linux (4.19.194-2) buster; urgency=medium * proc: Track /proc/$pid/attr/ opener mm_struct (Closes: #990072) -- Salvatore Bonaccorso Mon, 21 Jun 2021 10:46:20 +0200 linux (4.19.194-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.182 - [arm64] KVM: nvhe: Save the SPE context early - [armhf] net: dsa: b53: Support setting learning on port https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.183 - ALSA: hda: generic: Fix the micmute led init state - Revert "PM: runtime: Update device status before letting suppliers suspend" - vmlinux.lds.h: Create section for protection against instrumentation - btrfs: fix race when cloning extent buffer during rewind of an old root (CVE-2021-28964) - btrfs: fix slab cache flags for free space tree bitmap - [armhf] ASoC: fsl_ssi: Fix TDM slot setup for I2S mode - nvmet: don't check iosqes,iocqes for discovery controllers - NFSD: Repair misuse of sv_lock in 5.10.16-rt30. - svcrdma: disable timeouts on rdma backchannel - sunrpc: fix refcount leak for rpc auth modules - scsi: lpfc: Fix some error codes in debugfs - nvme-rdma: fix possible hang when failing to set io queues - [powerpc*] Force inlining of cpu_has_feature() to avoid build failure - usb-storage: Add quirk to defeat Kindle's automatic unload - usbip: Fix incorrect double assignment to udc->ud.tcp_rx - USB: replace hardcode maximum usb string length by definition - usb: gadget: configfs: Fix KASAN use-after-free - [arm64] iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel - iio: hid-sensor-prox: Fix scale not correct issue - [powerpc*] PCI: rpadlpar: Fix potential drc_name corruption in store functions (CVE-2021-28972) - [x86] perf/x86/intel: Fix a crash caused by zero PEBS status (CVE-2021-28971) - [x86] ioapic: Ignore IRQ2 again - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() - [x86] Move TS_COMPAT back to asm/thread_info.h - [x86] Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall() - ext4: find old entry again if failed to rename whiteout - ext4: do not try to set xattr into ea_inode if value is empty - ext4: fix potential error in ext4_do_update_inode - genirq: Disable interrupts for force threaded handlers - [x86] apic/of: Fix CPU devicetree-node lookups - cifs: Fix preauth hash corruption https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.184 - [armhf] net: fec: ptp: avoid register access when ipg clock is disabled - [powerpc*] 4xx: Fix build errors from mfdcr() - atm: eni: dont release is never initialized - atm: lanai: dont run lanai_dev_close if not open - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" - ixgbe: Fix memleak in ixgbe_configure_clsu32 - net: tehuti: fix error return code in bdx_probe() - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count - gianfar: fix jumbo packets+napi+rx overrun crash (CVE-2021-29264) - gpiolib: acpi: Add missing IRQF_ONESHOT - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default - NFS: Correct size calculation for create reply length - [arm64] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() - [x86] atm: uPD98402: fix incorrect allocation - atm: idt77252: fix null-ptr-dereference - u64_stats,lockdep: Fix u64_stats_init() vs lockdep - nfs: we don't support removing system.nfs4_acl - block: Suppress uevent for hidden device when removed - [arm64] netsec: restore phy power state after controller reset - [x86] platform/x86: intel-vbtn: Stop reporting SW_DOCK events - squashfs: fix inode lookup sanity checks - squashfs: fix xattr id and id lookup sanity checks - dm ioctl: fix out of bounds array access when no devices (CVE-2021-31916) - [armhf] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD - veth: Store queue_mapping independently of XDP prog presence - libbpf: Fix INSTALL flag order - macvlan: macvlan_count_rx() needs to be aware of preemption - [armhf] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port - e1000e: add rtnl_lock() to e1000_reset_task - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template - netfilter: ctnetlink: fix dump of the expect mask attribute - can: peak_usb: add forgotten supported devices - [armhf] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate - mac80211: fix rate mask reset - net: cdc-phonet: fix data-interface release on probe failure - [arm64,armhf] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes - [arm64] drm/msm: fix shutdown hook in case GPU components failed to bind - net/mlx5e: Fix error path for ethtool set-priv-flag - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server - bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs - Revert "netfilter: x_tables: Switch synchronization to RCU" - netfilter: x_tables: Use correct memory barriers. (CVE-2021-29650) - Revert "netfilter: x_tables: Update remaining dereference to RCU" - ACPI: scan: Rearrange memory allocation in acpi_device_add() - ACPI: scan: Use unique number for instance_no - dm verity: add root hash pkcs#7 signature verification - scsi: qedi: Fix error return code of qedi_alloc_global_queues() - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() - locking/mutex: Fix non debug version of mutex_lock_io_nested() - can: dev: Move device back to init netns on owning netns delete - net: sched: validate stab values - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() (CVE-2021-29647) - mac80211: fix double free in ibss_leave - ext4: add reclaim checks to xattr code - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" - xen-blkback: don't leak persistent grants from xen_blkbk_map() (CVE-2021-28688) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.185 - selinux: vsock: Set SID for socket returned by accept() - tcp: relookup sock for RST+ACK packets handled by obsolete req sock - ipv6: weaken the v4mapped source check - ext4: fix bh ref count on error paths - rpc: fix NULL dereference on kmalloc failure - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 - [x86] ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10 - [armhf] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe - [x86] ASoC: es8316: Simplify adc_pga_gain_tlv table - vhost: Fix vhost_vq_reset() - scsi: st: Fix a use after free in st_open() - scsi: qla2xxx: Fix broken #endif placement - [x86] staging: comedi: cb_pcidas: fix request_irq() warn - [x86] staging: comedi: cb_pcidas64: fix request_irq() warn - thermal/core: Add NULL pointer check before using cooling device stats - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling - ext4: do not iput inode under running transaction in ext4_rename() - brcmfmac: clear EAP/association status bits on linkdown events - ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr() - [amd64] net: ethernet: aquantia: Handle error cleanup of start on open - appletalk: Fix skb allocation size in loopback case - [x86] net: wan/lmc: unregister device when no matching device is found - bpf: Remove MTU check in __bpf_skb_max_len - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook - PM: runtime: Fix race getting/putting suppliers at probe - PM: runtime: Fix ordering in pm_runtime_get_suppliers() - tracing: Fix stack trace event size - mm: fix race by making init_zero_pfn() early_initcall - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings() - drm/amdgpu: check alignment on CPU page for bo map - reiserfs: update reiserfs_xattrs_initialized() condition - [arm64,armhf] pinctrl: rockchip: fix restore error in resume - extcon: Add stubs for extcon_register_notifier_all() functions - extcon: Fix error handling in extcon_dev_register - firewire: nosy: Fix a use-after-free bug in nosy_ioctl() (CVE-2021-3483) - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control() - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem - [arm64,armhf] usb: musb: Fix suspend with devices connected for a64 - cdc-acm: fix BREAK rx code path adding necessary calls - USB: cdc-acm: untangle a circular dependency between callback and softint - USB: cdc-acm: downgrade message to debug - USB: cdc-acm: fix double free on probe failure - USB: cdc-acm: fix use-after-free after probe failure - [i386] usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference - [arm*] usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board. - [x86] staging: rtl8192e: Fix incorrect source in memcpy() - staging: rtl8192e: Change state information from u16 to u8 - drivers: video: fbcon: fix NULL dereference in fbcon_cursor() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.186 - [armhf] bus: ti-sysc: Fix warning on unbind if reset is not deasserted - [x86] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2 - mISDN: fix crash in fritzpci - mac80211: choose first enabled channel for monitor - [arm64] drm/msm: Ratelimit invalid-fence message - [x86] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state - scsi: target: pscsi: Clean up after failure in pscsi_map_sg() - cifs: revalidate mapping when we open files for SMB1 POSIX - cifs: Silently ignore unknown oplock break handle - [amd64] bpf, x86: Validate computation of branch displacements for x86-64 (CVE-2021-29154) - [i386] bpf, x86: Validate computation of branch displacements for x86-32 (CVE-2021-29154) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.187 - ALSA: aloop: Fix initialization of controls - [x86] ASoC: intel: atom: Stop advertising non working S24LE support - nfc: fix refcount leak in llcp_sock_bind() (CVE-2020-25670) - nfc: fix refcount leak in llcp_sock_connect() (CVE-2020-25671) - nfc: fix memory leak in llcp_sock_connect() (CVE-2020-25672) - nfc: Avoid endless loops caused by repeated llcp_sock_connect() - xen/evtchn: Change irq_info lock to raw_spinlock_t - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh - ocfs2: fix deadlock between setattr and dio_end_io_write - fs: direct-io: fix missing sdio->boundary - [armhf] dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field - ice: Increase control queue timeout - net: hso: fix null-ptr-deref during tty device unregistration - net: ensure mac header is set in virtio_net_hdr_to_skb() - net: sched: sch_teql: fix null-pointer dereference - net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() - usbip: add sysfs_lock to synchronize sysfs code paths - usbip: stub-dev synchronize sysfs code paths - usbip: vudc synchronize sysfs code paths - usbip: synchronize event handler with sysfs code paths - i2c: turn recovery error on init to debug - virtio_net: Add XDP meta data support - xfrm: interface: fix ipv4 pmtu check to honor ip header df - net: xfrm: Localize sequence counter per network namespace - i40e: Added Asym_Pause to supported link modes - i40e: Fix kernel oops when i40e driver removes VF's - sch_red: fix off-by-one checks in red_check_params() - cxgb4: avoid collecting SGE_QBASE regs during traffic - net:tipc: Fix a double free in tipc_sk_mcast_rcv - [armhf] ASoC: sunxi: sun4i-codec: fill ASoC card owner - clk: fix invalid usage of list cursor in register - clk: fix invalid usage of list cursor in unregister - workqueue: Move the position of debug_work_activate() in __queue_work() - [s390x] cpcmd: fix inline assembly register clobbering - net/mlx5: Fix placement of log_max_flow_counter - net/mlx5: Fix PBMC register mapping - RDMA/cxgb4: check for ipv6 address properly while destroying listener - [armhf] clk: socfpga: fix iomem pointer cast on 64-bit - net: sched: bump refcount for new action in ACT replace mode - cfg80211: remove WARN_ON() in cfg80211_sme_connect - net: tun: set tun->dev->addr_len during TUNSETLINK processing - drivers: net: fix memory leak in atusb_probe - drivers: net: fix memory leak in peak_usb_create_dev - net: mac802154: Fix general protection fault - net: ieee802154: nl-mac: fix check on panid - net: ieee802154: fix nl802154 del llsec key - net: ieee802154: fix nl802154 del llsec dev - net: ieee802154: fix nl802154 add llsec key - net: ieee802154: fix nl802154 del llsec devkey - net: ieee802154: forbid monitor for set llsec params - net: ieee802154: forbid monitor for del llsec seclevel - net: ieee802154: stop dump llsec params for monitors - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath." (Closes: #988352) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.188 - [arm64] KVM: Hide system instruction access to Trace registers - [arm64] KVM: Disable guest access to trace filter controls - [armhf] drm/imx: imx-ldb: fix out of bounds array access warning - gfs2: report "already frozen/thawed" errors - [arm64,armhf] drm/tegra: dc: Don't set PLL clock to 0Hz - block: only update parent bi_status when bio fail - net: phy: broadcom: Only advertise EEE for supported modes - staging: m57621-mmc: delete driver from the tree. (Closes: #986949) - netfilter: x_tables: fix compat match/target pad out-of-bound write - driver core: Fix locking bug in deferred_probe_timeout_work_func() - xen/events: fix setting irq affinity https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.189 - net/sctp: fix race condition in sctp_destroy_sock - gpio: sysfs: Obey valid_mask - neighbour: Disregard DEAD dst in neigh_update - [arm64] drm/msm: Fix a5xx/a6xx timestamps - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state - net: ieee802154: stop dump llsec keys for monitors - net: ieee802154: stop dump llsec devs for monitors - net: ieee802154: forbid monitor for add llsec dev - net: ieee802154: stop dump llsec devkeys for monitors - net: ieee802154: forbid monitor for add llsec devkey - net: ieee802154: stop dump llsec seclevels for monitors - net: ieee802154: forbid monitor for add llsec seclevel - pcnet32: Use pci_resource_len to validate PCI resource - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices - readdir: make sure to verify directory entry for legacy interfaces too - [arm64] fix inline asm in load_unaligned_zeropad() - [arm64] alternatives: Move length validation in alternative_{insn, endif} - scsi: libsas: Reset num_scatter if libata marks qc as NODATA - netfilter: conntrack: do not print icmpv6 as unknown via /proc - netfilter: nft_limit: avoid possible divide error in nft_limit_init - net: sit: Unregister catch-all devices - net: ip6_tunnel: Unregister catch-all devices - i40e: fix the panic when running bpf in xdpdrv mode - [armel,armhf] 9071/1: uprobes: Don't hook on thumb instructions - net: phy: marvell: fix detection of PHY on Topaz switches - gup: document and work around "COW can break either way" issue (CVE-2020-29374) - [x86] pinctrl: lewisburg: Update number of pins in community - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() - [x86] perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 - HID: alps: fix error return code in alps_input_configured() - HID: wacom: Assign boolean values to a bool variable - net: geneve: check skb is large enough for IPv4/IPv6 header - [s390x] entry: save the caller of psw_idle - xen-netback: Check for hotplug-status existence before watching - [x86] crash: Fix crash_setup_memmap_entries() out-of-bounds access - net: hso: fix NULL-deref on disconnect regression - USB: CDC-ACM: fix poison/unpoison imbalance https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.190 - [x86] ACPI: tables: x86: Reserve memory occupied by ACPI tables - [x86] ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade() - net: usb: ax88179_178a: initialize local variables before use - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() - [mips*] Do not include hi and lo in clobber list for R6 - bpf: Fix masking negation logic upon negative dst register (CVE-2021-31829) - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd() - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet - USB: Add reset-resume quirk for WD19's Realtek Hub - [x86] platform/x86: thinkpad_acpi: Correct thermal sensor allocation - ovl: allow upperdir inside lowerdir https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.191 - [s390x] disassembler: increase ebpf disasm buffer size - ftrace: Handle commands when closing set_ftrace_filter file - ecryptfs: fix kernel panic with null dev_name - [armhf] spi: spi-ti-qspi: Free DMA resources - scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers - mmc: block: Update ext_csd.cache_ctrl if it was written - mmc: block: Issue a cache flush only when it's enabled - mmc: core: Do a power cycle when the CMD11 fails - mmc: core: Set read only for SD cards with permanent write protect bit - cifs: Return correct error code from smb2_get_enc_key - btrfs: fix metadata extent leak after failure to create subvolume - [x86] intel_th: pci: Add Rocket Lake CPU support - fbdev: zero-fill colormap in fbcmap.c - staging: wimax/i2400m: fix byte-order issue - crypto: api - check for ERR pointers in crypto_destroy_tfm() - usb: gadget: uvc: add bInterval checking for HS mode - [x86] genirq/matrix: Prevent allocation counter corruption - usb: gadget: f_uac1: validate input parameters - [arm64,armhf] usb: dwc3: gadget: Ignore EP queue requests during bus reset - usb: xhci: Fix port minor revision - PCI: PM: Do not read power state in pci_enable_device_flags() - [arm64] tee: optee: do not check memref size on return from Secure World - [arm*] perf/arm_pmu_platform: Fix error handling - xhci: check control context is valid before dereferencing it. - xhci: fix potential array out of bounds with several interrupters - [x86] intel_th: Consistency and off-by-one fix - [armhf] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe - scsi: lpfc: Fix pt2pt connection does not recover after LOGO - scsi: target: pscsi: Fix warning in pscsi_complete_cmd() - [x86] media: ite-cir: check for receive overflow - power: supply: bq27xxx: fix power_avg for newer ICs - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs - media: gspca/sq905.c: fix uninitialized variable - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() - scsi: qla2xxx: Fix use after free in bsg - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() - media: em28xx: fix memory leak - media: vivid: update EDID - [armhf] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return - media: dvb-usb: fix memory leak in dvb_usb_adapter_init - media: gscpa/stv06xx: fix memory leak - [arm64] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal - drm/amdgpu: fix NULL pointer dereference - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic - scsi: libfc: Fix a format specifier - [s390x] archrandom: add parameter check for s390_arch_random_generate - [i386] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer - ALSA: hda/conexant: Re-order CX5066 quirk table entries - [i386] ALSA: sb: Fix two use after free in snd_sb_qsound_build - ALSA: usb-audio: Explicitly set up the clock selector - ALSA: usb-audio: More constifications - ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx - btrfs: fix race when picking most recent mod log operation for an old root - [arm64] vdso: Discard .note.gnu.property sections in vDSO - ubifs: Only check replay with inode type to judge if inode linked - f2fs: fix to avoid out-of-bounds memory access (CVE-2021-3506) - openvswitch: fix stack OOB read while fragmenting IPv4 packets - [arm64] ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure - NFS: Don't discard pNFS layout segments that are marked for return - NFSv4: Don't discard segments marked for return in _pnfs_return_layout() - jffs2: Fix kasan slab-out-of-bounds problem - [powerpc*] eeh: Fix EEH handling for hugepages in ioremap space. - [x86] intel_th: pci: Add Alder Lake-M support - [arm64,x86] tpm: vtpm_proxy: Avoid reading host log when using a virtual device - md/raid1: properly indicate failure when ending a failed write request - dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences - security: commoncap: fix -Wstringop-overread warning - jffs2: check the validity of dstlen in jffs2_zlib_compress() - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") - posix-timers: Preserve return value in clock_adjtime32() - [arm64] vdso: remove commas between macro name and arguments - ext4: fix check to prevent false positive report of incorrect used inodes - ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() - ext4: fix error code in ext4_commit_super - media: dvbdev: Fix memory leak in dvb_media_device_free() - usb: gadget: Fix double free of device descriptor pointers - usb: gadget/function/f_fs string table fix for multiple languages - [arm64,armhf] usb: dwc3: gadget: Fix START_TRANSFER link state check - [arm*] usb: dwc2: Fix session request interrupt handler - tty: fix memory leak in vc_deallocate - tracing: Map all PIDs to command lines - tracing: Restructure trace_clock_global() to never block - dm space map common: fix division bug in sm_ll_find_free_block() - dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails - modules: mark ref_module static - modules: mark find_symbol static - modules: mark each_symbol_section static - modules: unexport __module_text_address - modules: unexport __module_address - modules: rename the licence field in struct symsearch to license - modules: return licensing information from find_symbol - modules: inherit TAINT_PROPRIETARY_MODULE - Bluetooth: verify AMP hci_chan before amp_destroy (CVE-2021-33034) - bluetooth: eliminate the potential race condition when removing the HCI controller (CVE-2021-32399) - net/nfc: fix use-after-free llcp_sock_bind/connect (CVE-2021-23134) - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR - misc: lis3lv02d: Fix false-positive WARN on various HP models - [x86] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct - [x86] misc: vmw_vmci: explicitly initialize vmci_datagram payload - md/bitmap: wait for external bitmap writes to complete during tear down - md-cluster: fix use-after-free issue when removing rdev - md: split mddev_find - md: factor out a mddev_find_locked helper from mddev_find - md: md_open returns -EBUSY when entering racing area - md: Fix missing unused status line of /proc/mdstat - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() - cfg80211: scan: drop entry from hidden_list on overflow - drm/radeon: fix copy of uninitialized variable back to userspace - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices - [x86] cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported - [s390x] KVM: split kvm_s390_logical_to_effective - [s390x] KVM: fix guarded storage control register handling - [s390x] KVM: split kvm_s390_real_to_abs - ovl: fix missing revert_creds() on error path - [x86] usb: gadget: pch_udc: Revert d3cb25a12138 completely - [armhf] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] - [armhf] dts: exynos: correct PMIC interrupt trigger level on SMDK5250 - regmap: set debugfs_name to NULL after it is freed - mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() - [x86] microcode: Check for offline CPUs before requesting new microcode - [x86] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() - [x86] usb: gadget: pch_udc: Check if driver is present before calling ->setup() - [x86] usb: gadget: pch_udc: Check for DMA mapping error - [x86] crypto: qat - don't release uninitialized resources - [x86] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init - mtd: require write permissions for locking and badblock ioctls - [arm64] bus: qcom: Put child node before return - [x86] crypto: qat - fix error path in adf_isr_resource_alloc() - [armhf] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init - [arm64,armhf] irqchip/gic-v3: Fix OF_BAD_ADDR error handling - [x86] staging: rtl8192u: Fix potential infinite loop - spi: Fix use-after-free with devm_spi_alloc_* - [arm64] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz - [arm64] soc: qcom: mdt_loader: Detect truncated read of segments - [amd64,arm64] ACPI: CPPC: Replace cppc_attr with kobj_attribute - [x86] crypto: qat - Fix a double free in adf_create_ring - [arm64] cpufreq: armada-37xx: Fix setting TBG parent for load levels - [arm64] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock - [arm64] cpufreq: armada-37xx: Fix the AVS value for load L1 - [arm64] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz - [arm64] clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 - [arm64] cpufreq: armada-37xx: Fix driver cleanup when registration failed - [arm64] cpufreq: armada-37xx: Fix determining base CPU frequency - USB: cdc-acm: fix unprivileged TIOCCSERIAL - tty: actually undefine superseded ASYNC flags - tty: fix return value for unsupported ioctls - usbip: vudc: fix missing unlock on error in usbip_sockfd_store() - [x86] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table - [x86] Drivers: hv: vmbus: Increase wait time for VMbus unload - [arm*] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. - [arm*] usb: dwc2: Fix hibernation between host and device modes. - ttyprintk: Add TTY hangup callback. - media: vivid: fix assignment of dev->fbuf_out_flags - media: m88rs6000t: avoid potential out-of-bounds reads on arrays - [x86] kprobes: Fix to check non boostable prefixes correctly - sata_mv: add IRQ checks - ata: libahci_platform: fix IRQ check - nvme: retrigger ANA log update if group descriptor isn't found - [arm64] clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE - [powerpc*] scsi: ibmvfc: Fix invalid state machine BUG_ON() - [armhf] HSI: core: fix resource leaks in hsi_add_client_from_dt() - [amd64] x86/events/amd/iommu: Fix sysfs type mismatch - sched/debug: Fix cgroup_path[] serialization - drivers/block/null_blk/main: Fix a double free in null_init. - HID: plantronics: Workaround for double volume key presses - [powerpc*] prom: Mark identical_pvr_fixup as __init - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect - bug: Remove redundant condition check in report_bug - nfc: pn533: prevent potential memory corruption - [arm64] net: hns3: Limiting the scope of vector_ring_chain variable - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls - [powerpc*] 64s: Fix pte update for kernel memory on radix - [powerpc*] perf: Fix PMU constraint check for EBB events - mac80211: bail out if cipher schemes are invalid - mt7601u: fix always true expression - [amd64] IB/hfi1: Fix error return code in parse_platform_config() - [arm64] net: thunderx: Fix unintentional sign extension issue - RDMA/srpt: Fix error return code in srpt_cm_req_recv() - [mips*] pci-legacy: stop using of_pci_range_to_resource - [powerpc*] pseries: extract host bridge from pci_bus prior to bus removal - rtlwifi: 8821ae: upgrade PHY and RF parameters - mwl8k: Fix a double Free in mwl8k_probe_hw - [x86] vsock/vmci: log once the failed queue pair allocation - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails - ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails - [armhf] net: davinci_emac: Fix incorrect masking of tx and rx error channel - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices - ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock - bnxt_en: fix ternary sign extension bug in bnxt_show_temp() - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb - [arm64] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req - mm/sparse: add the missing sparse_buffer_fini() in error branch - mm/memory-failure: unnecessary amount of unmapping - net: Only allow init netns to set default tcp cong to a restricted algo - smp: Fix smp_call_function_single_async prototype - Revert "net/sctp: fix race condition in sctp_destroy_sock" - sctp: delay auto_asconf init until binding the first addr (CVE-2021-23133) - Revert "of/fdt: Make sure no-map does not remove already reserved regions" - Revert "fdt: Properly handle "no-map" field in the memory region" - [arm64,x86] tpm: fix error return code in tpm2_get_cc_attrs_tbl() - fs: dlm: fix debugfs dump - tipc: convert dest node's address to network order - [x86] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF - [arm64] net: stmmac: Set FIFO sizes for ipq806x - i2c: bail out early when RDWR parameters are wrong - ALSA: hdsp: don't disable if not enabled - ALSA: hdspm: don't disable if not enabled - ALSA: rme9652: don't disable if not enabled - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default - Bluetooth: initialize skb_queue_head at l2cap_chan_create() - net: bridge: when suppression is enabled exclude RARP packets - Bluetooth: check for zapped sk before connecting - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet - i2c: Add I2C_AQ_NO_REP_START adapter quirk - mac80211: clear the beacon's CRC after channel switch - [armhf] pinctrl: samsung: use 'int' for register masks in Exynos - cuse: prevent clone - sctp: Fix out-of-bounds warning in sctp_process_asconf_param() - [powerpc*] smp: Set numa node before updating mask - [x86] ASoC: rt286: Generalize support for ALC3263 codec - ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user() - [powerpc*] pseries: Stop calling printk in rtas_stop_self() - [x86] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt - [x86] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join - [powerpc*] iommu: Annotate nested lock for lockdep - [x86] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs - PCI: Release OF node in pci_scan_device()'s error path - [armel,armhf] 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook - [arm64] rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() - NFSv4.2: Always flush out writes in nfs42_proc_fallocate() - NFS: Deal correctly with attribute generation counter overflow - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() - NFSv4.2 fix handling of sr_eof in SEEK's reply - rtc: ds1307: Fix wday settings for rx8130 - [arm64] net: hns3: disable phy loopback setting in hclge_mac_start_phy - sctp: do asoc update earlier in sctp_sf_do_dupcook_a - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b - netfilter: xt_SECMARK: add new revision to fix structure layout - drm/radeon: Fix off-by-one power_state index heap overwrite - drm/radeon: Avoid power table parsing memory leaks - khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() - ksm: fix potential missing rmap_item for stable_node - net: fix nla_strcmp to handle more then one trailing null character - smc: disallow TCP_ULP in smc_setsockopt() - netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check - sched/fair: Fix unfairness caused by missing load decay - [amd64] kernel: kexec_file: fix error return code of kexec_calculate_store_digests() - netfilter: nftables: avoid overflows in nft_hash_buckets() - i40e: Fix use-after-free in i40e_client_subtask() - [powerpc*] 64s: Fix crashes when toggling stf barrier - [powerpc*] 64s: Fix crashes when toggling entry flush barrier - hfsplus: prevent corruption in shrinking truncate - squashfs: fix divide error in calculate_skip() - userfaultfd: release page in error path to avoid BUG_ON - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected - [arm64,x86] ACPI: scan: Fix a memory leak in an error handling path - blk-mq: Swap two calls in blk_mq_exit_queue() - [armhf] usb: dwc3: omap: improve extcon initialization - [arm64] usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield - [arm*] usb: dwc2: Fix gadget DMA unmap direction - usb: core: hub: fix race condition about TRSMRCY of resume - [arm64,armhf] usb: dwc3: gadget: Return success always for kick transfer in ep queue - xhci: Do not use GFP_KERNEL in (potentially) atomic context - xhci: Add reset resume quirk for AMD xhci controller. - [x86] iio: tsl2583: Fix division by a zero lux_val - cdc-wdm: untangle a circular dependency between callback and softint - [x86] KVM: Cancel pvclock_gtod_work on module removal - thermal/core/fair share: Lock the thermal zone while looping over instances - kobject_uevent: remove warning in init_uevent_argv() - netfilter: conntrack: Make global sysctls readonly in non-init netns - nvme: do not try to reconfigure APST when the controller is not live - [x86] msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes - usb: sl811-hcd: improve misleading indentation - cxgb4: Fix the -Wmisleading-indentation warning - isdn: capi: fix mismatched prototypes - [arm64] PCI: thunder: Fix compile testing - [armel,armhf] 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend() - [arm64,x86] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() - [arm64] Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices - [armel,armhf] 9075/1: kernel: Fix interrupted SMC calls - ceph: fix fscache invalidation - scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found - [arm64,x86] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP - block: reexpand iov_iter after read/write - [arm64,armhf] net: stmmac: Do not enable RX FIFO overflow interrupts - ip6_gre: proper dev_{hold|put} in ndo_[un]init methods - sit: proper dev_{hold|put} in ndo_[un]init methods - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods - ipv6: remove extra dev_hold() for fallback tunnels - iomap: fix sub-page uptodate handling - [arm64] KVM: Initialize VCPU mdcr_el2 before loading it - tweewide: Fix most Shebang lines - scripts: switch explicitly to Python 3 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.192 - RDMA/rxe: Clear all QP fields if creation failed - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() - RDMA/mlx5: Recover from fatal event in dual port mode - [x86] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly - nvmet: seset ns->file when open fails - locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal - cifs: fix memory leak in smb2_copychunk_range - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency - ALSA: line6: Fix racy initialization of LINE6 MIDI - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 - ALSA: usb-audio: Validate MS endpoint descriptors - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro - [i386] Revert "ALSA: sb8: add a check for request_region" - ALSA: hda/realtek: reset eapd coeff to default value for alc287 - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 - [arm64] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference" - [x86] xen-pciback: reconfigure also from backend watch handler - dm snapshot: fix crash with transient storage and zero chunk size - [x86] Revert "video: hgafb: fix potential NULL pointer dereference" - [arm64,armhf] Revert "net: stmicro: fix a missing check of clk_prepare" - [armhf] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" - Revert "ecryptfs: replace BUG_ON with error handling code" - Revert "rtlwifi: fix a potential NULL pointer dereference" - Revert "qlcnic: Avoid potential NULL pointer dereference" - Revert "niu: fix missing checks of niu_pci_eeprom_read" - ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() - [arm64,armhf] net: stmicro: handle clk_prepare() failure during init - net: rtlwifi: properly check for alloc_workqueue() failure - [armhf] leds: lp5523: check return value of lp5xx_read and jump to cleanup code - qlcnic: Add null check after calling netdev_alloc_skb - [x86] video: hgafb: fix potential NULL pointer dereference - vgacon: Record video mode changes with VT_RESIZEX - vt: Fix character height handling with VT_RESIZEX - tty: vt: always invoke vc->vc_sw->con_resize callback - [x86] video: hgafb: correctly handle card detect failure during probe - Bluetooth: SMP: Fail if remote and local public keys are identical (CVE-2020-26558, CVE-2021-0129) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.193 - mm, vmstat: drop zone->lock in /proc/pagetypeinfo - [arm64,armhf] usb: dwc3: gadget: Enable suspend events - NFC: nci: fix memory leak in nci_allocate_device - cifs: set server->cipher_type to AES-128-CCM for SMB3.0 - NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() - [amd64] iommu/vt-d: Fix sysfs leak in alloc_iommu() - proc: Check /proc/$pid/attr/ writes against file opener - net: hso: fix control-request directions - mac80211: assure all fragments are encrypted (CVE-2020-26147) - mac80211: prevent mixed key and fragment cache attacks (CVE-2020-24586, CVE-2020-24587) - mac80211: properly handle A-MSDUs that start with an RFC 1042 header - cfg80211: mitigate A-MSDU aggregation attacks (CVE-2020-24588) - mac80211: drop A-MSDUs on old ciphers (CVE-2020-24588) - mac80211: add fragment cache to sta_info - mac80211: check defrag PN against current frame - mac80211: prevent attacks on TKIP/WEP as well - mac80211: do not accept/forward invalid EAPOL frames (CVE-2020-26139) - mac80211: extend protection against mixed key and fragment cache attacks (CVE-2020-24586, CVE-2020-24587) - ath10k: Validate first subframe of A-MSDU before processing the list - dm snapshot: properly fix a crash when an origin has no snapshots - misc/uss720: fix memory leak in uss720_probe - [x86] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue - [x86] mei: request autosuspend after sending rx flow control - USB: trancevibrator: fix control-request direction - USB: usbfs: Don't WARN about excessively large memory allocations - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' - USB: serial: ti_usb_3410_5052: add startech.com device id - USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 - USB: serial: ftdi_sio: add IDs for IDS GmbH Products - USB: serial: pl2303: add device id for ADLINK ND-6530 GC - [arm64,armhf] usb: dwc3: gadget: Properly track pending and queued SG - net: usb: fix memory leak in smsc75xx_bind - bpf: extend is_branch_taken to registers - bpf: Test_verifier, bpf_get_stack return value add <0 - bpf, test_verifier: switch bpf_get_stack's 0 s> r8 test - bpf: Move off_reg into sanitize_ptr_alu (CVE-2021-29155) - bpf: Ensure off_reg has no mixed signed bounds for all types (CVE-2021-29155) - bpf: Rework ptr_limit into alu_limit and add common error path (CVE-2021-29155) - bpf: Improve verifier error messages for users (CVE-2021-29155) - bpf: Refactor and streamline bounds check into helper (CVE-2021-29155) - bpf: Move sanitize_val_alu out of op switch (CVE-2021-29155) - bpf: Tighten speculative pointer arithmetic mask (CVE-2021-29155) - bpf: Update selftests to reflect new error states - bpf: Fix leakage of uninitialized bpf stack under speculation (CVE-2021-31829) - bpf: Wrap aux data inside bpf_sanitize_info container - bpf: Fix mask direction swap upon off reg sign change - bpf: No need to simulate speculative domain for immediates - [armhf] spi: gpio: Don't leak SPI master in probe error path - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails - NFS: fix an incorrect limit in filelayout_decode_layout() - NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() - NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config - [arm64] drm/meson: fix shutdown crash when component not probed - net/mlx4: Fix EEPROM dump support - Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" - tipc: skb_linearize the head skb when reassembling msgs - [arm64,armhf] net: dsa: fix a crash if ->get_sset_count() fails - [armhf] i2c: s3c2410: fix possible NULL pointer deref on read message after write - [x86] i2c: i801: Don't generate an interrupt on bus reset - [x86] platform/x86: hp_accel: Avoid invoking _INI to speed up resume - [x86] net: fujitsu: fix potential null-ptr-deref - [x86] char: hpet: add checks after calling ioremap - isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io - [arm64] dmaengine: qcom_hidma: comment platform_driver_register call - libertas: register sysfs groups properly - media: dvb: Add check on sp8870_readreg return - media: gspca: properly check for errors in po1030_probe() - [x86] scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic - btrfs: do not BUG_ON in link_to_fixup_dir - [x86] platform/x86: hp-wireless: add AMD's hardware id to the supported list - SMB3: incorrect file id in requests compounded with open - drm/amd/amdgpu: fix refcount leak - drm/amdgpu: Fix a use-after-free - [arm64,armhf] net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count - [armhf] net: fec: fix the potential memory leak in fec_enet_init() - [arm64] net: mdio: thunder: Fix a double free issue in the .remove function - [mips*] net: mdio: octeon: Fix some double free issues - openvswitch: meter: fix race when getting now_ms. - net: bnx2: Fix error return code in bnx2_init_board() - mld: fix panic in mld_newpack() - bpf: Set mac_len in bpf_skb_change_head - ixgbe: fix large MTU request from VF - scsi: libsas: Use _safe() loop in sas_resume_port() - ipv6: record frag_max_size in atomic fragments in input path - sch_dsmark: fix a NULL deref in qdisc_reset() - hugetlbfs: hugetlb_fault_mutex_hash() cleanup - drivers/net/ethernet: clean up unused assignments - [arm64] net: hns3: check the return of skb_checksum_help() - usb: core: reduce power-on-good delay time of root hub https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.194 - net: usb: cdc_ncm: don't spew notifications (Closes: #989451) - ALSA: usb: update old-style static const declaration - nl80211: validate key indexes for cfg80211_registered_device - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared - [arm64,x86] efi: cper: fix snprintf() use in cper_dimm_err_location() - vfio/pci: Fix error return code in vfio_ecap_init() - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service - HID: pidff: fix error return code in hid_pidff_init() - [arm64,x86] HID: i2c-hid: fix format string mismatch - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches - ieee802154: fix error return code in ieee802154_add_iface() - ieee802154: fix error return code in ieee802154_llsec_getparams() - ixgbevf: add correct exception tracing for XDP - tipc: add extack messages for bearer/media failure - tipc: fix unique bearer names sanity check - Bluetooth: fix the erroneous flush_work() order (CVE-2021-3564) - Bluetooth: use correct lock to prevent UAF of hdev object (CVE-2021-3573) - HID: multitouch: require Finger field to mark Win8 reports as MT - ALSA: timer: Fix master timer notification - ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed - [arm*] usb: dwc2: Fix build in periphal-only mode - pid: take a reference when initializing `cad_pid` - ocfs2: fix data corruption by fallocate - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect (CVE-2021-3587) - [x86] apic: Mark _all_ legacy interrupts when IO/APIC is missing - btrfs: mark ordered extent and inode with error if we fail to finish - btrfs: fix error handling in btrfs_del_csums - btrfs: return errors from btrfs_del_csums in cleanup_ref_head - btrfs: fixup error handling in fixup_inode_link_counts - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY - bpf: Add BPF_F_ANY_ALIGNMENT. - bnxt_en: Remove the setting of dev_port. - perf/cgroups: Don't rotate events for cgroups unnecessarily - perf/core: Fix corner case in perf_rotate_context() - btrfs: fix unmountable seed device after fstrim - [x86] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode - [arm64] KVM: Fix debug register indexing - [arm64,x86] ACPI: probe ECDT before loading AML tables regardless of module-level code flag - [arm64,x86] ACPI: EC: Look for ECDT EC after calling acpi_load_tables() - sched/fair: Optimize select_idle_cpu - [x86] xen-pciback: redo VF placement in the virtual topology [ Salvatore Bonaccorso ] * [rt] Update to 4.19.182-rt74 * [rt] Add new signing key for Clark Williams * [rt] Update to 4.19.184-rt75 * Bump ABI to 17 * [rt] Refresh "workqueue: Use normal rcu" * [rt] Refresh "workqueue: Use local irq lock instead of irq disable" * [rt] Refresh "workqueue: rework" * [rt] Update to 4.19.188-rt77 * [rt] Update to 4.19.190-rt79 * [rt] Refresh "ptrace: fix ptrace vs tasklist_lock race" * [rt] Update to 4.19.193-rt81 * [rt] Refresh "kernel: sched: Provide a pointer to the valid CPU mask" -- Salvatore Bonaccorso Thu, 10 Jun 2021 20:49:34 +0200 linux (4.19.181-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.178 - HID: make arrays usage and value to be the same - USB: quirks: sort quirk entries - usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable - block: add helper for checking if queue is registered - block: split .sysfs_lock into two locks - block: fix race between switching elevator and removing queues - block: don't release queue's sysfs lock during switching elevator - NET: usb: qmi_wwan: Adding support for Cinterion MV31 - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath. - jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations - locking/static_key: Fix false positive warnings on concurrent dec/inc - vmlinux.lds.h: add DWARF v5 sections - [arm64] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 - bfq: Avoid false bfq queue merging - ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode - [mips*] vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section - random: fix the RNDRESEEDCRNG ioctl - [arm64] Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function - Bluetooth: Fix initializing response id after clearing struct - [armhf] dts: exynos: correct PMIC interrupt trigger level on Spring - [armhf] dts: exynos: correct PMIC interrupt trigger level on Arndale Octa - bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args - [arm64] dts: allwinner: A64: properly connect USB PHY to port 0 - [arm64] dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz - ACPICA: Fix exception code class checks - usb: gadget: u_audio: Free requests only after callback - Bluetooth: drop HCI device reference before return - Bluetooth: Put HCI device if inquiry procedure interrupts - [arm*] usb: dwc2: Do not update data length if it is 0 on inbound transfers - [arm*] usb: dwc2: Abort transaction after errors with unknown reason - [arm*] usb: dwc2: Make "trimming xfer length" a debug message - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules - [armhf] dts: armada388-helios4: assign pinctrl to LEDs - [armhf] dts: armada388-helios4: assign pinctrl to each fan - bpf_lru_list: Read double-checked variable once without lock - bnxt_en: reverse order of TX disable and carrier off - xen/netback: fix spurious event detection for common event case - mac80211: fix potential overflow when multiplying to u32 integers - bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx - tcp: fix SO_RCVLOWAT related hangs under mem pressure - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case - [amd64,arm64] net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout - [amd64,arm64] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning - [amd64,arm64] net: amd-xgbe: Reset link when the link never comes back - [amd64,arm64] net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP - [arm64,armhf] net: mvneta: Remove per-cpu queue mapping for Armada 3700 - [x86] drm/gma500: Fix error return code in psb_driver_load() - [x86] gma500: clean up error handling in init - [armhf] crypto: sun4i-ss - fix kmap usage - [mips*] c-r4k: Fix section mismatch for loongson2_sc_init - media: em28xx: Fix use-after-free in em28xx_alloc_urbs - media: media/pci: Fix memleak in empress_init - [x86] media: tm6000: Fix memleak in tm6000_start_stream - media: lmedm04: Fix misuse of comma - media: qm1d1c0042: fix error return code in qm1d1c0042_init() - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values - f2fs: fix to avoid inconsistent quota data - drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() - [x86] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() - btrfs: clarify error returns values in __load_free_space_cache - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() - fs/jfs: fix potential integer overflow on shift of a int - jffs2: fix use after free in jffs2_sum_write_data() - capabilities: Don't allow writing ambiguous v3 file capabilities - [arm64,armhf] clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL - quota: Fix memory leak when handling corrupted quota file - [arm64] clk: sunxi-ng: h6: Fix CEC clock - HID: core: detect and skip invalid inputs to snto32() - fdt: Properly handle "no-map" field in the memory region - of/fdt: Make sure no-map does not remove already reserved regions - RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation - [arm64] clk: sunxi-ng: h6: Fix clock divider range on some clocks - [arm64,armhf] regulator: axp20x: Fix reference cout leak - certs: Fix blacklist flag type confusion - [armhf] regulator: s5m8767: Drop regulators OF node reference - isofs: release buffer head before return - IB/umad: Return EIO in case of when device disassociated - IB/umad: Return EPOLLERR in case of when device disassociated - [ppc64el] KVM: Make the VMX instruction emulation routines static - [armel,armhf] 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores - [arm*] amba: Fix resource leak for drivers without .remove - tracepoint: Do not fail unregistering a probe due to memory failure - perf tools: Fix DSO filtering when not finding a map for a sampled address - RDMA/rxe: Fix coding error in rxe_recv.c - RDMA/rxe: Correct skb on loopback path - [powerpc*] pseries/dlpar: handle ibm, configure-connector delay status - [amd64] spi: pxa2xx: Fix the controller numbering for Wildcat Point - Input: sur40 - fix an error code in sur40_probe() - perf intel-pt: Fix missing CYC processing in PSB - Input: elo - fix an error code in elo_connect() - [arm64,armhf] pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() - [x86] VMCI: Use set_page_dirty_lock() when unregistering guest memory - PCI: Align checking of syscall user config accessors - [arm64] drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) - ext4: fix potential htree index checksum corruption - i40e: Fix flow for IPv6 next header (extension header) - i40e: Add zero-initialization of AQ command structures - i40e: Fix overwriting flow control settings during driver loading - i40e: Fix VFs not created - i40e: Fix add TC filter for IPv6 - net/mlx4_core: Add missed mlx4_free_cmd_mailbox() - vxlan: move debug check after netdev unregister - ocfs2: fix a use after free on error - mm/memory.c: fix potential pte_unmap_unlock pte error - mm/hugetlb: fix potential double free in hugetlb_register_node() error path - r8169: fix jumbo packet handling on RTL8168e - [arm64] Add missing ISB after invalidating TLB in __primary_switch - mm/rmap: fix potential pte_unmap on an not mapped pte - blk-settings: align max_sectors on "logical_block_size" boundary - ACPI: property: Fix fwnode string properties matching - HID: wacom: Ignore attempts to overwrite the touch_max value from HID - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S - Input: joydev - prevent potential read overflow in ioctl - USB: serial: option: update interface mapping for ZTE P685M - [arm64,armhf] usb: musb: Fix runtime PM race in musb_queue_resume_work - [arm64,armhf] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 - [arm64,armhf] usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt - USB: serial: ftdi_sio: fix FTX sub-integer prescaler - USB: serial: mos7840: fix error code in mos7840_write() - USB: serial: mos7720: fix error code in mos7720_write() - ALSA: hda/realtek: modify EAPD in the ALC886 - tpm_tis: Fix check_locality for correct locality acquisition - tpm_tis: Clean up locality release - KEYS: trusted: Fix migratable=1 failing - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root - btrfs: fix reloc root leak with 0 ref reloc roots on recovery - btrfs: fix extent buffer leak on failure to copy root - [arm64] crypto: arm64/sha - add missing module aliases - [armhf] crypto: sun4i-ss - checking sg length is not sufficient - [armhf] crypto: sun4i-ss - handle BigEndian for cipher - seccomp: Add missing return in non-void function - misc: rtsx: init of rts522a add OCP power off when no card is present - [x86] drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table - [x86] reboot: Force all cpus to exit VMX root if VMX is supported - floppy: reintroduce O_NDELAY fix - [arm64] uprobe: Return EOPNOTSUPP for AARCH32 instruction probing - [x86] watchdog: mei_wdt: request stop on unregister - [arm64] mtd: spi-nor: hisi-sfc: Put child node np on error path - fs/affs: release old buffer head on error path - seq_file: document how per-entry resources are managed. - [x86] fix seq_file iteration for pat/memtype.c - hugetlb: fix copy_huge_page_from_user contig page struct assumption - libnvdimm/dimm: Avoid race between probe and available_slots_show() - [arm64] Extend workaround for erratum 1024718 to all versions of Cortex-A55 - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols - [armhf] mmc: sdhci-esdhc-imx: fix kernel panic when remove module - [armhf] gpio: pcf857x: Fix missing first interrupt - printk: fix deadlock when kernel panic - [x86] cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available - f2fs: fix out-of-repair __setattr_copy() - gfs2: Don't skip dlm unlock if glock has an lvb - dm: fix deadlock when swapping to encrypted device - dm era: Recover committed writeset after crash - dm era: Verify the data block size hasn't changed - dm era: Fix bitset memory leaks - dm era: Use correct value size in equality function of writeset tree - dm era: Reinitialize bitset cache before digesting a new writeset - dm era: only resize metadata in preresume - icmp: introduce helper for nat'd source address in network device context - icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n - gtp: use icmp_ndo_send helper - xfrm: interface: use icmp_ndo_send helper - ipv6: icmp6: avoid indirect call for icmpv6_send() - ipv6: silence compilation warning for non-IPV6 builds - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending - dm era: Update in-core bitset after committing the metadata https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.179 - net: usb: qmi_wwan: support ZTE P685M modem - hugetlb: fix update_and_free_page contig page struct assumption - drm/virtio: use kvmalloc for large allocations - [s390x] virtio/s390: implement virtio-ccw revision 2 correctly - [arm64] module: set plt* section addresses to 0x0 - [arm64] Avoid redundant type conversions in xchg() and cmpxchg() - [arm64] cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint - [arm64] Use correct ll/sc atomic constraints - JFS: more checks for invalid superblock - udlfb: Fix memory leak in dlfb_usb_probe - media: mceusb: sanity check for prescaler value - xfs: Fix assert failure in xfs_setattr_size() - net: fix up truesize of cloned skb in skb_prepare_for_shift() - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing - net: bridge: use switchdev for port flags set through sysfs too - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ - rsi: Fix TX EAPOL packet handling against iwlwifi AP - rsi: Move card interrupt handling to RX thread - [x86] reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk - vt/consolemap: do font sum unsigned - [arm64,armhf] wlcore: Fix command execute failure 19 for wl12xx - Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() - ath10k: fix wmi mgmt tx queue full due to race condition - [x86] build: Treat R_386_PLT32 relocation as R_386_PC32 - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data - crypto: tcrypt - avoid signed overflow in byte count - PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse - media: uvcvideo: Allow entities with no pads - f2fs: handle unallocated section and zone on pinned/atgc - f2fs: fix to set/clear I_LINKABLE under i_lock - btrfs: fix error handling in commit_fs_roots - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID 7316R tablet - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 tablet - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet - scsi: iscsi: Restrict sessions and handles to admin capabilities (CVE-2021-27363, CVE-2021-27364) - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (CVE-2021-27365) - scsi: iscsi: Verify lengths on passthrough PDUs (CVE-2021-27365) - Xen/gnttab: handle p2m update errors on a per-slot basis (CVE-2021-28038) - xen-netback: respect gnttab_map_refs()'s return value (CVE-2021-28038) - zsmalloc: account the number of compacted pages correctly - swap: fix swapfile read/write offset - media: v4l: ioctl: Fix memory leak in video_usercopy - ALSA: hda/realtek: Add quirk for Clevo NH55RZQ - ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.180 - btrfs: raid56: simplify tracking of Q stripe presence - btrfs: fix raid6 qstripe kmap - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl - btrfs: free correct amount of space in btrfs_delayed_inode_reserve_metadata - btrfs: unlock extents in btrfs_zero_range in case of quota reservation errors - PM: runtime: Update device status before letting suppliers suspend - dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size - drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie - usbip: tools: fix build error for multiple definition - Revert "zram: close udev startup race condition as default groups" - block: genhd: add 'groups' argument to device_add_disk - nvme: register ns_id attributes as default sysfs groups - aoe: register default groups with device_add_disk() - zram: register default groups with device_add_disk() - virtio-blk: modernize sysfs attribute creation - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits - rsxx: Return -EFAULT if copy_to_user() fails - r8169: fix resuming from suspend on RTL8105e if machine runs on battery - [arm64,armhf] net: dsa: add GRO support via gro_cells - dm table: fix iterate_devices based device capability checks - dm table: fix DAX iterate_devices based device capability checks - dm table: fix zoned iterate_devices based device capability checks - [amd64] iommu/amd: Fix sleeping in atomic in increase_address_space() - mwifiex: pcie: skip cancel_work_sync() on reset failure path - [x86] platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines - [x86] platform/x86: acer-wmi: Cleanup accelerometer device handling - [x86] platform/x86: acer-wmi: Add new force_caps module parameter - [x86] platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability flag - [x86] platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch devices - [x86] platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire Switch 10E SW3-016 - HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter - media: cx23885: add more quirks for reset DMA on some AMD IOMMU - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom - [arm64] drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.181 - uapi: nfnetlink_cthelper.h: fix userspace compilation error - ethernet: alx: fix order of calls on resume (Closes: #983595) - ath9k: fix transmitting to stations in dynamic SMPS mode - net: Fix gro aggregation for udp encaps with zero csum - net: Introduce parse_protocol header_ops callback - can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership - [armhf] can: flexcan: assert FRZ bit in flexcan_chip_freeze() - [armhf] can: flexcan: enable RX FIFO after FRZ/HALT valid - netfilter: x_tables: gpf inside xt_find_revision() - mt76: dma: do not report truncated frames to mac80211 - tcp: annotate tp->copied_seq lockless reads - tcp: annotate tp->write_seq lockless reads - tcp: add sanity tests to TCP_QUEUE_SEQ - cifs: return proper error code in statfs(2) - scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names - Revert "mm, slub: consider rest of partial list if acquire_slab() fails" - net: check if protocol extracted by virtio_net_hdr_set_proto is correct - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 - net/mlx4_en: update moderation when config reset - [arm64,armhf] net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10 - net: sched: avoid duplicates in classes dump - net: usb: qmi_wwan: allow qmimux add/del with master up - [arm64,armhf] net: stmmac: stop each tx channel independently - [arm64,armhf] net: stmmac: fix watchdog timeout during suspend/resume stress test - drm/compat: Clear bounce structures - [arm64] drm: meson_drv add shutdown function - media: usbtv: Fix deadlock on suspend - net: phy: fix save wrong speed and duplex problem if autoneg is on - udf: fix silent AED tagLocation corruption - [powerpc*] pci: Add ppc_md.discover_phbs() - [powerpc*] improve handling of unrecoverable system reset - [powerpc*] perf: Record counter overflow always if SAMPLE_IP is unset - [arm64] PCI: xgene-msi: Fix race in installing chained irq handler - PCI: Fix pci_register_io_range() memory leak - i40e: Fix memory leak in i40e_probe - [s390x] smp: __smp_rescan_cpus() - move cpumask away from stack - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling - scsi: target: core: Add cmd length set before cmd complete - scsi: target: core: Prevent underflow for service actions - ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk - ALSA: hda/hdmi: Cancel pending works before suspend - ALSA: hda: Drop the BATCH workaround for AMD controllers - ALSA: hda: Avoid spurious unsol event handling during S3/S4 - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar - ALSA: usb-audio: Apply the control quirk to Plantronics headsets - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") - [s390x] dasd: fix hanging DASD driver unbind - [s390x] dasd: fix hanging IO request during DASD driver unbind - mmc: core: Fix partition switch time for eMMC - mmc: cqhci: Fix random crash when remove mmc module/card - Goodix Fingerprint device is not a modem - USB: gadget: u_ether: Fix a configfs return code - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot - usb: gadget: f_uac1: stop playback on function disable - [arm64] usb: dwc3: qcom: Honor wakeup enabled/disabled state - USB: usblp: fix a hang in poll() if disconnected - xhci: Improve detection of device initiated wake signal. - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing - USB: serial: io_edgeport: fix memory leak in edge_startup - USB: serial: ch341: add new Product ID - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter - USB: serial: cp210x: add some more GE USB IDs - usbip: fix stub_dev to check for stream socket - usbip: fix vhci_hcd to check for stream socket - usbip: fix vudc to check for stream socket - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf - usbip: fix vhci_hcd attach_store() races leading to gpf - usbip: fix vudc usbip_sockfd_store races leading to gpf - [x86] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() (CVE-2021-28660) - staging: rtl8712: unterminated string leads to read overflow - staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd - [x86] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan - [x86] staging: comedi: addi_apci_1032: Fix endian problem for COS sample - [x86] staging: comedi: addi_apci_1500: Fix endian problem for command sample - [x86] staging: comedi: adv_pci1710: Fix endian problem for AI command data - [i386] staging: comedi: das6402: Fix endian problem for AI command data - [i386] staging: comedi: das800: Fix endian problem for AI command data - [i386] staging: comedi: dmm32at: Fix endian problem for AI command data - [x86] staging: comedi: me4000: Fix endian problem for AI command data - [i386] staging: comedi: pcl711: Fix endian problem for AI command data - [i386] staging: comedi: pcl818: Fix endian problem for AI command data - NFSv4.2: fix return value of _nfs4_get_security_label() - block: rsxx: fix error return code of rsxx_pci_probe() - configfs: fix a use-after-free in __configfs_open_file - hrtimer: Update softirq_expires_next correctly after __hrtimer_get_next_event() - stop_machine: mark helpers __always_inline - include/linux/sched/mm.h: use rcu_dereference in in_vfork() - [powerpc*] 64s: Fix instruction encoding for lis in ppc_function_entry() - binfmt_misc: fix possible deadlock in bm_register_write - [amd64] x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2 - hwmon: (lm90) Fix max6658 sporadic wrong temperature reading - [arm64] KVM: Fix exclusive limit for IPA size - xen/events: reset affinity of 2-level event when tearing it down - xen/events: don't unmask an event channel when an eoi is pending - xen/events: avoid handling the same event on two cpus at the same time [ Salvatore Bonaccorso ] * Bump ABI to 16 * ext4: check journal inode extents more carefully (CVE-2021-3428) * bpf: Prohibit alu ops for pointer types not defining ptr_limit (CVE-2020-27170) * bpf: Fix off-by-one for area size in creating mask to left (CVE-2020-27171) * bpf: Simplify alu_limit masking for pointer arithmetic * bpf: Add sanity check for upper ptr_limit -- Salvatore Bonaccorso Fri, 19 Mar 2021 15:29:57 +0100 linux (4.19.177-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.172 - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions - dm integrity: conditionally disable "recalculate" feature - writeback: Drop I_DIRTY_TIME_EXPIRE - fs: fix lazytime expiration handling in __writeback_single_inode() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.173 - nbd: freeze the queue while we're adding connections (CVE-2021-3348) - ACPI: sysfs: Prefer "compatible" modalias - kernel: kexec: remove the lock operation of system_transition_mutex - xen/privcmd: allow fetching resource sizes - ALSA: hda/via: Apply the workaround generically for Clevo machines - media: rc: ensure that uevent can be read directly after rc device register - wext: fix NULL-ptr-dereference with cfg80211's lack of commit() - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family - PM: hibernate: flush swap writer after marking - [x86] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] - [x86] KVM: get smi pending status correctly - leds: trigger: fix potential deadlock with libata - mt7601u: fix kernel crash unplugging the device - mt7601u: fix rx buffer refcounting - xen-blkfront: allow discard-* nodes to be optional - [armhf] imx: build suspend-imx6.S with arm instruction set - netfilter: nft_dynset: add timeout extension to template - xfrm: Fix oops in xfrm_replay_advance_bmp - xfrm: fix disable_xfrm sysctl when used on xfrm interfaces - RDMA/cxgb4: Fix the reported max_recv_sge value - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() - iwlwifi: pcie: use jiffies for memory read spin time limit - iwlwifi: pcie: reschedule in long-running memory reads - mac80211: pause TX while changing interface type - net/mlx5: Fix memory leak on flow table creation error flow - can: dev: prevent potential information leak in can_fill_info() - [amd64] iommu/vt-d: Gracefully handle DMAR units with no supported address widths - [amd64] iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built - rxrpc: Fix memory leak in rxrpc_lookup_local - NFC: fix resource leak when target index is invalid - NFC: fix possible resource leak - team: protect features update by RCU to avoid deadlock - tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.174 - [armhf] net: dsa: bcm_sf2: put device node before return - ACPI: thermal: Do not call acpi_thermal_check() directly - sysctl: handle overflow in proc_get_long - net_sched: gen_estimator: support large ewma log - [x86] platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron 7352 - [x86] __always_inline __{rd,wr}msr() - scsi: scsi_transport_srp: Don't block target in failfast state - scsi: libfc: Avoid invoking response handler twice if ep is already completed - mac80211: fix fast-rx encryption check - [ppc64el] scsi: ibmvfc: Set default timeout to avoid crash during migration - objtool: Don't fail on missing symbol table - kthread: Extract KTHREAD_IS_PER_CPU - workqueue: Restrict affinity change to rescuer https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.175 - USB: serial: cp210x: add pid/vid for WSDA-200-USB - USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 - USB: serial: option: Adding support for Cinterion MV31 - Input: i8042 - unbreak Pegatron C15B - rxrpc: Fix deadlock around release of dst cached on udp tunnel - net: lapb: Copy the skb before sending a packet - [arm64,armhf] net: mvpp2: TCAM entry enable should be written after SRAM data - memblock: do not start bottom-up allocations with kernel_end - USB: gadget: legacy: fix an error code in eth_bind() - USB: usblp: don't call usb_set_interface if there's a single alt - [arm*] usb: dwc2: Fix endpoint direction check in ep_from_windex - [arm64,armhf] usb: dwc3: fix clock issue during resume in OTG mode - ovl: fix dentry leak in ovl_get_redirect - mac80211: fix station rate table updates on assoc - kretprobe: Avoid re-registration of the same kretprobe earlier - genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set - xhci: fix bounce buffer usage for non-sg list case - cifs: report error instead of invalid when revalidating a dentry fails - smb3: Fix out-of-bounds bug in SMB2_negotiate() - mmc: core: Limit retries when analyse of SDIO tuples fails - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs - [x86] KVM: SVM: Treat SVM as unsupported when running as an SEV guest - mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page - mm: hugetlb: fix a race between freeing and dissolving the page - mm: hugetlb: fix a race between isolating and freeing page - mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active - mm: thp: fix MADV_REMOVE deadlock on shmem THP - [x86] build: Disable CET instrumentation in the kernel - [x86] apic: Add extra serialization for non-serializing MSRs - Input: xpad - sync supported devices with fork on GitHub - [amd64] iommu/vt-d: Do not use flush-queue when caching-mode is on - md: Set prev_flush_start and flush_bio in an atomic way - net: ip_tunnel: fix mtu calculation - [arm64,armhf] net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.176 - tracing/kprobe: Fix to support kretprobe events on unloaded modules - block: fix NULL pointer dereference in register_disk - fgraph: Initialize tracing_graph_pause at task creation - af_key: relax availability checks for skb size calculation - regulator: core: avoid regulator_resolve_supply() race condition - pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() - iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap - iwlwifi: pcie: fix context info memory leak - iwlwifi: mvm: guard against device removal in reprobe - SUNRPC: Move simple_get_bytes and simple_get_netobj into private header - SUNRPC: Handle 0 length opaque XDR object data properly - lib/string: Add strscpy_pad() function - include/trace/events/writeback.h: fix -Wstringop-truncation warnings - memcg: fix a crash in wb_workfn when a device disappears - [x86] Fix unsynchronized access to sev members through svm_register_enc_region - block: don't hold q->sysfs_lock in elevator_init_mq - blk-mq: don't hold q->sysfs_lock in blk_mq_map_swqueue - squashfs: add more sanity checks in id lookup - squashfs: add more sanity checks in inode lookup - squashfs: add more sanity checks in xattr id lookup - regulator: core: enable power when setting up constraints - regulator: core: Clean enabling always-on regulators + their supplies - regulator: Fix lockdep warning resolving supplies https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.177 - tracing: Do not count ftrace events in top level enable output - tracing: Check length before giving out the filter buffer - [armhf] xen: Don't probe xenbus as part of an early initcall - [x86] platform/x86: hp-wmi: Disable tablet-mode reporting by default - ovl: perform vfs_getxattr() with mounter creds - cap: fix conversions on getxattr - ovl: skip getxattr of security labels - bfq-iosched: Revert "bfq: Fix computation of shallow depth" - [armel,armhf] ensure the signal page contains defined contents - [armel,armhf] kexec: fix oops after TLB are invalidated - mt76: dma: fix a possible memory leak in mt76_add_fragment() - bpf: Check for integer overflow when using roundup_pow_of_two() - netfilter: xt_recent: Fix attempt to update deleted entry - netfilter: flowtable: fix tcp and udp header checksum update - xen/netback: avoid race in xenvif_rx_ring_slots_available() - [arm64,armhf] net: stmmac: set TxQ mode back to DCB after disabling CBS - netfilter: conntrack: skip identical origin tuple in same zone only - [arm64] net: hns3: add a check for queue_id in hclge_reset_vf_queue() - [arm64] usb: dwc3: ulpi: fix checkpatch warning - [arm64] usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one - net: fix iteration for sctp transport seq_files - net/vmw_vsock: improve locking in vsock_connect_timeout() - net: watchdog: hold device global xmit lock during tx disable - vsock/virtio: update credit only if socket is not closed - vsock: fix locking in vsock_shutdown() - net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS - ovl: expand warning in ovl_d_real() - [x86] KVM: SEV: fix double locking due to incorrect backport - [x86] Xen/x86: don't bail early from clear_foreign_p2m_mapping() (CVE-2021-26932) - [x86] Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (CVE-2021-26932) - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (CVE-2021-26932) - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (CVE-2021-26932) - [armhf] xen/arm: don't ignore return errors from set_phys_to_machine (CVE-2021-26932) - xen-blkback: don't "handle" error by BUG() (CVE-2021-26931) - xen-netback: don't "handle" error by BUG() (CVE-2021-26931) - xen-scsiback: don't "handle" error by BUG() (CVE-2021-26931) - xen-blkback: fix error handling in xen_blkbk_map() (CVE-2021-26930) - scsi: qla2xxx: Fix crash during driver load on big endian machines - kvm: check tlbs_dirty directly [ Salvatore Bonaccorso ] * [rt] Update to 4.19.173-rt72 * certs: Rotate to use the "Debian Secure Boot Signer 2021 - linux" certificate * Bump ABI to 15 -- Salvatore Bonaccorso Wed, 03 Mar 2021 13:48:46 +0100 linux (4.19.171-2) buster-security; urgency=high * xen: Fix XenStore initialisation for XS_LOCAL -- Salvatore Bonaccorso Sat, 30 Jan 2021 10:35:46 +0100 linux (4.19.171-1) buster-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.161 - perf event: Check ref_reloc_sym before using it - netfilter: clear skb->next in NF_HOOK_LIST() (CVE-2021-20177) - btrfs: don't access possibly stale fs_info data for printing duplicate device - btrfs: fix lockdep splat when reading qgroup config on mount - wireless: Use linux/stddef.h instead of stddef.h - [arm64] KVM: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace - [x86] KVM: handle !lapic_in_kernel case in kvm_cpu_*_extint - [x86] KVM: Fix split-irqchip vs interrupt injection window request - [arm64] pgtable: Fix pte_accessible() - [arm64] pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Closes: #977615) - drm/atomic_helper: Stop modesets on unregistered connectors harder - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close - HID: cypress: Support Varmilo Keyboards' media hotkeys - HID: add support for Sega Saturn - Input: i8042 - allow insmod to succeed on devices without an i8042 controller - HID: hid-sensor-hub: Fix issue with devices with no report ID - HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices - [x86] xen: don't unbind uninitialized lock_kicker_irq - HID: Add Logitech Dinovo Edge battery quirk - proc: don't allow async path resolution of /proc/self components - nvme: free sq/cq dbbuf pointers when dbbuf set fails - [arm64,armhf] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size - scsi: libiscsi: Fix NOP race condition - scsi: target: iscsi: Fix cmd abort fabric stop race - [x86] perf/x86: fix sysfs type mismatches - [arm64,armhf] phy: tegra: xusb: Fix dangling pointer on probe failure - scsi: ufs: Fix race between shutdown and runtime resume flow - bnxt_en: fix error return code in bnxt_init_one() - bnxt_en: fix error return code in bnxt_init_board() - [x86] video: hyperv_fb: Fix the cache type when mapping the VRAM - bnxt_en: Release PCI regions when DMA mask setup fails during probe. - cxgb4: fix the panic caused by non smac rewrite - [s390x] qeth: fix tear down of async TX buffers - IB/mthca: fix return value of error branch in mthca_init_cq() - net: ena: set initial DMA width to avoid intel iommu issue - [arm64] optee: add writeback to valid memory type - [arm64,armhf,x86] efivarfs: revert "fix memory leak in efivarfs_create()" (Closes: #977048) - can: gs_usb: fix endianess problem with candleLight firmware - [x86] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time - [x86] platform/x86: toshiba_acpi: Fix the wrong variable assignment - USB: core: Change %pK for __user pointers to %px - usb: gadget: f_midi: Fix memleak in f_midi_alloc - USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card - usb: gadget: Fix memleak in gadgetfs_fill_super - [x86] speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb - USB: core: Fix regression in Hercules audio card https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.162 - ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init - [s390x] net/af_iucv: set correct sk_protocol for child sockets - rose: Fix Null pointer dereference in rose_send_frame() - sock: set sk_err to ee_errno on dequeue from errq - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control - tun: honor IOCB_NOWAIT flag - i40e: Fix removing driver while bare-metal VFs pass traffic - bonding: wait for sysfs kobject destruction before freeing struct slave - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal - ipv4: Fix tos mask in inet_rtm_getroute() - geneve: pull IP header before ECN decapsulation - net: ip6_gre: set dev->hard_header_len when using header_ops - cxgb3: fix error return code in t3_sge_alloc_qset() - [arm64,armhf] net: mvpp2: Fix error return code in mvpp2_open() - net/mlx5: Fix wrong address reclaim when command interface is down - dt-bindings: net: correct interrupt flags in examples - ALSA: usb-audio: US16x08: fix value count for level meters - Input: xpad - support Ardwiino Controllers - Input: i8042 - add ByteSpeed touchpad to noloop table - tracing: Remove WARN_ON in start_thread() - RDMA/i40iw: Address an mmap handler exploit in i40iw https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.163 - [x86] pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output - [x86] pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) - usb: gadget: f_fs: Use local copy of descriptors for userspace copy - USB: serial: kl5kusb105: fix memleak on open - USB: serial: ch341: add new Product ID for CH341A - USB: serial: ch341: sort device-id entries - USB: serial: option: add Fibocom NL668 variants - USB: serial: option: add support for Thales Cinterion EXS82 - USB: serial: option: fix Quectel BG96 matching - tty: Fix ->pgrp locking in tiocspgrp() (CVE-2020-29661) - tty: Fix ->session locking (CVE-2020-29660) - ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model - ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 - ALSA: hda/realtek - Add new codec supported for ALC897 - ALSA: hda/generic: Add option to enforce preferred_dacs pairs - ftrace: Fix updating FTRACE_FL_TRAMP - cifs: fix potential use-after-free in cifs_echo_request() - [armhf] i2c: imx: Don't generate STOP condition if arbitration has been lost - scsi: mpt3sas: Fix ioctl timeout - dm writecache: fix the maximum number of arguments - dm: remove invalid sparse __acquires and __releases annotations - mm: list_lru: set shrinker map bit when child nr_items is not zero - mm/swapfile: do not sleep with a spin lock held - [x86] uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes - [armhf] i2c: imx: Fix reset of I2SR_IAL flag - [armhf] i2c: imx: Check for I2SR_IAL after every byte - speakup: Reject setting the speakup line discipline outside of speakup (CVE-2020-27830) - [amd64] iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs - spi: Introduce device-managed SPI controller allocation - [arm*] spi: bcm2835: Fix use-after-free on unbind - [arm*] spi: bcm2835: Release the DMA channel if probe fails after dma_init - tracing: Fix userstacktrace option for instances - gfs2: check for empty rgrp tree in gfs2_ri_update - [arm64] i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() - dm writecache: remove BUG() and fail gracefully instead - Input: i8042 - fix error return code in i8042_setup_aux() - netfilter: nf_tables: avoid false-postive lockdep splat - [x86] insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes - Revert "geneve: pull IP header before ECN decapsulation" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.164 - [x86] lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S - [arm*] spi: bcm2835aux: Fix use-after-free on unbind - [arm*] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe - iwlwifi: pcie: limit memory read spin time - iwlwifi: mvm: fix kernel panic in case of assert during CSA - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE - [arm64,armhf] irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend - [x86] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e - [x86] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen - [x86] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC - Input: cm109 - do not stomp on control URB - Input: i8042 - add Acer laptops to the i8042 reset list - pinctrl: amd: remove debounce filter setting in IRQ type setting - mmc: block: Fixup condition for CMD13 polling for RPMB requests - kbuild: avoid static_assert for genksyms - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" - [x86] membarrier: Get rid of a dubious optimization - [x86] apic/vector: Fix ordering in vector assignment - [arm64] PCI: qcom: Add missing reset for ipq806x - mac80211: mesh: fix mesh_pathtbl_init() error path - [arm64,armhf] net: stmmac: free tx skb buffer in stmmac_resume() - tcp: select sane initial rcvq_space.space for big MSS - tcp: fix cwnd-limited bug for TSO deferral where we send nothing - net/mlx4_en: Avoid scheduling restart task if it is already running - lan743x: fix for potential NULL pointer dereference with bare card - net/mlx4_en: Handle TX error CQE - [arm64,armhf] net: stmmac: delete the eee_ctrl_timer after napi disabled - [arm64,armhf] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux - net: bridge: vlan: fix error return code in __vlan_add() - USB: add RESET_RESUME quirk for Snapscan 1212 - ALSA: usb-audio: Fix potential out-of-bounds shift - ALSA: usb-audio: Fix control 'access overflow' errors from chmap - xhci: Give USB2 ports time to enter U3 in bus suspend - USB: UAS: introduce a quirk to set no_write_same - ALSA: pcm: oss: Fix potential out-of-bounds shift - [x86] drm/xen-front: Fix misused IS_ERR_OR_NULL checks - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi - [x86] pinctrl: baytrail: Avoid clearing debounce value when turning it off - [arm*] gpio: mvebu: fix potential user-after-free on probe - scsi: bnx2i: Requires MMU - xsk: Fix xsk_poll()'s return type - can: softing: softing_netdev_open(): fix error handling - block: factor out requeue handling from dispatch code - netfilter: x_tables: Switch synchronization to RCU - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait - ixgbe: avoid premature Rx buffer reuse - [arm64,armhf] drm/tegra: replace idr_init() by idr_init_base() - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling - [arm64,armhf] drm/tegra: sor: Disable clocks on error in tegra_sor_init() - [arm64] syscall: exit userspace before unmasking exceptions - vxlan: Add needed_headroom for lower device - vxlan: Copy needed_tailroom from lowerdev - scsi: mpt3sas: Increase IOCInit request timeout to 30s - dm table: Remove BUG_ON(in_interrupt()) - [arm64] soc/tegra: fuse: Fix index bug in get_process_id - USB: serial: option: add interface-number sanity check to flag handling - USB: gadget: f_acm: add support for SuperSpeed Plus - USB: gadget: f_midi: setup SuperSpeed Plus descriptors - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul - [armhf] dts: exynos: fix roles of USB 3.0 ports on Odroid XU - [armhf] dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU - scsi: megaraid_sas: Check user-provided offsets - HID: i2c-hid: add Vero K147 to descriptor override - serial_core: Check for port state when tty is in error state - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() - quota: Sanity-check quota file headers on load - media: msi2500: assign SPI bus number dynamically - crypto: af_alg - avoid undefined behavior accessing salg_name - md: fix a warning caused by a race between concurrent md_ioctl()s - perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata - perf cs-etm: Move definition of 'traceid_list' global variable from header file - [x86] drm/gma500: fix double free of gma_connector - selinux: fix error initialization in inode_doinit_with_dentry() - RDMA/rxe: Compute PSN windows correctly - [x86] mm/ident_map: Check for errors from ident_pud_init() - [armel,armhf] p2v: fix handling of LPAE translation in BE mode - [x86] apic: Fix x2apic enablement without interrupt remapping - sched/deadline: Fix sched_dl_global_validate() - sched: Reenable interrupts in do_sched_yield() - [arm64] crypto: inside-secure - Fix sizeof() mismatch - [powerpc*] 64: Set up a kernel stack for secondaries before cpu_restore() - [arm64] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state - ASoC: pcm: DRAIN support reactivation - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling - Bluetooth: Fix null pointer dereference in hci_event_packet() - Bluetooth: hci_h5: fix memory leak in h5_close - [armhf] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup - [arm64] spi: tegra20-slink: fix reference leak in slink ops of tegra20 - [arm64,armhf] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume - [arm64,armhf] spi: tegra114: fix reference leak in tegra spi ops - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure - RDMa/mthca: Work around -Wenum-conversion warning - [x86] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() - [x86] media: tm6000: Fix sizeof() mismatches - scsi: core: Fix VPD LUN ID designator priorities - media: solo6x10: fix missing snd_card_free in error handling case - [armhf] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() - Input: ads7846 - fix race that causes missing releases - Input: ads7846 - fix integer overflow on Rt calculation - Input: ads7846 - fix unaligned access on 7845 - spi: fix resource leak for drivers without .remove callback - [armhf] Input: omap4-keypad - fix runtime PM error handling - RDMA/cxgb4: Validate the number of CQEs - memstick: fix a double-free bug in memstick_check - orinoco: Move context allocation after processing the skb - [arm64] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() - media: siano: fix memory leak of debugfs members in smsdvb_hotplug - [armhf] HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() - [arm64] dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc - [x86] power: supply: bq24190_charger: fix reference leak - genirq/irqdomain: Don't try to free an interrupt that has no mapping - PCI: Bounds-check command-line resource alignment requests - PCI: Fix overflow in command-line resource alignment requests - [arm64] dts: meson: fix spi-max-frequency on Khadas VIM2 - [x86] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init - ath10k: Fix the parsing error in service available event - ath10k: Fix an error handling path - ath10k: Release some resources in an error handling path - NFSv4.2: condition READDIR's mask for security label based on LSM state - SUNRPC: xprt_load_transport() needs to support the netid "rdma6" - lockd: don't use interval-based rebinding over TCP - NFS: switch nfsiod to be an UNBOUND workqueue. - vfio-pci: Use io_remap_pfn_range() for PCI IO memory - media: saa7146: fix array overflow in vidioc_s_audio() - memstick: r592: Fix error return in r592_probe() - net/mlx5: Properly convey driver version to firmware - dm ioctl: fix error return code in target_message - [arm64,armhf] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI - [armhf] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe - scsi: pm80xx: Fix error return in pm8001_pci_probe() - seq_buf: Avoid type mismatch for seq_buf_init - [x86] scsi: fnic: Fix error return code in fnic_probe() - [powerpc*] pseries/hibernation: drop pseries_suspend_begin() from suspend ops - [powerpc*] pseries/hibernation: remove redundant cacheinfo update - [armhf] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe - speakup: fix uninitialized flush_lock - nfsd: Fix message level for normal termination - nfs_common: need lock during iterate through the list - [x86] kprobes: Restore BTF if the single-stepping is cancelled - [arm64,armhf] clk: tegra: Fix duplicated SE clock entry - mac80211: don't set set TDLS STA bandwidth wider than possible - watchdog: Fix potential dereferencing of null pointer - [armhf] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function - [arm64,x86] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update - [arm64] watchdog: qcom: Avoid context switch in restart handler - [armhf] clk: ti: Fix memleak in ti_fapll_synth_setup - qlcnic: Fix error code in probe - [armhf] clk: s2mps11: Fix a resource leak in error handling paths in the probe function - [arm64,armhf] clk: sunxi-ng: Make sure divider tables have sentinel - [armhf] sunxi: Add machine match for the Allwinner V3 SoC - cfg80211: initialize rekey_data - lwt: Disable BH too in run_lwt_bpf() - [arm64,armhf] Input: cros_ec_keyb - send 'scancodes' in addition to key events - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet - media: gspca: Fix memory leak in probe - [armhf] media: sunxi-cir: ensure IR is handled when it is continuous - media: netup_unidvb: Don't leak SPI master in probe error path - [x86] Input: cyapa_gen6 - fix out-of-bounds stack access - ALSA: hda/ca0132 - Change Input Source enum strings. - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" - ACPI: PNP: compare the string length in the matching_id() - ALSA: hda: Fix regressions on clear and reconfig sysfs - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 - ALSA: pcm: oss: Fix a few more UBSAN fixes - ALSA: hda/realtek: Add quirk for MSI-GP73 - ALSA: hda/realtek: Apply jack fixup for Quanta NL3 - ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices - ALSA: usb-audio: Disable sample read check if firmware doesn't give back - [s390x] smp: perform initial CPU reset also for SMT siblings - [s390x] dasd: fix hanging device offline processing - [s390x] dasd: prevent inconsistent LCU device data - [s390x] dasd: fix list corruption of pavgroup group list - [s390x] dasd: fix list corruption of lcu list - [x86] staging: comedi: mf6x4: Fix AI end-of-conversion detection - [powerpc*] perf: Exclude kernel samples while counting events in user space. - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() - [x86] EDAC/amd64: Fix PCI component registration - USB: serial: mos7720: fix parallel-port state restore - USB: serial: digi_acceleport: fix write-wakeup deadlocks - USB: serial: keyspan_pda: fix dropped unthrottle interrupts - USB: serial: keyspan_pda: fix write deadlock - USB: serial: keyspan_pda: fix stalled writes - USB: serial: keyspan_pda: fix write-wakeup use-after-free - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free - USB: serial: keyspan_pda: fix write unthrottling - ext4: fix a memory leak of ext4_free_data - ext4: fix deadlock with fs freezing and EA inodes - [arm64] KVM: Introduce handling of AArch32 TTBCR2 traps - [armhf] dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES - [powerpc*] Fix incorrect stw{, ux, u, x} instructions in __set_pte_at - [powerpc*] rtas: Fix typo of ibm,open-errinjct in RTAS filter - [powerpc*] xmon: Change printk() to pr_cont() - ceph: fix race in concurrent __ceph_remove_cap invocations - SMB3: avoid confusing warning message on mount to Azure - SMB3.1.1: do not log warning message if server doesn't populate salt - ubifs: wbuf: Don't leak kernel memory to flash - jffs2: Fix GC exit abnormally - jfs: Fix array index bounds check in dbAdjTree (CVE-2020-27815) - drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() - [armel] mtd: parser: cmdline: Fix parsing of part-names with colons - scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() - scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() - iio: buffer: Fix demux update - [arm64,armhf] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume - md/cluster: block reshape with remote resync job - md/cluster: fix deadlock when node is doing resync job - [arm64,armhf] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler - [arm64] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (CVE-2020-29569) - xen/xenbus: Allow watches discard events before queueing (CVE-2020-29568) - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (CVE-2020-29568) - xen/xenbus/xen_bus_type: Support will_handle watch callback (CVE-2020-29568) - xen/xenbus: Count pending messages for each watch (CVE-2020-29568) - xenbus/xenbus_backend: Disallow pending watch messages (CVE-2020-29568) - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels - [x86] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 - PCI: Fix pci_slot_release() NULL pointer dereference https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.165 - md/raid10: initialize r10_bio->read_slot before use. - fscrypt: add fscrypt_is_nokey_name() - ext4: prevent creating duplicate encrypted filenames - f2fs: prevent creating duplicate encrypted filenames - ubifs: prevent creating duplicate encrypted filenames - vfio/pci: Move dummy_resources_list init in vfio_pci_probe() - ext4: don't remount read-only with errors=continue on reboot - uapi: move constants from to - [x86] KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses - [x86] KVM: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits - [powerpc*] bitops: Fix possible undefined behaviour with fls() and fls64() - xen/gntdev.c: Mark pages as dirty - null_blk: Fix zone size initialization - of: fix linker-section match-table corruption - Bluetooth: hci_h5: close serdev device and free hu in h5_close - reiserfs: add check for an invalid ih_entry_count - [x86] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() - media: gp8psk: initialize stats at power control logic - ALSA: seq: Use bool for snd_seq_queue internal flags - ALSA: rawmidi: Access runtime->avail always in spinlock - fcntl: Fix potential deadlock in send_sig{io, urg}() - [arm64,armhf] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init - module: set MODULE_STATE_GOING state when a module fails to load - quota: Don't overflow quota file offsets - NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode - module: delay kobject uevent until after module init call - ALSA: pcm: Clear the full allocated memory at hw_params - dm verity: skip verity work if I/O error when system is shutting down https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.166 - kdev_t: always inline major/minor helper functions - mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start (CVE-2020-36158) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.167 - workqueue: Kick a worker based on the actual activation of delayed works - scsi: ufs: Fix wrong print message in dev_err() - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() - scsi: scsi_transport_spi: Set RQF_PM for domain validation commands - lib/genalloc: fix the overflow when size is too big - proc: change ->nlink under proc_subdir_lock - proc: fix lookup in /proc/net subdirectories after setns(2) - i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs - [arm64,armhf] net: mvpp2: Add TCAM entry to drop flow control pause frames - [arm64,armhf] net: mvpp2: prs: fix PPPoE with ipv6 packet parse - atm: idt77252: call pci_disable_device() on error path - [arm64,armhf] net: mvpp2: Fix GoP port 3 Networking Complex Control configurations - qede: fix offload for IPIP tunnel packets - virtio_net: Fix recursive call to cpus_read_lock() - net-sysfs: take the rtnl lock when storing xps_cpus - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() - [arm64] net: hns: fix return value check in __lb_other_process() - erspan: fix version 1 check in gre_parse_header() - net: hdlc_ppp: Fix issues when mod_timer is called while timer is running - CDC-NCM: remove "connected" log message - net: usb: qmi_wwan: add Quectel EM160R-GL - r8169: work around power-saving bug on some chip versions - vhost_net: fix ubuf refcount incorrectly when sendmsg fails - net: sched: prevent invalid Scell_log shift count - net-sysfs: take the rtnl lock when storing xps_rxqs - net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc - Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close - [x86] video: hyperv_fb: Fix the mmap() regression for v5.4.y and older - crypto: ecdh - avoid buffer overflow in ecdh_set_secret() - usb: gadget: enable super speed plus - USB: cdc-acm: blacklist another IR Droid device - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt(). - [arm64] usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion - [arm64,armhf] usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set - usb: usbip: vhci_hcd: protect shift size - USB: serial: iuu_phoenix: fix DMA from stack - USB: serial: option: add LongSung M5710 module support - USB: serial: option: add Quectel EM160R-GL - USB: yurex: fix control-URB timeout handling - USB: usblp: fix DMA to stack - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks - usb: gadget: f_uac2: reset wMaxPacketSize - usb: gadget: function: printer: Fix a memory leak for interface descriptor - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size - usb: gadget: Fix spinlock lockup on usb_function_deactivate - usb: gadget: configfs: Preserve function ordering after bind failure - usb: gadget: configfs: Fix use-after-free issue with udc_name - USB: serial: keyspan_pda: remove unused variable - [x86] mm: Fix leak of pmd ptlock - ALSA: hda/via: Fix runtime PM for Clevo W35xSS - ALSA: hda/conexant: add a new hda codec CX11970 - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 - btrfs: send: fix wrong file path when there is an inode with a pending rmdir - Revert "device property: Keep secondary firmware node secondary by type" - [x86] xen/pvh: correctly setup the PV EFI interface for dom0 - netfilter: x_tables: Update remaining dereference to RCU - netfilter: ipset: fix shift-out-of-bounds in htable_bits() - netfilter: xt_RATEEST: reject non-null terminated string from userspace - [x86] mtrr: Correct the range check before performing MTRR type lookups - scsi: target: Fix XCOPY NAA identifier lookup (CVE-2020-28374) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.168 - net: cdc_ncm: correct overhead in delayed_ndp_size (Closes: #970736) - [arm64] net: hns3: fix the number of queues actually used by ARQ - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY resource references - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY power - net: vlan: avoid leaks on register_vlan_dev() failures - net: ip: always refragment ip defragmented packets - net: fix pmtu check in nopmtudisc mode - net: ipv6: fib: flush exceptions when purging route - vmlinux.lds.h: Add PGO and AutoFDO input sections - [x86] drm/i915: Fix mismatch between misplaced vma check and vma insert - [amd64] spi: pxa2xx: Fix use-after-free on unbind - HID: wacom: Fix memory leakage caused by kfifo_alloc - [armhf] OMAP2+: omap_device: fix idling of devices during probe - [x86] cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() - [amd64] iommu/intel: Fix memleak in intel_irq_remapping_alloc - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups - net/mlx5e: Fix two double free cases - regmap: debugfs: Fix a memory leak when calling regmap_attach_dev - [arm64] KVM: Don't access PMCR_EL0 when no PMU is available - block: fix use-after-free in disk_part_iter_next - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet - regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.169 - ASoC: dapm: remove widget from dirty list on free - [x86] hyperv: check cpu mask after interrupt has been disabled - [mips*] boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB - ACPI: scan: Harden acpi_device_add() against device ID overflows - mm/hugetlb: fix potential missing huge page size info - dm snapshot: flush merged data before committing metadata - dm integrity: fix the maximum number of arguments - r8152: Add Lenovo Powered USB-C Travel Hub - ext4: fix bug for rename with RENAME_WHITEOUT - btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan - bfq: Fix computation of shallow depth - [arm64] drm/msm: Call msm_init_vram before binding the gpu - dump_common_audit_data(): fix racy accesses to ->d_name - [x86] ASoC: Intel: fix error code cnl_set_dsp_D0() - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock - pNFS: Mark layout for return if return-on-close was not sent - NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter - NFS: nfs_igrab_and_active must first reference the superblock - ext4: fix superblock checksum failure when setting password salt - [amd64] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp - RDMA/mlx5: Fix wrong free of blue flame register on error - mm, slub: consider rest of partial list if acquire_slab() fails - net: sunrpc: interpret the return value of kstrtou32 correctly - dm: eliminate potential source of excessive kernel log noise - ALSA: firewire-tascam: Fix integer overflow in midi_port_work() - ALSA: fireface: Fix integer overflow in transmit_midi_msg() - netfilter: conntrack: fix reading nf_conntrack_buckets - netfilter: nf_nat: Fix memleak in nf_nat_init https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.170 - usb: ohci: Make distrust_firmware param default to false - dm integrity: fix flush with external metadata device - nfsd4: readdirplus shouldn't return parent of export (CVE-2021-3178) - udp: Prevent reuseport_select_sock from reading uninitialized socks - netxen_nic: fix MSI/MSI-x interrupts - [arm64,armhf] net: mvpp2: Remove Pause and Asym_Pause support - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request - esp: avoid unneeded kmap_atomic call - net: dcb: Validate netlink message in DCB handler - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands - rxrpc: Call state should be read with READ_ONCE() under some circumstances - [arm64,armhf] net: stmmac: Fixed mtu channged by cache aligned - net: sit: unregister_netdevice on newlink's error path - net: avoid 32 x truesize under-estimation for tiny skbs - rxrpc: Fix handling of an unsupported token type in rxrpc_read() - tipc: fix NULL deref in tipc_link_xmit() - net: introduce skb_list_walk_safe for skb segment walking - net: skbuff: disambiguate argument and member for skb_list_walk_safe helper - net: ipv6: Validate GSO SKB before finish IPv6 processing https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.171 - ALSA: hda/via: Add minimum mute flag - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error - btrfs: fix lockdep splat in btrfs_recover_relocation - mmc: core: don't initialize block size from ext_csd if not present - [arm64] mmc: sdhci-xenon: fix 1.8v regulator stabilization - dm: avoid filesystem lookup in dm_get_dev_t() - dm integrity: fix a crash if "recalculate" used without "internal_hash" - drm/atomic: put state on error path - [x86] ASoC: Intel: haswell: Add missing pm_ops - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback - scsi: qedi: Correct max length of CHAP secret - HID: Ignore battery for Elan touchscreen on ASUS UX550 - xen: Fix event channel callback via INTX/GSI - drm/nouveau/bios: fix issue shadowing expansion ROMs - drm/nouveau/privring: ack interrupts the same way as RM - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields - drm/nouveau/mmu: fix vram heap sizing - drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 - scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression - i2c: octeon: check correct size of maximum RECV_LEN packet - [x86] platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list - can: dev: can_restart: fix use after free bug - can: vxcan: vxcan_xmit: fix use after free bug - can: peak_usb: fix use after free bugs - [mips*] irqchip/mips-cpu: Set IPI domain parent chip - [x86] intel_th: pci: Add Alder Lake-P support - [arm64] serial: mvebu-uart: fix tx lost characters at power off - ehci: fix EHCI host controller initialization sequence - usb: udc: core: Use lock when write to soft_connect - xhci: make sure TRB is fully written before giving it to the controller - [arm64,armhf] xhci: tegra: Delay for disabling LFPS detector - driver core: Extend device_is_dependent() - netfilter: rpfilter: mask ecn bits before fib lookup - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too - udp: mask TOS bits in udp_v4_early_demux() - ipv6: create multicast route with RTPROT_KERNEL - net_sched: avoid shift-out-of-bounds in tcindex_set_parms() - net_sched: reject silly cell_log in qdisc_get_rtab() - ipv6: set multicast flag on the multicast route - net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled - [armhf] net: dsa: b53: fix an off by one in checking "vlan->vid" [ Salvatore Bonaccorso ] * [rt] Update to 4.19.165-rt70 * Bump ABI to 14 * [rt] Refresh "net/core: protect users of napi_alloc_cache against reentrance" * futex: Move futex exit handling into futex code * futex: Replace PF_EXITPIDONE with a state * exit/exec: Seperate mm_release() * futex: Split futex_mm_release() for exit/exec * futex: Set task::futex_state to DEAD right after handling futex exit * futex: Mark the begin of futex exit explicitly * futex: Sanitize exit state handling * futex: Provide state handling for exec() as well * futex: Add mutex around futex exit * futex: Provide distinct return value when owner is exiting * futex: Prevent exit livelock * [rt] Refresh "softirq: Split softirq locks" * [arm*] gpio: mvebu: fix pwm .get_state period calculation * Revert "mm/slub: fix a memory leak in sysfs_slab_add()" * futex: Ensure the correct return value from futex_lock_pi() * futex: Replace pointless printk in fixup_owner() * futex: Provide and use pi_state_update_owner() * rtmutex: Remove unused argument from rt_mutex_proxy_unlock() * futex: Use pi_state_update_owner() in put_pi_state() * futex: Simplify fixup_pi_state_owner() * futex: Handle faults correctly for PI futexes * [rt] Refresh "rtmutex: Handle the various new futex race conditions" * [rt] Refresh "rtmutex: add sleeping lock implementation" * [rt] Refresh "Revert "rtmutex: Handle the various new futex race conditions"" * [rt] Refresh "futex: Make the futex_hash_bucket lock raw" * [rt] Refresh "futex: Delay deallocation of pi_state" * [rt] Refresh "futex: Make the futex_hash_bucket spinlock_t again and bring back its old state" * HID: wacom: Correct NULL dereference on AES pen proximity * tracing: Fix race in trace_open and buffer resize call (CVE-2020-27825) [ Uwe Kleine-König ] * [arm64] Enable support for NXP's PCF85063 RTC (Closes: #972345) -- Salvatore Bonaccorso Fri, 29 Jan 2021 23:03:16 +0100 linux (4.19.160-2) buster; urgency=medium * net: Disable MLX5_ESWITCH on mips and mipsel (Fixes FTBFS) -- Salvatore Bonaccorso Sat, 28 Nov 2020 08:47:24 +0100 linux (4.19.160-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.153 - [ppc64el] ibmveth: Switch order of ibmveth_helper calls. - [ppc64el] ibmveth: Identify ingress large send packets. - ipv4: Restore flowi4_oif update before call to xfrm_lookup_route - mlx4: handle non-napi callers to napi_poll - [armhf] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() - [armhf] net: fec: Fix PHY init after phy_reset_after_clk_enable() - net: fix pos incrementment in ipv6_route_seq_next - net/smc: fix valid DMBE buffer sizes - net: usb: qmi_wwan: add Cellient MPL200 card - tipc: fix the skb_unshare() in tipc_buf_append() - net/ipv4: always honour route mtu during forwarding - r8169: fix data corruption issue on RTL8402 - [arm*] binder: fix UAF when releasing todo list (CVE-2020-0423) - ALSA: bebob: potential info leak in hwdep_read() - net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device - [x86,ppc64el] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup - net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels - nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() - tcp: fix to update snd_wl1 in bulk receiver fast path - r8169: fix operation under forced interrupt threading - icmp: randomize the global rate limiter (CVE-2020-25705) - ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 - cifs: remove bogus debug code - cifs: Return the error from crypt_message when enc/dec key not found. - [x86] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages - [x86] KVM: SVM: Initialize prev_ga_tag before use - crypto: algif_aead - Do not set MAY_BACKLOG on the async path - [x86] EDAC/i5100: Fix error handling order in i5100_init_one() - [x86] fpu: Allow multiple bits in clearcpuid= parameter - [arm64] drivers/perf: xgene_pmu: Fix uninitialized resource struct - [x86] nmi: Fix nmi_handle() duration miscalculation - [amd64] x86/events/amd/iommu: Fix sizeof mismatch - crypto: algif_skcipher - EBUSY on aio should be an error - media: tuner-simple: fix regression in simple_set_radio_freq - media: uvcvideo: Set media controller entity functions - media: uvcvideo: Silence shift-out-of-bounds warning - [armhf] media: omap3isp: Fix memleak in isp_probe - [armhf] media: ti-vpe: Fix a missing check and reference count leak - regulator: resolve supply after creating regulator - ath10k: provide survey info as accumulated data - Bluetooth: hci_uart: Cancel init work before unregistering - ath6kl: prevent potential array overflow in ath6kl_add_new_sta() - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() - ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path - [arm64] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 - [arm64] ASoC: qcom: lpass-platform: fix memory leak - [arm64] ASoC: qcom: lpass-cpu: fix concurrency issue - brcmfmac: check ndev pointer - mwifiex: Do not use GFP_KERNEL in atomic context - [x86] staging: rtl8192u: Do not use GFP_KERNEL in atomic context - [x86] drm/gma500: fix error check - scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() - [x86] VMCI: check return value of get_user_pages_fast() for errors - [ppc64el] tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() - pty: do tty_flip_buffer_push without port->lock in pty_write - [x86] pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() - [x86] pwm: lpss: Add range limit check for the base_unit register value - [x86] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error - video: fbdev: sis: fix null ptr dereference - video: fbdev: radeon: Fix memleak in radeonfb_pci_register - HID: roccat: add bounds checking in kone_sysfs_write_settings() - [armhf] pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser - [armhf] pinctrl: mcp23s08: Fix mcp23x17 precious range - net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow - [arm64,armhf] net: stmmac: use netif_tx_start|stop_all_queues() function - [arm64] cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE - ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() - [amd64] misc: mic: scif: Fix error handling path - [arm*] usb: dwc2: Fix parameter type in function pointer prototype - quota: clear padding in v2r1_mem2diskdqb() - HID: hid-input: fix stylus battery reporting - net: enic: Cure the enic api locking trainwreck - [mips*] mfd: sm501: Fix leaks in probe() - iwlwifi: mvm: split a print to avoid a WARNING in ROC - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. - usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well - nl80211: fix non-split wiphy information - [arm*] usb: dwc2: Fix INTR OUT transfers in DDMA mode. - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized - scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() - mwifiex: fix double free - ipvs: clear skb->tstamp in forwarding path - netfilter: nf_log: missing vlan offload tag and proto - mm/memcg: fix device private memcg accounting - mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary - IB/mlx4: Fix starvation in paravirt mux/demux - IB/mlx4: Adjust delayed work when a dup is observed - [powerpc*] pseries: Fix missing of_node_put() in rng_init() - [powerpc*] icp-hv: Fix missing of_node_put() in success path - RDMA/ucma: Fix locking for ctx->events_reported - RDMA/ucma: Add missing locking around rdma_leave_multicast() - [powerpc*] pseries: explicitly reschedule during drmem_lmb list traversal - mtd: mtdoops: Don't write panic data twice - [armel,armhf] ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values - xfs: limit entries returned when counting fsmap records - xfs: fix high key handling in the rt allocator's query_range function - RDMA/qedr: Fix use of uninitialized field - RDMA/qedr: Fix inline size returned for iWARP https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.154 - [powerpc*] 64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm - RDMA/cma: Remove dead code for kernel rdmacm multicast - RDMA/cma: Consolidate the destruction of a cma_multicast in one place - [arm64] RDMA/hns: Set the unsupported wr opcode - [arm64] RDMA/hns: Fix missing sq_sig_type when querying QP - overflow: Include header file with SIZE_MAX declaration - [powerpc*] perf: Exclude pmc5/6 from the irrelevant PMU group constraints - [poerpc*] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier - IB/rdmavt: Fix sizeof mismatch - f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info - lib/crc32.c: fix trivial typo in preprocessor condition - rapidio: fix error handling path - rapidio: fix the missed put_device() for rio_mport_add_riodev - mailbox: avoid timer start from callback - [arm64,armhf] clk: rockchip: Initialize hw to error to avoid undefined behavior - [arm*] clk: bcm2835: add missing release if devm_clk_hw_register fails - watchdog: Fix memleak in watchdog_cdev_register - watchdog: Use put_device on error - svcrdma: fix bounce buffers for unaligned offsets and multiple pages - ext4: limit entries returned when counting fsmap records - vfio/pci: Clear token on bypass registration failure - [amd64,arm64] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() - [armhf] Input: omap4-keypad - fix handling of platform_get_irq() error - [armhf] Input: twl4030_keypad - fix handling of platform_get_irq() error - [armhf] Input: sun4i-ps2 - fix handling of platform_get_irq() error - [x86] KVM: emulating RDPID failure shall return #UD rather than #GP - netfilter: conntrack: connection timeout after re-register - netfilter: nf_fwd_netdev: clear timestamp in forwarding path - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator - [armhf] memory: omap-gpmc: Fix a couple off by ones - [powerpc*] powernv/dump: Fix race while processing OPAL dump - nvmet: fix uninitialized work for zero kato - [x86,arm64] i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs - block: ratelimit handle_bad_sector() message - [x86] crypto: ccp - fix error handling - media: firewire: fix memory leak - media: ati_remote: sanity check for both endpoints - media: media/pci: prevent memory leak in bttv_probe - media: uvcvideo: Ensure all probed info is returned to v4l2 - mmc: sdio: Check for CISTPL_VERS_1 buffer size - media: saa7134: avoid a shift overflow - fs: dlm: fix configfs memory leak - [arm64] media: venus: core: Fix runtime PM imbalance in venus_probe - ip_gre: set dev->hard_header_len and dev->needed_headroom properly - mac80211: handle lack of sband->bitrates in rates - PM: hibernate: remove the bogus call to get_gendisk() in software_resume() - scsi: mvumi: Fix error return in mvumi_io_attach() - scsi: target: core: Add CONTROL field for trace events - [amd64] mic: vop: copy data to kernel space then write to io memory - [amd64] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic - usb: gadget: function: printer: fix use-after-free in __lock_acquire - udf: Limit sparing table size - udf: Avoid accessing uninitialized data on failed inode read - USB: cdc-acm: handle broken union descriptors - [arm64,armhf] usb: dwc3: simple: add support for Hikey 970 - [armhf] can: flexcan: flexcan_chip_stop(): add error handling and propagate error value - ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() - misc: rtsx: Fix memory leak in rtsx_pci_probe - reiserfs: only call unlock_new_inode() if I_NEW - xfs: make sure the rt allocator doesn't run off the end - usb: ohci: Default to per-port over-current protection - Bluetooth: Only mark socket zapped after unlocking - [ppc64el] scsi: ibmvfc: Fix error return in ibmvfc_probe() - brcmsmac: fix memory leak in wlc_phy_attach_lcnphy - rtl8xxxu: prevent potential memory leak - Fix use after free in get_capset_info callback. - scsi: qedi: Protect active command list to avoid list corruption - scsi: qedi: Fix list_del corruption while removing active I/O - [x86] tty: ipwireless: fix error handling - ipvs: Fix uninit-value in do_ip_vs_set_ctl() - reiserfs: Fix memory leak in reiserfs_parse_options() - mwifiex: don't call del_timer_sync() on uninitialized timer - brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach - usb: core: Solve race condition in anchor cleanup functions - ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() - usb: cdc-acm: add quirk to blacklist ETAS ES58X devices - USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). - eeprom: at25: set minimum read/write access stride to 1 - usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets. https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.155 - scripts/setlocalversion: make git describe output more reliable - [arm64] Run ARCH_WORKAROUND_1 enabling code on all CPUs - [arm64] link with -z norelro regardless of CONFIG_RELOCATABLE - [x86,arm64,armhf] efivarfs: Replace invalid slashes with exclamation marks in dentries. - gtp: fix an use-before-init in gtp_newlink() - netem: fix zero division in tabledist - tcp: Prevent low rmem stalls with SO_RCVLOWAT. - tipc: fix memory leak caused by tipc_buf_append() - r8169: fix issue with forced threading in combination with shared interrupts - cxgb4: set up filter action after rewrites - [x86] arch/x86/amd/ibs: Fix re-arming IBS Fetch - [x86] xen: disable Firmware First mode for correctable memory errors - fuse: fix page dereference after free - bpf: Fix comment for helper bpf_current_task_under_cgroup() - p54: avoid accessing the data mapped to streaming DMA - [powerpc*] cxl: Rework error message for incompatible slots - RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() - mtd: lpddr: Fix bad logic in print_drs_error - [arm*] serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt - fscrypt: return -EXDEV for incompatible rename or link into encrypted dir - fscrypt: clean up and improve dentry revalidation - fscrypt: fix race allowing rename() and link() of ciphertext dentries - fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory - fscrypt: only set dentry_operations on ciphertext dentries - fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext - Revert "block: ratelimit handle_bad_sector() message" - xen/events: don't use chip_data for legacy IRQs - xen/events: avoid removing an event channel while handling it (CVE-2020-27675) - xen/events: add a proper barrier to 2-level uevent unmasking (CVE-2020-27673) - xen/events: fix race in evtchn_fifo_unmask() (CVE-2020-27673) - xen/events: add a new "late EOI" evtchn framework (CVE-2020-27673) - xen/blkback: use lateeoi irq binding (CVE-2020-27673) - xen/netback: use lateeoi irq binding (CVE-2020-27673) - xen/scsiback: use lateeoi irq binding (CVE-2020-27673) - xen/pvcallsback: use lateeoi irq binding (CVE-2020-27673) - xen/pciback: use lateeoi irq binding (CVE-2020-27673) - xen/events: switch user event channels to lateeoi model (CVE-2020-27673) - xen/events: use a common cpu hotplug hook for event channels (CVE-2020-27673) - xen/events: defer eoi in case of excessive number of events (CVE-2020-27673) - xen/events: block rogue events for some time (CVE-2020-27673) - RDMA/qedr: Fix memory leak in iWARP CM - ata: sata_nv: Fix retrieving of active qcs - futex: Fix incorrect should_fail_futex() handling - [powerpc*] powernv/smp: Fix spurious DBG() warning - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race - [powerpc*] select ARCH_WANT_IRQS_OFF_ACTIVATE_MM - f2fs: add trace exit in exception path - f2fs: fix uninit-value in f2fs_lookup - f2fs: fix to check segment boundary during SIT page readahead - [armel,armhf] 8997/2: hw_breakpoint: Handle inexact watchpoint addresses - power: supply: bq27xxx: report "not charging" on all types - xfs: fix realtime bitmap/summary file truncation when growing rt volume - ath10k: fix VHT NSS calculation when STBC is enabled - media: videodev2.h: RGB BT2020 and HSV are always full range - [x86] usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart - media: tw5864: check status of tw5864_frameinterval_get - mmc: via-sdmmc: Fix data race bug - [arm64] topology: Stop using MPIDR for topology information - media: uvcvideo: Fix dereference of out-of-bound list iterator - USB: adutux: fix debugging - uio: free uio id after uio file node is freed - usb: xhci: omit duplicate actions when suspending a runtime suspended host. - [arm64] mm: return cpu_all_mask when node is NUMA_NO_NODE - xfs: don't free rt blocks when we're doing a REMAP bunmapi call - ACPI: Add out of bounds and numa_off protections to pxm_to_node() - drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values - btrfs: fix replace of seed device - md/bitmap: md_bitmap_get_counter returns wrong blocks - bnxt_en: Log unknown link speed appropriately. - [arm64] rpmsg: glink: Use complete_all for open states - [armhf] clk: ti: clockdomain: fix static checker warning - net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid - ext4: Detect already used quota file early - gfs2: add validation checks for size of superblock - cifs: handle -EINTR in cifs_setattr - [armhf] memory: emif: Remove bogus debugfs error handling - nbd: make the config put is called before the notifying the waiter - sgl_alloc_order: fix memory leak - nvme-rdma: fix crash when connect rejected - md/raid5: fix oops during stripe resizing - [x86,arm64] mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN - [x86] perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count() - [x86] perf/x86/amd/ibs: Fix raw sample data accumulation - media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect - fs: Don't invalidate page buffers in block_write_full_page() - NFS: fix nfs_path in case of a rename retry - ACPI: button: fix handling lid state changes when input device closed - [x86] ACPI / extlog: Check for RDMSR failure (Closes: #971058) - [x86] ACPI: video: use ACPI backlight for HP 635 Notebook - [x86] acpi-cpufreq: Honor _PSD table setting on new AMD CPUs - scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() - scsi: qla2xxx: Fix crash on session cleanup with unload - btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode - btrfs: improve device scanning messages - btrfs: reschedule if necessary when logging directory items - btrfs: send, recompute reference path after orphanization of a directory - btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send() - btrfs: cleanup cow block on error - btrfs: fix use-after-free on readahead extent after failure to create it - usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC - [arm64,armhf] usb: dwc3: ep0: Fix ZLP for OUT ep0 requests - [arm64,armhf] usb: dwc3: gadget: Check MPS of the request length - [arm64,armhf] usb: dwc3: core: add phy cleanup for probe error handling - [arm64,armhf] usb: dwc3: core: don't trigger runtime pm when remove driver - usb: cdc-acm: fix cooldown mechanism - [x86] usb: typec: tcpm: reset hard_reset_count for any disconnect - [x86] drm/i915: Force VT'd workarounds when running as a guest OS - vt: keyboard, simplify vt_kdgkbsent - vt: keyboard, extend func_buf_lock to readers (CVE-2020-25656) - HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery - udf: Fix memory leak when mounting - [powerpc*] drmem: Make lmb_size 64 bit - [s390x] stp: add locking to sysfs functions - [powerpc*] rtas: Restrict RTAS requests from userspace (CVE-2020-27777) - [powerpc*] Warn about use of smt_snooze_delay - [powerpc*] powernv/elog: Fix race while processing OPAL error log event. - [powerpc*] Fix undetected data corruption with P9N DD2.1 VSX CI load emulation - NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag - NFSD: Add missing NFSv2 .pc_func methods - ubifs: dent: Fix some potential memory leaks while iterating entries - perf python scripting: Fix printable strings in python3 scripts - ubi: check kthread_should_stop() after the setting of task state - [armhf] i2c: imx: Fix external abort on interrupt in exit paths - drm/amdgpu: don't map BO in reserved region - ceph: promote to unsigned long long before shifting - libceph: clear con->out_msg on Policy::stateful_server faults - 9P: Cast to loff_t before multiplying - ring-buffer: Return 0 on success from ring_buffer_resize() - [amd64] vringh: fix __vringh_iov() when riov and wiov are different - ext4: fix leaking sysfs kobject after failed mount - ext4: fix error handling code in add_new_gdb - ext4: fix invalid inode checksum - drm/ttm: fix eviction valuable range check. - tty: make FONTX ioctl use the tty pointer they were actually passed (CVE-2020-25668) - cachefiles: Handle readpage error correctly - device property: Keep secondary firmware node secondary by type - device property: Don't clear secondary pointer for shared primary firmware node - [arm64] KVM: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR - [x86] staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice - [mips*] staging: octeon: repair "fixed-link" support - [mips*] staging: octeon: Drop on uncorrectable alignment or FCS error https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.156 - [x86] drm/i915: Break up error capture compression loops with cond_resched() - tipc: fix use-after-free in tipc_bcast_get_mode - ptrace: fix task_join_group_stop() for the case when current is traced - [arm64] cadence: force nonlinear buffers to be cloned - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition - sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms - [arm64,armhf] sfp: Fix error handing in sfp_probe() - blktrace: fix debugfs use after free (CVE-2019-19770) - btrfs: extent_io: Kill the forward declaration of flush_write_bio - btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up - Revert "btrfs: flush write bio if we loop in extent_write_cache_pages" - btrfs: flush write bio if we loop in extent_write_cache_pages - btrfs: extent_io: Handle errors better in extent_write_full_page() - btrfs: extent_io: Handle errors better in btree_write_cache_pages() - btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io() - Btrfs: fix unwritten extent buffers and hangs on future writeback attempts - btrfs: Don't submit any btree write bio if the fs has errors (CVE-2019-19039, CVE-2019-19377) - btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it - btrfs: tree-checker: Make chunk item checker messages more readable - btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO - btrfs: tree-checker: Check chunk item at tree block read time - btrfs: tree-checker: Verify dev item - btrfs: tree-checker: Fix wrong check on max devid - btrfs: tree-checker: Enhance chunk checker to validate chunk profile (CVE-2019-19816) - btrfs: tree-checker: Verify inode item - btrfs: tree-checker: fix the error message for transid error - Fonts: Replace discarded const qualifier - ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 - ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices - ALSA: usb-audio: Add implicit feedback quirk for Qu-16 - ALSA: usb-audio: Add implicit feedback quirk for MODX - mm: mempolicy: fix potential pte_unmap_unlock pte error - kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled - mm: always have io_remap_pfn_range() set pgprot_decrypted() - gfs2: Wake up when sd_glock_disposal becomes zero - ring-buffer: Fix recursion protection transitions between interrupt context - ftrace: Fix recursion check for NMI test - ftrace: Handle tracing when switching between context - tracing: Fix out of bounds write in get_trace_buf - futex: Handle transient "ownerless" rtmutex state correctly - [amd64] x86/kexec: Use up-to-dated screen_info copy to fill boot params - of: Fix reserved-memory overlap detection - blk-cgroup: Fix memleak on error path - blk-cgroup: Pre-allocate tree node on blkg_conf_prep - scsi: core: Don't start concurrent async scan on same host - vsock: use ns_capable_noaudit() on socket create - [arm*] drm/vc4: drv: Add error handding for bind - [amd64,arm64] ACPI: NFIT: Fix comparison to '-ENXIO' - vt: Disable KD_FONT_OP_COPY (CVE-2020-28974) - fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent - USB: serial: cyberjack: fix write-URB completion race - USB: serial: option: add Quectel EC200T module support - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 - USB: serial: option: add Telit FN980 composition 0x1055 - USB: Add NO_LPM quirk for Kingston flash drive - PM: runtime: Resume the device earlier in __device_release_driver() - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (CVE-2020-25704) - tools: perf: Fix build error in v4.19.y - [arm64,armhf] net: dsa: read mac address from DT for slave device - [arm64] dts: marvell: espressobin: Add ethernet switch aliases https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.157 - [x86] powercap: restrict energy meter to root access (CVE-2020-8694) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.158 - regulator: defer probe when trying to get voltage from unresolved supply - time: Prevent undefined behaviour in timespec64_to_ns() - nbd: don't update block size after device is started - [arm64,armhf] usb: dwc3: gadget: Continue to process pending requests - [arm64,armhf] usb: dwc3: gadget: Reclaim extra TRBs after request completion - btrfs: sysfs: init devices outside of the chunk_mutex - btrfs: reschedule when cloning lots of extents - [x86] hv_balloon: disable warning when floor reached - net: xfrm: fix a race condition during allocing spi - xfs: set xefi_discard when creating a deferred agfl free log intent item - netfilter: ipset: Update byte and packet counters regardless of whether they match - perf tools: Add missing swap for ino_generation - [x86] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() - can: rx-offload: don't call kfree_skb() from IRQ context - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() - can: peak_usb: add range checking in decode operations - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on - [armhf] can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A - xfs: flush new eof page on truncate to avoid post-eof corruption - [arm64,x86] tpm: efi: Don't create binary_bios_measurements file for an empty log - Btrfs: fix missing error return if writeback for extent buffer never started - ath9k_htc: Use appropriate rs_datalen type - netfilter: use actual socket sk rather than skb sk when routing harder - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free - gfs2: Add missing truncate_inode_pages_final for sd_aspace - gfs2: check for live vs. read-only file system in gfs2_fitrim - scsi: hpsa: Fix memory leak in hpsa_init_one() - drm/amdgpu: perform srbm soft reset always on SDMA resume - mac80211: fix use of skb payload instead of header - cfg80211: regulatory: Fix inconsistent format argument - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() - [s390x] smp: move rcu_cpu_starting() earlier - [x86] tpm_tis: Disable interrupts on ThinkPad T490s - tick/common: Touch watchdog in tick_unfreeze() on all CPUs - [x86] pinctrl: intel: Set default bias in case no particular value given - [armel,armhf] 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template - nbd: fix a block_device refcount leak in nbd_release - xfs: fix flags argument to rmap lookup when converting shared file rmaps - xfs: fix rmap key and record comparison functions - lan743x: fix "BUG: invalid wait context" when setting rx mode - xfs: fix a missing unlock on error in xfs_fs_map_blocks - of/address: Fix of_node memory leak in of_dma_is_coherent - [i386] cosa: Add missing kfree in error path of cosa_write - perf: Fix get_recursion_context() - ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA - ext4: unlock xattr_sem properly in ext4_inline_data_truncate() - btrfs: dev-replace: fail mount if we don't have replace item with target device - [x86] thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() - [x86] thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() - uio: Fix use-after-free in uio_unregister_device() - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode - futex: Don't enable IRQs unconditionally in put_pi_state() - ocfs2: initialize ip_next_orphan - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch - selinux: Fix error return code in sel_ib_pkey_sid_slow() - gpio: pcie-idio-24: Fix irq mask when masking - gpio: pcie-idio-24: Fix IRQ Enable Register value - gpio: pcie-idio-24: Enable PEX8311 interrupts - don't dump the threads that had been already exiting when zapped. - [x86] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] - pinctrl: amd: use higher precision for 512 RtcClk - pinctrl: amd: fix incorrect way to disable debounce filter - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" - IPv6: Set SIT tunnel hard_header_len to zero - [s390x] net/af_iucv: fix null pointer dereference on shutdown - net: Update window_clamp if SOCK_RCVBUF is set - tipc: fix memory leak in tipc_topsrv_start() - vrf: Fix fast path output packet handling with async Netfilter rules - r8169: fix potential skb double free in an error path - random32: make prandom_u32() output unpredictable - [x86] speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP - perf/core: Fix race in the perf_mmap_close() function (CVE-2020-14351) - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" - reboot: fix overflow parsing reboot cpu number - net: sch_generic: fix the missing new qdisc assignment bug - Convert trailing spaces and periods in path components https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.159 - [powerpc*] 64s: move some exception handlers out of line - [powerpc*] 64s: flush L1D on kernel entry (CVE-2020-4788) - [powerpc*] Add a framework for user access tracking - [powerpc*] Implement user_access_begin and friends - [powerpc*] Fix __clear_user() with KUAP enabled - [powerpc*] uaccess: Evaluate macro arguments once, before user access is allowed - [powerpc*] 64s: flush L1D after user accesses (CVE-2020-4788) - Revert "perf cs-etm: Move definition of 'traceid_list' global variable from header file" - Input: sunkbd - avoid use-after-free in teardown paths (CVE-2020-25669) - mac80211: always wind down STA state - can: proc: can_remove_proc(): silence remove_proc_entry warning - [x86] KVM: x86: clflushopt should be treated as a no-op by emulation - [arm64] ACPI: GED: fix -Wformat https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.160 - ah6: fix error return code in ah6_input() - atm: nicstar: Unmap DMA on send error - bnxt_en: read EEPROM A2h address using page 0 - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() - lan743x: fix issue causing intermittent kernel log warnings - lan743x: prevent entire kernel HANG on open, for some platforms - net: b44: fix error return code in b44_init_one() - net: bridge: add missing counters to ndo_get_stats64 callback - [arm64,armhf] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 - net: Have netpoll bring-up DSA management interface - net/mlx4_core: Fix init_hca fields offset - page_frag: Recover from memory pressure - qed: fix error return code in qed_iwarp_ll2_start() - qlcnic: fix error return code in qlcnic_83xx_restart_hw() - sctp: change to hold/put transport for proto_unreach_timer - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate - [arm64,armhf] net/mlx5: Disable QoS when min_rates on all VFs are zero - net: usb: qmi_wwan: Set DTR quirk for MR400 - [arm64,armhf] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq - scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() - [x86] ACPI: button: Add DMI quirk for Medion Akoya E2228T - [arm64] psci: Avoid printing in cpu_psci_cpu_die() - vfs: remove lockdep bogosity in __sb_start_write - [arm64] dts: allwinner: a64: Pine64 Plus: Fix ethernet node - [arm64] dts: allwinner: h5: OrangePi PC2: Fix ethernet node - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node - [armhf] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" - [armhf] dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY - [armhf] dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY - [arm64] dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY - [mips*] export has_transparent_hugepage() for modules - [arm64] dts: allwinner: h5: OrangePi Prime: Fix ethernet node - perf lock: Don't free "lock_seq_stat" if read_count isn't zero - ip_tunnels: Set tunnel option flag when tunnel metadata is present - can: af_can: prevent potential access of uninitialized member in can_rcv() - can: af_can: prevent potential access of uninitialized member in canfd_rcv() - can: dev: can_restart(): post buffer from the right context - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() - can: peak_usb: fix potential integer overflow on shift of a int - [arm64] ASoC: qcom: lpass-platform: Fix memory leak - [arm64,armhf] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits - [armhf] regulator: ti-abb: Fix array out of bound read access on the first transition - xfs: revert "xfs: fix rmap key and record comparison functions" - [amd64] efi/x86: Free efi_pgd with free_pages() - libfs: fix error cast of negative value in simple_attr_write() - speakup: Do not let the line discipline be used several times (CVE-2020-28941) - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() - ALSA: usb-audio: Add delay quirk for all Logitech USB devices - ALSA: ctl: fix error path at adding user-defined element set - ALSA: mixart: Fix mutex deadlock - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) - [armhf] tty: serial: imx: keep console clocks always on - [arm64,armhf,x86] efivarfs: fix memory leak in efivarfs_create() - [arm64,x86] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids - ext4: fix bogus warning in ext4_update_dx_flag() - [x86] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum - [x86] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode - [armhf] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} - regulator: fix memory leak with repeated set_machine_constraints() - regulator: avoid resolve_supply() infinite recursion - regulator: workaround self-referent regulators - mac80211: minstrel: remove deferred sampling code - mac80211: minstrel: fix tx status processing corner case - mac80211: free sta in sta_info_insert_finish() on errors - [s390x] cpum_sf.c: fix file permission for cpum_sfb_size - [s390x] dasd: fix null pointer dereference for ERP requests - ptrace: Set PF_SUPERPRIV when checking capability - seccomp: Set PF_SUPERPRIV when checking capability - [x86] microcode/intel: Check patch signature before saving microcode for early loading - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() [ Salvatore Bonaccorso ] * net: Enable NET_SWITCHDEV; disable on armel/marvell (Closes: #949863) * Bump ABI to 13 * [rt] Update to 4.19.152-rt65 * [rt] Refresh "mm: Protect activate_mm() by preempt_[disable&enable]_rt()" * [rt] Refresh "kthread: convert worker lock to raw spinlock" * [rt] Refresh "signals: Allow rt tasks to cache one sigqueue struct" * [rt] Refresh "tpm_tis: fix stall after iowrite*()s" * [rt] Refresh "futex: Delay deallocation of pi_state" * [rt] Refresh "futex: Make the futex_hash_bucket spinlock_t again" * [rt] Update to 4.19.152-rt66 - mm/memcontrol: Disable preemption in __mod_memcg_lruvec_state() - ptrace: fix ptrace_unfreeze_traced() race with rt-lock * [rt] Update to 4.19.160-rt69 [ Noah Meyerhans ] * Backport upstream fix for PCI bridge firmware configuration preservation (Closes: #968623) [ John L. Villalovos ] * Backport support for USB Host Controllers with local memory to avoid crashes. In particular the Renesas USB 3.0 controller (PD720201/PD720202) which is used on the Ampere's Mt Jade platform which is part of their Altra product line: - lib/genalloc: add gen_pool_dma_zalloc() for zeroed DMA allocations - USB: use genalloc for USB HCs with local memory - USB: drop HCD_LOCAL_MEM flag - usb: don't create dma pools for HCDs with a localmem_pool - usb: add a hcd_uses_dma helper - usb: host: ohci-sm501: init genalloc for local memory - usb/hcd: Fix a NULL vs IS_ERR() bug in usb_hcd_setup_local_mem() * [arm64] config/arm64/config: Set NODES_SHIFT to 4 [ Yves-Alexis Perez ] * usbnet: ipheth: fix connectivity with iOS 14 -- Salvatore Bonaccorso Thu, 26 Nov 2020 21:23:20 +0100 linux (4.19.152-1) buster-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.147 - [arm64,armhf] dsa: Allow forwarding of redirected IGMP traffic - scsi: qla2xxx: Update rscn_rcvd field to more meaningful scan_needed - scsi: qla2xxx: Move rport registration out of internal work_list - scsi: qla2xxx: Reduce holding sess_lock to prevent CPU lock-up - net: handle the return value of pskb_carve_frag_list() correctly - [x86] hv_netvsc: Remove "unlikely" from netvsc_select_queue - NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall - scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort - scsi: libfc: Fix for double free() - scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery - [arm64] regulator: pwm: Fix machine constraints application - NFS: Zero-stateid SETATTR should first return delegation - SUNRPC: stop printk reading past end of string - nvme-fc: cancel async events before freeing event struct - nvme-rdma: cancel async events before freeing event struct - f2fs: fix indefinite loop scanning for free nid - f2fs: Return EOF on unaligned end of file DIO read - i2c: algo: pca: Reapply i2c bus settings after reset - spi: Fix memory leak on splited transfers - [arm64,armhf] clk: rockchip: Fix initialization of mux_pll_src_4plls_p - [arm64] ASoC: qcom: Set card->owner to avoid warnings - [x86] Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload - fbcon: Fix user font detection test at fbcon_resize(). - USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook - USB: UAS: fix disconnect by unplugging a hub - usblp: fix race between disconnect() and read() - [x86] i2c: i801: Fix resume bug - Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO" - percpu: fix first chunk size calculation for populated bitmap - Input: trackpoint - add new trackpoint variant IDs - serial: 8250_pci: Add Realtek 816a and 816b - ehci-hcd: Move include to keep CRC stable - [powerpc*] dma: Fix dma_map_ops::get_required_mask https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.148 - af_key: pfkey_dump needs parameter validation - KVM: fix memory leak in kvm_io_bus_unregister_dev() - kprobes: fix kill kprobe which has been marked as gone - mm/thp: fix __split_huge_pmd_locked() for migration PMD - cxgb4: Fix offset when clearing filter byte counters - geneve: add transport ports in route lookup for geneve (CVE-2020-25645) - [x86,ppc64el] hdlc_ppp: add range checks in ppp_cp_parse_cr() (CVE-2020-25643) - ip: fix tos reflection in ack and reset packets - ipv6: avoid lockdep issue in fib6_del() - net: DCB: Validate DCB_ATTR_DCB_BUFFER argument - net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC - net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc - nfp: use correct define to return NONE fec - tipc: Fix memory leak in tipc_group_create_member() - tipc: fix shutdown() of connection oriented socket - tipc: use skb_unshare() instead in tipc_buf_append() - bnxt_en: return proper error codes in bnxt_show_temp - bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex. - net: phy: Avoid NPD upon phy_detach() when driver is unbound - net: add __must_check to skb_put_padto() - ipv4: Update exception handling for multipath routes via same device - kbuild: add OBJSIZE variable for the size tool - mm: memcg: fix memcg reclaim soft lockup - tcp_bbr: refactor bbr_target_cwnd() for general inflight provisioning - tcp_bbr: adapt cwnd based on ack aggregation estimation - serial: 8250: Avoid error message on reprobe https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.149 - selinux: allow labeling before policy is loaded - media: mc-device.c: fix memleak in media_device_register_entity - dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling) - ath10k: fix array out-of-bounds access - ath10k: fix memory leak for tpc_stats_final - mm: fix double page fault on arm64 if PTE_AF is cleared - scsi: aacraid: fix illegal IO beyond last LBA - [x86] gma/gma500: fix a memory disclosure bug due to uninitialized bytes - [armel,armhf] ASoC: kirkwood: fix IRQ error handling - [amd64] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback - [x86] ioapic: Unbreak check_timer() - ALSA: usb-audio: Add delay quirk for H570e USB headsets - ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged - ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 - lib/string.c: implement stpcpy - [armhf] PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out - [x86] scsi: fnic: fix use after free - scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce - net: silence data-races on sk_backlog.tail - [armhf] clk/ti/adpll: allocate room for terminating null - mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of cfi_amdstd_setup() - mfd: mfd-core: Protect against NULL call-back function pointer - [x86] tpm_crb: fix fTPM on AMD Zen+ CPUs - tracing: Adding NULL checks for trace_array descriptor pointer - bcache: fix a lost wake-up problem caused by mca_cannibalize_lock - RDMA/qedr: Fix potential use after free - RDMA/i40iw: Fix potential use after free - fix dget_parent() fastpath race - xfs: fix attr leaf header freemap.size underflow - RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()' - ubi: Fix producing anchor PEBs - mmc: core: Fix size overflow for mmc partitions - gfs2: clean up iopen glock mess in gfs2_create_inode - scsi: pm80xx: Cleanup command when a reset times out - CIFS: Properly process SMB3 lease breaks - ASoC: max98090: remove msleep in PLL unlocked workaround - kernel/sys.c: avoid copying possible padding bytes in copy_to_user - [arm64,armhf] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() - xfs: fix log reservation overflows when allocating large rt extents - neigh_stat_seq_next() should increase position index - rt_cpu_seq_next should increase position index - ipv6_route_seq_next should increase position index - seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier - sctp: move trace_sctp_probe_path into sctp_outq_sack - [arm64,x86] ACPI: EC: Reference count query handlers under lock - scsi: ufs: Make ufshcd_add_command_trace() easier to read - scsi: ufs: Fix a race condition in the tracing code - [s390x] /cpum_sf: Use kzalloc and minor changes - [powerpc*] eeh: Only dump stack once if an MMIO loop is detected - Bluetooth: btrtl: Use kvmalloc for FW allocations - [armel,armhf] ARM: 8948/1: Prevent OOB access in stacktrace - ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter - ceph: ensure we have a new cap before continuing in fill_inode - Bluetooth: Fix refcount use-after-free issue - mm/swapfile.c: swap_next should increase position index - mm: pagewalk: fix termination condition in walk_pte_range() - Bluetooth: prefetch channel before killing sock - KVM: fix overflow of zero page refcount with ksm running - ALSA: hda: Clear RIRB status before reading WP - skbuff: fix a data race in skb_queue_len() - audit: CONFIG_CHANGE don't log internal bookkeeping as an event - selinux: sel_avc_get_stat_idx should increase position index - scsi: lpfc: Fix RQ buffer leakage when no IOCBs available - scsi: lpfc: Fix coverity errors in fmdi attribute handling - [armhf] drm/omap: fix possible object reference leak - crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test - mt76: clear skb pointers from rx aggregation reorder buffer during cleanup - ALSA: usb-audio: Don't create a mixer element with bogus volume range - [s390x] perf test: Fix test trace+probe_vfs_getname.sh