linux (4.4.0-108.131) xenial; urgency=low

  * linux: 4.4.0-108.131 -proposed tracker (LP: #1741727)

  * CVE-2017-5754
    - x86/mm: Disable PCID on 32-bit kernels

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Sun, 07 Jan 2018 11:46:05 -0200

linux (4.4.0-107.130) xenial; urgency=low

  * linux: 4.4.0-107.130 -proposed tracker (LP: #1741643)

  * CVE-2017-5754
    - Revert "UBUNTU: SAUCE: arch/x86/entry/vdso: temporarily disable vdso"
    - KPTI: Report when enabled
    - x86, vdso, pvclock: Simplify and speed up the vdso pvclock reader
    - x86/vdso: Get pvclock data from the vvar VMA instead of the fixmap
    - x86/kasan: Clear kasan_zero_page after TLB flush
    - kaiser: Set _PAGE_NX only if supported

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Sat, 06 Jan 2018 17:13:03 +0100

linux (4.4.0-106.129) xenial; urgency=low

  * linux: 4.4.0-106.129 -proposed tracker (LP: #1741528)

  * CVE-2017-5754
    - KAISER: Kernel Address Isolation
    - kaiser: merged update
    - kaiser: do not set _PAGE_NX on pgd_none
    - kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE
    - kaiser: fix build and FIXME in alloc_ldt_struct()
    - kaiser: KAISER depends on SMP
    - kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER
    - kaiser: fix perf crashes
    - kaiser: ENOMEM if kaiser_pagetable_walk() NULL
    - kaiser: tidied up asm/kaiser.h somewhat
    - kaiser: tidied up kaiser_add/remove_mapping slightly
    - kaiser: kaiser_remove_mapping() move along the pgd
    - kaiser: cleanups while trying for gold link
    - kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET
    - kaiser: delete KAISER_REAL_SWITCH option
    - kaiser: vmstat show NR_KAISERTABLE as nr_overhead
    - x86/mm: Enable CR4.PCIDE on supported systems
    - x86/mm: Build arch/x86/mm/tlb.c even on !SMP
    - x86/mm, sched/core: Uninline switch_mm()
    - x86/mm: Add INVPCID helpers
    - x86/mm: If INVPCID is available, use it to flush global mappings
    - kaiser: enhanced by kernel and user PCIDs
    - kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user
    - kaiser: PCID 0 for kernel and 128 for user
    - kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user
    - kaiser: paranoid_entry pass cr3 need to paranoid_exit
    - kaiser: _pgd_alloc() without __GFP_REPEAT to avoid stalls
    - kaiser: fix unlikely error in alloc_ldt_struct()
    - kaiser: add "nokaiser" boot option, using ALTERNATIVE
    - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling
    - x86/boot: Add early cmdline parsing for options with arguments
    - x86/kaiser: Check boottime cmdline params
    - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush
    - kaiser: drop is_atomic arg to kaiser_pagetable_walk()
    - kaiser: asm/tlbflush.h handle noPGE at lower level
    - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID
    - x86/paravirt: Dont patch flush_tlb_single
    - x86/kaiser: Reenable PARAVIRT
    - kaiser: disabled on Xen PV
    - x86/kaiser: Move feature detection up
    - kvm: x86: fix RSM when PCID is non-zero
    - SAUCE: arch/x86/entry/vdso: temporarily disable vdso
    - [Config]: CONFIG_KAISER=y

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 05 Jan 2018 19:53:41 +0100

linux (4.4.0-104.127) xenial; urgency=low

  * linux: 4.4.0-104.127 -proposed tracker (LP: #1737511)

  * upgrading linux-image package to 4.4.0-103.126 breaks Ceph network file
    system connection (LP: #1737033)
    - Revert "libceph: MOSDOpReply v7 encoding"
    - Revert "libceph: advertise support for TUNABLES5"
    - Revert "crush: decode and initialize chooseleaf_stable"
    - Revert "crush: add chooseleaf_stable tunable"
    - Revert "crush: ensure take bucket value is valid"
    - Revert "crush: ensure bucket id is valid before indexing buckets array"

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 11 Dec 2017 12:20:36 +0100

linux (4.4.0-103.126) xenial; urgency=low

  * linux: 4.4.0-103.126 -proposed tracker (LP: #1736181)

  * CVE-2017-1000405
    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()

  * CVE-2017-16939
    - netlink: add a start callback for starting a netlink dump
    - ipsec: Fix aborted xfrm policy dump crash

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 04 Dec 2017 16:50:53 +0100

linux (4.4.0-102.125) xenial; urgency=low

  * linux: 4.4.0-102.125 -proposed tracker (LP: #1733541)

