Bug #1486670 “using ipsec, many connections result in no buffer ...” : Bugs : linux package : Ubuntu

Dan Streetman (ddstreet) on 2015-08-19

Changed in linux (Ubuntu):
assignee:	nobody → Dan Streetman (ddstreet)
status:	New → In Progress

Dan Streetman (ddstreet) on 2015-08-28

tags:

added: sts

Revision history for this message

Dan Streetman (ddstreet) wrote on 2015-10-27:

#1

This is caused by a bug that appears to have been present since ~2008. Proposed upstream patch:
http://marc.info/?l=linux-netdev&m=144596262420164&w=2

Dan Streetman (ddstreet) on 2015-10-30

Changed in linux (Ubuntu Precise):
assignee:	nobody → Dan Streetman (ddstreet)
Changed in linux (Ubuntu Trusty):
assignee:	nobody → Dan Streetman (ddstreet)
Changed in linux (Ubuntu Wily):
assignee:	nobody → Dan Streetman (ddstreet)
Changed in linux (Ubuntu Precise):
status:	New → In Progress
Changed in linux (Ubuntu Trusty):
status:	New → In Progress
Changed in linux (Ubuntu Wily):
status:	New → In Progress

Revision history for this message

Dan Streetman (ddstreet) wrote on 2015-10-30:

#2

Short summary:

ipsec uses a struct dst_ops object per net-namespace (e.g. per container), but does not correctly initialize each dst_ops object's percpu counter. This results in incorrect values for each net namespace's dst_ops counter.

Full details:

ipsec uses xfrm objects, which contain dst objects, which are tracked via the xfrm dst_ops struct in its percpu counter. However, ipsec creates a dst_ops object for every net namespace, not just the main net namespace. A dst_ops template is created, and its contents copied to the dst_ops object for each new net namespace. However, ipsec only initializes the percpu counter in the dst_ops object once - for the template. The way percpu counters work is, the percpu counter object has a main counter variable, and a pointer to the percpu counter variables. The percpu variables only go up to a small "batch" size (32 or so), at which point the percpu variable's count is moved to the main counter variable. However since multiple ipsec net namespaces are all using different main counter variables but the same percpu counter variables, the count from each percpu variable can be moved to a different net namespace. The result is, one net namespace (i.e. container) may have its xfrm count decrease to below 0, while another net namespace may have its xfrm count increase forever, and eventually cause complete ipsec failure once the xfrm4_gc_thresh limit is exceeded.

Revision history for this message

Dan Streetman (ddstreet) wrote on 2015-12-01:

#3

This is in the ipsec (git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git) tree, but not yet in net-next (git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git). Once it hits net-next, I'll request it for the net stable queue (if needed).

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-01-05:

#4

Patch is now in mainline; I'll request it gets added to net stable.

Joseph Salisbury (jsalisbury) on 2016-01-26

tags:

added: kernel-da-key

Brad Figg (brad-figg) on 2016-02-01

Changed in linux (Ubuntu Trusty):
status:	In Progress → Fix Committed

Brad Figg (brad-figg) on 2016-02-01

Changed in linux (Ubuntu Vivid):
status:	New → Fix Committed

Brad Figg (brad-figg) on 2016-02-01

Changed in linux (Ubuntu Wily):
status:	In Progress → Fix Committed

Dan Streetman (ddstreet) on 2016-02-05

Changed in linux (Ubuntu Precise):
status:	In Progress → Invalid

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-05:

#5

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:	added: verification-needed-trusty
tags:	added: verification-needed-vivid

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-05:

#6

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-wily

Revision history for this message

Brad Figg (brad-figg) wrote on 2016-02-05:

#7

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-wily' to 'verification-done-wily'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message

David Clarke (a-launchpad-uber-geek-nz) wrote on 2016-02-08:

#8

I'm still able to duplicate this bug using:

linux-image-3.13.0-78-generic (from trusty-backports)
linux-image-3.19.0-50-generic (from linux-image-generic-lts-vivid)

The LXC images failed to start under linux-image-4.2.0-28-generic, with a kernel oops.

I also tried, in Xenial, linux-image-4.4.0-2-generic and that failed.

Setting /proc/sys/net/ipv4/xfrm4_gc_thresh to 5 causes the failure almost immediately.

I would like to confirm my procedure however. I've been changing /proc/sys/net/ipv4/xfrm4_gc_thresh inside the containers, not the host. Is this correct?

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-09:

#9

Download full text (3.8 KiB)

> The LXC images failed to start under linux-image-4.2.0-28-generic, with a kernel oops.

this bug isn't about kernel oopses.

> Setting /proc/sys/net/ipv4/xfrm4_gc_thresh to 5 causes the failure almost immediately.
>
> I would like to confirm my procedure however. I've been changing /proc/sys/net/ipv4/xfrm4_gc_thresh inside the containers,
> not the host. Is this correct?

no, that's not correct, and unfortunately the "reproducer" in this bug description is completely invalid (it was copied from a private bug for this issue). ipsec will NEVER work with gc_thresh set to 5, due to the internal details between the xfrm gc_thresh and the hardcoded flowcache per-cpu hashtable size limit. In upstream the xfrm4_gc_thresh has been changed to INT_MAX, because using a gc_thresh doesn't make any sense for xfrm dst entries; the total number of them possible is entirely dependent on the number of cpus in the system.

There is 1 xfrm dst entry per flowcache entry, and the flowcache entries are kept in a per-cpu hashtable that is strictly limited at 4096 entries (per cpu). So, the total number of xfrm dst entries will be 4096 * num_active_cpus(), meaning that since the dst code stops allowing new dst allocation once the dst entry count is >= 2 * gc_thresh, the threshold (with the current default 32k gc_thresh) where dst allocation failures can begin to be seen is (32k * 2) / 4096 = 16 cpus. On systems with less than 16 cpus, at the default gc_thresh of 32k, there will never be any dst allocation failures (except due to the real bug this addresses). On systems with 16 or more cpus, with the default gc_thresh of 32k, there will/can be dst alloc failures (with a high enough ipsec usage rate, creating new connections - the flowcache clears all its entries every 10 minutes, so a lightly loaded ipsec with > 16 cpus could be fine).

Setting the xfrm4_gc_thresh value to anything less than (4k * 2 * CPUS) will result in failures, and in fact there is no point in setting xfrm4_gc_thresh to ANYTHING other than INT_MAX because it doesn't actually remove any dst entries.

All that, unfortunately, is actually tangential to this real bug - the problem here is with multiple net namespaces (i.e. multiple containers) all running ipsec, the dst entry counter changes for one container can incorrectly be given to a different container - so one container could have its dst entry count steadily go down (incorrectly) while another container's dst entry count keeps going up (incorrectly). The latter container there would eventually reach its 2 * gc_thresh limit and encounter dst allocation failures, making its ipsec network unusable. Unfortunately, that error looks identical to the error when the dst entry counter is correct, but the number of system cpus is > 16 as described above.

To test this fix, multiple containers must be started (just 2 is fine). On each container, new ipsec connections should be created as fast as possible; e.g. something like:

while true ; do ping -c 1 OTHER_CONTAINER ; done

so each container is pinging each other - but it's important to use -c 1 so that each ping creates a new ipsec dst entry; just normal ping will re-use the existing dst e...

> The LXC images failed to start under linux-image-4.2.0-28-generic, with a kernel oops.

this bug isn't about kernel oopses.

> Setting /proc/sys/net/ipv4/xfrm4_gc_thresh to 5 causes the failure almost immediately.
> 
> I would like to confirm my procedure however. I've been changing /proc/sys/net/ipv4/xfrm4_gc_thresh inside the containers,
> not the host. Is this correct?

no, that's not correct, and unfortunately the "reproducer" in this bug description is completely invalid (it was copied from a private bug for this issue).  ipsec will NEVER work with gc_thresh set to 5, due to the internal details between the xfrm gc_thresh and the hardcoded flowcache per-cpu hashtable size limit.  In upstream the xfrm4_gc_thresh has been changed to INT_MAX, because using a gc_thresh doesn't make any sense for xfrm dst entries; the total number of them possible is entirely dependent on the number of cpus in the system.

There is 1 xfrm dst entry per flowcache entry, and the flowcache entries are kept in a per-cpu hashtable that is strictly limited at 4096 entries (per cpu).  So, the total number of xfrm dst entries will be 4096 * num_active_cpus(), meaning that since the dst code stops allowing new dst allocation once the dst entry count is >= 2 * gc_thresh, the threshold (with the current default 32k gc_thresh) where dst allocation failures can begin to be seen is (32k * 2) / 4096 = 16 cpus.  On systems with less than 16 cpus, at the default gc_thresh of 32k, there will never be any dst allocation failures (except due to the real bug this addresses).  On systems with 16 or more cpus, with the default gc_thresh of 32k, there will/can be dst alloc failures (with a high enough ipsec usage rate, creating new connections - the flowcache clears all its entries every 10 minutes, so a lightly loaded ipsec with > 16 cpus could be fine).

Setting the xfrm4_gc_thresh value to anything less than (4k * 2 * CPUS) will result in failures, and in fact there is no point in setting xfrm4_gc_thresh to ANYTHING other than INT_MAX because it doesn't actually remove any dst entries.

All that, unfortunately, is actually tangential to this real bug - the problem here is with multiple net namespaces (i.e. multiple containers) all running ipsec, the dst entry counter changes for one container can incorrectly be given to a different container - so one container could have its dst entry count steadily go down (incorrectly) while another container's dst entry count keeps going up (incorrectly).  The latter container there would eventually reach its 2 * gc_thresh limit and encounter dst allocation failures, making its ipsec network unusable.  Unfortunately, that error looks identical to the error when the dst entry counter is correct, but the number of system cpus is > 16 as described above.

To test this fix, multiple containers must be started (just 2 is fine).  On each container, new ipsec connections should be created as fast as possible; e.g. something like:

while true ; do ping -c 1 OTHER_CONTAINER ; done

so each container is pinging each other - but it's important to use -c 1 so that each ping creates a new ipsec dst entry; just normal ping will re-use the existing dst entry.

