Ubuntu
linux package

Zesty update to v4.10.10 stable release

Bug #1682130 reported by Tim Gardner on 2017-04-12

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux (Ubuntu)	Fix Released	Undecided	Unassigned
	Zesty	Fix Released	Undecided	Unassigned

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The v4.10.10 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

git://git.kernel.org/

TEST CASE: TBD

The following patches from the v4.10.10 stable release shall be applied:

drm/vmwgfx: Type-check lookups of fence objects
drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
drm/vmwgfx: Remove getparam error message
drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
PCI: thunder-pem: Add legacy firmware support for Cavium ThunderX host controller
PCI: thunder-pem: Fix legacy firmware PEM-specific resources
sysfs: be careful of error returns from ops->show()
staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd
iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values
iio: st_pressure: initialize lps22hb bootime
iio: bmg160: reset chip when probing
arm64: mm: unaligned access by user-land should be received as SIGBUS
cfg80211: check rdev resume callback only for registered wiphy
Reset TreeId to zero on SMB2 TREE_CONNECT
mm/page_alloc.c: fix print order in show_free_areas()
ptrace: fix PTRACE_LISTEN race corrupting task->state
dax: fix radix tree insertion race
dm verity fec: limit error correction recursion
dm verity fec: fix bufio leaks
ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
ACPI / scan: Prefer devices without _HID for _ADR matching
Kbuild: use cc-disable-warning consistently for maybe-uninitialized
jump label: fix passing kbuild_cflags when checking for asm goto support
orangefs: move features validation to fix filesystem hang
xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files
ring-buffer: Fix return value check in test_ringbuffer()
mac80211: unconditionally start new netdev queues with iTXQ support
brcmfmac: use local iftype avoiding use-after-free of virtual interface
metag/usercopy: Drop unused macros
metag/usercopy: Fix alignment error checking
metag/usercopy: Add early abort to copy_to_user
metag/usercopy: Zero rest of buffer from copy_from_user
metag/usercopy: Set flags before ADDZ
metag/usercopy: Fix src fixup in from user rapf loops
metag/usercopy: Add missing fixups
drm/msm: adreno: fix build error without debugfs
powerpc: Disable HFSCR[TM] if TM is not supported
powerpc/mm: Add missing global TLB invalidate if cxl is active
powerpc/64: Fix flush_(d|i)cache_range() called from modules
powerpc: Don't try to fix up misaligned load-with-reservation instructions
powerpc/crypto/crc32c-vpmsum: Fix missing preempt_disable()
dm raid: fix NULL pointer dereference for raid1 without bitmap
x86/mce: Don't print MCEs when mcelog is active
nios2: reserve boot memory for device tree
xtensa: make __pa work with uncached KSEG addresses
s390/decompressor: fix initrd corruption caused by bss clear
s390/uaccess: get_user() should zero on failure (again)
MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
MIPS: ralink: Fix typos in rt3883 pinctrl
MIPS: End spinlocks with .insn
MIPS: Lantiq: fix missing xbar kernel panic
MIPS: Check TLB before handle_ri_rdhwr() for Loongson-3
MIPS: Add MIPS_CPU_FTLB for Loongson-3A R2
MIPS: Flush wrong invalid FTLB entry for huge page
MIPS: c-r4k: Fix Loongson-3's vcache/scache waysize calculation
drm/i915/gvt: Fix gvt scheduler interval time
drm/i915/kvmgt: fix suspicious rcu dereference usage
usb: dwc3: gadget: delay unmap of bounced requests
Documentation: stable-kernel-rules: fix stable-tag format
mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
random: use chacha20 for get_random_int/long
kvm: fix page struct leak in handle_vmon
drm/edid: constify edid quirk list
drm/i915: fix INTEL_BDW_IDS definition
drm/i915: more .is_mobile cleanups for BDW
drm/i915: actually drive the BDW reserved IDs
ASoC: Intel: bytcr_rt5640: quirks for Insyde devices
usb: chipidea: msm: Rely on core to override AHBBURST
serial: 8250_omap: Add OMAP_DMA_TX_KICK quirk for AM437x
usb: xhci: add quirk flag for broken PED bits
usb: host: xhci-plat: enable BROKEN_PED quirk if platform requested
usb: dwc3: host: pass quirk-broken-port-ped property for known broken revisions
drm/mga: remove device_is_agp callback
PCI: Add ACS quirk for Intel Union Point
PCI: xgene: Fix double free on init error
sata: ahci-da850: implement a workaround for the softreset quirk
ACPI / button: Change default behavior to lid_init_state=open
ASoC: codecs: rt5670: add quirk for Lenovo Thinkpad 10
ASoC: Intel: Baytrail: add quirk for Lenovo Thinkpad 10
ASoC: Intel: cht_bsw_rt5645: harden ACPI device detection
ASoC: Intel: cht_bsw_rt5645: add Baytrail MCLK support
ACPI: save NVS memory for Lenovo G50-45
ASoC: sun4i-i2s: Add quirks to handle a31 compatible
HID: wacom: don't apply generic settings to old devices
arm: kernel: Add SMC structure parameter
firmware: qcom: scm: Fix interrupted SCM calls
ARM: smccc: Update HVC comment to describe new quirk parameter
PCI: Add Broadcom Northstar2 PAXC quirk for device class and MPSS
PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports
mmc: sdhci-of-esdhc: remove default broken-cd for ARM
PCI: Sort the list of devices with D3 delay quirk by ID
watchdog: s3c2410: Fix infinite interrupt in soft mode
platform/x86: asus-wmi: Detect quirk_no_rfkill from the DSDT
x86/reboot/quirks: Add ASUS EeeBook X205TA reboot quirk
x86/reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk
usb-storage: Add ignore-residue quirk for Initio INIC-3619
x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk
Linux 4.10.10