  * tar -x sometimes fails on overlayfs (LP: #1728489)
    - ovl: check if all layers are on the same fs
    - ovl: persistent inode number for directories

  * NVMe timeout is too short (LP: #1729119)
    - nvme: update timeout module parameter type

  * Set PANIC_TIMEOUT=10 on Power Systems (LP: #1730660)
    - [Config]: Set PANIC_TIMEOUT=10 on ppc64el

  * Cannot pair BLE remote devices when using combo BT SoC (LP: #1731467)
    - Bluetooth: increase timeout for le auto connections

  * CIFS errors on 4.4.0-98, but not on 4.4.0-97 with same config (LP: #1729337)
    - SMB3: Validate negotiate request must always be signed

  * Plantronics P610 does not support sample rate reading (LP: #1719853)
    - ALSA: usb-audio: Add sample rate quirk for Plantronics P610

  * Invalid btree pointer causes the kernel NULL pointer dereference
    (LP: #1729256)
    - xfs: reinit btree pointer on attr tree inactivation walk

  * Samba mount/umount in docker container triggers kernel Oops (LP: #1729637)
    - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
    - ipv6: fix NULL dereference in ip6_route_dev_notify()

  * [kernel] tty/hvc: Use opal irqchip interface if available (LP: #1728098)
    - tty/hvc: Use opal irqchip interface if available

  * Device hotplugging with MPT SAS cannot work for VMWare ESXi (LP: #1730852)
    - scsi: mptsas: Fixup device hotplug for VMWare ESXi

  * NMI watchdog: BUG: soft lockup on Guest upon boot (KVM) (LP: #1727331)
    - KVM: PPC: Book3S: Treat VTB as a per-subcore register, not per-thread

  * Attempt to map rbd image from ceph jewel/luminous hangs (LP: #1728739)
    - crush: ensure bucket id is valid before indexing buckets array
    - crush: ensure take bucket value is valid
    - crush: add chooseleaf_stable tunable
    - crush: decode and initialize chooseleaf_stable
    - libceph: advertise support for TUNABLES5
    - libceph: MOSDOpReply v7 encoding

  * Xenial update to 4.4.98 stable release (LP: #1732698)
    - adv7604: Initialize drive strength to default when using DT
    - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
    - PCI: mvebu: Handle changes to the bridge windows while enabled
    - xen/netback: set default upper limit of tx/rx queues to 8
    - drm: drm_minor_register(): Clean up debugfs on failure
    - KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter
    - iommu/arm-smmu-v3: Clear prior settings when updating STEs
    - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4
    - ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6
    - crypto: vmx - disable preemption to enable vsx in aes_ctr.c
    - iio: trigger: free trigger resource correctly
    - phy: increase size of MII_BUS_ID_SIZE and bus_id
    - serial: sh-sci: Fix register offsets for the IRDA serial port
    - usb: hcd: initialize hcd->flags to 0 when rm hcd
    - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family
    - IPsec: do not ignore crypto err in ah4 input
    - Input: mpr121 - handle multiple bits change of status register
    - Input: mpr121 - set missing event capability
    - IB/ipoib: Change list_del to list_del_init in the tx object
    - s390/qeth: issue STARTLAN as first IPA command
    - (config) Add NET_DSA=n
    - net: dsa: select NET_SWITCHDEV
    - platform/x86: hp-wmi: Fix detection for dock and tablet mode
    - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices
    - KEYS: trusted: sanitize all key material
    - KEYS: trusted: fix writing past end of buffer in trusted_read()
    - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state
    - platform/x86: hp-wmi: Do not shadow error values
    - x86/uaccess, sched/preempt: Verify access_ok() context
    - workqueue: Fix NULL pointer dereference
    - crypto: x86/sha1-mb - fix panic due to unaligned access
    - KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]
    - ARM: 8720/1: ensure dump_instr() checks addr_limit
    - ALSA: seq: Fix OSS sysex delivery in OSS emulation
    - ALSA: seq: Avoid invalid lockdep class warning
    - MIPS: microMIPS: Fix incorrect mask in insn_table_MM
    - MIPS: Fix CM region target definitions
    - MIPS: SMP: Use a completion event to signal CPU up
    - MIPS: Fix race on setting and getting cpu_online_mask
    - MIPS: SMP: Fix deadlock & online race
    - test: firmware_class: report errors properly on failure
    - selftests: firmware: add empty string and async tests
    - selftests: firmware: send expected errors to /dev/null
    - tools: firmware: check for distro fallback udev cancel rule
    - MIPS: AR7: Defer registration of GPIO
    - MIPS: AR7: Ensure that serial ports are properly set up
    - Input: elan_i2c - add ELAN060C to the ACPI table
    - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
    - rbd: use GFP_NOIO for parent stat and data requests
    - can: sun4i: handle overrun in RX FIFO
    - can: c_can: don't indicate triple sampling support for D_CAN
    - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context
    - PKCS#7: fix unitialized boolean 'want'
    - Linux 4.4.98

