linux-aws (4.4.0-1044.47) trusty; urgency=medium


  [ Ubuntu: 4.4.0-148.174 ]

  * CVE-2018-12126 // CVE-2018-12127 // CVE-2018-12130
    - Documentation/l1tf: Fix small spelling typo
    - perf/x86/intel: Add model number for Skylake Server to perf
    - perf/x86: Add model numbers for Kabylake CPUs
    - perf/x86/intel: Use Intel family macros for core perf events
    - perf/x86/msr: Use Intel family macros for MSR events code
    - perf/x86/msr: Add missing Intel models
    - SAUCE: perf/x86/{cstate,rapl,uncore}: Use Intel Model name macros
    - perf/x86/msr: Add missing CPU IDs
    - x86/speculation: Simplify the CPU bug detection logic
    - x86/cpu: Sanitize FAM6_ATOM naming
    - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
    - bitops: avoid integer overflow in GENMASK(_ULL)
    - locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a
      new <linux/bits.h> file
    - tools include: Adopt linux/bits.h
    - x86/msr-index: Cleanup bit defines
    - x86/speculation: Consolidate CPU whitelists
    - x86/speculation/mds: Add basic bug infrastructure for MDS
    - x86/speculation/mds: Add BUG_MSBDS_ONLY
    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
    - x86/speculation/mds: Add mds_clear_cpu_buffers()
    - locking/static_keys: Provide DECLARE and well as DEFINE macros
    - x86/speculation/mds: Clear CPU buffers on exit to user
    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
    - SAUCE: sched/smt: Introduce sched_smt_{active,present}
    - SAUCE: Rename the Ubuntu-only spec_ctrl_mutex mutex
    - SAUCE: x86/speculation: Introduce arch_smt_update()
    - x86/speculation: Rework SMT state change
    - x86/speculation: Reorder the spec_v2 code
    - x86/speculation: Unify conditional spectre v2 print functions
    - x86/speculation/mds: Add mitigation control for MDS
    - x86/speculation/mds: Add sysfs reporting for MDS
    - x86/speculation/mds: Add mitigation mode VMWERV
    - Documentation: Move L1TF to separate directory
    - Documentation: Add MDS vulnerability documentation
    - x86/speculation/mds: Add mds=full,nosmt cmdline option
    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
    - x86/speculation/mds: Add SMT warning message
    - x86/speculation/mds: Fix comment
    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
    - x86/speculation/mds: Add 'mitigations=' support for MDS
  * CVE-2017-5715 // CVE-2017-5753
    - s390/speculation: Support 'mitigations=' cmdline option
  * CVE-2017-5715 // CVE-2017-5753 // CVE-2017-5754 // CVE-2018-3639
    - powerpc/speculation: Support 'mitigations=' cmdline option
  * CVE-2017-5715 // CVE-2017-5754 // CVE-2018-3620 // CVE-2018-3639 //
    CVE-2018-3646
    - cpu/speculation: Add 'mitigations=' cmdline option
    - x86/speculation: Support 'mitigations=' cmdline option
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 08 May 2019 20:17:36 +0200

linux-aws (4.4.0-1043.46) trusty; urgency=medium

  * linux-aws: 4.4.0-1043.46 -proposed tracker (LP: #1826034)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

  [ Ubuntu: 4.4.0-147.173 ]

  * linux: 4.4.0-147.173 -proposed tracker (LP: #1826036)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
  * Xenial: Sync to upstream v4.9 (Spectre) (LP: #1820872)
    - SAUCE: cpu/hotplug: Fix Documentation/kernel-parameters.txt
    - SAUCE: Fix typo in Documentation/kernel-parameters.txt
    - SAUCE: x86: Move hunks and sync to upstream stable 4.9
    - Revert "module: Add retpoline tag to VERMAGIC"
  * CVE-2017-5753
    - posix-timers: Protect posix clock array access against speculation
    - arm64: fix possible spectre-v1 in ptrace_hbp_get_event()
    - sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
    - media: dvb_ca_en50221: prevent using slot_info for Spectre attacs
    - s390/keyboard: sanitize array index in do_kdsk_ioctl
    - arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
    - pktcdvd: Fix possible Spectre-v1 for pkt_devs
    - net: socket: Fix potential spectre v1 gadget in sock_is_registered
    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
    - hwmon: (nct6775) Fix potential Spectre v1
    - mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom
    - nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
    - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities
    - powerpc/ptrace: Mitigate potential Spectre v1
    - cfg80211: prevent speculation on cfg80211_classify8021d() return
    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
    - ALSA: seq: oss: Fix Spectre v1 vulnerability
  * CVE-2019-3874
    - sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
    - sctp: use sk_wmem_queued to check for writable space
    - sctp: implement memory accounting on tx path
    - sctp: implement memory accounting on rx path
  * Kprobe event argument syntax in ftrace from ubuntu_kernel_selftests failed
    on B PowerPC (LP: #1812809)
    - selftests/ftrace: Add ppc support for kprobe args tests
  * CVE-2019-3882
    - vfio/type1: Limit DMA mappings per container
  * Intel I210 Ethernet card not working after hotplug [8086:1533]
    (LP: #1818490)
    - igb: Fix WARN_ONCE on runtime suspend
  * TSC clocksource not available in nested guests (LP: #1822821)
    - x86/tsc: Add X86_FEATURE_TSC_KNOWN_FREQ flag
    - kvmclock: fix TSC calibration for nested guests
  * Remove btrfs module after a failed fallocate attempt will cause error on 4.4
    i386 (LP: #1822579)
    - Btrfs: fix extent map leak during fallocate error path
  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
    6db23a14" on Cosmic i386 (LP: #1813244) // systemd cause kernel trace "BUG:
    unable to handle kernel paging request at 6db23a14" on Cosmic i386
    (LP: #1813244)
    - openvswitch: fix flow actions reallocation

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 07 May 2019 12:14:55 +0200

linux-aws (4.4.0-1042.45) trusty; urgency=medium

  * linux-aws: 4.4.0-1042.45 -proposed tracker (LP: #1824775)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

  * Please ship the ib_uverbs driver module in the main modules package
    (LP: #1822692)
    - [config] AWS: ib_uverbs.ko, ib_umad.ko moved to linux-modules package

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 17 Apr 2019 20:30:18 -0400

linux-aws (4.4.0-1041.44) trusty; urgency=medium

  * linux-aws: 4.4.0-1041.44 -proposed tracker (LP: #1822832)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

  [ Ubuntu: 4.4.0-146.172 ]

