Xenial update to 4.4.81 stable release

Bug #1711526 reported by Stefan Bader
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Xenial
Fix Released
Medium
Stefan Bader

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The 4.4.81 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

The following patches from the 4.4.81 stable release shall be applied:
* libata: array underflow in ata_find_dev()
* workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
* ALSA: hda - Fix speaker output from VAIO VPCL14M1R
* ASoC: do not close shared backend dailink
* KVM: async_pf: make rcu irq exit if not triggered from idle task
* mm/page_alloc: Remove kernel address exposure in free_reserved_area()
* ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
* ext4: fix overflow caused by missing cast in ext4_resize_fs()
* ARM: dts: armada-38x: Fix irq type for pca955
* media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS
  ioctl
* target: Avoid mappedlun symlink creation during lun shutdown
* iscsi-target: Always wait for kthread_should_stop() before kthread exit
* iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
* iscsi-target: Fix initial login PDU asynchronous socket close OOPs
* iscsi-target: Fix delayed logout processing greater than
  SECONDS_FOR_LOGOUT_COMP
* iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
* mm, mprotect: flush TLB if potentially racing with a parallel reclaim
  leaving stale TLB entries
* media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
* f2fs: sanity check checkpoint segno and blkoff
* drm: rcar-du: fix backport bug
* saa7164: fix double fetch PCIe access condition
* ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
* net: Zero terminate ifr_name in dev_ifname().
* ipv6: avoid overflow of offset in ip6_find_1stfragopt
* ipv4: initialize fib_trie prior to register_netdev_notifier call.
* rtnetlink: allocate more memory for dev_set_mac_address()
* mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
* openvswitch: fix potential out of bound access in parse_ct
* packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
* ipv6: Don't increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment()
* net: ethernet: nb8800: Handle all 4 RGMII modes identically
* dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly
* dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly
* dccp: fix a memleak for dccp_feat_init err process
* sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
* sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
* net/mlx5: Fix command bad flow on command entry allocation failure
* net: phy: Correctly process PHY_HALTED in phy_stop_machine()
* net: phy: Fix PHY unbind crash
* xen-netback: correctly schedule rate-limited queues
* sparc64: Measure receiver forward progress to avoid send mondo timeout
* wext: handle NULL extra data in iwe_stream_add_point better
* sh_eth: R8A7740 supports packet shecksumming
* net: phy: dp83867: fix irq generation
* tg3: Fix race condition in tg3_get_stats64().
* x86/boot: Add missing declaration of string functions
* phy state machine: failsafe leave invalid RUNNING state
* scsi: qla2xxx: Get mutex lock before checking optrom_state
* drm/virtio: fix framebuffer sparse warning
* virtio_blk: fix panic in initialization error path
* ARM: 8632/1: ftrace: fix syscall name matching
* mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
* lib/Kconfig.debug: fix frv build failure
* signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
* mm: don't dereference struct page fields of invalid pages
* workqueue: implicit ordered attribute should be overridable
* Linux 4.4.81

CVE References

Stefan Bader (smb)
tags: added: kernel-stable-tracking-bug
Revision history for this message
Stefan Bader (smb) wrote :

The following patches were skipped because they were already applied as part of the update for CVE-2017-1000112:
- ipv4: Should use consistent conditional judgement for ip fragment in
  __ip_append_data and ip_finish_output
- net: account for current skb length when deciding about UFO

description: updated
Changed in linux (Ubuntu Xenial):
assignee: nobody → Stefan Bader (smb)
importance: Undecided → Medium
status: New → In Progress
Changed in linux (Ubuntu):
status: New → Invalid
Changed in linux (Ubuntu Xenial):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (14.4 KiB)

This bug was fixed in the package linux - 4.4.0-96.119

---------------
linux (4.4.0-96.119) xenial; urgency=low

  * linux: 4.4.0-96.119 -proposed tracker (LP: #1716613)

  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
    - s390/mm: no local TLB flush for clearing-by-ASCE IDTE
    - SAUCE: s390/mm: fix local TLB flushing vs. detach of an mm address space
    - SAUCE: s390/mm: fix race on mm->context.flush_mm

  * CVE-2017-1000251
    - Bluetooth: Properly check L2CAP config option output buffer length

linux (4.4.0-95.118) xenial; urgency=low

  * linux: 4.4.0-95.118 -proposed tracker (LP: #1715651)

  * Xenial update to 4.4.78 stable release broke Address Sanitizer
    (LP: #1715636)
    - mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes

linux (4.4.0-94.117) xenial; urgency=low

  * linux: 4.4.0-94.117 -proposed tracker (LP: #1713462)

  * mwifiex causes kernel oops when AP mode is enabled (LP: #1712746)
    - SAUCE: net/wireless: do not dereference invalid pointer
    - SAUCE: mwifiex: do not dereference invalid pointer

  * Backport more recent Broadcom bnxt_en driver (LP: #1711056)
    - SAUCE: bnxt_en_bpo: Import bnxt_en driver version 1.8.1
    - SAUCE: bnxt_en_bpo: Drop distro out-of-tree detection logic
    - SAUCE: bnxt_en_bpo: Remove unnecessary compile flags
    - SAUCE: bnxt_en_bpo: Move config settings to Kconfig
    - SAUCE: bnxt_en_bpo: Remove PCI_IDs handled by the regular driver
    - SAUCE: bnxt_en_bpo: Rename the backport driver to bnxt_en_bpo
    - bnxt_en_bpo: [Config] Enable CONFIG_BNXT_BPO=m

  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
    - HID: multitouch: Support PTP Stick and Touchpad device
    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A

  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
    - SAUCE: igb: add support for using Broadcom 54616 as PHY

  * IPR driver causes multipath to fail paths/stuck IO on Medium Errors
    (LP: #1682644)
    - scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION

  * accessing /dev/hvc1 with stress-ng on Ubuntu xenial causes crash
    (LP: #1711401)
    - tty/hvc: Use IRQF_SHARED for OPAL hvc consoles

  * memory-hotplug test needs to be fixed (LP: #1710868)
    - selftests: typo correction for memory-hotplug test
    - selftests: check hot-pluggagble memory for memory-hotplug test
    - selftests: check percentage range for memory-hotplug test
    - selftests: add missing test name in memory-hotplug test
    - selftests: fix memory-hotplug test

  * HP lt4132 LTE/HSPA+ 4G Module (03f0:a31d) does not work (LP: #1707643)
    - net: cdc_mbim: apply "NDP to end" quirk to HP lt4132

  * Migrating KSM page causes the VM lock up as the KSM page merging list is too
    large (LP: #1680513)
    - ksm: introduce ksm_max_page_sharing per page deduplication limit
    - ksm: fix use after free with merge_across_nodes = 0
    - ksm: cleanup stable_node chain collapse case
    - ksm: swap the two output parameters of chain/chain_prune
    - ksm: optimize refile of stable_node_dup at the head of the chain

  * sort ABI files with C.UTF-8 locale (LP: #1712345)
    - [Packaging] sort ABI ...

Changed in linux (Ubuntu Xenial):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.