Changelog
linux (4.14.7-1) unstable; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.3
- [s390x] fix transactional execution control register handling
- [s390x] noexec: execute kexec datamover without DAT
- [s390x] runtime instrumention: fix possible memory corruption
- [s390x] guarded storage: fix possible memory corruption
- [s390x] disassembler: add missing end marker for e7 table
- [s390x] disassembler: increase show_code buffer size
- ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
- ACPI / EC: Fix regression related to triggering source of EC event
handling
- cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
- serdev: fix registration of second slave
- sched: Make resched_cpu() unconditional
- lib/mpi: call cond_resched() from mpi_powm() loop
- [x86] boot: Fix boot failure when SMP MP-table is based at 0
- [x86] decoder: Add new TEST instruction pattern
- [amd64] entry: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
- [x86] perf: intel: Hide TSX events when RTM is not supported
- [arm64] Implement arch-specific pte_access_permitted()
- [armhf/armmp-lpae] 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
- [armhf/armmp-lpae] 8721/1: mm: dump: check hardware RO bit for LPAE
- uapi: fix linux/tls.h userspace compilation error
- uapi: fix linux/rxrpc.h userspace compilation errors
- [mips*/4kc-malta] cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work
for 32-bit SMP
- [armhf,arm64] net: mvneta: fix handling of the Tx descriptor counter
- nbd: wait uninterruptible for the dead timeout
- nbd: don't start req until after the dead connection logic
- PM / OPP: Add missing of_node_put(np)
- PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
- PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
- [x86] PCI: hv: Use effective affinity mask
- [arm64] PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
- [arm64] PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
- dm integrity: allow unaligned bv_offset
- dm cache: fix race condition in the writeback mode overwrite_bio
optimisation
- dm crypt: allow unaligned bv_offset
- dm zoned: ignore last smaller runt zone
- dm mpath: remove annoying message of 'blk_get_request() returned -11'
- dm bufio: fix integer overflow when limiting maximum cache size
- ovl: Put upperdentry if ovl_check_origin() fails
- dm: allocate struct mapped_device with kvzalloc
- sched/rt: Simplify the IPI based RT balancing logic
- dm: fix race between dm_get_from_kobject() and __dm_destroy()
- dm: discard support requires all targets in a table support discards
- [mips*] Fix odd fp register warnings with MIPS64r2
- [mips*/4kc-malta] Fix MIPS64 FP save/restore on 32-bit kernels
- [mips*] dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
- [mips*] Fix an n32 core file generation regset support regression
- [mips*] math-emu: Fix final emulation phase for certain instructions
- rt2x00usb: mark device removed when get ENOENT usb error
- mm/z3fold.c: use kref to prevent page free/compact race
- autofs: don't fail mount for transient error
- nilfs2: fix race condition that causes file system corruption
- fscrypt: lock mutex before checking for bounce page pool
- eCryptfs: use after free in ecryptfs_release_messaging()
- libceph: don't WARN() if user tries to add invalid key
- bcache: check ca->alloc_thread initialized before wake up it
- fs: guard_bio_eod() needs to consider partitions
- fanotify: fix fsnotify_prepare_user_wait() failure
- isofs: fix timestamps beyond 2027
- btrfs: change how we decide to commit transactions during flushing
- f2fs: expose some sectors to user in inline data or dentry case
- NFS: Fix typo in nomigration mount option
- NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
- nfs: Fix ugly referral attributes
- NFS: Avoid RCU usage in tracepoints
- NFS: revalidate "." etc correctly on "open".
- nfsd: deal with revoked delegations appropriately
- rtlwifi: rtl8192ee: Fix memory leak when loading firmware
- rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
- iwlwifi: fix firmware names for 9000 and A000 series hw
- md: fix deadlock error in recent patch.