  * linux: 4.4.0-146.172 -proposed tracker (LP: #1822834)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction
  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
    triggers system hang on i386 (LP: #1812845)
    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()
  * Xenial update: 4.4.177 upstream stable release (LP: #1822271)
    - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
    - numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
    - KEYS: allow reaching the keys quotas exactly
    - mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
    - mfd: twl-core: Fix section annotations on {,un}protect_pm_master
    - mfd: db8500-prcmu: Fix some section annotations
    - mfd: ab8500-core: Return zero in get_register_interruptible()
    - mfd: qcom_rpm: write fw_version to CTRL_REG
    - mfd: wm5110: Add missing ASRC rate register
    - mfd: mc13xxx: Fix a missing check of a register-read failure
    - net: hns: Fix use after free identified by SLUB debug
    - MIPS: ath79: Enable OF serial ports in the default config
    - scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
    - scsi: isci: initialize shost fully before calling scsi_add_host()
    - MIPS: jazz: fix 64bit build
    - isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
    - atm: he: fix sign-extension overflow on large shift
    - leds: lp5523: fix a missing check of return value of lp55xx_read
    - isdn: avm: Fix string plus integer warning from Clang
    - RDMA/srp: Rework SCSI device reset handling
    - KEYS: user: Align the payload buffer
    - KEYS: always initialize keyring_index_key::desc_len
    - batman-adv: fix uninit-value in batadv_interface_tx()
    - net/packet: fix 4gb buffer limit due to overflow check
    - team: avoid complex list operations in team_nl_cmd_options_set()
    - sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
    - net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
    - ARCv2: Enable unaligned access in early ASM code
    - Revert "bridge: do not add port to router list when receives query with
      source 0.0.0.0"
    - libceph: handle an empty authorize reply
    - drm/msm: Unblock writer if reader closes file
    - ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
    - ALSA: compress: prevent potential divide by zero bugs
    - thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
    - usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
    - usb: gadget: Potential NULL dereference on allocation error
    - ASoC: dapm: change snprintf to scnprintf for possible overflow
    - ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
    - ARC: fix __ffs return value to avoid build warnings
    - mac80211: fix miscounting of ttl-dropped frames
    - serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
    - scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
    - net: altera_tse: fix connect_local_phy error path
    - ibmveth: Do not process frames after calling napi_reschedule
    - mac80211: don't initiate TDLS connection if station is not associated to AP
    - cfg80211: extend range deviation for DMG
    - KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting
      to L1
    - arm/arm64: KVM: Feed initialized memory to MMIO accesses
    - KVM: arm/arm64: Fix MMIO emulation data handling
    - powerpc: Always initialize input array when calling epapr_hypercall()
    - mmc: spi: Fix card detection during probe
    - x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
    - USB: serial: option: add Telit ME910 ECM composition
    - USB: serial: cp210x: add ID for Ingenico 3070
    - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
    - cpufreq: Use struct kobj_attribute instead of struct global_attr
    - sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
    - ncpfs: fix build warning of strncpy
    - isdn: isdn_tty: fix build warning of strncpy
    - staging: lustre: fix buffer overflow of string buffer
    - net-sysfs: Fix mem leak in netdev_register_kobject
    - team: Free BPF filter when unregistering netdev
    - bnxt_en: Drop oversize TX packets to prevent errors.
    - net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
    - xen-netback: fix occasional leak of grant ref mappings under memory pressure
    - net: Add __icmp_send helper.
    - net: avoid use IPCB in cipso_v4_error
    - net: phy: Micrel KSZ8061: link failure after cable connect
    - x86/CPU/AMD: Set the CPB bit unconditionally on F17h
    - applicom: Fix potential Spectre v1 vulnerabilities
    - MIPS: irq: Allocate accurate order pages for irq stack
    - hugetlbfs: fix races and page leaks during migration
    - netlabel: fix out-of-bounds memory accesses
    - net: dsa: mv88e6xxx: Fix u64 statistics
    - ip6mr: Do not call __IP6_INC_STATS() from preemptible context
    - media: uvcvideo: Fix 'type' check leading to overflow
    - vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
    - perf tools: Handle TOPOLOGY headers with no CPU
    - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
    - ipvs: Fix signed integer overflow when setsockopt timeout
    - iommu/amd: Fix IOMMU page flush when detach device from a domain
    - xtensa: SMP: fix ccount_timer_shutdown
    - xtensa: SMP: fix secondary CPU initialization
    - xtensa: smp_lx200_defconfig: fix vectors clash
    - xtensa: SMP: mark each possible CPU as present
    - xtensa: SMP: limit number of possible CPUs by NR_CPUS
    - net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
    - net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
    - net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
    - gpio: vf610: Mask all GPIO interrupts
    - nfs: Fix NULL pointer dereference of dev_name
    - scsi: libfc: free skb when receiving invalid flogi resp
    - platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
    - cifs: fix computation for MAX_SMB2_HDR_SIZE
    - x86/kexec: Don't setup EFI info if EFI runtime is not enabled
    - x86_64: increase stack size for KASAN_EXTRA
    - mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
    - mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
    - fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
    - autofs: drop dentry reference only when it is never used
    - autofs: fix error return in autofs_fill_super()
    - ARM: pxa: ssp: unneeded to free devm_ allocated data
    - irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
    - dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
    - dmaengine: dmatest: Abort test in case of mapping error
    - s390/qeth: fix use-after-free in error path
    - perf symbols: Filter out hidden symbols from labels
    - MIPS: Remove function size check in get_frame_info()
    - Input: wacom_serial4 - add support for Wacom ArtPad II tablet
    - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
    - iscsi_ibft: Fix missing break in switch statement
    - futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
    - ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
    - Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
    - ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on
      Exynos5420
    - udplite: call proper backlog handlers
    - netfilter: x_tables: enforce nul-terminated table name from getsockopt
      GET_ENTRIES
    - netfilter: nfnetlink_log: just returns error for unknown command
    - netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
    - netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP
      options
    - KEYS: restrict /proc/keys by credentials at open time
    - l2tp: fix infoleak in l2tp_ip6_recvmsg()
    - net: hsr: fix memory leak in hsr_dev_finalize()
    - net: sit: fix UBSAN Undefined behaviour in check_6rd
    - net/x25: fix use-after-free in x25_device_event()
    - net/x25: reset state in x25_connect()
    - pptp: dst_release sk_dst_cache in pptp_sock_destruct
    - ravb: Decrease TxFIFO depth of Q3 and Q2 to one
    - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
    - tcp: handle inet_csk_reqsk_queue_add() failures
    - net/mlx4_core: Fix reset flow when in command polling mode
    - net/mlx4_core: Fix qp mtt size calculation
    - net/x25: fix a race in x25_bind()
    - mdio_bus: Fix use-after-free on device_register fails
    - net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
    - missing barriers in some of unix_sock ->addr and ->path accesses
    - ipvlan: disallow userns cap_net_admin to change global mode/flags
    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
    - vxlan: Fix GRO cells race condition between receive and link delete
    - net/hsr: fix possible crash in add_timer()
    - gro_cells: make sure device is up in gro_cells_receive()
    - tcp/dccp: remove reqsk_put() from inet_child_forget()
    - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against
      Liquid Saffire 56
    - fs/9p: use fscache mutex rather than spinlock
    - It's wrong to add len to sector_nr in raid10 reshape twice
    - media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
    - 9p: use inode->i_lock to protect i_size_write() under 32-bit
    - 9p/net: fix memory leak in p9_client_create
    - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
    - stm class: Fix an endless loop in channel allocation
    - crypto: caam - fixed handling of sg list
    - crypto: ahash - fix another early termination in hash walk
    - gpu: ipu-v3: Fix i.MX51 CSI control registers offset
    - gpu: ipu-v3: Fix CSI offsets for imx53
    - s390/dasd: fix using offset into zero size array error
    - ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be
      uninitialized
    - Input: matrix_keypad - use flush_delayed_work()
    - i2c: cadence: Fix the hold bit setting
    - Input: st-keyscan - fix potential zalloc NULL dereference
    - ARM: 8824/1: fix a migrating irq bug when hotplug cpu
    - assoc_array: Fix shortcut creation
    - net: systemport: Fix reception of BPDUs
    - pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
    - net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
    - ASoC: topology: free created components in tplg load error
    - arm64: Relax GIC version check during early boot
    - tmpfs: fix link accounting when a tmpfile is linked in
    - ARC: uacces: remove lp_start, lp_end from clobber list
    - phonet: fix building with clang
    - mac80211_hwsim: propagate genlmsg_reply return code
    - net: set static variable an initial value in atl2_probe()
    - tmpfs: fix uninitialized return value in shmem_link
    - stm class: Prevent division by zero
    - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
    - CIFS: Fix read after write for files with read caching
    - tracing: Do not free iter->trace in fail path of tracing_open_pipe()
    - ACPI / device_sysfs: Avoid OF modalias creation for removed device
    - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
    - regulator: s2mpa01: Fix step values for some LDOs
    - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
    - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
    - s390/virtio: handle find on invalid queue gracefully
    - scsi: virtio_scsi: don't send sc payload with tmfs
    - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
    - m68k: Add -ffreestanding to CFLAGS
    - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
    - Btrfs: fix corruption reading shared and compressed extents after hole
      punching
    - crypto: pcbc - remove bogus memcpy()s with src == dest
    - cpufreq: tegra124: add missing of_node_put()
    - cpufreq: pxa2xx: remove incorrect __init annotation
    - ext4: fix crash during online resizing
    - ext2: Fix underflow in ext2_max_size()
    - clk: ingenic: Fix round_rate misbehaving with non-integer dividers
    - dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
    - mm/vmalloc: fix size check for remap_vmalloc_range_partial()
    - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
    - intel_th: Don't reference unassigned outputs
    - parport_pc: fix find_superio io compare code, should use equal test.
    - i2c: tegra: fix maximum transfer size
    - perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
    - serial: 8250_pci: Fix number of ports for ACCES serial cards
    - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954
      chip use the pci_pericom_setup()
    - jbd2: clear dirty flag when revoking a buffer from an older transaction
    - jbd2: fix compile warning when using JBUFFER_TRACE
    - powerpc/32: Clear on-stack exception marker upon exception return
    - powerpc/wii: properly disable use of BATs when requested.
    - powerpc/powernv: Make opal log only readable by root
    - powerpc/83xx: Also save/restore SPRG4-7 during suspend
    - ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
    - dm: fix to_sector() for 32bit
    - NFS41: pop some layoutget errors to application
    - perf intel-pt: Fix CYC timestamp calculation after OVF
    - perf auxtrace: Define auxtrace record alignment
    - perf intel-pt: Fix overlap calculation for padding
    - md: Fix failed allocation of md_register_thread
    - NFS: Fix an I/O request leakage in nfs_do_recoalesce
    - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
    - nfsd: fix memory corruption caused by readdir
    - nfsd: fix wrong check in write_v4_end_grace()
    - PM / wakeup: Rework wakeup source timer cancellation
    - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
    - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
    - drm/radeon/evergreen_cs: fix missing break in switch statement
    - KVM: nVMX: Sign extend displacements of VMX instr's mem operands
    - KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
    - KVM: X86: Fix residual mmio emulation request to userspace
    - Linux 4.4.177
  * sky2 ethernet card doesn't work after returning from suspend
    (LP: #1807259) // sky2 ethernet card link not up after suspend
    (LP: #1809843) // Xenial update: 4.4.177 upstream stable release
    (LP: #1822271)
    - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
    - lib/fonts/Kconfig: keep non-Sparc fonts listed together
    - Fonts: New Terminus large console font
    - [Config]: enable highdpi Terminus 16x32 font support
  * Hard lockup in 2 CPUs due to deadlock in cpu_stoppers (LP: #1821259)
    - stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock
    - stop_machine: Disable preemption when waking two stopper threads
    - stop_machine: Disable preemption after queueing stopper threads
    - stop_machine: Atomically queue and wake stopper threads

  [ Ubuntu: 4.4.0-145.171 ]

  * linux: 4.4.0-145.171 -proposed tracker (LP: #1821724)
  * linux-generic should depend on linux-base >=4.1 (LP: #1820419)
    - [Packaging] Fix linux-base dependency

 -- Connor Kuehl <connor.kuehl@canonical.com>  Tue, 09 Apr 2019 09:57:37 -0700

linux-aws (4.4.0-1040.43) trusty; urgency=medium

  * linux-aws: 4.4.0-1040.43 -proposed tracker (LP: #1819658)

  *  CONFIG_CIFS_POSIX=y needs to added to trusty/aws kernel config
    (LP: #1820158)
    - Revert "UBUNTU: [Config] Remove CONFIG_CIFS_POSIX=y"

  [ Ubuntu: 4.4.0-144.170 ]

