Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The v4.13.6 upstream stable
patch set is now available. It should be included in the Ubuntu
kernel as well.
git://git.kernel.org/
TEST CASE: TBD
The following patches from the v4.13.6 stable release shall be
applied:
imx-media-of: avoid uninitialized variable warning
usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
net: bonding: Fix transmit load balancing in balance-alb mode if specified by
sysfs
openvswitch: Fix an error handling path in 'ovs_nla_init_match_and_action()'
mlxsw: spectrum: Prevent mirred-related crash on removal
net: bonding: fix tlb_dynamic_lb default value
net_sched: gen_estimator: fix scaling error in bytes/packets samples
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
tcp: update skb->skb_mstamp more carefully
bpf/verifier: reject BPF_ALU64|BPF_END
tcp: fix data delivery rate
udpv6: Fix the checksum computation when HW checksum does not apply
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
net: phy: Fix mask value write on gmii2rgmii converter speed register
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
net/sched: cls_matchall: fix crash when used with classful qdisc
8139too: revisit napi_complete_done() usage
bpf: do not disable/enable BH in bpf_map_free_id()
tcp: fastopen: fix on syn-data transmit failure
net: emac: Fix napi poll list corruption
net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
packet: hold bind lock when rebinding to fanout hook
bpf: one perf event close won't free bpf program attached by another perf event
net: change skb->mac_header when Generic XDP calls adjust_head
isdn/i4l: fetch the ppp_write buffer in one shot
net_sched: always reset qdisc backlog in qdisc_reset()
net: stmmac: Cocci spatch "of_table"
net: qcom/emac: specify the correct size when mapping a DMA buffer
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
l2tp: fix race condition in l2tp_tunnel_delete
tun: bail out from tun_get_user() if the skb is empty
net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
net: dsa: Fix network device registration order
packet: in packet_do_bind, test fanout with bind_lock held
packet: only test po->has_vnet_hdr once in packet_snd
net: dsa: mv88e6xxx: lock mutex when freeing IRQs
net: Set sk_prot_creator when cloning sockets to the right proto
net/mlx5e: IPoIB, Fix access to invalid memory address
netlink: do not proceed if dump's start() errs
ip6_gre: ip6gre_tap device should keep dst
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
IPv4: early demux can return an error code
tipc: use only positive error codes in messages
l2tp: fix l2tp_eth module loading
socket, bpf: fix possible use after free
net: rtnetlink: fix info leak in RTM_GETSTATS call
bpf: fix bpf_tail_call() x64 JIT
usb: gadget: core: fix ->udc_set_speed() logic
USB: gadgetfs: Fix crash caused by inadequate synchronization
USB: gadgetfs: fix copy_to_user while holding spinlock
usb: gadget: udc: atmel: set vbus irqflags explicitly
usb: gadget: udc: renesas_usb3: fix for no-data control transfer
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
usb-storage: unusual_devs entry to fix write-access regression for Seagate
external drives
usb-storage: fix bogus hardware error messages for ATA pass-thru devices
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
usb: pci-quirks.c: Corrected timeout values used in handshake
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
USB: dummy-hcd: fix connection failures (wrong speed)
USB: dummy-hcd: fix infinite-loop resubmission bug
USB: dummy-hcd: Fix erroneous synchronization change
USB: devio: Prevent integer overflow in proc_do_submiturb()
USB: devio: Don't corrupt user memory
USB: g_mass_storage: Fix deadlock when driver is unbound
USB: uas: fix bug in handling of alternate settings
USB: core: harden cdc_parse_cdc_header
usb: Increase quirk delay for USB devices
USB: fix out-of-bounds in usb_set_configuration
usb: xhci: Free the right ring in xhci_add_endpoint()
xhci: fix finding correct bus_state structure for USB 3.1 hosts
xhci: fix wrong endpoint ESIT value shown in tracing
usb: host: xhci-plat: allow sysdev to inherit from ACPI
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of
'twl4030_madc_probe()'
iio: ad_sigma_delta: Implement a dedicated reset function
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from
stack.
iio: core: Return error for failed read_reg
IIO: BME280: Updates to Humidity readings need ctrl_reg write!