  * ELANTECH Touchpad is not detected in 'Lenovo Ideapad 320 14AST' after fresh
    install (LP: #1727544)
    - Input: elan_i2c - add ELAN060C to the ACPI table

  * Xenial update to 4.4.97 stable release (LP: #1731915)
    - ALSA: timer: Add missing mutex lock for compat ioctls
    - ALSA: seq: Fix nested rwsem annotation for lockdep splat
    - cifs: check MaxPathNameComponentLength != 0 before using it
    - KEYS: return full count in keyring_read() if buffer is too small
    - KEYS: fix out-of-bounds read during ASN.1 parsing
    - ASoC: adau17x1: Workaround for noise bug in ADC
    - arm64: ensure __dump_instr() checks addr_limit
    - ARM: dts: mvebu: pl310-cache disable double-linefill
    - ARM: 8715/1: add a private asm/unaligned.h
    - ocfs2: fstrim: Fix start offset of first cluster group during fstrim
    - perf tools: Fix build failure on perl script context
    - drm/msm: Fix potential buffer overflow issue
    - drm/msm: fix an integer overflow test
    - tracing/samples: Fix creation and deletion of simple_thread_fn creation
    - Fix tracing sample code warning.
    - PM / wakeirq: report a wakeup_event on dedicated wekup irq
    - mmc: s3cmci: include linux/interrupt.h for tasklet_struct
    - ARM: pxa: Don't rely on public mmc header to include leds.h
    - mfd: ab8500-sysctrl: Handle probe deferral
    - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped
    - staging: rtl8712u: Fix endian settings for structs describing network
      packets
    - ext4: fix stripe-unaligned allocations
    - ext4: do not use stripe_width if it is not set
    - i2c: riic: correctly finish transfers
    - drm/amdgpu: when dpm disabled, also need to stop/start vce.
    - perf tools: Only increase index if perf_evsel__new_idx() succeeds
    - cx231xx: Fix I2C on Internal Master 3 Bus
    - xen/manage: correct return value check on xenbus_scanf()
    - scsi: aacraid: Process Error for response I/O
    - platform/x86: intel_mid_thermal: Fix module autoload
    - staging: lustre: llite: don't invoke direct_IO for the EOF case
    - staging: lustre: hsm: stack overrun in hai_dump_data_field
    - staging: lustre: ptlrpc: skip lock if export failed
    - exynos4-is: fimc-is: Unmap region obtained by of_iomap()
    - mei: return error on notification request to a disconnected client
    - s390/dasd: check for device error pointer within state change interrupts
    - bt8xx: fix memory leak
    - xen: don't print error message in case of missing Xenstore entry
    - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c
    - Linux 4.4.97

  * Xenial update to 4.4.96 stable release (LP: #1731882)
    - workqueue: replace pool->manager_arb mutex with a flag
    - ALSA: hda/realtek - Add support for ALC236/ALC3204
    - ALSA: hda - fix headset mic problem for Dell machines with alc236
    - ceph: unlock dangling spinlock in try_flush_caps()
    - usb: xhci: Handle error condition in xhci_stop_device()
    - spi: uapi: spidev: add missing ioctl header
    - fuse: fix READDIRPLUS skipping an entry
    - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
    - Input: elan_i2c - add ELAN0611 to the ACPI table
    - Input: gtco - fix potential out-of-bound access
    - assoc_array: Fix a buggy node-splitting case
    - scsi: zfcp: fix erp_action use-before-initialize in REC action trace
    - scsi: sg: Re-fix off by one in sg_fill_request_table()
    - can: sun4i: fix loopback mode
    - can: kvaser_usb: Correct return value in printout
    - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages
    - regulator: fan53555: fix I2C device ids
    - x86/microcode/intel: Disable late loading on model 79
    - ecryptfs: fix dereference of NULL user_key_payload
    - Revert "drm: bridge: add DT bindings for TI ths8135"
    - Linux 4.4.96

  * Touchpad not detected - Lenovo ideapad 320-15IKB (LP: #1723736)
    - Input: elan_i2c - add ELAN0611 to the ACPI table

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 21 Nov 2017 15:37:52 +0100

linux (4.4.0-101.124) xenial; urgency=low

  * linux: 4.4.0-101.124 -proposed tracker (LP: #1731264)

  * s390/mm: fix write access check in gup_huge_pmd() (LP: #1730596)
    - s390/mm: fix write access check in gup_huge_pmd()

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 10 Nov 2017 08:24:10 -0200

linux (4.4.0-100.123) xenial; urgency=low

  * linux: 4.4.0-100.123 -proposed tracker (LP: #1729273)