  * linux: 4.4.0-144.170 -proposed tracker (LP: #1819660)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction
  * C++ demangling support missing from perf (LP: #1396654)
    - [Packaging] fix a mistype
  * CVE-2019-9213
    - mm: enforce min addr even if capable() in expand_downwards()
  * CVE-2019-3460
    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
  * Xenial update: 4.4.176 upstream stable release (LP: #1818815)
    - net: fix IPv6 prefix route residue
    - vsock: cope with memory allocation failure at socket creation time
    - hwmon: (lm80) Fix missing unlock on error in set_fan_div()
    - net: Fix for_each_netdev_feature on Big endian
    - net: Add header for usage of fls64()
    - tcp: tcp_v4_err() should be more careful
    - net: Do not allocate page fragments that are not skb aligned
    - tcp: clear icsk_backoff in tcp_write_queue_purge()
    - vxlan: test dev->flags & IFF_UP before calling netif_rx()
    - net: stmmac: Fix a race in EEE enable callback
    - net: ipv4: use a dedicated counter for icmp_v4 redirect packets
    - x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32
    - mfd: as3722: Handle interrupts on suspend
    - mfd: as3722: Mark PM functions as __maybe_unused
    - net/x25: do not hold the cpu too long in x25_new_lci()
    - mISDN: fix a race in dev_expire_timer()
    - ax25: fix possible use-after-free
    - Linux 4.4.176
  * sky2 ethernet card don't work after returning from suspension
    (LP: #1798921) // Xenial update: 4.4.176 upstream stable release
    (LP: #1818815)
    - sky2: Increase D3 delay again
  * Xenial update: 4.4.175 upstream stable release (LP: #1818813)
    - drm/bufs: Fix Spectre v1 vulnerability
    - staging: iio: adc: ad7280a: handle error from __ad7280_read32()
    - ASoC: Intel: mrfld: fix uninitialized variable access
    - scsi: lpfc: Correct LCB RJT handling
    - ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
    - dlm: Don't swamp the CPU with callbacks queued during recovery
    - x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
    - powerpc/pseries: add of_node_put() in dlpar_detach_node()
    - serial: fsl_lpuart: clear parity enable bit when disable parity
    - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
    - staging:iio:ad2s90: Make probe handle spi_setup failure
    - staging: iio: ad7780: update voltage on read
    - ARM: OMAP2+: hwmod: Fix some section annotations
    - modpost: validate symbol names also in find_elf_symbol
    - perf tools: Add Hygon Dhyana support
    - soc/tegra: Don't leak device tree node reference
    - f2fs: move dir data flush to write checkpoint process
    - f2fs: fix wrong return value of f2fs_acl_create
    - sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
    - nfsd4: fix crash on writing v4_end_grace before nfsd startup
    - arm64: ftrace: don't adjust the LR value
    - ARM: dts: mmp2: fix TWSI2
    - x86/fpu: Add might_fault() to user_insn()
    - media: DaVinci-VPBE: fix error handling in vpbe_initialize()
    - smack: fix access permissions for keyring
    - usb: hub: delay hub autosuspend if USB3 port is still link training
    - timekeeping: Use proper seqcount initializer
    - ARM: dts: Fix OMAP4430 SDP Ethernet startup
    - mips: bpf: fix encoding bug for mm_srlv32_op
    - iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
    - sata_rcar: fix deferred probing
    - clk: imx6sl: ensure MMDC CH0 handshake is bypassed
    - cpuidle: big.LITTLE: fix refcount leak
    - i2c-axxia: check for error conditions first
    - udf: Fix BUG on corrupted inode
    - ARM: pxa: avoid section mismatch warning
    - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
    - memstick: Prevent memstick host from getting runtime suspended during card
      detection
    - tty: serial: samsung: Properly set flags in autoCTS mode
    - arm64: KVM: Skip MMIO insn after emulation
    - powerpc/uaccess: fix warning/error with access_ok()
    - mac80211: fix radiotap vendor presence bitmap handling
    - xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
    - Bluetooth: Fix unnecessary error message for HCI request completion
    - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
    - drbd: narrow rcu_read_lock in drbd_sync_handshake
    - drbd: disconnect, if the wrong UUIDs are attached on a connected peer
    - drbd: skip spurious timeout (ping-timeo) when failing promote
    - drbd: Avoid Clang warning about pointless switch statment
    - video: clps711x-fb: release disp device node in probe()
    - fbdev: fbmem: behave better with small rotated displays and many CPUs
    - fbdev: fbcon: Fix unregister crash when more than one framebuffer
    - KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
    - NFS: nfs_compare_mount_options always compare auth flavors.
    - hwmon: (lm80) fix a missing check of the status of SMBus read
    - hwmon: (lm80) fix a missing check of bus read in lm80 probe
    - seq_buf: Make seq_buf_puts() null-terminate the buffer
    - crypto: ux500 - Use proper enum in cryp_set_dma_transfer
    - crypto: ux500 - Use proper enum in hash_set_dma_transfer
    - cifs: check ntwrk_buf_start for NULL before dereferencing it
    - um: Avoid marking pages with "changed protection"
    - niu: fix missing checks of niu_pci_eeprom_read
    - scripts/decode_stacktrace: only strip base path when a prefix of the path
    - ocfs2: don't clear bh uptodate for block read
    - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in
      HFCPCI_l1hw()
    - gdrom: fix a memory leak bug
    - block/swim3: Fix -EBUSY error when re-opening device after unmount
    - HID: lenovo: Add checks to fix of_led_classdev_register
    - kernel/hung_task.c: break RCU locks based on jiffies
    - fs/epoll: drop ovflist branch prediction
    - exec: load_script: don't blindly truncate shebang string
    - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
    - test_hexdump: use memcpy instead of strncpy
    - tipc: use destination length for copy string
    - string: drop __must_check from strscpy() and restore strscpy() usages in
      cgroup
    - dccp: fool proof ccid_hc_[rt]x_parse_options()
    - enic: fix checksum validation for IPv6
    - net: dp83640: expire old TX-skb
    - skge: potential memory corruption in skge_get_regs()
    - net: systemport: Fix WoL with password after deep sleep
    - net: dsa: slave: Don't propagate flag changes on down slave interfaces
    - ALSA: compress: Fix stop handling on compressed capture streams
    - ALSA: hda - Serialize codec registrations
    - fuse: call pipe_buf_release() under pipe lock
    - fuse: decrement NR_WRITEBACK_TEMP on the right page
    - fuse: handle zero sized retrieve correctly
    - dmaengine: imx-dma: fix wrong callback invoke
    - usb: phy: am335x: fix race condition in _probe
    - usb: gadget: udc: net2272: Fix bitwise and boolean operations
    - perf/x86/intel/uncore: Add Node ID mask
    - x86/MCE: Initialize mce.bank in the case of a fatal error in
      mce_no_way_out()
    - perf/core: Don't WARN() for impossible ring-buffer sizes
    - perf tests evsel-tp-sched: Fix bitwise operator
    - mtd: rawnand: gpmi: fix MX28 bus master lockup problem
    - signal: Always notice exiting tasks
    - signal: Better detection of synchronous signals
    - misc: vexpress: Off by one in vexpress_syscfg_exec()
    - debugfs: fix debugfs_rename parameter checking
    - mips: cm: reprime error cause
    - MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
    - MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds
    - ARM: iop32x/n2100: fix PCI IRQ mapping
    - mac80211: ensure that mgmt tx skbs have tailroom for encryption
    - drm/modes: Prevent division by zero htotal
    - drm/vmwgfx: Fix setting of dma masks
    - drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
    - HID: debug: fix the ring buffer implementation
    - NFC: nxp-nci: Include unaligned.h instead of access_ok.h
    - Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure
      cifs)"
    - Revert "UBUNTU: [Config] Remove CONFIG_CIFS_POSIX=y"
    - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
    - xfrm: refine validation of template and selector families
    - batman-adv: Avoid WARN on net_device without parent in netns
    - batman-adv: Force mac header to start of data on xmit
    - Revert "exec: load_script: don't blindly truncate shebang string"
    - uapi/if_ether.h: prevent redefinition of struct ethhdr
    - ARM: dts: da850-evm: Correct the sound card name
    - ARM: dts: kirkwood: Fix polarity of GPIO fan lines
    - gpio: pl061: handle failed allocations
    - cifs: Limit memory used by lock request calls to a page
    - Documentation/network: reword kernel version reference
    - Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
    - Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
    - perf/core: Fix impossible ring-buffer sizes warning
    - ALSA: hda - Add quirk for HP EliteBook 840 G5
    - ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
    - Input: bma150 - register input device after setting private data
    - Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
    - alpha: fix page fault handling for r16-r18 targets
    - alpha: Fix Eiger NR_IRQS to 128
    - tracing/uprobes: Fix output for multiple string arguments
    - x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
    - signal: Restore the stop PTRACE_EVENT_EXIT
    - x86/a.out: Clear the dump structure initially
    - dm thin: fix bug where bio that overwrites thin block ignores FUA
    - smsc95xx: Use skb_cow_head to deal with cloned skbs
    - ch9200: use skb_cow_head() to deal with cloned skbs
    - kaweth: use skb_cow_head() to deal with cloned skbs
    - usb: dwc2: Remove unnecessary kfree
    - pinctrl: msm: fix gpio-hog related boot issues
    - uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define
    - Linux 4.4.175
  * Xenial update: 4.4.174 upstream stable release (LP: #1818806)
    - inet: frags: change inet_frags_init_net() return value
    - inet: frags: add a pointer to struct netns_frags
    - inet: frags: refactor ipfrag_init()
    - inet: frags: refactor ipv6_frag_init()
    - inet: frags: refactor lowpan_net_frag_init()
    - rhashtable: add rhashtable_lookup_get_insert_key()
    - rhashtable: Add rhashtable_lookup()
    - rhashtable: add schedule points
    - inet: frags: use rhashtables for reassembly units
    - net: ieee802154: 6lowpan: fix frag reassembly
    - ipfrag: really prevent allocation on netns exit
    - inet: frags: remove some helpers
    - inet: frags: get rif of inet_frag_evicting()
    - inet: frags: remove inet_frag_maybe_warn_overflow()
    - inet: frags: break the 2GB limit for frags storage
    - inet: frags: do not clone skb in ip_expire()
    - ipv6: frags: rewrite ip6_expire_frag_queue()
    - rhashtable: reorganize struct rhashtable layout
    - inet: frags: reorganize struct netns_frags
    - inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
    - inet: frags: fix ip6frag_low_thresh boundary
    - ip: discard IPv4 datagrams with overlapping segments.
    - net: modify skb_rbtree_purge to return the truesize of all purged skbs.
    - ipv6: defrag: drop non-last frags smaller than min mtu
    - net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
    - ip: use rb trees for IP frag queue.
    - ip: add helpers to process in-order fragments faster.
    - ip: process in-order fragments efficiently
    - ip: frags: fix crash in ip_do_fragment()
    - ipv4: frags: precedence bug in ip_expire()
    - inet: frags: better deal with smp races
    - net: fix pskb_trim_rcsum_slow() with odd trim offset
    - net: ipv4: do not handle duplicate fragments as overlapping
    - rcu: Force boolean subscript for expedited stall warnings
    - Linux 4.4.174
  * Xenial update: 4.4.173 upstream stable release (LP: #1818803)
    - net: Fix usage of pskb_trim_rcsum
    - openvswitch: Avoid OOB read when parsing flow nlattrs
    - net: ipv4: Fix memory leak in network namespace dismantle
    - net_sched: refetch skb protocol for each filter
    - net: bridge: Fix ethernet header pointer before check skb forwardable
    - USB: serial: simple: add Motorola Tetra TPG2200 device id
    - USB: serial: pl2303: add new PID to support PL2303TB
    - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
    - ARC: perf: map generic branches to correct hardware condition
    - s390/early: improve machine detection
    - s390/smp: fix CPU hotplug deadlock with CPU rescan
    - char/mwave: fix potential Spectre v1 vulnerability
    - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
    - tty: Handle problem if line discipline does not have receive_buf
    - tty/n_hdlc: fix __might_sleep warning
    - CIFS: Fix possible hang during async MTU reads and writes
