linux (3.13.0-141.190) trusty; urgency=low

  * linux: 3.13.0-141.190 -proposed tracker (LP: #1744308)

  * ubuntu_32_on_64 test crash Trusty 3.13.0-140 amd64 system (LP: #1744199) //
    test_too_early_vsyscall from ubuntu_qrt_kernel_panic crashes Trusty
    3.13.0-140 amd64 system (LP: #1744226) // CVE-2017-5715 // CVE-2017-5753
    - SAUCE: x86/entry: Fixup 32bit compat call locations

  * CVE-2017-5715 // CVE-2017-5753
    - SAUCE: x86/cpuid: Fix ordering of scattered feature list
    - SAUCE: KVM: Fix spec_ctrl CPUID support for guests

  * CVE-2017-5754
    - kaiser: Set _PAGE_NX only if supported
    - kaiser: Set _PAGE_NX only if supported

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 19 Jan 2018 13:23:30 +0100

linux (3.13.0-140.189) trusty; urgency=low

  * linux: 3.13.0-140.189 -proposed tracker (LP: #1743375)

  [ Stefan Bader ]
  * CVE-2017-5715 // CVE-2017-5753
    - x86, microcode: Share native MSR accessing variants
    - x86: Add another set of MSR accessor functions
    - x86/cpuid: Provide get_scattered_cpuid_leaf()
    - kvm: vmx: Scrub hardware GPRs at VM-exit
    - SAUCE: locking/barriers: introduce new memory barrier gmb()
    - SAUCE: uvcvideo: prevent speculative execution
    - SAUCE: carl9170: prevent speculative execution
    - SAUCE: p54: prevent speculative execution
    - SAUCE: qla2xxx: prevent speculative execution
    - SAUCE: cw1200: prevent speculative execution
    - SAUCE: userns: prevent speculative execution
    - SAUCE: fs: prevent speculative execution
    - SAUCE: udf: prevent speculative execution
    - SAUCE: x86/feature: Enable the x86 feature to control Speculation
    - SAUCE: x86/feature: Report presence of IBPB and IBRS control
    - SAUCE: x86/enter: MACROS to set/clear IBRS and set IBPB
    - SAUCE: x86/enter: Use IBRS on syscall and interrupts
    - SAUCE: x86/idle: Disable IBRS entering idle and enable it on wakeup
    - SAUCE: x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup
    - SAUCE: x86/mm: Set IBPB upon context switch
    - SAUCE: x86/mm: Only set IBPB when the new thread cannot ptrace current
      thread
    - SAUCE: x86/entry: Stuff RSB for entry to kernel for non-SMEP platform
    - SAUCE: x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm
    - SAUCE: x86/kvm: Set IBPB when switching VM
    - SAUCE: x86/kvm: Toggle IBRS on VM entry and exit
    - SAUCE: x86/kvm: Pad RSB on VM transition
    - SAUCE: x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature
    - SAUCE: x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb control
    - SAUCE: x86/entry: Use retpoline for syscall's indirect calls
    - SAUCE: x86/cpu/AMD: Add speculative control support for AMD
    - SAUCE: x86/microcode: Extend post microcode reload to support IBPB feature
    - SAUCE: KVM: SVM: Do not intercept new speculative control MSRs
    - SAUCE: x86/svm: Set IBRS value on VM entry and exit
    - SAUCE: x86/svm: Set IBPB when running a different VCPU
    - SAUCE: KVM: x86: Add speculative control CPUID support for guests
    - SAUCE: x86/svm: Add code to clobber the RSB on VM exit
    - SAUCE: x86/cpu/AMD: Make the LFENCE instruction serialized
    - SAUCE: x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
    - SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit
    - SAUCE: arm64: no gmb() implementation yet
    - SAUCE: arm: no gmb() implementation yet
    - SAUCE: powerpc: no gmb() implementation yet

  * Do not duplicate changelog entries assigned to more than one bug or CVE
    (LP: #1743383)
    - [Packaging] git-ubuntu-log -- handle multiple bugs/cves better

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Mon, 15 Jan 2018 13:38:40 -0200

linux (3.13.0-139.188) trusty; urgency=low

  * linux: 3.13.0-139.188 -proposed tracker (LP: #1741609)