  * Xenial update to 4.4.95 stable release (LP: #1729107)
    - USB: devio: Revert "USB: devio: Don't corrupt user memory"
    - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
    - USB: serial: metro-usb: add MS7820 device id
    - usb: cdc_acm: Add quirk for Elatec TWN3
    - usb: quirks: add quirk for WORLDE MINI MIDI keyboard
    - usb: hub: Allow reset retry for USB2 devices on connect bounce
    - ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital
    - can: gs_usb: fix busy loop if no more TX context is available
    - usb: musb: sunxi: Explicitly release USB PHY on exit
    - usb: musb: Check for host-mode using is_host_active() on reset interrupt
    - can: esd_usb2: Fix can_dlc value for received RTR, frames
    - drm/nouveau/bsp/g92: disable by default
    - drm/nouveau/mmu: flush tlbs before deleting page tables
    - ALSA: seq: Enable 'use' locking in all configurations
    - ALSA: hda: Remove superfluous '-' added by printk conversion
    - i2c: ismt: Separate I2C block read from SMBus block read
    - brcmsmac: make some local variables 'static const' to reduce stack size
    - bus: mbus: fix window size calculation for 4GB windows
    - clockevents/drivers/cs5535: Improve resilience to spurious interrupts
    - rtlwifi: rtl8821ae: Fix connection lost problem
    - KEYS: encrypted: fix dereference of NULL user_key_payload
    - lib/digsig: fix dereference of NULL user_key_payload
    - KEYS: don't let add_key() update an uninstantiated key
    - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set.
    - parisc: Avoid trashing sr2 and sr3 in LWS code
    - parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels
    - sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task()
    - f2fs crypto: replace some BUG_ON()'s with error checks
    - f2fs crypto: add missing locking for keyring_key access
    - fscrypt: fix dereference of NULL user_key_payload
    - KEYS: Fix race between updating and finding a negative key
    - fscrypto: require write access to mount to set encryption policy
    - FS-Cache: fix dereference of NULL user_key_payload
    - Linux 4.4.95

  * Xenial update to 4.4.94 stable release (LP: #1729105)
    - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
    - drm/dp/mst: save vcpi with payloads
    - MIPS: Fix minimum alignment requirement of IRQ stack
    - sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
    - bpf/verifier: reject BPF_ALU64|BPF_END
    - udpv6: Fix the checksum computation when HW checksum does not apply
    - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
    - net: emac: Fix napi poll list corruption
    - packet: hold bind lock when rebinding to fanout hook
    - bpf: one perf event close won't free bpf program attached by another perf
      event
    - isdn/i4l: fetch the ppp_write buffer in one shot
    - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
    - l2tp: Avoid schedule while atomic in exit_net
    - l2tp: fix race condition in l2tp_tunnel_delete
    - tun: bail out from tun_get_user() if the skb is empty
    - packet: in packet_do_bind, test fanout with bind_lock held
    - packet: only test po->has_vnet_hdr once in packet_snd
    - net: Set sk_prot_creator when cloning sockets to the right proto
    - tipc: use only positive error codes in messages
    - Revert "bsg-lib: don't free job in bsg_prepare_job"
    - locking/lockdep: Add nest_lock integrity test
    - watchdog: kempld: fix gcc-4.3 build
    - irqchip/crossbar: Fix incorrect type of local variables
    - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length
    - mac80211: fix power saving clients handling in iwlwifi
    - net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
    - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.
    - iio: adc: xilinx: Fix error handling
    - Btrfs: send, fix failure to rename top level inode due to name collision
    - f2fs: do not wait for writeback in write_begin
    - md/linear: shutup lockdep warnning
    - sparc64: Migrate hvcons irq to panicked cpu
    - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new
      probed PFs
    - crypto: xts - Add ECB dependency
    - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock
    - slub: do not merge cache if slub_debug contains a never-merge flag
    - scsi: scsi_dh_emc: return success in clariion_std_inquiry()
    - net: mvpp2: release reference to txq_cpu[] entry after unmapping
    - i2c: at91: ensure state is restored after suspending
    - ceph: clean up unsafe d_parent accesses in build_dentry_path
    - uapi: fix linux/rds.h userspace compilation errors
    - uapi: fix linux/mroute6.h userspace compilation errors
    - target/iscsi: Fix unsolicited data seq_end_offset calculation
    - nfsd/callback: Cleanup callback cred on shutdown
    - cpufreq: CPPC: add ACPI_PROCESSOR dependency
    - Revert "tty: goldfish: Fix a parameter of a call to free_irq"
    - Linux 4.4.94

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Wed, 01 Nov 2017 16:54:28 -0200

linux (4.4.0-99.122) xenial; urgency=low

  * linux: 4.4.0-99.122 -proposed tracker (LP: #1728945)

