Bug #1546320 “crash starting at kernel v3.13.0-72 in timer code...” : Bugs : linux package : Ubuntu

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-16:

#1

It seems to a problem in add_timer_on moving from a timer_base to a new timer_base

It does look like 470ed44 exposed the problem by switching to add_timer_on from mod_timer; this is a fix to add_timer_on

Reference:
---
https://lkml.org/lkml/2016/2/3/295
https://lkml.org/lkml/2016/2/4/247

Patch:
https://lkml.org/lkml/diff/2016/2/4/247/1
---

Eric

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-16: Missing required logs.

#2

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1546320

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete
tags:	added: trusty

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-16:

#3

dmesg_detach_if_pending.out Edit (99.2 KiB, text/plain)

See "dmesg_detach_if_pending.out" taken from the last crash into /var/crash/

Changed in linux (Ubuntu):
status:	Incomplete → Confirmed
importance:	Undecided → High

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-16:

#4

Download full text (4.3 KiB)

It seems like commit: 22b886dd timers: Use proper base migration in add_timer_on() [1]

Has been started to by apply :

$ git tag --contains 22b886dd
Ubuntu-lts-4.4.0-4.19_14.04.1
Ubuntu-lts-4.4.0-4.19_14.04.2

[1] $ git show 22b886dd
commit 22b886dd1018093920c4250dee2a9a3cb7cff7b8
Author: Tejun Heo <email address hidden>
Date: Wed Nov 4 12:15:33 2015 -0500

timers: Use proper base migration in add_timer_on()

    Regardless of the previous CPU a timer was on, add_timer_on()
    currently simply sets timer->flags to the new CPU. As the caller must
    be seeing the timer as idle, this is locally fine, but the timer
    leaving the old base while unlocked can lead to race conditions as
    follows.

Let's say timer was on cpu 0.

      cpu 0 cpu 1
      -----------------------------------------------------------------------------
      del_timer(timer) succeeds
                                        del_timer(timer)
                                          lock_timer_base(timer) locks cpu_0_base
      add_timer_on(timer, 1)
        spin_lock(&cpu_1_base->lock)
        timer->flags set to cpu_1_base
        operates on @timer operates on @timer

    This triggered with mod_delayed_work_on() which contains
    "if (del_timer()) add_timer_on()" sequence eventually leading to the
    following oops.

      BUG: unable to handle kernel NULL pointer dereference at (null)
      IP: [<ffffffff810ca6e9>] detach_if_pending+0x69/0x1a0
      ...
      Workqueue: wqthrash wqthrash_workfunc [wqthrash]
      task: ffff8800172ca680 ti: ffff8800172d0000 task.ti: ffff8800172d0000
      RIP: 0010:[<ffffffff810ca6e9>] [<ffffffff810ca6e9>] detach_if_pending+0x69/0x1a0
      ...
      Call Trace:
       [<ffffffff810cb0b4>] del_timer+0x44/0x60
       [<ffffffff8106e836>] try_to_grab_pending+0xb6/0x160
       [<ffffffff8106e913>] mod_delayed_work_on+0x33/0x80
       [<ffffffffa0000081>] wqthrash_workfunc+0x61/0x90 [wqthrash]
       [<ffffffff8106dba8>] process_one_work+0x1e8/0x650
       [<ffffffff8106e05e>] worker_thread+0x4e/0x450
       [<ffffffff810746af>] kthread+0xef/0x110
       [<ffffffff8185980f>] ret_from_fork+0x3f/0x70

Fix it by updating add_timer_on() to perform proper migration as
__mod_timer() does.

    Reported-and-tested-by: Jeff Layton <email address hidden>
    Signed-off-by: Tejun Heo <email address hidden>
    Cc: Chris Worley <email address hidden>
    Cc: <email address hidden>
    Cc: Michael Skralivetsky <email address hidden>
    Cc: Trond Myklebust <email address hidden>
    Cc: Shaohua Li <email address hidden>
    Cc: Jeff Layton <email address hidden>
    Cc: <email address hidden>
    Cc: <email address hidden>
    Link: http://<email address hidden>
    Link: http://<email address hidden>
    Signed-off-by: Thomas Gleixner <email address hidden>

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 74591ba..bbc5d11 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -977,13 +977,29 @@ EXPORT_SYMBOL(add_timer);
*/...

It seems like commit: 22b886dd timers: Use proper base migration in add_timer_on() [1]

Has been started to by apply :

$ git tag --contains 22b886dd
Ubuntu-lts-4.4.0-4.19_14.04.1
Ubuntu-lts-4.4.0-4.19_14.04.2

[1] $ git show 22b886dd
commit 22b886dd1018093920c4250dee2a9a3cb7cff7b8
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Nov 4 12:15:33 2015 -0500

timers: Use proper base migration in add_timer_on()
    
    Regardless of the previous CPU a timer was on, add_timer_on()
    currently simply sets timer->flags to the new CPU.  As the caller must
    be seeing the timer as idle, this is locally fine, but the timer
    leaving the old base while unlocked can lead to race conditions as
    follows.
    
    Let's say timer was on cpu 0.
    
      cpu 0                                     cpu 1
      -----------------------------------------------------------------------------
      del_timer(timer) succeeds
                                        del_timer(timer)
                                          lock_timer_base(timer) locks cpu_0_base
      add_timer_on(timer, 1)
        spin_lock(&cpu_1_base->lock)
        timer->flags set to cpu_1_base
        operates on @timer                        operates on @timer
    
    This triggered with mod_delayed_work_on() which contains
    "if (del_timer()) add_timer_on()" sequence eventually leading to the
    following oops.
    
      BUG: unable to handle kernel NULL pointer dereference at           (null)
      IP: [<ffffffff810ca6e9>] detach_if_pending+0x69/0x1a0
      ...
      Workqueue: wqthrash wqthrash_workfunc [wqthrash]
      task: ffff8800172ca680 ti: ffff8800172d0000 task.ti: ffff8800172d0000
      RIP: 0010:[<ffffffff810ca6e9>]  [<ffffffff810ca6e9>] detach_if_pending+0x69/0x1a0
      ...
      Call Trace:
       [<ffffffff810cb0b4>] del_timer+0x44/0x60
       [<ffffffff8106e836>] try_to_grab_pending+0xb6/0x160
       [<ffffffff8106e913>] mod_delayed_work_on+0x33/0x80
       [<ffffffffa0000081>] wqthrash_workfunc+0x61/0x90 [wqthrash]
       [<ffffffff8106dba8>] process_one_work+0x1e8/0x650
       [<ffffffff8106e05e>] worker_thread+0x4e/0x450
       [<ffffffff810746af>] kthread+0xef/0x110
       [<ffffffff8185980f>] ret_from_fork+0x3f/0x70
    
    Fix it by updating add_timer_on() to perform proper migration as
    __mod_timer() does.
    
