linux (4.15.0-50.54) bionic; urgency=medium

  * CVE-2018-12126 // CVE-2018-12127 // CVE-2018-12130
    - Documentation/l1tf: Fix small spelling typo
    - x86/cpu: Sanitize FAM6_ATOM naming
    - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
    - locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a
      new <linux/bits.h> file
    - tools include: Adopt linux/bits.h
    - x86/msr-index: Cleanup bit defines
    - x86/speculation: Consolidate CPU whitelists
    - x86/speculation/mds: Add basic bug infrastructure for MDS
    - x86/speculation/mds: Add BUG_MSBDS_ONLY
    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
    - x86/speculation/mds: Add mds_clear_cpu_buffers()
    - x86/speculation/mds: Clear CPU buffers on exit to user
    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
    - x86/speculation/mds: Add mitigation control for MDS
    - x86/speculation/mds: Add sysfs reporting for MDS
    - x86/speculation/mds: Add mitigation mode VMWERV
    - Documentation: Move L1TF to separate directory
    - Documentation: Add MDS vulnerability documentation
    - x86/speculation/mds: Add mds=full,nosmt cmdline option
    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
    - x86/speculation/mds: Add SMT warning message
    - x86/speculation/mds: Fix comment
    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
    - x86/speculation/mds: Add 'mitigations=' support for MDS

  * CVE-2017-5715 // CVE-2017-5753
    - s390/speculation: Support 'mitigations=' cmdline option

  * CVE-2017-5715 // CVE-2017-5753 // CVE-2017-5754 // CVE-2018-3639
    - powerpc/speculation: Support 'mitigations=' cmdline option

  * CVE-2017-5715 // CVE-2017-5754 // CVE-2018-3620 // CVE-2018-3639 //
    CVE-2018-3646
    - cpu/speculation: Add 'mitigations=' cmdline option
    - x86/speculation: Support 'mitigations=' cmdline option

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 06 May 2019 18:59:24 +0200

linux (4.15.0-49.53) bionic; urgency=medium

  * linux: 4.15.0-49.53 -proposed tracker (LP: #1826358)

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870)
    - powerpc/64s: Add support for ori barrier_nospec patching
    - powerpc/64s: Patch barrier_nospec in modules
    - powerpc/64s: Enable barrier_nospec based on firmware settings
    - powerpc: Use barrier_nospec in copy_from_user()
    - powerpc/64: Use barrier_nospec in syscall entry
    - powerpc/64s: Enhance the information in cpu_show_spectre_v1()
    - powerpc/64: Disable the speculation barrier from the command line
    - powerpc/64: Make stf barrier PPC_BOOK3S_64 specific.
    - powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
    - powerpc/64: Call setup_barrier_nospec() from setup_arch()
    - powerpc/64: Make meltdown reporting Book3S 64 specific
    - powerpc/lib/code-patching: refactor patch_instruction()
    - powerpc/lib/feature-fixups: use raw_patch_instruction()
    - powerpc/asm: Add a patch_site macro & helpers for patching instructions
    - powerpc/64s: Add new security feature flags for count cache flush
    - powerpc/64s: Add support for software count cache flush
    - powerpc/pseries: Query hypervisor for count cache flush settings
    - powerpc/powernv: Query firmware for count cache flush settings
    - powerpc/fsl: Add nospectre_v2 command line argument
    - KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char()
    - [Config] Add CONFIG_PPC_BARRIER_NOSPEC

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

  * autopkgtests run too often, too much and don't skip enough (LP: #1823056)
    - [Debian] Set +x on rebuild testcase.
    - [Debian] Skip rebuild test, for regression-suite deps.
    - [Debian] Make ubuntu-regression-suite skippable on unbootable kernels.
    - [Debian] make rebuild use skippable error codes when skipping.
    - [Debian] Only run regression-suite, if requested to.

  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
    - [Packaging] remove arm64 snapdragon from getabis
    - [Config] config changes for snapdragon split
    - packaging: arm64: disable building the snapdragon flavour
    - [Packaging] arm64: Drop snapdragon from kernel-versions

  * CVE-2017-5753
    - KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()
    - media: dvb_ca_en50221: prevent using slot_info for Spectre attacs
    - sysvipc/sem: mitigate semnum index against spectre v1
    - libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
    - s390/keyboard: sanitize array index in do_kdsk_ioctl
    - arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
    - KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr()
    - pktcdvd: Fix possible Spectre-v1 for pkt_devs
    - net: socket: fix potential spectre v1 gadget in socketcall
    - net: socket: Fix potential spectre v1 gadget in sock_is_registered
    - drm/amdgpu/pm: Fix potential Spectre v1
    - netlink: Fix spectre v1 gadget in netlink_create()
    - ext4: fix spectre gadget in ext4_mb_regular_allocator()
    - drm/i915/kvmgt: Fix potential Spectre v1
    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
    - fs/quota: Fix spectre gadget in do_quotactl
    - hwmon: (nct6775) Fix potential Spectre v1
    - mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom
    - switchtec: Fix Spectre v1 vulnerability
    - misc: hmc6352: fix potential Spectre v1
    - tty: vt_ioctl: fix potential Spectre v1
    - nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
    - IB/ucm: Fix Spectre v1 vulnerability
    - RDMA/ucma: Fix Spectre v1 vulnerability
    - drm/bufs: Fix Spectre v1 vulnerability
    - usb: gadget: storage: Fix Spectre v1 vulnerability
    - ptp: fix Spectre v1 vulnerability
    - HID: hiddev: fix potential Spectre v1
    - vhost: Fix Spectre V1 vulnerability
    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
    - ipv4: Fix potential Spectre v1 vulnerability
    - aio: fix spectre gadget in lookup_ioctx
    - ALSA: emux: Fix potential Spectre v1 vulnerabilities
    - ALSA: pcm: Fix potential Spectre v1 vulnerability
    - ip6mr: Fix potential Spectre v1 vulnerability
    - ALSA: rme9652: Fix potential Spectre v1 vulnerability
    - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
    - KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
    - drm/ioctl: Fix Spectre v1 vulnerabilities
    - char/mwave: fix potential Spectre v1 vulnerability
    - applicom: Fix potential Spectre v1 vulnerabilities
    - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities
    - powerpc/ptrace: Mitigate potential Spectre v1
    - cfg80211: prevent speculation on cfg80211_classify8021d() return
    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
    - ALSA: seq: oss: Fix Spectre v1 vulnerability

  * Bionic: Sync to Xenial (Spectre) (LP: #1822760)
    - x86/speculation/l1tf: Suggest what to do on systems with too much RAM
    - KVM: SVM: Add MSR-based feature support for serializing LFENCE
    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
    - KVM: X86: Allow userspace to define the microcode version
    - SAUCE: [Fix] x86/KVM/VMX: Add L1D flush logic
    - SAUCE: [Fix] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on
      vmentry

  * [SRU] [B/OEM] Fix ACPI bug that causes boot failure (LP: #1819921)
    - SAUCE: ACPI / bus: Add some Lenovo laptops in list of acpi table term list

  * Bionic update: upstream stable patchset for fuse 2019-04-12 (LP: #1824553)
    - fuse: fix double request_end()
    - fuse: fix unlocked access to processing queue
    - fuse: umount should wait for all requests
    - fuse: Fix oops at process_init_reply()
    - fuse: Don't access pipe->buffers without pipe_lock()
    - fuse: Fix use-after-free in fuse_dev_do_read()
    - fuse: Fix use-after-free in fuse_dev_do_write()
    - fuse: set FR_SENT while locked
    - fuse: fix blocked_waitq wakeup
    - fuse: fix leaked notify reply
    - fuse: fix possibly missed wake-up after abort
    - fuse: fix use-after-free in fuse_direct_IO()
    - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS
    - fuse: handle zero sized retrieve correctly
    - fuse: call pipe_buf_release() under pipe lock
    - fuse: decrement NR_WRITEBACK_TEMP on the right page

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870) // Backport support for software
    count cache flush Spectre v2 mitigation. (CVE) (required for POWER9 DD2.3)
    (LP: #1822870)
    - powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
    - powerpc/fsl: Fix spectre_v2 mitigations reporting
    - powerpc: Avoid code patching freed init sections

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870) // Backport support for software
    count cache flush Spectre v2 mitigation. (CVE) (required for POWER9 DD2.3)
    (LP: #1822870) // Backport support for software count cache flush Spectre v2
    mitigation. (CVE) (required for POWER9 DD2.3) (LP: #1822870)
    - powerpc/security: Fix spectre_v2 reporting

  * CVE-2019-3874
    - sctp: use sk_wmem_queued to check for writable space
    - sctp: implement memory accounting on tx path
    - sctp: implement memory accounting on rx path

  * NULL pointer dereference when using z3fold and zswap (LP: #1814874)
    - z3fold: fix possible reclaim races

  * Kprobe event argument syntax in ftrace from ubuntu_kernel_selftests failed
    on B PowerPC (LP: #1812809)
    - selftests/ftrace: Add ppc support for kprobe args tests

  * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487)
    - misc: rtsx: make various functions static
    - misc: rtsx: Enable OCP for rts522a rts524a rts525a rts5260
    - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch

  * headset-mic doesn't work on two Dell laptops. (LP: #1825272)
    - ALSA: hda/realtek - add two more pin configuration sets to quirk table

  * CVE-2018-16884
    - sunrpc: use SVC_NET() in svcauth_gss_* functions
    - sunrpc: use-after-free in svc_process_common()

  * sky2 ethernet card don't work after returning from suspension (LP: #1798921)
    - sky2: Increase D3 delay again

  * CVE-2019-9500
    - brcmfmac: assure SSID length from firmware is limited

  * CVE-2019-9503
    - brcmfmac: add subtype check for event handling in data path

  * CVE-2019-3882
    - vfio/type1: Limit DMA mappings per container

  * Intel I210 Ethernet card not working after hotplug [8086:1533]
    (LP: #1818490)
    - igb: Fix WARN_ONCE on runtime suspend

  * bionic, xenial/hwe: misses "fuse: fix initial parallel dirops" patch
    (LP: #1823972)
    - fuse: fix initial parallel dirops

  * amdgpu resume failure: failed to allocate wb slot (LP: #1825074)
    - drm/amdgpu: fix&cleanups for wb_clear

  * Pop noise when headset is plugged in or removed from GHS/Line-out jack
    (LP: #1821290)
    - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode
      for ALC225
    - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
    - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
    - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB

  * mac80211_hwsim unable to handle kernel NULL pointer dereference
    at0000000000000000  (LP: #1825058)
    - mac80211_hwsim: Timer should be initialized before device registered

  * [regression][snd_hda_codec_realtek] repeating crackling noise after 19.04
    upgrade (LP: #1821663)
    - ALSA: hda: Add Intel NUC7i3BNB to the power_save blacklist
    - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist
    - ALSA: hda - Add two more machines to the power_save_blacklist

  * ubuntu_nbd_smoke_test failed on P9 with Bionic kernel (LP: #1822247)
    - nbd: fix how we set bd_invalidated

  * TSC clocksource not available in nested guests (LP: #1822821)
    - kvmclock: fix TSC calibration for nested guests

  * 4.15 kernel ip_vs --ops causes performance and hang problem (LP: #1819786)
    - ipvs: fix refcount usage for conns in ops mode

  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
    6db23a14" on Cosmic i386 (LP: #1813244) // systemd cause kernel trace "BUG:
    unable to handle kernel paging request at 6db23a14" on Cosmic i386
    (LP: #1813244)
    - openvswitch: fix flow actions reallocation

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 25 Apr 2019 10:40:22 +0200

linux (4.15.0-48.51) bionic; urgency=medium

  * linux: 4.15.0-48.51 -proposed tracker (LP: #1822820)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction

  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
    triggers system hang on i386 (LP: #1812845)
    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()

  * [P9][LTCTest][Opal][FW910] cpupower monitor shows multiple stop Idle_Stats
    (LP: #1719545)
    - cpupower : Fix header name to read idle state name

  * [amdgpu] screen corruption when using touchpad (LP: #1818617)
    - drm/amdgpu/gmc: steal the appropriate amount of vram for fw hand-over (v3)
    - drm/amdgpu: Free VGA stolen memory as soon as possible.

  * [SRU][B/C/OEM]IOMMU: add kernel dma protection (LP: #1820153)
    - ACPICA: AML parser: attempt to continue loading table after error
    - ACPI / property: Allow multiple property compatible _DSD entries
    - PCI / ACPI: Identify untrusted PCI devices
    - iommu/vt-d: Force IOMMU on for platform opt in hint
    - iommu/vt-d: Do not enable ATS for untrusted devices
    - thunderbolt: Export IOMMU based DMA protection support to userspace
    - iommu/vt-d: Disable ATS support on untrusted devices

  * Add basic support to NVLink2 passthrough (LP: #1819989)
    - powerpc/powernv/npu: Do not try invalidating 32bit table when 64bit table is
      enabled
    - powerpc/powernv: call OPAL_QUIESCE before OPAL_SIGNAL_SYSTEM_RESET
    - powerpc/powernv: Export opal_check_token symbol
    - powerpc/powernv: Make possible for user to force a full ipl cec reboot
    - powerpc/powernv/idoa: Remove unnecessary pcidev from pci_dn
    - powerpc/powernv: Move npu struct from pnv_phb to pci_controller
    - powerpc/powernv/npu: Move OPAL calls away from context manipulation
    - powerpc/pseries/iommu: Use memory@ nodes in max RAM address calculation
    - powerpc/pseries/npu: Enable platform support
    - powerpc/pseries: Remove IOMMU API support for non-LPAR systems
    - powerpc/powernv/npu: Check mmio_atsd array bounds when populating
    - powerpc/powernv/npu: Fault user page into the hypervisor's pagetable

  * Huawei Hi1822 NIC has poor performance (LP: #1820187)
    - net-next: hinic: fix a problem in free_tx_poll()
    - hinic: remove ndo_poll_controller
    - net-next/hinic: add checksum offload and TSO support
    - hinic: Fix l4_type parameter in hinic_task_set_tunnel_l4
    - net-next/hinic:replace multiply and division operators
    - net-next/hinic:add rx checksum offload for HiNIC
    - net-next/hinic:fix a bug in set mac address
    - net-next/hinic: fix a bug in rx data flow
    - net: hinic: fix null pointer dereference on pointer hwdev
    - hinic: optmize rx refill buffer mechanism
    - net-next/hinic:add shutdown callback
    - net-next/hinic: replace disable_irq_nosync/enable_irq

  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
    - Fonts: New Terminus large console font
    - [Config]: enable highdpi Terminus 16x32 font support

  * [19.04 FEAT] qeth: Enhanced link speed - kernel part (LP: #1814892)
    - s390/qeth: report 25Gbit link speed