on s390 - RDMA/rxe: Fix configuration of atomic queue pair attributes - [x86] KVM: x86: fix incorrect comparison in trace event - [x86] pkeys: Add check for pkey "overflow" - bpf: Remove recursion prevention from rcu free callback - [arm64,armhf] dmaengine: tegra-apb: Prevent race conditions on channel's freeing - random: fix data races at timer_rand_state - [arm64] bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal - media: go7007: Fix URB type for interrupt handling - Bluetooth: guard against controllers sending zero'd events - timekeeping: Prevent 32bit truncation in scale64_check_overflow() - ext4: fix a data race at inode->i_disksize - mm: avoid data corruption on CoW fault into PFN-mapped VMA - drm/amdgpu: increase atombios cmd timeout - ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read - scsi: aacraid: Disabling TM path and only processing IOP reset - Bluetooth: L2CAP: handle l2cap config request during open state - media: tda10071: fix unsigned sign extension overflow - xfs: don't ever return a stale pointer from __xfs_dir3_free_read - xfs: mark dir corrupt when lookup-by-hash fails - ext4: mark block bitmap corrupted when found instead of BUGON - nfsd: Don't add locks to closed or closing open stateids - RDMA/cm: Remove a race freeing timewait_info - [powerpc*] KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the valid ones - [arm64] drm/msm: fix leaks if initialization fails - [arm64] drm/msm/a5xx: Always set an OPP supported hardware value - serial: 8250_port: Don't service RX FIFO if throttled - [powerpc*] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn - nvme-multipath: do not reset on unknown status - nvme: Fix controller creation races with teardown flow - RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices - scsi: hpsa: correct race condition in offload enabled - SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()' - svcrdma: Fix leak of transport addresses - PCI: Use ioremap(), not phys_to_virt() for platform ROM - ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len - ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor - PCI: pciehp: Fix MSI interrupt race - NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests() - mm/kmemleak.c: use address-of operator on section symbols - mm/filemap.c: clear page error before actual read - mm/vmscan.c: fix data races using kswapd_classzone_idx - nvmet-rdma: fix double free of rdma queue - mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area - scsi: qedi: Fix termination timeouts in session logout - [arm64] serial: uartps: Wait for tx_empty in console setup - [x86] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race - bdev: Reduce time holding bd_mutex in sync in blkdev_close() - [x86] drivers: char: tlclk.c: Avoid data race between init and interrupt handler - [arm64] KVM: vgic-its: Fix memory leak on the error path of vgic_add_lpi() - net: openvswitch: use u64 for meter bucket - scsi: aacraid: Fix error handling paths in aac_probe_one() - staging:r8188eu: avoid skb_clone for amsdu to msdu conversion - [arm64] cpufeature: Relax checks for AArch32 support at EL[0-2] - dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion - atm: fix a memory leak of vcc->user_back - Bluetooth: Handle Inquiry Cancel error after Inquiry Complete - tipc: fix memory leak in service subscripting - [armhf] tty: serial: samsung: Correct clock selection logic - ALSA: hda: Fix potential race in unsol event handler - [powerpc*] traps: Make unrecoverable NMIs die instead of panic - fuse: don't check refcount after stealing page - [powerpc*] scsi: cxlflash: Fix error return code in cxlflash_probe() - [arm64] cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register - e1000: Do not perform reset in reset_task if we are already down - drm/nouveau/debugfs: fix runtime pm imbalance on error - drm/nouveau: fix runtime pm imbalance on error - drm/nouveau/dispnv50: fix runtime pm imbalance on error - printk: handle blank console arguments passed in. - [arm64,armhf] usb: dwc3: Increase timeout for CmdAct cleared by device controller - btrfs: don't force read-only after error in drop snapshot - vfio/pci: fix memory leaks of eventfd ctx - perf trace: Fix the selection for architectures to generate the errno name tables - [arm64,armhf] wlcore: fix runtime pm imbalance in wl1271_tx_work - [arm64,armhf] wlcore: fix runtime pm imbalance in wlcore_regdomain_config - [arm64,armhf] PCI: tegra: Fix runtime PM imbalance on error - ceph: fix potential race in ceph_check_caps - mm/swap_state: fix a data race in swapin_nr_pages - [armel] mtd: parser: cmdline: Support MTD names containing one or more colons - [x86] speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline - vfio/pci: Clear error and request eventfd ctx after releasing - cifs: Fix double add page to memcg when cifs_readpages - nvme: fix possible deadlock when I/O is blocked - scsi: libfc: Handling of extra kref - scsi: libfc: Skip additional kref updating work event - vfio/pci: fix racy on error and request eventfd ctx - btrfs: qgroup: fix data leak caused by race between writeback and truncate - net: openvswitch: use div_u64() for 64-by-32 divisions - nvme: explicitly update mpath disk capacity on revalidation - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 - [s390x] init: add missing __init annotations - lockdep: fix order in trace_hardirqs_off_caller() - [amd64] drm/amdkfd: fix a memory leak issue - i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices() - mwifiex: Increase AES key storage size to 256 bits - batman-adv: bla: fix type misuse for backbone_gw hash indexing - atm: eni: fix the missed pci_disable_device() for eni_init_one() - batman-adv: mcast/TT: fix wrongly dropped or rerouted packets - mac802154: tx: fix use-after-free - bpf: Fix clobbering of r2 in bpf_gen_ld_abs - [arm*] drm/vc4/vc4_hdmi: fill ASoC card owner - net: qed: RDMA personality shouldn't fail VF load - batman-adv: Add missing include for in_interrupt() - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh - batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh - bpf: Fix a rcu warning for bpffs map pretty-print - [x86] ALSA: asihpi: fix iounmap in error handler - regmap: fix page selection for noinc reads - [x86] KVM: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE - [x86] KVM: SVM: Add a dedicated INVD intercept routine - tracing: fix double free - [s390x] dasd: Fix zero write for FBA devices - kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() - mm, THP, swap: fix allocating cluster for swapfile by mistake - [s390x] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl - ata: define AC_ERR_OK - ata: make qc_prep return ata_completion_errors - ata: sata_mv, avoid trigerrable BUG_ON - [arm64] KVM: Assume write fault on S1PTW permission fault on instruction fetch https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.150 - mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models - USB: gadget: f_ncm: Fix NDP16 datagram validation - vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock - vsock/virtio: stop workers during the .remove() - vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock() - net: virtio_vsock: Enhance connection semantics - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 - ftrace: Move RCU is watching check after recursion check - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config - drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices - [armhf] drm/sun4i: mixer: Extend regmap max_register - net: dec: de2104x: Increase receive ring size for Tulip - rndis_host: increase sleep time in the query-response loop - nvme-core: get/put ctrl and transport module in nvme_dev_open/release() - [x86,ppc64el] drivers/net/wan/hdlc: Set skb->protocol before transmitting - mac80211: do not allow bigger VHT MPDUs than the hardware supports - nvme-fc: fail new connections to a deleted host or remote port - [armhf] pinctrl: mvebu: Fix i2c sda definition for 98DX3236 - nfs: Fix security label length not being reset - [armhf] clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED - Input: trackpoint - enable Synaptics trackpoints - random32: Restore __latent_entropy attribute on net_rand_state - mm: replace memmap_context by meminit_context - mm: don't rely on system state to detect hot-plug operations - epoll: do not insert into poll queues until all sanity checks are done - epoll: replace ->visited/visited_list with generation count - epoll: EPOLL_CTL_ADD: close the race in decision to take fast path - ep_create_wakeup_source(): dentry name can change under you... - netfilter: ctnetlink: add a range check for l3/l4 protonum (CVE-2020-25211) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.151 - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h - Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts - fbcon: Fix global-out-of-bounds read in fbcon_get_font() - net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() - drm/nouveau/mem: guard against NULL pointer access in mem_del - usermodehelper: reset umask to default before executing user process - [x86] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360 - [x86] platform/x86: thinkpad_acpi: initialize tp_nvram_state variable - [x86] platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting - [x86] platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse - driver core: Fix probe_count imbalance in really_probe() - [x86] i2c: i801: Exclude device from suspend direct complete optimization - [armhf] mtd: rawnand: sunxi: Fix the probe error path - nvme-core: put ctrl ref when module ref get fail - macsec: avoid use-after-free in macsec_handle_frame() - mm/khugepaged: fix filemap page_to_pgoff(page) != offset - xfrmi: drop ignore_df check before updating pmtu - cifs: Fix incomplete memory allocation on setxattr path - [arm64,armhf] i2c: meson: fix clock setting overwrite - [arm64,armhf] i2c: meson: fixup rate calculation with filter delay - sctp: fix sctp_auth_init_hmacs() error path - team: set dev->needed_headroom in team_setup_by_port() - net: team: fix memory leak in __team_options_register - openvswitch: handle DNAT tuple collision - drm/amdgpu: prevent double kfree ttm->sg - xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate - xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate - xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate - xfrm: clone whole liftime_cur structure in xfrm_do_migrate - [arm64,armhf] net: stmmac: removed enabling eee in EEE set callback - xfrm: Use correct address family in xfrm_state_find - bonding: set dev->needed_headroom in bond_setup_by_slave() - net: usb: ax88179_178a: fix missing stop entry in driver_info - net/mlx5e: Fix VLAN cleanup flow - net/mlx5e: Fix VLAN create flow - rxrpc: Fix rxkad token xdr encoding - rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() - rxrpc: Fix some missing _bh annotations on locking conn->state_lock - rxrpc: Fix server keyring leak - perf: Fix task_function_call() error handling - mmc: core: don't set limits.discard_granularity as 0 - mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged - net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.152 - Bluetooth: A2MP: Fix not initializing all members (CVE-2020-12352) - Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (CVE-2020-12351) - Bluetooth: MGMT: Fix not checking if BT_HS is enabled - Bluetooth: Consolidate encryption handling in hci_encrypt_cfm - Bluetooth: Fix update of connection state in `hci_encrypt_cfm` - Bluetooth: Disconnect if E0 is used for Level 4 - media: usbtv: Fix refcounting mixup - USB: serial: option: add Cellient MPL200 card - USB: serial: option: Add Telit FT980-KS composition - [x86] staging: comedi: check validity of wMaxPacketSize of usb endpoints found - USB: serial: pl2303: add device-id for HP GC device - USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters - reiserfs: Initialize inode keys properly - reiserfs: Fix oops during mount - [arm*] drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case (Closes: #908712) - [x86] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA [ Salvatore Bonaccorso ] * [rt] Update to 4.19.148-rt64 * Bump ABI to 12 * Revert "perf cs-etm: Move definition of 'traceid_list' global variable from header file" -- Salvatore Bonaccorso Sun, 18 Oct 2020 10:43:18 +0200 linux (4.19.146-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.133 - [s390x] KVM: s390: reduce number of IO pins to 1 - regmap: fix alignment issue - [arm64,armhf] drm/tegra: hub: Do not enable orphaned window group - [arm64,armhf] gpu: host1x: Detach driver on unregister - spi: spidev: fix a race between spidev_release and spidev_remove - spi: spidev: fix a potential use-after-free in spidev_release() - ixgbe: protect ring accesses with READ- and WRITE_ONCE - i40e: protect ring accesses with READ- and WRITE_ONCE - [x86] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel - [x86] drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003 - cifs: update ctime and mtime during truncate - [armhf] imx6: add missing put_device() call in imx6q_suspend_init() - scsi: mptscsih: Fix read sense data size - [arm64] usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work - block: release bip in a right way in error path - nvme-rdma: assign completion vector correctly - [x86] entry: Increase entry_stack size to a full page - net: cxgb4: fix return error value in t4_prep_fw - smsc95xx: check return value of smsc95xx_reset - smsc95xx: avoid memory leak in smsc95xx_bind - [arm64] net: hns3: fix use-after-free when doing self test - [x86] ALSA: compress: fix partial_drain completion state - nbd: Fix memory leak in nbd_add_socket - cxgb4: fix all-mask IP address comparison - bnxt_en: fix NULL dereference in case SR-IOV configuration fails - [arm64] net: macb: mark device wake capable when "magic-packet" property present - ALSA: opl3: fix infoleak in opl3 - ALSA: hda - let hs_mic be picked ahead of hp_mic - ALSA: usb-audio: add quirk for MacroSilicon MS2109 - [arm64] KVM: Fix definition of PAGE_HYP_DEVICE - [arm64] KVM: Stop clobbering x0 for HVC_SOFT_RESTART - [x86] KVM: bit 8 of non-leaf PDPEs is not reserved - [x86] KVM: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode - [x86] KVM: Mark CR4.TSD as being possibly owned by the guest - kallsyms: Refactor kallsyms_show_value() to take cred - kernel: module: Use struct_size() helper - module: Refactor section attr into bin attribute - module: Do not expose section addresses to non-CAP_SYSLOG - kprobes: Do not expose probe addresses to non-CAP_SYSLOG - bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() - btrfs: fix fatal extent_buffer readahead vs releasepage race - drm/radeon: fix double free - dm: use noio when sending kobject event - [s390x] mm: fix huge pte soft dirty copying https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.134 - perf: Make perf able to build with latest libbfd - genetlink: remove genl_bind - ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg - l2tp: remove skb_dst_set() from l2tp_xmit_skb() - llc: make sure applications use ARPHRD_ETHER - net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb - net_sched: fix a memory leak in atm_tc_init() - net: usb: qmi_wwan: add support for Quectel EG95 LTE modem - tcp: fix SO_RCVLOWAT possible hangs under high mem pressure - tcp: make sure listeners don't initialize congestion-control state - tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() - tcp: md5: do not send silly options in SYNCOOKIES - tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers - tcp: md5: allow changing MD5 keys in all socket states - cgroup: fix cgroup_sk_alloc() for sk_clone_lock() (CVE-2020-14356) (Closes: #966846) - cgroup: Fix sock_cgroup_data on big-endian. - sched: consistently handle layer3 header accesses in the presence of VLANs - vlan: consolidate VLAN parsing code and limit max parsing depth - [arm64] drm/msm: fix potential memleak in error branch - [arm64] alternatives: use subsections for replacement sequences - [arm64,x86] tpm_tis: extra chip->ops check on error path in tpm_tis_core_init - gfs2: read-only mounts should grab the sd_freeze_gl glock - [i386] i2c: eg20t: Load module automatically if ID matches - [arm64] alternatives: don't patch up internal branches - [armhf] iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() - [armhf] net: dsa: bcm_sf2: Fix node reference count - of: of_mdio: Correct loop scanning logic - Revert "usb/ohci-platform: Fix a warning when hibernating" - [arm64,armhf] Revert "usb/xhci-plat: Set PM runtime as active on resume" - Revert "usb/ehci-platform: Set PM runtime as active on resume" - [arm64,armhf] net: sfp: add support for module quirks - [arm64,armhf] net: sfp: add some quirks for GPON modules - HID: quirks: Remove ITE 8595 entry from hid_have_special_driver - ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8) - mmc: sdhci: do not enable card detect interrupt for gpio cd type - ALSA: usb-audio: Rewrite registration quirk handling - [x86] ACPI: video: Use native backlight on Acer Aspire 5783z - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S - [x86] ACPI: video: Use native backlight on Acer TravelMate 5735Z - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S - [arm64,armhf] phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked - [armhf] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate - [x86] staging: comedi: verify array index is correct before using it - regmap: debugfs: Don't sleep while atomic for fast_io regmaps - [x86] copy_xstate_to_kernel: Fix typo which caused GDB regression - apparmor: ensure that dfa state tables have entries - perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode - [armhf] mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered - [armhf] mtd: rawnand: marvell: Fix probe error path - mtd: rawnand: timings: Fix default tR_max and tCCS_min timings - HID: magicmouse: do not set up autorepeat - HID: quirks: Always poll Obins Anne Pro 2 keyboard - HID: quirks: Ignore Simply Automated UPB PIM - ALSA: line6: Perform sanity check for each URB creation - ALSA: line6: Sync the pending work cancel at disconnection - ALSA: usb-audio: Fix race against the error recovery URB submission - [x86] ALSA: hda/realtek - change to suitable link model for ASUS platform - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 - [arm*] usb: dwc2: Fix shutdown callback in platform - [arm64,armhf] usb: chipidea: core: add wakeup support for extcon - USB: serial: iuu_phoenix: fix memory corruption - USB: serial: cypress_m8: enable Simply Automated UPB PIM - USB: serial: ch341: add new Product ID for CH340 - USB: serial: option: add GosunCn GM500 series - USB: serial: option: add Quectel EG95 LTE modem - [x86] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream - [x86] virt: vbox: Fix guest capabilities mask check - [arm64] virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial - ovl: inode reference leak in ovl_is_inuse true case. - ovl: relax WARN_ON() when decoding lower directory file handle - ovl: fix unneeded call to ovl_change_flags() - fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS - Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" (CVE-2020-10781) - [x86] mei: bus: don't clean driver pointer - timer: Prevent base->clk from moving backward - timer: Fix wheel index calculation on last level - [mips*] Fix build for LTS kernel caused by backporting lpj adjustment - hwmon: (emc2103) fix unable to change fan pwm1_enable attribute - [powerpc*] book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey - [x86] intel_th: pci: Add Jasper Lake CPU support - [x86] intel_th: pci: Add Tiger Lake PCH-H support - [x86] intel_th: pci: Add Emmitsburg PCH support - [x86] intel_th: Fix a NULL dereference when hub driver is not loaded - [arm*] thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power - [arm64] ptrace: Override SPSR.SS when single-stepping is enabled - [arm64] ptrace: Consistently use pseudo-singlestep exceptions - [arm64] compat: Ensure upper 32 bits of x0 are zero on syscall return - sched: Fix unreliable rseq cpu_id for new tasks - sched/fair: handle case of task_h_load() returning 0 - genirq/affinity: Handle affinity setting on inactive interrupts correctly - printk: queue wake_up_klogd irq_work only if per-CPU areas are ready - libceph: don't omit recovery_deletes in target_copy() - rxrpc: Fix trace string https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.135 - mac80211: allow rx of mesh eapol frames with default rx key - scsi: scsi_transport_spi: Fix function pointer check - net: sky2: initialize return of gm_phy_read - drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout - fuse: fix weird page warning - [x86] irqdomain/treewide: Keep firmware node unconditionally allocated - SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") - tipc: clean up skb list lock handling on send path - IB/umem: fix reference count leak in ib_umem_odp_get() - uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression - ALSA: info: Drop WARN_ON() from buffer NULL sanity check - btrfs: fix double free on ulist after backref resolution failure - btrfs: fix mount failure caused by race with umount - btrfs: fix page leaks after failure to lock page for delalloc - bnxt_en: Fix race when modifying pause settings. - [x86] hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path - ax88172a: fix ax88172a_unbind() failures - ieee802154: fix one possible memleak in adf7242_probe - [arm64,armhf] drm: sun4i: hdmi: Fix inverted HPD result - [arm64,armhf] net: smc91x: Fix possible memory leak in smc_drv_probe() - bonding: check error value of register_netdevice() immediately - qed: suppress "don't support RoCE & iWARP" flooding on HW init - ipvs: fix the connection sync failed in some cases - bonding: check return value of register_netdevice() in bond_newlink() - serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X - [arm64,x86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override - HID: alps: support devices with report id 2 - HID: steam: fixes race in handling device list. - HID: apple: Disable Fn-key key-re-mapping on clone keyboards - [arm64] dmaengine: tegra210-adma: Fix runtime PM imbalance on error - Input: add `SW_MACHINE_COVER` - regmap: dev_get_regmap_match(): fix string comparison - hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow - [amd64] dmaengine: ioat setting ioat timeout as module parameter - [x86] Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen - [arm64] Use test_tsk_thread_flag() for checking TIF_SINGLESTEP - [arm*] binder: Don't use mmput() from shrinker function. - usb: xhci: Fix ASM2142/ASM3142 DMA addressing - Revert "cifs: Fix the target file was deleted when rename failed." (Closes: #966917) - [x86] staging: wlan-ng: properly check endpoint types - [x86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift - [x86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support - [x86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift - [x86] staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift - serial: 8250: fix null-ptr-deref in serial8250_start_tx() - fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. - vt: Reject zero-sized screen buffer size. - mm/memcg: fix refcount error while moving and swapping - mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock - mm: memcg/slab: fix memory leak at non-root kmem_cache destroy - io-mapping: indicate mapping failure - drm/amdgpu: Fix NULL dereference in dpm sysfs handlers - [x86] vmlinux.lds: Page-align end of ..page_aligned sections - [x86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10 - dm integrity: fix integrity recalculation that is improperly skipped - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb - ath9k: Fix regression with Atheros 9271 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.136 - AX.25: Fix out-of-bounds read in ax25_connect() - AX.25: Prevent out-of-bounds read in ax25_sendmsg() - dev: Defer free of skbs in flush_backlog - ip6_gre: fix null-ptr-deref in ip6gre_init_net() - net-sysfs: add a newline when printing 'tx_timeout' by sysfs - net: udp: Fix wrong clean up for IS_UDPLITE macro - rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA - tcp: allow at most one TLP probe per flight - AX.25: Prevent integer overflows in connect and sendmsg - sctp: shrink stream outq only when new outcnt < old outcnt - sctp: shrink stream outq when fails to do addstream reconf - udp: Copy has_conns in reuseport_grow(). - udp: Improve load balancing for SO_REUSEPORT. - rtnetlink: Fix memory(net_device) leak when ->newlink fails - regmap: debugfs: check count when read regmap file https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.137 - [x86] crypto: ccp - Release all allocated memory if sha type is invalid (CVE-2019-18808) - media: rc: prevent memory leak in cx23888_ir_probe (CVE-2019-19054) - iio: imu: adis16400: fix memory leak (CVE-2019-19061) - [x86] drm/amdgpu: fix multiple memory leaks in acp_hw_init (CVE-2019-19067) - tracing: Have error path in predicate_parse() free its allocated memory (CVE-2019-19072) - ath9k_htc: release allocated buffer if timed out (CVE-2019-19073) - ath9k: release allocated buffer if timed out (CVE-2019-19074) - drm/amd/display: prevent memory leak (CVE-2019-19082) - btrfs: inode: Verify inode mode to avoid NULL pointer dereference (CVE-2019-19813, CVE-2019-19816) - sctp: implement memory accounting on tx path (CVE-2019-3874) - Btrfs: fix selftests failure due to uninitialized i_mode in test inodes - PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge - 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work - wireless: Use offsetof instead of custom macro. - [armel,armhf] 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" - drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() - drm: hold gem reference until object is no longer accessed - rds: Prevent kernel-infoleak in rds_notify_queue_get() - xfs: fix missed wakeup on l_flush_wait - xfrm: Fix crash when the hold queue is used. - net/mlx5: Verify Hardware supports requested ptp function on a given pin - net: lan78xx: add missing endpoint sanity check - net: lan78xx: fix transfer-buffer memory leak - mlx4: disable device on shutdown - bpf: Fix map leak in HASH_OF_MAPS map - mac80211: mesh: Free ie data when leaving mesh - mac80211: mesh: Free pending skb when destroying a mpath - [arm64] alternatives: move length validation inside the subsection - [arm64] csum: Fix handling of bad packets - Bluetooth: fix kernel oops in store_pending_adv_report - net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq - qed: Disable "MFW indication via attention" SPAM every 5 minutes - [amd64] x86/unwind/orc: Fix ORC for newly forked tasks - cxgb4: add missing release on skb in uld_send() - xen-netfront: fix potential deadlock in xennet_remove() - [x86] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled - [x86] i8259: Use printk_deferred() to prevent deadlock https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.138 - random32: update the net random state on interrupt and activity (CVE-2020-16166) - [armel] ARM: percpu.h: fix build error - random: fix circular include dependency on arm64 after addition of percpu.h - random32: remove net_rand_state from the latent entropy gcc plugin - random32: move the pseudo-random 32-bit definitions to prandom.h - ext4: fix direct I/O read error https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.139 - USB: serial: qcserial: add EM7305 QDL product ID - USB: iowarrior: fix up report size handling for some devices - usb: xhci: define IDs for various ASMedia host controllers - usb: xhci: Fix ASMedia ASM1142 DMA addressing - Revert "ALSA: hda: call runtime_allow() for all hda controllers" - [arm*] staging: android: ashmem: Fix lockdep warning for write operation - Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() - [arm*] binder: Prevent context manager from incrementing ref 0 - vgacon: Fix for missing check in scrollback handling (CVE-2020-14331) - mtd: properly check all write ioctls for permissions - net/9p: validate fds in p9_fd_open - drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason - drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure - usb: hso: check for return value in hso_serial_common_create() - firmware: Fix a reference count leak. - cfg80211: check vendor command doit pointer before use - igb: reinit_locked() should be called with rtnl_lock - atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent - tools lib traceevent: Fix memory leak in process_dynamic_array_len - [x86] Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) - xattr: break delegations in {set,remove}xattr - ipv4: Silence suspicious RCU usage warning - ipv6: fix memory leaks on IPV6_ADDRFORM path - vxlan: Ensure FDB dump is performed under RCU - net: lan78xx: replace bogus endpoint lookup - [x86] hv_netvsc: do not use VF device if link is down - net: gre: recompute gre csum for sctp over gre tunnels - [arm64] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() - openvswitch: Prevent kernel-infoleak in ovs_ct_put_key() - Revert "vxlan: fix tos value before xmit" - rxrpc: Fix race between recvmsg and sendmsg on immediate call failure - i40e: add num_vectors checker in iwarp handler - i40e: Wrong truncation from u16 to u8 - i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c - i40e: Memory leak in i40e_config_iwarp_qvlist https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140 - tracepoint: Mark __tracepoint_string's __used - HID: input: Fix devices that return multiple bytes in battery report - cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone() - [x86] mce/inject: Fix a wrong assignment of i_mce.status - sched/fair: Fix NOHZ next idle balance - sched: correct SD_flags returned by tl->sd_flags() - EDAC: Fix reference count leaks - [x86] platform/x86: intel-hid: Fix return value check in check_acpi_dev() - [x86] platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() - [armhf] drm/tilcdc: fix leak & null ref in panel_connector_get_modes - Bluetooth: add a mutex lock to avoid UAF in do_enale_set - loop: be paranoid on exit and prevent new additions / removals - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls - drm/amdgpu: avoid dereferencing a NULL pointer - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync - [x86] crypto: aesni - Fix build with LLVM_IAS=1 - video: fbdev: neofb: fix memory leak in neo_scan_monitor() - md-cluster: fix wild pointer of unlock_all_bitmaps() - [arm64] dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding - [armhf] drm/etnaviv: fix ref count leak via pm_runtime_get_sync - drm/nouveau: fix multiple instances of reference count leaks - drm/debugfs: fix plain echo to connector "force" attribute - drm/radeon: disable AGP by default - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls - brcmfmac: keep SDIO watchdog running when console_interval is non-zero - brcmfmac: To fix Bss Info flag definition Bug - brcmfmac: set state of hanger slot to FREE when flushing PSQ - iwlegacy: Check the return value of pcie_capability_read_*() - [arm64,armhf] gpu: host1x: debug: Fix multiple channels emitting messages simultaneously - usb: gadget: net2280: fix memory leak on probe error handling paths - dyndbg: fix a BUG_ON in ddebug_describe_flags - bcache: fix super block seq numbers comparision in register_cache_set() - [arm64,x86] ACPICA: Do not increment operation_region reference counts for field units - [arm64] drm/msm: ratelimit crtc event overflow error - [x86] agp/intel: Fix a memory leak on module initialisation failure - ath10k: Acquire tx_lock in tx error paths - [armhf] drm/etnaviv: Fix error path on failure to enable bus clk - [arm64] drm/arm: fix unintentional integer overflow on left shift - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline - [powerpc*] cxl: Fix kobject memleak - drm/radeon: fix array out-of-bounds read and write issues - ipvs: allow connection reuse for unconfirmed conntrack - xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork - xfs: fix reflink quota reservation accounting error - RDMA/rxe: Skip dgid check in loopback mode - PCI: Fix pci_cfg_wait queue locking problem - leds: core: Flush scheduled work for system suspend - [arm64,armhf] drm: panel: simple: Fix bpc for LG LB070WV8 panel - [armhf] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY - scsi: scsi_debug: Add check for sdebug_max_queue during module init - mwifiex: Prevent memory corruption handling keys - [powerpc*] vdso: Fix vdso cpu truncation - RDMA/qedr: SRQ's bug fixes - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue - [x86] staging: rtl8192u: fix a dubious looking mask before a shift - PCI/ASPM: Add missing newline in sysfs 'policy' - [powerpc*] book3s64/pkeys: Use PVR check instead of cpu feature - USB: serial: iuu_phoenix: fix led-activity helpers - usb: core: fix quirks_param_set() writing to a const pointer - [armhf] thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() - [mips*] OCTEON: add missing put_device() call in dwc3_octeon_device_init() - [arm*] usb: dwc2: Fix error path in gadget registration - [arm64,armhf] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration - RDMA/core: Fix return error value in _ib_modify_qp() to negative - Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags - Bluetooth: hci_serdev: Only unregister device if it was registered - [x86] PCI: Release IVRS table in AMD ACS quirk - [s390x] qeth: don't process empty bridge port events - [arm64,armhf] wl1251: fix always return 0 error - [amd64] net: ethernet: aquantia: Fix wrong return value - liquidio: Fix wrong return value in cn23xx_get_pf_num() - dlm: Fix kobject memleak - ocfs2: fix unbalanced locking - [arm64,armhf] pinctrl-single: fix pcs_parse_pinconf() return value - svcrdma: Fix page leak in svc_rdma_recv_read_chunk() - [x86] fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task - [amd64] crypto: aesni - add compatibility with IAS - af_packet: TPACKET_V3: fix fill status rwlock imbalance - net/nfc/rawsock.c: add CAP_NET_RAW check. - net: Set fput_needed iff FDPUT_FPUT is set - net: refactor bind_bucket fastreuse into helper - net: initialize fastreuse on inet_inherit_port - USB: serial: cp210x: re-enable auto-RTS on open - USB: serial: cp210x: enable usb generic throttle/unthrottle - [x86] ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 - [x86] crypto: qat - fix double free in qat_uclo_create_batch_init_list - [x86] crypto: ccp - Fix use of merged scatterlists - [arm64] crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified - bitfield.h: don't compile-time validate _val in FIELD_FIT - fs/minix: check return value of sb_getblk() - fs/minix: don't allow getting deleted inodes - fs/minix: reject too-large maximum file size - ALSA: usb-audio: add quirk for Pioneer DDJ-RB - 9p: Fix memory leak in v9fs_mount - drm/ttm/nouveau: don't call tt destroy callback on alloc failure. - NFS: Don't move layouts to plh_return_segs list while in use - NFS: Don't return layout segments that are in use - [arm64] cpufreq: dt: fix oops on armada37xx - include/asm-generic/vmlinux.lds.h: align ro_after_init - spi: spidev: Align buffers for DMA - [x86] irqdomain/treewide: Free firmware node after domain removal - xen/balloon: fix accounting in alloc_xenballooned_pages error path - xen/balloon: make the balloon wait interruptible https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.141 - smb3: warn on confusing error scenario with sec=krb5 - genirq/affinity: Make affinity setting if activated opt-in - [arm64,x86] PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken - PCI: Add device even if driver attach failed - [arm64] PCI: qcom: Define some PARF params needed for ipq8064 SoC - [arm64] PCI: qcom: Add support for tx term offset for rev 2.1.0 - PCI: Probe bridge window attributes once at enumeration-time - btrfs: free anon block device right after subvolume deletion - btrfs: don't allocate anonymous block device for user invisible roots - btrfs: ref-verify: fix memory leak in add_block_entry - btrfs: don't traverse into the seed devices in show_devname - btrfs: open device without device_list_mutex - btrfs: fix messages after changing compression level by remount - btrfs: only search for left_info if there is no right_info in try_merge_free_space (CVE-2019-19448) - btrfs: fix memory leaks after failure to lookup checksums during inode logging - btrfs: fix return value mixup in btrfs_get_extent - cifs: Fix leak when handling lease break for cached root fid - [powerpc*] Allow 4224 bytes of stack expansion for the signal frame - [powerpc*] Fix circular dependency between percpu.h and mmu.h - [arm64] net: ethernet: stmmac: Disable hardware multicast filter - [arm64,armhf] net: stmmac: dwmac1000: provide multicast filter fallback - net/compat: Add missing sock updates for SCM_RIGHTS - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 - bcache: allocate meta data pages as compound pages - bcache: fix overflow in offset_to_stripe() - mac80211: fix misplaced while instead of if - driver core: Avoid binding drivers to dead devices - [mips*] CPU#0 is not hotpluggable - ocfs2: change slot number type s16 to u16 - mm/page_counter.c: fix protection usage propagation - ftrace: Setup correct FTRACE_FL_REGS flags for module - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler - tracing/hwlat: Honor the tracing_cpumask - tracing: Use trace_sched_process_free() instead of exit() for pid tracing - [x86] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options - [x86] watchdog: f71808e_wdt: remove use of wrong watchdog_info option - [x86] watchdog: f71808e_wdt: clear watchdog timeout occurred flag - [powerpc*] pseries: Fix 64 bit logical memory block panic - module: Correctly truncate sysfs sections output - [armhf] drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() - RDMA/ipoib: Return void from ipoib_ib_dev_stop() - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() - USB: serial: ftdi_sio: make process-packet buffer unsigned - USB: serial: ftdi_sio: clean up receive processing - [armhf] gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() - [amd64] iommu/vt-d: Enforce PASID devTLB field mask - scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport - watchdog: initialize device before misc_register - Input: sentelic - fix error return when fsp_reg_write fails - [x86] drm/vmwgfx: Use correct vmw_legacy_display_unit pointer - [x86] drm/vmwgfx: Fix two list_for_each loop exit tests - [arm64] net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init - nfs: Fix getxattr kernel panic and memory overflow (CVE-2020-25212) - fs/minix: set s_maxbytes correctly - fs/minix: fix block limit check for V1 filesystems - fs/minix: remove expected error message in block_to_path() - fs/ufs: avoid potential u32 multiplication overflow - khugepaged: retract_page_tables() remember to test exit - [arm64] dts: marvell: espressobin: add ethernet alias - [x86] drm: Added orientation quirk for ASUS tablet model T103HAF https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.142 - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() - perf probe: Fix memory leakage when the probe point is not found - khugepaged: khugepaged_test_exit() check mmget_still_valid() - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() - btrfs: export helpers for subvolume name/id resolution - btrfs: don't show full path of bind mounts in subvol= - btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range - btrfs: inode: fix NULL pointer dereference if inode doesn't need compression - btrfs: sysfs: use NOFS for device creation - romfs: fix uninitialized memory leak in romfs_dev_read() - kernel/relay.c: fix memleak on destroy relay channel - mm: include CMA pages in lowmem_reserve at boot - mm, page_alloc: fix core hung in free_pcppages_bulk() - ext4: fix checking of directory entry validity for inline directories - jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() - [s390x] scsi: zfcp: Fix use-after-free in request timeout handlers - kthread: Do not preempt current task if it is going to call schedule() - spi: Prevent adding devices below an unregistering controller - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices - [arm*] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM - media: budget-core: Improve exception handling in budget_register() - Input: psmouse - add a newline when printing 'proto' by sysfs - svcrdma: Fix another Receive buffer leak - xfs: fix inode quota reservation checks - jffs2: fix UAF problem - ceph: fix use-after-free for fsc->mdsc - [x86] cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 - scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases - virtio_ring: Avoid loop when vq is broken in virtqueue_poll - xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init - fs/signalfd.c: fix inconsistent return codes for signalfd4 - ext4: fix potential negative array index in do_split() (CVE-2020-14314) - ext4: don't allow overlapping system zones - i40e: Set RX_ONLY mode for unicast promiscuous on VLAN - i40e: Fix crash during removing i40e driver - [armhf] net: fec: correct the error path for regulator disable in probe - bonding: show saner speed for broadcast mode - bonding: fix a potential double-unregister - [s390x] runtime_instrumentation: fix storage key handling - [s390x] ptrace: fix storage key handling - [x86] ASoC: intel: Fix memleak in sst_media_open - [amd64,arm64] vfio/type1: Add proper error unwind for vfio_iommu_replay() - [x86] kvm: Toggling CR4.SMAP does not load PDPTEs in PAE mode - [x86] kvm: Toggling CR4.PKE does not load PDPTEs in PAE mode - efi: avoid error message when booting under Xen - afs: Fix NULL deref in afs_dynroot_depopulate() - bonding: fix active-backup failover for current ARP slave - net: ena: Prevent reset after device destruction - [x86] hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() - [armhf] net: dsa: b53: check for timeout - [powerpc*] pseries: Do not initiate shutdown when system is running on UPS - efi: add missed destroy_workqueue when efisubsys_init fails - epoll: Keep a reference on files added to the check list - do_epoll_ctl(): clean the failure exits up a bit - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible - xen: don't reschedule in preemption off sections - clk: Evict unregistered clks from parent caches - KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() - [arm64] KVM: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.143 - [powerpc*] 64s: Don't init FSCR_DSCR in __init_FSCR() - gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY - net: Fix potential wrong skb->protocol in skb_vlan_untag() - net/smc: Prevent kernel-infoleak in __smc_diag_dump() - tipc: fix uninit skb->data in tipc_nl_compat_dumpit() - net: ena: Make missed_tx stat incremental - ipvlan: fix device features - [x86] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs - [powerpc*] xive: Ignore kmemleak false positives - media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() - blktrace: ensure our debugfs dir exists - scsi: target: tcmu: Fix crash on ARM during cmd completion - [arm*] iommu/iova: Don't BUG on invalid PFNs - [amd64] drm/amdkfd: Fix reference count leaks. - drm/radeon: fix multiple reference count leak - drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms - drm/amd/display: fix ref count leak in amdgpu_drm_ioctl - drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config - drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails - scsi: lpfc: Fix shost refcount mismatch when deleting vport - xfs: Don't allow logging of XFS_ISTALE inodes - f2fs: fix error path in do_recover_data() - PCI: Fix pci_create_slot() reference count leak - rtlwifi: rtl8192cu: Prevent leaking urb - [mips*] vdso: Fix resource leaks in genvdso.c - cec-api: prevent leaking memory through hole in structure - HID: quirks: add NOGET quirk for Logitech GROUP - f2fs: fix use-after-free issue - drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open - drm/nouveau: fix reference count leak in nv50_disp_atomic_commit - drm/nouveau: Fix reference count leak in nouveau_connector_detect - btrfs: file: reserve qgroup space after the hole punch range is locked - scsi: iscsi: Do not put host in iscsi_set_flashnode_param() - ceph: fix potential mdsc use-after-free crash - scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() - [x86] EDAC/ie31200: Fallback if host bridge device is already initialized - [arm64] KVM: Fix symbol dependency in __hyp_call_panic_nvhe - USB: sisusbvga: Fix a potential UB casued by left shifting a negative value - [arm64] drm/msm/adreno: fix updating ring fence - nvme-fc: Fix wrong return value in __nvme_fc_init_request() - null_blk: fix passing of REQ_FUA flag in null_handle_rq - jbd2: make sure jh have b_transaction set in refile/unfile_buffer - ext4: don't BUG on inconsistent journal feature - ext4: handle read only external journal device - jbd2: abort journal if free a async write error metadata buffer - ext4: handle option set by mount flags correctly - ext4: handle error of ext4_setup_system_zone() on remount - ext4: correctly restore system zone info when remount fails - fs: prevent BUG_ON in submit_bh_wbc() - [s390x] cio: add cond_resched() in the slow_eval_known_fn() loop - scsi: fcoe: Fix I/O path allocation - scsi: ufs: Fix possible infinite loop in ufshcd_hold - scsi: ufs: Improve interrupt handling for shared interrupts - scsi: ufs: Clean up completed request without interrupt notification - scsi: qla2xxx: Check if FW supports MQ before enabling - scsi: qla2xxx: Fix null pointer access during disconnect from subsystem - Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" - macvlan: validate setting of multiple remote source MAC addresses - [powerpc*] perf: Fix soft lockups due to missed interrupt accounting - block: loop: set discard granularity and alignment for block device backed loop - [arm64,x86] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands - blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART - btrfs: reset compression level for lzo on remount - btrfs: fix space cache memory leak after transaction abort - fbcon: prevent user font height or width change from causing potential out-of-bounds access - vt: defer kfree() of vc_screenbuf in vc_do_resize() - vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() - [armhf] serial: samsung: Removes the IRQ not found warning - [arm*] serial: pl011: Fix oops on -EPROBE_DEFER - [arm*] serial: pl011: Don't leak amba_ports entry on driver register error - serial: 8250_exar: Fix number of ports for Commtech PCIe cards - serial: 8250: change lock order in serial8250_do_startup() - writeback: Protect inode->i_io_list with inode->i_lock - writeback: Avoid skipping inode writeback - writeback: Fix sync livelock due to b_dirty_time processing - XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. - usb: host: xhci: fix ep context print mismatch in debugfs - xhci: Do warm-reset when both CAS and XDEV_RESUME are set - xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed - PM: sleep: core: Fix the handling of pending runtime resume requests - device property: Fix the secondary firmware node handling in set_primary_fwnode() - [x86] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP - drm/amdgpu: Fix buffer overflow in INFO ioctl - USB: yurex: Fix bad gfp argument - USB: quirks: Add no-lpm quirk for another Raydium touchscreen - USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D - [armhf] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() - USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() - USB: cdc-acm: rework notification_buffer resizing - btrfs: check the right error variable in btrfs_del_dir_entries_in_log - [arm64,armhf] usb: dwc3: gadget: Don't setup more than requested - [arm64,armhf] usb: dwc3: gadget: Fix handling ZLP - [arm64,armhf] usb: dwc3: gadget: Handle ZLP for sg requests - [arm64,x86] tpm: Unify the mismatching TPM space buffer sizes - HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.144 - HID: core: Correctly handle ReportSize being zero - HID: core: Sanitize event code and type when mapping input - scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range - scsi: target: tcmu: Optimize use of flush_dcache_page - [arm64] drm/msm: add shutdown support for display platform_driver - [x86] hwmon: (applesmc) check status earlier. - nvmet: Disable keep-alive timer when kato is cleared to 0h - [arm64] drm/msm/a6xx: fix gmu start on newer firmware - ceph: don't allow setlease on cephfs - cpuidle: Fixup IRQ state - [s390x] don't trace preemption in percpu macros - xen/xenbus: Fix granting of vmalloc'd memory - dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling - batman-adv: Avoid uninitialized chaddr when handling DHCP - batman-adv: bla: use netif_rx_ni when not in interrupt context - [mips*] mm: BMIPS5000 has inclusive physical caches - netfilter: nf_tables: add NFTA_SET_USERDATA if not null - netfilter: nf_tables: incorrect enum nft_list_attributes definition - netfilter: nf_tables: fix destination register zeroing - [arm64] net: hns: Fix memleak in hns_nic_dev_probe - [arm64,armhf] dmaengine: pl330: Fix burst length if burst size is smaller than bus width - gtp: add GTPA_LINK info to msg sent to userspace - bnxt_en: Don't query FW when netif_running() is false. - bnxt_en: Check for zero dir entries in NVRAM. - bnxt_en: Fix PCI AER error recovery flow - bnxt_en: fix HWRM error when querying VF temperature - xfs: fix boundary test in xfs_attr_shortform_verify (CVE-2020-14385) - bnxt: don't enable NAPI until rings are ready - netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS - nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()' - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() - fix regression in "epoll: Keep a reference on files added to the check list" - xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files - tg3: Fix soft lockup when tg3_reset_task() fails. - [amd64] x86, fakenuma: Fix invalid starting node ID - [amd64] iommu/vt-d: Serialize IOMMU GCMD register modifications - [armhf] thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430 - xfs: don't update mtime on COW faults - btrfs: drop path before adding new uuid tree entry - vfio/type1: Support faulting PFNMAP vmas - vfio-pci: Fault mmaps to enable vma tracking - vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (CVE-2020-12888) - btrfs: Remove redundant extent_buffer_get in get_old_root - btrfs: Remove extraneous extent_buffer_get from tree_mod_log_rewind - btrfs: set the lockdep class for log tree extent buffers - uaccess: Add non-pagefault user-space read functions - uaccess: Add non-pagefault user-space write function - btrfs: fix potential deadlock in the search ioctl - net: usb: qmi_wwan: add Telit 0x1050 composition - usb: qmi_wwan: add D-Link DWM-222 A2 device ID - ALSA: ca0106: fix error code handling - ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check - [x86] ALSA: hda/hdmi: always check pin power status in i915 pin fixup - ALSA: firewire-digi00x: exclude Avid Adrenaline from detection - [x86] ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO - media: rc: do not access device via sysfs after rc_unregister_device() - media: rc: uevent sysfs file races with rc_unregister_device() - affs: fix basic permission bits to actually work - block: allow for_each_bvec to support zero len bvec - libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks - dm writecache: handle DAX to partitions on persistent memory correctly - dm cache metadata: Avoid returning cmd->bm wild pointer on error - dm thin metadata: Avoid returning cmd->bm wild pointer on error - mm: slub: fix conversion of freelist_corrupted() - [arm64] KVM: Add kvm_extable for vaxorcism code - [arm64] KVM: Defer guest entry when an asynchronous exception is pending - [arm64] KVM: Survive synchronous exceptions caused by AT instructions - [arm64] KVM: Set HCR_EL2.PTW to prevent AT taking synchronous exception - vfio/pci: Fix SR-IOV VF handling with MMIO blocking - checkpatch: fix the usage of capture group ( ... ) - mm/hugetlb: fix a race between hugetlb sysctl handlers (CVE-2020-25285) - cfg80211: regulatory: reject invalid hints - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.145 - ALSA; firewire-tascam: exclude Tascam FE-8 from detection - block: ensure bdi->io_pages is always initialized - net: usb: dm9601: Add USB ID of Keenetic Plus DSL - sctp: not disable bh in the whole sctp_get_port_local() - tipc: fix shutdown() of connectionless socket - net: disable netpoll on fresh napis - [arm64,armhf] net/mlx5e: Don't support phys switch id if not in switchdev mode https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.146 - RDMA/rxe: Fix memleak in rxe_mem_init_user - RDMA/rxe: Drop pointless checks in rxe_init_ports - [armhf] drm/sun4i: Fix dsi dcs long write function - scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA - RDMA/core: Fix reported speed and width - [arm64] mmc: sdhci-msm: Add retries when all tuning phases are found valid - [arm64,x86] dmaengine: acpi: Put the CSRT table after using it - netfilter: conntrack: allow sctp hearbeat after connection re-use - [x86] firestream: Fix memleak in fs_open - [arm64,armhf] ALSA: hda: Fix 2 channel swapping for Tegra - xfs: initialize the shortform attr header padding entry - nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance - nvme-rdma: serialize controller teardown sequences - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices - [ppc64el,x86] drivers/net/wan/hdlc_cisco: Add hard_header_len - HID: elan: Fix memleak in elan_input_configured - [x86] cpufreq: intel_pstate: Refuse to turn off with HWP enabled - [x86] cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled - ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled - [amd64] iommu/amd: Do not use IOMMUv2 functionality when SME is active - [x86] iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak. - [x86] iio:magnetometer:ak8975 Fix alignment and data leak issues. - [armhf] iio:accel:mma8452: Fix timestamp alignment and prevent data leak. - [x86] staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() - btrfs: require only sector size alignment for parent eb bytenr - btrfs: fix lockdep splat in add_missing_dev - btrfs: fix wrong address when faulting in pages in the search ioctl - regulator: push allocation in set_consumer_device_supply() out of lock - scsi: target: iscsi: Fix data digest calculation - scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem - [arm64] drm/msm: Disable preemption on all 5xx targets - rbd: require global CAP_SYS_ADMIN for mapping and unmapping (CVE-2020-25284) - RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars - vgacon: remove software scrollback support - fbcon: remove soft scrollback code (CVE-2020-14390) - fbcon: remove now unusued 'softback_lines' cursor() argument - [x86] KVM: VMX: Don't freeze guest when event delivery causes an APIC-access exit - [x86] video: fbdev: fix OOB read in vga_8planes_imageblit() - [arm64] phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init - usb: core: fix slab-out-of-bounds Read in read_descriptors - USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter - USB: serial: option: support dynamic Quectel USB compositions - USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules - usb: Fix out of sync data toggle if a configured device is reconfigured - [x86] usb: typec: ucsi: acpi: Check the _DEP dependencies [ Salvatore Bonaccorso ] * Bump ABI to 11 * Drop 'Revert "mips: Add udelay lpj numbers adjustment"' * [rt] Update to 4.19.135-rt60 * [rt] Refresh "net: Use skbufhead with raw lock" for context changes in 4.19.136 * [rt] Refresh "timers: Prepare for full preemption" for context changes in 4.19.138 * [rt] Refresh "timers: Redo the notification of canceling timers on -RT" for context changes in 4.19.138 * [rt] Refresh "watchdog: prevent deferral of watchdogd wakeup on RT" for context changes in 4.19.141 * Refresh "net: ena: fix crash during ena_remove()" for context changes in 4.19.142 * [rt] Refresh "Split IRQ-off and zone->lock while freeing pages from PCP list #1" for context changes in 4.19.142 * ACPI: configfs: Disallow loading ACPI tables when locked down (CVE-2020-15780) * [rt] Update to 4.19.142-rt63 * net/packet: fix overflow in tpacket_rcv (CVE-2020-14386) * debian/tests/python: pycodestyle: Increase max-line-length to 100. * gfs2: initialize transaction tr_ailX_lists earlier (Closes: #968567) -- Salvatore Bonaccorso Thu, 17 Sep 2020 23:42:03 +0200 linux (4.19.132-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.132 - btrfs: fix a block group ref counter leak after failure to remove block group - mm: fix swap cache node allocation mask - [x86] EDAC/amd64: Read back the scrub rate PCI register on F15h - usbnet: smsc95xx: Fix use-after-free after removal - mm/slub.c: fix corrupted freechain in deactivate_slab() - mm/slub: fix stack overruns with SLUB_STATS - [s390x] debug: avoid kernel warning on too large number of pages - nvme-multipath: set bdi capabilities once - nvme-multipath: fix deadlock between ana_work and scan_work - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() - [arm64] drm/msm/dpu: fix error return code in dpu_encoder_init - cxgb4: use unaligned conversion for fetching timestamp - cxgb4: parse TC-U32 key values and masks natively - cxgb4: use correct type for all-mask IP address comparison - cxgb4: fix SGE queue dump destination buffer context - [x86] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() - [arm64,armhf] drm: sun4i: hdmi: Remove extra HPD polling - virtio-blk: free vblk-vqs in error path of virtblk_probe() - SMB3: Honor 'posix' flag for multiuser mounts - nvme: fix a crash in nvme_mpath_add_disk - i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 - Revert "ALSA: usb-audio: Improve frames size computation" - SMB3: Honor 'seal' flag for multiuser mounts - SMB3: Honor persistent/resilient handle flags for multiuser mounts - SMB3: Honor lease disabling for multiuser mounts - cifs: Fix the target file was deleted when rename failed. - [mips*] Add missing EHB in mtc0 -> mfc0 sequence for DSPen - [arm64,armhf] irqchip/gic: Atomically update affinity - dm zoned: assign max_io_len correctly - efi: Make it possible to disable efivar_ssdt entirely [ Salvatore Bonaccorso ] * [rt] Update to 4.19.132-rt59 * Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb" (Closes: #964153, #964480) * efi: Restrict efivar_ssdt_load when the kernel is locked down (CVE-2019-20908) * certs: Rotate to use the Debian Secure Boot Signer 2020 certificate * e1000e: Add support for Comet Lake (Closes: #965365) -- Salvatore Bonaccorso Fri, 24 Jul 2020 20:46:18 +0200 linux (4.19.131-2) buster; urgency=medium [ Aurelien Jarno ] * Revert "mips: Add udelay lpj numbers adjustment", since it causes the build to fail with CONFIG_CPU_FREQ=y. -- Salvatore Bonaccorso Sat, 11 Jul 2020 15:44:13 +0200 linux (4.19.131-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.119 - ext4: fix extent_status fragmentation for plain files - [arm64] drm/msm: Use the correct dma_sync calls harder - vti4: removed duplicate log message. - [arm64] Add part number for Neoverse N1 - [arm64] errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419 - [arm64] Fake the IminLine size on systems affected by Neoverse-N1 #1542419 - [arm64] compat: Workaround Neoverse-N1 #1542419 for compat user-space - watchdog: reset last_hw_keepalive time at start - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login - scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG - ceph: return ceph_mdsc_do_request() errors from __get_parent() - ceph: don't skip updating wanted caps when cap is stale - scsi: iscsi: Report unbind session event when the target has been removed - [x86] ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() - nvme: fix deadlock caused by ANA update wrong locking - ipc/util.c: sysvipc_find_ipc() should increase position index - [s390x] cio: avoid duplicated 'ADD' uevents - loop: Better discard support for block devices - [powerpc*] Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled" - [arm*] pwm: bcm2835: Dynamically allocate base - perf/core: Disable page faults when getting phys address - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3 - virtio-blk: improve virtqueue error to BLK_STS - scsi: smartpqi: fix call trace in device discovery - PCI/ASPM: Allow re-enabling Clock PM - [x86] KVM: VMX: Zero out *all* general purpose registers after VM-Exit - cxgb4: fix adapter crash due to wrong MC size - cxgb4: fix large delays in PTP synchronization - ipv6: fix restrict IPV6_ADDRFORM operation - macsec: avoid to set wrong mtu - macvlan: fix null dereference in macvlan_device_event() - net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node - [arm64,armhf] net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array - sched: etf: do not assume all sockets are full blown - tcp: cache line align MAX_TCP_HEADER - team: fix hang in team_mode_get() - vrf: Fix IPv6 with qdisc and xfrm - [armhf] net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled - [armhf] net: dsa: b53: Fix ARL register definitions - [armhf] net: dsa: b53: Rework ARL bin logic - [armhf] net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL - xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish - vrf: Check skb for XFRM_TRANSFORMED flag - KEYS: Avoid false positive ENOMEM error on key read - ALSA: hda: Remove ASUS ROG Zenith from the blacklist - ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos - ALSA: usb-audio: Add connector notifier delegation - [armhf] iio: st_sensors: rely on odr mask to know if odr can be set - USB: sisusbvga: Change port variable from signed to unsigned - USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE - USB: early: Handle AMD's spec-compliant identifiers, too - USB: hub: Fix handling of connect changes during sleep - vmalloc: fix remap_vmalloc_range() bounds checks - mm/hugetlb: fix a addressing exception caused by huge_pte_offset - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled - ALSA: hda/realtek - Fix unexpected init_amp override - ALSA: hda/realtek - Add new codec supported for ALC245 - ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif - ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices - tpm/tpm_tis: Free IRQ if probing fails - [s390x] KVM: Return last valid slot if approx index is out-of-bounds - KVM: Check validity of resolved slot when searching memslots - [x86] KVM: VMX: Enable machine check support for 32bit targets - tty: hvc: fix buffer overflow during hvc_alloc(). - [x86] tty: rocket, avoid OOB access - usb-storage: Add unusual_devs entry for JMicron JMS566 - audit: check the length of userspace generated audit records - ASoC: dapm: fixup dapm kcontrol widget - iwlwifi: pcie: actually release queue memory in TVQM - iwlwifi: mvm: beacon statistics shouldn't go backwards - [armel,armhf] ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y - [powerpc*] setup_64: Set cache-line-size based on cache-block-size - [i386] staging: comedi: dt2815: fix writing hi byte of analog output - [x86] staging: comedi: Fix comedi_device refcnt leak in comedi_open - vt: don't hardcode the mem allocation upper bound - vt: don't use kmalloc() for the unicode screen buffer - [x86] staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. - [x86] staging: vt6656: Fix calling conditions of vnt_set_bss_mode - [x86] staging: vt6656: Fix drivers TBTT timing counter. - [x86] staging: vt6656: Fix pairwise key entry save. - [x86] staging: vt6656: Power save stop wake_up_count wrap around. - cdc-acm: close race betrween suspend() and acm_softint - cdc-acm: introduce a cool down - UAS: no use logging any details in case of ENODEV - UAS: fix deadlock in error handling and PM flushing work - [arm64,armhf] usb: dwc3: gadget: Fix request completion check - usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() - xhci: prevent bus suspend if a roothub port detected a over-current condition - xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.120 - mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer - [arm*] binder: take read mode of mmap_sem in binder_alloc_free_page() - [arm64,armhf] usb: dwc3: gadget: Do link recovery for SS and SSP - nfsd: memory corruption in nfsd4_lock() - rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket - net/cxgb4: Check the return from t4_query_params properly - xfs: acquire superblock freeze protection on eofblocks scans - svcrdma: Fix trace point use-after-free race - svcrdma: Fix leak of svc_rdma_recv_ctxt objects - PCI: Avoid ASMedia XHCI USB PME# from D0 defect - [s390x] net/mlx5: Fix failing fw tracer allocation on s390 - perf/core: fix parent pid/tid in task exit events - [i386] bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension - mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path - xfs: clear PF_MEMALLOC before exiting xfsaild thread - [x86] bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B - [armhf] net: fec: set GPR bit on suspend by DT configuration. - [x86] hyperv: report value of misc_features - xfs: fix partially uninitialized structure in xfs_reflink_remap_extent - ALSA: hda: Keep the controller initialization even if no codecs found - ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported - scsi: target: fix PR IN / READ FULL STATUS for FC - scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status - ALSA: hda: call runtime_allow() for all hda controllers - [arm64] Delete the space separator in __emit_inst - ext4: use matching invalidatepage in ext4_writepage - ext4: increase wait time needed before reuse of deleted inode numbers - ext4: convert BUG_ON's to WARN_ON's in mballoc.c - hwmon: (jc42) Fix name to have no illegal characters - [i386] bpf, x86_32: Fix clobbering of dst for BPF_JSET - qed: Fix use after free in qed_chain_free - ext4: check for non-zero journal inum in ext4_calculate_overhead https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.121 - drm/edid: Fix off-by-one in DispID DTD pixel clock - drm/qxl: qxl_release leak in qxl_draw_dirty_fb() - drm/qxl: qxl_release leak in qxl_hw_surface_alloc() - drm/qxl: qxl_release use after free - btrfs: fix block group leak when removing fails - ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter - ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID - ALSA: hda/hdmi: fix without unlocked before return - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly (Closes: #960493) - PM: ACPI: Output correct message on target power state - PM: hibernate: Freeze kernel threads in software_resume() - dm writecache: fix data corruption when reloading the target - dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath - scsi: qla2xxx: set UNLOADING before waiting for session deletion - scsi: qla2xxx: check UNLOADING before posting async work - RDMA/mlx5: Set GRH fields in query QP on RoCE - RDMA/mlx4: Initialize ib_spec on the stack - RDMA/core: Prevent mixed use of FDs between shared ufiles - RDMA/core: Fix race between destroy and release FD object - [amd64,arm64] vfio: avoid possible overflow in vfio_iommu_type1_pin_pages - [amd64,arm64] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() - [arm64] iommu/qcom: Fix local_base status check - scsi: target/iblock: fix WRITE SAME zeroing - [amd64] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl - btrfs: fix partial loss of prealloc extent past i_size after fsync - btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info - mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop - [arm64] mmc: sdhci-xenon: fix annoying 1.8V regulator warning - mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers - [arm64] mmc: sdhci-msm: Enable host capabilities pertains to R1b response - [armhf] mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY - [armhf] mmc: meson-mx-sdio: remove the broken ->card_busy() op https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.122 - vhost: vsock: kick send_pkt worker once device is started - [powerpc*] pci/of: Parse unassigned resources - [x86] ASoC: topology: Check return value of pcm_new_ver - [armhf] ASoC: sgtl5000: Fix VAG power-on handling - [arm64,armhf] usb: dwc3: gadget: Properly set maxpacket limit - [x86] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry - wimax/i2400m: Fix potential urb refcnt leak - [armhf] net: stmmac: fix enabling socfpga's ptp_ref_clock - [armhf] net: stmmac: Fix sub-second increment - cifs: protect updating server->dstaddr with a spinlock - [s390x] ftrace: fix potential crashes when switching tracers - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case - drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event - lib: devres: add a helper function for ioremap_uc - [x86] mfd: intel-lpss: Use devm_ioremap_uc for MMIO - ALSA: hda: Match both PCI ID and SSID for driver blacklist - [x86] platform: GPD pocket fan: Fix error message when temp-limits are out of range - mac80211: add ieee80211_is_any_nullfunc() - cgroup, netclassid: remove double cond_resched - drm/atomic: Take the atomic toys away from X https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.123 - USB: serial: qcserial: Add DW5816e support - tracing/kprobes: Fix a double initialization typo - vt: fix unicode console freeing with a common interface - fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks - net: macsec: preserve ingress frame ordering - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc() - net_sched: sch_skbprio: add message validation to skbprio_change() - net: usb: qmi_wwan: add support for DW5816e - sch_choke: avoid potential panic in choke_reset() - sch_sfq: validate silly quantum values - tipc: fix partial topology connection closure - bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features(). - net/mlx5: Fix forced completion access non initialized command entry - net/mlx5: Fix command entry leak in Internal Error State - bnxt_en: Improve AER slot reset. - bnxt_en: Fix VF anti-spoof filter setup. - net: stricter validation of untrusted gso packets - HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices - sctp: Fix bundling of SHUTDOWN with COOKIE-ACK - HID: usbhid: Fix race between usbhid_close() and usbhid_stop() - USB: uas: add quirk for LaCie 2Big Quadra - USB: serial: garmin_gps: add sanity checking for data length - tracing: Add a vmalloc_sync_mappings() for safe measure - [arm64,armhf] KVM: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER - [arm64] KVM: Fix 32bit PC wrap-around - [arm64] hugetlb: avoid potential NULL dereference - mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous() - [x86] KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs - [x86] KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu_run()'s asm blob - batman-adv: fix batadv_nc_random_weight_tq - batman-adv: Fix refcnt leak in batadv_show_throughput_override - batman-adv: Fix refcnt leak in batadv_store_throughput_override - batman-adv: Fix refcnt leak in batadv_v_ogm_process - [amd64] x86/entry/64: Fix unwind hints in register clearing code - [amd64] x86/entry/64: Fix unwind hints in kernel exit path - [amd64] x86/entry/64: Fix unwind hints in rewind_stack_do_exit() - [amd64] x86/unwind/orc: Don't skip the first frame for inactive tasks - [amd64] x86/unwind/orc: Prevent unwinding before ORC initialization - [amd64] x86/unwind/orc: Fix error path for bad ORC entry type - [amd64] x86/unwind/orc: Fix premature unwind stoppage due to IRET frames - netfilter: nat: never update the UDP checksum when it's 0 - netfilter: nf_osf: avoid passing pointer to local var - scripts/decodecode: fix trapping instruction formatting - ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.124 - [arm64,armhf] net: dsa: Do not make user port errors fatal - shmem: fix possible deadlocks on shmlock_user_lock - virtio-blk: handle block_device_operations callbacks after hot unplug - mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040 - net: fix a potential recursive NETDEV_FEAT_CHANGE - net: phy: fix aneg restart in phy_ethtool_set_eee - pppoe: only process PADT targeted at local interfaces - Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu" - tcp: fix error recovery in tcp_zerocopy_receive() - virtio_net: fix lockdep warning on 32 bit - [x86,arm64] hinic: fix a bug of ndo_stop - net: ipv4: really enforce backoff for redirects - netprio_cgroup: Fix unlimited memory leak of v2 cgroups - net: tcp: fix rx timestamp behavior for tcp_recvmsg - tcp: fix SO_RCVLOWAT hangs with fat skbs - [i386] dmaengine: pch_dma.c: Avoid data race between probe and irq handler - [x86] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once - ALSA: hda/hdmi: fix race in monitor detection during probe - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index - ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse - gfs2: Another gfs2_walk_metadata fix - [x86] pinctrl: baytrail: Enable pin configuration setting for GPIO chip - [x86] pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler - i40iw: Fix error handling in i40iw_manage_arp_cache() - mmc: core: Check request type before completing the request - mmc: block: Fix request completion in the CQE timeout path - NFS: Fix fscache super_cookie index_key from changing after umount - nfs: fscache: use timespec64 in inode auxdata - NFSv4: Fix fscache cookie aux_data to ensure change_attr is included - [arm64] fix the flush_icache_range arguments in machine_kexec - netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() - IB/mlx4: Test return value of calls to ib_get_cached_pkey - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses - ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset - usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B - [arm64,armhf] usb: host: xhci-plat: keep runtime active when removing host - usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list - cifs: fix leaked reference on requeued write - exec: Move would_dump into flush_old_exec - [arm64,armhf] clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks - [arm64,armhf] dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg() - Revert "ALSA: hda/realtek: Fix pop noise on ALC225" - clk: Unlink clock if failed to prepare or enable - [arm64] dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards - [x86] KVM: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.125 - i2c: dev: Fix the race between the release of i2c_dev and cdev - fix multiplication overflow in copy_fdtable() - ubifs: remove broken lazytime support - [amd64] iommu/amd: Fix over-read of ACPI UID from IVRS table - ubi: Fix seq_file usage in detailed_erase_block_info debugfs file - HID: multitouch: add eGalaxTouch P80H84 support - HID: alps: Add AUI1657 device ID - HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead - scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV - scsi: qla2xxx: Delete all sessions before unregister local nvme port - configfs: fix config_item refcnt leak in configfs_rmdir() - vhost/vsock: fix packet delivery order to monitoring devices - [amd64] aquantia: Fix the media type of AQC100 ethernet controller in the driver - component: Silence bind error on -EPROBE_DEFER - [ppc64el] scsi: ibmvscsi: Fix WARN_ON during event pool release - HID: i2c-hid: reset Synaptics SYNA2393 on resume - [x86] apic: Move TSC deadline timer debug printk - gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() - HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock - ceph: fix double unlock in handle_cap_export() - [arm64,armhf] stmmac: fix pointer check after utilization in stmmac_interrupt - USB: core: Fix misleading driver bug report - [x86] platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA - padata: Replace delayed timer with immediate workqueue in padata_reorder - padata: initialize pd->cpu with effective cpumask - padata: purge get_cpu and reorder_via_wq from padata_do_serial - ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option - ALSA: pcm: fix incorrect hw_base increase - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme - ALSA: hda/realtek - Add more fixup entries for Clevo machines - [armhf] drm/etnaviv: fix perfmon domain interation - apparmor: Fix use-after-free in aa_audit_rule_init - apparmor: fix potential label refcnt leak in aa_change_profile - apparmor: Fix aa_label refcnt leak in policy_update - [arm64] dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()' - [powerpc*] Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE - [powerpc*] 64s: Disable STRICT_KERNEL_RWX - [amd64,arm64] nfit: Add Hyper-V NVDIMM DSM command set to white list - [x86,arm64] libnvdimm/btt: Remove unnecessary code in btt_freelist_init - [x86,arm64] libnvdimm/btt: Fix LBA masking during 'free list' population - [x86] thunderbolt: Drop duplicated get_switch_at_route() - cxgb4: free mac_hlist properly - cxgb4/cxgb4vf: Fix mac_hlist initialization and free - brcmfmac: abort and release host after error - Revert "gfs2: Don't demote a glock until its revokes are written" - misc: rtsx: Add short delay after exit from ASPM - [x86] mei: release me_cl object reference - rxrpc: Fix a memory leak in rxkad_verify_response() - rxrpc: Trace discarded ACKs - rxrpc: Fix ack discard https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126 - ax25: fix setsockopt(SO_BINDTODEVICE) - __netif_receive_skb_core: pass skb by reference - net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* - net: ipip: fix wrong address family in init error path - net/mlx5: Add command entry handling completion - net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" - net sched: fix reporting the first-time use timestamp - r8152: support additional Microsoft Surface Ethernet Adapter variant - sctp: Don't add the shutdown timer if its already been added - sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed - net/mlx5e: Update netdev txq on completions during closure - net/mlx5: Annotate mutex destroy for root ns - net: sun: fix missing release regions in cas_init_one(). - net/mlx4_core: fix a memory leak bug. - [armhf] dts: rockchip: fix phy nodename for rk3228-evb - [arm64] dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts - [arm64,armhf] gpio: tegra: mask GPIO IRQs during IRQ shutdown - ALSA: usb-audio: add mapping for ASRock TRX40 Creator - gfs2: move privileged user check to gfs2_quota_lock_check - cachefiles: Fix race between read_waiter and read_copier involving op->to_do - [arm64] usb: dwc3: pci: Enable extcon driver for Intel Merrifield - usb: gadget: legacy: fix redundant initialization warnings - IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() - cifs: Fix null pointer check in cifs_read - Input: usbtouchscreen - add support for BonXeon TP - Input: evdev - call input_flush_device() on release(), not flush() - Input: xpad - add custom init packet for Xbox One S controllers - Input: i8042 - add ThinkPad S230u to i8042 reset list - Input: synaptics-rmi4 - really fix attn_data use-after-free - Input: synaptics-rmi4 - fix error return code in rmi_driver_probe() - [armel,armhf] 8970/1: decompressor: increase tag size - [arm*] 8843/1: use unified assembler in headers - gpio: exar: Fix bad handling for ida_simple_get error path - IB/qib: Call kobject_put() when kobject_init_and_add() fails - [armhf] dts/imx6q-bx50v3: Set display interface clock parents - [armel,armhf] dts: bcm2835-rpi-zero-w: Fix led polarity - mmc: block: Fix use-after-free issue for rpmb - ALSA: hwdep: fix a left shifting 1 by 31 UB bug - ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround - ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC - exec: Always set cap_ambient in cap_bprm_set_creds - ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio - ALSA: hda/realtek - Add new codec supported for ALC287 - libceph: ignore pool overlay and cache logic on redirects - IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode - mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() - include/asm-generic/topology.h: guard cpumask_of_node() macro argument - iommu: Fix reference count leak in iommu_group_alloc. - mmc: core: Fix recursive locking issue in CQE recovery path - RDMA/core: Fix double destruction of uobject - mac80211: mesh: fix discovery timer re-arming issue / crash - [x86] dma: Fix max PFN arithmetic overflow on 32 bit systems - [x86] copy_xstate_to_kernel(): don't leave parts of destination uninitialized - xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input - xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output - xfrm interface: fix oops when deleting a x-netns interface - xfrm: fix a warning in xfrm_policy_insert_list - xfrm: fix a NULL-ptr deref in xfrm_local_error - xfrm: fix error in comment - vti4: eliminated some duplicate code. - ip_vti: receive ipip packet by calling ip_tunnel_rcv - netfilter: nft_reject_bridge: enable reject with bridge vlan - netfilter: ipset: Fix subcounter update skip - netfilter: nfnetlink_cthelper: unbreak userspace helper support - netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code - esp6: get the right proto for transport mode in esp6_gso_encap - bnxt_en: Fix accumulation of bp->net_stats_prev. - xsk: Add overflow check for u64 division, stored into u32 - qlcnic: fix missing release in qlcnic_83xx_interrupt_test. - bonding: Fix reference count leak in bond_sysfs_slave_add. - netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build - mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.127 - Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window" - libnvdimm: Fix endian conversion issues  - HID: sony: Fix for broken buttons on DS3 USB dongles - HID: i2c-hid: add Schneider SCL142ALM to descriptor override - p54usb: add AirVasT USB stick device-id - mmc: fix compilation of user API - scsi: ufs: Release clock if DMA map fails - airo: Fix read overflows sending packets - [x86] drm/i915: fix port checks for MST support on gen >= 11 - [arm64] scsi: hisi_sas: Check sas_port before using it - [powerpc*] powernv: Avoid re-registration of imc debugfs directory - [s390x] ftrace: save traced function caller - drm/edid: Add Oculus Rift S to non-desktop list - [s390x] mm: fix set_huge_pte_at() for empty ptes - null_blk: return error for invalid zone size - [arm64] net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x - [arm64,armhf] net: smsc911x: Fix runtime PM imbalance on error https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.128 - devinet: fix memleak in inetdev_init() - l2tp: add sk_family checks to l2tp_validate_socket - l2tp: do not use inet_hash()/inet_unhash() - net: usb: qmi_wwan: add Telit LE910C1-EUX composition - vsock: fix timeout in vsock_accept() - net: check untrusted gso_size at kernel entry - USB: serial: qcserial: add DW5816e QDL support - USB: serial: usb_wwan: do not resubmit rx urb on fatal errors - USB: serial: option: add Telit LE910C1-EUX compositions - [arm64,armhf] usb: musb: start session in resume for host port - [arm64,armhf] usb: musb: Fix runtime PM imbalance on error - vt: keyboard: avoid signed integer overflow in k_ascii (CVE-2020-13974) - tty: hvc_console, fix crashes on parallel open/close - staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK - CDC-ACM: heed quirk also in error handling - [arm64] nvmem: qfprom: remove incorrect write support - uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned - Revert "net/mlx5: Annotate mutex destroy for root ns" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.129 - ipv6: fix IPV6_ADDRFORM operation logic - net_failover: fixed rollback in net_failover_open() - bridge: Avoid infinite loop when suppressing NS messages with invalid options - vxlan: Avoid infinite loop when suppressing NS messages with invalid options - tun: correct header offsets in napi frags mode - make 'user_access_begin()' do 'access_ok()' (CVE-2018-20669) - [x86] uaccess: Inhibit speculation past access_ok() in user_access_begin() - lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user() - btrfs: merge btrfs_find_device and find_device (CVE-2019-18885) - btrfs: Detect unbalanced tree with empty leaf before crashing btree operations - [armel,armhf] 8977/1: ptrace: Fix mask for thumb breakpoint hook - sched/fair: Don't NUMA balance for kthreads - Input: synaptics - add a second working PNP_ID for Lenovo T470s - [powerpc*] xive: Clear the page tables for the ESB IO mapping - ath9k_htc: Silence undersized packet warnings - RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated - [x86] cpu/amd: Make erratum #1054 a legacy erratum - perf probe: Accept the instance number of kretprobe event - mm: add kvfree_sensitive() for freeing sensitive data objects - aio: fix async fsync creds - btrfs: tree-checker: Check level for leaves and nodes - [x86] Fix jiffies ODR violation - [x86] PCI: Mark Intel C620 MROMs as having non-compliant BARs - [x86] speculation: Prevent rogue cross-process SSBD shutdown (CVE-2020-10766) - [x86] reboot/quirks: Add MacBook6,1 reboot quirk - efi/efivars: Add missing kobject_put() in sysfs entry creation error path - [i386] ALSA: es1688: Add the missed snd_card_free() - ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines - ALSA: usb-audio: Fix inconsistent card PM state after resume - ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock - [arm64,x86] ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() - [amd64,arm64] ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() - [arm64] ACPI: GED: add support for _Exx / _Lxx handler methods - [arm64,x86] ACPI: PM: Avoid using power resources if there are none for D0 - cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages - nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() - [arm*] spi: bcm2835aux: Fix controller unregister order - PM: runtime: clk: Fix clk_pm_runtime_get() error path - [arm64] crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when ndevlist is fully iterated - ALSA: pcm: disallow linking stream to itself - [x86] {mce,mm}: Unmap the entire page if the whole page is affected and poisoned - [x86] KVM: Fix APIC page invalidation race - [x86] kvm: Fix L1TF mitigation for shadow MMU - [x86] KVM: x86/mmu: Consolidate "is MMIO SPTE" code - [x86] KVM: only do L1TF workaround on affected processors - [x86] speculation: Change misspelled STIPB to STIBP - [x86] speculation: Add support for STIBP always-on preferred mode - [x86] speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS. (CVE-2020-10767) - [x86] speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches. (CVE-2020-10768) - spi: No need to assign dummy value in spi_unregister_controller() - spi: Fix controller unregister order - [amd64] spi: pxa2xx: Fix controller unregister order - [arm*] spi: bcm2835: Fix controller unregister order - [amd64] spi: pxa2xx: Balance runtime PM enable/disable on error - [amd64] spi: pxa2xx: Fix runtime PM ref imbalance on probe error - crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() - crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req() - crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req() - ovl: initialize error in ovl_copy_xattr - proc: Use new_inode not new_inode_pseudo - [x86] KVM: nSVM: fix condition for filtering async PF - [x86] KVM: nSVM: leave ASID aside in copy_vmcb_control_area - [x86] KVM: nVMX: Consult only the "basic" exit reason when routing nested exit - [arm64] KVM: Make vcpu_cp1x() work on Big Endian hosts - scsi: megaraid_sas: TM command refire leads to controller firmware crash - ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg - ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb - mm/slub: fix a memory leak in sysfs_slab_add() - fat: don't allow to mount if the FAT length == 0 - perf: Add cond_resched() to task_function_call() - [x86] agp/intel: Reinforce the barrier after GTT updates - [arm64] mmc: sdhci-msm: Clear tuning done flag while hs400 tuning - mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card() - xen/pvcalls-back: test for errors when calling backend_connect() - [arm64] KVM: Synchronize sysreg state on injecting an AArch32 exception - [arm64] ACPI: GED: use correct trigger type field in _Exx / _Lxx handling - [arm64] drm: bridge: adv7511: Extend list of audio sample rates - [x86] crypto: ccp -- don't "select" CONFIG_DMADEVICES - media: si2157: Better check for running tuner in init - [amd64] spi: pxa2xx: Apply CS clk quirk to BXT - [amd64] net: atlantic: make hw_get_regs optional - net: ena: fix error returning in ena_com_get_hash_function() - [arm64] insn: Fix two bugs in encoding 32-bit logical immediates - ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K - Bluetooth: Add SCO fallback for invalid LMP parameters error - [armhf] clocksource: dw_apb_timer: Make CPU-affiliation being optional - [armhf] clocksource: dw_apb_timer_of: Fix missing clockevent timers - btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums - batman-adv: Revert "disable ethtool link speed detection when auto negotiation off" - [armhf] mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error - [x86] kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit - [x86] net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() - brcmfmac: fix wrong location to get firmware feature - e1000: Distribute switch variables for initialization - dt-bindings: display: mediatek: control dpi pins mode to avoid leakage - audit: fix a net reference leak in audit_send_reply() - media: dvb: return -EREMOTEIO on i2c transfer failure. - [mips*] Make sparse_init() using top-down allocation - Bluetooth: btbcm: Add 2 missing models to subver tables - audit: fix a net reference leak in audit_list_rules_send() - netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported - exit: Move preemption fixup up, move blocking operations down - sched/core: Fix illegal RCU from offline CPUs - drivers/perf: hisi: Fix typo in events attribute array - [armhf] net: allwinner: Fix use correct return type for ndo_start_xmit() - xfs: clean up the error handling in xfs_swap_extents - Crypto/chcr: fix for ccm(aes) failed test - [mips*] cm: Fix an invalid error code of INTVN_*_ERR - xfs: reset buffer write failure state on successful completion - xfs: fix duplicate verification from xfs_qm_dqflush() - [x86] platform/x86: intel-vbtn: Use acpi_evaluate_integer() - [x86] platform/x86: intel-vbtn: Split keymap into buttons and switches parts - [x86] platform/x86: intel-vbtn: Do not advertise switches to userspace if they are not there - [x86] platform/x86: intel-vbtn: Also handle tablet-mode switch on "Detachable" and "Portable" chassis-types - nvme: refine the Qemu Identify CNS quirk - ath10k: Remove msdu from idr when management pkt send fails - [arm64] wcn36xx: Fix error handling path in 'wcn36xx_probe()' - net: qed*: Reduce RX and TX default ring count when running inside kdump kernel - mt76: avoid rx reorder buffer overflow - md: don't flush workqueue unconditionally in md_open - veth: Adjust hard_start offset on redirect XDP frames - net/mlx5e: IPoIB, Drop multicast packets that this interface sent - rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() - mwifiex: Fix memory corruption in dump_station - [x86] boot: Correct relocation destination on old linkers - [x86] mm: Stop printing BRK addresses - btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup - macvlan: Skip loopback packets in RX handler - PCI: Don't disable decoding when mmio_always_on is set - [mips*] Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() - bcache: fix refcount underflow in bcache_device_free() - [arm64] mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk - mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core - ixgbe: fix signed-integer-overflow warning - [armhf] mmc: sdhci-esdhc-imx: fix the mask for tuning start point - cpuidle: Fix three reference count leaks - [x86] platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32() - [x86] platform/x86: intel-hid: Add a quirk to support HP Spectre X2 (2015) - [x86] platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type - btrfs: include non-missing as a qualifier for the latest_bdev - btrfs: send: emit file capabilities after chown - mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() - mm: initialize deferred pages with interrupts enabled - ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max - ext4: fix error pointer dereference - ext4: fix race between ext4_sync_parent() and rename() - PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect - PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 - PCI: Avoid FLR for AMD Starship USB 3.0 - PCI: Add ACS quirk for iProc PAXB - PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints - PCI: Remove unused NFP32xx IDs - [x86] hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs - [x86] amd_nb: Add PCI device IDs for family 17h, model 30h - PCI: add USR vendor id and use it in r8169 and w6692 driver - PCI: Move Synopsys HAPS platform device IDs - PCI: Move Rohm Vendor ID to generic list - misc: pci_endpoint_test: Add the layerscape EP device support - misc: pci_endpoint_test: Add support to test PCI EP in AM654x - PCI: Add Synopsys endpoint EDDA Device ID - PCI: Add NVIDIA GPU multi-function power dependencies - PCI: Enable NVIDIA HDA controllers - [x86] amd_nb: Add PCI device IDs for family 17h, model 70h - ALSA: lx6464es - add support for LX6464ESe pci express variant - PCI: Add Genesys Logic, Inc. Vendor ID - PCI: Add Amazon's Annapurna Labs vendor ID - PCI: vmd: Add device id for VMD device 8086:9A0B - [x86] amd_nb: Add Family 19h PCI IDs - PCI: Add Loongson vendor ID - serial: 8250_pci: Move Pericom IDs to pci_ids.h - PCI: Make ACS quirk implementations more uniform - PCI: Unify ACS quirk desired vs provided checking - PCI: Generalize multi-function power dependency device links - btrfs: fix error handling when submitting direct I/O bio - btrfs: fix wrong file range cleanup after an error filling dealloc range - PCI: Program MPS for RCiEP devices - e1000e: Disable TSO for buffer overrun workaround - e1000e: Relax condition to trigger reset for ME workaround - carl9170: remove P2P_GO support - media: go7007: fix a miss of snd_card_free (CVE-2019-20810) - Bluetooth: hci_bcm: fix freeing not-requested IRQ - b43legacy: Fix case where channel status is corrupted - b43: Fix connection problem with WPA3 - b43_legacy: Fix connection problem with WPA3 - igb: Report speed and duplex as unknown when device is runtime suspended - [arm64,armhf] power: vexpress: add suppress_bind_attrs to true - [armhf] pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210 - [armhf] pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs - gnss: sirf: fix error return code in sirf_probe() - dm crypt: avoid truncating the logical block size - kernel/cpu_pm: Fix uninitted local in cpu_pm - [armhf] tegra: Correct PL310 Auxiliary Control Register initialization - [powerpc*] 64s: Don't let DT CPU features set FSCR_DSCR - [powerpc*] 64s: Save FSCR to init_task.thread.fscr after feature init - sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations. - sunrpc: clean up properly in gss_mech_unregister() - [armhf] w1: omap-hdq: cleanup to add missing newline for some dev_dbg - perf probe: Do not show the skipped events - perf probe: Fix to check blacklist address correctly - perf probe: Check address correctness by map instead of _etext - perf symbols: Fix debuginfo search for Ubuntu https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.130 - [arm64,armhf] clk: sunxi: Fix incorrect usage of round_down() - [arm64,armhf] ASoC: tegra: tegra_wm8903: Support nvidia, headset property - i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets - [x86] iio: pressure: bmp280: Tolerate IRQ before registering - [arm64] clk: qcom: msm8916: Fix the address location of pll->config_reg - [arm64] backlight: lp855x: Ensure regulators are disabled on probe failure - [armhf] ASoC: davinci-mcasp: Fix dma_chan refcnt leak when getting dma type - [armel] integrator: Add some Kconfig selections - scsi: qedi: Check for buffer overflow in qedi_set_path() - ALSA: hda/realtek - Introduce polarity for micmute LED GPIO - [i386] ALSA: isa/wavefront: prevent out of bounds write in ioctl - PCI: Allow pci_resize_resource() for devices on root bus - scsi: qla2xxx: Fix issue with adapter's stopping state - [x86] iio: bmp280: fix compensation of humidity - f2fs: report delalloc reserve as non-free in statfs for project quota - [x86] i2c: pxa: clear all master action bits in i2c_pxa_stop_message() - [armhf] clk: samsung: Mark top ISP and CAM clocks on Exynos542x as critical - usblp: poison URBs upon disconnect - serial: 8250: Fix max baud limit in generic 8250 port - dm mpath: switch paths in dm_blk_ioctl() code path - [arm64] PCI: aardvark: Don't blindly enable ASPM L0s and don't write to read-only register - vfio/pci: fix memory leaks in alloc_perm_bits() - RDMA/mlx5: Add init2init as a modify command - scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event - [powerpc*] perf/hv-24x7: Fix inconsistent output values incase multiple hv-24x7 events run - nfsd: Fix svc_xprt refcnt leak when setup callback client failed - [amd64] PCI: vmd: Filter resource type bits from shadow register - [powerpc*] crashkernel: Take "mem=" option into account - yam: fix possible memory leak in yam_init_driver - apparmor: fix introspection of of task mode for unconfined tasks - apparmor: check/put label on apparmor_sk_clone_security() - scsi: sr: Fix sr_probe() missing deallocate of device minor - [powerpc*] scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM - apparmor: fix nnp subset test for unconfined - [x86] purgatory: Disable various profiling and sanitizing options - scsi: qedi: Do not flush offload work if ARP not resolved - [armhf] dts: sun8i-h2-plus-bananapi-m2-zero: Fix led polarity - scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing - [arm64] firmware: qcom_scm: fix bogous abuse of dma-direct internals - ALSA: usb-audio: Improve frames size computation - ALSA: usb-audio: Fix racy list management in output queue - [s390x] qdio: put thinint indicator after early error - tty: hvc: Fix data abort due to race in hvc_open - [armhf] thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR - [arm64,armhf] usb: dwc3: gadget: Properly handle failed kick_transfer - [mips64el,mipsel] staging: sm750fb: add missing case while setting FB_VISUAL - [arm64,i386] i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output - [arm*] serial: amba-pl011: Make sure we initialize the port.lock spinlock - drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish - PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges - scsi: qla2xxx: Fix warning after FC target reset - scsi: mpt3sas: Fix double free warnings - [arm64,armhf] pinctrl: rockchip: fix memleak in rockchip_dt_node_to_map - [armhf] clk: ti: composite: fix memory leak - PCI: Fix pci_register_host_bridge() device_register() error handling - [powerpc*] Don't initialise init_task->thread.regs - tty: n_gsm: Fix SOF skipping - tty: n_gsm: Fix waking up upper tty layer when room available - HID: Add quirks for Trust Panora Graphic Tablet - ipmi: use vzalloc instead of kmalloc for user creation - [powerpc*] pseries/ras: Fix FWNMI_VALID off by one - vfio-pci: Mask cap zero - usb/ohci-platform: Fix a warning when hibernating - [arm64] drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT8-A tablet - [armhf] USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() - tty: n_gsm: Fix bogus i++ in gsm_data_kick - scsi: target: tcmu: Userspace must not complete queued commands - [powerpc*] 64s/pgtable: fix an undefined behaviour - dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone - PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port - [arm64,armhf] PCI: dwc: Fix inner MSI IRQ domain registration - IB/cma: Fix ports memory leak in cma_configfs - [arm*] usb: dwc2: gadget: move gadget resume after the core is in L0 state - usb: gadget: Fix issue with config_ep_by_speed function - RDMA/iw_cxgb4: cleanup device debugfs entries on ULD remove - [x86] apic: Make TSC deadline timer detection message visible - scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd() - [arm*] clk: bcm2835: Fix return type of bcm2835_register_gate - [ppc64el] KVM: Book3S HV: Ignore kmemleak false positives - net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' - NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION - of: Fix a refcounting bug in __of_attach_node_sysfs() - rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not user_ID - gfs2: Allow lock_nolock mount to specify jid=X - scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj - scsi: ufs: Don't update urgent bkops level when toggling auto bkops - [armhf] pinctrl: freescale: imx: Fix an error handling path in 'imx_pinctrl_probe()' - geneve: change from tx_error to tx_dropped on missing metadata - lib/zlib: remove outdated and incorrect pre-increment optimization - blktrace: use errno instead of bi_status - blktrace: fix endianness in get_pdu_int() - blktrace: fix endianness for blk_log_remap() - gfs2: fix use-after-free on transaction ail lists - drivers/perf: hisi: Fix wrong value for all counters enable - afs: Fix memory leak in afs_put_sysnames() - ASoC: core: only convert non DPCM link to DPCM link - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT10-A tablet - ASoC: rt5645: Add platform-data for Asus T101HA - [arm64,armhf] drm/sun4i: hdmi ddc clk: Fix size of m divider - [x86] idt: Keep spurious entries unset in system_vectors - net/filter: Permit reading NET in load_bytes_relative when MAC not set - xdp: Fix xsk_generic_xmit errno - [arm64,armhf] usb/xhci-plat: Set PM runtime as active on resume - usb: host: ehci-platform: add a quirk to avoid stuck - usb/ehci-platform: Set PM runtime as active on resume - perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() - ext4: stop overwrite the errcode in ext4_setup_super - bcache: fix potential deadlock problem in btree_gc_coalesce (CVE-2020-12771) - afs: Fix non-setting of mtime when writing into mmap - afs: afs_write_end() should change i_size under the right lock - block: Fix use-after-free in blkdev_get() - [arm64] hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints - libata: Use per port sync for detach - drm: encoder_slave: fix refcouting error for modules - drm/dp_mst: Reformat drm_dp_check_act_status() a bit - drm/qxl: Use correct notify port address when creating cursor ring - selinux: fix double free - ext4: fix partial cluster initialization when splitting extent - ext4: avoid race conditions when remounting with options that change dax - drm/dp_mst: Increase ACT retry timeout to 3s - block: nr_sects_write(): Disable preemption on seqcount write - mtd: rawnand: Pass a nand_chip object to nand_scan() - mtd: rawnand: Pass a nand_chip object to nand_release() - mtd: rawnand: diskonchip: Fix the probe error path - [armel,armhf] mtd: rawnand: orion: Fix the probe error path - [s390x] fix syscall_get_error for compat processes - [x86] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser - [x86] drm/i915/icl+: Fix hotplug interrupt disabling after storm detection - crypto: algif_skcipher - Cap recv SG list at ctx->used - crypto: algboss - don't wait during notifier callback - kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex - e1000e: Do not wake up the system via WOL if device wakeup is disabled - [mips*] net: octeon: mgmt: Repair filling of RX ring - kretprobe: Prevent triggering kretprobe from within kprobe_flush_task - sched/rt, net: Use CONFIG_PREEMPTION.patch - net: core: device_rename: Use rwsem instead of a seqcount - md: add feature flag MD_FEATURE_RAID0_LAYOUT - [x86] kvm: Move kvm_set_mmio_spte_mask() from x86.c to mmu.c - [x86] kvm: Fix reserved bits related calculation errors caused by MKTME - [x86] KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be generated https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.131 - net: be more gentle about silly gso requests coming from user - block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed - fanotify: fix ignore mask logic for events on child and on dir - [armhf] mtd: rawnand: marvell: Fix the condition on a return code - net: sched: export __netdev_watchdog_up() - [x86] EDAC/amd64: Add Family 17h Model 30h PCI IDs - [arm64,armhf] i2c: tegra: Cleanup kerneldoc comments - [arm64,armhf] i2c: tegra: Add missing kerneldoc for some fields - [arm64,armhf] i2c: tegra: Fix Maximum transfer size - ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 - ALSA: hda/realtek: Enable mute LED on an HP system - ALSA: hda/realtek - Enable micmute LED on and HP system - apparmor: don't try to replace stale label in ptraceme check (Closes: #963493) - [ppc64el] ibmveth: Fix max MTU limit - mld: fix memory leak in ipv6_mc_destroy_dev() - net: bridge: enfore alignment for ethernet address - net: fix memleak in register_netdevice() - net: place xmit recursion in softnet data - net: use correct this_cpu primitive in dev_recursion_level - net: increment xmit_recursion level in dev_direct_xmit() - net: usb: ax88179_178a: fix packet alignment padding - rxrpc: Fix notification call on completion of discarded calls - sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket - tcp: don't ignore ECN CWR on pure ACK - tcp: grow window for OOO packets only for SACK flows - tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes - ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() - net: phy: Check harder for errors in get_phy_id() - ip_tunnel: fix use-after-free in ip_tunnel_lookup() - sch_cake: don't try to reallocate or unshare skb unconditionally - sch_cake: fix a few style nits - tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT - sch_cake: don't call diffserv parsing code when it is not needed - net: Fix the arp error in some cases - net: Do not clear the sock TX queue in sk_set_socket() - net: core: reduce recursion limit value - [arm*] usb: dwc2: Postponed gadget registration to the udc class driver - usb: add USB_QUIRK_DELAY_INIT for Logitech C922 - USB: ehci: reopen solution for Synopsys HC bug - xhci: Poll for U0 after disabling USB2 LPM - [armhf] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() - ALSA: usb-audio: add quirk for Denon DCD-1500RE - ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG) - ALSA: usb-audio: Fix OOB access of mixer element list - [s390x] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action - xhci: Fix incorrect EP_STATE_MASK - xhci: Fix enumeration issue when setting max packet size for FS devices. - xhci: Return if xHCI doesn't support LPM - cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip - loop: replace kill_bdev with invalidate_bdev - IB/mad: Fix use after free when destroying MAD agent - cifs/smb3: Fix data inconsistent when punch hole - cifs/smb3: Fix data inconsistent when zero file range - xfrm: Fix double ESP trailer insertion in IPsec crypto offload. - efi/esrt: Fix reference count leak in esre_create_sysfs_entry. - [armhf] regualtor: pfuze100: correct sw1a/sw2 on pfuze3000 - [armhf] ASoC: fsl_ssi: Fix bclk calculation for mono channel - [armhf] dts: Fix duovero smsc interrupt for suspend - regmap: Fix memory leak from regmap_register_patch - rxrpc: Fix handling of rwind from an ACK packet - RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 - RDMA/cma: Protect bind_list and listen_list while finding matching cm id - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() - net: qed: fix left elements count calculation - net: qed: fix NVMe login fails over VFs - net: qed: fix excessive QM ILT lines consumption - cxgb4: move handling L2T ARP failures to caller - [armhf] imx5: add missing put_device() call in imx_suspend_alloc_ocram() - netfilter: ipset: fix unaligned atomic access - i2c: core: check returned size of emulated smbus block read - sched/deadline: Initialize ->dl_boosted - sched/core: Fix PI boosting between RT and DEADLINE tasks - ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function - net: alx: fix race condition in alx_remove - [s390x] ptrace: fix setting syscall number - [s390x] vdso: fix vDSO clock_getres() - kbuild: improve cc-option to clean up all temporary files - blktrace: break out of blktrace setup on concurrent calls - ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table - ALSA: hda/realtek - Add quirk for MSI GE63 laptop - [x86,arm64] ACPI: sysfs: Fix pm_profile_attr type - [x86] KVM: Fix MSR range of APIC registers in X2APIC mode - [x86] KVM: nVMX: Plumb L2 GPA through to PML emulation - [amd64] x86/asm/64: Align start of __clear_user() loop to 16-bytes - btrfs: fix data block group relocation failure due to concurrent scrub - btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof - mm/slab: use memzero_explicit() in kzfree() - ocfs2: avoid inode removal while nfsd is accessing it - ocfs2: load global_inode_alloc - ocfs2: fix value of OCFS2_INVALID_SLOT - ocfs2: fix panic on nfs server over ocfs2 - [arm64] perf: Report the PC value in REGS_ABI_32 mode - tracing: Fix event trigger to accept redundant spaces - ring-buffer: Zero out time extend if it is nested and not absolute - drm/radeon: fix fb_div check in ni_init_smc_spll_table() - [x86,arm64] Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate() - sunrpc: fixed rollback in rpc_gssd_dummy_populate() - SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() - pNFS/flexfiles: Fix list corruption if the mirror count changes - NFSv4 fix CLOSE not waiting for direct IO compeletion - dm writecache: correct uncommitted_block when discarding uncommitted entry - dm writecache: add cond_resched to loop in persistent_memory_claim() - xfs: add agf freeblocks verify in xfs_agf_verify (CVE-2020-12655) - Revert "tty: hvc: Fix data abort due to race in hvc_open" [ Salvatore Bonaccorso ] * [rt] Add new signing key for Tom Zanussi * nfsd: apply umask on fs without ACL support (Closes: #962254) * [rt] Update to 4.19.120-rt52: - tasklet: Address a race resulting in double-enqueue - hrtimer: fix logic for when grabbing softirq_expiry_lock can be elided * [rt] Update to 4.19.124-rt53 * [rt] Update to 4.19.127-rt55: - fs/dcache: Include swait.h header - mm: slub: Always flush the delayed empty slubs in flush_all() - tasklet: Fix UP case for tasklet CHAINED state * usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect (CVE-2020-15393) [ Ben Hutchings ] * [rt] Update "net: move xmit_recursion to per-task variable on -RT" to apply on top of "net: place xmit recursion in softnet data" * [rt] Drop "net: Add a mutex around devnet_rename_seq", redundant with "net: Introduce net_rwsem to protect net_namespace_list" * [rt] Drop idle task related parts of "sched: Move mmdrop to RCU on RT", redundant with "sched/core: Fix illegal RCU from offline CPUs" * Bump ABI to 10 [ YunQiang Su ] * [mips*]: Do not enable MIPS_O32_FP64_SUPPORT, since golang hasn't been migrated to FPXX yet and this breaks the golang packages on Octeon hardware. In turns this disables MSA on 32-bit kernels. [ Luca Boccassi ] * [cloud] Enable INFINIBAND configs for HyperV/Azure (Closes: #958300) -- Salvatore Bonaccorso Thu, 09 Jul 2020 04:45:56 +0200 linux (4.19.118-2+deb10u1) buster-security; urgency=high [ Salvatore Bonaccorso ] * selinux: properly handle multiple messages in selinux_netlink_send() (CVE-2020-10751) * fs/namespace.c: fix mountpoint reference counter race (CVE-2020-12114) * USB: core: Fix free-while-in-use bug in the USB S-Glibrary (CVE-2020-12464) * [x86] KVM: SVM: Fix potential memory leak in svm_cpu_init() (CVE-2020-12768) * scsi: sg: add sg_remove_request in sg_write (CVE-2020-12770) * USB: gadget: fix illegal array access in binding with UDC (CVE-2020-13143) * netlabel: cope with NULL catmap (CVE-2020-10711) * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (CVE-2020-10732) * kernel/relay.c: handle alloc_percpu returning NULL in relay_open (CVE-2019-19462) * mm: Fix mremap not considering huge pmd devmap (CVE-2020-10757) * [x86] KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01 * KVM: Introduce a new guest mapping API * [arm64] kvm: fix compilation on aarch64 * [s390x] kvm: fix compilation on s390 * [s390x] kvm: fix compile on s390 part 2 * KVM: Properly check if "page" is valid in kvm_vcpu_unmap * [x86] kvm: Introduce kvm_(un)map_gfn() (CVE-2019-3016) * [x86] kvm: Cache gfn to pfn translation (CVE-2019-3016) * [x86] KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed (CVE-2019-3016) * [x86] KVM: Clean up host's steal time structure (CVE-2019-3016) * include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap (Closes: #960271) [ Ben Hutchings ] * propagate_one(): mnt_set_mountpoint() needs mount_lock * [x86] Add support for mitigation of Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543): - x86/cpu: Add 'table' argument to cpu_matches() - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation - x86/speculation: Add SRBDS vulnerability and mitigation documentation - x86/speculation: Add Ivy Bridge to affected list * [x86] speculation: Do not match steppings, to avoid an ABI change -- Salvatore Bonaccorso Sun, 07 Jun 2020 17:42:22 +0200 linux (4.19.118-2) buster; urgency=medium * Merge changes from 4.19.67-2+deb10u2 to include all security fixes from DSA 4667-1. -- Salvatore Bonaccorso Wed, 29 Apr 2020 11:38:41 +0200 linux (4.19.118-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99 - Revert "efi: Fix debugobjects warning on 'efi_rts_work'" - xfs: Sanity check flags of Q_XQUOTARM call - [x86] mfd: intel-lpss: Add default I2C device properties for Gemini Lake - SUNRPC: Fix svcauth_gss_proxy_init() - [powerpc*] pseries: Enable support for ibm,drc-info property - tipc: update mon's self addr when node addr generated - tipc: fix wrong timeout input for tipc_wait_for_cond() - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready - [armhf] crypto: sun4i-ss - fix big endian issues - perf map: No need to adjust the long name of modules - ipmi: Fix memory leak in __ipmi_bmc_register (CVE-2019-19046) - ixgbe: don't clear IPsec sa counters on HW clearing - drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() - iio: fix position relative kernel version - apparmor: Fix network performance issue in aa_label_sk_perm - ALSA: hda: fix unused variable warning - apparmor: don't try to replace stale label in ptrace access check - firmware: coreboot: Let OF core populate platform device - bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER - [arm64] drm/hisilicon: hibmc: Don't overwrite fb helper surface depth - IB/rxe: replace kvfree with vfree - [amd64] IB/hfi1: Add mtu check for operational data VLs - genirq/debugfs: Reinstate full OF path for domain name - [arm64] usb: dwc3: add EXTCON dependency for qcom - cfg80211: regulatory: make initialization more robust - [x86] mei: replace POLL* with EPOLL* for write queues. - [arm64] drm/msm: fix unsigned comparison with less than zero - ALSA: usb-audio: update quirk for B&W PX to remove microphone - iwlwifi: nvm: get num of hw addresses from firmware - netfilter: nft_osf: usage from output path is not valid - [x86] pwm: lpss: Release runtime-pm reference from the driver's remove callback - [powerpc*] pseries/memory-hotplug: Fix return value type of find_aa_index - rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version - netfilter: nf_flow_table: do not remove offload when other netns's interface is down - tipc: eliminate message disordering during binding table update - [arm64] net: socionext: Add dummy PHY register read in phy_write() - [arm64,armhf] drm/sun4i: hdmi: Fix double flag assignation - [arm64] net: hns3: add error handler for hns3_nic_init_vector_data() - pcrypt: use format specifier in kobject_add - [armhf] ASoC: sun8i-codec: add missing route for ADC - [arm64] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins - [armhf] bus: ti-sysc: Add mcasp optional clocks flag - exportfs: fix 'passing zero to ERR_PTR()' warning - net: always initialize pagedlen - net: phy: Fix not to call phy_resume() if PHY is not attached - [amd64] IB/hfi1: Correctly process FECN and BECN in packets - IB/rxe: Fix incorrect cache cleanup in error flow - ipv6: add missing tx timestamping on IPPROTO_RAW - [arm64] net: hns3: fix error handling int the hns3_get_vector_ring_chain - vxlan: changelink: Fix handling of default remotes - fork,memcg: fix crash in free_thread_stack on memcg charge fail - [armhf] clk: highbank: fix refcount leak in hb_clk_init() - [armhf] clk: ti: fix refcount leak in ti_dt_clocks_register() - [armhf] clk: socfpga: fix refcount leak - [armhf] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() - [armhf] clk: imx6q: fix refcount leak in imx6q_clocks_init() - [armhf] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() - [armhf] clk: armada-370: fix refcount leak in a370_clk_init() - [armel] clk: kirkwood: fix refcount leak in kirkwood_clk_init() - [armhf] clk: armada-xp: fix refcount leak in axp_clk_init() - [armhf] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() - [armhf] clk: dove: fix refcount leak in dove_clk_init() - drm: Fix error handling in drm_legacy_addctx - [armhf] drm/etnaviv: fix some off by one bugs - drm/fb-helper: generic: Fix setup error path - fork, memcg: fix cached_stacks case - [amd64] IB/usnic: Fix out of bounds index check in query pkey - RDMA/ocrdma: Fix out of bounds index check in query pkey - RDMA/qedr: Fix out of bounds index check in query pkey - RDMA/iw_cxgb4: Fix the unchecked ep dereference - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 - [armhf] memory: tegra: Don't invoke Tegra30+ specific memory timing setup on Tegra20 - [armhf] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() - kbuild: mark prepare0 as PHONY to fix external module build - crypto: tgr192 - fix unaligned memory access - [armhf] ASoC: imx-sgtl5000: put of nodes if finding codec fails - IB/iser: Pass the correct number of entries for dma mapped SGL - [arm64] net: hns3: fix wrong combined count returned by ethtool -l - IB/mlx5: Don't override existing ip_protocol - rtc: cmos: ignore bogus century byte - [i386] spi/topcliff_pch: Fix potential NULL dereference on allocation error - [arm64] net: hns3: fix bug of ethtool_ops.get_channels for VF - [armhf] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it - iwlwifi: mvm: avoid possible access out of array. - net/mlx5: Take lock with IRQs disabled to avoid deadlock - ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit - iwlwifi: mvm: fix A-MPDU reference assignment - [armhf] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() - [x86] tty: ipwireless: Fix potential NULL pointer dereference - driver: uio: fix possible memory leak in __uio_register_device - driver: uio: fix possible use-after-free in __uio_register_device - driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling - driver core: Avoid careless re-use of existing device links - driver core: Do not resume suppliers under device_links_write_lock() - driver core: Fix handling of runtime PM flags in device_link_add() - driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link() - drm/xen-front: Fix mmap attributes for display buffers - iwlwifi: mvm: fix RSS config command - [mips*] rtc: ds1672: fix unintended sign extension - ath10k: fix dma unmap direction for management frames - net: phy: fixed_phy: Fix fixed_phy not checking GPIO - rtc: ds1307: rx8130: Fix alarm handling - net/smc: original socket family in inet_sock_diag - [arm64] rtc: pm8xxx: fix unintended sign extension - iw_cxgb4: use tos when importing the endpoint - iw_cxgb4: use tos when finding ipv6 routes - xsk: add missing smp_rmb() in xsk_mmap - [armhf] drm/etnaviv: potential NULL dereference - RDMA/mlx5: Fix memory leak in case we fail to add an IB device - driver core: Fix possible supplier PM-usage counter imbalance - [armhf] usb: phy: twl6030-usb: fix possible use-after-free on remove - block: don't use bio->bi_vcnt to figure out segment number - keys: Timestamp new keys - [armhf] net: dsa: b53: Fix default VLAN ID - [armhf] net: dsa: b53: Properly account for VLAN filtering - [armhf] net: dsa: b53: Do not program CPU port's PVID - mt76: usb: fix possible memory leak in mt76u_buf_free - vfio_pci: Enable memory accesses before calling pci_map_rom - mdio_bus: Fix PTR_ERR() usage after initialization to constant - [powerpc*] KVM: Release all hardware TCE tables attached to a group - [x86] staging: r8822be: check kzalloc return or bail - [arm*] dmaengine: mv_xor: Use correct device for DMA API - cdc-wdm: pass return value of recover_from_urb_loss - brcmfmac: create debugfs files for bus-specific layer - net/mlx5: Delete unused FPGA QPN variable - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON - drm/nouveau/pmu: don't print reply values if exec is false - drm/nouveau: fix missing break in switch statement - driver core: Fix PM-runtime for links added during consumer probe - [arm64] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() - [arm64,armhf] net: dsa: fix unintended change of bridge interface STP state - fs/nfs: Fix nfs_parse_devname to not modify it's argument - [x86] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx - [ppc64el] 64s: Fix logic when handling unknown CPU features - NFS: Fix a soft lockup in the delegation recovery code - perf: Copy parent's address filter offsets on clone - perf, pt, coresight: Fix address filters for vmas with non-zero offset - [armhf] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable - [armhf] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization - [x86] platform/x86: wmi: fix potential null pointer dereference - NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount - ath10k: Fix length of wmi tlv command for protected mgmt frames - netfilter: nft_set_hash: fix lookups with fixed size hash on big endian - netfilter: nft_set_hash: bogus element self comparison from deactivation path - net: sched: act_csum: Fix csum calc for tagged packets - [arm*] hwrng: bcm2835 - fix probe as platform device - [amd64] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() - NFS: Add missing encode / decode sequence_maxsz to v4.2 operations - NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() - [amd64] net: aquantia: fixed instack structure overflow - media: dvb/earth-pt1: fix wrong initialization for demod blocks - rbd: clear ->xferred on error from rbd_obj_issue_copyup() - PCI: Fix "try" semantics of bus and slot reset - scsi: megaraid_sas: reduce module load time - xen, cpu_hotplug: Prevent an out of bounds access - net/mlx5: Fix multiple updates of steering rules in parallel - net/mlx5e: IPoIB, Fix RX checksum statistics update - [arm64,armhf] soc: amlogic: gx-socinfo: Add mask for each SoC packages - media: ivtv: update *pos correctly in ivtv_read_pos() - media: cx18: update *pos correctly in cx18_read_pos() - [armhf] media: wl128x: Fix an error code in fm_download_firmware() - media: cx23885: check allocation return - jfs: fix bogus variable self-initialization - [armhf] dts: sun9i: optimus: Fix fixed-regulators - net: phy: don't clear BMCR in genphy_soft_reset - [armhf] OMAP2+: Fix potentially uninitialized return value for _setup_reset() - [arm64,armhf] net: dsa: Avoid null pointer when failing to connect to PHY - media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame - [arm64,armhf] spi: tegra114: clear packed bit for unpacked mode - [arm64,armhf] spi: tegra114: fix for unpacked mode transfers - [arm64,armhf] spi: tegra114: terminate dma and reset on transfer timeout - [arm64,armhf] spi: tegra114: flush fifos - [arm64,armhf] spi: tegra114: configure dma burst size to fifo trig level - [armhf] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated - [arm*] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios - drm/fb-helper: generic: Call drm_client_add() after setup is done - [arm64] vdso: don't leak kernel addresses - rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900 - bpf: Add missed newline in verifier verbose log - [x86] drm/vmwgfx: Remove set but not used variable 'restart' - scsi: qla2xxx: Unregister chrdev if module initialization fails - net/sched: cbs: fix port_rate miscalculation - ACPI: button: reinitialize button state upon resume - [arm64,armhf] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check - rxrpc: Fix detection of out of order acks - scsi: target/core: Fix a race condition in the LUN lookup code - brcmfmac: fix leak of mypkt on error return path - [arm64] net: hns3: fix for vport->bw_limit overflow problem - [x86] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses - perf/core: Fix the address filtering fix - [arm64,armhf] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask - [x86] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer - tipc: set sysctl_tipc_rmem and named_timeout right range - usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs - [arm64] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info() - 6lowpan: Off by one handling ->nexthdr - ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() - afs: Fix AFS file locking to allow fine grained locks - afs: Further fix file locking - NFS: Don't interrupt file writeout due to fatal errors - scsi: qla2xxx: Fix a format specifier - scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd() - scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory - [ppc64el] KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest - netfilter: nft_flow_offload: add entry to flowtable after confirmation - packet: in recvmsg msg_name return at least sizeof sockaddr_ll - ASoC: fix valid stream condition - [arm*] dwc2: gadget: Fix completed transfer size calculation in DDMA - IB/mlx5: Add missing XRC options to QP optional params mask - RDMA/rxe: Consider skb reserve space based on netdev of GID - [amd64] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU - [arm64] dmaengine: tegra210-adma: restore channel status - mmc: core: fix possible use after free of host - ath10k: Fix encoding for protected management frames - afs: Fix the afs.cell and afs.volume xattr handlers - l2tp: Fix possible NULL pointer dereference - [x86] platform/x86: alienware-wmi: printing the wrong error code - netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule - [arm64,armhf] pwm: meson: Consider 128 a valid pre-divider - [arm64,armhf] pwm: meson: Don't disable PWM when setting duty repeatedly - nfp: bpf: fix static check error through tightening shift amount adjustment - netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value - [arm*] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power - EDAC/mc: Fix edac_mc_find() in case no device is found - afs: Fix key leak in afs_release() and afs_evict_inode() - afs: Don't invalidate callback if AFS_VNODE_DIR_VALID not set - afs: Fix lock-wait/callback-break double locking - afs: Fix double inc of vnode->cb_break - [armhf] dts: sun8i-h3: Fix wifi in Beelink X2 DT - [arm64] clk: meson: gxbb: no spread spectrum on mpll0 - [arm64] clk: meson: axg: spread spectrum is on mpll2 - [arm64] dmaengine: tegra210-adma: Fix crash during probe - [arm64] dts: meson: libretech-cc: set eMMC as removable - RDMA/qedr: Fix incorrect device rate. - [x86] crypto: ccp - fix AES CFB error exposed by new test vectors - [x86] crypto: ccp - Fix 3DES complaint from ccp-crypto module - iommu: Add missing new line for dma type - iommu: Use right function to get group for device - signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig - inet: frags: call inet_frags_fini() after unregister_pernet_subsys() - [arm64] net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector - [x86] netvsc: unshare skb in VF rx handler - net: core: support XDP generic on stacked devices. - RDMA/uverbs: check for allocation failure in uapi_add_elm() - net: don't clear sock->sk early to avoid trouble in strparser - [arm64] phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable - [arm64] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register - media: vivid: fix incorrect assignment operation when setting video mode - [arm64] crypto: inside-secure - fix zeroing of the request in ahash_exit_inv - [arm64] crypto: inside-secure - fix queued len computation - mpls: fix warning with multi-label encap - [arm64] dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node - [arm64] dts: meson-gxm-khadas-vim2: fix Bluetooth support - [amd64] iommu/vt-d: Duplicate iommu_resv_region objects per device list - qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state - qed: iWARP - fix uninitialized callback - [powerpc*] cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild - [powerpc*] pseries/mobility: rebuild cacheinfo hierarchy post-migration - bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup - [amd64] IB/hfi1: Handle port down properly in pio - [arm64] drm/msm/mdp5: Fix mdp5_cfg_init error return - net: netem: fix backlog accounting for corrupted GSO frames - net/udp_gso: Allow TX timestamp with UDP GSO - [s390x] net/af_iucv: build proper skbs for HiperTransport - [s390x] net/af_iucv: always register net_device notifier - [armhf] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs - rtc: pcf8563: Fix interrupt trigger method - rtc: pcf8563: Clear event flags and disable interrupts before requesting irq - net/sched: cbs: Fix error path of cbs_module_init - [arm64] drm/msm/a3xx: remove TPL1 regs from snapshot - ip6_fib: Don't discard nodes with valid routing information in fib6_locate_1() - perf/ioctl: Add check for the sample_period value - [x86] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" - tools: bpftool: use correct argument in cgroup errors - fork,memcg: alloc_thread_stack_node needs to set tsk->stack - bnxt_en: Fix ethtool selftest crash under error conditions. - bnxt_en: Suppress error messages when querying DSCP DCB capabilities. - [amd64] iommu: Make iommu_disable safer - [x86] mfd: intel-lpss: Release IDA resources - rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() - xprtrdma: Fix use-after-free in rpcrdma_post_recvs - PM: ACPI/PCI: Resume all devices during hibernation - ACPI: PM: Simplify and fix PM domain hibernation callbacks - ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS - devres: allow const resource arguments - [arm64] RDMA/hns: Fixs hw access invalid dma memory error - ceph: fix "ceph.dir.rctime" vxattr value - xdp: fix possible cq entry leak - scsi: libfc: fix null pointer dereference on a null lport - xfrm interface: ifname may be wrong in logs - [armhf] clk: sunxi-ng: v3s: add the missing PLL_DDR1 - PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() - libertas_tf: Use correct channel range in lbtf_geo_init - qed: reduce maximum stack frame size - usb: host: xhci-hub: fix extra endianness conversion - [x86] crypto: ccp - Reduce maximum stack usage - tipc: reduce risk of wakeup queue starvation - net/mlx5: Fix mlx5_ifc_query_lag_out_bits - cifs: fix rmmod regression in cifs.ko caused by force_sig changes - net: fix bpf_xdp_adjust_head regression for generic-XDP - cxgb4: smt: Add lock for atomic_dec_and_test - ext4: set error return correctly when ext4_htree_store_dirent fails - [arm64] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver - [arm64] RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver - net/rds: Add a few missing rds_stat_names entries - tools: bpftool: fix arguments for p_err() in do_event_pipe() - tools: bpftool: fix format strings and arguments for jsonw_printf() - bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails - signal: Allow cifs and drbd to receive their terminating signals - [ppc64el] 64s/radix: Fix memory hot-unplug page table split - [x86] dmaengine: dw: platform: Switch to acpi_dma_controller_register() - mac80211: minstrel_ht: fix per-group max throughput rate initialization - i40e: reduce stack usage in i40e_set_fc - [armhf] 8896/1: VDSO: Don't leak kernel addresses - [mips*] avoid explicit UB in assignment of mips_io_port_base - media: em28xx: Fix exception handling in em28xx_alloc_urbs() - ahci: Do not export local variable ahci_em_messages - rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up - Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" - hwmon: (lm75) Fix write operations for negative temperatures - net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate - power: supply: Init device wakeup after device_add() - [x86] perf: Fix the dependency of the x86 insn decoder selftest - irqdomain: Add the missing assignment of domain->fwnode for named fwnode - bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA - bcache: Fix an error code in bch_dump_read() - netfilter: ctnetlink: honor IPS_OFFLOAD flag - [arm64] wcn36xx: use dynamic allocation for large variables - xsk: avoid store-tearing when assigning queues - xsk: avoid store-tearing when assigning umem - led: triggers: Fix dereferencing of null pointer - [arm64] net: hns3: fix error VF index when setting VLAN offload - rtlwifi: Fix file release memory leak - f2fs: fix wrong error injection path in inc_valid_block_count() - f2fs: fix error path of f2fs_convert_inline_page() - [x86] scsi: fnic: fix msix interrupt allocation - Btrfs: fix hang when loading existing inode cache off disk - Btrfs: fix inode cache waiters hanging on failure to start caching thread - Btrfs: fix inode cache waiters hanging on path allocation failure - btrfs: use correct count in btrfs_file_write_iter() - ixgbe: sync the first fragment unconditionally - ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet - RDMA/cma: Fix false error message - net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' - bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands - f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() - [powerpc*] mm/mce: Keep irqs disabled during lockless page table walk - bpf: fix BTF limits - [amd64] iommu: Wait for completion of IOTLB flush in attach_device - [amd64] net: aquantia: Fix aq_vec_isr_legacy() return value - cxgb4: Signedness bug in init_one() - [arm64] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() - [arm64] net: netsec: Fix signedness bug in netsec_probe() - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix signedness bug in probe - of: mdio: Fix a signedness bug in of_phy_get_and_connect() - [arm64] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() - net: sched: cbs: Avoid division by zero when calculating the port rate - nvme: retain split access workaround for capability reads - [arm64,armhf] net: stmmac: gmac4+: Not all Unicast addresses may be available - rxrpc: Fix trace-after-put looking at the put connection record - mac80211: accept deauth frames in IBSS mode - llc: fix another potential sk_buff leak in llc_ui_sendmsg() - llc: fix sk_buff refcounting in llc_conn_state_process() - ip6erspan: remove the incorrect mtu limit for ip6erspan - [arm64,armhf] net: stmmac: fix length of PTP clock's name string - [arm64,armhf] net: stmmac: fix disabling flexible PPS output - sctp: add chunks to sk_backlog when the newsk sk_socket is not set - [s390x] qeth: Fix error handling during VNICC initialization - [s390x] qeth: Fix initialization of vnicc cmd masks during set online - act_mirred: Fix mirred_init_module error handling - net: avoid possible false sharing in sk_leave_memory_pressure() - net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head - tcp: annotate lockless access to tcp_memory_pressure - net/smc: receive returns without data - net/smc: receive pending data after RCV_SHUTDOWN - [arm64] drm/msm/dsi: Implement reset correctly - [armhf] dmaengine: imx-sdma: fix size check for sdma script_number - [arm64] hibernate: check pgd table allocation - net: netem: fix error path for corrupted GSO frames - net: netem: correct the parent's backlog when corrupted packet was dropped - xsk: Fix registration of Rx-only sockets - bpf, offload: Unlock on error in bpf_offload_dev_create() - afs: Fix missing timeout reset - [x86] hv_netvsc: Fix offset usage in netvsc_send_table() - [x86] hv_netvsc: Fix send_table offset in case of a host bug - afs: Fix large file support - [armhf] hwrng: omap3-rom - Fix missing clock by probing with device tree - [mips64el,mipsel] Loongson: Fix return value of loongson_hwmon_init - [x86] hv_netvsc: flag software created hash value - net: neigh: use long type to store jiffies delta - packet: fix data-race in fanout_flow_is_huge() - affs: fix a memory leak in affs_remount - afs: Remove set but not used variables 'before', 'after' - [armhf] dmaengine: ti: edma: fix missed failure handling - drm/radeon: fix bad DMA from INTERRUPT_CNTL2 - [arm64] dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.100 - can, slip: Protect tty->disc_data in write_wakeup and close with RCU - [x86] firestream: fix memory leaks - gtp: make sure only SOCK_DGRAM UDP sockets are accepted - ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM - net: ip6_gre: fix moving ip6gre between namespaces - net, ip6_tunnel: fix namespaces move - net, ip_tunnel: fix namespaces move - net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link() - net_sched: fix datalen for ematch - net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject - net-sysfs: fix netdev_queue_add_kobject() breakage - net-sysfs: Call dev_hold always in netdev_queue_add_kobject - net-sysfs: Call dev_hold always in rx_queue_add_kobject - net-sysfs: Fix reference count leak - net: usb: lan78xx: Add .ndo_features_check - Revert "udp: do rmem bulk free even if the rx sk queue is empty" - tcp_bbr: improve arithmetic division in bbr_update_bw() - tcp: do not leave dangling pointers in tp->highest_sack - tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() - afs: Fix characters allowed into cell names - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input - hwmon: (core) Do not use device managed functions for memory allocations - PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken - tracing: trigger: Replace unneeded RCU-list traversals - Input: keyspan-remote - fix control-message timeouts - [x86] Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers" - [arm64,armhf] mmc: tegra: fix SDR50 tuning override - mmc: sdhci: fix minimum clock rate for v3 controller - [arm64] Documentation: Document arm64 kpti control - Input: sur40 - fix interface sanity checks - Input: gtco - fix endpoint sanity check - Input: aiptek - fix endpoint sanity check - Input: pegasus_notetaker - fix endpoint sanity check - [armhf] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register - netfilter: nft_osf: add missing check for DREG attribute - hwmon: (nct7802) Fix voltage limits to wrong registers - do_last(): fetch directory ->i_mode and ->i_uid before it's too late (CVE-2020-8428) - sd: Fix REQ_OP_ZONE_REPORT completion handling - [i386] crypto: geode-aes - switch to skcipher for cbc(aes) fallback - media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func - netfilter: ipset: use bitmap infrastructure completely - netfilter: nf_tables: add __nft_chain_type_get() - mm/memory_hotplug: make remove_memory() take the device_hotplug_lock - mm, sparse: drop pgdat_resize_lock in sparse_add/remove_one_section() - mm, sparse: pass nid instead of pgdat to sparse_add_one_section() - drivers/base/memory.c: remove an unnecessary check on NR_MEM_SECTIONS - mm, memory_hotplug: add nid parameter to arch_remove_memory - mm/memory_hotplug: release memory resource after arch_remove_memory() - drivers/base/memory.c: clean up relics in function parameters - mm, memory_hotplug: update a comment in unregister_memory() - mm/memory_hotplug: make unregister_memory_section() never fail - mm/memory_hotplug: make __remove_section() never fail - [powerpc*] mm: Fix section mismatch warning - mm/memory_hotplug: make __remove_pages() and arch_remove_memory() never fail - [s390x] mm: implement arch_remove_memory() - mm/memory_hotplug: allow arch_remove_memory() without CONFIG_MEMORY_HOTREMOVE - drivers/base/memory: pass a block_id to init_memory_block() - mm/memory_hotplug: create memory block devices after arch_add_memory() - mm/memory_hotplug: remove memory block devices before arch_remove_memory() - mm/memory_hotplug: make unregister_memory_block_under_nodes() never fail - mm/memory_hotplug: remove "zone" parameter from sparse_remove_one_section - mm/hotplug: kill is_dev_zone() usage in __remove_pages() - drivers/base/node.c: simplify unregister_memory_block_under_nodes() - mm/memunmap: don't access uninitialized memmap in memunmap_pages() - mm/memory_hotplug: fix try_offline_node() - mm/memory_hotplug: shrink zones when offlining memory https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.101 - orinoco_usb: fix interface sanity check - rsi_91x_usb: fix interface sanity check - USB: serial: ir-usb: add missing endpoint sanity check - USB: serial: ir-usb: fix link-speed handling - USB: serial: ir-usb: fix IrLAP framing - [arm64,armhf] usb: dwc3: turn off VBUS when leaving host mode - staging: wlan-ng: ensure error return is actually returned - [x86] staging: vt6656: correct packet types for CTS protect, mode. - [x86] staging: vt6656: use NULLFUCTION stack on mac80211 - [x86] staging: vt6656: Fix false Tx excessive retries reporting. - [arm64,armel] serial: 8250_bcm2835aux: Fix line mismatch on driver unbind - component: do not dereference opaque pointer in debugfs - [x86] mei: me: add comet point (lake) H device ids - crypto: chelsio - fix writing tfm flags to wrong place - cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() - ath9k: fix storage endpoint lookup - brcmfmac: fix interface sanity check - rtl8xxxu: fix interface sanity check - zd1211rw: fix storage endpoint lookup - net_sched: ematch: reject invalid TCF_EM_SIMPLE - net_sched: fix ops->bind_class() implementations - HID: multitouch: Add LG MELF0410 I2C touchscreen support - HID: Add quirk for Xin-Mo Dual Controller - HID: ite: Add USB id match for Acer SW5-012 keyboard dock - [x86] HID: Add quirk for incorrect input length on Lenovo Y720 - drivers/hid/hid-multitouch.c: fix a possible null pointer access. - [arm64] phy: qcom-qmp: Increase PHY ready timeout - drivers/net/b44: Change to non-atomic bit operations on pwol_mask - [i386] net: wan: sdla: Fix cast from pointer to integer of different size - [arm64] gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP - atm: eni: fix uninitialized variable warning - HID: steam: Fix input device disappearing - [x86] platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx - [amd64] PCI: Add DMA alias quirk for Intel VCA NTB - [amd64] iommu: Support multiple PCI DMA aliases in IRQ Remapping - usb-storage: Disable UAS on JMicron SATA enclosure - sched/fair: Add tmp_alone_branch assertion - sched/fair: Fix insertion in rq->leaf_cfs_rq_list - rsi: fix use-after-free on probe errors - rsi: fix memory leak on failed URB submission - rsi: fix non-atomic allocation in completion handler - crypto: af_alg - Use bh_lock_sock in sk_destruct - block: cleanup __blkdev_issue_discard() - block: fix 32 bit overflow in __blkdev_issue_discard() - [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.102 - vfs: fix do_last() regression - crypto: pcrypt - Fix user-after-free on module unload - perf c2c: Fix return type for histogram sorting comparision functions - PM / devfreq: Add new name attribute for sysfs - tools lib: Fix builds when glibc contains strlcpy() - ext4: validate the debug_want_extra_isize mount option at parse time - mm/mempolicy.c: fix out of bounds write in mpol_parse_str() - reiserfs: Fix memory leak of journal device string - media: digitv: don't continue if remote control state can't be read - media: af9005: uninitialized variable printked - media: vp7045: do not read uninitialized values if usb transfer fails - media: gspca: zero usb_buf - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 - tomoyo: Use atomic_t for statistics counter - ttyprintk: fix a potential deadlock in interrupt context issue - Bluetooth: Fix race condition in hci_release_sock() - cgroup: Prevent double killing of css when enabling threaded cgroup - [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity - [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes - [armhf] dts: beagle-x15-common: Model 5V0 regulator - [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order - mac80211: mesh: restrict airtime metric to peered established plinks - ASoC: rt5640: Fix NULL dereference on module unload - ixgbevf: Remove limit of 10 entries for unicast filter list - ixgbe: Fix calculation of queue with VFs and flow director on interface flap - igb: Fix SGMII SFP module discovery for 100FX/LX. - [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits - qmi_wwan: Add support for Quectel RM500Q - wireless: fix enabling channel 12 for custom regulatory domain - cfg80211: Fix radar event during another phy CAC - mac80211: Fix TKIP replay protection immediately after key setup - netfilter: nft_tunnel: ERSPAN_VERSION must not be null - [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec - bnxt_en: Fix ipv6 RFS filter matching logic. - iwlwifi: Don't ignore the cap field upon mcc update - [armhf] dts: am335x-boneblack-common: fix memory size - vti[6]: fix packet tx through bpf_redirect() - xfrm interface: fix packet tx through bpf_redirect() - xfrm: interface: do not confirm neighbor when do pmtu update - scsi: fnic: do not queue commands during fwreset - [armhf] 8955/1: virt: Relax arch timer version check during early boot - [arm64] tee: optee: Fix compilation issue with nommu - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE - r8152: get default setting of WOL before initializing - qlcnic: Fix CPU soft lockup while collecting firmware dump - seq_tab_next() should increase position index - l2t_seq_next should increase position index - net: Fix skb->csum update in inet_proto_csum_replace16(). - btrfs: do not zero f_bavail if we have available space - perf report: Fix no libunwind compiled warning break s390 issue - mm/migrate.c: also overwrite error when it is bigger than zero https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.103 - [armhf] Revert "drm/sun4i: dsi: Change the start delay calculation" - ovl: fix lseek overflow on 32bit - kernel/module: Fix memleak in module_add_modinfo_attrs() - media: iguanair: fix endpoint sanity check - ocfs2: fix oops when writing cloned file - [x86] cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR - udf: Allow writing to 'Rewritable' partitions - printk: fix exclusive_console replaying - iwlwifi: mvm: fix NVM check for 3168 devices - gtp: use __GFP_NOWARN to avoid memalloc warning - l2tp: Allow duplicate session creation with UDP - net_sched: fix an OOB access in cls_tcindex - [arm64,armhf] net: stmmac: Delete txtimer in suspend() - bnxt_en: Fix TC queue mapping. - tcp: clear tp->total_retrans in tcp_disconnect() - tcp: clear tp->delivered in tcp_disconnect() - tcp: clear tp->data_segs{in|out} in tcp_disconnect() - tcp: clear tp->segs_{in|out} in tcp_disconnect() - rxrpc: Fix use-after-free in rxrpc_put_local() - rxrpc: Fix insufficient receive notification generation - rxrpc: Fix missing active use pinning of rxrpc_local object - rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors - ipc/msg.c: consolidate all xxxctl_down() functions - tracing: Fix sched switch start/stop refcount racy updates - rcu: Avoid data-race in rcu_gp_fqs_check_wake() - brcmfmac: Fix memory leak in brcmf_usbdev_qinit - usb: gadget: f_ncm: Use atomic_t to track in-flight request - usb: gadget: f_ecm: Use atomic_t to track in-flight request - ALSA: usb-audio: Fix endianess in descriptor validation - ALSA: dummy: Fix PCM format loop in proc output - mm/memory_hotplug: fix remove_memory() lockdep splat - mm: move_pages: report