linux (4.4.0-135.161) xenial; urgency=medium

  * linux: 4.4.0-135.161 -proposed tracker (LP: #1788766)

  * [Regression] APM Merlin boards fail to recover link after interface down/up
    (LP: #1785739)
    - net: phylib: fix interrupts re-enablement in phy_start
    - net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT

  * qeth: don't clobber buffer on async TX completion (LP: #1786057)
    - s390/qeth: don't clobber buffer on async TX completion

  * nvme: avoid cqe corruption (LP: #1788035)
    - nvme: avoid cqe corruption when update at the same time as read

  * CacheFiles: Error: Overlong wait for old active object to go away.
    (LP: #1776254)
    - cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag
    - cachefiles: Wait rather than BUG'ing on "Unexpected object collision"

  * fscache cookie refcount updated incorrectly during fscache object allocation
    (LP: #1776277) // fscache cookie refcount updated incorrectly during fscache
    object allocation (LP: #1776277)
    - fscache: Fix reference overput in fscache_attach_object() error handling

  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
    - Revert "UBUNTU: SAUCE: CacheFiles: fix a read_waiter/read_copier race"
    - fscache: Allow cancelled operations to be enqueued
    - cachefiles: Fix refcounting bug in backing-file read monitoring

  * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
    walinuxagent.service (LP: #1739107)
    - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
      walinuxagent.service

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 26 Aug 2018 23:56:50 -0400

linux (4.4.0-134.160) xenial; urgency=medium

  * linux: 4.4.0-134.160 -proposed tracker (LP: #1787177)

  * locking sockets broken due to missing AppArmor socket mediation patches
    (LP: #1780227)
    - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets

  * Backport namespaced fscaps to xenial 4.4 (LP: #1778286)
    - Introduce v3 namespaced file capabilities
    - commoncap: move assignment of fs_ns to avoid null pointer dereference
    - capabilities: fix buffer overread on very short xattr
    - commoncap: Handle memory allocation failure.

  * Xenial update to 4.4.140 stable release (LP: #1784409)
    - usb: cdc_acm: Add quirk for Uniden UBC125 scanner
    - USB: serial: cp210x: add CESINEL device ids
    - USB: serial: cp210x: add Silicon Labs IDs for Windows Update
    - n_tty: Fix stall at n_tty_receive_char_special().
    - staging: android: ion: Return an ERR_PTR in ion_map_kernel
    - n_tty: Access echo_* variables carefully.
    - x86/boot: Fix early command-line parsing when matching at end
    - ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
    - i2c: rcar: fix resume by always initializing registers before transfer
    - ipv4: Fix error return value in fib_convert_metrics()
    - kprobes/x86: Do not modify singlestep buffer while resuming
    - nvme-pci: initialize queue memory before interrupts
    - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
    - ARM: dts: imx6q: Use correct SDMA script for SPI5 core
    - ubi: fastmap: Correctly handle interrupted erasures in EBA
    - mm: hugetlb: yield when prepping struct pages
    - tracing: Fix missing return symbol in function_graph output
    - scsi: sg: mitigate read/write abuse
    - s390: Correct register corruption in critical section cleanup
    - drbd: fix access after free
    - cifs: Fix infinite loop when using hard mount option
    - jbd2: don't mark block as modified if the handle is out of credits
    - ext4: make sure bitmaps and the inode table don't overlap with bg
      descriptors
    - ext4: always check block group bounds in ext4_init_block_bitmap()
    - ext4: only look at the bg_flags field if it is valid
    - ext4: verify the depth of extent tree in ext4_find_extent()
    - ext4: include the illegal physical block in the bad map ext4_error msg
    - ext4: clear i_data in ext4_inode_info when removing inline data
    - ext4: add more inode number paranoia checks
    - ext4: add more mount time checks of the superblock
    - ext4: check superblock mapped prior to committing
    - HID: i2c-hid: Fix "incomplete report" noise
    - HID: hiddev: fix potential Spectre v1
    - HID: debug: check length before copy_to_user()
    - x86/mce: Detect local MCEs properly
    - x86/mce: Fix incorrect "Machine check from unknown source" message
    - media: cx25840: Use subdev host data for PLL override
    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
    - dm bufio: avoid sleeping while holding the dm_bufio lock
    - dm bufio: drop the lock when doing GFP_NOIO allocation
    - mtd: rawnand: mxc: set spare area size register explicitly
    - dm bufio: don't take the lock in dm_bufio_shrink_count
    - mtd: cfi_cmdset_0002: Change definition naming to retry write operation
    - mtd: cfi_cmdset_0002: Change erase functions to retry for error
    - mtd: cfi_cmdset_0002: Change erase functions to check chip good only
    - netfilter: nf_log: don't hold nf_log_mutex during user access
    - staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
    - Linux 4.4.140

  * Xenial update to 4.4.139 stable release (LP: #1784382)
    - xfrm6: avoid potential infinite loop in _decode_session6()
    - netfilter: ebtables: handle string from userspace with care
    - ipvs: fix buffer overflow with sync daemon and service
    - atm: zatm: fix memcmp casting
    - net: qmi_wwan: Add Netgear Aircard 779S
    - net/sonic: Use dma_mapping_error()
    - Revert "Btrfs: fix scrub to repair raid6 corruption"
    - tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
    - Btrfs: make raid6 rebuild retry more
    - usb: musb: fix remote wakeup racing with suspend
    - bonding: re-evaluate force_primary when the primary slave name changes
    - tcp: verify the checksum of the first data segment in a new connection
    - ext4: update mtime in ext4_punch_hole even if no blocks are released
    - ext4: fix fencepost error in check for inode count overflow during resize
    - driver core: Don't ignore class_dir_create_and_add() failure.
    - btrfs: scrub: Don't use inode pages for device replace
    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
    - ALSA: hda: add dock and led support for HP ProBook 640 G4
    - cpufreq: Fix new policy initialization during limits updates via sysfs
    - libata: zpodd: make arrays cdb static, reduces object code size
    - libata: zpodd: small read overflow in eject_tray()
    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
    - x86/spectre_v1: Disable compiler optimizations over
      array_index_mask_nospec()
    - m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
    - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
    - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
    - usb: do not reset if a low-speed or full-speed device timed out
    - 1wire: family module autoload fails because of upper/lower case mismatch.
    - ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
    - ASoC: cirrus: i2s: Fix LRCLK configuration
    - ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
    - lib/vsprintf: Remove atomic-unsafe support for %pCr
    - mips: ftrace: fix static function graph tracing
    - branch-check: fix long->int truncation when profiling branches
    - ipmi:bt: Set the timeout before doing a capabilities check
    - Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
    - fuse: atomic_o_trunc should truncate pagecache
    - fuse: don't keep dead fuse_conn at fuse_fill_super().
    - fuse: fix control dir setup and teardown
    - powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
    - powerpc/ptrace: Fix setting 512B aligned breakpoints with
      PTRACE_SET_DEBUGREG
    - powerpc/ptrace: Fix enforcement of DAWR constraints
    - cpuidle: powernv: Fix promotion from snooze if next state disabled
    - powerpc/fadump: Unregister fadump on kexec down path.
    - ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
    - of: unittest: for strings, account for trailing 0 in property length field
    - IB/qib: Fix DMA api warning with debug kernel
    - RDMA/mlx4: Discard unknown SQP work requests
    - mtd: cfi_cmdset_0002: Change write buffer to check correct value
    - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
    - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
    - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
    - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
    - MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum
    - PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on
      resume
    - MIPS: io: Add barrier after register read in inX()
    - time: Make sure jiffies_to_msecs() preserves non-zero time periods
    - Btrfs: fix clone vs chattr NODATASUM race
    - iio:buffer: make length types match kfifo types
    - scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
    - scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
    - scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
    - scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for
      ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
    - linvdimm, pmem: Preserve read-only setting for pmem devices
    - md: fix two problems with setting the "re-add" device state.
    - ubi: fastmap: Cancel work upon detach
    - UBIFS: Fix potential integer overflow in allocation
    - xfrm: skip policies marked as dead while rehashing
    - backlight: as3711_bl: Fix Device Tree node lookup
    - backlight: max8925_bl: Fix Device Tree node lookup
    - backlight: tps65217_bl: Fix Device Tree node lookup
    - mfd: intel-lpss: Program REMAP register in PIO mode
    - perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
    - perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
    - perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
    - perf intel-pt: Fix MTC timing after overflow
    - perf intel-pt: Fix "Unexpected indirect branch" error
    - perf intel-pt: Fix packet decoding of CYC packets
    - media: v4l2-compat-ioctl32: prevent go past max size
    - media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
    - nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
    - NFSv4: Fix possible 1-byte stack overflow in
      nfs_idmap_read_and_verify_message
    - video: uvesafb: Fix integer overflow in allocation
    - Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
    - xen: Remove unnecessary BUG_ON from __unbind_from_irq()
    - udf: Detect incorrect directory size
    - Input: elan_i2c_smbus - fix more potential stack buffer overflows
    - Input: elantech - enable middle button of touchpads on ThinkPad P52
    - Input: elantech - fix V4 report decoding for module with middle key
    - ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
    - Btrfs: fix unexpected cow in run_delalloc_nocow
    - spi: Fix scatterlist elements size in spi_map_buf
    - block: Fix transfer when chunk sectors exceeds max
    - dm thin: handle running out of data space vs concurrent discard
    - cdc_ncm: avoid padding beyond end of skb
    - Bluetooth: Fix connection if directed advertising and privacy is used
    - Linux 4.4.139

  * Support AverMedia DVD EZMaker 7 USB video capture dongle (LP: #1620762) //
    Xenial update to 4.4.139 stable release (LP: #1784382)
    - media: cx231xx: Add support for AverMedia DVD EZMaker 7

  * vfio/pci: cannot assign a i40e pf device to a vm using vfio-pci
    (LP: #1779830)
    - vfio/pci: Hide broken INTx support from user

  * Kernel error "task zfs:pid blocked for more than 120 seconds" (LP: #1781364)
    - SAUCE: (noup) zfs to 0.6.5.6-0ubuntu25

  * Allow multiple mounts of zfs datasets (LP: #1759848)
    - SAUCE: Allow mounting datasets more than once (LP: #1759848)

  * CVE-2018-12233
    - jfs: Fix inconsistency between memory allocation and ea_buf->max_size

  * Redpine: Observed kernel panic while running wireless tests in regression
    mode (LP: #1773410) // Redpine: Observed kernel panic while running soft-ap
    tests (LP: #1777850)
    - SAUCE: Redpine: improve cancel_hw_scan handling to fix kernel panic

  * [HMS] Upgrades to Support SocketCAN over USB on Dell IoT 300x Gateways
    (LP: #1783241)
    - SAUCE: (no-up) upgrade IXXAT USB SocketCAN driver

  * CVE-2018-13094
    - xfs: don't call xfs_da_shrink_inode with NULL bp

  * other users' coredumps can be read via setgid directory and killpriv bypass
    (LP: #1779923) // CVE-2018-13405
    - Fix up non-directory creation in SGID directories

  * snapcraft.yaml: missing ubuntu-retpoline-extract-one script breaks the build
    (LP: #1782116)
    - snapcraft.yaml: copy retpoline-extract-one to scripts before build

  * Enable basic support for Solarflare 8000 series NIC (LP: #1783152)
    - sfc: make TSO version a per-queue parameter
    - sfc: Add PCI ID for Solarflare 8000 series 10/40G NIC

  * Redpine: Observed kernel panic while running wireless regressions tests
    (LP: #1777858)
    - SAUCE: Redpine: improve kernel thread handling to fix kernel panic

  * Xenial update to 4.4.138 stable release (LP: #1777389)
    - x86: Remove unused function cpu_has_ht_siblings()
    - x86/cpufeature: Remove unused and seldomly used cpu_has_xx macros
    - x86/fpu: Disable AVX when eagerfpu is off
    - x86/fpu: Revert ("x86/fpu: Disable AVX when eagerfpu is off")
    - x86/fpu: Hard-disable lazy FPU mode
    - af_key: Always verify length of provided sadb_key
    - x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc32c
      code
    - gpio: No NULL owner
    - Clarify (and fix) MAX_LFS_FILESIZE macros
    - serial: samsung: fix maxburst parameter for DMA transactions
    - vmw_balloon: fixing double free when batching mode is off
    - Input: goodix - add new ACPI id for GPD Win 2 touch screen
    - crypto: vmx - Remove overly verbose printk from AES init routines
    - Linux 4.4.138

  * Redpine: wifi-ap stopped working after restart (LP: #1773400)
    - SAUCE: Redpine: fix soft-ap invisible issue

  * Xenial update to 4.4.137 stable release (LP: #1777063)
    - tpm: do not suspend/resume if power stays on
    - tpm: self test failure should not cause suspend to fail
    - mmap: introduce sane default mmap limits
    - mmap: relax file size limit for regular files
    - kconfig: Avoid format overflow warning from GCC 8.1
    - xfs: fix incorrect log_flushed on fsync
    - drm: set FMODE_UNSIGNED_OFFSET for drm files
    - brcmfmac: Fix check for ISO3166 code
    - bnx2x: use the right constant
    - dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()
    - enic: set DMA mask to 47 bit
    - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
    - ipv4: remove warning in ip_recv_error
    - isdn: eicon: fix a missing-check bug
    - netdev-FAQ: clarify DaveM's position for stable backports
    - net/packet: refine check for priv area size
    - net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
    - packet: fix reserve calculation
    - qed: Fix mask for physical address in ILT entry
    - net/mlx4: Fix irq-unsafe spinlock usage
    - team: use netdev_features_t instead of u32
    - rtnetlink: validate attributes in do_setlink()
    - net: phy: broadcom: Fix bcm_write_exp()
    - net: metrics: add proper netlink validation
    - Linux 4.4.137