iio: trigger: stm32-timer: preset shouldn't be buffered
iio: trigger: stm32-timer: fix a corner case to write preset
iio: ad7793: Fix the serial interface reset
iio: adc: stm32: fix bad error check on max_channels
iio: adc: mcp320x: Fix readout of negative voltages
iio: adc: mcp320x: Fix oops on module unload
uwb: properly check kthread_run return value
uwb: ensure that endpoint is interrupt
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
mm, hugetlb, soft_offline: save compound page order before page migration
mm, oom_reaper: skip mm structs with mmu notifiers
mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
mm: avoid marking swap cached page as lazyfree
mm: fix data corruption caused by lazyfree page
userfaultfd: non-cooperative: fix fork use after free
lib/ratelimit.c: use deferred printk() version
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
ALSA: compress: Remove unused variable
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members
and total number of members"
ALSA: usx2y: Suppress kernel warning at page allocation failures
powerpc/powernv: Increase memory block size to 1GB on radix
powerpc: Fix action argument for cpufeatures-based TLB flush
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
powerpc/tm: Fix illegal TM state in signal handler
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
intel_th: pci: Add Lewisburg PCH support
driver core: platform: Don't read past the end of "driver_override" buffer
cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns
Drivers: hv: fcopy: restore correct transfer length
vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister()
stm class: Fix a use-after-free
auxdisplay: charlcd: properly restore atomic counter on error path
ftrace: Fix kmemleak in unregister_ftrace_graph
ovl: fix error value printed in ovl_lookup_index()
ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
ovl: fix dentry leak in ovl_indexdir_cleanup()
ovl: fix missing unlock_rename() in ovl_do_copy_up()
ovl: fix regression caused by exclusive upper/work dir protection
arm64: dt marvell: Fix AP806 system controller size
arm64: Ensure the instruction emulation is ready for userspace
HID: rmi: Make sure the HID device is opened on resume
HID: i2c-hid: allocate hid buffers for real worst case
HID: wacom: leds: Don't try to control the EKR's read-only LEDs
HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
HID: wacom: Correct coordinate system of touchring and pen twist
HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
HID: wacom: bits shifted too much for 9th and 10th buttons
btrfs: avoid overflow when sector_t is 32 bit
Btrfs: fix overlap of fs_info::flags values
rocker: fix rocker_tlv_put_* functions for KASAN
netlink: fix nla_put_{u8,u16,u32} for KASAN
dm crypt: reject sector_size feature if device length is not aligned to it
dm ioctl: fix alignment of event number in the device list
dm crypt: fix memory leak in crypt_ctr_cipher_old()
KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
kvm/x86: Avoid async PF preempting the kernel incorrectly
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
scsi: sd: Do not override max_sectors_kb sysfs setting
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
brcmfmac: setup passive scan if requested by user-space
drm/i915: always update ELD connector type after get modes
drm/i915/bios: ignore HDMI on port A
bsg-lib: fix use-after-free under memory-pressure
nvme-pci: Use PCI bus address for data/queues in CMB
mmc: core: add driver strength selection when selecting hs400es
nl80211: Define policy for packet pattern attributes
clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
udp: perform source validation for mcast early demux
udp: fix bcast packet reception
base: arch_topology: fix section mismatch build warnings
Linux 4.13.6
** Affects: linux (Ubuntu)
Importance: Medium
Assignee: Seth Forshee (sforshee)
Status: In Progress
** Affects: linux (Ubuntu Artful)
Importance: Medium
Assignee: Seth Forshee (sforshee)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Artful)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu Artful)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Artful)
Status: New => In Progress
** Changed in: linux (Ubuntu Artful)
Assignee: (unassigned) => Seth Forshee (sforshee)
** Description changed:
+ SRU Justification
- SRU Justification
+ Impact:
+ The upstream process for stable tree updates is quite similar
+ in scope to the Ubuntu SRU process, e.g., each patch has to
+ demonstrably fix a bug, and each patch is vetted by upstream
+ by originating either directly from a mainline/stable Linux tree or
+ a minimally backported form of that patch. The v4.13.6 upstream stable
+ patch set is now available. It should be included in the Ubuntu
+ kernel as well.
- Impact:
- The upstream process for stable tree updates is quite similar
- in scope to the Ubuntu SRU process, e.g., each patch has to
- demonstrably fix a bug, and each patch is vetted by upstream
- by originating either directly from a mainline/stable Linux tree or
- a minimally backported form of that patch. The v4.13.6 upstream stable
- patch set is now available. It should be included in the Ubuntu
- kernel as well.
