Lucid update to 2.6.32.60 stable release

Bug #1064480 reported by Herton R. Krzesinski
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Lucid
Fix Released
Medium
Herton R. Krzesinski

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from Linus' tree or in a minimally
       backported form of that patch. The 2.6.32.60 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches are in the 2.6.32.60 stable release:

netxen: support for GbE port settings
Fix sparc build with newer tools.
powerpc/pmac: Fix SMP kernels on pre-core99 UP machines
Bluetooth: btusb: fix bInterval for high/super speed isochronous endpoints
jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
fix pgd_lock deadlock
futex: Fix uninterruptible loop due to gate_area
ntp: Fix leap-second hrtimer livelock
ntp: Correct TAI offset during leap second
timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond
time: Move common updates to a function
hrtimer: Provide clock_was_set_delayed()
timekeeping: Fix leapsecond triggered load spike issue
timekeeping: Maintain ktime_t based offsets for hrtimers
hrtimers: Move lock held region in hrtimer_interrupt()
timekeeping: Provide hrtimer update function
hrtimer: Update hrtimer base offsets each hrtimer_interrupt
timekeeping: Add missing update call in timekeeping_resume()
time: Improve sanity checking of timekeeping inputs
time: Avoid making adjustments if we haven't accumulated anything
time: Move ktime_t overflow checking into timespec_valid_strict
drm/i915: Attempt to fix watermark setup on 85x (v2)
ioat2: kill pending flag
usb: Fix deadlock in hid_reset when Dell iDRAC is reset
eCryptfs: Copy up lower inode attrs after setting lower xattr
eCryptfs: Clear ECRYPTFS_NEW_FILE flag during truncate
oprofile: use KM_NMI slot for kmap_atomic
tty_audit: fix tty_audit_add_data live lock on audit disabled
bonding: 802.3ad - fix agg_device_up
usbnet: increase URB reference count before usb_unlink_urb
usbnet: don't clear urb->dev in tx_complete
sched: Fix signed unsigned comparison in check_preempt_tick()
x86/PCI: amd: factor out MMCONFIG discovery
PNP: fix "work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB"
KVM: Remove ability to assign a device without iommu support
KVM: Device assignment permission checks
KVM: x86: Prevent starting PIT timers in the absence of irqchip support
rose: Add length checks to CALL_REQUEST parsing
KVM: x86: extend "struct x86_emulate_ops" with "get_cpuid"
KVM: x86: fix missing checks in syscall emulation
block: Fix io_context leak after clone with CLONE_IO
block: Fix io_context leak after failure of clone with CLONE_IO
KVM: x86: disallow multiple KVM_CREATE_IRQCHIP
KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
KVM: ia64: fix build due to typo
xfs: Fix possible memory corruption in xfs_readlink
xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink()
fcaps: clear the same personality flags as suid when fcaps are used
security: fix compile error in commoncap.c
hugepages: fix use after free bug in "quota" handling
net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
dl2k: use standard #defines from mii.h.
dl2k: Clean up rio_ioctl
hfsplus: Fix potential buffer overflows
cred: copy_process() should clear child->replacement_session_keyring
tcp: Don't change unlocked socket state in tcp_v4_err().
x86: Derandom delay_tsc for 64 bit
ipsec: be careful of non existing mac headers
block, sx8: fix pointer math issue getting fw version
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
USB: ftdi_sio: fix problem when the manufacture is a NULL string
ntp: Fix integer overflow when setting time
SUNRPC: We must not use list_for_each_entry_safe() in rpc_wake_up()
ext4: check for zero length extent
xfs: Fix oops on IO error during xlog_recover_process_iunlinks()
nfsd: don't allow zero length strings in cache_parse()
sched/x86: Fix overflow in cyc2ns_offset
Bluetooth: add NULL pointer check in HCI
Bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close
sparc64: Fix bootup crash on sun4v.
video:uvesafb: Fix oops that uvesafb try to execute NX-protected page
USB: serial: fix race between probe and open
xhci: Don't write zeroed pointers to xHC registers.
xHCI: Correct the #define XHCI_LEGACY_DISABLE_SMI
crypto: sha512 - Fix byte counter overflow in SHA-512
PCI: Add quirk for still enabled interrupts on Intel Sandy Bridge GPUs
phonet: Check input from user before allocating
netlink: fix races after skb queueing
net: fix a race in sock_queue_err_skb()
atl1: fix kernel panic in case of DMA errors
net/ethernet: ks8851_mll fix rx frame buffer overflow
net_sched: gred: Fix oops in gred_dump() in WRED mode
ARM: 7410/1: Add extra clobber registers for assembly in kernel_execve
netem: fix possible skb leak
ALSA: echoaudio: Remove incorrect part of assertion
NFSv4: Revalidate uid/gid after open
ext3: Fix error handling on inode bitmap corruption
ext4: fix error handling on inode bitmap corruption
xhci: Reset reserved command ring TRBs on cleanup.