  * Xenial update to 4.4.136 stable release (LP: #1776177)
    - arm64: lse: Add early clobbers to some input/output asm operands
    - powerpc/64s: Clear PCR on boot
    - USB: serial: cp210x: use tcflag_t to fix incompatible pointer type
    - sh: New gcc support
    - xfs: detect agfl count corruption and reset agfl
    - Input: elan_i2c_smbus - fix corrupted stack
    - tracing: Fix crash when freeing instances with event triggers
    - selinux: KASAN: slab-out-of-bounds in xattr_getsecurity
    - cfg80211: further limit wiphy names to 64 bytes
    - rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c
    - ASoC: Intel: sst: remove redundant variable dma_dev_name
    - irda: fix overly long udelay()
    - tcp: avoid integer overflows in tcp_rcv_space_adjust()
    - i2c: rcar: make sure clocks are on when doing clock calculation
    - i2c: rcar: rework hw init
    - i2c: rcar: remove unused IOERROR state
    - i2c: rcar: remove spinlock
    - i2c: rcar: refactor setup of a msg
    - i2c: rcar: init new messages in irq
    - i2c: rcar: don't issue stop when HW does it automatically
    - i2c: rcar: check master irqs before slave irqs
    - i2c: rcar: revoke START request early
    - dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all()
    - iio:kfifo_buf: check for uint overflow
    - MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs
    - MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests
    - scsi: scsi_transport_srp: Fix shost to rport translation
    - stm class: Use vmalloc for the master map
    - hwtracing: stm: fix build error on some arches
    - drm/i915: Disable LVDS on Radiant P845
    - Kbuild: change CC_OPTIMIZE_FOR_SIZE definition
    - [Config] Add CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
    - fix io_destroy()/aio_complete() race
    - mm: fix the NULL mapping case in __isolate_lru_page()
    - sparc64: Fix build warnings with gcc 7.
    - Linux 4.4.136

  * Xenial update to 4.4.135 stable release (LP: #1776158)
    - Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU"
    - Linux 4.4.135

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 15 Aug 2018 13:51:11 +0000

linux (4.4.0-133.159) xenial; urgency=medium

  * CVE-2018-5390
    - tcp: avoid collapses in tcp_prune_queue() if possible
    - tcp: detect malicious patterns in tcp_collapse_ofo_queue()

  * CVE-2018-5391
    - Revert "net: increase fragment memory usage limits"

  * CVE-2018-3620 // CVE-2018-3646
    - KVM: x86: introduce linear_{read,write}_system
    - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and
      kvm_write_guest_virt_system
    - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
    - x86/speculation/l1tf: Change order of offset/type in swap entry
    - x86/speculation/l1tf: Protect swap entries against L1TF
    - x86/mm: Simplify p[g4um]d_page() macros
    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
    - x86/speculation/l1tf: Make sure the first page is always reserved
    - SAUCE: x86/cpu: Add Knights Mill/Gemini Lake
    - x86/speculation/l1tf: Add sysfs reporting for l1tf
    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2
    - x86/smp: Provide topology_is_primary_thread()
    - x86/topology: Provide topology_smt_supported()
    - cpu/hotplug: Split do_cpu_down()
    - x86/topology: Add topology_max_smt_threads()
    - cpu/hotplug: Provide knobs to control SMT
    - x86/CPU: Modify detect_extended_topology() to return result
    - x86/cpu: Remove the pointless CPU printout
    - x86/cpu/AMD: Remove the pointless detect_ht() call
    - x86/cpu/common: Provide detect_ht_early()
    - x86/cpu/topology: Provide detect_extended_topology_early()
    - x86/cpu/intel: Evaluate smp_num_siblings early
    - x86/cpu/AMD: Evaluate smp_num_siblings early
    - x86/apic: Ignore secondary threads if nosmt=force
    - x86/speculation/l1tf: Extend 64bit swap file size limit
    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
    - x86/cpufeatures: Add detection of L1D cache flush support.
    - x86/speculation/l1tf: Protect PAE swap entries against L1TF
    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
    - Revert "x86/apic: Ignore secondary threads if nosmt=force"
    - SAUCE: x86/mce: register mce notifier earlier
    - cpu/hotplug: Boot HT siblings at least once
    - KVM: x86: Introducing kvm_x86_ops VM init/destroy hooks
    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present.
    - x86/KVM/VMX: Add module argument for L1TF mitigation
    - x86/KVM/VMX: Add L1D flush algorithm
    - x86/KVM/VMX: Add L1D MSR based flush
    - x86/KVM/VMX: Add L1D flush logic
    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
    - x86/KVM/VMX: Add find_msr() helper function
    - x86/KVM/VMX: Seperate the VMX AUTOLOAD guest/host number accounting.
    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
    - cpu/hotplug: Online siblings when SMT control is turned on
    - x86/litf: Introduce vmx status variable
    - x86/kvm: Drop L1TF MSR list approach
    - x86/l1tf: Handle EPT disabled state proper
    - x86/kvm: Move l1tf setup function
    - x86/kvm: Add static key for flush always
    - x86/kvm: Serialize L1D flush parameter setter
    - x86/kvm: Allow runtime control of L1D flush
    - cpu/hotplug: Expose SMT control init function
    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
    - Documentation: Add section about CPU vulnerabilities
    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures
    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
    - Documentation/l1tf: Fix typos
    - cpu/hotplug: detect SMT disabled by BIOS
    - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
    - x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
    - x86: Don't include linux/irq.h from asm/hardirq.h
    - x86/apic: Order irq_enter/exit() calls correctly vs. ack_APIC_irq()
    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
    - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
    - Documentation/l1tf: Remove Yonah processors from not vulnerable list
    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
    - KVM: x86: Add a framework for supporting MSR-based features
    - KVM: X86: Introduce kvm_get_msr_feature()
    - KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
    - cpu/hotplug: Fix SMT supported evaluation
    - x86/speculation/l1tf: Invert all not present mappings
    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
    - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers
    - SAUCE: Add pfn_pud() and pud_mkhuge()
    - x86/mm/pat: Make set_memory_np() L1TF safe

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 08 Aug 2018 12:04:38 +0200

linux (4.4.0-131.157) xenial; urgency=medium

  * linux: 4.4.0-131.157 -proposed tracker (LP: #1779376)

  * Cannot set MTU higher than 1500 in Xen instance (LP: #1781413)
    - xen-netfront: Fix mismatched rtnl_unlock
    - xen-netfront: Update features after registering netdev

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 18 Jun 2018 17:00:46 +0200

linux (4.4.0-130.156) xenial; urgency=medium

  * linux: 4.4.0-130.156 -proposed tracker (LP: #1776822)

  * CVE-2018-3665 (x86)
    - x86/fpu: Fix early FPU command-line parsing
    - x86/fpu: Fix 'no387' regression
    - x86/fpu: Disable MPX when eagerfpu is off
    - x86/fpu: Default eagerfpu=on on all CPUs
    - x86/fpu: Fix FNSAVE usage in eagerfpu mode
    - x86/fpu: Fix math emulation in eager fpu mode
    - x86/fpu: Fix eager-FPU handling on legacy FPU machines

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 14 Jun 2018 06:53:41 +0200

linux (4.4.0-129.155) xenial; urgency=medium

  * linux: 4.4.0-129.155 -proposed tracker (LP: #1776352)

  * Xenial update to 4.4.134 stable release (LP: #1775771)
    - MIPS: ptrace: Expose FIR register through FP regset
    - MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs
    - KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"
    - affs_lookup(): close a race with affs_remove_link()
    - aio: fix io_destroy(2) vs. lookup_ioctx() race
    - ALSA: timer: Fix pause event notification
    - mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register
    - libata: Blacklist some Sandisk SSDs for NCQ
    - libata: blacklist Micron 500IT SSD with MU01 firmware
    - xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent
    - Revert "ipc/shm: Fix shmat mmap nil-page protection"
    - ipc/shm: fix shmat() nil address after round-down when remapping
    - kasan: fix memory hotplug during boot
    - kernel/sys.c: fix potential Spectre v1 issue
    - kernel/signal.c: avoid undefined behaviour in kill_something_info
    - xfs: remove racy hasattr check from attr ops
    - do d_instantiate/unlock_new_inode combinations safely
    - firewire-ohci: work around oversized DMA reads on JMicron controllers
    - NFSv4: always set NFS_LOCK_LOST when a lock is lost.
    - ALSA: hda - Use IS_REACHABLE() for dependency on input
    - ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read()
    - kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
    - tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into
      account
    - PCI: Add function 1 DMA alias quirk for Marvell 9128
    - tools lib traceevent: Simplify pointer print logic and fix %pF
    - perf callchain: Fix attr.sample_max_stack setting
    - tools lib traceevent: Fix get_field_str() for dynamic strings
    - dm thin: fix documentation relative to low water mark threshold
    - nfs: Do not convert nfs_idmap_cache_timeout to jiffies
    - watchdog: sp5100_tco: Fix watchdog disable bit
    - kconfig: Don't leak main menus during parsing
    - kconfig: Fix automatic menu creation mem leak
    - kconfig: Fix expr_free() E_NOT leak
    - ipmi/powernv: Fix error return code in ipmi_powernv_probe()
    - Btrfs: set plug for fsync
    - btrfs: Fix out of bounds access in btrfs_search_slot
    - Btrfs: fix scrub to repair raid6 corruption
    - scsi: fas216: fix sense buffer initialization
    - HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()
    - jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
    - powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes
    - powerpc/numa: Ensure nodes initialized for hotplug
    - RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure
    - ntb_transport: Fix bug with max_mw_size parameter
    - ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid
    - ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute
    - ocfs2: return error when we attempt to access a dirty bh in jbd2
    - mm/mempolicy: fix the check of nodemask from user
    - mm/mempolicy: add nodes_empty check in SYSC_migrate_pages
    - asm-generic: provide generic_pmdp_establish()
    - mm: pin address_space before dereferencing it while isolating an LRU page
    - IB/ipoib: Fix for potential no-carrier state
    - x86/power: Fix swsusp_arch_resume prototype
    - firmware: dmi_scan: Fix handling of empty DMI strings
    - ACPI: processor_perflib: Do not send _PPC change notification if not ready
    - MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS
    - xen-netfront: Fix race between device setup and open
    - xen/grant-table: Use put_page instead of free_page
    - RDS: IB: Fix null pointer issue
    - arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics
    - proc: fix /proc/*/map_files lookup
    - cifs: silence compiler warnings showing up with gcc-8.0.0
    - bcache: properly set task state in bch_writeback_thread()
    - bcache: fix for allocator and register thread race
    - bcache: fix for data collapse after re-attaching an attached device
    - bcache: return attach error when no cache set exist
    - tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
    - locking/qspinlock: Ensure node->count is updated before initialising node
    - irqchip/gic-v3: Change pr_debug message to pr_devel
    - scsi: ufs: Enable quirk to ignore sending WRITE_SAME command
    - scsi: bnx2fc: Fix check in SCSI completion handler for timed out request
    - scsi: sym53c8xx_2: iterator underflow in sym_getsync()
    - scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
    - scsi: qla2xxx: Avoid triggering undefined behavior in
      qla2x00_mbx_completion()
    - ARC: Fix malformed ARC_EMUL_UNALIGNED default
    - usb: gadget: f_uac2: fix bFirstInterface in composite gadget
    - usb: gadget: fsl_udc_core: fix ep valid checks
    - usb: dwc2: Fix dwc2_hsotg_core_init_disconnected()
    - selftests: memfd: add config fragment for fuse
    - scsi: storvsc: Increase cmd_per_lun for higher speed devices
    - scsi: aacraid: fix shutdown crash when init fails
    - scsi: qla4xxx: skip error recovery in case of register disconnect.
    - ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt
    - ARM: OMAP3: Fix prm wake interrupt for resume
    - ARM: OMAP1: clock: Fix debugfs_create_*() usage
    - NFC: llcp: Limit size of SDP URI
    - mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
    - md raid10: fix NULL deference in handle_write_completed()
    - drm/exynos: fix comparison to bitshift when dealing with a mask
    - usb: musb: fix enumeration after resume
    - locking/xchg/alpha: Add unconditional memory barrier to cmpxchg()
    - md: raid5: avoid string overflow warning
    - kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
    - powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access
    - s390/cio: fix return code after missing interrupt
    - s390/cio: clear timer when terminating driver I/O
    - ARM: OMAP: Fix dmtimer init for omap1
    - smsc75xx: fix smsc75xx_set_features()
    - regulatory: add NUL to request alpha2
    - locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs
    - x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across
      CPU hotplug operations
    - media: dmxdev: fix error code for invalid ioctls
    - md/raid1: fix NULL pointer dereference
    - batman-adv: fix packet checksum in receive path
    - batman-adv: invalidate checksum on fragment reassembly
    - netfilter: ebtables: convert BUG_ONs to WARN_ONs
    - nvme-pci: Fix nvme queue cleanup if IRQ setup fails
    - clocksource/drivers/fsl_ftm_timer: Fix error return checking
    - r8152: fix tx packets accounting
    - virtio-gpu: fix ioctl and expose the fixed status to userspace.
    - dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3
    - bcache: fix kcrashes with fio in RAID5 backend dev
    - sit: fix IFLA_MTU ignored on NEWLINK
    - gianfar: Fix Rx byte accounting for ndev stats
    - net/tcp/illinois: replace broken algorithm reference link
    - xen/pirq: fix error path cleanup when binding MSIs
    - Btrfs: send, fix issuing write op when processing hole in no data mode
    - selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable
    - KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing
    - watchdog: f71808e_wdt: Fix magic close handling
    - e1000e: Fix check_for_link return value with autoneg off
    - e1000e: allocate ring descriptors with dma_zalloc_coherent
    - usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers
    - scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM
    - scsi: sd: Keep disk read-only when re-reading partition
    - fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
      sbusfb_ioctl_helper().
    - xen: xenbus: use put_device() instead of kfree()
    - USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM
    - netfilter: ebtables: fix erroneous reject of last rule
    - bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa().
    - workqueue: use put_device() instead of kfree()
    - ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
    - sunvnet: does not support GSO for sctp
    - net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off
    - batman-adv: fix header size check in batadv_dbg_arp()
    - vti4: Don't count header length twice on tunnel setup
    - vti4: Don't override MTU passed on link creation via IFLA_MTU
    - perf/cgroup: Fix child event counting bug
    - RDMA/ucma: Correct option size check using optlen
    - mm/mempolicy.c: avoid use uninitialized preferred_node
    - selftests: ftrace: Add probe event argument syntax testcase
    - selftests: ftrace: Add a testcase for string type with kprobe_event
    - selftests: ftrace: Add a testcase for probepoint
    - batman-adv: fix multicast-via-unicast transmission with AP isolation
    - batman-adv: fix packet loss for broadcasted DHCP packets to a server
    - ARM: 8748/1: mm: Define vdso_start, vdso_end as array
    - net: qmi_wwan: add BroadMobi BM806U 2020:2033
    - net/usb/qmi_wwan.c: Add USB id for lt4120 modem
    - net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
    - llc: properly handle dev_queue_xmit() return value
    - mm/kmemleak.c: wait for scan completion before disabling free
    - net: Fix untag for vlan packets without ethernet header
    - net: mvneta: fix enable of all initialized RXQs
    - sh: fix debug trap failure to process signals before return to user
    - x86/pgtable: Don't set huge PUD/PMD on non-leaf entries
    - fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl
      table
    - swap: divide-by-zero when zero length swap file on ssd
    - sr: get/drop reference to device in revalidate and check_events
    - Force log to disk before reading the AGF during a fstrim
    - cpufreq: CPPC: Initialize shared perf capabilities of CPUs
    - scsi: aacraid: Insure command thread is not recursively stopped
    - dp83640: Ensure against premature access to PHY registers after reset
    - mm/ksm: fix interaction with THP
    - mm: fix races between address_space dereference and free in page_evicatable
    - Btrfs: bail out on error during replay_dir_deletes
    - Btrfs: fix NULL pointer dereference in log_dir_items
    - btrfs: Fix possible softlock on single core machines
    - ocfs2/dlm: don't handle migrate lockres if already in shutdown
    - sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning
    - KVM: VMX: raise internal error for exception during invalid protected mode
      state
    - fscache: Fix hanging wait on page discarded by writeback
    - sparc64: Make atomic_xchg() an inline function rather than a macro.
    - rtc: snvs: Fix usage of snvs_rtc_enable
    - net: bgmac: Fix endian access in bgmac_dma_tx_ring_free()
    - Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB
    - btrfs: tests/qgroup: Fix wrong tree backref level
    - Btrfs: fix copy_items() return value when logging an inode
    - btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers
    - xen/acpi: off by one in read_acpi_id()
    - ACPI: acpi_pad: Fix memory leak in power saving threads
    - powerpc/mpic: Check if cpu_possible() in mpic_physmask()
    - m68k: set dma and coherent masks for platform FEC ethernets
    - parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
    - hwmon: (nct6775) Fix writing pwmX_mode
    - rtc: hctosys: Ensure system time doesn't overflow time_t
    - powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer
    - powerpc/perf: Fix kernel address leak via sampling registers
    - tools/thermal: tmon: fix for segfault
    - selftests: Print the test we're running to /dev/kmsg
    - net/mlx5: Protect from command bit overflow
    - ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk)
    - ima: Fix Kconfig to select TPM 2.0 CRB interface
    - [Config] CONFIG_TCG_CRB=y
    - ima: Fallback to the builtin hash algorithm
    - arm: dts: socfpga: fix GIC PPI warning
    - usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields
    - cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path
    - clk: Don't show the incorrect clock phase
    - zorro: Set up z->dev.dma_mask for the DMA API
    - bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set
    - ACPICA: Events: add a return on failure from acpi_hw_register_read
    - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
    - i2c: mv64xxx: Apply errata delay only in standard mode
    - KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use
    - xhci: zero usb device slot_id member when disabling and freeing a xhci slot
    - MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset
    - PCI: Restore config space on runtime resume despite being unbound
    - ipmi_ssif: Fix kernel panic at msg_done_handler
    - usb: dwc2: Fix interval type issue
    - usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS
    - usb: gadget: ffs: Execute copy_to_user() with USER_DS set
    - powerpc: Add missing prototype for arch_irq_work_raise()
    - ASoC: topology: create TLV data for dapm widgets
    - perf/core: Fix perf_output_read_group()
    - hwmon: (pmbus/max8688) Accept negative page register values
    - hwmon: (pmbus/adm1275) Accept negative page register values
    - cdrom: do not call check_disk_change() inside cdrom_open()
    - gfs2: Fix fallocate chunk size
    - usb: gadget: udc: change comparison to bitshift when dealing with a mask
    - usb: gadget: composite: fix incorrect handling of OS desc requests
    - x86/devicetree: Initialize device tree before using it
    - x86/devicetree: Fix device IRQ settings in DT
    - ALSA: vmaster: Propagate slave error
    - media: cx23885: Override 888 ImpactVCBe crystal frequency
    - media: cx23885: Set subdev host data to clk_freq pointer
    - media: s3c-camif: fix out-of-bounds array access
    - dmaengine: pl330: fix a race condition in case of threaded irqs
    - media: em28xx: USB bulk packet size fix
    - clk: rockchip: Prevent calculating mmc phase if clock rate is zero
    - enic: enable rq before updating rq descriptors
    - hwrng: stm32 - add reset during probe
    - staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr
    - rtc: tx4939: avoid unintended sign extension on a 24 bit shift
    - serial: xuartps: Fix out-of-bounds access through DT alias
    - serial: samsung: Fix out-of-bounds access through serial port index
    - serial: mxs-auart: Fix out-of-bounds access through serial port index
    - serial: imx: Fix out-of-bounds access through serial port index
    - serial: fsl_lpuart: Fix out-of-bounds access through DT alias
    - serial: arc_uart: Fix out-of-bounds access through DT alias
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9220
    - udf: Provide saner default for invalid uid / gid
    - media: cx25821: prevent out-of-bounds read on array card
    - clk: samsung: s3c2410: Fix PLL rates
    - clk: samsung: exynos5260: Fix PLL rates
    - clk: samsung: exynos5433: Fix PLL rates
    - clk: samsung: exynos5250: Fix PLL rates
    - clk: samsung: exynos3250: Fix PLL rates
    - crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss
    - audit: return on memory error to avoid null pointer dereference
    - MIPS: Octeon: Fix logging messages with spurious periods after newlines
    - drm/rockchip: Respect page offset for PRIME mmap calls
    - x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic'
      specified
    - perf tests: Use arch__compare_symbol_names to compare symbols
    - perf report: Fix memory corruption in --branch-history mode --branch-history
    - selftests/net: fixes psock_fanout eBPF test case
    - netlabel: If PF_INET6, check sk_buff ip header version
    - scsi: lpfc: Fix issue_lip if link is disabled
    - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
    - scsi: lpfc: Fix frequency of Release WQE CQEs
    - regulator: of: Add a missing 'of_node_put()' in an error handling path of
      'of_regulator_match()'
    - ASoC: samsung: i2s: Ensure the RCLK rate is properly determined
    - Bluetooth: btusb: Add device ID for RTL8822BE
    - kdb: make "mdr" command repeat
    - s390/ftrace: use expoline for indirect branches
    - Linux 4.4.134