    Reported-and-tested-by: Jeff Layton <jlayton@poochiereds.net>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Chris Worley <chris.worley@primarydata.com>
    Cc: bfields@fieldses.org
    Cc: Michael Skralivetsky <michael.skralivetsky@primarydata.com>
    Cc: Trond Myklebust <trond.myklebust@primarydata.com>
    Cc: Shaohua Li <shli@fb.com>
    Cc: Jeff Layton <jlayton@poochiereds.net>
    Cc: kernel-team@fb.com
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernel.org/r/20151029103113.2f893924@tlielax.poochiereds.net
    Link: http://lkml.kernel.org/r/20151104171533.GI5749@mtj.duckdns.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 74591ba..bbc5d11 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -977,13 +977,29 @@ EXPORT_SYMBOL(add_timer);
  */
 void add_timer_on(struct timer_list *timer, int cpu)
 {
-       struct tvec_base *base = per_cpu_ptr(&tvec_bases, cpu);
+       struct tvec_base *new_base = per_cpu_ptr(&tvec_bases, cpu);
+       struct tvec_base *base;
        unsigned long flags;
 
        timer_stats_timer_set_start_info(timer);
        BUG_ON(timer_pending(timer) || !timer->function);
-       spin_lock_irqsave(&base->lock, flags);
-       timer->flags = (timer->flags & ~TIMER_BASEMASK) | cpu;
+
+       /*
+        * If @timer was on a different CPU, it should be migrated with the
+        * old base locked to prevent other operations proceeding with the
+        * wrong base locked.  See lock_timer_base().
+        */
+       base = lock_timer_base(timer, &flags);
+       if (base != new_base) {
+               timer->flags |= TIMER_MIGRATING;
+
+               spin_unlock(&base->lock);
+               base = new_base;
+               spin_lock(&base->lock);
+               WRITE_ONCE(timer->flags,
+                          (timer->flags & ~TIMER_BASEMASK) | cpu);
+       }
+
        debug_activate(timer, timer->expires);
        internal_add_timer(base, timer);
        spin_unlock_irqrestore(&base->lock, flags);

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-16:

#5

The problem has been reported by few different peoples of the community already.

Tim Gardner (timg-tpi) on 2016-02-16

Changed in linux (Ubuntu Trusty):
assignee:	nobody → Kamal Mostafa (kamalmostafa)
status:	New → In Progress
Changed in linux (Ubuntu Vivid):
assignee:	nobody → Kamal Mostafa (kamalmostafa)
status:	New → In Progress
Changed in linux (Ubuntu Wily):
assignee:	nobody → Kamal Mostafa (kamalmostafa)
status:	New → In Progress

Eric Desrochers (slashd) on 2016-02-16

Changed in linux (Ubuntu Trusty):
importance:	Undecided → High

Revision history for this message

Kamal Mostafa (kamalmostafa) wrote on 2016-02-17:

#6

Eric comments that this may be fixed by the mainline stable commit:

[mainline] 22b886d "timers: Use proper base migration in add_timer_on()"

... but that can't be applied to pre-4.2 kernels (since it would require 0eeda71 "timer: Replace timer base by a cpu index", which isn't suitable for pre-4.2).

@Eric, please try reverting the commit that (apparently) introduced the problem:

[trusty] 470ed44 "workqueue: make sure delayed work run in local cpu"

Ante Karamatić (ivoks) on 2016-02-18

tags:

added: cpec

Revision history for this message

Rafael David Tinoco (rafaeldtinoco) wrote on 2016-02-18:

#7

# SUMMARY

- recent changes (2016) broke timer guarantee of work items queue without explicit cpuu to be put on local cpus.
- 874bbfe made sure delayed work run in local cpu (Sep 2015)
- vmstat was broken and fixed by 176bed1de5bf (explicitly scheduling per-cpu work) (Oct 2015)
- 874bbfe introduced a bug fixed by 22b886d (Nov 2015)
- 22b886d could NOT be backported beyond certain point (older kernels)
- kernels with only 874bbfe started crashing (THIS CASE)
- since 176bed1de5bf fixed vmstat, 874bbfe SHOULD BE REMOVED from stable kernels
- newer bugs expected (delayed work will not be guaranteed to run locally)
- new bugs will be backported to stable kernels as they appear

Revision history for this message

Rafael David Tinoco (rafaeldtinoco) wrote on 2016-02-18:

#8

Working on removing "874bbfe" from Trusty, as Kamal well said:

commit 874bbfe600a660cba9c776b3957b1ce393151b76
Author: Shaohua Li <email address hidden>
Date: Wed Sep 30 09:05:30 2015 -0700

workqueue: make sure delayed work run in local cpu

Is commit:

commit 470ed447e21e8411cd628c92ab93dcebaa0d199d
Author: Shaohua Li <email address hidden>
Date: Wed Sep 30 09:05:30 2015 -0700

workqueue: make sure delayed work run in local cpu

BugLink: http://bugs.launchpad.net/bugs/1520264

In Trusty.

Revision history for this message

Rafael David Tinoco (rafaeldtinoco) wrote on 2016-02-18:

#9

inaddy@rafael(~/Codes/kernel/linux/stable)$ git tag --contains 22b886d
v4.4
v4.4-rc1

22b886d first appeared in 4.4-rc1

commit 22b886dd1018093920c4250dee2a9a3cb7cff7b8
Author: Tejun Heo <email address hidden>
Date: Wed Nov 4 12:15:33 2015 -0500

timers: Use proper base migration in add_timer_on()

And Wily is good:

commit 3896b1a08841c8dad99a84e58a4818b7cbd0c631
Author: Tejun Heo <email address hidden>
Date: Wed Nov 4 12:15:33 2015 -0500

timers: Use proper base migration in add_timer_on()

BugLink: http://bugs.launchpad.net/bugs/1532342

commit 22b886dd1018093920c4250dee2a9a3cb7cff7b8 upstream.

So, for now, it only affects Trusty & Vivid (EOL).

Revision history for this message

Rafael David Tinoco (rafaeldtinoco) wrote on 2016-02-18:

#10

So, Wily can be "more safe" with both: 874bbfe & 22b886d, since the upstream decision described in:

"The local CPU guarantee was accidental more than anything else and we
    want to get rid of it anyway. As, with the vmstat case fixed,
    874bbfe600a6 is causing more problems than it's fixing, it has been
    decided to take the chance and officially break the guarantee by
    reverting the commit. A debug feature will be added to force foreign
    CPU assignment to expose cases relying on the guarantee and fixes for
    the individual cases will be backported to stable as necessary.
"

Assures that removing patch 874bbfe will indeed break the "guarantee".