- md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
- Bluetooth: btqcomsmd: Add support for BD address setup
- md/bitmap: revert a patch
- fsnotify: clean up fsnotify_prepare/finish_user_wait()
- fsnotify: pin both inode and vfsmount mark
- fsnotify: fix pinning group in fsnotify_prepare_user_wait()
- ata: fixes kernel crash while tracing ata_eh_link_autopsy event
- ext4: fix interaction between i_size, fallocate, and delalloc after a
crash
- ext4: prevent data corruption with inline data + DAX
- ext4: prevent data corruption with journaling + DAX
- ALSA: pcm: update tstamp only if audio_tstamp changed
- ALSA: usb-audio: Add sanity checks to FE parser
- ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
- ALSA: usb-audio: Add sanity checks in v2 clock parsers
- ALSA: timer: Remove kernel warning at compat ioctl error paths
- ALSA: hda/realtek - Fix ALC275 no sound issue
- ALSA: hda: Fix too short HDMI/DP chmap reporting
- ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
- ALSA: hda/realtek - Fix ALC700 family no sound issue
- [x86] mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
- fix a page leak in vhost_scsi_iov_to_sgl() error recovery
- 9p: Fix missing commas in mount options
- fs/9p: Compare qid.path in v9fs_test_inode
- net/9p: Switch to wait_event_killable()
- scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
- scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
- scsi: lpfc: fix pci hot plug crash in timer management routines
- scsi: lpfc: fix pci hot plug crash in list_add call
- scsi: lpfc: Fix crash receiving ELS while detaching driver
- scsi: lpfc: Fix FCP hba_wqidx assignment
- scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
- iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
- iscsi-target: Fix non-immediate TMR reference leak
- target: fix null pointer regression in core_tmr_drain_tmr_list
- target: fix buffer offset in core_scsi3_pri_read_full_status
- target: Fix QUEUE_FULL + SCSI task attribute handling
- target: Fix caw_sem leak in transport_generic_request_failure
- target: Fix quiese during transport_write_pending_qf endless loop
- target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
- mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
- mtd: nand: atmel: Actually use the PM ops
- mtd: nand: omap2: Fix subpage write
- mtd: nand: Fix writing mtdoops to nand flash.
- mtd: nand: mtk: fix infinite ECC decode IRQ issue
- p54: don't unregister leds when they are not initialized
- block: Fix a race between blk_cleanup_queue() and timeout handling
- raid1: prevent freeze_array/wait_all_barriers deadlock
- genirq: Track whether the trigger type has been set
- [armhf,arm64] irqchip/gic-v3: Fix ppi-partitions lookup
- lockd: double unregister of inetaddr notifiers
- [powerpc*] KVM: Book3S HV: Don't call real-mode XICS hypercall handlers
if not enabled
- [x86] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
- [x86] KVM: SVM: obey guest PAT
- [x86] kvm: vmx: Reinstate support for CPUs without virtual NMI
(Closes: #884482)
- dax: fix PMD faults on zero-length files
- dax: fix general protection fault in dax_alloc_inode
- SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
- [armhf] clk: ti: dra7-atl-clock: fix child-node lookups
- libnvdimm, dimm: clear 'locked' status on successful DIMM enable
- libnvdimm, pfn: make 'resource' attribute only readable by root
- libnvdimm, namespace: fix label initialization to use valid seq numbers
- libnvdimm, region : make 'resource' attribute only readable by root
- libnvdimm, namespace: make 'resource' attribute only readable by root
- svcrdma: Preserve CB send buffer across retransmits
- IB/srpt: Do not accept invalid initiator port names
- IB/cm: Fix memory corruption in handling CM request
- IB/hfi1: Fix incorrect available receive user context count
- IB/srp: Avoid that a cable pull can trigger a kernel crash
- IB/core: Avoid crash on pkey enforcement failed in received MADs
- IB/core: Only maintain real QPs in the security lists
- NFC: fix device-allocation error return
- spi-nor: intel-spi: Fix broken software sequencing codes
- fm10k,i40e,i40evf,igb,igbvf,ixgbe,ixgbevf: Use smp_rmb rather than
read_barrier_depends
- [hppa] Fix validity check of pointer size argument in new CAS
implementation
- [powerpc*] Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
- [powerpc*] mm/radix: Fix crashes on Power9 DD1 with radix MMU and
STRICT_RWX
- [powerpc*] perf/imc: Use cpu_to_node() not topology_physical_package_id()
- [powerpc*] signal: Properly handle return value from uprobe_deny_signal()
- [powerpc*] 64s: Fix masking of SRR1 bits on instruction fault
- [powerpc*] 64s/radix: Fix 128TB-512TB virtual address boundary case
allocation
- [powerpc*] 64s/hash: Fix 512T hint detection to use >= 128T
- [powerpc*] 64s/hash: Fix 128TB-512TB virtual address boundary case
allocation
- [powerpc*] 64s/hash: Fix fork() with 512TB process address space
- [powerpc*] 64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
- media: Don't do DMA on stack for firmware upload in the AS102 driver
- media: rc: check for integer overflow