  * Support SocketCAN over USB on Dell IoT 300x Gateways (LP: #1774563)
    - [Config] CONFIG_CAN_HMS_USB=m
    - SAUCE: (no-up) Support IXXAT USB SocketCAN device
    - i386/amd64 -- Add new module ixx_usb

  * Ubuntu 16.04 (4.4.0-127) hangs on boot with virtio-scsi MQ enabled
    (LP: #1775235)
    - SAUCE: (no-up) virtio-scsi: Increment reqs counter.

  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
    - fs/binfmt_misc.c: do not allow offset overflow

  * The kernel NULL pointer dereference happens when accessing the task_struct
    by task_cpu() in function cpuacct_charge() (LP: #1775326)
    - sched/cpuacct: Simplify the cpuacct code

  * Xenial update to 4.4.133 stable release (LP: #1775477)
    - 8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
    - bridge: check iface upper dev when setting master via ioctl
    - dccp: fix tasklet usage
    - ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
    - llc: better deal with too small mtu
    - net: ethernet: sun: niu set correct packet size in skb
    - net/mlx4_en: Verify coalescing parameters are in range
    - net_sched: fq: take care of throttled flows before reuse
    - net: support compat 64-bit time in {s,g}etsockopt
    - openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
    - qmi_wwan: do not steal interfaces from class drivers
    - r8169: fix powering up RTL8168h
    - sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
    - sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
    - tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
    - bonding: do not allow rlb updates to invalid mac
    - tcp: ignore Fast Open on repair mode
    - sctp: fix the issue that the cookie-ack with auth can't get processed
    - sctp: delay the authentication for the duplicated cookie-echo chunk
    - ALSA: timer: Call notifier in the same spinlock
    - audit: move calcs after alloc and check when logging set loginuid
    - arm64: introduce mov_q macro to move a constant into a 64-bit register
    - [Config] Add CONFIG_ARM64_ERRATUM_1024718=y
    - arm64: Add work around for Arm Cortex-A55 Erratum 1024718
    - futex: Remove unnecessary warning from get_futex_key
    - futex: Remove duplicated code and fix undefined behaviour
    - xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
    - lockd: lost rollback of set_grace_period() in lockd_down_net()
    - Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap"
    - l2tp: revert "l2tp: fix missing print session offset info"
    - pipe: cap initial pipe capacity according to pipe-max-size limit
    - futex: futex_wake_op, fix sign_extend32 sign bits
    - kernel/exit.c: avoid undefined behaviour when calling wait4()
    - usbip: usbip_host: refine probe and disconnect debug msgs to be useful
    - usbip: usbip_host: delete device from busid_table after rebind
    - usbip: usbip_host: run rebind from exit when module is removed
    - usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
    - usbip: usbip_host: fix bad unlock balance during stub_probe()
    - ALSA: usb: mixer: volume quirk for CM102-A+/102S+
    - ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist
    - ALSA: control: fix a redundant-copy issue
    - spi: pxa2xx: Allow 64-bit DMA
    - powerpc/powernv: panic() on OPAL < V3
    - powerpc/powernv: Remove OPALv2 firmware define and references
    - powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL
    - cpuidle: coupled: remove unused define cpuidle_coupled_lock
    - powerpc: Don't preempt_disable() in show_cpuinfo()
    - vmscan: do not force-scan file lru if its absolute size is small
    - mm: filemap: remove redundant code in do_read_cache_page
    - mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to
      complete during a read
    - signals: avoid unnecessary taking of sighand->siglock
    - tracing/x86/xen: Remove zero data size trace events
      trace_xen_mmu_flush_tlb{_all}
    - proc read mm's {arg,env}_{start,end} with mmap semaphore taken.
    - powerpc/powernv: Fix NVRAM sleep in invalid context when crashing
    - mm: don't allow deferred pages with NEED_PER_CPU_KM
    - s390/qdio: fix access to uninitialized qdio_q fields
    - s390/qdio: don't release memory in qdio_setup_irq()
    - s390: remove indirect branch from do_softirq_own_stack
    - efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32'
      definition for mixed mode
    - ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
    - tick/broadcast: Use for_each_cpu() specially on UP kernels
    - ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
    - ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
    - ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions
    - Btrfs: fix xattr loss after power failure
    - btrfs: fix crash when trying to resume balance without the resume flag
    - btrfs: fix reading stale metadata blocks after degraded raid1 mounts
    - net: test tailroom before appending to linear skb
    - packet: in packet_snd start writing at link layer allocation
    - sock_diag: fix use-after-free read in __sk_free
    - tcp: purge write queue in tcp_connect_init()
    - ext2: fix a block leak
    - s390: add assembler macros for CPU alternatives
    - s390: move expoline assembler macros to a header
    - s390/lib: use expoline for indirect branches
    - s390/kernel: use expoline for indirect branches
    - s390: move spectre sysfs attribute code
    - s390: extend expoline to BC instructions
    - s390: use expoline thunks in the BPF JIT
    - scsi: libsas: defer ata device eh commands to libata
    - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
    - scsi: zfcp: fix infinite iteration on ERP ready list
    - dmaengine: ensure dmaengine helpers check valid callback
    - time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
    - gpio: rcar: Add Runtime PM handling for interrupts
    - cfg80211: limit wiphy names to 128 bytes
    - hfsplus: stop workqueue when fill_super() failed
    - x86/kexec: Avoid double free_page() upon do_kexec_load() failure
    - Linux 4.4.133

  * vmxnet3: update to latest ToT (LP: #1768143)
    - vmxnet3: avoid xmit reset due to a race in vmxnet3
    - vmxnet3: use correct flag to indicate LRO feature
    - vmxnet3: fix incorrect dereference when rxvlan is disabled

  * Prevent speculation on user controlled pointer (LP: #1775137)
    - x86: reorganize SMAP handling in user space accesses
    - x86: fix SMAP in 32-bit environments
    - x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
    - x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec

  * Xenial update to 4.4.132 stable release (LP: #1774173)
    - perf/core: Fix the perf_cpu_time_max_percent check
    - bpf: map_get_next_key to return first key on NULL
    - percpu: include linux/sched.h for cond_resched()
    - mac80211: allow not sending MIC up from driver for HW crypto
    - mac80211: allow same PN for AMSDU sub-frames
    - mac80211: Add RX flag to indicate ICV stripped
    - ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
    - ath10k: rebuild crypto header in rx data frames
    - gpmi-nand: Handle ECC Errors in erased pages
    - USB: serial: option: Add support for Quectel EP06
    - ALSA: pcm: Check PCM state at xfern compat ioctl
    - ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
    - ALSA: aloop: Mark paused device as inactive
    - ALSA: aloop: Add missing cable lock to ctl API callbacks
    - tracepoint: Do not warn on ENOMEM
    - Input: leds - fix out of bound access
    - Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
    - xfs: prevent creating negative-sized file via INSERT_RANGE
    - RDMA/ucma: Allow resolving address w/o specifying source address
    - RDMA/mlx5: Protect from shift operand overflow
    - NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
    - IB/mlx5: Use unlimited rate when static rate is not supported
    - drm/vmwgfx: Fix a buffer object leak
    - test_firmware: fix setting old custom fw path back on exit, second try
    - USB: serial: visor: handle potential invalid device configuration
    - USB: Accept bulk endpoints with 1024-byte maxpacket
    - USB: serial: option: reimplement interface masking
    - USB: serial: option: adding support for ublox R410M
    - usb: musb: host: fix potential NULL pointer dereference
    - ipvs: fix rtnl_lock lockups caused by start_sync_thread
    - crypto: af_alg - fix possible uninit-value in alg_bind()
    - netlink: fix uninit-value in netlink_sendmsg
    - net: fix rtnh_ok()
    - net: initialize skb->peeked when cloning
    - net: fix uninit-value in __hw_addr_add_ex()
    - dccp: initialize ireq->ir_mark
    - soreuseport: initialise timewait reuseport field
    - perf: Remove superfluous allocation error check
    - tcp: fix TCP_REPAIR_QUEUE bound checking
    - bdi: Fix oops in wb_workfn()
    - f2fs: fix a dead loop in f2fs_fiemap()
    - xfrm_user: fix return value from xfrm_user_rcv_msg
    - rfkill: gpio: fix memory leak in probe error path
    - libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs
    - tracing: Fix regex_match_front() to not over compare the test string
    - can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg()
    - net: atm: Fix potential Spectre v1
    - atm: zatm: Fix potential Spectre v1
    - Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174"
    - tracing/uprobe_event: Fix strncpy corner case
    - perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
    - perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
    - perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
    - perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
    - perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
    - Linux 4.4.132