So, IMO, this is a (using upstream tags):

Trusty: Remove 874bbfe
Wily: Keep 874bbfe & 22b886d
Xenial: Follow upstream

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-18:

#11

I build a test kernel and made it available on a PPA[1] for verification in order to bring confidence for the SRU process.

This test kernel revert the offending commit "470ed447: workqueue: make sure delayed work run in local cpu".

Instructions
--
# Add the PPA to your system
$ sudo add-apt-repository ppa:slashd/bug1546320-hotfix

# Resynchronize the package index files from their sources
$ sudo apt-get update

# Installing the packages desired for installation
$ sudo apt-get install linux-image-3.13.0-78-generic=3.13.0-78.122hf1546320v20160218b6 -y
$ sudo apt-get install linux-headers-3.13.0-78-generic=3.13.0-78.122hf1546320v20160218b6 -y

Note: A reboot will be necessary for the hotfix kernel to be effective and taken into account by your systems.
--

[1] - https://launchpad.net/~slashd/+archive/ubuntu/bug1546320-hotfix
[2] - https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

Regards,
Eric

Eric Desrochers (slashd) on 2016-02-19

Changed in linux (Ubuntu Trusty):
assignee:	Kamal Mostafa (kamalmostafa) → Eric Desrochers (slashd)

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-19:

#12

Here's a positive feedback by someone from the community about the trusty testfix kernel with commit 470ed447 reverted that I have provided yesterday:

"I am able to reproduce the kernel panic consistently courtesy of the wqthrash kernel module on this LKML post: https://lkml.org/lkml/2015/11/3/582

Building and inserting this module reliably causes an instantaneous kernel panic on -76 and -77 for both physical and virtual machines, so long as more than one CPU is present. It did not cause a kernel panic on -61 or the hotfixed -78 kernel from the PPA."

penalvch (penalvch) on 2016-02-21

Changed in linux (Ubuntu):
status:	Confirmed → Triaged

Brad Figg (brad-figg) on 2016-02-22

no longer affects:

linux (Ubuntu Wily)

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-22:

#13

Rectification about the hotfix instruction procedure on comment #11.

Instructions
--
# Add the PPA to your system
$ sudo add-apt-repository ppa:slashd/bug1546320-hotfix

# Resynchronize the package index files from their sources
$ sudo apt-get update

# Installing the packages desired for installation
$ sudo apt-get install linux-image-3.13.0-78-generic=3.13.0-78.122hf1546320v20160218b6 -y
$ sudo apt-get install linux-headers-3.13.0-78-generic=3.13.0-78.122hf1546320v20160218b6 -y
$ sudo apt-get install linux-image-extra-3.13.0-78-generic=3.13.0-78.122hf1546320v20160218b6 -y

Note: A reboot will be necessary for the hotfix kernel to be effective and taken into account by your systems.
--

Eric

Brad Figg (brad-figg) on 2016-02-22

Changed in linux (Ubuntu Trusty):
status:	In Progress → Fix Committed
Changed in linux (Ubuntu Vivid):
status:	In Progress → Fix Committed
no longer affects:	linux-lts-utopic (Ubuntu Vivid)
Changed in linux-lts-utopic (Ubuntu Trusty):
status:	New → Fix Committed
Changed in linux-lts-utopic (Ubuntu):
status:	New → Invalid

Revision history for this message

Eric Desrochers (slashd) wrote on 2016-02-22:

#14

It also been brought to my attention the following about the hotfix kernel:

--
Hi Eric,

We have applied the update from your PPA to the controller nodes and they have been stable over the weekend. We will see if they remain stable under load over the rest of the week.

Thanks
--

Eric

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-25:

#15

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-trusty
tags:	added: verification-needed-vivid

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-25:

#16

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Eric Desrochers (slashd) on 2016-02-25

tags:

added: verification-done-trusty
removed: verification-needed-trusty

Eric Desrochers (slashd) on 2016-03-02

tags:

added: verification-done-vivid
removed: verification-needed-vivid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-03-14:

#17

Download full text (21.3 KiB)

This bug was fixed in the package linux - 3.19.0-56.62

---------------
linux (3.19.0-56.62) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555832

[ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.19.0-55.61) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1554708

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
- LP: #1554608

linux (3.19.0-54.60) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1552337

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
- LP: #1551419

linux (3.19.0-53.59) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1550576

[ Kamal Mostafa ]

* Merged back 3.19.0-52.58

linux (3.19.0-52.58) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1548548

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
- LP: #1505564

[ Upstream Kernel Changes ]

  * Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1542457
  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * net: ipmr: fix static mfc/dev leaks on table destruction
    - LP: #1542457
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1542457
  * ovl: allow zero size xattr
    - LP: #1542457
  * ovl: use a minimal buffer in ovl_copy_xattr
    - LP: #1542457
  * [media] vb2: fix a regression in poll() behavior for output,streams
    - LP: #1542457
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542457
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542457
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542457
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1542457
  * KVM: x86: correctly print #AC in traces
    - LP: #1542457
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542457
  * xhci: refuse loading if nousb is used
    - LP: #1542457
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542457
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542457
  * ovl: root: copy attr
    - LP: #1542457
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1542457
  * rtlwifi: fix memory leak for USB device
    - LP: #1542457
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542457
  * ovl: check dentry positiveness in ovl_cleanup_whiteouts()
    - LP: #1542457
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542457
  * EDAC: Robustify workqueues destruction
    - LP: #1542457
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1542457
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542457
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542457
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542457
  * dm thi...