    - Input: xpad - add support for SteelSeries Stratus Duo
    - KVM: x86: Fix single-step debugging
    - x86/kaslr: Fix incorrect i8254 outb() parameters
    - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by
      removing it
    - can: bcm: check timer values before ktime conversion
    - vt: invoke notifier on screen size change
    - perf unwind: Unwind with libdw doesn't take symfs into account
    - perf unwind: Take pgoff into account when reporting elf to libdwfl
    - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
    - arm64: mm: remove page_mapping check in __sync_icache_dcache
    - f2fs: read page index before freeing
    - Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in
      loop_control_ioctl()"
    - Revert "loop: Get rid of loop_index_mutex"
    - Revert "loop: Fold __loop_release into loop_release"
    - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
    - fs: add the fsnotify call to vfs_iter_write
    - ipv6: Consider sk_bound_dev_if when binding a socket to an address
    - l2tp: copy 4 more bytes to linear part if necessary
    - net/mlx4_core: Add masking for a few queries on HCA caps
    - netrom: switch to sock timer API
    - net/rose: fix NULL ax25_cb kernel panic
    - ucc_geth: Reset BQL queue when stopping device
    - l2tp: remove l2specific_len dependency in l2tp_core
    - l2tp: fix reading optional fields of L2TPv3
    - CIFS: Do not count -ENODATA as failure for query directory
    - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
    - ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
    - arm64: hyp-stub: Forbid kprobing of the hyp-stub
    - gfs2: Revert "Fix loop in gfs2_rbm_find"
    - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
    - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
    - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
    - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
    - mm, oom: fix use-after-free in oom_kill_process
    - cifs: Always resolve hostname before reconnecting
    - drivers: core: Remove glue dirs from sysfs earlier
    - mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
    - fs: don't scan the inode cache before SB_BORN is set
    - Linux 4.4.173
  * Xenial update: 4.4.172 upstream stable release (LP: #1818797)
    - tty/ldsem: Wake up readers after timed out down_write()
    - can: gw: ensure DLC boundaries after CAN frame modification
    - f2fs: clean up argument of recover_data
    - f2fs: cover more area with nat_tree_lock
    - f2fs: move sanity checking of cp into get_valid_checkpoint
    - f2fs: fix to convert inline directory correctly
    - f2fs: give -EINVAL for norecovery and rw mount
    - f2fs: remove an obsolete variable
    - f2fs: factor out fsync inode entry operations
    - f2fs: fix inode cache leak
    - f2fs: fix to avoid reading out encrypted data in page cache
    - f2fs: not allow to write illegal blkaddr
    - f2fs: avoid unneeded loop in build_sit_entries
    - f2fs: use crc and cp version to determine roll-forward recovery
    - f2fs: introduce get_checkpoint_version for cleanup
    - f2fs: put directory inodes before checkpoint in roll-forward recovery
    - f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack
    - f2fs: detect wrong layout
    - f2fs: free meta pages if sanity check for ckpt is failed
    - f2fs: fix race condition in between free nid allocator/initializer
    - f2fs: return error during fill_super
    - f2fs: check blkaddr more accuratly before issue a bio
    - f2fs: sanity check on sit entry
    - f2fs: enhance sanity_check_raw_super() to avoid potential overflow
    - f2fs: clean up with is_valid_blkaddr()
    - f2fs: introduce and spread verify_blkaddr
    - f2fs: fix to do sanity check with secs_per_zone
    - f2fs: fix to do sanity check with user_block_count
    - f2fs: Add sanity_check_inode() function
    - f2fs: fix to do sanity check with node footer and iblocks
    - f2fs: fix to do sanity check with reserved blkaddr of inline inode
    - f2fs: fix to do sanity check with block address in main area
    - f2fs: fix to do sanity check with block address in main area v2
    - f2fs: fix to do sanity check with cp_pack_start_sum
    - f2fs: fix invalid memory access
    - f2fs: fix missing up_read
    - f2fs: fix validation of the block count in sanity_check_raw_super
    - media: em28xx: Fix misplaced reset of dev->v4l::field_count
    - arm64/kvm: consistently handle host HCR_EL2 flags
    - arm64: Don't trap host pointer auth use to EL2
    - ipv6: fix kernel-infoleak in ipv6_local_error()
    - net: bridge: fix a bug on using a neighbour cache entry without checking its
      state
    - packet: Do not leak dev refcounts on error exit
    - ip: on queued skb use skb_header_pointer instead of pskb_may_pull
    - crypto: authencesn - Avoid twice completion call in decrypt path
    - crypto: authenc - fix parsing key with misaligned rta_len
    - btrfs: wait on ordered extents on abort cleanup
    - Yama: Check for pid death before checking ancestry
    - scsi: sd: Fix cache_type_store()
    - mips: fix n32 compat_ipc_parse_version
    - mfd: tps6586x: Handle interrupts on suspend
    - Disable MSI also when pcie-octeon.pcie_disable on
    - omap2fb: Fix stack memory disclosure
    - media: vivid: fix error handling of kthread_run
    - media: vivid: set min width/height to a value > 0
    - LSM: Check for NULL cred-security on free
    - media: vb2: vb2_mmap: move lock up
    - sunrpc: handle ENOMEM in rpcb_getport_async
    - selinux: fix GPF on invalid policy
    - sctp: allocate sctp_sockaddr_entry with kzalloc
    - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats
    - tipc: fix uninit-value in tipc_nl_compat_bearer_enable
    - tipc: fix uninit-value in tipc_nl_compat_link_set
    - tipc: fix uninit-value in tipc_nl_compat_name_table_dump
    - tipc: fix uninit-value in tipc_nl_compat_doit
    - block/loop: Use global lock for ioctl() operation.
    - loop: Fold __loop_release into loop_release
    - loop: Get rid of loop_index_mutex
    - loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()
    - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
    - media: vb2: be sure to unlock mutex on errors
    - r8169: Add support for new Realtek Ethernet
    - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address
    - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
    - platform/x86: asus-wmi: Tell the EC the OS will handle the display off
      hotkey
    - e1000e: allow non-monotonic SYSTIM readings
    - writeback: don't decrement wb->refcnt if !wb->bdi
    - MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur
    - arm64: perf: set suppress_bind_attrs flag to true
    - jffs2: Fix use of uninitialized delayed_work, lockdep breakage
    - pstore/ram: Do not treat empty buffers as valid
    - powerpc/pseries/cpuidle: Fix preempt warning
    - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info
    - net: call sk_dst_reset when set SO_DONTROUTE
    - scsi: target: use consistent left-aligned ASCII INQUIRY data
    - clk: imx6q: reset exclusive gates on init
    - kconfig: fix file name and line number of warn_ignored_character()
    - kconfig: fix memory leak when EOF is encountered in quotation
    - mmc: atmel-mci: do not assume idle after atmci_request_end
    - perf intel-pt: Fix error with config term "pt=0"
    - perf svghelper: Fix unchecked usage of strncpy()
    - perf parse-events: Fix unchecked usage of strncpy()
    - dm kcopyd: Fix bug causing workqueue stalls
    - dm snapshot: Fix excessive memory usage and workqueue stalls
    - ALSA: bebob: fix model-id of unit for Apogee Ensemble
    - sysfs: Disable lockdep for driver bind/unbind files
    - scsi: megaraid: fix out-of-bound array accesses
    - ocfs2: fix panic due to unrecovered local alloc
    - mm/page-writeback.c: don't break integrity writeback on ->writepage() error
    - mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps
    - net: speed up skb_rbtree_purge()
    - ipmi:ssif: Fix handling of multi-part return messages
    - Linux 4.4.172
  * Xenial update: 4.4.171 upstream stable release (LP: #1818237)
    - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
    - btrfs: cleanup, stop casting for extent_map->lookup everywhere
    - btrfs: Enhance chunk validation check
    - Btrfs: add validadtion checks for chunk loading
    - Btrfs: check inconsistence between chunk and block group
    - Btrfs: fix em leak in find_first_block_group
    - Btrfs: detect corruption when non-root leaf has zero item
    - Btrfs: check btree node's nritems
    - Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
    - Btrfs: memset to avoid stale content in btree node block
    - Btrfs: improve check_node to avoid reading corrupted nodes
    - Btrfs: kill BUG_ON in run_delayed_tree_ref
    - Btrfs: memset to avoid stale content in btree leaf
    - Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
    - btrfs: struct-funcs, constify readers
    - btrfs: Refactor check_leaf function for later expansion
    - btrfs: Check if item pointer overlaps with the item itself
    - btrfs: Add sanity check for EXTENT_DATA when reading out leaf
    - btrfs: Add checker for EXTENT_CSUM
    - btrfs: Move leaf and node validation checker to tree-checker.c
    - btrfs: tree-checker: Enhance btrfs_check_node output
    - btrfs: tree-checker: Fix false panic for sanity test
    - btrfs: tree-checker: Add checker for dir item
    - btrfs: tree-checker: use %zu format string for size_t
    - btrfs: tree-check: reduce stack consumption in check_dir_item
    - btrfs: tree-checker: Verify block_group_item
    - btrfs: tree-checker: Detect invalid and empty essential trees
    - btrfs: validate type when reading a chunk
    - btrfs: Check that each block group has corresponding chunk at mount time
    - btrfs: Verify that every chunk has corresponding block group at mount time
    - btrfs: tree-checker: Check level for leaves and nodes
    - btrfs: tree-checker: Fix misleading group system information
    - CIFS: Do not hide EINTR after sending network packets
    - cifs: Fix potential OOB access of lock element array
    - usb: cdc-acm: send ZLP for Telit 3G Intel based modems
    - USB: storage: don't insert sane sense for SPC3+ when bad sense specified
    - USB: storage: add quirk for SMI SM3350
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
    - slab: alien caches must not be initialized if the allocation of the alien
      cache failed
    - PCI: altera: Fix altera_pcie_link_is_up()
    - PCI: altera: Reorder read/write functions
    - PCI: altera: Check link status before retrain link
    - PCI: altera: Poll for link up status after retraining the link
    - PCI: altera: Poll for link training status after retraining the link
    - PCI: altera: Rework config accessors for use without a struct pci_bus
    - PCI: altera: Move retrain from fixup to altera_pcie_host_init()
    - ACPI: power: Skip duplicate power resource references in _PRx
    - i2c: dev: prevent adapter retries and timeout being set as minus value
    - crypto: cts - fix crash on short inputs
    - ext4: fix a potential fiemap/page fault deadlock w/ inline_data
    - sunrpc: use-after-free in svc_process_common()
    - Linux 4.4.171
  * [Packaging] Allow overlay of config annotations (LP: #1752072)
    - [Packaging] config-check: Add an include directive
  * CVE-2018-9517
    - l2tp: pass tunnel pointer to ->session_create()
  * squashfs hardening (LP: #1816756)
    - squashfs metadata 2: electric boogaloo
    - Squashfs: Compute expected length from inode size rather than block length
  * Update ENA driver to version 2.0.3K (LP: #1816806)
    - net: ena: update driver version from 2.0.2 to 2.0.3
    - net: ena: fix race between link up and device initalization
    - net: ena: fix crash during failed resume from hibernation
  * bnxt_en_po: TX timed out triggering Netdev Watchdog Timer (LP: #1814095)
    - SAUCE: bnxt_en_bpo: Fix TX timeout during netpoll
  * CVE-2019-3459
    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
  * CVE-2019-7222
    - KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  * CVE-2019-7221
    - KVM: nVMX: unconditionally cancel preemption timer in free_nested
      (CVE-2019-7221)
  * CVE-2019-6974
    - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
  * Regular D-state processes impacting LXD containers (LP: #1817628)
    - mm: do not stall register_shrinker()
  * libsas disks can have non-unique by-path names (LP: #1817784)
    - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  * Hard lockups due to unrestricted lapic timer delay (LP: #1817918)
    - KVM: x86: move nsec_to_cycles from x86.c to x86.h
    - KVM: LAPIC: cap __delay at lapic_timer_advance_ns