After a sufficiently long period (depending on the number of containers and number of cpus, and the luck of randomly incorrectly assigning dst entry count changes to different containers) one or more containers should get dst allocation failures and its ipsec network should not be usable anymore.  To speed up reproduction of this bug, lower the xfrm4_gc_thresh to a value ABOVE (2 * 4096 * CPUS), but close to it - e.g. something like 10k * CPUS.  With that gc_thresh value set, this bug should be reproducable fairly quickly (order of days or less) without the patch, but not reproducable with the patch (i.e. with the -proposed repo kernel).

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-09:

#10

> To speed up reproduction of this bug, lower the xfrm4_gc_thresh to a value ABOVE (2 * 4096 * CPUS), but close to it -
> e.g. something like 10k * CPUS

sorry got the math wrong on the verification - the xfrm4_gc_thresh should be set to above ((4096 * CPUS) / 2), so something like 4K * CPUS, or even (2K * CPUS) + 4k; basically just above the max flowcache limit, plus a bit for dst entries that are released but not yet freed/cleaned yet.

And to re-affirm, for production use the xfrm4_gc_thresh should NEVER be set to anything other than INT_MAX (i.e., a number higher than 4k * 2 * CPUS) - there's absolutely no benefit to setting it any lower than max, and a real chance of causing failures if set too low.

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-09:

#11

and a reminder - the /proc/sys/net/ipv4/xfrm4_gc_thresh param is a per-netns value, so it should be changed in each container.

Dan Streetman (ddstreet) on 2016-02-09

Changed in linux (Ubuntu Vivid):
assignee:	nobody → Dan Streetman (ddstreet)

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-10:

#12

> To test this fix, multiple containers must be started (just 2 is fine).

note - it can be reproduced with just 2, but it happens exponentially faster with a higher number of containers.

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-10:

#13

the systemtap script below can be used to monitor the dst count for all net namespaces. When any of the counts goes significantly negative (more than 32 * CPUS negative) it indicates this bug is reproduced - meaning, the count from one net namespace was incorrectly shifted to another net namespace, and once that happens enough times one (or more) net namespaces have a count that goes negative (which is not possible). Other net namespaces have counts that are much higher than they should be. Note this script is just for ipv4, but the bug exists for ipv6 also (and the patch fixes ipv6 also).

#!/usr/bin/stap

global dst_count

probe kernel.function("xfrm_resolve_and_create_bundle") {
  if ($family == 2) {
    dst_count[&$pols[0]->xp_net] = $pols[0]->xp_net->xfrm->xfrm4_dst_ops->pcpuc_entries->count
  }
}

probe timer.sec(1) {
  foreach (c in dst_count) {
    printf("%ld ", dst_count[c])
  }
  print("\n")
}

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-10:

#14

correction on the script above, to only show each netns count once (script above duplicates netns counts)

probe kernel.function("xfrm_resolve_and_create_bundle") {
if ($family == 2) {
- dst_count[&$pols[0]->xp_net] = $pols[0]->xp_net->xfrm->xfrm4_dst_ops->pcpuc_entries->count
+ dst_count[$pols[0]->xp_net->loopback_dev] = $pols[0]->xp_net->xfrm->xfrm4_dst_ops->pcpuc_entries->count
}
}

Dan Streetman (ddstreet) on 2016-02-11

tags:

added: verification-done-trusty
removed: verification-needed-trusty

Dan Streetman (ddstreet) on 2016-02-17

tags:

added: verification-done-vivid
removed: verification-needed-vivid

Revision history for this message

Dan Streetman (ddstreet) wrote on 2016-02-19:

#15

and on wily, this patch is required on top of the patch from comment 14:

probe kernel.function("xfrm_resolve_and_create_bundle") {
if ($family == 2) {
- dst_count[$pols[0]->xp_net->loopback_dev] = $pols[0]->xp_net->xfrm->xfrm4_dst_ops->pcpuc_entries->count
+ dst_count[$pols[0]->xp_net->net->loopback_dev] = $pols[0]->xp_net->net->xfrm->xfrm4_dst_ops->pcpuc_entries->count
}
}

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-02-22:

#16

Download full text (43.7 KiB)

This bug was fixed in the package linux - 4.2.0-30.35

---------------
linux (4.2.0-30.35) wily; urgency=low

[ Seth Forshee ]

  * SAUCE: cred: Add clone_cred() interface
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of selectively
    raising caps
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux (4.2.0-29.34) wily; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1543167

[ Brad Figg ]

* Revert "SAUCE: apparmor: fix sleep from invalid context"
- LP: #1542049

[ Upstream Kernel Changes ]

* Revert "af_unix: Revert 'lock_interruptible' in stream receive code"
- LP: #1540731

linux (4.2.0-28.33) wily; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1540634

[ Brad Figg ]

* CONFIG: CONFIG_DEBUG_UART_BCM63XX is not set

[ J. R. Okajima ]

  * SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

[ John Johansen ]

  * SAUCE: (no-up): apparmor: fix for failed mediation of socket that is
    being shutdown
    - LP: #1446906
  * SAUCE: apparmor: fix sleep from invalid context
    - LP: #1539349

[ Tim Gardner ]

* [Config] Add pvpanic to virtual flavour
- LP: #1537923

[ Upstream Kernel Changes ]

  * Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1540532
  * tools: Add a "make all" rule
    - LP: #1536370
  * vf610_adc: Fix internal temperature calculation
    - LP: #1536370
  * iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock
    - LP: #1536370
  * iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success
    - LP: #1536370
  * iio: ad5064: Fix ad5629/ad5669 shift
    - LP: #1536370
  * iio:ad7793: Fix ad7785 product ID
    - LP: #1536370
  * iio: adc: vf610_adc: Fix division by zero error
    - LP: #1536370
  * mmc: mmc: Improve reliability of mmc_select_hs200()
    - LP: #1536370
  * mmc: mmc: Fix HS setting in mmc_select_hs400()
    - LP: #1536370
  * mmc: mmc: Move mmc_switch_status()
    - LP: #1536370
  * mmc: mmc: Improve reliability of mmc_select_hs400()
    - LP: #1536370
  * crypto: qat - don't use userspace pointer
    - LP: #1536370
  * iio: si7020: Swap data byte order
    - LP: #1536370
  * iio: adc: xilinx: Fix VREFN scale
    - LP: #1536370
  * ipmi: Start the timer and thread on internal msgs
    - LP: #1536370
  * drm/i915: quirk backlight present on Macbook 4, 1
    - LP: #1536370
  * drm/i915: get runtime PM reference around GEM set_caching IOCTL
    - LP: #1536370
  * drm/radeon: Disable uncacheable CPU mappings of GTT with RV6xx
    - LP: #1536370
  *...

This bug was fixed in the package linux - 4.2.0-30.35

---------------
linux (4.2.0-30.35) wily; urgency=low

[ Seth Forshee ]

* SAUCE: cred: Add clone_cred() interface
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of selectively
    raising caps
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux (4.2.0-29.34) wily; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1543167

[ Brad Figg ]

* Revert "SAUCE: apparmor: fix sleep from invalid context"
    - LP: #1542049

[ Upstream Kernel Changes ]

* Revert "af_unix: Revert 'lock_interruptible' in stream receive code"
    - LP: #1540731

linux (4.2.0-28.33) wily; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1540634

[ Brad Figg ]

* CONFIG: CONFIG_DEBUG_UART_BCM63XX is not set

[ J. R. Okajima ]

* SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

[ John Johansen ]

* SAUCE: (no-up): apparmor: fix for failed mediation of socket that is
    being shutdown
    - LP: #1446906
  * SAUCE: apparmor: fix sleep from invalid context
    - LP: #1539349

[ Tim Gardner ]

* [Config] Add pvpanic to virtual flavour
    - LP: #1537923

[ Upstream Kernel Changes ]

* Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - LP: #1540532
  * tools: Add a "make all" rule
    - LP: #1536370
  * vf610_adc: Fix internal temperature calculation
    - LP: #1536370
  * iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock
    - LP: #1536370
  * iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success
    - LP: #1536370
  * iio: ad5064: Fix ad5629/ad5669 shift
    - LP: #1536370
  * iio:ad7793: Fix ad7785 product ID
    - LP: #1536370
  * iio: adc: vf610_adc: Fix division by zero error
    - LP: #1536370
  * mmc: mmc: Improve reliability of mmc_select_hs200()
    - LP: #1536370
  * mmc: mmc: Fix HS setting in mmc_select_hs400()
    - LP: #1536370
  * mmc: mmc: Move mmc_switch_status()
    - LP: #1536370
  * mmc: mmc: Improve reliability of mmc_select_hs400()
    - LP: #1536370
  * crypto: qat - don't use userspace pointer
    - LP: #1536370
  * iio: si7020: Swap data byte order
    - LP: #1536370
  * iio: adc: xilinx: Fix VREFN scale
    - LP: #1536370
  * ipmi: Start the timer and thread on internal msgs
    - LP: #1536370
  * drm/i915: quirk backlight present on Macbook 4, 1
    - LP: #1536370
  * drm/i915: get runtime PM reference around GEM set_caching IOCTL
    - LP: #1536370
  * drm/radeon: Disable uncacheable CPU mappings of GTT with RV6xx
    - LP: #1536370
  * drm/radeon: unconditionally set sysfs_initialized
    - LP: #1536370
  * drm/amdgpu: Fix default page access routing
    - LP: #1536370
  * USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem
    - LP: #1536370
  * ext2, ext4: warn when mounting with dax enabled
    - LP: #1536370
  * arm64: mm: use correct mapping granularity under DEBUG_RODATA
    - LP: #1536370
  * drm/i915: Don't clobber the addfb2 ioctl params
    - LP: #1536370
  * arm64: kernel: pause/unpause function graph tracer in cpu_suspend()
    - LP: #1536370
  * usb: chipidea: debug: disable usb irq while role switch
    - LP: #1536370
  * xhci: Fix a race in usb2 LPM resume, blocking U3 for usb2 devices
    - LP: #1536370
  * fat: fix fake_offset handling on error path
    - LP: #1536370
  * kernel/signal.c: unexport sigsuspend()
    - LP: #1536370
  * parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h
    - LP: #1536370
  * mmc: remove bondage between REQ_META and reliable write
    - LP: #1536370
  * stmmac: avoid ipq806x constant overflow warning
    - LP: #1536370
  * perf symbols: Fix dso lookup by long name and missing buildids
    - LP: #1536370
  * net/mlx4_core: Avoid returning success in case of an error flow
    - LP: #1536370
  * mtd: nand: fix shutdown/reboot for multi-chip systems
    - LP: #1536370
  * FS-Cache: Add missing initialization of ret in cachefiles_write_page()
    - LP: #1536370
  * ipvlan: fix leak in ipvlan_rcv_frame
    - LP: #1536370
  * ipvlan: fix use after free of skb
    - LP: #1536370
  * macvlan: fix leak in macvlan_handle_frame
    - LP: #1536370
  * ALSA: hda - Fix noise on Dell Latitude E6440
    - LP: #1536370
  * dm thin: restore requested 'error_if_no_space' setting on OODS to WRITE
    transition
    - LP: #1536370
  * ALSA: hda - Add fixup for Acer Aspire One Cloudbook 14
    - LP: #1536370
  * dm crypt: fix a possible hang due to race condition on exit
    - LP: #1536370
  * mac: validate mac_partition is within sector
    - LP: #1536370
  * ALSA: hda - Apply HP headphone fixups more generically
    - LP: #1536370
  * blk-mq: fix calling unplug callbacks with preempt disabled
    - LP: #1536370
  * ARM: imx: add platform irq type setting in gpc
    - LP: #1536370
  * watchdog: omap_wdt: fix null pointer dereference
    - LP: #1536370
  * ARC: dw2 unwind: Remove falllback linear search thru FDE entries
    - LP: #1536370
  * dm thin: fix regression in advertised discard limits
    - LP: #1536370
  * fix sysvfs symlinks
    - LP: #1536370
  * vfs: Make sendfile(2) killable even better
    - LP: #1536370
  * vfs: Avoid softlockups with sendfile(2)
    - LP: #1536370
  * nfs4: limit callback decoding to received bytes
    - LP: #1536370
  * ALSA: hda - Fix headphone noise after Dell XPS 13 resume back from S3
    - LP: #1519168, #1536370
  * ARM: dts: vfxxx: Fix dspi[01] spi-num-chipselects.
    - LP: #1536370
  * ARM/arm64: KVM: test properly for a PTE's uncachedness
    - LP: #1536370
  * arm64: KVM: Fix AArch32 to AArch64 register mapping
    - LP: #1536370
  * drm/radeon: make rv770_set_sw_state failures non-fatal
    - LP: #1536370
  * PCI: Prevent out of bounds access in numa_node override
    - LP: #1536370
  * ALSA: hda - Fix noise on Gigabyte Z170X mobo
    - LP: #1536370
  * ARM: dove: Fix legacy get_irqnr_and_base
    - LP: #1536370
  * ARM: orion5x: Fix legacy get_irqnr_and_base
    - LP: #1536370
  * drm/radeon: make some dpm errors debug only
    - LP: #1536370
  * NFSv4.1/pNFS: Don't request a minimal read layout beyond the end of
    file
    - LP: #1536370
  * nfs4: resend LAYOUTGET when there is a race that changes the seqid
    - LP: #1536370
  * xen/gntdev: Grant maps should not be subject to NUMA balancing
    - LP: #1536370
  * iscsi-target: Fix rx_login_comp hang after login failure
    - LP: #1536370
  * target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
    - LP: #1536370
  * target: fix COMPARE_AND_WRITE non zero SGL offset data corruption
    - LP: #1536370
  * thermal: fix thermal_zone_bind_cooling_device prototype
    - LP: #1536370
  * ARM: 8454/1: OF implies OF_FLATTREE
    - LP: #1536370
  * ARM: dts: Kirkwood: Fix QNAP TS219 power-off
    - LP: #1536370
  * ASoC: rsnd: fixup SCU_SYS_INT_EN1 address
    - LP: #1536370
  * Bluetooth: Fix l2cap_chan leak in SMP
    - LP: #1536370
  * crypto: nx - Fix timing leak in GCM and CCM decryption
    - LP: #1536370
  * crypto: talitos - Fix timing leak in ESP ICV verification
    - LP: #1536370
  * ASoC: wm8962: correct addresses for HPF_C_0/1
    - LP: #1536370
  * rtlwifi: rtl8821ae: Fix lockups on boot
    - LP: #1536370
  * mac80211: mesh: fix call_rcu() usage
    - LP: #1536370
  * advansys: fix big-endian builds
    - LP: #1536370
  * mac80211: ensure we don't update tx power on a non-running sdata
    - LP: #1536370
  * drm/i915: Mark uneven memory banks on gen4 desktop as unknown swizzling
    - LP: #1536370
  * ring-buffer: Update read stamp with first real commit on page
    - LP: #1536370
  * drm/i915: Don't override output type for DDI HDMI
    - LP: #1536370
  * block: Always check queue limits for cloned requests
    - LP: #1536370
  * direct-io: Fix negative return from dio read beyond eof
    - LP: #1536370
  * drm/amdgpu: fix userptr flags check
    - LP: #1536370
  * virtio-gpu: use no-merge for fill-modes
    - LP: #1536370
  * Fix a memory leak in scsi_host_dev_release()
    - LP: #1536370
  * wan/x25: Fix use-after-free in x25_asy_open_tty()
    - LP: #1536370
  * mac80211: do not actively scan DFS channels
    - LP: #1536370
  * PM / Domains: Fix bad of_node_put() in failure paths of
    genpd_dev_pm_attach()
    - LP: #1536370
  * drm: Fix an unwanted master inheritance v2
    - LP: #1536370
  * sched/core: Clear the root_domain cpumasks in init_rootdomain()
    - LP: #1536370
  * ARM/arm64: KVM: correct PTE uncachedness check
    - LP: #1536370
  * drm/amdgpu: partially revert "drm/amdgpu: fix
    VM_CONTEXT*_PAGE_TABLE_END_ADDR" v2
    - LP: #1536370
  * x86/mpx: Fix instruction decoder condition
    - LP: #1536370
  * x86/signal: Fix restart_syscall number for x32 tasks
    - LP: #1536370
  * Don't reset ->total_link_count on nested calls of vfs_path_lookup()
    - LP: #1536370
  * net: mvneta: fix bit assignment in MVNETA_RXQ_CONFIG_REG
    - LP: #1536370
  * net: mvneta: fix bit assignment for RX packet irq enable
    - LP: #1536370
  * net: mvneta: add configuration for MBUS windows access protection
    - LP: #1536370
  * iwlwifi: mvm: don't overwrite the key indices in D3 entry
    - LP: #1536370
  * mac80211: fix off-channel mgmt-tx uninitialized variable usage
    - LP: #1536370
  * drm/rockchip: unset pgoff when mmap'ing gems
    - LP: #1536370
  * remoteproc: avoid stack overflow in debugfs file
    - LP: #1536370
  * sched/rt: Hide the push_irq_work_func() declaration
    - LP: #1536370
  * drm: imx: convert to drm_crtc_send_vblank_event()
    - LP: #1536370
  * sched/wait: Fix signal handling in bit wait helpers
    - LP: #1536370
  * ACPI / property: fix compile error for
    acpi_node_get_property_reference() when CONFIG_ACPI=n
    - LP: #1536370
  * ipv4: igmp: Allow removing groups from a removed interface
    - LP: #1536370
  * isdn: Partially revert debug format string usage clean up
    - LP: #1536370
  * sched/core: Remove false-positive warning from wake_up_process()
    - LP: #1536370
  * gpio: omap: drop omap1 mpuio specific irq_mask/unmask callbacks
    - LP: #1536370
  * SUNRPC: Fix callback channel
    - LP: #1536370
  * cuse: fix memory leak
    - LP: #1536370
  * fuse: break infinite loop in fuse_fill_write_pages()
    - LP: #1536370
  * usb: gadget: pxa27x: fix suspend callback
    - LP: #1536370
  * iio: fix some warning messages
    - LP: #1536370
  * iio: adc: spmi-vadc: add missing of_node_put
    - LP: #1536370
  * USB: cp210x: Remove CP2110 ID from compatibility list
    - LP: #1536370
  * USB: cdc_acm: Ignore Infineon Flash Loader utility
    - LP: #1536370
  * USB: serial: Another Infineon flash loader USB ID
    - LP: #1536370
  * ext4: Fix handling of extended tv_sec
    - LP: #1536370
  * jbd2: Fix unreclaimed pages after truncate in data=journal mode
    - LP: #1536370
  * drm/ttm: Fixed a read/write lock imbalance
    - LP: #1536370
  * ext4: fix an endianness bug in ext4_encrypted_zeroout()
    - LP: #1536370
  * ext4: fix an endianness bug in ext4_encrypted_follow_link()
    - LP: #1536370
  * AHCI: Fix softreset failed issue of Port Multiplier
    - LP: #1536370
  * sata_sil: disable trim
    - LP: #1536370
  * usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter
    JMicron
    - LP: #1536370
  * staging: lustre: echo_copy.._lsm() dereferences userland pointers
    directly
    - LP: #1536370
  * irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
    - LP: #1536370
  * usb: core : hub: Fix BOS 'NULL pointer' kernel panic
    - LP: #1536370
  * USB: whci-hcd: add check for dma mapping error
    - LP: #1536370
  * usb: Use the USB_SS_MULT() macro to decode burst multiplier for log
    message
    - LP: #1536370
  * dm btree: fix leak of bufio-backed block in btree_split_sibling error
    path
    - LP: #1536370
  * dm thin metadata: fix bug in dm_thin_remove_range()