This bug was fixed in the package linux - 3.19.0-56.62

---------------
linux (3.19.0-56.62) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555832

[ Florian Westphal ]

* SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.19.0-55.61) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1554708

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608

linux (3.19.0-54.60) vivid; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1552337

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419

linux (3.19.0-53.59) vivid; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1550576

[ Kamal Mostafa ]

* Merged back 3.19.0-52.58

linux (3.19.0-52.58) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1548548

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

[ Upstream Kernel Changes ]

* Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1542457
  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * net: ipmr: fix static mfc/dev leaks on table destruction
    - LP: #1542457
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1542457
  * ovl: allow zero size xattr
    - LP: #1542457
  * ovl: use a minimal buffer in ovl_copy_xattr
    - LP: #1542457
  * [media] vb2: fix a regression in poll() behavior for output,streams
    - LP: #1542457
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542457
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542457
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542457
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1542457
  * KVM: x86: correctly print #AC in traces
    - LP: #1542457
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542457
  * xhci: refuse loading if nousb is used
    - LP: #1542457
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542457
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542457
  * ovl: root: copy attr
    - LP: #1542457
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1542457
  * rtlwifi: fix memory leak for USB device
    - LP: #1542457
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542457
  * ovl: check dentry positiveness in ovl_cleanup_whiteouts()
    - LP: #1542457
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542457
  * EDAC: Robustify workqueues destruction
    - LP: #1542457
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1542457
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542457
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542457
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542457
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542457
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542457
  * arm64: mdscr_el1: avoid exposing DCC to userspace
    - LP: #1542457
  * arm64: kernel: enforce pmuserenr_el0 initialization and restore
    - LP: #1542457
  * drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr
    - LP: #1542457
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542457
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542457
  * mmc: sdhci: Fix DMA descriptor with zero data length
    - LP: #1542457
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542457
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542457
  * [media] rc: sunxi-cir: Initialize the spinlock properly
    - LP: #1542457
  * nfs: Fix race in __update_open_stateid()
    - LP: #1542457
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1542457
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1542457
  * NFS: Ensure we revalidate attributes before using execute_ok()
    - LP: #1542457
  * Thermal: initialize thermal zone device correctly
    - LP: #1542457
  * Thermal: handle thermal zone device properly during system sleep
    - LP: #1542457
  * Thermal: do thermal zone update after a cooling device registered
    - LP: #1542457
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1542457
  * rtlwifi: rtl8723be: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8723ae: Fix initialization of module parameters
    - LP: #1542457
  * rtlwifi: rtl8821ae: Fix errors in parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8188ee: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1542457
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1542457
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1542457
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1542457
  * NFS: Fix attribute cache revalidation
    - LP: #1542457
  * rtlwifi: rtl_pci: Fix kernel panic
    - LP: #1542457
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1542457
  * bcache: Add a cond_resched() call to gc
    - LP: #1542457
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1542457
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1542457
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1542457
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1542457
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1542457
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1542457
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1542457
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1542457
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1542457
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1542457
  * udf: Check output buffer length when converting name to CS0
    - LP: #1542457
  * drm/dp/mst: process broadcast messages correctly
    - LP: #1542457
  * drm/dp/mst: always send reply for UP request
    - LP: #1542457
  * drm/dp/mst: fix in MSTB RAD initialization
    - LP: #1542457
  * drm/dp/mst: fix in RAD element access
    - LP: #1542457
  * PCI: Fix minimum allocation address overwrite
    - LP: #1542457
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1542457
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1542457
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1542457
  * ASoC: compress: Fix compress device direction check
    - LP: #1542457
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1542457
  * uml: fix hostfs mknod()
    - LP: #1542457
  * uml: flush stdout before forking
    - LP: #1542457
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1542457
  * ALSA: usb: Add native DSD support for Oppo HA-1
    - LP: #1542457
  * ALSA: hda - Fixup inverted internal mic for Lenovo E50-80
    - LP: #1529624, #1542457
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1542457
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1542457
  * s390: fix normalization bug in exception table sorting
    - LP: #1542457
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1542457
  * xfs: handle dquot buffer readahead in log recovery correctly
    - LP: #1542457
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1542457
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1542457
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1542457
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1542457
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1542457
  * virtio_balloon: fix race by fill and leak
    - LP: #1542457
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1542457
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1542457
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1542457
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1542457
  * ALSA: hda - fix the headset mic detection problem for a Dell laptop
    - LP: #1533461, #1542457
  * ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices
    - LP: #1542457
  * drm/i915: intel_hpd_init(): Fix suspend/resume reprobing
    - LP: #1542457
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1542457
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1542457
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1542457
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1542457
  * mmc: mmci: fix an ages old detection error
    - LP: #1542457
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1542457
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1542457
  * cifs: Ratelimit kernel log messages
    - LP: #1542457
  * cifs: fix race between call_async() and reconnect()
    - LP: #1542457
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1542457
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1542457
  * dma-debug: switch check from _text to _stext
    - LP: #1542457
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1542457
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1542457
  * ALSA: timer: Harden slave timer list handling
    - LP: #1542457
  * zram/zcomp: use GFP_NOIO to allocate streams
    - LP: #1542457
  * zram: try vmalloc() after kmalloc()
    - LP: #1542457
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1542457
  * memcg: only free spare array when readers are done
    - LP: #1542457
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1542457
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1542457
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1542457
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1542457
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1542457
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1542457
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1542457
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1542457
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1542457
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1542457
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1542457
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1542457
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1542457