  * CVE-2017-5754
    - perf/x86: Correctly use FEATURE_PDCM
    - arch: Introduce smp_load_acquire(), smp_store_release()
    - mm, x86: Account for TLB flushes only when debugging
    - x86/mm: Clean up inconsistencies when flushing TLB ranges
    - x86/mm: Eliminate redundant page table walk during TLB range flushing
    - mm, x86: Revisit tlb_flushall_shift tuning for page flushes except on
      IvyBridge
    - x86/mm: Clean up the TLB flushing code
    - x86/mm: Rip out complicated, out-of-date, buggy TLB flushing
    - x86/mm: Fix missed global TLB flush stat
    - x86/mm: New tunable for single vs full TLB flush
    - x86/mm: Set TLB flush tunable to sane value (33)
    - x86/mm: Fix sparse 'tlb_single_page_flush_ceiling' warning and make the
      variable read-mostly
    - rcu: Provide counterpart to rcu_dereference() for non-RCU situations
    - rcu: Move lockless_dereference() out of rcupdate.h
    - x86/ldt: Make modify_ldt synchronous
    - x86/ldt: Correct LDT access in single stepping logic
    - x86/ldt: Correct FPU emulation access to LDT
    - x86/ldt: Further fix FPU emulation
    - x86/mm: Disable preemption during CR3 read+write
    - x86: Clean up cr4 manipulation
    - x86/mm: Add INVPCID helpers
    - x86/mm: Fix INVPCID asm constraint
    - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID
    - x86/mm: If INVPCID is available, use it to flush global mappings
    - mm/mmu_context, sched/core: Fix mmu_context.h assumption
    - sched/core: Add switch_mm_irqs_off() and use it in the scheduler
    - x86/mm: Build arch/x86/mm/tlb.c even on !SMP
    - x86/mm, sched/core: Uninline switch_mm()
    - x86/mm, sched/core: Turn off IRQs in switch_mm()
    - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
    - x86/irq: Do not substract irq_tlb_count from irq_call_count
    - x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly()
    - x86/mm: Remove flush_tlb() and flush_tlb_current_task()
    - x86/mm: Make flush_tlb_mm_range() more predictable
    - x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range()
    - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP
      code
    - x86/mm: Disable PCID on 32-bit kernels
    - x86/mm: Add the 'nopcid' boot option to turn off PCID
    - x86/mm: Enable CR4.PCIDE on supported systems
    - x86/mm/64: Fix reboot interaction with CR4.PCIDE
    - KAISER: Kernel Address Isolation
    - x86/mm/kaiser: re-enable vsyscalls
    - kaiser: user_map __kprobes_text too
    - kaiser: alloc_ldt_struct() use get_zeroed_page()
    - x86/alternatives: Cleanup DPRINTK macro
    - x86/alternatives: Add instruction padding
    - x86/alternatives: Make JMPs more robust
    - x86/alternatives: Use optimized NOPs for padding
    - kaiser: add "nokaiser" boot option, using ALTERNATIVE
    - x86, boot: Carve out early cmdline parsing function
    - x86/boot: Fix early command-line parsing when matching at end
    - x86/boot: Fix early command-line parsing when partial word matches
    - x86/boot: Simplify early command line parsing
    - x86/boot: Pass in size to early cmdline parsing
    - x86/boot: Add early cmdline parsing for options with arguments
    - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling
    - x86/kaiser: Check boottime cmdline params
    - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush
    - kaiser: asm/tlbflush.h handle noPGE at lower level
    - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID
    - x86/paravirt: Dont patch flush_tlb_single
    - x86/kaiser: Reenable PARAVIRT
    - kaiser: disabled on Xen PV
    - x86/kaiser: Move feature detection up
    - KPTI: Rename to PAGE_TABLE_ISOLATION
    - KPTI: Report when enabled
    - kvmclock: export kvmclock clocksource and data pointers
    - x86/mm/kaiser: remove paravirt clock warning
    - kaiser: x86: Fix NMI handling
    - [Config] updateconfigs - enable PAGE_TABLE_ISOLATION