- media: rc: nec decoder should not send both repeat and keycode
- media: v4l2-ctrl: Fix flags field on Control events
- [arm64] media: venus: fix wrong size on dma_free
- [arm64] media: venus: venc: fix bytesused v4l2_plane field
- [arm64] media: venus: reimplement decoder stop command
- [arm64] dts: meson-gxl: Add alternate ARM Trusted Firmware reserved
memory zone
- iwlwifi: fix wrong struct for a000 device
- iwlwifi: fix PCI IDs and configuration mapping for 9000 series
- iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
- e1000e: Fix error path in link detection
- e1000e: Fix return value test
- e1000e: Separate signaling for link check/link up
- e1000e: Avoid receiver overrun interrupt bursts
- e1000e: fix buffer overrun while the I219 is processing DMA transactions
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4
- [x86]: platform: hp-wmi: Fix tablet mode detection for convertibles
- mm, memory_hotplug: do not back off draining pcp free pages from kworker
context
- mm, oom_reaper: gather each vma to prevent leaking TLB entry
- [armhf,arm64] mm/cma: fix alloc_contig_range ret code/potential leak
- mm: fix device-dax pud write-faults triggered by get_user_pages()
- mm, hugetlbfs: introduce ->split() to vm_operations_struct
- device-dax: implement ->split() to catch invalid munmap attempts
- mm: introduce get_user_pages_longterm
- mm: fail get_vaddr_frames() for filesystem-dax mappings
- v4l2: disable filesystem-dax mapping support
- IB/core: disable memory registration of filesystem-dax vmas
- exec: avoid RLIMIT_STACK races with prlimit()
- mm/madvise.c: fix madvise() infinite loop under special circumstances
- mm: migrate: fix an incorrect call of prep_transhuge_page()
- mm, memcg: fix mem_cgroup_swapout() for THPs
- fs/fat/inode.c: fix sb_rdonly() change
- autofs: revert "autofs: take more care to not update last_used on path
walk"
- autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored"
- mm/hugetlb: fix NULL-pointer dereference on 5-level paging machine
- btrfs: clear space cache inode generation always
- nfsd: Fix stateid races between OPEN and CLOSE
- nfsd: Fix another OPEN stateid race
- nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
- crypto: algif_aead - skip SGL entries with NULL page
- crypto: af_alg - remove locking in async callback
- crypto: skcipher - Fix skcipher_walk_aead_common
- lockd: lost rollback of set_grace_period() in lockd_down_net()
- [s390x] revert ELF_ET_DYN_BASE base changes
- [armhf] drm: omapdrm: Fix DPI on platforms using the DSI VDDS
- [armhf] omapdrm: hdmi4: Correct the SoC revision matching
- [arm64] module-plts: factor out PLT generation code for ftrace
- [arm64] ftrace: emit ftrace-mod.o contents through code
- [powerpc*] powernv: Fix kexec crashes caused by tlbie tracing
- [powerpc*] kexec: Fix kexec/kdump in P9 guest kernels
- [x86] KVM: pvclock: Handle first-time write to pvclock-page contains
random junk
- [x86] KVM: Exit to user-mode on #UD intercept when emulator requires
- [x86] KVM: inject exceptions produced by x86_decode_insn
- [x86] KVM: lapic: Split out x2apic ldr calculation
- [x86] KVM: lapic: Fixup LDR on load in x2apic
- mmc: sdhci: Avoid swiotlb buffer being full
- mmc: block: Fix missing blk_put_request()
- mmc: block: Check return value of blk_get_request()
- mmc: core: Do not leave the block driver in a suspended state
- mmc: block: Ensure that debugfs files are removed
- mmc: core: prepend 0x to pre_eol_info entry in sysfs
- mmc: core: prepend 0x to OCR entry in sysfs
- ACPI / EC: Fix regression related to PM ops support in ECDT device
- eeprom: at24: fix reading from 24MAC402/24MAC602
- eeprom: at24: correctly set the size for at24mac402
- eeprom: at24: check at24_read/write arguments
- [alpha,x86] i2c: i801: Fix Failed to allocate irq -2147483648 error
- bcache: Fix building error on MIPS
- bcache: only permit to recovery read error when cache device is clean
- bcache: recover data from backing when data is clean
- hwmon: (jc42) optionally try to disable the SMBUS timeout
- nvme-pci: add quirk for delay before CHK RDY for WDC SN200
- Revert "drm/radeon: dont switch vt on suspend"
- drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
- drm/amdgpu: Potential uninitialized variable in
amdgpu_vm_update_directories()
- drm/amdgpu: correct reference clock value on vega10
- drm/amdgpu: fix error handling in amdgpu_bo_do_create
- drm/amdgpu: Properly allocate VM invalidate eng v2
- drm/amdgpu: Remove check which is not valid for certain VBIOS
- drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more
- dma-buf: make reservation_object_copy_fences rcu save
- drm/amdgpu: reserve root PD while releasing it
- drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list
- drm/vblank: Fix flip event vblank count
- drm/vblank: Tune drm_crtc_accurate_vblank_count() WARN down to a debug
- drm/tilcdc: Precalculate total frametime in tilcdc_crtc_set_mode()
- drm/radeon: fix atombios on big endian
- drm/panel: simple: Add missing panel_simple_unprepare() calls
- [arm64] drm/hisilicon: Ensure LDI regs are properly configured.