See original description

Tags:

CVE References

2017-7477

Tim Gardner (timg-tpi) on 2017-04-12

tags:	added: kernel-stable-tracking-bug
description:	updated

Thadeu Lima de Souza Cascardo (cascardo) on 2017-04-25

Changed in linux (Ubuntu Zesty):
status:	New → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-05-16:

Download full text (14.0 KiB)

This bug was fixed in the package linux - 4.10.0-21.23

---------------
linux (4.10.0-21.23) zesty; urgency=low

* linux: 4.10.0-21.23 -proposed tracker (LP: #1686414)

  * Need to stop using bzip2 compression in packages for zesty onward
    (LP: #1686782)
    - [Debian] Use default compression for all packages

  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
    (LP: #1684971)
    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain

  * CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec (LP: #1685892)
    - macsec: avoid heap overflow in skb_to_sgvec
    - macsec: dynamically allocate space for sglist

  * Zesty update to 4.10.11 stable release (LP: #1685140)
    - drm/i915: Fix forcewake active domain tracking
    - drm/i915: Move updating color management to before vblank evasion
    - drm/i915/fbdev: Stop repeating tile configuration on stagnation
    - drm/i915: Squelch any ktime/jiffie rounding errors for wait-ioctl
    - drm/i915/gen9: Increase PCODE request timeout to 50ms
    - drm/i915: Store a permanent error in obj->mm.pages
    - drm/i915: Nuke debug messages from the pipe update critical section
    - drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
    - drm/i915: Reject HDMI 12bpc if the sink doesn't indicate support
    - drm/i915: Only enable hotplug interrupts if the display interrupts are
      enabled
    - drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters.
    - drm/i915: Stop using RP_DOWN_EI on Baytrail
    - drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
    - drm/i915: Do .init_clock_gating() earlier to avoid it clobbering watermarks
    - orangefs: Dan Carpenter influenced cleanups...
    - orangefs: fix buffer size mis-match between kernel space and user space.
    - nfs: flexfiles: fix kernel OOPS if MDS returns unsupported DS type
    - rt2x00usb: fix anchor initialization
    - rt2x00usb: do not anchor rx and tx urb's
    - MIPS: Introduce irq_stack
    - MIPS: Stack unwinding while on IRQ stack
    - MIPS: Only change $28 to thread_info if coming from user mode
    - MIPS: Switch to the irq_stack in interrupts
    - MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
    - crypto: caam - fix RNG deinstantiation error checking
    - crypto: caam - fix invalid dereference in caam_rsa_init_tfm()
    - dma-buf: add support for compat ioctl
    - Linux 4.10.11