the number of non-attempted pages - media/v4l2-core: set pages dirty upon releasing DMA buffers - media: v4l2-core: compat: ignore native command codes - media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments - irqdomain: Fix a memory leak in irq_domain_push_irq() - [x86] platform/x86: intel_scu_ipc: Fix interrupt support - [x86] ALSA: hda: Add Clevo W65_67SB the power_save blacklist - [arm64] KVM: Correct PSTATE on exception entry - [arm64,armhf] KVM: Correct CPSR on exception entry - [arm64,armhf] KVM: Correct AArch32 SPSR on exception entry - [arm64] KVM: Only sign-extend MMIO up to register width - [s390x] mm: fix dynamic pagetable upgrade for hugetlbfs - [powerpc*] pseries: Advance pfn if section is not present in lmb_is_removable() - smb3: fix signing verification of large reads - [arm64,armhf] PCI: tegra: Fix return value check of pm_runtime_get_sync() - [arm64,armhf] mmc: spi: Toggle SPI polarity, do not hardcode it - [x86] ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards - [x86] ACPI / battery: Deal with design or full capacity being reported as -1 - [x86] ACPI / battery: Use design-cap for capacity calculations if full-cap is not available - [x86] ACPI / battery: Deal better with neither design nor full capacity not being reported - alarmtimer: Unregister wakeup source when module get fails - ubifs: Reject unsupported ioctl flags explicitly - ubifs: don't trigger assertion on invalid no-key filename - ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag - ubifs: Fix deadlock in concurrent bulk-read and writepage - [i386] crypto: geode-aes - convert to skcipher API and make thread-safe - [x86] hv_balloon: Balloon up according to request page number - mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile - crypto: api - Check spawn->alg under lock in crypto_drop_spawn - scsi: qla2xxx: Fix mtcp dump collection failure - ovl: fix wrong WARN_ON() in ovl_cache_update_ino() - f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() - f2fs: fix miscounted block limit in f2fs_statfs_project() - f2fs: code cleanup for f2fs_statfs_project() - PM: core: Fix handling of devices deleted during system-wide resume - dm zoned: support zone sizes smaller than 128MiB - dm space map common: fix to ensure new block isn't already in use - dm crypt: fix benbi IV constructor crash if used in authenticated mode - dm: fix potential for q->make_request_fn NULL pointer - dm writecache: fix incorrect flush sequence when doing SSD mode commit - padata: Remove broken queue flushing - tracing: Annotate ftrace_graph_hash pointer with __rcu - tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu - ftrace: Add comment to why rcu_dereference_sched() is open coded - ftrace: Protect ftrace_graph_hash with ftrace_sync - [x86] crypto: ccp - set max RSA modulus size for v3 platform devices as well - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request - crypto: api - Fix race condition in crypto_spawn_alg - scsi: qla2xxx: Fix unbound NVME response length - NFS: Fix memory leaks and corruption in readdir - NFS: Directory page cache pages need to be locked when read - jbd2_seq_info_next should increase position index - Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES - btrfs: set trans->drity in btrfs_commit_transaction - Btrfs: fix race between adding and putting tree mod seq elements and nodes - [armhf] tegra: Enable PLLP bypass during Tegra124 LP1 - iwlwifi: don't throw error when trying to remove IGTK - mwifiex: fix unbalanced locking in mwifiex_process_country_ie() - sunrpc: expiry_time should be seconds not timeval - gfs2: move setting current->backing_dev_info - gfs2: fix O_SYNC write handling - drm/rect: Avoid division by zero - media: rc: ensure lirc is initialized before registering input device - xen/balloon: Support xend-based toolstack take two - watchdog: fix UAF in reboot notifier handling in watchdog core code - bcache: add readahead cache policy options via sysfs interface - eventfd: track eventfd_signal() recursion depth - aio: prevent potential eventfd recursion on poll - [x86] KVM: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks - [x86] KVM: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks - [x86] KVM: Protect pmu_intel.c from Spectre-v1/L1TF attacks - [x86] KVM: Protect DR-based index computations from Spectre-v1/L1TF attacks - [x86] KVM: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks - [x86] KVM: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks - [x86] KVM: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks - [x86] KVM: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks - [x86] KVM: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks - [x86] KVM: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c - [x86] KVM: Protect x86_decode_insn from Spectre-v1/L1TF attacks - [x86] KVM: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks - [x86] KVM: Fix potential put_fpu() w/o load_fpu() on MPX platform - [ppc64el] KVM: Book3S HV: Uninit vCPU if vcore creation fails - [ppc64el] KVM: Book3S PR: Free shared page if mmu initialization fails - [x86] kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit (CVE-2019-3016) - [x86] KVM: Don't let userspace set host-reserved cr4 bits - [x86] KVM: Free wbinvd_dirty_mask if vCPU creation fails - [s390x] KVM: do not clobber registers during guest reset/store status - [arm64,armhf] clk: tegra: Mark fuse clock as critical - percpu: Separate decrypted varaibles anytime encryption can be enabled - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type - scsi: csiostor: Adjust indentation in csio_device_reset - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free - scsi: ufs: Recheck bkops level if bkops is disabled - [arm64] phy: qualcomm: Adjust indentation in read_poll_timeout - ext2: Adjust indentation in ext2_fill_super - [arm64] drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable - IB/mlx5: Fix outstanding_pi index for GSI qps - IB/core: Fix ODP get user pages flow - nfsd: fix delay timer on 32-bit architectures - nfsd: fix jiffies/time_t mixup in LRU list - nfsd: Return the correct number of bytes written to the file - ubi: fastmap: Fix inverted logic in seen selfcheck - ubi: Fix an error pointer dereference in error handling code - bonding/alb: properly access headers in bond_alb_xmit() - [armhf] net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port - [arm64,armhf] net: mvneta: move rx_dropped and rx_errors in per-cpu stats - net_sched: fix a resource leak in tcindex_set_parms() - net/mlx5: IPsec, Fix esp modify function attribute - net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx - [arm64] net: macb: Remove unnecessary alignment check for TSO - [arm64] net: macb: Limit maximum GEM TX length in TSO - [armhf] net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan() - ext4: fix deadlock allocating crypto bounce page from mempool - btrfs: use bool argument in free_root_pointers() - btrfs: free block groups after free'ing fs trees - btrfs: flush write bio if we loop in extent_write_cache_pages - [x86] KVM: mmu: Apply max PA check for MMIO sptes to 32-bit KVM - [x86] KVM: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM - [x86] KVM: nVMX: vmread should not set rflags to specify success in case of #PF - KVM: Use vcpu-specific gva->hva translation when querying host page size - KVM: Play nice with read-only memslots when querying host page size - mm: zero remaining unavailable struct pages - mm: return zero_resv_unavail optimization - mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section - cifs: fail i/o on soft mounts if sessionsetup errors out - [x86] apic/msi: Plug non-maskable MSI affinity race - clocksource: Prevent double add_timer_on() for watchdog_timer - perf/core: Fix mlock accounting in perf_mmap() - rxrpc: Fix service call disconnection https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.104 - ASoC: pcm: update FE/BE trigger order based on the command - [x86] hv_sock: Remove the accept port restriction - IB/mlx4: Fix memory leak in add_gid error flow - RDMA/netlink: Do not always generate an ACK for some netlink operations - RDMA/core: Fix locking in ib_uverbs_event_read - scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails - PCI/IOV: Fix memory leak in pci_iov_add_virtfn() - ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe - PCI: Don't disable bridge BARs when assigning bus resources - nfs: NFS_SWAP should depend on SWAP - NFS: Revalidate the file size on a fatal write error - NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes() - NFSv4: try lease recovery on NFS4ERR_EXPIRED - [arm64] serial: uartps: Add a timeout to the tx empty wait - [arm64] gpio: zynq: Report gpio direction at boot - spi: spi-mem: Add extra sanity checks on the op param - spi: spi-mem: Fix inverted logic in op sanity check - rtc: cmos: Stop using shared IRQ - [x86] platform/x86: intel_mid_powerbtn: Take a copy of ddata - [powerpc*] pseries/vio: Fix iommu_table use-after-free refcount warning - [powerpc*] pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW - [arm64] iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA - [arm64,armhf] KVM: vgic-its: Fix restoration of unmapped collections - [armel,armhf] 8949/1: mm: mark free_memmap as __init - [arm64] cpufeature: Fix the type of no FP/SIMD capability - [arm64] ptrace: nofpsimd: Fail FP/SIMD regset operations - [arm64,armhf] KVM: Fix young bit from mmu notifier - [arm64,armhf] KVM: Fix DFSR setting for non-LPAE aarch32 guests - [arm64,armhf] KVM: Make inject_abt32() inject an external abort instead - [arm64] KVM: pmu: Don't increment SW_INCR if PMCR.E is unset - mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock - mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() - mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() - libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held - libertas: make lbs_ibss_join_existing() return error code on rates overflow - scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state - [x86] stackframe: Move ENCODE_FRAME_POINTER to asm/frame.h - [x86] x86/stackframe, x86/ftrace: Add pt_regs frame annotations - [arm64] serial: uartps: Move the spinlock after the read of the tx empty - padata: fix null pointer deref of pd->pinst https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.105 - Input: synaptics - switch T470s to RMI4 by default - Input: synaptics - enable SMBus on ThinkPad L470 - Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list - ALSA: usb-audio: Fix UAC2/3 effect unit parsing - ALSA: hda/realtek - Fix silent output on MSI-GL73 - ALSA: usb-audio: Apply sample rate quirk for Audioengine D1 - [arm64] cpufeature: Set the FP/SIMD compat HWCAP bits properly - [arm64] nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly - ALSA: usb-audio: sound: usb: usb true/false for bool return type - ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 - ext4: don't assume that mmp_nodename/bdevname have NUL - ext4: fix support for inode sizes > 1024 bytes - ext4: fix checksum errors with indexed dirs - ext4: add cond_resched() to ext4_protect_reserved_inode (CVE-2020-8992) - ext4: improve explanation of a mount failure caused by a misconfigured kernel - Btrfs: fix race between using extent maps and merging them - btrfs: ref-verify: fix memory leaks - btrfs: print message when tree-log replay starts - btrfs: log message when rw remount is attempted with unclean tree-log - [arm64] ssbs: Fix context-switch when SSBS is present on all CPUs - [x86] perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map - nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info - [amd64] IB/hfi1: Acquire lock to release TID entries when user file is closed - [amd64] IB/hfi1: Close window for pq and request coliding - IB/rdmavt: Reset all QPs when the device is shut down - RDMA/core: Fix invalid memory access in spec_filter_size - [amd64] RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create - RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq - RDMA/core: Fix protection fault in get_pkey_idx_qp_list - [s390x] time: Fix clk type in get_tod_clock - [x86] perf/x86/intel: Fix inaccurate period in context switch for auto- reload - NFSv4.1 make cachethis=no for writes - jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() - jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer - [x86] KVM: mmu: Fix struct guest_walker arrays for 5-level paging https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.106 - core: Don't skip generic XDP program execution for cloned SKBs - enic: prevent waking up stopped tx queues over watchdog reset - net/smc: fix leak of kernel memory to user space - net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS - net/sched: flower: add missing validation of TCA_FLOWER_FLAGS - [x86] KVM: nVMX: Use correct root level for nested EPT shadow page tables - [x86] drm/gma500: Fixup fbdev stolen size usage evaluation - cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order - brcmfmac: Fix use after free in brcmf_sdio_readframes() - ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT - ALSA: ctl: allow TLV read operation for callback type of element in locked case - [powerpc*] powernv/iov: Ensure the pdn for VFs always contains a valid PE number - [amd64] iommu/vt-d: Fix off-by-one in PASID allocation - [x86] pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins - [x86] efi: Map the entire EFI vendor string before copying it - [mips64el,mipsel] Loongson: Fix potential NULL dereference in loongson3_platform_init() - [arm*] usb: dwc2: Fix IN FIFO allocation - [armel,armhf] clocksource/drivers/bcm2835_timer: Fix memory leak of timer - jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal - [armhf] pwm: omap-dmtimer: Simplify error handling - [s390x] pci: Fix possible deadlock in recover_store() - [powerpc*] iov: Move VF pdev fixup into pcibios_fixup_iov() - tracing: Fix tracing_stat return values in error handling paths - tracing: Fix very unlikely race of registering two stat tracers - ext4, jbd2: ensure panic when aborting with zero errno - ath10k: Correct the DMA direction for management tx buffers - nbd: add a flush_workqueue in nbd_start_device - [s390x] KVM: ENOTSUPP -> EOPNOTSUPP fixups - [arm64] clk: qcom: rcg2: Don't crash if our parent can't be found; return an error - drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table - [arm64,armhf] regulator: rk808: Lower log level on optional GPIOs being not available - NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu(). - selinux: fall back to ref-walk if audit is required - selinux: ensure we cleanup the internal AVC counters on error in avc_insert() - media: cx23885: Add support for AVerMedia CE310B - PCI: Add generic quirk for increasing D3hot delay - PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers - media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros - reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling - fore200e: Fix incorrect checks of NULL pointer dereference - netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy - ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status - orinoco: avoid assertion in case of NULL pointer - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 - scsi: ufs: Complete pending requests in host reset and restore path - scsi: aic7xxx: Adjust indentation in ahc_find_syncrate - selinux: ensure we cleanup the internal AVC counters on error in avc_update() - dmaengine: Store module owner in dma_device struct - [arm64] clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock - tools lib api fs: Fix gcc9 stringop-truncation compilation error - [x86] ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch - mlx5: work around high stack usage with gcc - drm: remove the newline for CRC source name. - usbip: Fix unsafe unaligned pointer usage - udf: Fix free space reporting for metadata and virtual partitions - staging: rtl8188: avoid excessive stack usage - [amd64] IB/hfi1: Add software counter for ctxt0 seq drop - [armhf] soc/tegra: fuse: Correct straps' address for older Tegra124 device trees - [x86] efi: Don't panic or BUG() on non-critical error conditions - rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls - [x86] nmi: Remove irq_work from the long duration NMI handler - driver core: platform: Prevent resouce overflow from causing infinite loops - driver core: Print device when resources present in really_probe() - bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map - drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new() - drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fw - drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler - drm/nouveau/fault/gv100-: fix memory leak on module unload - [x86] drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add - [armhf] usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue - [arm64] iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE - f2fs: set I_LINKABLE early to avoid wrong access by vfs - f2fs: free sysfs kobject - scsi: iscsi: Don't destroy session if there are outstanding connections - watchdog/softlockup: Enforce that timestamp is valid on boot - f2fs: fix memleak of kobject - [x86] mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd - [armhf] pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional - btrfs: fix possible NULL-pointer dereference in integrity checks - btrfs: safely advance counter when looking up bio csums - btrfs: device stats, log when stats are zeroed - module: avoid setting info->name early in case we can fall back to info->mod->name - ALSA: hda/hdmi - add retry logic to parse_intel_hdmi() - driver core: platform: fix u32 greater or equal to zero comparison - ALSA: hda - Add docking station support for Lenovo Thinkpad T420s - drm/nouveau/mmu: fix comptag memory leak - [powerpc*] sriov: Remove VF eeh_dev state when disabling SR-IOV - bcache: cached_dev_free needs to put the sb page - [amd64] iommu/vt-d: Remove unnecessary WARN_ON_ONCE() - jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record - jbd2: make sure ESHUTDOWN to be recorded in the journal superblock - iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop - cifs: fix NULL dereference in match_prepath - bpf: map_seq_next should always increase position index - ceph: check availability of mds cluster on mount after wait timeout - [arm64,armhf] irqchip/gic-v3: Only provision redistributors that are enabled in ACPI - drm/nouveau/disp/nv50-: prevent oops when no channel method map provided - ftrace: fpid_next() should increase position index - trigger_next should increase position index - radeon: insert 10ms sleep in dce5_crtc_load_lut - ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans() - reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() - bcache: explicity type cast in bset_bkey_last() - [arm64,armhf] irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL - iwlwifi: mvm: Fix thermal zone registration - brd: check and limit max_part par - NFS: Fix memory leaks - help_next should increase position index - cifs: log warning message (once) if out of disk space - virtio_balloon: prevent pfn array overflow https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.107 - [arm64] iommu/qcom: Fix bogus detach logic - ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs - [x86] ALSA: hda/realtek - Apply quirk for MSI GP63, too - [x86] ALSA: hda/realtek - Apply quirk for yet another MSI laptop - [armhf] ASoC: sun8i-codec: Fix setting DAI data format - ecryptfs: fix a memory leak bug in parse_tag_1_packet() - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() - [x86] thunderbolt: Prevent crash if non-active NVMem file is read - USB: misc: iowarrior: add support for 2 OEMed devices - USB: misc: iowarrior: add support for the 28 and 28L devices - USB: misc: iowarrior: add support for the 100 device - floppy: check FDC index for errors before assigning it (CVE-2020-9383) - vt: fix scrollback flushing on background consoles - vt: selection, handle pending signals in paste_selection - vt: vt_ioctl: fix race in VT_RESIZEX - [arm*] staging: android: ashmem: Disallow ashmem memory from being remapped (CVE-2020-0009) - [x86] staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. - xhci: Force Maximum Packet size for Full-speed bulk devices to valid range. - xhci: fix runtime pm enabling for quirky Intel hosts - xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2 - usb: host: xhci: update event ring dequeue pointer on purpose - USB: core: add endpoint-blacklist quirk - USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 - usb: uas: fix a plug & unplug racing - USB: Fix novation SourceControl XL after suspend - USB: hub: Don't record a connect-change event during reset-resume - USB: hub: Fix the broken detection of USB3 device in SMSC hub - [arm*] usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows - [arm64,armhf] usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields - staging: rtl8188eu: Fix potential security hole - staging: rtl8188eu: Fix potential overuse of kernel memory - staging: rtl8723bs: Fix potential security hole - staging: rtl8723bs: Fix potential overuse of kernel memory - [powerpc*] tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery - jbd2: fix ocfs2 corrupt when clearing block group bits - [x86] mce/amd: Publish the bank pointer only after setup has succeeded - [x86] mce/amd: Fix kobject lifetime - [x86] cpu/amd: Enable the fixed Instructions Retired counter IRPERF - serial: 8250: Check UPF_IRQ_SHARED in advance - [armhf] tty: serial: imx: setup the correct sg entry for tx dma - serdev: ttyport: restore client ops on deregistration - Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" - mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps() - nvme-multipath: Fix memory leak with ana_log_buf - genirq/irqdomain: Make sure all irq domain flags are distinct - mm/vmscan.c: don't round up scan size for online memory cgroup - drm/amdgpu/soc15: fix xclk for raven - [x86] xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms - [x86] KVM: nVMX: Don't emulate instructions in guest mode (CVE-2020-2732) - [x86] KVM: don't notify userspace IOAPIC on edge-triggered interrupt EOI - drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets - ext4: fix a data race in EXT4_I(inode)->i_disksize - ext4: add cond_resched() to __ext4_find_entry() - ext4: fix potential race between online resizing and write operations - ext4: fix potential race between s_group_info online resizing and access - ext4: fix potential race between s_flex_groups online resizing and access - ext4: fix mount failure with quota configured as module - ext4: rename s_journal_flag_rwsem to s_writepages_rwsem - ext4: fix race between writepages and enabling EXT4_EXTENTS_FL - [x86] KVM: nVMX: Refactor IO bitmap checks into helper function - [x86] KVM: nVMX: Check IO instruction VM-exit conditions - [x86] KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1 - [x86] KVM: apic: avoid calculating pending eoi from an uninitialized val - btrfs: fix bytes_may_use underflow in prealloc error condtition - btrfs: reset fs_root to NULL on error in open_ctree - btrfs: do not check delayed items are empty for single transaction cleanup - Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents - scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session" - usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus - [arm*] usb: dwc2: Fix in ISOC request length checking - staging: rtl8723bs: fix copy of overlapping memory - ecryptfs: replace BUG_ON with error handling code - genirq/proc: Reject invalid affinity masks (again) - bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill - ALSA: seq: Avoid concurrent access to queue flags - ALSA: seq: Fix concurrent access to queue current tick/time - netfilter: xt_hashlimit: limit the max size of hashtable - rxrpc: Fix call RCU cleanup using non-bh-safe locks - ata: ahci: Add shutdown to freeze hardware resources of ahci - xen: Enable interrupts when calling _cond_resched() - [s390x] mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.108 - [arm64,armhf] irqchip/gic-v3-its: Fix misuse of GENMASK macro - iwlwifi: pcie: fix rb_allocator workqueue allocation - ipmi:ssif: Handle a possible NULL pointer reference - [arm64] drm/msm: Set dma maximum segment size for mdss - dax: pass NOWAIT flag to iomap_apply - mac80211: consider more elements in parsing CRC - cfg80211: check wiphy driver existence for drvinfo report - [s390x] zcrypt: fix card and queue total counter wrap - qmi_wwan: re-add DW5821e pre-production variant - qmi_wwan: unconditionally reject 2 ep interfaces - [arm64] soc/tegra: fuse: Fix build with Tegra194 configuration - net: ena: fix potential crash when rxfh key is NULL - net: ena: fix uses of round_jiffies() - net: ena: add missing ethtool TX timestamping indication - net: ena: fix incorrect default RSS key - net: ena: rss: fix failure to get indirection table - net: ena: rss: store hash function as values and not bits - net: ena: fix incorrectly saving queue numbers when setting RSS indirection table - net: ena: ethtool: use correct value for crc32 hash - net: ena: ena-com.c: prevent NULL pointer dereference - cifs: Fix mode output in debugging statements - cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE - sysrq: Restore original console_loglevel when sysrq disabled - sysrq: Remove duplicated sysrq message - net: fib_rules: Correctly set table field when table number exceeds 8 bits - net: sched: correct flower port blocking - sctp: move the format error check out of __sctp_sf_do_9_1_abort - ipv6: Fix route replacement with dev-only route - ipv6: Fix nlmsg_flags when splitting a multipath route - qede: Fix race between rdma destroy workqueue and link change event - ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() - audit: fix error handling in audit_data_to_entry() - ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro - [arm64,x86] ACPI: watchdog: Fix gas->access_width usage - [x86] KVM: VMX: check descriptor table exits on instruction emulation - HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock - HID: core: fix off-by-one memset in hid_report_raw_event() - HID: core: increase HID report buffer size to 8KiB - tracing: Disable trace_printk() on post poned tests - Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" - amdgpu/gmc_v9: save/restore sdpif regs during S3 - vhost: Check docket sk_family instead of call getname (CVE-2020-10942) - HID: alps: Fix an error handling path in 'alps_input_configured()' - HID: hiddev: Fix race in in hiddev_disconnect() - [x86] hv_netvsc: Fix unwanted wakeup in netvsc_attach() - [s390x] qeth: vnicc Fix EOPNOTSUPP precedence - net: netlink: cap max groups which will be considered in netlink_bind() - [amd64] net: atlantic: fix use after free kasan warn - [amd64] net: atlantic: fix potential error handling - net/smc: no peer ID in CLC decline for SMCD - net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE - namei: only return -ECHILD from follow_dotdot_rcu() - mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame() - [x86] KVM: SVM: Override default MMIO mask if memory encryption is enabled - KVM: Check for a bad hva before dropping into the ghc slow path - sched/fair: Optimize update_blocked_averages() - sched/fair: Fix O(nr_cgroups) in the load balancing path - perf stat: Use perf_evsel__is_clocki() for clock events - perf stat: Fix shadow stats for clock events - [arm64] drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()' - kprobes: Set unoptimized flag after unoptimizing code - [armhf] pwm: omap-dmtimer: put_device() after of_find_device_by_node() - perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc - [x86] KVM: Remove spurious kvm_mmu_unload() from vcpu destruction path - [x86] KVM: Remove spurious clearing of async #PF MSR - netfilter: nft_tunnel: no need to call htons() when dumping ports - mm/huge_memory.c: use head to check huge zero page - mm, thp: fix defrag setting if newline is not used - audit: always check the netlink payload length in audit_receive_msg() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.109 - [x86] EDAC/amd64: Set grain per DIMM - ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 - [armhf] net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec - kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic - [x86] ALSA: hda: do not override bus codec_mask in link_get() - usb: gadget: composite: Support more than 500mA MaxPower - usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags - usb: gadget: serial: fix Tx stall after buffer overflow - [arm64] drm/msm/mdp5: rate limit pp done timeout warnings - [arm64] drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI - scsi: megaraid_sas: silence a warning - [arm64] drm/msm/dsi: save pll state before dsi host is powered off - [arm64] drm/msm/dsi/pll: call vco set rate explicitly - [armhf] net: dsa: b53: Ensure the default VID is untagged - [s390x] cio: cio_ignore_proc_seq_next should increase position index - [s390x] qdio: fill SL with absolute addresses - ice: Don't tell the OS that link is going down - [arm64] net: thunderx: workaround BGX TX Underflow issue - ALSA: hda/realtek - Add Headset Mic supported - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master - cifs: don't leak -EAGAIN for stat() during reconnect - usb: storage: Add quirk for Samsung Fit flash - usb: quirks: add NO_LPM quirk for Logitech Screen Share - [arm64,armhf] usb: dwc3: gadget: Update chain bit correctly when using sg list - usb: core: hub: fix unhandled return by employing a void function - usb: core: hub: do error out if usb_autopm_get_interface() fails - usb: core: port: do error out if usb_autopm_get_interface() fails - vgacon: Fix a UAF in vgacon_invert_region (CVE-2020-8647, CVE-2020-8649) - mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa - mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() - fat: fix uninit-memory access for partial initialized inode - [arm64] tty:serial:mvebu-uart:fix a wrong return - serial: 8250_exar: add support for ACCES cards - vt: selection, close sel_buffer race (CVE-2020-8648) - vt: selection, push console lock down - vt: selection, push sel_lock up - [arm64,armhf] media: v4l2-mem2mem.c: fix broken links - [x86] pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes - [arm64,armhf] dmaengine: tegra-apb: Fix use-after-free - [arm64,armhf] dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list - dm cache: fix a crash due to incorrect work item cancelling - dm: report suspended device during destroy - dm writecache: verify watermark during resume - [x86] ASoC: topology: Fix memleak in soc_tplg_link_elems_load() - [x86] ASoC: topology: Fix memleak in soc_tplg_manifest_load() - [x86] ASoC: intel: skl: Fix pin debug prints - [x86] ASoC: intel: skl: Fix possible buffer overflow in debug outputs - [armhf] dmaengine: imx-sdma: remove dma_slave_config direction usage and leave sdma_event_enable() - ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output - ASoC: dapm: Correct DAPM handling of active widgets during shutdown - [armhf] drm/sun4i: Fix DE2 VI layer format support - [armhf] drm/sun4i: de2/de3: Remove unsupported VI layer formats - RDMA/iwcm: Fix iwcm work deallocation - RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() - [amd64] IB/hfi1, qib: Ensure RCU is locked when accessing list - [armhf] ARM: imx: build v7_cpu_resume() unconditionally - hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() - [powerpc*] fix hardware PMU exception bug on PowerVM compatibility mode systems - [amd64] efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper - [amd64] efi/x86: Handle by-ref arguments covering multiple pages in mixed mode - dm integrity: fix a deadlock due to offloading to an incorrect workqueue - scsi: pm80xx: Fixed kernel panic during error recovery for SATA drive https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.110 - [x86] KVM: SVM: fix up incorrect backport https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.111 - phy: Revert toggling reset changes. - net: phy: Avoid multiple suspends - cgroup, netclassid: periodically release file_lock on classid updating - gre: fix uninit-value in __iptunnel_pull_header - inet_diag: return classid for all socket types - ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface - ipvlan: add cond_resched_rcu() while processing muticast backlog - ipvlan: do not add hardware address of master to its unicast filter list - ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() - ipvlan: don't deref eth hdr before checking it's set - net/ipv6: use configured metric when add peer route - netlink: Use netlink header as base to calculate bad attribute offset - net: macsec: update SCI upon MAC address change. - net: nfc: fix bounds checking bugs on "pipe" - net/packet: tpacket_rcv: do not increment ring index on drop - [arm64,armhf] net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used - r8152: check disconnect status after long sleep - sfc: detach from cb_page in efx_copy_channel() - bnxt_en: reinitialize IRQs when MTU is modified - cgroup: memcg: net: do not associate sock with unrelated cgroup - net: memcg: late association of sock to memcg - net: memcg: fix lockdep splat in inet_csk_accept() - devlink: validate length of param values - nl802154: add missing attribute validation - nl802154: add missing attribute validation for dev_type - can: add missing attribute validation for termination - macsec: add missing attribute validation for port - net: fq: add missing attribute validation for orphan mask - team: add missing attribute validation for port ifindex - team: add missing attribute validation for array index - nfc: add missing attribute validation for SE API - nfc: add missing attribute validation for deactivate target - nfc: add missing attribute validation for vendor subcommand - net: phy: fix MDIO bus PM PHY resuming - net/ipv6: need update peer route when modify metric - net/ipv6: remove the old peer route if change it to a new one - tipc: add missing attribute validation for MTU property - devlink: validate length of region addr/len - bonding/alb: make sure arp header is pulled before accessing it - slip: make slhc_compress() more robust against malicious packets - [armhf] net: fec: validate the new settings in fec_enet_set_coalesce() - macvlan: add cond_resched() during multicast processing - cgroup: cgroup_procs_next should increase position index - cgroup: Iterate tasks that did not finish do_exit() - iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices - virtio-blk: fix hw_queue stopped on arbitrary error - [amd64] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint - netfilter: nf_conntrack: ct_cpu_seq_next should increase position index - netfilter: synproxy: synproxy_cpu_seq_next should increase position index - netfilter: xt_recent: recent_seq_next should increase position index - netfilter: x_tables: xt_mttg_seq_next should increase position index - workqueue: don't use wq_select_unbound_cpu() for bound works - drm/amd/display: remove duplicated assignment to grph_obj_type - cifs_atomic_open(): fix double-put on late allocation failure - gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache - [x86] KVM: clear stale x86_emulate_ctxt->intercept value - efi: Fix a race and a buffer overflow while reading efivars via sysfs - efi: Make efi_rts_work accessible to efi page fault handler - mt76: fix array overflow on receiving too many fragments for a packet - [x86] mce: Fix logic and comments around MSR_PPIN_CTL - [arm64] iommu/dma: Fix MSI reservation allocation - [amd64] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint - [amd64] iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page - batman-adv: Don't schedule OGM for disabled interface - [arm64] pinctrl: meson-gxl: fix GPIOX sdio pins - pinctrl: core: Remove extra kref_get which blocks hogs being freed - [arm64,armhf] i2c: gpio: suppress error on probe defer - nl80211: add missing attribute validation for critical protocol indication - nl80211: add missing attribute validation for beacon report scanning - nl80211: add missing attribute validation for channel switch - perf bench futex-wake: Restore thread count default to online CPU count - netfilter: cthelper: add missing attribute validation for cthelper - netfilter: nft_payload: add missing attribute validation for payload csum flags - netfilter: nft_tunnel: add missing attribute validation for tunnels - [amd64] iommu/vt-d: Fix the wrong printing in RHSA parsing - [amd64] iommu/vt-d: Ignore devices with out-of-spec domain number - [arm64,x86] i2c: acpi: put device when verifying client fails - ipv6: restrict IPV6_ADDRFORM operation - net/smc: check for valid ib_client_data - net/smc: cancel event worker during device removal - efi: Add a sanity check to efivar_store_raw() - batman-adv: Avoid free/alloc race when handling OGM2 buffer https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.112 - [x86] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag - [armhf] mmc: sdhci-omap: Add platform specific reset callback - [armhf] mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929) - ACPI: watchdog: Allow disabling WDAT at boot - HID: apple: Add support for recent firmware on Magic Keyboards - [x86] HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override - cfg80211: check reg_rule for NULL in handle_channel_custom() - scsi: libfc: free response frame from GPN_ID - net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch - mac80211: rx: avoid RCU list traversal under mutex - signal: avoid double atomic counter increments for user accounting - slip: not call free_netdev before rtnl_unlock in slip_open - [x86,arm64] hinic: fix a irq affinity bug - [x86,arm64] hinic: fix a bug of setting hw_ioctxt - sfc: fix timestamp reconstruction at 16-bit rollover points - jbd2: fix data races at struct journal_head - [armhf] mmc: sdhci-omap: Don't finish_mrq() on a command error during tuning - [armhf] mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C - driver core: Remove the link if there is no driver with AUTO flag - driver core: Fix adding device links to probing suppliers - driver core: Make driver core own stateful device links - driver core: Add device link flag DL_FLAG_AUTOPROBE_CONSUMER - driver core: Remove device link creation limitation - driver core: Fix creation of device links with PM-runtime flags - mm: slub: add missing TID bump in kmem_cache_alloc_bulk() - efi: Fix debugobjects warning on 'efi_rts_work' https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.113 - [arm64] spi: qup: call spi_qup_pm_resume_runtime before suspending - [amd64] spi: pxa2xx: Add CS control clock quirk - [armhf] drm/exynos: dsi: fix workaround for the legacy clock name - [arm64] drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer - dm bio record: save/restore bi_end_io and bi_integrity - dm integrity: use dm_bio_record and dm_bio_restore - xenbus: req->body should be updated before req->state - xenbus: req->err should be updated before req->state - block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() - USB: Disable LPM on WD19's Realtek Hub - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters - USB: serial: option: add ME910G1 ECM composition 0x110b - [arm64,armhf] usb: host: xhci-plat: add a shutdown - USB: serial: pl2303: add device-id for HP LD381 - [x86] usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c - ALSA: line6: Fix endless MIDI read loop - ALSA: seq: virmidi: Fix running status after receiving sysex - ALSA: seq: oss: Fix running status after receiving sysex - ALSA: pcm: oss: Avoid plugin buffer overflow - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks - [armhf] iio: st_sensors: remap SMO8840 to LIS2DH12 - mmc: rtsx_pci: Fix support for speed-modes that relies on tuning - staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 - staging/speakup: fix get_word non-space look-ahead - [x86] intel_th: Fix user-visible error codes - [x86] intel_th: pci: Add Elkhart Lake CPU support - xhci: Do not open code __print_symbolic() in xhci trace events - btrfs: fix log context list corruption after rename whiteout error - drm/amd/amdgpu: Fix GPR read from debugfs (v2) - drm/lease: fix WARNING in idr_destroy - memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event - mm: slub: be more careful about the double cmpxchg of freelist - mm, slub: prevent kmalloc_node crashes and memory leaks - page-flags: fix a crash at SetPageError(THP_SWAP) - [x86] mm: split vmalloc_sync_all() (Closes: #953017) - USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL - USB: cdc-acm: fix rounding error in TIOCSSERIAL - futex: Fix inode life-time issue - futex: Unbreak futex hashing - Revert "vrf: mark skb for multicast or link-local as enslaved to VRF" - Revert "ipv6: Fix handling of LLA with VRF and sockets bound to VRF" - ALSA: hda/realtek: Fix pop noise on ALC225 - [arm64] smp: fix smp_send_stop() behaviour - [arm64] smp: fix crash_smp_send_stop() behaviour - [arm64,armhf] drm/bridge: dw-hdmi: fix AVI frame colorimetry https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.114 - mmc: core: Allow host controllers to require R1B for CMD6 - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command - [armhf] mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY - [arm64,armhf] mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY - geneve: move debug check after netdev unregister - macsec: restrict to ethernet devices - net: cbs: Fix software cbs to consider packet sending time - [armhf] net: dsa: Fix duplicate frames flooded by learning - [arm64,armhf] net: mvneta: Fix the case where the last poll did not process all rx - net/packet: tpacket_rcv: avoid a producer race condition - net: qmi_wwan: add support for ASKEY WWHC050 - net_sched: cls_route: remove the right filter from hashtable - net_sched: keep alloc_hash updated after hash allocation - [arm64,armhf] net: stmmac: dwmac-rk: fix error path in rk_gmac_probe - slcan: not call free_netdev before rtnl_unlock in slcan_open - bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets() - bnxt_en: Reset rings if ring reservation fails during open() - net: ip_gre: Separate ERSPAN newlink / changelink callbacks - net: ip_gre: Accept IFLA_INFO_DATA-less configuration - r8169: re-enable MSI on RTL8168c - tcp: repair: fix TCP_QUEUE_SEQ implementation - vxlan: check return value of gro_cells_init() - cgroup-v1: cgroup_pidlist_next should update position index - nfs: add minor version to nfs_server_key for fscache - drivers/of/of_mdio.c:fix of_mdiobus_register() - cgroup1: don't call release_agent when it is "" - [s390x] qeth: handle error when backing RX buffer - scsi: ipr: Fix softlockup when rescanning devices in petitboot - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled - [x86] ftrace: Anotate text_mutex split between ftrace_arch_code_modify_post_process() and ftrace_arch_code_modify_prepare() - [x86] Input: synaptics - enable RMI on HP Envy 13-ad105ng - Input: avoid BIT() macro usage in the serio.h UAPI header - ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL - perf probe: Do not depend on dwfl_module_addrsym() - scsi: sd: Fix optimal I/O size for devices that change reported values - nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type - mac80211: mark station unauthorized before key removal - [x86] gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk - gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model - genirq: Fix reference leaks on irq affinity notifiers - xfrm: handle NETDEV_UNREGISTER for xfrm device - vti[6]: fix packet tx through bpf_redirect() in XinY cases - RDMA/mlx5: Block delay drop to unprivileged users - xfrm: fix uctx len check in verify_sec_ctx_len - xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire - xfrm: policy: Fix doulbe free in xfrm_policy_timer - afs: Fix some tracing details - netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6} - netfilter: nft_fwd_netdev: validate family and chain type - bpf/btf: Fix BTF verification of enum members in struct/union - vti6: Fix memory leak of skb if input policy check fails - mac80211: add option for setting control flags - mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX - USB: serial: option: add support for ASKEY WWHC050 - USB: serial: option: add BroadMobi BM806U - USB: serial: option: add Wistron Neweb D19Q1 - USB: cdc-acm: restore capability check order - USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback - [arm64,armhf] usb: musb: fix crash with highmen PIO and usbmon - media: flexcop-usb: fix endpoint sanity check - media: usbtv: fix control-message timeouts - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table - [x86] ahci: Add Intel Comet Lake H RAID PCI ID - libfs: fix infoleak in simple_attr_read() - media: ov519: add missing endpoint sanity checks (CVE-2020-11608) - media: dib0700: fix rc endpoint lookup - media: stv06xx: add missing descriptor sanity checks (CVE-2020-11609) - media: xirlink_cit: add missing descriptor sanity checks (CVE-2020-11668) - mac80211: Check port authorization in the ieee80211_tx_dequeue() case - mac80211: fix authentication with iwlwifi/mvm - vt: selection, introduce vc_is_sel - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines - vt: switch vt_dont_switch to bool - vt: vt_ioctl: remove unnecessary console allocation checks - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console - vt: vt_ioctl: fix use-after-free in vt_in_use() - [x86] platform: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table - bpf: Explicitly memset the bpf_attr structure - bpf: Explicitly memset some bpf info structures declared on the stack - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model - perf map: Fix off by one in strncpy() size argument - [armel] bcm2835-rpi-zero-w: Add missing pinctrl name - [armhf] dts: N900: fix onenand timings https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.115 - ipv4: fix a RCU-list lock in fib_triestat_seq_show - net, ip_tunnel: fix interface lookup with no key - sctp: fix refcount bug in sctp_wfree - sctp: fix possibly using a bad saddr with a given dst - nvme-rdma: Avoid double freeing of async event data - drm/bochs: downgrade pci_request_region failure from error to warning - drm/amdgpu: fix typo for vcn1 idle check - [x86] tools/power turbostat: Fix gcc build warnings - [x86] tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks - [armhf] drm/etnaviv: replace MMU flush marker with flush sequence - media: rc: IR signal for Panasonic air conditioner too long - misc: rtsx: set correct pcr_ops for rts522A - [x86] mei: me: add cedar fork device ids - ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard - rxrpc: Fix sendmsg(MSG_WAITALL) handling - net: Fix Tx hash bound checking - padata: always acquire cpu_hotplug_lock before pinst->lock - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (CVE-2020-11565) - ipv6: don't auto-add link-local address to lag ports - [armhf] net: dsa: bcm_sf2: Do not register slave MDIO bus with OF - [armhf] net: dsa: bcm_sf2: Ensure correct sub-node is parsed - net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers - [arm64,armhf] net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting - slcan: Don't transmit uninitialized stack data in padding (CVE-2020-11494) - random: always use batched entropy for get_random_u{32,64} - [arm64,armhf] usb: dwc3: gadget: Wrap around when skip TRBs - [armhf] hwrng: imx-rngc - fix an error path - [amd64] IB/hfi1: Call kobject_put() when kobject_init_and_add() fails - [amd64] IB/hfi1: Fix memory leaks in sysfs registration and unregistration - ceph: remove the extra slashes in the server path - ceph: canonicalize server path in place - RDMA/ucma: Put a lock around every call to the rdma_cm layer - RDMA/cma: Teach lockdep about the order of rtnl and lock - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow - fbcon: fix null-ptr-deref in fbcon_switch - [arm64] clk: qcom: rcg: Return failure for RCG update - [arm64] drm/msm: stop abusing dma_map/unmap for cache - [arm64] Fix size of __early_cpu_boot_status - [arm64] rpmsg: glink: Remove chunk size word align warning - [arm64,armhf] usb: dwc3: don't set gadget->is_otg flag - drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() - [arm64] drm/msm: Use the correct dma_sync calls in msm_gem https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.116 - [armhf] dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage - [arm64,armhf] bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads - [x86,arm64] hinic: fix a bug of waitting for IO stopped - [x86,arm64] hinic: fix wrong para of wait_for_completion_timeout - cxgb4/ptp: pass the sign of offset delta in FW CMD - qlcnic: Fix bad kzalloc null test - [armhf] cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL - [arm64] media: venus: hfi_parser: Ignore HEVC encoding for V1 - null_blk: Fix the null_add_dev() error path - null_blk: Handle null_add_dev() failures properly - null_blk: fix spurious IO errors after failed past-wp access - xhci: bail out early if driver can't accress host in resume - [x86] Don't let pgprot_modify() change the page encryption bit - block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices - sched: Avoid scale real weight down to zero - libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() - [amd64,x86] pstore/platform: fix potential mem leak if pstore_init_fs failed - gfs2: Don't demote a glock until its revokes are written - [i386] efi/x86: Ignore the memory attributes table on i386 - genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy() - block: Fix use-after-free issue accessing struct io_cq - [arm64,armhf] usb: dwc3: core: add support for disabling SS instances in park mode - [arm64,armhf] irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency - md: check arrays is suspended in mddev_detach before call quiesce operations - firmware: fix a double abort case with fw_load_sysfs_fallback - block, bfq: fix use-after-free in bfq_idle_slice_timer_body - btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued - btrfs: remove a BUG_ON() from merge_reloc_roots() - btrfs: track reloc roots based on their commit root bytenr - IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads - uapi: rename ext2_swab() to swab() and share globally in swab.h - slub: improve bit diffusion for freelist ptr obfuscation - ASoC: fix regwmask - ASoC: dapm: connect virtual mux with default value - ASoC: dpcm: allow start or stop during pause for backend - [x86] ASoC: topology: use name_prefix for new kcontrol - usb: gadget: f_fs: Fix use after free issue as part of queue failure - usb: gadget: composite: Inform controller driver of self-powered - ALSA: hda: Add driver blacklist - ALSA: hda: Fix potential access overflow in beep helper - ALSA: ice1724: Fix invalid access for enumerated ctl items - ALSA: pcm: oss: Fix regression by buffer overflow fix - ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256 - ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 - [x86] ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups - [x86] ALSA: hda/realtek - Add quirk for MSI GL63 - [x86] acpi: ignore unspecified bit positions in the ACPI global lock field - nvme-fc: Revert "add module to ops template to allow module references" - nvme: Treat discovery subsystems as unique subsystems - PCI: pciehp: Fix indefinite wait on sysfs requests - PCI/ASPM: Clear the correct bits when enabling L1 substates - PCI: Add boot interrupt quirk mechanism for Xeon chipsets - tpm: Don't make log failures fatal - tpm: tpm1_bios_measurements_next should increase position index - tpm: tpm2_bios_measurements_next should increase position index - KEYS: reaching the keys quotas correctly - [amd64,x86] pstore: pstore_ftrace_seq_next should increase position index - [mips*el] tlbex: Fix LDDIR usage in setup_pw() for Loongson-3 - [mips*/octeon] irq: Fix potential NULL pointer dereference - ath9k: Handle txpower changes even when TPC is disabled - signal: Extend exec_id to 64bits - [i386] x86/entry/32: Add missing ASM_CLAC to general_protection entry - [x86] KVM: nVMX: Properly handle userspace interrupt window request - [s390x] KVM: vsie: Fix region 1 ASCE sanity shadow address checks - [s390x] KVM: vsie: Fix delivery of addressing exceptions - [x86] KVM: Allocate new rmap and large page tracking when moving memslot - [x86] KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support - [x86] KVM: Gracefully handle __vmalloc() failure during VM allocation - [x86] KVM: VMX: fix crash cleanup when KVM wasn't used - CIFS: Fix bug which the return value by asynchronous read is error - Btrfs: fix crash during unmount due to race with delayed inode workers - btrfs: set update the uuid generation as soon as possible - btrfs: drop block from cache on error in relocation - btrfs: fix missing file extent item for hole after ranged fsync - btrfs: fix missing semaphore unlock in btrfs_sync_file - [powerpc*] pseries: Drop pointless static qualifier in vpa_debugfs_init() - [x86] speculation: Remove redundant arch_smt_update() invocation - mm: Use fixed constant in page_frag_alloc instead of size + 1 - dm writecache: add cond_resched to avoid CPU hangs - [s390x] scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point - [arm64] armv8_deprecated: Fix undef_hook mask for thumb setend - [armhf] drm/etnaviv: rework perfmon query infrastructure - [powerpc*] pseries: Avoid NULL pointer dereference when drmem is unavailable - NFS: Fix a page leak in nfs_destroy_unlinked_subrequests() - ext4: fix a data race at inode->i_blocks - fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() - ocfs2: no need try to truncate file beyond i_size - [s390x] diag: fix display of diagnose call statistics - [x86] Input: i8042 - add Acer Aspire 5738z to nomux list - kmod: make request_module() return an error when autoloading is disabled - [powerpc*] cpufreq: powernv: Fix use-after-free - hfsplus: fix crash and filesystem corruption when deleting files - libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set - ipmi: fix hung processes in __get_guid() - xen/blkfront: fix memory allocation flags in blkfront_setup_indirect() - [powerpc*] powernv/idle: Restore AMR/UAMOR/AMOR after idle (CVE-2020-11669) - [powerpc*] 64/tm: Don't let userspace set regs->trap via sigreturn - [powerpc*] hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries - [powerpc*] xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs - [powerpc*] kprobes: Ignore traps that happened in real mode - scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug - [powerpc*] Add attributes for setjmp/longjmp - [powerpc*] Make setjmp/longjmp signature standard - btrfs: use nofs allocations for running delayed items - dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone() - drm/dp_mst: Fix clearing payload state on topology disable - drm: Remove PageReserved manipulation from drm_pci_alloc - ftrace/kprobe: Show the maxactive number on kprobe_events - [armhf] etnaviv: perfmon: fix total and idle HI cyleces readout - [amd64] efi/x86: Fix the deletion of variables in mixed mode https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.117 - [amd64,arm64] amd-xgbe: Use __napi_schedule() in BH context - net: ipv6: do not consider routes via gateways for anycast address check - net: revert default NAPI poll timeout to 2 jiffies - [arm64,armhf] net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes - ovl: fix value of i_ino for lower hardlink corner case - scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic - jbd2: improve comments about freeing data buffers whose page mapping is NULL - ext4: fix incorrect group count in ext4_fill_super error message - ext4: fix incorrect inodes per group in error message - [x86] ASoC: Intel: mrfld: fix incorrect check on p->sink - [x86] ASoC: Intel: mrfld: return error codes when an error occurs - ALSA: usb-audio: Filter error from connector kctl ops, too - ALSA: usb-audio: Don't override ignore_ctl_error value from the map - ALSA: usb-audio: Don't create jack controls for PCM terminals - ALSA: usb-audio: Check mapping at creating connector controls, too - keys: Fix proc_keys_next to increase position index - tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation - btrfs: check commit root generation in should_ignore_root - mac80211_hwsim: Use kstrndup() in place of kasprintf() - [arm64,armhf] usb: dwc3: gadget: don't enable interrupt when disabling endpoint - [arm64,armhf] usb: dwc3: gadget: Don't clear flags before transfer ended - ext4: do not zeroout extents beyond i_disksize - [x86] kvm: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD - scsi: target: fix hang when multiple threads try to destroy the same iscsi session - [x86] microcode/AMD: Increase microcode PATCH_MAX_SIZE - wil6210: check rx_buff_mgmt before accessing it - wil6210: ignore HALP ICR if already handled - wil6210: add general initialization/size checks - wil6210: make sure Rx ring sizes are correlated - wil6210: remove reset file from debugfs - mm/vmalloc.c: move 'area->pages' after if statement https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.118 - [armel,armhf] bpf: Fix offset overflow for BPF_MEM BPF_DW - scsi: sg: add sg_remove_request in sg_common_write - ext4: use non-movable memory for superblock readahead - [arm64,armhf] watchdog: sp805: fix restart handler - [armel,armhf] arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0 - netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type - [arm64] irqchip/mbigen: Free msi_desc on device teardown - ALSA: hda: Don't release card at firmware loading error - of: overlay: kmemleak in dup_and_fixup_symbol_prop() - [x86] Hyper-V: Report crash register data or kmsg before running crash kernel - rbd: avoid a deadlock on header_rwsem when flushing notifies - rbd: call rbd_dev_unprobe() after unwatching and flushing notifies - xsk: Add missing check on user supplied headroom size - [x86] Hyper-V: Unload vmbus channel in hv panic callback - [x86] Hyper-V: Free hv_panic_page when fail to register kmsg dump - [x86] Hyper-V: Trigger crash enlightenment only once during system crash. - [x86] Hyper-V: Report crash register data when sysctl_record_panic_msg is not set - [x86] Hyper-V: Report crash data in die() when panic_on_oops is set - power: supply: bq27xxx_battery: Silence deferred-probe error - [arm64,armhf] clk: tegra: Fix Tegra PMC clock out parents - [armhf] soc: imx: gpc: fix power up sequencing - NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid() - NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails - [s390x] cpuinfo: fix wrong output when CPU0 is offline - [s390x] cpum_sf: Fix wrong page count in error message - ext4: do not commit super on read-only bdev - cifs: Allocate encryption header through kmalloc - include/linux/swapops.h: correct guards for non_swap_entry() - percpu_counter: fix a data race at vm_committed_as - [s390x] KVM: vsie: Fix possible race when shadowing region 3 tables - [x86] ACPI: fix CPU hotplug deadlock - [amd64] drm/amdkfd: kfree the wrong pointer - NFS: Fix memory leaks in nfs_pageio_stop_mirroring() - f2fs: fix NULL pointer dereference in f2fs_write_begin() - [arm*] drm/vc4: Fix HDMI mode validation - [amd64] iommu/vt-d: Fix mm reference leak - power: supply: axp288_fuel_gauge: Broaden vendor check for Intel Compute Sticks. - libnvdimm: Out of bounds read in __nd_ioctl() - f2fs: fix to wait all node page writeback - [armhf] net: dsa: bcm_sf2: Fix overflow checks - fbdev: potential information leak in do_fb_ioctl() - mtd: lpddr: Fix a double free in probe() - mtd: phram: fix a double free issue in error path - KEYS: Don't write out to userspace while holding key semaphore - bpf: fix buggy r0 retval refinement for tracing helpers [ Salvatore Bonaccorso ] * Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for out-of-tree modules"" for context changes in 4.19.99 * Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context changes in 4.19.99 * Drop "tools/lib/api/fs/fs.c: Fix misuse of strncpy()" * Refresh "net: ena: add MAX_QUEUES_EXT get feature admin command" for context changes in 4.19.108 * [rt] Update to 4.19.115-rt48: - Revert "genirq: Do not invoke the affinity callback via a workqueue on RT" * [rt] Refresh "pci/switchtec: Don't use completion's wait queue" for context changes in 4.19.116 * Refresh "firmware: Remove redundant log messages from drivers" for context changes in 4.19.118 * f2fs: fix to avoid memory leakage in f2fs_listxattr (CVE-2020-0067) * net: ipv6: add net argument to ip6_dst_lookup_flow * net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup (CVE-2020-1749) * blktrace: Protect q->blk_trace with RCU (CVE-2019-19768) * blktrace: fix dereference after null check [ Ben Hutchings ] * [x86] Drop "Add a SysRq option to lift kernel lockdown" (Closes: #947021) - This patch allowed remotely disabling lockdown using usbip - Lockdown can be disabled by running "mokutil --disable-validation", rebooting, and confirming the change when prompted * debian/README.source: Refer to upload checklist in kernel-team.git * Bump ABI to 9 [ YunQiang Su ] * [mips*] enable CONFIG_MIPS_O32_FP64_SUPPORT. * [mips*] enable CONFIG_CPU_HAS_MSA except octeon. [ Steve McIntyre ] * [arm64] Include the Hisilicon Hibmc drm driver in fb-modules (Closes: #951274) [ Noah Meyerhans ] * [cloud] Enable CONFIG_KSM (Closes: #955366) -- Ben Hutchings Sun, 26 Apr 2020 14:04:11 +0100 linux (4.19.98-1+deb10u1) buster-security; urgency=high * [x86] KVM: nVMX: Don't emulate instructions in guest mode (CVE-2020-2732) * do_last(): fetch directory ->i_mode and ->i_uid before it's too late (CVE-2020-8428) * vfs: fix do_last() regression * vhost: Check docket sk_family instead of call getname (CVE-2020-10942) * mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (CVE-2020-11565) * [s390x] mm: fix page table upgrade vs 2ndary address mode accesses (CVE-2020-11884) -- Salvatore Bonaccorso Mon, 27 Apr 2020 07:05:39 +0200 linux (4.19.98-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.88 - [arm64] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate - ASoC: compress: fix unsigned integer overflow check - reset: Fix memory leak in reset_control_array_put() - [armhf] clk: samsung: exynos5433: Fix error paths - [armel/marvell,armhf] ASoC: kirkwood: fix external clock probe defer - [armel/marvell,armhf] ASoC: kirkwood: fix device remove ordering - [armhf] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume - [x86] pinctrl: cherryview: Allocate IRQ chip dynamic - [armhf] dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts - reset: fix reset_control_ops kerneldoc comment - [armhf,arm64] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup - [armhf] clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 - [armhf] dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend - [ppc64el] bpf: Fix tail call implementation - idr: Fix integer overflow in idr_for_each_entry - idr: Fix idr_alloc_u32 on 32-bit systems - [x86] resctrl: Prevent NULL pointer dereference when reading mondata - [armhf] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call - [armhf] clk: ti: clkctrl: Fix failed to enable error with double udelay timeout - bridge: ebtables: don't crash when using dnat target in output chains - can: peak_usb: report bus recovery as well - can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak - can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max - can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM - can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors - can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error - can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error - [armhf] can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails - [arm64] watchdog: meson: Fix the wrong value of left time - ceph: return -EINVAL if given fsc mount option on kernel w/o support - net/fq_impl: Switch to kvmalloc() for memory allocation - mac80211: fix station inactive_time shortly after boot - block: drbd: remove a stray unlock in __drbd_send_protocol() - scsi: target/tcmu: Fix queue_cmd_ring() declaration - scsi: lpfc: Fix kernel Oops due to null pring pointers - scsi: lpfc: Fix dif and first burst use in write commands - tracing: Lock event_mutex before synth_event_mutex - [armhf] dts: imx*: Fix memory node duplication - [armhf] dts: Fix hsi gdd range for omap4 - [arm64] mm: Prevent mismatched 52-bit VA support - [arm64] smp: Handle errors reported by the firmware - [armhf] bus: ti-sysc: Check for no-reset and no-idle flags at the child level - [arm64] RDMA/hns: Fix the bug while use multi-hop of pbl - [x86] RDMA/vmw_pvrdma: Use atomic memory allocation in create AH - [armhf] PM / AVS: SmartReflex: NULL check before some freeing functions is not needed - xfs: zero length symlinks are not valid - ACPI / LPSS: Ignore acpi_device_fix_up_power() return value - scsi: lpfc: Enable Management features for IF_TYPE=6 - scsi: qla2xxx: Fix NPIV handling for FC-NVMe - scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port - nvme: provide fallback for discard alloc failure - [s390x] zcrypt: make sysfs reset attribute trigger queue reset - crypto: user - support incremental algorithm dumps - mwifiex: fix potential NULL dereference and use after free - mwifiex: debugfs: correct histogram spacing, formatting - brcmfmac: set F2 watermark to 256 for 4373 - brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373 - rtl818x: fix potential use after free - bcache: do not check if debug dentry is ERR or NULL explicitly on remove - bcache: do not mark writeback_running too early - xfs: require both realtime inodes to mount - nvme: fix kernel paging oops - ubifs: Fix default compression selection in ubifs - ubi: Put MTD device after it is not used - ubi: Do not drop UBI device reference before using - iwlwifi: move iwl_nvm_check_version() into dvm - iwlwifi: mvm: force TCM re-evaluation on TCM resume - iwlwifi: pcie: fix erroneous print - iwlwifi: pcie: set cmd_len in the correct place - [armhf,arm64] gpio: pca953x: Fix AI overflow on PCAL6524 - gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB - [x86] kvm: vmx: Set IA32_TSC_AUX for legacy mode guests - [x86] Revert "KVM: nVMX: reset cache/shadows when switching loaded VMCS" - [x86] Revert "KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode()" - VSOCK: bind to random port for VMADDR_PORT_ANY - [amd64] mmc: meson-gx: make sure the descriptor is stopped on errors - [armhf] mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET - [armhf] usb: ehci-omap: Fix deferred probe for phy handling - btrfs: Check for missing device before bio submission in btrfs_map_bio - btrfs: fix ncopies raid_attr for RAID56 - btrfs: dev-replace: set result code of cancel by status of scrub - Btrfs: allow clear_extent_dirty() to receive a cached extent state record - btrfs: only track ref_heads in delayed_ref_updates - [x86] HID: intel-ish-hid: fixes incorrect error handling - serial: 8250: Rate limit serial port rx interrupts during input overruns - [x86] kprobes/xen: blacklist non-attachable xen interrupt functions - xen/pciback: Check dev_data before using it - kprobes: Blacklist symbols in arch-defined prohibited area - [amd64] kprobes: Show x86-64 specific blacklisted symbols correctly - [armhf] memory: omap-gpmc: Get the header of the enum - net/mlx5: Continue driver initialization despite debugfs failure - netfilter: nf_nat_sip: fix RTP/RTCP source port translations - exofs_mount(): fix leaks on failure exits - bnxt_en: Return linux standard errors in bnxt_ethtool.c - bnxt_en: Save ring statistics before reset. - bnxt_en: query force speeds before disabling autoneg mode. - [s390x] KVM: unregister debug feature on failing arch init - dm flakey: Properly corrupt multi-page bios. - gfs2: take jdata unstuff into account in do_grow - dm raid: fix false -EBUSY when handling check/repair message - xfs: Align compat attrlist_by_handle with native implementation. - xfs: Fix bulkstat compat ioctls on x32 userspace. - IB/qib: Fix an error code in qib_sdma_verbs_send() - vxlan: Fix error path in __vxlan_dev_create() - [ppc64el] xmon: fix dump_segments() - drivers/regulator: fix a missing check of return value - Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading - RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer - scsi: qla2xxx: deadlock by configfs_depend_item - scsi: csiostor: fix incorrect dma device in case of vport - brcmfmac: Fix access point mode - ath6kl: Only use match sets when firmware supports it - ath6kl: Fix off by one error in scan completion - [ppc64el] perf: Fix unit_sel/cache_sel checks - [ppc64el] prom: fix early DEBUG messages - [ppc64el] mm: Make NULL pointer deferences explicit on bad page faults. - [ppc64el] vfio/spapr_tce: Get rid of possible infinite loop - [ppc64el] powernv/eeh/npu: Fix uninitialized variables in opal_pci_eeh_freeze_status - drbd: ignore "all zero" peer volume sizes in handshake - drbd: reject attach of unsuitable uuids even if connected - drbd: do not block when adjusting "disk-options" while IO is frozen - drbd: fix print_st_err()'s prototype to match the definition - IB/rxe: Make counters thread safe - bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't - [armhf] regulator: tps65910: fix a missing check of return value - [ppc64el] powerpc/pseries: Fix node leak in update_lmb_associativity_index() - net/netlink_compat: Fix a missing check of nla_parse_nested - net/net_namespace: Check the return value of register_pernet_subsys() - f2fs: fix block address for __check_sit_bitmap - f2fs: fix to dirty inode synchronously - [armhf] net: dsa: bcm_sf2: Propagate error value from mdio_write - atl1e: checking the status of atl1e_write_phy_reg - tipc: fix a missing check of genlmsg_put - net: marvell: fix a missing check of acpi_match_device - ocfs2: clear journal dirty flag after shutdown journal - vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is n - mm/page_alloc.c: free order-0 pages through PCP in page_frag_free() - mm/page_alloc.c: use a single function to free page - mm/page_alloc.c: deduplicate __memblock_free_early() and memblock_free() - netfilter: nf_tables: fix a missing check of nla_put_failure - xprtrdma: Prevent leak of rpcrdma_rep objects - infiniband/qedr: Potential null ptr dereference of qp - lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk - lib/genalloc.c: use vzalloc_node() to allocate the bitmap - drivers/base/platform.c: kmemleak ignore a known leak - lib/genalloc.c: include vmalloc.h - mtd: Check add_mtd_device() ret code - tipc: fix memory leak in tipc_nl_compat_publ_dump - net/core/neighbour: tell kmemleak about hash tables - [armhf,arm64] ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs - PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() - net/core/neighbour: fix kmemleak minimal reference count for hash tables - serial: 8250: Fix serial8250 initialization crash - [armhf] gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change - sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe - ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel - decnet: fix DN_IFREQ_SIZE - net/smc: prevent races between smc_lgr_terminate() and smc_conn_free() - net/smc: don't wait for send buffer space when data was already sent - mm/hotplug: invalid PFNs from pfn_to_online_page() - xfs: end sync buffer I/O properly on shutdown error - net/smc: fix sender_free computation - blktrace: Show requests without sector - net/smc: fix byte_order for rx_curs_confirmed - tipc: fix skb may be leaky in tipc_link_input - sfc: initialise found bitmap in efx_ef10_mtd_probe - geneve: change NET_UDP_TUNNEL dependency to select - net: fix possible overflow in __sk_mem_raise_allocated() - net: ip_gre: do not report erspan_ver for gre or gretap - net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap - sctp: don't compare hb_timer expire date before starting it - bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id() - mmc: core: align max segment size with logical block size - net: dev: Use unsigned integer as an argument to left-shift - kvm: properly check debugfs dentry before using it - bpf: drop refcount if bpf_map_new_fd() fails in map_create() - [arm64] net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED - [arm64] net: hns3: fix PFC not setting problem for DCB module - [arm64] net: hns3: fix an issue for hclgevf_ae_get_hdev - [arm64] net: hns3: fix an issue for hns3_update_new_int_gl - [x86] iommu/amd: Fix NULL dereference bug in match_hid_uid - apparmor: delete the dentry in aafs_remove() to avoid a leak - scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery - ACPI / APEI: Don't wait to serialise with oops messages when panic()ing - ACPI / APEI: Switch estatus pool to use vmalloc memory - [arm64] scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned - scsi: libsas: Check SMP PHY control function result - [arm64] RDMA/hns: Fix the bug with updating rq head pointer when flush cqe - [arm64] RDMA/hns: Bugfix for the scene without receiver queue - [arm64] RDMA/hns: Fix the state of rereg mr - [arm64] RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board - [ppc64el] pseries/dlpar: Fix a missing check in dlpar_parse_cc_property() (CVE-2019-12614) - xdp: fix cpumap redirect SKB creation bug - mtd: Remove a debug trace in mtdpart.c - [s390x] mm, gup: add missing refcount overflow checks on s390 - [armhf,arm64] usb: dwc2: use a longer core rest timeout in dwc2_core_reset() - staging: rtl8192e: fix potential use after free - staging: rtl8723bs: Drop ACPI device ids - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P - [x86] mei: bus: prefix device names on bus with the bus name - [x86] mei: me: add comet point V device id - thunderbolt: Power cycle the