    - LP: #1536370
  * perf: Fix PERF_EVENT_IOC_PERIOD deadlock
    - LP: #1536370
  * xhci: Fix memory leak in xhci_pme_acpi_rtd3_enable()
    - LP: #1536370
  * usb: xhci: fix config fail of FS hub behind a HS hub with MTT
    - LP: #1536370
  * jbd2: fix null committed data return in undo_access
    - LP: #1536370
  * block: detach bdev inode from its wb in __blkdev_put()
    - LP: #1536370
  * ALSA: rme96: Fix unexpected volume reset after rate changes
    - LP: #1536370
  * ALSA: hda - Add inverted dmic for Packard Bell DOTS
    - LP: #1523232, #1536370
  * vhost: relax log address alignment
    - LP: #1536370
  * virtio: fix memory leak of virtio ida cache layers
    - LP: #1536370
  * IB/srp: Fix a memory leak
    - LP: #1536370
  * IB/srp: Fix possible send queue overflow
    - LP: #1536370
  * powerpc/opal-irqchip: Fix double endian conversion
    - LP: #1536370
  * powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian
    conversion"
    - LP: #1536370
  * cxl: Set endianess of kernel contexts
    - LP: #1536370
  * ALSA: hda - Fixing speaker noise on the two latest thinkpad models
    - LP: #1523517, #1536370
  * of/fdt: Add mutex protection for calls to __unflatten_device_tree()
    - LP: #1536370
  * 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
    - LP: #1536370
  * fix the regression from "direct-io: Fix negative return from dio read
    beyond eof"
    - LP: #1536370
  * radeon/cik: Fix GFX IB test on Big-Endian
    - LP: #1536370
  * radeon: Fix VCE ring test for Big-Endian systems
    - LP: #1536370
  * radeon: Fix VCE IB test on Big-Endian systems
    - LP: #1536370
  * ALSA: hda - Fix noise problems on Thinkpad T440s
    - LP: #1536370
  * ALSA: hda/ca0132 - quirk for Alienware 17 2015
    - LP: #1536370
  * dm thin metadata: fix bug when taking a metadata snapshot
    - LP: #1536370
  * dm space map metadata: fix ref counting bug when bootstrapping a new
    space map
    - LP: #1536370
  * ipmi: move timer init to before irq is setup
    - LP: #1536370
  * dm btree: fix bufio buffer leaks in dm_btree_del() error path
    - LP: #1536370
  * vgaarb: fix signal handling in vga_get()
    - LP: #1536370
  * ARM: dts: vf610: use reset values for L2 cache latencies
    - LP: #1536370
  * xhci: fix usb2 resume timing and races.
    - LP: #1536370
  * USB: add quirk for devices with broken LPM
    - LP: #1536370
  * parisc iommu: fix panic due to trying to allocate too large region
    - LP: #1536370
  * mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
    - LP: #1536370
  * mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't
    make any progress
    - LP: #1536370
  * mm: hugetlb: call huge_pte_alloc() only if ptep is null
    - LP: #1536370
  * drivers/base/memory.c: prohibit offlining of memory blocks with missing
    sections
    - LP: #1536370
  * ocfs2: fix SGID not inherited issue
    - LP: #1536370
  * sh64: fix __NR_fgetxattr
    - LP: #1536370
  * sched/wait: Fix the signal handling fix
    - LP: #1536370
  * sata/mvebu: use #ifdef around suspend/resume code
    - LP: #1536370
  * usb: musb: USB_TI_CPPI41_DMA requires dmaengine support
    - LP: #1536370
  * i2c: rk3x: populate correct variable for sda_falling_time
    - LP: #1536370
  * i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
    - LP: #1536370
  * xen/events/fifo: Consume unprocessed events when a CPU dies
    - LP: #1536370
  * ARM: 8465/1: mm: keep reserved ASIDs in sync with mm after multiple
    rollovers
    - LP: #1536370
  * net: mvpp2: fix missing DMA region unmap in egress processing
    - LP: #1536370
  * net: mvpp2: fix buffers' DMA handling on RX path
    - LP: #1536370
  * net: mvpp2: fix refilling BM pools in RX path
    - LP: #1536370
  * dmaengine: at_xdmac: fix macro typo
    - LP: #1536370
  * video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
    - LP: #1536370
  * crypto: skcipher - Copy iv from desc even for 0-len walks
    - LP: #1536370
  * ASoC: es8328: Fix deemphasis values
    - LP: #1536370
  * KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
    - LP: #1536370
  * dmaengine: at_xdmac: fix at_xdmac_prep_dma_memcpy()
    - LP: #1536370
  * rfkill: copy the name into the rfkill struct
    - LP: #1536370
  * ses: Fix problems with simple enclosures
    - LP: #1536370
  * ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx
    - LP: #1536370
  * ses: fix additional element traversal bug
    - LP: #1536370
  * powercap / RAPL: fix BIOS lock check
    - LP: #1536370
  * ARCv2: intc: Fix random perf irq disabling in SMP setup
    - LP: #1536370
  * i2c: designware: reverts "i2c: designware: Add support for AMD I2C
    controller"
    - LP: #1536370
  * i2c: designware: fix IO timeout issue for AMD controller
    - LP: #1536370
  * ASoC: wm8974: set cache type for regmap
    - LP: #1536370
  * n_tty: Fix poll() after buffer-limited eof push read
    - LP: #1536370
  * tty: Fix GPF in flush_to_ldisc()
    - LP: #1536370
  * ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
    DragonFly
    - LP: #1536370
  * ALSA: usb-audio: Add sample rate inquiry quirk for AudioQuest DragonFly
    - LP: #1536370
  * drm: Don't overwrite UNVERFIED mode status to OK
    - LP: #1536370
  * ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
    - LP: #1536370
  * ARM: 8471/1: need to save/restore arm register(r11) when it is
    corrupted
    - LP: #1536370
  * ALSA: hda - Fix headphone mic input on a few Dell ALC293 machines
    - LP: #1526330, #1536370
  * ALSA: hda - Apply click noise workaround for Thinkpads generically
    - LP: #1536370
  * ALSA: hda - Set codec to D3 at reboot/shutdown on Thinkpads
    - LP: #1536370
  * ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd
    - LP: #1536370
  * spi: fix parent-device reference leak
    - LP: #1536370
  * scripts: recordmcount: break hardlinks
    - LP: #1536370
  * dma-debug: Fix dma_debug_entry offset calculation
    - LP: #1536370
  * ftrace/scripts: Have recordmcount copy the object file
    - LP: #1536370
  * mtd: ubi: fixup error correction in do_sync_erase()
    - LP: #1536370
  * mtd: ubi: don't leak e if schedule_erase() fails
    - LP: #1536370
  * ARC: dw2 unwind: Reinstante unwinding out of modules
    - LP: #1536370
  * ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing
    - LP: #1536370
  * powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type
    - LP: #1536370
  * drm/nouveau/bios/fan: hardcode the fan mode to linear
    - LP: #1536370
  * md/raid10: fix data corruption and crash during resync
    - LP: #1536370
  * ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
    - LP: #1536370
  * s390/dis: Fix handling of format specifiers
    - LP: #1536370
  * [media] Revert "[media] ivtv: avoid going past input/audio array"
    - LP: #1536370
  * [media] airspy: increase USB control message buffer size
    - LP: #1536370
  * USB: ipaq.c: fix a timeout loop
    - LP: #1536370
  * USB: fix invalid memory access in hub_activate()
    - LP: #1536370
  * i2c: rcar: disable runtime PM correctly in slave mode
    - LP: #1536370
  * md: remove check for MD_RECOVERY_NEEDED in action_store.
    - LP: #1536370
  * parisc: Fix syscall restarts
    - LP: #1536370
  * ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
    - LP: #1536370
  * MIPS: uaccess: Fix strlen_user with EVA
    - LP: #1536370
  * drm/i915: Break busywaiting for requests on pending signals
    - LP: #1536370
  * drm/i915: Limit the busy wait on requests to 5us not 10ms!
    - LP: #1536370
  * drm/i915: Only spin whilst waiting on the current request
    - LP: #1536370
  * MIPS: CPS: drop .set mips64r2 directives
    - LP: #1536370
  * KVM: MTRR: fix fixed MTRR segment look up
    - LP: #1536370
  * KVM: MTRR: observe maxphyaddr from guest CPUID, not host
    - LP: #1536370
  * KVM: MTRR: treat memory as writeback if MTRR is disabled in guest CPUID
    - LP: #1536370
  * arm: fix handling of F_OFD_... in oabi_fcntl64()
    - LP: #1536370
  * ocfs2: fix BUG when calculate new backup super
    - LP: #1536370
  * mm/memory_hotplug.c: check for missing sections in
    test_pages_in_a_zone()
    - LP: #1536370
  * ipv6/addrlabel: fix ip6addrlbl_get()
    - LP: #1536370
  * xfrm: add rcu protection to sk->sk_policy[]
    - LP: #1536370
  * amd-xgbe: fix a couple timeout loops
    - LP: #1536370
  * phy: sun9i-usb: add USB dependency
    - LP: #1536370
  * sctp: convert sack_needed and sack_generation to bits
    - LP: #1536370
  * sctp: start t5 timer only when peer rwnd is 0 and local state is
    SHUTDOWN_PENDING
    - LP: #1536370
  * serial: 8250_uniphier: fix dl_read and dl_write functions
    - LP: #1536370
  * net: fix warnings in 'make htmldocs' by moving macro definition out of
    field declaration
    - LP: #1536370
  * netfilter: nfnetlink_queue: Unregister pernet subsys in case of init
    failure
    - LP: #1536370
  * addrconf: always initialize sysctl table data
    - LP: #1536370
  * ser_gigaset: fix deallocation of platform device structure
    - LP: #1536370
  * pinctrl: bcm2835: Fix initial value for direction_output
    - LP: #1536370
  * mISDN: fix a loop count
    - LP: #1536370
  * sh_eth: fix TX buffer byte-swapping
    - LP: #1536370
  * qlcnic: fix a timeout loop
    - LP: #1536370
  * dmaengine: bcm2835-dma: Convert to use DMA pool
    - LP: #1536370
  * net: phy: mdio-mux: Check return value of mdiobus_alloc()
    - LP: #1536370
  * include/linux/mmdebug.h: should include linux/bug.h
    - LP: #1536370
  * genirq: Prevent chip buslock deadlock
    - LP: #1536370
  * x86/mce: Ensure offline CPUs don't participate in rendezvous process
    - LP: #1536370
  * x86/paravirt: Prevent rtc_cmos platform device init on PV guests
    - LP: #1536370
  * ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
    - LP: #1536370
  * ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO
    - LP: #1536370
  * ALSA: hda - Add keycode map for alc input device
    - LP: #1536370
  * ftrace/scripts: Fix incorrect use of sprintf in recordmcount
    - LP: #1536370
  * tracing: Fix setting of start_index in find_next()
    - LP: #1536370
  * tile: provide CONFIG_PAGE_SIZE_64KB etc for tilepro
    - LP: #1536370
  * ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
    - LP: #1536370
  * ARM: versatile: fix MMC/SD interrupt assignment
    - LP: #1536370
  * async_tx: use GFP_NOWAIT rather than GFP_IO
    - LP: #1536370
  * dts: vt8500: Add SDHC node to DTS file for WM8650
    - LP: #1536370
  * ftrace/module: Call clean up function when module init fails early