SCSI: fix scsi_wait_scan
powerpc: Fix kernel panic during kernel module load
fuse: fix stat call on 32 bit platforms
udf: Avoid run away loop when partition table length is corrupted
udf: Improve table length check to avoid possible overflow
stable: Allow merging of backports for serious user-visible performance issues
eCryptfs: Properly check for O_RDONLY flag before doing privileged open
USB: cdc-wdm: fix lockup on error in wdm_read
mm: Hold a file reference in madvise_remove
ntp: Fix STA_INS/DEL clearing bug
MIPS: Properly align the .data..init_task section.
powerpc/ftrace: Fix assembly trampoline register usage
powerpc: Add "memory" attribute for mfmsr()
SCSI: libsas: continue revalidation
SCSI: libsas: fix sas_discover_devices return code handling
SCSI: fix eh wakeup (scsi_schedule_eh vs scsi_restart_operations)
SCSI: Avoid dangling pointer in scsi_requeue_command()
usbdevfs: Correct amount of data copied to user in processcompl_compat
locks: fix checking of fcntl_setlease argument
ACPI/AC: prevent OOPS on some boxes due to missing check power_supply_register() return value check
Btrfs: call the ordered free operation without any locks held
nfsd4: our filesystems are normally case sensitive
ext4: don't let i_reserved_meta_blocks go negative
sctp: Fix list corruption resulting from freeing an association on a list
cipso: don't follow a NULL pointer when setsockopt() is called
wanmain: comparing array with NULL
USB: kaweth.c: use GFP_ATOMIC under spin_lock
tcp: perform DMA to userspace only if there is a task waiting for it
net/tun: fix ioctl() based info leaks
USB: echi-dbgp: increase the controller wait time to come out of halt.
ALSA: mpu401: Fix missing initialization of irq field
futex: Test for pi_mutex on fault in futex_wait_requeue_pi()
futex: Fix bug in WARN_ON for NULL q.pi_state
futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi()
pcdp: use early_ioremap/early_iounmap to access pcdp table
mm: mmu_notifier: fix freed page still mapped in secondary MMU
fuse: verify all ioctl retry iov elements
xhci: Increase reset timeout for Renesas 720201 host.
usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
ALSA: hda - fix Copyright debug message
vfs: missed source of ->f_pos races
NFSv3: Ensure that do_proc_get_root() reports errors correctly
NFS: Alias the nfs module to nfs4
svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
svcrpc: sends on closed socket should stop immediately
cciss: fix incorrect scsi status reporting
USB: CDC ACM: Fix NULL pointer dereference
Remove user-triggerable BUG from mpol_to_str
udf: Fix data corruption for files in ICB
ext3: Fix fdatasync() for files with only i_size changes
PARISC: Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
dccp: check ccid before dereferencing
ia64: Add accept4() syscall
tcp: do_tcp_sendpages() must try to push data out on oom conditions
tcp: drop SYN+FIN messages
xen: correctly check for pending events when restoring irq flags
x86, amd, xen: Avoid NULL pointer paravirt references
x86, tls: Off by one limit check
sparc64: Eliminate obsolete __handle_softirq() function
udf: Fortify loading of sparing table
udf: fix retun value on error path in udf_load_logicalvol
mtd: cafe_nand: fix an & vs | mistake
epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()
epoll: ep_unregister_pollwait() can use the freed pwq->whead
epoll: limit paths
Don't limit non-nested epoll paths
epoll: clear the tfile_check_list on -ELOOP
random: Reorder struct entropy_store to remove padding on 64bits
random: update interface comments to reflect reality
random: simplify fips mode
x86, cpu: Add CPU flags for F16C and RDRND
x86, cpufeature: Update CPU feature RDRND to RDRAND
random: Add support for architectural random hooks
x86, random: Architectural inlines to get random integers with RDRAND
x86, random: Verify RDRAND functionality and allow it to be disabled
fix typo/thinko in get_random_bytes()
random: Use arch_get_random_int instead of cycle counter if avail
random: Use arch-specific RNG to initialize the entropy store
random: Adjust the number of loops when initializing
drivers/char/random.c: fix boot id uniqueness race
random: make 'add_interrupt_randomness()' do something sane
random: use lockless techniques in the interrupt path
random: create add_device_randomness() interface
random: use the arch-specific rng in xfer_secondary_pool
random: add new get_random_bytes_arch() function
random: mix in architectural randomness in extract_buf()
MAINTAINERS: Theodore Ts'o is taking over the random driver
usb: feed USB device information to the /dev/random driver
net: feed /dev/random with the MAC address when registering a device
random: remove rand_initialize_irq()
random: Add comment to random_initialize()
rtc: wm831x: Feed the write counter into device_add_randomness()
mfd: wm831x: Feed the device UUID into device_add_randomness()
dmi: Feed DMI table to /dev/random driver
Linux 2.6.32.60