  * CVE-2017-5754
    - x86/nmi: Fix NMI uaccess race against CR3 switching
    - x86/mm: Fix documentation of module mapping range with 4-level paging
    - x86/pti: Enable global pages for shared areas
    - x86/pti: Never implicitly clear _PAGE_GLOBAL for kernel image
    - x86/pti: Leave kernel text global for !PCID
    - x86/pti: Fix boot problems from Global-bit setting
    - x86/pti: Fix boot warning from Global-bit setting
    - x86/pti: Reduce amount of kernel text allowed to be Global
    - x86/pti: Disallow global kernel text with RANDSTRUCT
    - x86/entry/32: Add explicit 'l' instruction suffix
    - x86/asm-offsets: Move TSS_sp0 and TSS_sp1 to asm-offsets.c
    - x86/entry/32: Rename TSS_sysenter_sp0 to TSS_entry2task_stack
    - x86/entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler
    - x86/entry/32: Put ESPFIX code into a macro
    - x86/entry/32: Unshare NMI return path
    - x86/entry/32: Split off return-to-kernel path
    - x86/entry/32: Enter the kernel via trampoline stack
    - x86/entry/32: Leave the kernel via trampoline stack
    - x86/entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI
    - x86/entry/32: Handle Entry from Kernel-Mode on Entry-Stack
    - x86/entry/32: Simplify debug entry point
    - x86/entry/32: Add PTI cr3 switch to non-NMI entry/exit points
    - x86/entry/32: Add PTI CR3 switches to NMI handler code
    - x86/entry: Rename update_sp0 to update_task_stack
    - x86/pgtable: Rename pti_set_user_pgd() to pti_set_user_pgtbl()
    - x86/pgtable/pae: Unshare kernel PMDs when PTI is enabled
    - x86/pgtable/32: Allocate 8k page-tables when PTI is enabled
    - x86/pgtable: Move pgdp kernel/user conversion functions to pgtable.h
    - x86/pgtable: Move pti_set_user_pgtbl() to pgtable.h
    - x86/pgtable: Move two more functions from pgtable_64.h to pgtable.h
    - x86/mm/pae: Populate valid user PGD entries
    - x86/mm/pae: Populate the user page-table with user pgd's
    - x86/mm/pti: Add an overflow check to pti_clone_pmds()
    - x86/mm/pti: Define X86_CR3_PTI_PCID_USER_BIT on x86_32
    - x86/mm/pti: Clone CPU_ENTRY_AREA on PMD level on x86_32
    - x86/mm/pti: Make pti_clone_kernel_text() compile on 32 bit
    - x86/mm/pti: Keep permissions when cloning kernel text in
      pti_clone_kernel_text()
    - x86/mm/pti: Introduce pti_finalize()
    - x86/mm/pti: Clone entry-text again in pti_finalize()
    - x86/mm/dump_pagetables: Define INIT_PGD
    - x86/pgtable/pae: Use separate kernel PMDs for user page-table
    - x86/ldt: Reserve address-space range on 32 bit for the LDT
    - x86/ldt: Define LDT_END_ADDR
    - x86/ldt: Split out sanity check in map_ldt_struct()
    - x86/ldt: Enable LDT user-mapping for PAE
    - x86/pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32
    - [Config] Update PAGE_TABLE_ISOLATION annotations
    - x86/mm/pti: Add Warning when booting on a PCID capable CPU
    - x86/entry/32: Add debug code to check entry/exit CR3
    - x86/pti: Check the return value of pti_user_pagetable_walk_p4d()
    - x86/pti: Check the return value of pti_user_pagetable_walk_pmd()
    - perf/core: Make sure the ring-buffer is mapped in all page-tables
    - x86/entry/32: Check for VM86 mode in slow-path check
    - x86/mm: Remove in_nmi() warning from vmalloc_fault()
    - x86/kexec: Allocate 8k PGDs for PTI
    - x86/mm/pti: Clear Global bit more aggressively
    - mm: Allow non-direct-map arguments to free_reserved_area()
    - x86/mm/init: Pass unconverted symbol addresses to free_init_pages()
    - x86/mm/init: Add helper for freeing kernel image pages
    - x86/mm/init: Remove freed kernel image areas from alias mapping
    - x86/mm/pti: Fix 32 bit PCID check
    - x86/mm/pti: Don't clear permissions in pti_clone_pmd()
    - x86/mm/pti: Clone kernel-image on PTE level for 32 bit
    - x86/relocs: Add __end_rodata_aligned to S_REL
    - x86/mm/pti: Move user W+X check into pti_finalize()
    - x86/efi: Load fixmap GDT in efi_call_phys_epilog()
    - x86/efi: Load fixmap GDT in efi_call_phys_epilog() before setting %cr3
    - x86/mm/doc: Clean up the x86-64 virtual memory layout descriptions
    - x86/mm/doc: Enhance the x86-64 virtual memory layout descriptions
    - x86/entry/32: Clear the CS high bits
    - x86/mm: Move LDT remap out of KASLR region on 5-level paging
    - x86/ldt: Unmap PTEs for the slot before freeing LDT pages
    - x86/ldt: Remove unused variable in map_ldt_struct()
    - x86/mm: Fix guard hole handling
    - x86/dump_pagetables: Fix LDT remap address marker

  * Avoid potential memory corruption on HiSilicon SoCs (LP: #1819546)
    - iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads

  * Ubuntu18.04.01: [Power9] power8 Compat guest(RHEL7.6) crashes during guest
    boot with > 256G of memory (kernel/kvm) (LP: #1818645)
    - ]PATCH] KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function

  * Fix for dual Intel NVMes (LP: #1821961)
    - SAUCE: nvme: Merge two quirk entries into one for Intel 760p/Pro 7600p

  * CVE-2017-5715
    - tools headers: Synchronize prctl.h ABI header
    - x86/spectre: Add missing family 6 check to microcode check
    - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
    - x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
    - x86/speculation: Propagate information about RSB filling mitigation to sysfs
    - x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC
      variant
    - x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
    - x86/retpoline: Remove minimal retpoline support
    - x86/speculation: Update the TIF_SSBD comment
    - x86/speculation: Clean up spectre_v2_parse_cmdline()
    - x86/speculation: Remove unnecessary ret variable in cpu_show_common()
    - x86/speculation: Move STIPB/IBPB string conditionals out of
      cpu_show_common()
    - x86/speculation: Disable STIBP when enhanced IBRS is in use
    - x86/speculation: Rename SSBD update functions
    - x86/speculation: Reorganize speculation control MSRs update
    - sched/smt: Make sched_smt_present track topology
    - x86/Kconfig: Select SCHED_SMT if SMP enabled
    - sched/smt: Expose sched_smt_present static key
    - x86/speculation: Rework SMT state change
    - x86/l1tf: Show actual SMT state
    - x86/speculation: Reorder the spec_v2 code
    - x86/speculation: Mark string arrays const correctly
    - x86/speculataion: Mark command line parser data __initdata
    - x86/speculation: Unify conditional spectre v2 print functions
    - x86/speculation: Add command line control for indirect branch speculation
    - x86/speculation: Prepare for per task indirect branch speculation control
    - x86/process: Consolidate and simplify switch_to_xtra() code
    - x86/speculation: Avoid __switch_to_xtra() calls
    - x86/speculation: Prepare for conditional IBPB in switch_mm()
    - ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
    - x86/speculation: Split out TIF update
    - x86/speculation: Prevent stale SPEC_CTRL msr content
    - x86/speculation: Prepare arch_smt_update() for PRCTL mode
    - x86/speculation: Add prctl() control for indirect branch speculation
    - x86/speculation: Enable prctl mode for spectre_v2_user
    - x86/speculation: Add seccomp Spectre v2 user space protection mode
    - x86/speculation: Provide IBPB always command line options
    - kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
    - x86/speculation: Change misspelled STIPB to STIBP
    - x86/speculation: Add support for STIBP always-on preferred mode
    - x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
    - s390: remove closung punctuation from spectre messages
    - x86/speculation: Simplify the CPU bug detection logic

  * CVE-2018-3639
    - x86/bugs: Add AMD's variant of SSB_NO
    - x86/bugs: Add AMD's SPEC_CTRL MSR usage
    - x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
    - x86/bugs: Update when to check for the LS_CFG SSBD mitigation
    - x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled

  * [Ubuntu] vfio-ap: add subsystem to matrix device to avoid libudev failures
    (LP: #1818854)
    - s390: vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem

  * Kernel regularly logs: Bluetooth: hci0: last event is not cmd complete
    (0x0f) (LP: #1748565)
    - Bluetooth: Fix unnecessary error message for HCI request completion

  * HiSilicon HNS ethernet broken in 4.15.0-45 (LP: #1818294)
    - net: hns: Fix WARNING when hns modules installed

  * rtl8723be wifi does not work under linux-modules-extra-4.15.0-33-generic
    (LP: #1788997)
    - SAUCE: Revert "rtlwifi: cleanup 8723be ant_sel definition"

  * Crash from :i915 module with 4.15.0-46-generic using multi-display
    (LP: #1819486)
    - SAUCE: Revert "drm/i915: Fix hotplug irq ack on i965/g4x"

  * kernel linux-image-4.15.0-44 not booting on Hyperv Server 2008R2
    (LP: #1814069)
    - hv/netvsc: fix handling of fallback to single queue mode
    - hv/netvsc: Fix NULL dereference at single queue mode fallback

  * Lenovo ideapad 330-15ICH Wifi rfkill hard blocked (LP: #1811815)
    - platform/x86: ideapad: Add ideapad 330-15ICH to no_hw_rfkill

  * Qualcomm Atheros QCA9377 wireless does not work (LP: #1818204)
    - platform/x86: ideapad-laptop: Add Ideapad 530S-14ARR to no_hw_rfkill list

  * fscache: jobs might hang when fscache disk is full (LP: #1821395)
    - fscache: fix race between enablement and dropping of object

  * hns3: fix oops in hns3_clean_rx_ring() (LP: #1821064)
    - net: hns3: add dma_rmb() for rx description

  * Hard lockup in 2 CPUs due to deadlock in cpu_stoppers (LP: #1821259)
    - stop_machine: Disable preemption after queueing stopper threads
    - stop_machine: Atomically queue and wake stopper threads

  * tcm_loop.ko: move from modules-extra into main modules package
    (LP: #1817786)
    - [Packaging] move tcm_loop.lo to main linux-modules package

  * tcmu user space crash results in kernel module hang. (LP: #1819504)
    - scsi: tcmu: delete unused __wait
    - scsi: tcmu: track nl commands
    - scsi: tcmu: simplify nl interface
    - scsi: tcmu: add module wide block/reset_netlink support

  * Intel XL710 - i40e driver does not work with kernel 4.15 (Ubuntu 18.04)
    (LP: #1779756)
    - i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled
    - i40e: prevent overlapping tx_timeout recover

  * some codecs stop working after S3 (LP: #1820930)
    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec

  * i40e xps management broken when > 64 queues/cpus (LP: #1820948)
    - i40e: Do not allow use more TC queue pairs than MSI-X vectors exist
    - i40e: Fix the number of queues available to be mapped for use

  * 4.15 s390x kernel BUG at /build/linux-
    Gycr4Z/linux-4.15.0/drivers/block/virtio_blk.c:565! (LP: #1788432)
    - virtio/s390: avoid race on vcdev->config
    - virtio/s390: fix race in ccw_io_helper()

  * [SRU][B/B-OEM/C/D] Fix AMD IOMMU NULL dereference (LP: #1820990)
    - iommu/amd: Fix NULL dereference bug in match_hid_uid

  * New Intel Wireless-AC 9260 [8086:2526] card not correctly probed in Ubuntu
    system (LP: #1821271)
    - iwlwifi: add new card for 9260 series

  * Add support for MAC address pass through on RTL8153-BD (LP: #1821276)
    - r8152: Add support for MAC address pass through on RTL8153-BD
    - r8152: Fix an error on RTL8153-BD MAC Address Passthrough support

 -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Apr 2019 18:31:55 +0200

linux (4.15.0-47.50) bionic; urgency=medium

  * linux: 4.15.0-47.50 -proposed tracker (LP: #1819716)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction

  * C++ demangling support missing from perf (LP: #1396654)
    - [Packaging] fix a mistype

  * arm-smmu-v3 arm-smmu-v3.3.auto: CMD_SYNC timeout (LP: #1818162)
    - iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout

  * Crash in nvme_irq_check() when using threaded interrupts (LP: #1818747)
    - nvme-pci: fix out of bounds access in nvme_cqe_pending

  * CVE-2019-9213
    - mm: enforce min addr even if capable() in expand_downwards()

  * CVE-2019-3460
    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt

  * amdgpu with mst WARNING on blanking (LP: #1814308)
    - drm/amd/display: Don't use dc_link in link_encoder
    - drm/amd/display: Move wait for hpd ready out from edp power control.
    - drm/amd/display: eDP sequence BL off first then DP blank.
    - drm/amd/display: Fix unused variable compilation error
    - drm/amd/display: Fix warning about misaligned code
    - drm/amd/display: Fix MST dp_blank REG_WAIT timeout

  * tun/tap: unable to manage carrier state from userland (LP: #1806392)
    - tun: implement carrier change

  * CVE-2019-8980
    - exec: Fix mem leak in kernel_read_file

  * raw_skew in timer from the ubuntu_kernel_selftests failed on Bionic
    (LP: #1811194)
    - selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock
      adjustments are in progress

  * [Packaging] Allow overlay of config annotations (LP: #1752072)
    - [Packaging] config-check: Add an include directive

  * CVE-2019-7308
    - bpf: move {prev_,}insn_idx into verifier env
    - bpf: move tmp variable into ax register in interpreter
    - bpf: enable access to ax register also from verifier rewrite
    - bpf: restrict map value pointer arithmetic for unprivileged
    - bpf: restrict stack pointer arithmetic for unprivileged
    - bpf: restrict unknown scalars of mixed signed bounds for unprivileged
    - bpf: fix check_map_access smin_value test when pointer contains offset
    - bpf: prevent out of bounds speculation on pointer arithmetic
    - bpf: fix sanitation of alu op with pointer / scalar type from different
      paths
    - bpf: add various test cases to selftests

  * CVE-2017-5753
    - bpf: properly enforce index mask to prevent out-of-bounds speculation
    - bpf: fix inner map masking to prevent oob under speculation

  * BPF: kernel pointer leak to unprivileged userspace (LP: #1815259)
    - bpf/verifier: disallow pointer subtraction

  * squashfs hardening (LP: #1816756)
    - squashfs: more metadata hardening
    - squashfs metadata 2: electric boogaloo
    - squashfs: more metadata hardening
    - Squashfs: Compute expected length from inode size rather than block length

  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted

  * Update ENA driver to version 2.0.3K (LP: #1816806)
    - net: ena: update driver version from 2.0.2 to 2.0.3
    - net: ena: fix race between link up and device initalization
    - net: ena: fix crash during failed resume from hibernation

  * ipset kernel error: 4.15.0-43-generic (LP: #1811394)
    - netfilter: ipset: Fix wraparound in hash:*net* types

  * Silent "Unknown key" message when pressing keyboard backlight hotkey
    (LP: #1817063)
    - platform/x86: dell-wmi: Ignore new keyboard backlight change event

  * CVE-2018-18021
    - arm64: KVM: Tighten guest core register access from userspace
    - KVM: arm/arm64: Introduce vcpu_el1_is_32bit
    - arm64: KVM: Sanitize PSTATE.M when being set from userspace

  * CVE-2018-14678
    - x86/entry/64: Remove %ebx handling from error_entry/exit

  * CVE-2018-19824
    - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

  * CVE-2019-3459
    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer

  * Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234)
    - fork: unconditionally clear stack on fork
    - spi: spi-s3c64xx: Fix system resume support
    - Input: elan_i2c - add ACPI ID for lenovo ideapad 330
    - Input: i8042 - add Lenovo LaVie Z to the i8042 reset list
    - Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST
    - kvm, mm: account shadow page tables to kmemcg
    - delayacct: fix crash in delayacct_blkio_end() after delayacct init failure
    - tracing: Fix double free of event_trigger_data
    - tracing: Fix possible double free in event_enable_trigger_func()
    - kthread, tracing: Don't expose half-written comm when creating kthreads
    - tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure
    - tracing: Quiet gcc warning about maybe unused link variable
    - arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups
    - mlxsw: spectrum_switchdev: Fix port_vlan refcounting
    - kcov: ensure irq code sees a valid area
    - xen/netfront: raise max number of slots in xennet_get_responses()
    - skip LAYOUTRETURN if layout is invalid
    - ALSA: emu10k1: add error handling for snd_ctl_add
    - ALSA: fm801: add error handling for snd_ctl_add
    - NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY
    - nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo
    - vfio: platform: Fix reset module leak in error path
    - vfio/mdev: Check globally for duplicate devices
    - vfio/type1: Fix task tracking for QEMU vCPU hotplug
    - kernel/hung_task.c: show all hung tasks before panic
    - mm: /proc/pid/pagemap: hide swap entries from unprivileged users
    - mm: vmalloc: avoid racy handling of debugobjects in vunmap
    - mm/slub.c: add __printf verification to slab_err()
    - rtc: ensure rtc_set_alarm fails when alarms are not supported
    - perf tools: Fix pmu events parsing rule
    - netfilter: ipset: forbid family for hash:mac sets
    - netfilter: ipset: List timing out entries with "timeout 1" instead of zero
    - irqchip/ls-scfg-msi: Map MSIs in the iommu
    - watchdog: da9063: Fix updating timeout value
    - printk: drop in_nmi check from printk_safe_flush_on_panic()
    - bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}
    - ceph: fix alignment of rasize
    - e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes
    - powerpc/lib: Adjust .balign inside string functions for PPC32
    - powerpc/64s: Add barrier_nospec
    - powerpc/eeh: Fix use-after-release of EEH driver
    - hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()
    - powerpc/64s: Fix compiler store ordering to SLB shadow area
    - RDMA/mad: Convert BUG_ONs to error flows
    - lightnvm: pblk: warn in case of corrupted write buffer
    - netfilter: nf_tables: check msg_type before nft_trans_set(trans)
    - pnfs: Don't release the sequence slot until we've processed layoutget on
      open
    - disable loading f2fs module on PAGE_SIZE > 4KB
    - f2fs: fix error path of move_data_page
    - f2fs: fix to don't trigger writeback during recovery
    - f2fs: fix to wait page writeback during revoking atomic write
    - f2fs: Fix deadlock in shutdown ioctl
    - f2fs: fix to detect failure of dquot_initialize
    - f2fs: fix race in between GC and atomic open
    - block, bfq: remove wrong lock in bfq_requests_merged
    - usbip: usbip_detach: Fix memory, udev context and udev leak
    - usbip: dynamically allocate idev by nports found in sysfs
    - perf/x86/intel/uncore: Correct fixed counter index check in generic code
    - perf/x86/intel/uncore: Correct fixed counter index check for NHM
    - selftests/intel_pstate: Improve test, minor fixes
    - selftests: memfd: return Kselftest Skip code for skipped tests
    - selftests: intel_pstate: return Kselftest Skip code for skipped tests
    - PCI: Fix devm_pci_alloc_host_bridge() memory leak
    - iwlwifi: pcie: fix race in Rx buffer allocator
    - Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
    - Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011
    - ASoC: dpcm: fix BE dai not hw_free and shutdown
    - mfd: cros_ec: Fail early if we cannot identify the EC
    - mwifiex: handle race during mwifiex_usb_disconnect
    - wlcore: sdio: check for valid platform device data before suspend
    - media: tw686x: Fix incorrect vb2_mem_ops GFP flags
    - media: videobuf2-core: don't call memop 'finish' when queueing
    - Btrfs: don't return ino to ino cache if inode item removal fails
    - Btrfs: don't BUG_ON() in btrfs_truncate_inode_items()
    - btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups
    - btrfs: qgroup: Finish rescan when hit the last leaf of extent tree
    - x86/microcode: Make the late update update_lock a raw lock for RT
    - PM / wakeup: Make s2idle_lock a RAW_SPINLOCK
    - PCI: Prevent sysfs disable of device while driver is attached
    - nvme-rdma: stop admin queue before freeing it
    - nvme-pci: Fix AER reset handling
    - ath: Add regulatory mapping for FCC3_ETSIC
    - ath: Add regulatory mapping for ETSI8_WORLD
    - ath: Add regulatory mapping for APL13_WORLD
    - ath: Add regulatory mapping for APL2_FCCA
    - ath: Add regulatory mapping for Uganda
    - ath: Add regulatory mapping for Tanzania
    - ath: Add regulatory mapping for Serbia
    - ath: Add regulatory mapping for Bermuda
    - ath: Add regulatory mapping for Bahamas
    - powerpc/32: Add a missing include header
    - powerpc/chrp/time: Make some functions static, add missing header include
    - powerpc/powermac: Add missing prototype for note_bootable_part()
    - powerpc/powermac: Mark variable x as unused
    - powerpc: Add __printf verification to prom_printf
    - spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC
    - powerpc/8xx: fix invalid register expression in head_8xx.S
    - pinctrl: at91-pio4: add missing of_node_put
    - bpf: powerpc64: pad function address loads with NOPs
    - PCI: pciehp: Request control of native hotplug only if supported
    - net: dsa: qca8k: Add support for QCA8334 switch
    - mwifiex: correct histogram data with appropriate index
    - ima: based on policy verify firmware signatures (pre-allocated buffer)
    - drivers/perf: arm-ccn: don't log to dmesg in event_init
    - spi: Add missing pm_runtime_put_noidle() after failed get
    - fscrypt: use unbound workqueue for decryption
    - scsi: ufs: ufshcd: fix possible unclocked register access
    - scsi: ufs: fix exception event handling
    - scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger
    - drm/nouveau/fifo/gk104-: poll for runlist update completion
    - Bluetooth: btusb: add ID for LiteOn 04ca:301a
    - rtc: tps6586x: fix possible race condition
    - rtc: vr41xx: fix possible race condition
    - rtc: tps65910: fix possible race condition
    - ALSA: emu10k1: Rate-limit error messages about page errors
    - regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
    - md/raid1: add error handling of read error from FailFast device
    - md: fix NULL dereference of mddev->pers in remove_and_add_spares()
    - ixgbevf: fix MAC address changes through ixgbevf_set_mac()
    - media: smiapp: fix timeout checking in smiapp_read_nvm
    - net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value
    - ALSA: usb-audio: Apply rate limit to warning messages in URB complete
      callback
    - media: atomisp: ov2680: don't declare unused vars
    - arm64: cmpwait: Clear event register before arming exclusive monitor
    - HID: hid-plantronics: Re-resend Update to map button for PTT products
    - arm64: dts: renesas: salvator-common: use audio-graph-card for Sound
    - drm/radeon: fix mode_valid's return type
    - drm/amdgpu: Remove VRAM from shared bo domains.
    - powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by
      Starlet
    - HID: i2c-hid: check if device is there before really probing
    - EDAC, altera: Fix ARM64 build warning
    - ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage
    - ARM: dts: emev2: Add missing interrupt-affinity to PMU node
    - ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node
    - nvmem: properly handle returned value nvmem_reg_read
    - i40e: free the skb after clearing the bitlock
    - tty: Fix data race in tty_insert_flip_string_fixed_flag
    - dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
    - net: phy: phylink: Release link GPIO
    - media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()
    - libata: Fix command retry decision
    - ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2
    - media: media-device: fix ioctl function types
    - media: saa7164: Fix driver name in debug output
    - mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages
    - brcmfmac: Add support for bcm43364 wireless chipset
    - s390/cpum_sf: Add data entry sizes to sampling trailer entry
    - perf: fix invalid bit in diagnostic entry
    - bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only.
    - scsi: 3w-9xxx: fix a missing-check bug
    - scsi: 3w-xxxx: fix a missing-check bug
    - scsi: megaraid: silence a static checker bug
    - scsi: qedf: Set the UNLOADING flag when removing a vport
    - staging: lustre: o2iblnd: fix race at kiblnd_connect_peer
    - staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5
    - thermal: exynos: fix setting rising_threshold for Exynos5433
    - bpf: fix references to free_bpf_prog_info() in comments
    - f2fs: avoid fsync() failure caused by EAGAIN in writepage()
    - media: siano: get rid of __le32/__le16 cast warnings
    - drm/atomic: Handling the case when setting old crtc for plane
    - ALSA: hda/ca0132: fix build failure when a local macro is defined
    - mmc: dw_mmc: update actual clock for mmc debugfs
    - mmc: pwrseq: Use kmalloc_array instead of stack VLA
    - dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC
    - spi: meson-spicc: Fix error handling in meson_spicc_probe()
    - dt-bindings: net: meson-dwmac: new compatible name for AXG SoC
    - backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction
    - stop_machine: Use raw spinlocks
    - delayacct: Use raw_spinlocks
    - memory: tegra: Do not handle spurious interrupts
    - memory: tegra: Apply interrupts mask per SoC
    - nvme: lightnvm: add granby support
    - arm64: defconfig: Enable Rockchip io-domain driver
    - igb: Fix queue selection on MAC filters on i210
    - drm/gma500: fix psb_intel_lvds_mode_valid()'s return type
    - ipconfig: Correctly initialise ic_nameservers
    - rsi: Fix 'invalid vdd' warning in mmc
    - rsi: fix nommu_map_sg overflow kernel panic
    - audit: allow not equal op for audit by executable
    - staging: vchiq_core: Fix missing semaphore release in error case
    - staging: lustre: llite: correct removexattr detection
    - staging: lustre: ldlm: free resource when ldlm_lock_create() fails.
    - serial: core: Make sure compiler barfs for 16-byte earlycon names
    - soc: imx: gpcv2: Do not pass static memory as platform data
    - microblaze: Fix simpleImage format generation
    - usb: hub: Don't wait for connect state at resume for powered-off ports
    - crypto: authencesn - don't leak pointers to authenc keys
    - crypto: authenc - don't leak pointers to authenc keys
    - media: omap3isp: fix unbalanced dma_iommu_mapping
    - regulator: Don't return or expect -errno from of_map_mode()
    - scsi: scsi_dh: replace too broad "TP9" string with the exact models
    - scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs
    - media: atomisp: compat32: fix __user annotations
    - media: si470x: fix __be16 annotations
    - ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format()
    - ASoC: topology: Add missing clock gating parameter when parsing hw_configs
    - drm: Add DP PSR2 sink enable bit
    - drm/atomic-helper: Drop plane->fb references only for
      drm_atomic_helper_shutdown()
    - drm/dp/mst: Fix off-by-one typo when dump payload table
    - block: reset bi_iter.bi_done after splitting bio
    - random: mix rdrand with entropy sent in from userspace
    - squashfs: be more careful about metadata corruption
    - ext4: fix inline data updates with checksums enabled
    - ext4: fix check to prevent initializing reserved inodes
    - PCI: xgene: Remove leftover pci_scan_child_bus() call
    - RDMA/uverbs: Protect from attempts to create flows on unsupported QP
    - net: dsa: qca8k: Force CPU port to its highest bandwidth
    - net: dsa: qca8k: Enable RXMAC when bringing up a port
    - net: dsa: qca8k: Add QCA8334 binding documentation
    - net: dsa: qca8k: Allow overwriting CPU port setting
    - ipv4: remove BUG_ON() from fib_compute_spec_dst
    - net: fix amd-xgbe flow-control issue
    - net: lan78xx: fix rx handling before first packet is send
    - net: mdio-mux: bcm-iproc: fix wrong getter and setter pair
    - NET: stmmac: align DMA stuff to largest cache line length
    - tcp_bbr: fix bw probing to raise in-flight data for very small BDPs
    - xen-netfront: wait xenbus state change when load module manually
    - netlink: Do not subscribe to non-existent groups
    - netlink: Don't shift with UB on nlk->ngroups
    - tcp: do not force quickack when receiving out-of-order packets
    - tcp: add max_quickacks param to tcp_incr_quickack and
      tcp_enter_quickack_mode
    - tcp: do not aggressively quick ack after ECN events
    - tcp: refactor tcp_ecn_check_ce to remove sk type cast
    - tcp: add one more quick ack after after ECN events
    - mm: disallow mappings that conflict for devm_memremap_pages()
    - drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.
    - mm: check for SIGKILL inside dup_mmap() loop
    - rxrpc: Fix terminal retransmission connection ID to include the channel
    - ceph: fix use-after-free in ceph_statfs()
    - lightnvm: proper error handling for pblk_bio_add_pages
    - f2fs: don't drop dentry pages after fs shutdown
    - selftests: filesystems: return Kselftest Skip code for skipped tests
    - selftests/filesystems: devpts_pts included wrong header
    - iwlwifi: mvm: open BA session only when sta is authorized
    - drm/amd/display: Do not program interrupt status on disabled crtc
    - soc: qcom: smem: fix qcom_smem_set_global_partition()
    - soc: qcom: smem: byte swap values properly
    - pinctrl: msm: fix gpio-hog related boot issues
    - net: mvpp2: Add missing VLAN tag detection
    - drm/nouveau: remove fence wait code from deferred client work handler
    - drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl
    - clocksource: Move inline keyword to the beginning of function declarations
    - media: staging: atomisp: Comment out several unused sensor resolutions
    - IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS
    - rsi: Add null check for virtual interfaces in wowlan config
    - ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage
    - ARM: dts: imx53: Fix LDB OF graph warning
    - soc/tegra: pmc: Don't allocate struct tegra_powergate on stack
    - mlxsw: spectrum_router: Return an error for non-default FIB rules
    - i40e: Add advertising 10G LR mode
    - i40e: avoid overflow in i40e_ptp_adjfreq()
    - ath10k: fix kernel panic while reading tpc_stats
    - ASoC: fsl_ssi: Use u32 variable type when using regmap_read()
    - platform/x86: dell-smbios: Match on www.dell.com in OEM strings too
    - staging: ks7010: fix error handling in ks7010_upload_firmware
    - media: rc: mce_kbd decoder: low timeout values cause double keydowns
    - ath10k: search all IEs for variant before falling back
    - PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR
    - ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl
    - drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier
    - nvmet-fc: fix target sgl list on large transfers
    - i2c: rcar: handle RXDMA HW behaviour on Gen3
    - gpio: uniphier: set legitimate irq trigger type in .to_irq hook
    - tcp: ack immediately when a cwr packet arrives
    - ACPICA: AML Parser: ignore control method status in module-level code

  * Bionic update: upstream stable patchset 2019-02-05 (LP: #1814813)
    - MIPS: ath79: fix register address in ath79_ddr_wb_flush()
    - MIPS: Fix off-by-one in pci_resource_to_user()
    - xen/PVH: Set up GS segment for stack canary
    - drm/nouveau/drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit()
    - drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs
    - bonding: set default miimon value for non-arp modes if not set
    - ip: hash fragments consistently
    - ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull
    - net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper
    - net: skb_segment() should not return NULL
    - net/mlx5: Adjust clock overflow work period
    - net/mlx5e: Don't allow aRFS for encapsulated packets
    - net/mlx5e: Fix quota counting in aRFS expire flow
    - net/ipv6: Fix linklocal to global address with VRF
    - multicast: do not restore deleted record source filter mode to new one
    - net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv
    - sock: fix sg page frag coalescing in sk_alloc_sg
    - rtnetlink: add rtnl_link_state check in rtnl_configure_link
    - vxlan: add new fdb alloc and create helpers
    - vxlan: make netlink notify in vxlan_fdb_destroy optional
    - vxlan: fix default fdb entry netlink notify ordering during netdev create
    - tcp: fix dctcp delayed ACK schedule
    - tcp: helpers to send special DCTCP ack
    - tcp: do not cancel delay-AcK on DCTCP special ACK
    - tcp: do not delay ACK in DCTCP upon CE status change
    - staging: speakup: fix wraparound in uaccess length check
    - usb: cdc_acm: Add quirk for Castles VEGA3000
    - usb: core: handle hub C_PORT_OVER_CURRENT condition
    - usb: dwc2: Fix DMA alignment to start at allocated boundary
    - usb: gadget: f_fs: Only return delayed status when len is 0
    - driver core: Partially revert "driver core: correct device's shutdown order"
    - can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK
    - can: xilinx_can: fix power management handling
    - can: xilinx_can: fix recovery from error states not being propagated
    - can: xilinx_can: fix device dropping off bus on RX overrun
    - can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting
    - can: xilinx_can: fix incorrect clear of non-processed interrupts
    - can: xilinx_can: fix RX overflow interrupt not being enabled
    - can: peak_canfd: fix firmware < v3.3.0: limit allocation to 32-bit DMA addr
      only
    - can: m_can.c: fix setup of CCCR register: clear CCCR NISO bit before
      checking can.ctrlmode
    - turn off -Wattribute-alias
    - net-next/hinic: fix a problem in hinic_xmit_frame()
    - net/mlx5e: Refine ets validation function
    - nfp: flower: ensure dead neighbour entries are not offloaded
    - usb: gadget: Fix OS descriptors support
    - ACPICA: AML Parser: ignore dispatcher error status during table load

  * installer does not support iSCSI iBFT (LP: #1817321)
    - d-i: add iscsi_ibft to scsi-modules

  * CVE-2019-7222
    - KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)

  * CVE-2019-7221
    - KVM: nVMX: unconditionally cancel preemption timer in free_nested
      (CVE-2019-7221)

  * CVE-2019-6974
    - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

  * Regular D-state processes impacting LXD containers (LP: #1817628)
    - mm: do not stall register_shrinker()

  * hns3 nic speed may not match optical port speed (LP: #1817969)
    - net: hns3: Config NIC port speed same as that of optical module

  * [Hyper-V] srcu: Lock srcu_data structure in srcu_gp_start() (LP: #1802021)
    - srcu: Prohibit call_srcu() use under raw spinlocks
    - srcu: Lock srcu_data structure in srcu_gp_start()

  * libsas disks can have non-unique by-path names (LP: #1817784)
    - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached

  * Bluetooth not working (Intel CyclonePeak) (LP: #1817518)
    - Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029

  * CVE-2019-8912
    - net: crypto set sk to NULL when af_alg_release.
    - net: socket: set sock->sk to NULL after calling proto_ops::release()

  * Trackpad is not recognized. (LP: #1817200)
    - pinctrl: cannonlake: Fix gpio base for GPP-E

  * [ALSA] [PATCH] System76 darp5 and oryp5 fixups (LP: #1815831)
    - ALSA: hda/realtek - Headset microphone support for System76 darp5
    - ALSA: hda/realtek - Headset microphone and internal speaker support for
      System76 oryp5

  * Constant noise in the headphone on Lenovo X1 machines (LP: #1817263)
    - ALSA: hda/realtek: Disable PC beep in passthrough on alc285

  * AC adapter status not detected on Asus ZenBook UX410UAK (LP: #1745032)
    - Revert "ACPI / battery: Add quirk for Asus GL502VSK and UX305LA"
    - ACPI / AC: Remove initializer for unused ident dmi_system_id
    - ACPI / battery: Remove initializer for unused ident dmi_system_id
    - ACPI / battery: Add handling for devices which wrongly report discharging
      state
    - ACPI / battery: Ignore AC state in handle_discharging on systems where it is
      broken

  * TPM intermittently fails after cold-boot (LP: #1762672)
    - tpm: fix intermittent failure with self tests

  * qlcnic: Firmware aborts/hangs in QLogic NIC (LP: #1815033)
    - qlcnic: fix Tx descriptor corruption on 82xx devices

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 13 Mar 2019 04:37:49 +0000

linux (4.15.0-46.49) bionic; urgency=medium

  * linux: 4.15.0-46.49 -proposed tracker (LP: #1814726)

  * mprotect fails on ext4 with dax (LP: #1799237)
    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion

  * kernel BUG at /build/linux-vxxS7y/linux-4.15.0/mm/slub.c:296! (LP: #1812086)
    - iscsi target: fix session creation failure handling
    - scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values
      fails
    - scsi: iscsi: target: Fix conn_ops double free

  * user_copy in user from ubuntu_kernel_selftests failed on KVM kernel
    (LP: #1812198)
    - selftests: user: return Kselftest Skip code for skipped tests
    - selftests: kselftest: change KSFT_SKIP=4 instead of KSFT_PASS
    - selftests: kselftest: Remove outdated comment

  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
    - SAUCE: staging: rtlwifi: allow RTLWIFI_DEBUG_ST to be disabled
    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
    - SAUCE: Add r8822be to signature inclusion list

  * kernel oops in bcache module (LP: #1793901)
    - SAUCE: bcache: never writeback a discard operation

  * CVE-2018-18397
    - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
    - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    - userfaultfd: shmem: add i_size checks
    - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set

  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

  * Vsock connect fails with ENODEV for large CID (LP: #1813934)
    - vhost/vsock: fix vhost vsock cid hashing inconsistent

  * SRU: Fix thinkpad 11e 3rd boot hang (LP: #1804604)
    - ACPI / LPSS: Force LPSS quirks on boot

  * Bionic update: upstream stable patchset 2019-01-17 (LP: #1812229)
    - scsi: sd_zbc: Fix variable type and bogus comment
    - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in
      parallel.
    - x86/apm: Don't access __preempt_count with zeroed fs
    - x86/events/intel/ds: Fix bts_interrupt_threshold alignment
    - x86/MCE: Remove min interval polling limitation
    - fat: fix memory allocation failure handling of match_strdup()
    - ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk
    - ARCv2: [plat-hsdk]: Save accl reg pair by default
    - ARC: Fix CONFIG_SWAP
    - ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    - ARC: mm: allow mprotect to make stack mappings executable
    - mm: memcg: fix use after free in mem_cgroup_iter()
    - mm/huge_memory.c: fix data loss when splitting a file pmd
    - cpufreq: intel_pstate: Register when ACPI PCCH is present
    - vfio/pci: Fix potential Spectre v1
    - stop_machine: Disable preemption when waking two stopper threads
    - drm/i915: Fix hotplug irq ack on i965/g4x
    - drm/nouveau: Use drm_connector_list_iter_* for iterating connectors
    - drm/nouveau: Avoid looping through fake MST connectors
    - gen_stats: Fix netlink stats dumping in the presence of padding
    - ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
    - ipv6: fix useless rol32 call on hash
    - ipv6: ila: select CONFIG_DST_CACHE
    - lib/rhashtable: consider param->min_size when setting initial table size
    - net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort
    - net: Don't copy pfmemalloc flag in __copy_skb_header()
    - skbuff: Unconditionally copy pfmemalloc in __skb_clone()
    - net/ipv4: Set oif in fib_compute_spec_dst
    - net: phy: fix flag masking in __set_phy_supported
    - ptp: fix missing break in switch
    - qmi_wwan: add support for Quectel EG91
    - tg3: Add higher cpu clock for 5762.
    - hv_netvsc: Fix napi reschedule while receive completion is busy
    - net/mlx4_en: Don't reuse RX page when XDP is set
    - net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite
    - ipv6: make DAD fail with enhanced DAD when nonce length differs
    - net: usb: asix: replace mii_nway_restart in resume path
    - alpha: fix osf_wait4() breakage
    - cxl_getfile(): fix double-iput() on alloc_file() failures
    - powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from stop (idle)
    - xhci: Fix perceived dead host due to runtime suspend race with event handler
    - KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
    - x86/kvmclock: set pvti_cpu0_va after enabling kvmclock
    - ALSA: hda/realtek - Yet another Clevo P950 quirk entry
    - drm/amdgpu: Reserve VM root shared fence slot for command submission (v3)
    - rhashtable: add restart routine in rhashtable_free_and_destroy()
    - sch_fq_codel: zero q->flows_cnt when fq_codel_init fails
    - sctp: introduce sctp_dst_mtu
    - sctp: fix the issue that pathmtu may be set lower than MINSEGMENT
    - net: aquantia: vlan unicast address list correct handling
    - drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open()

  * Bionic update: upstream stable patchset 2019-01-15 (LP: #1811877)
    - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations
    - x86/asm: Add _ASM_ARG* constants for argument registers to <asm/asm.h>
    - x86/paravirt: Make native_save_fl() extern inline
    - Btrfs: fix duplicate extents after fsync of file with prealloc extents
    - cpufreq / CPPC: Set platform specific transition_delay_us
    - PCI: exynos: Fix a potential init_clk_resources NULL pointer dereference
    - alx: take rtnl before calling __alx_open from resume
    - atm: Preserve value of skb->truesize when accounting to vcc
    - atm: zatm: Fix potential Spectre v1
    - ipv6: sr: fix passing wrong flags to crypto_alloc_shash()
    - ipvlan: fix IFLA_MTU ignored on NEWLINK
    - ixgbe: split XDP_TX tail and XDP_REDIRECT map flushing
    - net: dccp: avoid crash in ccid3_hc_rx_send_feedback()
    - net: dccp: switch rx_tstamp_last_feedback to monotonic clock
    - net: fix use-after-free in GRO with ESP
    - net: macb: Fix ptp time adjustment for large negative delta
    - net/mlx5e: Avoid dealing with vport representors if not being e-switch
      manager
    - net/mlx5: E-Switch, Avoid setup attempt if not being e-switch manager
    - net/mlx5: Fix command interface race in polling mode
    - net/mlx5: Fix incorrect raw command length parsing
    - net/mlx5: Fix required capability for manipulating MPFS
    - net/mlx5: Fix wrong size allocation for QoS ETC TC regitster
    - net: mvneta: fix the Rx desc DMA address in the Rx path
    - net/packet: fix use-after-free
    - net_sched: blackhole: tell upper qdisc about dropped packets
    - net: sungem: fix rx checksum support
    - net/tcp: Fix socket lookups with SO_BINDTODEVICE
    - qede: Adverstise software timestamp caps when PHC is not available.
    - qed: Fix setting of incorrect eswitch mode.
    - qed: Fix use of incorrect size in memcpy call.
    - qed: Limit msix vectors in kdump kernel to the minimum required count.
    - r8152: napi hangup fix after disconnect
    - stmmac: fix DMA channel hang in half-duplex mode
    - strparser: Remove early eaten to fix full tcp receive buffer stall
    - tcp: fix Fast Open key endianness
    - tcp: prevent bogus FRTO undos with non-SACK flows
    - vhost_net: validate sock before trying to put its fd
    - VSOCK: fix loopback on big-endian systems
    - net: cxgb3_main: fix potential Spectre v1
    - rtlwifi: Fix kernel Oops "Fw download fail!!"
    - rtlwifi: rtl8821ae: fix firmware is not ready to run
    - net: lan78xx: Fix race in tx pending skb size calculation
    - crypto: af_alg - Initialize sg_num_bytes in error code path
    - mtd: rawnand: denali_dt: set clk_x_rate to 200 MHz unconditionally
    - PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg()
    - netfilter: ebtables: reject non-bridge targets
    - reiserfs: fix buffer overflow with long warning messages
    - KEYS: DNS: fix parsing multiple options
    - tls: Stricter error checking in zerocopy sendmsg path
    - autofs: fix slab out of bounds read in getname_kernel()
    - nsh: set mac len based on inner packet
    - bdi: Fix another oops in wb_workfn()
    - rds: avoid unenecessary cong_update in loop transport
    - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.
    - string: drop __must_check from strscpy() and restore strscpy() usages in
      cgroup
    - nfsd: COPY and CLONE operations require the saved filehandle to be set
    - net/sched: act_ife: fix recursive lock and idr leak
    - net/sched: act_ife: preserve the action control in case of error
    - hinic: reset irq affinity before freeing irq
    - nfp: flower: fix mpls ether type detection
    - net: macb: initialize bp->queues[0].bp for at91rm9200
    - enic: do not overwrite error code
    - virtio_net: fix memory leak in XDP_REDIRECT
    - netfilter: ipv6: nf_defrag: drop skb dst before queueing
    - ipvs: initialize tbl->entries after allocation
    - ipvs: initialize tbl->entries in ip_vs_lblc_init_svc()
    - bpf: enforce correct alignment for instructions
    - bpf, arm32: fix to use bpf_jit_binary_lock_ro api

  * Fix non-working pinctrl-intel (LP: #1811777)
    - pinctrl: intel: Implement intel_gpio_get_direction callback
    - pinctrl: intel: Do pin translation in other GPIO operations as well

  * ip6_gre: fix tunnel list corruption for x-netns (LP: #1812875)
    - ip6_gre: fix tunnel list corruption for x-netns

  * Userspace break as a result of missing patch backport (LP: #1813873)
    - tty: Don't hold ldisc lock in tty_reopen() if ldisc present

  * kvm_stat : missing python dependency (LP: #1798776)
    - tools/kvm_stat: fix python3 issues
    - tools/kvm_stat: switch to python3

  * [SRU] Fix Xorg crash with nomodeset when BIOS enable 64-bit fb addr
    (LP: #1812797)
    - vgaarb: Add support for 64-bit frame buffer address
    - vgaarb: Keep adding VGA device in queue

  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
    - USB: Add new USB LPM helpers
    - USB: Consolidate LPM checks to avoid enabling LPM twice

  * ptrace-tm-spd-gpr in powerpc/ptrace from ubuntu_kerenl_selftests failed on
    Bionic P8 (LP: #1813127)
    - selftests/powerpc: Fix ptrace tm failure

  * [SRU] IO's are issued with incorrect Scatter Gather Buffer (LP: #1795453)
    - scsi: megaraid_sas: Use 63-bit DMA addressing

  * Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
    - [Config] Enable timestamping in network PHY devices

  * CVE-2018-19854
    - crypto: user - fix leaking uninitialized memory to userspace

  * x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000
    (LP: #1813532)
    - x86/mm: Do not warn about PCI BIOS W+X mappings

  * CVE-2019-6133
    - fork: record start_time late

  * Fix not working Goodix touchpad (LP: #1811929)
    - HID: i2c-hid: Disable runtime PM on Goodix touchpad

  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y

  * X1 Extreme: only one of the two SSDs is loaded (LP: #1811755)
    - nvme-core: rework a NQN copying operation
    - nvme: pad fake subsys NQN vid and ssvid with zeros
    - nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN

  * Crash on "ip link add foo type ipip" (LP: #1811803)
    - SAUCE: fan: Fix NULL pointer dereference

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 06 Feb 2019 04:57:21 +0000

linux (4.15.0-45.48) bionic; urgency=medium

  * linux: 4.15.0-45.48 -proposed tracker (LP: #1813779)

  * External monitors does not work anymore 4.15.0-44 (LP: #1813663)
    - SAUCE: Revert "drm/i915/dp: Send DPCD ON for MST before phy_up"

  * kernel 4.15.0-44 cannot mount ext4 fs with meta_bg enabled (LP: #1813727)
    - ext4: fix false negatives *and* false positives in ext4_check_descriptors()

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 29 Jan 2019 16:39:15 +0100

linux (4.15.0-44.47) bionic; urgency=medium

  * linux: 4.15.0-44.47 -proposed tracker (LP: #1811419)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * CPU hard lockup with rigorous writes to NVMe drive (LP: #1810998)
    - blk-wbt: pass in enum wbt_flags to get_rq_wait()
    - blk-wbt: Avoid lock contention and thundering herd issue in wbt_wait
    - blk-wbt: move disable check into get_limit()
    - blk-wbt: use wq_has_sleeper() for wq active check
    - blk-wbt: fix has-sleeper queueing check
    - blk-wbt: abstract out end IO completion handler
    - blk-wbt: improve waking of tasks

  * To reduce the Realtek USB cardreader power consumption (LP: #1811337)
    - mmc: sdhci: Disable 1.8v modes (HS200/HS400/UHS) if controller can't support
      1.8v
    - mmc: core: Introduce MMC_CAP_SYNC_RUNTIME_PM
    - mmc: rtsx_usb_sdmmc: Don't runtime resume the device while changing led
    - mmc: rtsx_usb: Use MMC_CAP2_NO_SDIO
    - mmc: rtsx_usb: Enable MMC_CAP_ERASE to allow erase/discard/trim requests
    - mmc: rtsx_usb_sdmmc: Re-work runtime PM support
    - mmc: rtsx_usb_sdmmc: Re-work card detection/removal support
    - memstick: rtsx_usb_ms: Add missing pm_runtime_disable() in probe function
    - misc: rtsx_usb: Use USB remote wakeup signaling for card insertion detection
    - memstick: Prevent memstick host from getting runtime suspended during card
      detection
    - memstick: rtsx_usb_ms: Use ms_dev() helper
    - memstick: rtsx_usb_ms: Support runtime power management

  * Support non-strict iommu mode on arm64 (LP: #1806488)
    - iommu/io-pgtable-arm: Fix race handling in split_blk_unmap()
    - iommu/arm-smmu-v3: Implement flush_iotlb_all hook
    - iommu/dma: Add support for non-strict mode
    - iommu: Add "iommu.strict" command line option
    - iommu/io-pgtable-arm: Add support for non-strict mode
    - iommu/arm-smmu-v3: Add support for non-strict mode
    - iommu/io-pgtable-arm-v7s: Add support for non-strict mode
    - iommu/arm-smmu: Support non-strict mode

  * ELAN900C:00 04F3:2844 touchscreen doesn't work (LP: #1811335)
    - pinctrl: cannonlake: Fix community ordering for H variant
    - pinctrl: cannonlake: Fix HOSTSW_OWN register offset of H variant

  * Add Cavium ThunderX2 SoC UNCORE PMU driver (LP: #1811200)
    - perf: Export perf_event_update_userpage
    - Documentation: perf: Add documentation for ThunderX2 PMU uncore driver
    - drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver
    - [Config] New config CONFIG_THUNDERX2_PMU=m

  * Update hisilicon SoC-specific drivers (LP: #1810457)
    - SAUCE: Revert "net: hns3: Updates RX packet info fetch in case of multi BD"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
      resetting"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Use roce handle when calling roce
      callback function"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add calling roce callback
      function when link status change"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: optimize the process of notifying
      roce client"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE"
    - scsi: hisi_sas: Remove depends on HAS_DMA in case of platform dependency
    - ethernet: hisilicon: hns: hns_dsaf_mac: Use generic eth_broadcast_addr
    - scsi: hisi_sas: consolidate command check in hisi_sas_get_ata_protocol()
    - scsi: hisi_sas: remove some unneeded structure members
    - scsi: hisi_sas: Introduce hisi_sas_phy_set_linkrate()
    - net: hns: Fix the process of adding broadcast addresses to tcam
    - net: hns3: remove redundant variable 'protocol'
    - scsi: hisi_sas: Drop hisi_sas_slot_abort()
    - net: hns: Make many functions static
    - net: hns: make hns_dsaf_roce_reset non static
    - net: hisilicon: hns: Replace mdelay() with msleep()
    - net: hns3: fix return value error while hclge_cmd_csq_clean failed
    - net: hns: remove redundant variables 'max_frm' and 'tmp_mac_key'
    - net: hns: Mark expected switch fall-through
    - net: hns3: Mark expected switch fall-through
    - net: hns3: Remove tx ring BD len register in hns3_enet
    - net: hns: modify variable type in hns_nic_reuse_page
    - net: hns: use eth_get_headlen interface instead of hns_nic_get_headlen
    - net: hns3: modify variable type in hns3_nic_reuse_page
    - net: hns3: Fix for vf vlan delete failed problem
    - net: hns3: Fix for multicast failure
    - net: hns3: Fix error of checking used vlan id
    - net: hns3: Implement shutdown ops in hns3 pci driver
    - net: hns3: Fix for loopback selftest failed problem
    - net: hns3: Fix ping exited problem when doing lp selftest
    - net: hns3: Preserve vlan 0 in hardware table
    - net: hns3: Only update mac configuation when necessary
    - net: hns3: Change the dst mac addr of loopback packet
    - net: hns3: Remove redundant codes of query advertised flow control abilitiy
    - net: hns3: Refine hns3_get_link_ksettings()
    - net: hns: make function hns_gmac_wait_fifo_clean() static
    - net: hns3: Add default irq affinity
    - net: hns3: Add unlikely for buf_num check
    - net: hns3: Remove tx budget to clean more TX descriptors in a napi
    - net: hns3: Remove packet statistics of public
    - net: hns3: Add support for hns3_nic_netdev_ops.ndo_do_ioctl
    - net: hns3: Set STATE_DOWN bit of hdev state when stopping net
    - net: hns3: Check hdev state when getting link status
    - net: hns3: Fix for setting speed for phy failed problem
    - net: hns3: Fix cmdq registers initialization issue for vf
    - net: hns3: Clear client pointer when initialize client failed or unintialize
      finished
    - net: hns3: Fix client initialize state issue when roce client initialize
      failed
    - net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg()
    - net: hns3: Fix ets validate issue
    - net: hns3: Unify the type convert for desc.data
    - net: hns3: Adjust prefix of tx/rx statistic names
    - net: hns3: Fix tqp array traversal condition for vf
    - net: hns3: Unify the prefix of vf functions
    - net: hns3: Add handle for default case
    - net: hns3: Add nic state check before calling netif_tx_wake_queue
    - net: hns3: Add unlikely for dma_mapping_error check
    - net: hns3: Remove print messages for error packet
    - net: hns3: Add get_media_type ops support for VF
    - net: hns3: Fix speed/duplex information loss problem when executing ethtool
      ethx cmd of VF
    - net: hns3: Remove redundant hclge_get_port_type()
    - net: hns3: Add support for sctp checksum offload
    - net: hns3: Set extra mac address of pause param for HW
    - net: hns3: Rename loop mode
    - net: hns3: Rename mac loopback to app loopback
    - net: hns3: Add serdes parallel inner loopback support
    - net: hns3: Fix for packet buffer setting bug
    - net: hns3: Fix for netdev not up problem when setting mtu
    - net: hns3: Change return type of hclge_tm_schd_info_update()
    - net: hns3: Modify hns3_get_max_available_channels
    - net: hns3: Fix loss of coal configuration while doing reset
    - net: hns: remove ndo_poll_controller
    - hns3: Fix the build.
    - hns3: Another build fix.
    - net: hns3: Add flow director initialization
    - net: hns3: Add input key and action config support for flow director
    - net: hns3: Add support for rule add/delete for flow director
    - net: hns3: Add support for rule query of flow director
    - net: hns3: Add reset handle for flow director
    - net: hns3: Remove all flow director rules when unload hns3 driver
    - net: hns3: Add support for enable/disable flow director
    - net: hns3: Remove the default mask configuration for mac vlan table
    - net: hns3: Clear mac vlan table entries when unload driver or function reset
    - net: hns3: Optimize for unicast mac vlan table
    - net: hns3: Drop depricated mta table support
    - net: hns3: Add egress/ingress vlan filter for revision 0x21
    - net: hns3: Fix for rx vlan id handle to support Rev 0x21 hardware
    - net: hns3: Add new RSS hash algorithm support for PF
    - net: hns3: Add RSS general configuration support for VF
    - net: hns3: Add RSS tuples support for VF
    - net: hns3: Add HW RSS hash information to RX skb
    - net: hns3: Enable promisc mode when mac vlan table is full
    - net: hns3: Resume promisc mode and vlan filter status after reset
    - net: hns3: Resume promisc mode and vlan filter status after loopback test
    - scsi: hisi_sas: Feed back linkrate(max/min) when re-attached
    - scsi: hisi_sas: Move evaluation of hisi_hba in hisi_sas_task_prep()
    - scsi: hisi_sas: Fix the race between IO completion and timeout for
      SMP/internal IO
    - scsi: hisi_sas: Free slot later in slot_complete_vx_hw()
    - scsi: hisi_sas: unmask interrupts ent72 and ent74
    - scsi: hisi_sas: Use block layer tag instead for IPTT
    - scsi: hisi_sas: Update v3 hw AIP_LIMIT and CFG_AGING_TIME register values
    - net: hns3: remove hns3_fill_desc_tso
    - net: hns3: move DMA map into hns3_fill_desc
    - net: hns3: add handling for big TX fragment
    - net: hns3: rename hns_nic_dma_unmap
    - net: hns3: fix for multiple unmapping DMA problem
    - scsi: hisi_sas: Fix spin lock management in slot_index_alloc_quirk_v2_hw()
    - scsi: hisi_sas: Fix NULL pointer dereference
    - net: hns3: Add PCIe AER callback error_detected
    - net: hns3: Add PCIe AER error recovery
    - net: hns3: Add support to enable and disable hw errors
    - net: hns3: Add enable and process common ecc errors
    - net: hns3: Add enable and process hw errors from IGU, EGU and NCSI
    - net: hns3: Add enable and process hw errors from PPP
    - net: hns3: Add enable and process hw errors of TM scheduler
    - net: hns3: Fix for warning uninitialized symbol hw_err_lst3
    - net: hns3: fix spelling mistake "intrerrupt" -> "interrupt"
    - net: hns3: add error handler for hns3_nic_init_vector_data()
    - net: hns3: bugfix for buffer not free problem during resetting
    - net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem
    - net: hns3: bugfix for the initialization of command queue's spin lock
    - net: hns3: remove unnecessary queue reset in the hns3_uninit_all_ring()
    - net: hns3: bugfix for is_valid_csq_clean_head()
    - net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read
    - net: hns3: fix incorrect return value/type of some functions
    - net: hns3: bugfix for handling mailbox while the command queue reinitialized
    - net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
    - net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
    - net: hns3: Fix for out-of-bounds access when setting pfc back pressure
    - scsi: hisi_sas: Remove set but not used variable 'dq_list'
    - net: hns3: bugfix for not checking return value
    - net: hns: Incorrect offset address used for some registers.
    - net: hns: All ports can not work when insmod hns ko after rmmod.
    - net: hns: Some registers use wrong address according to the datasheet.
    - net: hns: Fixed bug that netdev was opened twice
    - net: hns: Clean rx fbd when ae stopped.
    - net: hns: Free irq when exit from abnormal branch
    - net: hns: Avoid net reset caused by pause frames storm
    - net: hns: Fix ntuple-filters status error.
    - net: hns: Add mac pcs config when enable|disable mac
    - net: hns: Fix ping failed when use net bridge and send multicast
    - net: hns3: use HNS3_NIC_STATE_INITED to indicate the initialization state of
      enet
    - net: hns3: add set_default_reset_request in the hnae3_ae_ops
    - net: hns3: provide some interface & information for the client
    - net: hns3: adjust the location of clearing the table when doing reset
    - net: hns3: enable/disable ring in the enet while doing UP/DOWN
    - net: hns3: use HNS3_NIC_STATE_RESETTING to indicate resetting
    - net: hns3: ignore new coming low-level reset while doing high-level reset
    - net: hns3: move some reset information from hnae3_handle into
      hclge_dev/hclgevf_dev
    - net: hns3: adjust the process of PF reset
    - net: hns3: call roce's reset notify callback when resetting
    - net: hns3: add error handler for hclge_reset()
    - net: hns3: fix for cmd queue memory not freed problem during reset
    - net: hns3: Remove set but not used variable 'reset_level'
    - net: hns3: fix spelling mistake, "assertting" -> "asserting"
    - net: hns3: add reset_hdev to reinit the hdev in VF's reset process
    - net: hns3: adjust VF's reset process
    - net: hns3: add reset handling for VF when doing PF reset
    - net: hns3: add reset handling for VF when doing Core/Global/IMP reset
    - net: hns3: stop handling command queue while resetting VF
    - net: hns3: add error handler for hclgevf_reset()
    - net: hns3: stop napi polling when HNS3_NIC_STATE_DOWN is set
    - net: hns3: implement the IMP reset processing for PF
    - net: hns3: add PCIe FLR support for PF
    - net: hns3: do VF's pci re-initialization while PF doing FLR
    - net: hns3: add PCIe FLR support for VF
    - net: hns3: Enable HW GRO for Rev B(=0x21) HNS3 hardware
    - net: hns3: Add handling of GRO Pkts not fully RX'ed in NAPI poll
    - net: hns3: Add skb chain when num of RX buf exceeds MAX_SKB_FRAGS
    - net: hns3: Adds GRO params to SKB for the stack
    - scsi: hisi_sas: use dma_set_mask_and_coherent
    - scsi: hisi_sas: Create separate host attributes per HBA
    - scsi: hisi_sas: Add support for interrupt converge for v3 hw
    - scsi: hisi_sas: Add support for interrupt coalescing for v3 hw
    - scsi: hisi_sas: Relocate some codes to avoid an unused check
    - scsi: hisi_sas: change the time of SAS SSP connection
    - net: hns3: fix spelling mistake "failded" -> "failed"
    - net: hns3: Support two vlan header when setting mtu
    - net: hns3: Refactor mac mtu setting related functions
    - net: hns3: Add vport alive state checking support
    - net: hns3: Add mtu setting support for vf
    - net: hns3: up/down netdev in hclge module when setting mtu
    - net: hns3: add common validation in hclge_dcb
    - net: hns3: Add debugfs framework registration
    - net: hns3: Add "queue info" query function
    - net: hns3: Add "FD flow table" info query function
    - net: hns3: Add "tc config" info query function
    - net: hns3: Add "tm config" info query function
    - net: hns3: Add "qos pause" config info query function
    - net: hns3: Add "qos prio map" info query function
    - net: hns3: Add "qos buffer" config info query function
    - net: hns3: Support "ethtool -d" for HNS3 VF driver
    - net: hns3: Adds support to dump(using ethool-d) PCIe regs in HNS3 PF driver
    - net: hns3: remove existing process error functions and reorder hw_blk table
    - net: hns3: rename enable error interrupt functions
    - net: hns3: re-enable error interrupts on hw reset
    - net: hns3: deletes unnecessary settings of the descriptor data
    - net: hns3: rename process_hw_error function
    - net: hns3: add optimization in the hclge_hw_error_set_state
    - net: hns3: add handling of hw ras errors using new set of commands
    - net: hns3: deleted logging 1 bit errors
    - net: hns3: add handling of hw errors reported through MSIX
    - net: hns3: add handling of hw errors of MAC
    - net: hns3: handle hw errors of PPP PF
    - net: hns3: handle hw errors of PPU(RCB)
    - net: hns3: handle hw errors of SSU
    - net: hns3: add handling of RDMA RAS errors
    - net: hns3: fix spelling mistake "offser" -> "offset"
    - scsi: hisi_sas: Fix warnings detected by sparse
    - scsi: hisi_sas: Relocate some code to reduce complexity
    - scsi: hisi_sas: Make sg_tablesize consistent value
    - hns3: prevent building without CONFIG_INET
    - net: hns3: Add "bd info" query function
    - net: hns3: Add "manager table" information query function
    - net: hns3: Add "status register" information query function
    - net: hns3: Add "dcb register" status information query function
    - net: hns3: Add "queue map" information query function
    - net: hns3: Add "tm map" status information query function
    - net: hns3: fix error handling int the hns3_get_vector_ring_chain
    - net: hns3: uninitialize pci in the hclgevf_uninit
    - net: hns3: fix napi_disable not return problem
    - net: hns3: update some variables while hclge_reset()/hclgevf_reset() done
    - net: hns3: remove unnecessary configuration recapture while resetting
    - net: hns3: fix incomplete uninitialization of IRQ in the
      hns3_nic_uninit_vector_data()
    - net: hns3: update coalesce param per second
    - net: hns3: remove 1000M/half support of phy
    - net: hns3: synchronize speed and duplex from phy when phy link up
    - net: hns3: getting tx and dv buffer size through firmware
    - net: hns3: aligning buffer size in SSU to 256 bytes
    - net: hns3: fix a SSU buffer checking bug
    - scsi: hisi_sas: Add support for DIF feature for v2 hw
    - net: hns3: refine the handle for hns3_nic_net_open/stop()
    - net: hns3: change default tc state to close
    - net: hns3: fix a bug caused by udelay
    - net: hns3: add max vector number check for pf
    - net: hns3: reset tqp while doing DOWN operation
    - net: hns3: fix vf id check issue when add flow director rule
    - net: hns3: don't restore rules when flow director is disabled
    - net: hns3: fix the descriptor index when get rss type
    - net: hns3: remove redundant variable initialization
    - net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT

  * iptables connlimit allows more connections than the limit when using
    multiple CPUs (LP: #1811094)
    - SAUCE: netfilter: xt_connlimit: remove the 'addr' parameter in add_hlist()
    - netfilter: nf_conncount: expose connection list interface
    - netfilter: nf_conncount: Fix garbage collection with zones
    - netfilter: nf_conncount: fix garbage collection confirm race
    - netfilter: nf_conncount: don't skip eviction when age is negative

  * CVE-2018-16882
    - KVM: Fix UAF in nested posted interrupt processing

  * Cannot initialize ATA disk if IDENTIFY command fails (LP: #1809046)
    - scsi: libsas: check the ata device status by ata_dev_enabled()

  * scsi: libsas: fix a race condition when smp task timeout (LP: #1808912)
    - scsi: libsas: fix a race condition when smp task timeout

  * CVE-2018-14625
    - vhost/vsock: fix use-after-free in network stack callers

  * Fix and issue that LG I2C touchscreen stops working after reboot
    (LP: #1805085)
    - HID: i2c-hid: Disable runtime PM for LG touchscreen

  * powerpc/powernv/pci: Work around races in PCI bridge enabling (LP: #1805245)
    - powerpc/powernv/pci: Work around races in PCI bridge enabling

  * Drivers: hv: vmbus: Offload the handling of channels to two workqueues
    (LP: #1807757)
    - hv_netvsc: fix network namespace issues with VF support
    - hv_netvsc: split sub-channel setup into async and sync
    - Drivers: hv: vmbus: Fix the offer_in_progress in vmbus_process_offer()
    - hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()
    - vmbus: don't return values for uninitalized channels
    - Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
    - Drivers: hv: vmbus: Offload the handling of channels to two workqueues

  * Disable LPM for Raydium Touchscreens (LP: #1802248)
    - USB: quirks: Add no-lpm quirk for Raydium touchscreens

  * Power leakage at S5 with Qualcomm Atheros QCA9377 802.11ac Wireless Network
    Adapter (LP: #1805607)
    - SAUCE: ath10k: provide reset function for QCA9377 chip

  * CVE-2018-17972
    - proc: restrict kernel stack dumps to root

  * CVE-2018-19407
    - KVM: X86: Fix scan ioapic use-before-initialization

  * CVE-2018-18281
    - mremap: properly flush TLB before releasing the page

  * Fix USB2 device wrongly detected as USB1 (LP: #1806534)
    - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc

  * armhf guests fail to boot in EFI mode (LP: #1809488)
    - efi/arm: Revert deferred unmap of early memmap mapping

  * Bionic shows incorrect warning about number of pointers in TFD
    (LP: #1801102)
    - iwlwifi: pcie: don't warn if we use all the transmit pointers

  * audio output has constant noise on a Dell machine (LP: #1810891)
    - ALSA: hda/realtek - Fixed headphone issue for ALC700

  * ldisc crash on reopened tty (LP: #1791758)
    - tty: Drop tty->count on tty_reopen() failure
    - tty: Hold tty_ldisc_lock() during tty_reopen()
    - tty: Don't block on IO when ldisc change is pending
    - tty: Simplify tty->count math in tty_reopen()

  * SATA device is not going to DEVSLP (LP: #1781533)
    - ahci: Allow setting a default LPM policy for mobile chipsets
    - ata: libahci: Correct setting of DEVSLP register
    - ata: libahci: Allow reconfigure of DEVSLP register
    - ata: ahci: Support state with min power but Partial low power state
    - ata: ahci: Enable DEVSLP by default on x86 with SLP_S0
    - [Config] set CONFIG_SATA_MOBILE_LPM_POLICY=0

  * Console got stuck using serial tty after logout (LP: #1808097)
    - tty: do not set TTY_IO_ERROR flag if console port

  * fanotify10 in ubuntu_ltp_syscalls failed (LP: #1802454)
    - fsnotify: fix ignore mask logic in fsnotify()

  * SRU: Fix kernel xhci hang when resume from S3 (LP: #1805344)
    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
    - usb: xhci: fix timeout for transition from RExit to U0

  * Add pointstick support for Cirque Touchpad (LP: #1805081)
    - HID: multitouch: Add pointstick support for Cirque Touchpad

  * Intel NVMe drives timeout when nvme format is attempted (LP: #1797587)
    - nvme: Use admin command effects for admin commands

  * lineout jack can't work on a Dell machine (LP: #1810892)
    - ALSA: hda/realtek - Support Dell headset mode for New AIO platform

  * Bionic update: upstream stable patchset 2019-01-04 (LP: #1810554)
    - MIPS: Call dump_stack() from show_regs()
    - MIPS: Use async IPIs for arch_trigger_cpumask_backtrace()
    - MIPS: Fix ioremap() RAM check
    - mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states
    - mmc: dw_mmc: fix card threshold control configuration
    - ibmasm: don't write out of bounds in read handler
    - staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
    - staging: r8822be: Fix RTL8822be can't find any wireless AP
    - ata: Fix ZBC_OUT command block check
    - ata: Fix ZBC_OUT all bit handling
    - vmw_balloon: fix inflation with batching
    - ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
    - USB: serial: ch341: fix type promotion bug in ch341_control_in()
    - USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
    - USB: serial: keyspan_pda: fix modem-status error handling
    - USB: serial: mos7840: fix status-register error handling
    - usb: quirks: add delay quirks for Corsair Strafe
    - xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
    - ALSA: hda - Handle pm failure during hotplug
    - fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps*
    - fs, elf: make sure to page align bss in load_elf_library
    - mm: do not bug_on on incorrect length in __mm_populate()
    - tracing: Reorder display of TGID to be after PID
    - kbuild: delete INSTALL_FW_PATH from kbuild documentation
    - arm64: neon: Fix function may_use_simd() return error status
    - tools build: fix # escaping in .cmd files for future Make
    - IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values
    - i2c: tegra: Fix NACK error handling
    - iw_cxgb4: correctly enforce the max reg_mr depth
    - xen: setup pv irq ops vector earlier
    - nvme-pci: Remap CMB SQ entries on every controller reset
    - crypto: x86/salsa20 - remove x86 salsa20 implementations
    - uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
    - netfilter: nf_queue: augment nfqa_cfg_policy
    - netfilter: x_tables: initialise match/target check parameter struct
    - loop: add recursion validation to LOOP_CHANGE_FD
    - PM / hibernate: Fix oops at snapshot_write()
    - RDMA/ucm: Mark UCM interface as BROKEN
    - loop: remember whether sysfs_create_group() was done
    - f2fs: give message and set need_fsck given broken node id
    - mm: do not drop unused pages when userfaultd is running
    - bpf: reject passing modified ctx to helper functions
    - mei: discard messages from not connected client during power down.
    - mm: zero unavailable pages before memmap init
    - xen: remove global bit from __default_kernel_pte_mask for pv guests
    - f2fs: return error during fill_super
    - f2fs: avoid bug_on on corrupted inode
    - f2fs: sanity check on sit entry
    - f2fs: sanity check for total valid node blocks
    - ARM: dts: armada-38x: use the new thermal binding
    - mm: don't do zero_resv_unavail if memmap is not allocated

  * Blacklist Realtek Virtual IPMI device (LP: #1808353)
    - ipmi:pci: Blacklist a Realtek "IPMI" device

  * Ethernet[10ec:8136] doesn't work after S3 with kernel 4.15.0.43.64
    (LP: #1809847)
    - SAUCE: Revert "r8169: don't use MSI-X on RTL8106e"
    - r8169: re-enable MSI-X on RTL8168g

  * Killer 802.11ac 2x2 (1550 or 1550i) [8086:2526][1a56:1550] is not supported
    (LP: #1809219)
    - iwlwifi: add more card IDs for 9000 series

  * Support new Realtek ethernet chips (LP: #1811055)
    - r8169: Add support for new Realtek Ethernet

  * PC SN720 NVMe WDC 256GB consumes more power in S2Idle than during long idle
    (LP: #1805775)
    - SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3 and being
      disabled

  * Power consumption during s2idle is higher than long idle (Intel SSDPEKKF)
    (LP: #1804588)
    - SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3
    - SAUCE: nvme: add quirk to not call disable function when suspending

  * mpt3sas - driver using the wrong register to update a queue index in FW
    (LP: #1810781)
    - scsi: mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5
      controllers when HBA supports more than 16 MSI-x vectors.

  * HP mobile workstations with hybrid graphics support, can not directly output
    to external monitors by dGPU (LP: #1810702)
    - ACPI / OSI: Add OEM _OSI string to enable dGPU direct output

  * broken touchpad after i2c-i801 blacklist change (LP: #1802135)
    - i2c: i801: Don't restore config registers on runtime PM

  * Enable new Realtek card reader (LP: #1806335)
    - USB: usb-storage: Add new IDs to ums-realtek
    - SAUCE: (noup) USB: usb-storage: Make MMC support optional on ums-realtek

  * The line-out on the Dell Dock station can't work (LP: #1806532)
    - ALSA: usb-audio: Allow to override the longname string
    - ALSA: usb-audio: Give proper vendor/product name for Dell WD15 Dock
    - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] getabis -- handle all known package combinations
    - [Packaging] getabis -- support parsing a simple version

  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
    - igb: Fix an issue that PME is not enabled during runtime suspend

  * Fix Terminus USB hub that may breaks connected USB devices after S3
    (LP: #1806850)
    - USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub

  * Add support for Dell DW5821e WWAN/GPS module (LP: #1807342)
    - qmi_wwan: add support for the Dell Wireless 5821e module
    - qmi_wwan: fix interface number for DW5821e production firmware
    - USB: option: add support for DW5821e

  * Add support for 0cf3:535b QCA_ROME device (LP: #1807333)
    - Bluetooth: btusb: Add support for 0cf3:535b QCA_ROME device

  * The mute led can't work anymore on the lenovo x1 carbon (LP: #1808465)
    - ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon

  * click/pop noise in the headphone on several lenovo laptops (LP: #1805079) //
    click/pop noise in the headphone on several lenovo laptops (LP: #1805079)
    - ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops

  * Touchpad stops working after reboot on Apollo Lake (LP: #1728244)
    - HID: i2c-hid: disable runtime PM operations on hantick touchpad

  * MAC address pass through on RTL8153-BND for docking station (LP: #1808729)
    - r8152: Add support for MAC address pass through on RTL8153-BND

  * [Ubuntu] kernel: zcrypt: reinit ap queue state machine (LP: #1805414)
    - s390/zcrypt: reinit ap queue state machine during device probe

  * [UBUNTU] qeth: fix length check in SNMP processing (LP: #1805802)
    - s390/qeth: fix length check in SNMP processing

  * ASPEED server console output extremely slow after upgrade to 18.04
    (LP: #1808183)
    - drm/ast: Remove existing framebuffers before loading driver

  * Bionic update: upstream stable patchset 2018-12-13 (LP: #1808399)
    - userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access
    - mm: hugetlb: yield when prepping struct pages
    - tracing: Fix missing return symbol in function_graph output
    - scsi: target: Fix truncated PR-in ReadKeys response
    - s390: Correct register corruption in critical section cleanup
    - drbd: fix access after free
    - vfio: Use get_user_pages_longterm correctly
    - cifs: Fix use after free of a mid_q_entry
    - cifs: Fix memory leak in smb2_set_ea()
    - cifs: Fix infinite loop when using hard mount option
    - drm: Use kvzalloc for allocating blob property memory
    - drm/udl: fix display corruption of the last line
    - jbd2: don't mark block as modified if the handle is out of credits
    - ext4: add corruption check in ext4_xattr_set_entry()
    - ext4: always verify the magic number in xattr blocks
    - ext4: make sure bitmaps and the inode table don't overlap with bg
      descriptors
    - ext4: always check block group bounds in ext4_init_block_bitmap()
    - ext4: only look at the bg_flags field if it is valid
    - ext4: verify the depth of extent tree in ext4_find_extent()
    - ext4: include the illegal physical block in the bad map ext4_error msg
    - ext4: never move the system.data xattr out of the inode body
    - ext4: avoid running out of journal credits when appending to an inline file
    - ext4: add more inode number paranoia checks
    - ext4: add more mount time checks of the superblock
    - ext4: check superblock mapped prior to committing
    - HID: i2c-hid: Fix "incomplete report" noise
    - HID: hiddev: fix potential Spectre v1
    - HID: debug: check length before copy_to_user()
    - media: vb2: core: Finish buffers at the end of the stream
    - f2fs: truncate preallocated blocks in error case
    - Revert "dpaa_eth: fix error in dpaa_remove()"
    - Kbuild: fix # escaping in .cmd files for future Make
    - media: cx25840: Use subdev host data for PLL override
    - fs: allow per-device dax status checking for filesystems
    - dax: change bdev_dax_supported() to support boolean returns
    - dax: check for QUEUE_FLAG_DAX in bdev_dax_supported()
    - dm: set QUEUE_FLAG_DAX accordingly in dm_table_set_restrictions()
    - dm: prevent DAX mounts if not supported
    - mtd: cfi_cmdset_0002: Change definition naming to retry write operation
    - mtd: cfi_cmdset_0002: Change erase functions to retry for error
    - mtd: cfi_cmdset_0002: Change erase functions to check chip good only
    - netfilter: nf_log: don't hold nf_log_mutex during user access
    - staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
    - sched, tracing: Fix trace_sched_pi_setprio() for deboosting
    - PCI / ACPI / PM: Resume bridges w/o drivers on suspend-to-RAM
    - drm/amdgpu: Make struct amdgpu_atif private to amdgpu_acpi.c
    - scsi: aacraid: Fix PD performance regression over incorrect qd being set
    - ARM: dts: imx51-zii-rdu1: fix touchscreen pinctrl
    - drm/amdgpu: Add amdgpu_atpx_get_dhandle()
    - drm/amdgpu: Dynamically probe for ATIF handle (v2)
    - i2c: core: smbus: fix a potential missing-check bug

  * Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185)
    - usb: cdc_acm: Add quirk for Uniden UBC125 scanner
    - USB: serial: cp210x: add CESINEL device ids
    - USB: serial: cp210x: add Silicon Labs IDs for Windows Update
    - usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub
    - acpi: Add helper for deactivating memory region
    - usb: typec: ucsi: acpi: Workaround for cache mode issue
    - usb: typec: ucsi: Fix for incorrect status data issue
    - xhci: Fix kernel oops in trace_xhci_free_virt_device
    - n_tty: Fix stall at n_tty_receive_char_special().
    - n_tty: Access echo_* variables carefully.
    - staging: android: ion: Return an ERR_PTR in ion_map_kernel
    - serial: 8250_pci: Remove stalled entries in blacklist
    - serdev: fix memleak on module unload
    - vt: prevent leaking uninitialized data to userspace via /dev/vcs*
    - drm/amdgpu: Add APU support in vi_set_uvd_clocks
    - drm/amdgpu: Add APU support in vi_set_vce_clocks
    - drm/amdgpu: fix the missed vcn fw version report
    - drm/qxl: Call qxl_bo_unref outside atomic context
    - drm/atmel-hlcdc: check stride values in the first plane
    - drm/amdgpu: Use kvmalloc_array for allocating VRAM manager nodes array
    - drm/amdgpu: Refactor amdgpu_vram_mgr_bo_invisible_size helper
    - drm/i915: Enable provoking vertex fix on Gen9 systems.
    - netfilter: nf_tables: nft_compat: fix refcount leak on xt module
    - netfilter: nft_compat: prepare for indirect info storage
    - netfilter: nft_compat: fix handling of large matchinfo size
    - netfilter: nf_tables: don't assume chain stats are set when jumplabel is set
    - netfilter: nf_tables: bogus EBUSY in chain deletions
    - netfilter: nft_meta: fix wrong value dereference in nft_meta_set_eval
    - netfilter: nf_tables: disable preemption in nft_update_chain_stats()
    - netfilter: nf_tables: increase nft_counters_enabled in
      nft_chain_stats_replace()
    - netfilter: nf_tables: fix memory leak on error exit return
    - netfilter: nf_tables: add missing netlink attrs to policies
    - netfilter: nf_tables: fix NULL-ptr in nf_tables_dump_obj()
    - netfilter: don't set F_IFACE on ipv6 fib lookups
    - netfilter: ip6t_rpfilter: provide input interface for route lookup
    - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
    - ARM: dts: imx6q: Use correct SDMA script for SPI5 core
    - xfrm6: avoid potential infinite loop in _decode_session6()
    - afs: Fix directory permissions check
    - netfilter: ebtables: handle string from userspace with care
    - s390/dasd: use blk_mq_rq_from_pdu for per request data
    - netfilter: nft_limit: fix packet ratelimiting
    - ipvs: fix buffer overflow with sync daemon and service
    - iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
    - atm: zatm: fix memcmp casting
    - net: qmi_wwan: Add Netgear Aircard 779S
    - perf test: "Session topology" dumps core on s390
    - perf bpf: Fix NULL return handling in bpf__prepare_load()
    - fs: clear writeback errors in inode_init_always
    - sched/core: Fix rules for running on online && !active CPUs
    - sched/core: Require cpu_active() in select_task_rq(), for user tasks
    - platform/x86: asus-wmi: Fix NULL pointer dereference
    - net/sonic: Use dma_mapping_error()
    - net: dsa: b53: Add BCM5389 support
    - usb: typec: tcpm: fix logbuffer index is wrong if _tcpm_log is re-entered
    - iio: mma8452: Fix ignoring MMA8452_INT_DRDY
    - drm/amdgpu: fix clear_all and replace handling in the VM (v2)
    - drm/amd/display: Clear connector's edid pointer
    - drm/i915/dp: Send DPCD ON for MST before phy_up
    - drm/amdgpu: remove DC special casing for KB/ML
    - drm/amdgpu: Don't default to DC support for Kaveri and older
    - drm/amdgpu: GPU vs CPU page size fixes in amdgpu_vm_bo_split_mapping
    - drm/amd/display: release spinlock before committing updates to stream
    - drm/i915: Fix PIPESTAT irq ack on i965/g4x
    - ARM64: dts: meson-gxl-s905x-p212: Add phy-supply for usb0
    - x86/mm: Don't free P4D table when it is folded at runtime

  * Bionic update: upstream stable patchset 2018-12-07 (LP: #1807469)
    - x86/spectre_v1: Disable compiler optimizations over
      array_index_mask_nospec()
    - x86/mce: Improve error message when kernel cannot recover
    - x86/mce: Check for alternate indication of machine check recovery on Skylake
    - x86/mce: Fix incorrect "Machine check from unknown source" message
    - x86/mce: Do not overwrite MCi_STATUS in mce_no_way_out()
    - x86: Call fixup_exception() before notify_die() in math_error()
    - m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
    - m68k/mac: Fix SWIM memory resource end address
    - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
    - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
    - PM / Domains: Fix error path during attach in genpd
    - PM / core: Fix supplier device runtime PM usage counter imbalance
    - PM / OPP: Update voltage in case freq == old_freq
    - usb: do not reset if a low-speed or full-speed device timed out
    - 1wire: family module autoload fails because of upper/lower case mismatch.
    - ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
    - ASoC: cs35l35: Add use_single_rw to regmap config
    - ASoC: cirrus: i2s: Fix LRCLK configuration
    - ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
    - thermal: bcm2835: Stop using printk format %pCr
    - clk: renesas: cpg-mssr: Stop using printk format %pCr
    - lib/vsprintf: Remove atomic-unsafe support for %pCr
    - ftrace/selftest: Have the reset_trigger code be a bit more careful
    - mips: ftrace: fix static function graph tracing
    - branch-check: fix long->int truncation when profiling branches
    - ipmi:bt: Set the timeout before doing a capabilities check
    - Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
    - printk: fix possible reuse of va_list variable
    - fuse: fix congested state leak on aborted connections
    - fuse: atomic_o_trunc should truncate pagecache
    - fuse: don't keep dead fuse_conn at fuse_fill_super().
    - fuse: fix control dir setup and teardown
    - powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
    - powerpc/ptrace: Fix setting 512B aligned breakpoints with
      PTRACE_SET_DEBUGREG
    - powerpc/ptrace: Fix enforcement of DAWR constraints
    - powerpc/powernv/ioda2: Remove redundant free of TCE pages
    - powerpc/powernv: copy/paste - Mask SO bit in CR
    - powerpc/fadump: Unregister fadump on kexec down path.
    - soc: rockchip: power-domain: Fix wrong value when power up pd with writemask
    - ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
    - ARM: dts: Fix SPI node for Arria10
    - ARM: dts: socfpga: Fix NAND controller node compatible
    - ARM: dts: socfpga: Fix NAND controller clock supply
    - ARM: dts: socfpga: Fix NAND controller node compatible for Arria10
    - arm64: Fix syscall restarting around signal suppressed by tracer
    - arm64: kpti: Use early_param for kpti= command-line option
    - arm64: mm: Ensure writes to swapper are ordered wrt subsequent cache
      maintenance
    - ARM64: dts: meson: disable sd-uhs modes on the libretech-cc
    - of: overlay: validate offset from property fixups
    - of: unittest: for strings, account for trailing 0 in property length field
    - of: platform: stop accessing invalid dev in of_platform_device_destroy
    - tpm: fix use after free in tpm2_load_context()
    - tpm: fix race condition in tpm_common_write()
    - IB/qib: Fix DMA api warning with debug kernel
    - IB/{hfi1, qib}: Add handling of kernel restart
    - IB/mlx4: Mark user MR as writable if actual virtual memory is writable
    - IB/core: Make testing MR flags for writability a static inline function
    - IB/mlx5: Fetch soft WQE's on fatal error state
    - IB/isert: Fix for lib/dma_debug check_sync warning
    - IB/isert: fix T10-pi check mask setting
    - IB/hfi1: Fix fault injection init/exit issues
    - IB/hfi1: Reorder incorrect send context disable
    - IB/hfi1: Optimize kthread pointer locking when queuing CQ entries
    - IB/hfi1: Fix user context tail allocation for DMA_RTAIL
    - RDMA/mlx4: Discard unknown SQP work requests
    - xprtrdma: Return -ENOBUFS when no pages are available
    - mtd: cfi_cmdset_0002: Change write buffer to check correct value
    - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
    - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
    - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
    - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
    - PCI: hv: Make sure the bus domain is really unique
    - PCI: Add ACS quirk for Intel 7th & 8th Gen mobile
    - PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on
      resume
    - auxdisplay: fix broken menu
    - pinctrl: samsung: Correct EINTG banks order
    - pinctrl: devicetree: Fix pctldev pointer overwrite
    - cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0
    - MIPS: io: Add barrier after register read in inX()
    - time: Make sure jiffies_to_msecs() preserves non-zero time periods
    - irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
    - X.509: unpack RSA signatureValue field from BIT STRING
    - Btrfs: fix return value on rename exchange failure
    - iio: adc: ad7791: remove sample freq sysfs attributes
    - iio: sca3000: Fix an error handling path in 'sca3000_probe()'
    - mm: fix __gup_device_huge vs unmap
    - scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
    - scsi: qla2xxx: Mask off Scope bits in retry delay
    - scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
    - scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
    - scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for
      ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
    - linvdimm, pmem: Preserve read-only setting for pmem devices
    - clk: at91: PLL recalc_rate() now using cached MUL and DIV values
    - rtc: sun6i: Fix bit_idx value for clk_register_gate
    - md: fix two problems with setting the "re-add" device state.
    - rpmsg: smd: do not use mananged resources for endpoints and channels
    - ubi: fastmap: Cancel work upon detach
    - ubi: fastmap: Correctly handle interrupted erasures in EBA
    - backlight: as3711_bl: Fix Device Tree node lookup
    - backlight: max8925_bl: Fix Device Tree node lookup
    - backlight: tps65217_bl: Fix Device Tree node lookup
    - mfd: intel-lpss: Program REMAP register in PIO mode
    - arm: dts: mt7623: fix invalid memory node being generated
    - perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
    - perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
    - perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
    - perf intel-pt: Fix MTC timing after overflow
    - perf intel-pt: Fix "Unexpected indirect branch" error
    - perf intel-pt: Fix packet decoding of CYC packets
    - media: vsp1: Release buffers for each video node
    - media: v4l2-compat-ioctl32: prevent go past max size
    - media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
    - nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
    - NFSv4: Fix possible 1-byte stack overflow in
      nfs_idmap_read_and_verify_message
    - NFSv4: Revert commit 5f83d86cf531d ("NFSv4.x: Fix wraparound issues..")
    - NFSv4: Fix a typo in nfs41_sequence_process
    - ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
    - Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
    - pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume
    - rbd: flush rbd_dev->watch_dwork after watch is unregistered
    - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm()
    - mm: fix devmem_is_allowed() for sub-page System RAM intersections
    - xen: Remove unnecessary BUG_ON from __unbind_from_irq()
    - udf: Detect incorrect directory size
    - Input: xpad - fix GPD Win 2 controller name
    - Input: elan_i2c_smbus - fix more potential stack buffer overflows
    - ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl
    - ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co
    - ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
    - slub: fix failure when we delete and create a slab cache
    - block: Fix transfer when chunk sectors exceeds max
    - block: Fix cloning of requests with a special payload
    - x86/efi: Fix efi_call_phys_epilog() with CONFIG_X86_5LEVEL=y
    - dm zoned: avoid triggering reclaim from inside dmz_map()
    - dm thin: handle running out of data space vs concurrent discard
    - x86/platform/UV: Use new set memory block size function
    - x86/platform/UV: Add kernel parameter to set memory block size
    - platform/chrome: cros_ec_lpc: Register the driver if ACPI entry is missing.
    - platform/chrome: cros_ec_lpc: do not try DMI match when ACPI device found
    - hwmon: (k10temp) Add support for Stoney Ridge and Bristol Ridge CPUs
    - spi-nor: intel-spi: Remove unused preopcodes field
    - mtd: spi-nor: intel-spi: Fix atomic sequence handling
    - PCI / PM: Do not clear state_saved for devices that remain suspended
    - ASoC: mediatek: preallocate pages use platform device
    - libnvdimm, pmem: Do not flush power-fail protected CPU caches
    - powerpc/64s: Set assembler machine type to POWER4
    - powerpc/e500mc: Set assembler machine type to e500mc
    - hwrng: core - Always drop the RNG in hwrng_unregister()
    - softirq: Reorder trace_softirqs_on to prevent lockdep splat
    - ARM64: dts: meson-gx: fix ATF reserved memory region
    - mtd: rawnand: fix return value check for bad block status
    - mtd: rawnand: mxc: set spare area size register explicitly
    - PCI: Account for all bridges on bus when distributing bus numbers
    - pinctrl: armada-37xx: Fix spurious irq management
    - MIPS: pb44: Fix i2c-gpio GPIO descriptor table
    - locking/rwsem: Fix up_read_non_owner() warning with DEBUG_RWSEMS
    - scsi: scsi_debug: Fix memory leak on module unload
    - scsi: qla2xxx: Spinlock recursion in qla_target
    - libnvdimm, pmem: Unconditionally deep flush on *sync
    - f2fs: don't use GFP_ZERO for page caches
    - mfd: twl-core: Fix clock initialization
    - remoteproc: Prevent incorrect rproc state on xfer mem ownership failure
    - media: rc: mce_kbd decoder: fix stuck keys
    - Input: silead - add Chuwi Hi8 support
    - Input: silead - add MSSL0002 ACPI HID
    - ALSA: hda - Force to link down at runtime suspend on ATI/AMD HDMI
    - i2c: gpio: initialize SCL to HIGH again
    - kasan: depend on CONFIG_SLUB_DEBUG
    - dm: ensure bio submission follows a depth-first tree walk
    - dm: rename 'bio' member of dm_io structure to 'orig_bio'
    - dm: use bio_split() when splitting out the already processed bio
    - x86/e820: put !E820_TYPE_RAM regions into memblock.reserved

  * Support AverMedia DVD EZMaker 7 USB video capture dongle (LP: #1620762) //
    Bionic update: upstream stable patchset 2018-12-07 (LP: #1807469)
    - media: cx231xx: Add support for AverMedia DVD EZMaker 7

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 14 Jan 2019 09:38:05 +0000

linux (4.15.0-43.46) bionic; urgency=medium

  * linux: 4.15.0-43.46 -proposed tracker (LP: #1806659)

  * System randomly hangs during suspend when mei_wdt is loaded (LP: #1803942)
    - SAUCE: base/dd: limit release function changes to vfio driver only

  * Workaround CSS timeout on AMD SNPS 3.0 xHC (LP: #1806838)
    - xhci: Allow more than 32 quirks
    - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] limit preparation to linux-libc-dev in headers
    - [Packaging] commonise debhelper invocation
    - [Packaging] ABI -- accumulate abi information at the end of the build
    - [Packaging] buildinfo -- add basic build information
    - [Packaging] buildinfo -- add firmware information to the flavour ABI
    - [Packaging] buildinfo -- add compiler information to the flavour ABI
    - [Packaging] buildinfo -- add buildinfo support to getabis
    - [Config] buildinfo -- add retpoline version markers

  * linux packages should own /usr/lib/linux/triggers (LP: #1770256)
    - [Packaging] own /usr/lib/linux/triggers

  * CVE-2018-12896
    - posix-timers: Sanitize overrun handling

  * CVE-2018-16276
    - USB: yurex: fix out-of-bounds uaccess in read handler

  * CVE-2018-10902
    - ALSA: rawmidi: Change resized buffers atomically

  * CVE-2018-18710
    - cdrom: fix improper type cast, which can leat to information leak.

  * CVE-2018-18690
    - xfs: don't fail when converting shortform attr to long form during
      ATTR_REPLACE

  * CVE-2018-14734
    - infiniband: fix a possible use-after-free bug

  * CVE-2018-18445
    - bpf: 32-bit RSH verification must truncate input before the ALU op

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 06 Dec 2018 13:52:12 +0000

linux (4.15.0-42.45) bionic; urgency=medium

  * linux: 4.15.0-42.45 -proposed tracker (LP: #1803592)

  * [FEAT] Guest-dedicated Crypto Adapters (LP: #1787405)
    - KVM: s390: reset crypto attributes for all vcpus
    - KVM: s390: vsie: simulate VCPU SIE entry/exit
    - KVM: s390: introduce and use KVM_REQ_VSIE_RESTART
    - KVM: s390: refactor crypto initialization
    - s390: vfio-ap: base implementation of VFIO AP device driver
    - s390: vfio-ap: register matrix device with VFIO mdev framework
    - s390: vfio-ap: sysfs interfaces to configure adapters
    - s390: vfio-ap: sysfs interfaces to configure domains
    - s390: vfio-ap: sysfs interfaces to configure control domains
    - s390: vfio-ap: sysfs interface to view matrix mdev matrix
    - KVM: s390: interface to clear CRYCB masks
    - s390: vfio-ap: implement mediated device open callback
    - s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
    - s390: vfio-ap: zeroize the AP queues
    - s390: vfio-ap: implement VFIO_DEVICE_RESET ioctl
    - KVM: s390: Clear Crypto Control Block when using vSIE
    - KVM: s390: vsie: Do the CRYCB validation first
    - KVM: s390: vsie: Make use of CRYCB FORMAT2 clear
    - KVM: s390: vsie: Allow CRYCB FORMAT-2
    - KVM: s390: vsie: allow CRYCB FORMAT-1
    - KVM: s390: vsie: allow CRYCB FORMAT-0
    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-1
    - KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2
    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-2
    - KVM: s390: device attrs to enable/disable AP interpretation
    - KVM: s390: CPU model support for AP virtualization
    - s390: doc: detailed specifications for AP virtualization
    - KVM: s390: fix locking for crypto setting error path
    - KVM: s390: Tracing APCB changes
    - s390: vfio-ap: setup APCB mask using KVM dedicated function
    - s390/zcrypt: Add ZAPQ inline function.
    - s390/zcrypt: Review inline assembler constraints.
    - s390/zcrypt: Integrate ap_asm.h into include/asm/ap.h.
    - s390/zcrypt: fix ap_instructions_available() returncodes
    - s390/zcrypt: remove VLA usage from the AP bus
    - s390/zcrypt: Remove deprecated ioctls.
    - s390/zcrypt: Remove deprecated zcrypt proc interface.
    - s390/zcrypt: Support up to 256 crypto adapters.
    - [Config:] Enable CONFIG_S390_AP_IOMMU and set CONFIG_VFIO_AP to module.

  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
    - mount: Retest MNT_LOCKED in do_umount
    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts

  *  CVE-2018-18955: nested user namespaces with more than five extents
    incorrectly grant privileges over inode (LP: #1801924) // CVE-2018-18955
    - userns: also map extents in the reverse map to kernel IDs

  * kdump fail due to an IRQ storm (LP: #1797990)
    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
    - SAUCE: x86/quirks: Scan all busses for early PCI quirks

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 15 Nov 2018 17:01:46 -0200

linux (4.15.0-40.43) bionic; urgency=medium

  * linux: 4.15.0-40.43 -proposed tracker (LP: #1802554)

  * crash in ENA driver on removing an interface (LP: #1802341)
    - SAUCE: net: ena: fix crash during ena_remove()

  * Ubuntu 18.04.1 - [s390x] Kernel panic while stressing network bonding
    (LP: #1797367)
    - s390/qeth: don't keep track of MAC address's cast type
    - s390/qeth: consolidate qeth MAC address helpers
    - s390/qeth: avoid using is_multicast_ether_addr_64bits on (u8 *)[6]
    - s390/qeth: remove outdated portname debug msg
    - s390/qeth: reduce hard-coded access to ccw channels
    - s390/qeth: sanitize strings in debug messages

  * [18.04 FEAT] zcrypt DD: introduce APQN tags to support deterministic driver
    binding (LP: #1799184)
    - s390/zcrypt: code beautify
    - s390/zcrypt: AP bus support for alternate driver(s)
    - s390/zcrypt: hex string mask improvements for apmask and aqmask.
    - s390/zcrypt: remove unused functions and declarations
    - s390/zcrypt: Show load of cards and queues in sysfs

  * [GLK/CLX] Enhanced IBRS (LP: #1786139)
    - x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
    - x86/speculation: Support Enhanced IBRS on future CPUs

  * Allow signed kernels to be kexec'ed under lockdown (LP: #1798441)
    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
      boot

  * Overlayfs in user namespace leaks directory content of inaccessible
    directories (LP: #1793458) // CVE-2018-6559
    - SAUCE: overlayfs: ensure mounter privileges when reading directories

  * Update ENA driver to version 2.0.1K (LP: #1798182)
    - net: ena: remove ndo_poll_controller
    - net: ena: fix warning in rmmod caused by double iounmap
    - net: ena: fix rare bug when failed restart/resume is followed by driver
      removal
    - net: ena: fix NULL dereference due to untimely napi initialization
    - net: ena: fix auto casting to boolean
    - net: ena: minor performance improvement
    - net: ena: complete host info to match latest ENA spec
    - net: ena: introduce Low Latency Queues data structures according to ENA spec
    - net: ena: add functions for handling Low Latency Queues in ena_com
    - net: ena: add functions for handling Low Latency Queues in ena_netdev
    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
    - net: ena: explicit casting and initialization, and clearer error handling
    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
    - net: ena: change rx copybreak default to reduce kernel memory pressure
    - net: ena: remove redundant parameter in ena_com_admin_init()
    - net: ena: update driver version to 2.0.1
    - net: ena: fix indentations in ena_defs for better readability
    - net: ena: Fix Kconfig dependency on X86
    - net: ena: enable Low Latency Queues
    - net: ena: fix compilation error in xtensa architecture

  * Bionic update: upstream stable patchset 2018-10-29 (LP: #1800537)
    - bonding: re-evaluate force_primary when the primary slave name changes
    - cdc_ncm: avoid padding beyond end of skb
    - ipv6: allow PMTU exceptions to local routes
    - net: dsa: add error handling for pskb_trim_rcsum
    - net/sched: act_simple: fix parsing of TCA_DEF_DATA
    - tcp: verify the checksum of the first data segment in a new connection
    - udp: fix rx queue len reported by diag and proc interface
    - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds
      vlan
    - tls: fix use-after-free in tls_push_record
    - ext4: fix hole length detection in ext4_ind_map_blocks()
    - ext4: update mtime in ext4_punch_hole even if no blocks are released
    - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget()
    - ext4: fix fencepost error in check for inode count overflow during resize
    - driver core: Don't ignore class_dir_create_and_add() failure.
    - Btrfs: fix clone vs chattr NODATASUM race
    - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2()
    - btrfs: return error value if create_io_em failed in cow_file_range
    - btrfs: scrub: Don't use inode pages for device replace
    - ALSA: hda/conexant - Add fixup for HP Z2 G4 workstation
    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
    - ALSA: hda: add dock and led support for HP ProBook 640 G4
    - x86/MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read()
    - smb3: fix various xid leaks
    - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session
      expiry
    - cifs: For SMB2 security informaion query, check for minimum sized security
      descriptor instead of sizeof FileAllInformation class
    - nbd: fix nbd device deletion
    - nbd: update size when connected
    - nbd: use bd_set_size when updating disk size
    - blk-mq: reinit q->tag_set_list entry only after grace period
    - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue
    - cpufreq: Fix new policy initialization during limits updates via sysfs
    - cpufreq: governors: Fix long idle detection logic in load calculation
    - libata: zpodd: small read overflow in eject_tray()
    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
    - x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
    - iwlwifi: fw: harden page loading code
    - orangefs: set i_size on new symlink
    - orangefs: report attributes_mask and attributes for statx
    - HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
    - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
    - net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
    - cpufreq: ti-cpufreq: Fix an incorrect error return value
    - x86/vector: Fix the args of vector_alloc tracepoint
    - x86/apic/vector: Prevent hlist corruption and leaks
    - x86/apic: Provide apic_ack_irq()
    - x86/ioapic: Use apic_ack_irq()
    - x86/platform/uv: Use apic_ack_irq()
    - irq_remapping: Use apic_ack_irq()
    - genirq/generic_pending: Do not lose pending affinity update
    - genirq/affinity: Defer affinity setting if irq chip is busy
    - genirq/migration: Avoid out of line call if pending is not set

  * [bionic]mlx5: reading SW stats through ifstat cause kernel crash
    (LP: #1799049)
    - net/mlx5e: Don't attempt to dereference the ppriv struct if not being
      eswitch manager

  * [Bionic][Cosmic]  ipmi: Fix timer race with module unload (LP: #1799281)
    - ipmi: Fix timer race with module unload

  * [Bionic] ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driver
    (LP: #1799276)
    - ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driver

  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()

  * [Bionic][Cosmic] Fix to ipmi to support vendor specific messages greater
    than 255 bytes (LP: #1799794)
    - ipmi:ssif: Add support for multi-part transmit messages > 2 parts

  * libvirtd is unable to configure bridge devices inside of LXD containers
    (LP: #1784501)
    - kernfs: allow creating kernfs objects with arbitrary uid/gid
    - sysfs, kobject: allow creating kobject belonging to arbitrary users
    - kobject: kset_create_and_add() - fetch ownership info from parent
    - driver core: set up ownership of class devices in sysfs
    - net-sysfs: require net admin in the init ns for setting tx_maxrate
    - net-sysfs: make sure objects belong to container's owner
    - net: create reusable function for getting ownership info of sysfs inodes
    - bridge: make sure objects belong to container's owner
    - sysfs: Fix regression when adding a file to an existing group

  * [Ubuntu] kvm: fix deadlock when killed by oom (LP: #1800849)
    - s390/kvm: fix deadlock when killed by oom

  * [Ubuntu] net/af_iucv: fix skb leaks for HiperTransport (LP: #1800639)
    - net/af_iucv: drop inbound packets with invalid flags
    - net/af_iucv: fix skb handling on HiperTransport xmit error

  * Power consumption during s2idle is higher than long idle(sk hynix)
    (LP: #1801875)
    - SAUCE: pci: prevent sk hynix nvme from entering D3
    - SAUCE: nvme: add quirk to not call disable function when suspending

  * Enable keyboard wakeup for S2Idle laptops (LP: #1798552)
    - Input: i8042 - enable keyboard wakeups by default when s2idle is used

  * NULL pointer dereference at 0000000000000020 when access
    dst_orig->ops->family in function  xfrm_lookup_with_ifid() (LP: #1801878)
    - xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.

  * [Ubuntu] qdio: reset old sbal_state flags (LP: #1801686)
    - s390/qdio: reset old sbal_state flags

  * hns3: map tx ring to tc (LP: #1802023)
    - net: hns3: Set tx ring' tc info when netdev is up

  * [Ubuntu] qeth: Fix potential array overrun in cmd/rc lookup (LP: #1800641)
    - s390: qeth_core_mpc: Use ARRAY_SIZE instead of reimplementing its function
    - s390: qeth: Fix potential array overrun in cmd/rc lookup

  * Vulkan applications cause permanent memory leak with Intel GPU
    (LP: #1798165)
    - drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set

  * Mounting SOFS SMB shares fails (LP: #1792580)
    - cifs: connect to servername instead of IP for IPC$ share

  * Packaging resync (LP: #1786013)
    - [Package] add support for specifying the primary makefile

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 09 Nov 2018 17:29:18 -0200

# For older changelog entries, run 'apt-get changelog linux-image-unsigned-4.15.0-50-generic'