 -- Khalid Elmously <khalid.elmously@canonical.com>  Thu, 21 Mar 2019 00:49:32 -0400

linux-aws (4.4.0-1039.42) trusty; urgency=medium

  * linux-aws: 4.4.0-1039.42 -proposed tracker (LP: #1814648)

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] drop redundant = from define statements
    - [Config] resync flavour-control.stub

  * Xenial update: 4.4.169 upstream stable release (LP: #1811252)
    - [Config] aws: Remove CONFIG_CIFS_POSIX=y

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  [ Ubuntu: 4.4.0-143.169 ]

  * linux: 4.4.0-143.169 -proposed tracker (LP: #1814647)
  * x86/kvm: Backport fixup and missing commits (LP: #1811646)
    - KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID
    - kvm: nVMX: VMCLEAR an active shadow VMCS after last use
    - X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
    - KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR
      path as unlikely()
    - kvm: x86: IA32_ARCH_CAPABILITIES is always supported
    - KVM: SVM: Add MSR-based feature support for serializing LFENCE
    - KVM: X86: Allow userspace to define the microcode version
    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
    - kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
    - kvm: vmx: Scrub hardware GPRs at VM-exit
    - SAUCE: [Fix] x86/KVM/VMX: Add L1D flush logic
    - SAUCE: KVM: Move code fragments, cleanup and re-indent
  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] limit preparation to linux-libc-dev in headers
    - [Packaging] commonise debhelper invocation
    - [Packaging] ABI -- accumulate abi information at the end of the build
    - [Packaging] buildinfo -- add basic build information
    - [Packaging] buildinfo -- add firmware information to the flavour ABI
    - [Packaging] buildinfo -- add compiler information to the flavour ABI
    - [Packaging] buildinfo -- add buildinfo support to getabis
    - [Config] buildinfo -- add retpoline version markers
    - [Packaging] getabis -- handle all known package combinations
    - [Packaging] getabis -- support parsing a simple version
  * signing: only install a signed kernel (LP: #1764794)
    - [Packaging] update to Debian like control scripts
    - [Packaging] switch to triggers for postinst.d postrm.d handling
    - [Packaging] signing -- switch to raw-signing tarballs
    - [Packaging] signing -- switch to linux-image as signed when available
    - [Packaging] printenv -- add signing options
    - [Packaging] fix invocation of header postinst hooks
    - [Packaging] signing -- add support for signing Opal kernel binaries
    - [Debian] Use src_pkg_name when constructing udeb control files
    - [Debian] Dynamically determine linux udebs package name
    - [Packaging] handle both linux-lts* and linux-hwe* as backports
    - [Config] linux-source-* is in the primary linux namespace
    - [Packaging] lookup the upstream tag
    - [Packaging] zfs/spl -- enhance provides information
    - [Packaging] switch up to debhelper 9
    - [Packaging] autopkgtest -- disable d-i when dropping flavours
    - [debian] support for ship_extras_package=false
    - [Debian] do_common_tools should always be on
    - [debian] do not force do_tools_common
    - [Packaging] Add linux-tools-host package for VM host tools
    - [Packaging] signing should be conditional
    - [Packaging] skip cloud tools packaging when not building package
    - [Packaging] add acpidbg
    - [debian] prep linux-libc-dev only if do_libc_dev_package=true
    - [Packaging] Only install cloud init files when do_tools_common=true
  * Redpine: Driver crash with network-manager 1.10 and above (LP: #1813869)
    - SAUCE: Redpine: enhancement for MAC spoofing to avoid kernel crash
  * Guests using IBRS incur a large performance penalty (LP: #1764956)
    - SAUCE: Restore the IBRS host state on VMEXIT
  * Xenial update: 4.4.170 upstream stable release (LP: #1811647)
    - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
    - xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
    - USB: serial: option: add GosunCn ZTE WeLink ME3630
    - USB: serial: option: add HP lt4132
    - USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
    - USB: serial: option: add Fibocom NL668 series
    - USB: serial: option: add Telit LN940 series
    - mmc: core: Reset HPI enabled state during re-init and in case of errors
    - mmc: omap_hsmmc: fix DMA API warning
    - gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
    - Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
    - x86/mtrr: Don't copy uninitialized gentry fields back to userspace
    - drm/ioctl: Fix Spectre v1 vulnerabilities
    - ip6mr: Fix potential Spectre v1 vulnerability
    - ipv4: Fix potential Spectre v1 vulnerability
    - ax25: fix a use-after-free in ax25_fillin_cb()
    - ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
    - ieee802154: lowpan_header_create check must check daddr
    - ipv6: explicitly initialize udp6_addr in udp_sock_create6()
    - isdn: fix kernel-infoleak in capi_unlocked_ioctl
    - netrom: fix locking in nr_find_socket()
    - packet: validate address length
    - packet: validate address length if non-zero
    - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
    - vhost: make sure used idx is seen before log in vhost_add_used_n()
    - VSOCK: Send reset control packet when socket is partially bound
    - xen/netfront: tolerate frags with no data
    - gro_cell: add napi_disable in gro_cells_destroy
    - sock: Make sock->sk_stamp thread-safe
    - ALSA: rme9652: Fix potential Spectre v1 vulnerability
    - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
    - ALSA: pcm: Fix potential Spectre v1 vulnerability
    - ALSA: emux: Fix potential Spectre v1 vulnerabilities
    - ALSA: hda: add mute LED support for HP EliteBook 840 G4
    - ALSA: hda/tegra: clear pending irq handlers
    - USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
    - USB: serial: option: add Fibocom NL678 series
    - usb: r8a66597: Fix a possible concurrency use-after-free bug in
      r8a66597_endpoint_disable()
    - Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
    - KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
    - perf pmu: Suppress potential format-truncation warning
    - ext4: fix possible use after free in ext4_quota_enable
    - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
    - ext4: fix EXT4_IOC_GROUP_ADD ioctl
    - ext4: force inode writes when nfsd calls commit_metadata()
    - spi: bcm2835: Fix race on DMA termination
    - spi: bcm2835: Fix book-keeping of DMA termination
    - spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
    - cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
    - media: vivid: free bitmap_cap when updating std/timings/etc.
    - MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
    - MIPS: Align kernel load address to 64KB
    - CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
    - x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when
      running nested
    - spi: bcm2835: Unbreak the build of esoteric configs
    - powerpc: Fix COFF zImage booting on old powermacs
    - ARM: imx: update the cpu power up timing setting on i.mx6sx
    - Input: restore EV_ABS ABS_RESERVED
    - checkstack.pl: fix for aarch64
    - xfrm: Fix bucket count reported to userspace
    - scsi: bnx2fc: Fix NULL dereference in error handling
    - Input: omap-keypad - fix idle configuration to not block SoC idle states
    - scsi: zfcp: fix posting too many status read buffers leading to adapter
      shutdown
    - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
    - mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
    - mm, devm_memremap_pages: kill mapping "System RAM" support
    - sunrpc: fix cache_head leak due to queued request
    - sunrpc: use SVC_NET() in svcauth_gss_* functions
    - crypto: x86/chacha20 - avoid sleeping with preemption disabled
    - ALSA: cs46xx: Potential NULL dereference in probe
    - ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
    - ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
    - dlm: fixed memory leaks after failed ls_remove_names allocation
    - dlm: possible memory leak on error path in create_lkb()
    - dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
    - dlm: memory leaks on error path in dlm_user_request()
    - gfs2: Fix loop in gfs2_rbm_find
    - b43: Fix error in cordic routine
    - 9p/net: put a lower bound on msize
    - iommu/vt-d: Handle domain agaw being less than iommu agaw
    - ceph: don't update importing cap's mseq when handing cap export
    - genwqe: Fix size check
    - intel_th: msu: Fix an off-by-one in attribute store
    - power: supply: olpc_battery: correct the temperature units
    - Linux 4.4.170
  * Xenial update: 4.4.169 upstream stable release (LP: #1811252)
    - lib/interval_tree_test.c: make test options module parameters
    - lib/interval_tree_test.c: allow full tree search
    - lib/rbtree_test.c: make input module parameters
    - lib/rbtree-test: lower default params
    - lib/interval_tree_test.c: allow users to limit scope of endpoint
    - timer/debug: Change /proc/timer_list from 0444 to 0400
    - powerpc/boot: Fix random libfdt related build errors
    - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
    - aio: fix spectre gadget in lookup_ioctx
    - MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
    - tracing: Fix memory leak in set_trigger_filter()
    - tracing: Fix memory leak of instance function hash filters
    - powerpc/msi: Fix NULL pointer access in teardown code
    - Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
    - f2fs: fix a panic caused by NULL flush_cmd_control
    - mac80211: don't WARN on bad WMM parameters from buggy APs
    - mac80211: Fix condition validating WMM IE
    - mac80211_hwsim: fix module init error paths for netlink
    - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
    - scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during
      unload
    - x86/earlyprintk/efi: Fix infinite loop on some screen widths
    - drm/msm: Grab a vblank reference when waiting for commit_done
    - ARC: io.h: Implement reads{x}()/writes{x}()
    - bonding: fix 802.3ad state sent to partner when unbinding slave
    - SUNRPC: Fix a potential race in xprt_connect()
    - sbus: char: add of_node_put()
    - drivers/sbus/char: add of_node_put()
    - drivers/tty: add missing of_node_put()
    - ide: pmac: add of_node_put()
    - clk: mmp: Off by one in mmp_clk_add()
    - Input: omap-keypad - fix keyboard debounce configuration
    - libata: whitelist all SAMSUNG MZ7KM* solid-state disks
    - mv88e6060: disable hardware level MAC learning
    - ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address
      handling
    - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
    - [Config] Remove CONFIG_CIFS_POSIX=y
    - i2c: axxia: properly handle master timeout
    - i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
    - rtc: snvs: add a missing write sync
    - rtc: snvs: Add timeouts to avoid kernel lockups
    - ALSA: isa/wavefront: prevent some out of bound writes
    - Linux 4.4.169
  * Xenial update: 4.4.168 upstream stable release (LP: #1811080)
    - ipv6: Check available headroom in ip6_xmit() even without options
    - net: 8139cp: fix a BUG triggered by changing mtu with network traffic
    - net: phy: don't allow __set_phy_supported to add unsupported modes
    - net: Prevent invalid access to skb->prev in __qdisc_drop_all
    - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
    - tcp: fix NULL ref in tail loss probe
    - tun: forbid iface creation with rtnl ops
    - neighbour: Avoid writing before skb->head in neigh_hh_output()
    - ARM: OMAP2+: prm44xx: Fix section annotation on
      omap44xx_prm_enable_io_wakeup
    - ARM: OMAP1: ams-delta: Fix possible use of uninitialized field
    - sysv: return 'err' instead of 0 in __sysv_write_inode
    - s390/cpum_cf: Reject request for sampling in event initialization
    - hwmon: (ina2xx) Fix current value calculation
    - ASoC: dapm: Recalculate audio map forcely when card instantiated
    - hwmon: (w83795) temp4_type has writable permission
    - Btrfs: send, fix infinite loop due to directory rename dependencies
    - ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
    - ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
    - exportfs: do not read dentry after free
    - bpf: fix check of allowed specifiers in bpf_trace_printk
    - USB: omap_udc: use devm_request_irq()
    - USB: omap_udc: fix crashes on probe error and module removal
    - USB: omap_udc: fix omap_udc_start() on 15xx machines
    - USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
    - KVM: x86: fix empty-body warnings
    - net: thunderx: fix NULL pointer dereference in nic_remove
    - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps
    - net: hisilicon: remove unexpected free_netdev
    - drm/ast: fixed reading monitor EDID not stable issue
    - xen: xlate_mmu: add missing header to fix 'W=1' warning
    - fscache: fix race between enablement and dropping of object
    - fscache, cachefiles: remove redundant variable 'cache'
    - ocfs2: fix deadlock caused by ocfs2_defrag_extent()
    - hfs: do not free node before using
    - hfsplus: do not free node before using
    - debugobjects: avoid recursive calls with kmemleak
    - ocfs2: fix potential use after free
    - pstore: Convert console write to use ->write_buf
    - ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
    - KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC
    - KVM: nVMX: mark vmcs12 pages dirty on L2 exit
    - KVM: nVMX: Eliminate vmcs02 pool
    - KVM: VMX: introduce alloc_loaded_vmcs
    - KVM: VMX: make MSR bitmaps per-VCPU
    - KVM/x86: Add IBPB support
    - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
    - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
    - KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
    - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
    - bpf: support 8-byte metafield access
    - bpf/verifier: Add spi variable to check_stack_write()
    - bpf/verifier: Pass instruction index to check_mem_access() and check_xadd()
    - bpf: Prevent memory disambiguation attack
    - wil6210: missing length check in wmi_set_ie
    - mm/hugetlb.c: don't call region_abort if region_chg fails
    - hugetlbfs: fix offset overflow in hugetlbfs mmap
    - hugetlbfs: check for pgoff value overflow
    - hugetlbfs: fix bug in pgoff overflow checking
    - swiotlb: clean up reporting
    - sr: pass down correctly sized SCSI sense buffer
    - mm: remove write/force parameters from __get_user_pages_locked()
    - mm: remove write/force parameters from __get_user_pages_unlocked()
    - mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages()
    - mm: replace get_user_pages_unlocked() write/force parameters with gup_flags
    - mm: replace get_user_pages_locked() write/force parameters with gup_flags
    - mm: replace get_vaddr_frames() write/force parameters with gup_flags
    - mm: replace get_user_pages() write/force parameters with gup_flags
    - mm: replace __access_remote_vm() write parameter with gup_flags
    - mm: replace access_remote_vm() write parameter with gup_flags
    - proc: don't use FOLL_FORCE for reading cmdline and environment
    - proc: do not access cmdline nor environ from file-backed areas
    - media: dvb-frontends: fix i2c access helpers for KASAN
    - matroxfb: fix size of memcpy
    - staging: speakup: Replace strncpy with memcpy
    - rocker: fix rocker_tlv_put_* functions for KASAN
    - selftests: Move networking/timestamping from Documentation
    - Linux 4.4.168
  * kernel oops in bcache module (LP: #1793901)
    - SAUCE: bcache: never writeback a discard operation
  * Userspace break as a result of missing patch backport (LP: #1813873)
    - tty: Don't hold ldisc lock in tty_reopen() if ldisc present
  * CVE-2019-6133
    - fork: record start_time late
  * Crash on "ip link add foo type ipip" (LP: #1811803)
    - SAUCE: fan: Fix NULL pointer dereference

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 15 Feb 2019 14:09:55 +0000

linux-aws (4.4.0-1038.41) trusty; urgency=medium

  * linux-aws: 4.4.0-1038.41 -proposed tracker (LP: #1811847)

  * Xenial update: 4.4.164 upstream stable release (LP: #1810947)
    - [Config] Remove CONFIG{,_ARCH_USE}_QUEUED_SPINLOCKS

  * Packaging resync (LP: #1786013)
    - [Packaging] update update.conf

  [ Ubuntu: 4.4.0-142.168 ]