  * Update to upstream's implementation of Spectre v1 mitigation (LP: #1774181)
    - Documentation: Document array_index_nospec
    - array_index_nospec: Sanitize speculative array de-references
    - x86: Implement array_index_mask_nospec
    - x86: Introduce barrier_nospec
    - x86/get_user: Use pointer masking to limit speculation
    - x86/syscall: Sanitize syscall table de-references under speculation
    - vfs, fdtable: Prevent bounds-check bypass via speculative execution
    - nl80211: Sanitize array index in parse_txq_params
    - x86/spectre: Report get_user mitigation for spectre_v1
    - x86/kvm: Update spectre-v1 mitigation
    - nospec: Allow index argument to have const-qualified type
    - x86/syscall: Sanitize syscall table de-references under speculation fix
    - mpls, nospec: Sanitize array index in mpls_label_ok()
    - nospec: Include <asm/barrier.h> dependency
    - nospec: Move array_index_nospec() parameter checking into separate macro
    - nospec: Kill array_index_nospec_mask_check()
    - ALSA: seq: oss: Hardening for potential Spectre v1
    - ALSA: hda: Hardening for potential Spectre v1
    - SAUCE: Replace osb() calls with array_index_nospec()
    - SAUCE: Rename osb() to barrier_nospec()
    - SAUCE: bpf: Use barrier_nospec() instead of osb()

  * CVE-2018-3639 (x86)
    - KVM: x86: remove magic number with enum cpuid_leafs
    - SAUCE: x86/cpufeatures: Move CPUID_7_EDX CPUID bits to word 18
    - SAUCE: x86: Remove double include
    - SAUCE: x86/pti: Evaluate X86_BUG_CPU_MELTDOWN when pti=auto
    - SAUCE: x86/speculation: Query individual feature flags when reloading
      microcode

  * cpum_sf: ensure sample freq is non-zero (LP: #1772593)
    - s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero

  * ELANPAD ELAN0612 does not work, patch available (LP: #1773509)
    - SAUCE: Input: elan_i2c - add ELAN0612 to the ACPI table

  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
    - SAUCE: CacheFiles: fix a read_waiter/read_copier race

  * Kernel 4.4 NBD size overflow with image size exceeding 1TB (LP: #1772575)
    - nbd: use loff_t for blocksize and nbd_set_size args
    - nbd: fix 64-bit division

  * 4.4.0-127.153 generates many "sit: non-ECT" messages (LP: #1772775)
    - Revert "sit: reload iphdr in ipip6_rcv"

  * Creation of IMA file hashes fails when appraisal is enabled (LP: #1771826)
    - Revert "ima: limit file hash setting by user to fix and log modes"

  * Setting ipv6.disable=1 prevents both IPv4 and IPv6 socket opening for VXLAN
    tunnels (LP: #1771301)
    - vxlan: correctly handle ipv6.disable module parameter

  * CVE-2018-7755
    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl

  * Support UVC1.5 Camera for Xenial (LP: #1773905)
    - uvcvideo: Enable UVC 1.5 device detection

  * Kernel produces empty lines in /proc/PID/status (LP: #1772671)
    - SAUCE: seccomp: Remove double newline sequence in /proc/PID/status

  * rfi-flush: Switch to new linear fallback flush (LP: #1744173)
    - powerpc/64s: Improve RFI L1-D cache flush fallback
    - SAUCE: rfi-flush: Make it possible to call setup_rfi_flush() again

 -- Khalid Elmously <khalid.elmously@canonical.com>  Tue, 12 Jun 2018 04:10:32 -0400

linux (4.4.0-128.154) xenial; urgency=medium

  * linux: 4.4.0-128.154 -proposed tracker (LP: #1772960)

  * CVE-2018-3639 (x86)
    - x86/cpu: Make alternative_msr_write work for 32-bit code
    - x86/bugs: Fix the parameters alignment and missing void
    - KVM: SVM: Move spec control call after restore of GS
    - x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
    - x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS
    - x86/cpufeatures: Disentangle SSBD enumeration
    - x86/cpu/AMD: Fix erratum 1076 (CPB bit)
    - x86/cpufeatures: Add FEATURE_ZEN
    - x86/speculation: Handle HT correctly on AMD
    - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
    - x86/speculation: Add virtualized speculative store bypass disable support
    - x86/speculation: Rework speculative_store_bypass_update()
    - x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host}
    - x86/bugs: Expose x86_spec_ctrl_base directly
    - x86/bugs: Remove x86_spec_ctrl_set()
    - x86/bugs: Rework spec_ctrl base and mask logic
    - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG
    - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
    - x86/bugs: Rename SSBD_NO to SSB_NO
    - KVM: VMX: Expose SSBD properly to guests.

  * [i915_bpo] Fix flickering issue after panel change (LP: #1770565)
    - drm/i915: Fix iboost setting for DDI with 4 lanes on SKL
    - drm/i915: Name the "iboost bit"
    - drm/i915: Program iboost settings for HDMI/DVI on SKL
    - drm/i915: Move bxt_ddi_vswing_sequence() call into intel_ddi_pre_enable()
      for HDMI
    - drm/i915: Explicitly use ddi buf trans entry 9 for hdmi
    - drm/i915: Split DP/eDP/FDI and HDMI/DVI DDI buffer programming apart
    - drm/i915: Get the iboost setting based on the port type
    - drm/i915: Simplify intel_ddi_get_encoder_port()
    - drm/i915: Fix iboost setting for SKL Y/U DP DDI buffer translation entry 2
    - drm/i915: KBL - Recommended buffer translation programming for DisplayPort
    - drm/i915: Ignore OpRegion panel type except on select machines

  * [SRU][Bionic/Artful] fix false positives in W+X checking (LP: #1769696)
    - init: fix false positives in W+X checking

  * [Ubuntu 16.04] kernel: fix rwlock implementation (LP: #1761674)
    - SAUCE: (no-up) s390: fix rwlock implementation

  * linux < 4.11: unable to use netfilter logging from non-init namespaces
    (LP: #1766573)
    - netfilter: allow logging from non-init namespaces

  * [LTC Test] Ubuntu 18.04:  tm_sigreturn failed on P8 compat mode 16.04.04
    guest (LP: #1771439)
    - powerpc: signals: Discard transaction state from signal frames

  * QCA9377 requires more IRAM banks for its new firmware (LP: #1748345)
    - ath10k: update the IRAM bank number for QCA9377

  * i915/kbl_dmc_ver1.bin failed with error -2 package 1.157.17 kernel
    4.4.0-116-generic (LP: #1752536)
    - ubuntu: i915_bpo - Add MODULE_FIRMWARE for Geminilake's DMC

  * Xenial update to 4.4.131 stable release (LP: #1768825)
    - ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS
    - ext4: set h_journal if there is a failure starting a reserved handle
    - ext4: add validity checks for bitmap block numbers
    - ext4: fix bitmap position validation
    - usbip: usbip_host: fix to hold parent lock for device_attach() calls
    - usbip: vhci_hcd: Fix usb device and sockfd leaks
    - USB: serial: simple: add libtransistor console
    - USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster
    - USB: serial: cp210x: add ID for NI USB serial console
    - usb: core: Add quirk for HP v222w 16GB Mini
    - USB: Increment wakeup count on remote wakeup.
    - ALSA: usb-audio: Skip broken EU on Dell dock USB-audio
    - virtio: add ability to iterate over vqs
    - virtio_console: free buffers after reset
    - drm/virtio: fix vq wait_event condition
    - tty: Don't call panic() at tty_ldisc_init()
    - tty: n_gsm: Fix long delays with control frame timeouts in ADM mode
    - tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set
    - tty: Use __GFP_NOFAIL for tty_ldisc_get()
    - ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr
    - ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device
    - ALSA: hda/realtek - Add some fixes for ALC233
    - mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
    - mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
    - mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
    - kobject: don't use WARN for registration failures
    - scsi: sd: Defer spinning up drive while SANITIZE is in progress
    - ARM: amba: Make driver_override output consistent with other buses
    - ARM: amba: Fix race condition with driver_override
    - ARM: amba: Don't read past the end of sysfs "driver_override" buffer
    - ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
    - libceph: validate con->state at the top of try_write()
    - x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds
    - x86/smpboot: Don't use mwait_play_dead() on AMD systems
    - serial: mctrl_gpio: export mctrl_gpio_disable_ms and mctrl_gpio_init
    - serial: mctrl_gpio: Add missing module license
    - Linux 4.4.131

  * Xenial update to 4.4.130 stable release (LP: #1768474) // CVE-2017-5715 //
    CVE-2017-5753
    - SAUCE: s390: print messages for gmb and nobp

  * Xenial update to 4.4.130 stable release (LP: #1768474)
    - cifs: do not allow creating sockets except with SMB1 posix exensions
    - x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
    - perf: Return proper values for user stack errors
    - staging: ion : Donnot wakeup kswapd in ion system alloc
    - r8152: add Linksys USB3GIGV1 id
    - Input: drv260x - fix initializing overdrive voltage
    - ath9k_hw: check if the chip failed to wake up
    - jbd2: fix use after free in kjournald2()
    - Revert "ath10k: send (re)assoc peer command when NSS changed"
    - Revert "UBUNTU: SAUCE: s390: print messages for gmb and nobp"
    - Revert "UBUNTU: SAUCE: s390: improve cpu alternative handling for gmb and
      nobp"
    - Revert "s390: add ppa to kernel entry / exit"
    - Revert "s390: introduce CPU alternatives"
    - s390: introduce CPU alternatives
    - s390: enable CPU alternatives unconditionally
    - s390/alternative: use a copy of the facility bit mask
    - s390: add options to change branch prediction behaviour for the kernel
    - s390: scrub registers on kernel entry and KVM exit
    - s390: add optimized array_index_mask_nospec
    - s390: run user space and KVM guests with modified branch prediction
    - s390: introduce execute-trampolines for branches
    - s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*)
    - s390: do not bypass BPENTER for interrupt system calls
    - s390/entry.S: fix spurious zeroing of r0
    - s390: move nobp parameter functions to nospec-branch.c
    - s390: add automatic detection of the spectre defense
    - [Config] Add CONFIG_EXPOLINE=y and CONFIG_EXPOLINE_AUTO=y
    - s390: report spectre mitigation via syslog
    - s390: add sysfs attributes for spectre
    - s390: correct nospec auto detection init order
    - s390: correct module section names for expoline code revert
    - bonding: do not set slave_dev npinfo before slave_enable_netpoll in
      bond_enslave
    - KEYS: DNS: limit the length of option strings
    - l2tp: check sockaddr length in pppol2tp_connect()
    - net: validate attribute sizes in neigh_dump_table()
    - llc: delete timers synchronously in llc_sk_free()
    - tcp: don't read out-of-bounds opsize
    - team: avoid adding twice the same option to the event list
    - team: fix netconsole setup over team
    - packet: fix bitfield update race
    - pppoe: check sockaddr length in pppoe_connect()
    - vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
    - sctp: do not check port in sctp_inet6_cmp_addr
    - llc: hold llc_sap before release_sock()
    - llc: fix NULL pointer deref for SOCK_ZAPPED
    - tipc: add policy for TIPC_NLA_NET_ADDR
    - net: fix deadlock while clearing neighbor proxy table
    - tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
    - net: af_packet: fix race in PACKET_{R|T}X_RING
    - ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
    - scsi: mptsas: Disable WRITE SAME
    - cdrom: information leak in cdrom_ioctl_media_changed()
    - s390/cio: update chpid descriptor after resource accessibility event
    - s390/uprobes: implement arch_uretprobe_is_alive()
    - Linux 4.4.130
    - SAUCE: s390: Add 'nogmb' kernel parameter