+ git://git.kernel.org/
- git://git.kernel.org/
+ TEST CASE: TBD
- TEST CASE: TBD
+ The following patches from the v4.13.6 stable release shall be
+ applied:
- The following patches from the v4.13.6 stable release shall be
- applied:
+ imx-media-of: avoid uninitialized variable warning
+ usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
+ mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
+ net: bonding: Fix transmit load balancing in balance-alb mode if specified by
sysfs
+ openvswitch: Fix an error handling path in 'ovs_nla_init_match_and_action()'
+ mlxsw: spectrum: Prevent mirred-related crash on removal
+ net: bonding: fix tlb_dynamic_lb default value
+ net_sched: gen_estimator: fix scaling error in bytes/packets samples
+ net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
+ sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
+ tcp: update skb->skb_mstamp more carefully
+ bpf/verifier: reject BPF_ALU64|BPF_END
+ tcp: fix data delivery rate
+ udpv6: Fix the checksum computation when HW checksum does not apply
+ ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
+ net: phy: Fix mask value write on gmii2rgmii converter speed register
+ ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
+ net/sched: cls_matchall: fix crash when used with classful qdisc
+ 8139too: revisit napi_complete_done() usage
+ bpf: do not disable/enable BH in bpf_map_free_id()
+ tcp: fastopen: fix on syn-data transmit failure
+ net: emac: Fix napi poll list corruption
+ net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
+ packet: hold bind lock when rebinding to fanout hook
+ bpf: one perf event close won't free bpf program attached by another perf
event
+ net: change skb->mac_header when Generic XDP calls adjust_head
+ isdn/i4l: fetch the ppp_write buffer in one shot
+ net_sched: always reset qdisc backlog in qdisc_reset()
+ net: stmmac: Cocci spatch "of_table"
+ net: qcom/emac: specify the correct size when mapping a DMA buffer
+ vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
+ l2tp: fix race condition in l2tp_tunnel_delete
+ tun: bail out from tun_get_user() if the skb is empty
+ net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
+ net: dsa: Fix network device registration order
+ packet: in packet_do_bind, test fanout with bind_lock held
+ packet: only test po->has_vnet_hdr once in packet_snd
+ net: dsa: mv88e6xxx: lock mutex when freeing IRQs
+ net: Set sk_prot_creator when cloning sockets to the right proto
+ net/mlx5e: IPoIB, Fix access to invalid memory address
+ netlink: do not proceed if dump's start() errs
+ ip6_gre: ip6gre_tap device should keep dst
+ ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
+ IPv4: early demux can return an error code
+ tipc: use only positive error codes in messages
+ l2tp: fix l2tp_eth module loading
+ socket, bpf: fix possible use after free
+ net: rtnetlink: fix info leak in RTM_GETSTATS call
+ bpf: fix bpf_tail_call() x64 JIT
+ usb: gadget: core: fix ->udc_set_speed() logic
+ USB: gadgetfs: Fix crash caused by inadequate synchronization
+ USB: gadgetfs: fix copy_to_user while holding spinlock
+ usb: gadget: udc: atmel: set vbus irqflags explicitly
+ usb: gadget: udc: renesas_usb3: fix for no-data control transfer
+ usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
+ usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
+ usb-storage: unusual_devs entry to fix write-access regression for Seagate
external drives
+ usb-storage: fix bogus hardware error messages for ATA pass-thru devices
+ usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
+ usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
+ ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
+ usb: pci-quirks.c: Corrected timeout values used in handshake
+ USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
+ USB: dummy-hcd: fix connection failures (wrong speed)
+ USB: dummy-hcd: fix infinite-loop resubmission bug
+ USB: dummy-hcd: Fix erroneous synchronization change
+ USB: devio: Prevent integer overflow in proc_do_submiturb()
+ USB: devio: Don't corrupt user memory
+ USB: g_mass_storage: Fix deadlock when driver is unbound
+ USB: uas: fix bug in handling of alternate settings
+ USB: core: harden cdc_parse_cdc_header
+ usb: Increase quirk delay for USB devices
+ USB: fix out-of-bounds in usb_set_configuration
+ usb: xhci: Free the right ring in xhci_add_endpoint()
+ xhci: fix finding correct bus_state structure for USB 3.1 hosts
+ xhci: fix wrong endpoint ESIT value shown in tracing
+ usb: host: xhci-plat: allow sysdev to inherit from ACPI
+ xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
+ xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
+ Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
+ iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
+ iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path
of 'twl4030_madc_probe()'
+ iio: ad_sigma_delta: Implement a dedicated reset function
+ staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma
from stack.