This bug was fixed in the package linux - 4.10.0-21.23

---------------
linux (4.10.0-21.23) zesty; urgency=low

* linux: 4.10.0-21.23 -proposed tracker (LP: #1686414)

* Need to stop using bzip2 compression in packages for zesty onward
    (LP: #1686782)
    - [Debian] Use default compression for all packages

* [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
    (LP: #1684971)
    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain

* CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec (LP: #1685892)
    - macsec: avoid heap overflow in skb_to_sgvec
    - macsec: dynamically allocate space for sglist

* Zesty update to v4.10.10 stable release (LP: #1682130)
    - drm/vmwgfx: Type-check lookups of fence objects
    - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
    - drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
    - drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
    - drm/vmwgfx: Remove getparam error message
    - drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
    - PCI: thunder-pem: Add legacy firmware support for Cavium ThunderX host
      controller
    - PCI: thunder-pem: Fix legacy firmware PEM-specific resources
    - sysfs: be careful of error returns from ops->show()
    - staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
    - arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
    - arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
    - kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd
    - iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values
    - iio: st_pressure: initialize lps22hb bootime
    - iio: bmg160: reset chip when probing
    - arm64: mm: unaligned access by user-land should be received as SIGBUS
    - cfg80211: check rdev resume callback only for registered wiphy
    - Reset TreeId to zero on SMB2 TREE_CONNECT
    - mm/page_alloc.c: fix print order in show_free_areas()
    - ptrace: fix PTRACE_LISTEN race corrupting task->state
    - dax: fix radix tree insertion race
    - dm verity fec: limit error correction recursion
    - dm verity fec: fix bufio leaks
    - ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
    - ACPI / scan: Prefer devices without _HID for _ADR matching
    - Kbuild: use cc-disable-warning consistently for maybe-uninitialized
    - jump label: fix passing kbuild_cflags when checking for asm goto support
    - orangefs: move features validation to fix filesystem hang
    - xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files
    - ring-buffer: Fix return value check in test_ringbuffer()
    - mac80211: unconditionally start new netdev queues with iTXQ support
    - brcmfmac: use local iftype avoiding use-after-free of virtual interface
    - metag/usercopy: Drop unused macros
    - metag/usercopy: Fix alignment error checking
    - metag/usercopy: Add early abort to copy_to_user
    - metag/usercopy: Zero rest of buffer from copy_from_user
    - metag/usercopy: Set flags before ADDZ
    - metag/usercopy: Fix src fixup in from user rapf loops
    - metag/usercopy: Add missing fixups
    - drm/msm: adreno: fix build error without debugfs
    - powerpc: Disable HFSCR[TM] if TM is not supported
    - powerpc/mm: Add missing global TLB invalidate if cxl is active
    - powerpc/64: Fix flush_(d|i)cache_range() called from modules
    - powerpc: Don't try to fix up misaligned load-with-reservation instructions