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1542457
  * ARM: debug-ll: fix BCM63xx entry for multiplatform
    - LP: #1542457
  * xfs: log mount failures don't wait for buffers to be released
    - LP: #1542457
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1542457
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1542457
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1542457
  * IB/qib: Support creating qps with GFP_NOIO flag
    - LP: #1542457
  * ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list
    - LP: #1542457
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1542457
  * ALSA: hda - Flush the pending probe work at remove
    - LP: #1542457
  * ALSA: timer: Handle disconnection more safely
    - LP: #1542457
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1542457
  * MAINTAINERS: return arch/sh to maintained state, with new maintainers
    - LP: #1542457
  * ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
    - LP: #1542457
  * drm/i915: On fb alloc failure, unref gem object where it gets refed
    - LP: #1542457
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1542457
  * SCSI: initio: remove duplicate module device table
    - LP: #1542457
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1542457
  * clk: st: avoid uninitialized variable use
    - LP: #1542457
  * ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
    - LP: #1542457
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1542457
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1542457
  * mtd: nand: denali: add missing nand_release() call in denali_remove()
    - LP: #1542457
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1542457
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1542457
  * mmc: sdhci: restore behavior when setting VDD via external regulator
    - LP: #1542457
  * x86/LDT: Print the real LDT base address
    - LP: #1542457
  * sysrq: Fix warning in sysrq generated crash.
    - LP: #1542457
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1542457
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1542457
  * power: test_power: correctly handle empty writes
    - LP: #1542457
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1542457
  * target: Fix a memory leak in target_dev_lba_map_store()
    - LP: #1542457
  * m68k/atari, m68k/sun3: Fix SCSI platform device registration when
    driver is modular
    - LP: #1542457
  * um: Fix build error and kconfig for i386
    - LP: #1542457
  * kbuild: Demote 'sign-compare' warning to W=2
    - LP: #1542457
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1542457
  * net: tcp_memcontrol: properly detect ancestor socket pressure
    - LP: #1542457
  * vmstat: make vmstat_updater deferrable again and shut down on idle
    - LP: #1542457
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1542457
  * btrfs: initialize the seq counter in struct btrfs_device
    - LP: #1542457
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1542457
  * ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
    - LP: #1542457
  * mmc: debugfs: correct wrong voltage value
    - LP: #1542457
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1542457
  * net/mlx4: Remove unused macro
    - LP: #1542457
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1542457
  * net: cdc_ncm: avoid changing RX/TX buffers on MTU changes
    - LP: #1542457
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1542457
  * connector: bump skb->users before callback invocation
    - LP: #1542457
  * unix: properly account for FDs passed over unix sockets
    - LP: #1542457
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1542457
  * vxlan: fix test which detect duplicate vxlan iface
    - LP: #1542457
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1542457
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1542457
  * udp: disallow UFO for sockets with SO_NO_CHECK option
    - LP: #1542457
  * net: preserve IP control block during GSO segmentation
    - LP: #1542457
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1542457
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1542457
  * net: bpf: reject invalid shifts
    - LP: #1542457
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1542457
  * bridge: fix lockdep addr_list_lock false positive splat
    - LP: #1542457
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1542457
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1542457
  * batman-adv: Drop immediate batadv_orig_ifinfo free function
    - LP: #1542457
  * batman-adv: Drop immediate batadv_neigh_node free function
    - LP: #1542457
  * batman-adv: Drop immediate neigh_ifinfo free function
    - LP: #1542457
  * batman-adv: Drop immediate batadv_hard_iface free function
    - LP: #1542457
  * batman-adv: Drop immediate orig_node free function
    - LP: #1542457
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1542457
  * sctp: Prevent soft lockup when sctp_accept() is called during a timeout
    event
    - LP: #1542457
  * xen-netback: respect user provided max_queues
    - LP: #1542457
  * xen-netfront: respect user provided max_queues
    - LP: #1542457
  * xen-netfront: update num_queues to real created
    - LP: #1542457
  * Linux 3.19.8-ckt14
    - LP: #1542457
  * x86/xen/p2m: hint at the last populated P2M entry
    - LP: #1542941
  * qeth: initialize net_device with carrier off
    - LP: #1541907
  * HID: i2c-hid: Prevent sending reports from racing with device reset
    - LP: #1535513
  * iio: adis_buffer: Fix out-of-bounds memory access
    - LP: #1546183
  * KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
    - LP: #1546183
  * KVM: PPC: Fix ONE_REG AltiVec support
    - LP: #1546183
  * x86/irq: Call chip->irq_set_affinity in proper context
    - LP: #1546183
  * ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist"
    - LP: #1546183
  * ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot()
    - LP: #1546183
  * usb: cdc-acm: handle unlinked urb in acm read callback
    - LP: #1546183
  * usb: cdc-acm: send zero packet for intel 7260 modem
    - LP: #1546183
  * cdc-acm:exclude Samsung phone 04e8:685d
    - LP: #1546183
  * usb: hub: do not clear BOS field during reset device
    - LP: #1546183
  * USB: cp210x: add ID for IAI USB to RS485 adaptor
    - LP: #1546183
  * USB: visor: fix null-deref at probe
    - LP: #1546183
  * USB: serial: visor: fix crash on detecting device without write_urbs
    - LP: #1546183
  * USB: serial: option: Adding support for Telit LE922
    - LP: #1546183
  * ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
    - LP: #1546183
  * ALSA: seq: Degrade the error message for too many opens
    - LP: #1546183
  * USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
    - LP: #1546183
  * arm64: kernel: fix architected PMU registers unconditional access
    - LP: #1546183
  * USB: option: fix Cinterion AHxx enumeration
    - LP: #1546183
  * ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
    - LP: #1546183
  * ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
    - LP: #1546183
  * ALSA: bebob: Use a signed return type for get_formation_index
    - LP: #1546183
  * arm64: errata: Add -mpc-relative-literal-loads to build flags
    - LP: #1533009, #1546183
  * arm64: mm: avoid calling apply_to_page_range on empty range
    - LP: #1546183
  * x86/mm: Fix types used in pgprot cacheability flags translations
    - LP: #1546183
  * powerpc/eeh: Fix PE location code
    - LP: #1546183
  * SCSI: fix crashes in sd and sr runtime PM
    - LP: #1546183
  * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
    - LP: #1546183
  * n_tty: Fix unsafe reference to "other" ldisc
    - LP: #1546183
  * staging/speakup: Use tty_ldisc_ref() for paste kworker
    - LP: #1546183
  * irqchip/atmel-aic: Fix wrong bit operation for IRQ priority
    - LP: #1546183
  * seccomp: always propagate NO_NEW_PRIVS on tsync
    - LP: #1546183
  * ALSA: dummy: Disable switching timer backend via sysfs
    - LP: #1546183
  * drm/vmwgfx: respect 'nomodeset'
    - LP: #1546183
  * Staging: speakup: Fix getting port information
    - LP: #1546183
  * x86/mm/pat: Avoid truncation when converting cpa->numpages to address
    - LP: #1546183
  * serial: 8250_pci: Add Intel Broadwell ports
    - LP: #1546183
  * perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    - LP: #1546183
  * perf hists: Fix HISTC_MEM_DCACHELINE width setting
    - LP: #1546183
  * powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
    - LP: #1546183
  * [media] usbvision fix overflow of interfaces array
    - LP: #1546183
  * [media] usbvision: fix leak of usb_dev on failure paths in
    usbvision_probe()
    - LP: #1546183
  * [media] usbvision: fix crash on detecting device with invalid
    configuration
    - LP: #1546183
  * ASN.1: Fix non-match detection failure on data overrun
    - LP: #1546183
  * Linux 3.19.8-ckt15
    - LP: #1546183
  * netfilter: bridge: don't use nf_bridge_info data to store mac header
    - LP: #1463911
  * netfilter: bridge: restore vlan tag when refragmenting
    - LP: #1463911
  * netfilter: bridge: forward IPv6 fragmented packets
    - LP: #1463911
  * netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in
    br_validate_ipv6
    - LP: #1463911
  * mwifiex: remove USB8897 chipset support
    - LP: #1494593
  * ALSA: usb-audio: avoid freeing umidi object twice
    - LP: #1546177
    - CVE-2016-2384
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1546320