- drm/ttm: once more fix ttm_buffer_object_transfer
- drm/amd/pp: fix typecast error in powerplay.
- drm/fb_helper: Disable all crtc's when initial setup fails.
- drm/edid: Don't send non-zero YQ in AVI infoframe for HDMI 1.x sinks
- drm/amdgpu: move UVD/VCE and VCN structure out from union
- drm/amdgpu: Set adev->vcn.irq.num_types for VCN
- IB/core: Do not warn on lid conversions for OPA
- IB/hfi1: Do not warn on lid conversions for OPA
- e1000e: fix the use of magic numbers for buffer overrun issue
- md: forbid a RAID5 from having both a bitmap and a journal.
- [x86] drm/i915: Fix false-positive assert_rpm_wakelock_held in
i915_pmic_bus_access_notifier v2
- [x86] drm/i915: Re-register PMIC bus access notifier on runtime resume
- [x86] drm/i915/fbdev: Serialise early hotplug events with async fbdev
config
- [x86] drm/i915/gvt: Correct ADDR_4K/2M/1G_MASK definition
- [x86] drm/i915: Don't try indexed reads to alternate slave addresses
- [x86] drm/i915: Prevent zero length "index" write
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.5
- drm/amdgpu: Use unsigned ring indices in amdgpu_queue_mgr_map
- [s390x] runtime instrumentation: simplify task exit handling
- usbip: fix usbip attach to find a port that matches the requested speed
- usbip: Fix USB device hang due to wrong enabling of scatter-gather
- uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
- usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
- serial: 8250_early: Only set divisor if valid clk & baud
- [mips*] Add custom serial.h with BASE_BAUD override for generic kernel
- ima: fix hash algorithm initialization
- [s390x] vfio-ccw: Do not attempt to free no-op, test and tic cda.
- PM / Domains: Fix genpd to deal with drivers returning 1 from ->prepare()
- [s390x] pci: do not require AIS facility
- serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
- staging: rtl8188eu: avoid a null dereference on pmlmepriv
- [arm64] mmc: sdhci-msm: fix issue with power irq
- hwmon: (pmbus/core) Prevent unintentional setting of page to 0xFF
- perf/core: Fix __perf_read_group_add() locking
- [armhf] PCI: dra7xx: Create functional dependency between PCIe and PHY
- [x86] intel_rdt: Initialize bitmask of shareable resource if CDP enabled
- [x86] intel_rdt: Fix potential deadlock during resctrl mount
- serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X
- kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y
- [x86] entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
- [armhf,arm64] clocksource/drivers/arm_arch_timer: Validate CNTFRQ after
enabling frame
- [x86] EDAC, sb_edac: Fix missing break in switch
- [arm64] cpuidle: Correct driver unregistration if init fails
- usb: xhci: Return error when host is dead in xhci_disable_slot()
- [armel,armhf] sysrq : fix Show Regs call trace on ARM
- [sh4] serial: sh-sci: suppress warning for ports without dma channels
- [armhf] serial: imx: Update cached mctrl value when changing RTS
- [x86] kprobes: Disable preemption in ftrace-based jprobes
- [x86] locking/refcounts, asm: Use unique .text section for refcount
exceptions
- [s390x] ptrace: fix guarded storage regset handling
- perf tools: Fix leaking rec_argv in error cases
- mm, x86/mm: Fix performance regression in get_user_pages_fast()
- iio: adc: ti-ads1015: add 10% to conversion wait time
- iio: multiplexer: add NULL check on devm_kzalloc() and devm_kmemdup()
return values
- [x86] locking/refcounts, asm: Enable CONFIG_ARCH_HAS_REFCOUNT
- [powerpc*] jprobes: Disable preemption when triggered through ftrace
- [powerpc*] kprobes: Disable preemption before invoking probe handler for
optprobes
- usb: hub: Cycle HUB power when initialization fails
- [armhf,arm64] USB: ulpi: fix bus-node lookup
- xhci: Don't show incorrect WARN message about events for empty rings
- usb: xhci: fix panic in xhci_free_virt_devices_depth_first