    - powerpc/crypto/crc32c-vpmsum: Fix missing preempt_disable()
    - dm raid: fix NULL pointer dereference for raid1 without bitmap
    - x86/mce: Don't print MCEs when mcelog is active
    - nios2: reserve boot memory for device tree
    - xtensa: make __pa work with uncached KSEG addresses
    - s390/decompressor: fix initrd corruption caused by bss clear
    - s390/uaccess: get_user() should zero on failure (again)
    - MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
    - MIPS: ralink: Fix typos in rt3883 pinctrl
    - MIPS: End spinlocks with .insn
    - MIPS: Lantiq: fix missing xbar kernel panic
    - MIPS: Check TLB before handle_ri_rdhwr() for Loongson-3
    - MIPS: Add MIPS_CPU_FTLB for Loongson-3A R2
    - MIPS: Flush wrong invalid FTLB entry for huge page
    - MIPS: c-r4k: Fix Loongson-3's vcache/scache waysize calculation
    - drm/i915/gvt: Fix gvt scheduler interval time
    - drm/i915/kvmgt: fix suspicious rcu dereference usage
    - usb: dwc3: gadget: delay unmap of bounced requests
    - Documentation: stable-kernel-rules: fix stable-tag format
    - mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
    - random: use chacha20 for get_random_int/long
    - kvm: fix page struct leak in handle_vmon
    - drm/edid: constify edid quirk list
    - drm/i915: fix INTEL_BDW_IDS definition
    - drm/i915: more .is_mobile cleanups for BDW
    - drm/i915: actually drive the BDW reserved IDs
    - ASoC: Intel: bytcr_rt5640: quirks for Insyde devices
    - usb: chipidea: msm: Rely on core to override AHBBURST
    - serial: 8250_omap: Add OMAP_DMA_TX_KICK quirk for AM437x
    - usb: xhci: add quirk flag for broken PED bits
    - usb: host: xhci-plat: enable BROKEN_PED quirk if platform requested
    - usb: dwc3: host: pass quirk-broken-port-ped property for known broken
      revisions
    - drm/mga: remove device_is_agp callback
    - PCI: Add ACS quirk for Intel Union Point
    - PCI: xgene: Fix double free on init error
    - sata: ahci-da850: implement a workaround for the softreset quirk
    - ACPI / button: Change default behavior to lid_init_state=open
    - ASoC: codecs: rt5670: add quirk for Lenovo Thinkpad 10
    - ASoC: Intel: Baytrail: add quirk for Lenovo Thinkpad 10
    - ASoC: Intel: cht_bsw_rt5645: harden ACPI device detection
    - ASoC: Intel: cht_bsw_rt5645: add Baytrail MCLK support
    - ACPI: save NVS memory for Lenovo G50-45
    - ASoC: sun4i-i2s: Add quirks to handle a31 compatible
    - HID: wacom: don't apply generic settings to old devices
    - arm: kernel: Add SMC structure parameter
    - firmware: qcom: scm: Fix interrupted SCM calls
    - ARM: smccc: Update HVC comment to describe new quirk parameter
    - PCI: Add Broadcom Northstar2 PAXC quirk for device class and MPSS
    - PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports
    - mmc: sdhci-of-esdhc: remove default broken-cd for ARM
    - PCI: Sort the list of devices with D3 delay quirk by ID
    - watchdog: s3c2410: Fix infinite interrupt in soft mode
    - platform/x86: asus-wmi: Detect quirk_no_rfkill from the DSDT
    - x86/reboot/quirks: Add ASUS EeeBook X205TA reboot quirk
    - x86/reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk
    - usb-storage: Add ignore-residue quirk for Initio INIC-3619
    - x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk
    - Linux 4.10.10