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 09 Jan 2018 15:11:34 +0100

linux (3.13.0-137.186) trusty; urgency=low

  * linux: 3.13.0-137.186 -proposed tracker (LP: #1736194)

  * CVE-2017-1000405
    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()

  * CVE-2017-16939
    - netlink: add a start callback for starting a netlink dump
    - ipsec: Fix aborted xfrm policy dump crash

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 04 Dec 2017 19:45:06 +0100

linux (3.13.0-136.185) trusty; urgency=low

  * linux: 3.13.0-136.185 -proposed tracker (LP: #1734733)

  * NVMe timeout is too short (LP: #1729119)
    - NVMe: Make I/O timeout a module parameter
    - nvme: update timeout module parameter type

 -- Khalid Elmously <khalid.elmously@canonical.com>  Mon, 27 Nov 2017 15:46:57 -0500

linux (3.13.0-135.184) trusty; urgency=low

  * linux: 3.13.0-135.184 -proposed tracker (LP: #1724500)

  * Trusty NVMe boot fails on some systems (LP: #1720867)
    - NVMe: RCU protected access to io queues
    - NVMe: IOCTL path RCU protect queue access
    - powerpc/mm: fix ".__node_distance" undefined
    - NVMe: per-cpu io queues
    - nvme: Use pci_enable_msi_range() and pci_enable_msix_range()
    - NVMe: make setup work for devices that don't do INTx
    - NVMe: Always use MSI/MSI-x interrupts

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Wed, 18 Oct 2017 07:09:04 -0200

linux (3.13.0-134.183) trusty; urgency=low

  * linux: 3.13.0-134.183 -proposed tracker (LP: #1722335)

  [ Thadeu Lima de Souza Cascardo ]
  * CVE-2017-10661
    - timerfd: Protect the might cancel mechanism proper

  * CVE-2017-10662
    - f2fs: sanity check segment count

  * CVE-2017-10663
    - f2fs: sanity check checkpoint segno and blkoff

  * CVE-2017-14340
    - xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present

  * CVE-2017-10911
    - xen-blkback: don't leak stack data via response ring

  * CVE-2017-11176
    - mqueue: fix a use-after-free in sys_mq_notify()

  * CVE-2016-8632
    - tipc: check minimum bearer MTU

 -- Juerg Haefliger <juerg.haefliger@canonical.com>  Tue, 10 Oct 2017 13:23:11 +0200

linux (3.13.0-133.182) trusty; urgency=low

  * linux: 3.13.0-133.182 -proposed tracker (LP: #1718159)

  [ Stefan Bader ]
  * CVE-2016-8633
    - firewire: net: guard against rx buffer overflows

  * CVE-2017-14106
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

 -- Juerg Haefliger <juerg.haefliger@canonical.com>  Tue, 19 Sep 2017 13:11:55 +0200

linux (3.13.0-132.181) trusty; urgency=low

  * linux: 3.13.0-132.181 -proposed tracker (LP: #1716634)

  * CVE-2017-1000251
    - Bluetooth: Properly check L2CAP config option output buffer length

 -- Juerg Haefliger <juerg.haefliger@canonical.com>  Wed, 13 Sep 2017 13:34:29 +0200

linux (3.13.0-131.180) trusty; urgency=low

  * linux: 3.13.0-131.180 -proposed tracker (LP: #1715439)

  * CVE-2016-7097
    - posix_acl: Clear SGID bit when setting file permissions

  * CVE-2016-9083
    - vfio/pci: Fix integer overflows, bitmask check

  * CVE-2016-9084
    - vfio/pci: Fix integer overflows, bitmask check

  * CVE-2016-9604
    - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings

  * CVE-2016-9191
    - sysctl: Drop reference added by grab_header in proc_sys_readdir

  * CVE-2016-9178
    - fix minor infoleak in get_user_ex()

  * CVE-2016-8650
    - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

  * CVE-2016-10044
    - vfs: Commit to never having exectuables on proc and sysfs.
    - aio: mark AIO pseudo-fs noexec

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 07 Sep 2017 10:14:05 +0200

# For older changelog entries, run 'apt-get changelog linux-doc'