  * Remove vmbus-rdma driver from Xenial kernel (LP: #1721538)
    - SAUCE: remove hv_network_direct driver
    - [Config]: Remove hv_network_direct driver

  * usb 3-1: 2:1: cannot get freq at ep 0x1 (LP: #1708499)
    - ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M

  * Plantronics Blackwire C520-M - Cannot get freq at ep 0x1, 0x81
    (LP: #1709282)
    - ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M

  * wait-for-root fails to detect nbd root (LP: #696435)
    - nbd: Create size change events for userspace

  * Fix OpenNSL GPL bugs found by CoverityScan static analysis (LP: #1718388)
    - SAUCE: opennsl: bcm-knet: check for null sinfo to avoid a null pointer
      dereference
    - SAUCE: opennsl: bcm-knet: remove redundant null checks on dev->name
    - SAUCE: opennsl: bde: check for out-of-bounds index io.dev

  * HID: multitouch: Correct ALPS PTP Stick and Touchpad devices ID
    (LP: #1722719)
    - Revert "HID: multitouch: Support ALPS PTP stick with pid 0x120A"

  * Xenial update to 4.4.93 stable release (LP: #1724836)
    - brcmfmac: add length check in brcmf_cfg80211_escan_handler()
    - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
    - CIFS: Reconnect expired SMB sessions
    - nl80211: Define policy for packet pattern attributes
    - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
    - rcu: Allow for page faults in NMI handlers
    - USB: dummy-hcd: Fix deadlock caused by disconnect detection
    - MIPS: math-emu: Remove pr_err() calls from fpu_emu()
    - dmaengine: edma: Align the memcpy acnt array size with the transfer
    - HID: usbhid: fix out-of-bounds bug
    - crypto: shash - Fix zero-length shash ahash digest crash
    - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
    - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
    - iommu/amd: Finish TLB flush in amd_iommu_unmap()
    - ALSA: usb-audio: Kill stray URB at exiting
    - ALSA: seq: Fix use-after-free at creating a port
    - ALSA: seq: Fix copy_from_user() call inside lock
    - ALSA: caiaq: Fix stray URB at probe error path
    - ALSA: line6: Fix leftover URB at error-path during probe
    - usb: gadget: composite: Fix use-after-free in
      usb_composite_overwrite_options
    - direct-io: Prevent NULL pointer access in submit_page_section
    - fix unbalanced page refcounting in bio_map_user_iov
    - USB: serial: ftdi_sio: add id for Cypress WICED dev board
    - USB: serial: cp210x: add support for ELV TFD500
    - USB: serial: option: add support for TP-Link LTE module
    - Revert "UBUNTU: SAUCE: USB: serial: qcserial: add Dell DW5818, DW5819"
    - USB: serial: qcserial: add Dell DW5818, DW5819
    - USB: serial: console: fix use-after-free after failed setup
    - x86/alternatives: Fix alt_max_short macro to really be a max()
    - Linux 4.4.93

  * NULL pointer dereference in tty_write() in kernel 4.4.0-93.116+
    (LP: #1721065)
    - tty: Prepare for destroying line discipline on hangup

  * Xenial update to 4.4.92 stable release (LP: #1724783)
    - usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write
    - USB: gadgetfs: Fix crash caused by inadequate synchronization
    - USB: gadgetfs: fix copy_to_user while holding spinlock
    - usb: gadget: udc: atmel: set vbus irqflags explicitly
    - usb-storage: unusual_devs entry to fix write-access regression for Seagate
      external drives
    - usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
    - usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
    - usb: pci-quirks.c: Corrected timeout values used in handshake
    - USB: dummy-hcd: fix connection failures (wrong speed)
    - USB: dummy-hcd: fix infinite-loop resubmission bug
    - USB: dummy-hcd: Fix erroneous synchronization change
    - USB: devio: Don't corrupt user memory
    - usb: gadget: mass_storage: set msg_registered after msg registered
    - USB: g_mass_storage: Fix deadlock when driver is unbound
    - lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
    - ALSA: compress: Remove unused variable
    - ALSA: usx2y: Suppress kernel warning at page allocation failures
    - driver core: platform: Don't read past the end of "driver_override" buffer
    - Drivers: hv: fcopy: restore correct transfer length
    - stm class: Fix a use-after-free
    - ftrace: Fix kmemleak in unregister_ftrace_graph
    - HID: i2c-hid: allocate hid buffers for real worst case
    - iwlwifi: add workaround to disable wide channels in 5GHz
    - scsi: sd: Do not override max_sectors_kb sysfs setting
    - USB: uas: fix bug in handling of alternate settings
    - USB: core: harden cdc_parse_cdc_header
    - usb: Increase quirk delay for USB devices
    - USB: fix out-of-bounds in usb_set_configuration
    - xhci: fix finding correct bus_state structure for USB 3.1 hosts
    - iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
    - iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path
      of 'twl4030_madc_probe()'
    - iio: ad_sigma_delta: Implement a dedicated reset function
    - staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma
      from stack.
    - iio: core: Return error for failed read_reg
    - iio: ad7793: Fix the serial interface reset
    - iio: adc: mcp320x: Fix readout of negative voltages
    - iio: adc: mcp320x: Fix oops on module unload
    - uwb: properly check kthread_run return value
    - uwb: ensure that endpoint is interrupt
    - brcmfmac: setup passive scan if requested by user-space
    - drm/i915/bios: ignore HDMI on port A
    - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
    - ext4: fix data corruption for mmap writes
    - ext4: Don't clear SGID when inheriting ACLs
    - ext4: don't allow encrypted operations without keys
    - Linux 4.4.92