The applied version of patch "xfs: Fix possible memory corruption in xfs_readlink" was reverted in master-next in favour of the fixed version from this update (properly using xfs_fs_cmn_err)

The following patches from 2.6.32.60 update were dropped as they were already applied on lucid master-next:
jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
ntp: Fix leap-second hrtimer livelock
ntp: Correct TAI offset during leap second
timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond
time: Move common updates to a function
hrtimer: Provide clock_was_set_delayed()
timekeeping: Fix leapsecond triggered load spike issue
timekeeping: Maintain ktime_t based offsets for hrtimers
hrtimers: Move lock held region in hrtimer_interrupt()
timekeeping: Provide hrtimer update function
hrtimer: Update hrtimer base offsets each hrtimer_interrupt
timekeeping: Add missing update call in timekeeping_resume()
eCryptfs: Copy up lower inode attrs after setting lower xattr
eCryptfs: Clear ECRYPTFS_NEW_FILE flag during truncate
KVM: Remove ability to assign a device without iommu support
KVM: Device assignment permission checks
KVM: x86: Prevent starting PIT timers in the absence of irqchip support
rose: Add length checks to CALL_REQUEST parsing
KVM: x86: extend "struct x86_emulate_ops" with "get_cpuid"
KVM: x86: fix missing checks in syscall emulation
block: Fix io_context leak after clone with CLONE_IO
block: Fix io_context leak after failure of clone with CLONE_IO
KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
fcaps: clear the same personality flags as suid when fcaps are used
security: fix compile error in commoncap.c
hugepages: fix use after free bug in "quota" handling
net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
dl2k: Clean up rio_ioctl
hfsplus: Fix potential buffer overflows
cred: copy_process() should clear child->replacement_session_keyring
udf: Avoid run away loop when partition table length is corrupted
mm: Hold a file reference in madvise_remove
udf: Fortify loading of sparing table

The following patches from 2.6.32.60 needed rediff or code updates so they would be correct and could be applied to lucid master-next:
KVM: x86: disallow multiple KVM_CREATE_IRQCHIP
udf: Improve table length check to avoid possible overflow
udf: fix retun value on error path in udf_load_logicalvol
usb: feed USB device information to the /dev/random driver

The patch "drm/i915: Attempt to fix watermark setup on 85x (v2)" was not part of 2.6.32.60+drm33.26, but was part of an earlier release. It was applied now with this update, and is also part of upstream 2.6.32.60. The remaining patches between 2.6.32.59+drm33.24 and 2.6.32.60+drm33.26 were already applied to Lucid. So we are up to date now, and thus the version jump .59+drm33.24 -> .60+drm33.26 on Makefile.