  * Xenial update to 4.4.129 stable release (LP: #1768429)
    - media: v4l2-compat-ioctl32: don't oops on overlay
    - parisc: Fix out of array access in match_pci_device()
    - perf intel-pt: Fix overlap detection to identify consecutive buffers
      correctly
    - perf intel-pt: Fix sync_switch
    - perf intel-pt: Fix error recovery from missing TIP packet
    - perf intel-pt: Fix timestamp following overflow
    - radeon: hide pointless #warning when compile testing
    - block/loop: fix deadlock after loop_set_status
    - s390/qdio: don't retry EQBS after CCQ 96
    - s390/qdio: don't merge ERROR output buffers
    - s390/ipl: ensure loadparm valid flag is set
    - getname_kernel() needs to make sure that ->name != ->iname in long case
    - rtl8187: Fix NULL pointer dereference in priv->conf_mutex
    - hwmon: (ina2xx) Fix access to uninitialized mutex
    - cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
    - slip: Check if rstate is initialized before uncompressing
    - lan78xx: Correctly indicate invalid OTP
    - x86/hweight: Get rid of the special calling convention
    - [Config] Remove ARCH_HWEIGHT_CFLAGS
    - x86/hweight: Don't clobber %rdi
    - tty: make n_tty_read() always abort if hangup is in progress
    - ubifs: Check ubifs_wbuf_sync() return code
    - ubi: fastmap: Don't flush fastmap work on detach
    - ubi: Fix error for write access
    - ubi: Reject MLC NAND
    - fs/reiserfs/journal.c: add missing resierfs_warning() arg
    - resource: fix integer overflow at reallocation
    - ipc/shm: fix use-after-free of shm file via remap_file_pages()
    - mm, slab: reschedule cache_reap() on the same CPU
    - usb: musb: gadget: misplaced out of bounds check
    - ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
    - ARM: dts: at91: sama5d4: fix pinctrl compatible string
    - xen-netfront: Fix hang on device removal
    - regmap: Fix reversed bounds check in regmap_raw_write()
    - ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
    - ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
    - USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
    - usb: dwc3: pci: Properly cleanup resource
    - HID: i2c-hid: fix size check and type usage
    - powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
    - powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
    - powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops
    - powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
    - HID: Fix hid_report_len usage
    - HID: core: Fix size as type u32
    - ASoC: ssm2602: Replace reg_default_raw with reg_default
    - thunderbolt: Resume control channel after hibernation image is created
    - random: use a tighter cap in credit_entropy_bits_safe()
    - jbd2: if the journal is aborted then don't allow update of the log tail
    - ext4: don't update checksum of new initialized bitmaps
    - ext4: fail ext4_iget for root directory if unallocated
    - RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
    - ALSA: pcm: Fix UAF at PCM release via PCM timer access
    - IB/srp: Fix srp_abort()
    - IB/srp: Fix completion vector assignment algorithm
    - dmaengine: at_xdmac: fix rare residue corruption
    - um: Use POSIX ucontext_t instead of struct ucontext
    - iommu/vt-d: Fix a potential memory leak
    - mmc: jz4740: Fix race condition in IRQ mask update
    - clk: mvebu: armada-38x: add support for 1866MHz variants
    - clk: mvebu: armada-38x: add support for missing clocks
    - clk: bcm2835: De-assert/assert PLL reset signal when appropriate
    - thermal: imx: Fix race condition in imx_thermal_probe()
    - watchdog: f71808e_wdt: Fix WD_EN register read
    - ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
    - ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
    - ALSA: pcm: Avoid potential races between OSS ioctls and read/write
    - ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
    - ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
    - ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
    - vfio-pci: Virtualize PCIe & AF FLR
    - vfio/pci: Virtualize Maximum Payload Size
    - vfio/pci: Virtualize Maximum Read Request Size
    - ext4: don't allow r/w mounts if metadata blocks overlap the superblock
    - drm/radeon: Fix PCIe lane width calculation
    - ext4: fix crashes in dioread_nolock mode
    - ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
    - ALSA: line6: Use correct endpoint type for midi output
    - ALSA: rawmidi: Fix missing input substream checks in compat ioctls
    - ALSA: hda - New VIA controller suppor no-snoop path
    - HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
    - MIPS: uaccess: Add micromips clobbers to bzero invocation
    - MIPS: memset.S: EVA & fault support for small_memset
    - MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
    - MIPS: memset.S: Fix clobber of v1 in last_fixup
    - powerpc/eeh: Fix enabling bridge MMIO windows
    - powerpc/lib: Fix off-by-one in alternate feature patching
    - jffs2_kill_sb(): deal with failed allocations
    - hypfs_kill_super(): deal with failed allocations
    - rpc_pipefs: fix double-dput()
    - Don't leak MNT_INTERNAL away from internal mounts
    - autofs: mount point create should honour passed in mode
    - mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
    - mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
    - ext4: bugfix for mmaped pages in mpage_release_unused_pages()
    - fanotify: fix logic of events on child
    - writeback: safer lock nesting
    - Linux 4.4.129

  * CVE-2018-8087
    - mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()

  * Integrated Webcam Realtek Integrated_Webcam_HD (0bda:58f4) not working in
    DELL XPS 13 9370 with firmware 1.50 (LP: #1763748)
    - SAUCE: media: uvcvideo: Support realtek's UVC 1.5 device

  * [Xenial] Kernels OOPS when mwifiex is in AP mode (LP: #1769671)
    - Revert "UBUNTU: SAUCE: mwifiex: do not dereference invalid pointer"
    - Revert "UBUNTU: SAUCE: net/wireless: do not dereference invalid pointer"
    - mwifiex: cfg80211: do not change virtual interface during scan processing

  * user space process hung in 'D' state waiting for disk io to complete
    (LP: #1750038)
    - NFS: Use GFP_NOIO for two allocations in writeback

  * Acer Swift sf314-52 power button not managed  (LP: #1766054)
    - SAUCE: platform/x86: acer-wmi: add another KEY_POWER keycode

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 25 May 2018 15:58:45 +0200

linux (4.4.0-127.153) xenial; urgency=medium

  * CVE-2018-3639 (powerpc)
    - powerpc/pseries: Support firmware disable of RFI flush
    - powerpc/powernv: Support firmware disable of RFI flush
    - powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
    - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
    - powerpc/rfi-flush: Always enable fallback flush on pseries
    - powerpc/rfi-flush: Differentiate enabled and patched flush types
    - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
    - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
    - powerpc: Add security feature flags for Spectre/Meltdown
    - powerpc/pseries: Set or clear security feature flags
    - powerpc/powernv: Set or clear security feature flags
    - powerpc/64s: Move cpu_show_meltdown()
    - powerpc/64s: Enhance the information in cpu_show_meltdown()
    - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
    - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
    - powerpc/64s: Wire up cpu_show_spectre_v1()
    - powerpc/64s: Wire up cpu_show_spectre_v2()
    - powerpc/pseries: Fix clearing of security feature flags
    - powerpc: Move default security feature flags
    - powerpc/pseries: Restore default security feature flags on setup
    - SAUCE: powerpc/64s: Add support for a store forwarding barrier at kernel
      entry/exit

  * CVE-2018-3639 (x86)
    - SAUCE: Clean up IBPB and IBRS control functions and macros
    - SAUCE: Fix up IBPB and IBRS kernel parameters documentation
    - SAUCE: Remove #define X86_FEATURE_PTI
    - x86/cpufeature: Move some of the scattered feature bits to x86_capability
    - x86/cpufeature: Cleanup get_cpu_cap()
    - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6
    - x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
    - x86/cpufeatures: Add Intel feature bits for Speculation Control
    - SAUCE: x86/kvm: Expose SPEC_CTRL from the leaf
    - x86/cpufeatures: Add AMD feature bits for Speculation Control
    - x86/msr: Add definitions for new speculation control MSRs
    - SAUCE: x86/msr: Rename MSR spec control feature bits
    - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
    - x86/speculation: Add <asm/msr-index.h> dependency
    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags
    - x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
    - SAUCE: x86/speculation: Move vendor specific IBRS/IBPB control code
    - SAUCE: x86: Add alternative_msr_write
    - SAUCE: x86/nospec: Simplify alternative_msr_write()
    - SAUCE: x86/bugs: Concentrate bug detection into a separate function
    - SAUCE: x86/bugs: Concentrate bug reporting into a separate function
    - arch: Introduce post-init read-only memory
    - SAUCE: x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits
    - SAUCE: x86/bugs, KVM: Support the combination of guest and host IBRS
    - SAUCE: x86/bugs: Expose /sys/../spec_store_bypass
    - SAUCE: x86/cpufeatures: Add X86_FEATURE_RDS
    - SAUCE: x86/bugs: Provide boot parameters for the spec_store_bypass_disable
      mitigation
    - SAUCE: x86/bugs/intel: Set proper CPU features and setup RDS
    - SAUCE: x86/bugs: Whitelist allowed SPEC_CTRL MSR values
    - SAUCE: x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if
      requested
    - SAUCE: x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
    - SAUCE: x86/speculation: Create spec-ctrl.h to avoid include hell
    - SAUCE: prctl: Add speculation control prctls
    - x86/process: Optimize TIF checks in __switch_to_xtra()
    - SAUCE: x86/process: Allow runtime control of Speculative Store Bypass
    - SAUCE: x86/speculation: Add prctl for Speculative Store Bypass mitigation
    - SAUCE: nospec: Allow getting/setting on non-current task
    - SAUCE: proc: Provide details on speculation flaw mitigations
    - SAUCE: seccomp: Enable speculation flaw mitigations
    - SAUCE: x86/bugs: Honour SPEC_CTRL default
    - SAUCE: x86/bugs: Make boot modes __ro_after_init
    - SAUCE: prctl: Add force disable speculation
    - SAUCE: seccomp: Use PR_SPEC_FORCE_DISABLE
    - selftest/seccomp: Fix the flag name SECCOMP_FILTER_FLAG_TSYNC
    - SAUCE: seccomp: Add filter flag to opt-out of SSB mitigation
    - SAUCE: seccomp: Move speculation migitation control to arch code
    - SAUCE: x86/speculation: Make "seccomp" the default mode for Speculative
      Store Bypass
    - SAUCE: x86/bugs: Rename _RDS to _SSBD
    - SAUCE: proc: Use underscores for SSBD in 'status'
    - SAUCE: Documentation/spec_ctrl: Do some minor cleanups
    - SAUCE: x86/bugs: Fix __ssb_select_mitigation() return type
    - SAUCE: x86/bugs: Make cpu_show_common() static
    - x86/entry: define _TIF_ALLWORK_MASK flags explicitly
    - Revert "x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2
      microcodes"
    - SAUCE: kvm/cpuid: Fix CPUID_7_0.EDX handling

 -- Stefan Bader <stefan.bader@canonical.com>  Sat, 19 May 2018 11:58:02 +0200

linux (4.4.0-125.150) xenial; urgency=medium

  * linux: 4.4.0-125.150 -proposed tracker (LP: #1770011)

  * Unable to insert test_bpf module on Xenial (LP: #1765698)
    - bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y
    - test_bpf: Fix testing with CONFIG_BPF_JIT_ALWAYS_ON=y on other arches

  * virtio_scsi race can corrupt memory, panic kernel (LP: #1765241)
    - SAUCE: (no-up) virtio-scsi: Fix race in target free

  * bpf_map_lookup_elem: BUG: unable to handle kernel paging request
    (LP: #1763454) // CVE-2017-17862
    - SAUCE: Add missing hunks from "bpf: fix branch pruning logic"

  * Xenial: rfkill: fix missing return on rfkill_init  (LP: #1764810)
    - rfkill: fix missing return on rfkill_init

  * "ip a" command on a guest VM shows UNKNOWN status (LP: #1761534)
    - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS

  * Xenial update to 4.4.128 stable release (LP: #1765010)
    - cfg80211: make RATE_INFO_BW_20 the default
    - md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
    - rtc: snvs: fix an incorrect check of return value
    - x86/asm: Don't use RBP as a temporary register in
      csum_partial_copy_generic()
    - NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
    - IB/srpt: Fix abort handling
    - af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
    - mac80211: bail out from prep_connection() if a reconfig is ongoing
    - bna: Avoid reading past end of buffer
    - qlge: Avoid reading past end of buffer
    - ipmi_ssif: unlock on allocation failure
    - net: cdc_ncm: Fix TX zero padding
    - net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
    - lockd: fix lockd shutdown race
    - drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
    - pidns: disable pid allocation if pid_ns_prepare_proc() is failed in
      alloc_pid()
    - s390: move _text symbol to address higher than zero
    - net/mlx4_en: Avoid adding steering rules with invalid ring
    - NFSv4.1: Work around a Linux server bug...
    - CIFS: silence lockdep splat in cifs_relock_file()
    - net: qca_spi: Fix alignment issues in rx path
    - netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
    - Input: elan_i2c - check if device is there before really probing
    - Input: elantech - force relative mode on a certain module
    - KVM: PPC: Book3S PR: Check copy_to/from_user return values
    - vmxnet3: ensure that adapter is in proper state during force_close
    - SMB2: Fix share type handling
    - bus: brcmstb_gisb: Use register offsets with writes too
    - bus: brcmstb_gisb: correct support for 64-bit address output
    - PowerCap: Fix an error code in powercap_register_zone()
    - ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
    - staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before
      calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
    - x86/tsc: Provide 'tsc=unstable' boot parameter
    - ARM: dts: imx6qdl-wandboard: Fix audio channel swap
    - ipv6: avoid dad-failures for addresses with NODAD
    - async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
    - usb: dwc3: keystone: check return value
    - btrfs: fix incorrect error return ret being passed to mapping_set_error
    - ata: libahci: properly propagate return value of platform_get_irq()
    - neighbour: update neigh timestamps iff update is effective
    - arp: honour gratuitous ARP _replies_
    - usb: chipidea: properly handle host or gadget initialization failure
    - USB: ene_usb6250: fix first command execution
    - net: x25: fix one potential use-after-free issue
    - USB: ene_usb6250: fix SCSI residue overwriting
    - serial: 8250: omap: Disable DMA for console UART
    - serial: sh-sci: Fix race condition causing garbage during shutdown
    - sh_eth: Use platform device for printing before register_netdev()
    - scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
    - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
    - ath5k: fix memory leak on buf on failed eeprom read
    - selftests/powerpc: Fix TM resched DSCR test with some compilers
    - xfrm: fix state migration copy replay sequence numbers
    - iio: hi8435: avoid garbage event at first enable
    - iio: hi8435: cleanup reset gpio
    - ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
    - md-cluster: fix potential lock issue in add_new_disk
    - ARM: davinci: da8xx: Create DSP device only when assigned memory
    - ray_cs: Avoid reading past end of buffer
    - leds: pca955x: Correct I2C Functionality
    - sched/numa: Use down_read_trylock() for the mmap_sem
    - net/mlx5: Tolerate irq_set_affinity_hint() failures
    - selinux: do not check open permission on sockets
    - block: fix an error code in add_partition()
    - mlx5: fix bug reading rss_hash_type from CQE
    - net: ieee802154: fix net_device reference release too early
    - libceph: NULL deref on crush_decode() error path
    - netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
    - pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
    - ASoC: rsnd: SSI PIO adjust to 24bit mode
    - scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
    - fix race in drivers/char/random.c:get_reg()
    - ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
    - tcp: better validation of received ack sequences
    - net: move somaxconn init from sysctl code
    - Input: elan_i2c - clear INT before resetting controller
    - bonding: Don't update slave->link until ready to commit
    - KVM: nVMX: Fix handling of lmsw instruction
    - net: llc: add lock_sock in llc_ui_bind to avoid a race condition
    - ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
    - thermal: power_allocator: fix one race condition issue for thermal_instances
      list
    - perf probe: Add warning message if there is unexpected event name
    - l2tp: fix missing print session offset info
    - rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
    - hwmon: (ina2xx) Make calibration register value fixed
    - media: videobuf2-core: don't go out of the buffer range
    - ASoC: Intel: cht_bsw_rt5645: Analog Mic support
    - scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
    - vfb: fix video mode and line_length being set when loaded
    - gpio: label descriptors using the device name
    - ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
    - wl1251: check return from call to wl1251_acx_arp_ip_filter
    - hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
    - ovl: filter trusted xattr for non-admin
    - powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
    - dmaengine: imx-sdma: Handle return value of clk_prepare_enable
    - arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
    - net/mlx5: avoid build warning for uniprocessor
    - cxgb4: FW upgrade fixes
    - rtc: opal: Handle disabled TPO in opal_get_tpo_time()
    - rtc: interface: Validate alarm-time before handling rollover
    - SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
    - net: freescale: fix potential null pointer dereference
    - KVM: SVM: do not zero out segment attributes if segment is unusable or not
      present
    - clk: scpi: fix return type of __scpi_dvfs_round_rate
    - clk: Fix __set_clk_rates error print-string
    - powerpc/spufs: Fix coredump of SPU contexts
    - perf trace: Add mmap alias for s390
    - qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and
      qlcnic_82xx_hw_read_wx_2M
    - mISDN: Fix a sleep-in-atomic bug
    - drm/omap: fix tiled buffer stride calculations
    - cxgb4: fix incorrect cim_la output for T6
    - Fix serial console on SNI RM400 machines
    - bio-integrity: Do not allocate integrity context for bio w/o data
    - skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
    - sit: reload iphdr in ipip6_rcv
    - net/mlx4: Fix the check in attaching steering rules
    - net/mlx4: Check if Granular QoS per VF has been enabled before updating QP
      qos_vport
    - perf header: Set proper module name when build-id event found
    - perf report: Ensure the perf DSO mapping matches what libdw sees
    - tags: honor COMPILED_SOURCE with apart output directory
    - e1000e: fix race condition around skb_tstamp_tx()
    - cx25840: fix unchecked return values
    - mceusb: sporadic RX truncation corruption fix
    - net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
    - ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
    - e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
    - perf/core: Correct event creation with PERF_FORMAT_GROUP
    - MIPS: mm: fixed mappings: correct initialisation
    - MIPS: mm: adjust PKMAP location
    - MIPS: kprobes: flush_insn_slot should flush only if probe initialised
    - Fix loop device flush before configure v3
    - net: emac: fix reset timeout with AR8035 phy
    - skbuff: only inherit relevant tx_flags
    - xen: avoid type warning in xchg_xen_ulong
    - bnx2x: Allow vfs to disable txvlan offload
    - sctp: fix recursive locking warning in sctp_do_peeloff
    - sparc64: ldc abort during vds iso boot
    - iio: magnetometer: st_magn_spi: fix spi_device_id table
    - Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
    - cpuidle: dt: Add missing 'of_node_put()'
    - ACPICA: Events: Add runtime stub support for event APIs
    - ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
    - s390/dasd: fix hanging safe offline
    - vxlan: dont migrate permanent fdb entries during learn
    - bcache: stop writeback thread after detaching
    - bcache: segregate flash only volume write streams
    - scsi: libsas: fix memory leak in sas_smp_get_phy_events()
    - scsi: libsas: fix error when getting phy events
    - scsi: libsas: initialize sas_phy status according to response of DISCOVER
    - blk-mq: fix kernel oops in blk_mq_tag_idle()
    - tty: n_gsm: Allow ADM response in addition to UA for control dlci
    - EDAC, mv64x60: Fix an error handling path
    - cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
    - perf tools: Fix copyfile_offset update of output offset
    - ipsec: check return value of skb_to_sgvec always
    - rxrpc: check return value of skb_to_sgvec always
    - virtio_net: check return value of skb_to_sgvec always
    - virtio_net: check return value of skb_to_sgvec in one more location
    - random: use lockless method of accessing and updating f->reg_idx
    - futex: Remove requirement for lock_page() in get_futex_key()
    - Kbuild: provide a __UNIQUE_ID for clang
    - arp: fix arp_filter on l3slave devices
    - net: fix possible out-of-bound read in skb_network_protocol()
    - net/ipv6: Fix route leaking between VRFs
    - netlink: make sure nladdr has correct size in netlink_connect()
    - net/sched: fix NULL dereference in the error path of tcf_bpf_init()
    - pptp: remove a buggy dst release in pptp_connect()
    - sctp: do not leak kernel memory to user space
    - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
    - vhost: correctly remove wait queue during poll failure
    - vlan: also check phy_driver ts_info for vlan's real device
    - bonding: fix the err path for dev hwaddr sync in bond_enslave
    - bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
    - bonding: process the err returned by dev_set_allmulti properly in
      bond_enslave
    - net: fool proof dev_valid_name()
    - ip_tunnel: better validate user provided tunnel names
    - ipv6: sit: better validate user provided tunnel names
    - ip6_gre: better validate user provided tunnel names
    - ip6_tunnel: better validate user provided tunnel names
    - vti6: better validate user provided tunnel names
    - r8169: fix setting driver_data after register_netdev
    - net sched actions: fix dumping which requires several messages to user space
    - net/ipv6: Increment OUTxxx counters after netfilter hook
    - ipv6: the entire IPv6 header chain must fit the first fragment
    - vrf: Fix use after free and double free in vrf_finish_output
    - Revert "xhci: plat: Register shutdown for xhci_plat"
    - Linux 4.4.128

  * sky2 gigabit ethernet driver sometimes stops working after lid-open resume
    from sleep (88E8055) (LP: #1758507) // Xenial update to 4.4.128 stable
    release (LP: #1765010)
    - sky2: Increase D3 delay to sky2 stops working after suspend

  * Xenial update to 4.4.127 stable release (LP: #1765007)
    - mtd: jedec_probe: Fix crash in jedec_read_mfr()
    - ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
    - ALSA: pcm: potential uninitialized return values
    - partitions/msdos: Unable to mount UFS 44bsd partitions
    - usb: gadget: define free_ep_req as universal function
    - usb: gadget: change len to size_t on alloc_ep_req()
    - usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align
    - usb: gadget: align buffer size when allocating for OUT endpoint
    - usb: gadget: f_hid: fix: Prevent accessing released memory
    - kprobes/x86: Fix to set RWX bits correctly before releasing trampoline
    - ACPI, PCI, irq: remove redundant check for null string pointer
    - writeback: fix the wrong congested state variable definition
    - PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant
    - dm ioctl: remove double parentheses
    - Input: mousedev - fix implicit conversion warning
    - netfilter: nf_nat_h323: fix logical-not-parentheses warning
    - genirq: Use cpumask_available() for check of cpumask variable
    - cpumask: Add helper cpumask_available()
    - selinux: Remove unnecessary check of array base in selinux_set_mapping()
    - fs: compat: Remove warning from COMPATIBLE_IOCTL
    - jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp
    - frv: declare jiffies to be located in the .data section
    - audit: add tty field to LOGIN event
    - tty: provide tty_name() even without CONFIG_TTY
    - netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch
    - selinux: Remove redundant check for unknown labeling behavior
    - arm64: avoid overflow in VA_START and PAGE_OFFSET
    - xfrm_user: uncoditionally validate esn replay attribute struct
    - RDMA/ucma: Check AF family prior resolving address
    - RDMA/ucma: Fix use-after-free access in ucma_close
    - RDMA/ucma: Ensure that CM_ID exists prior to access it
    - RDMA/ucma: Check that device is connected prior to access it
    - RDMA/ucma: Check that device exists prior to accessing it
    - RDMA/ucma: Don't allow join attempts for unsupported AF family
    - RDMA/ucma: Introduce safer rdma_addr_size() variants
    - net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
    - xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
    - netfilter: bridge: ebt_among: add more missing match size checks
    - netfilter: x_tables: add and use xt_check_proc_name
    - Bluetooth: Fix missing encryption refresh on Security Request
    - llist: clang: introduce member_address_is_nonnull()
    - scsi: virtio_scsi: always read VPD pages for multiqueue too
    - usb: dwc2: Improve gadget state disconnection handling
    - USB: serial: ftdi_sio: add RT Systems VX-8 cable
    - USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
    - USB: serial: cp210x: add ELDAT Easywave RX09 id
    - mei: remove dev_err message on an unsupported ioctl
    - media: usbtv: prevent double free in error case
    - parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
    - crypto: ahash - Fix early termination in hash walk
    - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
    - fs/proc: Stop trying to report thread stacks
    - staging: comedi: ni_mio_common: ack ai fifo error interrupts.
    - Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
    - Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
    - vt: change SGR 21 to follow the standards
    - Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property
      definition
    - ARM: dts: dra7: Add power hold and power controller properties to palmas
    - ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property
    - md/raid10: reset the 'first' at the end of loop
    - net: hns: Fix ethtool private flags
    - Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()"
    - Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
    - Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
    - Revert "cpufreq: Fix governor module removal race"
    - Revert "mtip32xx: use runtime tag to initialize command header"
    - spi: davinci: fix up dma_mapping_error() incorrect patch
    - net: cavium: liquidio: fix up "Avoid dma_unmap_single on uninitialized
      ndata"
    - Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
    - Linux 4.4.127

  * Xenial update to 4.4.126 stable release (LP: #1764999)
    - scsi: sg: don't return bogus Sg_requests
    - Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for
      shared IRQs"
    - net: Fix hlist corruptions in inet_evict_bucket()
    - dccp: check sk for closed state in dccp_sendmsg()
    - ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
    - l2tp: do not accept arbitrary sockets
    - net: ethernet: arc: Fix a potential memory leak if an optional regulator is
      deferred
    - net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY
      interface
    - net/iucv: Free memory obtained by kzalloc
    - netlink: avoid a double skb free in genlmsg_mcast()
    - net: Only honor ifindex in IP_PKTINFO if non-0
    - skbuff: Fix not waking applications when errors are enqueued
    - team: Fix double free in error path
    - s390/qeth: free netdevice when removing a card
    - s390/qeth: when thread completes, wake up all waiters
    - s390/qeth: lock read device while queueing next buffer
    - s390/qeth: on channel error, reject further cmd requests
    - ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
    - net: fec: Fix unbalanced PM runtime calls
    - net: systemport: Rewrite __bcm_sysport_tx_reclaim()
    - Linux 4.4.126

  * Xenial update to 4.4.125 stable release (LP: #1764973)
    - MIPS: ralink: Remove ralink_halt()
    - iio: st_pressure: st_accel: pass correct platform data to init
    - ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
    - ALSA: aloop: Sync stale timer before release
    - ALSA: aloop: Fix access to not-yet-ready substream via cable
    - ALSA: hda/realtek - Always immediately update mute LED with pin VREF
    - mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
    - PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
    - ahci: Add PCI-id for the Highpoint Rocketraid 644L card
    - clk: bcm2835: Protect sections updating shared registers
    - Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
    - libata: fix length validation of ATAPI-relayed SCSI commands
    - libata: remove WARN() for DMA or PIO command without data
    - libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
    - libata: Enable queued TRIM for Samsung SSD 860
    - libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
    - libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
    - libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
    - mm/vmalloc: add interfaces to free unmapped page table
    - x86/mm: implement free pmd/pte page interfaces
    - drm/vmwgfx: Fix a destoy-while-held mutex problem.
    - drm/radeon: Don't turn off DP sink when disconnected
    - drm: udl: Properly check framebuffer mmap offsets
    - acpi, numa: fix pxm to online numa node associations
    - brcmfmac: fix P2P_DEVICE ethernet address generation
    - rtlwifi: rtl8723be: Fix loss of signal
    - tracing: probeevent: Fix to support minus offset from symbol
    - mtd: nand: fsl_ifc: Fix nand waitfunc return value
    - staging: ncpfs: memory corruption in ncp_read_kernel()
    - can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
    - can: cc770: Fix queue stall & dropped RTR reply
    - can: cc770: Fix use after free in cc770_tx_interrupt()
    - tty: vt: fix up tabstops properly
    - x86/build/64: Force the linker to use 2MB page size
    - x86/boot/64: Verify alignment of the LOAD segment
    - perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
    - staging: lustre: ptlrpc: kfree used instead of kvfree
    - kbuild: disable clang's default use of -fmerge-all-constants
    - bpf: skip unnecessary capability check
    - bpf, x64: increase number of passes
    - Linux 4.4.125

  * System fails to start (boot) on battery due to read-only root file-system
    (LP: #1726930) // Xenial update to 4.4.125 stable release (LP: #1764973)
    - libata: disable LPM for Crucial BX100 SSD 500GB drive