-- Brad Figg <brad.figg@canonical.com>  Thu, 10 Mar 2016 14:11:41 -0800

Changed in linux (Ubuntu Vivid):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-03-14:

#18

Download full text (14.5 KiB)

This bug was fixed in the package linux - 3.13.0-83.127

---------------
linux (3.13.0-83.127) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555839

[ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.13.0-82.126) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1554732

[ Upstream Kernel Changes ]

  * Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608
  * net: generic dev_disable_lro() stacked device handling
    - LP: #1547680

linux (3.13.0-81.125) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1552316

[ Upstream Kernel Changes ]

  * Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419
  * bcache: Fix a lockdep splat in an error path
    - LP: #1551327

linux (3.13.0-80.124) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1548519

[ Andy Whitcroft ]

  * [Debian] hv: hv_set_ifconfig -- convert to python3
    - LP: #1506521
  * [Debian] hv: hv_set_ifconfig -- switch to approved indentation
    - LP: #1540586
  * [Debian] hv: hv_set_ifconfig -- fix numerous parameter handling issues
    - LP: #1540586

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
- LP: #1505564

[ Upstream Kernel Changes ]

  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542497
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542497
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542497
  * KVM: x86: correctly print #AC in traces
    - LP: #1542497
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542497
  * xhci: refuse loading if nousb is used
    - LP: #1542497
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542497
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542497
  * rtlwifi: fix memory leak for USB device
    - LP: #1542497
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542497
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542497
  * EDAC: Don't try to cancel workqueue when it's never setup
    - LP: #1542497
  * EDAC: Robustify workqueues destruction
    - LP: #1542497
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542497
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542497
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542497
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542497
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542497
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542497
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542497
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542497
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542497
  * nfs: Fix race in __update_open_stateid...

This bug was fixed in the package linux - 3.13.0-83.127

---------------
linux (3.13.0-83.127) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555839

[ Florian Westphal ]

* SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.13.0-82.126) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1554732

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608
  * net: generic dev_disable_lro() stacked device handling
    - LP: #1547680

linux (3.13.0-81.125) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1552316

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419
  * bcache: Fix a lockdep splat in an error path
    - LP: #1551327

linux (3.13.0-80.124) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1548519

[ Andy Whitcroft ]

* [Debian] hv: hv_set_ifconfig -- convert to python3
    - LP: #1506521
  * [Debian] hv: hv_set_ifconfig -- switch to approved indentation
    - LP: #1540586
  * [Debian] hv: hv_set_ifconfig -- fix numerous parameter handling issues
    - LP: #1540586

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

[ Upstream Kernel Changes ]

* Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542497
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542497
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542497
  * KVM: x86: correctly print #AC in traces
    - LP: #1542497
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542497
  * xhci: refuse loading if nousb is used
    - LP: #1542497
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542497
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542497
  * rtlwifi: fix memory leak for USB device
    - LP: #1542497
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542497
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542497
  * EDAC: Don't try to cancel workqueue when it's never setup
    - LP: #1542497
  * EDAC: Robustify workqueues destruction
    - LP: #1542497
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542497
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542497
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542497
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542497
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542497
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542497
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542497
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542497
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542497
  * nfs: Fix race in __update_open_stateid()
    - LP: #1542497
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1542497
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1542497
  * NFS: Fix attribute cache revalidation
    - LP: #1542497
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1542497
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1542497
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1542497
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1542497
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1542497
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1542497
  * bcache: Add a cond_resched() call to gc
    - LP: #1542497
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1542497
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1542497
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1542497
  * bcache: add mutex lock for bch_is_open
    - LP: #1542497
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1542497
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1542497
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1542497
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1542497
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1542497
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1542497
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1542497
  * udf: Check output buffer length when converting name to CS0
    - LP: #1542497
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1542497
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1542497
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1542497
  * ASoC: compress: Fix compress device direction check
    - LP: #1542497
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1542497
  * uml: fix hostfs mknod()
    - LP: #1542497
  * uml: flush stdout before forking
    - LP: #1542497
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1542497
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1542497
  * s390: fix normalization bug in exception table sorting
    - LP: #1542497
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1542497
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1542497
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1542497
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1542497
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1542497
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1542497
  * virtio_balloon: fix race by fill and leak
    - LP: #1542497
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1542497
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1542497
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1542497
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1542497
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1542497
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1542497
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1542497
  * mmc: mmci: fix an ages old detection error
    - LP: #1542497
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1542497
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1542497
  * cifs: Ratelimit kernel log messages
    - LP: #1542497
  * cifs: fix race between call_async() and reconnect()
    - LP: #1542497
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1542497
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1542497
  * dma-debug: switch check from _text to _stext
    - LP: #1542497
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1542497
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1542497
  * ALSA: timer: Harden slave timer list handling
    - LP: #1542497
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1542497
  * memcg: only free spare array when readers are done
    - LP: #1542497
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1542497
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1542497
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1542497
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1542497
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1542497
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1542497
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1542497
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1542497
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1542497
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1542497
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1542497
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1542497
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1542497
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1542497
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1542497
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1542497
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1542497
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1542497
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1542497
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1542497
  * SCSI: initio: remove duplicate module device table
    - LP: #1542497
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1542497
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1542497
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1542497
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1542497
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1542497
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1542497
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1542497
  * power: test_power: correctly handle empty writes
    - LP: #1542497
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1542497
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1542497
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1542497
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1542497
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1542497
  * batman-adv: Drop immediate orig_node free function
    - LP: #1542497
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1542497
  * mmc: debugfs: correct wrong voltage value
    - LP: #1542497
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1542497
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1542497
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1542497
  * connector: bump skb->users before callback invocation
    - LP: #1542497
  * unix: properly account for FDs passed over unix sockets
    - LP: #1542497
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1542497
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1542497
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1542497
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1542497
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1542497
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1542497
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1542497
  * Linux 3.13.11-ckt34
    - LP: #1542497
  * qeth: initialize net_device with carrier off
    - LP: #1541907
  * umount: Do not allow unmounting rootfs.
    - LP: #1541313
  * [media] usbvision fix overflow of interfaces array
    - LP: #1546273
  * [media] usbvision: fix leak of usb_dev on failure paths in
    usbvision_probe()
    - LP: #1546273
  * [media] usbvision: fix crash on detecting device with invalid
    configuration
    - LP: #1546273
  * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
    - LP: #1546273
  * USB: serial: visor: fix crash on detecting device without write_urbs
    - LP: #1546273
  * ASN.1: Fix non-match detection failure on data overrun
    - LP: #1546273
  * iio: adis_buffer: Fix out-of-bounds memory access
    - LP: #1546273
  * x86/irq: Call chip->irq_set_affinity in proper context
    - LP: #1546273
  * usb: cdc-acm: handle unlinked urb in acm read callback
    - LP: #1546273
  * usb: cdc-acm: send zero packet for intel 7260 modem
    - LP: #1546273
  * cdc-acm:exclude Samsung phone 04e8:685d
    - LP: #1546273
  * usb: hub: do not clear BOS field during reset device
    - LP: #1546273
  * USB: cp210x: add ID for IAI USB to RS485 adaptor
    - LP: #1546273
  * USB: visor: fix null-deref at probe
    - LP: #1546273
  * USB: serial: option: Adding support for Telit LE922
    - LP: #1546273
  * ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
    - LP: #1546273
  * ALSA: seq: Degrade the error message for too many opens
    - LP: #1546273
  * USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
    - LP: #1546273
  * USB: option: fix Cinterion AHxx enumeration
    - LP: #1546273
  * ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
    - LP: #1546273
  * ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
    - LP: #1546273
  * arm64: errata: Add -mpc-relative-literal-loads to build flags
    - LP: #1533009, #1546273
  * SCSI: fix crashes in sd and sr runtime PM
    - LP: #1546273
  * n_tty: Fix unsafe reference to "other" ldisc
    - LP: #1546273
  * ALSA: dummy: Disable switching timer backend via sysfs
    - LP: #1546273
  * drm/vmwgfx: respect 'nomodeset'
    - LP: #1546273
  * x86/mm/pat: Avoid truncation when converting cpa->numpages to address
    - LP: #1546273
  * perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    - LP: #1546273
  * powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
    - LP: #1546273
  * Linux 3.13.11-ckt35
    - LP: #1546273
  * netfilter: bridge: don't use nf_bridge_info data to store mac header
    - LP: #1463911
  * netfilter: bridge: restore vlan tag when refragmenting
    - LP: #1463911
  * netfilter: bridge: forward IPv6 fragmented packets
    - LP: #1463911
  * netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in
    br_validate_ipv6
    - LP: #1463911
  * ALSA: usb-audio: avoid freeing umidi object twice
    - LP: #1546177
    - CVE-2016-2384
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1546320