  * Xenial update to 4.4.91 stable release (LP: #1724772)
    - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
    - drm: bridge: add DT bindings for TI ths8135
    - GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
    - RDS: RDMA: Fix the composite message user notification
    - ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
    - MIPS: Ensure bss section ends on a long-aligned address
    - MIPS: ralink: Fix incorrect assignment on ralink_soc
    - igb: re-assign hw address pointer on reset after PCI error
    - extcon: axp288: Use vbus-valid instead of -present to determine cable
      presence
    - sh_eth: use correct name for ECMR_MPDE bit
    - hwmon: (gl520sm) Fix overflows and crash seen when writing into limit
      attributes
    - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
    - iio: adc: hx711: Add DT binding for avia,hx711
    - ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
    - tty: goldfish: Fix a parameter of a call to free_irq
    - IB/ipoib: Fix deadlock over vlan_mutex
    - IB/ipoib: rtnl_unlock can not come after free_netdev
    - IB/ipoib: Replace list_del of the neigh->list with list_del_init
    - drm/amdkfd: fix improper return value on error
    - USB: serial: mos7720: fix control-message error handling
    - USB: serial: mos7840: fix control-message error handling
    - partitions/efi: Fix integer overflow in GPT size calculation
    - ASoC: dapm: handle probe deferrals
    - audit: log 32-bit socketcalls
    - usb: chipidea: vbus event may exist before starting gadget
    - ASoC: dapm: fix some pointer error handling
    - MIPS: Lantiq: Fix another request_mem_region() return code check
    - net: core: Prevent from dereferencing null pointer when releasing SKB
    - net/packet: check length in getsockopt() called with PACKET_HDRLEN
    - team: fix memory leaks
    - usb: plusb: Add support for PL-27A1
    - mmc: sdio: fix alignment issue in struct sdio_func
    - bridge: netlink: register netdevice before executing changelink
    - netfilter: invoke synchronize_rcu after set the _hook_ to NULL
    - MIPS: IRQ Stack: Unwind IRQ stack onto task stack
    - exynos-gsc: Do not swap cb/cr for semi planar formats
    - netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
    - parisc: perf: Fix potential NULL pointer dereference
    - iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
    - rds: ib: add error handle
    - md/raid10: submit bio directly to replacement disk
    - i2c: meson: fix wrong variable usage in meson_i2c_put_data
    - xfs: remove kmem_zalloc_greedy
    - libata: transport: Remove circular dependency at free time
    - drivers: firmware: psci: drop duplicate const from psci_of_match
    - IB/qib: fix false-postive maybe-uninitialized warning
    - ARM: remove duplicate 'const' annotations'
    - ALSA: au88x0: avoid theoretical uninitialized access
    - ttpci: address stringop overflow warning
    - Linux 4.4.91

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 31 Oct 2017 11:49:30 -0200

linux (4.4.0-98.121) xenial; urgency=low

  * linux: 4.4.0-98.121 -proposed tracker (LP: #1722299)

  * Controller lockup detected on ProLiant DL380 Gen9 with P440 Controller
    (LP: #1720359)
    - scsi: hpsa: limit transfer length to 1MB

  * [Dell Docking IE][0bda:8153] Realtek USB Ethernet leads to system hang
    (LP: #1720977)
    - r8152: fix the list rx_done may be used without initialization

  * Add installer support for Broadcom BCM573xx network drivers. (LP: #1720466)
    - d-i: Add bnxt_en to nic-modules.