CVE References

tags: added: kernel-stable-tracking-bug
description: updated
Changed in linux (Ubuntu):
status: New → Invalid
Changed in linux (Ubuntu Lucid):
status: New → Fix Committed
importance: Undecided → Medium
assignee: nobody → Herton R. Krzesinski (herton)
Revision history for this message
Adam Conrad (adconrad) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (11.7 KiB)

This bug was fixed in the package linux - 2.6.32-45.99

---------------
linux (2.6.32-45.99) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1067331

  [ Tim Gardner ]

  * SAUCE: omnibook: Expose PWD for standalone builds
    - LP: #505420

  [ Upstream Kernel Changes ]

  * Revert "xfs: Fix possible memory corruption in xfs_readlink,
    CVE-2011-4077"
    - LP: #1064480
  * UBUNTU SAUCE: apparmor: fix IRQ stack overflow
    - LP: #1056078
  * net/9p: fix virtio transport to correctly update status on connect
    - LP: #676823
  * 9p: Fix the kernel crash on a failed mount
    - LP: #676823
  * netxen: support for GbE port settings
    - LP: #1064480
  * Fix sparc build with newer tools.
    - LP: #1064480
  * powerpc/pmac: Fix SMP kernels on pre-core99 UP machines
    - LP: #1064480
  * Bluetooth: btusb: fix bInterval for high/super speed isochronous
    endpoints
    - LP: #1064480
  * fix pgd_lock deadlock
    - LP: #1064480
  * futex: Fix uninterruptible loop due to gate_area
    - LP: #1064480
  * time: Improve sanity checking of timekeeping inputs
    - LP: #1064480
  * time: Avoid making adjustments if we haven't accumulated anything
    - LP: #1064480
  * time: Move ktime_t overflow checking into timespec_valid_strict
    - LP: #1064480
  * drm/i915: Attempt to fix watermark setup on 85x (v2)
    - LP: #1064480
  * ioat2: kill pending flag
    - LP: #1064480
  * usb: Fix deadlock in hid_reset when Dell iDRAC is reset
    - LP: #1064480
  * oprofile: use KM_NMI slot for kmap_atomic
    - LP: #1064480
  * tty_audit: fix tty_audit_add_data live lock on audit disabled
    - LP: #1064480
  * bonding: 802.3ad - fix agg_device_up
    - LP: #1064480
  * usbnet: increase URB reference count before usb_unlink_urb
    - LP: #1064480
  * usbnet: don't clear urb->dev in tx_complete
    - LP: #1064480
  * sched: Fix signed unsigned comparison in check_preempt_tick()
    - LP: #1064480
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #1064480
  * PNP: fix "work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB"
    - LP: #1064480
  * KVM: x86: disallow multiple KVM_CREATE_IRQCHIP
    - LP: #1064480
  * KVM: ia64: fix build due to typo
    - LP: #1064480
  * xfs: Fix possible memory corruption in xfs_readlink
    - LP: #1064480
  * xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink()
    - LP: #1064480
  * dl2k: use standard #defines from mii.h.
    - LP: #1064480
  * tcp: Don't change unlocked socket state in tcp_v4_err().
    - LP: #1064480
  * x86: Derandom delay_tsc for 64 bit
    - LP: #1064480
  * ipsec: be careful of non existing mac headers
    - LP: #1064480
  * block, sx8: fix pointer math issue getting fw version
    - LP: #1064480
  * nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
    - LP: #1064480
  * USB: ftdi_sio: fix problem when the manufacture is a NULL string
    - LP: #1064480
  * ntp: Fix integer overflow when setting time
    - LP: #1064480
  * SUNRPC: We must not use list_for_each_entry_safe() in rpc_wake_up()
    - LP: #1064480
  * ext4: check for zero length extent
    - LP: #1064480
  * xfs: Fix oops on IO error during xlog_recover_pr...

Changed in linux (Ubuntu Lucid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.