+ iio: core: Return error for failed read_reg
+ IIO: BME280: Updates to Humidity readings need ctrl_reg write!
+ iio: trigger: stm32-timer: preset shouldn't be buffered
+ iio: trigger: stm32-timer: fix a corner case to write preset
+ iio: ad7793: Fix the serial interface reset
+ iio: adc: stm32: fix bad error check on max_channels
+ iio: adc: mcp320x: Fix readout of negative voltages
+ iio: adc: mcp320x: Fix oops on module unload
+ uwb: properly check kthread_run return value
+ uwb: ensure that endpoint is interrupt
+ staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
+ ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
+ mm, hugetlb, soft_offline: save compound page order before page migration
+ mm, oom_reaper: skip mm structs with mmu notifiers
+ mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
+ mm: avoid marking swap cached page as lazyfree
+ mm: fix data corruption caused by lazyfree page
+ userfaultfd: non-cooperative: fix fork use after free
+ lib/ratelimit.c: use deferred printk() version
+ lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
+ ALSA: compress: Remove unused variable
+ Revert "ALSA: echoaudio: purge contradictions between dimension matrix
members and total number of members"
+ ALSA: usx2y: Suppress kernel warning at page allocation failures
+ powerpc/powernv: Increase memory block size to 1GB on radix
+ powerpc: Fix action argument for cpufeatures-based TLB flush
+ powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
+ powerpc/tm: Fix illegal TM state in signal handler
+ percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
+ intel_th: pci: Add Lewisburg PCH support
+ driver core: platform: Don't read past the end of "driver_override" buffer
+ cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute()
returns
+ Drivers: hv: fcopy: restore correct transfer length
+ vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister()
+ stm class: Fix a use-after-free
+ auxdisplay: charlcd: properly restore atomic counter on error path
+ ftrace: Fix kmemleak in unregister_ftrace_graph
+ ovl: fix error value printed in ovl_lookup_index()
+ ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
+ ovl: fix dentry leak in ovl_indexdir_cleanup()
+ ovl: fix missing unlock_rename() in ovl_do_copy_up()
+ ovl: fix regression caused by exclusive upper/work dir protection
+ arm64: dt marvell: Fix AP806 system controller size
+ arm64: Ensure the instruction emulation is ready for userspace
+ HID: rmi: Make sure the HID device is opened on resume
+ HID: i2c-hid: allocate hid buffers for real worst case
+ HID: wacom: leds: Don't try to control the EKR's read-only LEDs
+ HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
+ HID: wacom: Correct coordinate system of touchring and pen twist
+ HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
+ HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
+ HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
+ HID: wacom: bits shifted too much for 9th and 10th buttons
+ btrfs: avoid overflow when sector_t is 32 bit
+ Btrfs: fix overlap of fs_info::flags values
+ rocker: fix rocker_tlv_put_* functions for KASAN
+ netlink: fix nla_put_{u8,u16,u32} for KASAN
+ dm crypt: reject sector_size feature if device length is not aligned to it
+ dm ioctl: fix alignment of event number in the device list
+ dm crypt: fix memory leak in crypt_ctr_cipher_old()
+ KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
+ kvm/x86: Avoid async PF preempting the kernel incorrectly
+ iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
+ scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
+ scsi: sd: Do not override max_sectors_kb sysfs setting
+ brcmfmac: add length check in brcmf_cfg80211_escan_handler()
+ brcmfmac: setup passive scan if requested by user-space
+ drm/i915: always update ELD connector type after get modes
+ drm/i915/bios: ignore HDMI on port A
+ bsg-lib: fix use-after-free under memory-pressure
+ nvme-pci: Use PCI bus address for data/queues in CMB
+ mmc: core: add driver strength selection when selecting hs400es
+ nl80211: Define policy for packet pattern attributes
+ clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
+ udp: perform source validation for mcast early demux
+ udp: fix bcast packet reception
+ base: arch_topology: fix section mismatch build warnings
+ Linux 4.13.6
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1723145
Title:
Artful update to v4.13.6 stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1723145/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