  * snapcraft.yaml: add dpkg-dev to the build deps (LP: #1718886)
    - snapcraft.yaml: add dpkg-dev to the build deps

  * Support setting I2C_TIMEOUT via ioctl for i2c-designware (LP: #1718578)
    - i2c: designware: Use transfer timeout from ioctl I2C_TIMEOUT

  * 5U84 - ses driver isn't binding right - cannot blink lights on 1 of the 2
    5u84 (LP: #1693369)
    - scsi_transport_sas: add function to get SAS endpoint address
    - ses: fix discovery of SATA devices in SAS enclosures
    - scsi: sas: provide stub implementation for scsi_is_sas_rphy
    - scsi: ses: Fix SAS device detection in enclosure

  * multipath -ll is not showing the disks which are actually multipath
    (LP: #1718397)
    - fs: aio: fix the increment of aio-nr and counting against aio-max-nr

  * Support Dell Wireless DW5819/5818 WWAN devices (LP: #1721455)
    - SAUCE: USB: serial: qcserial: add Dell DW5818, DW5819

  * CVE-2017-10911
    - xen-blkback: don't leak stack data via response ring

  * implement 'complain mode' in seccomp for developer mode with snaps
    (LP: #1567597)
    - seccomp: Provide matching filter for introspection
    - seccomp: Sysctl to display available actions
    - seccomp: Operation for checking if an action is available
    - seccomp: Sysctl to configure actions that are allowed to be logged
    - seccomp: Selftest for detection of filter flag support
    - seccomp: Action to log before allowing

  * implement errno action logging in seccomp for strict mode with snaps
    (LP: #1721676)
    - seccomp: Provide matching filter for introspection
    - seccomp: Sysctl to display available actions
    - seccomp: Operation for checking if an action is available
    - seccomp: Sysctl to configure actions that are allowed to be logged
    - seccomp: Selftest for detection of filter flag support
    - seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW

  * [Xenial] update OpenNSL kernel modules to 6.5.10 (LP: #1721511)
    - SAUCE: update OpenNSL kernel modules to 6.5.10

  * Xenial update to 4.4.90 stable release (LP: #1721550)
    - cifs: release auth_key.response for reconnect.
    - mac80211: flush hw_roc_start work before cancelling the ROC
    - KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()
    - tracing: Fix trace_pipe behavior for instance traces
    - tracing: Erase irqsoff trace with empty write
    - md/raid5: fix a race condition in stripe batch
    - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
    - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse
      nlmsg properly
    - crypto: talitos - Don't provide setkey for non hmac hashing algs.
    - crypto: talitos - fix sha224
    - KEYS: fix writing past end of user-supplied buffer in keyring_read()
    - KEYS: prevent creating a different user's keyrings
    - KEYS: prevent KEYCTL_READ on negative key
    - powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
    - Fix SMB3.1.1 guest authentication to Samba
    - SMB: Validate negotiate (to protect against downgrade) even if signing off
    - SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags
    - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
    - nl80211: check for the required netlink attributes presence
    - bsg-lib: don't free job in bsg_prepare_job
    - seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
    - arm64: Make sure SPsel is always set
    - arm64: fault: Route pte translation faults via do_translation_fault
    - KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
    - kvm: nVMX: Don't allow L2 to access the hardware CR8
    - PCI: Fix race condition with driver_override
    - btrfs: fix NULL pointer dereference from free_reloc_roots()
    - btrfs: propagate error to btrfs_cmp_data_prepare caller
    - btrfs: prevent to set invalid default subvolid
    - x86/fpu: Don't let userspace set bogus xcomp_bv
    - gfs2: Fix debugfs glocks dump
    - timer/sysclt: Restrict timer migration sysctl values to 0 and 1
    - KVM: VMX: do not change SN bit in vmx_update_pi_irte()
    - KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt
    - cxl: Fix driver use count
    - dmaengine: mmp-pdma: add number of requestors
    - ARM: pxa: add the number of DMA requestor lines
    - ARM: pxa: fix the number of DMA requestor lines
    - KVM: VMX: use cmpxchg64
    - video: fbdev: aty: do not leak uninitialized padding in clk to userspace
    - swiotlb-xen: implement xen_swiotlb_dma_mmap callback
    - fix xen_swiotlb_dma_mmap prototype
    - Linux 4.4.90