-- Brad Figg <brad.figg@canonical.com>  Thu, 10 Mar 2016 14:41:56 -0800

Changed in linux (Ubuntu Trusty):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-03-14:

#19

Download full text (15.5 KiB)

This bug was fixed in the package linux-lts-utopic - 3.16.0-67.87~14.04.1

---------------
linux-lts-utopic (3.16.0-67.87~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555847

[ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux-lts-utopic (3.16.0-66.86~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1555277

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
- LP: #1554608

linux-lts-utopic (3.16.0-65.85~14.04.1) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1552352

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
- LP: #1551419

linux-lts-utopic (3.16.0-64.84~14.04.1) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
- LP: #1550605

[ Kamal Mostafa ]

* Merged back 3.16.0-63.83~14.04.1

linux-lts-utopic (3.16.0-63.83~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1548934

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
- LP: #1505564

[ Upstream Kernel Changes ]

  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1543126
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1543126
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1543126
  * connector: bump skb->users before callback invocation
    - LP: #1543126
  * unix: properly account for FDs passed over unix sockets
    - LP: #1543126
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1543126
  * vxlan: fix test which detect duplicate vxlan iface
    - LP: #1543126
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1543126
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1543126
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1543126
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1543126
  * net: bpf: reject invalid shifts
    - LP: #1543126
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1543126
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1543126
  * xen-netback: respect user provided max_queues
    - LP: #1543126
  * xen-netfront: respect user provided max_queues
    - LP: #1543126
  * xen-netfront: print correct number of queues
    - LP: #1543126
  * xen-netfront: update num_queues to real created
    - LP: #1543126
  * sctp: Prevent soft lockup when sctp_accept() is called during a timeout
    event
    - LP: #1543126
  * sctp: convert sack_needed and sack_generation to bits
    - LP: #1543126
  * sctp: start t5 timer only when peer rwnd is 0 and local state is
    SHUTDOWN_PENDING
    - LP: #1543126
  * nfs: Fix unused variable error
    - LP: #1543126
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1543126
  * [me...

This bug was fixed in the package linux-lts-utopic - 3.16.0-67.87~14.04.1

---------------
linux-lts-utopic (3.16.0-67.87~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555847

[ Florian Westphal ]

* SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux-lts-utopic (3.16.0-66.86~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1555277

[ Upstream Kernel Changes ]

* Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608

linux-lts-utopic (3.16.0-65.85~14.04.1) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1552352

[ Upstream Kernel Changes ]

* Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419

linux-lts-utopic (3.16.0-64.84~14.04.1) trusty; urgency=low

[ Kamal Mostafa ]

* Release Tracking Bug
    - LP: #1550605

[ Kamal Mostafa ]

* Merged back 3.16.0-63.83~14.04.1

linux-lts-utopic (3.16.0-63.83~14.04.1) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1548934

[ Dan Streetman ]

* SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

[ Upstream Kernel Changes ]

* Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1543126
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1543126
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1543126
  * connector: bump skb->users before callback invocation
    - LP: #1543126
  * unix: properly account for FDs passed over unix sockets
    - LP: #1543126
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1543126
  * vxlan: fix test which detect duplicate vxlan iface
    - LP: #1543126
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1543126
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1543126
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1543126
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1543126
  * net: bpf: reject invalid shifts
    - LP: #1543126
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1543126
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1543126
  * xen-netback: respect user provided max_queues
    - LP: #1543126
  * xen-netfront: respect user provided max_queues
    - LP: #1543126
  * xen-netfront: print correct number of queues
    - LP: #1543126
  * xen-netfront: update num_queues to real created
    - LP: #1543126
  * sctp: Prevent soft lockup when sctp_accept() is called during a timeout
    event
    - LP: #1543126
  * sctp: convert sack_needed and sack_generation to bits
    - LP: #1543126
  * sctp: start t5 timer only when peer rwnd is 0 and local state is
    SHUTDOWN_PENDING
    - LP: #1543126
  * nfs: Fix unused variable error
    - LP: #1543126
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1543126
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1543126
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1543126
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1543126
  * KVM: x86: correctly print #AC in traces
    - LP: #1543126
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1543126
  * xhci: refuse loading if nousb is used
    - LP: #1543126
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1543126
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1543126
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1543126
  * rtlwifi: fix memory leak for USB device
    - LP: #1543126
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1543126
  * EDAC: Fix the leak of mci->bus->name when bus_register fails
    - LP: #1543126
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1543126
  * EDAC: Robustify workqueues destruction
    - LP: #1543126
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1543126
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1543126
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1543126
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1543126
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1543126
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1543126
  * arm64: mdscr_el1: avoid exposing DCC to userspace
    - LP: #1543126
  * arm64: kernel: enforce pmuserenr_el0 initialization and restore
    - LP: #1543126
  * drm/radeon: clean up fujitsu quirks
    - LP: #1543126
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1543126
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1543126
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1543126
  * nfs: Fix race in __update_open_stateid()
    - LP: #1543126
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1543126
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1543126
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1543126
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1543126
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1543126
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1543126
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1543126
  * NFS: Fix attribute cache revalidation
    - LP: #1543126
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1543126
  * bcache: Add a cond_resched() call to gc
    - LP: #1543126
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1543126
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1543126
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1543126
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1543126
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1543126
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1543126
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1543126
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1543126
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1543126
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1543126
  * udf: Check output buffer length when converting name to CS0
    - LP: #1543126
  * PCI: Fix minimum allocation address overwrite
    - LP: #1543126
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1543126
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1543126
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1543126
  * ASoC: compress: Fix compress device direction check
    - LP: #1543126
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1543126
  * uml: fix hostfs mknod()
    - LP: #1543126
  * uml: flush stdout before forking
    - LP: #1543126
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1543126
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1543126
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1543126
  * s390: fix normalization bug in exception table sorting
    - LP: #1543126
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1543126
  * xfs: handle dquot buffer readahead in log recovery correctly
    - LP: #1543126
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1543126
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1543126
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1543126
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1543126
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1543126
  * virtio_balloon: fix race by fill and leak
    - LP: #1543126
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1543126
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1543126
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1543126
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1543126
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1543126
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1543126
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1543126
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1543126
  * mmc: mmci: fix an ages old detection error
    - LP: #1543126
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1543126
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1543126
  * cifs: fix race between call_async() and reconnect()
    - LP: #1543126
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1543126
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1543126
  * dma-debug: switch check from _text to _stext
    - LP: #1543126
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1543126
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1543126
  * ALSA: timer: Harden slave timer list handling
    - LP: #1543126
  * zram/zcomp: use GFP_NOIO to allocate streams
    - LP: #1543126
  * zram: try vmalloc() after kmalloc()
    - LP: #1543126
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1543126
  * memcg: only free spare array when readers are done
    - LP: #1543126
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1543126
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1543126
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1543126
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1543126
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1543126
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1543126
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1543126
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1543126
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1543126
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1543126
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1543126
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1543126
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1543126
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1543126
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1543126
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1543126
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1543126
  * IB/qib: Support creating qps with GFP_NOIO flag
    - LP: #1543126
  * ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list
    - LP: #1543126
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1543126
  * ALSA: timer: Handle disconnection more safely
    - LP: #1543126
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1543126
  * MAINTAINERS: return arch/sh to maintained state, with new maintainers
    - LP: #1543126
  * ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
    - LP: #1543126
  * drm/i915: avoid deadlock on failure paths in
    __intel_framebuffer_create()
    - LP: #1543126
  * drm/i915: On fb alloc failure, unref gem object where it gets refed
    - LP: #1543126
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1543126
  * SCSI: initio: remove duplicate module device table
    - LP: #1543126
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1543126
  * clk: st: avoid uninitialized variable use
    - LP: #1543126
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1543126
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1543126
  * mtd: nand: denali: add missing nand_release() call in denali_remove()
    - LP: #1543126
  * mtd: nand: remove unused and buggy get_platform_nandchip() helper
    function
    - LP: #1543126
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1543126
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1543126
  * x86/LDT: Print the real LDT base address
    - LP: #1543126
  * sysrq: Fix warning in sysrq generated crash.
    - LP: #1543126
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1543126
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1543126
  * power: test_power: correctly handle empty writes
    - LP: #1543126
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1543126
  * target: Fix a memory leak in target_dev_lba_map_store()
    - LP: #1543126
  * um: Fix build error and kconfig for i386
    - LP: #1543126
  * ipv6: tcp: add rcu locking in tcp_v6_send_synack()
    - LP: #1543126
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1543126
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1543126
  * bridge: fix lockdep addr_list_lock false positive splat
    - LP: #1543126
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1543126
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1543126
  * batman-adv: fix potential TT client + orig-node memory leak
    - LP: #1543126
  * batman-adv: Drop immediate batadv_orig_ifinfo free function
    - LP: #1543126
  * batman-adv: Drop immediate batadv_neigh_node free function
    - LP: #1543126
  * batman-adv: Drop immediate neigh_ifinfo free function
    - LP: #1543126
  * batman-adv: Drop immediate batadv_hard_iface free function
    - LP: #1543126
  * batman-adv: Drop immediate orig_node free function
    - LP: #1543126
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1543126
  * mmc: debugfs: correct wrong voltage value
    - LP: #1543126
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1543126
  * net/mlx4: Remove unused macro
    - LP: #1543126
  * arm64: fix building without CONFIG_UID16
    - LP: #1543126
  * mn10300: Select CONFIG_HAVE_UID16 to fix build failure
    - LP: #1543126
  * openrisc: fix CONFIG_UID16 setting
    - LP: #1543126
  * cifs: Ratelimit kernel log messages
    - LP: #1543126
  * HID: usbhid: fix recursive deadlock
    - LP: #1543126
  * Linux 3.16.7-ckt24
    - LP: #1543126
  * qeth: initialize net_device with carrier off
    - LP: #1541907
  * netfilter: bridge: don't use nf_bridge_info data to store mac header
    - LP: #1463911
  * netfilter: bridge: restore vlan tag when refragmenting
    - LP: #1463911
  * netfilter: bridge: forward IPv6 fragmented packets
    - LP: #1463911
  * netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in
    br_validate_ipv6
    - LP: #1463911
  * ALSA: usb-audio: avoid freeing umidi object twice
    - LP: #1546177
    - CVE-2016-2384
  * vmstat: explicitly schedule per-cpu work on the CPU we need it to run
    on
    - LP: #1546320

-- Brad Figg <brad.figg@canonical.com>  Thu, 10 Mar 2016 15:11:47 -0800

Changed in linux-lts-utopic (Ubuntu Trusty):
status:	Fix Committed → Fix Released

Eric Desrochers (slashd) on 2016-03-14

Changed in linux-lts-utopic (Ubuntu Trusty):
assignee:	nobody → Eric Desrochers (slashd)

Mathew Hodson (mhodson) on 2016-12-02

no longer affects:	linux-lts-utopic (Ubuntu)
Changed in linux (Ubuntu):
status:	Triaged → Fix Released
Changed in linux (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Trusty):
importance:	Undecided → High

Ubuntu
linux package

crash starting at kernel v3.13.0-72 in timer code

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	High	Unassigned
Trusty	Fix Released	High	Eric Desrochers
Vivid	Fix Released	High	Kamal Mostafa
linux-lts-utopic (Ubuntu)
Trusty	Fix Released	High	Eric Desrochers

Ubuntulinux package

crash starting at kernel v3.13.0-72 in timer code

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux package