: qca8k: Force CPU port to its highest bandwidth + - net: dsa: qca8k: Enable RXMAC when bringing up a port + - net: dsa: qca8k: Add QCA8334 binding documentation + - net: dsa: qca8k: Allow overwriting CPU port setting + - ipv4: remove BUG_ON() from fib_compute_spec_dst + - netdevsim: don't leak devlink resources + - net: ena: Fix use of uninitialized DMA address bits field + - net: fix amd-xgbe flow-control issue + - net: lan78xx: fix rx handling before first packet is send + - net: mdio-mux: bcm-iproc: fix wrong getter and setter pair + - NET: stmmac: align DMA stuff to largest cache line length + - RDS: RDMA: Fix the NULL-ptr deref in rds_ib_get_mr + - tcp_bbr: fix bw probing to raise in-flight data for very small BDPs + - virtio_net: Fix incosistent received bytes counter + - xen-netfront: wait xenbus state change when load module manually + - cxgb4: Added missing break in ndo_udp_tunnel_{add/del} + - net: rollback orig value on failure of dev_qdisc_change_tx_queue_len + - netlink: Do not subscribe to non-existent groups + - netlink: Don't shift with UB on nlk->ngroups + - tcp: do not force quickack when receiving out-of-order packets + - tcp: add max_quickacks param to tcp_incr_quickack and + tcp_enter_quickack_mode + - tcp: do not aggressively quick ack after ECN events + - tcp: refactor tcp_ecn_check_ce to remove sk type cast + - tcp: add one more quick ack after after ECN events + - tcp: ack immediately when a cwr packet arrives + - ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation + - [x86, arm64] ACPICA: AML Parser: ignore control method status in + module-level code + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.13 + - bonding: avoid lockdep confusion in bond_get_stats() + - inet: frag: enforce memory limits earlier + - ipv4: frags: handle possible skb truesize change + - net: dsa: Do not suspend/resume closed slave_dev + - netlink: Fix spectre v1 gadget in netlink_create() + - [armhf, arm64] net: stmmac: Fix WoL for PCI-based setups + - rxrpc: Fix user call ID check in rxrpc_service_prealloc_one + - net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager + - net/mlx5e: Set port trust mode to PCP as default + - net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow + - squashfs: more metadata hardening + - can: ems_usb: Fix memory leak on ems_usb_disconnect() + - net: socket: fix potential spectre v1 gadget in socketcall + - net: socket: Fix potential spectre v1 gadget in sock_is_registered + - virtio_balloon: fix another race between migration and ballooning + - [x86] efi: Access EFI MMIO data as unencrypted when SEV is active + - [x86] apic: Future-proof the TSC_DEADLINE quirk for SKX + - [x86] entry/64: Remove %ebx handling from error_entry/exit + - [86] kvm: x86: vmx: fix vpid leak + - audit: fix potential null dereference 'context->module.name' + - ipc/shm.c add ->pagesize function to shm_vm_ops + - userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails + - iwlwifi: add more card IDs for 9000 series + - brcmfmac: fix regression in parsing NVRAM for multiple devices + - RDMA/uverbs: Expand primary and alt AV port checks + - [x86] crypto: padlock-aes - Fix Nano workaround data corruption + - [armhf, arm64] drm/vc4: Reset ->{x, y}_scaling[1] when dealing with + uniplanar formats + - drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check() + - drm/atomic: Initialize variables in drm_atomic_helper_async_check() to + make gcc happy + - scsi: sg: fix minor memory leak in error path + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.14 + - scsi: qla2xxx: Fix unintialized List head crash + - scsi: qla2xxx: Fix NPIV deletion by calling wait_for_sess_deletion + - scsi: qla2xxx: Fix driver unload by shutting down chip + - scsi: qla2xxx: Fix ISP recovery on unload + - scsi: qla2xxx: Return error when TMF returns + - jfs: Fix usercopy whitelist for inline inode data + - genirq: Make force irq threading setup more robust + - [x86] perf/x86/intel/uncore: Fix hardcoded index of Broadwell extra PCI + devices + - nohz: Fix local_timer_softirq_pending() + - nohz: Fix missing tick reprogram when interrupting an inline softirq + - netlink: Don't shift on 64 for ngroups + - ring_buffer: tracing: Inherit the tracing setting to next ring buffer + - i2c: imx: Fix reinit_completion() use + - Btrfs: fix file data corruption after cloning a range and fsync + - Partially revert "block: fail op_is_write() requests to read-only + partitions" (Closes: #900442) + - xfs: don't call xfs_da_shrink_inode with NULL bp + - xfs: validate cached inodes are free when allocated + - jfs: Fix inconsistency between memory allocation and ea_buf->max_size + + [ Ben Hutchings ] + * [armhf] gpu: host1x: Drop my build fix in favour of upstream fix: + - Revert "Revert "gpu: host1x: Add IOMMU support"" + - gpu: host1x: Fix compiler errors by converting to dma_addr_t + * [ia64] sched: Disable SCHED_STACK_END_CHECK (Closes: #905461) + * mtd: powernv_flash: set of_node in mtd's dev (Closes: #904380) + * block: really disable runtime-pm for blk-mq (Closes: #904441) + + [ Bastian Blank ] + * Bump ABI to 2 + + -- Bastian Blank <waldi@debian.org> Mon, 13 Aug 2018 15:33:58 +0200 + +linux (4.17.8-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.7 + - bpf: reject passing modified ctx to helper functions + - [mips*] Call dump_stack() from show_regs() + - [mips*] Use async IPIs for arch_trigger_cpumask_backtrace() + - [mips*] Fix ioremap() RAM check + - [armhf] drm/etnaviv: Check for platform_device_register_simple() failure + - [armhf] drm/etnaviv: Fix driver unregistering + - [armhf] drm/etnaviv: bring back progress check in job timeout handler + - ACPICA: Clear status of all events when entering S5 + - [armhf] mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz + pinctrl states + - [armhf] mmc: dw_mmc: fix card threshold control configuration + - [x86] ibmasm: don't write out of bounds in read handler + - [arm64,x86] staging: rtl8723bs: Prevent an underflow in + rtw_check_beacon_data(). + - ata: Fix ZBC_OUT command block check + - ata: Fix ZBC_OUT all bit handling + - [x86] mei: discard messages from not connected client during power down. + - mtd: spi-nor: cadence-quadspi: Fix direct mode write timeouts + - tracing/kprobe: Release kprobe print_fmt properly + - vmw_balloon: fix inflation with batching + - ahci: Add Intel Ice Lake LP PCI ID + - ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS + - [x86] thunderbolt: Notify userspace when boot_acl is changed + - USB: serial: ch341: fix type promotion bug in ch341_control_in() + - USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick + - USB: serial: keyspan_pda: fix modem-status error handling + - USB: yurex: fix out-of-bounds uaccess in read handler + - USB: serial: mos7840: fix status-register error handling + - usb: quirks: add delay quirks for Corsair Strafe + - xhci: xhci-mem: off by one in xhci_stream_id_to_ring() + - mm: zero unavailable pages before memmap init + - ALSA: hda/realtek - two more lenovo models need fixup of + MIC_LOCATION + - ALSA: hda - Handle pm failure during hotplug + - mm: do not drop unused pages when userfaultd is running + - fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* + - x86/purgatory: add missing FORCE to Makefile target + - fs, elf: make sure to page align bss in load_elf_library + - mm: do not bug_on on incorrect length in __mm_populate() + - tracing: Reorder display of TGID to be after PID + - kbuild: delete INSTALL_FW_PATH from kbuild documentation + - acpi, nfit: Fix scrub idle detection + - [arm64] neon: Fix function may_use_simd() return error status + - tools build: fix # escaping in .cmd files for future Make + - IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values + - [arm64,armhf] i2c: tegra: Fix NACK error handling + - i2c: recovery: if possible send STOP with recovery pulses + - iw_cxgb4: correctly enforce the max reg_mr depth + - [x86] xen: remove global bit from __default_kernel_pte_mask for pv + guests + - [x86] xen: setup pv irq ops vector earlier + - bsg: fix bogus EINVAL on non-data commands + - [x86] uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() + - netfilter: nf_queue: augment nfqa_cfg_policy + - crypto: don't optimize keccakf() + - netfilter: x_tables: initialise match/target check parameter + struct + - loop: add recursion validation to LOOP_CHANGE_FD + - xfs: fix inobt magic number check + - PM / hibernate: Fix oops at snapshot_write() + - RDMA/ucm: Mark UCM interface as BROKEN + - loop: remember whether sysfs_create_group() was done + - [x86] kvm: vmx: Nested VM-entry prereqs for event inj. + - f2fs: give message and set need_fsck given broken node id + - f2fs: avoid bug_on on corrupted inode + - f2fs: sanity check on sit entry + - f2fs: sanity check for total valid node blocks + - [armhf] dts: armada-38x: use the new thermal binding + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.8 + - mm: don't do zero_resv_unavail if memmap is not allocated + + [ Ben Hutchings ] + * ext4: fix false negatives *and* false positives in ext4_check_descriptors() + (Closes: #903838) + * Fix remaining build failures with gcc 8 (Closes: #897802): + - tools/lib/api/fs/fs.c: Fix misuse of strncpy() + - usbip: Fix misuse of strncpy() + + [ Salvatore Bonaccorso ] + * Ignore ABI changes for acpi_nfit_desc_init and acpi_nfit_init + * Ignore ABI changes for loop_register_transfer + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 20 Jul 2018 23:08:27 +0200 + +linux (4.17.6-2) unstable; urgency=medium + + [ Ben Hutchings ] + * [armhf] drm/sun4i: Ignore ABI changes (fixes FTBFS) + * debian/control: Fix arch/profile qualifications for libelf-dev + build-dependency + * debian/rules.real: Pass KERNEL_ARCH variable down to debian/rules.d + * debian/rules.d/tools/perf/Makefile: Use KERNEL_ARCH variable + * linux-kbuild: Fix the assumed host architecture for cross-built objtool + * [ppc64] linux-bootwrapper: Work around compiler include path quirk + (fixes FTBFS) + * Fix file conflicts between debug packages where a vDSO is identical + (Closes: #872263): + - kbuild: Add build salt to the kernel and modules + - [arm64,powerpc,x86] Add build salt to the vDSO + - Set BUILD_SALT equal to the release string + * init: Avoid ABI change for build salt + + [ Vagrant Cascadian ] + * [riscv64] Build linux-libc-dev (Closes: #886440). + Thanks to Manuel A. Fernandez Montecelo. + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 15 Jul 2018 23:45:56 +0100 + +linux (4.17.6-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.4 + - [x86] spectre_v1: Disable compiler optimizations over + array_index_mask_nospec() + - [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths + - [x86] UV: Add adjustable set memory block size function + - [x86] UV: Use new set memory block size function + - [x86] UV: Add kernel parameter to set memory block size + - [x86] mce: Improve error message when kernel cannot recover + - [x86] mce: Check for alternate indication of machine check recovery on + Skylake + - [x86] mce: Fix incorrect "Machine check from unknown source" message + - [x86] mce: Do not overwrite MCi_STATUS in mce_no_way_out() + - [x86] Call fixup_exception() before notify_die() in math_error() + - [m68k] mm: Adjust VM area to be unmapped by gap size for __iounmap() + - [m68k] mac: Fix SWIM memory resource end address + - hwmon: (k10temp) Add support for Stoney Ridge and Bristol Ridge CPUs + - mtd: spi-nor: intel-spi: Fix atomic sequence handling + - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version + - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user + - PM / Domains: Fix error path during attach in genpd + - PCI / PM: Do not clear state_saved for devices that remain suspended + - ACPI / LPSS: Avoid PM quirks on suspend and resume from S3 + - PM / core: Fix supplier device runtime PM usage counter imbalance + - PM / OPP: Update voltage in case freq == old_freq + - mmc: renesas_sdhi: really fix WP logic regressions + - usb: do not reset if a low-speed or full-speed device timed out + - 1wire: family module autoload fails because of upper/lower case mismatch. + - ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it + - ASoC: cs35l35: Add use_single_rw to regmap config + - ASoC: mediatek: preallocate pages use platform device + - ASoC: cirrus: i2s: Fix LRCLK configuration + - ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup + - thermal: bcm2835: Stop using printk format %pCr + - lib/vsprintf: Remove atomic-unsafe support for %pCr + - ftrace/selftest: Have the reset_trigger code be a bit more careful + - mips: ftrace: fix static function graph tracing + - branch-check: fix long->int truncation when profiling branches + - ipmi:bt: Set the timeout before doing a capabilities check + - Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw + loader + - printk: fix possible reuse of va_list variable + - fuse: fix congested state leak on aborted connections + - fuse: atomic_o_trunc should truncate pagecache + - fuse: don't keep dead fuse_conn at fuse_fill_super(). + - fuse: fix control dir setup and teardown + - [powerpc*] mm/hash: Add missing isync prior to kernel stack SLB switch + - [powerpc*] pkeys: Detach execute_only key on !PROT_EXEC + - [powerpc*] ptrace: Fix setting 512B aligned breakpoints with + PTRACE_SET_DEBUGREG + - [powerpc*] perf: Fix memory allocation for core-imc based on + num_possible_cpus() + - [powerpc*] ptrace: Fix enforcement of DAWR constraints + - [powerpc*] powernv/ioda2: Remove redundant free of TCE pages + - [powerpc*] powernv: copy/paste - Mask SO bit in CR + - [powerpc*] powernv/cpuidle: Init all present cpus for deep states + - [powerpc*] cpuidle: powernv: Fix promotion from snooze if next state + disabled + - [powerpc*] fadump: Unregister fadump on kexec down path. + - libnvdimm, pmem: Do not flush power-fail protected CPU caches + - [armhf, arm64] soc: rockchip: power-domain: Fix wrong value when power + up pd with writemask + - [powerpc*] 64s/radix: Fix radix_kvm_prefetch_workaround paca access of not + possible CPU + - [powerpc] e500mc: Set assembler machine type to e500mc + - [powerpc*] 64s: Fix DT CPU features Power9 DD2.1 logic + - cxl: Configure PSL to not use APC virtual machines + - cxl: Disable prefault_mode in Radix mode + - [armhf] 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size + - [armhf] dts: Fix SPI node for Arria10 + - [armhf] dts: socfpga: Fix NAND controller node compatible + - [armhf] dts: socfpga: Fix NAND controller clock supply + - [armhf] dts: socfpga: Fix NAND controller node compatible for Arria10 + - hwrng: core - Always drop the RNG in hwrng_unregister() + - softirq: Reorder trace_softirqs_on to prevent lockdep splat + - [arm64] Fix syscall restarting around signal suppressed by tracer + - [arm64] crypto: arm64/aes-blk - fix and move skcipher_walk_done out of + kernel_neon_begin, _end + - [arm64] kpti: Use early_param for kpti= command-line option + - [arm64] mm: Ensure writes to swapper are ordered wrt subsequent cache + maintenance + - [arm64] dts: marvell: fix CP110 ICU node size + - [arm64] dts: meson: disable sd-uhs modes on the libretech-cc + - [arm64] dts: meson-gx: fix ATF reserved memory region + - of: overlay: validate offset from property fixups + - of: unittest: for strings, account for trailing \0 in property length + field + - of: platform: stop accessing invalid dev in of_platform_device_destroy + - tpm: fix use after free in tpm2_load_context() + - tpm: fix race condition in tpm_common_write() + - efi/libstub/tpm: Initialize efi_physical_addr_t vars to zero for mixed + mode + - IB/qib: Fix DMA api warning with debug kernel + - IB/{hfi1, qib}: Add handling of kernel restart + - IB/mlx4: Mark user MR as writable if actual virtual memory is writable + - IB/core: Make testing MR flags for writability a static inline function + - IB/mlx5: Fetch soft WQE's on fatal error state + - IB/isert: Fix for lib/dma_debug check_sync warning + - IB/isert: fix T10-pi check mask setting + - IB/hfi1: Fix fault injection init/exit issues + - IB/hfi1: Reorder incorrect send context disable + - IB/hfi1: Optimize kthread pointer locking when queuing CQ entries + - IB/hfi1: Fix user context tail allocation for DMA_RTAIL + - IB/uverbs: Fix ordering of ucontext check in ib_uverbs_write + - RDMA/mlx4: Discard unknown SQP work requests + - xprtrdma: Return -ENOBUFS when no pages are available + - RDMA/core: Save kernel caller name when creating CQ using ib_create_cq() + - mtd: rawnand: Do not check FAIL bit when executing a SET_FEATURES op + - mtd: cfi_cmdset_0002: Change write buffer to check correct value + - mtd: rawnand: denali_dt: set clk_x_rate to 200 MHz unconditionally + - mtd: rawnand: fix return value check for bad block status + - mtd: rawnand: mxc: set spare area size register explicitly + - mtd: rawnand: micron: add ONFI_FEATURE_ON_DIE_ECC to supported features + - mtd: rawnand: All AC chips have a broken GET_FEATURES(TIMINGS). + - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock() + - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips + - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary + - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking. + - clk:aspeed: Fix reset bits for PCI/VGA and PECI + - [x86] PCI: hv: Make sure the bus domain is really unique + - PCI: Add ACS quirk for Intel 7th & 8th Gen mobile + - PCI: Add ACS quirk for Intel 300 series + - PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on + resume + - PCI: Account for all bridges on bus when distributing bus numbers + - auxdisplay: fix broken menu + - pinctrl: armada-37xx: Fix spurious irq management + - pinctrl: samsung: Correct EINTG banks order + - pinctrl: devicetree: Fix pctldev pointer overwrite + - cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0 + - [mips*] pb44: Fix i2c-gpio GPIO descriptor table + - [mips*] io: Add barrier after register read in inX() + - time: Make sure jiffies_to_msecs() preserves non-zero time periods + - irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node + - locking/rwsem: Fix up_read_non_owner() warning with DEBUG_RWSEMS + - X.509: unpack RSA signatureValue field from BIT STRING + - Btrfs: fix return value on rename exchange failure + - iio: adc: ad7791: remove sample freq sysfs attributes + - iio: sca3000: Fix an error handling path in 'sca3000_probe()' + - mm: fix __gup_device_huge vs unmap + - scsi: scsi_debug: Fix memory leak on module unload + - scsi: hpsa: disable device during shutdown + - scsi: qla2xxx: Delete session for nport id change + - scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails + - scsi: qla2xxx: Mask off Scope bits in retry delay + - scsi: qla2xxx: Spinlock recursion in qla_target + - scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler + - scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF + - scsi: zfcp: fix misleading REC trigger trace where erp_action setup + failed + - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early + return + - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for + ERP_FAILED + - scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED + - scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread + - linvdimm, pmem: Preserve read-only setting for pmem devices + - libnvdimm, pmem: Unconditionally deep flush on *sync + - [armhf] clk: meson: meson8b: mark fclk_div2 gate clocks as CLK_IS_CRITICAL + - [armhf] rtc: sun6i: Fix bit_idx value for clk_register_gate + - md: fix two problems with setting the "re-add" device state. + - rpmsg: smd: do not use mananged resources for endpoints and channels + - ubi: fastmap: Cancel work upon detach + - ubi: fastmap: Correctly handle interrupted erasures in EBA + - UBIFS: Fix potential integer overflow in allocation + - backlight: as3711_bl: Fix Device Tree node lookup + - backlight: max8925_bl: Fix Device Tree node lookup + - backlight: tps65217_bl: Fix Device Tree node lookup + - Revert "iommu/amd_iommu: Use CONFIG_DMA_DIRECT_OPS=y and + dma_direct_{alloc,free}()" + - f2fs: don't use GFP_ZERO for page caches + - um: Fix initialization of vector queues + - um: Fix raw interface options + - mfd: twl-core: Fix clock initialization + - mfd: intel-lpss: Program REMAP register in PIO mode + - mfd: intel-lpss: Fix Intel Cannon Lake LPSS I2C input clock + - perf tools: Fix symbol and object code resolution for vdso32 and vdsox32 + - [x86] perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING + - [x86] perf intel-pt: Fix decoding to accept CBR between FUP and + corresponding TIP + - [x86] perf intel-pt: Fix MTC timing after overflow + - [x86] perf intel-pt: Fix "Unexpected indirect branch" error + - [x86] perf intel-pt: Fix packet decoding of CYC packets + - media: vsp1: Release buffers for each video node + - media: uvcvideo: Support realtek's UVC 1.5 device + - media: cx231xx: Ignore an i2c mux adapter + - media: v4l2-compat-ioctl32: prevent go past max size + - media: cx231xx: Add support for AverMedia DVD EZMaker 7 + - media: rc: mce_kbd decoder: fix stuck keys + - media: dvb_frontend: fix locking issues at dvb_frontend_get_event() + - nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir + - NFSv4: Fix possible 1-byte stack overflow in + nfs_idmap_read_and_verify_message + - NFSv4: Revert commit 5f83d86cf531d ("NFSv4.x: Fix wraparound issues..") + - NFSv4: Fix a typo in nfs41_sequence_process + - video: uvesafb: Fix integer overflow in allocation (CVE-2018-13406) + - ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices + - Input: silead - add MSSL0002 ACPI HID + - Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID + - pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume + - rbd: flush rbd_dev->watch_dwork after watch is unregistered + - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm() + - mm: fix devmem_is_allowed() for sub-page System RAM intersections + - xen: Remove unnecessary BUG_ON from __unbind_from_irq() + - net: ethernet: fix suspend/resume in davinci_emac + - udf: Detect incorrect directory size + - Input: xpad - fix GPD Win 2 controller name + - Input: psmouse - fix button reporting for basic protocols + - Input: elan_i2c_smbus - fix more potential stack buffer overflows + - Input: elantech - enable middle button of touchpads on ThinkPad P52 + - Input: elantech - fix V4 report decoding for module with middle key + - ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl + - ALSA: hda - Force to link down at runtime suspend on ATI/AMD HDMI + - ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co + - ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210 + - ALSA: hda/realtek - Fix the problem of two front mics on more machines + - Revert "i2c: algo-bit: init the bus to a known state" + - i2c: gpio: initialize SCL to HIGH again + - slub: fix failure when we delete and create a slab cache + - kasan: depend on CONFIG_SLUB_DEBUG + - dm: use bio_split() when splitting out the already processed bio + - pmem: only set QUEUE_FLAG_DAX for fsdax mode + - block: Fix transfer when chunk sectors exceeds max + - block: Fix cloning of requests with a special payload + - [x86] e820: put !E820_TYPE_RAM regions into memblock.reserved + - selinux: move user accesses in selinuxfs out of locked regions + - [x86] entry/64/compat: Fix "x86/entry/64/compat: Preserve r8-r11 in int + $0x80" + - [x86] efi: Fix efi_call_phys_epilog() with CONFIG_X86_5LEVEL=y + - dm zoned: avoid triggering reclaim from inside dmz_map() + - dm thin: handle running out of data space vs concurrent discard + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.5 + - [armhf,arm64] usb: dwc2: fix the incorrect bitmaps for the ports of + multi_tt hub + - usb: typec: tcpm: fix logbuffer index is wrong if _tcpm_log is re-entered + - acpi: Add helper for deactivating memory region + - usb: typec: ucsi: acpi: Workaround for cache mode issue + - usb: typec: ucsi: Fix for incorrect status data issue + - xhci: Fix kernel oops in trace_xhci_free_virt_device + - n_tty: Fix stall at n_tty_receive_char_special(). + - n_tty: Access echo_* variables carefully. + - [armhf] iio: mma8452: Fix ignoring MMA8452_INT_DRDY + - serial: 8250_pci: Remove stalled entries in blacklist + - serdev: fix memleak on module unload + - vt: prevent leaking uninitialized data to userspace via /dev/vcs* + - drm/amdgpu: Add APU support in vi_set_uvd_clocks + - drm/amdgpu: Add APU support in vi_set_vce_clocks + - drm/amdgpu: fix the missed vcn fw version report + - drm/amdgpu: Grab/put runtime PM references in atomic_commit_tail() + - drm/amdgpu: fix clear_all and replace handling in the VM (v2) + - drm/amd/display: Clear connector's edid pointer + - [x86] drm/i915/dp: Send DPCD ON for MST before phy_up + - drm/qxl: Call qxl_bo_unref outside atomic context + - [armhf] Revert "drm/sun4i: Handle DRM_BUS_FLAG_PIXDATA_*EDGE" + - drm/amdgpu: Don't default to DC support for Kaveri and older + - drm/amdgpu: Use kvmalloc_array for allocating VRAM manager nodes array + - drm/amdgpu: Refactor amdgpu_vram_mgr_bo_invisible_size helper + - drm/amdgpu: Make amdgpu_vram_mgr_bo_invisible_size always accurate + - drm/amdgpu: Update pin_size values before unpinning BO + - drm/amdgpu: GPU vs CPU page size fixes in amdgpu_vm_bo_split_mapping + - drm/amdgpu: Count disabled CRTCs in commit tail earlier + - drm/amd/display: release spinlock before committing updates to stream + - [x86] drm/i915: Allow DBLSCAN user modes with eDP/LVDS/DSI + - [x86] drm/i915: Fix PIPESTAT irq ack on i965/g4x + - [x86] drm/i915: Disallow interlaced modes on g4x DP outputs + - [x86] drm/i915: Turn off g4x DP port in .post_disable() + - [x86] drm/i915: Enable provoking vertex fix on Gen9 systems. + - netfilter: ip6t_rpfilter: provide input interface for route lookup + - netfilter: xt_connmark: fix list corruption on rmmod + - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in + nft_do_chain() + - [arm64] dts: meson-gxl-s905x-p212: Add phy-supply for usb0 + - [x86] mm: Don't free P4D table when it is folded at runtime + - [armhf] dts: imx6q: Use correct SDMA script for SPI5 core + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.6 + - userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access + - mm: hugetlb: yield when prepping struct pages + - mm: teach dump_page() to correctly output poisoned struct pages + - PCI / ACPI / PM: Resume bridges w/o drivers on suspend-to-RAM + - ACPICA: Drop leading newlines from error messages + - ACPI / battery: Safe unregistering of hooks + - tracing: Avoid string overflow + - tracing: Fix missing return symbol in function_graph output + - scsi: sg: mitigate read/write abuse + - scsi: aacraid: Fix PD performance regression over incorrect qd being set + - scsi: target: Fix truncated PR-in ReadKeys response + - [s390x] Correct register corruption in critical section cleanup + - drbd: fix access after free + - vfio: Use get_user_pages_longterm correctly + - [armhf] dts: imx51-zii-rdu1: fix touchscreen pinctrl + - [armhf] dts: omap3: Fix am3517 mdio and emac clock references + - [armhf] dts: dra7: Disable metastability workaround for USB2 + - cifs: Fix use after free of a mid_q_entry + - cifs: Fix memory leak in smb2_set_ea() + - cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting + - cifs: Fix infinite loop when using hard mount option + - drm: Use kvzalloc for allocating blob property memory + - drm/udl: fix display corruption of the last line + - drm/amdgpu: Add amdgpu_atpx_get_dhandle() + - drm/amdgpu: Dynamically probe for ATIF handle (v2) + - ext4: include the illegal physical block in the bad map ext4_error msg + - ext4: add more mount time checks of the superblock + - ext4: check superblock mapped prior to committing + - HID: i2c-hid: Fix "incomplete report" noise + - HID: hiddev: fix potential Spectre v1 (CVE-2017-5715) + - HID: debug: check length before copy_to_user() + - HID: core: allow concurrent registration of drivers + - i2c: core: smbus: fix a potential missing-check bug + - i2c: smbus: kill memory leak on emulated and failed DMA SMBus xfers + - fs: allow per-device dax status checking for filesystems + - dax: change bdev_dax_supported() to support boolean returns + - dax: check for QUEUE_FLAG_DAX in bdev_dax_supported() + - dm: prevent DAX mounts if not supported + - mtd: cfi_cmdset_0002: Change definition naming to retry write operation + - mtd: cfi_cmdset_0002: Change erase functions to retry for error + - mtd: cfi_cmdset_0002: Change erase functions to check chip good only + - netfilter: nf_log: don't hold nf_log_mutex during user access + - [x86] staging: comedi: quatech_daqp_cs: fix no-op loop + daqp_ao_insn_write() + - Revert mm/vmstat.c: fix vmstat_update() preemption BUG + + [ Sjoerd Simons ] + * [armhf] DRM: Enable CONFIG_DRM_IMX_PARALLEL_DISPLAY + + [ Ben Hutchings ] + * linux-tools: Fix cross-build of objtool + * [powerpcspe] Fix build failures (thanks to James Clarke): + - powerpc/lib/sstep: Fix building for powerpcspe + - powerpc/lib/Makefile: Don't pull in quad.o for 32-bit kernels + - linux-perf: Disable building for powerpcspe + * [powerpc,powerpcspe,ppc64] Fix cross-build (Closes: #903096): + - Introduce linux-bootwrapper-<abiname> package containing boot wrapper + tools for the host architecture + - linux-image: Install symlinks to boot wrapper tools instead of the + native tools built by kbuild + * fs: Fix up non-directory creation in SGID directories (CVE-2018-13405) + * sound/pci/hda: Ignore ABI changes + * HID: Avoid ABI change in 4.17.6 + * dax: Avoid ABI change in 4.17.6 + + [ Cyril Brulebois ] + * udeb: Add virtio_console to virtio-modules (Closes: #903122). + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 12 Jul 2018 02:05:27 +0100 + +linux (4.17.3-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.3 + - net: aquantia: fix unsigned numvecs comparison with less than zero + - bonding: re-evaluate force_primary when the primary slave name changes + - cdc_ncm: avoid padding beyond end of skb + - ipv6: allow PMTU exceptions to local routes + - [armhf,arm64] net: dsa: add error handling for pskb_trim_rcsum + - net/sched: act_simple: fix parsing of TCA_DEF_DATA + - tcp: verify the checksum of the first data segment in a new connection + - socket: close race condition between sock_close() and sockfs_setattr() + (CVE-2018-12232) + - udp: fix rx queue len reported by diag and proc interface + - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds + vlan + - ACPICA: AML parser: attempt to continue loading table after error + - ext4: fix hole length detection in ext4_ind_map_blocks() + - ext4: update mtime in ext4_punch_hole even if no blocks are released + - ext4: do not allow external inodes for inline data (CVE-2018-11412) + - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget() + - ext4: correctly handle a zero-length xattr with a non-zero e_value_offs + (CVE-2018-10840) + - ext4: fix fencepost error in check for inode count overflow during resize + - driver core: Don't ignore class_dir_create_and_add() failure. + - Btrfs: allow empty subvol= again + - Btrfs: fix clone vs chattr NODATASUM race + - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2() + - btrfs: return error value if create_io_em failed in cow_file_range + - btrfs: scrub: Don't use inode pages for device replace + - ALSA: usb-audio: Disable the quirk for Nura headset + - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() + - [x86] MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read() + - smb3: fix various xid leaks + - smb3: on reconnect set PreviousSessionId field + - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session + expiry + - cifs: For SMB2 security informaion query, check for minimum sized + security descriptor instead of sizeof FileAllInformation class + - nbd: fix nbd device deletion + - nbd: update size when connected + - nbd: use bd_set_size when updating disk size + - blk-mq: reinit q->tag_set_list entry only after grace period + - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue + - cpufreq: Fix new policy initialization during limits updates via sysfs + - cpufreq: governors: Fix long idle detection logic in load calculation + - libata: zpodd: small read overflow in eject_tray() + - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk + - nvme/pci: Sync controller reset for AER slot_reset + - [x86] vector: Fix the args of vector_alloc tracepoint + - [x86] apic/vector: Prevent hlist corruption and leaks + - [x86] apic: Provide apic_ack_irq() + - [x86] ioapic: Use apic_ack_irq() + - [x86] platform/uv: Use apic_ack_irq() + - irq_remapping: Use apic_ack_irq() + - genirq/generic_pending: Do not lose pending affinity update + - genirq/affinity: Defer affinity setting if irq chip is busy + - genirq/migration: Avoid out of line call if pending is not set + - [x86] intel_rdt: Enable CMT and MBM on new Skylake stepping + - media: uvcvideo: Prevent setting unavailable flags + - media: rc: ensure input/lirc device can be opened after register + - iwlwifi: fw: harden page loading code + - [x86] HID: intel_ish-hid: ipc: register more pm callbacks to support + hibernation + - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large + - vhost: fix info leak due to uninitialized memory (CVE-2018-1118) + - fs/binfmt_misc.c: do not allow offset overflow + - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset + + [ Ben Hutchings ] + * [amd64,arm64,armhf] android: Build modules to support Anbox + (Closes: #901492) + - Export symbols needed by Android drivers + - Enable building ashmem and binder as modules + - Enable ANDROID + - Enable ANDROID_BINDER_IPC, ASHMEM as modules + - Set ANDROID_BINDER_DEVICES="binder" + - Disable ANDROID_BINDER_IPC_32BIT + * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00140000 (fixes FTBFS) + * Set ABI to 1 + * [x86,arm64] Disable code signing for upload to unstable + * [x86] virt: vbox: Only copy_from_user the request-header once + (CVE-2018-12633) + * [x86] vboxguest: Enable VBOXGUEST and DRM_VBOXVIDEO as modules + * aufs: Update support patchset to aufs4.x-rcN-20180611 + * debian/rules.d/scripts/mod/gendef.py: Use Python 3 + * debian/rules: Fix pkg.linux.notools build profile + * tracing: Check for no filter when processing event filters (CVE-2018-12714) + * dm: Enable DM_INTEGRITY as module (except on armel) (Closes: #896649) + * debian/lib/python/debian_linux/debian.py: Accept arbitrary revision + suffixes (Closes: #898087) + * ext4: add corruption check in ext4_xattr_set_entry() (CVE-2018-10879) + * ext4: always verify the magic number in xattr blocks (CVE-2018-10879) + * ext4: always check block group bounds in ext4_init_block_bitmap() + (CVE-2018-10878) + * ext4: make sure bitmaps and the inode table don't overlap with bg + descriptors (CVE-2018-10878) + * ext4: only look at the bg_flags field if it is valid (CVE-2018-10876) + * ext4: verify the depth of extent tree in ext4_find_extent() + (CVE-2018-10877) + * ext4: clear i_data in ext4_inode_info when removing inline data + (CVE-2018-10881) + * ext4: never move the system.data xattr out of the inode body + (CVE-2018-10880) + * jbd2: don't mark block as modified if the handle is out of credits + (CVE-2018-10883) + * ext4: avoid running out of journal credits when appending to an inline file + (CVE-2018-10883) + * ext4: add more inode number paranoia checks (CVE-2018-10882) + * jfs: Fix inconsistency between memory allocation and ea_buf->max_size + (CVE-2018-12233) + * debian/control: Move bison and flex to Build-Depends (Closes: #901712) + + [ Romain Perier ] + * [x86] amdgpu: Enable DCN 1.0 Raven family (Closes: #901349) + * [armhf] Enable missing SND_EDMA_SOC for davinci-mcasp on the BeagleBoneBlack + + [ Vagrant Cascadian ] + * [arm64] Add device-tree to support Pinebook. + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 02 Jul 2018 22:13:27 +0100 + +linux (4.17.2-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.17 + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.1 + - netfilter: nf_flow_table: attach dst to skbs + - bnx2x: use the right constant + - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds + - ipv6: omit traffic class when calculating flow hash + - l2tp: fix refcount leakage on PPPoL2TP sockets + - netdev-FAQ: clarify DaveM's position for stable backports + - net: metrics: add proper netlink validation + - net/packet: refine check for priv area size + - rtnetlink: validate attributes in do_setlink() + - sctp: not allow transport timeout value less than HZ/5 for hb_timer + - team: use netdev_features_t instead of u32 + - vrf: check the original netdevice for generating redirect + - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC + - ipmr: fix error path when ipmr_new_table fails + - PCI: hv: Do not wait forever on a device that has disappeared + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2 + - crypto: chelsio - request to HW should wrap + - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers + - KVM: X86: Fix reserved bits check for MOV to CR3 + - KVM: x86: introduce linear_{read,write}_system + - kvm: fix typo in flag name + - kvm: nVMX: Enforce cpl=0 for VMX instructions + - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system + - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access + - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy + - NFC: pn533: don't send USB data off of the stack + - usbip: vhci_sysfs: fix potential Spectre v1 + - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver + - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive + - Input: xpad - add GPD Win 2 Controller USB IDs + - phy: qcom-qusb2: Fix crash if nvmem cell not specified + - usb: core: message: remove extra endianness conversion in usb_set_isoch_delay + - usb: typec: wcove: Remove dependency on HW FSM + - usb: gadget: function: printer: avoid wrong list handling in printer_write() + - usb: gadget: udc: renesas_usb3: fix double phy_put() + - usb: gadget: udc: renesas_usb3: should remove debugfs + - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add udc + - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc + - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error + - usb: gadget: udc: renesas_usb3: disable the controller's irqs for reconnecting + - serial: sh-sci: Stop using printk format %pCr + - tty/serial: atmel: use port->name as name in request_irq() + - serial: samsung: fix maxburst parameter for DMA transactions + - serial: 8250: omap: Fix idling of clocks for unused uarts + - vmw_balloon: fixing double free when batching mode is off + - doc: fix sysfs ABI documentation + - arm64: defconfig: Enable CONFIG_PINCTRL_MT7622 by default + - tty: pl011: Avoid spuriously stuck-off interrupts + - crypto: ccree - correct host regs offset + - Input: goodix - add new ACPI id for GPD Win 2 touch screen + - Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID + - crypto: caam - strip input zeros from RSA input buffer + - crypto: caam - fix DMA mapping dir for generated IV + - crypto: caam - fix IV DMA mapping and updating + - crypto: caam/qi - fix IV DMA mapping and updating + - crypto: caam - fix size of RSA prime factor q + - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK + - crypto: cavium - Limit result reading attempts + - crypto: vmx - Remove overly verbose printk from AES init routines + - crypto: vmx - Remove overly verbose printk from AES XTS init + - crypto: omap-sham - fix memleak + + [ Vagrant Cascadian ] + * [armhf] Enable MFD_AC100 and RTC_DRV_AC100, used in allwinner A80/A83t + systems. + + [ Helge Deller ] + * [hppa] Disable debug info due to required disk size. + + [ Bastian Blank ] + * [cloud-amd64] Enable VIRTUALIZATION. (closes: #900861) + * [cloud-amd64] Enable MEMORY_HOTPLUG. + + [ Romain Perier ] + * [arm64] correct voltage selector for Firefly-RK3399 (Closes: #900799) + + [ Vagrant Cascadian ] + * [arm64] Enable configuration options used in Firefly-RK3399: + DRM_ROCKCHIP, ROCKCHIP_ANALOGIX_DP, ROCKCHIP_DW_HDMI, + ROCKCHIP_DW_MIPI_DSI, ROCKCHIP_SARADC, ROCKCHIP_IOMMU, ROCKCHIP_EFUSE, + PHY_ROCKCHIP_TYPEC, ROCKCHIP_THERMAL (Closes: #901159). + Thanks to Heinrich Schuchardt. + + -- Bastian Blank <waldi@debian.org> Tue, 19 Jun 2018 22:00:47 +0200 + +linux (4.17~rc7-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Romain Perier] + * Update patch debian/wireless-disable-regulatory.db-direct-loading.patch to + fix a FTBFS with undefined symbol reg_query_regdb_wmm() that is used by + wireless driver iwlwifi. + + [ Luca Boccassi ] + * Disable building linux-doc-* and tools documentation when the "nodoc" + build profile is used. + * Add new "pkg.linux.nosource" build profile that disables building the + linux-source-* package, and a "[packages] source" option for the + debian/config/defines file that defines the default behaviour. + * Remove redundant "Dual License" from debian/copyright to fix Lintian + source warning "space-in-std-shortname-in-dep5-copyright". + * Add missing Copyright line to debian/copyright to fix Lintian source + warning "missing-field-in-dep5-copyright". + + [ John Paul Adrian Glaubitz ] + * [m68k] Enable CONFIG_PATA_GAYLE as module. + + [ Ben Hutchings ] + * Fix building only versioned tools packages + * Reclassify lockdep packages as unversioned tools + * [hppa/parisc64-smp] IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for + DMA_VIRT_OPS + * rtl8192se: Fix warning introduced by "firmware: Remove redundant log + messages from drivers" + * SCSI: Enable SCSI_MQ_DEFAULT. This can be reverted using the kernel + parameter: scsi_mod.use_blk_mq=n + * dm: Enable DM_MQ_DEFAULT. This can be reverted using the kernel parameter: + dm_mod.use_blk_mq=n + + [ Jason Duerstock ] + * [ia64] udeb: Add compress-modules package (fixes FTBFS) + + [ YunQiang Su ] + * [mips{,64}el/loongson-3] enable NUMA, CPU_PM, CPU_IDLE, RS780_HPET, + REGULATOR. (Closes: #898521). + * [mips{,64}r6{,el}] use boston as the target, and enable MIPS_CPS. + Add a patch to disable uImage generation to avoid depend on u-boot-tools. + Fix typo the EL's flavor names in installer: not same within defines + Malta is never used for r6. (Closes: #898523) + Boston also requires relocation table size >= 0x00121000. + + [ Vagrant Cascadian ] + * [armhf] Update mtd-modules: Replace pxa3xx_nand with marvell_nand. + + [ Hideki Yamane ] + * Improve battery life on laptops (Closes: #898629) + Thanks to Hans de Goede <hdegoede@redhat.com> + - ATA: A new SATA link-powermanagement-policy will be the default on all + Intel mobile chipsets. This can be reverted by passing + "ahci.mobile_lpm_policy=0" on the kernel commandline. + - sound: Enable Intel HDA codec power-saving by default with a 1 second + timeout. This can be overridden by passing "snd_hda_intel.power_save=0" + on the kernel commandline (0 is previously default). + - BlueTooth: Enable USB autosuspend for Bluetooth USB devices by default. + This can be disabled by passing "btusb.enable_autosuspend=n" on the + kernel commandline. + + [ Bastian Blank ] + * [cloud-amd64] Disable some filesystems. + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 29 May 2018 09:54:12 +0100 + +linux (4.17~rc3-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [amd64] Drop our patch "Don't WARN about expected W+X pages on Xen"; the + problem appears to have been fixed upstream + * Drop our patch "Kbuild: kconfig: Verbose version of --listnewconfig"; + listnewconfig now shows symbol values by default + * debian/rules.real: Stop enabling verbose output for listnewconfig target + * Documentation: typec.rst: Use literal-block element with ascii art + * Documentation: Update references to drivers/base/firmware_class.c + * [armhf] Enable MTD_NAND_MARVELL as module, replacing MTD_NAND_PXA3xx + * linux-kbuild: Update genksyms makefile to run flex and bison + * Add support for building only versioned tools packages + * Change generation of linux-doc, linux-source, linux-support package names + + [ Luca Boccassi ] + * Build-Dep on libelf-dev even for nopython/notools builds to fix FTBFS, + needed when CONFIG_STACK_VALIDATION and CONFIG_UNWINDER_ORC are enabled. + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 30 Apr 2018 00:13:06 +0100 + +linux (4.16.16-2) unstable; urgency=medium + + * [powerpc*] Ignore further ABI changes in cxl. + * [ia64] Add compress-modules udeb. + + -- Bastian Blank <waldi@debian.org> Fri, 22 Jun 2018 11:50:22 +0200 + +linux (4.16.16-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.13 + - [mips*] c-r4k: Fix data corruption related to cache coherence + - [mips*] ptrace: Expose FIR register through FP regset + - [mips*] Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 + FGRs + - affs_lookup(): close a race with affs_remove_link() + - fix breakage caused by d_find_alias() semantics change + - fs: don't scan the inode cache before SB_BORN is set + - aio: fix io_destroy(2) vs. lookup_ioctx() race + - Btrfs: fix error handling in btrfs_truncate() + - ALSA: timer: Fix pause event notification + - do d_instantiate/unlock_new_inode combinations safely + - mmc: block: propagate correct returned value in mmc_rpmb_ioctl + - mmc: sdhci-iproc: remove hard coded mmc cap 1.8v + - mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register + - mmc: sdhci-iproc: add SDHCI_QUIRK2_HOST_OFF_CARD_ON for cygnus + - ahci: Add PCI ID for Cannon Lake PCH-LP AHCI + - libata: Blacklist some Sandisk SSDs for NCQ + - libata: blacklist Micron 500IT SSD with MU01 firmware + - xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent + - drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros + - [arm64] lse: Add early clobbers to some input/output asm operands + - [arm64] export tishift functions to modules + - [powerpc*] 64s: Clear PCR on boot + - IB/hfi1: Use after free race condition in send context error path + - IB/umem: Use the correct mm during ib_umem_release + - sr: pass down correctly sized SCSI sense buffer (CVE-2018-11506) + - bcma: fix buffer size caused crash in bcma_core_mips_print_irq() + - idr: fix invalid ptr dereference on item delete + - Revert "ipc/shm: Fix shmat mmap nil-page protection" + - ipc/shm: fix shmat() nil address after round-down when remapping + - mm/kasan: don't vfree() nonexistent vm_area + - kasan: free allocated shadow memory on MEM_CANCEL_ONLINE + - kasan: fix memory hotplug during boot + - kernel/sys.c: fix potential Spectre v1 issue + - PM / core: Fix direct_complete handling for devices with no callbacks + - KVM/VMX: Expose SSBD properly to guests + - KVM: s390: vsie: fix < 8k check for the itdba + - KVM: x86: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed + - kvm: x86: IA32_ARCH_CAPABILITIES is always supported + - x86/kvm: fix LAPIC timer drift when guest uses periodic mode + - [armhf] dts: sun4i: Fix incorrect clocks for displays + - sh: fix debug trap failure to process signals before return to user + - firmware: dmi_scan: Fix UUID length safety check + - nvme: don't send keep-alives to the discovery controller + - Btrfs: clean up resources during umount after trans is aborted + - Btrfs: fix loss of prealloc extents past i_size after fsync log replay + - x86/pgtable: Don't set huge PUD/PMD on non-leaf entries + - x86/mm: Do not forbid _PAGE_RW before init for __ro_after_init + - bnxt_en: Ignore src port field in decap filter nodes + - nvme: expand nvmf_check_if_ready checks + - fs/proc/proc_sysctl.c: fix potential page fault while unregistering + sysctl table + - kasan: fix invalid-free test crashing the kernel + - kasan, slub: fix handling of kasan_slab_free hook + - swap: divide-by-zero when zero length swap file on ssd + - z3fold: fix memory leak + - sr: get/drop reference to device in revalidate and check_events + - Force log to disk before reading the AGF during a fstrim + - cpufreq: CPPC: Initialize shared perf capabilities of CPUs + - powerpc/fscr: Enable interrupts earlier before calling get_user() + - perf tools: Fix perf builds with clang support + - perf clang: Add support for recent clang versions + - dp83640: Ensure against premature access to PHY registers after reset + - ibmvnic: Zero used TX descriptor counter on reset + - genirq/affinity: Don't return with empty affinity masks on error + - mm/ksm: fix interaction with THP + - mm: fix races between address_space dereference and free in + page_evicatable + - mm: thp: fix potential clearing to referenced flag in + page_idle_clear_pte_refs_one() + - Btrfs: bail out on error during replay_dir_deletes + - Btrfs: fix NULL pointer dereference in log_dir_items + - btrfs: Fix possible softlock on single core machines + - IB/rxe: Fix for oops in rxe_register_device on ppc64le arch + - ocfs2/dlm: don't handle migrate lockres if already in shutdown + - [powerpc*] 64s: Fix restore of AMOR on POWER9 after deep sleep + - sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning + - x86/mm: Fix bogus warning during EFI bootup, use boot_cpu_has() instead + of this_cpu_has() in build_cr3_noflush() + - KVM: VMX: raise internal error for exception during invalid protected + mode state + - lan78xx: Connect phy early + - fscache: Fix hanging wait on page discarded by writeback + - dmaengine: rcar-dmac: Fix too early/late system suspend/resume callbacks + - [sparc64] Make atomic_xchg() an inline function rather than a macro. + - riscv/spinlock: Strengthen implementations with fences + - platform/x86: dell-smbios: Fix memory leaks in build_tokens_sysfs() + - net: bgmac: Fix endian access in bgmac_dma_tx_ring_free() + - net: bgmac: Correctly annotate register space + - bnxt_en: fix clear flags in ethtool reset handling + - [powerpc*] 64s: sreset panic if there is no debugger or crash dump handlers + - btrfs: tests/qgroup: Fix wrong tree backref level + - Btrfs: fix copy_items() return value when logging an inode + - btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers + - btrfs: qgroup: Fix root item corruption when multiple same source + snapshots are created with quota enabled + - rxrpc: Fix resend event time calculation + - rxrpc: Fix Tx ring annotation after initial Tx failure + - rxrpc: Don't treat call aborts as conn aborts + - xen/acpi: off by one in read_acpi_id() + - drivers: macintosh: rack-meter: really fix bogus memsets + - ACPI: acpi_pad: Fix memory leak in power saving threads + - powerpc/mpic: Check if cpu_possible() in mpic_physmask() + - ieee802154: ca8210: fix uninitialised data read + - ath10k: advertize beacon_int_min_gcd + - iommu/amd: Take into account that alloc_dev_data() may return NULL + - intel_th: Use correct method of finding hub + - [m68k] set dma and coherent masks for platform FEC ethernets + - iwlwifi: mvm: check if mac80211_queue is valid in iwl_mvm_disable_txq + - iwlwifi: mvm: take RCU lock before dereferencing + - net/mlx5e: Move all TX timeout logic to be under state lock + - parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode + - perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done() + - hwmon: (nct6775) Fix writing pwmX_mode + - mt76x2: fix possible NULL pointer dereferencing in mt76x2_tx() + - mt76x2: fix warning in ieee80211_get_key_rx_seq() + - [powerpc] perf: Prevent kernel address leak to userspace via BHRB buffer + - [powerpc] perf: Fix kernel address leak via sampling registers + - rsi: fix kernel panic observed on 64bit machine + - tools/thermal: tmon: fix for segfault + - selftests: Print the test we're running to /dev/kmsg + - i40e: hold the RTNL lock while changing interrupt schemes + - net/mlx5: Protect from command bit overflow + - watchdog: davinci_wdt: fix error handling in davinci_wdt_probe() + - net: hns3: fix for the wrong shift problem in hns3_set_txbd_baseinfo + - net: hns3: fix for returning wrong value problem in + hns3_get_rss_indir_size + - net: hns3: fix for returning wrong value problem in hns3_get_rss_key_size + - net: qualcomm: rmnet: check for null ep to avoid null pointer dereference + - ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) + - nvme_fc: fix abort race on teardown with lld reject + - nvme-pci: disable APST for Samsung NVMe SSD 960 EVO + ASUS PRIME Z370-A + - ath9k: fix crash in spectral scan + - btrfs: fix null pointer deref when target device is missing + - cxgb4: Setup FW queues before registering netdev + - hv_netvsc: Fix the return status in RX path + - ima: Fix Kconfig to select TPM 2.0 CRB interface + - ima: Fallback to the builtin hash algorithm + - watchdog: aspeed: Allow configuring for alternate boot + - gfs2: Check for the end of metadata in punch_hole + - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS + - [armhf] dts: socfpga: fix GIC PPI warning + - ima: clear IMA_HASH + - ext4: don't complain about incorrect features when probing + - drm/vmwgfx: Unpin the screen object backup buffer when not used + - iommu/mediatek: Fix protect memory setting + - cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path + - firmware: fix checking for return values for fw_add_devm_name() + - IB/mlx5: Set the default active rate and width to QDR and 4X + - zorro: Set up z->dev.dma_mask for the DMA API + - bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set + - remoteproc: imx_rproc: Fix an error handling path in 'imx_rproc_probe()' + - bcache: fix cached_dev->count usage for bch_cache_set_error() + - ACPICA: Events: add a return on failure from acpi_hw_register_read + - ACPICA: Fix memory leak on unusual memory leak + - bcache: stop dc->writeback_rate_update properly + - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c + - cxgb4: Fix queue free path of ULD drivers + - i2c: mv64xxx: Apply errata delay only in standard mode + - KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use + - perf top: Fix top.c[all] all-graph config option reading + - perf stat: Fix core dump when flag T is used + - IB/core: Honor port_num while resolving GID for IB link layer + - drm/amdkfd: add missing include of mm.h + - coresight: Use %px to print pcsr instead of %p + - ibmvnic: Fix reset return from closed state + - regulator: gpio: Fix some error handling paths in 'gpio_regulator_probe()' + - spi: bcm-qspi: fIX some error handling paths + - net/smc: pay attention to MAX_ORDER for CQ entries + - MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset + - powerpc/vas: Fix cleanup when VAS is not configured + - PCI: Restore config space on runtime resume despite being unbound + - watchdog: sprd_wdt: Fix error handling in sprd_wdt_enable() + - watchdog: dw: RMW the control register + - watchdog: aspeed: Fix translation of reset mode to ctrl register + - ipmi_ssif: Fix kernel panic at msg_done_handler + - [arm64] drm/meson: Fix some error handling paths in 'meson_drv_bind_master()' + - [arm64] drm/meson: Fix an un-handled error path in 'meson_drv_bind_master()' + - [powerpc] powernv/npu: Fix deadlock in mmio_invalidate() + - f2fs: flush cp pack except cp pack 2 page at first + - cxl: Check if PSL data-cache is available before issue flush request + - f2fs: fix to set KEEP_SIZE bit in f2fs_zero_range + - f2fs: fix to clear CP_TRIMMED_FLAG + - f2fs: fix to check extent cache in f2fs_drop_extent_tree + - perf/core: Fix installing cgroup events on CPU + - max17042: propagate of_node to power supply device + - perf/core: Fix perf_output_read_group() + - drm/panel: simple: Fix the bus format for the Ontat panel + - hwmon: (pmbus/max8688) Accept negative page register values + - hwmon: (pmbus/adm1275) Accept negative page register values + - [amd64] perf: Properly save/restore the PMU state in the NMI handler + - cdrom: do not call check_disk_change() inside cdrom_open() + - [armhf, arm64] efi: Only register page tables when they exist + - [amd64] perf: Fix large period handling on Broadwell CPUs + - [amd64] perf: Fix event update for auto-reload + - [arm64] dts: qcom: Fix SPI5 config on MSM8996 + - [arm64] soc: qcom: wcnss_ctrl: Fix increment in NV upload + - gfs2: Fix fallocate chunk size + - [amd64] x86/devicetree: Initialize device tree before using it + - [amd64] x86/devicetree: Fix device IRQ settings in DT + - phy: rockchip-emmc: retry calpad busy trimming + - ALSA: vmaster: Propagate slave error + - phy: qcom-qmp: Fix phy pipe clock gating + - drm/bridge: sii902x: Retry status read after DDI I2C + - drm/amdgpu: Clean sdma wptr register when only enable wptr polling + - tools: hv: fix compiler warnings about major/target_fname + - block: null_blk: fix 'Invalid parameters' when loading module + - dmaengine: pl330: fix a race condition in case of threaded irqs + - [powerpc] mm/slice: Remove intermediate bitmap copy + - [powerpc] mm/slice: create header files dedicated to slices + - [powerpc] mm/slice: Enhance for supporting PPC32 + - [powerpc] mm/slice: Fix hugepage allocation at hint address on 8xx + - dmaengine: rcar-dmac: Check the done lists in rcar_dmac_chan_get_residue() + - enic: enable rq before updating rq descriptors + - watchdog: asm9260_wdt: fix error handling in asm9260_wdt_probe() + - hwrng: stm32 - add reset during probe + - pinctrl: devicetree: Fix dt_to_map_one_config handling of hogs + - pinctrl: artpec6: dt: add missing pin group uart5nocts + - vfio-ccw: fence off transport mode + - dmaengine: qcom: bam_dma: get num-channels and num-ees from dt + - drm: omapdrm: dss: Move initialization code from component bind to probe + - [armhf] dts: dra71-evm: Correct evm_sd regulator max voltage + - drm/amdgpu: disable GFX ring and disable PQ wptr in hw_fini + - drm/amdgpu: adjust timeout for ib_ring_tests(v2) + - ibmvnic: Allocate statistics buffers during probe + - [armhf, arm64] net: stmmac: ensure that the device has released ownership + before reading data + - [armhf, arm64] net: stmmac: ensure that the MSS desc is the last desc to + set the own bit + - cpufreq: Reorder cpufreq_online() error code path + - dpaa_eth: fix SG mapping + - PCI: Add function 1 DMA alias quirk for Marvell 88SE9220 + - udf: Provide saner default for invalid uid / gid + - ixgbe: prevent ptp_rx_hang from running when in FILTER_ALL mode + - sh_eth: fix TSU init on SH7734/R8A7740 + - power: supply: ltc2941-battery-gauge: Fix temperature units + - [armhf] dts: bcm283x: Fix probing of bcm2835-i2s + - [armhf] dts: bcm283x: Fix pin function of JTAG pins + - PCMCIA / PM: Avoid noirq suspend aborts during suspend-to-idle + - hwrng: bcm2835 - Handle deferred clock properly + - audit: return on memory error to avoid null pointer dereference + - [armhf, arm64] net: stmmac: call correct function in + stmmac_mac_config_rx_queues_routing() + - rcu: Call touch_nmi_watchdog() while printing stall warnings + - pinctrl: sh-pfc: r8a7796: Fix MOD_SEL register pin assignment for SSI + pins group + - dt-bindings: display: msm/dsi: Fix the PHY regulator supply props + - drm/amd/display: Set vsc pack revision when DPCD revision is >= 1.2 + - dpaa_eth: fix pause capability advertisement logic + - [mips*/octeon] Fix logging messages with spurious periods after newlines + - [arm64] soc: renesas: r8a77970-sysc: fix power area parents + - [armhf] drm/rockchip: Respect page offset for PRIME mmap calls + - x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' + specified + - perf report: Fix wrong jump arrow + - perf tests: Use arch__compare_symbol_names to compare symbols + - perf report: Fix memory corruption in --branch-history mode + --branch-history + - perf tests: Fix dwarf unwind for stripped binaries + - selftests/net: fixes psock_fanout eBPF test case + - drm/vblank: Data type fixes for 64-bit vblank sequences. + - netlabel: If PF_INET6, check sk_buff ip header version + - drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen3 + - drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen2 + - selftests: Add FIB onlink tests + - regmap: Correct comparison in regmap_cached + - soc: amlogic: meson-gx-pwrc-vpu: fix error on shutdown when domain is + powered off + - i40e: Add delay after EMP reset for firmware to recover + - [armhf] dts: imx7d: cl-som-imx7: fix pinctrl_enet + - [armhf] dts: porter: Fix HDMI output routing + - regulator: of: Add a missing 'of_node_put()' in an error handling path of + 'of_regulator_match()' + - pinctrl: msm: Use dynamic GPIO numbering + - pinctrl: mcp23s08: spi: Fix regmap debugfs entries + - kdb: make "mdr" command repeat + - drm/vmwgfx: Set dmabuf_size when vmw_dmabuf_init is successful + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.14 + - objtool: Support GCC 8's cold subfunctions + - objtool: Support GCC 8 switch tables + - objtool: Detect RIP-relative switch table references + - objtool: Detect RIP-relative switch table references, part 2 + - objtool: Fix "noreturn" detection for recursive sibling calls + - x86/mce/AMD: Carve out SMCA get_block_address() code + - x86/MCE/AMD: Cache SMCA MISC block addresses + - drm/vmwgfx: Use kasprintf + - drm/vmwgfx: Fix host logging / guestinfo reading error paths + - Revert "pinctrl: msm: Use dynamic GPIO numbering" + - xfs: convert XFS_AGFL_SIZE to a helper function + - xfs: detect agfl count corruption and reset agfl + - Input: synaptics - Lenovo Carbon X1 Gen5 (2017) devices should use RMI + - Input: synaptics - Lenovo Thinkpad X1 Carbon G5 (2017) with Elantech trackpoints should use RMI + - Input: synaptics - add Intertouch support on X1 Carbon 6th and X280 + - Input: synaptics - add Lenovo 80 series ids to SMBus + - Input: elan_i2c_smbus - fix corrupted stack + - tracing: Fix crash when freeing instances with event triggers + - tracing: Make the snapshot trigger work with instances + - nvme: fix extended data LBA supported setting + - selinux: KASAN: slab-out-of-bounds in xattr_getsecurity + - cfg80211: further limit wiphy names to 64 bytes + - drm/amd/powerplay: Fix enum mismatch + - rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c + - iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ + - iio: hid-sensor-trigger: Fix sometimes not powering up the sensor after resume + - iio:buffer: make length types match kfifo types + - iio:kfifo_buf: check for uint overflow + - iio: adc: stm32-dfsdm: fix successive oversampling settings + - iio: adc: stm32-dfsdm: fix sample rate for div2 spi clock + - iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels + - iio: adc: select buffer for at91-sama5d2_adc + - MIPS: lantiq: gphy: Drop reboot/remove reset asserts + - MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs + - MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests + - scsi: scsi_transport_srp: Fix shost to rport translation + - stm class: Use vmalloc for the master map + - hwtracing: stm: fix build error on some arches + - IB/core: Fix error code for invalid GID entry + - mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty() + - Revert "rt2800: use TXOP_BACKOFF for probe frames" + - intel_th: Use correct device when freeing buffers + - drm/psr: Fix missed entry in PSR setup time table. + - drm/i915/lvds: Move acpi lid notification registration to registration phase + - drm/i915: Disable LVDS on Radiant P845 + - fix io_destroy()/aio_complete() race + - mm: fix the NULL mapping case in __isolate_lru_page() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.15 + - mmap: introduce sane default mmap limits + - mmap: relax file size limit for regular files + - netfilter: nf_flow_table: attach dst to skbs + - kconfig: Avoid format overflow warning from GCC 8.1 + - be2net: Fix error detection logic for BE3 + - bnx2x: use the right constant + - cls_flower: Fix incorrect idr release when failing to modify rule + - dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect() + - enic: set DMA mask to 47 bit + - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds + - ip6_tunnel: remove magic mtu value 0xFFF8 + - ipmr: properly check rhltable_init() return value + - ipv4: remove warning in ip_recv_error + - ipv6: omit traffic class when calculating flow hash + - isdn: eicon: fix a missing-check bug + - kcm: Fix use-after-free caused by clonned sockets + - l2tp: fix refcount leakage on PPPoL2TP sockets + - mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG + - netdev-FAQ: clarify DaveM's position for stable backports + - net: ethernet: davinci_emac: fix error handling in probe() + - net: ipv4: add missing RTA_TABLE to rtm_ipv4_policy + - net: metrics: add proper netlink validation + - net/packet: refine check for priv area size + - net: phy: broadcom: Fix bcm_write_exp() + - net: usb: cdc_mbim: add flag FLAG_SEND_ZLP + - packet: fix reserve calculation + - qed: Fix mask for physical address in ILT entry + - rtnetlink: validate attributes in do_setlink() + - sctp: not allow transport timeout value less than HZ/5 for hb_timer + - team: use netdev_features_t instead of u32 + - vhost: synchronize IOTLB message with dev cleanup + - vrf: check the original netdevice for generating redirect + - ipv6: sr: fix memory OOB access in seg6_do_srh_encap/inline + - net: phy: broadcom: Fix auxiliary control register reads + - net-sysfs: Fix memory leak in XPS configuration + - virtio-net: correctly transmit XDP buff after linearizing + - virtio-net: fix leaking page for gso packet during mergeable XDP + - net/mlx4: Fix irq-unsafe spinlock usage + - net/mlx5e: When RXFCS is set, add FCS data into checksum calculation + - tun: Fix NULL pointer dereference in XDP redirect + - virtio-net: correctly check num_buf during err path + - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC + - net : sched: cls_api: deal with egdev path only if needed + - virtio-net: correctly redirect linearized packet + - ip_tunnel: restore binding to ifaces with a large mtu + - net: netsec: reduce DMA mask to 40 bits + - vhost_net: flush batched heads before trying to busy polling + - PCI: hv: Do not wait forever on a device that has disappeared + - drm: set FMODE_UNSIGNED_OFFSET for drm files + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.16 + - netfilter: nf_tables: fix NULL pointer dereference on nft_ct_helper_obj_dump() + - crypto: chelsio - request to HW should wrap + - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers + - af_key: Always verify length of provided sadb_key + - KVM: X86: Fix reserved bits check for MOV to CR3 + - KVM: x86: introduce linear_{read,write}_system + - kvm: nVMX: Enforce cpl=0 for VMX instructions + - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system + - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy + - NFC: pn533: don't send USB data off of the stack + - usbip: vhci_sysfs: fix potential Spectre v1 + - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver + - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive + - Input: xpad - add GPD Win 2 Controller USB IDs + - phy: qcom-qusb2: Fix crash if nvmem cell not specified + - usb: core: message: remove extra endianness conversion in usb_set_isoch_delay + - usb: typec: wcove: Remove dependency on HW FSM + - usb: gadget: function: printer: avoid wrong list handling in printer_write() + - usb: gadget: udc: renesas_usb3: fix double phy_put() + - usb: gadget: udc: renesas_usb3: should remove debugfs + - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add udc + - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc + - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error + - usb: gadget: udc: renesas_usb3: disable the controller's irqs for reconnecting + - serial: sh-sci: Stop using printk format %pCr + - tty/serial: atmel: use port->name as name in request_irq() + - serial: samsung: fix maxburst parameter for DMA transactions + - serial: 8250: omap: Fix idling of clocks for unused uarts + - vmw_balloon: fixing double free when batching mode is off + - tty: pl011: Avoid spuriously stuck-off interrupts + - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access + - Input: goodix - add new ACPI id for GPD Win 2 touch screen + - Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID + - crypto: caam - strip input zeros from RSA input buffer + - crypto: caam - fix DMA mapping dir for generated IV + - crypto: caam - fix IV DMA mapping and updating + - crypto: caam/qi - fix IV DMA mapping and updating + - crypto: caam - fix size of RSA prime factor q + - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK + - crypto: cavium - Limit result reading attempts + - crypto: vmx - Remove overly verbose printk from AES init routines + - crypto: vmx - Remove overly verbose printk from AES XTS init + - crypto: omap-sham - fix memleak + + [ Vagrant Cascadian ] + * [armhf] Enable MFD_AC100 and RTC_DRV_AC100, used in allwinner A80/A83t + systems. + + [ Yves-Alexis Perez ] + * hardening: enable FORTIFY_SOURCE, disable HARDENED_USERCOPY_FALLBACK + * [x86] hardening: enable REFCOUNT_FULL + + [ Ben Hutchings ] + * ext4: Fix duplicate softdep fields in module info + + [ Bastian Blank ] + * hv_netvsc: Fix a network regression after ifdown/ifup + * [rt] Update to 4.16.15-rt7. + + [ Vagrant Cascadian ] + * [arm64] Enable configuration options used in Firefly-RK3399: + DRM_ROCKCHIP, ROCKCHIP_ANALOGIX_DP, ROCKCHIP_DW_HDMI, + ROCKCHIP_DW_MIPI_DSI, ROCKCHIP_SARADC, ROCKCHIP_IOMMU, ROCKCHIP_EFUSE, + PHY_ROCKCHIP_TYPEC, ROCKCHIP_THERMAL (Closes: #901159). + Thanks to Heinrich Schuchardt. + * [arm64,armhf] Add device-tree to support Raspberry PI 3b+. + + -- Bastian Blank <waldi@debian.org> Tue, 19 Jun 2018 20:23:54 +0200 + +linux (4.16.12-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.6 + - Revert "pinctrl: intel: Initialize GPIO properly when used through + irqchip" + - [armhf] drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson + GX SoCs + - i40e: Fix attach VF to VM issue + - tpm: cmd_ready command can be issued only after granting locality + - tpm: tpm-interface: fix tpm_transmit/_cmd kdoc + - tpm: add retry logic + - Revert "ath10k: send (re)assoc peer command when NSS changed" + - bonding: do not set slave_dev npinfo before slave_enable_netpoll in + bond_enslave + - docs: ip-sysctl.txt: fix name of some ipv6 variables + - ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy + - ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts + - KEYS: DNS: limit the length of option strings + - l2tp: check sockaddr length in pppol2tp_connect() + - llc: delete timers synchronously in llc_sk_free() + - net: af_packet: fix race in PACKET_{R|T}X_RING + - net: fix deadlock while clearing neighbor proxy table + - [arm64,armhf] net: mvpp2: Fix DMA address mask size + - net: qmi_wwan: add Wistron Neweb D19Q1 + - net/smc: fix shutdown in state SMC_LISTEN + - net: stmmac: Disable ACS Feature for GMAC >= 4 + - packet: fix bitfield update race + - pppoe: check sockaddr length in pppoe_connect() + - Revert "macsec: missing dev_put() on error in macsec_newlink()" + - sctp: do not check port in sctp_inet6_cmp_addr + - strparser: Do not call mod_delayed_work with a timeout of LONG_MAX + - strparser: Fix incorrect strp->need_bytes value. + - tcp: clear tp->packets_out when purging write queue + - tcp: don't read out-of-bounds opsize + - tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets + - team: avoid adding twice the same option to the event list + - team: fix netconsole setup over team + - tipc: add policy for TIPC_NLA_NET_ADDR + - vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi + - vmxnet3: fix incorrect dereference when rxvlan is disabled + - [amd64,arm64] amd-xgbe: Add pre/post auto-negotiation phy hooks + - [amd64,arm64] amd-xgbe: Improve KR auto-negotiation and training + - [amd64,arm64] amd-xgbe: Only use the SFP supported transceiver signals + - net: sched: ife: signal not finding metaid + - net: sched: ife: handle malformed tlv length + - net: sched: ife: check on metadata length + - l2tp: hold reference on tunnels in netlink dumps + - l2tp: hold reference on tunnels printed in pppol2tp proc file + - l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file + - l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow + - llc: hold llc_sap before release_sock() + - llc: fix NULL pointer deref for SOCK_ZAPPED + - [s390x] qeth: fix error handling in adapter command callbacks + - [s390x] qeth: avoid control IO completion stalls + - [s390x] qeth: handle failure on workqueue creation + - [armhf] net: ethernet: ti: cpsw: fix tx vlan priority mapping + - net: validate attribute sizes in neigh_dump_table() + - bnxt_en: Fix memory fault in bnxt_ethtool_init() + - virtio-net: add missing virtqueue kick when flushing packets + - VSOCK: make af_vsock.ko removable again + - net: aquantia: Regression on reset with 1.x firmware + - tun: fix vlan packet truncation + - net: aquantia: oops when shutdown on already stopped device + - virtio_net: split out ctrl buffer + - virtio_net: fix adding vids on big-endian + - Revert "mm/hmm: fix header file if/else/endif maze" + - commoncap: Handle memory allocation failure. + - scsi: mptsas: Disable WRITE SAME + - cdrom: information leak in cdrom_ioctl_media_changed() (CVE-2018-10940) + - fsnotify: Fix fsnotify_mark_connector race + - [m68k] mac: Don't remap SWIM MMIO region + - [m68k] block/swim: Check drive type + - [m68k] block/swim: Don't log an error message for an invalid ioctl + - [m68k] block/swim: Remove extra put_disk() call from error path + - [m68k] block/swim: Rename macros to avoid inconsistent inverted logic + - [m68k] block/swim: Select appropriate drive on device open + - [m68k] block/swim: Fix array bounds check + - [m68k] block/swim: Fix IO error at end of medium + - tracing: Fix missing tab for hwlat_detector print format + - hwmon: (k10temp) Add temperature offset for Ryzen 2700X + - hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics + - [s390x] cio: update chpid descriptor after resource accessibility event + - [s390x] dasd: fix IO error for newly defined devices + - [s390x] uprobes: implement arch_uretprobe_is_alive() + - [s390x] cpum_cf: rename IBM z13/z14 counter names + - kprobes: Fix random address output of blacklist file + - ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.7 + - ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS + - ext4: set h_journal if there is a failure starting a reserved handle + - ext4: add MODULE_SOFTDEP to ensure crc32c is included in the initramfs + - random: set up the NUMA crng instances after the CRNG is fully + initialized + - random: fix possible sleeping allocation from irq context + - random: rate limit unseeded randomness warnings + - usbip: usbip_event: fix to not print kernel pointer address + - usbip: usbip_host: fix to hold parent lock for device_attach() calls + - usbip: vhci_hcd: Fix usb device and sockfd leaks + - usbip: vhci_hcd: check rhport before using in vhci_hub_control() + - Revert "xhci: plat: Register shutdown for xhci_plat" + - xhci: Fix USB ports for Dell Inspiron 5775 + - USB: serial: simple: add libtransistor console + - USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster + - USB: serial: cp210x: add ID for NI USB serial console + - [arm64] serial: mvebu-uart: Fix local flags handling on termios update + - usb: typec: ucsi: Increase command completion timeout value + - usb: core: Add quirk for HP v222w 16GB Mini + - USB: Increment wakeup count on remote wakeup. + - ALSA: usb-audio: Skip broken EU on Dell dock USB-audio + - virtio: add ability to iterate over vqs + - virtio_console: don't tie bufs to a vq + - virtio_console: free buffers after reset + - virtio_console: drop custom control queue cleanup + - virtio_console: move removal code + - virtio_console: reset on out of memory + - drm/virtio: fix vq wait_event condition + - tty: Don't call panic() at tty_ldisc_init() + - tty: n_gsm: Fix long delays with control frame timeouts in ADM mode + - tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set + - tty: Avoid possible error pointer dereference at tty_ldisc_restore(). + - tty: Use __GFP_NOFAIL for tty_ldisc_get() + - ALSA: dice: fix OUI for TC group + - ALSA: dice: fix error path to destroy initialized stream data + - ALSA: hda - Skip jack and others for non-existing PCM streams + - ALSA: opl3: Hardening for potential Spectre v1 + - ALSA: asihpi: Hardening for potential Spectre v1 + - ALSA: hdspm: Hardening for potential Spectre v1 + - ALSA: rme9652: Hardening for potential Spectre v1 + - ALSA: control: Hardening for potential Spectre v1 + - ALSA: pcm: Return negative delays from SNDRV_PCM_IOCTL_DELAY. + - ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr + - ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device + - ALSA: seq: oss: Hardening for potential Spectre v1 + - ALSA: hda: Hardening for potential Spectre v1 + - ALSA: hda/realtek - Add some fixes for ALC233 + - ALSA: hda/realtek - Update ALC255 depop optimize + - ALSA: hda/realtek - change the location for one of two front mics + - mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic + - mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block. + - mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug. + - mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block. + - mtd: rawnand: tango: Fix struct clk memory leak + - mtd: rawnand: marvell: fix the chip-select DT parsing logic + - kobject: don't use WARN for registration failures + - scsi: sd_zbc: Avoid that resetting a zone fails sporadically + - scsi: sd: Defer spinning up drive while SANITIZE is in progress + - blk-mq: start request gstate with gen 1 + - bfq-iosched: ensure to clear bic/bfqq pointers when preparing request + - block: do not use interruptible wait anywhere + - [s390x] vfio: ccw: process ssch with interrupts disabled + - [arm64] PCI: aardvark: Fix logic in advk_pcie_{rd,wr}_conf() + - [arm64] PCI: aardvark: Set PIO_ADDR_LS correctly in advk_pcie_rd_conf() + - [arm64] PCI: aardvark: Use ISR1 instead of ISR0 interrupt in legacy irq + mode + - [arm64] PCI: aardvark: Fix PCIe Max Read Request Size setting + - [armhf,arm64] KVM: Close VMID generation race + - [powerpc*] mm: Flush cache on memory hot(un)plug + - [powerpc*] mce: Fix a bug where mce loops on memory UE. + - [powerpc*] powernv/npu: Do a PID GPU TLB flush when invalidating a large + address range + - crypto: drbg - set freed buffers to NULL + - libceph: un-backoff on tick when we have a authenticated session + - libceph: reschedule a tick in finish_hunting() + - libceph: validate con->state at the top of try_write() + - PCI / PM: Do not clear state_saved in pci_pm_freeze() when smart suspend + is set + - module: Fix display of wrong module .text address + - earlycon: Use a pointer table to fix __earlycon_table stride + - [powerpc*] cpufreq: powernv: Fix hardlockup due to synchronous smp_call + in timer interrupt + - [powerpc*] rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops + - drm/edid: Reset more of the display info + - drm/amdgpu: set COMPUTE_PGM_RSRC1 for SGPR/VGPR clearing shaders + - [x86] drm/i915/fbdev: Enable late fbdev initial configuration + - [x86] drm/i915/audio: set minimum CD clock to twice the BCLK + - [x86] drm/i915: Enable display WA#1183 from its correct spot + - drm/amd/display: Fix deadlock when flushing irq + - drm/amd/display: Don't read EDID in atomic_check + - drm/amd/display: Disallow enabling CRTC without primary plane with FB + - objtool, perf: Fix GCC 8 -Wrestrict error + - [x86] ipc: Fix x32 version of shmid64_ds and msqid64_ds + - [x86] smpboot: Don't use mwait_play_dead() on AMD systems + - [x86] microcode/intel: Save microcode patch unconditionally + - [x86] microcode: Do not exit early from __reload_late() + - tick/sched: Do not mess with an enqueued hrtimer + - [x86] crypto: ccp - add check to get PSP master only when PSP is + detected + - [armhf,arm64] KVM: Add PSCI version selection API + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.8 + - ACPI / button: make module loadable when booted in non-ACPI mode + - [arm64] Add work around for Arm Cortex-A55 Erratum 1024718 + - ALSA: hda - Fix incorrect usage of IS_REACHABLE() + - ALSA: pcm: Check PCM state at xfern compat ioctl + - ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() + - ALSA: dice: fix kernel NULL pointer dereference due to invalid + calculation for array index + - ALSA: aloop: Mark paused device as inactive + - ALSA: aloop: Add missing cable lock to ctl API callbacks + - errseq: Always report a writeback error once + - tracepoint: Do not warn on ENOMEM + - scsi: target: Fix fortify_panic kernel exception + - Input: leds - fix out of bound access + - Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook + Pro + - swiotlb: fix inversed DMA_ATTR_NO_WARN test + - rtlwifi: cleanup 8723be ant_sel definition + - xfs: prevent creating negative-sized file via INSERT_RANGE + - RDMA/cxgb4: release hw resources on device removal + - RDMA/ucma: Allow resolving address w/o specifying source address + - RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow + - RDMA/mlx4: Add missed RSS hash inner header flag + - RDMA/mlx5: Protect from shift operand overflow + - NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 + - IB/mlx5: Use unlimited rate when static rate is not supported + - infiniband: mlx5: fix build errors when INFINIBAND_USER_ACCESS=m + - IB/hfi1: Fix handling of FECN marked multicast packet + - IB/hfi1: Fix loss of BECN with AHG + - IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used + - iw_cxgb4: Atomically flush per QP HW CQEs + - btrfs: Take trans lock before access running trans in check_delayed_ref + - [arm64,armhf] drm/vc4: Make sure vc4_bo_{inc,dec}_usecnt() calls are + balanced + - [x86] drm/vmwgfx: Fix a buffer object leak + - drm/bridge: vga-dac: Fix edid memory leak + - xhci: Fix use-after-free in xhci_free_virt_device + - USB: serial: visor: handle potential invalid device configuration + - [arm64,armhf] usb: dwc3: gadget: Fix list_del corruption in + dwc3_ep_dequeue + - USB: Accept bulk endpoints with 1024-byte maxpacket + - USB: serial: option: reimplement interface masking + - USB: serial: option: adding support for ublox R410M + - [arm64,armhf] usb: musb: host: fix potential NULL pointer dereference + - [arm64, armhf] usb: musb: trace: fix NULL pointer dereference in + musb_g_tx() + - [x86] platform/x86: asus-wireless: Fix NULL pointer dereference + - [x86] platform/x86: Kconfig: Fix dell-laptop dependency chain. + - [x86] KVM: remove APIC Timer periodic/oneshot spikes + - [x86] tsc: Always unregister clocksource_tsc_early + - [x86] tsc: Fix mark_tsc_unstable() + - [arm64] irqchip/qcom: Fix check for spurious interrupts + - clocksource: Allow clocksource_mark_unstable() on unregistered + clocksources + - clocksource: Initialize cs->wd_list + - clocksource: Consistent de-rate when marking unstable + - tracing: Fix bad use of igrab in trace_uprobe.c + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.9 + - ipvs: fix rtnl_lock lockups caused by start_sync_thread + - netfilter: ebtables: don't attempt to allocate 0-sized compat array + - clk: ti: fix flag space conflict with clkctrl clocks + - rds: tcp: must use spin_lock_irq* and not spin_lock_bh with + rds_tcp_conn_lock + - crypto: af_alg - fix possible uninit-value in alg_bind() + - netlink: fix uninit-value in netlink_sendmsg + - net: fix rtnh_ok() + - net: initialize skb->peeked when cloning + - net: fix uninit-value in __hw_addr_add_ex() + - dccp: initialize ireq->ir_mark + - ipv4: fix uninit-value in ip_route_output_key_hash_rcu() + - soreuseport: initialise timewait reuseport field + - inetpeer: fix uninit-value in inet_getpeer + - bpf/tracing: fix a deadlock in perf_event_detach_bpf_prog + - memcg: fix per_node_info cleanup + - perf: Remove superfluous allocation error check + - i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr() + - tcp: fix TCP_REPAIR_QUEUE bound checking + - bdi: wake up concurrent wb_shutdown() callers. + - bdi: Fix use after free bug in debugfs_remove() + - bdi: Fix oops in wb_workfn() + - compat: fix 4-byte infoleak via uninitialized struct field + - gpioib: do not free unrequested descriptors + - gpio: fix error path in lineevent_create + - rfkill: gpio: fix memory leak in probe error path + - libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs + - dm integrity: use kvfree for kvmalloc'd memory + - tracing: Fix regex_match_front() to not over compare the test string + - mm: sections are not offlined during memory hotremove + - mm, oom: fix concurrent munlock and oom reaper unmap (CVE-2018-1000200) + - ceph: fix rsize/wsize capping in ceph_direct_read_write() + - can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() + - [armhf,arm64] drm/vc4: Fix scaling of uni-planar formats + - drm/ttm: Use GFP_TRANSHUGE_LIGHT for allocating huge pages + - [x86] drm/i915: Fix drm:intel_enable_lvds ERROR message in kernel log + - [x86] drm/i915: Adjust eDP's logical vco in a reliable place. + - drm/nouveau: Fix deadlock in nv50_mstm_register_connector() + (Closes: #898825) + - drm/nouveau/ttm: don't dereference nvbo::cli, it can outlive client + - drm/atomic: Clean old_state/new_state in drm_atomic_state_default_clear() + - drm/atomic: Clean private obj old_state/new_state in + drm_atomic_state_default_clear() + - net: atm: Fix potential Spectre v1 + - atm: zatm: Fix potential Spectre v1 + - PCI / PM: Always check PME wakeup capability for runtime wakeup support + - PCI / PM: Check device_may_wakeup() in pci_enable_wake() + - cpufreq: schedutil: Avoid using invalid next_freq + - Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" + - [x86] Bluetooth: btusb: Add Dell XPS 13 9360 to + btusb_needs_reset_resume_table + - Bluetooth: btusb: Only check needs_reset_resume DMI table for QCA rome + chipsets + - [armhf] thermal: exynos: Reading temperature makes sense only when TMU is + turned on + - [armhf] thermal: exynos: Propagate error value from tmu_read() + - nvme: add quirk to force medium priority for SQ creation + - nvme: Fix sync controller reset return + - smb3: directory sync should not return an error + - swiotlb: silent unwanted warning "buffer is full" + - sched/core: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] + - sched/autogroup: Fix possible Spectre-v1 indexing for + sched_prio_to_weight[] + - tracing/uprobe_event: Fix strncpy corner case + - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* + - [x86] perf/cstate: Fix possible Spectre-v1 indexing for pkg_msr + - [x86] perf/msr: Fix possible Spectre-v1 indexing in the MSR driver + - perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] + - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.10 + - 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() + - bridge: check iface upper dev when setting master via ioctl + - dccp: fix tasklet usage + - ipv4: fix fnhe usage by non-cached routes + - ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg + - llc: better deal with too small mtu + - net: ethernet: sun: niu set correct packet size in skb + - [armhf] net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode + - net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()' + - net/mlx4_en: Verify coalescing parameters are in range + - net/mlx5e: Err if asked to offload TC match on frag being first + - net/mlx5: E-Switch, Include VF RDMA stats in vport statistics + - net sched actions: fix refcnt leak in skbmod + - net_sched: fq: take care of throttled flows before reuse + - net: support compat 64-bit time in {s,g}etsockopt + - openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is + found + - qmi_wwan: do not steal interfaces from class drivers + - r8169: fix powering up RTL8168h + - rds: do not leak kernel memory to user land + - sctp: delay the authentication for the duplicated cookie-echo chunk + - sctp: fix the issue that the cookie-ack with auth can't get processed + - sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr + - sctp: remove sctp_chunk_put from fail_mark err path in + sctp_ulpevent_make_rcvmsg + - sctp: use the old asoc when making the cookie-ack chunk in dupcook_d + - tcp_bbr: fix to zero idle_restart only upon S/ACKed data + - tcp: ignore Fast Open on repair mode + - tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent(). + - bonding: do not allow rlb updates to invalid mac + - bonding: send learning packets for vlans on slave + - net: sched: fix error path in tcf_proto_create() when modules are not + configured + - net/mlx5e: TX, Use correct counter in dma_map error flow + - net/mlx5: Avoid cleaning flow steering table twice during error flow + - [x86] hv_netvsc: set master device + - ipv6: fix uninit-value in ip6_multipath_l3_keys() + - net/mlx5e: Allow offloading ipv4 header re-write for icmp + - udp: fix SO_BINDTODEVICE + - net/mlx5e: DCBNL fix min inline header size for dscp + - sctp: clear the new asoc's stream outcnt in sctp_stream_update + - tcp: restore autocorking + - tipc: fix one byte leak in tipc_sk_set_orig_addr() + - [x86] hv_netvsc: Fix net device attach on older Windows hosts + - ipv4: reset fnhe_mtu_locked after cache route flushed + - net/mlx5: Fix mlx5_get_vector_affinity function + - net: phy: sfp: fix the BR,min computation + - net/smc: keep clcsock reference in smc_tcp_listen_work() + - scsi: aacraid: Correct hba_send to include iu_type + - proc: do not access cmdline nor environ from file-backed areas + (CVE-2018-1120) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.11 + - xhci: Fix USB3 NULL pointer dereference at logical disconnect. + - usbip: usbip_host: refine probe and disconnect debug msgs to be useful + - usbip: usbip_host: delete device from busid_table after rebind + - usbip: usbip_host: run rebind from exit when module is removed + - usbip: usbip_host: fix NULL-ptr deref and use-after-free errors + - usbip: usbip_host: fix bad unlock balance during stub_probe() + - ALSA: usb: mixer: volume quirk for CM102-A+/102S+ + - ALSA: hda/realtek - Clevo P950ER ALC1220 Fixup + - ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist + - ALSA: control: fix a redundant-copy issue + - [amd64] spi: pxa2xx: Allow 64-bit DMA + - KVM: vmx: update sec exec controls for UMIP iff emulating UMIP + - [armhf,arm64] KVM: Properly protect VGIC locks from IRQs + - [armhf,arm64] KVM: VGIC/ITS: Promote irq_lock() in update_affinity + - [armhf,arm64] KVM: VGIC/ITS save/restore: protect kvm_read_guest() calls + - [armhf,arm64] KVM: VGIC/ITS: protect kvm_read_guest() calls with SRCU + lock + - hwmon: (k10temp) Fix reading critical temperature register + - hwmon: (k10temp) Use API function to access System Management Network + - [s390x] vfio: ccw: fix cleanup if cp_prefetch fails + - tracing/x86/xen: Remove zero data size trace events + trace_xen_mmu_flush_tlb{_all} + - vsprintf: Replace memory barrier with static_key for random_ptr_key + update + - [x86] amd_nb: Add support for Raven Ridge CPUs + - [arm64] tee: shm: fix use-after-free via temporarily dropped reference + - netfilter: nf_tables: free set name in error path + - netfilter: nf_tables: can't fail after linking rule into active rule + list + - netfilter: nf_tables: nf_tables_obj_lookup_byhandle() can be static + - [arm64] dts: marvell: armada-cp110: Add clocks for the xmdio node + - [arm64] dts: marvell: armada-cp110: Add mg_core_clk for ethernet node + - i2c: designware: fix poll-after-enable regression + - mtd: rawnand: marvell: Fix read logic for layouts with ->nchunks > 2 + - [powerpc*] powerpc/powernv: Fix NVRAM sleep in invalid context when + crashing + - drm: Match sysfs name in link removal to link creation + - radix tree: fix multi-order iteration race + - mm: don't allow deferred pages with NEED_PER_CPU_KM + - [x86] drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk + - [s390x] qdio: fix access to uninitialized qdio_q fields + - [s390x] cpum_sf: ensure sample frequency of perf event attributes is + non-zero + - [s390x] qdio: don't release memory in qdio_setup_irq() + - [s390x] remove indirect branch from do_softirq_own_stack + - bcache: return 0 from bch_debug_init() if CONFIG_DEBUG_FS=n + - [x86] pkeys: Override pkey when moving away from PROT_EXEC + - [x86] pkeys: Do not special case protection key 0 + - efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' + definition for mixed mode + - [arm*] 8771/1: kprobes: Prohibit kprobes on do_undefinstr + - [x86] apic/x2apic: Initialize cluster ID properly + - [x86] mm: Drop TS_COMPAT on 64-bit exec() syscall + - tick/broadcast: Use for_each_cpu() specially on UP kernels + - [arm*] 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed + - [arm*] 8770/1: kprobes: Prohibit probing on optimized_callback + - [arm*] 8772/1: kprobes: Prohibit kprobes on get_user functions + - Btrfs: fix xattr loss after power failure + - Btrfs: send, fix invalid access to commit roots due to concurrent + snapshotting + - btrfs: property: Set incompat flag if lzo/zstd compression is set + - btrfs: fix crash when trying to resume balance without the resume flag + - btrfs: Split btrfs_del_delalloc_inode into 2 functions + - btrfs: Fix delalloc inodes invalidation during transaction abort + - btrfs: fix reading stale metadata blocks after degraded raid1 mounts + - x86/nospec: Simplify alternative_msr_write() + - x86/bugs: Concentrate bug detection into a separate function + - x86/bugs: Concentrate bug reporting into a separate function + - x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits + - x86/bugs, KVM: Support the combination of guest and host IBRS + - x86/bugs: Expose /sys/../spec_store_bypass + - x86/cpufeatures: Add X86_FEATURE_RDS + - x86/bugs: Provide boot parameters for the spec_store_bypass_disable + mitigation + - x86/bugs/intel: Set proper CPU features and setup RDS + - x86/bugs: Whitelist allowed SPEC_CTRL MSR values + - x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested + - x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest + - x86/speculation: Create spec-ctrl.h to avoid include hell + - prctl: Add speculation control prctls + - x86/process: Allow runtime control of Speculative Store Bypass + - x86/speculation: Add prctl for Speculative Store Bypass mitigation + - nospec: Allow getting/setting on non-current task + - proc: Provide details on speculation flaw mitigations + - seccomp: Enable speculation flaw mitigations + - x86/bugs: Make boot modes __ro_after_init + - prctl: Add force disable speculation + - seccomp: Use PR_SPEC_FORCE_DISABLE + - seccomp: Add filter flag to opt-out of SSB mitigation + - seccomp: Move speculation migitation control to arch code + - x86/speculation: Make "seccomp" the default mode for Speculative Store + Bypass + - x86/bugs: Rename _RDS to _SSBD + - proc: Use underscores for SSBD in 'status' + - Documentation/spec_ctrl: Do some minor cleanups + - x86/bugs: Fix __ssb_select_mitigation() return type + - x86/bugs: Make cpu_show_common() static + - x86/bugs: Fix the parameters alignment and missing void + - x86/cpu: Make alternative_msr_write work for 32-bit code + - KVM: SVM: Move spec control call after restore of GS + - x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP + - x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS + - x86/cpufeatures: Disentangle SSBD enumeration + - x86/cpufeatures: Add FEATURE_ZEN + - x86/speculation: Handle HT correctly on AMD + - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL + - x86/speculation: Add virtualized speculative store bypass disable + support + - x86/speculation: Rework speculative_store_bypass_update() + - x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host} + - x86/bugs: Expose x86_spec_ctrl_base directly + - x86/bugs: Remove x86_spec_ctrl_set() + - x86/bugs: Rework spec_ctrl base and mask logic + - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG + - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD + - x86/bugs: Rename SSBD_NO to SSB_NO + - bpf: Prevent memory disambiguation attack + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.12 + - net/mlx5: Fix build break when CONFIG_SMP=n + - net: Fix a bug in removing queues from XPS map + - net/mlx4_core: Fix error handling in mlx4_init_port_info. + - net/sched: fix refcnt leak in the error path of tcf_vlan_init() + - net: sched: red: avoid hashing NULL child + - net/smc: check for missing nlattrs in SMC_PNETID messages + - net: test tailroom before appending to linear skb + - packet: in packet_snd start writing at link layer allocation + - sock_diag: fix use-after-free read in __sk_free + - tcp: purge write queue in tcp_connect_init() + - tun: fix use after free for ptr_ring + - tuntap: fix use after free during release + - cxgb4: Correct ntuple mask validation for hash filters + - [armhf] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule + - net: dsa: Do not register devlink for unused ports + - [armhf] net: dsa: bcm_sf2: Fix IPv6 rules and chain ID + - [armhf] net: dsa: bcm_sf2: Fix IPv6 rule half deletion + - 3c59x: convert to generic DMA API + - cxgb4: fix offset in collecting TX rate limit info + - vmxnet3: set the DMA mask before the first DMA map operation + - vmxnet3: use DMA memory barriers where required + - net: ip6_gre: Request headroom in __gre6_xmit() + - net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit() + - net: ip6_gre: Split up ip6gre_tnl_link_config() + - net: ip6_gre: Split up ip6gre_tnl_change() + - net: ip6_gre: Split up ip6gre_newlink() + - net: ip6_gre: Split up ip6gre_changelink() + - net: ip6_gre: Fix ip6erspan hlen calculation + - net: ip6_gre: fix tunnel metadata device sharing. + - [sparc*]: vio: use put_device() instead of kfree() + - ext2: fix a block leak + - [powerpc*] rfi-flush: Always enable fallback flush on pseries + - [powerpc*] Add security feature flags for Spectre/Meltdown + - [powerpc*] pseries: Add new H_GET_CPU_CHARACTERISTICS flags + - [powerpc*] pseries: Set or clear security feature flags + - [powerpc*] powerpc/powernv: Set or clear security feature flags + - [powerpc*] powerpc/64s: Move cpu_show_meltdown() + - [powerpc*] powerpc/64s: Enhance the information in cpu_show_meltdown() + - [powerpc*] powerpc/powernv: Use the security flags in + pnv_setup_rfi_flush() + - [powerpc*] powerpc/pseries: Use the security flags in + pseries_setup_rfi_flush() + - [powerpc*] powerpc/64s: Wire up cpu_show_spectre_v1() + - [powerpc*] powerpc/64s: Wire up cpu_show_spectre_v2() + - [powerpc*] powerpc/pseries: Fix clearing of security feature flags + - [powerpc*] powerpc: Move default security feature flags + - [powerpc*] powerpc/64s: Add support for a store forwarding barrier at + kernel entry/exit + - [s390x] move nobp parameter functions to nospec-branch.c + - [s390x] add automatic detection of the spectre defense + - [s390x] report spectre mitigation via syslog + - [s390x] add sysfs attributes for spectre + - [s390x] add assembler macros for CPU alternatives + - [s390x] correct nospec auto detection init order + - [s390x] correct module section names for expoline code revert + - [s390x] move expoline assembler macros to a header + - [s390x] crc32-vx: use expoline for indirect branches + - [s390x] lib: use expoline for indirect branches + - [s390x] ftrace: use expoline for indirect branches + - [s390x] kernel: use expoline for indirect branches + - [s390x] move spectre sysfs attribute code + - [s390x] extend expoline to BC instructions + - [s390x] use expoline thunks in the BPF JIT + - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() + - [s390x] scsi: zfcp: fix infinite iteration on ERP ready list + - Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB + - ALSA: usb-audio: Add native DSD support for Luxman DA-06 + - [arm64,armhf] usb: dwc3: Add SoftReset PHY synchonization delay + - [arm64,armhf] usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields + - [arm64,armhf] usb: dwc3: Makefile: fix link error on randconfig + - xhci: zero usb device slot_id member when disabling and freeing a xhci slot + - [arm64,armhf] usb: dwc2: Fix interval type issue + - [arm64,armhf] usb: dwc2: hcd: Fix host channel halt flow + - [arm64,armhf] usb: dwc2: host: Fix transaction errors in host mode + - usbip: Correct maximum value of CONFIG_USBIP_VHCI_HC_PORTS + - media: em28xx: USB bulk packet size fix + - Bluetooth: btusb: Add device ID for RTL8822BE + - Bluetooth: btusb: Add support for Intel Bluetooth device 22560 + [8087:0026] + - xhci: Show what USB release number the xHC supports from protocol + capablity + - loop: don't call into filesystem while holding lo_ctl_mutex + - loop: fix LOOP_GET_STATUS lock imbalance + - cfg80211: limit wiphy names to 128 bytes + - hfsplus: stop workqueue when fill_super() failed + - [x86] kexec: Avoid double free_page() upon do_kexec_load() failure + - staging: bcm2835-audio: Release resources on module_exit() + - staging: lustre: fix bug in osc_enter_cache_try + - [x86] staging: rtl8192u: return -ENOMEM on failed allocation of + priv->oldaddr + - staging: lustre: lmv: correctly iput lmo_root + - [arm64] crypto: inside-secure - move the digest to the request context + - [arm64] crypto: inside-secure - wait for the request to complete if in + the backlog + - [x86] crypto: ccp - don't disable interrupts while setting up debugfs + - [arm64] crypto: inside-secure - do not process request if no command was + issued + - [arm64] crypto: inside-secure - fix the cache_len computation + - [arm64] crypto: inside-secure - fix the extra cache computation + - [arm64] crypto: inside-secure - do not overwrite the threshold value + - [armhf] crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss + - [arm64] crypto: inside-secure - fix the invalidation step during + cra_exit + - scsi: aacraid: Insure command thread is not recursively stopped + - scsi: devinfo: add HP DISK-SUBSYSTEM device, for HP XP arrays + - scsi: lpfc: Fix NVME Initiator FirstBurst + - scsi: core: Make SCSI Status CONDITION MET equivalent to GOOD + - scsi: mvsas: fix wrong endianness of sgpio api + - scsi: lpfc: Fix issue_lip if link is disabled + - scsi: lpfc: Fix nonrecovery of NVME controller after cable swap. + - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing + - scsi: lpfc: Fix IO failure during hba reset testing with nvme io. + - scsi: lpfc: Fix frequency of Release WQE CQEs + - [armhf] clk: rockchip: Fix wrong parent for SDMMC phase clock for rk3228 + - clk: Don't show the incorrect clock phase + - clk: hisilicon: mark wdt_mux_p[] as const + - [arm64,armhf] clk: tegra: Fix pll_u rate configuration + - [armhf] clk: rockchip: Prevent calculating mmc phase if clock rate is + zero + - [armhf] clk: samsung: s3c2410: Fix PLL rates + - [armhf] clk: samsung: exynos7: Fix PLL rates + - [armhf] clk: samsung: exynos5260: Fix PLL rates + - [armhf] clk: samsung: exynos5433: Fix PLL rates + - [armhf] clk: samsung: exynos5250: Fix PLL rates + - [armhf] clk: samsung: exynos3250: Fix PLL rates + - clk: meson: axg: fix the od shift of the sys_pll + - clk: meson: axg: add the fractional part of the fixed_pll + - media: cx23885: Override 888 ImpactVCBe crystal frequency + - media: cx23885: Set subdev host data to clk_freq pointer + - media: em28xx: Add Hauppauge SoloHD/DualHD bulk models + - media: v4l: vsp1: Fix display stalls when requesting too many inputs + - media: i2c: adv748x: fix HDMI field heights + - media: vb2: Fix videobuf2 to map correct area + - media: vivid: fix incorrect capabilities for radio + - media: cx25821: prevent out-of-bounds read on array card + - [arm64] serial: mvebu-uart: fix tx lost characters + - [sh4] serial: sh-sci: Fix out-of-bounds access through DT alias + - [armhf] serial: samsung: Fix out-of-bounds access through serial port + index + - [armhf] serial: imx: Fix out-of-bounds access through serial port index + - [armhf] serial: arc_uart: Fix out-of-bounds access through DT alias + - [arm*] serial: 8250: Don't service RX FIFO if interrupts are disabled + - [armhf] rtc: snvs: Fix usage of snvs_rtc_enable + - rtc: hctosys: Ensure system time doesn't overflow time_t + - [arm64,armhf] rtc: rk808: fix possible race condition + - [armel/marvell] rtc: m41t80: fix race conditions + - [m68k] rtc: rp5c01: fix possible race condition + + [ Romain Perier ] + * [armhf] DRM: Enable DW_HDMI_AHB_AUDIO and DW_HDMI_CEC (Closes: #897204) + * [armhf] MFD: Enable MFD_TPS65217 (Closes: #897590) + + [ Ben Hutchings ] + * kbuild: use -fmacro-prefix-map to make __FILE__ a relative path + * Bump ABI to 2 + * [rt] Update to 4.16.8-rt3 + * [x86] KVM: VMX: Expose SSBD properly to guests. + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.16.7-rt1 and reenable + * [rt] certs: Reference certificate for test key used in Debian signing + service + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 27 May 2018 14:05:03 +0200 + +linux (4.16.5-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.3 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4 + - ext4: limit xattr size to INT_MAX (CVE-2018-1095) + - random: fix crng_ready() test (CVE-2018-1108) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.5 + + [ Ben Hutchings ] + * aufs: gen-patch: Fix Subject generation to skip SPDX-License-Identifier + * aufs: Update support patchset to aufs4.16-20180409 (no functional change) + * wireless: Add Debian wireless-regdb certificates (see #892229) + * Add support for compilers installed outside the default PATH + * linux-headers: Change linux-kbuild dependency to be versioned + * Set ABI to 1 + * [x86,arm64] Disable code signing for upload to unstable + * debian/lib/python/debian_linux/debian.py: Fix binNMU changelog parsing + * debian/lib/python/debian_linux/debian.py: Fix binNMU revision parsing + * xfs: enhance dinode verifier (CVE-2018-10322) + * xfs: set format back to extents if xfs_bmap_extents_to_btree + (CVE-2018-10323) + * udeb: Add algif_skcipher to crypto-modules (Closes: #896968) + * ext4: fix bitmap position validation (fixes regression in 4.15.17-1) + * debian/lib/python/debian_linux/gencontrol.py: Allow uploads to *-security + with a simple revision + + [ Vagrant Cascadian ] + * [arm64] Add patches to support SATA on Tegra210/Jetson-TX1. + + [ James Clarke ] + * [ia64] Drop nic-modules Depends overrides (fixes FTBFS) + + [ Vagrant Cascadian ] + * [arm64] Enable features to support Pinebook and other A64 systems: + CONFIG_USB_MUSB_HDRC, CONFIG_USB_MUSB_SUNXI, CONFIG_SUN8I_DE2_CCU, + CONFIG_DMA_SUN6I + * [arm64] Add patch enabling simplefb LCD on A64. + + [ Roger Shimizu ] + * [armel] Add dependency of udeb modules (fixes FTBFS): + - Add lzo_decompress to lzo-modules. + - Add cmdlinepart to mtd-modules. + * [armel] Add dependency of udeb packages (fixes FTBFS): + - Add package dependency of mtd-modules to jffs2-modules. + - Add package dependency of lzo-modules to squashfs-modules. + + [ Helge Deller ] + * [hppa] Switch to self-decompressing kernel to save disk space in /boot + + [ Uwe Kleine-König ] + * [amd64] enable AMD 10GbE Ethernet driver (CONFIG_AMD_XGBE=m) + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 29 Apr 2018 17:09:14 +0100 + +linux (4.16-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.16 + + [ Jeremy Stanley ] + * [x86] Power management support for GPD Pocket UMPC systems + (Closes: #895164) + - Enable CONFIG_PWM_LPSS_PLATFORM as a module (provides support for the + low-level power subsystem handling backlight control) along with its + dependency CONFIG_PWM=y + - Enable CONFIG_INTEL_INT0002_VGPIO as a module (provides support for the + Bay Trail/Cherry Trail virtual GPIO controller to handle power events) + - Enable CONFIG_REGULATOR (needed to build the already enabled + CONFIG_INTEL_CHT_INT33FE module which provides support for the ACPI + interface) + - Enable CONFIG_TYPEC_FUSB302 as a module (provides support for the USB + type-C interface) along with its dependencies CONFIG_TYPEC=m and + CONFIG_TYPEC_TCPM=m + - Enable CONFIG_BATTERY_MAX17042 as a module (provides support for the + battery level monitor) + - Enable CONFIG_CHARGER_BQ24190 as a module (provides support for the + battery charger) along with its dependencies CONFIG_EXTCON=m, + CONFIG_EXTCON_INTEL_CHT_WC=m, CONFIG_I2C_CHT_WC=m and + CONFIG_INTEL_SOC_PMIC_CHTWC=y + + [ Roger Shimizu ] + * [armel] Bring back armel build by reverting two commits that disabled + armel previously: + - [2ed70eb] "Add empty featuresets for armel to help abiupdate script" + - [5f62872] "(Temporarily) disable armel kernel image build" + * [armel] Reduce armel image size by: + - Set CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y + - Change MTD, MTD_CMDLINE_PARTS, RTC_DRV_MV, and SPI_ORION from + built-in to module. + - Disable VT, ZSWAP, RD_BZIP2, and RD_LZMA. + Thanks to Leigh Brown <leigh@solinno.co.uk> for his idea to disable VT. + + [ Riku Voipio ] + * [armhf] Add dove cubox support, thanks to Josua Mayer (Closes: #876774) + + [ Sjoerd Simons ] + * Enable DRM_DP_AUX_CHARDEV (Closes: #890235) + + [ Ben Hutchings ] + * Set ABI name to trunk + * debian/config: Rename [build]signed-modules setting to signed-code + * debian/lib/python/debian_linux/gencontrol.py: Allow overriding output + filenames + * debian/lib/python/debian_linux/debian.py: Close changelog after parsing + * debian/lib/python/debian_linux/debian.py: Allow parsing any file as + changelog + * debian/rules.d/tools/lib/lockdep/Makefile: Fix repeated 'make install' + * Add template source package to support code signing + * Use a dummy build profile for udebs that we test-build before signing + * debian/lib/python/debian_linux/debian.py: Parse bottom lines of changelog + entries + * debian/bin/gencontrol_signed.py: Copy maintainer and date into template's + changelog + * [x86,arm64] Enable code signing again + * certs: Add certificate for test key used in Debian signing service + * integrity: Disable IMA until it works properly with lockdown + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 08 Apr 2018 14:44:18 +0200 + +linux (4.16~rc6-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Jeremy Stanley ] + * [x86] Enable CONFIG_GPD_POCKET_FAN as a module (provides fan control on + GPD Pocket UMPC systems) (Closes: #893451) + + [ Uwe Kleine-König ] + * [arm64] enable various drivers as module for teres-i OSHW laptop + (Closes: #892786) + + [ Helge Deller ] + * [hppa] Re-enable 32-bit SMP kernel build. Qemu now supports it. + + [ Ben Hutchings ] + * udeb: Add dependency from nic-modules to zlib-modules (fixes FTBFS on + some architectures) + * i40e: Add kconfig dependency to ensure cmpxchg64() is available + (fixes FTBFS on some architectures) + * [ia64] Re-add configuration for kernel and udebs: + - Revert "Remove all support for ia64" (Closes: #886693) + - Disable IRDA, consistent with other architectures + - linux-image: Don't suggest fdutils + - Compile with gcc-7 + - linux-image: Improve flavour descriptions + - udeb: Combine core-modules/kernel-image and scsi{,-common,-extra}-modules + - udeb: Add i2c-modules + + [ Vagrant Cascadian ] + * [armhf] Enable ARCH_MESON and related drivers. + * [armhf] Add device-tree patches from linux-next to support USB and + Ethernet on meson8b. + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 20 Mar 2018 13:52:03 +0000 + +linux (4.16~rc5-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Uwe Kleine-König ] + * netfilter: enable NFT_FIB_NETDEV as module + + [ Thadeu Lima de Souza Cascardo ] + * [powerpc,ppc64el,ppc64] Enable CRASH_DUMP (Closes: #883432) + + [ Bastian Blank ] + * Drop note about Xen from long descriptions. + + [ Vagrant Cascadian ] + * [arm64] Enable ROCKCHIP_IODOMAIN as a module, to enable PCIe reset. + * [arm64] Enable REGULATOR_FAN53555 as a module, enabling cpufreq to + work on rk3399 A72 cores. + * [arm64] Apply patch from linux-next to fix eMMC corruption on + Odroid-C2 (Closes: #879072). + + [ Ben Hutchings ] + * debian/control: Update profile qualification for build-deps on bison + and flex, which are now used to build kconfig + * debian/rules.d/tools/kconfig/Makefile: Use bison and flex to build kconfig + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 13 Mar 2018 02:06:57 +0000 + +linux (4.15.17-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.12 + - [i386] vm86: Fix POPF emulation + - [i386] speculation, objtool: Annotate indirect calls/jumps for objtool on + 32-bit kernels + - [x86] speculation: Remove Skylake C2 from Speculation Control microcode + blacklist + - [x86] KVM: Fix device passthrough when SME is active + - [x86] mm: Fix vmalloc_fault to use pXd_large + - [hppa] Handle case where flush_cache_range is called with no context + - ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() + - ALSA: hda - Revert power_save option default value + - ALSA: seq: Fix possible UAF in snd_seq_check_queue() + - ALSA: seq: Clear client entry before deleting else at closing + - drm/nouveau/bl: Fix oops on driver unbind + - drm/nouveau/mmu: ALIGN_DOWN correct variable (Closes: #895750) + - drm/amdgpu: fix prime teardown order + - drm/radeon: fix prime teardown order + - drm/amdgpu/dce: Don't turn off DP sink when disconnected + - fs: Teach path_connected to handle nfs filesystems with multiple roots. + - [armhf,arm64] KVM: Reduce verbosity of KVM init log + - [armhf,arm64] KVM: Reset mapped IRQs on VM reset + - [armhf,arm64] kvm: vgic-v3: Tighten synchronization for guests using v2 + on v3 + - [armhf.arm64] KVM: vgic: Don't populate multiple LRs with the same vintid + - lock_parent() needs to recheck if dentry got __dentry_kill'ed under it + - fs/aio: Add explicit RCU grace period when freeing kioctx + - fs/aio: Use RCU accessors for kioctx_table->table[] + - RDMAVT: Fix synchronization around percpu_ref + - [armhf.arm64] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis + - nvme: fix subsystem multiple controllers support check + - xfs: preserve i_rdev when recycling a reclaimable inode + - btrfs: Fix NULL pointer exception in find_bio_stripe + - btrfs: add missing initialization in btrfs_check_shared + - btrfs: alloc_chunk: fix DUP stripe size handling + - btrfs: Fix use-after-free when cleaning up fs_devs with a single stale + device + - btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes + - btrfs: Fix memory barriers usage with device stats counters + - scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que + - scsi: qla2xxx: Fix NULL pointer access for fcport structure + - scsi: qla2xxx: Fix logo flag for qlt_free_session_done() + - scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure + - usb: dwc2: fix STM32F7 USB OTG HS compatible + - USB: gadget: udc: Add missing platform_device_put() on error in + bdc_pci_probe() + - usb: dwc3: Fix GDBGFIFOSPACE_TYPE values + - usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode + - usb: dwc3: of-simple: fix oops by unbalanced clk disable call + - usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.13 + - scsi: megaraid_sas: Do not use 32-bit atomic request descriptor for + Ventura controllers + - drm/amdgpu: use polling mem to set SDMA3 wptr for VF + - Bluetooth: hci_qca: Avoid setup failure on missing rampatch + - [arm64] Bluetooth: btqcomsmd: Fix skb double free corruption + - [x86] cpufreq: longhaul: Revert transition_delay_us to 200 ms + - [arm64] drm/msm: fix leak in failed get_pages + - IB/ipoib: Warn when one port fails to initialize + - RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() + - [x86] hv_netvsc: Fix the receive buffer size limit + - [x86] hv_netvsc: Fix the TX/RX buffer default sizes + - tcp: allow TLP in ECN CWR + - libbpf: prefer global symbols as bpf program name source + - rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled. + - rtlwifi: always initialize variables given to RT_TRACE() + - media: bt8xx: Fix err 'bt878_probe()' + - ath10k: handling qos at STA side based on AP WMM enable/disable + - media: dvb-frontends: Add delay to Si2168 restart + - qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect + - serial: 8250_dw: Disable clock on error + - [armhf,arm64] cros_ec: fix nul-termination for firmware build info + - watchdog: Fix potential kref imbalance when opening watchdog + - watchdog: Fix kref imbalance seen if handle_boot_enabled=0 + - platform/chrome: Use proper protocol transfer function + - [armhf] drm/tilcdc: ensure nonatomic iowrite64 is not used + - mmc: avoid removing non-removable hosts during suspend + - mmc: block: fix logical error to avoid memory leak + - /dev/mem: Add bounce buffer for copy-out + - [arm64] net: phy: meson-gxl: check phy_write return value + - IB/ipoib: Avoid memory leak if the SA returns a different DGID + - RDMA/cma: Use correct size when writing netlink stats + - IB/umem: Fix use of npages/nmap fields + - iser-target: avoid reinitializing rdma contexts for isert commands + - bpf/cgroup: fix a verification error for a CGROUP_DEVICE type prog + - PCI/ASPM: Calculate LTR_L1.2_THRESHOLD from device characteristics + - vgacon: Set VGA struct resource types + - [armhf] omapdrm: panel: fix compatible vendor string for td028ttec1 + - [arm64] mmc: sdhci-xenon: wait 5ms after set 1.8V signal enable + - [armhf] drm/omap: DMM: Check for DMM readiness after successful + transaction commit + - pty: cancel pty slave port buf's work in tty_release + - clk: check ops pointer on clock register + - clk: use round rate to bail out early in set_rate + - pinctrl: Really force states during suspend/resume + - [armhf,arm64] pinctrl: rockchip: enable clock when reading pin direction + register + - [x86] iommu/vt-d: clean up pr_irq if request_threaded_irq fails + - ip6_vti: adjust vti mtu according to mtu of lower device + - ip_gre: fix error path when erspan_rcv failed + - ip_gre: fix potential memory leak in erspan_rcv + - [arm64] soc: qcom: smsm: fix child-node lookup + - scsi: lpfc: Fix SCSI LUN discovery when SCSI and NVME enabled + - scsi: lpfc: Fix issues connecting with nvme initiator + - RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS + - nfsd4: permit layoutget of executable-only files + - clk: Don't touch hardware when reparenting during registration + - hwrng: core - Clean up RNG list when last hwrng is unregistered + - [armhf] dmaengine: ti-dma-crossbar: Fix event mapping for + TPCC_EVT_MUX_60_63 + - IB/mlx5: Fix integer overflows in mlx5_ib_create_srq + - IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq + - [x86] RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file + - serial: 8250_pci: Don't fail on multiport card class + - RDMA/core: Do not use invalid destination in determining port reuse + - clk: migrate the count of orphaned clocks at init + - RDMA/ucma: Fix access to non-initialized CM_ID object + - RDMA/ucma: Don't allow join attempts for unsupported AF family + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.14 + - [armhf] iio: st_pressure: st_accel: pass correct platform data to init + - [arm64] iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock() + - ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit + - ALSA: aloop: Sync stale timer before release + - ALSA: aloop: Fix access to not-yet-ready substream via cable + - ALSA: hda - Force polling mode on CFL for fixing codec communication + - ALSA: hda/realtek - Fix speaker no sound after system resume + - ALSA: hda/realtek - Fix Dell headset Mic can't record + - ALSA: hda/realtek - Always immediately update mute LED with pin VREF + - mmc: core: Fix tracepoint print of blk_addr and blksz + - mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards + - mmc: block: fix updating ext_csd caches on ioctl call + - [armhf] mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for + 32-bit systems + - [armhf] mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433 + - [armhf,arm64] mmc: dw_mmc: fix falling from idmac to PIO mode when + dw_mci_reset occurs + - PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L + - lockdep: fix fs_reclaim warning + - [armhf,arm64] clk: bcm2835: Fix ana->maskX definitions + - [armhf,arm64] clk: bcm2835: Protect sections updating shared registers + - [armhf,arm64] clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops + - RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory + - [x86] Drivers: hv: vmbus: Fix ring buffer signaling + - [armhf] pinctrl: samsung: Validate alias coming from DT + - Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table + - Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table + - Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174 + - libata: fix length validation of ATAPI-relayed SCSI commands + - libata: remove WARN() for DMA or PIO command without data + - libata: don't try to pass through NCQ commands to non-NCQ devices + - libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs + - libata: disable LPM for Crucial BX100 SSD 500GB drive + - libata: Enable queued TRIM for Samsung SSD 860 + - libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs + - libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions + - libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version + - sched, cgroup: Don't reject lower cpu.max on ancestors + - cgroup: fix rule checking for threaded mode switching + - nfsd: remove blocked locks on client teardown + - hugetlbfs: check for pgoff value overflow (CVE-2018-7740) + - [x86] mm: implement free pmd/pte page interfaces + - mm/khugepaged.c: convert VM_BUG_ON() to collapse fail + - mm/thp: do not wait for lock_page() in deferred_split_scan() + - mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink() + - Revert "mm: page_alloc: skip over regions of invalid pfns where possible" + - [x86] drm/vmwgfx: Fix black screen and device errors when running without + fbdev + - [x86] drm/vmwgfx: Fix a destoy-while-held mutex problem. + - drm/radeon: Don't turn off DP sink when disconnected + - drm/amd/display: We shouldn't set format_default on plane as atomic driver + - drm/amd/display: Add one to EDID's audio channel count when passing to DC + - drm: Reject getfb for multi-plane framebuffers + - drm: udl: Properly check framebuffer mmap offsets + - mm/vmscan: wake up flushers for legacy cgroups too + - module: propagate error in modules_open() + - acpi, numa: fix pxm to online numa node associations + - ACPI / watchdog: Fix off-by-one error at resource assignment + - libnvdimm, {btt, blk}: do integrity setup before add_disk() + - brcmfmac: fix P2P_DEVICE ethernet address generation + - rtlwifi: rtl8723be: Fix loss of signal + - tracing: probeevent: Fix to support minus offset from symbol + - mtdchar: fix usage of mtd_ooblayout_ecc() + - staging: ncpfs: memory corruption in ncp_read_kernel() (CVE-2018-8822) + - [i386] can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack + - [i386] can: cc770: Fix queue stall & dropped RTR reply + - [i386] can: cc770: Fix use after free in cc770_tx_interrupt() + - tty: vt: fix up tabstops properly + - [amd64] entry: Don't use IST entry for #BP stack + - [amd64] vsyscall: Use proper accessor to update P4D entry + - [x86] efi: Free efi_pgd with free_pages() + - posix-timers: Protect posix clock array access against speculation + - [x86] kvm: fix icebp instruction handling + - [amd64] build: Force the linker to use 2MB page size + - [amd64] boot: Verify alignment of the LOAD segment + - [x86] hwmon: (k10temp) Only apply temperature offset if result is positive + - [x86] hwmon: (k10temp) Add temperature offset for Ryzen 1900X + - [x86] perf/intel/uncore: Fix Skylake UPI event format + - perf stat: Fix CVS output format for non-supported counters + - perf/core: Fix ctx_event_type in ctx_resched() + - trace/bpf: remove helper bpf_perf_prog_read_value from tracepoint type + programs + - [x86] perf/intel: Don't accidentally clear high bits in bdw_limit_period() + - [x86] perf/intel/uncore: Fix multi-domain PCI CHA enumeration bug on + Skylake servers + - iio: ABI: Fix name of timestamp sysfs file + - bpf: skip unnecessary capability check + - [amd64] bpf: increase number of passes + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.15 + - net: dsa: Fix dsa_is_user_port() test inversion + - openvswitch: meter: fix the incorrect calculation of max delta_t + - qed: Fix MPA unalign flow in case header is split across two packets. + - tcp: purge write queue upon aborting the connection + - qed: Fix non TCP packets should be dropped on iWARP ll2 connection + - net: phy: relax error checking when creating sysfs link netdev->phydev + - devlink: Remove redundant free on error path + - macvlan: filter out unsupported feature flags + - net: ipv6: keep sk status consistent after datagram connect failure + - ipv6: old_dport should be a __be16 in __ip6_datagram_connect() + - ipv6: sr: fix NULL pointer dereference when setting encap source address + - ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state + - net: phy: Tell caller result of phy_change() + - ipv6: Reflect MTU changes on PMTU of exceptions for MTU-less routes + - net sched actions: return explicit error when tunnel_key mode is not + specified + - ppp: avoid loop in xmit recursion detection code + - rhashtable: Fix rhlist duplicates insertion + - sch_netem: fix skb leak in netem_enqueue() + - ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() + - net: use skb_to_full_sk() in skb_update_prio() + - net: Fix hlist corruptions in inet_evict_bucket() + - [s390x] qeth: free netdevice when removing a card + - [s390x] qeth: when thread completes, wake up all waiters + - [s390x] qeth: lock read device while queueing next buffer + - [s390x] qeth: on channel error, reject further cmd requests + - dccp: check sk for closed state in dccp_sendmsg() + - ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option() + - l2tp: do not accept arbitrary sockets + - [armhf] net: ethernet: ti: cpsw: add check for in-band mode setting with + RGMII PHY interface + - [armhf] net: fec: Fix unbalanced PM runtime calls + - [s390x] net/iucv: Free memory obtained by kzalloc + - netlink: avoid a double skb free in genlmsg_mcast() + - net: Only honor ifindex in IP_PKTINFO if non-0 + - net: systemport: Rewrite __bcm_sysport_tx_reclaim() + - qede: Fix qedr link update + - skbuff: Fix not waking applications when errors are enqueued + - team: Fix double free in error path + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.16 + - [armhf] OMAP: Fix SRAM W+X mapping + - [armhf] 8746/1: vfp: Go back to clearing vfp_current_hw_state[] + - [armhf] dts: sun6i: a31s: bpi-m2: improve pmic properties + - [armhf] dts: sun6i: a31s: bpi-m2: add missing regulators + - mtd: jedec_probe: Fix crash in jedec_read_mfr() + - ALSA: usb-audio: Add native DSD support for TEAC UD-301 + - ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() + - ALSA: pcm: potential uninitialized return values + - perf/hwbp: Simplify the perf-hwbp code, fix documentation + - ceph: only dirty ITER_IOVEC pages for direct read + - ipc/shm.c: add split function to shm_vm_ops + - [powerpc*] mm: Add tracking of the number of coprocessors using a context + - [powerpc*] mm: Workaround Nest MMU bug with TLB invalidations + - [powerpc*] 64s: Fix lost pending interrupt due to race causing lost + update to irq_happened + - [powerpc*] 64s: Fix i-side SLB miss bad address handler saving + nonvolatile GPRs + - partitions/msdos: Unable to mount UFS 44bsd partitions + - xfrm_user: uncoditionally validate esn replay attribute struct + - RDMA/ucma: Check AF family prior resolving address + - RDMA/ucma: Fix use-after-free access in ucma_close + - RDMA/ucma: Ensure that CM_ID exists prior to access it + - RDMA/rdma_cm: Fix use after free race with process_one_req + - RDMA/ucma: Check that device is connected prior to access it + - RDMA/ucma: Check that device exists prior to accessing it + - RDMA/ucma: Introduce safer rdma_addr_size() variants + - ipv6: fix possible deadlock in rt6_age_examine_exception() + - net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() + - xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems + - percpu: add __GFP_NORETRY semantics to the percpu balancing path + - netfilter: x_tables: make allocation less aggressive + - netfilter: bridge: ebt_among: add more missing match size checks + - l2tp: fix races with ipv4-mapped ipv6 addresses + - netfilter: drop template ct when conntrack is skipped. + - netfilter: x_tables: add and use xt_check_proc_name + - [arm64] phy: qcom-ufs: add MODULE_LICENSE tag + - Bluetooth: Fix missing encryption refresh on Security Request + - [x86] drm/i915/dp: Write to SET_POWER dpcd to enable MST hub. + - bitmap: fix memset optimization on big-endian systems + - [x86] mei: remove dev_err message on an unsupported ioctl + - /dev/mem: Avoid overwriting "err" in read_mem() + - media: usbtv: prevent double free in error case (CVE-2017-17975) + - crypto: lrw - Free rctx->ext with kzfree + - [arm64] crypto: inside-secure - fix clock management + - crypto: testmgr - Fix incorrect values in PKCS#1 test vector + - crypto: ahash - Fix early termination in hash walk + - [x86] crypto: ccp - return an actual key size from RSA max_size callback + - [arm*] crypto - Fix random regeneration of S_shipped + - [x86] crypto: cast5-avx - fix ECB encryption when long sg follows short + one + - Btrfs: fix unexpected cow in run_delalloc_nocow + - [x86] staging: comedi: ni_mio_common: ack ai fifo error interrupts. + - Revert "base: arch_topology: fix section mismatch build warnings" + - [x86] Input: ALPS - fix TrackStick detection on Thinkpad L570 and + Latitude 7370 + - [x86] Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list + - [x86] Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad + - vt: change SGR 21 to follow the standards + - [arm64] net: hns: Fix ethtool private flags (CVE-2017-18222) + - Fix slab name "biovec-(1<<(21-12))" + - [armhf] Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin" + - [armhf] Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin" + - Revert "cpufreq: Fix governor module removal race" + - Revert "ip6_vti: adjust vti mtu according to mtu of lower device" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.17 + - i40iw: Fix sequence number for the first partial FPDU + - i40iw: Correct Q1/XF object count equation + - i40iw: Validate correct IRD/ORD connection parameters + - [arm64] clk: meson: mpll: use 64-bit maths in params_from_rate + - ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT + - thermal: power_allocator: fix one race condition issue for + thermal_instances list + - perf probe: Find versioned symbols from map + - perf probe: Add warning message if there is unexpected event name + - perf evsel: Fix swap for samples with raw data + - perf evsel: Enable ignore_missing_thread for pid option + - l2tp: fix missing print session offset info + - rds; Reset rs->rs_bound_addr in rds_add_bound() failure path + - [x86] ACPI / video: Default lcd_only to true on Win8-ready and newer + machines + - net/mlx4_en: Change default QoS settings + - IB/mlx5: Report inner RSS capability + - VFS: close race between getcwd() and d_move() + - [armhf,arm64] watchdog: dw_wdt: add stop watchdog operation + - clk: divider: fix incorrect usage of container_of + - PM / devfreq: Fix potential NULL pointer dereference in governor_store + - gpiolib: don't dereference a desc before validation + - net_sch: red: Fix the new offload indication + - [arm64] thermal/drivers/hisi: Remove bogus const from function return type + - RDMA/cma: Mark end of CMA ID messages + - f2fs: fix lock dependency in between dio_rwsem & i_mmap_sem + - [armhf] clk: sunxi-ng: a83t: Add M divider to TCON1 clock + - media: videobuf2-core: don't go out of the buffer range + - [x86] ASoC: Intel: Skylake: Disable clock gating during firmware and + library download + - [x86] ASoC: Intel: cht_bsw_rt5645: Analog Mic support + - [arm64] drm/msm: Fix NULL deref in adreno_load_gpu + - IB/ipoib: Fix for notify send CQ failure messages + - scsi: libiscsi: Allow sd_shutdown on bad transport + - scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. + - [armhf,arm64] irqchip/gic-v3: Fix the driver probe() fail due to disabled + GICC entry + - ACPI: EC: Fix debugfs_create_*() usage + - mac80211: Fix setting TX power on monitor interfaces + - vfb: fix video mode and line_length being set when loaded + - gpio: label descriptors using the device name + - [arm64] asid: Do not replace active_asids if already 0 + - [powerpc*] powernv-cpufreq: Add helper to extract pstate from PMSR + - IB/rdmavt: Allocate CQ memory on the correct node + - blk-mq: avoid to map CPU into stale hw queue + - blk-mq: fix race between updating nr_hw_queues and switching io sched + - nvme-fabrics: protect against module unload during create_ctrl + - nvme-fabrics: don't check for non-NULL module in nvmf_register_transport + - [x86] pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts + - nvme_fcloop: disassocate local port structs + - nvme_fcloop: fix abort race condition + - tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented + - perf report: Fix a no annotate browser displayed issue + - [x86] staging: lustre: disable preempt while sampling processor id. + - [x86] ASoC: Intel: sst: Fix the return value o + 'sst_send_byte_stream_mrfld()' + - [armhf] power: supply: axp288_charger: Properly stop work on probe-error + / remove + - rt2x00: do not pause queue unconditionally on error path + - wl1251: check return from call to wl1251_acx_arp_ip_filter + - net/mlx5: Fix race for multiple RoCE enable + - bcache: ret IOERR when read meets metadata error + - bcache: stop writeback thread after detaching + - bcache: segregate flash only volume write streams + - scsi: libsas: Use dynamic alloced work to avoid sas event lost + - net: Fix netdev_WARN_ONCE macro + - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (CVE-2018-7757) + - scsi: libsas: fix error when getting phy events + - scsi: libsas: initialize sas_phy status according to response of DISCOVER + - net/mlx5e: IPoIB, Use correct timestamp in child receive flow + - blk-mq: fix kernel oops in blk_mq_tag_idle() + - tty: n_gsm: Allow ADM response in addition to UA for control dlci + - block, bfq: put async queues for root bfq groups too + - serdev: Fix serdev_uevent failure on ACPI enumerated serdev-controllers + - i40evf: don't rely on netif_running() outside rtnl_lock() + - drm/amd/powerplay: fix memory leakage when reload (v2) + - cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages + - PM / domains: Don't skip driver's ->suspend|resume_noirq() callbacks + - scsi: megaraid_sas: Error handling for invalid ldcount provided by + firmware in RAID map + - scsi: megaraid_sas: unload flag should be set after scsi_remove_host is + called + - RDMA/cma: Fix rdma_cm path querying for RoCE + - [x86] gart: Exclude GART aperture from vmcore + - sdhci: Advertise 2.0v supply on SDIO host controller + - Input: goodix - disable IRQs while suspended + - mtd: mtd_oobtest: Handle bitflips during reads + - crypto: aes-generic - build with -Os on gcc-7+ + - perf tools: Fix copyfile_offset update of output offset + - tcmu: release blocks for partially setup cmds + - [x86] thermal: int3400_thermal: fix error handling in + int3400_thermal_probe() + - [x86] drm/i915/cnp: Ignore VBT request for know invalid DDC pin. + - [x86] drm/i915/cnp: Properly handle VBT ddc pin out of bounds. + - [x86] microcode: Propagate return value from updating functions + - [x86] CPU: Add a microcode loader callback + - [x86] CPU: Check CPU feature bits after microcode upgrade + - [x86] microcode: Get rid of struct apply_microcode_ctx + - [x86] microcode/intel: Check microcode revision before updating sibling + threads + - [x86] microcode/intel: Writeback and invalidate caches before updating + microcode + - [x86] microcode: Do not upload microcode if CPUs are offline + - [x86] microcode/intel: Look into the patch cache first + - [x86] microcode: Request microcode on the BSP + - [x86] microcode: Synchronize late microcode loading + - [x86] microcode: Attempt late loading only when new microcode is present + - [x86] microcode: Fix CPU synchronization routine + - arp: fix arp_filter on l3slave devices + - ipv6: the entire IPv6 header chain must fit the first fragment + - lan78xx: Crash in lan78xx_writ_reg (Workqueue: events + lan78xx_deferred_multicast_write) + - net: dsa: Discard frames from unused ports + - net: fix possible out-of-bound read in skb_network_protocol() + - net/ipv6: Fix route leaking between VRFs + - net/ipv6: Increment OUTxxx counters after netfilter hook + - netlink: make sure nladdr has correct size in netlink_connect() + - net/mlx5e: Verify coalescing parameters in range + - net sched actions: fix dumping which requires several messages to user + space + - net/sched: fix NULL dereference in the error path of tcf_bpf_init() + - pptp: remove a buggy dst release in pptp_connect() + - r8169: fix setting driver_data after register_netdev + - sctp: do not leak kernel memory to user space + - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 + - sky2: Increase D3 delay to sky2 stops working after suspend + - vhost: correctly remove wait queue during poll failure + - vlan: also check phy_driver ts_info for vlan's real device + - vrf: Fix use after free and double free in vrf_finish_output + - bonding: fix the err path for dev hwaddr sync in bond_enslave + - bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave + - bonding: process the err returned by dev_set_allmulti properly in + bond_enslave + - net: fool proof dev_valid_name() + - ip_tunnel: better validate user provided tunnel names + - ipv6: sit: better validate user provided tunnel names + - ip6_gre: better validate user provided tunnel names + - ip6_tunnel: better validate user provided tunnel names + - vti6: better validate user provided tunnel names + - net/mlx5e: Set EQE based as default TX interrupt moderation mode + - net_sched: fix a missing idr_remove() in u32_delete_key() + - net/sched: fix NULL dereference in the error path of tcf_vlan_init() + - net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path + - net/mlx5e: Fix memory usage issues in offloading TC flows + - net/sched: fix NULL dereference in the error path of tcf_sample_init() + - nfp: use full 40 bits of the NSP buffer address + - ipv6: sr: fix seg6 encap performances with TSO enabled + - net/mlx5e: Don't override vport admin link state in switchdev mode + - net/mlx5e: Sync netdev vxlan ports at open + - net/sched: fix NULL dereference in the error path of tunnel_key_init() + - net/sched: fix NULL dereference on the error path of tcf_skbmod_init() + - strparser: Fix sign of err codes + - net/mlx4_en: Fix mixed PFC and Global pause user control requests + - net/mlx5e: Fix traffic being dropped on VF representor + - vhost: validate log when IOTLB is enabled + - route: check sysctl_fib_multipath_use_neigh earlier than hash + - team: move dev_mc_sync after master_upper_dev_link in team_port_add + - vhost_net: add missing lock nesting notation + - net/mlx4_core: Fix memory leak while delete slave's resources + + [ Roger Shimizu ] + * [armel] Bring back armel build by reverting two commits that disabled + armel previously: + - [2ed70eb] "Add empty featuresets for armel to help abiupdate script" + - [5f62872] "(Temporarily) disable armel kernel image build" + * [armel] Reduce armel image size by: + - Set CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y + - Change MTD, MTD_CMDLINE_PARTS, RTC_DRV_MV, and SPI_ORION from + built-in to module. + - Disable VT, ZSWAP, RD_BZIP2, and RD_LZMA. + Thanks to Leigh Brown <leigh@solinno.co.uk> for his idea to disable VT. + * [armel] Add dependency of udeb modules (fixes FTBFS): + - Add lzo_decompress to lzo-modules. + - Add cmdlinepart to mtd-modules. + * [armel] Add dependency of udeb packages (fixes FTBFS): + - Add package dependency of mtd-modules to jffs2-modules. + - Add package dependency of lzo-modules to squashfs-modules. + + [ Ben Hutchings ] + * wireless: Disable regulatory.db direct loading (see #892229) + * Bump ABI to 3 + * scsi: libsas: direct call probe and destruct (CVE-2017-18232) + * ext4: fail ext4_iget for root directory if unallocated (CVE-2018-1092) + * ext4: add validity checks for bitmap block numbers (CVE-2018-1093) + * ext4: always initialize the crc32c checksum driver (CVE-2018-1094) + * scsi: libsas: defer ata device eh commands to libata (CVE-2018-10021) + * [armel/marvell] linux-image: Replace supported model list with wiki link + * [armhf] udeb: Add i2c-exynos5 to i2c-modules (Closes: #895976) + * [arm*] iio: Enable DHT11 as module (Closes: #873176) + * udeb: Move arc4 and ecb from nic-wireless-modules to crypto-modules + (Closes: #895362) + * SCSI: Enable SCSI_SYM53C8XX_2 as module on all architectures + (Closes: #895532) + * [x86] Enable MFD_AXP20X_I2C, AXP288_FUEL_GAUGE as modules (Closes: #895129) + * w1: Enable all "slave" device drivers (Closes: #895340) + * [arm64] net/phy: Enable MDIO_BUS_MUX_MMIOREG as module (Closes: #894336) + * [x86] net: Enable THUNDERBOLT_NET as module (Closes: #894310) + * [x86] platform: Enable DELL_SMBIOS_SMM, DELL_SMBIOS_WMI as modules + (closes: #893976) + * ath9k_htc: Fix regression in 4.15, thanks to Ben Caradoc-Davies + (Closes: #891060) + - mac80211: add ieee80211_hw flag for QoS NDP support + - ath9k_htc: use non-QoS NDP for AP probing + * squashfs: Enable SQUASHFS_ZSTD (Closes: #883410) + * block: Enable BLK_SED_OPAL (except on armel) + * [arm64] Enable ARCH_SYNQUACER and related driver modules (Closes: #891787) + * [arm64] PCI: Enable PCI_TEGRA (Closes: #888817) + * [amd64] net: Enable AQTION as module + * udeb: Rename lzo-modules to compress-modules + * udeb: Add zstd_decompress to compress-modules and make squashfs-modules + depend on it + + [ Vagrant Cascadian ] + * [armhf] Add patch to fix loading of imx6q-cpufreq module. + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 19 Apr 2018 11:13:03 +0100 + +linux (4.15.11-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.5 + - IB/umad: Fix use of unprotected device pointer + - IB/qib: Fix comparison error with qperf compare/swap test + - IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH + ports + - IB/core: Fix two kernel warnings triggered by rxe registration + - IB/core: Fix ib_wc structure size to remain in 64 bytes boundary + - IB/core: Avoid a potential OOPs for an unused optional parameter + - RDMA/rxe: Fix a race condition related to the QP error state + - RDMA/rxe: Fix a race condition in rxe_requester() + - RDMA/rxe: Fix rxe_qp_cleanup() + - [powerpc*] cpufreq: powernv: Dont assume distinct pstate values for + nominal and pmin + - swiotlb: suppress warning when __GFP_NOWARN is set + - PM / devfreq: Propagate error from devfreq_add_device() + - mwifiex: resolve reset vs. remove()/shutdown() deadlocks + - ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE + - trace_uprobe: Display correct offset in uprobe_events + - [powerpc*] radix: Remove trace_tlbie call from radix__flush_tlb_all + - [powerpc*] kernel: Block interrupts when updating TIDR + - [powerpc*] vas: Don't set uses_vas for kernel windows + - [powerpc*] numa: Invalidate numa_cpu_lookup_table on cpu remove + - [powerpc*] mm: Flush radix process translations when setting MMU type + - [powerpc*] xive: Use hw CPU ids when configuring the CPU queues + - dma-buf: fix reservation_object_wait_timeout_rcu once more v2 + - [s390x] fix handling of -1 in set{,fs}[gu]id16 syscalls + - [arm64] dts: msm8916: Correct ipc references for smsm + - [x86] gpu: add CFL to early quirks + - [x86] kexec: Make kexec (mostly) work in 5-level paging mode + - [x86] xen: init %gs very early to avoid page faults with stack protector + - [x86] PM: Make APM idle driver initialize polling state + - mm, memory_hotplug: fix memmap initialization + - [amd64] entry: Clear extra registers beyond syscall arguments, to reduce + speculation attack surface + - [amd64] entry/compat: Clear registers for compat syscalls, to reduce + speculation attack surface + - [armhf] crypto: sun4i_ss_prng - fix return value of sun4i_ss_prng_generate + - [armhf] crypto: sun4i_ss_prng - convert lock to _bh in + sun4i_ss_prng_generate + - [powerpc*] mm/radix: Split linear mapping on hot-unplug + - [x86] speculation: Update Speculation Control microcode blacklist + - [x86] speculation: Correct Speculation Control microcode blacklist again + - [x86] Revert "x86/speculation: Simplify + indirect_branch_prediction_barrier()" + - [x86] KVM: Reduce retpoline performance impact in + slot_handle_level_range(), by always inlining iterator helper methods + - [X86] nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs + - [x86] KVM/nVMX: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 + MSR bitmap + - [x86] speculation: Clean up various Spectre related details + - PM / runtime: Update links_count also if !CONFIG_SRCU + - PM: cpuidle: Fix cpuidle_poll_state_init() prototype + - [x86] platform: wmi: fix off-by-one write in wmi_dev_probe() + - [amd64] entry: Clear registers for exceptions/interrupts, to reduce + speculation attack surface + - [amd64] entry: Merge SAVE_C_REGS and SAVE_EXTRA_REGS, remove unused + extensions + - [amd64] entry: Merge the POP_C_REGS and POP_EXTRA_REGS macros into a + single POP_REGS macro + - [amd64] entry: Interleave XOR register clearing with PUSH instructions + - [amd64] entry: Introduce the PUSH_AND_CLEAN_REGS macro + - [amd64] entry: Use PUSH_AND_CLEAN_REGS in more cases + - [amd64] entry: Get rid of the ALLOC_PT_GPREGS_ON_STACK and + SAVE_AND_CLEAR_REGS macros + - [amd64] entry: Indent PUSH_AND_CLEAR_REGS and POP_REGS properly + - [amd64] entry: Fix paranoid_entry() frame pointer warning + - [amd64] entry: Remove the unused 'icebp' macro + - gfs2: Fixes to "Implement iomap for block_map" + - objtool: Fix segfault in ignore_unreachable_insn() + - [x86] debug, objtool: Annotate WARN()-related UD2 as reachable + - [x86] debug: Use UD2 for WARN() + - [x86] speculation: Fix up array_index_nospec_mask() asm constraint + - nospec: Move array_index_nospec() parameter checking into separate macro + - [x86] speculation: Add <asm/msr-index.h> dependency + - [x86] mm: Rename flush_tlb_single() and flush_tlb_one() to + __flush_tlb_one_[user|kernel]() + - [x86] cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping + - [x86] spectre: Fix an error message + - [x86] cpu: Change type of x86_cache_size variable to unsigned int + - [amd64] entry: Fix CR3 restore in paranoid_exit() + - drm/ttm: Don't add swapped BOs to swap-LRU list + - drm/ttm: Fix 'buf' pointer update in ttm_bo_vm_access_kmap() (v2) + - drm/qxl: unref cursor bo when finished with it + - drm/qxl: reapply cursor after resetting primary + - drm/amd/powerplay: Fix smu_table_entry.handle type + - drm/ast: Load lut in crtc_commit + - drm: Check for lessee in DROP_MASTER ioctl + - [arm64] Add missing Falkor part number for branch predictor hardening + - drm/radeon: Add dpm quirk for Jet PRO (v2) + - drm/radeon: adjust tested variable + - [x86] smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a + physical CPU + - [powerpc*] rtc-opal: Fix handling of firmware error codes, prevent busy + loops + - mbcache: initialize entry->e_referenced in mb_cache_entry_create() + - mmc: sdhci: Implement an SDHCI-specific bounce buffer + - [armhf,arm64] mmc: bcm2835: Don't overwrite max frequency unconditionally + - [arm64] Revert "mmc: meson-gx: include tx phase in the tuning process" + - mlx5: fix mlx5_get_vector_affinity to start from completion vector 0 + - [x86] Revert "apple-gmux: lock iGP IO to protect from vgaarb changes" + - ext4: fix a race in the ext4 shutdown path + - ext4: save error to disk in __ext4_grp_locked_error() + - ext4: correct documentation for grpid mount option + - mm: Fix memory size alignment in devm_memremap_pages_release() + - [mips*] Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN + - [mips*] CPS: Fix MIPS_ISA_LEVEL_RAW fallout + - [mips*] Fix incorrect mem=X@Y handling + - [arm64] PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode + - [armhf,arm64] PCI: iproc: Fix NULL pointer dereference for BCMA + - [x86] PCI: pciehp: Assume NoCompl+ for Thunderbolt ports + - console/dummy: leave .con_font_get set to NULL + - rbd: whitelist RBD_FEATURE_OPERATIONS feature bit + - xen: Fix {set,clear}_foreign_p2m_mapping on autotranslating guests + - xenbus: track caller request id + - seq_file: fix incomplete reset on read from zero offset + - tracing: Fix parsing of globs with a wildcard at the beginning + - mpls, nospec: Sanitize array index in mpls_label_ok() (CVE-2017-5753) + - rtlwifi: rtl8821ae: Fix connection lost problem correctly + - [arm64] proc: Set PTE_NG for table entries to avoid traversing them twice + - xprtrdma: Fix calculation of ri_max_send_sges + - xprtrdma: Fix BUG after a device removal + - blk-wbt: account flush requests correctly + - target/iscsi: avoid NULL dereference in CHAP auth error path + - iscsi-target: make sure to wake up sleeping login worker + - dm: correctly handle chained bios in dec_pending() + - Btrfs: fix deadlock in run_delalloc_nocow + - Btrfs: fix crash due to not cleaning up tree log block's dirty bits + - Btrfs: fix extent state leak from tree log + - Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly + - Btrfs: fix use-after-free on root->orphan_block_rsv + - Btrfs: fix unexpected -EEXIST when creating new inode + - 9p/trans_virtio: discard zero-length reply + - mtd: nand: vf610: set correct ooblayout + - ALSA: hda - Fix headset mic detection problem for two Dell machines + - ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute + - ALSA: hda/realtek - Add headset mode support for Dell laptop + - ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform + - ALSA: hda/realtek: PCI quirk for Fujitsu U7x7 + - ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204 + - ALSA: usb: add more device quirks for USB DSD devices + - ALSA: seq: Fix racy pool initializations (CVE-2018-7566) + - [armhf,arm64] mvpp2: fix multicast address filter + - usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT + - [x86] mm, mm/hwpoison: Don't unconditionally unmap kernel 1:1 pages + - [armhf] dts: exynos: fix RTC interrupt for exynos5410 + - [arm64] dts: msm8916: Add missing #phy-cells + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.6 + - tun: fix tun_napi_alloc_frags() frag allocator + - ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE + - ptr_ring: try vmalloc() when kmalloc() fails + - selinux: ensure the context is NUL terminated in + security_context_to_sid_core() + - selinux: skip bounded transition processing if the policy isn't loaded + - media: pvrusb2: properly check endpoint types + - [x86] crypto: twofish-3way - Fix %rbp usage + - blk_rq_map_user_iov: fix error override + - [x86] KVM: fix escape of guest dr6 to the host + - kcov: detect double association with a single task + - netfilter: x_tables: fix int overflow in xt_alloc_table_info() + - netfilter: x_tables: avoid out-of-bounds reads in + xt_request_find_{match|target} + - netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in + clusterip_tg_check() + - netfilter: on sockopt() acquire sock lock only in the required scope + - netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1() + - netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert + - rds: tcp: correctly sequence cleanup on netns deletion. + - rds: tcp: atomically purge entries from rds_tcp_conn_list during netns + delete + - net: avoid skb_warn_bad_offload on IS_ERR + - net_sched: gen_estimator: fix lockdep splat + - [arm64] dts: add #cooling-cells to CPU nodes + - dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock + - xhci: Fix NULL pointer in xhci debugfs + - xhci: Fix xhci debugfs devices node disappearance after hibernation + - xhci: xhci debugfs device nodes weren't removed after device plugged out + - xhci: fix xhci debugfs errors in xhci_stop + - usbip: keep usbip_device sockfd state in sync with tcp_socket + - [x86] mei: me: add cannon point device ids + - [x86] mei: me: add cannon point device ids for 4th device + - vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.7 + - netfilter: drop outermost socket lock in getsockopt() + - [arm64] mm: don't write garbage into TTBR1_EL1 register + - kconfig.h: Include compiler types to avoid missed struct attributes + - scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info + - [mips*] Drop spurious __unused in struct compat_flock + - cfg80211: fix cfg80211_beacon_dup + - i2c: designware: must wait for enable + - [armhf,arm64] i2c: bcm2835: Set up the rising/falling edge delays + - X.509: fix BUG_ON() when hash algorithm is unsupported + - X.509: fix NULL dereference when restricting key with unsupported_sig + - PKCS#7: fix certificate chain verification + - PKCS#7: fix certificate blacklisting + - [x86] genirq/matrix: Handle CPU offlining proper + - RDMA/uverbs: Protect from races between lookup and destroy of uobjects + - RDMA/uverbs: Protect from command mask overflow + - RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd + - RDMA/uverbs: Fix circular locking dependency + - RDMA/uverbs: Sanitize user entered port numbers prior to access it + - iio: buffer: check if a buffer has been set up when poll is called + - Kbuild: always define endianess in kconfig.h + - [x86] apic/vector: Handle vector release on CPU unplug correctly + - mm, swap, frontswap: fix THP swap if frontswap enabled + - mm: don't defer struct page initialization for Xen pv guests + - uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define + - [armhf,arm64] irqchip/gic-v3: Use wmb() instead of smb_wmb() in + gic_raise_softirq() + - [mips*] irqchip/mips-gic: Avoid spuriously handling masked interrupts + - PCI/cxgb4: Extend T3 PCI quirk to T4+ devices + - [x86] net: thunderbolt: Tear down connection properly on suspend + - [x86] net: thunderbolt: Run disconnect flow asynchronously when logout is + received + - ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and + io_watchdog_func() + - usb: ohci: Proper handling of ed_rm_list to handle race condition between + usb_kill_urb() and finish_unlinks() + - [arm64] Remove unimplemented syscall log message + - [arm64] Disable unhandled signal log messages by default + - [arm64] cpufeature: Fix CTR_EL0 field definitions + - USB: Add delay-init quirk for Corsair K70 RGB keyboards + - drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA + - usb: host: ehci: use correct device pointer for dma ops + - usb: dwc3: gadget: Set maxpacket size for ep0 IN + - usb: dwc3: ep0: Reset TRB counter for ep0 IN + - usb: ldusb: add PIDs for new CASSY devices supported by this driver + - Revert "usb: musb: host: don't start next rx urb if current one failed" + - usb: gadget: f_fs: Process all descriptors during bind + - usb: gadget: f_fs: Use config_ep_by_speed() + - drm/cirrus: Load lut in crtc_commit + - drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits + - drm: Handle unexpected holes in color-eviction + - drm/amdgpu: disable MMHUB power gating on raven + - drm/amdgpu: fix VA hole handling on Vega10 v3 + - drm/amdgpu: Add dpm quirk for Jet PRO (v2) + - drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji + - drm/amdgpu: add atpx quirk handling (v2) + - drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) + - drm/amdgpu: add new device to use atpx quirk + - [arm64] __show_regs: Only resolve kernel symbols when running at EL1 + - [x86] drm/i915/breadcrumbs: Ignore unsubmitted signalers + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.8 + - vsprintf: avoid misleading "(null)" for %px + - hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) + - ipmi_si: Fix error handling of platform device + - [x86] platform: dell-laptop: Allocate buffer on heap rather than globally + - [powerpc*] pseries: Enable RAS hotplug events later + - Bluetooth: btusb: Use DMI matching for QCA reset_resume quirking + - ixgbe: fix crash in build_skb Rx code path + - [x86] tpm: st33zp24: fix potential buffer overruns caused by bit glitches + on the bus + - tpm: fix potential buffer overruns caused by bit glitches on the bus + - [x86] tpm_i2c_infineon: fix potential buffer overruns caused by bit + glitches on the bus + - [x86] tpm_i2c_nuvoton: fix potential buffer overruns caused by bit + glitches on the bus + - [x86] tpm_tis: fix potential buffer overruns caused by bit glitches on + the bus + - ALSA: usb-audio: Add a quirck for B&W PX headphones + - ALSA: control: Fix memory corruption risk in snd_ctl_elem_read + - [x86] ALSA: x86: Fix missing spinlock and mutex initializations + - ALSA: hda: Add a power_save blacklist + - ALSA: hda - Fix pincfg at resume on Lenovo T470 dock + - mmc: sdhci-pci: Fix S0i3 for Intel BYT-based controllers + - [armhf,arm64] mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias + - [armhf,arm64] mmc: dw_mmc: Avoid accessing registers in runtime suspended + state + - [armhf,arm64] mmc: dw_mmc: Factor out dw_mci_init_slot_caps + - [armhf,arm64] mmc: dw_mmc: Fix out-of-bounds access for slot's caps + - timers: Forward timer base before migrating timers + - [hppa] Use cr16 interval timers unconditionally on qemu + - [hppa] Reduce irq overhead when run in qemu + - [hppa] Fix ordering of cache and TLB flushes + - [hppa] Hide virtual kernel memory layout + - btrfs: use proper endianness accessors for super_copy + - block: fix the count of PGPGOUT for WRITE_SAME + - block: kyber: fix domain token leak during requeue + - block: pass inclusive 'lend' parameter to truncate_inode_pages_range + - vfio: disable filesystem-dax page pinning + - dax: fix vma_is_fsdax() helper + - direct-io: Fix sleep in atomic due to sync AIO + - [x86] xen: Zero MSR_IA32_SPEC_CTRL before suspend + - [x86] cpu_entry_area: Sync cpu_entry_area to initial_page_table + - bridge: check brport attr show in brport_show + - fib_semantics: Don't match route with mismatching tclassid + - hdlc_ppp: carrier detect ok, don't turn off negotiation + - [arm64] net: amd-xgbe: fix comparison to bitshift when dealing with a mask + - [armhf] net: ethernet: ti: cpsw: fix net watchdog timeout + - net: fix race on decreasing number of TX queues + - net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 + - netlink: ensure to loop over all netns in genlmsg_multicast_allns() + - net: sched: report if filter is too large to dump + - ppp: prevent unregistered channels from connecting to PPP units + - sctp: verify size of a new chunk in _sctp_make_chunk() (CVE-2018-5803) + - udplite: fix partial checksum initialization + - net/mlx5e: Fix TCP checksum in LRO buffers + - sctp: fix dst refcnt leak in sctp_v4_get_dst + - net/mlx5e: Specify numa node when allocating drop rq + - net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT + - tcp: Honor the eor bit in tcp_mtu_probe + - rxrpc: Fix send in rxrpc_send_data_packet() + - tcp_bbr: better deal with suboptimal GSO + - doc: Change the min default value of tcp_wmem/tcp_rmem. + - net/mlx5e: Fix loopback self test when GRO is off + - net_sched: gen_estimator: fix broken estimators based on percpu stats + - net/sched: cls_u32: fix cls_u32 on filter replace + - sctp: do not pr_err for the duplicated node in transport rhlist + - net: ipv4: Set addr_type in hash_keys for forwarded case + - sctp: fix dst refcnt leak in sctp_v6_get_dst() + - bridge: Fix VLAN reference count problem + - net/mlx5e: Verify inline header size do not exceed SKB linear size + - tls: Use correct sk->sk_prot for IPV6 + - [arm64] amd-xgbe: Restore PCI interrupt enablement setting on resume + - cls_u32: fix use after free in u32_destroy_key() + - netlink: put module reference if dump start fails + - tcp: purge write queue upon RST + - tuntap: correctly add the missing XDP flush + - tuntap: disable preemption during XDP processing + - virtio-net: disable NAPI only when enabled during XDP set + - cxgb4: fix trailing zero in CIM LA dump + - net/mlx5: Fix error handling when adding flow rules + - net: phy: Restore phy_resume() locking assumption + - tcp: tracepoint: only call trace_tcp_send_reset with full socket + - l2tp: don't use inet_shutdown on tunnel destroy + - l2tp: don't use inet_shutdown on ppp session destroy + - l2tp: fix races with tunnel socket close + - l2tp: fix race in pppol2tp_release with session object destroy + - l2tp: fix tunnel lookup use-after-free race + - [s390x] qeth: fix underestimated count of buffer elements + - [s390x] qeth: fix SETIP command handling + - [s390x] qeth: fix overestimated count of buffer elements + - [s390x] qeth: fix IP removal on offline cards + - [s390x] qeth: fix double-free on IP add/remove race + - [s390x] Revert "s390/qeth: fix using of ref counter for rxip addresses" + - [s390x] qeth: fix IP address lookup for L3 devices + - [s390x] qeth: fix IPA command submission race + - tcp: revert F-RTO middle-box workaround + - tcp: revert F-RTO extension to detect more spurious timeouts + - blk-mq: don't call io sched's .requeue_request when requeueing rq to + ->dispatch + - media: m88ds3103: don't call a non-initalized function + - [x86] EDAC, sb_edac: Fix out of bound writes during DIMM configuration on + KNL + - [s390x] KVM: take care of clock-comparator sign control + - [s390x] KVM: provide only a single function for setting the tod (fix SCK) + - [s390x] KVM: consider epoch index on hotplugged CPUs + - [s390x] KVM: consider epoch index on TOD clock syncs + - nospec: Allow index argument to have const-qualified type + - [x86] mm: Fix {pmd,pud}_{set,clear}_flags() + - [armhf] orion: fix orion_ge00_switch_board_info initialization + - [armhf] dts: rockchip: Remove 1.8 GHz operation point from phycore som + - [armhf] mvebu: Fix broken PL310_ERRATA_753970 selects + - [x86] KVM: Fix SMRAM accessing even if VM is shutdown + - KVM: mmu: Fix overlap between public and private memslots + - [x86] KVM: Remove indirect MSR op calls from SPEC_CTRL + - [x86] KVM: move LAPIC initialization after VMCS creation + - [x86] KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the + RDMSR path as unlikely() + - [x86] KVM: fix vcpu initialization with userspace lapic + - [x86] KVM: remove WARN_ON() for when vm_munmap() fails + - [x86] ACPI / bus: Parse tables as term_list for Dell XPS 9570 and + Precision M5530 + - [armhf] dts: LogicPD SOM-LV: Fix I2C1 pinmux + - [armhf] dts: LogicPD Torpedo: Fix I2C1 pinmux + - [powerpc*] 64s/radix: Boot-time NULL pointer protection using a guard-PID + - md: only allow remove_and_add_spares when no sync_thread running. + - [x86] platform: dell-laptop: fix kbd_get_state's request value + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.9 + - bpf: fix mlock precharge on arraymaps + - bpf: fix memory leak in lpm_trie map_free callback function + - bpf: fix rcu lockdep warning for lpm_trie map_free callback + - [amd64] bpf: implement retpoline for tail call (CVE-2017-5715) + - [arm64] bpf: fix out of bounds access in tail call + - bpf: add schedule points in percpu arrays management + - bpf: allow xadd only on aligned memory + - [powerpc*] bpf, ppc64: fix out of bounds access in tail call + - scsi: mpt3sas: fix oops in error handlers after shutdown/unload + - scsi: mpt3sas: wait for and flush running commands on shutdown/unload + - [x86] KVM: fix backward migration with async_PF + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.10 + - RDMA/ucma: Limit possible option size + - RDMA/ucma: Check that user doesn't overflow QP state + - RDMA/mlx5: Fix integer overflow while resizing CQ + - bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in + __cpu_map_entry_alloc() + - IB/uverbs: Improve lockdep_check + - mac80211_hwsim: don't use WQ_MEM_RECLAIM + - [x86] drm/i915: Check for fused or unused pipes + - [x86] drm/i915/audio: fix check for av_enc_map overflow + - [x86] drm/i915: Fix rsvd2 mask when out-fence is returned + - [x86] drm/i915: Clear the in-use marker on execbuf failure + - [x86] drm/i915: Disable DC states around GMBUS on GLK + - [x86] drm/i915: Update watermark state correctly in sanitize_watermarks + - [x86] drm/i915: Try EDID bitbanging on HDMI after failed read + - [x86] drm/i915/perf: fix perf stream opening lock + - scsi: core: Avoid that ATA error handling can trigger a kernel hang or + oops (Closes: #891467) + - scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS + - [x86] drm/i915: Always call to intel_display_set_init_power() in + resume_early. + - workqueue: Allow retrieval of current task's work struct + - drm: Allow determining if current task is output poll worker + - drm/nouveau: Fix deadlock on runtime suspend + - drm/radeon: Fix deadlock on runtime suspend + - drm/amdgpu: Fix deadlock on runtime suspend + - drm/nouveau: prefer XBGR2101010 for addfb ioctl + - drm/amd/powerplay/smu7: allow mclk switching with no displays + - drm/amd/powerplay/vega10: allow mclk switching with no displays + - Revert "drm/radeon/pm: autoswitch power state when in balanced mode" + - drm/amd/display: check for ipp before calling cursor operations + - drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE + - drm/amd/powerplay: fix power over limit on Fiji + - drm/amd/display: Default HDMI6G support to true. Log VBIOS table error. + - drm/amdgpu: used cached pcie gen info for SI (v2) + - drm/amdgpu: Notify sbios device ready before send request + - drm/radeon: fix KV harvesting + - drm/amdgpu: fix KV harvesting + - drm/amdgpu:Correct max uvd handles + - drm/amdgpu:Always save uvd vcpu_bo in VM Mode + - ovl: redirect_dir=nofollow should not follow redirect for opaque lower + - [mips*/octeon] irq: Check for null return on kzalloc allocation + - PCI: dwc: Fix enumeration end when reaching root subordinate + - Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI" + - bug: use %pB in BUG and stack protector failure + - lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() + - mm/memblock.c: hardcode the end_pfn being -1 + - Documentation/sphinx: Fix Directive import error + - loop: Fix lost writes caused by missing flag + - virtio_ring: fix num_free handling in error case + - [x390x] KVM: fix memory overwrites when not using SCA entries + - [arm64] mm: fix thinko in non-global page table attribute check + - IB/core: Fix missing RDMA cgroups release in case of failure to register + device + - Revert "nvme: create 'slaves' and 'holders' entries for hidden + controllers" + - kbuild: Handle builtin dtb file names containing hyphens + - dm bufio: avoid false-positive Wmaybe-uninitialized warning + - IB/mlx5: Fix incorrect size of klms in the memory region + - bcache: fix crashes in duplicate cache device register + - bcache: don't attach backing with duplicate UUID + - [x86] MCE: Save microcode revision in machine check records + - [x86] MCE: Serialize sysfs changes (CVE-2018-7995) + - perf tools: Fix trigger class trigger_on() + - [x86] spectre_v2: Don't check microcode versions when running under + hypervisors + - ALSA: hda/realtek - Add support headset mode for DELL WYSE + - ALSA: hda/realtek - Add headset mode support for Dell laptop + - ALSA: hda/realtek: Limit mic boost on T480 + - ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 + - ALSA: hda/realtek - Make dock sound work on ThinkPad L570 + - ALSA: seq: Don't allow resizing pool in use + - ALSA: seq: More protection for concurrent write and ioctl races + - ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines + - ALSA: hda: add dock and led support for HP EliteBook 820 G3 + - ALSA: hda: add dock and led support for HP ProBook 640 G2 + - scsi: qla2xxx: Fix NULL pointer crash due to probe failure + - scsi: qla2xxx: Fix recursion while sending terminate exchange + - dt-bindings: Document mti,mips-cpc binding + - nospec: Kill array_index_nospec_mask_check() + - nospec: Include <asm/barrier.h> dependency + - [x86] entry: Reduce the code footprint of the 'idtentry' macro + - [x86] entry/64: Use 'xorl' for faster register clearing + - [x86] mm: Remove stale comment about KMEMCHECK + - [x86] asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers + - [x86] IO-APIC: Avoid warning in 32-bit builds + - [x86] LDT: Avoid warning in 32-bit builds with older gcc + - x86-64/realmode: Add instruction suffix + - Revert "x86/retpoline: Simplify vmexit_fill_RSB()" + - [x86] speculation: Use IBRS if available before calling into firmware + - [x86] retpoline: Support retpoline builds with Clang + - [x86] speculation, objtool: Annotate indirect calls/jumps for objtool + - [x86] speculation: Move firmware_restrict_branch_speculation_*() from C + to CPP + - [x86] paravirt, objtool: Annotate indirect calls + - [x86] boot, objtool: Annotate indirect jump in secondary_startup_64() + - [x86] mm/sme, objtool: Annotate indirect call in sme_encrypt_execute() + - objtool: Use existing global variables for options + - objtool: Add retpoline validation + - objtool: Add module specific retpoline rules + - objtool, retpolines: Integrate objtool with retpoline support more + closely + - objtool: Fix another switch table detection issue + - objtool: Fix 32-bit build + - [x86] kprobes: Fix kernel crash when probing .entry_trampoline code + - watchdog: hpwdt: SMBIOS check + - watchdog: hpwdt: Check source of NMI + - watchdog: hpwdt: fix unused variable warning + - watchdog: hpwdt: Remove legacy NMI sourcing. + - netfilter: add back stackpointer size checks (CVE-2018-1065) + - netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation + - netfilter: xt_hashlimit: fix lock imbalance + - netfilter: x_tables: fix missing timer initialization in xt_LED + - netfilter: nat: cope with negative port range + - netfilter: IDLETIMER: be syzkaller friendly + - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets + (CVE-2018-1068) + - netfilter: bridge: ebt_among: add missing match size checks + - netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt + - netfilter: use skb_to_full_sk in ip6_route_me_harder + - tpm_tis: Move ilb_base_addr to tpm_tis_data + - tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd() + - tpm: delete the TPM_TIS_CLK_ENABLE flag + - tpm: remove unused variables + - tpm: only attempt to disable the LPC CLKRUN if is already enabled + - [x86] xen: Calculate __max_logical_packages on PV domains + - scsi: qla2xxx: Fix system crash for Notify ack timeout handling + - scsi: qla2xxx: Fix gpnid error processing + - scsi: qla2xxx: Move session delete to driver work queue + - scsi: qla2xxx: Skip IRQ affinity for Target QPairs + - scsi: qla2xxx: Fix re-login for Nport Handle in use + - scsi: qla2xxx: Retry switch command on time out + - scsi: qla2xxx: Serialize GPNID for multiple RSCN + - scsi: qla2xxx: Fix login state machine stuck at GPDB + - scsi: qla2xxx: Fix NPIV host cleanup in target mode + - scsi: qla2xxx: Relogin to target port on a cable swap + - scsi: qla2xxx: Fix Relogin being triggered too fast + - scsi: qla2xxx: Fix PRLI state check + - scsi: qla2xxx: Fix abort command deadlock due to spinlock + - scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport + - scsi: qla2xxx: Fix scan state field for fcport + - scsi: qla2xxx: Clear loop id after delete + - scsi: qla2xxx: Defer processing of GS IOCB calls + - scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout. + - scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref + - scsi: qla2xxx: Fix memory leak in dual/target mode + - NFS: Fix an incorrect type in struct nfs_direct_req + - pNFS: Prevent the layout header refcount going to zero in pnfs_roc() + - NFS: Fix unstable write completion + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.11 + - [x86] Treat R_X86_64_PLT32 as R_X86_64_PC32 + - usb: host: xhci-rcar: add support for r8a77965 + - xhci: Fix front USB ports on ASUS PRIME B350M-A + - xhci: fix endpoint context tracer output + - [sh4] serial: sh-sci: prevent lockup on full TTY buffers + - tty/serial: atmel: add new version check for usart + - uas: fix comparison for error code + - [x86] staging: comedi: fix comedi_nsamples_left. + - USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h + - usbip: vudc: fix null pointer dereference on udc->lock + - usb: quirks: add control message delay for 1b1c:1b20 + - usb: usbmon: Read text within supplied buffer size + - usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() + - [arm64,armhf] usb: dwc3: Fix lock-up on ID change during system + suspend/resume + - serial: 8250_pci: Add Brainboxes UC-260 4 port serial device + - serial: core: mark port as initialized in autoconfig + - earlycon: add reg-offset to physical address before mapping + - dm mpath: fix passing integrity data + - Revert "btrfs: use proper endianness accessors for super_copy" + - gfs2: Clean up {lookup,fillup}_metapath + - gfs2: Fixes to "Implement iomap for block_map" (2) + - [armhf] spi: imx: Fix failure path leak on GPIO request error correctly + - HID: multitouch: Only look at non touch fields in first packet of a + frame + - [powerpc*] KVM: Book3S HV: Avoid shifts by negative amounts + - drm/edid: set ELD connector type in drm_edid_to_eld() + - dma-buf/fence: Fix lock inversion within dma-fence-array + - video/hdmi: Allow "empty" HDMI infoframes + - [powerpc*] KVM: Book3S HV: Fix typo in kvmppc_hv_get_dirty_log_radix() + - HID: elo: clear BTN_LEFT mapping + - iwlwifi: mvm: rs: don't override the rate history in the search cycle + - [armhf] dts: exynos: Correct Trats2 panel reset line + - drm/amdgpu: fix get_max_engine_clock_in_mhz + - USB: ledtrig-usbport: fix of-node leak + - dt-bindings: serial: Add common rs485 binding for RTS polarity + - sched: Stop switched_to_rt() from sending IPIs to offline CPUs + - sched: Stop resched_cpu() from sending IPIs to offline CPUs + - crypto: chelsio - Fix an error code in chcr_hash_dma_map() + - crypto: keywrap - Add missing ULL suffixes for 64-bit constants + - crypto: cavium - fix memory leak on info + - test_firmware: fix setting old custom fw path back on exit + - drm/vblank: Fix vblank timestamp debugs + - net: ieee802154: adf7242: Fix bug if defined DEBUG + - perf report: Fix -D output for user metadata events + - net: xfrm: allow clearing socket xfrm policies. + - gpiolib: don't allow OPEN_DRAIN & OPEN_SOURCE flags simultaneously + - mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() + - [arm64] net: thunderx: Set max queue count taking XDP_TX into account + - [armhf] dts: am335x-pepper: Fix the audio CODEC's reset pin + - [armhf] dts: omap3-n900: Fix the audio CODEC's reset pin + - mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 + - userns: Don't fail follow_automount based on s_user_ns + - xfrm: Fix xfrm_replay_overflow_offload_esn + - leds: pm8058: Silence pointer to integer size warning + - bpf: fix stack state printing in verifier log + - [armhf] drm/etnaviv: make THERMAL selectable + - ath10k: update tdls teardown state to target + - cpufreq: Fix governor module removal race + - [x86] KVM: Restart the guest when insn_len is zero and SEV is enabled + - drm/amdgpu:fix random missing of FLR NOTIFY + - scsi: lpfc: Fix crash during driver unload with running nvme traffic + - scsi: ses: don't ask for diagnostic pages repeatedly during probe + - [armhf] drm/sun4i: Fix format mask in DE2 driver + - [s390x] perf annotate: Fix unnecessary memory allocation for s390x + - perf annotate: Fix objdump comment parsing for Intel mov dissassembly + - iwlwifi: mvm: avoid dumping assert log when device is stopped + - drm/amdgpu:fix virtual dce bug + - drm/amdgpu: fix amdgpu_sync_resv v2 + - bnxt_en: Uninitialized variable in bnxt_tc_parse_actions() + - [arm64] clk: qcom: msm8916: fix mnd_width for codec_digcodec + - mwifiex: cfg80211: do not change virtual interface during scan + processing + - ath10k: fix invalid STS_CAP_OFFSET_MASK + - tools/usbip: fixes build with musl libc toolchain + - [armhf] spi: sun6i: disable/unprepare clocks on remove + - bnxt_en: Don't print "Link speed -1 no longer supported" messages. + - scsi: core: scsi_get_device_flags_keyed(): Always return device flags + - scsi: devinfo: apply to HP XP the same flags as Hitachi VSP + - scsi: dh: add new rdac devices + - media: vsp1: Prevent suspending and resuming DRM pipelines + - dm raid: fix raid set size revalidation + - media: cpia2: Fix a couple off by one bugs + - [arm*] media: davinci: vpif_capture: add NULL check on devm_kzalloc + return value + - virtio_net: Disable interrupts if napi_complete_done rescheduled napi + - net: sched: drop qdisc_reset from dev_graft_qdisc + - veth: set peer GSO values + - [x86] drm/amdkfd: Fix memory leaks in kfd topology + - [powerpc*] modules: Don't try to restore r2 after a sibling call + - [powerpc/powerpc64,ppc64*] Don't trace irqs-off at interrupt return to + soft-disabled context + - [arm64] dts: renesas: salvator-common: Add EthernetAVB PHY reset + - agp/intel: Flush all chipset writes after updating the GGTT + - mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED + - mac80211: remove BUG() when interface type is invalid + - crypto: caam/qi - use correct print specifier for size_t + - mmc: mmc_test: Ensure command queue is disabled for testing + - Fix misannotated out-of-line _copy_to_user() + - ipvlan: add L2 check for packets arriving via virtual devices + - locking/locktorture: Fix num reader/writer corner cases + - ima: relax requiring a file signature for new files with zero length + - IB/mlx5: revisit -Wmaybe-uninitialized warning + - [arm64] dmaengine: qcom_hidma: check pending interrupts + - [x86] drm/i915/glk: Disable Guc and HuC on GLK + + [ Ben Hutchings ] + * aufs: gen-patch: Fix Subject generation to skip SPDX-License-Identifier + * aufs: Update support patchset to aufs4.15-20180219 (no functional change) + * debian/control: Point Vcs URLs to Salsa + * [x86] sound/soc/intel: Enable SND_SOC_INTEL_SST_TOPLEVEL, + SND_SOC_INTEL_HASWELL, SND_SOC_INTEL_BAYTRAIL, SND_SST_ATOM_HIFI2_PLATFORM, + SND_SOC_INTEL_SKYLAKE as modules; re-enable dependent board drivers + (Closes: #892629) + * firmware_class: Refer to Debian wiki page when logging missing firmware + (Closes: #888405) + * amdgpu: Abort probing if firmware is not installed, as we do in radeon + * Bump ABI to 2 + * [amd64] udeb: Add vmd to scsi-modules, required for NVMe on some systems + (Closes: #891482) + * udeb: Update patterns for PHY modules included in usb-modules + (Closes: #893154) + + [ Uwe Kleine-König ] + * netfilter: enable NFT_FIB_NETDEV as module + + [ Thadeu Lima de Souza Cascardo ] + * [powerpc,ppc64el,ppc64] Enable CRASH_DUMP (Closes: #883432) + + [ Bastian Blank ] + * Drop note about Xen from long descriptions. + + [ Vagrant Cascadian ] + * [arm64] Enable ROCKCHIP_IODOMAIN as a module, to enable PCIe reset. + * [arm64] Enable REGULATOR_FAN53555 as a module, enabling cpufreq to + work on rk3399 A72 cores. + * [arm64] Apply patch from linux-next to fix eMMC corruption on + Odroid-C2 (Closes: #879072). + + [ Salvatore Bonaccorso ] + * mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() + (CVE-2018-8087) + + -- Salvatore Bonaccorso <carnil@debian.org> Tue, 20 Mar 2018 09:31:07 +0100 + +linux (4.15.4-1) unstable; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.15 + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.1 + - Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops + - tools/gpio: Fix build error with musl libc + - gpio: stmpe: i2c transfer are forbiden in atomic context + - gpio: Fix kernel stack leak to userspace + - scsi: storvsc: missing error code in storvsc_probe() + - staging: lustre: separate a connection destroy from free struct kib_conn + - staging: ccree: NULLify backup_info when unused + - staging: ccree: fix fips event irq handling build + - usb: option: Add support for FS040U modem + - serial: 8250_dw: Revert "Improve clock rate setting" + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.2 + - [x86] KVM: Make indirect calls in emulator speculation safe + - [x86] KVM: VMX: Make indirect call speculation safe + - module/retpoline: Warn about missing retpoline in module + - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf + - [x86] cpufeatures: Add Intel feature bits for Speculation Control + - [x86] cpufeatures: Add AMD feature bits for Speculation Control + - [x86] msr: Add definitions for new speculation control MSRs + - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to + Meltdown + - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 + microcodes + - [x86] speculation: Add basic IBPB (Indirect Branch Prediction Barrier) + support + - [x86] alternative: Print unadorned pointers + - [x86] nospec: Fix header guards names + - [x86] bugs: Drop one "mitigation" from dmesg + - [x86] cpu/bugs: Make retpoline module warning conditional + - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags + - [x86] retpoline: Simplify vmexit_fill_RSB() + - [x86] speculation: Simplify indirect_branch_prediction_barrier() + - [x86] KVM: nVMX: Eliminate vmcs02 pool + - [x86] KVM: VMX: introduce alloc_loaded_vmcs + - objtool: Improve retpoline alternative handling + - objtool: Add support for alternatives at the end of a section + - objtool: Warn on stripped section symbol + - [x86] mm: Fix overlap of i386 CPU_ENTRY_AREA with FIX_BTMAP + - [x86] spectre: Check CONFIG_RETPOLINE in command line parser + - [x86] entry/64: Remove the SYSCALL64 fast path + - [x86] entry/64: Push extra regs right away + - [x86] asm: Move 'status' from thread_struct to thread_info + - Documentation: Document array_index_nospec + - array_index_nospec: Sanitize speculative array de-references + - [x86] Implement array_index_mask_nospec + - [x86] Introduce barrier_nospec + - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec + - [x86] usercopy: Replace open coded stac/clac with __uaccess_{begin, end} + - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec + - [x86] get_user: Use pointer masking to limit speculation + - [x86] syscall: Sanitize syscall table de-references under speculation + - vfs, fdtable: Prevent bounds-check bypass via speculative execution + - nl80211: Sanitize array index in parse_txq_params + - [x86] spectre: Report get_user mitigation for spectre_v1 + - [x86] spectre: Fix spelling mistake: "vunerable"-> "vulnerable" + - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel + - [x86] speculation: Use Indirect Branch Prediction Barrier in context + switch + - [x86] paravirt: Remove 'noreplace-paravirt' cmdline option + - [x86] KVM: VMX: make MSR bitmaps per-VCPU + - [x86] kvm: Update spectre-v1 mitigation + - [x86] retpoline: Avoid retpolines for built-in __init functions + - [x86] spectre: Simplify spectre_v2 command line parsing + - [x86] pti: Mark constant arrays as __initconst + - [x86] speculation: Fix typo IBRS_ATT, which should be IBRS_ALL + - [x86] KVM: Update the reverse_cpuid list to include CPUID_7_EDX + - [x86] KVM: Add IBPB support + - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES + - [x86] KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL + - [x86] KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL + - serial: core: mark port as initialized after successful IRQ change + - fpga: region: release of_parse_phandle nodes after use + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.3 + - ip6mr: fix stale iterator + - net: igmp: add a missing rcu locking section + - qlcnic: fix deadlock bug + - qmi_wwan: Add support for Quectel EP06 + - r8169: fix RTL8168EP take too long to complete driver initialization. + - tcp: release sk_frag.page in tcp_disconnect + - vhost_net: stop device during reset owner + - ipv6: addrconf: break critical section in addrconf_verify_rtnl() + - ipv6: change route cache aging logic + - Revert "defer call to mem_cgroup_sk_alloc()" + - net: ipv6: send unsolicited NA after DAD + - rocker: fix possible null pointer dereference in + rocker_router_fib_event_work + - tcp_bbr: fix pacing_gain to always be unity when using lt_bw + - cls_u32: add missing RCU annotation. + - ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only + - soreuseport: fix mem leak in reuseport_add_sock() + - net_sched: get rid of rcu_barrier() in tcf_block_put_ext() + - net: sched: fix use-after-free in tcf_block_put_ext + - crypto: tcrypt - fix S/G table for test_aead_speed() + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.4 + - cifs: Fix missing put_xid in cifs_file_strict_mmap + - cifs: Fix autonegotiate security settings mismatch + - CIFS: zero sensitive data when freeing + - cpufreq: mediatek: add mediatek related projects into blacklist + - [arm64] watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop + - Revert "drm/i915: mark all device info struct with __initconst" + - sched/rt: Use container_of() to get root domain in + rto_push_irq_work_func() + - sched/rt: Up the root domain ref count when passing it around via IPIs + - [arm64] mm: Use non-global mappings for kernel space + - [arm64] mm: Temporarily disable ARM64_SW_TTBR0_PAN + - [arm64] mm: Move ASID from TTBR0 to TTBR1 + - [arm64] mm: Remove pre_ttbr0_update_workaround for Falkor erratum #E1003 + - [arm64] mm: Rename post_ttbr0_update_workaround + - [arm64] mm: Fix and re-enable ARM64_SW_TTBR0_PAN + - [arm64] mm: Allocate ASIDs in pairs + - [arm64] mm: Add arm64_kernel_unmapped_at_el0 helper + - [arm64] mm: Invalidate both kernel and user ASIDs when performing TLBI + - [arm64] entry: Add exception trampoline page for exceptions from EL0 + - [arm64] mm: Map entry trampoline into trampoline and kernel page tables + - [arm64] entry: Explicitly pass exception level to kernel_ventry macro + - [arm64] entry: Hook up entry trampoline to exception vectors + - [arm64] erratum: Work around Falkor erratum #E1003 in trampoline code + - [arm64] cpu_errata: Add Kryo to Falkor 1003 errata + - [arm64] tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks + - [arm64] entry: Add fake CPU feature for unmapping the kernel at EL0 + - [arm64] kaslr: Put kernel vectors address in separate data page + - [arm64] use RET instruction for exiting the trampoline + - [arm64] Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0 + - [arm64] Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry + - [arm64] Take into account ID_AA64PFR0_EL1.CSV3 + - [arm64] capabilities: Handle duplicate entries for a capability + - [arm64] mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR + - [arm64] kpti: Fix the interaction between ASID switching and software PAN + - [arm64] cputype: Add MIDR values for Cavium ThunderX2 CPUs + - [arm64] Turn on KPTI only on CPUs that need it + - [arm64] kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0() + - [arm64] mm: Permit transitioning from Global to Non-Global without BBM + - [arm64] kpti: Add ->enable callback to remap swapper using nG mappings + - [arm64] Force KPTI to be disabled on Cavium ThunderX + - [arm64] entry: Reword comment about post_ttbr_update_workaround + - [arm64] idmap: Use "awx" flags for .idmap.text .pushsection directives + - [arm64] barrier: Add CSDB macros to control data-value prediction + - [arm64] Implement array_index_mask_nospec() + - [arm64] Make USER_DS an inclusive limit + - [arm64] Use pointer masking to limit uaccess speculation + - [arm64] entry: Ensure branch through syscall table is bounded under + speculation + - [arm64] uaccess: Prevent speculative use of the current addr_limit + - [arm64] uaccess: Don't bother eliding access_ok checks in __{get, + put}_user + - [arm64] uaccess: Mask __user pointers for __arch_{clear, copy_*}_user + - [arm64] futex: Mask __user pointers prior to dereference + - [arm64] cpufeature: __this_cpu_has_cap() shouldn't stop early + - [arm64] Run enable method for errata work arounds on late CPUs + - [arm64] cpufeature: Pass capability structure to ->enable callback + - drivers/firmware: Expose psci_get_version through psci_ops structure + - [arm64] Move post_ttbr_update_workaround to C code + - [arm64] Add skeleton to harden the branch predictor against aliasing + attacks + - [arm64] Move BP hardening to check_and_switch_context + - [arm64] KVM: Use per-CPU vector when BP hardening is enabled + - [arm64] entry: Apply BP hardening for high-priority synchronous + exceptions + - [arm64] entry: Apply BP hardening for suspicious interrupts from EL0 + - [arm64] cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 + - [arm64] Implement branch predictor hardening for affected Cortex-A CPUs + - [arm64] Implement branch predictor hardening for Falkor + - [arm64] Branch predictor hardening for Cavium ThunderX2 + - [arm64] KVM: Increment PC after handling an SMC trap + - [armhf,arm64] KVM: Consolidate the PSCI include files + - [armhf,arm64] KVM: Add PSCI_VERSION helper + - [armhf,arm64] KVM: Add smccc accessors to PSCI code + - [armhf,arm64] KVM: Implement PSCI 1.0 support + - [armhf,arm64] KVM: Advertise SMCCC v1.1 + - [arm64] KVM: Make PSCI_VERSION a fast path + - [armhf,arm64] KVM: Turn kvm_psci_version into a static inline + - [arm64] KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support + - [arm64] KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling + - firmware/psci: Expose PSCI conduit + - firmware/psci: Expose SMCCC version through psci_ops + - arm/arm64: smccc: Make function identifiers an unsigned quantity + - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive + - [arm64] Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support + - [arm64] Kill PSCI_GET_VERSION as a variant-2 workaround + - mtd: cfi: convert inline functions to macros + - mtd: nand: brcmnand: Disable prefetch by default + - mtd: nand: Fix nand_do_read_oob() return value + - mtd: nand: sunxi: Fix ECC strength choice + - ubi: Fix race condition between ubi volume creation and udev + - ubi: fastmap: Erase outdated anchor PEBs during attach + - ubi: block: Fix locking for idr_alloc/idr_remove + - ubifs: free the encrypted symlink target + - nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds + - nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE + - NFS: Add a cond_resched() to nfs_commit_release_pages() + - NFS: Fix nfsstat breakage due to LOOKUPP + - NFS: commit direct writes even if they fail partially + - NFS: reject request for id_legacy key without auxdata + - NFS: Fix a race between mmap() and O_DIRECT + - nfsd: Detect unhashed stids in nfsd4_verify_open_stid() + - kernfs: fix regression in kernfs_fop_write caused by wrong type + - ahci: Annotate PCI ids for mobile Intel chipsets as such + - ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI + - ahci: Add Intel Cannon Lake PCH-H PCI ID + - crypto: hash - introduce crypto_hash_alg_has_setkey() + - crypto: cryptd - pass through absence of ->setkey() + - crypto: mcryptd - pass through absence of ->setkey() + - crypto: poly1305 - remove ->setkey() method + - crypto: hash - annotate algorithms taking optional key + - crypto: hash - prevent using keyed hashes without setting key + - media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt + - media: v4l2-ioctl.c: don't copy back the result for -ENOTTY + - media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF + - media: v4l2-compat-ioctl32.c: fix the indentation + - media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 + - media: v4l2-compat-ioctl32.c: avoid sizeof(type) + - media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 + - media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer + - media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 + - media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type + - media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors + - media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic + - media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs + - crypto: caam - fix endless loop when DECO acquire fails + - crypto: sha512-mb - initialize pending lengths correctly + - crypto: talitos - fix Kernel Oops on hashing an empty file + - [armhf,arm64 KVM: Fix SMCCC handling of unimplemented SMC/HVC calls + - [x86] KVM: nVMX: Fix races when sending nested PI while dest + enters/leaves L2 + - [x86] KVM: nVMX: Fix bug of injecting L2 exception into L1 + - [powerpc*] KVM: PPC: Book3S HV: Make sure we don't re-enter guest + without XIVE loaded + - [powerpc*] KVM: PPC: Book3S HV: Drop locks before reading guest memory + - [armhf,arm64] KVM: Handle CPU_PM_ENTER_FAILED + - [powerpc*] KVM: PPC: Book3S PR: Fix broken select due to misspelling + - watchdog: imx2_wdt: restore previous timeout after suspend+resume + - afs: Add missing afs_put_cell() + - afs: Need to clear responded flag in addr cursor + - afs: Fix missing cursor clearance + - afs: Fix server list handling + - btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker + - Btrfs: raid56: iterate raid56 internal bio with bio_for_each_segment_all + - kasan: don't emit builtin calls when sanitization is off + - kasan: rework Kconfig settings + - media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return + code + - media: dvb-frontends: fix i2c access helpers for KASAN + - media: dt-bindings/media/cec-gpio.txt: mention the CEC/HPD max voltages + - media: ts2020: avoid integer overflows on 32 bit machines + - media: vivid: fix module load error when enabling fb and no_error_inj=1 + - media: cxusb, dib0700: ignore XC2028_I2C_FLUSH + - fs/proc/kcore.c: use probe_kernel_read() instead of memcpy() + - kernel/async.c: revert "async: simplify lowest_in_progress()" + - kernel/relay.c: revert "kernel/relay.c: fix potential memory leak" + - pipe: actually allow root to exceed the pipe buffer limits + - pipe: fix off-by-one error when checking buffer limits + - HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working + - Bluetooth: btsdio: Do not bind to non-removable BCM43341 + - Revert "Bluetooth: btusb: fix QCA Rome suspend/resume" + - Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" + version + - ipmi: use dynamic memory for DMI driver override + - signal/openrisc: Fix do_unaligned_access to send the proper signal + - signal/sh: Ensure si_signo is initialized in do_divide_error + - alpha: fix crash if pthread_create races with signal delivery + - alpha: osf_sys.c: fix put_tv32 regression + - alpha: Fix mixed up args in EXC macro in futex operations + - alpha: fix reboot on Avanti platform + - alpha: fix formating of stack content + - xtensa: fix futex_atomic_cmpxchg_inatomic + - EDAC, octeon: Fix an uninitialized variable warning + - genirq: Make legacy autoprobing work again + - pinctrl: intel: Initialize GPIO properly when used through irqchip + - pinctrl: mcp23s08: fix irq setup order + - pinctrl: sx150x: Unregister the pinctrl on release + - pinctrl: sx150x: Register pinctrl before adding the gpiochip + - pinctrl: sx150x: Add a static gpio/pinctrl pin range mapping + - pktcdvd: Fix pkt_setup_dev() error path + - pktcdvd: Fix a recently introduced NULL pointer dereference + - blk-mq: quiesce queue before freeing queue + - clocksource/drivers/stm32: Fix kernel panic with multiple timers + - lib/ubsan.c: s/missaligned/misaligned/ + - lib/ubsan: add type mismatch handler for new GCC/Clang + - objtool: Fix switch-table detection + - [arm64] dts: marvell: add Ethernet aliases + - drm/i915: Avoid PPS HW/SW state mismatch due to rounding + - ACPI: sbshc: remove raw pointer from printk() message (CVE-2018-5750) + - acpi, nfit: fix register dimm error handling + - ovl: force r/o mount when index dir creation fails + - ovl: fix failure to fsync lower dir + - ovl: take mnt_want_write() for work/index dir setup + - ovl: take mnt_want_write() for removing impure xattr + - ovl: hash directory inodes for fsnotify + - devpts: fix error handling in devpts_mntget() + - ftrace: Remove incorrect setting of glob search field + - scsi: core: Ensure that the SCSI error handler gets woken up + - scsi: lpfc: Fix crash after bad bar setup on driver attachment + - scsi: cxlflash: Reset command ioasc + - rcu: Export init_rcu_head() and destroy_rcu_head() to GPL modules + + [ Bastian Blank ] + * Add cloud-amd64 kernel flavour. + - Support Microsoft Azure. + - Support Amazon EC2. + - Support Google Compute Engine. + * Enable NUMA_BALANCING_DEFAULT_ENABLED, enabled by all others. + * Enable INET_ESP_OFFLOAD, INET6_ESP_OFFLOAD, IPV6_SEG6_LWTUNNEL, + IPV6_SEG6_HMAC, NF_LOG_NETDEV, IP_SET_HASH_IPMAC, NET_ACT_SAMPLE, + IPVTAP, VIRTIO_MMIO, CRYPTO_RSA, CRYPTO_DH, CRYPTO_ECDH. + * x86: Enable SCHED_MC_PRIO, HYPERV_VSOCKETS. + * Enable NVME_MULTIPATH, NVME_FC, NVME_TARGET_FC, move nvme module into + scsi-modules installer udeb. + * Switch to SLUB as kernel allocator. (Closes: #862718) + - Enable SLUB_DEBUG, SLAB_FREELIST_HARDENED except on armel/marvell. + (Closes: #883069) + * Fix building of liblockdep. + + [ Uwe Kleine-König ] + * [arm64] enable I2C_PXA for espressobin (Closes: #886983) + + [ Ben Hutchings ] + * Enable CGROUP_BPF (except for armel) (Closes: #872560) + * usb: Enable USBIP_CORE, USBIP_VHCI_HCD, USBIP_HOST, USBIP_VUDC as + modules on all architectures (Closes: #888042) + * [x86] Rewrite "Make x32 syscall support conditional on a kernel parameter" + to use a static key + + [ Salvatore Bonaccorso ] + * (Temporarily) disable armel kernel image build. + The armel/marvell kernel size is growing to large and the compressed + image is over the limit. + Given the armel architecture will most likely not be part of Buster, + disable the image build. + Cf. https://lists.debian.org/debian-kernel/2018/01/msg00278.html + * Set ABI to 1 + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 18 Feb 2018 09:36:49 +0100 + +linux (4.15~rc8-1~exp1) experimental; urgency=medium + + * New upstream release candidate + - RDS: Heap OOB write in rds_message_alloc_sgs() (CVE-2018-5332) + - RDS: null pointer dereference in rds_atomic_free_op (CVE-2018-5333) + - loop: fix concurrent lo_open/lo_release (CVE-2018-5344) + + [ Ben Hutchings ] + * [arm64] Update "add kernel config option to lock down when in Secure Boot + mode" for 4.15 + * efi: Enable LOCK_DOWN_IN_EFI_SECURE_BOOT, replacing + EFI_SECURE_BOOT_LOCK_DOWN + * iio: Enable AD5446 as module, replacing TI_DAC7512 + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 15 Jan 2018 04:43:14 +0000 + +linux (4.15~rc5-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Riku Voipio ] + * [arm64] udeb: add multifunction devices + * [arm64] udeb: add mvebu comphy for armada 8K + + [ Ben Hutchings ] + * aufs: Update support patchset to aufs4.x-rcN-20171218 + * lockdown: Update patchset to 2017-11-10 version + * lockdown: Update calls to kernel_is_locked_down() in "mtd: Disable slram and + phram when locked down" + * cpupower: Move library to multiarch directory + * [rt] Disable until it is updated for 4.15 or later + * linux-kbuild: Add objtool + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 27 Dec 2017 02:48:14 +0000 + +linux (4.14.17-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.14 + - dm bufio: fix shrinker scans when (nr_to_scan < retain_target) + - can: gs_usb: fix return value of the "set_bittiming" callback + - IB/srpt: Disable RDMA access by the initiator + - IB/srpt: Fix ACL lookup during login + - [mips*] Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the + task + - [mips*] Factor out NT_PRFPREG regset access helpers + - [mips*] Guard against any partial write attempt with PTRACE_SETREGSET + - [mips*] Consistently handle buffer counter with PTRACE_SETREGSET + - [mips*] Fix an FCSR access API regression with NT_PRFPREG and MSA + - [mips*] Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET + - [mips*] Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses + - cgroup: fix css_task_iter crash on CSS_TASK_ITER_PROC (Closes: #888954) + - [x86] kvm: vmx: Scrub hardware GPRs at VM-exit (partial mitigation of + CVE-2017-5715, CVE-2017-5753) + - [x86] platform: wmi: Call acpi_wmi_init() later + - iw_cxgb4: only call the cq comp_handler when the cq is armed + - iw_cxgb4: atomically flush the qp + - iw_cxgb4: only clear the ARMED bit if a notification is needed + - iw_cxgb4: reflect the original WR opcode in drain cqes + - iw_cxgb4: when flushing, complete all wrs in a chain + - [x86] acpi: Handle SCI interrupts above legacy space gracefully + - ALSA: pcm: Remove incorrect snd_BUG_ON() usages + - ALSA: pcm: Workaround for weird PulseAudio behavior on rewind error + - ALSA: pcm: Add missing error checks in OSS emulation plugin builder + - ALSA: pcm: Abort properly at pending signal in OSS read/write loops + - ALSA: pcm: Allow aborting mutex lock at OSS read/write loops + - ALSA: aloop: Release cable upon open error path + - ALSA: aloop: Fix inconsistent format due to incomplete rule + - ALSA: aloop: Fix racy hw constraints adjustment + - [x86] acpi: Reduce code duplication in mp_override_legacy_irq() + - 8021q: fix a memory leak for VLAN 0 device + - ip6_tunnel: disable dst caching if tunnel is dual-stack + - net: core: fix module type in sock_diag_bind + - RDS: Heap OOB write in rds_message_alloc_sgs() (CVE-2018-5332) + - RDS: null pointer dereference in rds_atomic_free_op (CVE-2018-5333) + - net: fec: restore dev_id in the cases of probe error + - net: fec: defer probe if regulator is not ready + - net: fec: free/restore resource in related probe error pathes + - sctp: do not retransmit upon FragNeeded if PMTU discovery is disabled + - sctp: fix the handling of ICMP Frag Needed for too small MTUs + - [arm64, armhf] net: stmmac: enable EEE in MII, GMII or RGMII only + - ipv6: fix possible mem leaks in ipv6_make_skb() + - net/sched: Fix update of lastuse in act modules implementing + stats_update + - ipv6: sr: fix TLVs not being copied using setsockopt + - sfp: fix sfp-bus oops when removing socket/upstream + - membarrier: Disable preemption when calling smp_call_function_many() + - crypto: algapi - fix NULL dereference in crypto_remove_spawns() + - rbd: reacquire lock should update lock owner client id + - rbd: set max_segments to USHRT_MAX + - iwlwifi: pcie: fix DMA memory mapping / unmapping + - [x86] microcode/intel: Extend BDW late-loading with a revision check + - [x86] KVM: Add memory barrier on vmcs field lookup + - [powerpc*] KVM: Book3S PR: Fix WIMG handling under pHyp + - [powerpc*] KVM: Book3S HV: Drop prepare_done from struct kvm_resize_hpt + - [powerpc*] KVM: Book3S HV: Fix use after free in case of multiple resize + requests + - [powerpc*] KVM: Book3S HV: Always flush TLB in kvmppc_alloc_reset_hpt() + - [x86] drm/vmwgfx: Don't cache framebuffer maps + - [x86] drm/vmwgfx: Potential off by one in vmw_view_add() + - [x86] drm/i915/gvt: Clear the shadow page table entry after post-sync + - [x86] drm/i915: Whitelist SLICE_COMMON_ECO_CHICKEN1 on Geminilake. + - [x86] drm/i915: Move init_clock_gating() back to where it was + - [x86] drm/i915: Fix init_clock_gating for resume + - bpf: prevent out-of-bounds speculation (partial mitigation of + CVE-2017-5753) + - bpf, array: fix overflow in max_entries and undefined behavior in + index_mask + - bpf: arsh is not supported in 32 bit alu thus reject it + - [arm64, armhf] usb: misc: usb3503: make sure reset is low for at least + 100us + - USB: fix usbmon BUG trigger + - USB: UDC core: fix double-free in usb_add_gadget_udc_release + - usbip: remove kernel addresses from usb device and urb debug msgs + - usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input + - usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer + buffer + - staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl + (CVE-2017-13216) + - mux: core: fix double get_device() + - kdump: write correct address of mem_section into vmcoreinfo + - apparmor: fix ptrace label match when matching stacked labels + - [x86] pti: Unbreak EFI old_memmap + - [x86] Documentation: Add PTI description + - [x86] cpufeatures: Add X86_BUG_SPECTRE_V[12] + - sysfs/cpu: Add vulnerability folder + - [x86] cpu: Implement CPU vulnerabilites sysfs functions + - [x86] tboot: Unbreak tboot with PTI enabled + - [x86] mm/pti: Remove dead logic in pti_user_pagetable_walk*() + - [x86] cpu/AMD: Make LFENCE a serializing instruction + - [x86] cpu/AMD: Use LFENCE_RDTSC in preference to MFENCE_RDTSC + - [x86] alternatives: Fix optimize_nops() checking + - [x86] pti: Make unpoison of pgd for trusted boot work for real + - [x86] retpoline: Add initial retpoline support (partial mitigation of + CVE-2017-5715) + - [x86] spectre: Add boot time option to select Spectre v2 mitigation + - [x86] retpoline/crypto: Convert crypto assembler indirect jumps + - [x86] retpoline/entry: Convert entry assembler indirect jumps + - [x86] retpoline/ftrace: Convert ftrace assembler indirect jumps + - [x86] retpoline/hyperv: Convert assembler indirect jumps + - [x86] retpoline/xen: Convert Xen hypercall indirect jumps + - [x86] retpoline/checksum32: Convert assembler indirect jumps + - [x86] retpoline/irq32: Convert assembler indirect jumps + - [x86] retpoline: Fill return stack buffer on vmexit + - [x86] pti: Fix !PCID and sanitize defines + - [x86] perf: Disable intel_bts when PTI + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.15 + - tools/objtool/Makefile: don't assume sync-check.sh is executable + - objtool: Fix seg fault with clang-compiled objects + - objtool: Fix Clang enum conversion warning + - objtool: Fix seg fault caused by missing parameter + - [powerpc*] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper + - [powerpc*] 64: Add macros for annotating the destination of rfid/hrfid + - [powerpc*] 64s: Simple RFI macro conversions + - [powerpc*] 64: Convert the syscall exit path to use RFI_TO_USER/KERNEL + - [powerpc*] 64: Convert fast_exception_return to use RFI_TO_USER/KERNEL + - [powerpc*] 64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL + - [powerpc*] 64s: Add support for RFI flush of L1-D cache + - [powerpc*] 64s: Support disabling RFI flush with no_rfi_flush and nopti + - [powerpc*] pseries: Query hypervisor for RFI flush settings + - [powerpc*] powernv: Check device-tree for RFI flush settings + - futex: Avoid violating the 10th rule of futex + - futex: Prevent overflow by strengthen input validation (CVE-2018-6927) + - ALSA: seq: Make ioctls race-free (CVE-2018-1000004) + - ALSA: pcm: Remove yet superfluous WARN_ON() + - ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant + - ALSA: hda - Apply the existing quirk to iMac 14,1 + - IB/hfi1: Prevent a NULL dereference + - RDMA/mlx5: Fix out-of-bound access while querying AH + - timers: Unconditionally check deferrable base + - af_key: fix buffer overread in verify_address_len() + - af_key: fix buffer overread in parse_exthdrs() + - iser-target: Fix possible use-after-free in connection establishment + error + - delayacct: Account blkio completion on the correct task + - objtool: Fix seg fault with gold linker + - [armhf] mmc: sdhci-esdhc-imx: Fix i.MX53 eSDHCv3 clock + - [x86] kasan: Panic if there is not enough memory to boot + - [x86] retpoline: Fill RSB on context switch for affected CPUs + - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros + - objtool: Improve error message for bad file argument + - [x86] cpufeature: Move processor tracing out of scattered features + - [x86] intel_rdt/cqm: Prevent use after free + - [x86] mm/pkeys: Fix fill_sig_info_pkey + - [x86] idt: Mark IDT tables __initconst + - [x86] tsc: Future-proof native_calibrate_tsc() + - [x86] tsc: Fix erroneous TSC rate on Skylake Xeon + - pipe: avoid round_pipe_size() nr_pages overflow on 32-bit + - [x86] apic/vector: Fix off by one in error path + - [x86] mm: Clean up register saving in the __enc_copy() assembly code + - [x86] mm: Use a struct to reduce parameters for SME PGD mapping + - [x86] mm: Centralize PMD flags in sme_encrypt_kernel() + - [x86] mm: Prepare sme_encrypt_kernel() for PAGE aligned encryption + - [armhf] OMAP3: hwmod_data: add missing module_offs for MMC3 + - [x86] mm: Encrypt the initrd earlier for BSP microcode update + - Input: ALPS - fix multi-touch decoding on SS4 plus touchpads + - Input: synaptics-rmi4 - prevent UAF reported by KASAN + - [armhf] Input: twl6040-vibra - fix child-node lookup + - [armhf] Input: twl4030-vibra - fix sibling-node lookup + - tracing: Fix converting enum's from the map in trace_event_eval_update() + - phy: work around 'phys' references to usb-nop-xceiv devices + - [arm64] dts: marvell: armada-cp110: Fix clock resources for various node + - [armhf] sunxi_defconfig: Enable CMA + - [armel] dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7 + - can: peak: fix potential bug in packet fragmentation + - can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once + - can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once + - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA + - proc: fix coredump vs read /proc/*/stat race + - libata: apply MAX_SEC_1024 to all LITEON EP1 series devices + - workqueue: avoid hard lockups in show_workqueue_state() + - [x86] drm/vmwgfx: fix memory corruption with legacy/sou connectors + - dm btree: fix serious bug in btree_split_beneath() + - dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 + - dm integrity: don't store cipher request on the stack + - dm crypt: fix crash by adding missing check for auth key size + - dm crypt: wipe kernel key copy after IV initialization + - dm crypt: fix error return code in crypt_ctr() + - [x86] x86: Use __nostackprotect for sme_encrypt_kernel + - [alpha] PCI: Fix noname IRQ level detection + - [mips*] CM: Drop WARN_ON(vp != 0) + - [arm*] KVM: Check pagesize when allocating a hugepage at Stage 2 + - [arm64] KVM: Fix SMCCC handling of unimplemented SMC/HVC calls + - [x86] mce: Make machine check speculation protected + - retpoline: Introduce start/end markers of indirect thunk + - [x86] kprobes: Blacklist indirect thunk functions for kprobes + - [x86] kprobes: Disable optimizing on the function jumps to indirect + thunk + - [x86] retpoline: Optimize inline assembler for vmexit_fill_RSB + - [x86] mm: Rework wbinvd, hlt operation in stop_this_cpu() + - mm, page_vma_mapped: Drop faulty pointer arithmetics in check_pte() + - [arm64, armhf] net: mvpp2: do not disable GMAC padding + - [mips]: AR7: ensure the port type's FCR value is used + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.16 + - mm, page_alloc: fix potential false positive in __zone_watermark_ok + - xfrm: Fix a race in the xdst pcpu cache. + - Input: xpad - add support for PDP Xbox One controllers + - Input: trackpoint - force 3 buttons if 0 button is reported + - Input: trackpoint - only expose supported controls for Elan, ALPS and + NXP + - Btrfs: fix stale entries in readdir + - [s390x] KVM: add proper locking for CMMA migration bitmap + - [arm*] net: bpf: avoid 'bx' instruction on non-Thumb capable CPUs + - [arm*] net: bpf: fix tail call jumps + - [arm*] net: bpf: fix stack alignment + - [arm*] net: bpf: move stack documentation + - [arm*] net: bpf: correct stack layout documentation + - [arm*] net: bpf: fix register saving + - [arm*] net: bpf: fix LDX instructions + - [arm*] net: bpf: clarify tail_call index + - [arm64,armhf] drm/vc4: Fix NULL pointer dereference in + vc4_save_hang_state() + - net: Allow neigh contructor functions ability to modify the primary_key + - ipv4: Make neigh lookup keys for loopback/point-to-point devices be + INADDR_ANY + - dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state + - ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL + - ipv6: fix udpv6 sendmsg crash caused by too small MTU + - ipv6: ip6_make_skb() needs to clear cork.base.dst + - lan78xx: Fix failure in USB Full Speed + - net: igmp: fix source address check for IGMPv3 reports + - net: qdisc_pkt_len_init() should be more robust + - net: tcp: close sock if net namespace is exiting + - net/tls: Fix inverted error codes to avoid endless loop + - net: vrf: Add support for sends to local broadcast address + - pppoe: take ->needed_headroom of lower device into account on xmit + - r8169: fix memory corruption on retrieval of hardware statistics. + - sctp: do not allow the v4 socket to bind a v4mapped v6 address + - sctp: return error if the asoc has been peeled off in + sctp_wait_for_sndbuf + - tipc: fix a memory leak in tipc_nl_node_get_link() + - {net,ib}/mlx5: Don't disable local loopback multicast traffic when + needed + - net/mlx5: Fix get vector affinity helper function + - ppp: unlock all_ppp_mutex before registering device + - be2net: restore properly promisc mode after queues reconfiguration + - ip6_gre: init dev->mtu and dev->hard_header_len correctly + - gso: validate gso_type in GSO handlers + - tun: fix a memory leak for tfile->tx_array + - flow_dissector: properly cap thoff field + - sctp: reinit stream if stream outcnt has been change by sinit in sendmsg + - netlink: extack needs to be reset each time through loop + - net/mlx5e: Fix fixpoint divide exception in mlx5e_am_stats_compare + - nfp: use the correct index for link speed table + - netlink: reset extack earlier in netlink_rcv_skb + - net/tls: Only attach to sockets in ESTABLISHED state + - tls: fix sw_ctx leak + - tls: return -EBUSY if crypto_info is already set + - tls: reset crypto_info when do_tls_setsockopt_tx fails + - net: ipv4: Make "ip route get" match iif lo rules again. + - vmxnet3: repair memory leak + - perf/x86/amd/power: Do not load AMD power module on !AMD platforms + - [x86] microcode/intel: Extend BDW late-loading further with LLC size + check + - [x86] microcode: Fix again accessing initrd after having been freed + - [x86] mm/64: Fix vmapped stack syncing on very-large-memory 4-level + systems + - hrtimer: Reset hrtimer cpu base proper on CPU hotplug + - bpf: introduce BPF_JIT_ALWAYS_ON config + - bpf: fix divides by zero + - bpf: fix 32-bit divide by zero + - bpf: reject stores into ctx via st and xadd + - [arm64] bpf: fix stack_depth tracking in combination with tail calls + - cpufreq: governor: Ensure sufficiently large sampling intervals + - nfsd: auth: Fix gid sorting when rootsquash enabled (CVE-2018-1000028) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.17 + - futex: Fix OWNER_DEAD fixup + - loop: fix concurrent lo_open/lo_release (CVE-2018-5344) + - [x86] KVM: Fix CPUID function for word 6 (80000001_ECX) + - gpio: Fix kernel stack leak to userspace + - ALSA: hda - Reduce the suspend time consumption for ALC256 + - crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH + - [x86] crypto: aesni - handle zero length dst buffer + - [x86] crypto: aesni - fix typo in generic_gcmaes_decrypt + - crypto: gcm - add GCM IV size constant + - [x86] crypto: aesni - Use GCM IV size constant + - [x86] crypto: aesni - add wrapper for generic gcm(aes) + - [x86] crypto: aesni - Fix out-of-bounds access of the data buffer in + generic-gcm-aesni + - [x86] crypto: aesni - Fix out-of-bounds access of the AAD buffer in + generic-gcm-aesni + - [arm64] crypto: inside-secure - fix hash when length is a multiple of a + block + - [arm64] crypto: inside-secure - avoid unmapping DMA memory that was not + mapped + - crypto: sha3-generic - fixes for alignment and big endian operation + - crypto: af_alg - whitelist mask and type + - HID: wacom: EKR: ensure devres groups at higher indexes are released + - HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) + events + - igb: Free IRQs when device is hotplugged + - ima/policy: fix parsing of fsuuid + - scsi: aacraid: Fix udev inquiry race condition + - scsi: aacraid: Fix hang in kdump + - VFS: Handle lazytime in do_mount() + - [arm64,armhf] drm/vc4: Account for interrupts in flight + - btrfs: Fix transaction abort during failure in btrfs_rm_dev_item + - Btrfs: bail out gracefully rather than BUG_ON + - cpupowerutils: bench - Fix cpu online check + - cpupower : Fix cpupower working when cpu0 is offline + - [x86] KVM: nVMX/nSVM: Don't intercept #UD when running L2 + - [x86] KVM: emulator: Return to user-mode on L1 CPL=0 emulation failure + - [x86] KVM: Don't re-execute instruction when not passing CR2 value + - [x86] KVM: Fix operand/address-size during instruction decoding + - [x86] KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure + - [x86] KVM: fix em_fxstor() sleeping while in atomic + - [x86] KVM: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race + - [x86] KVM: ioapic: Clear Remote IRR when entry is switched to + edge-triggered + - [x86] KVM: ioapic: Preserve read-only values in the redirection table + - [x86] KVM: nVMX: Fix vmx_check_nested_events() return value in case an + event was reinjected to L2 + - nvme-fabrics: introduce init command check for a queue that is not alive + - nvme-fc: check if queue is ready in queue_rq + - nvme-loop: check if queue is ready in queue_rq + - nvme-pci: disable APST on Samsung SSD 960 EVO + ASUS PRIME B350M-A + - nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set. + - nvmet-fc: correct ref counting error when deferred rcv used + - [s390x] topology: fix compile error in file arch/s390/kernel/smp.c + - [s390x] zcrypt: Fix wrong comparison leading to strange load balancing + - ACPI / bus: Leave modalias empty for devices which are not present + - null_blk: fix dev->badblocks leak + - [s390x] fix alloc_pgste check in init_new_context again + - rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing + - rxrpc: Provide a different lockdep key for call->user_mutex for kernel + calls + - rxrpc: Fix service endpoint expiry + - bcache: check return value of register_shrinker + - drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode + - [x86] drm/amdkfd: Fix SDMA ring buffer size calculation + - [x86] drm/amdkfd: Fix SDMA oversubsription handling + - uapi: fix linux/kfd_ioctl.h userspace compilation errors + - nvme-rdma: don't complete requests before a send work request has + completed + - openvswitch: fix the incorrect flow action alloc size + - [armhf] drm/rockchip: dw-mipi-dsi: fix possible un-balanced runtime PM + enable + - mac80211: use QoS NDP for AP probing + - mac80211: fix the update of path metric for RANN frame + - btrfs: fix deadlock when writing out space cache + - sctp: only allow the asoc reset when the asoc outq is empty + - sctp: avoid flushing unsent queue when doing asoc reset + - sctp: set sender next_tsn for the old result with ctsn_ack_point plus 1 + - reiserfs: remove unneeded i_version bump + - [x86] KVM: Fix softlockup when get the current kvmclock + - [x86] KVM: VMX: Fix rflags cache during vCPU reset + - Btrfs: fix list_add corruption and soft lockups in fsync + - KVM: Let KVM_SET_SIGNAL_MASK work as advertised + - xfs: always free inline data before resetting inode fork during ifree + - xfs: log recovery should replay deferred ops in order + - xen-netfront: remove warning when unloading module + - nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) + - nfsd: Ensure we check stateid validity in the seqid operation checks + - grace: replace BUG_ON by WARN_ONCE in exit_net hook + - nfsd: check for use of the closed special stateid + - race of lockd inetaddr notifiers vs nlmsvc_rqst change + - lockd: fix "list_add double add" caused by legacy signal interface + - quota: propagate error from __dquot_initialize + - [arm64,armhf] net: mvpp2: fix the txq_init error path + - [arm64] net: phy: marvell10g: fix the PHY id mask + - bnxt_en: Fix an error handling path in 'bnxt_get_module_eeprom()' + - Btrfs: incremental send, fix wrong unlink path after renaming file + - nvme-pci: fix NULL pointer dereference in nvme_free_host_mem() + - xfs: fortify xfs_alloc_buftarg error handling + - drm/amdgpu: don't try to move pinned BOs + - quota: Check for register_shrinker() failure. + - SUNRPC: Allow connect to return EHOSTUNREACH + - kmemleak: add scheduling point to kmemleak_scan() + - [armhf] drm/omap: Fix error handling path in 'omap_dmm_probe()' + - [armhf] drm/omap: displays: panel-dpi: add backlight dependency + - xfs: ubsan fixes + - xfs: Properly retry failed dquot items in case of error during buffer + writeback + - perf/core: Fix memory leak triggered by perf --namespace + - scsi: aacraid: Prevent crash in case of free interrupt during scsi EH + path + - scsi: ufs: ufshcd: fix potential NULL pointer dereference in + ufshcd_config_vreg + - iwlwifi: mvm: fix the TX queue hang timeout for MONITOR vif type + - iwlwifi: fix access to prph when transport is stopped + - [arm*] dts: NSP: Disable AHCI controller for HR NSP boards + - [arm*] ARM: dts: NSP: Fix PPI interrupt types + - media: usbtv: add a new usbid + - [x86] xen: Support early interrupts in xen pv guests + - usb: gadget: don't dereference g until after it has been null checked + - staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID + - [arm64,armhf] drm/vc4: Move IRQ enable to PM path + - [x86] KVM: emulate #UD while in guest mode + - [x86] staging: lustre: separate a connection destroy from free struct + kib_conn + - tty: fix data race between tty_init_dev and flush of buf + - USB: serial: pl2303: new device id for Chilitag + - USB: cdc-acm: Do not log urb submission errors on disconnect + - CDC-ACM: apply quirk for card reader + - USB: serial: io_edgeport: fix possible sleep-in-atomic + - usbip: prevent bind loops on devices attached to vhci_hcd + - usbip: list: don't list devices attached to vhci_hcd + - USB: serial: simple: add Motorola Tetra driver + - usb: f_fs: Prevent gadget unbind if it is already unbound + - usb: uas: unconditionally bring back host after reset + - usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc() + - [x86] mei: me: allow runtime pm for platform with D0i3 + - serial: 8250_of: fix return code when probe function fails to get reset + - serial: 8250_uniphier: fix error return code in uniphier_uart_probe() + - [armhf] serial: imx: Only wakeup via RTSDEN bit if the system has + RTS/CTS + - [armhf] spi: imx: do not access registers while clocks disabled + - iio: adc: stm32: fix scan of multiple channels with DMA + - iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels + - test_firmware: fix missing unlock on error in + config_num_requests_store() + - Input: synaptics-rmi4 - unmask F03 interrupts when port is opened + - Input: synaptics-rmi4 - do not delete interrupt memory too early + - [x86] efi: Clarify that reset attack mitigation needs appropriate + userspace + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.14.15-rt11 + * [rt] Update to 4.14.15-rt13 + * crypto: ecc - Fix NULL pointer deref. on no default_rng (Closes: #886556) + * mac80211: Avoid ABI change in 4.14.17 + * rxrpc: Avoid ABI change in 4.14.17 + + [ Ben Hutchings ] + * bpf: Avoid ABI change in 4.14.14 + * usbip: Reduce USBIP_VHCI_HC_PORTS to 15, the maximum allowed for SuperSpeed + hubs (Closes: #878866) + * [x86] Add versioned build-dependency on gcc-7 for retpoline support + * [x86] linux-compiler-gcc-7-x86: Add versioned dependency on gcc-7 for + retpoline support + * linux-compiler-gcc-7-{arm,s390,x86}: Remove specific (and wrong) compiler + version from description (Closes: #883363) + * [x86] linux-headers: Depend on updated linux-compiler-gcc-7-x86 + + [ Riku Voipio ] + * [arm64] build in reset drivers + * [arm64] enable COMMON_CLK_HI655X so wifi and bluetooth work on Hikey + + -- Salvatore Bonaccorso <carnil@debian.org> Wed, 14 Feb 2018 06:56:06 +0100 + +linux (4.14.13-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.13 + - [x86] mm: Set MODULES_END to 0xffffffffff000000 + - [x86] mm: Map cpu_entry_area at the same place on 4/5 level + - [x86] kaslr: Fix the vaddr_end mess + - [x86] events/intel/ds: Use the proper cache flush method for mapping ds + buffers + - [x86] alternatives: Add missing '\n' at end of ALTERNATIVE inline asm + - [x86] pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN + - kernel/acct.c: fix the acct->needcheck check in check_free_space() + - mm/mprotect: add a cond_resched() inside change_pmd_range() + - mm/sparse.c: wrong allocation for mem_section + - userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails + - btrfs: fix refcount_t usage when deleting btrfs_delayed_nodes + - efi/capsule-loader: Reinstate virtual capsule mapping + - [sparc*] crypto: n2 - cure use after free + - crypto: chacha20poly1305 - validate the digest size + - crypto: pcrypt - fix freeing pcrypt instances + - crypto: chelsio - select CRYPTO_GF128MUL + - [x86] drm/i915: Disable DC states around GMBUS on GLK + - [x86] drm/i915: Apply Display WA #1183 on skl, kbl, and cfl + - fscache: Fix the default for fscache_maybe_release_page() + - [x86] CPU: Avoid unnecessary IPIs in arch_freq_get_on_cpu() + - [x86] CPU: Always show current CPU frequency in /proc/cpuinfo + - kernel/signal.c: protect the traced SIGNAL_UNKILLABLE tasks from SIGKILL + - kernel/signal.c: protect the SIGNAL_UNKILLABLE tasks from + !sig_kernel_only() signals + - kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in + complete_signal() + - [arm64] iommu/arm-smmu-v3: Don't free page table ops twice + - [arm64] iommu/arm-smmu-v3: Cope with duplicated Stream IDs + - [powerpc* ]mm: Fix SEGV on mapped region to return SEGV_ACCERR + - Input: elantech - add new icbody type 15 + - [x86] microcode/AMD: Add support for fam17h microcode loading + - apparmor: fix regression in mount mediation when feature set is pinned + - [hppa/parisc] Fix alignment of pa_tlb_lock in assembly on 32-bit SMP + kernel + - [hppa/parisc] qemu idle sleep support + - mtd: nand: pxa3xx: Fix READOOB implementation + - [s390x] KVM: fix cmma migration for multiple memory slots + - [s390x] KVM: prevent buffer overrun on memory hotplug during migration + + [ Salvatore Bonaccorso ] + * libsas: Disable asynchronous aborts for SATA devices + * drm/nouveau/disp/gf119: add missing drive vfunc ptr (Closes: #880660) + + [ Riku Voipio ] + * [arm64] disable CONFIG_HW_RANDOM_OMAP until the IRQ storm bug is fixed + + [ Ben Hutchings ] + * abiupdate.py: Add support for security mirrors + * Fix dependencies related to objtool (Closes: #886474): + - linux-headers: Add versioned dependency on linux-kbuild + - Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for out-of-tree + modules" + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 14 Jan 2018 19:45:05 +0000 + +linux (4.14.12-2) unstable; urgency=medium + + [ Ben Hutchings ] + * linux-kbuild: Add objtool + * linux-headers: Add symlink to linux-kbuild tools directory for objtool + + [ Salvatore Bonaccorso ] + * linux-headers: Add symlink to linux-kbuild tools directory for objtool in + architecture-specific headers package. + Thanks to Luca Boccassi (Closes: #886366) + + -- Salvatore Bonaccorso <carnil@debian.org> Sat, 06 Jan 2018 09:08:42 +0100 + +linux (4.14.12-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.9 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.10 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 + - x86/cpufeatures: Add X86_BUG_CPU_INSECURE + - x86/mm/pti: Disable global pages if PAGE_TABLE_ISOLATION=y + - x86/mm/pti: Prepare the x86/entry assembly code for entry/exit CR3 + switching + - x86/mm/pti: Add infrastructure for page table isolation + - x86/pti: Add the pti= cmdline option and documentation + - x86/mm/pti: Add mapping helper functions + - x86/mm/pti: Allow NX poison to be set in p4d/pgd + - x86/mm/pti: Allocate a separate user PGD + - x86/mm/pti: Populate user PGD + - x86/mm/pti: Add functions to clone kernel PMDs + - x86/mm/pti: Force entry through trampoline when PTI active + - x86/mm/pti: Share cpu_entry_area with user space page tables + - x86/entry: Align entry text section to PMD boundary + - x86/mm/pti: Share entry text PMD + - x86/mm/pti: Map ESPFIX into user space + - x86/cpu_entry_area: Add debugstore entries to cpu_entry_area + - x86/events/intel/ds: Map debug buffers in cpu_entry_area + - x86/mm/64: Make a full PGD-entry size hole in the memory map + - x86/pti: Put the LDT in its own PGD if PTI is on + - x86/pti: Map the vsyscall page if needed + - x86/mm: Allow flushing for future ASID switches + - x86/mm: Abstract switching CR3 + - x86/mm: Use/Fix PCID to optimize user/kernel switches + - x86/mm: Optimize RESTORE_CR3 + - x86/mm: Use INVPCID for __native_flush_tlb_single() + - x86/mm: Clarify the whole ASID/kernel PCID/user PCID naming + - x86/dumpstack: Indicate in Oops whether PTI is configured and enabled + - x86/mm/pti: Add Kconfig + - net: Fix double free and memory corruption in get_net_ns_by_id() + (CVE-2017-15129) + * [amd64] Implement Kernel Page Table Isolation (KPTI, aka KAISER) + (CVE-2017-5754) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.12 + - exec: Weaken dumpability for secureexec + - capabilities: fix buffer overread on very short xattr + - x86/cpu, x86/pti: Do not enable PTI on AMD processors + - x86/pti: Make sure the user/kernel PTEs match + - x86/dumpstack: Fix partial register dumps + - x86/dumpstack: Print registers for first stack frame + - x86/pti: Switch to kernel CR3 at early in entry_SYSCALL_compat() + - x86/process: Define cpu_tss_rw in same section as declaration + + [ Ben Hutchings ] + * e1000e: Fix e1000_check_for_copper_link_ich8lan return value. + (Closes: #885348) + + [ Vagrant Cascadian ] + * [arm64] Backport patch from linux-next to support SMP on tegra210 + systems. + + [ Salvatore Bonaccorso ] + * [rt] Update to 4.14.8-rt9 + * Bump ABI to 3 + * Revert "scsi: libsas: allow async aborts" + Fixes "Oops: NULL pointer dereference - RIP: + isci_task_abort_task+0x30/0x3e0 [isci]" (Closes: #882414) + * x86/tlb: Drop the _GPL from the cpu_tlbstate export + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 05 Jan 2018 21:20:26 +0100 + +linux (4.14.7-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.3 + - [s390x] fix transactional execution control register handling + - [s390x] noexec: execute kexec datamover without DAT + - [s390x] runtime instrumention: fix possible memory corruption + - [s390x] guarded storage: fix possible memory corruption + - [s390x] disassembler: add missing end marker for e7 table + - [s390x] disassembler: increase show_code buffer size + - ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock + - ACPI / EC: Fix regression related to triggering source of EC event + handling + - cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq + - serdev: fix registration of second slave + - sched: Make resched_cpu() unconditional + - lib/mpi: call cond_resched() from mpi_powm() loop + - [x86] boot: Fix boot failure when SMP MP-table is based at 0 + - [x86] decoder: Add new TEST instruction pattern + - [amd64] entry: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing + - [x86] perf: intel: Hide TSX events when RTM is not supported + - [arm64] Implement arch-specific pte_access_permitted() + - [armhf/armmp-lpae] 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE + - [armhf/armmp-lpae] 8721/1: mm: dump: check hardware RO bit for LPAE + - uapi: fix linux/tls.h userspace compilation error + - uapi: fix linux/rxrpc.h userspace compilation errors + - [mips*/4kc-malta] cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work + for 32-bit SMP + - [armhf,arm64] net: mvneta: fix handling of the Tx descriptor counter + - nbd: wait uninterruptible for the dead timeout + - nbd: don't start req until after the dead connection logic + - PM / OPP: Add missing of_node_put(np) + - PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time + - PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD + - [x86] PCI: hv: Use effective affinity mask + - [arm64] PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF + - [arm64] PCI: Apply Cavium ThunderX ACS quirk to more Root Ports + - dm integrity: allow unaligned bv_offset + - dm cache: fix race condition in the writeback mode overwrite_bio + optimisation + - dm crypt: allow unaligned bv_offset + - dm zoned: ignore last smaller runt zone + - dm mpath: remove annoying message of 'blk_get_request() returned -11' + - dm bufio: fix integer overflow when limiting maximum cache size + - ovl: Put upperdentry if ovl_check_origin() fails + - dm: allocate struct mapped_device with kvzalloc + - sched/rt: Simplify the IPI based RT balancing logic + - dm: fix race between dm_get_from_kobject() and __dm_destroy() + - dm: discard support requires all targets in a table support discards + - [mips*] Fix odd fp register warnings with MIPS64r2 + - [mips*/4kc-malta] Fix MIPS64 FP save/restore on 32-bit kernels + - [mips*] dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry + - [mips*] Fix an n32 core file generation regset support regression + - [mips*] math-emu: Fix final emulation phase for certain instructions + - rt2x00usb: mark device removed when get ENOENT usb error + - mm/z3fold.c: use kref to prevent page free/compact race + - autofs: don't fail mount for transient error + - nilfs2: fix race condition that causes file system corruption + - fscrypt: lock mutex before checking for bounce page pool + - eCryptfs: use after free in ecryptfs_release_messaging() + - libceph: don't WARN() if user tries to add invalid key + - bcache: check ca->alloc_thread initialized before wake up it + - fs: guard_bio_eod() needs to consider partitions + - fanotify: fix fsnotify_prepare_user_wait() failure + - isofs: fix timestamps beyond 2027 + - btrfs: change how we decide to commit transactions during flushing + - f2fs: expose some sectors to user in inline data or dentry case + - NFS: Fix typo in nomigration mount option + - NFS: Revert "NFS: Move the flock open mode check into nfs_flock()" + - nfs: Fix ugly referral attributes + - NFS: Avoid RCU usage in tracepoints + - NFS: revalidate "." etc correctly on "open". + - nfsd: deal with revoked delegations appropriately + - rtlwifi: rtl8192ee: Fix memory leak when loading firmware + - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time + - iwlwifi: fix firmware names for 9000 and A000 series hw + - md: fix deadlock error in recent patch. + - md: don't check MD_SB_CHANGE_CLEAN in md_allow_write + - Bluetooth: btqcomsmd: Add support for BD address setup + - md/bitmap: revert a patch + - fsnotify: clean up fsnotify_prepare/finish_user_wait() + - fsnotify: pin both inode and vfsmount mark + - fsnotify: fix pinning group in fsnotify_prepare_user_wait() + - ata: fixes kernel crash while tracing ata_eh_link_autopsy event + - ext4: fix interaction between i_size, fallocate, and delalloc after a + crash + - ext4: prevent data corruption with inline data + DAX + - ext4: prevent data corruption with journaling + DAX + - ALSA: pcm: update tstamp only if audio_tstamp changed + - ALSA: usb-audio: Add sanity checks to FE parser + - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU + - ALSA: usb-audio: Add sanity checks in v2 clock parsers + - ALSA: timer: Remove kernel warning at compat ioctl error paths + - ALSA: hda/realtek - Fix ALC275 no sound issue + - ALSA: hda: Fix too short HDMI/DP chmap reporting + - ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization + - ALSA: hda/realtek - Fix ALC700 family no sound issue + - [x86] mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method + - fix a page leak in vhost_scsi_iov_to_sgl() error recovery + - 9p: Fix missing commas in mount options + - fs/9p: Compare qid.path in v9fs_test_inode + - net/9p: Switch to wait_event_killable() + - scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair() + - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics() + - scsi: lpfc: fix pci hot plug crash in timer management routines + - scsi: lpfc: fix pci hot plug crash in list_add call + - scsi: lpfc: Fix crash receiving ELS while detaching driver + - scsi: lpfc: Fix FCP hba_wqidx assignment + - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails + - iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref + - iscsi-target: Fix non-immediate TMR reference leak + - target: fix null pointer regression in core_tmr_drain_tmr_list + - target: fix buffer offset in core_scsi3_pri_read_full_status + - target: Fix QUEUE_FULL + SCSI task attribute handling + - target: Fix caw_sem leak in transport_generic_request_failure + - target: Fix quiese during transport_write_pending_qf endless loop + - target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK + - mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid + - mtd: nand: atmel: Actually use the PM ops + - mtd: nand: omap2: Fix subpage write + - mtd: nand: Fix writing mtdoops to nand flash. + - mtd: nand: mtk: fix infinite ECC decode IRQ issue + - p54: don't unregister leds when they are not initialized + - block: Fix a race between blk_cleanup_queue() and timeout handling + - raid1: prevent freeze_array/wait_all_barriers deadlock + - genirq: Track whether the trigger type has been set + - [armhf,arm64] irqchip/gic-v3: Fix ppi-partitions lookup + - lockd: double unregister of inetaddr notifiers + - [powerpc*] KVM: Book3S HV: Don't call real-mode XICS hypercall handlers + if not enabled + - [x86] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state + - [x86] KVM: SVM: obey guest PAT + - [x86] kvm: vmx: Reinstate support for CPUs without virtual NMI + (Closes: #884482) + - dax: fix PMD faults on zero-length files + - dax: fix general protection fault in dax_alloc_inode + - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status + - [armhf] clk: ti: dra7-atl-clock: fix child-node lookups + - libnvdimm, dimm: clear 'locked' status on successful DIMM enable + - libnvdimm, pfn: make 'resource' attribute only readable by root + - libnvdimm, namespace: fix label initialization to use valid seq numbers + - libnvdimm, region : make 'resource' attribute only readable by root + - libnvdimm, namespace: make 'resource' attribute only readable by root + - svcrdma: Preserve CB send buffer across retransmits + - IB/srpt: Do not accept invalid initiator port names + - IB/cm: Fix memory corruption in handling CM request + - IB/hfi1: Fix incorrect available receive user context count + - IB/srp: Avoid that a cable pull can trigger a kernel crash + - IB/core: Avoid crash on pkey enforcement failed in received MADs + - IB/core: Only maintain real QPs in the security lists + - NFC: fix device-allocation error return + - spi-nor: intel-spi: Fix broken software sequencing codes + - fm10k,i40e,i40evf,igb,igbvf,ixgbe,ixgbevf: Use smp_rmb rather than + read_barrier_depends + - [hppa] Fix validity check of pointer size argument in new CAS + implementation + - [powerpc*] Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX + - [powerpc*] mm/radix: Fix crashes on Power9 DD1 with radix MMU and + STRICT_RWX + - [powerpc*] perf/imc: Use cpu_to_node() not topology_physical_package_id() + - [powerpc*] signal: Properly handle return value from uprobe_deny_signal() + - [powerpc*] 64s: Fix masking of SRR1 bits on instruction fault + - [powerpc*] 64s/radix: Fix 128TB-512TB virtual address boundary case + allocation + - [powerpc*] 64s/hash: Fix 512T hint detection to use >= 128T + - [powerpc*] 64s/hash: Fix 128TB-512TB virtual address boundary case + allocation + - [powerpc*] 64s/hash: Fix fork() with 512TB process address space + - [powerpc*] 64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary + - media: Don't do DMA on stack for firmware upload in the AS102 driver + - media: rc: check for integer overflow + - media: rc: nec decoder should not send both repeat and keycode + - media: v4l2-ctrl: Fix flags field on Control events + - [arm64] media: venus: fix wrong size on dma_free + - [arm64] media: venus: venc: fix bytesused v4l2_plane field + - [arm64] media: venus: reimplement decoder stop command + - [arm64] dts: meson-gxl: Add alternate ARM Trusted Firmware reserved + memory zone + - iwlwifi: fix wrong struct for a000 device + - iwlwifi: fix PCI IDs and configuration mapping for 9000 series + - iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command + - e1000e: Fix error path in link detection + - e1000e: Fix return value test + - e1000e: Separate signaling for link check/link up + - e1000e: Avoid receiver overrun interrupt bursts + - e1000e: fix buffer overrun while the I219 is processing DMA transactions + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4 + - [x86]: platform: hp-wmi: Fix tablet mode detection for convertibles + - mm, memory_hotplug: do not back off draining pcp free pages from kworker + context + - mm, oom_reaper: gather each vma to prevent leaking TLB entry + - [armhf,arm64] mm/cma: fix alloc_contig_range ret code/potential leak + - mm: fix device-dax pud write-faults triggered by get_user_pages() + - mm, hugetlbfs: introduce ->split() to vm_operations_struct + - device-dax: implement ->split() to catch invalid munmap attempts + - mm: introduce get_user_pages_longterm + - mm: fail get_vaddr_frames() for filesystem-dax mappings + - v4l2: disable filesystem-dax mapping support + - IB/core: disable memory registration of filesystem-dax vmas + - exec: avoid RLIMIT_STACK races with prlimit() + - mm/madvise.c: fix madvise() infinite loop under special circumstances + - mm: migrate: fix an incorrect call of prep_transhuge_page() + - mm, memcg: fix mem_cgroup_swapout() for THPs + - fs/fat/inode.c: fix sb_rdonly() change + - autofs: revert "autofs: take more care to not update last_used on path + walk" + - autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored" + - mm/hugetlb: fix NULL-pointer dereference on 5-level paging machine + - btrfs: clear space cache inode generation always + - nfsd: Fix stateid races between OPEN and CLOSE + - nfsd: Fix another OPEN stateid race + - nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat + - crypto: algif_aead - skip SGL entries with NULL page + - crypto: af_alg - remove locking in async callback + - crypto: skcipher - Fix skcipher_walk_aead_common + - lockd: lost rollback of set_grace_period() in lockd_down_net() + - [s390x] revert ELF_ET_DYN_BASE base changes + - [armhf] drm: omapdrm: Fix DPI on platforms using the DSI VDDS + - [armhf] omapdrm: hdmi4: Correct the SoC revision matching + - [arm64] module-plts: factor out PLT generation code for ftrace + - [arm64] ftrace: emit ftrace-mod.o contents through code + - [powerpc*] powernv: Fix kexec crashes caused by tlbie tracing + - [powerpc*] kexec: Fix kexec/kdump in P9 guest kernels + - [x86] KVM: pvclock: Handle first-time write to pvclock-page contains + random junk + - [x86] KVM: Exit to user-mode on #UD intercept when emulator requires + - [x86] KVM: inject exceptions produced by x86_decode_insn + - [x86] KVM: lapic: Split out x2apic ldr calculation + - [x86] KVM: lapic: Fixup LDR on load in x2apic + - mmc: sdhci: Avoid swiotlb buffer being full + - mmc: block: Fix missing blk_put_request() + - mmc: block: Check return value of blk_get_request() + - mmc: core: Do not leave the block driver in a suspended state + - mmc: block: Ensure that debugfs files are removed + - mmc: core: prepend 0x to pre_eol_info entry in sysfs + - mmc: core: prepend 0x to OCR entry in sysfs + - ACPI / EC: Fix regression related to PM ops support in ECDT device + - eeprom: at24: fix reading from 24MAC402/24MAC602 + - eeprom: at24: correctly set the size for at24mac402 + - eeprom: at24: check at24_read/write arguments + - [alpha,x86] i2c: i801: Fix Failed to allocate irq -2147483648 error + - bcache: Fix building error on MIPS + - bcache: only permit to recovery read error when cache device is clean + - bcache: recover data from backing when data is clean + - hwmon: (jc42) optionally try to disable the SMBUS timeout + - nvme-pci: add quirk for delay before CHK RDY for WDC SN200 + - Revert "drm/radeon: dont switch vt on suspend" + - drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs() + - drm/amdgpu: Potential uninitialized variable in + amdgpu_vm_update_directories() + - drm/amdgpu: correct reference clock value on vega10 + - drm/amdgpu: fix error handling in amdgpu_bo_do_create + - drm/amdgpu: Properly allocate VM invalidate eng v2 + - drm/amdgpu: Remove check which is not valid for certain VBIOS + - drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more + - dma-buf: make reservation_object_copy_fences rcu save + - drm/amdgpu: reserve root PD while releasing it + - drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list + - drm/vblank: Fix flip event vblank count + - drm/vblank: Tune drm_crtc_accurate_vblank_count() WARN down to a debug + - drm/tilcdc: Precalculate total frametime in tilcdc_crtc_set_mode() + - drm/radeon: fix atombios on big endian + - drm/panel: simple: Add missing panel_simple_unprepare() calls + - [arm64] drm/hisilicon: Ensure LDI regs are properly configured. + - drm/ttm: once more fix ttm_buffer_object_transfer + - drm/amd/pp: fix typecast error in powerplay. + - drm/fb_helper: Disable all crtc's when initial setup fails. + - drm/edid: Don't send non-zero YQ in AVI infoframe for HDMI 1.x sinks + - drm/amdgpu: move UVD/VCE and VCN structure out from union + - drm/amdgpu: Set adev->vcn.irq.num_types for VCN + - IB/core: Do not warn on lid conversions for OPA + - IB/hfi1: Do not warn on lid conversions for OPA + - e1000e: fix the use of magic numbers for buffer overrun issue + - md: forbid a RAID5 from having both a bitmap and a journal. + - [x86] drm/i915: Fix false-positive assert_rpm_wakelock_held in + i915_pmic_bus_access_notifier v2 + - [x86] drm/i915: Re-register PMIC bus access notifier on runtime resume + - [x86] drm/i915/fbdev: Serialise early hotplug events with async fbdev + config + - [x86] drm/i915/gvt: Correct ADDR_4K/2M/1G_MASK definition + - [x86] drm/i915: Don't try indexed reads to alternate slave addresses + - [x86] drm/i915: Prevent zero length "index" write + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.5 + - drm/amdgpu: Use unsigned ring indices in amdgpu_queue_mgr_map + - [s390x] runtime instrumentation: simplify task exit handling + - usbip: fix usbip attach to find a port that matches the requested speed + - usbip: Fix USB device hang due to wrong enabling of scatter-gather + - uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices + - usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub + - serial: 8250_early: Only set divisor if valid clk & baud + - [mips*] Add custom serial.h with BASE_BAUD override for generic kernel + - ima: fix hash algorithm initialization + - [s390x] vfio-ccw: Do not attempt to free no-op, test and tic cda. + - PM / Domains: Fix genpd to deal with drivers returning 1 from ->prepare() + - [s390x] pci: do not require AIS facility + - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() + - staging: rtl8188eu: avoid a null dereference on pmlmepriv + - [arm64] mmc: sdhci-msm: fix issue with power irq + - hwmon: (pmbus/core) Prevent unintentional setting of page to 0xFF + - perf/core: Fix __perf_read_group_add() locking + - [armhf] PCI: dra7xx: Create functional dependency between PCIe and PHY + - [x86] intel_rdt: Initialize bitmask of shareable resource if CDP enabled + - [x86] intel_rdt: Fix potential deadlock during resctrl mount + - serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X + - kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y + - [x86] entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() + - [armhf,arm64] clocksource/drivers/arm_arch_timer: Validate CNTFRQ after + enabling frame + - [x86] EDAC, sb_edac: Fix missing break in switch + - [arm64] cpuidle: Correct driver unregistration if init fails + - usb: xhci: Return error when host is dead in xhci_disable_slot() + - [armel,armhf] sysrq : fix Show Regs call trace on ARM + - [sh4] serial: sh-sci: suppress warning for ports without dma channels + - [armhf] serial: imx: Update cached mctrl value when changing RTS + - [x86] kprobes: Disable preemption in ftrace-based jprobes + - [x86] locking/refcounts, asm: Use unique .text section for refcount + exceptions + - [s390x] ptrace: fix guarded storage regset handling + - perf tools: Fix leaking rec_argv in error cases + - mm, x86/mm: Fix performance regression in get_user_pages_fast() + - iio: adc: ti-ads1015: add 10% to conversion wait time + - iio: multiplexer: add NULL check on devm_kzalloc() and devm_kmemdup() + return values + - [x86] locking/refcounts, asm: Enable CONFIG_ARCH_HAS_REFCOUNT + - [powerpc*] jprobes: Disable preemption when triggered through ftrace + - [powerpc*] kprobes: Disable preemption before invoking probe handler for + optprobes + - usb: hub: Cycle HUB power when initialization fails + - [armhf,arm64] USB: ulpi: fix bus-node lookup + - xhci: Don't show incorrect WARN message about events for empty rings + - usb: xhci: fix panic in xhci_free_virt_devices_depth_first + - USB: core: Add type-specific length check of BOS descriptors + - USB: usbfs: Filter flags passed in from user space + - usb: host: fix incorrect updating of offset + - locking/refcounts: Do not force refcount_t usage as GPL-only export + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.6 + - usb: gadget: core: Fix ->udc_set_speed() speed handling + - serdev: ttyport: add missing receive_buf sanity checks + - serdev: ttyport: fix NULL-deref on hangup + - serdev: ttyport: fix tty locking in close + - usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT + - can: peak/pci: fix potential bug when probe() fails + - can: kvaser_usb: free buf in error paths + - can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() + - can: kvaser_usb: ratelimit errors if incomplete messages are received + - can: kvaser_usb: cancel urb on -EPIPE and -EPROTO + - can: ems_usb: cancel urb on -EPIPE and -EPROTO + - can: esd_usb2: cancel urb on -EPIPE and -EPROTO + - can: usb_8dev: cancel urb on -EPIPE and -EPROTO + - can: peak/pcie_fd: fix potential bug in restarting tx queue + - virtio: release virtio index when fail to device_register + - [arm64] pinctrl: armada-37xx: Fix direction_output() callback behavior + - [x86] Drivers: hv: vmbus: Fix a rescind issue + - [x86] hv: kvp: Avoid reading past allocated blocks from KVP file + - firmware: vpd: Destroy vpd sections in remove function + - firmware: vpd: Tie firmware kobject to device lifetime + - firmware: vpd: Fix platform driver and device registration/unregistration + - scsi: dma-mapping: always provide dma_get_cache_alignment + - scsi: use dma_get_cache_alignment() as minimum DMA alignment + - scsi: libsas: align sata_device's rps_resp on a cacheline + - efi: Move some sysfs files to be read-only by root + - efi/esrt: Use memunmap() instead of kfree() to free the remapping + - ASN.1: fix out-of-bounds read when parsing indefinite length item + - ASN.1: check for error from ASN1_OP_END__ACT actions + - KEYS: add missing permission check for request_key() destination + (CVE-2017-17807) + - KEYS: reject NULL restriction string when type is specified + - X.509: reject invalid BIT STRING for subjectPublicKey + - X.509: fix comparisons of ->pkey_algo + - [x86] idt: Load idt early in start_secondary + - [x86] PCI: Make broadcom_postcore_init() check acpi_disabled + - [x86] KVM: fix APIC page invalidation + - btrfs: fix missing error return in btrfs_drop_snapshot + - btrfs: handle errors while updating refcounts in update_ref_for_cow + - ALSA: pcm: prevent UAF in snd_pcm_info + - ALSA: seq: Remove spurious WARN_ON() at timer check + - ALSA: usb-audio: Fix out-of-bound error + - ALSA: usb-audio: Add check return value for usb_string() + - [x86] iommu/vt-d: Fix scatterlist offset handling + - smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place + - [s390x] always save and restore all registers on context switch + - [s390x] mm: fix off-by-one bug in 5-level page table handling + - [s390x] fix compat system call table + - [s390x] KVM: Fix skey emulation permission check + - [powerpc*] Revert "powerpc: Do not call ppc_md.panic in fadump panic + notifier" + - [powerpc*] 64s: Initialize ISAv3 MMU registers before setting partition + table + - iwlwifi: mvm: mark MIC stripped MPDUs + - iwlwifi: mvm: don't use transmit queue hang detection when it is not + possible + - iwlwifi: mvm: flush queue before deleting ROC + - iwlwifi: mvm: fix packet injection + - iwlwifi: mvm: enable RX offloading with TKIP and WEP + - brcmfmac: change driver unbind order of the sdio function devices + - md/r5cache: move mddev_lock() out of r5c_journal_mode_set() + - [armhf] drm/bridge: analogix dp: Fix runtime PM state in get_modes() + callback + - [armhf] drm/exynos: gem: Drop NONCONTIG flag for buffers allocated + without IOMMU + - [x86] drm/i915: Fix vblank timestamp/frame counter jumps on gen2 + - media: dvb: i2c transfers over usb cannot be done from stack + - media: rc: sir_ir: detect presence of port + - media: rc: partial revert of "media: rc: per-protocol repeat period" + - [arm64] KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one + - [armhf] KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one + - [x86] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts + (CVE-2017-1000407) + - [armhf,arm64] KVM: Fix broken GICH_ELRSR big endian conversion + - [armhf,arm64] KVM: vgic-irqfd: Fix MSI entry allocation + - [armhf,arm64] KVM: vgic: Preserve the revious read from the pending table + - [armhf,arm64] KVM: vgic-its: Check result of allocation before use + - [arm64] fpsimd: Prevent registers leaking from dead tasks + - [arm64] SW PAN: Point saved ttbr0 at the zero page when switching to + init_mm + - [arm64] SW PAN: Update saved ttbr0 value on enter_lazy_tlb + - [armhf] Revert "ARM: dts: imx53: add srtc node" + - [armhf] bus: arm-cci: Fix use of smp_processor_id() in preemptible context + - IB/core: Only enforce security for InfiniBand + - [armel,armhf] BUG if jumping to usermode address in kernel mode + - [armel,armhf] avoid faulting on qemu + - [arm64] irqchip/qcom: Fix u32 comparison with value less than zero + - [powerpc*] perf: Fix pmu_count to count only nest imc pmus + - apparmor: fix leak of null profile name if profile allocation fails + - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() + - gre6: use log_ecn_error module parameter in ip6_tnl_rcv() + - route: also update fnhe_genid when updating a route cache + - route: update fnhe_expires for redirect when the fnhe exists + - rsi: fix memory leak on buf and usb_reg_buf + - pipe: match pipe_max_size data type with procfs + - lib/genalloc.c: make the avail variable an atomic_long_t + - NFS: Fix a typo in nfs_rename() + - sunrpc: Fix rpc_task_begin trace point + - nfp: inherit the max_mtu from the PF netdev + - nfp: fix flower offload metadata flag usage + - xfs: fix forgotten rcu read unlock when skipping inode reclaim + - block: wake up all tasks blocked in get_request() + - [sparc64] mm: set fields in deferred pages + - zsmalloc: calling zs_map_object() from irq is a bug + - slub: fix sysfs duplicate filename creation when slub_debug=O + - sctp: do not free asoc when it is already dead in sctp_sendmsg + - sctp: use the right sk after waking up from wait_buf sleep + - fcntl: don't leak fd reference when fixup_compat_flock fails + - geneve: fix fill_info when link down + - bpf: fix lockdep splat + - [arm64] clk: qcom: common: fix legacy board-clock registration + - [arm64] clk: hi3660: fix incorrect uart3 clock freqency + - atm: horizon: Fix irq release error + - xfrm: Copy policy family in clone_policy + - f2fs: fix to clear FI_NO_PREALLOC + - bnxt_re: changing the ip address shouldn't affect new connections + - IB/mlx4: Increase maximal message size under UD QP + - IB/mlx5: Assign send CQ and recv CQ of UMR QP + - afs: Fix total-length calculation for multiple-page send + - afs: Connect up the CB.ProbeUuid + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.7 + - net: realtek: r8169: implement set_link_ksettings() + - [s390x] qeth: fix early exit from error path + - tipc: fix memory leak in tipc_accept_from_sock() + - vhost: fix skb leak in handle_rx() + - rds: Fix NULL pointer dereference in __rds_rdma_map + - sit: update frag_off info + - tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb() + - packet: fix crash in fanout_demux_rollover() + - net/packet: fix a race in packet_bind() and packet_notifier() + - tcp: remove buggy call to tcp_v6_restore_cb() + - usbnet: fix alignment for frames with no ethernet header + - net: remove hlist_nulls_add_tail_rcu() + - stmmac: reset last TSO segment size after device open + - tcp/dccp: block bh before arming time_wait timer + - [s390x] qeth: build max size GSO skbs on L2 devices + - [s390x] qeth: fix thinko in IPv4 multicast address tracking + - [s390x] qeth: fix GSO throughput regression + - tcp: use IPCB instead of TCP_SKB_CB in inet_exact_dif_match() + - tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() + - tcp: use current time in tcp_rcv_space_adjust() + - net: sched: cbq: create block for q->link.block + - tap: free skb if flags error + - tcp: when scheduling TLP, time of RTO should account for current ACK + - tun: free skb in early errors + - net: ipv6: Fixup device for anycast routes during copy + - tun: fix rcu_read_lock imbalance in tun_build_skb + - net: accept UFO datagrams from tuntap and packet + - net: openvswitch: datapath: fix data type in queue_gso_packets + - cls_bpf: don't decrement net's refcount when offload fails + - sctp: use right member as the param of list_for_each_entry + - ipmi: Stop timers before cleaning up the module + - usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping + - fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall + - fix kcm_clone() + - [armhf,arm64] KVM: vgic-its: Preserve the revious read from the pending + table + - kbuild: do not call cc-option before KBUILD_CFLAGS initialization + - [powerpc*] powernv/idle: Round up latency and residency values + - ipvlan: fix ipv6 outbound device + - blk-mq: Avoid that request queue removal can trigger list corruption + - nvmet-rdma: update queue list during ib_device removal + - audit: Allow auditd to set pid to 0 to end auditing + - audit: ensure that 'audit=1' actually enables audit for PID 1 + - dm raid: fix panic when attempting to force a raid to sync + - md: free unused memory after bitmap resize + - RDMA/cxgb4: Annotate r2 and stag as __be32 + - [x86] intel_rdt: Fix potential deadlock during resctrl unmount + + [ Salvatore Bonaccorso ] + * Add ABI reference for 4.14.0-1 + * xen/time: do not decrease steal time after live migration on xen + (Closes: #871608) + * crypto: salsa20 - fix blkcipher_walk API usage (CVE-2017-17805) + * crypto: hmac - require that the underlying hash algorithm is unkeyed + (CVE-2017-17806) + + [ Vagrant Cascadian ] + * [armhf, arm64] Backport patches from 4.15.x to support dwmac-sun8i. + + [ Ben Hutchings ] + * [rt] Update to 4.14.6-rt7: + - hrtimer: account for migrated timers + - crypto: mcryptd: protect the per-CPU queue with a lock + - tracing: Update inter-event hist trigger support to v7: + + Rename virtual "$common_timestamp" field to "common_timestamp" + + Fix use-after-free in trigger removal + - mm/slub: close possible memory-leak in kmem_cache_alloc_bulk() + - crypto: limit more FPU-enabled sections + * dccp: CVE-2017-8824: use-after-free in DCCP code + * netfilter: nfnetlink_cthelper: Add missing permission checks + (CVE-2017-17448) + * netlink: Add netns check on taps (CVE-2017-17449) + * netfilter: xt_osf: Add missing permission checks (CVE-2017-17450) + * USB: core: prevent malicious bNumInterfaces overflow (CVE-2017-17558) + * net: ipv4: fix for a race condition in raw_sendmsg (CVE-2017-17712) + * media: dvb-usb-v2: lmedm04: Improve logic checking of warm start + (CVE-2017-16538) + * media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner + (CVE-2017-16538) + * media: hdpvr: Fix an error handling path in hdpvr_probe() (CVE-2017-16644) + * [armhf,arm64,x86] KVM: Fix stack-out-of-bounds read in write_mmio + (CVE-2017-17741) + * bluetooth: Prevent stack info leak from the EFS element. + (CVE-2017-1000410) + * bpf/verifier: Fix multiple security issues (Closes: #883558): + - encapsulate verifier log state into a structure + - move global verifier log into verifier environment + - fix branch pruning logic + - fix bounds calculation on BPF_RSH + - fix incorrect sign extension in check_alu_op() (CVE-2017-16995) + - fix incorrect tracking of register size truncation (CVE-2017-16996) + - fix 32-bit ALU op verification + - fix missing error return in check_stack_boundary() + - force strict alignment checks for stack pointers + - don't prune branches when a scalar is replaced with a pointer + - fix integer overflows + * Bump ABI to 2 + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 22 Dec 2017 14:12:23 +0000 + +linux (4.14.2-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2 + - mm/pagewalk.c: report holes in hugetlb ranges (CVE-2017-16994) + + [ Ben Hutchings ] + * [rt] Update to 4.14-rt1 and reenable (Closes: #882192) + * i40e: Build for 32-bit targets again + - i40e/i40evf: organize and re-number feature flags + - i40e: fix flags declaration + - Revert "i40e: Build for 64-bit targets only" + * aufs: Update support patchset to aufs4.14-20171120 + * [armel] Change configuration to reduce image size (fixes FTBFS): + - Change CONNECTOR from built-in to module, and disable PROC_EVENTS + - Disable INTEGRITY and dependent options + - video: Disable USB_APPLEDISPLAY, BACKLIGHT_CLASS_DEVICE + * apparmor: fix oops in audit_signal_cb hook (regression in 4.14) + * leds: Enable LEDS_BRIGHTNESS_HW_CHANGED (Closes: #872862) + * [rt] Add new signing subkey for Steven Rostedt + * [rt] Update to 4.14.1-rt3 + * Set ABI to 1 + * mmap: Remember the MAP_FIXED flag as VM_FIXED + * [x86] mmap: Add an exception to the stack gap for Hotspot JVM compatibility + (Closes: #865303) + + [ Salvatore Bonaccorso ] + * mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() + (CVE-2017-1000405) + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 30 Nov 2017 12:33:47 +0000 + +linux (4.14-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.14 + + [ Ben Hutchings ] + * debian/control: Set Rules-Requires-Root to no + * [armhf] drm: Enable DRM_SUN4I, DRM_SUN4I_HDMI, DRM_SUN4I_BACKEND, + DRM_SUN8I_MIXER as modules; and DRM_SUN4I_HDMI_CEC (Closes: #881570) + * media: dvb-core: always call invoke_release() in fe_free() + * dvb_frontend: don't use-after-free the frontend struct (CVE-2017-16648) + * Set ABI name to trunk + + [ Bastian Blank ] + * Enable CRYPTO_SHA3. + + [ Riku Voipio ] + * [arm64] enable generic server options. + - NUMA, ACPI_NUMA, CRASH_DUMP, VFIO, HOTPLUG_PCI, ACPI_CPPC_CPUFREQ, + MMC_SDHCI_ACPI, PL330_DMA + * [arm64] enable various server platform drivers + - NET_XGENE_V2, EDAC_THUNDERX, MMC_CAVIUM_THUNDER, + GPIO_XLP, I2C_XLP9XX, SPI_XLP, DRM_HISI_HIBMC, HISI_SAS_PCI, + GPIO_WATCHDOG, ARM_SP805_WATCHDOG, ARM_SBSA_WATCHDOG, DW_WATCHDOG + * [arm64] enable support for Marvell arm64 boards + - CRYPTO_DEV_MARVELL_CESA, MARVELL_PHY, MARVELL_10G_PHY, + PHY_MVEBU_CP110_COMPHY, RTC_DRV_MV, RTC_DRV_ARMADA38X, SPI_ARMADA_3700 + ARMADA_THERMAL, HW_RANDOM_OMAP, CRYPTO_DEV_SAFEXCE + * [arm64] 96boards Hikey and Dragonboard support + - PCIE_KIRIN, TEE, OPTEE, SND_I2S_HI6210_I2S, DRM_I2C_ADV7511_AUDIO, + CMA, USB_ISP176, USB_CHIPIDEA_ULPI, USB_DWC3_ULPI, NOP_USB_XCEIV + USB_ULPI, RPMSG_QCOM*, PHY_QCOM*, QCOM_IOMMU, QCOM_CLK*, etc + - SERIAL_DEV_BUS for HiKey bluetooth + * All options as modules when possible + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 17 Nov 2017 00:16:15 +0000 + +linux (4.14~rc7-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00120000 (fixes FTBFS) + * debian/bin/gencontrol.py: Set encoding to UTF-8 globally + * [alpha] udeb: Remove empty fb-modules package (fixes FTBFS) + * [armel] udeb: Remove fbcon from fb-modules package + + [ Uwe Kleine-König ] + * [arm64] add BRCMFMAC_SDIO for wifi on Raspberry Pi 3 (Closes: #877911) + + [ Vagrant Cascadian ] + * Enable SQUASHFS_LZ4 in default config. + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 30 Oct 2017 18:31:38 +0000 + +linux (4.14~rc5-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * Update kconfig for 4.14: + - [alpha] fbdev: Re-enable FRAMEBUFFER_CONSOLE as built-in + - [armel] fbdev: Explicitly disable FRAMEBUFFER_CONSOLE, as it can no + longer be a module + - [arm64] Re-enable MMC_QCOM_DML + - Change RC_CORE back to being a module + - power/supply: Enable BATTERY_BQ27XXX and BATTERY_BQ27XXX_HDQ as modules, + replacing W1_SLAVE_BQ27000 + * net: Disable IRDA, which will soon be deleted upstream + * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00110000 for all flavours + (fixes FTBFS) + * i40e: Build for 64-bit targets only (fixes FTBFS on hppa) + * Compile with gcc-7 on all architectures + + [ John Paul Adrian Glaubitz ] + * [m68k] udeb: Build ata-modules package, include libata + * [m68k] udeb: Add ide-cd_mod to cdrom-core-modules + * [m68k] udeb: Build ide-core-modules package, include ide-core + * [m68k] udeb: Build ide-modules package, include ide-gd_mod + * [m68k] udeb: Move old IDE drivers from pata-modules to ide-modules: + - buddha, falconide, gayle, macide, q40ide + * [m68k] udeb: Add missing SCSI drivers to scsi-modules: + - a2091, a3000, a4000t, bvme6000_scsi, gvp11, mvme16x_scsi, zorro7xx + * [m68k] Build uncompressed kernel image by default. + + [ Uwe Kleine-König ] + * media: drop explicit setting of DVB_MAX_ADAPTERS to follow upstream default + (Closes: #878846) + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 17 Oct 2017 23:37:52 +0100 + +linux (4.14~rc3-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * aufs: Update support patchset to aufs4.x-rcN-20171002 + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 02 Oct 2017 04:47:08 +0100 + +linux (4.13.13-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11 + - workqueue: replace pool->manager_arb mutex with a flag + - [x86] ALSA: hda/realtek - Add support for ALC236/ALC3204 + - [x86] ALSA: hda - fix headset mic problem for Dell machines with alc236 + - ceph: unlock dangling spinlock in try_flush_caps() + - [powerpc*] KVM: PPC: Fix oops when checking KVM_CAP_PPC_HTM + (CVE-2017-15306) + - [powerpc*] KVM: PPC: Book3S HV: POWER9 more doorbell fixes + - [powerpc*] KVM: PPC: Book3S: Protect kvmppc_gpa_to_ua() with SRCU + - [s390x] kvm: fix detection of guest machine checks + - nbd: handle interrupted sendmsg with a sndtimeo set + - spi: uapi: spidev: add missing ioctl header + - spi: a3700: Return correct value on timeout detection + - spi: bcm-qspi: Fix use after free in bcm_qspi_probe() in error path + - spi: armada-3700: Fix failing commands with quad-SPI + - ovl: add NULL check in ovl_alloc_inode + - ovl: fix EIO from lookup of non-indexed upper + - ovl: handle ENOENT on index lookup + - ovl: do not cleanup unsupported index entries + - fuse: fix READDIRPLUS skipping an entry + - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() + - xen: fix booting ballooned down hvm guest + - cifs: Select all required crypto modules + - CIFS: Fix NULL pointer deref on SMB2_tcon() failure + - Input: elan_i2c - add ELAN0611 to the ACPI table + - Input: gtco - fix potential out-of-bound access (CVE-2017-16643) + - Fix encryption labels and lengths for SMB3.1.1 + - SMB3: Validate negotiate request must always be signed + - assoc_array: Fix a buggy node-splitting case (CVE-2017-12193) + - [s390x] scsi: zfcp: fix erp_action use-before-initialize in REC action + trace + - scsi: aacraid: Fix controller initialization failure + - scsi: qla2xxx: Initialize Work element before requesting IRQs + - scsi: sg: Re-fix off by one in sg_fill_request_table() + - [x86] cpu/AMD: Apply the Erratum 688 fix when the BIOS doesn't + - [x86] drm/amd/powerplay: fix uninitialized variable + - [x86] drm/i915/perf: fix perf enable/disable ioctls with 32bits + userspace + - [armhf] can: sun4i: fix loopback mode + - can: kvaser_usb: Correct return value in printout + - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages + - cfg80211: fix connect/disconnect edge cases + - ipsec: Fix aborted xfrm policy dump crash + - [armhf] regulator: fan53555: fix I2C device ids (Closes: #879768) + - [powerpc*] xive: Fix the size of the cpumask used in + xive_find_target_in_mask() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.12 + - ALSA: timer: Add missing mutex lock for compat ioctls + - ALSA: seq: Fix nested rwsem annotation for lockdep splat + - cifs: check MaxPathNameComponentLength != 0 before using it + (Closes: #880504) + - KEYS: return full count in keyring_read() if buffer is too small + - KEYS: trusted: fix writing past end of buffer in trusted_read() + - KEYS: fix out-of-bounds read during ASN.1 parsing + - ASoC: adau17x1: Workaround for noise bug in ADC + - virtio_blk: Fix an SG_IO regression + - [arm64] ensure __dump_instr() checks addr_limit + - [arm64] KVM: its: Fix missing dynamic allocation check in scan_its_table + - [armhf, arm64] KVM: set right LR register value for 32 bit guest when + inject abort + - [armhf,arm64] kvm: Disable branch profiling in HYP code + - [armhf] dts: mvebu: pl310-cache disable double-linefill + - drm/amdgpu: return -ENOENT from uvd 6.0 early init for harvesting + - drm/amdgpu: allow harvesting check for Polaris VCE + - userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of + i_size + - ocfs2: fstrim: Fix start offset of first cluster group during fstrim + - fs/hugetlbfs/inode.c: fix hwpoison reserve accounting + - mm, swap: fix race between swap count continuation operations + - [x86] drm/i915: Do not rely on wm preservation for ILK watermarks + - [x86] drm/i915/edp: read edp display control registers unconditionally + - [mips*] bpf: Fix a typo in build_one_insn() + - [mips*] smp-cmp: Use right include for task_struct + - [mips*] SMP: Fix deadlock & online race + - Revert "x86: do not use cpufreq_quick_get() for /proc/cpuinfo "cpu MHz"" + - [powerpc*] kprobes: Dereference function pointers only if the address + does not belong to kernel text + - futex: Fix more put_pi_state() vs. exit_pi_state_list() races + - perf/cgroup: Fix perf cgroup hierarchy support + - [x86] mcelog: Get rid of RCU remnants + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.13 + - netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to + rhashtable" + - netfilter: nft_set_hash: disable fast_ops for 2-len keys (Closes: #880145) + - workqueue: Fix NULL pointer dereference + - crypto: ccm - preserve the IV buffer + - [x86] crypto: sha1-mb - fix panic due to unaligned access + - [x86] crypto: sha256-mb - fix panic due to unaligned access + - KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2] + - [x86] ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360 + - ACPICA: Dispatch active GPEs at init time + - ACPICA: Make it possible to enable runtime GPEs earlier + - ACPI / scan: Enable GPEs before scanning the namespace + - [armel,armhf] 8720/1: ensure dump_instr() checks addr_limit + - ALSA: timer: Limit max instances per timer + - ALSA: usb-audio: support new Amanero Combo384 firmware version + - [x86] ALSA: hda - fix headset mic problem for Dell machines with alc274 + - ALSA: seq: Fix OSS sysex delivery in OSS emulation + - ALSA: seq: Avoid invalid lockdep class warning + - [mips*] Fix CM region target definitions + - [powerpc*] KVM: Book3S HV: Fix exclusion between HPT resizing and other + HPT updates + - Input: elan_i2c - add ELAN060C to the ACPI table + - rbd: use GFP_NOIO for parent stat and data requests + - [x86] drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue + - [armhf] can: sun4i: handle overrun in RX FIFO + - can: peak: Add support for new PCIe/M2 CAN FD interfaces + - [x86] debug: Handle warnings before the notifier chain, to fix KGDB crash + - [x86] smpboot: Make optimization of delay calibration work correctly + - [x86] oprofile/ppro: Do not use __this_cpu*() in preemptible context + + [ Salvatore Bonaccorso ] + * mac80211: accept key reinstall without changing anything (CVE-2017-13080) + * sctp: do not peel off an assoc from one netns to another one + (CVE-2017-15115) + + [ Ben Hutchings ] + * linux-image: Recommend apparmor, as systemd units with an AppArmor + profile will fail without it (Closes: #880441) + * [powerpc*] kvm: Ignore ABI change in 4.13.6 (fixes FTBFS) + * swap: Avoid ABI change in 4.13.12 + * mac80211: use constant time comparison with keys + * mac80211: don't compare TKIP TX MIC key in reinstall prevention + * usb: usbtest: fix NULL pointer dereference (CVE-2017-16532) + * media: cx231xx-cards: fix NULL-deref on missing association descriptor + (CVE-2017-16536) + * media: imon: Fix null-ptr-deref in imon_probe (CVE-2017-16537) + * media: dib0700: fix invalid dvb_detach argument (CVE-2017-16646) + * net: usb: asix: fill null-ptr-deref in asix_suspend (CVE-2017-16647) + * net: cdc_ether: fix divide by 0 on bad descriptors (CVE-2017-16649) + * net: qmi_wwan: fix divide by 0 on bad descriptors (CVE-2017-16650) + * nftables: Enable NFT_RT, NFT_SET_BITMAP, NFT_OBJREF as modules + (Closes: #881931) + * [powerpc*/*64*] drm: Enable DRM_AMDGPU as module (Closes: #881593) + * amdgpu: Enable DRM_AMDGPU_USERPTR on all architectures + * amdgpu: Enable DRM_AMDGPU_SI, CONFIG_DRM_AMDGPU_CIK (Closes: #847570) + * [arm64,x86] net/wireless: Enable RTL8723BS as module (Closes: #881568) + * [arm64] nvmem: Enable NVMEM_SUNXI_SID as module (Closes: #881567) + * [x86] rmi4: Disable RMI4_SMB (Closes: #880471) + * ALSA: timer: Avoid ABI change in 4.13.13 + * netfilter: nat: Avoid ABI change in 4.13.13 + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 16 Nov 2017 21:04:10 +0000 + +linux (4.13.10-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5 + - cifs: check rsp for NULL before dereferencing in SMB2_open + - cifs: release cifs root_cred after exit_cifs + - cifs: release auth_key.response for reconnect. + - nvme-pci: fix host memory buffer allocation fallback + - nvme-pci: use appropriate initial chunk size for HMB allocation + - nvme-pci: propagate (some) errors from host memory buffer setup + - dax: remove the pmem_dax_ops->flush abstraction + - dm integrity: do not check integrity for failed read operations + - mmc: block: Fix incorrectly initialized requests + - fs/proc: Report eip/esp in /prod/PID/stat for coredumping + - scsi: scsi_transport_fc: fix NULL pointer dereference in + fc_bsg_job_timeout + - cifs: SMB3: Add support for multidialect negotiate (SMB2.1 and later) + - mac80211: fix VLAN handling with TXQs + - mac80211_hwsim: Use proper TX power + - mac80211: flush hw_roc_start work before cancelling the ROC + - genirq: Make sparse_irq_lock protect what it should protect + - genirq/msi: Fix populating multiple interrupts + - genirq: Fix cpumask check in __irq_startup_managed() + - [powerpc*] KVM: Book3S HV: Hold kvm->lock around call to + kvmppc_update_lpcr + - [powerpc*] KVM: Book3S HV: Fix bug causing host SLB to be restored + incorrectly + - [powerpc*] KVM: PPC: Book3S HV: Don't access XIVE PIPR register using + byte accesses + - tracing: Fix trace_pipe behavior for instance traces + - tracing: Erase irqsoff trace with empty write + - tracing: Remove RCU work arounds from stack tracer + - md/raid5: fix a race condition in stripe batch + - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list + - scsi: aacraid: Fix 2T+ drives on SmartIOC-2000 + - scsi: aacraid: Add a small delay after IOP reset + - [armhf] drm/exynos: Fix locking in the suspend/resume paths + - [x86] drm/i915/gvt: Fix incorrect PCI BARs reporting + - Revert "drm/i915/bxt: Disable device ready before shutdown command" + - drm/amdgpu: revert tile table update for oland + - drm/radeon: disable hard reset in hibernate for APUs + - crypto: drbg - fix freeing of resources + - security/keys: properly zero out sensitive key material in big_key + - security/keys: rewrite all of big_key crypto + - KEYS: fix writing past end of user-supplied buffer in keyring_read() + - KEYS: prevent creating a different user's keyrings + - [x86] libnvdimm, namespace: fix btt claim class crash + - [powerpc*] eeh: Create PHB PEs after EEH is initialized + - [powerpc*] pseries: Fix parent_dn reference leak in add_dt_node() + - [powerpc*] tm: Flush TM only if CPU has TM feature + - [mips*] Fix perf event init + - [s390x] perf: fix bug when creating per-thread event + - [s390x] mm: make pmdp_invalidate() do invalidation only + - [s390x] mm: fix write access check in gup_huge_pmd() + - PM: core: Fix device_pm_check_callbacks() + - Revert "IB/ipoib: Update broadcast object if PKey value was changed in + index 0" + - cifs: Fix SMB3.1.1 guest authentication to Samba + - cifs: SMB3: Fix endian warning + - cifs: SMB3: Warn user if trying to sign connection that authenticated as + guest + - cifs: SMB: Validate negotiate (to protect against downgrade) even if + signing off + - cifs: SMB3: handle new statx fields + - cifs: SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags + - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets + - libceph: don't allow bidirectional swap of pg-upmap-items + - brd: fix overflow in __brd_direct_access + - gfs2: Fix debugfs glocks dump + - bsg-lib: don't free job in bsg_prepare_job + - iw_cxgb4: drop listen destroy replies if no ep found + - iw_cxgb4: remove the stid on listen create failure + - iw_cxgb4: put ep reference in pass_accept_req() + - rcu: Allow for page faults in NMI handlers + - mmc: sdhci-pci: Fix voltage switch for some Intel host controllers + - extable: Consolidate *kernel_text_address() functions + - extable: Enable RCU if it is not watching in kernel_text_address() + - seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() + - [arm64] Make sure SPsel is always set + - [arm64] mm: Use READ_ONCE when dereferencing pointer to pte table + - [arm64] fault: Route pte translation faults via do_translation_fault + - [x86] KVM: VMX: extract __pi_post_block + - [x86] KVM: VMX: avoid double list add with VT-d posted interrupts + - [x86] KVM: VMX: simplify and fix vmx_vcpu_pi_load + - [x86] KVM: nVMX: fix HOST_CR3/HOST_CR4 cache + - [x86] kvm: Handle async PF in RCU read-side critical sections + - xfs: validate bdev support for DAX inode flag + - sched/sysctl: Check user input value of sysctl_sched_time_avg + - irq/generic-chip: Don't replace domain's name + - mtd: Fix partition alignment check on multi-erasesize devices + - [armhf] etnaviv: fix submit error path + - [armhf] etnaviv: fix gem object list corruption + - futex: Fix pi_state->owner serialization + - md: fix a race condition for flush request handling + - md: separate request handling + - PCI: Fix race condition with driver_override + - btrfs: fix NULL pointer dereference from free_reloc_roots() + - btrfs: clear ordered flag on cleaning up ordered extents + - btrfs: finish ordered extent cleaning if no progress is found + - btrfs: propagate error to btrfs_cmp_data_prepare caller + - btrfs: prevent to set invalid default subvolid + - [x86] platform: fujitsu-laptop: Don't oops when FUJ02E3 is not presnt + - PM / OPP: Call notifier without holding opp_table->lock + - [x86] mm: Fix fault error path using unsafe vma pointer + - [x86] fpu: Don't let userspace set bogus xcomp_bv (CVE-2017-15537) + - [x86] KVM: VMX: do not change SN bit in vmx_update_pi_irte() + - [x86] KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt + - [x86] KVM: VMX: use cmpxchg64 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6 + - [armhf,arm64] usb: dwc3: ep0: fix DMA starvation by assigning req->trb on + ep0 + - mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+ + - net: bonding: Fix transmit load balancing in balance-alb mode if + specified by sysfs + - openvswitch: Fix an error handling path in + 'ovs_nla_init_match_and_action()' + - net: bonding: fix tlb_dynamic_lb default value + - net_sched: gen_estimator: fix scaling error in bytes/packets samples + - net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker + - sctp: potential read out of bounds in sctp_ulpevent_type_enabled() + - tcp: update skb->skb_mstamp more carefully + - bpf/verifier: reject BPF_ALU64|BPF_END + - tcp: fix data delivery rate + - udpv6: Fix the checksum computation when HW checksum does not apply + - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header + - net: phy: Fix mask value write on gmii2rgmii converter speed register + - ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline + - net/sched: cls_matchall: fix crash when used with classful qdisc + - 8139too: revisit napi_complete_done() usage + - bpf: do not disable/enable BH in bpf_map_free_id() + - tcp: fastopen: fix on syn-data transmit failure + - [powerpc*] net: emac: Fix napi poll list corruption + - net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure + - packet: hold bind lock when rebinding to fanout hook (CVE-2017-15649) + - net: change skb->mac_header when Generic XDP calls adjust_head + - net_sched: always reset qdisc backlog in qdisc_reset() + - [armhf,arm64] net: stmmac: Cocci spatch "of_table" + - [arm64] net: qcom/emac: specify the correct size when mapping a DMA buffer + - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit + - l2tp: fix race condition in l2tp_tunnel_delete + - tun: bail out from tun_get_user() if the skb is empty + - [armhf,arm64] net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple + vlans + - [armhf,arm64] net: dsa: Fix network device registration order + - packet: in packet_do_bind, test fanout with bind_lock held (CVE-2017-15649) + - packet: only test po->has_vnet_hdr once in packet_snd + - [armhf,arm64] net: dsa: mv88e6xxx: lock mutex when freeing IRQs + - net: Set sk_prot_creator when cloning sockets to the right proto + - net/mlx5e: IPoIB, Fix access to invalid memory address + - netlink: do not proceed if dump's start() errs + - ip6_gre: ip6gre_tap device should keep dst + - ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path + - IPv4: early demux can return an error code + - tipc: use only positive error codes in messages + - l2tp: fix l2tp_eth module loading + - socket, bpf: fix possible use after free + - net: rtnetlink: fix info leak in RTM_GETSTATS call + - [amd64] bpf: fix bpf_tail_call() x64 JIT + - usb: gadget: core: fix ->udc_set_speed() logic + - USB: gadgetfs: Fix crash caused by inadequate synchronization + - USB: gadgetfs: fix copy_to_user while holding spinlock + - usb: gadget: udc: atmel: set vbus irqflags explicitly + - usb-storage: unusual_devs entry to fix write-access regression for + Seagate external drives + - usb-storage: fix bogus hardware error messages for ATA pass-thru devices + - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor + - usb: pci-quirks.c: Corrected timeout values used in handshake + - USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse + - USB: dummy-hcd: fix connection failures (wrong speed) + - USB: dummy-hcd: fix infinite-loop resubmission bug + - USB: dummy-hcd: Fix erroneous synchronization change + - USB: devio: Prevent integer overflow in proc_do_submiturb() + - USB: g_mass_storage: Fix deadlock when driver is unbound + - USB: uas: fix bug in handling of alternate settings + - USB: core: harden cdc_parse_cdc_header + - usb: Increase quirk delay for USB devices + - USB: fix out-of-bounds in usb_set_configuration + - usb: xhci: Free the right ring in xhci_add_endpoint() + - xhci: fix finding correct bus_state structure for USB 3.1 hosts + - xhci: fix wrong endpoint ESIT value shown in tracing + - usb: host: xhci-plat: allow sysdev to inherit from ACPI + - xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround + - xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor + - [x86] Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts" + - [armhf] iio: adc: twl4030: Fix an error handling path in + 'twl4030_madc_probe()' + - [armhf] iio: adc: twl4030: Disable the vusb3v1 rugulator in the error + handling path of 'twl4030_madc_probe()' + - iio: core: Return error for failed read_reg + - uwb: properly check kthread_run return value + - uwb: ensure that endpoint is interrupt + - ksm: fix unlocked iteration over vmas in cmp_and_merge_page() + - mm, hugetlb, soft_offline: save compound page order before page migration + - mm, oom_reaper: skip mm structs with mmu notifiers + - mm: fix RODATA_TEST failure "rodata_test: test data was not read only" + - mm: avoid marking swap cached page as lazyfree + - mm: fix data corruption caused by lazyfree page + - userfaultfd: non-cooperative: fix fork use after free + - ALSA: compress: Remove unused variable + - Revert "ALSA: echoaudio: purge contradictions between dimension matrix + members and total number of members" + - ALSA: usx2y: Suppress kernel warning at page allocation failures + - [powerpc*] powernv: Increase memory block size to 1GB on radix + - [powerpc*] Fix action argument for cpufeatures-based TLB flush + - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts + - [x86] intel_th: pci: Add Lewisburg PCH support + - driver core: platform: Don't read past the end of "driver_override" buffer + - cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() + returns + - [x86] Drivers: hv: fcopy: restore correct transfer length + - [x86] vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister() + - ftrace: Fix kmemleak in unregister_ftrace_graph + - ovl: fix error value printed in ovl_lookup_index() + - ovl: fix dput() of ERR_PTR in ovl_cleanup_index() + - ovl: fix dentry leak in ovl_indexdir_cleanup() + - ovl: fix missing unlock_rename() in ovl_do_copy_up() + - ovl: fix regression caused by exclusive upper/work dir protection + - [arm64] dt marvell: Fix AP806 system controller size + - [arm64] Ensure the instruction emulation is ready for userspace + - HID: rmi: Make sure the HID device is opened on resume + - HID: i2c-hid: allocate hid buffers for real worst case + - HID: wacom: leds: Don't try to control the EKR's read-only LEDs + - HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth + - HID: wacom: Correct coordinate system of touchring and pen twist + - HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox + - HID: wacom: generic: Clear ABS_MISC when tool leaves proximity + - HID: wacom: Always increment hdev refcount within wacom_get_hdev_data + - HID: wacom: bits shifted too much for 9th and 10th buttons + - btrfs: avoid overflow when sector_t is 32 bit + - Btrfs: fix overlap of fs_info::flags values + - dm crypt: reject sector_size feature if device length is not aligned to it + - dm ioctl: fix alignment of event number in the device list + - dm crypt: fix memory leak in crypt_ctr_cipher_old() + - [powerpc*] KVM: Book3S: Fix server always zero from kvmppc_xive_get_xive() + - [x86] kvm: Avoid async PF preempting the kernel incorrectly + - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD + - scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP + - scsi: sd: Do not override max_sectors_kb sysfs setting + - brcmfmac: setup passive scan if requested by user-space + - [x86] drm/i915: always update ELD connector type after get modes + - [x86] drm/i915/bios: ignore HDMI on port A + - bsg-lib: fix use-after-free under memory-pressure + - nvme-pci: Use PCI bus address for data/queues in CMB + - mmc: core: add driver strength selection when selecting hs400es + - nl80211: Define policy for packet pattern attributes + - [armhf] clk: samsung: exynos4: Enable VPLL and EPLL clocks for + suspend/resume cycle + - udp: perform source validation for mcast early demux + - udp: fix bcast packet reception + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.7 + - watchdog: Revert "iTCO_wdt: all versions count down twice" + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8 + - USB: dummy-hcd: Fix deadlock caused by disconnect detection + - [mips*] math-emu: Remove pr_err() calls from fpu_emu() + - [mips*] bpf: Fix uninitialised target compiler error + - [x86] mei: always use domain runtime pm callbacks. + - [armhf] dmaengine: edma: Align the memcpy acnt array size with the + transfer + - [armhf] dmaengine: ti-dma-crossbar: Fix possible race condition with + dma_inuse + - NFS: Fix uninitialized rpc_wait_queue + - nfs/filelayout: fix oops when freeing filelayout segment + - HID: usbhid: fix out-of-bounds bug + - crypto: skcipher - Fix crash on zero-length input + - crypto: shash - Fix zero-length shash ahash digest crash + - [x86] KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit + - [x86] pinctrl/amd: Fix build dependency on pinmux code + - [x86] iommu/amd: Finish TLB flush in amd_iommu_unmap() + - device property: Track owner device of device property + - Revert "vmalloc: back off when the current task is killed" + - fs/mpage.c: fix mpage_writepage() for pages with buffers + - ALSA: usb-audio: Kill stray URB at exiting + - ALSA: seq: Fix copy_from_user() call inside lock + - ALSA: caiaq: Fix stray URB at probe error path + - ALSA: line6: Fix NULL dereference at podhd_disconnect() + - ALSA: line6: Fix missing initialization before error path + - ALSA: line6: Fix leftover URB at error-path during probe + - drm/atomic: Unref duplicated drm_atomic_state in + drm_atomic_helper_resume() + - [x86] drm/i915/edp: Get the Panel Power Off timestamp after panel is off + - [x86] drm/i915: Read timings from the correct transcoder in + intel_crtc_mode_get() + - [x86] drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP + AUX channel + - [x86] drm/i915: Use crtc_state_is_legacy_gamma in intel_color_check + - usb: gadget: configfs: Fix memory leak of interface directory data + - usb: gadget: composite: Fix use-after-free in + usb_composite_overwrite_options + - [arm64] PCI: aardvark: Move to struct pci_host_bridge IRQ mapping + functions + - [armhf,armhf] Revert "PCI: tegra: Do not allocate MSI target memory" + - direct-io: Prevent NULL pointer access in submit_page_section + - fix unbalanced page refcounting in bio_map_user_iov (CVE-2017-12190) + - more bio_map_user_iov() leak fixes + - bio_copy_user_iov(): don't ignore ->iov_offset + - perf script: Add missing separator for "-F ip,brstack" (and brstackoff) + - genirq/cpuhotplug: Enforce affinity setting on startup of managed irqs + - genirq/cpuhotplug: Add sanity check for effective affinity mask + - USB: serial: cp210x: fix partnum regression + - USB: serial: console: fix use-after-free on disconnect + - USB: serial: console: fix use-after-free after failed setup + - RAS/CEC: Use the right length for "cec_disable" + - [x86] alternatives: Fix alt_max_short macro to really be a max() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.9 + - [x86] apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on CPUs + without the feature + - [x86] apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on + hypervisors + - [armhf,arm64] perf pmu: Unbreak perf record for arm/arm64 with events + with explicit PMU + - mm: page_vma_mapped: ensure pmd is loaded with READ_ONCE outside of lock + - HID: hid-elecom: extend to fix descriptor for HUGE trackball + - [x86] Drivers: hv: vmbus: Fix rescind handling issues + - [x86] Drivers: hv: vmbus: Fix bugs in rescind handling + - [x86] vmbus: simplify hv_ringbuffer_read + - [x86] vmbus: refactor hv_signal_on_read + - [x86] vmbus: eliminate duplicate cached index + - [x86] vmbus: more host signalling avoidance + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.10 + - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() + - usb: hub: Allow reset retry for USB2 devices on connect bounce + - ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital + - can: gs_usb: fix busy loop if no more TX context is available + - scsi: qla2xxx: Fix uninitialized work element + - nbd: don't set the device size until we're connected + - [s390x] cputime: fix guest/irq/softirq times after CPU hotplug + - [hppa/parisc] Fix double-word compare and exchange in LWS code on 32-bit + kernels + - [hppa] Fix detection of nonsynchronous cr16 cycle counters + - iio: dummy: events: Add missing break + - [armhf] usb: musb: sunxi: Explicitly release USB PHY on exit + - [armhf] USB: musb: fix session-bit runtime-PM quirk + - [armhf] USB: musb: fix late external abort on suspend + - [armhf] usb: musb: musb_cppi41: Fix the address of teardown and autoreq + registers + - [armhf] usb: musb: musb_cppi41: Fix cppi41_set_dma_mode() for DA8xx + - [armhf] usb: musb: musb_cppi41: Configure the number of channels for DA8xx + - [armhf] usb: musb: Check for host-mode using is_host_active() on reset + interrupt + - xhci: Identify USB 3.1 capable hosts by their port protocol capability + - xhci: Cleanup current_cmd in xhci_cleanup_command_queue() + - usb: xhci: Reset halted endpoint if trb is noop + - usb: xhci: Handle error condition in xhci_stop_device() + - can: esd_usb2: Fix can_dlc value for received RTR, frames + - can: af_can: can_pernet_init(): add missing error handling for kzalloc + returning NULL + - KEYS: encrypted: fix dereference of NULL user_key_payload + - mmc: sdhci-pci: Fix default d3_retune for Intel host controllers + - [x86] drm/i915: Use bdw_ddi_translations_fdi for Broadwell + - drm/nouveau/kms/nv50: fix oops during DP IRQ handling on non-MST boards + - drm/nouveau/bsp/g92: disable by default + - drm/nouveau/mmu: flush tlbs before deleting page tables + - media: cec: Respond to unregistered initiators, when applicable + - media: dvb: i2c transfers over usb cannot be done from stack + - ALSA: seq: Enable 'use' locking in all configurations + - ALSA: hda: Remove superfluous '-' added by printk conversion + - ALSA: hda: Abort capability probe at invalid register read + - [x86] i2c: ismt: Separate I2C block read from SMBus block read + - [x86] i2c: piix4: Fix SMBus port selection for AMD Family 17h chips + - Revert "tools/power turbostat: stop migrating, unless '-m'" + - brcmfmac: Add check for short event packets + - brcmsmac: make some local variables 'static const' to reduce stack size + - [armhf] dts: sun6i: Fix endpoint IDs in second display pipeline + - [i386] clockevents/drivers/cs5535: Improve resilience to spurious + interrupts + - rtlwifi: rtl8821ae: Fix connection lost problem + - [x86] microcode/intel: Disable late loading on model 79 + - lib/digsig: fix dereference of NULL user_key_payload + - fscrypt: fix dereference of NULL user_key_payload + - ecryptfs: fix dereference of NULL user_key_payload + - KEYS: Fix race between updating and finding a negative key + (CVE-2017-15951) + - FS-Cache: fix dereference of NULL user_key_payload + - KEYS: don't let add_key() update an uninstantiated key (CVE-2017-15299) + - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set. + - [arm64] dts: rockchip: correct vqmmc voltage for rk3399 platforms + - ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() + removal + - iomap_dio_rw: Allocate AIO completion queue before submitting dio + - xfs: don't unconditionally clear the reflink flag on zero-block files + - xfs: evict CoW fork extents when performing finsert/fcollapse + - fs/xfs: Use %pS printk format for direct addresses + - xfs: report zeroed or not correctly in xfs_zero_range() + - xfs: update i_size after unwritten conversion in dio completion + - xfs: perag initialization should only touch m_ag_max_usable for AG 0 + - xfs: Capture state of the right inode in xfs_iflush_done + - xfs: always swap the cow forks when swapping extents + - xfs: handle racy AIO in xfs_reflink_end_cow + - xfs: Don't log uninitialised fields in inode structures + - xfs: move more RT specific code under CONFIG_XFS_RT + - xfs: don't change inode mode if ACL update fails + - xfs: reinit btree pointer on attr tree inactivation walk + - xfs: handle error if xfs_btree_get_bufs fails + - xfs: cancel dirty pages on invalidation + - xfs: trim writepage mapping to within eof + - xfs: move two more RT specific functions into CONFIG_XFS_RT + + [ Ben Hutchings ] + * [arm64] brcmfmac: Enable BRCMFMAC_SDIO (Closes: #877911) + * Update build dependencies on libbabeltrace[,-ctf}-dev + * linux-kbuild: Include scripts/ld-version.sh, needed for powerpc 64-bit + modules + * dax: Avoid most ABI changes in 4.13.5 + * SCSI: Avoid ABI change in 4.13.6 + * [x86] kvm: Ignore ABI change in 4.13.6 + * inet, l2tp, snd-seq, usb/gadget: Ignore ABI changes + * [armel,armhf] mbus: Ignore ABI change in 4.13.10 + * Revert "bpf: one perf event close won't free bpf program attached ..." + to avoid an ABI change + * [armel] security: Enable SECURITY_APPARMOR and disable SECURITY_SELINUX + * security: Enable DEFAULT_SECURITY_APPARMOR + * mac80211: Avoid ABI change in 4.13.5 + * [x86] rmi4: Enable RMI4_SMB as module (Closes: #875621) + * KEYS: Limit ABI change in 4.13.10 + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 30 Oct 2017 15:32:11 +0000 + +linux (4.13.4-2) unstable; urgency=medium + + [ Ben Hutchings ] + * [armhf,arm64] thermal: Enable BCM2835_THERMAL as module (Closes: #877699) + + [ Salvatore Bonaccorso ] + * brcmfmac: add length check in brcmf_cfg80211_escan_handler() + (CVE-2017-0786) + * [powerpc*] Use emergency stack for kernel TM Bad Thing program + (CVE-2017-1000255) + * [powerpc*] Fix illegal TM state in signal handler + * mac80211: fix deadlock in driver-managed RX BA session start. + Thanks to Eric Côté (Closes: #878092) + * KEYS: prevent KEYCTL_READ on negative key (CVE-2017-12192) + * waitid(): Add missing access_ok() checks (CVE-2017-5123) + * ALSA: seq: Fix use-after-free at creating a port (CVE-2017-15265) + * [x86] KVM: nVMX: update last_nonleaf_level when initializing nested EPT + (CVE-2017-12188) + * [x86] KVM: MMU: always terminate page walks at level 1 (CVE-2017-12188) + + -- Salvatore Bonaccorso <carnil@debian.org> Sun, 15 Oct 2017 08:57:36 +0200 + +linux (4.13.4-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.3 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.4 + + [ Ben Hutchings ] + * [armhf,arm64] mmc: Enable MMC_BCM2835 (Closes: #845422) + * [arm64ilp32] Build a linux-libc-dev package (Closes: #874536) + * [mips*r6*] Re-enable these architectures, now that dak knows about them + (Closes: #825024) + * [x86] Enable INTEL_CHT_INT33FE as module (Closes: #873164) + * [armhf] Enable AXP20X_ADC, CHARGER_AXP20X, BATTERY_AXP20X, GPIO_AXP209, + AXP288_CHARGER, AXP288_FUEL_GAUGE, EXTCON_AXP288, AXP288_ADC as modules + (Closes: #873038) + * thp: Enable TRANSPARENT_HUGEPAGE_ALWAYS instead of + TRANSPARENT_HUGEPAGE_MADVISE + * ALSA: Enable SND_OSSEMUL, a new dependency of SND_{MIXER,PCM}_OSS + * [armel] rtc: Disable RTC_NVMEM + * [x86] hyperv-daemons: Use pid file name in init script status operation + * Update policy version to 4.1.1: + - linux-doc: Build an empty package when the nodoc profile is used + - [x86] hyperv-daemons: Create pid files under /run, not /var/run + - Change all binary packages with priority: extra to priority: optional + - Install copyright file (and some other documentation) when the nodoc + profile is used + * debian/control: Move many build dependencies to Build-Depends-Arch field + * debian/control: Remove obsolete workarounds and alternate build deps + * usbip: Stop building broken libusbip-dev package + * Rename lintian-overrides template files to be consistent + * linux-image-dbg: Override lintian errors binary-from-other-architecture and + shlib-without-PT_GNU_STACK-section for vDSOs + * [armhf] dts: exynos: Add dwc3 SUSPHY quirk (Closes: #843448) + * liblockdep: Make missing function declarations fatal errors, to catch use + of missing kernel APIs + * liblockdep: Define pr_cont() + * Set ABI to 1 + + [ Uwe Kleine-König ] + * [arm64] really enable NET_DSA_MV88E6XXX for Espressobin + + [ John Paul Adrian Glaubitz ] + * [m68k] Enable CONFIG_PATA_FALCON as module. + + [ Salvatore Bonaccorso ] + * fix infoleak in waitid(2) (CVE-2017-14954) + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 01 Oct 2017 15:52:09 +0100 + +linux (4.13.2-1~exp1) experimental; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.2 + + [ Uwe Kleine-König ] + * USB/misc: reenable UCSI which got lost due to upstream changes + * update kernel config templates for upstream changes + * [amd64] enable CONFIG_SPI_PXA2XX for Apple MacBook Pro (Closes: #872004) + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 19 Sep 2017 18:35:42 +0100 + +linux (4.13.1-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.13 + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.1 + + [ Roger Shimizu ] + * debian/bin/buildcheck.py: + Add check for uncompressed Image size, which is necessary for + armel/marvell flavour currently. + + [ Ben Hutchings ] + * [mips*/octeon] mmc: Enable MMC_CAVIUM_OCTEON as module (Closes: #800594) + + [ Uwe Kleine-König ] + * [arm64] enable NET_DSA_MV88E6XXX for Espressobin. + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 11 Sep 2017 05:40:04 +0100 + +linux (4.13~rc7-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [sh4] Do not use hyphen in exported variable names (fixes FTBFS) + * aufs: Update support patchset to aufs4.x-rcN-20170828 + + [ Roger Shimizu ] + * [armel] Disable CONFIG_STRICT_KERNEL_RWX, which will save about 3MB + on linux Image (before compression). (Closes: #870185) + * [armel] Change MTD_OF_PARTS, MTD_BLOCK, and MTD_PHYSMAP_OF from + built-in to modules. + Also change all RTC related except RTC_DRV_MV, which includes + RTC_DRV_DS1307, RTC_DRV_RS5C372, RTC_DRV_PCF8563, RTC_DRV_M41T80, + and RTC_DRV_S35390A, to modules. Because most marvell boards use + RTC_DRV_MV. (above two fix FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 30 Aug 2017 20:39:57 +0100 + +linux (4.13~rc5-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * cpupower: Add/update definition of MSRHEADER macro for turbostat and + x86_energy_perf_policy + * Remove support for upstream DocBook-based documentation, including the + linux-manual package + * liblockdep: Re-enable liblockdep packages following upstream fixes + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 14 Aug 2017 23:20:50 +0100 + +linux (4.12.13-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.13 + - mtd: nand: make Samsung SLC NAND usable again + - mtd: nand: hynix: add support for 20nm NAND chips + - [armhf] mtd: nand: mxc: Fix mxc_v1 ooblayout + - nvme-fabrics: generate spec-compliant UUID NQNs + - btrfs: resume qgroup rescan on rw remount + - rtlwifi: btcoexist: Fix breakage of ant_sel for rtl8723be + - radix-tree: must check __radix_tree_preload() return value + - mm: kvfree the swap cluster info if the swap file is unsatisfactory + - mm/swapfile.c: fix swapon frontswap_map memory leak on error + - mm/memory.c: fix mem_cgroup_oom_disable() call missing + - [i386] ALSA: msnd: Optimize / harden DSP and MIDI loops + - [x86] KVM: SVM: Limit PFERR_NESTED_GUEST_PAGE error_code check to L1 guest + - rt2800: fix TX_PIN_CFG setting for non MT7620 chips + - Bluetooth: Properly check L2CAP config option output buffer length + (CVE-2017-1000251) (Closes: #875881) + - [arm64] dts: marvell: armada-37xx: Fix GIC maintenance interrupt + - [armel,armhf] 8692/1: mm: abort uaccess retries upon fatal signal + - NFS: Fix 2 use after free issues in the I/O code + - NFS: Sync the correct byte range during synchronous writes + - NFSv4: Fix up mirror allocation + - xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present + (CVE-2017-14340) + + [ Salvatore Bonaccorso ] + * sctp: Avoid out-of-bounds reads from address storage (CVE-2017-7558) + * scsi: qla2xxx: Fix an integer overflow in sysfs code (CVE-2017-14051) + * Add ABI reference for 4.12.0-2 + + [ Ben Hutchings ] + * nl80211: check for the required netlink attributes presence (CVE-2017-12153) + * [x86] kvm: nVMX: Don't allow L2 to access the hardware CR8 (CVE-2017-12154) + * video: fbdev: aty: do not leak uninitialized padding in clk to userspace + (CVE-2017-14156) + * scsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly + (CVE-2017-14489) + * packet: Don't write vnet header beyond end of buffer (CVE-2017-14497) + * [x86] KVM: VMX: Do not BUG() on out-of-bounds guest IRQ (CVE-2017-1000252) + * nfs: Ignore ABI change + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 19 Sep 2017 01:59:17 +0100 + +linux (4.12.12-2) unstable; urgency=medium + + * debian/source/lintian-overrides: Override license-problem-gfdl-invariants + error triggered by a ReSTified copy of the GFDL + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 11 Sep 2017 04:35:28 +0100 + +linux (4.12.12-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.7 + - ppp: Fix false xmit recursion detect with two ppp devices + - ppp: fix xmit recursion detection on ppp channels + - tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states + - net: fix keepalive code vs TCP_FASTOPEN_CONNECT + - ipv6: set rt6i_protocol properly in the route when it is installed + - [s390x] bpf: fix jit branch offset related to ldimm64 + - net/mlx4_en: don't set CHECKSUM_COMPLETE on SCTP packets + - net: sched: set xt_tgchk_param par.net properly in ipt_init_target + - net: sched: set xt_tgchk_param par.nft_compat as 0 in ipt_init_target + - tcp: fastopen: tcp_connect() must refresh the route + - qmi_wwan: fix NULL deref on disconnect + - net: avoid skb_warn_bad_offload false positives on UFO + - igmp: Fix regression caused by igmp sysctl namespace code. + - scsi: sg: only check for dxfer_len greater than 256M + - btrfs: Remove false alert when fiemap range is smaller than on-disk + extent + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.8 + - mm: ratelimit PFNs busy info message + - mm: fix list corruptions on shmem shrinklist + - futex: Remove unnecessary warning from get_futex_key + - xfs: Fix leak of discard bio + - [armhf] pinctrl: armada-37xx: Fix number of pin in south bridge + - mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES + - mtd: nand: Declare tBERS, tR and tPROG as u64 to avoid integer overflow + - iscsi-target: fix memory leak in iscsit_setup_text_cmd() + - iscsi-target: Fix iscsi_np reset hung task during parallel delete + - usb-storage: fix deadlock involving host lock and scsi_done + - target: Fix node_acl demo-mode + uncached dynamic shutdown regression + - fuse: initialize the flock flag in fuse_file on allocation + - i2c: designware: Some broken DSTDs use 1MiHz instead of 1MHz + - nand: fix wrong default oob layout for small pages using soft ecc + - mmc: mmc: correct the logic for setting HS400ES signal voltage + - nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays + - [armhf] drm/etnaviv: Fix off-by-one error in reloc checking + - [x86] drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut + - [armhf] usb: musb: fix tx fifo flush handling again + - USB: hcd: Mark secondary HCD as dead if the primary one died + - [armhf] iio: accel: st_accel: add SPI-3wire support + - [x86] iio: accel: bmc150: Always restore device to normal mode after + suspend-resume + - iio: light: tsl2563: use correct event code + - staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING + - uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 + - firmware: fix batched requests - wake all waiters + - firmware: fix batched requests - send wake up on failure on direct lookups + - firmware: avoid invalid fallback aborts by using killable wait + - block: Make blk_mq_delay_kick_requeue_list() rerun the queue at a quiet + time + - USB: Check for dropped connection before switching to full speed + - usb: core: unlink urbs from the tail of the endpoint's urb_list + - usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter + - usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume + - PCI: Protect pci_error_handlers->reset_notify() usage with device_lock() + - xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA issue + - pnfs/blocklayout: require 64-bit sector_t + - [x86] pinctrl: cherryview: Add Setzer models to the Chromebook DMI quirk + - [armhf] pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver + - [x86] pinctrl: intel: merrifield: Correct UART pin lists + - [armhf] pinctrl: samsung: Remove bogus irq_[un]mask from resource + management + - [arm64] pinctrl: meson-gxbb: Add missing GPIODV_18 pin entry + - [arm64] pinctrl: meson-gxl: Add missing GPIODV_18 pin entry + - [mips*] Revert "MIPS: Don't unnecessarily include kmalloc.h into + <asm/cache.h>." + - [mips*/octeon] Fix broken EDAC driver. + - [ppc64el] Fix /proc/cpuinfo revision for POWER9 DD2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.9 + - audit: Fix use after free in audit_remove_watch_rule() + - [hppa] pci memory bar assignment fails with 64bit kernels on dino/cujo + - [x86] crypto: sha1 - Fix reads beyond the number of blocks passed + - [x86] drm/i915: Perform an invalidate prior to executing golden + renderstate + - drm/amdgpu: save list length when fence is signaled + - md: fix test in md_write_start() + - md: always clear ->safemode when md_check_recovery gets the mddev lock. + - MD: not clear ->safemode for external metadata array + - ALSA: seq: 2nd attempt at fixing race creating a queue + - ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset + - ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices + - ALSA: usb-audio: add DSD support for new Amanero PID + - mm: discard memblock data later + - slub: fix per memcg cache leak on css offline + - mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS + - mm/cma_debug.c: fix stack corruption due to sprintf usage + - mm/mempolicy: fix use after free when calling get_mempolicy + - mm/vmalloc.c: don't unconditonally use __GFP_HIGHMEM + - [amd64,arm64] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes + - xen: fix bio vec merging (CVE-2017-12134) (Closes: #866511) + - [armhf] ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset + - blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL + - [powerpc*] Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC + - xen-blkfront: use a right index when checking requests + - [x86] perf: Fix RDPMC vs. mm_struct tracking + - [amd64] asm: Clear AC on NMI entries + - [x86] Fix norandmaps/ADDR_NO_RANDOMIZE + - [x86] elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks + - genirq: Restore trigger settings in irq_modify_status() + - genirq/ipi: Fixup checks against nr_cpu_ids + - kernel/watchdog: Prevent false positives with turbo modes + - Sanitize 'move_pages()' permission checks (CVE-2017-14140) + - pids: make task_tgid_nr_ns() safe + - debug: Fix WARN_ON_ONCE() for modules + - usb: optimize acpi companion search for usb port devices + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10 + - [sparc64] remove unnecessary log message + - bonding: require speed/duplex only for 802.3ad, alb and tlb + - bonding: ratelimit failed speed/duplex update warning + - af_key: do not use GFP_KERNEL in atomic contexts + - dccp: purge write queue in dccp_destroy_sock() + - dccp: defer ccid_hc_tx_delete() at dismantle time + - ipv4: fix NULL dereference in free_fib_info_rcu() + - net_sched/sfq: update hierarchical backlog when drop packet + - net_sched: remove warning from qdisc_hash_add + - bpf: fix bpf_trace_printk on 32 bit archs + - net: igmp: Use ingress interface rather than vrf device + - openvswitch: fix skb_panic due to the incorrect actions attrlen + - ptr_ring: use kmalloc_array() + - ipv4: better IP_MAX_MTU enforcement + - nfp: fix infinite loop on umapping cleanup + - tun: handle register_netdevice() failures properly + - sctp: fully initialize the IPv6 address in sctp_v6_to_addr() + - tipc: fix use-after-free + - ipv6: reset fn->rr_ptr when replacing route + - ipv6: repair fib6 tree in failure case + - tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP + - net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled + - irda: do not leak initialized list.dev to userspace + - net: sched: fix NULL pointer dereference when action calls some targets + - net_sched: fix order of queue length updates in qdisc_replace() + - bpf, verifier: add additional patterns to evaluate_reg_imm_alu + - bpf: fix mixed signed/unsigned derived min/max value bounds + - bpf/verifier: fix min/max handling in BPF_SUB + - Input: ALPS - fix two-finger scroll breakage in right side on ALPS + touchpad + - [s390x] KVM: sthyi: fix sthyi inline assembly + - [s390x] KVM: sthyi: fix specification exception detection + - [x86] KVM: simplify handling of PKRU + - [x86] KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state + - [x86] KVM: block guest protection keys unless the host has them enabled + - ALSA: core: Fix unexpected error at replacing user TLV + - ALSA: firewire: fix NULL pointer dereference when releasing + uninitialized data of iso-resource + - ALSA: firewire-motu: destroy stream data surely at failure of card + initialization + - PM/hibernate: touch NMI watchdog when creating snapshot + - mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled + - dax: fix deadlock due to misaligned PMD faults + - i2c: designware: Fix system suspend + - mm/madvise.c: fix freeing of locked page with MADV_FREE + - fork: fix incorrect fput of ->exe_file causing use-after-free + - mm/memblock.c: reversed logic in memblock_discard() + - [arm64] fpsimd: Prevent registers leaking across exec + - drm: Fix framebuffer leak + - drm: Release driver tracking before making the object available again + - [armhf] drm/sun4i: Implement drm_driver lastclose to restore fbdev + console + - drm/atomic: Handle -EDEADLK with out-fences correctly + - drm/atomic: If the atomic check fails, return its value first + - [x86] drm/i915/vbt: ignore extraneous child devices for a port + - [x86] drm/i915/gvt: Fix the kernel null pointer error + - Revert "drm/amdgpu: fix vblank_time when displays are off" + - ACPI: device property: Fix node lookup in + acpi_graph_get_child_prop_value() + - tracing: Call clear_boot_tracer() at lateinit_sync + - tracing: Missing error code in tracer_alloc_buffers() + - tracing: Fix kmemleak in tracing_map_array_free() + - tracing: Fix freeing of filter in create_filter() when set_str is false + - RDMA/uverbs: Initialize cq_context appropriately + - cifs: Fix df output for users with quota limits + - cifs: return ENAMETOOLONG for overlong names in + cifs_open()/cifs_lookup() + - nfsd: Limit end of page list when decoding NFSv4 WRITE + - ring-buffer: Have ring_buffer_alloc_read_page() return error on offline + CPU + - virtio_pci: fix cpu affinity support + - ftrace: Check for null ret_stack on profile function graph entry + function + - perf/core: Fix group {cpu,task} validation + - timers: Fix excessive granularity of new timers after a nohz idle + - [x86] mm: Fix use-after-free of ldt_struct + - net: sunrpc: svcsock: fix NULL-pointer exception + - netfilter: expect: fix crash when putting uninited expectation + - netfilter: nat: fix src map lookup + - netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv + - Bluetooth: hidp: fix possible might sleep error in hidp_session_thread + - Bluetooth: cmtp: fix possible might sleep error in cmtp_session + - Bluetooth: bnep: fix possible might sleep error in bnep_session + - iio: hid-sensor-trigger: Fix the race with user space powering up + sensors + - iommu: Fix wrong freeing of iommu_device->dev + - Clarify (and fix) MAX_LFS_FILESIZE macros + - ACPI: EC: Fix regression related to wrong ECDT initialization order + - [powerpc*] mm: Ensure cpumask update is ordered + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.11 + - [arm64] mm: abort uaccess retries upon fatal signal + - [x86] io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl + - [mips*] irqchip: mips-gic: SYNC after enabling GIC region + - Input: synaptics - fix device info appearing different on reconnect + - Input: xpad - fix PowerA init quirk for some gamepad models + - crypto: chacha20 - fix handling of chunked input + - [x86] i2c: ismt: Don't duplicate the receive length for block reads + - [x86] i2c: ismt: Return EMSGSIZE for block reads with bogus length + - crypto: algif_skcipher - only call put_page on referenced and used pages + - mm, uprobes: fix multiple free of ->uprobes_state.xol_area + - mm, madvise: ensure poisoned pages are removed from per-cpu lists + - ceph: fix readpage from fscache + - cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs + - cpuset: Fix incorrect memory_pressure control file mapping + - CIFS: Fix maximum SMB2 header size + - CIFS: remove endian related sparse warning + - dm mpath: do not lock up a CPU with requeuing activity + - [x86] drm/vmwgfx: Fix F26 Wayland screen update issue + - [arm64, armhf] wl1251: add a missing spin_lock_init() + - [arm64] mmc: sdhci-xenon: add set_power callback + - lib/mpi: kunmap after finishing accessing buffer + - xfrm: policy: check policy direction value + - drm/ttm: Fix accounting error when fail to get pages for pool + - nvme: fix the definition of the doorbell buffer config support bit + - drm/nouveau/i2c/gf119-: add support for address-only transactions + - epoll: fix race between ep_poll_callback(POLLFREE) and + ep_free()/ep_remove() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.12 + - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard + - USB: serial: option: add support for D-Link DWM-157 C1 + - usb: Add device quirk for Logitech HD Pro Webcam C920-C + - usb:xhci:Fix regression when ATI chipsets detected + - [armhf] USB: musb: fix external abort on suspend + - USB: core: Avoid race of async_completed() w/ usbdev_release() + - [x86] staging/rts5208: fix incorrect shift to extract upper nybble + - iio: adc: ti-ads1015: fix incorrect data rate setting update + - iio: adc: ti-ads1015: fix scale information for ADS1115 + - iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set + - iio: adc: ti-ads1015: avoid getting stale result after runtime resume + - iio: adc: ti-ads1015: don't return invalid value from buffer setup + callbacks + - iio: adc: ti-ads1015: add adequate wait time to get correct conversion + - driver core: bus: Fix a potential double free + - HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage + - [x86] intel_th: pci: Add Cannon Lake PCH-H support + - [x86] intel_th: pci: Add Cannon Lake PCH-LP support + - ath10k: fix memory leak in rx ring buffer allocation + - Input: trackpoint - assume 3 buttons when buttons detection fails + - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter + - Bluetooth: Add support of 13d3:3494 RTL8723BE device + - iwlwifi: pci: add new PCI ID for 7265D + - dlm: avoid double-free on error path in dlm_device_{register,unregister} + - mwifiex: correct channel stat buffer overflows + - [s390x] mm: avoid empty zero pages for KVM guests to avoid postcopy + hangs + - [s390x] mm: fix BUG_ON in crst_table_upgrade + - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default + - drm/nouveau: Fix error handling in nv50_disp_atomic_commit + - workqueue: Fix flag collision + - ahci: don't use MSI for devices with the silly Intel NVMe remapping + scheme + - cs5536: add support for IDE controller variant + - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE + - scsi: sg: recheck MMAP_IO request length with lock held + - of/device: Prevent buffer overflow in of_device_modalias() + - rtlwifi: Fix memory leak when firmware request fails + - rtlwifi: Fix fallback firmware loading + + [ Ben Hutchings ] + * [alpha] udeb: Add i2c-modules (fixes FTBFS) + * cpupower: Add/update definition of MSRHEADER macro for turbostat and + x86_energy_perf_policy (Closes: #872414) + * Bump ABI to 2 + + [ Roger Shimizu ] + * [armel] Disable CONFIG_STRICT_KERNEL_RWX, which will save about 3MB + on linux Image (before compression). (Closes: #870185) + + [ Uwe Kleine-König ] + * mtd: nandsim: remove debugfs entries in error path + + -- Ben Hutchings <ben@decadent.org.uk> Sun, 10 Sep 2017 19:42:51 +0100 + +linux (4.12.6-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.3 + - brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() + (CVE-2017-7541) + - [sparc64] Adding asm-prototypes.h for genksyms to generate crc + - [sparc64] sed regex in Makefile.build requires line break between + exported symbols + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.4 + - f2fs: sanity check checkpoint segno and blkoff (CVE-2017-10663) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.5 + - dentry name snapshots (CVE-2017-7533) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.6 + - saa7164: fix double fetch PCIe access condition (CVE-2017-8831) + - ipv6: avoid overflow of offset in ip6_find_1stfragopt (CVE-2017-7542) + + [ Ben Hutchings ] + * media: Enable USB_RAINSHADOW_CEC as module (see #868511) + * Clean up symbol version fixes for symbols exported from asm + (fixes FTBFS on sparc64): + - [alpha] Un-revert "alpha: move exports to actual definitions" + - [alpha] Restore symbol versions for symbols exported from assembly + - [m68k] Un-revert "m68k: move exports to definitions" + - [sparc64] Un-revert "sparc: move exports to definitions" + * [mips*/octeon] Fix broken EDAC driver (fixes FTBFS) + * [armhf] Revert "gpu: host1x: Add IOMMU support" + * [armhf] udeb: Replace imx-ipuv3-crtc with imxdrm in fb-modules + * [i386] perf tools: Fix unwind build (fixes FTBFS) + * debian/control: Fix version in dependencies on arch-independent + linux-headers-*-common* (Closes: #869511) + * xfrm: policy: check policy direction value (CVE-2017-11600) + * rtlwifi: Fix memory leak when firmware request fails + * rtlwifi: Fix fallback firmware loading (Closes: #869084) + * [arm64] video: Enable FRAMEBUFFER_CONSOLE (Closes: #870071) + * integrity: Enable INTEGRITY_SIGNATURE, INTEGRITY_ASYMMETRIC_KEYS + (Closes: #869565) + * [x86] sound: Enable SND_X86; enable HDMI_LPE_AUDIO as module + (Closes: #869372) + * blk-mq: Change MQ_IOSCHED_KYBER from built-in to module + * blk-mq: Enable IOSCHED_BFQ as module (Closes: #869028); enable + BFQ_GROUP_IOSCHED + * bfq: Enable auto-loading when built as a module + * netfilter: Enable NFT_FIB_IPV4, NFT_FIB_IPV6, NFT_FIB_INET as modules + (Closes: #868803) + * [amd64,arm64] mm: Revert x86_64 and arm64 ELF_ET_DYN_BASE base + (Closes: #869090) + + [ Salvatore Bonaccorso ] + * packet: fix tp_reserve race in packet_set_ring (CVE-2017-1000111) + * udp: consistently apply ufo or fragmentation (CVE-2017-1000112) + * Set ABI to 1 + + [ Uwe Kleine-König ] + * [arm64] enable MMC_SDHCI_XENON and MVNETA for Espressobin and enable + respective device in its device tree (Closes: #871049) + + [ Roger Shimizu ] + * [armel] Change NAND related stuff to modules (fixes FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Sat, 12 Aug 2017 23:09:26 +0100 + +linux (4.12.2-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.12 + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.2 + + [ Ben Hutchings ] + * Add script to regenerate lockdown patch series from git + * [rt] Disable until it is updated for 4.12 or later + * scripts/mod: Update modpost wrapper for 4.12 + * Set ABI name to trunk + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 18 Jul 2017 12:19:38 +0100 + +linux (4.11.11-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.7 + - fs: pass on flags in compat_writev + - configfs: Fix race between create_link and configfs_rmdir + - can: gs_usb: fix memory leak in gs_cmd_reset() + - ila_xlat: add missing hash secret initialization + - cpufreq: conservative: Allow down_threshold to take values from 1 to 10 + - vb2: Fix an off by one error in 'vb2_plane_vaddr' + - cec: race fix: don't return -ENONET in cec_receive() + - selinux: fix double free in selinux_parse_opts_str() + - mac80211: don't look at the PM bit of BAR frames + - mac80211/wpa: use constant time memory comparison for MACs + - [x86] drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. + - [x86] drm/i915: Fix GVT-g PVINFO version compatibility check + - [x86] drm/i915: Fix scaling check for 90/270 degree plane rotation + - [x86] drm/i915: Do not sync RCU during shrinking + - mac80211: fix IBSS presp allocation size + - mac80211: strictly check mesh address extension mode + - mac80211: fix dropped counter in multiqueue RX + - mac80211: don't send SMPS action frame in AP mode when not needed + - [arm64, armhf] drm/vc4: Fix OOPSes from trying to cache a partially + constructed BO. + - serial: 8250_lpss: Unconditionally set PCI master for Quark + - [sh4] serial: sh-sci: Fix (AUTO)RTS in sci_init_pins() + - [sh4] serial: sh-sci: Fix late enablement of AUTORTS + - [x86] mm/32: Set the '__vmalloc_start_set' flag in initmem_init() + - [armhf] mfd: axp20x: Add support for dts property "xpowers,master-mode" + - [armhf] dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for + AXP806 PMICs + - [powerpc] mm: Add physical address to Linux page table dump + - staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() + - [armhf] iio: adc: ti_am335x_adc: allocating too much in probe + - [x86] ALSA: hda: Add Geminilake id to SKL_PLUS + - ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts + - USB: hub: fix SS max number of ports + - usb: core: fix potential memory leak in error path during hcd creation + - [x86] USB: usbip: fix nonconforming hub descriptor + - [arm64, armhf] usb: dwc3: gadget: Fix ISO transfer performance + - pvrusb2: reduce stack usage pvr2_eeprom_analyze() + - USB: gadget: dummy_hcd: fix hub-descriptor removable fields + - coda: restore original firmware locations + - usb: xhci: Fix USB 3.1 supported protocol parsing + - usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk + - USB: gadget: fix GPF in gadgetfs + - USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks + - mm/memory-failure.c: use compound_head() flags for huge pages + - swap: cond_resched in swap_cgroup_prepare() + - mm: numa: avoid waiting on freed migrated pages + - userfaultfd: shmem: handle coredumping in handle_userfault() + - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() + - genirq: Release resources in __setup_irq() error path + - alarmtimer: Prevent overflow of relative timers + - alarmtimer: Rate limit periodic intervals + - virtio_balloon: disable VIOMMU support + - [mips*] Fix bnezc/jialc return address calculation + - [mips*] .its targets depend on vmlinux + - [sparc*] crypto: Work around deallocated stack frame reference gcc bug + on sparc. + - [armhf] dts: am335x-sl50: Fix card detect pin for mmc1 + - [armhf] dts: am335x-sl50: Fix cannot claim requested pins for spi0 + - mm: larger stack guard gap, between vmas + - Allow stack to grow up to address space limit + - mm: fix new crash in unmapped_area_topdown() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8 + - [armhf] clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset + - [armhf] clk: sunxi-ng: v3s: Fix usb otg device reset bit + - [armhf] clk: sunxi-ng: sun5i: Fix ahb_bist_clk definition + - xen/blkback: fix disconnect while I/Os in flight + - xen-blkback: don't leak stack data via response ring (XSA-216, + CVE-2017-10911) + - ALSA: firewire-lib: Fix stall of process context at packet error + - ALSA: pcm: Don't treat NULL chmap as a fatal error + - ALSA: hda - Add Coffelake PCI ID + - ALSA: hda - Apply quirks to Broxton-T, too + - fs/exec.c: account for argv/envp pointers (CVE-2017-1000365) + - [powerpc] perf: Fix oops when kthread execs user process + - autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL + - fs/dax.c: fix inefficiency in dax_writeback_mapping_range() + - lib/cmdline.c: fix get_options() overflow while parsing ranges + - [x86] perf/x86/intel: Add 1G DTLB load/store miss support for SKL + - perf probe: Fix probe definition for inlined functions + - [x86] KVM: fix singlestepping over syscall (CVE-2017-7518) + - [s390x] KVM gaccess: fix real-space designation asce handling for gmap + shadows + - [powerpc*] KVM: Book3S HV: Cope with host using large decrementer mode + - [powerpc*] KVM: Book3S HV: Preserve userspace HTM state properly + - [powerpc*] KVM: Book3S HV: Ignore timebase offset on POWER9 DD1 + - [powerpc*] KVM: Book3S HV: Context-switch EBB registers properly + - [powerpc*] KVM: Book3S HV: Restore critical SPRs to host values on guest + exit + - [powerpc*] KVM: Book3S HV: Save/restore host values of debug registers + - CIFS: Improve readdir verbosity + - CIFS: Fix some return values in case of error in 'crypt_message' + - cxgb4: notify uP to route ctrlq compl to rdma rspq + - HID: Add quirk for Dell PIXART OEM mouse + - random: silence compiler warnings and fix race + - signal: Only reschedule timers on signals timers have sent + - [powerpc] kprobes: Pause function_graph tracing during jprobes handling + - ]powerpc*] 64s: Handle data breakpoints in Radix mode + - Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list + - brcmfmac: add parameter to pass error code in firmware callback + - brcmfmac: use firmware callback upon failure to load + - brcmfmac: unbind all devices upon failure in firmware callback + - time: Fix clock->read(clock) race around clocksource changes + - time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting + - [arm64] vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW + - target: Fix kref->refcount underflow in transport_cmd_finish_abort + - iscsi-target: Fix delayed logout processing greater than + SECONDS_FOR_LOGOUT_COMP + - iscsi-target: Reject immediate data underflow larger than SCSI transfer + length + - drm/radeon: add a PX quirk for another K53TK variant + - drm/radeon: add a quirk for Toshiba Satellite L20-183 + - [x86] drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating + - [x86] drm/amdgpu: adjust default display clock + - [x86] drm/amdgpu: add Polaris12 DID + - ACPI / scan: Apply default enumeration to devices with ACPI drivers + - ACPI / scan: Fix enumeration for special SPI and I2C devices + - rxrpc: Fix several cases where a padded len isn't checked in ticket + decode (CVE-2017-7482) + - drm: Fix GETCONNECTOR regression + - usb: gadget: f_fs: avoid out of bounds access on comp_desc + - spi: double time out tolerance + - net: phy: fix marvell phy status reading + - netfilter: xtables: zero padding in data_to_user + - netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside + CONFIG_COMPAT + - brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2() + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.9 + - net: don't call strlen on non-terminated string in dev_set_alias() + - net: Fix inconsistent teardown and release of private netdev state. + - [s390x] net: fix up for "Fix inconsistent teardown and release of + private netdev state" + - mac80211: free netdev on dev_alloc_name() error + - decnet: dn_rtmsg: Improve input length sanitization in + dnrmg_receive_user_skb + - net: Zero ifla_vf_info in rtnl_fill_vfinfo() + - net: ipv6: Release route when device is unregistering + - net: vrf: Make add_fib_rules per network namespace flag + - af_unix: Add sockaddr length checks before accessing sa_family in bind + and connect handlers + - Fix an intermittent pr_emerg warning about lo becoming free. + - sctp: disable BH in sctp_for_each_endpoint + - net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx + - net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse + - net/mlx5: Remove several module events out of ethtool stats + - net/mlx5e: Added BW check for DIM decision mechanism + - net/mlx5e: Fix wrong indications in DIM due to counter wraparound + - net/mlx5: Enable 4K UAR only when page size is bigger than 4K + - proc: snmp6: Use correct type in memset + - igmp: acquire pmc lock for ip_mc_clear_src() + - igmp: add a missing spin_lock_init() + - qmi_wwan: new Telewell and Sierra device IDs + - net: don't global ICMP rate limit packets originating from loopback + - ipv6: fix calling in6_ifa_hold incorrectly for dad work + - sctp: return next obj by passing pos + 1 into sctp_transport_get_idx + - net/mlx5e: Fix min inline value for VF rep SQs + - net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it + - net/mlx5: Wait for FW readiness before initializing command interface + - net/mlx5e: Fix timestamping capabilities reporting + - decnet: always not take dst->__refcnt when inserting dst into hash table + - net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev + - ipv6: Do not leak throw route references + - rtnetlink: add IFLA_GROUP to ifla_policy + - netfilter: synproxy: fix conntrackd interaction + - NFSv4.x/callback: Create the callback service through svc_create_pooled + - xen/blkback: don't use xen_blkif_get() in xen-blkback kthread + - [mips*] head: Reorder instructions missing a delay slot + - [mips*] Avoid accidental raw backtrace + - [mips*] pm-cps: Drop manual cache-line alignment of ready_count + - [mips*] Fix IRQ tracing & lockdep when rescheduling + - ALSA: hda - Fix endless loop of codec configure + - ALSA: hda - set input_path bitmap to zero after moving it to new place + - NFSv4.2: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask + - NFSv4.1: Fix a race in nfs4_proc_layoutget + - Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind" + - ovl: copy-up: don't unlock between lookup and link + - gpiolib: fix filtering out unwanted events + - [x86] intel_rdt: Fix memory leak on mount failure + - [x86] perf/x86/intel/uncore: Fix wrong box pointer check + - [x86] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr + - dm thin: do not queue freed thin mapping for next stage processing + - [x86] mm: Fix boot crash caused by incorrect loop count calculation in + sync_global_pgds() + - [arm64] pinctrl/amd: Use regular interrupt instead of chained + - mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap + mappings + - xen/blkback: don't free be structure too early + - xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish + - xfrm: move xfrm_garbage_collect out of xfrm_policy_flush + - xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY + - xfrm: NULL dereference on allocation failure + - xfrm: Oops on error in pfkey_msg2xfrm_state() + - [arm64] PCI: Fix struct acpi_pci_root_ops allocation failure path + - [arm64] ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation + - [arm*] 8685/1: ensure memblock-limit is pmd-aligned + - [arm*] davinci: PM: Free resources in error handling path in + 'davinci_pm_init' + - [arm*] davinci: PM: Do not free useful resources in normal path in + 'davinci_pm_init' + - Revert "x86/entry: Fix the end of the stack for newly forked tasks" + - [x86] boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug + - [x86] perf: Fix spurious NMI with PEBS Load Latency event + - [x86] mpx: Correctly report do_mpx_bt_fault() failures to user-space + - [x86] mm: Fix flush_tlb_page() on Xen + - ocfs2: o2hb: revert hb threshold to keep compatible + - ocfs2: fix deadlock caused by recursive locking in xattr + - iommu/dma: Don't reserve PCI I/O windows + - [amd64] iommu/amd: Fix incorrect error handling in + amd_iommu_bind_pasid() + - [amd64] iommu/amd: Fix interrupt remapping when disable guest_mode + - mtd: nand: brcmnand: Check flash #WP pin status before nand + erase/program + - mtd: nand: fsmc: fix NAND width handling + - [x86] KVM: fix emulation of RSM and IRET instructions + - [x86] KVM: vPMU: fix undefined shift in intel_pmu_refresh() + - [x86] KVM: zero base3 of unusable segments + - KVM: nVMX: Fix exception injection + - esp4: Fix udpencap for local TCP packets. + - [armhf] hsi: Fix build regression due to netdev destructor fix. + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.10 + - fs: completely ignore unknown open flags + - driver core: platform: fix race condition with driver_override + - RDMA/uverbs: Check port number supplied by user verbs cmds + - ceph: choose readdir frag based on previous readdir reply + - tracing/kprobes: Allow to create probe with a module name starting with a + digit + - drm/virtio: don't leak bo on drm_gem_object_init failure (CVE-2017-10810) + - usb: dwc3: replace %p with %pK + - Add USB quirk for HVR-950q to avoid intermittent device resets + - usb: usbip: set buffer pointers to NULL after free + - usb: Fix typo in the definition of Endpoint[out]Request + - USB: core: fix device node leak + - [armhf] pinctrl: meson: meson8b: fix the NAND DQS pins + - [armhf,arm64] pinctrl: sunxi: Fix SPDIF function name for A83T + - pinctrl: core: Fix warning by removing bogus code + - [x86] xhci: Limit USB2 port wake support for AMD Promontory hosts + - gfs2: Fix glock rhashtable rcu bug + - Add "shutdown" to "struct class". + - tpm: Issue a TPM2_Shutdown for TPM2 devices. + - tpm: fix a kernel memory leak in tpm-sysfs.c + - [x86] uaccess: Optimize copy_user_enhanced_fast_string() for short strings + - xen: avoid deadlock in xenbus driver + - crypto: drbg - Fixes panic in wait_for_completion call + - [x86] rt286: add Thinkpad Helix 2 to force_combo_jack_table + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.11 + - mqueue: fix a use-after-free in sys_mq_notify() (CVE-2017-11176) + - proc: Fix proc_sys_prune_dcache to hold a sb reference + - locking/rwsem-spinlock: Fix EINTR branch in __down_write_common() + - [x86] staging: comedi: fix clean-up of comedi_class in comedi_init() + - crypto: rsa-pkcs1pad - use constant time memory comparison for MACs + - ext4: check return value of kstrtoull correctly in reserved_clusters_store + - [x86] mm/pat: Don't report PAT on CPUs that don't support it + + [ Ben Hutchings ] + * [m68k] udeb: Use only the common module list for nic-shared-modules + (fixes FTBFS) + * [sparc64] Update "Revert "sparc: move exports to definitions"" for the + addition of __multi3 (fixes FTBFS) + * binfmt_elf: use ELF_ET_DYN_BASE only for PIE (CVE-2017-1000370, + CVE-2017-1000371) + * [rt] Update to 4.11.9-rt7: + - smp/hotplug: Move unparking of percpu threads to the control CPU + - cpu_pm: replace raw_notifier to atomic_notifier + * media: Enable MEDIA_CEC_SUPPORT, VIDEO_VIVID_CEC; USB_PULSE8_CEC as module + (Closes: #868511) + * [armhf] udeb: Add sunxi_wdt to kernel-image (Closes: #866130) + * crypto: Enable CRYPTO_USER, CRYPTO_USER_API_RNG as modules (Closes: #868291) + * udeb: Add dm-raid to md-modules (Closes: #868251) + * [arm64] sound: Enable SND_HDA_INTEL as module (Closes: #867611) + * aufs: Update support patchset to aufs4.11.7+-20170703 (Closes: #867257) + * [x86] ideapad-laptop: Add various IdeaPad models to no_hw_rfkill list + (Closes: #866706) + * firmware: dmi: Add DMI_PRODUCT_FAMILY identification string + * [x86] pinctrl: cherryview: Extend the Chromebook DMI quirk to Intel_Strago + systems (Closes: #862723) + * [armhf] Add ARM Mali Midgard device tree bindings and gpu node for rk3288 + (thanks to Guillaume Tucker) (Closes: #865646) + + [ Uwe Kleine-König ] + * [arm64] enable FB_SIMPLE + + [ Vagrant Cascadian ] + * [arm64] Enable support for Rockchip systems (Closes: #860976). + + [ Salvatore Bonaccorso ] + * Bump ABI to 2 + * [rt] Update to 4.11.8-rt5 + + [ Cyril Brulebois ] + * [arm64,armhf] udeb: Ship usb3503 module in usb-modules, needed for + e.g. Arndale development boards, thanks to Wei Liu (Closes: #865645). + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 17 Jul 2017 03:01:21 +0100 + +linux (4.11.6-1) unstable; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.4 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5 + - [x86] drm/vmwgfx: limit the number of mip levels in + vmw_gb_surface_define_ioctl() (CVE-2017-7346) + - [x86] drm/vmwgfx: Make sure backup_handle is always valid (CVE-2017-9605) + - ALSA: timer: Fix race between read and ioctl (CVE-2017-1000380) + - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT + (CVE-2017-1000380) + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.6 + + [ John Paul Adrian Glaubitz ] + * [m68k] udeb: Build affs-modules package + * [m68k] udeb: Build hfs-modules package + * [m68k] udeb: Build nic-modules package + * [m68k] udeb: Build pata-modules package + * [m68k] udeb: Build scsi-core-modules package + * [m68k] udeb: Move non-shared modules from nic-shared-modules to nic-modules + * [m68k] udeb: Add buddha, falconide, gayle, macide, q40ide to pata-modules + * [m68k] udeb: Add atari_scsi, mac_esp, mac_scsi to scsi-modules + + [ Ben Hutchings ] + * [x86] Enable SERIAL_8250_MID as built-in (Closes: #864368) + * Set ABI to 1 + * debian/rules.real: Include rules.defs before using architecture variables + (Closes: #862842) + * [rt] Update to 4.11.5-rt1 and reenable + * fs: Reenable HPFS_FS as module (Closes: #864878) + * USB: serial: option: add two Longcheer device ids (Closes: #864604) + * [armhf] PCI: Enable PCI_HOST_GENERIC (Closes: #864726) + * mm: larger stack guard gap, between vmas (CVE-2017-1000364) + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 20 Jun 2017 00:25:45 +0100 + +linux (4.11.3-1~exp1) experimental; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3 + + [ Ben Hutchings ] + * [armel] udeb: Add af_packet. firmware_class, nls_base to kernel-image + (fixes FTBFS) + * [m68k] Update 'Revert "m68k: move exports to definitions"' for 4.11 + (fixes FTBFS) (Closes: #862393) + + -- Ben Hutchings <ben@decadent.org.uk> Mon, 05 Jun 2017 14:13:41 +0100 + +linux (4.11-1~exp2) experimental; urgency=medium + + * [armel/marvell] Change MQ_IOSCHED_DEADLINE, FW_LOADER, HWMON, + INPUT_MOUSEDEV, THERMAL, SERIAL_8250_PCI, SERIAL_8250_EXAR, NLS, PACKET + from built-in to modules (fixes FTBFS) + * usbip: Fix potential format overflow in userspace tools (fixes FTBFS on + 64-bit architectures with gcc-7) + * [mips*/octeon] Increase RELOCATION_TABLE_SIZE to 0x00110000 (fixes FTBFS) + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 05 May 2017 04:35:12 +0100 + +linux (4.11-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.11 + (thanks to Lukas Wunner for rebasing up to 4.11-rc6) + + [ Ben Hutchings ] + * aufs: Update support patchset to aufs4.x-rcN-20170410 + * [arm64,x86] Replace securelevel patch set with lockdown patch set + * [x86] Make hyperv-modules depends on nic-shared-modules, as hv_utils now + implements PTP clock + * [arm64] Enable ARCH_SUNXI, RTC_DRV_SUN6I as built-in, + MMC_SUNXI and PHY_SUN4I_USB as modules (Closes: #860855) + * [arm64] Enable REGULATOR_GPIO as module (Closes: #860222) + * block: Enable BLK_WBT, BLK_WBT_MQ (Closes: #859570) + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 02 May 2017 20:57:50 +0100 + +linux (4.10.7-1~exp1) experimental; urgency=medium + + * New upstream stable update: + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.1 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.2 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.3 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.5 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.6 + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.7 + + [ Ben Hutchings ] + * netfilter: Enable NF_SOCKET_IPV4, NF_SOCKET_IPV6 as modules + (Closes: #858897) + * [s390x] Set NR_CPUS=256 (Closes: #858731) + * Enable BUG_ON_DATA_CORRUPTION + + -- Ben Hutchings <ben@decadent.org.uk> Fri, 31 Mar 2017 00:41:15 +0100 + +linux (4.10-1~exp1) experimental; urgency=medium + + * New upstream release: https://kernelnewbies.org/Linux_4.10 + + [ Ben Hutchings ] + * aufs: Update support patchset to aufs4.x-rcN-20170206 + * Set ABI to trunk + + [ Roger Shimizu ] + * debian/copyright & debian/README.source: + - Prefer https URL than http for security merit. + + -- Ben Hutchings <ben@decadent.org.uk> Wed, 22 Feb 2017 20:58:19 +0000 + +linux (4.10~rc6-1~exp2) experimental; urgency=medium + + * [s390x] Un-revert upstream change moving exports to assembly sources + (fixes FTBFS) + * [sparc64] topology_64.h: Fix condition for including cpudata.h + (might fix FTBFS) + * [powerpc*] Fix various build failures: + - Revert the initial stack protector support + - Fix missing CRC for _mcount + - [ppc64el] udeb: Exclude ehea from nic-modules + * debian/control: Fix compiler build-dependencies for cross-building + * [armel] Adjust configuration to reduce image size (fixes FTBFS): + - PCI: Disable PCIEAER, PCIEASPM + - net: Disable LWTUNNEL, IPV6_ILA + - trace: Disable UPROBE_EVENT + + -- Ben Hutchings <ben@decadent.org.uk> Thu, 02 Feb 2017 03:44:51 +0000 + +linux (4.10~rc6-1~exp1) experimental; urgency=medium + + * New upstream release candidate + + [ Ben Hutchings ] + * [rt] Disable until it is updated for 4.10 or later + * [amd64] Enable LEGACY_VSYSCALL_NONE instead of LEGACY_VSYSCALL_EMULATE + (Closes: #852620). This breaks (e)glibc versions < 2.14 and dietlibc + versions < 0.33. It can be reverted using the kernel parameter: + vsyscall=emulate + * [arm64] Enable DRM_MESON, MMC_MESON_GX, DWMAC_MESON, MESON_GXL_PHY, + PHY_MESON8B_USB2, MESON_WATCHDOG as modules + * net: Enable SFC_FALCON as module; SFC_FALCON_MTD + * cpupower: Fix compiler options for turbostat on 4.10 + * linux-doc: Update documentation file list for 4.10 + * linux-doc: Fix up symlinks to gzipped docs + * debian/control: Add build-dependency on graphviz for documentation + * linux-doc: Copy source to build directory, to avoid creating files in + source directory + + [ Roger Shimizu ] + * debian/copyright: Add GPL/X11 Dual License + + -- Ben Hutchings <ben@decadent.org.uk> Tue, 31 Jan 2017 15:33:20 +0000 + |