* Broken PowerNV PCI hotplug driver - Patch backporting to zesty
    (LP: #1680328)
    - drivers/pci/hotplug: Mask PDC interrupt if required

* Zesty update to v4.10.9 stable release (LP: #1681875)
    - libceph: force GFP_NOIO for socket allocations
    - KVM: nVMX: fix nested EPT detection
    - xfs: pull up iolock from xfs_free_eofblocks()
    - xfs: sync eofblocks scans under iolock are livelock prone
    - xfs: fix eofblocks race with file extending async dio writes
    - xfs: fix toctou race when locking an inode to access the data map
    - xfs: fail _dir_open when readahead fails
    - xfs: filter out obviously bad btree pointers
    - xfs: check for obviously bad level values in the bmbt root
    - xfs: verify free block header fields
    - xfs: allow unwritten extents in the CoW fork
    - xfs: mark speculative prealloc CoW fork extents unwritten
    - xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t
    - xfs: reject all unaligned direct writes to reflinked files
    - xfs: update ctime and mtime on clone destinatation inodes
    - xfs: correct null checks and error processing in xfs_initialize_perag
    - xfs: don't fail xfs_extent_busy allocation
    - xfs: handle indlen shortage on delalloc extent merge
    - xfs: split indlen reservations fairly when under reserved
    - xfs: fix uninitialized variable in _reflink_convert_cow
    - xfs: don't reserve blocks for right shift transactions
    - xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment
    - xfs: tune down agno asserts in the bmap code
    - xfs: only reclaim unwritten COW extents periodically
    - xfs: fix and streamline error handling in xfs_end_io
    - xfs: Use xfs_icluster_size_fsb() to calculate inode alignment mask
    - xfs: use iomap new flag for newly allocated delalloc blocks
    - xfs: try any AG when allocating the first btree block when reflinking
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN
    - scsi: libsas: fix ata xfer length
    - scsi: scsi_dh_alua: Check scsi_device_get() return value
    - scsi: scsi_dh_alua: Ensure that alua_activate() calls the completion
      function
    - PCI: iproc: Save host bridge window resource in struct iproc_pcie
    - PCI: thunder-pem: Use Cavium assigned hardware ID for ThunderX host
      controller
    - ALSA: seq: Fix race during FIFO resize
    - ALSA: hda - fix a problem for lineout on a Dell AIO machine
    - ASoC: atmel-classd: fix audio clock rate
    - ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of
      pointer
    - ASoC: rt5665: fix getting wrong work handler container
    - HID: wacom: Don't add ghost interface as shared data
    - mmc: sdhci: Disable runtime pm when the sdio_irq is enabled
    - mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection
    - crypto: ccp - Make some CCP DMA channels private
    - crypto: xts,lrw - fix out-of-bounds write after kmalloc failure
    - ARCv2: SLC: Make sure busy bit is set properly on SLC flushing
    - NFSv4.1 fix infinite loop on IO BAD_STATEID error
    - nfsd: map the ENOKEY to nfserr_perm for avoiding warning
    - dt-bindings: rng: clocks property on omap_rng not always mandatory
    - parisc: Clean up fixup routines for get_user()/put_user()
    - parisc: Avoid stalled CPU warnings after system shutdown
    - parisc: Fix access fault handling in pa_memcpy()
    - ACPI: Fix incompatibility with mcount-based function graph tracing
    - ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
    - tty/serial: atmel: fix race condition (TX+DMA)
    - tty/serial: atmel: fix TX path in atmel_console_write()
    - xhci: Set URB actual length for stopped control transfers
    - USB: fix linked-list corruption in rh_call_control()
    - serial: mxs-auart: Fix baudrate calculation
    - KVM: x86: clear bus pointer when destroyed
    - KVM: kvm_io_bus_unregister_dev() should never fail
    - drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
    - drm/vc4: Allocate the right amount of space for boot-time CRTC state.
    - drm/etnaviv: (re-)protect fence allocation with GPU mutex
    - drm/i915/kvmgt: Hold struct kvm reference
    - x86/mm/KASLR: Exclude EFI region from KASLR VA space randomization
    - x86/mce: Fix copy/paste error in exception table entries
    - lib/syscall: Clear return values when no stack
    - mm: rmap: fix huge file mmap accounting in the memcg stats
    - mm: workingset: fix premature shadow node shrinking with cgroups
    - mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()
    - drm/armada: Fix compile fail
    - ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
    - MIPS: Lantiq: Fix cascaded IRQ setup
    - blk: improve order of bio handling in generic_make_request()
    - blk: Ensure users for current->bio_list can see the full list.
    - padata: avoid race in reordering
    - nvme/core: Fix race kicking freed request_queue
    - nvme/pci: Disable on removal when disconnected
    - drm/i915: Move the release of PT page to the upper caller
    - drm/i915: Let execlist_update_context() cover !FULL_PPGTT mode.
    - drm/i915: A hotfix for making aliasing PPGTT work for GVT-g
    - Linux 4.10.9

* POWER9: Improve performance on memory management (LP: #1681429)
    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
      flush
    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync

* Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
    - [Config] Disable CONFIG_HVC_UDBG on ppc64el

-- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 28 Apr 2017 12:41:49 +0200

Changed in linux (Ubuntu Zesty):
status:	Fix Committed → Fix Released

Launchpad Janitor (janitor) on 2017-05-24

Changed in linux (Ubuntu):
status:	New → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package