    - LP: #1536370
  * vmstat: allocate vmstat_wq before it is used
    - LP: #1536370
  * firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
    - LP: #1536370
  * kvm: x86: only channel 0 of the i8254 is linked to the HPET
    - LP: #1536370
  * ASoC: Use nested lock for snd_soc_dapm_mutex_lock
    - LP: #1536370
  * net: sched: fix missing free per cpu on qstats
    - LP: #1536370
  * net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
    - LP: #1536370
  * sched/core: Reset task's lockless wake-queues on fork()
    - LP: #1536370
  * net: possible use after free in dst_release
    - LP: #1536370
  * Linux 4.2.8-ckt2
    - LP: #1536370
  * drivers/base/memory.c: fix kernel warning during memory hotplug on
    ppc64
    - LP: #1463654
  * xfrm: dst_entries_init() per-net dst_ops
    - LP: #1486670
  * powerpc/pseries: Limit EPOW reset event warnings
    - LP: #1539102
  * drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
    - LP: #1540532
  * ovl: allow zero size xattr
    - LP: #1540532
  * ovl: use a minimal buffer in ovl_copy_xattr
    - LP: #1540532
  * [media] vb2: fix a regression in poll() behavior for output,streams
    - LP: #1540532
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1540532
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1540532
  * [media] si2157: return -EINVAL if firmware blob is too big
    - LP: #1540532
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1540532
  * cxl: use correct operator when writing pcie config space values
    - LP: #1540532
  * KVM: x86: expose MSR_TSC_AUX to userspace
    - LP: #1540532
  * KVM: x86: correctly print #AC in traces
    - LP: #1540532
  * drm/amdgpu: call hpd_irq_event on resume
    - LP: #1540532
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1540532
  * xhci: refuse loading if nousb is used
    - LP: #1540532
  * ARM: mvebu: remove duplicated regulator definition in Armada 388 GP
    - LP: #1540532
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1540532
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1540532
  * ovl: root: copy attr
    - LP: #1540532
  * Bluetooth: Add support of Toshiba Broadcom based devices
    - LP: #1522949, #1540532
  * ext4 crypto: exit cleanly if ext4_derive_key_aes() fails
    - LP: #1540532
  * ext4 crypto: add missing locking for keyring_key access
    - LP: #1540532
  * rtlwifi: fix memory leak for USB device
    - LP: #1540532
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1540532
  * ovl: setattr: check permissions before copy-up
    - LP: #1540532
  * ovl: check dentry positiveness in ovl_cleanup_whiteouts()
    - LP: #1540532
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1540532
  * EDAC: Robustify workqueues destruction
    - LP: #1540532
  * arm64: mm: ensure that the zero page is visible to the page table
    walker
    - LP: #1540532
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1540532
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1540532
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1540532
  * Drivers: hv: vmbus: Fix a Host signaling bug
    - LP: #1540532
  * tools: hv: vss: fix the write()'s argument: error -> vss_msg
    - LP: #1540532
  * clk: exynos: use irqsave version of spin_lock to avoid deadlock with
    irqs
    - LP: #1540532
  * iommu/io-pgtable-arm: Ensure we free the final level on teardown
    - LP: #1540532
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1540532
  * drm/radeon: Fix "slow" audio over DP on DCE8+
    - LP: #1540532
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1540532
  * arm64: mdscr_el1: avoid exposing DCC to userspace
    - LP: #1540532
  * arm64: kernel: enforce pmuserenr_el0 initialization and restore
    - LP: #1540532
  * coresight: checking for NULL string in coresight_name_match()
    - LP: #1540532
  * drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr
    - LP: #1540532
  * drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map
    - LP: #1540532
  * drm/radeon: clean up fujitsu quirks
    - LP: #1540532
  * mmc: mmc: Fix incorrect use of driver strength switching HS200 and
    HS400
    - LP: #1540532
  * mmc: sdhci-pci: Do not default to 33 Ohm driver strength for Intel SPT
    - LP: #1540532
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1540532
  * mmc: sdhci: Fix DMA descriptor with zero data length
    - LP: #1540532
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1540532
  * regulator: axp20x: Fix GPIO LDO enable value for AXP22x
    - LP: #1540532
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1540532
  * [media] rc: sunxi-cir: Initialize the spinlock properly
    - LP: #1540532
  * nfs: Fix race in __update_open_stateid()
    - LP: #1540532
  * USB: cp210x: add ID for ELV Marble Sound Board 1
    - LP: #1540532
  * Thermal: initialize thermal zone device correctly
    - LP: #1540532
  * Thermal: handle thermal zone device properly during system sleep
    - LP: #1540532
  * Thermal: do thermal zone update after a cooling device registered
    - LP: #1540532
  * posix-clock: Fix return code on the poll method's error path
    - LP: #1540532
  * rtlwifi: rtl8723be: Fix module parameter initialization
    - LP: #1540532
  * rtlwifi: rtl8723ae: Fix initialization of module parameters
    - LP: #1540532
  * rtlwifi: rtl8821ae: Fix errors in parameter initialization
    - LP: #1540532
  * rtlwifi: rtl8188ee: Fix module parameter initialization
    - LP: #1540532
  * rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
    - LP: #1540532
  * rtlwifi: rtl8192se: Fix module parameter initialization
    - LP: #1540532
  * rtlwifi: rtl8192ce: Fix handling of module parameters
    - LP: #1540532
  * rtlwifi: rtl8192cu: Add missing parameter setup
    - LP: #1540532
  * NFS: Fix attribute cache revalidation
    - LP: #1540532
  * rtlwifi: rtl_pci: Fix kernel panic
    - LP: #1540532
  * bcache: fix a livelock when we cause a huge number of cache misses
    - LP: #1540532
  * bcache: Add a cond_resched() call to gc
    - LP: #1540532
  * bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing
    device
    - LP: #1540532
  * bcache: fix a leak in bch_cached_dev_run()
    - LP: #1540532
  * bcache: unregister reboot notifier if bcache fails to unregister device
    - LP: #1540532
  * bcache: allows use of register in udev to avoid "device_busy" error.
    - LP: #1540532
  * bcache: Change refill_dirty() to always scan entire disk if necessary
    - LP: #1540532
  * wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
    - LP: #1540532
  * Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
    - LP: #1540532
  * libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
    - LP: #1540532
  * x86/xen: don't reset vcpu_info on a cancelled suspend
    - LP: #1540532
  * udf: Prevent buffer overrun with multi-byte characters
    - LP: #1540532
  * udf: Check output buffer length when converting name to CS0
    - LP: #1540532
  * drm/dp/mst: process broadcast messages correctly
    - LP: #1540532
  * drm/dp/mst: always send reply for UP request
    - LP: #1540532
  * drm/dp/mst: fix in MSTB RAD initialization
    - LP: #1540532
  * drm/dp/mst: fix in RAD element access
    - LP: #1540532
  * PCI: Fix minimum allocation address overwrite
    - LP: #1540532
  * PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
    - LP: #1540532
  * btrfs: handle invalid num_stripes in sys_array
    - LP: #1540532
  * iwlwifi: update and fix 7265 series PCI IDs
    - LP: #1540532
  * iwlwifi: pcie: properly configure the debug buffer size for 8000
    - LP: #1540532
  * locks: fix unlock when fcntl_setlk races with a close
    - LP: #1540532
  * scsi: add Synology to 1024 sector blacklist
    - LP: #1540532
  * ASoC: compress: Fix compress device direction check
    - LP: #1540532
  * dm snapshot: fix hung bios when copy error occurs
    - LP: #1540532
  * uml: fix hostfs mknod()
    - LP: #1540532
  * uml: flush stdout before forking
    - LP: #1540532
  * drm/nouveau/kms: take mode_config mutex in connector hotplug path
    - LP: #1540532
  * ALSA: usb: Add native DSD support for Oppo HA-1
    - LP: #1540532
  * ALSA: hda - Fixup inverted internal mic for Lenovo E50-80
    - LP: #1529624, #1540532
  * x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
    - LP: #1540532
  * x86/boot: Double BOOT_HEAP_SIZE to 64KB
    - LP: #1540532
  * s390: fix normalization bug in exception table sorting
    - LP: #1540532
  * xfs: inode recovery readahead can race with inode buffer creation
    - LP: #1540532
  * xfs: handle dquot buffer readahead in log recovery correctly
    - LP: #1540532
  * clocksource/drivers/vt8500: Increase the minimum delta
    - LP: #1540532
  * Input: elantech - mark protocols v2 and v3 as semi-mt
    - LP: #1540532
  * x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
    - LP: #1540532
  * ALSA: seq: Fix missing NULL check at remove_events ioctl
    - LP: #1540532
  * ALSA: seq: Fix race at timer setup and close
    - LP: #1540532
  * virtio_balloon: fix race by fill and leak
    - LP: #1540532
  * virtio_balloon: fix race between migration and ballooning
    - LP: #1540532
  * ALSA: hda - Fix white noise on Dell Latitude E5550
    - LP: #1540532
  * parisc: Fix __ARCH_SI_PREAMBLE_SIZE
    - LP: #1540532
  * scripts/recordmcount.pl: support data in text section on powerpc
    - LP: #1540532
  * powerpc/module: Handle R_PPC64_ENTRY relocations
    - LP: #1540532
  * ALSA: hda - fix the headset mic detection problem for a Dell laptop
    - LP: #1533461, #1540532
  * ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices
    - LP: #1540532
  * drm/i915: Restore inhibiting the load of the default context
    - LP: #1540532
  * drm/i915: intel_hpd_init(): Fix suspend/resume reprobing
    - LP: #1540532
  * x86/mm: Improve switch_mm() barrier comments
    - LP: #1540532
  * ALSA: timer: Fix double unlink of active_list
    - LP: #1540532
  * dmaengine: dw: fix cyclic transfer setup
    - LP: #1540532
  * dmaengine: dw: fix cyclic transfer callbacks
    - LP: #1540532
  * mmc: mmci: fix an ages old detection error
    - LP: #1540532
  * ALSA: timer: Fix race among timer ioctls
    - LP: #1540532
  * sparc64: fix incorrect sign extension in sys_sparc64_personality
    - LP: #1540532
  * cifs: Ratelimit kernel log messages
    - LP: #1540532
  * cifs: fix race between call_async() and reconnect()
    - LP: #1540532
  * cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
    - LP: #1540532
  * m32r: fix m32104ut_defconfig build fail