- USB: core: Add type-specific length check of BOS descriptors
- USB: usbfs: Filter flags passed in from user space
- usb: host: fix incorrect updating of offset
- locking/refcounts: Do not force refcount_t usage as GPL-only export
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.6
- usb: gadget: core: Fix ->udc_set_speed() speed handling
- serdev: ttyport: add missing receive_buf sanity checks
- serdev: ttyport: fix NULL-deref on hangup
- serdev: ttyport: fix tty locking in close
- usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
- can: peak/pci: fix potential bug when probe() fails
- can: kvaser_usb: free buf in error paths
- can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
- can: kvaser_usb: ratelimit errors if incomplete messages are received
- can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
- can: ems_usb: cancel urb on -EPIPE and -EPROTO
- can: esd_usb2: cancel urb on -EPIPE and -EPROTO
- can: usb_8dev: cancel urb on -EPIPE and -EPROTO
- can: peak/pcie_fd: fix potential bug in restarting tx queue
- virtio: release virtio index when fail to device_register
- [arm64] pinctrl: armada-37xx: Fix direction_output() callback behavior
- [x86] Drivers: hv: vmbus: Fix a rescind issue
- [x86] hv: kvp: Avoid reading past allocated blocks from KVP file
- firmware: vpd: Destroy vpd sections in remove function
- firmware: vpd: Tie firmware kobject to device lifetime
- firmware: vpd: Fix platform driver and device registration/unregistration
- scsi: dma-mapping: always provide dma_get_cache_alignment
- scsi: use dma_get_cache_alignment() as minimum DMA alignment
- scsi: libsas: align sata_device's rps_resp on a cacheline
- efi: Move some sysfs files to be read-only by root
- efi/esrt: Use memunmap() instead of kfree() to free the remapping
- ASN.1: fix out-of-bounds read when parsing indefinite length item
- ASN.1: check for error from ASN1_OP_END__ACT actions
- KEYS: add missing permission check for request_key() destination
(CVE-2017-17807)
- KEYS: reject NULL restriction string when type is specified
- X.509: reject invalid BIT STRING for subjectPublicKey
- X.509: fix comparisons of ->pkey_algo
- [x86] idt: Load idt early in start_secondary
- [x86] PCI: Make broadcom_postcore_init() check acpi_disabled
- [x86] KVM: fix APIC page invalidation
- btrfs: fix missing error return in btrfs_drop_snapshot
- btrfs: handle errors while updating refcounts in update_ref_for_cow
- ALSA: pcm: prevent UAF in snd_pcm_info
- ALSA: seq: Remove spurious WARN_ON() at timer check
- ALSA: usb-audio: Fix out-of-bound error
- ALSA: usb-audio: Add check return value for usb_string()
- [x86] iommu/vt-d: Fix scatterlist offset handling
- smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place
- [s390x] always save and restore all registers on context switch
- [s390x] mm: fix off-by-one bug in 5-level page table handling
- [s390x] fix compat system call table
- [s390x] KVM: Fix skey emulation permission check
- [powerpc*] Revert "powerpc: Do not call ppc_md.panic in fadump panic
notifier"
- [powerpc*] 64s: Initialize ISAv3 MMU registers before setting partition
table
- iwlwifi: mvm: mark MIC stripped MPDUs
- iwlwifi: mvm: don't use transmit queue hang detection when it is not
possible
- iwlwifi: mvm: flush queue before deleting ROC
- iwlwifi: mvm: fix packet injection
- iwlwifi: mvm: enable RX offloading with TKIP and WEP
- brcmfmac: change driver unbind order of the sdio function devices
- md/r5cache: move mddev_lock() out of r5c_journal_mode_set()
- [armhf] drm/bridge: analogix dp: Fix runtime PM state in get_modes()
callback
- [armhf] drm/exynos: gem: Drop NONCONTIG flag for buffers allocated
without IOMMU
- [x86] drm/i915: Fix vblank timestamp/frame counter jumps on gen2
- media: dvb: i2c transfers over usb cannot be done from stack