  * Xenial update to 4.4.89 stable release (LP: #1721477)
    - ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
    - ipv6: add rcu grace period before freeing fib6_node
    - ipv6: fix sparse warning on rt6i_node
    - qlge: avoid memcpy buffer overflow
    - Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
    - Revert "net: use lib/percpu_counter API for fragmentation mem accounting"
    - Revert "net: fix percpu memory leaks"
    - gianfar: Fix Tx flow control deactivation
    - ipv6: fix memory leak with multiple tables during netns destruction
    - ipv6: fix typo in fib6_net_exit()
    - f2fs: check hot_data for roll-forward recovery
    - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps
    - md/raid5: release/flush io in raid5_do_work()
    - nfsd: Fix general protection fault in release_lock_stateid()
    - mm: prevent double decrease of nr_reserved_highatomic
    - tty: improve tty_insert_flip_char() fast path
    - tty: improve tty_insert_flip_char() slow path
    - tty: fix __tty_insert_flip_char regression
    - Input: i8042 - add Gigabyte P57 to the keyboard reset table
    - MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN propagation
    - MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of both inputs zero
    - MIPS: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative
    - MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite
      signs
    - MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both infinite inputs
    - MIPS: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs
    - crypto: AF_ALG - remove SGL terminator indicator when chaining
    - ext4: fix incorrect quotaoff if the quota feature is enabled
    - ext4: fix quota inconsistency during orphan cleanup for read-only mounts
    - powerpc: Fix DAR reporting when alignment handler faults
    - block: Relax a check in blk_start_queue()
    - md/bitmap: disable bitmap_resize for file-backed bitmaps.
    - skd: Avoid that module unloading triggers a use-after-free
    - skd: Submit requests to firmware before triggering the doorbell
    - scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled
    - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path
    - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records
    - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA
    - scsi: zfcp: fix missing trace records for early returns in TMF eh handlers
    - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records
    - scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late
      response
    - scsi: zfcp: trace high part of "new" 64 bit SCSI LUN
    - scsi: megaraid_sas: Check valid aen class range to avoid kernel panic
    - scsi: megaraid_sas: Return pended IOCTLs with cmd_status
      MFI_STAT_WRONG_STATE in case adapter is dead
    - scsi: storvsc: fix memory leak on ring buffer busy
    - scsi: sg: remove 'save_scat_len'
    - scsi: sg: use standard lists for sg_requests
    - scsi: sg: off by one in sg_ioctl()
    - scsi: sg: factor out sg_fill_request_table()
    - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE
    - scsi: qla2xxx: Fix an integer overflow in sysfs code
    - ftrace: Fix selftest goto location on error
    - tracing: Apply trace_clock changes to instance max buffer
    - ARC: Re-enable MMU upon Machine Check exception
    - PCI: shpchp: Enable bridge bus mastering if MSI is enabled
    - media: v4l2-compat-ioctl32: Fix timespec conversion
    - media: uvcvideo: Prevent heap overflow when accessing mapped controls
    - bcache: initialize dirty stripes in flash_dev_run()
    - bcache: Fix leak of bdev reference
    - bcache: do not subtract sectors_to_gc for bypassed IO
    - bcache: correct cache_dirty_target in __update_writeback_rate()
    - bcache: Correct return value for sysfs attach errors
    - bcache: fix for gc and write-back race
    - bcache: fix bch_hprint crash and improve output
    - ftrace: Fix memleak when unregistering dynamic ops when tracing disabled
    - Linux 4.4.89

  * ETPS/2 Elantech Touchpad inconsistently detected (Gigabyte P57W laptop)
    (LP: #1594214)
    - Input: i8042 - add Gigabyte P57 to the keyboard reset table

  * Xenial update to 4.4.88 stable release (LP: #1718195)
    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
    - USB: serial: option: add support for D-Link DWM-157 C1
    - usb: Add device quirk for Logitech HD Pro Webcam C920-C
    - usb:xhci:Fix regression when ATI chipsets detected
    - USB: core: Avoid race of async_completed() w/ usbdev_release()
    - staging/rts5208: fix incorrect shift to extract upper nybble
    - driver core: bus: Fix a potential double free
    - intel_th: pci: Add Cannon Lake PCH-H support
    - intel_th: pci: Add Cannon Lake PCH-LP support
    - ath10k: fix memory leak in rx ring buffer allocation
    - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
    - Bluetooth: Add support of 13d3:3494 RTL8723BE device
    - dlm: avoid double-free on error path in dlm_device_{register,unregister}
    - mwifiex: correct channel stat buffer overflows
    - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
    - workqueue: Fix flag collision
    - cs5536: add support for IDE controller variant
    - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
    - scsi: sg: recheck MMAP_IO request length with lock held
    - drm: adv7511: really enable interrupts for EDID detection
    - drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
    - drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq
      context
    - drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
    - drm/bridge: adv7511: Re-write the i2c address before EDID probing
    - btrfs: resume qgroup rescan on rw remount
    - locktorture: Fix potential memory leak with rw lock test
    - ALSA: msnd: Optimize / harden DSP and MIDI loops
    - ARM: 8692/1: mm: abort uaccess retries upon fatal signal
    - NFS: Fix 2 use after free issues in the I/O code
    - xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
    - Linux 4.4.88

  * Kernel has troule recognizing Corsair Strafe RGB keyboard (LP: #1678477)
    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 10 Oct 2017 08:52:24 -0300

# For older changelog entries, run 'apt-get changelog linux-tools-common'