    - LP: #1540532
  * dma-debug: switch check from _text to _stext
    - LP: #1540532
  * scripts/bloat-o-meter: fix python3 syntax error
    - LP: #1540532
  * ocfs2/dlm: ignore cleaning the migration mle that is inuse
    - LP: #1540532
  * ALSA: hda - Add fixup for Dell Latitidue E6540
    - LP: #1540532
  * ALSA: timer: Harden slave timer list handling
    - LP: #1540532
  * zram/zcomp: use GFP_NOIO to allocate streams
    - LP: #1540532
  * zram: try vmalloc() after kmalloc()
    - LP: #1540532
  * ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba
    Portege R700
    - LP: #1540532
  * ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba
    Satellite R830
    - LP: #1540532
  * mm: soft-offline: check return value in second __get_any_page() call
    - LP: #1540532
  * zram: don't call idr_remove() from zram_remove()
    - LP: #1540532
  * memcg: only free spare array when readers are done
    - LP: #1540532
  * panic: release stale console lock to always get the logbuf printed out
    - LP: #1540532
  * kernel/panic.c: turn off locks debug before releasing console lock
    - LP: #1540532
  * printk: do cond_resched() between lines while outputting to consoles
    - LP: #1540532
  * ALSA: hda - Fix bass pin fixup for ASUS N550JX
    - LP: #1540532
  * crypto: algif_skcipher - Require setkey before accept(2)
    - LP: #1540532
  * crypto: af_alg - Disallow bind/setkey/... after accept(2)
    - LP: #1540532
  * crypto: af_alg - Fix socket double-free when accept fails
    - LP: #1540532
  * crypto: af_alg - Add nokey compatibility path
    - LP: #1540532
  * crypto: algif_skcipher - Add nokey compatibility path
    - LP: #1540532
  * crypto: hash - Add crypto_ahash_has_setkey
    - LP: #1540532
  * crypto: algif_hash - Require setkey before accept(2)
    - LP: #1540532
  * crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
    - LP: #1540532
  * crypto: algif_hash - Remove custom release parent function
    - LP: #1540532
  * crypto: algif_skcipher - Remove custom release parent function
    - LP: #1540532
  * crypto: af_alg - Forbid bind(2) when nokey child sockets are present
    - LP: #1540532
  * lib: sw842: select crc32
    - LP: #1540532
  * crypto: algif_hash - Fix race condition in hash_check_key
    - LP: #1540532
  * crypto: algif_skcipher - Fix race condition in skcipher_check_key
    - LP: #1540532
  * ALSA: hrtimer: Fix stall by hrtimer_cancel()
    - LP: #1540532
  * dmaengine: at_xdmac: fix resume for cyclic transfers
    - LP: #1540532
  * ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    - LP: #1540532
  * ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    - LP: #1540532
  * ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
    - LP: #1540532
  * ARM: debug-ll: fix BCM63xx entry for multiplatform
    - LP: #1540532
  * xfs: log mount failures don't wait for buffers to be released
    - LP: #1540532
  * crypto: algif_skcipher - Load TX SG list after waiting
    - LP: #1540532
  * crypto: crc32c - Fix crc32c soft dependency
    - LP: #1540532
  * IB/qib: fix mcast detach when qp not attached
    - LP: #1540532
  * IB/qib: Support creating qps with GFP_NOIO flag
    - LP: #1540532
  * IB/mlx5: Expose correct maximum number of CQE capacity
    - LP: #1540532
  * IB/cm: Fix a recently introduced deadlock
    - LP: #1540532
  * ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list
    - LP: #1540532
  * Btrfs: fix deadlock running delayed iputs at transaction commit time
    - LP: #1540532
  * iscsi-target: Fix potential dead-lock during node acl delete
    - LP: #1540532
  * crypto: algif_skcipher - sendmsg SG marking is off by one
    - LP: #1540532
  * ALSA: hda - Flush the pending probe work at remove
    - LP: #1540532
  * zsmalloc: fix migrate_zspage-zs_free race condition
    - LP: #1540532
  * prctl: take mmap sem for writing to protect against others
    - LP: #1540532
  * ALSA: timer: Handle disconnection more safely
    - LP: #1540532
  * libceph: fix ceph_msg_revoke()
    - LP: #1540532
  * MIPS: Loongson-3: Fix SMP_ASK_C0COUNT IPI handler
    - LP: #1540532
  * MIPS: hpet: Choose a safe value for the ETIME check
    - LP: #1540532
  * ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with
    ocfs2_unblock_lock
    - LP: #1540532
  * pNFS/flexfiles: Fix an XDR encoding bug in layoutreturn
    - LP: #1540532
  * make sure that freeing shmem fast symlinks is RCU-delayed
    - LP: #1540532
  * MAINTAINERS: return arch/sh to maintained state, with new maintainers
    - LP: #1540532
  * MIPS: Fix some missing CONFIG_CPU_MIPSR6 #ifdefs
    - LP: #1540532
  * ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
    - LP: #1540532
  * drm/i915: On fb alloc failure, unref gem object where it gets refed
    - LP: #1540532
  * [media] rc: allow rc modules to be loaded if rc-main is not a module
    - LP: #1540532
  * [media] lirc_imon: do not leave imon_probe() with mutex held
    - LP: #1540532
  * SCSI: initio: remove duplicate module device table
    - LP: #1540532
  * clk: xgene: Fix divider with non-zero shift value
    - LP: #1540532
  * clk: st: avoid uninitialized variable use
    - LP: #1540532
  * MAINTAINERS: gpio-brcmstb: Remove stray '>'
    - LP: #1540532
  * ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
    - LP: #1540532
  * PCI/MSI: Initialize MSI capability for all architectures
    - LP: #1540532
  * ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - LP: #1540532
  * ASoC: tegra_alc5632: check return value
    - LP: #1540532
  * mtd: nand: fix ONFI parameter page layout
    - LP: #1540532
  * mac80211: fix mgmt-tx abort cookie and leak
    - LP: #1540532
  * mtd: nand: denali: add missing nand_release() call in denali_remove()
    - LP: #1540532
  * Drivers: hv: util: catch allocation errors
    - LP: #1540532
  * Drivers: hv: utils: use memdup_user in hvt_op_write
    - LP: #1540532
  * tpm_tis: Use devm_free_irq not free_irq
    - LP: #1540532
  * ALSA: fm801: explicitly free IRQ line
    - LP: #1540532
  * ARM: imx: select SRC for i.MX7
    - LP: #1540532
  * ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - LP: #1540532
  * ALSA: fm801: detect FM-only card earlier
    - LP: #1540532
  * pinctrl: bcm2835: Fix memory leak in error path
    - LP: #1540532
  * mmc: sdhci: restore behavior when setting VDD via external regulator
    - LP: #1540532
  * x86/LDT: Print the real LDT base address
    - LP: #1540532
  * sysrq: Fix warning in sysrq generated crash.
    - LP: #1540532
  * kconfig: return 'false' instead of 'no' in bool function
    - LP: #1540532
  * perf/x86: Fix filter_events() bug with event mappings
    - LP: #1540532
  * perf/x86: fix PEBS issues on Intel Atom/Core2
    - LP: #1540532
  * power: test_power: correctly handle empty writes
    - LP: #1540532
  * firmware: actually return NULL on failed request_firmware_nowait()
    - LP: #1540532
  * target: Fix a memory leak in target_dev_lba_map_store()
    - LP: #1540532
  * phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
    - LP: #1540532
  * m68k/atari, m68k/sun3: Fix SCSI platform device registration when
    driver is modular
    - LP: #1540532
  * um: Fix build error and kconfig for i386
    - LP: #1540532
  * net: sctp: prevent writes to cookie_hmac_alg from accessing invalid
    memory
    - LP: #1540532
  * ipv6: tcp: add rcu locking in tcp_v6_send_synack()
    - LP: #1540532
  * bonding: Prevent IPv6 link local address on enslaved devices
    - LP: #1540532
  * kbuild: Demote 'sign-compare' warning to W=2
    - LP: #1540532
  * mmc: sd: limit SD card power limit according to cards capabilities
    - LP: #1540532
  * net: tcp_memcontrol: properly detect ancestor socket pressure
    - LP: #1540532
  * vmstat: make vmstat_updater deferrable again and shut down on idle
    - LP: #1540532
  * include/linux/memblock.h: fix ordering of 'flags' argument in comments
    - LP: #1540532
  * Btrfs: clean up an error code in btrfs_init_space_info()
    - LP: #1540532
  * btrfs: initialize the seq counter in struct btrfs_device
    - LP: #1540532
  * bridge: fix lockdep addr_list_lock false positive splat
    - LP: #1540532
  * batman-adv: Avoid recursive call_rcu for batadv_bla_claim
    - LP: #1540532
  * batman-adv: Avoid recursive call_rcu for batadv_nc_node
    - LP: #1540532
  * batman-adv: Drop immediate batadv_orig_ifinfo free function
    - LP: #1540532
  * batman-adv: Drop immediate batadv_neigh_node free function
    - LP: #1540532
  * batman-adv: Drop immediate neigh_ifinfo free function
    - LP: #1540532
  * batman-adv: Drop immediate orig_node free function
    - LP: #1540532
  * printk: help pr_debug and pr_devel to optimize out arguments
    - LP: #1540532
  * ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
    - LP: #1540532
  * team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
    - LP: #1540532
  * mmc: debugfs: correct wrong voltage value
    - LP: #1540532
  * IB/mlx4: Initialize hop_limit when creating address handle
    - LP: #1540532
  * net/mlx4: Remove unused macro
    - LP: #1540532
  * NFSv4: Don't perform cached access checks before we've OPENed the file
    - LP: #1540532
  * NFS: Ensure we revalidate attributes before using execute_ok()
    - LP: #1540532
  * veth: don’t modify ip_summed; doing so treats packets with bad
    checksums as good.
    - LP: #1540532
  * net: cdc_ncm: avoid changing RX/TX buffers on MTU changes
    - LP: #1540532
  * sctp: sctp should release assoc when sctp_make_abort_user return NULL
    in sctp_close
    - LP: #1540532
  * connector: bump skb->users before callback invocation
    - LP: #1540532
  * af_unix: Fix splice-bind deadlock
    - LP: #1540532
  * unix: properly account for FDs passed over unix sockets
    - LP: #1540532
  * bridge: Only call /sbin/bridge-stp for the initial network namespace
    - LP: #1540532
  * tcp_yeah: don't set ssthresh below 2
    - LP: #1540532
  * sched,cls_flower: set key address type when present
    - LP: #1540532
  * udp: disallow UFO for sockets with SO_NO_CHECK option
    - LP: #1540532
  * net: preserve IP control block during GSO segmentation
    - LP: #1540532
  * phonet: properly unshare skbs in phonet_rcv()
    - LP: #1540532
  * net: bpf: reject invalid shifts
    - LP: #1540532
  * batman-adv: Drop immediate batadv_hard_iface free function
    - LP: #1540532
  * vxlan: fix test which detect duplicate vxlan iface
    - LP: #1540532
  * ipv6: update skb->csum when CE mark is propagated
    - LP: #1540532
  * Linux 4.2.8-ckt3
    - LP: #1540532