- media: rc: sir_ir: detect presence of port
- media: rc: partial revert of "media: rc: per-protocol repeat period"
- [arm64] KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
- [armhf] KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
- [x86] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
(CVE-2017-1000407)
- [armhf,arm64] KVM: Fix broken GICH_ELRSR big endian conversion
- [armhf,arm64] KVM: vgic-irqfd: Fix MSI entry allocation
- [armhf,arm64] KVM: vgic: Preserve the revious read from the pending table
- [armhf,arm64] KVM: vgic-its: Check result of allocation before use
- [arm64] fpsimd: Prevent registers leaking from dead tasks
- [arm64] SW PAN: Point saved ttbr0 at the zero page when switching to
init_mm
- [arm64] SW PAN: Update saved ttbr0 value on enter_lazy_tlb
- [armhf] Revert "ARM: dts: imx53: add srtc node"
- [armhf] bus: arm-cci: Fix use of smp_processor_id() in preemptible context
- IB/core: Only enforce security for InfiniBand
- [armel,armhf] BUG if jumping to usermode address in kernel mode
- [armel,armhf] avoid faulting on qemu
- [arm64] irqchip/qcom: Fix u32 comparison with value less than zero
- [powerpc*] perf: Fix pmu_count to count only nest imc pmus
- apparmor: fix leak of null profile name if profile allocation fails
- mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
- gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
- route: also update fnhe_genid when updating a route cache
- route: update fnhe_expires for redirect when the fnhe exists
- rsi: fix memory leak on buf and usb_reg_buf
- pipe: match pipe_max_size data type with procfs
- lib/genalloc.c: make the avail variable an atomic_long_t
- NFS: Fix a typo in nfs_rename()
- sunrpc: Fix rpc_task_begin trace point
- nfp: inherit the max_mtu from the PF netdev
- nfp: fix flower offload metadata flag usage
- xfs: fix forgotten rcu read unlock when skipping inode reclaim
- block: wake up all tasks blocked in get_request()
- [sparc64] mm: set fields in deferred pages
- zsmalloc: calling zs_map_object() from irq is a bug
- slub: fix sysfs duplicate filename creation when slub_debug=O
- sctp: do not free asoc when it is already dead in sctp_sendmsg
- sctp: use the right sk after waking up from wait_buf sleep
- fcntl: don't leak fd reference when fixup_compat_flock fails
- geneve: fix fill_info when link down
- bpf: fix lockdep splat
- [arm64] clk: qcom: common: fix legacy board-clock registration
- [arm64] clk: hi3660: fix incorrect uart3 clock freqency
- atm: horizon: Fix irq release error
- xfrm: Copy policy family in clone_policy
- f2fs: fix to clear FI_NO_PREALLOC
- bnxt_re: changing the ip address shouldn't affect new connections
- IB/mlx4: Increase maximal message size under UD QP
- IB/mlx5: Assign send CQ and recv CQ of UMR QP
- afs: Fix total-length calculation for multiple-page send
- afs: Connect up the CB.ProbeUuid
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.7
- net: realtek: r8169: implement set_link_ksettings()
- [s390x] qeth: fix early exit from error path
- tipc: fix memory leak in tipc_accept_from_sock()
- vhost: fix skb leak in handle_rx()
- rds: Fix NULL pointer dereference in __rds_rdma_map
- sit: update frag_off info
- tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb()
- packet: fix crash in fanout_demux_rollover()
- net/packet: fix a race in packet_bind() and packet_notifier()
- tcp: remove buggy call to tcp_v6_restore_cb()
- usbnet: fix alignment for frames with no ethernet header
- net: remove hlist_nulls_add_tail_rcu()
- stmmac: reset last TSO segment size after device open
- tcp/dccp: block bh before arming time_wait timer
- [s390x] qeth: build max size GSO skbs on L2 devices
- [s390x] qeth: fix thinko in IPv4 multicast address tracking
- [s390x] qeth: fix GSO throughput regression
- tcp: use IPCB instead of TCP_SKB_CB in inet_exact_dif_match()
- tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
- tcp: use current time in tcp_rcv_space_adjust()
- net: sched: cbq: create block for q->link.block
- tap: free skb if flags error
- tcp: when scheduling TLP, time of RTO should account for current ACK
- tun: free skb in early errors
- net: ipv6: Fixup device for anycast routes during copy
- tun: fix rcu_read_lock imbalance in tun_build_skb
- net: accept UFO datagrams from tuntap and packet
- net: openvswitch: datapath: fix data type in queue_gso_packets
- cls_bpf: don't decrement net's refcount when offload fails
- sctp: use right member as the param of list_for_each_entry
- ipmi: Stop timers before cleaning up the module
- usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
- fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall
- fix kcm_clone()
- [armhf,arm64] KVM: vgic-its: Preserve the revious read from the pending
table
- kbuild: do not call cc-option before KBUILD_CFLAGS initialization
- [powerpc*] powernv/idle: Round up latency and residency values
- ipvlan: fix ipv6 outbound device
- blk-mq: Avoid that request queue removal can trigger list corruption
- nvmet-rdma: update queue list during ib_device removal
- audit: Allow auditd to set pid to 0 to end auditing
- audit: ensure that 'audit=1' actually enables audit for PID 1
- dm raid: fix panic when attempting to force a raid to sync
- md: free unused memory after bitmap resize
- RDMA/cxgb4: Annotate r2 and stag as __be32
- [x86] intel_rdt: Fix potential deadlock during resctrl unmount
[ Salvatore Bonaccorso ]
* Add ABI reference for 4.14.0-1
* xen/time: do not decrease steal time after live migration on xen
(Closes: #871608)
* crypto: salsa20 - fix blkcipher_walk API usage (CVE-2017-17805)
* crypto: hmac - require that the underlying hash algorithm is unkeyed
(CVE-2017-17806)
[ Vagrant Cascadian ]
* [armhf, arm64] Backport patches from 4.15.x to support dwmac-sun8i.
[ Ben Hutchings ]
* [rt] Update to 4.14.6-rt7:
- hrtimer: account for migrated timers
- crypto: mcryptd: protect the per-CPU queue with a lock
- tracing: Update inter-event hist trigger support to v7:
+ Rename virtual "$common_timestamp" field to "common_timestamp"
+ Fix use-after-free in trigger removal
- mm/slub: close possible memory-leak in kmem_cache_alloc_bulk()
- crypto: limit more FPU-enabled sections
* dccp: CVE-2017-8824: use-after-free in DCCP code
* netfilter: nfnetlink_cthelper: Add missing permission checks
(CVE-2017-17448)
* netlink: Add netns check on taps (CVE-2017-17449)
* netfilter: xt_osf: Add missing permission checks (CVE-2017-17450)
* USB: core: prevent malicious bNumInterfaces overflow (CVE-2017-17558)
* net: ipv4: fix for a race condition in raw_sendmsg (CVE-2017-17712)
* media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
(CVE-2017-16538)
* media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
(CVE-2017-16538)
* media: hdpvr: Fix an error handling path in hdpvr_probe() (CVE-2017-16644)
* [armhf,arm64,x86] KVM: Fix stack-out-of-bounds read in write_mmio
(CVE-2017-17741)
* bluetooth: Prevent stack info leak from the EFS element.
(CVE-2017-1000410)
* bpf/verifier: Fix multiple security issues (Closes: #883558):
- encapsulate verifier log state into a structure
- move global verifier log into verifier environment
- fix branch pruning logic
- fix bounds calculation on BPF_RSH
- fix incorrect sign extension in check_alu_op() (CVE-2017-16995)
- fix incorrect tracking of register size truncation (CVE-2017-16996)
- fix 32-bit ALU op verification
- fix missing error return in check_stack_boundary()
- force strict alignment checks for stack pointers
- don't prune branches when a scalar is replaced with a pointer
- fix integer overflows
* Bump ABI to 2
-- Ben Hutchings <email address hidden> Fri, 22 Dec 2017 14:12:23 +0000