  * linux: 4.4.0-142.168 -proposed tracker (LP: #1811846)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * iptables connlimit allows more connections than the limit when using
    multiple CPUs (LP: #1811094)
    - netfilter: xt_connlimit: don't store address in the conn nodes
    - SAUCE: netfilter: xt_connlimit: remove the 'addr' parameter in add_hlist()
    - netfilter: nf_conncount: expose connection list interface
    - netfilter: nf_conncount: Fix garbage collection with zones
    - netfilter: nf_conncount: fix garbage collection confirm race
    - netfilter: nf_conncount: don't skip eviction when age is negative
  * CVE-2017-5715
    - SAUCE: x86/speculation: Cleanup IBPB runtime control handling
    - SAUCE: x86/speculation: Cleanup IBRS runtime control handling
    - SAUCE: x86/speculation: Use x86_spec_ctrl_base in entry/exit code
    - SAUCE: x86/speculation: Move RSB_CTXSW hunk
  * Xenial update: 4.4.167 upstream stable release (LP: #1811077)
    - media: em28xx: Fix use-after-free when disconnecting
    - Revert "wlcore: Add missing PM call for
      wlcore_cmd_wait_for_event_or_timeout()"
    - rapidio/rionet: do not free skb before reading its length
    - s390/qeth: fix length check in SNMP processing
    - usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
    - kvm: mmu: Fix race in emulated page table writes
    - xtensa: enable coprocessors that are being flushed
    - xtensa: fix coprocessor context offset definitions
    - Btrfs: ensure path name is null terminated at btrfs_control_ioctl
    - ALSA: wss: Fix invalid snd_free_pages() at error path
    - ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
    - ALSA: control: Fix race between adding and removing a user element
    - ALSA: sparc: Fix invalid snd_free_pages() at error path
    - ext2: fix potential use after free
    - dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
    - dmaengine: at_hdmac: fix module unloading
    - btrfs: release metadata before running delayed refs
    - USB: usb-storage: Add new IDs to ums-realtek
    - usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
    - misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
    - Kbuild: suppress packed-not-aligned warning for default setting only
    - exec: avoid gcc-8 warning for get_task_comm
    - disable stringop truncation warnings for now
    - kobject: Replace strncpy with memcpy
    - unifdef: use memcpy instead of strncpy
    - kernfs: Replace strncpy with memcpy
    - ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
    - drm: gma500: fix logic error
    - scsi: bfa: convert to strlcpy/strlcat
    - staging: rts5208: fix gcc-8 logic error warning
    - kdb: use memmove instead of overlapping memcpy
    - iser: set sector for ambiguous mr status errors
    - uprobes: Fix handle_swbp() vs. unregister() + register() race once more
    - MIPS: ralink: Fix mt7620 nd_sd pinmux
    - mips: fix mips_get_syscall_arg o32 check
    - drm/ast: Fix incorrect free on ioregs
    - scsi: scsi_devinfo: cleanly zero-pad devinfo strings
    - ALSA: trident: Suppress gcc string warning
    - scsi: csiostor: Avoid content leaks and casts
    - kgdboc: Fix restrict error
    - kgdboc: Fix warning with module build
    - leds: call led_pwm_set() in leds-pwm to enforce default LED_OFF
    - leds: turn off the LED and wait for completion on unregistering LED class
      device
    - leds: leds-gpio: Fix return value check in create_gpio_led()
    - Input: xpad - quirk all PDP Xbox One gamepads
    - Input: matrix_keypad - check for errors from of_get_named_gpio()
    - Input: elan_i2c - add ELAN0620 to the ACPI table
    - Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
    - Input: elan_i2c - add support for ELAN0621 touchpad
    - btrfs: Always try all copies when reading extent buffers
    - Btrfs: fix use-after-free when dumping free space
    - ARC: change defconfig defaults to ARCv2
    - arc: [devboards] Add support of NFSv3 ACL
    - mm: cleancache: fix corruption on missed inode invalidation
    - usb: gadget: dummy: fix nonsensical comparisons
    - iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
    - iommu/ipmmu-vmsa: Fix crash on early domain free
    - can: rcar_can: Fix erroneous registration
    - batman-adv: Expand merged fragment buffer for full packet
    - bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
    - qed: Fix PTT leak in qed_drain()
    - qed: Fix reading wrong value in loop condition
    - net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
    - net/mlx4_core: Fix uninitialized variable compilation warning
    - net/mlx4: Fix UBSAN warning of signed integer overflow
    - net: faraday: ftmac100: remove netif_running(netdev) check before disabling
      interrupts
    - iommu/vt-d: Use memunmap to free memremap
    - net: amd: add missing of_node_put()
    - usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
    - usb: appledisplay: Add 27" Apple Cinema Display
    - USB: check usb_get_extra_descriptor for proper size
    - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
    - ALSA: hda: Add support for AMD Stoney Ridge
    - ALSA: pcm: Fix starvation on down_write_nonblock()
    - ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
    - ALSA: pcm: Fix interval evaluation with openmin/max
    - virtio/s390: avoid race on vcdev->config
    - virtio/s390: fix race in ccw_io_helper()
    - SUNRPC: Fix leak of krb5p encode pages
    - xhci: Prevent U1/U2 link pm states if exit latency is too long
    - Staging: lustre: remove two build warnings
    - cifs: Fix separator when building path from dentry
    - tty: serial: 8250_mtk: always resume the device in probe.
    - kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
    - mac80211_hwsim: Timer should be initialized before device registered
    - mac80211: Clear beacon_int in ieee80211_do_stop
    - mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
    - mac80211: fix reordering of buffered broadcast packets
    - mac80211: ignore NullFunc frames in the duplicate detection
    - Linux 4.4.167
  * CVE-2018-19407
    - KVM: X86: Fix scan ioapic use-before-initialization
  * cpu-hotplug test in ubuntu_kernel_selftest always return 0 on Xenial
    (LP: #1809699)
    - selftests/cpu-hotplug: exit with failure when test occured unexpected
      behaviors
  * iommu - need to effectively disable iommu if "intel_iommu=off" is passed as
    a kernel parameter (LP: #1810328)
    - iommu/vt-d: Make sure IOMMUs are off when intel_iommu=off
  * ldisc crash on reopened tty (LP: #1791758)
    - tty: fix data race between tty_init_dev and flush of buf
    - tty: Drop tty->count on tty_reopen() failure
    - tty: Hold tty_ldisc_lock() during tty_reopen()
    - tty: Don't block on IO when ldisc change is pending
    - tty: Simplify tty->count math in tty_reopen()
  * Xenial update: 4.4.166 upstream stable release (LP: #1810967)
    - usb: core: Fix hub port connection events lost
    - usb: xhci: fix timeout for transition from RExit to U0
    - MAINTAINERS: Add Sasha as a stable branch maintainer
    - iwlwifi: mvm: support sta_statistics() even on older firmware
    - v9fs_dir_readdir: fix double-free on p9stat_read error
    - bfs: add sanity check at bfs_fill_super()
    - sctp: clear the transport of some out_chunk_list chunks in
      sctp_assoc_rm_peer
    - gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
    - llc: do not use sk_eat_skb()
    - drm/ast: change resolution may cause screen blurred
    - drm/ast: fixed cursor may disappear sometimes
    - can: dev: can_get_echo_skb(): factor out non sending code to
      __can_get_echo_skb()
    - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to
      access frame length
    - can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb
      is accessed out of bounds
    - can: dev: __can_get_echo_skb(): print error message, if trying to echo non
      existing skb
    - usb: xhci: Prevent bus suspend if a port connect change or polling state is
      detected
    - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
    - cpufreq: imx6q: add return value check for voltage scale
    - SUNRPC: Fix a bogus get/put in generic_key_to_expire()
    - kdb: Use strscpy with destination buffer size
    - powerpc/numa: Suppress "VPHN is not supported" messages
    - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
    - of: add helper to lookup compatible child node
    - NFC: nfcmrvl_uart: fix OF child-node lookup
    - net: bcmgenet: fix OF child-node lookup
    - x86/entry: spell EBX register correctly in documentation
    - x86/entry/64: Remove %ebx handling from error_entry/exit
    - arm64: remove no-op -p linker flag
    - ath10k: fix kernel panic due to race in accessing arvif list
    - Input: xpad - remove spurious events of wireless xpad 360 controller
    - Input: xpad - handle "present" and "gone" correctly
    - Input: xpad - update Xbox One Force Feedback Support
    - Input: xpad - workaround dead irq_out after suspend/ resume
    - Input: xpad - use LED API when identifying wireless controllers
    - Input: xpad - correct xbox one pad device name
    - Input: xpad - remove unused function
    - Input: xpad - add Mad Catz FightStick TE 2 VID/PID
    - Input: xpad - prevent spurious input from wired Xbox 360 controllers
    - Input: xpad - add more third-party controllers
    - Input: xpad - xbox one elite controller support
    - Input: xpad - fix rumble on Xbox One controllers with 2015 firmware
    - Input: xpad - power off wireless 360 controllers on suspend
    - Input: xpad - add product ID for Xbox One S pad
    - Input: xpad - fix Xbox One rumble stopping after 2.5 secs
    - Input: xpad - correctly sort vendor id's
    - Input: xpad - move reporting xbox one home button to common function
    - Input: xpad - simplify error condition in init_output
    - Input: xpad - don't depend on endpoint order
    - Input: xpad - fix stuck mode button on Xbox One S pad
    - Input: xpad - restore LED state after device resume
    - Input: xpad - support some quirky Xbox One pads
    - Input: xpad - sort supported devices by USB ID
    - Input: xpad - sync supported devices with xboxdrv
    - Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth
    - Input: xpad - sync supported devices with 360Controller
    - Input: xpad - sync supported devices with XBCD
    - Input: xpad - constify usb_device_id
    - Input: xpad - fix PowerA init quirk for some gamepad models
    - Input: xpad - validate USB endpoint type during probe
    - Input: xpad - add support for PDP Xbox One controllers
    - Input: xpad - add PDP device id 0x02a4
    - Input: xpad - fix some coding style issues
    - Input: xpad - avoid using __set_bit() for capabilities
    - Input: xpad - add GPD Win 2 Controller USB IDs
    - Input: xpad - fix GPD Win 2 controller name
    - Input: xpad - add support for Xbox1 PDP Camo series gamepad
    - cw1200: Don't leak memory if krealloc failes
    - mwifiex: Fix NULL pointer dereference in skb_dequeue()
    - mwifiex: fix p2p device doesn't find in scan problem
    - netfilter: nf_tables: fix oops when inserting an element into a verdict map
    - scsi: ufs: fix bugs related to null pointer access and array size
    - scsi: ufshcd: Fix race between clk scaling and ungate work
    - scsi: ufs: fix race between clock gating and devfreq scaling work
    - scsi: ufshcd: release resources if probe fails
    - scsi: qla2xxx: do not queue commands when unloading
    - iwlwifi: mvm: fix regulatory domain update when the firmware starts
    - tty: wipe buffer.
    - tty: wipe buffer if not echoing data
    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
    - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
    - sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
    - s390/mm: Check for valid vma before zapping in gmap_discard
    - drm/ast: Remove existing framebuffers before loading driver
    - Linux 4.4.166
  * Xenial update: 4.4.166 upstream stable release (LP: #1810967) //
    CVE-2000-1134 // CVE-2007-3852 // CVE-2008-0525 // CVE-2009-0416 //
    CVE-2011-4834 // CVE-2015-1838 // CVE-2015-7442 // CVE-2016-7489
    - namei: allow restricted O_CREAT of FIFOs and regular files
  * Xenial update: 4.4.165 upstream stable release (LP: #1810958)
    - flow_dissector: do not dissect l4 ports for fragments
    - ip_tunnel: don't force DF when MTU is locked
    - net-gro: reset skb->pkt_type in napi_reuse_skb()
    - tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
    - ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
    - kbuild: Add better clang cross build support
    - kbuild: clang: add -no-integrated-as to KBUILD_[AC]FLAGS
    - kbuild: Consolidate header generation from ASM offset information
    - kbuild: consolidate redundant sed script ASM offset generation
    - kbuild: fix asm-offset generation to work with clang
    - kbuild: drop -Wno-unknown-warning-option from clang options
    - kbuild, LLVMLinux: Add -Werror to cc-option to support clang
    - kbuild: use -Oz instead of -Os when using clang
    - kbuild: Add support to generate LLVM assembly files
    - modules: mark __inittest/__exittest as __maybe_unused
    - kbuild: clang: Disable 'address-of-packed-member' warning
    - crypto: arm64/sha - avoid non-standard inline asm tricks
    - efi/libstub/arm64: Force 'hidden' visibility for section markers
    - efi/libstub/arm64: Set -fpie when building the EFI stub
    - kbuild: fix linker feature test macros when cross compiling with Clang
    - kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
    - kbuild: move cc-option and cc-disable-warning after incl. arch Makefile
    - kbuild: clang: fix build failures with sparse check
    - kbuild: clang: remove crufty HOSTCFLAGS
    - kbuild: clang: disable unused variable warnings only when constant
    - kbuild: set no-integrated-as before incl. arch Makefile
    - kbuild: allow to use GCC toolchain not in Clang search path
    - arm64: Disable asm-operand-width warning for clang
    - x86/kbuild: Use cc-option to enable -falign-{jumps/loops}
    - crypto, x86: aesni - fix token pasting for clang
    - x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang
      incompatibility
    - kbuild: Add __cc-option macro
    - x86/build: Use __cc-option for boot code compiler options
    - x86/build: Specify stack alignment for clang
    - x86/boot: #undef memcpy() et al in string.c
    - x86/build: Fix stack alignment for CLang
    - x86/build: Use cc-option to validate stack alignment parameter
    - reiserfs: propagate errors from fill_with_dentries() properly
    - hfs: prevent btree data loss on root split
    - hfsplus: prevent btree data loss on root split
    - um: Give start_idle_thread() a return code
    - fs/exofs: fix potential memory leak in mount option parsing
    - clk: samsung: exynos5420: Enable PERIS clocks for suspend
    - platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
    - arm64: percpu: Initialize ret in the default case
    - s390/vdso: add missing FORCE to build targets
    - netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
    - s390/mm: Fix ERROR: "__node_distance" undefined!
    - netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
    - netfilter: xt_IDLETIMER: add sysfs filename checking routine
    - hwmon: (ibmpowernv) Remove bogus __init annotations
    - lib/raid6: Fix arm64 test build
    - zram: close udev startup race condition as default groups
    - SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
    - gfs2: Put bitmap buffers in put_super
    - btrfs: fix pinned underflow after transaction aborted
    - Revert "media: videobuf2-core: don't call memop 'finish' when queueing"
    - media: v4l: event: Add subscription to list before calling "add" operation
    - uio: Fix an Oops on load
    - usb: cdc-acm: add entry for Hiro (Conexant) modem
    - USB: quirks: Add no-lpm quirk for Raydium touchscreens
    - usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
    - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
    - USB: misc: appledisplay: add 20" Apple Cinema Display
    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
    - ACPI / platform: Add SMB0001 HID to forbidden_id_list
    - new helper: uaccess_kernel()
    - HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
    - xhci: Fix USB3 NULL pointer dereference at logical disconnect.
    - Linux 4.4.165
  * Xenial update: 4.4.164 upstream stable release (LP: #1810947)
    - bcache: fix miss key refill->end in writeback
    - hwmon: (pmbus) Fix page count auto-detection.
    - jffs2: free jffs2_sb_info through jffs2_kill_sb()
    - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
    - ipmi: Fix timer race with module unload
    - parisc: Fix address in HPMC IVA
    - parisc: Fix map_pages() to not overwrite existing pte entries
    - ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
    - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
    - x86/corruption-check: Fix panic in memory_corruption_check() when boot
      option without value is provided
    - x86/kconfig: Fall back to ticket spinlocks
    - [Config] Remove CONFIG{,_ARCH_USE}_QUEUED_SPINLOCKS
    - sparc: Fix single-pcr perf event counter management.
    - x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
    - net: qla3xxx: Remove overflowing shift statement
    - selftests: ftrace: Add synthetic event syntax testcase
    - locking/lockdep: Fix debug_locks off performance problem
    - ataflop: fix error handling during setup
    - swim: fix cleanup on setup error
    - tun: Consistently configure generic netdev params via rtnetlink
    - perf tools: Free temporary 'sys' string in read_event_files()
    - perf tools: Cleanup trace-event-info 'tdata' leak
    - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
    - Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
    - x86: boot: Fix EFI stub alignment
    - pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
    - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
    - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
    - pinctrl: qcom: spmi-mpp: Fix drive strength setting
    - pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
    - pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
    - ath10k: schedule hardware restart if WMI command times out
    - scsi: esp_scsi: Track residual for PIO transfers
    - scsi: megaraid_sas: fix a missing-check bug
    - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
    - ext4: fix argument checking in EXT4_IOC_MOVE_EXT
    - MD: fix invalid stored role for a disk
    - usb: chipidea: Prevent unbalanced IRQ disable
    - driver/dma/ioat: Call del_timer_sync() without holding prep_lock
    - uio: ensure class is registered before devices
    - scsi: lpfc: Correct soft lockup when running mds diagnostics
    - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace
      init
    - dmaengine: dma-jz4780: Return error if not probed from DT
    - ALSA: hda: Check the non-cached stream buffers more explicitly
    - xen-swiotlb: use actually allocated size on check physical continuous
    - tpm: Restore functionality to xen vtpm driver.
    - xen: fix race in xen_qlock_wait()
    - xen: make xen_qlock_wait() nestable
    - net/ipv4: defensive cipso option parsing
    - libnvdimm: Hold reference on parent while scheduling async init
    - jbd2: fix use after free in jbd2_log_do_checkpoint()
    - gfs2_meta: ->mount() can get NULL dev_name
    - ext4: initialize retries variable in ext4_da_write_inline_data_begin()
    - HID: hiddev: fix potential Spectre v1
    - PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
    - signal/GenWQE: Fix sending of SIGKILL
    - crypto: lrw - Fix out-of bounds access on counter overflow
    - ima: fix showing large 'violations' or 'runtime_measurements_count'
    - hugetlbfs: dirty pages as they are added to pagecache
    - kbuild: fix kernel/bounds.c 'W=1' warning
    - iio: adc: at91: fix acking DRDY irq on simple conversions
    - iio: adc: at91: fix wrong channel number in triggered buffer mode
    - w1: omap-hdq: fix missing bus unregister at removal
    - smb3: allow stats which track session and share reconnects to be reset
    - smb3: do not attempt cifs operation in smb3 query info error path
    - smb3: on kerberos mount if server doesn't specify auth type use krb5
    - printk: Fix panic caused by passing log_buf_len to command line
    - genirq: Fix race on spurious interrupt detection
    - NFSv4.1: Fix the r/wsize checking
    - nfsd: Fix an Oops in free_session()
    - lockd: fix access beyond unterminated strings in prints
    - dm ioctl: harden copy_params()'s copy_from_user() from malicious users
    - powerpc/msi: Fix compile error on mpc83xx
    - MIPS: OCTEON: fix out of bounds array access on CN68XX
    - TC: Set DMA masks for devices
    - kgdboc: Passing ekgdboc to command line causes panic
    - xen: fix xen_qlock_wait()
    - media: em28xx: use a default format if TRY_FMT fails
    - media: em28xx: fix input name for Terratec AV 350
    - media: em28xx: make v4l2-compliance happier by starting sequence on zero
    - ext4: avoid running out of journal credits when appending to an inline file
    - Cramfs: fix abad comparison when wrap-arounds occur
    - arm64: dts: stratix10: Correct System Manager register size
    - soc/tegra: pmc: Fix child-node lookup
    - btrfs: Handle owner mismatch gracefully when walking up tree
    - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
    - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
    - btrfs: don't attempt to trim devices that don't support it
    - btrfs: wait on caching when putting the bg cache
    - btrfs: reset max_extent_size on clear in a bitmap
    - btrfs: make sure we create all new block groups
    - Btrfs: fix wrong dentries after fsync of file that got its parent replaced
    - btrfs: qgroup: Dirty all qgroups before rescan
    - Btrfs: fix null pointer dereference on compressed write path error
    - btrfs: set max_extent_size properly
    - MD: fix invalid stored role for a disk - try2
    - tty: check name length in tty_find_polling_driver()
    - powerpc/nohash: fix undefined behaviour when testing page size support
    - drm/omap: fix memory barrier bug in DMM driver
    - media: pci: cx23885: handle adding to list failure
    - MIPS: kexec: Mark CPU offline before disabling local IRQ
    - powerpc/boot: Ensure _zimage_start is a weak symbol
    - sc16is7xx: Fix for multi-channel stall
    - media: tvp5150: fix width alignment during set_selection()
    - 9p locks: fix glock.client_id leak in do_lock
    - 9p: clear dangling pointers in p9stat_free
    - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
    - fuse: Fix use-after-free in fuse_dev_do_read()
    - fuse: Fix use-after-free in fuse_dev_do_write()
    - fuse: fix blocked_waitq wakeup
    - fuse: set FR_SENT while locked
    - mm, elf: handle vm_brk error
    - binfmt_elf: fix calculations for bss padding
    - mm: refuse wrapped vm_brk requests
    - fs, elf: make sure to page align bss in load_elf_library
    - mm: do not bug_on on incorrect length in __mm_populate()
    - e1000: avoid null pointer dereference on invalid stat type
    - e1000: fix race condition between e1000_down() and e1000_watchdog
    - bna: ethtool: Avoid reading past end of buffer
    - MIPS: Loongson-3: Fix CPU UART irq delivery problem
    - MIPS: Loongson-3: Fix BRIDGE irq delivery problem
    - xtensa: add NOTES section to the linker script
    - xtensa: make sure bFLT stack is 16 byte aligned
    - xtensa: fix boot parameters address translation
    - clk: s2mps11: Fix matching when built as module and DT node contains
      compatible
    - libceph: bump CEPH_MSG_MAX_DATA_LEN
    - mach64: fix display corruption on big endian machines
    - mach64: fix image corruption due to reading accelerator registers
    - vhost/scsi: truncate T10 PI iov_iter to prot_bytes
    - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
    - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
    - termios, tty/tty_baudrate.c: fix buffer overrun
    - arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
    - Btrfs: fix data corruption due to cloning of eof block
    - clockevents/drivers/i8253: Add support for PIT shutdown quirk
    - ext4: add missing brelse() update_backups()'s error path
    - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
    - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
    - ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
    - ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
    - ext4: avoid buffer leak in ext4_orphan_add() after prior errors
    - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
    - ext4: avoid possible double brelse() in add_new_gdb() on error path
    - ext4: fix possible leak of sbi->s_group_desc_leak in error path
    - ext4: release bs.bh before re-using in ext4_xattr_block_find()
    - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
    - ext4: fix buffer leak in __ext4_read_dirblock() on error path
    - mount: Prevent MNT_DETACH from disconnecting locked mounts
    - sunrpc: correct the computation for page_ptr when truncating
    - rtc: hctosys: Add missing range error reporting
    - fuse: fix leaked notify reply
    - configfs: replace strncpy with memcpy
    - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
    - mm: migration: fix migration of huge PMD shared pages
    - drm/rockchip: Allow driver to be shutdown on reboot/kexec
    - drm/dp_mst: Check if primary mstb is null
    - drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
    - Linux 4.4.164
  * Xenial update: 4.4.163 upstream stable release (LP: #1810807)
    - xfrm: Validate address prefix lengths in the xfrm selector.
    - xfrm6: call kfree_skb when skb is toobig
    - mac80211: Always report TX status
    - cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
    - ARM: 8799/1: mm: fix pci_ioremap_io() offset check
    - xfrm: validate template mode
    - mac80211_hwsim: do not omit multicast announce of first added radio
    - Bluetooth: SMP: fix crash in unpairing
    - pxa168fb: prepare the clock
    - asix: Check for supported Wake-on-LAN modes
    - ax88179_178a: Check for supported Wake-on-LAN modes
    - lan78xx: Check for supported Wake-on-LAN modes
    - sr9800: Check for supported Wake-on-LAN modes
    - r8152: Check for supported Wake-on-LAN Modes
    - smsc75xx: Check for Wake-on-LAN modes
    - smsc95xx: Check for Wake-on-LAN modes
    - perf/ring_buffer: Prevent concurent ring buffer access
    - net: cxgb3_main: fix a missing-check bug
    - KEYS: put keyring if install_session_keyring_to_cred() fails
    - ipv6: suppress sparse warnings in IP6_ECN_set_ce()
    - net: drop write-only stack variable
    - ser_gigaset: use container_of() instead of detour
    - tracing: Skip more functions when doing stack tracing of events
    - ARM: dts: apq8064: add ahci ports-implemented mask
    - x86/mm/pat: Prevent hang during boot when mapping pages
    - radix-tree: fix radix_tree_iter_retry() for tagged iterators.
    - af_iucv: Move sockaddr length checks to before accessing sa_family in bind
      and connect handlers
    - net/mlx4_en: Resolve dividing by zero in 32-bit system
    - ipv6: orphan skbs in reassembly unit
    - um: Avoid longjmp/setjmp symbol clashes with libpthread.a
    - sched/cgroup: Fix cgroup entity load tracking tear-down
    - btrfs: don't create or leak aliased root while cleaning up orphans
    - thermal: allow spear-thermal driver to be a module
    - thermal: allow u8500-thermal driver to be a module
    - x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
    - aacraid: Start adapter after updating number of MSIX vectors
    - perf/core: Don't leak event in the syscall error path
    - usbvision: revert commit 588afcc1
    - MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
    - ASoC: ak4613: Enable cache usage to fix crashes on resume
    - ASoC: wm8940: Enable cache usage to fix crashes on resume
    - CIFS: handle guest access errors to Windows shares
    - arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
    - xfrm: Clear sk_dst_cache when applying per-socket policy.
    - scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
    - sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
    - sch_red: update backlog as well
    - usb-storage: fix bogus hardware error messages for ATA pass-thru devices
    - bpf: generally move prog destruction to RCU deferral
    - drm/nouveau/fbcon: fix oops without fbdev emulation
    - fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio
    - net/mlx5e: Fix LRO modify
    - net/mlx5e: Correctly handle RSS indirection table when changing number of
      channels
    - ALSA: timer: Fix zero-division by continue of uninitialized instance
    - vti6: flush x-netns xfrm cache when vti interface is removed
    - brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
    - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
    - tty: serial: sprd: fix error return code in sprd_probe()
    - video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
    - sparc64 mm: Fix more TSB sizing issues
    - gpu: host1x: fix error return code in host1x_probe()
    - sparc64: Fix exception handling in UltraSPARC-III memcpy.
    - gpio: msic: fix error return code in platform_msic_gpio_probe()
    - usb: imx21-hcd: fix error return code in imx21_probe()
    - usb: ehci-omap: fix error return code in ehci_hcd_omap_probe()
    - usb: dwc3: omap: fix error return code in dwc3_omap_probe()
    - spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe()
    - MIPS: Handle non word sized instructions when examining frame
    - spi/bcm63xx: fix error return code in bcm63xx_spi_probe()
    - spi: xlp: fix error return code in xlp_spi_probe()
    - ASoC: spear: fix error return code in spdif_in_probe()
    - PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
    - bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal
    - scsi: aacraid: Fix typo in blink status
    - MIPS: microMIPS: Fix decoding of swsp16 instruction
    - igb: Remove superfluous reset to PHY and page 0 selection
    - MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression
    - ARM: dts: imx53-qsb: disable 1.2GHz OPP
    - fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
    - mtd: spi-nor: Add support for is25wp series chips
    - perf tools: Disable parallelism for 'make clean'
    - bridge: do not add port to router list when receives query with source
      0.0.0.0
    - net: bridge: remove ipv6 zero address check in mcast queries
    - ipv6: mcast: fix a use-after-free in inet6_mc_check
    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
      called
    - net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
    - net: sched: gred: pass the right attribute to gred_change_table_def()
    - net: socket: fix a missing-check bug
    - net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
    - r8169: fix NAPI handling under high load
    - sctp: fix race on sctp_id2asoc
    - net: drop skb on failure in ip_check_defrag()
    - vhost: Fix Spectre V1 vulnerability
    - rtnetlink: Disallow FDB configuration for non-Ethernet device
    - mremap: properly flush TLB before releasing the page
    - crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
    - ahci: don't ignore result code of ahci_reset_controller()
    - cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
    - ptp: fix Spectre v1 vulnerability
    - RDMA/ucma: Fix Spectre v1 vulnerability
    - IB/ucm: Fix Spectre v1 vulnerability
    - cdc-acm: correct counting of UART states in serial state notification
    - usb: gadget: storage: Fix Spectre v1 vulnerability
    - USB: fix the usbfs flag sanitization for control transfers
    - Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
    - sched/fair: Fix throttle_list starvation with low CFS quota
    - x86/percpu: Fix this_cpu_read()
    - cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
    - l2tp: hold tunnel socket when handling control frames in l2tp_ip and
      l2tp_ip6
    - x86/time: Correct the attribute on jiffies' definition
    - Linux 4.4.163
  * nvme - Polling on timeout (LP: #1807393)
    - nvme/pci: Poll CQ on timeout
  * Xenial: data corruption when using i40e with iommu (LP: #1802421)
    - i40e: Drop packet split receive routine
  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
    - igb: Fix an issue that PME is not enabled during runtime suspend

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 17 Jan 2019 19:02:23 +0100

linux-aws (4.4.0-1037.40) trusty; urgency=medium

  * linux-aws: 4.4.0-1037.40 -proposed tracker (LP: #1806570)

  [ Ubuntu: 4.4.0-141.167 ]

  * linux: 4.4.0-141.167 -proposed tracker (LP: #1806569)
  *  Redpine: firmware assert upon assoc   timeout (LP: #1804360)
    - SAUCE: Redpine: fix for firmware assert upon assoc timeout
  * CVE-2018-12896
    - posix-timers: Sanitize overrun handling
  * CVE-2017-5753
    - ALSA: opl3: Hardening for potential Spectre v1
    - ALSA: asihpi: Hardening for potential Spectre v1
    - ALSA: hdspm: Hardening for potential Spectre v1
    - ALSA: rme9652: Hardening for potential Spectre v1
    - ALSA: control: Hardening for potential Spectre v1
    - usbip: vhci_sysfs: fix potential Spectre v1
    - libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
  * CVE-2018-18710
    - cdrom: fix improper type cast, which can leat to information leak.
  * CVE-2018-18690
    - xfs: don't fail when converting shortform attr to long form during
      ATTR_REPLACE
  * CVE-2017-18174
    - pinctrl: Add devm_ apis for pinctrl_{register, unregister}
    - pinctrl: amd: Use devm_pinctrl_register() for pinctrl registration

 -- Khalid Elmously <khalid.elmously@canonical.com>  Thu, 06 Dec 2018 03:39:23 +0000

linux-aws (4.4.0-1036.39) trusty; urgency=medium

  * linux-aws: 4.4.0-1036.39 -proposed tracker (LP: #1804491)

  * Restore request-based mode to xen-blkfront for AWS kernels (LP: #1801305)
    - xen-blkfront: don't use req->errors
    - SAUCE: xen-blkfront: resurrect request-based mode

 -- Kamal Mostafa <kamal@canonical.com>  Wed, 21 Nov 2018 09:55:44 -0800

linux-aws (4.4.0-1035.38) trusty; urgency=medium

  * linux-aws: 4.4.0-1035.38 -proposed tracker (LP: #1802778)

  * Improve AWS hibernation performance (LP: #1803613)
    - PM / Hibernate: Call flush_icache_range() on pages restored in-place
    - SAUCE: [aws] PM / hibernate: Speed up hibernation by batching requests

  [ Ubuntu: 4.4.0-140.166 ]

  * linux: 4.4.0-140.166 -proposed tracker (LP: #1802776)
  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
    - mount: Retest MNT_LOCKED in do_umount
    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
  * kdump fail due to an IRQ storm (LP: #1797990)
    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
    - SAUCE: x86/quirks: Scan all busses for early PCI quirks
  * crash in ENA driver on removing an interface (LP: #1802341)
    - SAUCE: net: ena: fix crash during ena_remove()
  * xenial guest on arm64 drops to busybox under openstack bionic-rocky
    (LP: #1797092)
    - [Config] CONFIG_PCI_ECAM=y
    - PCI: Provide common functions for ECAM mapping
    - PCI: generic, thunder: Use generic ECAM API
    - PCI, of: Move PCI I/O space management to PCI core code
    - PCI: Move ecam.h to linux/include/pci-ecam.h
    - PCI: Add parent device field to ECAM struct pci_config_window
    - PCI: Add pci_unmap_iospace() to unmap I/O resources
    - PCI/ACPI: Support I/O resources when parsing host bridge resources
    - [Config] CONFIG_ACPI_MCFG=y
    - PCI/ACPI: Add generic MCFG table handling
    - PCI: Refactor pci_bus_assign_domain_nr() for CONFIG_PCI_DOMAINS_GENERIC
    - PCI: Factor DT-specific pci_bus_find_domain_nr() code out
    - ARM64: PCI: Add acpi_pci_bus_find_domain_nr()
    - ARM64: PCI: ACPI support for legacy IRQs parsing and consolidation with DT
      code
    - ARM64: PCI: Support ACPI-based PCI host controller
  * [GLK/CLX] Enhanced IBRS (LP: #1786139)
    - x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
    - x86/speculation: Support Enhanced IBRS on future CPUs
  * Update ENA driver to version 2.0.1K (LP: #1798182)
    - net: ena: remove ndo_poll_controller
    - net: ena: fix warning in rmmod caused by double iounmap
    - net: ena: fix rare bug when failed restart/resume is followed by driver
      removal
    - net: ena: fix NULL dereference due to untimely napi initialization
    - net: ena: fix auto casting to boolean
    - net: ena: minor performance improvement
    - net: ena: complete host info to match latest ENA spec
    - net: ena: introduce Low Latency Queues data structures according to ENA spec
    - net: ena: add functions for handling Low Latency Queues in ena_com
    - net: ena: add functions for handling Low Latency Queues in ena_netdev
    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
    - net: ena: explicit casting and initialization, and clearer error handling
    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
    - net: ena: change rx copybreak default to reduce kernel memory pressure
    - net: ena: remove redundant parameter in ena_com_admin_init()
    - net: ena: update driver version to 2.0.1
    - net: ena: fix indentations in ena_defs for better readability
    - net: ena: Fix Kconfig dependency on X86
    - net: ena: enable Low Latency Queues
    - net: ena: fix compilation error in xtensa architecture
  * Xenial update: 4.4.162 upstream stable release (LP: #1801900)
    - ASoC: wm8804: Add ACPI support
    - ASoC: sigmadsp: safeload should not have lower byte limit
    - selftests/efivarfs: add required kernel configs
    - mfd: omap-usb-host: Fix dts probe of children
    - sound: enable interrupt after dma buffer initialization
    - stmmac: fix valid numbers of unicast filter entries
    - net: macb: disable scatter-gather for macb on sama5d3
    - ARM: dts: at91: add new compatibility string for macb on sama5d3
    - drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
    - ext4: add corruption check in ext4_xattr_set_entry()
    - mm/vmstat.c: fix outdated vmstat_text
    - mach64: detect the dot clock divider correctly on sparc
    - perf script python: Fix export-to-postgresql.py occasional failure
    - i2c: i2c-scmi: fix for i2c_smbus_write_block_data
    - xhci: Don't print a warning when setting link state for disabled ports
    - jffs2: return -ERANGE when xattr buffer is too small
    - bnxt_en: Fix TX timeout during netpoll.
    - bonding: avoid possible dead-lock
    - ip6_tunnel: be careful when accessing the inner header
    - ip_tunnel: be careful when accessing the inner header
    - ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
    - net: ipv4: update fnhe_pmtu when first hop's MTU changes
    - net/ipv6: Display all addresses in output of /proc/net/if_inet6
    - netlabel: check for IPV4MASK in addrinfo_get
    - net/usb: cancel pending work when unbinding smsc75xx
    - qlcnic: fix Tx descriptor corruption on 82xx devices
    - team: Forbid enslaving team device to itself
    - net: mvpp2: Extract the correct ethtype from the skb for tx csum offload
    - net: systemport: Fix wake-up interrupt race during resume
    - rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096
    - KVM: x86: remove eager_fpu field of struct kvm_vcpu_arch
    - x86/fpu: Remove use_eager_fpu()
    - x86/fpu: Remove struct fpu::counter
    - x86/fpu: Finish excising 'eagerfpu'
    - media: af9035: prevent buffer overflow on write
    - clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-
      am43 SoCs
    - Input: atakbd - fix Atari keymap
    - Input: atakbd - fix Atari CapsLock behaviour
    - net/mlx4: Use cpumask_available for eq->affinity_mask
    - powerpc/tm: Fix userspace r13 corruption
    - powerpc/tm: Avoid possible userspace r1 corruption on reclaim
    - ARC: build: Get rid of toolchain check
    - usb: gadget: serial: fix oops when data rx'd after close
    - HV: properly delay KVP packets when negotiation is in progress
    - Linux 4.4.162
  * Xenial update: 4.4.161 upstream stable release (LP: #1801893)
    - mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly
    - fbdev/omapfb: fix omapfb_memory_read infoleak
    - x86/vdso: Fix asm constraints on vDSO syscall fallbacks
    - x86/vdso: Fix vDSO syscall fallback asm constraint regression
    - PCI: Reprogram bridge prefetch registers on resume
    - mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys
    - PM / core: Clear the direct_complete flag on errors
    - dm cache: fix resize crash if user doesn't reload cache table
    - xhci: Add missing CAS workaround for Intel Sunrise Point xHCI
    - USB: serial: simple: add Motorola Tetra MTP6550 id
    - of: unittest: Disable interrupt node tests for old world MAC systems
    - ext4: always verify the magic number in xattr blocks
    - cgroup: Fix deadlock in cpu hotplug path
    - ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
    - ARC: clone syscall to setp r25 as thread pointer
    - ucma: fix a use-after-free in ucma_resolve_ip()
    - ubifs: Check for name being NULL while mounting
    - tcp: increment sk_drops for dropped rx packets
    - tcp: use an RB tree for ooo receive queue
    - tcp: fix a stale ooo_last_skb after a replace
    - tcp: free batches of packets in tcp_prune_ofo_queue()
    - tcp: call tcp_drop() from tcp_data_queue_ofo()
    - tcp: add tcp_ooo_try_coalesce() helper
    - ath10k: fix scan crash due to incorrect length calculation
    - ebtables: arpreply: Add the standard target sanity check
    - Linux 4.4.161
  * mlock203 test in ubuntu_ltp_syscalls failed with Xenial kernel
    (LP: #1793451)
    - mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(,
      MLOCK_ONFAULT)
  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
  * [Ubuntu] net/af_iucv: fix skb leaks for HiperTransport (LP: #1800639)
    - net/af_iucv: drop inbound packets with invalid flags
    - net/af_iucv: fix skb handling on HiperTransport xmit error
  * NULL pointer dereference at 0000000000000020 when access
    dst_orig->ops->family in function  xfrm_lookup_with_ifid() (LP: #1801878)
    - xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
  * [Ubuntu] qeth: Fix potential array overrun in cmd/rc lookup (LP: #1800641)
    - s390: qeth_core_mpc: Use ARRAY_SIZE instead of reimplementing its function
    - s390: qeth: Fix potential array overrun in cmd/rc lookup
  * Packaging resync (LP: #1786013)
    - [Package] add support for specifying the primary makefile

 -- Khalid Elmously <khalid.elmously@canonical.com>  Fri, 16 Nov 2018 20:48:59 +0000

# For older changelog entries, run 'apt-get changelog linux-buildinfo-4.4.0-1044-aws'