-- Luis Henriques <luis.henriques@canonical.com>  Fri, 19 Feb 2016 10:25:02 +0000

Changed in linux (Ubuntu Wily):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-02-22:

#17

Download full text (12.3 KiB)

This bug was fixed in the package linux - 3.19.0-51.57

---------------
linux (3.19.0-51.57) vivid; urgency=low

[ Seth Forshee ]

  * SAUCE: cred: Add clone_cred() interface
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of selectively
    raising caps
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux (3.19.0-50.56) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1540576

[ J. R. Okajima ]

  * SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

[ John Johansen ]

  * SAUCE: (no-up): apparmor: fix for failed mediation of socket that is
    being shutdown
    - LP: #1446906

[ Upstream Kernel Changes ]

  * drivers/base/memory.c: fix kernel warning during memory hotplug on
    ppc64
    - LP: #1463654
  * sched/wait: Fix signal handling in bit wait helpers
    - LP: #1537859
  * sched/wait: Fix the signal handling fix
    - LP: #1537859
  * ARC: Fix silly typo in MAINTAINERS file
    - LP: #1537859
  * ip6mr: call del_timer_sync() in ip6mr_free_table()
    - LP: #1537859
  * gre6: allow to update all parameters via rtnl
    - LP: #1537859
  * atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation
    - LP: #1537859
  * sctp: use the same clock as if sock source timestamps were on
    - LP: #1537859
  * sctp: update the netstamp_needed counter when copying sockets
    - LP: #1537859
  * sctp: also copy sk_tsflags when copying the socket
    - LP: #1537859
  * net: qca_spi: fix transmit queue timeout handling
    - LP: #1537859
  * ipv6: sctp: clone options to avoid use after free
    - LP: #1537859
  * net: add validation for the socket syscall protocol argument
    - LP: #1537859
  * sh_eth: fix kernel oops in skb_put()
    - LP: #1537859
  * net: fix IP early demux races
    - LP: #1537859
  * vlan: Fix untag operations of stacked vlans with REORDER_HEADER off
    - LP: #1537859
  * skbuff: Fix offset error in skb_reorder_vlan_header
    - LP: #1537859
  * pptp: verify sockaddr_len in pptp_bind() and pptp_connect()
    - LP: #1537859
  * bluetooth: Validate socket address length in sco_sock_bind().
    - LP: #1537859
  * fou: clean up socket with kfree_rcu
    - LP: #1537859
  * af_unix: Revert 'lock_interruptible' in stream receive code
    - LP: #1537859
  * KEYS: Fix race between read and revoke
    - LP: #1537859
  * tools: Add a "make all" rule
    - LP: #1537859
  * efi: Disable interrupts around EFI calls, not in the epilog/prolog
    calls
    - LP: #1537859
  * fuse: break infinite loop in fuse_fill_write_pages()
    - LP: #1537859
  * usb: gadget: pxa2...

This bug was fixed in the package linux - 3.19.0-51.57

---------------
linux (3.19.0-51.57) vivid; urgency=low

[ Seth Forshee ]

* SAUCE: cred: Add clone_cred() interface
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of selectively
    raising caps
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1531747, #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux (3.19.0-50.56) vivid; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #1540576

[ J. R. Okajima ]

* SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

[ John Johansen ]

* SAUCE: (no-up): apparmor: fix for failed mediation of socket that is
    being shutdown
    - LP: #1446906

[ Upstream Kernel Changes ]