  * Xenial update to 4.4.124 stable release (LP: #1764762)
    - tpm: fix potential buffer overruns caused by bit glitches on the bus
    - tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
    - staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
    - platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
    - regulator: anatop: set default voltage selector for pcie
    - x86: i8259: export legacy_pic symbol
    - rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs
    - Input: ar1021_i2c - fix too long name in driver's device table
    - time: Change posix clocks ops interfaces to use timespec64
    - ACPI/processor: Fix error handling in __acpi_processor_start()
    - ACPI/processor: Replace racy task affinity logic
    - cpufreq/sh: Replace racy task affinity logic
    - genirq: Use irqd_get_trigger_type to compare the trigger type for shared
      IRQs
    - i2c: i2c-scmi: add a MS HID
    - net: ipv6: send unsolicited NA on admin up
    - media/dvb-core: Race condition when writing to CAM
    - spi: dw: Disable clock after unregistering the host
    - ath: Fix updating radar flags for coutry code India
    - clk: ns2: Correct SDIO bits
    - scsi: virtio_scsi: Always try to read VPD pages
    - KVM: PPC: Book3S PR: Exit KVM on failed mapping
    - ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER
    - iommu/omap: Register driver before setting IOMMU ops
    - md/raid10: wait up frozen array in handle_write_completed
    - NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()
    - tcp: remove poll() flakes with FastOpen
    - e1000e: fix timing for 82579 Gigabit Ethernet controller
    - ALSA: hda - Fix headset microphone detection for ASUS N551 and N751
    - IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow
    - IB/ipoib: Update broadcast object if PKey value was changed in index 0
    - HSI: ssi_protocol: double free in ssip_pn_xmit()
    - IB/mlx4: Take write semaphore when changing the vma struct
    - IB/mlx4: Change vma from shared to private
    - ASoC: Intel: Skylake: Uninitialized variable in probe_codec()
    - Fix driver usage of 128B WQEs when WQ_CREATE is V1.
    - netfilter: xt_CT: fix refcnt leak on error path
    - openvswitch: Delete conntrack entry clashing with an expectation.
    - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()
    - wan: pc300too: abort path on failure
    - qlcnic: fix unchecked return value
    - scsi: mac_esp: Replace bogus memory barrier with spinlock
    - infiniband/uverbs: Fix integer overflows
    - NFS: don't try to cross a mountpount when there isn't one there.
    - Revert "UBUNTU: SAUCE: (no-up) iio: st_pressure: st_accel: Initialise sensor
      platform data properly"
    - iio: st_pressure: st_accel: Initialise sensor platform data properly
    - mt7601u: check return value of alloc_skb
    - rndis_wlan: add return value validation
    - Btrfs: send, fix file hole not being preserved due to inline extent
    - mac80211: don't parse encrypted management frames in ieee80211_frame_acked
    - mfd: palmas: Reset the POWERHOLD mux during power off
    - mtip32xx: use runtime tag to initialize command header
    - staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK
      set to y
    - staging: wilc1000: fix unchecked return value
    - mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a
    - ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP
    - ipmi/watchdog: fix wdog hang on panic waiting for ipmi response
    - ACPI / PMIC: xpower: Fix power_table addresses
    - drm/nouveau/kms: Increase max retries in scanout position queries.
    - bnx2x: Align RX buffers
    - power: supply: pda_power: move from timer to delayed_work
    - Input: twl4030-pwrbutton - use correct device for irq request
    - md/raid10: skip spare disk as 'first' disk
    - ia64: fix module loading for gcc-5.4
    - tcm_fileio: Prevent information leak for short reads
    - video: fbdev: udlfb: Fix buffer on stack
    - sm501fb: don't return zero on failure path in sm501fb_start()
    - net: hns: fix ethtool_get_strings overflow in hns driver
    - cifs: small underflow in cnvrtDosUnixTm()
    - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks
    - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL
    - perf tests kmod-path: Don't fail if compressed modules aren't supported
    - Bluetooth: hci_qca: Avoid setup failure on missing rampatch
    - media: c8sectpfe: fix potential NULL pointer dereference in
      c8sectpfe_timer_interrupt
    - drm/msm: fix leak in failed get_pages
    - RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()
    - rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.
    - media: bt8xx: Fix err 'bt878_probe()'
    - media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
    - cros_ec: fix nul-termination for firmware build info
    - platform/chrome: Use proper protocol transfer function
    - mmc: avoid removing non-removable hosts during suspend
    - IB/ipoib: Avoid memory leak if the SA returns a different DGID
    - RDMA/cma: Use correct size when writing netlink stats
    - IB/umem: Fix use of npages/nmap fields
    - vgacon: Set VGA struct resource types
    - drm/omap: DMM: Check for DMM readiness after successful transaction commit
    - pty: cancel pty slave port buf's work in tty_release
    - coresight: Fix disabling of CoreSight TPIU
    - pinctrl: Really force states during suspend/resume
    - iommu/vt-d: clean up pr_irq if request_threaded_irq fails
    - ip6_vti: adjust vti mtu according to mtu of lower device
    - RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
    - nfsd4: permit layoutget of executable-only files
    - clk: si5351: Rename internal plls to avoid name collisions
    - dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
    - RDMA/ucma: Fix access to non-initialized CM_ID object
    - Linux 4.4.124

  * Xenial update to 4.4.123 stable release (LP: #1764666)
    - blkcg: fix double free of new_blkg in blkcg_init_queue
    - Input: tsc2007 - check for presence and power down tsc2007 during probe
    - staging: speakup: Replace BUG_ON() with WARN_ON().
    - staging: wilc1000: add check for kmalloc allocation failure.
    - HID: reject input outside logical range only if null state is set
    - drm: qxl: Don't alloc fbdev if emulation is not supported
    - ath10k: fix a warning during channel switch with multiple vaps
    - PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
    - selinux: check for address length in selinux_socket_bind()
    - perf sort: Fix segfault with basic block 'cycles' sort dimension
    - i40e: Acquire NVM lock before reads on all devices
    - i40e: fix ethtool to get EEPROM data from X722 interface
    - perf tools: Make perf_event__synthesize_mmap_events() scale
    - drivers: net: xgene: Fix hardware checksum setting
    - drm: Defer disabling the vblank IRQ until the next interrupt (for instant-
      off)
    - ath10k: disallow DFS simulation if DFS channel is not enabled
    - perf probe: Return errno when not hitting any event
    - HID: clamp input to logical range if no null state
    - net/8021q: create device with all possible features in wanted_features
    - ARM: dts: Adjust moxart IRQ controller and flags
    - batman-adv: handle race condition for claims between gateways
    - of: fix of_device_get_modalias returned length when truncating buffers
    - solo6x10: release vb2 buffers in solo_stop_streaming()
    - scsi: ipr: Fix missed EH wakeup
    - media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
    - timers, sched_clock: Update timeout for clock wrap
    - sysrq: Reset the watchdog timers while displaying high-resolution timers
    - Input: qt1070 - add OF device ID table
    - sched: act_csum: don't mangle TCP and UDP GSO packets
    - ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
    - spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
    - tcp: sysctl: Fix a race to avoid unexpected 0 window from space
    - dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
    - driver: (adm1275) set the m,b and R coefficients correctly for power
    - mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
    - blk-throttle: make sure expire time isn't too big
    - f2fs: relax node version check for victim data in gc
    - bonding: refine bond_fold_stats() wrap detection
    - braille-console: Fix value returned by _braille_console_setup
    - drm/vmwgfx: Fixes to vmwgfx_fb
    - vxlan: vxlan dev should inherit lowerdev's gso_max_size
    - NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
    - NFC: nfcmrvl: double free on error path
    - ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
    - ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
    - powerpc: Avoid taking a data miss on every userspace instruction miss
    - net/faraday: Add missing include of of.h
    - ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
    - reiserfs: Make cancel_old_flush() reliable
    - ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
    - fm10k: correctly check if interface is removed
    - apparmor: Make path_max parameter readonly
    - iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
    - video: ARM CLCD: fix dma allocation size
    - drm/radeon: Fail fb creation from imported dma-bufs.
    - drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
    - coresight: Fixes coresight DT parse to get correct output port ID.
    - MIPS: BPF: Quit clobbering callee saved registers in JIT code.
    - MIPS: BPF: Fix multiple problems in JIT skb access helpers.
    - MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
    - MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
    - regulator: isl9305: fix array size
    - md/raid6: Fix anomily when recovering a single device in RAID6.
    - usb: dwc2: Make sure we disconnect the gadget state
    - usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in
      dummy_hub_control()
    - drivers/perf: arm_pmu: handle no platform_device
    - perf inject: Copy events when reordering events in pipe mode
    - perf session: Don't rely on evlist in pipe mode
    - scsi: sg: check for valid direction before starting the request
    - scsi: sg: close race condition in sg_remove_sfp_usercontext()
    - kprobes/x86: Fix kprobe-booster not to boost far call instructions
    - kprobes/x86: Set kprobes pages read-only
    - pwm: tegra: Increase precision in PWM rate calculation
    - wil6210: fix memory access violation in wil_memcpy_from/toio_32
    - drm/edid: set ELD connector type in drm_edid_to_eld()
    - video/hdmi: Allow "empty" HDMI infoframes
    - HID: elo: clear BTN_LEFT mapping
    - ARM: dts: exynos: Correct Trats2 panel reset line
    - sched: Stop switched_to_rt() from sending IPIs to offline CPUs
    - sched: Stop resched_cpu() from sending IPIs to offline CPUs
    - test_firmware: fix setting old custom fw path back on exit
    - net: xfrm: allow clearing socket xfrm policies.
    - mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
    - ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
    - ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
    - ath10k: update tdls teardown state to target
    - cpufreq: Fix governor module removal race
    - clk: qcom: msm8916: fix mnd_width for codec_digcodec
    - ath10k: fix invalid STS_CAP_OFFSET_MASK
    - tools/usbip: fixes build with musl libc toolchain
    - spi: sun6i: disable/unprepare clocks on remove
    - scsi: core: scsi_get_device_flags_keyed(): Always return device flags
    - scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
    - scsi: dh: add new rdac devices
    - media: cpia2: Fix a couple off by one bugs
    - veth: set peer GSO values
    - drm/amdkfd: Fix memory leaks in kfd topology
    - agp/intel: Flush all chipset writes after updating the GGTT
    - mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
    - mac80211: remove BUG() when interface type is invalid
    - ASoC: nuc900: Fix a loop timeout test
    - ipvlan: add L2 check for packets arriving via virtual devices
    - rcutorture/configinit: Fix build directory error message
    - ima: relax requiring a file signature for new files with zero length
    - selftests/x86/entry_from_vm86: Exit with 1 if we fail
    - selftests/x86: Add tests for User-Mode Instruction Prevention
    - selftests/x86: Add tests for the STR and SLDT instructions
    - selftests/x86/entry_from_vm86: Add test cases for POPF
    - x86/vm86/32: Fix POPF emulation
    - x86/mm: Fix vmalloc_fault to use pXd_large
    - ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
    - ALSA: hda - Revert power_save option default value
    - ALSA: seq: Fix possible UAF in snd_seq_check_queue()
    - ALSA: seq: Clear client entry before deleting else at closing
    - drm/amdgpu/dce: Don't turn off DP sink when disconnected
    - fs: Teach path_connected to handle nfs filesystems with multiple roots.
    - lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
    - fs/aio: Add explicit RCU grace period when freeing kioctx
    - fs/aio: Use RCU accessors for kioctx_table->table[]
    - irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
    - scsi: sg: fix SG_DXFER_FROM_DEV transfers
    - scsi: sg: fix static checker warning in sg_is_valid_dxfer
    - scsi: sg: only check for dxfer_len greater than 256M
    - ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
    - btrfs: alloc_chunk: fix DUP stripe size handling
    - btrfs: Fix use-after-free when cleaning up fs_devs with a single stale
      device
    - USB: gadget: udc: Add missing platform_device_put() on error in
      bdc_pci_probe()
    - usb: gadget: bdc: 64-bit pointer capability check
    - Linux 4.4.123

  * Xenial update to 4.4.123 stable release (LP: #1764666) // CVE-2017-16995
    - Revert "bpf: fix incorrect sign extension in check_alu_op()"
    - bpf: fix incorrect sign extension in check_alu_op()

  * Xenial update to 4.4.122 stable release (LP: #1764627)
    - RDMA/ucma: Limit possible option size
    - RDMA/ucma: Check that user doesn't overflow QP state
    - RDMA/mlx5: Fix integer overflow while resizing CQ
    - scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
    - workqueue: Allow retrieval of current task's work struct
    - drm: Allow determining if current task is output poll worker
    - drm/nouveau: Fix deadlock on runtime suspend
    - drm/radeon: Fix deadlock on runtime suspend
    - drm/amdgpu: Fix deadlock on runtime suspend
    - drm/amdgpu: Notify sbios device ready before send request
    - drm/radeon: fix KV harvesting
    - drm/amdgpu: fix KV harvesting
    - MIPS: BMIPS: Do not mask IPIs during suspend
    - MIPS: ath25: Check for kzalloc allocation failure
    - MIPS: OCTEON: irq: Check for null return on kzalloc allocation
    - Input: matrix_keypad - fix race when disabling interrupts
    - loop: Fix lost writes caused by missing flag
    - kbuild: Handle builtin dtb file names containing hyphens
    - bcache: don't attach backing with duplicate UUID
    - x86/MCE: Serialize sysfs changes
    - ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
    - ALSA: seq: More protection for concurrent write and ioctl races
    - ALSA: hda: add dock and led support for HP EliteBook 820 G3
    - ALSA: hda: add dock and led support for HP ProBook 640 G2
    - watchdog: hpwdt: SMBIOS check
    - watchdog: hpwdt: Check source of NMI
    - watchdog: hpwdt: fix unused variable warning
    - netfilter: nfnetlink_queue: fix timestamp attribute
    - Input: tca8418_keypad - remove double read of key event register
    - tc358743: fix register i2c_rd/wr function fix
    - netfilter: add back stackpointer size checks
    - netfilter: x_tables: fix missing timer initialization in xt_LED
    - netfilter: nat: cope with negative port range
    - netfilter: IDLETIMER: be syzkaller friendly
    - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
    - netfilter: bridge: ebt_among: add missing match size checks
    - netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
    - netfilter: use skb_to_full_sk in ip_route_me_harder
    - ext4: inplace xattr block update fails to deduplicate blocks
    - ubi: Fix race condition between ubi volume creation and udev
    - scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
    - NFS: Fix an incorrect type in struct nfs_direct_req
    - Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux"
    - x86/module: Detect and skip invalid relocations
    - x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
    - serial: sh-sci: prevent lockup on full TTY buffers
    - tty/serial: atmel: add new version check for usart
    - uas: fix comparison for error code
    - staging: comedi: fix comedi_nsamples_left.
    - staging: android: ashmem: Fix lockdep issue during llseek
    - USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
    - usb: quirks: add control message delay for 1b1c:1b20
    - USB: usbmon: remove assignment from IS_ERR argument
    - usb: usbmon: Read text within supplied buffer size
    - usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
    - serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
    - fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
    - Linux 4.4.122

  * Xenial update to 4.4.122 stable release (LP: #1764627) // CVE-2018-1000004.
    - ALSA: seq: Don't allow resizing pool in use

  * Xenial update to 4.4.121 stable release (LP: #1764367)
    - tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the
      bus
    - tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on
      the bus
    - tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the
      bus
    - ALSA: usb-audio: Add a quirck for B&W PX headphones
    - ALSA: hda: Add a power_save blacklist
    - cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
    - media: m88ds3103: don't call a non-initalized function
    - ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
    - KVM: mmu: Fix overlap between public and private memslots
    - btrfs: Don't clear SGID when inheriting ACLs
    - ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
    - x86/apic/vector: Handle legacy irq data correctly
    - leds: do not overflow sysfs buffer in led_trigger_show
    - x86/spectre: Fix an error message
    - bridge: check brport attr show in brport_show
    - fib_semantics: Don't match route with mismatching tclassid
    - hdlc_ppp: carrier detect ok, don't turn off negotiation
    - ipv6 sit: work around bogus gcc-8 -Wrestrict warning
    - net: fix race on decreasing number of TX queues
    - net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
    - netlink: ensure to loop over all netns in genlmsg_multicast_allns()
    - ppp: prevent unregistered channels from connecting to PPP units
    - udplite: fix partial checksum initialization
    - sctp: fix dst refcnt leak in sctp_v4_get_dst
    - sctp: fix dst refcnt leak in sctp_v6_get_dst()
    - s390/qeth: fix SETIP command handling
    - s390/qeth: fix IPA command submission race
    - sctp: verify size of a new chunk in _sctp_make_chunk()
    - net: mpls: Pull common label check into helper
    - dm io: fix duplicate bio completion due to missing ref count
    - bpf, x64: implement retpoline for tail call
    - btrfs: preserve i_mode if __btrfs_set_acl() fails
    - Linux 4.4.121