* drivers/base/memory.c: fix kernel warning during memory hotplug on
    ppc64
    - LP: #1463654
  * sched/wait: Fix signal handling in bit wait helpers
    - LP: #1537859
  * sched/wait: Fix the signal handling fix
    - LP: #1537859
  * ARC: Fix silly typo in MAINTAINERS file
    - LP: #1537859
  * ip6mr: call del_timer_sync() in ip6mr_free_table()
    - LP: #1537859
  * gre6: allow to update all parameters via rtnl
    - LP: #1537859
  * atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation
    - LP: #1537859
  * sctp: use the same clock as if sock source timestamps were on
    - LP: #1537859
  * sctp: update the netstamp_needed counter when copying sockets
    - LP: #1537859
  * sctp: also copy sk_tsflags when copying the socket
    - LP: #1537859
  * net: qca_spi: fix transmit queue timeout handling
    - LP: #1537859
  * ipv6: sctp: clone options to avoid use after free
    - LP: #1537859
  * net: add validation for the socket syscall protocol argument
    - LP: #1537859
  * sh_eth: fix kernel oops in skb_put()
    - LP: #1537859
  * net: fix IP early demux races
    - LP: #1537859
  * vlan: Fix untag operations of stacked vlans with REORDER_HEADER off
    - LP: #1537859
  * skbuff: Fix offset error in skb_reorder_vlan_header
    - LP: #1537859
  * pptp: verify sockaddr_len in pptp_bind() and pptp_connect()
    - LP: #1537859
  * bluetooth: Validate socket address length in sco_sock_bind().
    - LP: #1537859
  * fou: clean up socket with kfree_rcu
    - LP: #1537859
  * af_unix: Revert 'lock_interruptible' in stream receive code
    - LP: #1537859
  * KEYS: Fix race between read and revoke
    - LP: #1537859
  * tools: Add a "make all" rule
    - LP: #1537859
  * efi: Disable interrupts around EFI calls, not in the epilog/prolog
    calls
    - LP: #1537859
  * fuse: break infinite loop in fuse_fill_write_pages()
    - LP: #1537859
  * usb: gadget: pxa27x: fix suspend callback
    - LP: #1537859
  * iio: fix some warning messages
    - LP: #1537859
  * USB: cp210x: Remove CP2110 ID from compatibility list
    - LP: #1537859
  * USB: cdc_acm: Ignore Infineon Flash Loader utility
    - LP: #1537859
  * ext4: Fix handling of extended tv_sec
    - LP: #1537859
  * jbd2: Fix unreclaimed pages after truncate in data=journal mode
    - LP: #1537859
  * drm/ttm: Fixed a read/write lock imbalance
    - LP: #1537859
  * i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
    - LP: #1537859
  * AHCI: Fix softreset failed issue of Port Multiplier
    - LP: #1537859
  * sata_sil: disable trim
    - LP: #1537859
  * usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter
    JMicron
    - LP: #1537859
  * staging: lustre: echo_copy.._lsm() dereferences userland pointers
    directly
    - LP: #1537859
  * irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
    - LP: #1537859
  * usb: core : hub: Fix BOS 'NULL pointer' kernel panic
    - LP: #1537859
  * USB: whci-hcd: add check for dma mapping error
    - LP: #1537859
  * usb: Use the USB_SS_MULT() macro to decode burst multiplier for log
    message
    - LP: #1537859
  * xen/events/fifo: Consume unprocessed events when a CPU dies
    - LP: #1537859
  * dm btree: fix leak of bufio-backed block in btree_split_sibling error
    path
    - LP: #1537859
  * ARM: 8465/1: mm: keep reserved ASIDs in sync with mm after multiple
    rollovers
    - LP: #1537859
  * perf: Fix PERF_EVENT_IOC_PERIOD deadlock
    - LP: #1537859
  * usb: xhci: fix config fail of FS hub behind a HS hub with MTT
    - LP: #1537859
  * ALSA: rme96: Fix unexpected volume reset after rate changes
    - LP: #1537859
  * net: mvpp2: fix missing DMA region unmap in egress processing
    - LP: #1537859
  * net: mvpp2: fix buffers' DMA handling on RX path
    - LP: #1537859
  * net: mvpp2: fix refilling BM pools in RX path
    - LP: #1537859
  * dmaengine: at_xdmac: fix macro typo
    - LP: #1537859
  * ALSA: hda - Add inverted dmic for Packard Bell DOTS
    - LP: #1523232, #1537859
  * vhost: relax log address alignment
    - LP: #1537859
  * virtio: fix memory leak of virtio ida cache layers
    - LP: #1537859
  * IB/srp: Fix a memory leak
    - LP: #1537859
  * IB/srp: Fix possible send queue overflow
    - LP: #1537859
  * ALSA: hda - Fixing speaker noise on the two latest thinkpad models
    - LP: #1523517, #1537859
  * 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
    - LP: #1537859
  * radeon/cik: Fix GFX IB test on Big-Endian
    - LP: #1537859
  * radeon: Fix VCE ring test for Big-Endian systems
    - LP: #1537859
  * radeon: Fix VCE IB test on Big-Endian systems
    - LP: #1537859
  * video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
    - LP: #1537859
  * crypto: skcipher - Copy iv from desc even for 0-len walks
    - LP: #1537859
  * ALSA: hda - Fix noise problems on Thinkpad T440s
    - LP: #1537859
  * dm thin metadata: fix bug when taking a metadata snapshot
    - LP: #1537859
  * dm space map metadata: fix ref counting bug when bootstrapping a new
    space map
    - LP: #1537859
  * ipmi: move timer init to before irq is setup
    - LP: #1537859
  * ASoC: es8328: Fix deemphasis values
    - LP: #1537859
  * KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
    - LP: #1537859
  * rfkill: copy the name into the rfkill struct
    - LP: #1537859
  * dm btree: fix bufio buffer leaks in dm_btree_del() error path
    - LP: #1537859
  * ses: Fix problems with simple enclosures
    - LP: #1537859
  * vgaarb: fix signal handling in vga_get()
    - LP: #1537859
  * ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx
    - LP: #1537859
  * ARM: dts: vf610: use reset values for L2 cache latencies
    - LP: #1537859
  * ses: fix additional element traversal bug
    - LP: #1537859
  * xhci: fix usb2 resume timing and races.
    - LP: #1537859
  * USB: add quirk for devices with broken LPM
    - LP: #1537859
  * powercap / RAPL: fix BIOS lock check
    - LP: #1537859
  * parisc iommu: fix panic due to trying to allocate too large region
    - LP: #1537859
  * mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
    - LP: #1537859
  * vmstat: Reduce time interval to stat update on idle cpu
    - LP: #1537859
  * mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't
    make any progress
    - LP: #1537859
  * mm: hugetlb: call huge_pte_alloc() only if ptep is null
    - LP: #1537859
  * drivers/base/memory.c: prohibit offlining of memory blocks with missing
    sections
    - LP: #1537859
  * ocfs2: fix SGID not inherited issue
    - LP: #1537859
  * sh64: fix __NR_fgetxattr
    - LP: #1537859
  * ASoC: wm8974: set cache type for regmap
    - LP: #1537859
  * n_tty: Fix poll() after buffer-limited eof push read
    - LP: #1537859
  * tty: Fix GPF in flush_to_ldisc()
    - LP: #1537859
  * genirq: Prevent chip buslock deadlock
    - LP: #1537859
  * ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
    DragonFly
    - LP: #1537859
  * ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
    - LP: #1537859
  * ARM: 8471/1: need to save/restore arm register(r11) when it is
    corrupted
    - LP: #1537859
  * ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd
    - LP: #1537859
  * spi: fix parent-device reference leak
    - LP: #1537859
  * scripts: recordmcount: break hardlinks
    - LP: #1537859
  * dma-debug: Fix dma_debug_entry offset calculation
    - LP: #1537859
  * ftrace/scripts: Have recordmcount copy the object file
    - LP: #1537859
  * ARC: dw2 unwind: Reinstante unwinding out of modules
    - LP: #1537859
  * ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing
    - LP: #1537859
  * powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type
    - LP: #1537859
  * ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
    - LP: #1537859
  * s390/dis: Fix handling of format specifiers
    - LP: #1537859
  * airspy: increase USB control message buffer size
    - LP: #1537859
  * USB: ipaq.c: fix a timeout loop
    - LP: #1537859
  * USB: fix invalid memory access in hub_activate()
    - LP: #1537859
  * x86/mce: Ensure offline CPUs don't participate in rendezvous process
    - LP: #1537859
  * i2c: rcar: disable runtime PM correctly in slave mode
    - LP: #1537859
  * parisc: Fix syscall restarts
    - LP: #1537859
  * ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
    - LP: #1537859
  * MIPS: uaccess: Fix strlen_user with EVA
    - LP: #1537859
  * ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
    - LP: #1537859
  * arm: fix handling of F_OFD_... in oabi_fcntl64()
    - LP: #1537859
  * ocfs2: fix BUG when calculate new backup super
    - LP: #1537859
  * mm/memory_hotplug.c: check for missing sections in
    test_pages_in_a_zone()
    - LP: #1537859
  * ftrace/scripts: Fix incorrect use of sprintf in recordmcount
    - LP: #1537859
  * tracing: Fix setting of start_index in find_next()
    - LP: #1537859
  * tile: provide CONFIG_PAGE_SIZE_64KB etc for tilepro
    - LP: #1537859
  * ARM: versatile: fix MMC/SD interrupt assignment
    - LP: #1537859
  * async_tx: use GFP_NOWAIT rather than GFP_IO
    - LP: #1537859
  * dts: vt8500: Add SDHC node to DTS file for WM8650
    - LP: #1537859
  * ftrace/module: Call clean up function when module init fails early
    - LP: #1537859
  * vmstat: allocate vmstat_wq before it is used
    - LP: #1537859
  * usb: musb: USB_TI_CPPI41_DMA requires dmaengine support
    - LP: #1537859
  * sctp: convert sack_needed and sack_generation to bits
    - LP: #1537859
  * sctp: start t5 timer only when peer rwnd is 0 and local state is
    SHUTDOWN_PENDING
    - LP: #1537859
  * pinctrl: bcm2835: Fix initial value for direction_output
    - LP: #1537859
  * net: phy: mdio-mux: Check return value of mdiobus_alloc()
    - LP: #1537859
  * sh_eth: fix TX buffer byte-swapping
    - LP: #1537859
  * mISDN: fix a loop count
    - LP: #1537859
  * amd-xgbe: fix a couple timeout loops
    - LP: #1537859
  * qlcnic: fix a timeout loop
    - LP: #1537859
  * ser_gigaset: fix deallocation of platform device structure
    - LP: #1537859
  * net: fix warnings in 'make htmldocs' by moving macro definition out of
    field declaration
    - LP: #1537859
  * net/mlx4_en: Remove dependency between timestamping capability and
    service_task
    - LP: #1537859
  * net/mlx4_en: Fix HW timestamp init issue upon system startup
    - LP: #1537859
  * include/linux/mmdebug.h: should include linux/bug.h
    - LP: #1537859
  * ipv6/addrlabel: fix ip6addrlbl_get()
    - LP: #1537859
  * ASoC: Use nested lock for snd_soc_dapm_mutex_lock
    - LP: #1537859
  * net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
    - LP: #1537859
  * net: sched: fix missing free per cpu on qstats
    - LP: #1537859
  * net: possible use after free in dst_release
    - LP: #1537859
  * kvm: x86: only channel 0 of the i8254 is linked to the HPET
    - LP: #1537859
  * firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
    - LP: #1537859
  * Linux 3.19.8-ckt13
    - LP: #1537859
  * hotplugcpu: Avoid deadlocks by waking active_writer
    - LP: #1481357
  * xfrm: dst_entries_init() per-net dst_ops
    - LP: #1486670

-- Luis Henriques <luis.henriques@canonical.com>  Fri, 19 Feb 2016 11:12:52 +0000

Changed in linux (Ubuntu Vivid):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-02-22:

#18

Download full text (9.5 KiB)

This bug was fixed in the package linux - 3.13.0-79.123

---------------
linux (3.13.0-79.123) trusty; urgency=low

[ Seth Forshee ]

  * SAUCE: cred: Add clone_cred() interface
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Use mounter's credentials instead of full kernel
    credentials
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.*
    xattrs
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Be more careful about copying up sxid files
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576
  * SAUCE: overlayfs: Propogate nosuid from lower and upper mounts
    - LP: #1534961, #1535150
    - CVE-2016-1575 CVE-2016-1576

linux (3.13.0-78.122) trusty; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #1540559

[ Eric Dumazet ]

* SAUCE: (no-up) udp: properly support MSG_PEEK with truncated buffers
- LP: #1527902

[ J. R. Okajima ]

  * SAUCE: ubuntu: aufs: tiny, extract a new func xino_fwrite_wkq()
    - LP: #1533043
  * SAUCE: ubuntu: aufs: for 4.3, XINO handles EINTR from the dying process
    - LP: #1533043

[ Upstream Kernel Changes ]

  * Revert "[stable-only] net: add length argument to
    skb_copy_and_csum_datagram_iovec"
    - LP: #1538756
  * unregister_netdevice : move RTM_DELLINK to until after ndo_uninit
    - LP: #1525324
  * rtnetlink: delay RTM_DELLINK notification until after ndo_uninit()
    - LP: #1525324
  * Drivers: hv: Eliminate the channel spinlock in the callback path
    - LP: #1519897
  * Drivers: hv: vmbus: Implement per-CPU mapping of relid to channel
    - LP: #1519897
  * Drivers: hv: vmbus: Suport an API to send pagebuffers with additional
    control
    - LP: #1519897
  * Drivers: hv: vmbus: Suport an API to send packet with additional
    control
    - LP: #1519897
  * Drivers: hv: vmbus: Export the vmbus_sendpacket_pagebuffer_ctl()
    - LP: #1519897
  * Drivers: hv: vmbus: Fix a siganlling host signalling issue
    - LP: #1519897
  * Drivers: hv: vmbus: Fix a Host signaling bug
    - LP: #1519897
  * ARC: Fix silly typo in MAINTAINERS file
    - LP: #1538756
  * ip6mr: call del_timer_sync() in ip6mr_free_table()
    - LP: #1538756
  * gre6: allow to update all parameters via rtnl
    - LP: #1538756
  * atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation
    - LP: #1538756
  * sctp: use the same clock as if sock source timestamps were on
    - LP: #1538756
  * sctp: update the netstamp_needed counter when copying sockets
    - LP: #1538756
  * ipv6: sctp: clone options to avoid use after free
    - LP: #1538756
  * net: add validation for the socket syscall protocol argument
    - LP: #1538756
  * sh_eth: fix kernel oops in skb_put()
    - LP: #1538756
  * pptp: verify sockaddr_len in pptp_bind() and pptp_connect()
    - LP: #1538756
  * bluetooth: Validate socket address length in sco_sock_bind().
    - LP: #1538756
  * af_unix: Revert 'lock_interruptible' in stream receive code
    - LP: #1538756
  * KEYS: Fix race between read and revoke
    - LP: #1538756
  * tools: Add a "make all" rule
    - LP: #1538...

Ubuntu
linux package

using ipsec, many connections result in no buffer space error

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Undecided	Dan Streetman
Precise	Invalid	Undecided	Dan Streetman
Trusty	Fix Released	Undecided	Dan Streetman
Vivid	Fix Released	Undecided	Dan Streetman
Wily	Fix Released	Undecided	Dan Streetman

Changed in linux (Ubuntu):
status:	In Progress → Fix Released

Ubuntulinux package

using ipsec, many connections result in no buffer space error

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package