  * Xenial update to 4.4.120 stable release (LP: #1764316)
    - hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)
    - f2fs: fix a bug caused by NULL extent tree
    - mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
    - ipv6: icmp6: Allow icmp messages to be looped back
    - ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
    - sget(): handle failures of register_shrinker()
    - drm/nouveau/pci: do a msi rearm on init
    - spi: atmel: fixed spin_lock usage inside atmel_spi_remove
    - net: arc_emac: fix arc_emac_rx() error paths
    - scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
    - ARM: dts: ls1021a: fix incorrect clock references
    - lib/mpi: Fix umul_ppmm() for MIPS64r6
    - tg3: Add workaround to restrict 5762 MRRS to 2048
    - tg3: Enable PHY reset in MTU change path for 5720
    - bnx2x: Improve reliability in case of nested PCI errors
    - s390/dasd: fix wrongly assigned configuration data
    - IB/mlx4: Fix mlx4_ib_alloc_mr error flow
    - IB/ipoib: Fix race condition in neigh creation
    - xfs: quota: fix missed destroy of qi_tree_lock
    - xfs: quota: check result of register_shrinker()
    - e1000: fix disabling already-disabled warning
    - drm/ttm: check the return value of kzalloc
    - mac80211: mesh: drop frames appearing to be from us
    - can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
    - bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
    - xen-netfront: enable device after manual module load
    - mdio-sun4i: Fix a memory leak
    - SolutionEngine771x: fix Ether platform data
    - xen/gntdev: Fix off-by-one error when unmapping with holes
    - xen/gntdev: Fix partial gntdev_mmap() cleanup
    - sctp: make use of pre-calculated len
    - net: gianfar_ptp: move set_fipers() to spinlock protecting area
    - MIPS: Implement __multi3 for GCC7 MIPS64r6 builds
    - Linux 4.4.120

  * Xenial update to 4.4.119 stable release (LP: #1762453)
    - netfilter: drop outermost socket lock in getsockopt()
    - powerpc/64s: Fix RFI flush dependency on HARDLOCKUP_DETECTOR
    - PCI: keystone: Fix interrupt-controller-node lookup
    - ip_tunnel: replace dst_cache with generic implementation
    - ip_tunnel: fix preempt warning in ip tunnel creation/updating
    - scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info
    - cfg80211: fix cfg80211_beacon_dup
    - iio: buffer: check if a buffer has been set up when poll is called
    - iio: adis_lib: Initialize trigger before requesting interrupt
    - x86/oprofile: Fix bogus GCC-8 warning in nmi_setup()
    - irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()
    - usb: ohci: Proper handling of ed_rm_list to handle race condition between
      usb_kill_urb() and finish_unlinks()
    - arm64: Disable unhandled signal log messages by default
    - Add delay-init quirk for Corsair K70 RGB keyboards
    - usb: dwc3: gadget: Set maxpacket size for ep0 IN
    - usb: ldusb: add PIDs for new CASSY devices supported by this driver
    - usb: gadget: f_fs: Process all descriptors during bind
    - usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path
    - drm/amdgpu: Avoid leaking PM domain on driver unbind (v2)
    - binder: add missing binder_unlock()
    - Linux 4.4.119

  * [regression] Colour banding and artefacts appear system-wide on an Asus
    Zenbook UX303LA with Intel HD 4400 graphics (LP: #1749420) // Xenial update
    to 4.4.119 stable release (LP: #1762453)
    - drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA

  * Xenial update to 4.4.118 stable release (LP: #1756866)
    - net: add dst_cache support
    - [Config] Add CONFIG_DST_CACHE=y
    - net: replace dst_cache ip6_tunnel implementation with the generic one
    - cfg80211: check dev_set_name() return value
    - mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
    - xfrm: Fix stack-out-of-bounds read on socket policy lookup.
    - xfrm: check id proto in validate_tmpl()
    - blktrace: fix unlocked registration of tracepoints
    - drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
    - Provide a function to create a NUL-terminated string from unterminated data
    - selinux: ensure the context is NUL terminated in
      security_context_to_sid_core()
    - selinux: skip bounded transition processing if the policy isn't loaded
    - crypto: x86/twofish-3way - Fix %rbp usage
    - KVM: x86: fix escape of guest dr6 to the host
    - netfilter: x_tables: fix int overflow in xt_alloc_table_info()
    - netfilter: x_tables: avoid out-of-bounds reads in
      xt_request_find_{match|target}
    - netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
    - netfilter: on sockopt() acquire sock lock only in the required scope
    - netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
    - net: avoid skb_warn_bad_offload on IS_ERR
    - ASoC: ux500: add MODULE_LICENSE tag
    - video: fbdev/mmp: add MODULE_LICENSE
    - arm64: dts: add #cooling-cells to CPU nodes
    - Make DST_CACHE a silent config option
    - dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
    - staging: android: ashmem: Fix a race condition in pin ioctls
    - binder: check for binder_thread allocation failure in binder_poll()
    - staging: iio: adc: ad7192: fix external frequency setting
    - usbip: keep usbip_device sockfd state in sync with tcp_socket
    - usb: build drivers/usb/common/ when USB_SUPPORT is set
    - ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
    - ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
    - ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
    - ARM: dts: am4372: Correct the interrupts_properties of McASP
    - perf top: Fix window dimensions change handling
    - perf bench numa: Fixup discontiguous/sparse numa nodes
    - media: s5k6aa: describe some function parameters
    - pinctrl: sunxi: Fix A80 interrupt pin bank
    - RDMA/cma: Make sure that PSN is not over max allowed
    - scripts/kernel-doc: Don't fail with status != 0 if error encountered with
      -none
    - ipvlan: Add the skb->mark as flow4's member to lookup route
    - powerpc/perf: Fix oops when grouping different pmu events
    - s390/dasd: prevent prefix I/O error
    - gianfar: fix a flooded alignment reports because of padding issue.
    - net_sched: red: Avoid devision by zero
    - net_sched: red: Avoid illegal values
    - btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
    - 509: fix printing uninitialized stack memory when OID is empty
    - dmaengine: ioat: Fix error handling path
    - dmaengine: at_hdmac: fix potential NULL pointer dereference in
      atc_prep_dma_interleaved
    - clk: fix a panic error caused by accessing NULL pointer
    - ASoC: rockchip: disable clock on error
    - spi: sun4i: disable clocks in the remove function
    - xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
    - drm/armada: fix leak of crtc structure
    - dmaengine: jz4740: disable/unprepare clk if probe fails
    - mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
    - x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
    - xen: XEN_ACPI_PROCESSOR is Dom0-only
    - hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
    - virtio_balloon: prevent uninitialized variable use
    - isdn: icn: remove a #warning
    - vmxnet3: prevent building with 64K pages
    - [Config] ppc64el: Drop vmxnet3 module
    - gpio: intel-mid: Fix build warning when !CONFIG_PM
    - platform/x86: intel_mid_thermal: Fix suspend handlers unused warning
    - video: fbdev: via: remove possibly unused variables
    - scsi: advansys: fix build warning for PCI=n
    - x86/ras/inject: Make it depend on X86_LOCAL_APIC=y
    - arm64: define BUG() instruction without CONFIG_BUG
    - x86/fpu/math-emu: Fix possible uninitialized variable use
    - tools build: Add tools tree support for 'make -s'
    - x86/build: Silence the build with "make -s"
    - thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies
    - x86: add MULTIUSER dependency for KVM
    - x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG
    - scsi: advansys: fix uninitialized data access
    - arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
    - ALSA: hda/ca0132 - fix possible NULL pointer use
    - reiserfs: avoid a -Wmaybe-uninitialized warning
    - ssb: mark ssb_bus_register as __maybe_unused
    - thermal: spear: use __maybe_unused for PM functions
    - x86/boot: Avoid warning for zero-filling .bss
    - scsi: sim710: fix build warning
    - drivers/net: fix eisa_driver probe section mismatch
    - dpt_i2o: fix build warning
    - profile: hide unused functions when !CONFIG_PROC_FS
    - md: avoid warning for 32-bit sector_t
    - mtd: ichxrom: maybe-uninitialized with gcc-4.9
    - mtd: maps: add __init attribute
    - mptfusion: hide unused seq_mpt_print_ioc_summary function
    - scsi: fdomain: drop fdomain_pci_tbl when built-in
    - video: fbdev: sis: remove unused variable
    - staging: ste_rmi4: avoid unused function warnings
    - fbdev: sis: enforce selection of at least one backend
    - video: Use bool instead int pointer for get_opt_bool() argument
    - scsi: mvumi: use __maybe_unused to hide pm functions
    - SCSI: initio: remove duplicate module device table
    - pwc: hide unused label
    - usb: musb/ux500: remove duplicate check for dma_is_compatible
    - tty: hvc_xen: hide xen_console_remove when unused
    - target/user: Fix cast from pointer to phys_addr_t
    - driver-core: use 'dev' argument in dev_dbg_ratelimited stub
    - fbdev: auo_k190x: avoid unused function warnings
    - amd-xgbe: Fix unused suspend handlers build warning
    - mtd: sh_flctl: pass FIFO as physical address
    - mtd: cfi: enforce valid geometry configuration
    - fbdev: s6e8ax0: avoid unused function warnings
    - modsign: hide openssl output in silent builds
    - fbdev: sm712fb: avoid unused function warnings
    - hwrng: exynos - use __maybe_unused to hide pm functions
    - USB: cdc_subset: only build when one driver is enabled
    - [Config] Add CONFIG_USB_NET_CDC_SUBSET_ENABLE=m
    - rtlwifi: fix gcc-6 indentation warning
    - staging: wilc1000: fix kbuild test robot error
    - x86/platform/olpc: Fix resume handler build warning
    - netfilter: ipvs: avoid unused variable warnings
    - ipv4: ipconfig: avoid unused ic_proto_used symbol
    - tc1100-wmi: fix build warning when CONFIG_PM not enabled
    - tlan: avoid unused label with PCI=n
    - drm/vmwgfx: use *_32_bits() macros
    - tty: cyclades: cyz_interrupt is only used for PCI
    - genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msg
    - ASoC: mediatek: add i2c dependency
    - iio: adc: axp288: remove redundant duplicate const on axp288_adc_channels
    - infiniband: cxgb4: use %pR format string for printing resources
    - b2c2: flexcop: avoid unused function warnings
    - i2c: remove __init from i2c_register_board_info()
    - staging: unisys: visorinput depends on INPUT
    - tc358743: fix register i2c_rd/wr functions
    - drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized
    - Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning
    - KVM: add X86_LOCAL_APIC dependency
    - go7007: add MEDIA_CAMERA_SUPPORT dependency
    - em28xx: only use mt9v011 if camera support is enabled
    - ISDN: eicon: reduce stack size of sig_ind function
    - ASoC: rockchip: use __maybe_unused to hide st_irq_syscfg_resume
    - serial: 8250_mid: fix broken DMA dependency
    - drm/gma500: Sanity-check pipe index
    - hdpvr: hide unused variable
    - v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER
    - cw1200: fix bogus maybe-uninitialized warning
    - wireless: cw1200: use __maybe_unused to hide pm functions_
    - perf/x86: Shut up false-positive -Wmaybe-uninitialized warning
    - dmaengine: zx: fix build warning
    - net: hp100: remove unnecessary #ifdefs
    - gpio: xgene: mark PM functions as __maybe_unused
    - ncpfs: fix unused variable warning
    - Revert "power: bq27xxx_battery: Remove unneeded dependency in Kconfig"
    - power: bq27xxx_battery: mark some symbols __maybe_unused
    - isdn: sc: work around type mismatch warning
    - binfmt_elf: compat: avoid unused function warning
    - idle: i7300: add PCI dependency
    - usb: phy: msm add regulator dependency
    - ncr5380: shut up gcc indentation warning
    - ARM: tegra: select USB_ULPI from EHCI rather than platform
    - ASoC: Intel: Kconfig: fix build when ACPI is not enabled
    - netlink: fix nla_put_{u8,u16,u32} for KASAN
    - dell-wmi, dell-laptop: depends DMI
    - genksyms: Fix segfault with invalid declarations
    - x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix
      preemptibility bug
    - drm/gma500: remove helper function
    - kasan: rework Kconfig settings
    - KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready"
      exceptions simultaneously
    - x86/retpoline: Remove the esp/rsp thunk
    - module/retpoline: Warn about missing retpoline in module
    - x86/nospec: Fix header guards names
    - x86/bugs: Drop one "mitigation" from dmesg
    - x86/cpu/bugs: Make retpoline module warning conditional
    - x86/spectre: Check CONFIG_RETPOLINE in command line parser
    - x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
    - x86/paravirt: Remove 'noreplace-paravirt' cmdline option
    - x86/retpoline: Avoid retpolines for built-in __init functions
    - x86/spectre: Simplify spectre_v2 command line parsing
    - x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
    - KVM: nVMX: kmap() can't fail
    - KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail
    - kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
    - KVM: VMX: clean up declaration of VPID/EPT invalidation types
    - KVM: nVMX: invvpid handling improvements
    - crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
    - net: dst_cache_per_cpu_dst_set() can be static
    - ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
    - Linux 4.4.118

  * ibrs/ibpb fixes result in excessive kernel logging  (LP: #1755627)
    - SAUCE: remove ibrs_dump sysctl interface

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 07 May 2018 09:23:29 +0200

linux (4.4.0-124.148) xenial; urgency=medium

  * CVE-2018-8897
    - x86/entry/64: Don't use IST entry for #BP stack

  * CVE-2018-1087
    - kvm/x86: fix icebp instruction handling

  * CVE-2018-1000199
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 02 May 2018 11:37:20 +0200

# For older changelog entries, run 'apt-get changelog linux-doc'