router if NVM authentication fails - xfrm: Fix memleak on xfrm state destroy - media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE - [arm64] net: macb: fix error format in dev_err() - pwm: Clear chip_data in pwm_put() - macvlan: schedule bc_work even if error - net: psample: fix skb_over_panic - openvswitch: fix flow command message size - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook - slip: Fix use-after-free Read in slip_open - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() - openvswitch: remove another BUG_ON() - tipc: fix link name length check - sctp: cache netns in sctp_ep_common - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues - [arm64] net: macb: add missed tasklet_kill - ext4: add more paranoia checking in ext4_expand_extra_isize handling (CVE-2019-19767) - [arm64] net: macb: Fix SUBNS increment and increase resolution - [arm64] net: macb driver, check for SKBTX_HW_TSTAMP - mtd: spi-nor: cast to u64 to avoid uint overflows - tcp: exit if nothing to retransmit on RTO timeout - HID: core: check whether Usage Page item is after Usage ID items - [x86] platform: hp-wmi: Fix ACPI errors caused by too small buffer - [x86] platform: hp-wmi: Fix ACPI errors caused by passing 0 as input size https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.89 - rsi: release skb if rsi_prepare_beacon fails (CVE-2019-19071) - [arm64] tegra: Fix 'active-low' warning for Jetson TX1 regulator - usb: gadget: u_serial: add missing port entry locking - [arm64] tty: serial: msm_serial: Fix flow control - [armhf,arm64] serial: pl011: Fix DMA ->flush_buffer() - serial: serial_core: Perform NULL checks for break_ctl ops - autofs: fix a leak in autofs_expire_indirect() - [arm64] RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN - iwlwifi: pcie: don't consider IV len in A-MSDU - exportfs_decode_fh(): negative pinned may become positive without the parent locked - audit_get_nd(): don't unlock parent too early - xfrm: release device reference for invalid state - sched/core: Avoid spurious lock dependencies - perf/core: Consistently fail fork on allocation failures - ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() - [armhf,arm64] drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. - rsxx: add missed destroy_workqueue calls in remove - i2c: core: fix use after free in of_i2c_notify - serial: core: Allow processing sysrq at port unlock time - cxgb4vf: fix memleak in mac_hlist initialization - iwlwifi: mvm: synchronize TID queue removal - iwlwifi: trans: Clear persistence bit when starting the FW - iwlwifi: mvm: Send non offchannel traffic via AP sta - [armhf] 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ - audit: Embed key into chunk - netfilter: nf_tables: don't use position attribute on rule replacement - net/mlx5: Release resource on error flow - [arm64] clk: sunxi-ng: a64: Fix gate bit of DSI DPHY - ice: Fix NVM mask defines - dlm: fix possible call to kfree() for non-initialized pointer - [armhf] dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1 - [armhf,arm64] rtc: max77686: Fix the returned value in case of error in 'max77686_rtc_read_time()' - i40e: don't restart nway if autoneg not supported - virtchnl: Fix off by one error - [armhf] clk: rockchip: fix rk3188 sclk_smc gate data - [armhf] clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering - [armhf] dts: rockchip: Fix rk3288-rock2 vcc_flash name - dlm: fix missing idr_destroy for recover_idr - [armhf,arm64] net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MII_PHYSID2 - [s390x] scsi: zfcp: update kernel message for invalid FCP_CMND length, it's not the CDB - [s390x] scsi: zfcp: drop default switch case which might paper over missing case - [armhf] bus: ti-sysc: Fix getting optional clocks in clock_roles - [armhf] dts: imx6: RDU2: fix eGalax touchscreen node - crypto: ecc - check for invalid values in the key verification test - crypto: bcm - fix normal/non key hash algorithm failure - [arm64] dts: zynqmp: Fix node names which contain "_" - [arm64] pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues - [arm*] firmware: raspberrypi: Fix firmware calls with large buffers - mm/vmstat.c: fix NUMA statistics updates - [arm64] clk: rockchip: fix I2S1 clock gate register for rk3328 - [arm64] clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 - sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit - regulator: Fix return value of _set_load() stub - USB: serial: f81534: fix reading old/new IC config - xfs: extent shifting doesn't fully invalidate page cache - net-next/hinic:fix a bug in set mac address - net-next/hinic: fix a bug in rx data flow - ice: Fix return value from NAPI poll - ice: Fix possible NULL pointer de-reference - iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents - iomap: sub-block dio needs to zeroout beyond EOF - iomap: dio data corruption and spurious errors when pipes fill - iomap: readpages doesn't zero page tail beyond EOF - iw_cxgb4: only reconnect with MPAv1 if the peer aborts - [mips*/octeon] octeon-platform: fix typing - net/smc: use after free fix in smc_wr_tx_put_slot() - [armhf] dts: exynos: Use Samsung SoC specific compatible for DWC2 module - media: pulse8-cec: return 0 when invalidating the logical address - media: cec: report Vendor ID after initialization - iwlwifi: fix cfg structs for 22000 with different RF modules - net/ipv6: re-do dad when interface has IFF_NOARP flag change - [x86] dmaengine: dw-dmac: implement dma protection control setting - [armhf,arm64] usb: dwc3: debugfs: Properly print/set link state for HS - [armhf,arm64] usb: dwc3: don't log probe deferrals; but do log other error codes - ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() - f2fs: fix to account preflush command for noflush_merge mode - f2fs: fix count of seg_freed to make sec_freed correct - f2fs: change segment to section in f2fs_ioc_gc_range - [armhf] dts: rockchip: Fix the PMU interrupt number for rv1108 - [armhf] dts: rockchip: Assign the proper GPIO clocks for rv1108 - f2fs: fix to allow node segment for GC by ioctl path - nvme: Free ctrl device name on init failure - dma-mapping: fix return type of dma_set_max_seg_size() - [armhf] serial: imx: fix error handling in console_setup - [armhf] i2c: imx: don't print error message on probe defer - [arm64] clk: meson: Fix GXL HDMI PLL fractional bits width - [armhf,arm64] gpu: host1x: Fix syncpoint ID field size on Tegra186 - lockd: fix decoding of TEST results - sctp: increase sk_wmem_alloc when head->truesize is increased - [x86] iommu/amd: Fix line-break in error log reporting - [armhf] dts: sun8i: a23/a33: Fix OPP DTC warnings - [armhf] dts: sun8i: v3s: Change pinctrl nodes to avoid warning - nfsd: fix a warning in __cld_pipe_upcall() - bpf: btf: implement btf_name_valid_identifier() - bpf: btf: check name validity for various types - [armhf] OMAP1/2: fix SoC name printing - [arm64] dts: meson-gxl-libretech-cc: fix GPIO lines names - [arm64] dts: meson-gxbb-nanopi-k2: fix GPIO lines names - [arm64] dts: meson-gxbb-odroidc2: fix GPIO lines names - [arm64] dts: meson-gxl-khadas-vim: fix GPIO lines names - net/x25: fix called/calling length calculation in x25_parse_address_block - net/x25: fix null_x25_address handling - tcp: make tcp_space() aware of socket backlog - tcp: fix off-by-one bug on aborting window-probing socket - tcp: fix SNMP under-estimation on failed retransmission - tcp: fix SNMP TCP timeout under-estimation - kbuild: fix single target build for external module - mtd: fix mtd_oobavail() incoherent returned value - [arm64] clk: meson: meson8b: fix the offset of vid_pll_dco's N value - [armhf,arm64] clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent - [arm64] clk: qcom: Fix MSM8998 resets - dlm: fix invalid cluster name warning - net/mlx4_core: Fix return codes of unsupported operations - pstore/ram: Avoid NULL deref in ftrace merging failure path - [mips*/octeon] cvmx_pko_mem_debug8: use oldest forward compatible definition - nfsd: Return EPERM, not EACCES, in some SETATTR cases - media: uvcvideo: Abstract streaming object lifetime - [armhf] dts: sun8i: h3: Fix the system-control register range - tty: Don't block on IO when ldisc change is pending - media: stkwebcam: Bugfix for wrong return values - sctp: frag_point sanity check - IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state - IB/hfi1: Close VNIC sdma_progress sleep window - mlx4: Use snprintf instead of complicated strcpy - [armhf] dts: sunxi: Fix PMU compatible strings - [armhf] dts: am335x-pdu001: Fix polarity of card detection input - net: aquantia: fix RSS table and key sizes - sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision - fuse: verify nlink - fuse: verify attributes - [x86] ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC - [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop - [x86] ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 - ALSA: pcm: oss: Avoid potential buffer overflows - [x86] ALSA: hda - Add mute led support for HP ProBook 645 G4 - [x86] Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus - [x86] Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash - [x86] Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers - [x86] Input: goodix - add upside-down quirk for Teclast X89 tablet - Input: Fix memory leak in psxpad_spi_probe - [i386] mm: Sync only to VMALLOC_END in vmalloc_sync_all() - [x86] PCI: Avoid AMD FCH XHCI USB PME# from D0 defect - xfrm interface: fix memory leak on creation - xfrm interface: avoid corruption on changelink - xfrm interface: fix list corruption for x-netns - xfrm interface: fix management of phydev - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks - CIFS: Fix SMB2 oplock break processing - tty: vt: keyboard: reject invalid keycodes - can: slcan: Fix use-after-free Read in slcan_open - kernfs: fix ino wrap-around detection - jbd2: Fix possible overflow in jbd2_log_space_left() - [arm64] drm/msm: fix memleak on release - [i386] drm/i810: Prevent underflow in ioctl - [armhf,arm64] KVM: vgic: Don't rely on the wrong pending table - [x86] KVM: do not modify masked bits of shared MSRs - [x86] KVM: fix presentation of TSX feature in ARCH_CAPABILITIES - [x86] KVM: Grab KVM's srcu lock when setting nested state - crypto: af_alg - cast ki_complete ternary op to int - [x86] crypto: ccp - fix uninitialized list head - crypto: ecdh - fix big endian bug in ECC library - crypto: user - fix memory leak in crypto_report (CVE-2019-19062) - mwifiex: update set_mac_address logic - can: ucan: fix non-atomic allocation in completion handler - RDMA/qib: Validate ->show()/store() callbacks before calling them - iomap: Fix pipe page leakage during splicing - thermal: Fix deadlock in thermal thermal_zone_device_check - vcs: prevent write access to vcsu devices (CVE-2019-19252) - binder: Fix race between mmap() and binder_alloc_print_pages() - binder: Handle start==NULL in binder_update_page_range() - ALSA: hda - Fix pending unsol events at shutdown - perf script: Fix invalid LBR/binary mismatch error - splice: don't read more than available pipe space - iomap: partially revert 4721a601099 (simulated directio short read on EFAULT) - xfs: add missing error check in xfs_prepare_shift() - ASoC: rsnd: fixup MIX kctrl registration - [x86] KVM: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) - net: qrtr: fix memort leak in qrtr_tun_write_iter (CVE-2019-19079) - appletalk: Fix potential NULL pointer dereference in unregister_snap_client (CVE-2019-19227) - appletalk: Set error code if register_snap_client failed https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.90 - usb: gadget: configfs: Fix missing spin_lock_init() - [x86] usb: gadget: pch_udc: fix use after free - scsi: qla2xxx: Fix driver unload hang - [arm64] media: venus: remove invalid compat_ioctl32 handler - USB: uas: honor flag to avoid CAPACITY16 - USB: uas: heed CAPACITY_HEURISTICS - usb: Allow USB device to be warm reset in suspended state - staging: rtl8188eu: fix interface sanity check - staging: rtl8712: fix interface sanity check - staging: gigaset: fix general protection fault on probe - staging: gigaset: fix illegal free on probe errors - staging: gigaset: add endpoint-type sanity check - usb: xhci: only set D3hot for pci device - xhci: Fix memory leak in xhci_add_in_port() - xhci: Increase STS_HALT timeout in xhci_suspend() - xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. - [armhf] dts: pandora-common: define wl1251 as child node of mmc3 - [x86] iio: imu: inv_mpu6050: fix temperature reporting using bad unit - USB: atm: ueagle-atm: add missing endpoint check - USB: idmouse: fix interface sanity checks - USB: serial: io_edgeport: fix epic endpoint lookup - usb: roles: fix a potential use after free - USB: adutux: fix interface sanity check - usb: core: urb: fix URB structure initialization function - usb: mon: Fix a deadlock in usbmon between mmap and read - tpm: add check after commands attribs tab allocation - virtio-balloon: fix managed page counts when migrating pages between zones - [armhf,arm64] usb: dwc3: gadget: Fix logical condition - [armhf,arm64] usb: dwc3: ep0: Clear started flag on completion - btrfs: check page->mapping when loading free space cache - btrfs: use refcount_inc_not_zero in kill_all_nodes - Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc - Btrfs: fix negative subv_writers counter and data space leak after buffered write - btrfs: Avoid getting stuck during cyclic writebacks - btrfs: Remove btrfs_bio::flags member - Btrfs: send, skip backreference walking for extents with many references - btrfs: record all roots for rename exchange on a subvol - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer - rtlwifi: rtl8192de: Fix missing enable interrupt flag - ovl: fix corner case of non-unique st_dev;st_ino - ovl: relax WARN_ON() on rename to self - [armhf] hwrng: omap - Fix RNG wait loop timeout - dm writecache: handle REQ_FUA - dm zoned: reduce overhead of backing device checks - workqueue: Fix spurious sanity check failures in destroy_workqueue() - workqueue: Fix pwq ref leak in rescuer_thread() - ASoC: rt5645: Fixed buddy jack support. - ASoC: rt5645: Fixed typo for buddy jack support. - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report - md: improve handling of bio with REQ_PREFLUSH in md_flush_request() - blk-mq: avoid sysfs buffer overflow with too many CPU cores - cgroup: pids: use atomic64_t for pids->limit - ar5523: check NULL before memcpy() in ar5523_cmd() - [s390x] mm: properly clear _PAGE_NOEXEC bit when it is not supported - media: cec.h: CEC_OP_REC_FLAG_ values were swapped - cpuidle: Do not unset the driver if it is there already - erofs: zero out when listxattr is called with no xattr - [x86] intel_th: Fix a double put_device() in error path - [x86] intel_th: pci: Add Ice Lake CPU support - [x86] intel_th: pci: Add Tiger Lake CPU support - PM / devfreq: Lock devfreq in trans_stat_show - [ppc64el] cpufreq: powernv: fix stack bloat and hard limit on number of CPUs - ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge - ACPI: OSL: only free map once in osl.c - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() - ACPI: PM: Avoid attaching ACPI PM domain to certain devices - [arm64] pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() - [armhf] pinctrl: samsung: Add of_node_put() before return in error path - [armhf] pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init - [armhf] pinctrl: samsung: Fix device node refcount leaks in init code - [armhf] mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card - [armhf] dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity - ppdev: fix PPGETTIME/PPSETTIME ioctls - [ppc64el] Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB - [ppc64el] xive: Prevent page fault issues in the machine crash handler - [ppc64el] Allow flush_icache_range to work across ranges >4GB - [ppc64el] xive: Skip ioremap() of ESB pages for LSI interrupts - video/hdmi: Fix AVI bar unpack - quota: Check that quota is not dirty before release - ext2: check err when partial != NULL - quota: fix livelock in dquot_writeback_dquots - ext4: Fix credit estimate for final inode freeing - reiserfs: fix extended attributes on the root directory - block: fix single range discard merge - [s390x] scsi: zfcp: trace channel log even for FCP command responses - scsi: qla2xxx: Fix DMA unmap leak - scsi: qla2xxx: Fix hang in fcport delete path - scsi: qla2xxx: Fix session lookup in qlt_abort_work() - scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() - scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value - scsi: qla2xxx: Fix message indicating vectors used by driver - scsi: qla2xxx: Fix SRB leak on switch command timeout - xhci: make sure interrupts are restored to correct state - usb: typec: fix use after free in typec_register_port() - [armhf] omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 - scsi: lpfc: Cap NPIV vports to 256 - scsi: lpfc: Correct code setting non existent bits in sli4 ABORT WQE - scsi: lpfc: Correct topology type reporting on G7 adapters - sch_cake: Correctly update parent qlen when splitting GSO packets - net/smc: do not wait under send_lock - [arm64] net: hns3: clear pci private data when unload hns3 driver - [arm64] net: hns3: change hnae3_register_ae_dev() to int - [arm64] net: hns3: Check variable is valid before assigning it to another - [arm64] scsi: hisi_sas: send primitive NOTIFY to SSP situation only - [arm64] scsi: hisi_sas: Reject setting programmed minimum linkrate > 1.5G - [x86] MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models - [x86] MCE/AMD: Carve out the MC4_MISC thresholding quirk - ath10k: fix fw crash by moving chip reset after napi disabled - [ppc64el] Fix vDSO clock_getres() - ext4: work around deleting a file with i_nlink == 0 safely (CVE-2019-19447) - mm/shmem.c: cast the type of unmap_start to u64 - rtc: disable uie before setting time and enable after - splice: only read in as much information as there is pipe buffer space - ext4: fix a bug in ext4_wait_for_tail_page_commit - [armhf,arm64] mfd: rk808: Fix RK818 ID template - mm, thp, proc: report THP eligibility for each vma - [s390x] smp,vdso: fix ASCE handling - blk-mq: make sure that line break can be printed - workqueue: Fix missing kfree(rescuer) in destroy_workqueue() - perf callchain: Fix segfault in thread__resolve_callchain_sample() - gre: refetch erspan header from skb->data after pskb_may_pull() - sunrpc: fix crash when cache_head become valid before update - net/mlx5e: Fix SFF 8472 eeprom length - leds: trigger: netdev: fix handling on interface rename - gfs2: fix glock reference problem in gfs2_trans_remove_revoke - of: overlay: add_changeset_property() memory leak - kernel/module.c: wakeup processes in module_wq on module unload - cifs: Fix potential softlockups while refreshing DFS cache - [x86] gpiolib: acpi: Add Terra Pad 1061 to the run_edge_events_on_boot_blacklist - raid5: need to set STRIPE_HANDLE for batch head - scsi: qla2xxx: Change discovery state before PLOGI - [x86] iio: imu: mpu6050: add missing available scan masks - idr: Fix idr_get_next_ul race with idr_remove - of: unittest: fix memory leak in attach_node_and_children https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.91 - inet: protect against too small mtu values. - mqprio: Fix out-of-bounds access in mqprio_dump - net: bridge: deny dev_set_mac_address() when unregistering - net: dsa: fix flow dissection on Tx path - net: ethernet: ti: cpsw: fix extra rx interrupt - net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues - [arm64] net: thunderx: start phy before starting autonegotiation - openvswitch: support asymmetric conntrack - tcp: md5: fix potential overestimation of TCP option space - tipc: fix ordering of tipc module init and exit routine - net/mlx5e: Query global pause state before setting prio2buffer - tcp: fix rejected syncookies due to stale timestamps - tcp: tighten acceptance of ACKs not matching a child socket - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() - [arm64] Revert "arm64: preempt: Fix big-endian when checking preempt count in assembly" - mmc: block: Make card_busy_detect() a bit more generic - mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response - PCI/PM: Always return devices to D0 when thawing - PCI: pciehp: Avoid returning prematurely from sysfs requests - [x86] PCI: Fix Intel ACS quirk UPDCR register address - PCI/MSI: Fix incorrect MSI-X masking on resume - [arm64] PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3 - [arm64] rpmsg: glink: Set tail pointer to 0 at end of FIFO - [arm64] rpmsg: glink: Fix reuse intents memory leak issue - [arm64] rpmsg: glink: Fix use after free in open_ack TIMEOUT case - [arm64] rpmsg: glink: Put an extra reference during cleanup - [arm64] rpmsg: glink: Fix rpmsg_register_device err handling - [arm64] rpmsg: glink: Don't send pending rx_done during remove - [arm64] rpmsg: glink: Free pending deferred work on remove - cifs: smbd: Return -EAGAIN when transport is reconnecting - cifs: smbd: Add messages on RDMA session destroy and reconnection - cifs: smbd: Return -EINVAL when the number of iovs exceeds SMBDIRECT_MAX_SGE - cifs: Don't display RDMA transport on reconnect - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect - CIFS: Close open handle after interrupted close - [armhf] tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() - vfio/pci: call irq_bypass_unregister_producer() before freeing irq - dma-buf: Fix memory leak in sync_file_merge() - [arm64] drm: meson: venc: cvbs: fix CVBS mode matching - dm mpath: remove harmful bio-based optimization - dm btree: increase rebalance threshold in __rebalance2() - scsi: iscsi: Fix a potential deadlock in the timeout handler - scsi: qla2xxx: Change discovery state before PLOGI - drm/radeon: fix r1xx/r2xx register checker for POT textures - xhci: fix USB3 device initiated resume race with roothub autosuspend https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.92 - af_packet: set defaule value for tmo - [amd64] fjes: fix missed check in fjes_acpi_add - [arm64] net: hisilicon: Fix a BUG trigered by wrong bytes_compl - net: qlogic: Fix error paths in ql_alloc_large_buffers() - net: usb: lan78xx: Fix suspend/resume PHY register access error - qede: Disable hardware gro when xdp prog is installed - qede: Fix multicast mac configuration - sctp: fully initialize v4 addr in some functions - btrfs: don't double lock the subvol_sem for rename exchange - btrfs: do not call synchronize_srcu() in inode_tree_del - Btrfs: fix missing data checksums after replaying a log tree - btrfs: send: remove WARN_ON for readonly mount - btrfs: abort transaction after failed inode updates in create_subvol - btrfs: skip log replay on orphaned roots - btrfs: do not leak reloc root if we fail to read the fs root - btrfs: handle ENOENT in btrfs_uuid_tree_iterate - Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues - ALSA: pcm: Avoid possible info leaks from PCM stream buffers - ALSA: hda/ca0132 - Keep power on during processing DSP response - ALSA: hda/ca0132 - Avoid endless loop - ALSA: hda/ca0132 - Fix work handling in delayed HP detection - [arm64,armhf] drm/panel: Add missing drm_panel_init() in panel drivers - drm/amdgpu: grab the id mgr lock while accessing passid_mapping - spi: Add call to spi_slave_abort() function when spidev driver is released - [x86] staging: rtl8192u: fix multiple memory leaks on error path - staging: rtl8188eu: fix possible null dereference - rtlwifi: prevent memory leak in rtl_usb_probe (CVE-2019-19063) - libertas: fix a potential NULL pointer dereference - ath10k: fix backtrace on coredump - IB/iser: bound protection_sg size by data_sg size - [arm64] media: venus: core: Fix msm8996 frequency table - ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq - pinctrl: devicetree: Avoid taking direct reference to device name string - [amd64] drm/amdkfd: fix a potential NULL pointer dereference - [arm64] media: venus: Fix occasionally failures to suspend - [armhf] hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() - [arm64,armhf] drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller - block: Fix writeback throttling W=1 compiler warnings - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring (CVE-2019-19057) - drm/drm_vblank: Change EINVAL by the correct errno - media: cx88: Fix some error handling path in 'cx8800_initdev()' - [armhf] media: ti-vpe: vpe: Fix Motion Vector vpdma stride - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number - [armhf] media: ti-vpe: vpe: Make sure YUYV is set as default format - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic - [armhf] media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage - [x86] syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 - [x86] mm: Use the correct function type for native_set_fixmap() - ath10k: Correct error handling of dma_map_single() - [arm64,armhf] drm/bridge: dw-hdmi: Restore audio when setting a mode - perf report: Add warning when libunwind not compiled in - usb: usbfs: Suppress problematic bind and unbind uevents. - Bluetooth: missed cpu_to_le16 conversion in hci_init4_req - Bluetooth: Workaround directed advertising bug in Broadcom controllers - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL - [x86] mce: Lower throttling MCE messages' priority to warning - [x86] drm/gma500: fix memory disclosures due to uninitialized bytes - rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot - ipmi: Don't allow device module unload when in use - [x86] ioapic: Prevent inconsistent state when moving an interrupt - md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit - [arm64] psci: Reduce the waiting time for cpu_psci_cpu_kill() - i40e: initialize ITRN registers with correct values - net: phy: dp83867: enable robust auto-mdix - [arm64,armhf] drm/tegra: sor: Use correct SOR index on Tegra210 - ACPI: button: Add DMI quirk for Medion Akoya E2215T - RDMA/qedr: Fix memory leak in user qp and mr - [arm64,armhf] gpu: host1x: Allocate gather copy for host1x - [arm64,armhf] net: dsa: LAN9303: select REGMAP when LAN9303 enable - [arm64] phy: qcom-usb-hs: Fix extcon double register after power cycle - [s390x] time: ensure get_clock_monotonic() returns monotonic values - [s390x] mm: add mm_pxd_folded() checks to pxd_free() - [arm64] net: hns3: add struct netdev_queue debug info for TX timeout - libata: Ensure ata_port probe has completed before detach - loop: fix no-unmap write-zeroes request behavior - Bluetooth: Fix advertising duplicated flags - pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() - ixgbe: protect TX timestamping from API misuse - media: rcar_drif: fix a memory disclosure (CVE-2019-18786) - media: v4l2-core: fix touch support in v4l_g_fmt - rfkill: allocate static minor - bnx2x: Fix PF-VF communication over multi-cos queues. - ALSA: timer: Limit max amount of slave instances - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() - perf probe: Fix to find range-only function instance - perf probe: Fix to list probe event with correct line number - perf jevents: Fix resource leak in process_mapfile() and main() - perf probe: Walk function lines in lexical blocks - perf probe: Fix to probe an inline function which has no entry pc - perf probe: Fix to show ranges of variables in functions without entry_pc - perf probe: Fix to show inlined function callsite without entry_pc - perf probe: Fix to probe a function which has no entry pc - perf tools: Splice events onto evlist even on error - perf parse: If pmu configuration fails free terms - perf probe: Skip overlapped location on searching variables - perf probe: Return a better scope DIE if there is no best scope - perf probe: Fix to show calling lines of inlined functions - perf probe: Skip end-of-sequence and non statement lines - perf probe: Filter out instances except for inlined subroutine and subprogram - ath10k: fix get invalid tx rate for Mesh metric - media: pvrusb2: Fix oops on tear-down when radio support is not present - ice: delay less - [amd64] spi: pxa2xx: Add missed security checks - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile - iio: dac: ad5446: Add support for new AD5600 DAC - [x86] ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint - [s390x] disassembler: don't hide instruction addresses - nvme: Discard workaround for non-conformant devices - parport: load lowlevel driver if ports not found - bcache: fix static checker warning in bcache_device_free() - cpufreq: Register drivers only after CPU devices have been registered - tracing: use kvcalloc for tgid_map array allocation - tracing/kprobe: Check whether the non-suffixed symbol is notrace - bcache: fix deadlock in bcache_allocator - iwlwifi: mvm: fix unaligned read of rx_pkt_status - [arm64] spi: tegra20-slink: add missed clk_unprepare - tun: fix data-race in gro_normal_list() - crypto: virtio - deal with unsupported input sizes - btrfs: don't prematurely free work in end_workqueue_fn() - btrfs: don't prematurely free work in run_ordered_work() - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 - [x86] insn: Add some Intel instructions to the opcode map - brcmfmac: remove monitor interface when detaching - iwlwifi: check kasprintf() return value - [armhf] net: ethernet: ti: ale: clean ale tbl on init and intf restart - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c - mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED - net: phy: initialise phydev speed and duplex sanely - btrfs: don't prematurely free work in reada_start_machine_worker() - btrfs: don't prematurely free work in scrub_missing_raid56_worker() - Revert "mmc: sdhci: Fix incorrect switch to HS mode" - can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices (CVE-2019-19947) - usb: xhci: Fix build warning seen with CONFIG_PM=n - [s390x] ftrace: fix endless recursion in function_graph tracer - btrfs: return error pointer from alloc_test_extent_buffer - usbip: Fix receive error in vhci-hcd when using scatter-gather - usbip: Fix error path of vhci_recv_ret_submit() - cpufreq: Avoid leaving stale IRQ work items during CPU offline - [x86] intel_th: pci: Add Comet Lake PCH-V support - [x86] intel_th: pci: Add Elkhart Lake SOC support - [x86] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes - [x86] staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value - ext4: fix ext4_empty_dir() for directories with holes (CVE-2019-19037) - ext4: check for directory entries too close to block end - ext4: unlock on error in ext4_expand_extra_isize() - [arm64] KVM: Ensure 'params' is initialised when looking up sys register - [x86] MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() - [x86] MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] - [powerpc*] irq: fix stack overflow verification - [arm64] mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register - mmc: sdhci: Update the tuning failed messages to pr_debug level - mmc: sdhci: Workaround broken command queuing on Intel GLK - mmc: sdhci: Add a quirk for broken command queuing - nbd: fix shutdown and recv work deadlock - perf probe: Fix to show function entry line as probe-able https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.93 - scsi: lpfc: Fix discovery failures when target device connectivity bounces - scsi: mpt3sas: Fix clear pending bit in ioctl status - scsi: lpfc: Fix locking on mailbox command completion - Input: atmel_mxt_ts - disable IRQ across suspend - f2fs: fix to update time in lazytime mode - [arm64,armhf] iommu: rockchip: Free domain on .domain_free - [arm64,armhf] iommu/tegra-smmu: Fix page tables in > 4 GiB memory - scsi: target: compare full CHAP_A Algorithm strings - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices - scsi: csiostor: Don't enable IRQs too early - [arm64] scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec() - [ppc64el] pseries: Mark accumulate_stolen_time() as notrace - [ppc64el] pseries: Don't fail hash page table insert for bolted mapping - clocksource/drivers/timer-of: Use unique device name instead of timer - [ppc64el] security/book3s64: Report L1TF status in sysfs - [ppc64el] book3s64/hash: Add cond_resched to avoid soft lockup warning - ext4: update direct I/O read lock pattern for IOCB_NOWAIT - ext4: iomap that extends beyond EOF should be marked dirty - jbd2: Fix statistics for the number of logged blocks - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow - f2fs: fix to update dir's i_pino during cross_rename - [arm64] clk: qcom: Allow constant ratio freq tables for rcg - clk: clk-gpio: propagate rate change to parent - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences - [ppc64el] PCI: rpaphp: Fix up pointer to first drc-info entry - scsi: ufs: fix potential bug which ends in system hang - [ppc64el] PCI: rpaphp: Don't rely on firmware feature to imply drc-info support - [ppc64el] PCI: rpaphp: Annotate and correctly byte swap DRC properties - [ppc64el] PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info - [ppc64el] powerpc/security: Fix wrong message when RFI Flush is disable - bcache: at least try to shrink 1 node in bch_mca_scan() - HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse - HID: logitech-hidpp: Silence intermittent get_battery_capacity errors - [armhf] 8937/1: spectre-v2: remove Brahma-B53 from hardening - libnvdimm/btt: fix variable 'rc' set but not used - HID: Improve Windows Precision Touchpad detection. - HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device - watchdog: Fix the race between the release of watchdog_core_data and cdev - scsi: pm80xx: Fix for SATA device discovery - scsi: ufs: Fix error handing during hibern8 enter - scsi: scsi_debug: num_tgts must be >= 0 - scsi: iscsi: Don't send data to unbound connection - scsi: target: iscsi: Wait for all commands to finish before freeing a session - apparmor: fix unsigned len comparison with less than zero - scripts/kallsyms: fix definitely-lost memory leak - cdrom: respect device capabilities during opening action - perf script: Fix brstackinsn for AUXTRACE - perf regs: Make perf_reg_name() return "unknown" instead of NULL - [s390x] zcrypt: handle new reply code FILTERED_BY_HYPERVISOR - [s390x] cpum_sf: Check for SDBT and SDB consistency - ocfs2: fix passing zero to 'PTR_ERR' warning - kernel: sysctl: make drop_caches write-only - userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK - [x86] mce: Fix possibly incorrect severity calculation on AMD - net, sysctl: Fix compiler warning when only cBPF is present - netfilter: nf_queue: enqueue skbs with NULL dst - ALSA: hda - Downgrade error message for single-cmd fallback - bonding: fix active-backup transition after link failure - perf strbuf: Remove redundant va_end() in strbuf_addv() - Make filldir[64]() verify the directory entry filename is valid (CVE-2019-10220) - filldir[64]: remove WARN_ON_ONCE() for bad directory entries (CVE-2019-10220) - netfilter: ebtables: compat: reject all padding in matches/watchers - 6pack,mkiss: fix possible deadlock - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() - inetpeer: fix data-race in inet_putpeer / inet_putpeer - net: add a READ_ONCE() in skb_peek_tail() - net: icmp: fix data-race in cmp_global_allow() - hrtimer: Annotate lockless access to timer->state - net: ena: fix napi handler misbehavior when the napi budget is zero - net/mlxfw: Fix out-of-memory error in mfa2 flash burning - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs - ptp: fix the race between the release of ptp_clock and cdev - tcp: Fix highest_sack and highest_sack_seq - udp: fix integer overflow while computing available space in sk_rcvbuf - vhost/vsock: accept only packets with the right dst_cid - net: add bool confirm_neigh parameter for dst_ops.update_pmtu - ip6_gre: do not confirm neighbor when do pmtu update - gtp: do not confirm neighbor when do pmtu update - net/dst: add new function skb_dst_update_pmtu_no_confirm - tunnel: do not confirm neighbor when do pmtu update - vti: do not confirm neighbor when do pmtu update - sit: do not confirm neighbor when do pmtu update - net/dst: do not confirm neighbor for vxlan and geneve pmtu update - gtp: do not allow adding duplicate tid and ms_addr pdp context - [arm64,armhf] net: marvell: mvpp2: phylink requires the link interrupt - tcp/dccp: fix possible race __inet_lookup_established() - tcp: do not send empty skb from tcp_write_xmit() - gtp: fix wrong condition in gtp_genl_dump_pdp() - gtp: fix an use-after-free in ipv4_pdp_find() - gtp: avoid zero size hashtable - [arm64,armhf] pinctrl: baytrail: Really serialize all register accesses https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.94 - nvme_fc: add module to ops template to allow module references - nvme-fc: fix double-free scenarios on hw queues - drm/amdgpu: add check before enabling/disabling broadcast mode - drm/amdgpu: add cache flush workaround to gfx8 emit_fence - PM / devfreq: Fix devfreq_notifier_call returning errno - PM / devfreq: Set scaling_max_freq to max on OPP notifier error - PM / devfreq: Don't fail devfreq_dev_release if not in list - afs: Fix afs_find_server lookups for ipv4 peers - afs: Fix SELinux setting security label on /afs - RDMA/cma: add missed unregister_pernet_subsys in init failure - rxe: correctly calculate iCRC for unaligned payloads - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func - scsi: qla2xxx: Drop superfluous INIT_WORK of del_work - scsi: qla2xxx: Don't call qlt_async_event twice - scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length - scsi: qla2xxx: Configure local loop for N2N target - scsi: qla2xxx: Send Notify ACK after N2N PLOGI - scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI - scsi: iscsi: qla4xxx: fix double free in probe - scsi: libsas: stop discovering if oob mode is disconnected (CVE-2019-19965) - drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit - usb: gadget: fix wrong endpoint desc - net: make socket read/write_iter() honor IOCB_NOWAIT - afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP - md: raid1: check rdev before reference in raid1_sync_request func - [s390x] cpum_sf: Adjust sampling interval to avoid hitting sample limits - [s390x] cpum_sf: Avoid SBD overflow condition in irq handler - IB/mlx4: Follow mirror sequence of device add during device removal - IB/mlx5: Fix steering rule of drop and count - xen-blkback: prevent premature module unload - xen/balloon: fix ballooned page accounting without hotplug enabled - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation - ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker - ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC - ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen - xfs: fix mount failure crash on invalid iclog memory access - taskstats: fix data-race - drm: limit to INT_MAX in create_blob ioctl - netfilter: nft_tproxy: Fix port selector on Big Endian - ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code - ALSA: usb-audio: fix set_format altsetting sanity check - ALSA: usb-audio: set the interface format after resume on Dell WD19 - ALSA: hda/realtek - Add headset Mic no shutup for ALC283 - [arm64,armhf] drm/sun4i: hdmi: Remove duplicate cleanup calls - [mips*] Avoid VDSO ABI breakage due to global register variable - media: pulse8-cec: fix lost cec_transmit_attempt_done() call - media: cec: CEC 2.0-only bcast messages were ignored - media: cec: avoid decrementing transmit_queue_sz if it is 0 - media: cec: check 'transmit_in_progress', not 'transmitting' - mm/zsmalloc.c: fix the migrated zspage statistics. - memcg: account security cred as well to kmemcg - mm: move_pages: return valid node id in status if the page is already on the target node - [x86,arm64] pstore/ram: Write new dumps to start of recycled zones - locks: print unsigned ino in /proc/locks - compat_ioctl: block: handle Persistent Reservations - compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE - ata: libahci_platform: Export again ahci_platform_able_phys() - libata: Fix retrieving of active qcs - gpiolib: fix up emulated open drain outputs - tracing: Fix lock inversion in trace_event_enable_tgid_record() - tracing: Avoid memory leak in process_system_preds() - tracing: Have the histogram compare functions convert to u64 first - tracing: Fix endianness bug in histogram trigger - apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock - [i386] ALSA: cs4236: fix error return comparison of an unsigned integer - ALSA: firewire-motu: Correct a typo in the clock proc string - exit: panic before exit_mm() on global init exit - [arm64] Revert support for execute-only user mappings - ftrace: Avoid potential division by zero in function profiler - [arm64] drm/msm: include linux/sched/task.h - PM / devfreq: Check NULL governor in available_governors_show - nfsd4: fix up replay_matches_cache() - [x86,arm64] HID: i2c-hid: Reset ALPS touchpads on resume - ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 - xfs: don't check for AG deadlock for realtime files in bunmapi - [x86] platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table - Bluetooth: btusb: fix PM leak in error case of setup - Bluetooth: delete a stray unlock - Bluetooth: Fix memory leak in hci_connect_le_scan - media: flexcop-usb: ensure -EIO is returned on error condition - media: usb: fix memory leak in af9005_identify_state (CVE-2019-18809) - [arm64] dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning - [arm64] tty: serial: msm_serial: Fix lockup for sysrq and oops - fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP - bdev: Factor out bdev revalidation into a common helper - bdev: Refresh bdev size for disks without partitioning - scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails - drm/mst: Fix MST sideband up-reply failure handling - [ppc64el] pseries/hvconsole: Fix stack overread via udbg - [ppc64el] KVM: PPC: Book3S HV: use smp_mb() when setting/clearing host_ipi flag - rxrpc: Fix possible NULL pointer access in ICMP handling - tcp: annotate tp->rcv_nxt lockless reads - net: core: limit nested device depth - ath9k_htc: Modify byte order for an error message - ath9k_htc: Discard undersized packets - xfs: periodically yield scrub threads to the scheduler - net: add annotations on hh->hh_len lockless accesses - ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps - [s390x] smp: fix physical to logical CPU map for SMT - xen/blkback: Avoid unmapping unmapped grant pages - [x86] perf/x86/intel/bts: Fix the use of page_private() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.95 - bpf: Fix passing modified ctx to ld/abs/ind instruction - regulator: fix use after free issue - ASoC: max98090: fix possible race conditions - netfilter: ctnetlink: netns exit must wait for callbacks - mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (CVE-2019-14901) - [x86] efi: Update e820 with reserved EFI boot services data to fix kexec breakage - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 - efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs - efi/gop: Return EFI_SUCCESS if a usable GOP was found - efi/gop: Fix memory leak in __gop_query32/64() - netfilter: uapi: Avoid undefined left-shift in xt_sctp.h - netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets - netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() - [arm64] spi: spi-cavium-thunderx: Add missing pci_release_regions() - ASoC: topology: Check return value for soc_tplg_pcm_create() - bnxt_en: Return error if FW returns more data than dump length - [mips*] bpf, mips: Limit to 33 tail calls - [armhf] spi: spi-ti-qspi: Fix a bug when accessing non default CS - [powerpc*] Ensure that swiotlb buffer is allocated from low memory - btrfs: Fix error messages in qgroup_rescan_init - bpf: Clear skb->tstamp in bpf_redirect when necessary - bnx2x: Do not handle requests from VFs after parity - bnx2x: Fix logic to get total no. of PFs per engine - cxgb4: Fix kernel panic while accessing sge_info - net: usb: lan78xx: Fix error message format specifier - rfkill: Fix incorrect check to avoid NULL pointer dereference - iommu/iova: Init the struct iova to fix the possible memleak - [x86] perf/x86/intel: Fix PT PMI handling - fs: avoid softlockups in s_inodes iterators - [arm64,armhf] net: stmmac: Do not accept invalid MTU values - [arm64,armhf] net: stmmac: xgmac: Clear previous RX buffer size - [arm64,armhf] net: stmmac: RX buffer size must be 16 byte aligned - [arm64,armhf] net: stmmac: Always arm TX Timer at end of transmission start - [s390x] dasd/cio: Interpret ccw_device_get_mdc return value correctly - [s390x] dasd: fix memleak in path handling error case - block: fix memleak when __blk_rq_map_user_iov() is failed - llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) - [x86] hv_netvsc: Fix unwanted rx_table reset - [powerpc*] vcpu: Assume dedicated processors as non-preempt - [powerpc*] spinlocks: Include correct header for static key - [armhf] cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull - gtp: fix bad unlock balance in gtp_encap_enable_socket - macvlan: do not assume mac_header is set in macvlan_broadcast() - [arm64,armhf] net: dsa: mv88e6xxx: Preserve priority when setting CPU port. - [arm64,armhf] net: stmmac: dwmac-sun8i: Allow all RGMII modes - [arm64,armhf] net: stmmac: dwmac-sunxi: Allow all RGMII modes - net: usb: lan78xx: fix possible skb leak - pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM - sch_cake: avoid possible divide by zero in cake_enqueue() - sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY - tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK - vxlan: fix tos value before xmit - vlan: fix memory leak in vlan_dev_set_egress_priority - vlan: vlan_changelink() should propagate errors - net: sch_prio: When ungrafting, replace with FIFO - [arm64,armhf] usb: dwc3: gadget: Fix request complete check - USB: core: fix check for duplicate endpoints - USB: serial: option: add Telit ME910G1 0x110a composition - usb: missing parentheses in USE_NEW_SCHEME https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.96 - chardev: Avoid potential use-after-free in 'chrdev_open()' - i2c: fix bus recovery stop mode timing - [arm64,armhf] usb: chipidea: host: Disable port power only if previously enabled - ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5 - ALSA: hda/realtek - Add new codec supported for ALCS1200A - ALSA: hda/realtek - Set EAPD control to default for ALC222 - [x86] ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen - kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail - tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined - tracing: Change offset type to s32 in preempt/irq tracepoints - HID: Fix slab-out-of-bounds read in hid_field_extract - HID: uhid: Fix returning EPOLLOUT from uhid_char_poll - HID: hid-input: clear unmapped usages - Input: add safety guards to input_set_keycode() - [arm64,armhf] drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model - drm/fb-helper: Round up bits_per_pixel if possible - drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ - can: kvaser_usb: fix interface sanity check - can: gs_usb: gs_usb_probe(): use descriptors of current altsetting - can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs - gpiolib: acpi: Turn dmi_system_id table into a generic quirk table - gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism - [x86] staging: vt6656: set usb_set_intfdata on driver fail. - USB: serial: option: add ZLP support for 0x1bc7/0x9010 - [arm64,armhf] usb: musb: fix idling for suspend after disconnect interrupt - [arm64,armhf] usb: musb: Disable pullup at init - [arm64,armhf] usb: musb: dma: Correct parameter passed to IRQ handler - [x86] staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713 - staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 - serdev: Don't claim unsupported ACPI serial devices - tty: link tty and port before configuring it as console - tty: always relink the port - mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (CVE-2019-14895) - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf (CVE-2019-19056) - scsi: bfa: release allocated memory in case of error (CVE-2019-19066) - rtl8xxxu: prevent leaking urb (CVE-2019-19068) - ath10k: fix memory leak (CVE-2019-19078) - HID: hiddev: fix mess in hiddev_open() - USB: Fix: Don't skip endpoint descriptors with maxpacket=0 - netfilter: arp_tables: init netns pointer in xt_tgchk_param struct - netfilter: conntrack: dccp, sctp: handle null timeout argument - netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present - [x86] drm/i915/gen9: Clear residual context state on context switch (CVE-2019-14615) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.97 - hidraw: Return EPOLLOUT from hidraw_poll - HID: hidraw: Fix returning EPOLLOUT from hidraw_poll - HID: hidraw, uhid: Always report EPOLLOUT - cfg80211/mac80211: make ieee80211_send_layer2_update a public function - mac80211: Do not send Layer 2 Update frame before authorization (CVE-2019-5108) - f2fs: Move err variable to function scope in f2fs_fill_dentries() - f2fs: check memory boundary by insane namelen - f2fs: check if file namelen exceeds max value (CVE-2019-9445) - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (CVE-2019-15217) - iwlwifi: dbg_ini: fix memory leak in alloc_sgtable (CVE-2019-19058) - iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init (CVE-2019-19059) - RDMA: Fix goto target to release the allocated memory (CVE-2019-19077) - dccp: Fix memleak in __feat_register_sp (CVE-2019-20096) - [x86] drm/i915: Fix use-after-free when destroying GEM context - ASoC: soc-core: Set dpcm_playback / dpcm_capture - [armhf] mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy - [arm64] gpio: zynq: Fix for bug in zynq_gpio_restore_context API - iommu: Remove device link to group on failure - gpio: Fix error message on out-of-range GPIO in lookup table - [s390x] qeth: fix false reporting of VNIC CHAR config failure - [s390x] qeth: Fix vnicc_is_in_use if rx_bcast not set - cifs: Adjust indentation in smb2_open_file - afs: Fix missing cell comparison in afs_test_super() - drm/ttm: fix start page for huge page check in ttm_put_pages() (CVE-2019-19927) - drm/ttm: fix incrementing the page pointer for huge pages (CVE-2019-19927) - btrfs: simplify inode locking for RWF_NOWAIT - RDMA/mlx5: Return proper error value - RDMA/srpt: Report the SCSI residual to the initiator - scsi: enclosure: Fix stale device oops with hot replug - scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI - [x86] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 - [x86] platform/x86: GPD pocket fan: Use default values when wrong modparams are given - xprtrdma: Fix completion wait during device removal - crypto: virtio - implement missing support for output IVs - NFSv2: Fix a typo in encode_sattr() - NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn - mei: fix modalias documentation - [armhf] clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume - [armhf] pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call - [x86] pinctrl: lewisburg: Update pin list according to v1.1v6 - scsi: sd: enable compat ioctls for sed-opal - af_unix: add compat_ioctl support - compat_ioctl: handle SIOCOUTQNSD - [arm64,armhf] PCI: dwc: Fix find_next_bit() usage - PCI/PTM: Remove spurious "d" from granularity message - [powerpc*] powernv: Disable native PCIe port management - [armhf] tty: serial: imx: use the sg count from dma_map_sg - [i386] tty: serial: pch_uart: correct usage of dma_unmap_sg - mtd: spi-nor: fix silent truncation in spi_nor_read() - mtd: spi-nor: fix silent truncation in spi_nor_read_raw() - rtlwifi: Remove unnecessary NULL check in rtl_regd_init - f2fs: fix potential overflow - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() - [mips*] cacheinfo: report shared CPU map - [arm64] drm/arm/mali: make malidp_mw_connector_helper_funcs static - [arm64] dmaengine: k3dma: Avoid null pointer traversal - [amd64] ioat: ioat_alloc_ring() failure handling. - ocfs2: call journal flush to mark journal as empty after journal recovery when mount https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.98 - clk: Don't try to enable critical clocks if prepare failed - iio: buffer: align the size of scan bytes to size of the largest element - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx - USB: serial: option: Add support for Quectel RM500Q - USB: serial: opticon: fix control-message timeouts - USB: serial: option: add support for Quectel RM500Q in QDL mode - USB: serial: suppress driver bind attributes - USB: serial: ch341: handle unbound port at reset_resume - USB: serial: io_edgeport: handle unbound ports on URB completion - USB: serial: io_edgeport: add missing active-port sanity check - USB: serial: keyspan: handle unbound ports - USB: serial: quatech2: handle unbound ports - [x86] scsi: fnic: fix invalid stack access - scsi: mptfusion: Fix double fetch bug in ioctl - [armhf] dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection - ALSA: dice: fix fallback from protocol extension into limited functionality - ALSA: seq: Fix racy access for queue timer in proc read - ALSA: usb-audio: fix sync-ep altsetting sanity check - [arm64] dts: allwinner: a64: olinuxino: Fix SDIO supply regulator - block: fix an integer overflow in logical block size - [armhf] dts: am571x-idk: Fix gpios property to have the correct gpio number - LSM: generalize flag passing to security_capable - ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() - usb: core: hub: Improved device recognition on remote wakeup - [x86] resctrl: Fix an imbalance in domain_remove_cpu() - [x86] CPU/AMD: Ensure clearing of SME/SEV features is maintained - [amd64] x86/efistub: Disable paging at mixed mode entry - [x86] resctrl: Fix potential memory leak - perf hists: Fix variable name's inconsistency in hists__for_each() macro - perf report: Fix incorrectly added dimensions as switch perf data file - mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment - mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid - btrfs: rework arguments of btrfs_unlink_subvol - btrfs: fix invalid removal of root ref - btrfs: do not delete mismatched root refs - btrfs: fix memory leak in qgroup accounting - mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() - [armhf] dts: imx6qdl: Add Engicam i.Core 1.5 MX6 - [armhf] dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL - [arm64,armhf] net: stmmac: 16KB buffer must be 16 byte aligned - [arm64,armhf] net: stmmac: Enable 16KB buffer size - mm/huge_memory.c: make __thp_get_unmapped_area static - mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment - bpf: Fix incorrect verifier simulation of ARSH under ALU32 - cfg80211: fix deadlocks in autodisconnect work - cfg80211: fix memory leak in cfg80211_cqm_rssi_update - cfg80211: fix page refcount issue in A-MSDU decap - netfilter: fix a use-after-free in mtype_destroy() - netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct - netfilter: nft_tunnel: fix null-attribute check - netfilter: nf_tables: remove WARN and add NLA_STRING upper limits - netfilter: nf_tables: store transaction list locally while requesting module - netfilter: nf_tables: fix flowtable list del corruption - NFC: pn533: fix bulk-message timeout - batman-adv: Fix DAT candidate selection on little endian systems - macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() - [x86] hv_netvsc: Fix memory leak when removing rndis device - [arm64] net: hns: fix soft lockup when there is not enough memory - net: usb: lan78xx: limit size of local TSO packets - ptp: free ptp device pin descriptors properly - r8152: add missing endpoint sanity check - tcp: fix marked lost packets not being retransmitted - xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk - tcp: refine rule to allow EPOLLOUT generation under mem pressure - [arm64] dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node - cfg80211: check for set_wiphy_params - tick/sched: Annotate lockless access to last_jiffies_update - drm/nouveau/bar/nv50: check bar1 vmm return value - drm/nouveau/bar/gf100: ensure BAR is mapped - drm/nouveau/mmu: qualify vmm during dtor - reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr - scsi: esas2r: unlock on error in esas2r_nvram_read_direct() - scsi: qla4xxx: fix double free bug - scsi: bnx2i: fix potential use after free - scsi: target: core: Fix a pr_debug() argument - scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI - scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan - scsi: core: scsi_trace: Use get_unaligned_be*() - perf probe: Fix wrong address verification [ Joe Richey ] * [cloud-amd64] tpm: Enable TPM drivers for Cloud (Closes: #946237) [ Salvatore Bonaccorso ] * Refresh powerpc-fix-mcpu-options-for-spe-only-compiler.patch (Context changes in 4.19.88) * Drop 0027-RDMA-hns-Fix-the-bug-with-updating-rq-head-pointer-w.patch * Drop 0028-RDMA-hns-Bugfix-for-the-scene-without-receiver-queue.patch * [rt] Refresh 0199-net-move-xmit_recursion-to-per-task-variable-on-RT.patch (Context changes in 4.19.88) * [rt] Update to 4.19.90-rt35: - Update "workqueue: rework" for workqueue changes in 4.19.90 * [rt] Drop 0245-Revert-arm64-preempt-Fix-big-endian-when-checking-pr.patch * Refresh 0013-scsi-hisi_sas-Relocate-some-codes-to-avoid-an-unused.patch for context changes in 4.19.93. * [rt] Refresh 0253-watchdog-prevent-deferral-of-watchdogd-wakeup-on-RT.patch (Context changes in 4.19.93) * [rt] Refresh 0199-net-move-xmit_recursion-to-per-task-variable-on-RT.patch (Context changes in 4.19.97) [ Ben Hutchings ] * [rt] Update to 4.19.94-rt38: - Refresh "x86/ioapic: Don't let setaffinity unmask threaded EOI interrupt too early" which was partly included in 4.19.92 * aufs: Update support patchset to aufs4.19.63+ 20200113; no functional changes * Bump ABI to 8 * libertas: Fix two buffer overflows at parsing bss descriptor (CVE-2019-14896, CVE-2019-14897) * wimax: i2400: fix memory leak (CVE-2019-19051) * wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle (CVE-2019-19051) * [amd64/cloud-amd64] hwrandom: Enable HW_RANDOM_VIRTIO (Closes: #914511) [ Noah Meyerhans ] * random: try to actively add entropy rather than passively wait for it (Closes: #948519) [ Aurelien Jarno ] * [mips*/malta] Enable POWER_RESET_PIIX4_POWEROFF. -- Salvatore Bonaccorso Sun, 26 Jan 2020 21:01:13 +0100 linux (4.19.87-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.68 - seq_file: fix problem when seeking mid-record - mm/hmm: fix bad subpage pointer in try_to_unmap_one - mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and MPOL_MF_STRICT were specified - mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind - mm/memcontrol.c: fix use after free in mem_cgroup_iter() - mm/usercopy: use memory range to be accessed for wraparound check - Revert "pwm: Set class for exported channels in sysfs" - cpufreq: schedutil: Don't skip freq update when limits change - [x86] ALSA: hda/realtek - Add quirk for HP Envy x360 - ALSA: hda - Apply workaround for another AMD chip 1022:1487 - ALSA: hda - Fix a memory leak bug - ALSA: hda - Add a generic reboot_notify - ALSA: hda - Let all conexant codec enter D3 when rebooting - HID: holtek: test for sanity of intfdata - HID: hiddev: avoid opening a disconnected device - HID: hiddev: do cleanup in failure of opening a device - Input: kbtab - sanity check for endpoint type - Input: iforce - add sanity checks - net: usb: pegasus: fix improper read if get_registers() fail - netfilter: ebtables: also count base chain policies - xen/pciback: remove set but not used variable 'old_state' - [armhf,arm64] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail - perf header: Fix divide by zero error if f_header.attr_size==0 - perf header: Fix use of unitialized value warning - libata: zpodd: Fix small read overflow in zpodd_get_mech_type() - Btrfs: fix deadlock between fiemap and transaction commits - scsi: hpsa: correct scsi command status issue after reset - scsi: qla2xxx: Fix possible fcport null-pointer dereferences - drm/amdgpu: fix a potential information leaking bug - ata: libahci: do not complain in case of deferred probe - kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules - [arm64] efi: fix variable 'si' set but not used - [arm64] unwind: Prohibit probing on return_address() - [arm64] mm: fix variable 'pud' set but not used - IB/core: Add mitigation for Spectre V1 - IB/mlx5: Fix MR registration flow to use UMR properly - IB/mad: Fix use-after-free in ib mad completion handling - [arm64] drm: msm: Fix add_gpu_components - [armhf] drm/exynos: fix missing decrement of retry counter - ocfs2: remove set but not used variable 'last_hash' - asm-generic: fix -Wtype-limits compiler warnings - [arm64] KVM: regmap: Fix unexpected switch fall-through - [armhf,arm64] KVM: Sync ICH_VMCR_EL2 back when about to block - [x86] staging: comedi: dt3000: Fix signed integer overflow 'divider * base' - [x86] staging: comedi: dt3000: Fix rounding up of timer divisor - USB: core: Fix races in character device registration and deregistraion - usb: cdc-acm: make sure a refcount is taken early enough - USB: CDC: fix sanity checks in CDC union parser - USB: serial: option: add D-Link DWM-222 device ID - USB: serial: option: Add support for ZTE MF871A - USB: serial: option: add the BroadMobi BM818 card - USB: serial: option: Add Motorola modem UARTs - [x86] drm/i915/cfl: Add a new CFL PCI ID. - [arm64] ftrace: Ensure module ftrace trampoline is coherent with I-side - Input: psmouse - fix build error of multiple definition - bnx2x: Fix VF's VLAN reconfiguration in reload. - bonding: Add vlan tx offload to hw_enc_features - net: dsa: Check existence of .port_mdb_add callback before calling it - net/mlx4_en: fix a memory leak bug - net/packet: fix race in tpacket_snd() - sctp: fix memleak in sctp_send_reset_streams - sctp: fix the transport error_count check - team: Add vlan tx offload to hw_enc_features - tipc: initialise addr_trail_end when setting node addresses - xen/netback: Reset nr_frags before freeing skb - net/mlx5e: Only support tx/rx pause setting for port owner - net/mlx5e: Use flow keys dissector to parse packets for ARFS - [arm64] mmc: sdhci-of-arasan: Do now show error message in case of deffered probe https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.69 - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT - [mips*] kernel: only use i8253 clocksource with periodic clockevent - [mips*] fix cacheinfo - netfilter: ebtables: fix a memory leak bug in compat - ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks - bonding: Force slave speed check after link state recovery for 802.3ad - [armhf,arm64] net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links - can: dev: call netif_carrier_off() in register_candev() - can: gw: Fix error path of cgw_module_init - [armhf,arm64] ASoC: rockchip: Fix mono capture - [armhf] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint - net: usb: qmi_wwan: Add the BroadMobi BM818 card - qed: RDMA - Fix the hw_ver returned in device attributes - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() - mac80211_hwsim: Fix possible null-pointer dereferences in hwsim_dump_radio_nl() - netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too - netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets - netfilter: ipset: Fix rename concurrency with listing - rxrpc: Fix potential deadlock - rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack - net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed() - can: sja1000: force the string buffer NULL-terminated - can: peak_usb: force the string buffer NULL-terminated - net/ethernet/qlogic/qed: force the string buffer NULL-terminated - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() - NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts - HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 - HID: input: fix a4tech horizontal wheel custom usage - [armhf,arm64] drm/rockchip: Suspend DP late - SMB3: Fix potential memory leak when processing compound chain - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL - [s390x] put _stext and _etext into .text section - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' - [armhf,arm64] net: stmmac: Fix issues when number of Queues >= 4 - [armhf,arm64] net: stmmac: tc: Do not return a fragment entry - [arm64] net: hisilicon: make hip04_tx_reclaim non-reentrant - [arm64] net: hisilicon: fix hip04-xmit never return TX_BUSY - [arm64] net: hisilicon: Fix dma_map_single failed on arm64 - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests - libata: add SG safety checks in SFF pio transfers - [x86] lib/cpu: Address missing prototypes warning - [x86] drm/vmwgfx: fix memory leak when too many retries have occurred - block, bfq: handle NULL return value by bfq_init_rq() - perf ftrace: Fix failure to set cpumask when only one cpu is present - perf cpumap: Fix writing to illegal memory in handling cpumap mask - perf pmu-events: Fix missing "cpu_clk_unhalted.core" event - [arm64] KVM: Don't write junk to sysregs on reset - [armhf] KVM: Don't write junk to CP15 registers on reset - HID: wacom: correct misreported EKR ring values - HID: wacom: Correct distance scale for 2nd-gen Intuos devices - Revert "dm bufio: fix deadlock with loop device" (regression in 4.19.61) - ceph: clear page dirty before invalidate page - ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply - libceph: fix PG split vs OSD (re)connect race - drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX - gpiolib: never report open-drain/source lines as 'input' to user-space - [x86] Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE - userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx - [i386] retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 - [x86] apic: Handle missing global clockevent gracefully - [x86] CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h - [x86] boot: Save fields explicitly, zero out everything else - [x86] boot: Fix boot regression caused by bootparam sanitizing - dm kcopyd: always complete failed jobs - dm btree: fix order of block initialization in btree_split_beneath - dm integrity: fix a crash due to BUG_ON in __journal_read_write() - dm raid: add missing cleanup in raid_ctr() - dm space map metadata: fix missing store of apply_bops() return value - dm table: fix invalid memory accesses with too high sector number - dm zoned: improve error handling in reclaim - dm zoned: improve error handling in i/o map code - dm zoned: properly handle backing device failure - genirq: Properly pair kobject_del() with kobject_add() - mm, page_owner: handle THP splits correctly - mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely - mm/zsmalloc.c: fix race condition in zs_destroy_pool - xfs: don't trip over uninitialized buffer on extent read of corrupted inode - xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h - xfs: Add helper function xfs_attr_try_sf_addname - xfs: Add attibute set and helper functions - xfs: Add attibute remove and helper functions - xfs: always rejoin held resources during defer roll - dm zoned: fix potential NULL dereference in dmz_do_reclaim() - [ppc64el] Allow flush_(inval_)dcache_range to work across ranges >4GB - rxrpc: Fix local endpoint refcounting - rxrpc: Fix read-after-free in rxrpc_queue_local() - rxrpc: Fix local endpoint replacement - rxrpc: Fix local refcounting https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.70 - nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns - afs: Fix the CB.ProbeUuid service handler to reply correctly - afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u() - fs: afs: Fix a possible null-pointer dereference in afs_put_read() - afs: Only update d_fsdata if different in afs_d_revalidate() - nvmet-loop: Flush nvme_delete_wq when removing the port - nvme: fix a possible deadlock when passthru commands sent to a multipath device - nvme-pci: Fix async probe remove race - [armhf] omap-dma/omap_vout_vrfb: fix off-by-one fi value - iommu/dma: Handle SG length overflow better - usb: gadget: composite: Clear "suspended" on reset/disconnect - usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt - xen/blkback: fix memory leaks - [arm64] cpufeature: Don't treat granule sizes as strict - drm/ast: Fixed reboot test may cause system hanged - [x86] tools: hv: fix KVP and VSS daemons exit code - [x86] drm/i915: fix broadwell EU computation - [arm*] watchdog: bcm2835_wdt: Fix module autoload - scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value - [armhf] drm/tilcdc: Register cpufreq notifier after we have initialized crtc - ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set - ipv6: Default fib6_type to RTN_UNICAST when not set - net/smc: make sure EPOLLOUT is raised - tcp: make sure EPOLLOUT wont be missed - ipv4/icmp: fix rt dst dev null pointer dereference - mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n - ALSA: usb-audio: Check mixer unit bitmap yet more strictly - ALSA: line6: Fix memory leak at line6_init_pcm() error path - ALSA: hda - Fixes inverted Conexant GPIO mic mute led - ALSA: seq: Fix potential concurrent access to the deleted pool - ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() - ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604 - [x86] kvm: skip populating logical dest map if apic is not sw enabled - [x86] KVM: Don't update RIP or do single-step on faulting emulation - [amd64] uprobes: Fix detection of 32-bit user mode - [x86] apic: Do not initialize LDR and DFR for bigsmp - ftrace: Fix NULL pointer dereference in t_probe_next() - ftrace: Check for successful allocation of hash - ftrace: Check for empty hash and comment the race with registering probes - usb-storage: Add new JMS567 revision to unusual_devs - USB: cdc-wdm: fix race between write and disconnect due to flag abuse - usb: hcd: use managed device resources - [armhf,arm64] usb: chipidea: udc: don't do hardware access if gadget has stopped - usb: host: ohci: fix a race condition between shutdown and irq - usb: host: xhci: rcar: Fix typo in compatible string matching - USB: storage: ums-realtek: Update module parameter description for auto_delink_en - USB: storage: ums-realtek: Whitelist auto-delink support - [x86] mei: me: add Tiger Lake point LP device ID - mmc: core: Fix init of SD cards reporting an invalid VDD range - stm class: Fix a double free of stm_source_device - [x86] intel_th: pci: Add support for another Lewisburg PCH - [x86] intel_th: pci: Add Tiger Lake support - [x86] typec: tcpm: fix a typo in the comparison of pdo_max_voltage - lib: logic_pio: Fix RCU usage - lib: logic_pio: Avoid possible overlap for unregistering regions - lib: logic_pio: Add logic_pio_unregister_range() - [x86] drm/amdgpu: Add APTX quirk for Dell Latitude 5495 - [x86] drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest - [x86] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() - [arm64] bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free - [arm64] bus: hisi_lpc: Add .remove method to avoid driver unbind crash - [x86] VMCI: Release resource if the work is already queued - [x86] crypto: ccp - Ignore unconfigured CCP device on suspend/resume - Revert "cfg80211: fix processing world regdomain when non modular" - mac80211: fix possible sta leak - mac80211: Don't memset RXCB prior to PAE intercept - mac80211: Correctly set noencrypt for PAE frames - [ppc64el] KVM: Book3S: Fix incorrect guest-to-user-translation error handling - [armhf,arm64] KVM: vgic: Fix potential deadlock when ap_list is long - [armhf,arm64] KVM: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI - NFS: Clean up list moves of struct nfs_page - NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() - NFS: Pass error information to the pgio error cleanup routine - NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 - [x86] i2c: piix4: Fix port selection for AMD Family 16h Model 30h - mt76: mt76x0u: do not reset radio on resume https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.71 - Revert "Input: elantech - enable SMBus on new (2018+) systems" (regression in 4.19.67) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.72 - mld: fix memory leak in mld_del_delrec() - net: fix skb use after free in netpoll - net: sched: act_sample: fix psample group handling on overwrite - net_sched: fix a NULL pointer deref in ipt action - [armhf,arm64] net: stmmac: dwmac-rk: Don't fail if phy regulator is absent - tcp: inherit timestamp on mtu probe - tcp: remove empty skb from write queue in error cases - net/rds: Fix info leak in rds6_inc_info_copy() (CVE-2019-16714) - [x86] boot: Preserve boot_params.secure_boot from sanitizing - [arm*] spi: bcm2835aux: unifying code between polling and interrupt driven code - [arm*] spi: bcm2835aux: remove dangerous uncontrolled read of fifo - [arm*] spi: bcm2835aux: fix corruptions for longer spi transfers - netfilter: nf_tables: use-after-free in failing rule with bound set - [x86] hv_netvsc: Fix a warning of suspicious RCU usage - Bluetooth: btqca: Add a short delay before downloading the NVM - [ppc64el] ibmveth: Convert multicast list size for little-endian system - gpio: Fix build error of function redefinition - netfilter: nft_flow_offload: skip tcp rst and fin packets - scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure - scsi: target: tcmu: avoid use-after-free after command timeout - cxgb4: fix a memory leak bug - liquidio: add cleanup in octeon_setup_iq() - net: myri10ge: fix memory leaks - lan78xx: Fix memory leaks - vfs: fix page locking deadlocks when deduping files - cx82310_eth: fix a memory leak bug - net: kalmia: fix memory leaks - net: cavium: fix driver name - wimax/i2400m: fix a memory leak bug - kprobes: Fix potential deadlock in kprobe_optimizer() - HID: cp2112: prevent sleeping function called from invalid context - [amd64] boot/compressed: Fix boot on machines with broken E820 table - [x86] Input: hyperv-keyboard: Use in-place iterator API in the channel callback - [x86] Tools: hv: kvp: eliminate 'may be used uninitialized' warning - nvme-multipath: fix possible I/O hang when paths are updated - IB/mlx4: Fix memory leaks - infiniband: hfi1: fix a memory leak bug - infiniband: hfi1: fix memory leaks - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() - ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() - ceph: fix buffer free while holding i_ceph_lock in fill_inode() - [armhf,arm64] KVM: Only skip MMIO insn once - afs: Fix leak in afs_lookup_cell_rcu() - [armhf,arm64] KVM: VGIC: Properly initialise private IRQ affinity - [amd64] boot/compressed: Fix missing initialization in find_trampoline_placement() - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.73 - ALSA: hda - Fix potential endless loop at applying quirks - ALSA: hda/realtek - Fix overridden device-specific initialization - [x86] ALSA: hda/realtek - Add quirk for HP Pavilion 15 - [x86] ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL - [x86] ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre - sched/fair: Don't assign runtime for throttled cfs_rq - [x86] drm/vmwgfx: Fix double free in vmw_recv_msg() - [ppc64el] tm: Fix FP/VMX unavailable exceptions inside a transaction (CVE-2019-15030) - batman-adv: fix uninit-value in batadv_netlink_get_ifindex() - batman-adv: Only read OGM tvlv_len after buffer len check - [x86] hv_sock: Fix hang when a connection is closed - Blk-iolatency: warn on negative inflight IO counter - blk-iolatency: fix STS_AGAIN handling - {nl,mac}80211: fix interface combinations on crypto controlled devices - timekeeping: Use proper ktime_add when adding nsecs in coarse offset - selftests: fib_rule_tests: use pre-defined DEV_ADDR - [x86] ftrace: Fix warning and considate ftrace_jmp_replace() and ftrace_call_replace() - [ppc64el] mark start_here_multiplatform as __ref - [arm64] dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 - nvme-fc: use separate work queue to avoid warning - [armhf] clk: s2mps11: Add used attribute to s2mps11_dt_match - [arm64] remoteproc: qcom: q6v5: shore up resource probe handling - modules: always page-align module section allocations - kernel/module: Fix mem leak in module_add_modinfo_attrs - [x86] drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse" - scsi: qla2xxx: Move log messages before issuing command to firmware - keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h - [x86] Drivers: hv: kvp: Fix two "this statement may fall through" warnings - [x86] hibernate: Fix nosave_regions setup for hibernation - [arm64] remoteproc: qcom: q6v5-mss: add SCM probe dependency - drm/amdgpu/gfx9: Update gfx9 golden settings. - drm/amdgpu: Update gc_9_0 golden settings. - [x86] KVM: hyperv: enforce vp_index < KVM_MAX_VCPUS - [x86] KVM: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables - [x86] KVM: hyperv: keep track of mismatched VP indexes - [x86] KVM: hyperv: define VP assist page helpers - [x86] kvm/lapic: preserve gfn_to_hva_cache len on cache reinit - [x86] drm/i915: Fix intel_dp_mst_best_encoder() - [x86] drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE - [x86] drm/i915/gen9+: Fix initial readout for Y tiled framebuffers - drm/atomic_helper: Disallow new modesets on unregistered connectors - [x86] Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up - powerplay: Respect units on max dcfclk watermark - drm/amd/pp: Fix truncated clock value when set watermark - drm/amd/dm: Understand why attaching path/tile properties are needed - [s390x] zcrypt: reinit ap queue state machine during device probe - [x86] drm/i915: Restore sane defaults for KMS on GEM error load - [x86] drm/i915: Cleanup gt powerstate from gem - [ppc64el] KVM: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch - Btrfs: clean up scrub is_dev_replace parameter - Btrfs: fix deadlock with memory reclaim during scrub - btrfs: Remove extent_io_ops::fill_delalloc - btrfs: Fix error handling in btrfs_cleanup_ordered_extents - scsi: megaraid_sas: Fix combined reply queue mode detection - scsi: megaraid_sas: Add check for reset adapter bit - scsi: megaraid_sas: Use 63-bit DMA addressing - [ppc64el] pkeys: Fix handling of pkey state across fork() - btrfs: volumes: Make sure no dev extent is beyond device boundary - btrfs: Use real device structure to verify dev extent - IB/uverbs: Fix OOPs upon device disassociation - drm/vblank: Allow dynamic per-crtc max_vblank_count - [x86] drm/i915/ilk: Fix warning when reading emon_status with no output - tpm: Fix some name collisions with drivers/char/tpm.h - bcache: replace hard coded number with BUCKET_GC_GEN_MAX - bcache: treat stale && dirty keys as bad keys - [x86] KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run - [armhf] iio: adc: exynos-adc: Add S5PV210 variant - [armhf] iio: adc: exynos-adc: Use proper number of channels for Exynos4x12 - mt76: fix corrupted software generated tx CCMP PN - drm/nouveau: Don't WARN_ON VCPI allocation failures - iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules - iwlwifi: add new card for 9260 series - spi: spi-gpio: fix SPI_CS_HIGH capability - [ppc64el] kvm: Save and restore host AMR/IAMR/UAMOR - btrfs: scrub: pass fs_info to scrub_setup_ctx - btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex - btrfs: scrub: fix circular locking dependency warning - btrfs: init csum_list before possible free - [arm64] PCI: qcom: Fix error handling in runtime PM support - [arm64] PCI: qcom: Don't deassert reset GPIO during probe - CIFS: Fix error paths in writeback code - CIFS: Fix leaking locked VFS cache pages in writeback retry - [x86] drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set - [x86] drm/i915: Sanity check mmap length against object size - [x86] usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps - IB/mlx5: Reset access mask when looping inside page fault handler - kvm: mmu: Fix overflow on kvm mmu page limit calculation - [x86] kvm: move kvm_load/put_guest_xcr0 into atomic context - [x86] KVM: Always use 32-bit SMRAM save state for 32-bit kernels - cifs: Fix lease buffer length error (CVE-2019-15918) - ext4: protect journal inode's blocks using block_validity - [x86] PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary - dm mpath: fix missing call of path selector type->end_io - blk-mq: free hw queue's resource in hctx's release handler - mmc: sdhci-pci: Add support for Intel CML - PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code - cifs: smbd: take an array of reqeusts when sending upper layer data - dm crypt: move detailed message into debug level - [x86] drm/amdkfd: Add missing Polaris10 ID - kvm: Check irqchip mode before assign irqfd - drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2) - drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc - Btrfs: fix race between block group removal and block group allocation - cifs: add spinlock for the openFileList to cifsInodeInfo - [arm64] clk: tegra: Fix maximum audio sync clock for Tegra124/210 - [arm64] clk: tegra210: Fix default rates for HDA clocks - IB/hfi1: Avoid hardlockup with flushlist_lock - apparmor: reset pos on failure to unpack for various functions - scsi: target/core: Use the SECTOR_SHIFT constant - scsi: target/iblock: Fix overrun in WRITE SAME emulation - [s390x] scsi: zfcp: fix request object use-after-free in send path causing wrong traces - cifs: Properly handle auto disabling of serverino option - [x86] ALSA: hda - Don't resume forcibly i915 HDMI/DP codec - [x86] KVM: optimize check for valid PAT value - [x86] KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value - [x86] KVM: VMX: Fix handling of #MC that occurs during VM-Entry - [x86] KVM: VMX: check CPUID before allowing read/write of IA32_XSS - [ppc64el] KVM: Use ccr field in pt_regs struct embedded in vcpu struct - [ppc64el] KVM: Book3S HV: Fix CR0 setting in TM emulation - RDMA/srp: Document srp_parse_in() arguments - RDMA/srp: Accept again source addresses that do not have a port number - btrfs: correctly validate compression type - resource: Include resource end in walk_*() interfaces - resource: Fix find_next_iomem_res() iteration issue - resource: fix locking in find_next_iomem_res() - pstore: Fix double-free in pstore_mkfile() failure path - dm thin metadata: check if in fail_io mode when setting needs_check - [armhf,arm64] drm/panel: Add support for Armadeus ST0700 Adapt - [x86] ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips - [ppc64el] mm: Limit rma_size to 1TB when running without HV mode - iommu/iova: Remove stale cached32_node - gpio: don't WARN() on NULL descs if gpiolib is disabled - mm/migrate.c: initialize pud_entry in migrate_vma() - NFSv4: Fix delegation state recovery - bcache: only clear BTREE_NODE_dirty bit when it is set - bcache: add comments for mutex_lock(&b->write_lock) - bcache: fix race in btree_flush_write() - [x86] drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV - [s390x] virtio: fix race on airq_areas[] - drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors - ext4: don't perform block validity checks on the journal inode - ext4: fix block validity checks for journal inodes using indirect blocks - ext4: unsigned int compared against zero - [x86] PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround - [ppc64el] tm: Remove msr_tm_active() - [ppc64el] tm: Fix restoring FP/VMX facility incorrectly on interrupts (CVE-2019-15031) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.74 - bridge/mdb: remove wrong use of NLM_F_MULTI - cdc_ether: fix rndis support for Mediatek based smartphones - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' - isdn/capi: check message length in capi_write() - net: Fix null de-reference of device refcount - net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list - net: phylink: Fix flow control resolution - net: sched: fix reordering issues - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR - tipc: add NULL pointer check before calling kfree_rcu - tun: fix use-after-free when register netdev failed - gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist - gpio: fix line flag validation in linehandle_create - Btrfs: fix assertion failure during fsync and use of stale transaction - ixgbe: Prevent u8 wrapping of ITR value to something less than 10us - genirq: Prevent NULL pointer dereference in resend_irqs() - [s390x] KVM: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() - [s390x] KVM: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl - [x86] KVM: work around leak of uninitialized stack contents - [x86] KVM: nVMX: handle page fault in vmread - [x86] purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors - [ppc64el] Add barrier_nospec to raw_copy_in_user() - [arm64] drm/meson: Add support for XBGR8888 & ABGR8888 formats - [armhf,arm64] clk: rockchip: Don't yell about bad mmc phases when getting - PCI: Always allow probing with driver_override - gpio: fix line flag validation in lineevent_create - ubifs: Correctly use tnc_next() in search_dh_cookie() - driver core: Fix use-after-free and double free on glue directory - firmware: ti_sci: Always request response from firmware - [x86] drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC - Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" - modules: fix BUG when load module with rodata=n - rsi: fix a double free bug in rsi_91x_deinit() (CVE-2019-15504) - nvmem: Use the same permissions for eeprom as for nvmem https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.75 - netfilter: nf_flow_table: set default timeout after successful insertion - HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report - RDMA/restrack: Release task struct which was hold by CM_ID object - [x86] Input: elan_i2c - remove Lenovo Legion Y7000 PnpID - [ppc64el] mm/radix: Use the right page size for vmemmap mapping - USB: usbcore: Fix slab-out-of-bounds bug during device reset - media: tm6000: double free if usb disconnect while streaming - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit - udp: correct reuseport selection with connected sockets - xen-netfront: do not assume sk_buff_head list is empty in error handling - net_sched: let qdisc_put() accept NULL pointer - mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816) - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds - ieee802154: hwsim: Fix error handle path in hwsim_init_module - ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails - [armhf] dts: am57xx: Disable voltage switching for SD card - [armhf] OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss - [armhf] bus: ti-sysc: Fix using configured sysc mask value - [s390x] bpf: fix lcgr instruction encoding - [armhf] OMAP2+: Fix omap4 errata warning on other SoCs - [armhf] dts: dra74x: Fix iodelay configuration for mmc3 - [armhf] bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() - [s390x] bpf: use 32-bit index for tail calls - netfilter: ebtables: Fix argument order to ADD_COUNTER - netfilter: nft_flow_offload: missing netlink attribute policy - netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info - NFSv4: Fix return values for nfs4_file_open() - NFSv4: Fix return value in nfs_finish_open() - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup - xdp: unpin xdp umem pages in error path - qed: Add cleanup in qed_slowpath_start() - [armel,armhf] 8874/1: mm: only adjust sections of valid mm structures - batman-adv: Only read OGM2 tvlv_len after buffer len check - bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0 - r8152: Set memory to all 0xFFs on failed reg reads - [x86] apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines - netfilter: xt_physdev: Fix spurious error message in physdev_mt_check - netfilter: nf_conntrack_ftp: Fix debug output - NFSv2: Fix eof handling - NFSv2: Fix write regression - kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol - cifs: set domainName when a domain-key is used in multiuser - cifs: Use kzfree() to zero out the password - [armhf,arm64] usb: host: xhci-tegra: Set DMA mask correctly - [armel,armhf] 8901/1: add a criteria for pfn_valid of arm - sky2: Disable MSI on yet another ASUS boards (P6Xxxx) - i2c: designware: Synchronize IRQs when unregistering slave client - [x86] perf/intel: Restrict period on Nehalem - [x86] perf/amd/ibs: Fix sample bias for dispatched micro-ops - amd-xgbe: Fix error path in xgbe_mod_init() - [x86] tools/power x86_energy_perf_policy: Fix argument parsing - [x86] tools/power turbostat: fix buffer overrun - net: aquantia: fix out of memory condition on rx side - [armhf] dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() - [x86] uaccess: Don't leak the AC flags into __get_user() argument evaluation - [x86] hyper-v: Fix overflow bug in fill_gva_list() - keys: Fix missing null pointer check in request_key_auth_describe() - [x86] iommu/amd: Flush old domains in kdump kernel - [x86] iommu/amd: Fix race in increase_address_space() - [arm64] PCI: kirin: Fix section mismatch warning - ovl: fix regression caused by overlapping layers detection - floppy: fix usercopy direction - binfmt_elf: move brk out of mmap when doing direct loader exec - [arm64] kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field - media: technisat-usb2: break out of loop at end of buffer (CVE-2019-15505) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.76 - Revert "Bluetooth: validate BLE connection interval updates" - RDMA/restrack: Protect from reentry to resource return path - [ppc64el] xive: Fix bogus error code returned by OPAL - IB/core: Add an unbound WQ type to the new CQ API - HID: prodikeys: Fix general protection fault during probe - HID: sony: Fix memory corruption issue on cleanup. - HID: logitech: Fix general protection fault caused by Logitech driver - HID: hidraw: Fix invalid read in hidraw_ioctl - HID: Add quirk for HP X500 PIXART OEM mouse - mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() - CIFS: fix deadlock in cached root handling - net/mlx5e: Set ECN for received packets using CQE indication - net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets - mlx5: fix get_ip_proto() - net/mlx5e: Allow reporting of checksum unnecessary - net/mlx5e: XDP, Avoid checksum complete when XDP prog is loaded - net/mlx5e: Rx, Fixup skb checksum for packets with tail padding - net/mlx5e: Rx, Check ip headers sanity - iwlwifi: mvm: send BCAST management frames to the right station - iwlwifi: mvm: always init rs_fw with 20MHz bandwidth rates - media: tvp5150: fix switch exit in set control handler - [x86] ASoC: Intel: cht_bsw_max98090_ti: Enable codec clock once and keep it enabled - ALSA: usb-audio: Add Hiby device family to quirks for native DSD support - ALSA: usb-audio: Add DSD support for EVGA NU Audio - ALSA: dice: fix wrong packet parameter for Alesis iO26 - [x86] ALSA: hda - Add laptop imic fixup for ASUS M9V laptop - [x86] ALSA: hda - Apply AMD controller workaround for Raven platform - objtool: Clobber user CFLAGS variable - power: supply: sysfs: ratelimit property read error message - scsi: qla2xxx: Turn off IOCB timeout timer on IOCB completion - scsi: qla2xxx: Remove all rports if fabric scan retry fails - scsi: qla2xxx: Return switch command on a timeout - Revert "drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD" - bpf: libbpf: retry loading program on EAGAIN - [armhf,arm64] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices - f2fs: check all the data segments against all node ones - [x86] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it - bcache: remove redundant LIST_HEAD(journal) from run_cache_set() - initramfs: don't free a non-existent initrd - blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs - blk-mq: move cancel of requeue_work to the front of blk_exit_queue - Revert "f2fs: avoid out-of-range memory access" - dm zoned: fix invalid memory access - f2fs: fix to do sanity check on segment bitmap of LFS curseg - drm: Flush output polling on shutdown - net: don't warn in inet diag when IPV6 is disabled - Bluetooth: btrtl: HCI reset on close for Realtek BT chip - [x86] ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 - drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling - xfs: don't crash on null attr fork xfs_bmapi_read - netfilter: nft_socket: fix erroneous socket assignment - Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices - net_sched: check cops->tcf_block in tc_bind_tclass() - net/rds: An rds_sock is added too early to the hash table - net/rds: Check laddr_check before calling it - f2fs: use generic EFSBADCRC/EFSCORRUPTED https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.77 - arcnet: provide a buffer big enough to actually receive packets - cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize - macsec: drop skb sk before calling gro_cells_receive - net/phy: fix DP83865 10 Mbps HDX loopback disable function - net/sched: act_sample: don't push mac header on ip6gre ingress - net_sched: add max len check for TCA_KIND - nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs (CVE-2019-19081) - openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC - ppp: Fix memory leak in ppp_write - sch_netem: fix a divide by zero in tabledist() - skge: fix checksum byte order - usbnet: ignore endpoints with invalid wMaxPacketSize - usbnet: sanity checking of packet sizes and device mtu - net: sched: fix possible crash in tcf_action_destroy() - tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state - net/mlx5: Add device ID of upcoming BlueField-2 - mISDN: enforce CAP_NET_RAW for raw sockets (CVE-2019-17055) - appletalk: enforce CAP_NET_RAW for raw sockets (CVE-2019-17054) - ax25: enforce CAP_NET_RAW for raw sockets (CVE-2019-17052) - ieee802154: enforce CAP_NET_RAW for raw sockets (CVE-2019-17053) - nfc: enforce CAP_NET_RAW for raw sockets (CVE-2019-17056) - nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs (CVE-2019-19080) - ALSA: hda: Flush interrupts on disabling - [armhf] ASoC: sgtl5000: Fix of unmute outputs on probe - [armhf] ASoC: sgtl5000: Fix charge pump source assignment - [arm*] dmaengine: bcm2835: Print error in case setting DMA mask fails - media: dib0700: fix link error for dibx000_i2c_set_speed - media: hdpvr: Add device num check and handling - time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint - sched/fair: Fix imbalance due to CPU affinity - sched/core: Fix CPU controller for !RT_GROUP_SCHED - [x86] apic: Make apic_pending_intr_clear() more robust - sched/deadline: Fix bandwidth accounting at all levels after offline migration - [x86] reboot: Always use NMI fallback when shutdown via reboot vector IPI fails - [x86] apic: Soft disable APIC before initializing it - ALSA: hda - Show the fatal CORB/RIRB error more clearly - ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls() - EDAC/mc: Fix grain_bits calculation - media: iguanair: add sanity checks - base: soc: Export soc_device_register/unregister APIs - ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid - [arm64] prefetch: fix a -Wtype-limits warning - md/raid1: end bio when the device faulty - md: don't call spare_active in md_reap_sync_thread if all member devices can't work - md: don't set In_sync if array is frozen - ACPI / processor: don't print errors for processorIDs == 0xff - loop: Add LOOP_SET_DIRECT_IO to compat ioctl - [x86] EDAC, pnd2: Fix ioremap() size in dnv_rd_reg() - efi: cper: print AER info of PCIe fatal error - sched/fair: Use rq_lock/unlock in online_fair_sched_group - idle: Prevent late-arriving interrupts from disrupting offline - media: gspca: zero usb_buf on error - perf config: Honour $PERF_CONFIG env var to specify alternate .perfconfig - perf test vfs_getname: Disable ~/.perfconfig to get default output - media: em28xx: modules workqueue not inited for 2nd device - media: rc: imon: Allow iMON RC protocol for ffdc 7e device - [arm64] perf record: Support aarch64 random socket_id assignment - [armhf] media: omap3isp: Don't set streaming state on random subdevs - media: radio/si470x: kill urb on error - media: hdpvr: add terminating 0 at end of string - led: triggers: Fix a memory leak bug - nbd: add missing config put - media: mceusb: fix (eliminate) TX IR signal length limit - media: dvb-frontends: use ida for pll number - posix-cpu-timers: Sanitize bogus WARNONS - media: dvb-core: fix a memory leak bug - libperf: Fix alignment trap with xyarray contents in 'perf stat' - [amd64] EDAC/amd64: Recognize DRAM device type ECC capability - [amd64] EDAC/amd64: Decode syndrome before translating address - PM / devfreq: passive: Use non-devm notifiers - PM / devfreq: exynos-bus: Correct clock enable sequence - media: cec-notifier: clear cec_adap in cec_notifier_unregister - media: saa7146: add cleanup in hexium_attach() - media: cpia2_usb: fix memory leaks - media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() - perf trace beauty ioctl: Fix off-by-one error in cmd->string table - [x86] ASoC: es8316: fix headphone mixer volume table - ACPI / CPPC: do not require the _PSD method - sched/cpufreq: Align trace event behavior of fast switching - [x86] apic/vector: Warn when vector space exhaustion breaks affinity - [arm64] kpti: ensure patched kernel text is fetched from PoU - [x86] mm/pti: Do not invoke PTI functions when PTI is disabled - [x86] mm/pti: Handle unaligned address gracefully in pti_clone_pagetable() - nvmet: fix data units read and written counters in SMART log - nvme-multipath: fix ana log nsid lookup when nsid is not found - ALSA: firewire-motu: add support for MOTU 4pre - iommu/amd: Silence warnings under memory pressure - libata/ahci: Drop PCS quirk for Denverton and beyond - iommu/iova: Avoid false sharing on fq_timer_on - libtraceevent: Change users plugin directory - [armhf] dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks - ACPI: custom_method: fix memory leaks - ACPI / PCI: fix acpi_pci_irq_enable() memory leak - closures: fix a race on wakeup from closure_sync - hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' - md/raid1: fail run raid1 array when active disk less than one - dmaengine: ti: edma: Do not reset reserved paRAM slots - kprobes: Prohibit probing on BUG() and WARN() address - [s390x] crypto: xts-aes-s390 fix extra run-time crypto self tests finding - [x86] cpu: Add Tiger Lake to Intel family - [x86] platform: intel_pmc_core: Do not ioremap RAM - ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set - raid5: don't set STRIPE_HANDLE to stripe which is in batch list - mmc: core: Clarify sdio_irq_pending flag for MMC_CAP2_SDIO_IRQ_NOTHREAD - mmc: sdhci: Fix incorrect switch to HS mode - mmc: core: Add helper function to indicate if SDIO IRQs is enabled - [armhf,arm64] mmc: dw_mmc: Re-store SDIO IRQs mask at system resume - raid5: don't increment read_errors on EILSEQ return - libertas: Add missing sentinel at end of if_usb.c fw_table - e1000e: add workaround for possible stalled packet - ALSA: hda - Drop unsol event handler for Intel HDMI codecs - drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() - [x86] ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 - [x86] iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems - btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type - [armhf] media: omap3isp: Set device on omap3isp subdevs - PM / devfreq: passive: fix compiler warning - iwlwifi: fw: don't send GEO_TX_POWER_LIMIT command to FW version 36 - ALSA: firewire-tascam: handle error code when getting current source of clock - ALSA: firewire-tascam: check intermediate state of clock status and retry - scsi: scsi_dh_rdac: zero cdb in send_mode_select() - scsi: qla2xxx: Fix Relogin to prevent modifying scan_state flag - printk: Do not lose last line in kmsg buffer dump - IB/mlx5: Free mpi in mp_slave mode - IB/hfi1: Define variables as unsigned long to fix KASAN warning - randstruct: Check member structs in is_pure_ops_struct() - ceph: use ceph_evict_inode to cleanup inode's resource - [x86] ALSA: hda/realtek - PCI quirk for Medion E4254 - blk-mq: add callback of .cleanup_rq - scsi: implement .cleanup_rq callback - [ppc64el] imc: Dont create debugfs files for cpu-less nodes - fuse: fix missing unlock_page in fuse_writepage() - [x86] KVM: always stop emulation on page fault - [x86] KVM: set ctxt->have_exception in x86_decode_insn() - [x86] KVM: Manually calculate reserved bits when loading PDPTRS - [x86] media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table - media: don't drop front-end reference count for ->detach - binfmt_elf: Do not move brk for INTERP-less ET_EXEC - [x86] ASoC: Intel: NHLT: Fix debug print format - [x86] ASoC: Intel: Skylake: Use correct function to access iomem space - [x86] ASoC: Intel: Fix use of potentially uninitialized variable - [arm64] Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}" - [arm64] tlb: Ensure we execute an ISB following walk cache invalidation - [arm64] dts: rockchip: limit clock rate of MMC controllers for RK3328 - alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP - regulator: Defer init completion for a while after late_initcall - efifb: BGRT: Improve efifb_bgrt_sanity_check - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps - memcg, oom: don't require __GFP_FS when invoking memcg OOM killer - memcg, kmem: do not fail __GFP_NOFAIL charges - i40e: check __I40E_VF_DISABLE bit in i40e_sync_filters_subtask - block: fix null pointer dereference in blk_mq_rq_timed_out() - smb3: allow disabling requesting leases - ovl: Fix dereferencing possible ERR_PTR() - ovl: filter of trusted xattr results in audit - btrfs: fix allocation of free space cache v1 bitmap pages - Btrfs: fix use-after-free when using the tree modification log - btrfs: Relinquish CPUs in btrfs_compare_trees - btrfs: qgroup: Fix the wrong target io_tree when freeing reserved data space - btrfs: qgroup: Fix reserved data space leak if we have multiple reserve calls - Btrfs: fix race setting up and completing qgroup rescan workers - md/raid6: Set R5_ReadError when there is read failure on parity disk - md: don't report active array_state until after revalidate_disk() completes. - md: only call set_in_sync() when it is expected to succeed. - cfg80211: Purge frame registrations on iftype change - /dev/mem: Bail out upon SIGKILL. - ext4: fix warning inside ext4_convert_unwritten_extents_endio - ext4: fix punch hole for inline_data file systems - quota: fix wrong condition in is_quota_modification() - hwrng: core - don't wait on add_early_randomness() - CIFS: fix max ea value size - CIFS: Fix oplock handling for SMB 2.1+ protocols - md/raid0: avoid RAID0 data corruption due to layout confusion. - fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock - mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new zone - drm/amd/display: Restore backlight brightness after system resume https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.78 - tpm: use tpm_try_get_ops() in tpm-sysfs.c. - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations - [armhf,arm64] drm/panel: simple: fix AUO g185han01 horizontal blanking - [armhf,arm64] drm/panel: check failure cases in the probe func - [armhf,arm64] drm/rockchip: Check for fast link training before enabling psr - gpu: drm: radeon: Fix a possible null-pointer dereference in radeon_connector_set_property() - [ppc64el] PCI: rpaphp: Avoid a sometimes-uninitialized warning - ipmi_si: Only schedule continuously in the thread in maintenance mode - [armhf,arm64] clk: sunxi-ng: v3s: add missing clock slices for MMC2 module clocks - drm/amd/display: fix issue where 252-255 values are clipped - drm/amd/display: reprogram VM config when system resume - [ppc64el] powernv/ioda2: Allocate TCE table levels on demand for default DMA window - [ppc64el] xmon: Check for HV mode when dumping XIVE info from OPAL - [ppc64el] rtas: use device model APIs and serialization during LPM - [ppc64el] futex: Fix warning: 'oldval' may be used uninitialized in this function - [ppc64el] pseries/mobility: use cond_resched when updating device tree - [armhf,arm64] pinctrl: tegra: Fix write barrier placement in pmx_writel - [ppc64el] eeh: Clear stale EEH_DEV_NO_HANDLER flag - vfio_pci: Restore original state on release - drm/nouveau/volt: Fix for some cards having 0 maximum voltage - [x86] pinctrl: amd: disable spurious-firing GPIO IRQs - drm/amd/display: support spdif - drm/amdgpu/si: fix ASIC tests - [ppc64el] exception: machine check use correct cfar for late handler - pstore: fs superblock limits - [ppc64el] pseries: correctly track irq state in default idle - [arm64] pinctrl: meson-gxbb: Fix wrong pinning definition for uart_c - [ppc64el] dump kernel log before carrying out fadump or kdump - [arm64] mbox: qcom: add APCS child device for QCS404 - scsi: core: Reduce memory required for SCSI logging - dma-buf/sw_sync: Synchronize signal vs syncpt free - ext4: fix potential use after free after remounting with noblock_validity - [mips*] tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean - [x86] i2c-cht-wc: Fix lockdep warning - [x86] mfd: intel-lpss: Remove D3cold delay - HID: wacom: Fix several minor compiler warnings - [armel,armhf] 8898/1: mm: Don't treat faults reported from cache maintenance as writes - [armhf] rtc: snvs: fix possible race condition - HID: apple: Fix stuck function keys when using FN - [arm64] PCI: rockchip: Propagate errors for optional regulators - [armhf] PCI: imx6: Propagate errors for optional regulators - [armel,armhf] 8903/1: ensure that usable memory in bank 0 starts from a PMD-aligned address - fat: work around race with userspace's read via blockdev while mounting - pktcdvd: remove warning on attempting to register non-passthrough dev - [s390x] hypfs: Fix error number left in struct pointer member - ocfs2: wait for recovering done after direct unlock request - [arm64] consider stack randomization for mmap base only when necessary - [mips*] properly account for stack randomization and stack guard gap - [armel,armhf] properly account for stack randomization and stack guard gap - [armel,armhf] use STACK_TOP when computing mmap base address - block: mq-deadline: Fix queue restart handling - bpf: fix use after free in prog symbol exposure - cxgb4:Fix out-of-bounds MSI-X info array access - erspan: remove the incorrect mtu limit for erspan - hso: fix NULL-deref on tty open - ipv6: drop incoming packets having a v4mapped source address - ipv6: Handle missing host route in __ipv6_ifa_notify - net: ipv4: avoid mixed n_redirects and rate_tokens usage - net: qlogic: Fix memory leak in ql_alloc_large_buffers - net: Unpublish sk from sk_reuseport_cb before call_rcu - nfc: fix memory leak in llcp_sock_bind() - qmi_wwan: add support for Cinterion CLS8 devices - rxrpc: Fix rxrpc_recvmsg tracepoint - sch_dsmark: fix potential NULL deref in dsmark_init() - udp: fix gso_segs calculations - vsock: Fix a lockdep warning in __vsock_release() - udp: only do GSO if # of segs > 1 - net/rds: Fix error handling in rds_ib_add_one() - xen-netfront: do not use ~0U as error return value for xennet_fill_frags() - tipc: fix unlimited bundling of small messages - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash - NFC: fix attrs checks in netlink interface - kexec: bail out upon SIGKILL when allocating memory. - 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.79 - [s390x] process: avoid potential reading of freed stack - [s390x] KVM: Test for bad access register and size at the start of S390_MEM_OP - [s390x] topology: avoid firing events before kobjs are created - [s390x] cio: exclude subchannels with no parent from pseudo check - [ppc64el] KVM: Book3S HV: Fix race in re-enabling XIVE escalation interrupts - [ppc64el] KVM: Book3S HV: Check for MMU ready on piggybacked virtual cores - [ppc64el] KVM: Book3S HV: Don't lose pending doorbell request on migration on P9 - [x86] KVM: Fix userspace set invalid CR4 - [x86] KVM: nVMX: handle page fault in vmread fix - nbd: fix max number of supported devs - PM / devfreq: tegra: Fix kHz to Hz conversion - ASoC: Define a set of DAPM pre/post-up events - [armhf] ASoC: sgtl5000: Improve VAG power and mute control - [ppc64el] mce: Fix MCE handling for huge pages - [ppc64el] mce: Schedule work from irq_work - [ppc64el] powernv: Restrict OPAL symbol map to only be readable by root - [ppc64el] powernv/ioda: Fix race in TCE level allocation - [ppc64el] book3s64/mm: Don't do tlbie fixup for some hardware revisions - tools lib traceevent: Fix "robust" test of do_generate_dynamic_list_file - [x86] crypto: qat - Silence smp_processor_id() warning - crypto: skcipher - Unmap pages after an external error - [mips*el/loongson-3] Treat Loongson Extensions as ASEs - power: supply: sbs-battery: use correct flags field - power: supply: sbs-battery: only return health when battery present - tracing: Make sure variable reference alias has correct var_ref_idx - usercopy: Avoid HIGHMEM pfn warning - timer: Read jiffies once when forwarding base clk - [x86] PCI: vmd: Fix shadow offsets to reflect spec changes - PCI: Restore Resizable BAR size bits correctly for 1MB BARs - [armhf] watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout - perf stat: Fix a segmentation fault when using repeat forever - [armhf] drm/omap: fix max fclk divider for omap36xx - [arm64] drm/msm/dsi: Fix return value check for clk_get_parent - drm/nouveau/kms/nv50-: Don't create MSTMs for eDP connectors - [x86] drm/i915/gvt: update vgpu workload head pointer correctly - mmc: sdhci: improve ADMA error reporting - Revert "locking/pvqspinlock: Don't wait if vCPU is preempted" - xen/xenbus: fix self-deadlock after killing user process - ieee802154: atusb: fix use-after-free at disconnect - [s390x] cio: avoid calling strlen on null pointer - cfg80211: initialize on-stack chandefs - [arm64] cpufeature: Detect SSBS and advertise to userspace - ima: always return negative code for error - ima: fix freeing ongoing ahash_request - fs: nfs: Fix possible null-pointer dereferences in encode_attrs() - 9p: Transport error uninitialized - 9p: avoid attaching writeback_fid on mmap with type PRIVATE - xen/pci: reserve MCFG areas earlier - ceph: fix directories inode i_blkbits initialization - ceph: reconnect connection if session hang in opening state - watchdog: aspeed: Add support for AST2600 - netfilter: nf_tables: allow lookups in dynamic sets - drm/amdgpu: Fix KFD-related kernel oops on Hawaii - drm/amdgpu: Check for valid number of registers to read - pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors - [x86] purgatory: Disable the stackleak GCC plugin for the purgatory - ntb: point to right memory window index - thermal: Fix use-after-free when unregistering thermal zone device - thermal_hwmon: Sanitize thermal_zone type - libnvdimm/region: Initialize bad block for volatile namespaces - fuse: fix memleak in cuse_channel_open - libnvdimm/nfit_test: Fix acpi_handle redefinition - sched/membarrier: Call sync_core only before usermode for same mm - sched/membarrier: Fix private expedited registration check - sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() - kernel/elfcore.c: include proper prototypes - nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs - drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed - [ppc64el] KVM: HV: XIVE: Free escalation interrupts before disabling the VP - [x86] KVM: nVMX: Fix consistency check on injected exception error code - nbd: fix crash when the blksize is zero - [ppc64el] pseries: Fix cpu_hotplug_lock acquisition in resize_hpt() - [ppc64el] radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag - tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure - tick: broadcast-hrtimer: Fix a race in bc_set_next - perf tools: Fix segfault in cpu_cache_level__read() - perf stat: Reset previous counts on repeat with interval - [arm64] ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 - [arm64] KVM: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe - [arm64] docs: Document SSBS HWCAP - [arm64] fix SSBS sanitization - [arm64] Add sysfs vulnerability show for spectre-v1 - [arm64] add sysfs vulnerability show for meltdown - [arm64] enable generic CPU vulnerabilites support - [arm64] Always enable ssb vulnerability detection - [arm64] Provide a command line to disable spectre_v2 mitigation - [arm64] Advertise mitigation of Spectre-v2, or lack thereof - [arm64] Always enable spectre-v2 vulnerability detection - [arm64] add sysfs vulnerability show for spectre-v2 - [arm64] add sysfs vulnerability show for speculative store bypass - [arm64] ssbs: Don't treat CPUs with SSBS as unaffected by SSB - [arm64] Force SSBS on context switch - [arm64] Use firmware to detect CPUs that are not affected by Spectre-v2 - [arm64] speculation: Support 'mitigations=' cmdline option - vfs: Fix EOVERFLOW testing in put_compat_statfs64 - cfg80211: add and use strongly typed element iteration macros - cfg80211: Use const more consistently in for_each_element macros - nl80211: validate beacon head (CVE-2019-16746) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.80 - panic: ensure preemption is disabled during panic() - f2fs: use EINVAL for superblock with invalid magic - USB: rio500: Remove Rio 500 kernel driver - USB: yurex: Don't retry on unexpected errors - USB: yurex: fix NULL-derefs on disconnect - USB: usb-skeleton: fix runtime PM after driver unbind - USB: usb-skeleton: fix NULL-deref on disconnect - xhci: Fix false warning message about wrong bounce buffer write length - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long - xhci: Check all endpoints for LPM timeout - xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts - usb: xhci: wait for CNR controller not ready bit in xhci resume - xhci: Prevent deadlock when xhci adapter breaks during init - xhci: Increase STS_SAVE timeout in xhci_suspend() - USB: adutux: fix use-after-free on disconnect - USB: adutux: fix NULL-derefs on disconnect - USB: adutux: fix use-after-free on release - USB: iowarrior: fix use-after-free on disconnect - USB: iowarrior: fix use-after-free on release - USB: iowarrior: fix use-after-free after driver unbind - USB: usblp: fix runtime PM after driver unbind - USB: chaoskey: fix use-after-free on release - USB: ldusb: fix NULL-derefs on driver unbind - serial: uartlite: fix exit path null pointer - USB: serial: keyspan: fix NULL-derefs on open() and write() - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 - USB: serial: option: add Telit FN980 compositions - USB: serial: option: add support for Cinterion CLS8 devices - USB: serial: fix runtime PM after driver unbind - USB: usblcd: fix I/O after disconnect - USB: microtek: fix info-leak at probe - USB: dummy-hcd: fix power budget for SuperSpeed mode - USB: legousbtower: fix slab info leak at probe - USB: legousbtower: fix deadlock on disconnect - USB: legousbtower: fix potential NULL-deref on disconnect - USB: legousbtower: fix open after failed reset request - USB: legousbtower: fix use-after-free on release - [x86] mei: me: add comet point (lake) LP device ids - [x86] mei: avoid FW version request on Ibex Peak and earlier - [armhf,arm64] iio: adc: axp288: Override TS pin bias current for some models - efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified - perf llvm: Don't access out-of-scope array - perf inject jit: Fix JIT_CODE_MOVE filename - blk-wbt: fix performance regression in wbt scale_up/scale_down - CIFS: Gracefully handle QueryInfo errors during open - CIFS: Force revalidate inode when dentry is stale - CIFS: Force reval dentry if LOOKUP_REVAL flag is set - kernel/sysctl.c: do not override max_threads provided by userspace - mm/vmpressure.c: fix a signedness bug in vmpressure_register_event() - gpiolib: don't clear FLAG_IS_OUT when emulating open-drain/open-source - cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic - btrfs: fix incorrect updating of log root tree - btrfs: fix uninitialized ret in ref-verify - NFS: Fix O_DIRECT accounting of number of bytes read/written - [mips*] elf_hwcap: Export userspace ASEs - ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags - ACPI/PPTT: Add support for ACPI 6.3 thread flag - [arm64] topology: Use PPTT to determine if PE is a thread - vfs: Fix the locking in dcache_readdir() and friends - media: stkwebcam: fix runtime PM after driver unbind - [arm64] sve: Fix wrong free for task->thread.sve_state - [rt] tracing/hwlat: Report total time spent in all NMIs during the sample - [rt] tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency - ftrace: Get a reference counter for the trace_array on filter files - tracing: Get trace_array reference for available_tracers files - hwmon: Fix HWMON_P_MIN_ALARM mask - [x86] asm: Fix MWAITX C-state hint value - [x86] PCI: vmd: Fix config addressing when using bus offsets - perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.81 - nvme-pci: Fix a race in controller removal - scsi: ufs: skip shutdown if hba is not powered - scsi: megaraid: disable device when probe failed after enabled device - scsi: qla2xxx: Fix unbound sleep in fcport delete path. - [armhf] OMAP2+: Fix missing reset done flag for am3 and am43 - [armhf] OMAP2+: Fix warnings with broken omap2_set_init_voltage() - xen/efi: Set nonblocking callbacks - nl80211: fix null pointer dereference - mac80211: fix txq null pointer dereference - netfilter: nft_connlimit: disable bh on garbage collection - [mips*el/loongson-3] Fix the link time qualifier of 'serial_exit()' - [arm64] net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write() - lib: textsearch: fix escapes in example code - r8152: Set macpassthru in reset_resume callback - libata/ahci: Fix PCS quirk application - md/raid0: fix warning message for parameter default_layout - ocfs2: fix panic due to ocfs2_wq is null - ipv4: fix race condition between route lookup and invalidation - net: avoid potential infinite loop in tc_ctl_action() - net: ipv6: fix listify ip6_rcv_finish in case of forwarding - [armhf,arm64] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow - sctp: change sctp_prot .no_autobind with true - memfd: Fix locking when tagging pins - USB: legousbtower: fix memleak on disconnect - ALSA: hda/realtek - Add support for ALC711 - [x86] ALSA: hda/realtek - Enable headset mic on Asus MJ401TA - ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers - ALSA: hda - Force runtime PM on Nvidia HDMI codecs - USB: serial: ti_usb_3410_5052: fix port-close races - USB: ldusb: fix memleak on disconnect - USB: usblp: fix use-after-free on disconnect - USB: ldusb: fix read info leaks - [mips*] tlbex: Fix build_restore_pagemask KScratch restore - staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS - [s390x] scsi: zfcp: fix reaction on bit error threshold notification - scsi: sd: Ignore a failure to sync cache due to lack of authorization - scsi: core: save/restore command resid for error handling - scsi: core: try to get module before removing device - scsi: ch: Make it possible to open a ch device multiple times again - Input: synaptics-rmi4 - avoid processing unknown IRQs - ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() - cfg80211: wext: avoid copying malformed SSIDs (CVE-2019-17133) - mac80211: Reject malformed SSID elements - [x86] drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 - drm/ttm: Restore ttm prefaulting - drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1 - drivers/base/memory.c: don't access uninitialized memmaps in soft_offline_page_store() - fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c - mm/memory-failure.c: don't access uninitialized memmaps in memory_failure() - mm/slub: fix a deadlock in show_slab_objects() - mm/page_owner: don't access uninitialized memmaps when reading /proc/pagetypeinfo - hugetlbfs: don't access uninitialized memmaps in pfn_range_valid_gigantic() - mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if mmaped more than once - EDAC/ghes: Fix Use after free in ghes_edac remove path - [arm64] Enable workaround for Cavium TX2 erratum 219 when running SMT - CIFS: avoid using MID 0xFFFF - CIFS: Fix use after free of file info structures - perf/aux: Fix AUX output stopping - tracing: Fix race in perf_trace_buf initialization - dm cache: fix bugs when a GFP_NOWAIT allocation fails - [amd64] boot: Make level2_kernel_pgt pages invalid outside kernel area - [x86] apic/x2apic: Fix a NULL pointer deref when handling a dying cpu - [x86] pinctrl: cherryview: restore Strago DMI workaround for all versions - [arm64] pinctrl: armada-37xx: fix control of pins 32 and up - [arm64] pinctrl: armada-37xx: swap polarity on LED group - btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() - Btrfs: add missing extents release on file extent cluster relocation error - Btrfs: check for the full sync flag while holding the inode lock during fsync - btrfs: tracepoints: Fix bad entry members of qgroup events - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown - xen/netback: fix error path of xenvif_connect_data() - PCI: PM: Fix pci_power_up() - blk-rq-qos: fix first node deletion of rq_qos_del() - RDMA/cxgb4: Do not dma memory off of the stack (CVE-2019-17075) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.82 - zram: fix race between backing_dev_show and backing_dev_store - dm snapshot: introduce account_start_copy() and account_end_copy() - dm snapshot: rework COW throttling to fix deadlock - Btrfs: fix inode cache block reserve leak on failure to allocate data space - Btrfs: fix memory leak due to concurrent append writes with fiemap - btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents() - btrfs: tracepoints: Fix wrong parameter order for qgroup events - wil6210: fix freeing of rx buffers in EDMA mode - f2fs: flush quota blocks after turnning it off - scsi: lpfc: Fix a duplicate 0711 log message number. - f2fs: fix to recover inode's i_gc_failures during POR - f2fs: fix to recover inode->i_flags of inode block during POR - [x86] HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override - [arm64,armel,armhf] usb: dwc2: fix unbalanced use of external vbus-supply - [x86] tools/power turbostat: fix goldmont C-state limit decoding - [x86] cpu: Add Atom Tremont (Jacobsville) - [arm64] drm/msm/dpu: handle failures while initializing displays - bcache: fix input overflow to writeback_rate_minimum - PCI: Fix Switchtec DMA aliasing quirk dmesg noise - Btrfs: fix deadlock on tree root leaf when finding free extent - netfilter: ipset: Make invalid MAC address checks consistent - HID: i2c-hid: Disable runtime PM for LG touchscreen - HID: i2c-hid: Ignore input report if there's no data present on Elan touchpanels - HID: i2c-hid: Add Odys Winbook 13 to descriptor override - [x86] platform/x86: Add the VLV ISP PCI ID to atomisp2_pm - [x86] platform/x86: Fix config space access for intel_atomisp2_pm - ath10k: assign 'n_cipher_suites = 11' for WCN3990 to enable WPA3 - HID: Add ASUS T100CHI keyboard dock battery quirks - NFSv4: Ensure that the state manager exits the loop on SIGKILL - HID: steam: fix boot loop with bluetooth firmware - HID: steam: fix deadlock with input devices. - [arm64,armhf] usb: dwc3: gadget: early giveback if End Transfer already completed - [arm64,armhf] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete - ALSA: usb-audio: Cleanup DSD whitelist - usb: handle warm-reset port requests on hub resume - [armhf] rtc: pcf8523: set xtal load capacitance from DT - [arm64] Add MIDR encoding for HiSilicon Taishan CPUs - [arm64] kpti: Whitelist HiSilicon Taishan v110 CPUs - scsi: lpfc: Correct localport timeout duration error - CIFS: Respect SMB2 hdr preamble size in read responses - cifs: add credits from unmatched responses/messages - ALSA: hda/realtek - Apply ALC294 hp init also for S4 resume - ext4: disallow files with EXT4_JOURNAL_DATA_FL from EXT4_IOC_SWAP_BOOT - exec: load_script: Do not exec truncated interpreter path - [arm64,armhf] net: dsa: mv88e6xxx: Release lock while requesting IRQ - PCI/PME: Fix possible use-after-free on remove - [arm64,armhf] iio: adc: meson_saradc: Fix memory allocation order - [x86] iio: fix center temperature of bmc150-accel-core - perf map: Fix overlapped map handling - perf script brstackinsn: Fix recovery from LBR/binary mismatch - perf jevents: Fix period for Intel fixed counters - perf tools: Propagate get_cpuid() error - perf annotate: Propagate perf_env__arch() error - perf annotate: Fix the signedness of failure returns - perf annotate: Propagate the symbol__annotate() error return - perf annotate: Return appropriate error code for allocation failures - staging: rtl8188eu: fix null dereference when kzalloc fails - RDMA/hfi1: Prevent memory leak in sdma_init (CVE-2019-19065) - RDMA/iwcm: Fix a lock inversion issue - [x86] HID: hyperv: Use in-place iterator API in the channel callback - nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request - [arm64] ftrace: Ensure synchronisation in PLT setup for Neoverse-N1 - [arm64] gpio: max77620: Use correct unit for debounce times - fs: cifs: mute -Wunused-const-variable message - [armhf] serial: mctrl_gpio: Check for NULL pointer - efi/cper: Fix endianness of PCIe class code - [x86] efi/x86: Do not clean dummy variable in kexec path - [x86] xen: Return from panic notifier - ocfs2: clear zero in unaligned direct IO - fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() - fs: ocfs2: fix a possible null-pointer dereference in ocfs2_write_end_nolock() - fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() - [arm64] armv8_deprecated: Checking return value for memory allocation - [x86] cpu: Add Comet Lake to the Intel CPU models header - sched/vtime: Fix guest/system mis-accounting on task switch - [x86] perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp - drm/amdgpu: fix memory leak - iio: imu: adis16400: release allocated memory on failure (CVE-2019-19060) - [x86] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr (CVE-2019-19048) - NFSv4: Fix leak of clp->cl_acceptor string - tracing: Initialize iter->seq after zeroing in tracing_read_pipe() - ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 - iwlwifi: exclude GEO SAR support for 3168 - nbd: verify socket is supported during setup - USB: legousbtower: fix a signedness bug in tower_probe() - [x86] thunderbolt: Use 32-bit writes when writing ring producer/consumer - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() (CVE-2019-15098) - fuse: flush dirty data/metadata before non-truncate setattr - fuse: truncate pending writes on O_TRUNC - ALSA: bebob: Fix prototype of helper function to return negative value - ALSA: hda/realtek - Fix 2 front mics of codec 0x623 - ALSA: hda/realtek - Add support for ALC623 - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") - USB: gadget: Reject endpoints with 0 maxpacket value - usb-storage: Revert commit 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG overflows") - USB: ldusb: fix ring-buffer locking - USB: ldusb: fix control-message timeout - usb: xhci: fix __le32/__le64 accessors in debugfs code - USB: serial: whiteheat: fix potential slab corruption - USB: serial: whiteheat: fix line-speed endianness - scsi: target: cxgbit: Fix cxgbit_fw4_ack() - HID: i2c-hid: add Trekstor Primebook C11B to descriptor override - HID: Fix assumption that devices have inputs - HID: fix error message in hid_open_report() - nl80211: fix validation of mesh path nexthop - [s390x] cmm: fix information leak in cmm_timeout_handler() - [s390x] idle: fix cpu idle time calculation - [arm64] Ensure VM_WRITE|VM_SHARED ptes are clean by default - rtlwifi: Fix potential overflow on P2P code (CVE-2019-17666) - [arm64] dmaengine: qcom: bam_dma: Fix resource leak - [armhf] dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle - NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid() - batman-adv: Avoid free/alloc race when handling OGM buffer - llc: fix sk_buff leak in llc_sap_state_process() - llc: fix sk_buff leak in llc_conn_service() - rxrpc: Fix call ref leak - rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record - rxrpc: Fix trace-after-put looking at the put peer record - NFC: pn533: fix use-after-free and memleaks - bonding: fix potential NULL deref in bond_update_slave_arr - net: usb: sr9800: fix uninitialized local variable - sch_netem: fix rcu splat in netem_enqueue() - ALSA: timer: Simplify error path in snd_timer_open() - ALSA: timer: Fix mutex deadlock at releasing card - ALSA: usb-audio: DSD auto-detection for Playback Designs - ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface - [ppc64el] powerpc/powernv: Fix CPU idle to be called with IRQs disabled - Revert "ALSA: hda: Flush interrupts on disabling" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.83 - regulator: of: fix suspend-min/max-voltage parsing - [arm64] dts: allwinner: a64: pine64-plus: Add PHY regulator delay - [arm64] arm64: dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay - [armhf] regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone - [x86] ASoC: rt5682: add NULL handler to set_jack function - [armhf] regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized - [arm64,armhf] ASoc: rockchip: i2s: Fix RPM imbalance - [armel,armhf] mm: fix alignment handler faults under memory pressure - scsi: qla2xxx: fix a potential NULL pointer dereference - scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions - drm/amdgpu: fix potential VM faults - scsi: target: core: Do not overwrite CDB byte 1 - tracing: Fix "gfp_t" format for synthetic events - of: unittest: fix memory leak in unittest_data_add (CVE-2019-19049) - [arm64,armhf] irqchip/gic-v3-its: Use the exact ITSList for VMOVP - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs - nbd: protect cmd->status with cmd->lock - nbd: handle racing with error'ed out commands - cxgb4: fix panic when attaching to ULD fail - dccp: do not leak jiffies on the wire - erspan: fix the tun_info options_len check for erspan - inet: stop leaking jiffies on the wire - net: annotate accesses to sk->sk_incoming_cpu - net: annotate lockless accesses to sk->sk_napi_id - [armhf] net: dsa: bcm_sf2: Fix IMP setup for port different than 8 - net: fix sk_page_frag() recursion from memory reclaim - [arm64] net: hisilicon: Fix ping latency when deal with high throughput - net/mlx4_core: Dynamically set guaranteed amount of counters per VF - netns: fix GFP flags in rtnl_net_notifyid() - net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() - udp: fix data-race in udp_set_dev_scratch() - vxlan: check tun_info options_len properly - net: add skb_queue_empty_lockless() - udp: use skb_queue_empty_lockless() - net: use skb_queue_empty_lockless() in poll() handlers - net: use skb_queue_empty_lockless() in busy poll contexts - net: add READ_ONCE() annotation in __skb_wait_for_more_packets() - ipv4: fix route update on metric change. - net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget - r8169: fix wrong PHY ID issue with RTL8168dp - net/mlx5e: Fix ethtool self test: link speed - [armhf] net: dsa: b53: Do not clear existing mirrored port mask - [armhf] net: phy: bcm7xxx: define soft_reset for 40nm EPHY - net: usb: lan78xx: Connect PHY before registering MAC - [arm64,armhf] net: dsa: fix switch tree list - r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2 - net/flow_dissector: switch to siphash - wireless: Skip directory when generating certificates - [x86] platform/x86: pmc_atom: Add Siemens SIMATIC IPC227E to critclk_systems DMI table - [ppc64el] powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9 - usb: gadget: udc: core: Fix segfault if udc_bind_to_driver() for pending driver fails https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.84 - bonding: fix state transition issue in link monitoring - CDC-NCM: handle incomplete transfer of MTU - ipv4: Fix table id reference in fib_sync_down_addr - [mips*] net: ethernet: octeon_mgmt: Account for second possible VLAN header - net: fix data-race in neigh_event_send() - net: usb: qmi_wwan: add support for DW5821e with eSIM support - nfc: netlink: fix double device reference drop - qede: fix NULL pointer deref in __qede_remove() - ipv6: fixes rt6_probe() and fib6_nh->last_probe init - [arm64] net: hns: Fix the stray netpoll locks causing deadlock in NAPI path - ALSA: timer: Fix incorrectly assigned timer instance - ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series - ALSA: hda/ca0132 - Fix possible workqueue stall - mm: memcontrol: fix network errors from failing __GFP_ATOMIC charges - mm, meminit: recalculate pcpu batch and high limits after init completes - mm: thp: handle page cache THP correctly in PageTransCompoundMap - mm, vmstat: hide /proc/pagetypeinfo from normal users - dump_stack: avoid the livelock of the dump_lock - perf tools: Fix time sorting - drm/radeon: fix si_enable_smc_cac() failed issue - HID: wacom: generic: Treat serial number and related fields as unsigned - [arm64] Do not mask out PTE_RDONLY in pte_same() - ceph: fix use-after-free in __ceph_remove_cap() - ceph: add missing check in d_revalidate snapdir handling - [armhf] sunxi: Fix CPU powerdown on A83T - netfilter: nf_tables: Align nft_expr private data to 64-bit - netfilter: ipset: Fix an error code in ip_set_sockfn_get() - [x86] intel_th: pci: Add Comet Lake PCH support - [x86] intel_th: pci: Add Jasper Lake PCH support - [x86] apic/32: Avoid bogus LDR warnings - SMB3: Fix persistent handles reconnect - can: usb_8dev: fix use-after-free on disconnect - [armhf] can: flexcan: disable completely the ECC mechanism - can: peak_usb: fix a potential out-of-sync while decoding packets - can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid skb mem leak - can: gs_usb: gs_can_open(): prevent memory leak (CVE-2019-19052) - can: dev: add missing of_node_put() after calling of_get_child_by_name() - can: mcba_usb: fix use-after-free on disconnect - can: peak_usb: fix slab info leak - configfs: stash the data we need into configfs_buffer at open time - configfs_register_group() shouldn't be (and isn't) called in rmdirable parts - configfs: new object reprsenting tree fragments - configfs: provide exclusion between IO and removals - configfs: fix a deadlock in configfs_symlink() - ALSA: usb-audio: More validations of descriptor units - ALSA: usb-audio: Simplify parse_audio_unit() - ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects - ALSA: usb-audio: Remove superfluous bLength checks - ALSA: usb-audio: Clean up check_input_term() - ALSA: usb-audio: Fix possible NULL dereference at create_yamaha_midi_quirk() - ALSA: usb-audio: remove some dead code - ALSA: usb-audio: Fix copy&paste error in the validator - sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices - sched/fair: Fix -Wunused-but-set-variable warnings - usbip: Fix vhci_urb_enqueue() URB null transfer buffer error path - usbip: Implement SG support to vhci-hcd and stub driver - [arm64,armhf] PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 - [amd64] HID: intel-ish-hid: fix wrong error handling in ishtp_cl_alloc_tx_ring() - RDMA/mlx5: Clear old rate limit when closing QP - iw_cxgb4: fix ECN check on the passive accept - RDMA/qedr: Fix reported firmware version - net/mlx5e: TX, Fix consumer index of error cqe dump - net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq (CVE-2019-19045) - scsi: qla2xxx: fixup incorrect usage of host_byte - RDMA/uverbs: Prevent potential underflow - net: openvswitch: free vport unless register_netdevice() succeeds - scsi: lpfc: Honor module parameter lpfc_use_adisc - scsi: qla2xxx: Initialized mailbox to prevent driver load failure - netfilter: nf_flow_table: set timeout before insertion into hashes - ipvs: don't ignore errors in case refcounting ip_vs module fails - ipvs: move old_secure_tcp into struct netns_ipvs - bonding: fix unexpected IFF_BONDING bit unset - macsec: fix refcnt leak in module exit routine - usb: gadget: composite: Fix possible double free memory bug - [arm64] usb: dwc3: pci: prevent memory leak in dwc3_pci_probe (CVE-2019-18813) - usb: gadget: configfs: fix concurrent issue between composite APIs - [arm64,armhf] usb: dwc3: remove the call trace of USBx_GFLADJ - [x86] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity - [x86] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h) - [x86] perf/x86/uncore: Fix event group support - USB: Skip endpoints with 0 maxpacket length - USB: ldusb: use unsigned size format specifiers - usbip: tools: Fix read_usb_vudc_device() error path handling - RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case - [arm64] RDMA/hns: Prevent memory leaks of eq->buf_list - scsi: qla2xxx: stop timer in shutdown path - nvme-multipath: fix possible io hang after ctrl reconnect - [amd64] fjes: Handle workqueue allocation failure - [arm64] net: hisilicon: Fix "Trying to free already-free IRQ" - drm/amdgpu: If amdgpu_ib_schedule fails return back the error. - [x86] hv_netvsc: Fix error handling in netvsc_attach() - [arm64,armhf] usb: dwc3: gadget: fix race when disabling ep with cancelled xfers - NFSv4: Don't allow a cached open with a revoked delegation - igb: Fix constant media auto sense switching when no cable is connected - e1000: fix memory leaks - [x86] pinctrl: intel: Avoid potential glitches if pin is in GPIO mode - ocfs2: protect extent tree in ocfs2_prepare_inode_for_write() - [x86] pinctrl: cherryview: Fix irq_valid_mask calculation - blkcg: make blkcg_print_stat() print stats only for online blkgs - [x86] iio: imu: mpu6050: Add support for the ICM 20602 IMU - [x86] iio: imu: inv_mpu6050: fix no data on MPU6050 - mm/filemap.c: don't initiate writeback if mapping has no dirty pages - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead - usbip: Fix free of unallocated memory in vhci tx - netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets - net: prevent load/store tearing on sk->sk_stamp - [x86] iio: imu: mpu6050: Fix FIFO layout for ICM20602 - vsock/virtio: fix sock refcnt holding during the shutdown - x86/cpu: Add Tremont to the cpu vulnerability whitelist https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.85 - scsi: core: Handle drivers which set sg_tablesize to zero - ax88172a: fix information leak on short answers - ipmr: Fix skb headroom in ipmr_get_route(). - net: gemini: add missed free_netdev - net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules - slip: Fix memory leak in slip_open error path - ALSA: usb-audio: Fix missing error check at mixer resolution test - ALSA: usb-audio: not submit urb for stopped endpoint - ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() - ALSA: usb-audio: Fix incorrect size check for processing/extension units - Btrfs: fix log context list corruption after rename exchange operation - Input: ff-memless - kill timer in destroy() - Input: synaptics-rmi4 - fix video buffer size - Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver - Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) - Input: synaptics-rmi4 - clear IRQ enables for F54 - Input: synaptics-rmi4 - destroy F54 poller workqueue when removing - IB/hfi1: Ensure full Gen3 speed in a Gen4 system - IB/hfi1: Use a common pad buffer for 9B and 16B packets - i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either - [armhf] net: ethernet: dwmac-sun8i: Use the correct function in exit path - [x86] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros - mm: mempolicy: fix the wrong return value and potential pages leak of mbind - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() - iio: adc: max9611: explicitly cast gain_selectors - tee: optee: take DT status property into account - ath10k: fix kernel panic by moving pci flush after napi_disable - clk: sunxi-ng: h6: fix PWM gate/reset offset - soundwire: Initialize completion for defer messages - [x86] soundwire: intel: Fix uninitialized adev deref - [arm64] dts: allwinner: a64: Orange Pi Win: Fix SD card node - [arm64] dts: allwinner: a64: Olinuxino: fix DRAM voltage - [arm64] dts: allwinner: a64: NanoPi-A64: Fix DCDC1 voltage - ALSA: pcm: signedness bug in snd_pcm_plug_alloc() - [arm64] soc/tegra: pmc: Fix pad voltage configuration for Tegra186 - [arm64] dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply - y2038: make do_gettimeofday() and get_seconds() inline - rtc: sysfs: fix NULL check in rtc_add_groups() - remoteproc/davinci: Use %zx for formating size_t - extcon: cht-wc: Return from default case to avoid warnings - cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set - ALSA: seq: Do error checks at creating system ports - ath10k: skip resetting rx filter for WCN3990 - ath9k: fix tx99 with monitor mode interface - wil6210: drop Rx multicast packets that are looped-back to STA - wil6210: set edma variables only for Talyn-MB devices - wil6210: prevent usage of tx ring 0 for eDMA - wil6210: fix invalid memory access for rx_buff_mgmt debugfs - ath10k: limit available channels via DT ieee80211-freq-limit - ice: Update request resource command to latest specification - ice: Prevent control queue operations during reset - gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated - ice: Fix and update driver version string - ASoC: dapm: Don't fail creating new DAPM control on NULL pinctrl - ASoC: dpcm: Properly initialise hw->rate_max - ASoC: meson: axg-fifo: report interrupt request failure - ASoC: AMD: Change MCLK to 48Mhz - pinctrl: ingenic: Probe driver at subsys_initcall - [armhf] dts: exynos: Use i2c-gpio for HDMI-DDC on Arndale - [armhf] dts: exynos: Fix HDMI-HPD line handling on Arndale - [armhf] dts: exynos: Fix sound in Snow-rev5 Chromebook - liquidio: fix race condition in instruction completion processing - [arm64] dts: stratix10: i2c clock running out of spec - [armhf] dts: exynos: Fix regulators configuration on Peach Pi/Pit Chromebooks - i40evf: Validate the number of queues a PF sends - i40e: use correct length for strncpy - i40evf: set IFF_UNICAST_FLT flag for the VF - i40e: Check and correct speed values for link on open - i40evf: Don't enable vlan stripping when rx offload is turned on - i40e: hold the rtnl lock on clearing interrupt scheme - i40evf: cancel workqueue sync for adminq when a VF is removed - i40e: Prevent deleting MAC address from VF when set by PF - IB/rxe: avoid back-to-back retries - IB/rxe: fixes for rdma read retry - iwlwifi: drop packets with bad status in CD - iwlwifi: don't WARN on trying to dump dead firmware - iwlwifi: mvm: avoid sending too many BARs - media: vicodec: fix out-of-range values when decoding - media: i2c: Fix pm_runtime_get_if_in_use() usage in sensor drivers - media: ov772x: Disable clk on error path - rtl8187: Fix warning generated when strncpy() destination length matches the sixe argument - mwifiex: do no submit URB in suspended state - mwifex: free rx_cmd skb in suspended state - brcmfmac: fix wrong strnchr usage - mt76: Fix comparisons with invalid hardware key index - soc: imx: gpc: fix PDN delay - ASoC: rsnd: ssi: Fix issue in dma data address assignment - net: hns3: Fix for multicast failure - net: hns3: Fix error of checking used vlan id - net: hns3: Fix for loopback selftest failed problem - net: hns3: Change the dst mac addr of loopback packet - net/mlx5: Fix atomic_mode enum values - net: phy: mscc: read 'vsc8531,vddmac' as an u32 - net: phy: mscc: read 'vsc8531, edge-slowdown' as an u32 - [armhf] dts: meson8: fix the clock controller register size - [armhf] dts: meson8b: fix the clock controller register size - mtd: rawnand: marvell: use regmap_update_bits() for syscon access - mtd: rawnand: fsl_ifc: check result of SRAM initialization - mtd: rawnand: fsl_ifc: fixup SRAM init for newer ctrl versions - mtd: rawnand: qcom: don't include dma-direct.h - IB/mlx5: Change TX affinity assignment in RoCE LAG mode - qxl: fix null-pointer crash during suspend - mac80211: fix saving a few HE values - cfg80211: validate wmm rule when setting - f2fs: avoid wrong decrypted data from disk - net: lan78xx: Bail out if lan78xx_get_endpoints fails - rtnetlink: move type calculation out of loop - ASoC: sgtl5000: avoid division by zero if lo_vag is zero - ath10k: avoid possible memory access violation - [armhf] dts: exynos: Disable pull control for S5M8767 PMIC - ath10k: wmi: disable softirq's while calling ieee80211_rx - i2c: mediatek: Use DMA safe buffers for i2c transactions - IB/mlx5: Don't hold spin lock while checking device state - IB/ipoib: Ensure that MTU isn't less than minimum permitted - RDMA/core: Rate limit MAD error messages - RDMA/core: Follow correct unregister order between sysfs and cgroup - udf: Fix crash during mount - ASoC: dapm: Avoid uninitialised variable warning - [x86] ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation - ata: Disable AHCI ALPM feature for Ampere Computing eMAG SATA - [powerpc] make PowerMac cache node search conditional on CONFIG_PPC_PMAC - [armhf] dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in other DTS files - [armhf] dts: omap3-gta04: fixes for tvout / venc - [armhf] dts: omap3-gta04: tvout: enable as display1 alias - [armhf] dts: omap3-gta04: fix touchscreen tsc2007 - [armhf] dts: omap3-gta04: make NAND partitions compatible with recent U-Boot - [armhf] dts: omap3-gta04: keep vpll2 always on - f2fs: submit bio after shutdown - failover: Fix error return code in net_failover_create - sched/debug: Explicitly cast sched_feat() to bool - sched/debug: Use symbolic names for task state constants - firmware: arm_scmi: use strlcpy to ensure NULL-terminated strings - [arm64] dts: rockchip: Fix VCC5V0_HOST_EN on rk3399-sapphire - [armhf] dts: exynos: Disable pull control for PMIC IRQ line on Artik5 board - usb: mtu3: disable vbus rise/fall interrupts of ltssm - EDAC, sb_edac: Return early on ADDRV bit and address type test - [armhf] rtc: pl030: fix possible race condition - ath9k: add back support for using active monitor interfaces for tx99 - dmaengine: at_xdmac: remove a stray bottom half unlock - RDMA/hns: Fix an error code in hns_roce_v2_init_eq_table() - IB/hfi1: Missing return value in error path for user sdma - signal: Always ignore SIGKILL and SIGSTOP sent to the global init - signal: Properly deliver SIGILL from uprobes - signal: Properly deliver SIGSEGV from x86 uprobes - f2fs: fix memory leak of write_io in fill_super() - f2fs: fix memory leak of percpu counter in fill_super() - f2fs: fix setattr project check upon fssetxattr ioctl - scsi: qla2xxx: Use correct qpair for ABTS/CMD - scsi: qla2xxx: Fix iIDMA error - scsi: qla2xxx: Defer chip reset until target mode is enabled - scsi: qla2xxx: Terminate Plogi/PRLI if WWN is 0 - scsi: qla2xxx: Fix deadlock between ATIO and HW lock - scsi: qla2xxx: Increase abort timeout value - scsi: qla2xxx: Check for Register disconnect - scsi: qla2xxx: Fix port speed display on chip reset - scsi: qla2xxx: Fix dropped srb resource. - scsi: qla2xxx: Fix duplicate switch's Nport ID entries - scsi: lpfc: Fix GFT_ID and PRLI logic for RSCN - scsi: lpfc: Correct invalid EQ doorbell write on if_type=6 - scsi: lpfc: Fix errors in log messages. - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() - [armhf] imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set - scsi: pm80xx: Corrected dma_unmap_sg() parameter - scsi: pm80xx: Fixed system hang issue during kexec boot - kprobes: Don't call BUG_ON() if there is a kprobe in use on free list - net: aquantia: fix hw_atl_utils_fw_upload_dwords - Drivers: hv: vmbus: Fix synic per-cpu context initialization - nvmem: core: return error code instead of NULL from nvmem_device_get - media: dt-bindings: adv748x: Fix decimal unit addresses - [x86] ALSA: hda: Fix implicit definition of pci_iomap() on SH - media: fix: media: pci: meye: validate offset to avoid arbitrary access - media: dvb: fix compat ioctl translation - net: bcmgenet: Fix speed selection for reverse MII - [arm64] dts: meson: libretech: update board model - [arm64] dts: meson-axg: use the proper compatible for ethmac - [x86] ALSA: intel8x0m: Register irq handler after register initializations - [arm64] dts: renesas: salvator-common: adv748x: Override secondary addresses - [arm64] dts: renesas: r8a77965: Attach the SYS-DMAC to the IPMMU - [arm64] dts: renesas: r8a77965: Fix HS-USB compatible - [arm64] dts: renesas: r8a77965: Fix clock/reset for usb2_phy1 - pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map() - llc: avoid blocking in llc_sap_close() - [armhf] dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value - [arm64] soc: qcom: wcnss_ctrl: Avoid string overflow - [arm64] dts: broadcom: Fix I2C and SPI bus warnings - [armhf] dts: bcm: Fix SPI bus warnings - [armhf] dts: aspeed: Fix I2C bus warnings - [ppc64el,powerpc*] powerpc/vdso: Correct call frame information - [armhf] dts: socfpga: Fix I2C bus unit-address error - [armhf] dts: sunxi: Fix I2C bus warnings - [armhf] dts: sun9i: Fix I2C bus warnings - android: binder: no outgoing transaction when thread todo has transaction - cxgb4: Fix endianness issue in t4_fwcache() - [arm64] fix for bad_mode() handler to always result in panic - block, bfq: inject other-queue I/O into seeky idle queues on NCQ flash - blok, bfq: do not plug I/O if all queues are weight-raised - [arm64] dts: meson: Fix erroneous SPI bus warnings - power: supply: ab8500_fg: silence uninitialized variable warnings - component: fix loop condition to call unbind() if bind() fails - kernfs: Fix range checks in kernfs_get_target_path - ip_gre: fix parsing gre header in ipgre_err - scsi: ufshcd: Fix NULL pointer dereference for in ufshcd_init - [armhf] dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036 - [arm64] dts: rockchip: Fix I2C bus unit-address error on rk3399-puma-haikou - [x86] ACPI / LPSS: Exclude I2C busses shared with PUNIT from pmc_atom_d3_mask - netfilter: nf_tables: avoid BUG_ON usage - ath9k: Fix a locking bug in ath9k_add_interface() - [s390x] qeth: uninstall IRQ handler on device removal - [s390x] qeth: invoke softirqs after napi_schedule() - media: vsp1: Fix vsp1_regs.h license header - media: vsp1: Fix YCbCr planar formats pitch calculation - media: ov2680: don't register the v4l2 subdevice before checking chip ID - PCI/ACPI: Correct error message for ASPM disabling - net: socionext: Fix two sleep-in-atomic-context bugs in ave_rxfifo_reset() - PCI: mediatek: Fix unchecked return value - [armhf] dts: xilinx: Fix I2C and SPI bus warnings - serial: uartps: Fix suspend functionality - serial: samsung: Enable baud clock for UART reset procedure in resume - serial: mxs-auart: Fix potential infinite loop - tty: serial: qcom_geni_serial: Fix serial when not used as console - [arm64] dts: ti: k3-am65: Change #address-cells and #size-cells of interconnect to 2 - samples/bpf: fix a compilation failure - spi: mediatek: Don't modify spi_transfer when transfer. - ASoC: rt5682: Fix the boost volume at the begining of playback - ipmi_si_pci: fix NULL device in ipmi_si error message - ipmi_si: fix potential integer overflow on large shift - ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address - ipmi: fix return value of ipmi_set_my_LUN - net: hns3: fix return type of ndo_start_xmit function - net: cavium: fix return type of ndo_start_xmit function - net: ibm: fix return type of ndo_start_xmit function - [ppc64el,powerpc*] iommu: Avoid derefence before pointer check - [ppc64el,powerpc*] selftests: Do not fail with reschedule - [ppc64el,powerpc64] hash: Fix stab_rr off by one initialization - [ppc64el,powerpc64] pseries/memory-hotplug: Only update DT once per memory DLPAR request - [ppc64el,powerpc64] pseries: Disable CPU hotplug across migrations - [ppc64el,powerpc*] Fix duplicate const clang warning in user access code - RDMA/i40iw: Fix incorrect iterator type - OPP: Protect dev_list with opp_table lock - of/unittest: Fix I2C bus unit-address error - libfdt: Ensure INT_MAX is defined in libfdt_env.h - power: supply: twl4030_charger: fix charging current out-of-bounds - power: supply: twl4030_charger: disable eoc interrupt on linear charge - net: mvpp2: fix the number of queues per cpu for PPv2.2 - net: marvell: fix return type of ndo_start_xmit function - net: toshiba: fix return type of ndo_start_xmit function - net: xilinx: fix return type of ndo_start_xmit function - net: broadcom: fix return type of ndo_start_xmit function - net: amd: fix return type of ndo_start_xmit function - net: sun: fix return type of ndo_start_xmit function - net: hns3: Fix for setting speed for phy failed problem - net: hns3: Fix cmdq registers initialization issue for vf - net: hns3: Clear client pointer when initialize client failed or unintialize finished - net: hns3: Fix client initialize state issue when roce client initialize failed - net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg() - nfp: provide a better warning when ring allocation fails - usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is already started - usb: chipidea: Fix otg event handler - usb: usbtmc: Fix ioctl USBTMC_IOCTL_ABORT_BULK_OUT - [s390x] zcrypt: enable AP bus scan without a valid default domain - [s390x] vdso: avoid 64-bit vdso mapping for compat tasks - [s390x] vdso: correct CFI annotations of vDSO functions - brcmfmac: increase buffer for obtaining firmware capabilities - brcmsmac: Use kvmalloc() for ucode allocations - mlxsw: spectrum: Init shaper for TCs 8..15 - PCI: portdrv: Initialize service drivers directly - [armhf] dts: am335x-evm: fix number of cpsw - [armhf] dts: ti: Fix SPI and I2C bus warnings - f2fs: avoid infinite loop in f2fs_alloc_nid - f2fs: fix to recover inode's uid/gid during POR - [armhf] dts: ux500: Correct SCU unit address - [armhf] dts: ux500: Fix LCDA clock line muxing - [armhf] dts: ste: Fix SPI controller node names - spi: pic32: Use proper enum in dmaengine_prep_slave_rg - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) - cpufeature: avoid warning when compiling with clang - [armhf] crypto: crc32 - avoid warning when compiling with Clang - [armel] dts: marvell: Fix SPI and I2C bus warnings - [x86] mce-inject: Reset injection struct after injection - [armhf,arm64] dts: clearfog: fix sdhci supply property name - bnx2x: Ignore bandwidth attention in single function mode - PCI/AER: Take reference on error devices - PCI/AER: Don't read upstream ports below fatal errors - PCI/ERR: Use slot reset if available - samples/bpf: fix compilation failure - net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider - net: micrel: fix return type of ndo_start_xmit function - net: freescale: fix return type of ndo_start_xmit function - [x86] CPU: Use correct macros for Cyrix calls - [x86] CPU: Change query logic so CPUID is enabled before testing - EDAC: Correct DIMM capacity unit symbol - [mips*] kexec: Relax memory restriction - [arm64] dts: rockchip: Fix microSD in rk3399 sapphire board - mlxsw: Make MLXSW_SP1_FWREV_MINOR a hard requirement - media: imx: work around false-positive warning, again - media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init() - media: au0828: Fix incorrect error messages - media: davinci: Fix implicit enum conversion warning - [armhf] dts: rockchip: explicitly set vcc_sd0 pin to gpio on rk3188-radxarock - usb: gadget: uvc: configfs: Drop leaked references to config items - usb: gadget: uvc: configfs: Prevent format changes after linking header - usb: gadget: uvc: configfs: Sort frame intervals upon writing - [armhf] dts: exynos: Correct audio subsystem parent clock on Peach Chromebooks - i2c: aspeed: fix invalid clock parameters for very large divisors - gpiolib: Fix gpio_direction_* for single direction GPIOs - phy: brcm-sata: allow PHY_BRCM_SATA driver to be built for DSL SoCs - phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs - phy: phy-twl4030-usb: fix denied runtime access - [armhf] dts: imx6ull: update vdd_soc voltage for 900MHz operating point - usb: gadget: uvc: Factor out video USB request queueing - usb: gadget: uvc: Only halt video streaming endpoint in bulk mode - coresight: Use ERR_CAST instead of ERR_PTR - coresight: Fix handling of sinks - coresight: perf: Fix per cpu path management - coresight: perf: Disable trace path upon source error - coresight: tmc-etr: Handle driver mode specific ETR buffers - coresight: etm4x: Configure EL2 exception level when kernel is running in HYP - coresight: tmc: Fix byte-address alignment for RRP - coresight: dynamic-replicator: Handle multiple connections - slimbus: ngd: register ngd driver only once. - slimbus: ngd: return proper error code instead of zero - silmbus: ngd: register controller after power up. - misc: kgdbts: Fix restrict error - misc: genwqe: should return proper error value. - vmbus: keep pointer to ring buffer page - vfio/pci: Fix potential memory leak in vfio_msi_cap_len - vfio/pci: Mask buggy SR-IOV VF INTx support - iw_cxgb4: Use proper enumerated type in c4iw_bar2_addrs - scsi: libsas: always unregister the old device if going to discover new - f2fs: fix remount problem of option io_bits - phy: lantiq: Fix compile warning - [arm64] dts: fsl: Fix I2C and SPI bus warnings - [armhf] dts: imx51-zii-rdu1: Fix the rtc compatible string - [arm64] tegra: I2C on Tegra194 is not compatible with Tegra114 - [armhf] dts: tegra30: fix xcvr-setup-use-fuses - [armhf] dts: tegra20: restore address order - [armhf] tegra: apalis_t30: fix mmc1 cmd pull-up - [armhf] tegra: apalis_t30: fix mcp2515 can controller interrupt polarity - [armhf] tegra: colibri_t30: fix mcp2515 can controller interrupt polarity - [armhf] dts: paz00: fix wakeup gpio keycode - net: smsc: fix return type of ndo_start_xmit function - net: faraday: fix return type of ndo_start_xmit function - PCI/ERR: Run error recovery callbacks for all affected devices - f2fs: update i_size after DIO completion - f2fs: fix to recover inode's project id during POR - f2fs: mark inode dirty explicitly in recover_inode() - RDMA: Fix dependencies for rdma_user_mmap_io - EDAC: Raise the maximum number of memory controllers - firmware: dell_rbu: Make payload memory uncachable - Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing proto races - Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS - Bluetooth: btrsi: fix bt tx timeout issue - [x86] hyperv: Suppress "PCI: Fatal: No config space access function found" - crypto: s5p-sss: Fix race in error handling - crypto: s5p-sss: Fix Fix argument list alignment - crypto: fix a memory leak in rsa-kcs1pad's encryption mode - iwlwifi: dbg: don't crash if the firmware crashes in the middle of a debug dump - iwlwifi: fix non_shared_ant for 22000 devices - iwlwifi: pcie: read correct prph address for newer devices - iwlwifi: api: annotate compressed BA notif array sizes - iwlwifi: pcie: gen2: build A-MSDU only for GSO - iwlwifi: pcie: fit reclaim msg to MAX_MSG_LEN - iwlwifi: mvm: use correct FIFO length - iwlwifi: mvm: Allow TKIP for AP mode - scsi: NCR5380: Clear all unissued commands on host reset - scsi: NCR5380: Have NCR5380_select() return a bool - scsi: NCR5380: Withhold disconnect privilege for REQUEST SENSE - scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data - scsi: NCR5380: Check for invalid reselection target - scsi: NCR5380: Don't clear busy flag when abort fails - scsi: NCR5380: Don't call dsprintk() following reselection interrupt - scsi: NCR5380: Handle BUS FREE during reselection - scsi: NCR5380: Check for bus reset - [arm64] dts: amd: Fix SPI bus warnings - [arm64] dts: lg: Fix SPI controller node names - rtc: isl1208: avoid possible sysfs race - rtc: tx4939: fixup nvmem name and register size - rtc: armada38x: fix possible race condition - netfilter: masquerade: don't flush all conntracks if only one address deleted on device - usb: xhci-mtk: fix ISOC error when interval is zero - usb: usbtmc: uninitialized symbol 'actual' in usbtmc_ioctl_clear - fuse: use READ_ONCE on congestion_threshold and max_background - IB/iser: Fix possible NULL deref at iser_inv_desc() - media: ov2680: fix null dereference at power on - [s390x] vdso: correct vdso mapping for compat tasks - net: phy: mdio-bcm-unimac: mark PM functions as __maybe_unused - memfd: Use radix_tree_deref_slot_protected to avoid the warning. - slcan: Fix memory leak in error path https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.86 - spi: mediatek: use correct mata->xfer_len when in fifo transfer - i2c: mediatek: modify threshold passed to i2c_get_dma_safe_msg_buf() - tee: optee: add missing of_node_put after of_device_is_available - Revert "OPP: Protect dev_list with opp_table lock" - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() - idr: Fix idr_get_next race with idr_remove - mm/memory_hotplug: don't access uninitialized memmaps in shrink_pgdat_span() - mm/memory_hotplug: fix updating the node span - [arm64] uaccess: Ensure PAN is re-enabled after unhandled uaccess fault - fbdev: Ditch fb_edid_add_monspecs - [i386] bpf, x32: Fix bug for BPF_ALU64 | BPF_NEG - [i386] bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_X shift by 0 - [i386] bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_K shift by 0 - [i386] bpf, x32: Fix bug for BPF_JMP | {BPF_JSGT, BPF_JSLE, BPF_JSLT, BPF_JSGE} - net: ovs: fix return type of ndo_start_xmit function - net: xen-netback: fix return type of ndo_start_xmit function - [armhf] dts: dra7: Enable workaround for errata i870 in PCIe host mode - [armhf] dts: omap5: enable OTG role for DWC3 controller - [arm64] net: hns3: Fix for netdev not up problem when setting mtu - [arm64] net: hns3: Fix loss of coal configuration while doing reset - f2fs: return correct errno in f2fs_gc - [armhf] dts: sun8i: h3-h5: ir register size should be the whole memory block - [armhf] dts: sun8i: h3: bpi-m2-plus: Fix address for external RGMII Ethernet PHY - tcp: up initial rmem to 128KB and SYN rwin to around 64KB - SUNRPC: Fix priority queue fairness - ACPI / LPSS: Make acpi_lpss_find_device() also find PCI devices - ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq - f2fs: keep lazytime on remount - IB/hfi1: Error path MAD response size is incorrect - IB/hfi1: Ensure ucast_dlid access doesnt exceed bounds - mt76x2: fix tx power configuration for VHT mcs 9 - mt76x2: disable WLAN core before probe - mt76: fix handling ps-poll frames - [arm64,armhf] iommu/io-pgtable-arm: Fix race handling in split_blk_unmap() - [arm64,armhf] iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout - [arm64,armhf] kvm: Fix stage2_flush_memslot for 4 level page table - [arm64] numa: Report correct memblock range for the dummy node - ath10k: fix vdev-start timeout on error - rtlwifi: btcoex: Use proper enumerated types for Wi-Fi only interface - ata: ahci_brcm: Allow using driver or DSL SoCs - PM / devfreq: Fix devfreq_add_device() when drivers are built as modules. - PM / devfreq: Fix handling of min/max_freq == 0 - PM / devfreq: stopping the governor before device_unregister() - ath9k: fix reporting calculated new FFT upper max - selftests/tls: Fix recv(MSG_PEEK) & splice() test cases - usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status() - usb: dwc3: gadget: Check ENBLSLPM before sending ep command - nl80211: Fix a GET_KEY reply attribute - [arm64,armhf] irqchip/irq-mvebu-icu: Fix wrong private data retrieval - watchdog: core: fix null pointer dereference when releasing cdev - watchdog: w83627hf_wdt: Support NCT6796D, NCT6797D, NCT6798D - [ppc64el,powerpc64] Inform the userspace about TCE update failures - printk: Do not miss new messages when replaying the log - printk: CON_PRINTBUFFER console registration is a bit racy - dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction - dmaengine: timb_dma: Use proper enum in td_prep_slave_sg - [x86] ALSA: hda: Fix mismatch for register mask and value in ext controller. - ext4: fix build error when DX_DEBUG is defined - clk: keystone: Enable TISCI clocks if K3_ARCH - sunrpc: Fix connect metrics - [x86] PCI: Apply VMD's AERSID fixup generically - mei: samples: fix a signedness bug in amt_host_if_call() - cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update - cxgb4: Use proper enum in IEEE_FAUX_SYNC - [ppc64el,powerpc*] Fix DTL buffer registration - [ppc64el,powerpc*] Fix how we iterate over the DTL entries - [ppc64el,powerpc*] xive: Move a dereference below a NULL test - mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer - PM / hibernate: Check the success of generating md5 digest before hibernation - tools: PCI: Fix compilation warnings - ice: Fix forward to queue group logic - md: allow metadata updates while suspending an array - fix - ixgbe: Fix ixgbe TX hangs with XDP_TX beyond queue limit - i40e: Use proper enum in i40e_ndo_set_vf_link_state - ixgbe: Fix crash with VFs and flow director on interface flap - IB/mthca: Fix error return code in __mthca_init_one() - IB/rxe: avoid srq memory leak - RDMA/hns: Bugfix for reserved qp number - RDMA/hns: Submit bad wr when post send wr exception - RDMA/hns: Bugfix for CM test - RDMA/hns: Limit the size of extend sge of sq - IB/mlx4: Avoid implicit enumerated type conversion - rpmsg: glink: smem: Support rx peak for size less than 4 bytes - msm/gpu/a6xx: Force of_dma_configure to setup DMA for GMU - OPP: Return error on error from dev_pm_opp_get_opp_count() - ACPICA: Never run _REG on system_memory and system_IO - cpuidle: menu: Fix wakeup statistics updates for polling state - ASoC: qdsp6: q6asm-dai: checking NULL vs IS_ERR() - [ppc64el,powerpc*] time: Use clockevents_register_device(), fixing an issue with large decrementer - [ppc64el,powerpc64] radix: Explicitly flush ERAT with local LPID invalidation - ata: ep93xx: Use proper enums for directions - qed: Avoid implicit enum conversion in qed_ooo_submit_tx_buffers - media: rc: ir-rc6-decoder: enable toggle bit for Kathrein RCU-676 remote - media: pxa_camera: Fix check for pdev->dev.of_node - media: rcar-vin: fix redeclaration of symbol - media: i2c: adv748x: Support probing a single output - [x86] ALSA: hda/sigmatel - Disable automute for Elo VuPoint - bnxt_en: return proper error when FW returns HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED - [ppc64el,powerpc64] Book3S PR: Exiting split hack mode needs to fixup both PC and LR - USB: serial: cypress_m8: fix interrupt-out transfer length - usb: dwc2: disable power_down on rockchip devices - mtd: physmap_of: Release resources on error - cpu/SMT: State SMT is disabled even with nosmt and without "=force" - brcmfmac: reduce timeout for action frame scan - brcmfmac: fix full timeout waiting for action frame on-channel tx - qtnfmac: request userspace to do OBSS scanning if FW can not - qtnfmac: pass sgi rate info flag to wireless core - qtnfmac: inform wireless core about supported extended capabilities - qtnfmac: drop error reports for out-of-bounds key indexes - [armhf] clk: samsung: Use NOIRQ stage for Exynos5433 clocks suspend/resume - [armhf] clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or Exynos5420 - [armhf] clk: samsung: Use clk_hw API for calling clk framework from clk notifiers - printk: Correct wrong casting - NFSv4.x: fix lock recovery during delegation recall - dmaengine: ioat: fix prototype of ioat_enumerate_channels - media: ov5640: fix framerate update - media: cec-gpio: select correct Signal Free Time - gfs2: slow the deluge of io error messages - i2c: omap: use core to detect 'no zero length' quirk - i2c: qup: use core to detect 'no zero length' quirk - i2c: tegra: use core to detect 'no zero length' quirk - i2c: zx2967: use core to detect 'no zero length' quirk - Input: st1232 - set INPUT_PROP_DIRECT property - Input: silead - try firmware reload after unsuccessful resume - soc: fsl: bman_portals: defer probe after bman's probe - net: hns3: Fix for rx vlan id handle to support Rev 0x21 hardware - tc-testing: fix build of eBPF programs - remoteproc: Check for NULL firmwares in sysfs interface - remoteproc: qcom: q6v5: Fix a race condition on fatal crash - kexec: Allocate decrypted control pages for kdump if SME is enabled - [x86] olpc: Fix build error with CONFIG_MFD_CS5535=m - dmaengine: rcar-dmac: set scatter/gather max segment size - xfrm: use correct size to initialise sp->ovec - ACPI / SBS: Fix rare oops when removing modules - iwlwifi: mvm: don't send keys when entering D3 - xsk: proper AF_XDP socket teardown ordering - [amd64] fsgsbase: Fix ptrace() to read the FS/GS base accurately - mmc: renesas_sdhi_internal_dmac: Whitelist r8a774a1 - mmc: tmio: Fix SCC error detection - mmc: renesas_sdhi_internal_dmac: set scatter/gather max segment size - fbdev: sbuslib: use checked version of put_user() - fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() - fbdev: fix broken menu dependencies - reset: Fix potential use-after-free in __of_reset_control_get() - bcache: account size of buckets used in uuid write to ca->meta_sectors_written - bcache: recal cached_dev_sectors on detach - [x86] platform: mlx-platform: Properly use mlxplat_mlxcpld_msn201x_items - media: dw9714: Fix error handling in probe function - media: dw9807-vcm: Fix probe error handling - media: cx18: Don't check for address of video_dev - mtd: spi-nor: cadence-quadspi: Use proper enum for dma_[un]map_single - mtd: devices: m25p80: Make sure WRITE_EN is issued before each write - [x86] intel_rdt: Introduce utility to obtain CDP peer - [x86] intel_rdt: CBM overlap should also check for overlap with CDP peer - mmc: mmci: expand startbiterr to irqmask and error check - [s390x] kasan: avoid vdso instrumentation - [s390x] kasan: avoid instrumentation of early C code - [s390x] kasan: avoid user access code instrumentation - [i386] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() - backlight: lm3639: Unconditionally call led_classdev_unregister - mfd: ti_am335x_tscadc: Keep ADC interface on if child is wakeup capable - printk: Give error on attempt to set log buffer length to over 2G - media: isif: fix a NULL pointer dereference bug - GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads - media: cx231xx: fix potential sign-extension overflow on large shift - media: venus: vdec: fix decoded data size - [x86] ALSA: hda/ca0132 - Fix input effect controls for desktop cards - lightnvm: pblk: fix rqd.error return value in pblk_blk_erase_sync - lightnvm: pblk: fix incorrect min_write_pgs - lightnvm: pblk: guarantee emeta on line close - lightnvm: pblk: fix write amplificiation calculation - lightnvm: pblk: guarantee mw_cunits on read buffer - lightnvm: do no update csecs and sos on 1.2 - lightnvm: pblk: fix error handling of pblk_lines_init() - lightnvm: pblk: consider max hw sectors supported for max_write_pgs - [x86] kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error - bpf: btf: Fix a missing check bug - net: fix generic XDP to handle if eth header was mangled - gpio: syscon: Fix possible NULL ptr usage - spi: fsl-lpspi: Prevent FIFO under/overrun by default - pinctrl: gemini: Mask and set properly - spi: spidev: Fix OF tree warning logic - [armel,armhf] 8802/1: Call syscall_trace_exit even when system call skipped - [x86] mm: Do not warn about PCI BIOS W+X mappings - orangefs: rate limit the client not running info message - pinctrl: gemini: Fix up TVC clock group - scsi: arcmsr: clean up clang warning on extraneous parentheses - [x86] hwmon: (k10temp) Support all Family 15h Model 6xh and Model 7xh processors - hwmon: (nct6775) Fix names of DIMM temperature sources - hwmon: (pwm-fan) Silence error on probe deferral - hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros - hwmon: (npcm-750-pwm-fan) Change initial pwm target to 255 - selftests: forwarding: Have lldpad_app_wait_set() wait for unknown, too - net: sched: avoid writing on noop_qdisc - netfilter: nft_compat: do not dump private area - misc: cxl: Fix possible null pointer dereference - mac80211: minstrel: fix using short preamble CCK rates on HT clients - mac80211: minstrel: fix CCK rate group streams value - mac80211: minstrel: fix sampling/reporting of CCK rates in HT mode - spi: rockchip: initialize dma_slave_config properly - mlxsw: spectrum_switchdev: Check notification relevance based on upper device - [armhf] dts: omap5: Fix dual-role mode on Super-Speed port - tcp: start receiver buffer autotuning sooner - ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate - PM / devfreq: Fix static checker warning in try_then_request_governor - tools: PCI: Fix broken pcitest compilation - [ppc64el,powerpc*] time: Fix clockevent_decrementer initalisation for PR KVM - mmc: tmio: fix SCC error handling to avoid false positive CRC error - [x86] resctrl: Fix rdt_find_domain() return value and checks https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.87 - mlxsw: spectrum_router: Fix determining underlay for a GRE tunnel - net/mlx4_en: fix mlx4 ethtool -N insertion - net/mlx4_en: Fix wrong limitation for number of TX rings - net: rtnetlink: prevent underflows in do_setvfinfo() - net/sched: act_pedit: fix WARN() in the traffic path - net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key - sfc: Only cancel the PPS workqueue if it exists - net/mlx5e: Fix set vf link state error flow - net/mlxfw: Verify FSM error code translation doesn't exceed array size - net/mlx5: Fix auto group size calculation - vhost/vsock: split packets to send using multiple buffers - gpio: max77620: Fixup debounce delays - tools: gpio: Correctly add make dependencies for gpio_utils - nbd:fix memory leak in nbd_get_socket() - virtio_console: allocate inbufs in add_port() only if it is needed - Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() - [x86] drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs - [x86] drm/i915/pmu: "Frequency" is reported as accumulated cycles - [x86] drm/i915/userptr: Try to acquire the page lock around set_page_dirty() - mwifiex: Fix NL80211_TX_POWER_LIMITED - ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback - crypto: testmgr - fix sizeof() on COMP_BUF_SIZE - printk: lock/unlock console only for new logbuf entries - printk: fix integer overflow in setup_log_buf() - pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux - PCI: cadence: Write MSI data with 32bits - gfs2: Fix marking bitmaps non-full - pty: fix compat ioctls - synclink_gt(): fix compat_ioctl() - [ppc64] Fix signedness bug in update_flash_db() - [powerpc] boot: Fix opal console in boot wrapper - [ppc64*,powerpc] boot: Disable vector instructions - [ppc64*,powerpc] eeh: Fix null deref for devices removed during EEH - [ppc64*,powerpc] eeh: Fix use of EEH_PE_KEEP on wrong field - EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() - mt76: do not store aggregation sequence number for null-data frames - mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc - brcmsmac: AP mode: update beacon when TIM changes - ath10k: set probe request oui during driver start - ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem - skd: fixup usage of legacy IO API - cdrom: don't attempt to fiddle with cdo->capability - spi: sh-msiof: fix deferred probing - mmc: mediatek: fill the actual clock for mmc debugfs - mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail - PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag - btrfs: handle error of get_old_root - gsmi: Fix bug in append_to_eventlog sysfs handler - misc: mic: fix a DMA pool free failure - w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). - [m68k] fix command-line parsing when passed from u-boot - RDMA/bnxt_re: Avoid NULL check after accessing the pointer - RDMA/bnxt_re: Fix qp async event reporting - RDMA/bnxt_re: Avoid resource leak in case the NQ registration fails - pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' - pwm: lpss: Only set update bit if we are actually changing the settings - amiflop: clean up on errors during setup - qed: Align local and global PTT to propagate through the APIs. - scsi: ips: fix missing break in switch - nfp: bpf: protect against mis-initializing atomic counters - [x86] KVM: nVMX: reset cache/shadows when switching loaded VMCS - [x86] KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode() - [x86] KVM: Fix invvpid and invept register operand size in 64-bit mode - clk: tegra: Fixes for MBIST work around - scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler - scsi: isci: Change sci_controller_start_task's return type to sci_status - scsi: bfa: Avoid implicit enum conversion in bfad_im_post_vendor_event - scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param - nvmet: avoid integer overflow in the discard code - nvmet-fcloop: suppress a compiler warning - nvme-pci: fix hot removal during error handling - PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks - clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk - ASoC: tegra_sgtl5000: fix device_node refcounting - scsi: dc395x: fix dma API usage in srb_done - scsi: dc395x: fix DMA API usage in sg_update_list - scsi: zorro_esp: Limit DMA transfers to 65535 bytes - net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed - net: fix warning in af_unix - xfs: fix use-after-free race in xfs_buf_rele - xfs: clear ail delwri queued bufs on unmount of shutdown fs - kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack - ACPI / scan: Create platform device for INT33FE ACPI nodes - PM / Domains: Deal with multiple states but no governor in genpd - ALSA: i2c/cs8427: Fix int to char conversion - macintosh/windfarm_smu_sat: Fix debug output - PCI: vmd: Detach resources after stopping root bus - USB: misc: appledisplay: fix backlight update_status return code - usbip: tools: fix atoi() on non-null terminated string - sctp: use sk_wmem_queued to check for writable space - dm raid: avoid bitmap with raid4/5/6 journal device - selftests/bpf: fix file resource leak in load_kallsyms - SUNRPC: Fix a compile warning for cmpxchg64() - sunrpc: safely reallow resvport min/max inversion - atm: zatm: Fix empty body Clang warnings - [s390x] perf: Return error when debug_register fails - swiotlb: do not panic on mapping failures - spi: omap2-mcspi: Set FIFO DMA trigger level to word length - [x86] intel_rdt: Prevent pseudo-locking from using stale pointers - sparc: Fix parport build warnings. - [ppc64*,powerpc] pseries: Export raw per-CPU VPA data via debugfs - [ppc64*,powerpc] mm/radix: Fix off-by-one in split mapping logic - [ppc64*,powerpc] mm/radix: Fix overuse of small pages in splitting logic - [ppc64*,powerpc] mm/radix: Fix small page at boundary when splitting - [ppc64*] radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd - selftests/bpf: fix return value comparison for tests in test_libbpf.sh - tools: bpftool: fix completion for "bpftool map update" - ceph: fix dentry leak in ceph_readdir_prepopulate - ceph: only allow punch hole mode in fallocate - thermal: armada: fix a test in probe() - f2fs: fix to spread clear_cold_data() - f2fs: spread f2fs_set_inode_flags() - mISDN: Fix type of switch control variable in ctrl_teimanager - qlcnic: fix a return in qlcnic_dcb_get_capability() - net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode - mfd: arizona: Correct calling of runtime_put_sync - mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values - [x86] mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well - mfd: max8997: Enale irq-wakeup unconditionally - net: socionext: Stop PHY before resetting netsec - fs/cifs: fix uninitialised variable warnings - spi: uniphier: fix incorrect property items - selftests/ftrace: Fix to test kprobe $comm arg only if available - selftests: watchdog: fix message when /dev/watchdog open fails - selftests: watchdog: Fix error message. - selftests: kvm: Fix -Wformat warnings - selftests: fix warning: "_GNU_SOURCE" redefined - net: ethernet: cadence: fix socket buffer corruption problem - bpf: devmap: fix wrong interface selection in notifier_call - bpf, btf: fix a missing check bug in btf_parse - [sparc64] Rework xchg() definition to avoid warnings. - [arm64] lib: use C string functions with KASAN enabled - fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() - mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock - tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage - mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition - macsec: update operstate when lower device changes - macsec: let the administrator set UP state even if lowerdev is down - block: fix the DISCARD request merge - i2c: uniphier-f: make driver robust against concurrency - i2c: uniphier-f: fix occasional timeout error - i2c: uniphier-f: fix race condition when IRQ is cleared - um: Make line/tty semantics use true write IRQ - vfs: avoid problematic remapping requests into partial EOF block - ipv4/igmp: fix v1/v2 switchback timeout based on rfc3376, 8.12 - [ppc64*,powerpc] xmon: Relax frame size for clang - [ppc64*,powerpc] selftests/ptrace: Fix out-of-tree build - [ppc64*,powerpc] selftests/signal: Fix out-of-tree build - [ppc64*,powerpc] selftests/switch_endian: Fix out-of-tree build - [ppc64*,powerpc] selftests/cache_shape: Fix out-of-tree build - block: call rq_qos_exit() after queue is frozen - mm/gup_benchmark.c: prevent integer overflow in ioctl - linux/bitmap.h: handle constant zero-size bitmaps correctly - linux/bitmap.h: fix type of nbits in bitmap_shift_right() - lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf - hfsplus: fix BUG on bnode parent update - hfs: fix BUG on bnode parent update - hfsplus: prevent btree data loss on ENOSPC - hfs: prevent btree data loss on ENOSPC - hfsplus: fix return value of hfsplus_get_block() - hfs: fix return value of hfs_get_block() - hfsplus: update timestamps on truncate() - hfs: update timestamp on truncate() - fs/hfs/extent.c: fix array out of bounds read of array extent - kernel/panic.c: do not append newline to the stack protector panic string - mm/memory_hotplug: make add_memory() take the device_hotplug_lock - mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock - [ppc64*,powerprc] powerpc/powernv: hold device_hotplug_lock when calling device_online() - igb: shorten maximum PHC timecounter update interval - fm10k: ensure completer aborts are marked as non-fatal after a resume - [arm64] net: hns3: bugfix for buffer not free problem during resetting - [arm64] net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem - [arm64] net: hns3: bugfix for is_valid_csq_clean_head() - [arm64] net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read - ntb_netdev: fix sleep time mismatch - [x86] ntb: intel: fix return value for ndev_vec_mask() - irq/matrix: Fix memory overallocation - nvme-pci: fix conflicting p2p resource adds - [arm64] makefile fix build of .i file in external module case - [x86] tools/power turbosat: fix AMD APIC-id output - mm: handle no memcg case in memcg_kmem_charge() properly - ocfs2: without quota support, avoid calling quota recovery - ocfs2: don't use iocb when EIOCBQUEUED returns - ocfs2: don't put and assigning null to bh allocated outside - ocfs2: fix clusters leak in ocfs2_defrag_extent() - net: do not abort bulk send on BQL status - sched/topology: Fix off by one bug - sched/fair: Don't increase sd->balance_interval on newidle balance - openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS - [armhf] dts: imx6sx-sdb: Fix enet phy regulator - [arm64] sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock - soc: bcm: brcmstb: Fix re-entry point with a THUMB2_KERNEL - audit: print empty EXECVE args - sock_diag: fix autoloading of the raw_diag module - net: bpfilter: fix iptables failure if bpfilter_umh is disabled - nds32: Fix bug in bitfield.h - media: ov13858: Check for possible null pointer - btrfs: avoid link error with CONFIG_NO_AUTO_INLINE - wil6210: fix debugfs memory access alignment - wil6210: fix L2 RX status handling - wil6210: fix RGF_CAF_ICR address for Talyn-MB - wil6210: fix locking in wmi_call - ath10k: snoc: fix unbalanced clock error handling - wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()' - rtl8xxxu: Fix missing break in switch - brcmsmac: never log "tid x is not agg'able" by default - wireless: airo: potential buffer overflow in sprintf() - rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information - net: dsa: bcm_sf2: Turn on PHY to allow successful registration - scsi: mpt3sas: Fix Sync cache command failure during driver unload - scsi: mpt3sas: Don't modify EEDPTagMode field setting on SAS3.5 HBA devices - scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11 - scsi: megaraid_sas: Fix msleep granularity - scsi: megaraid_sas: Fix goto labels in error handling - scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces - scsi: lpfc: Fix odd recovery in duplicate FLOGIs in point-to-point - scsi: lpfc: Correct loss of fc4 type on remote port address change - usb: typec: tcpm: charge current handling for sink during hard reset - dlm: fix invalid free - dlm: don't leak kernel pointer to userspace - vrf: mark skb for multicast or link-local as enslaved to VRF - clk: tegra20: Turn EMC clock gate into divider - ACPICA: Use %d for signed int print formatting instead of %u - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down - of: unittest: allow base devicetree to have symbol metadata - of: unittest: initialize args before calling of_*parse_*() - tools: bpftool: pass an argument to silence open_obj_pinned() - cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces - pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues - pinctrl: bcm2835: Use define directive for BCM2835_PINCONF_PARAM_PULL - pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT - pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD - PCI: keystone: Use quirk to limit MRRS for K2G - nvme-pci: fix surprise removal - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch - i2c: uniphier-f: fix timeout error after reading 8 bytes - mm/memory_hotplug: Do not unlock when fails to take the device_hotplug_lock - ipv6: Fix handling of LLA with VRF and sockets bound to VRF - cfg80211: call disconnect_wk when AP stops - mm/page_io.c: do not free shared swap slots - Bluetooth: Fix invalid-free in bcsp_close() - KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe - ath9k_hw: fix uninitialized variable data - md/raid10: prevent access of uninitialized resync_pages offset - mm/memory_hotplug: don't access uninitialized memmaps in shrink_zone_span() - net: phy: dp83867: fix speed 10 in sgmii mode - net: phy: dp83867: increase SGMII autoneg timer duration - ocfs2: remove ocfs2_is_o2cb_active() - [arm*] 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary - ARC: perf: Accommodate big-endian CPU - [x86] insn: Fix awk regexp warnings - [x86] speculation: Fix incorrect MDS/TAA mitigation status - [x86] speculation: Fix redundant MDS mitigation message - nbd: prevent memory leak - y2038: futex: Move compat implementation into futex.c - futex: Prevent robust futex exit race - ALSA: usb-audio: Fix NULL dereference at parsing BADD - nfc: port100: handle command failure cleanly - media: vivid: Set vid_cap_streaming and vid_out_streaming to true - media: vivid: Fix wrong locking that causes race conditions on streaming stop (CVE-2019-18683) - media: usbvision: Fix races among open, close, and disconnect - cpufreq: Add NULL checks to show() and store() methods of cpufreq - media: uvcvideo: Fix error path in control parsing failure - media: b2c2-flexcop-usb: add sanity checking - media: cxusb: detect cxusb_ctrl_msg error in query - media: imon: invalid dereference in imon_touch_event - virtio_ring: fix return code on DMA mapping fails - USBIP: add config dependency for SGL_ALLOC - usbip: tools: fix fd leakage in the function of read_attr_usbip_status - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() - usb-serial: cp201x: support Mark-10 digital force gauge - USB: chaoskey: fix error case of a timeout - appledisplay: fix error handling in the scheduled work - USB: serial: mos7840: add USB ID to support Moxa UPort 2210 - USB: serial: mos7720: fix remote wakeup - USB: serial: mos7840: fix remote wakeup - USB: serial: option: add support for DW5821e with eSIM support - USB: serial: option: add support for Foxconn T77W968 LTE modules - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error - [ppc64*] support nospectre_v2 cmdline option - [ppc64*] book3s: Fix link stack flush on context switch (CVE-2019-18660) - [ppc64*, powerpc] PPC: Book3S HV: Flush link stack on guest exit to host kernel - PM / devfreq: Fix kernel oops on governor module load [ Romain Perier ] * [armel/rpi] Enable CONFIG_BRCMFMAC_SDIO (Closes: #940530) * [armhf, arm64] Backport devicetree for enabling support for the Raspberry PI 3 A+ [ Salvatore Bonaccorso ] * ixgbe: Fix secpath usage for IPsec TX offload (Closes: #930443) * ipv4: Return -ENETUNREACH if we can't create route but saddr is valid (Closes: #945023) * [x86] KVM: x86: introduce is_pae_paging (Regression in 4.19.77) * [rt] Refresh 0011-sched-fair-Robustify-CFS-bandwidth-timer-locking.patch (context changes in 4.19.84) [ Bastian Blank ] * [amd64/cloud-amd64] Re-enable RTC drivers. (closes: #931341) [ Noah Meyerhans ] * drivers/net/ethernet/amazon: Backport driver fixes from Linux 5.4 (Closes: #941291) * Bump ABI to 7 [ Ben Hutchings ] * debian/bin/genpatch-rt: Fix series generation from git * [rt] Update to 4.19.82-rt30: - Drop changes in "fs/dcache: disable preemption on i_dir_seq's write side" that conflict with "Fix the locking in dcache_readdir() and friends" - Rewrite "fs/aio: simple simple work" using kthread_work - Rewrite "thermal: Defer thermal wakups to threads" using kthread_work - Rewrite "block: blk-mq: move blk_queue_usage_counter_release() into process context" using kthread_work - workqueue: rework [ Benjamin Poirier ] * tools/perf: Add python3 support to scripts (Closes: #944641) [ Aurelien Jarno ] * [rt] Refresh 0025-NFSv4-replace-seqcount_t-with-a-seqlock_t.patch (context changes in 4.19.86) * [rt] Refresh 0202-net-Qdisc-use-a-seqlock-instead-seqcount.patch (context changes in 4.19.86) * [rt] Refresh 0057-printk-Add-a-printk-kill-switch.patch (context changes in 4.19.87) * [rt] Refresh 0207-printk-Make-rt-aware.patch (context changes in 4.19.87) -- Salvatore Bonaccorso Tue, 03 Dec 2019 06:58:41 +0100 linux (4.19.67-2+deb10u2) buster-security; urgency=high * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135): - KVM: x86: use Intel speculation bugs and features as derived in generic x86 code - x86/msr: Add the IA32_TSX_CTRL MSR - x86/cpu: Add a helper function x86_read_arch_cap_msr() - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default - x86/speculation/taa: Add mitigation for TSX Async Abort - x86/speculation/taa: Add sysfs reporting for TSX Async Abort - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled - x86/tsx: Add "auto" option to the tsx= cmdline parameter - x86/speculation/taa: Add documentation for TSX Async Abort - x86/tsx: Add config options to set tsx=on|off|auto - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs TSX is now disabled by default; see Documentation/admin-guide/hw-vuln/tsx_async_abort.rst * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change (aka iTLB multi-hit, CVE-2018-12207): - kvm: Convert kvm_lock to a mutex - kvm: x86: Do not release the page inside mmu_set_spte() - KVM: x86: make FNAME(fetch) and __direct_map more similar - KVM: x86: remove now unneeded hugepage gfn adjustment - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON - KVM: x86: add tracepoints around __direct_map and FNAME(fetch) - kvm: x86, powerpc: do not allow clearing largepages debugfs entry - KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active - x86/bugs: Add ITLB_MULTIHIT bug infrastructure - cpu/speculation: Uninline and export CPU mitigations helpers - kvm: mmu: ITLB_MULTIHIT mitigation - kvm: Add helper function for creating VM worker threads - kvm: x86: mmu: Recovery of shattered NX large pages - Documentation: Add ITLB_MULTIHIT documentation * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155): - drm/i915: Rename gen7 cmdparser tables - drm/i915: Disable Secure Batches for gen6+ - drm/i915: Remove Master tables from cmdparser - drm/i915: Add support for mandatory cmdparsing - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers - drm/i915: Allow parsing of unsized batches - drm/i915: Add gen9 BCS cmdparsing - drm/i915/cmdparser: Use explicit goto for error paths - drm/i915/cmdparser: Add support for backward jumps - drm/i915/cmdparser: Ignore Length operands during command matching - drm/i915/cmdparser: Fix jump whitelist clearing * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154): - drm/i915: Lower RM timeout to avoid DSI hard hangs - drm/i915/gen8+: Add RC6 CTX corruption WA -- Ben Hutchings Mon, 11 Nov 2019 00:30:56 +0000 linux (4.19.67-2+deb10u1) buster-security; urgency=high [ Romain Perier ] * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (CVE-2019-15117) * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term (CVE-2019-15118) [ Salvatore Bonaccorso ] * vhost: make sure log_num < in_num (CVE-2019-14835) * [x86] ptrace: fix up botched merge of spectrev1 fix (CVE-2019-15902) * KVM: coalesced_mmio: add bounds checking (CVE-2019-14821) -- Salvatore Bonaccorso Fri, 20 Sep 2019 12:51:55 +0200 linux (4.19.67-2) buster; urgency=medium [ Salvatore Bonaccorso ] * dm: disable DISCARD if the underlying storage no longer supports it (Closes: #934331) * xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT (CVE-2019-15538) [ Ben Hutchings ] * KVM: Ignore ABI changes * [ppc64el] Disable PPC_TRANSACTIONAL_MEM (Closes: #866122) * [ppc64el] Avoid ABI change for disabling TM * netfilter: conntrack: Use consistent ct id hash calculation (fixes regression in 4.19.44) [ Cyril Brulebois ] * [arm] Backport DTB support for Rasperry Pi Compute Module 3. * [arm64] Backport DTB support for Rasperry Pi Compute Module 3. -- Salvatore Bonaccorso Wed, 28 Aug 2019 06:20:22 +0200 linux (4.19.67-1) buster; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.38 - netfilter: nft_compat: use refcnt_t type for nft_xt reference count - netfilter: nft_compat: make lists per netns - netfilter: nf_tables: split set destruction in deactivate and destroy phase - netfilter: nft_compat: destroy function must not have side effects - netfilter: nf_tables: warn when expr implements only one of activate/deactivate - netfilter: nf_tables: unbind set in rule from commit path - netfilter: nft_compat: don't use refcount_inc on newly allocated entry - netfilter: nft_compat: use .release_ops and remove list of extension - netfilter: nf_tables: fix set double-free in abort path - netfilter: nf_tables: bogus EBUSY when deleting set after flush - netfilter: nf_tables: bogus EBUSY in helper removal from transaction - net/ibmvnic: Fix RTNL deadlock during device reset - net: mvpp2: fix validate for PPv2.1 - ext4: fix some error pointer dereferences - tipc: handle the err returned from cmd header function - loop: do not print warn message if partition scan is successful - [armhf,arm64] drm/rockchip: fix for mailbox read validation. - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock - ipvs: fix warning on unused variable - [ppc64el] vdso32: fix CLOCK_MONOTONIC on PPC64 - [armhf,arm64] net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new DSA framework - cifs: fix memory leak in SMB2_read - cifs: do not attempt cifs operation on smb2+ rename error - tracing: Fix a memory leak by early error exit in trace_pid_write() - zram: pass down the bvec we need to read into in the work struct - trace: Fix preempt_enable_no_resched() abuse - IB/rdmavt: Fix frwr memory registration - RDMA/mlx5: Do not allow the user to write to the clock page - sched/numa: Fix a possible divide-by-zero - ceph: only use d_name directly when parent is locked - ceph: ensure d_name stability in ceph_dentry_hash() - ceph: fix ci->i_head_snapc leak - nfsd: Don't release the callback slot unless it was actually held - sunrpc: don't mark uninitialised items as VALID. - [x86] perf/intel: Update KBL Package C-state events to also include PC8/PC9/PC10 counters - Input: synaptics-rmi4 - write config register values to the right offset - [armhf] 8857/1: efi: enable CP15 DMB instructions before cleaning the cache - [ppc64el] mm/radix: Make Radix require HUGETLB_PAGE - [arm*] drm/vc4: Fix memory leak during gpu reset. - [x86] Revert "drm/i915/fbdev: Actually configure untiled displays" - USB: Add new USB LPM helpers - USB: Consolidate LPM checks to avoid enabling LPM twice - slip: make slhc_free() silently accept an error pointer - [x86] intel_th: gth: Fix an off-by-one in output unassigning - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference - workqueue: Try to catch flush_work() without INIT_WORK(). - sched/deadline: Correctly handle active 0-lag timers - NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family. - netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON - fm10k: Fix a potential NULL pointer dereference - tipc: check bearer name with right length in tipc_nl_compat_bearer_enable - tipc: check link name with right length in tipc_nl_compat_link_set - net: netrom: Fix error cleanup path of nr_proto_init - net/rds: Check address length before reading address family - rxrpc: fix race condition in rxrpc_input_packet() - [x86] retpolines: Raise limit for generating indirect calls from switch-case - [x86] retpolines: Disable switch jump tables when retpolines are enabled - mm: Fix warning in insert_pfn() - [x86] fpu: Don't export __kernel_fpu_{begin,end}() - ipv4: add sanity checks in ipv4_link_failure() - ipv4: set the tcp_min_rtt_wlen range from 0 to one day - net/mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query - net: rds: exchange of 8K and 1M pool - net/rose: fix unbound loop in rose_loopback_timer() - [armhf,arm64] net: stmmac: move stmmac_check_ether_addr() to driver probe - team: fix possible recursive locking when add slaves - [arm64] net: hns: Fix WARNING when hns modules installed - net/mlx5e: Fix the max MTU check in case of XDP - net/mlx5e: Fix use-after-free after xdp_return_frame https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.39 - selinux: use kernel linux/socket.h for genheaders and mdp - Revert "ACPICA: Clear status of GPEs before enabling them" - [arm*] dts: bcm283x: Fix hdmi hpd gpio pull - [s390x] limit brk randomization to 32MB - net: ieee802154: fix a potential NULL pointer dereference - ieee802154: hwsim: propagate genlmsg_reply return code - [armhf,arm64] net: stmmac: don't set own bit too early for jumbo frames - qlcnic: Avoid potential NULL pointer dereference - xsk: fix umem memory leak on cleanup - netfilter: nft_set_rbtree: check for inactive element after flag mismatch - netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING - netfilter: fix NETFILTER_XT_TARGET_TEE dependencies - netfilter: ip6t_srh: fix NULL pointer dereferences - [s390x] qeth: fix race when initializing the IP address table - [armhf] imx51: fix a leaked reference by adding missing of_node_put - [arm64] KVM: Reset the PMU in preemptible context - [armhf,arm64] KVM: vgic-its: Take the srcu lock when writing to guest memory - [armhf,arm64] KVM: vgic-its: Take the srcu lock when parsing the memslots - [x86] usb: dwc3: pci: add support for Comet Lake PCH ID - usb: gadget: net2280: Fix overrun of OUT messages - usb: gadget: net2280: Fix net2280_dequeue() - [x86] i2c: i801: Add support for Intel Comet Lake - staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc - staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer dereference - staging: rtl8712: uninitialized memory in read_bbreg_hdl() - staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc - [arm64] net: macb: Add null check for PCLK and HCLK - net/sched: don't dereference a->goto_chain to read the chain index - [armhf] dts: imx6qdl: Fix typo in imx6qdl-icore-rqs.dtsi - [armhf,arm64] drm/tegra: hub: Fix dereference before check - NFS: Fix a typo in nfs_init_timeout_values() - drm: Fix drm_release() and device unplug - [arm64] drm/meson: Fix invalid pointer in meson_drv_unbind() - [arm64] drm/meson: Uninstall IRQ handler - scsi: mpt3sas: Fix kernel panic during expander reset - scsi: aacraid: Insure we don't access PCIe space during AER/EEH - scsi: qla4xxx: fix a potential NULL pointer dereference - leds: trigger: netdev: fix refcnt leak on interface rename - [x86] realmode: Don't leak the trampoline kernel address - usb: u132-hcd: fix resource leak - ceph: fix use-after-free on symlink traversal - [s390x] scsi: zfcp: reduce flood of fcrscn1 trace records on multi- element RSCN - [x86] mm: Don't exceed the valid physical address space - libata: fix using DMA buffers on stack - gpio: of: Fix of_gpiochip_add() error path - nvme-multipath: relax ANA state check - perf machine: Update kernel map address and re-order properly - [x86] iommu/amd: Reserve exclusion range in iova-domain - ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK - leds: trigger: netdev: use memcpy in device_name_store https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.40 - ipv4: ip_do_fragment: Preserve skb_iif during fragmentation - ipv6: A few fixes on dereferencing rt->from - ipv6: fix races in ip6_dst_destroy() - ipv6/flowlabel: wait rcu grace period before put_pid() - ipv6: invert flowlabel sharing check in process and user mode - l2ip: fix possible use-after-free - l2tp: use rcu_dereference_sk_user_data() in l2tp_udp_encap_recv() - [armhf] net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc - net: phy: marvell: Fix buffer overrun with stats counters - rxrpc: Fix net namespace cleanup - sctp: avoid running the sctp state machine recursively - packet: validate msg_namelen in send directly - bnxt_en: Improve multicast address setup logic. - bnxt_en: Free short FW command HWRM memory in error path in bnxt_init_one() - bnxt_en: Fix uninitialized variable usage in bnxt_rx_pkt(). - [x86] KVM: Whitelist port 0x7e for pre-incrementing %rip - [x86] KVM: nVMX: Fix size checks in vmx_set_nested_state - ALSA: line6: use dynamic buffers - ath10k: Drop WARN_ON()s that always trigger during system resume https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.41 - iwlwifi: fix driver operation for 5350 - mwifiex: Make resume actually do something useful again on SDIO cards - mac80211: don't attempt to rename ERR_PTR() debugfs dirs - [armhf] i2c: imx: correct the method of getting private data in notifier_call - i2c: Remove unnecessary call to irq_find_mapping - i2c: Clear client->irq in i2c_device_remove - i2c: Allow recovery of the initial IRQ by an I2C client device. - i2c: Prevent runtime suspend of adapter when Host Notify is required - [x86] ALSA: hda/realtek - Add new Dell platform for headset mode - [x86] ALSA: hda/realtek - Fixed Dell AIO speaker noise - [x86] ALSA: hda/realtek - Apply the fixup for ASUS Q325UAR - USB: yurex: Fix protection fault after device removal (CVE-2019-15216) - USB: w1 ds2490: Fix bug caused by improper use of altsetting array - USB: dummy-hcd: Fix failure to give back unlinked URBs - usb: usbip: fix isoc packet num validation in get_pipe - USB: core: Fix unterminated string returned by usb_string() - USB: core: Fix bug caused by duplicate interface PM usage counter - nvme-loop: init nvmet_ctrl fatal_err_work when allocate - [arm64] dts: rockchip: fix rk3328-roc-cc gmac2io tx/rx_delay - HID: logitech: check the return value of create_singlethread_workqueue - HID: debug: fix race condition with between rdesc_show() and device removal - rtc: cros-ec: Fail suspend/resume if wake IRQ can't be configured - batman-adv: Reduce claim hash refcnt only for removed entry - batman-adv: Reduce tt_local hash refcnt only for removed entry - batman-adv: Reduce tt_global hash refcnt only for removed entry - batman-adv: fix warning in function batadv_v_elp_get_throughput - [armhf] dts: rockchip: Fix gpu opp node names for rk3288 - [arm64] reset: meson-audio-arb: Fix missing .owner setting of reset_controller_dev - igb: Fix WARN_ONCE on runtime suspend - HID: quirks: Fix keyboard + touchpad on Lenovo Miix 630 - net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands - bonding: show full hw address in sysfs for slave entries - [armhf,arm64] net: stmmac: use correct DMA buffer size in the RX descriptor - [armhf,arm64] net: stmmac: ratelimit RX error logs - [armhf,arm64] net: stmmac: don't stop NAPI processing when dropping a packet - [armhf,arm64] net: stmmac: don't overwrite discard_frame status - [armhf,arm64] net: stmmac: fix dropping of multi-descriptor RX frames - [armhf,arm64] net: stmmac: don't log oversized frames - jffs2: fix use-after-free on symlink traversal - debugfs: fix use-after-free on symlink traversal - [armhf] mfd: twl-core: Disable IRQ while suspended - block: use blk_free_flush_queue() to free hctx->fq in blk_mq_init_hctx - HID: input: add mapping for Assistant key - vfio/pci: use correct format characters - scsi: core: add new RDAC LENOVO/DE_Series device - [x86] scsi: storvsc: Fix calculation of sub-channel count - [arm64] fix wrong check of on_sdei_stack in nmi context - [arm64] net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw() - [arm64] net: hns: Use NAPI_POLL_WEIGHT for hns driver - [arm64] net: hns: Fix probabilistic memory overwrite when HNS driver initialized - [arm64] net: hns: fix ICMP6 neighbor solicitation messages discard problem - [arm64] net: hns: Fix WARNING when remove HNS driver with SMMU enabled - libcxgb: fix incorrect ppmax calculation - [x86] KVM: SVM: prevent DBG_DECRYPT and DBG_ENCRYPT overflow - hugetlbfs: fix memory leak for resv_map - fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock - [armel] orion: don't use using 64-bit DMA masks - block: pass no-op callback to INIT_WORK(). - [x86] perf/amd: Update generic hardware cache events for Family 17h - Bluetooth: btusb: request wake pin with NOAUTOEN - Bluetooth: mediatek: fix up an error path to restore bdev->tx_state - [arm64] clk: qcom: Add missing freq for usb30_master_clk on 8998 - scsi: RDMA/srpt: Fix a credit leak for aborted commands - [x86] ASoC: Intel: bytcr_rt5651: Revert "Fix DMIC map headsetmic mapping" - [x86] platform: intel_pmc_core: Fix PCH IP name - [x86] platform: intel_pmc_core: Handle CFL regmap properly - IB/core: Unregister notifier before freeing MAD security - IB/core: Fix potential memory leak while creating MAD agents - IB/core: Destroy QP if XRC QP fails - selinux: avoid silent denials in permissive mode under RCU walk - selinux: never allow relabeling on context mounts - mac80211: Honor SW_CRYPTO_CONTROL for unicast keys in AP VLAN mode - [ppc64el] mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown search - [x86] mce: Improve error message when kernel cannot recover, p2 - [x86] clk: Add system specific quirk to mark clocks as critical - [x86] mm/KASLR: Fix the size of the direct mapping section - [x86] mm: Fix a crash with kmemleak_scan() - [x86] mm/tlb: Revert "x86/mm: Align TLB invalidation info" - media: v4l2: i2c: ov7670: Fix PLL bypass register values https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.42 - [armhf,arm64] net: stmmac: Use bfsize1 in ndesc_init_rx_desc - [x86] Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup() - ASoC: hdmi-codec: fix S/PDIF DAI - ASoC:soc-pcm:fix a codec fixup issue in TDM case - [x86] ASoC:intel:skl:fix a simultaneous playback & capture issue on hda platform - [arm64] clk: meson-gxbb: round the vdec dividers to closest - ASoC: dapm: Fix NULL pointer dereference in snd_soc_dapm_free_kcontrol - [armhf] drm/omap: hdmi4_cec: Fix CEC clock handling for PM - IB/hfi1: Eliminate opcode tests on mr deref - IB/hfi1: Fix the allocation of RSM table - [x86] perf/intel: Fix handling of wakeup_events for multi-entry PEBS - [x86] perf/intel: Initialize TFA MSR - linux/kernel.h: Use parentheses around argument in u64_to_user_ptr() - drm/amd/display: fix cursor black issue - objtool: Add rewind_stack_do_exit() to the noreturn list - slab: fix a crash by reading /proc/slab_allocators - [armhf,arm64] drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in sun8i_tcon_top_un/bind - virtio_pci: fix a NULL pointer reference in vp_del_vqs - [x86] RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove - [arm64] RDMA/hns: Fix bug that caused srq creation to fail - scsi: csiostor: fix missing data copy in csio_scsi_err_handler() - [x86] ASoC: Intel: kbl: fix wrong number of channels - virtio-blk: limit number of hw queues by nr_cpu_ids - nvme-fc: correct csn initialization and increments on error - [x86] platform: pmc_atom: Drop __initconst on dmi table - perf/core: Fix perf_event_disable_inatomic() race - [x86] iommu/amd: Set exclusion range correctly - genirq: Prevent use-after-free and work list corruption - usb: dwc3: Fix default lpm_nyet_threshold value - USB: serial: f81232: fix interrupt worker not stop - USB: cdc-acm: fix unthrottle races - usb-storage: Set virt_boundary_mask to avoid SG overflows - [x86] intel_th: pci: Add Comet Lake support - [arm64] cpufreq: armada-37xx: fix frequency calculation for opp - scsi: lpfc: change snprintf to scnprintf for possible overflow - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines - scsi: qla2xxx: Fix device staying in blocked state - UAS: fix alignment of scatter/gather segments - [x86] ASoC: Intel: avoid Oops if DMA setup fails - locking/futex: Allow low-level atomic operations to return -EAGAIN - [arm64] futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.43 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.44 - bfq: update internal depth state when queue depth changes - [x86] platform: sony-laptop: Fix unintentional fall-through - [x86] platform: thinkpad_acpi: Disable Bluetooth for some machines - [x86] platform: dell-laptop: fix rfkill functionality - hwmon: (pwm-fan) Disable PWM if fetching cooling data fails - kernfs: fix barrier usage in __kernfs_new_node() - [x86] virt: vbox: Sanity-check parameter types for hgcm-calls coming from userspace - USB: serial: fix unthrottle races - acpi/nfit: Always dump _DSM output payload - libnvdimm/namespace: Fix a potential NULL pointer dereference - HID: input: add mapping for Expose/Overview key - HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys - HID: input: add mapping for "Toggle Display" key - libnvdimm/btt: Fix a kmemdup failure check - [s390x] dasd: Fix capacity calculation for large volumes - mac80211: fix unaligned access in mesh table hash function - mac80211: Increase MAX_MSG_LEN - cfg80211: Handle WMM rules in regulatory domain intersection - mac80211: fix memory accounting with A-MSDU aggregation - nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands - libnvdimm/pmem: fix a possible OOB access when read and write pmem - [s390x] 3270: fix lockdep false positive on view->lock - drm/amd/display: extending AUX SW Timeout - mISDN: Check address length before reading address family - vxge: fix return of a free'd memblock on a failed dma mapping - qede: fix write to free'd pointer error and double free of ptp - afs: Unlock pages for __pagevec_release() - drm/amd/display: If one stream full updates, full update all planes - [s390x] pkey: add one more argument space for debug feature entry - [x86] reboot, efi: Use EFI reboot for Acer TravelMate X514-51T - [x86] KVM: fix spectrev1 gadgets - [x86] KVM: avoid misreporting level-triggered irqs as edge-triggered in tracing - tools lib traceevent: Fix missing equality check for strcmp - ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash - scsi: aic7xxx: fix EISA support - mm: fix inactive list balancing between NUMA nodes and cgroups - init: initialize jump labels before command line option parsing - ipvs: do not schedule icmp errors from tunnels - netfilter: ctnetlink: don't use conntrack/expect object addresses as id - netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook() - [s390x] ctcm: fix ctcm_new_device error return code - [armhf,arm64] drm/sun4i: Set device driver data at bind time for use in unbind - [armhf,arm64] drm/sun4i: Fix component unbinding and component master deletion - netfilter: fix nf_l4proto_log_invalid to log invalid packets - [armhf] gpu: ipu-v3: dp: fix CSC handling - [armhf] drm/imx: don't skip DP channel disable for background plane - [armhf,arm64] drm/sun4i: Unbind components before releasing DRM and memory - Input: synaptics-rmi4 - fix possible double free - [arm64] RDMA/hns: Bugfix for mapping user db - mm/memory_hotplug.c: drop memory device reference after find_memory_block() - [ppc64el] smp: Fix NMI IPI timeout - [ppc64el] smp: Fix NMI IPI xmon timeout - [armhf,arm64] net: dsa: mv88e6xxx: fix few issues in mv88e6390x_port_set_cmode - mm/memory.c: fix modifying of page protection by insert_pfn() - usb: typec: Fix unchecked return value - netfilter: nf_tables: use-after-free in dynamic operations - netfilter: nf_tables: add missing ->release_ops() in error path of newrule() (Closes: #934168) - net: fec: manage ahb clock in runtime pm - net: strparser: partially revert "strparser: Call skb_unclone conditionally" - NFC: nci: Add some bounds checking in nci_hci_cmd_received() - nfc: nci: Potential off by one in ->pipes[] array - [x86] kprobes: Avoid kretprobe recursion bug - mwl8k: Fix rate_idx underflow - rtlwifi: rtl8723ae: Fix missing break in switch statement - bonding: fix arp_validate toggling in active-backup mode - bridge: Fix error path for kobject_init_and_add() - ipv4: Fix raw socket lookup for local traffic - net: dsa: Fix error cleanup path in dsa_init_module - [armhf] net: ethernet: stmmac: dwmac-sun8i: enable support of unicast filtering - [arm64] net: macb: Change interrupt and napi enable order in open - packet: Fix error path in packet_init - selinux: do not report error on connect(AF_UNSPEC) - vlan: disable SIOCSHWTSTAMP in container - vrf: sit mtu should not be updated when vrf netdev is the link - tuntap: fix dividing by zero in ebpf queue selection - tuntap: synchronize through tfiles array instead of tun->numqueues - isdn: bas_gigaset: use usb_fill_int_urb() properly - tipc: fix hanging clients using poll with EPOLLOUT flag - [ppc64el] book3s/64: check for NULL pointer in pgd_alloc() - [ppc64el] powernv/idle: Restore IAMR after idle - [x86] PCI: hv: Fix a memory leak in hv_eject_device_work() - [x86] PCI: hv: Add hv_pci_remove_slots() when we unload the driver - [x86] PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.45 - locking/rwsem: Prevent decrement of reader count before increment - [x86] speculation/mds: Revert CPU buffer clear on double fault exit - [x86] speculation/mds: Improve CPU buffer clear documentation - objtool: Fix function fallthrough detection - [arm64] dts: rockchip: Disable DCMDs on RK3399's eMMC controller. - [armhf] dts: exynos: Fix interrupt for shared EINTs on Exynos5260 - [armhf] dts: exynos: Fix audio (microphone) routing on Odroid XU3 - [arm64] mmc: sdhci-of-arasan: Add DTS property to disable DCMDs. - [armhf] exynos: Fix a leaked reference by adding missing of_node_put - [armhf] power: supply: axp288_charger: Fix unchecked return value - [armhf,arm64] power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini PCs to the blacklist - [arm64] mmap: Ensure file offset is treated as unsigned - [arm64] arch_timer: Ensure counter register reads occur with seqlock held - [arm64] compat: Reduce address limit - [arm64] Clear OSDLR_EL1 on CPU boot - [arm64] Save and restore OSDLR_EL1 across suspend/resume - [x96] sched: Save [ER]FLAGS on context switch - crypto: salsa20 - don't access already-freed walk.iv - crypto: chacha20poly1305 - set cra_name correctly - [x86] crypto: ccp - Do not free psp_master when PLATFORM_INIT fails - [ppc64el] crypto: vmx - fix copy-paste error in CTR mode - crypto: skcipher - don't WARN on unprocessed data after slow walk step - crypto: crct10dif-generic - fix use via crypto_shash_digest() - [x86] crypto: crct10dif-pcl - fix use via crypto_shash_digest() - [arm64] crypto: gcm-aes-ce - fix no-NEON fallback code - crypto: gcm - fix incompatibility between "gcm" and "gcm_base" - [armhf,arm64] crypto: aes-neonbs - don't access already-freed walk.iv - mmc: core: Fix tag set memory leak - ALSA: line6: toneport: Fix broken usage of timer for delayed execution - ALSA: usb-audio: Fix a memory leak bug - ALSA: hda/hdmi - Read the pin sense from register when repolling - ALSA: hda/hdmi - Consider eld_valid when reporting jack event - ALSA: hda/realtek - EAPD turn on later - ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14) - [armhf,arm64] ASoC: max98090: Fix restore of DAPM Muxes - ASoC: codec: hdac_hdmi add device_link to card device - [arm64] bpf: remove prefetch insn in xadd mapping - mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses - mm/hugetlb.c: don't put_page in lock of hugetlb_lock - hugetlb: use same fault hash key for shared and private mappings - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget - userfaultfd: use RCU to free the task struct when fork fails - ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle - [arm64] mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values - mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write - tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0 - tty/vt: fix write/write race in ioctl(KDSKBSENT) handler - jbd2: check superblock mapped prior to committing - ext4: make sanity check in mballoc more strict - ext4: ignore e_value_offs for xattrs with value-in-ea-inode - ext4: avoid drop reference to iloc.bh twice - ext4: fix use-after-free race with debug_want_extra_isize - ext4: actually request zeroing of inode table after grow - ext4: fix ext4_show_options for file systems w/o journal - btrfs: Check the first key and level for cached extent buffer - btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages fails - Btrfs: send, flush dellaloc in order to avoid data loss - Btrfs: do not start a transaction during fiemap - Btrfs: do not start a transaction at iterate_extent_inodes() - bcache: fix a race between cache register and cacheset unregister - bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim() - ipmi:ssif: compare block number correctly for multi-part return messages - crypto: ccm - fix incompatibility between "ccm" and "ccm_base" - fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount - ext4: fix data corruption caused by overlapping unaligned and aligned IO - ext4: fix use-after-free in dx_release() - ext4: avoid panic during forced reboot due to aborted journal - [x86] ALSA: hda/realtek - Corrected fixup for System76 Gazelle (gaze14) - ALSA: hda/realtek - Fixup headphone noise via runtime suspend - [x86] ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug - jbd2: fix potential double free - [x86] KVM: Skip EFER vs. guest CPUID checks for host-initiated writes - [x86] KVM: lapic: Busy wait for timer to expire when using hv_timer - xen/pvh: set xen_domain_type to HVM in xen_pvh_init - libnvdimm/namespace: Fix label tracking error - iov_iter: optimize page_copy_sane() - pstore: Centralize init/exit routines - pstore: Allocate compression during late_initcall() - pstore: Refactor compression initialization - ext4: don't update s_rev_level if not required https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.46 - ipv6: fix src addr routing with the exception table - ipv6: prevent possible fib6 leaks - net: Always descend into dsa/ - net: avoid weird emergency message - net/mlx4_core: Change the error print to info print - net: test nouarg before dereferencing zerocopy pointers - net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions - nfp: flower: add rcu locks when accessing netdev for tunnels - ppp: deflate: Fix possible crash in deflate_init - rtnetlink: always put IFLA_LINK for links with a link-netnsid - tipc: switch order of device registration to fix a crash - vsock/virtio: free packets during the socket release - vsock/virtio: Initialize core virtio vsock before registering the driver - net/mlx5: Imply MLXFW in mlx5_core - net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled - stm class: Fix channel free in stm output free path - stm class: Fix channel bitmap on 32-bit systems - brd: re-enable __GFP_HIGHMEM in brd_insert_page() - proc: prevent changes to overridden credentials - Revert "MD: fix lock contention for flush bios" - md: batch flush requests. - md: add mddev->pers to avoid potential NULL pointer dereference - dcache: sort the freeing-without-RCU-delay mess for good. - [x86] intel_th: msu: Fix single mode with IOMMU - p54: drop device reference count if fails to enable device - of: fix clang -Wunsequenced for be32_to_cpu() - cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() - [armhf] phy: ti-pipe3: fix missing bit-wise or operator when assigning val - NFS4: Fix v4.0 client state corruption when mount - PNFS fallback to MDS if no deviceid found - [arm64] clk: hi3660: Mark clk_gate_ufs_subsys as critical - [armhf,arm64] clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider - [arm64] clk: rockchip: fix wrong clock definitions for rk3328 - udlfb: delete the unused parameter for dlfb_handle_damage - udlfb: fix sleeping inside spinlock - udlfb: introduce a rendering mutex - fuse: fix writepages on 32bit - fuse: honor RLIMIT_FSIZE in fuse_file_fallocate - ovl: fix missing upper fs freeze protection on copy up for ioctl - [armhf] iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 - ceph: flush dirty inodes before proceeding with remount - [amd64] Add gap to int3 to allow for call emulation - [amd64] Allow breakpoints to emulate call instructions - [amd64] ftrace: Emulate call function while updating in breakpoint handler - tracing: Fix partial reading of trace event's id file - [armhf,arm64] memory: tegra: Fix integer overflow on tick value calculation - [x86] perf intel-pt: Fix instructions sampling rate - [x86] perf intel-pt: Fix improved sample timestamp - [x86] perf intel-pt: Fix sample timestamp wrt non-taken branches - fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types - PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken - PCI: Mark Atheros AR9462 to avoid bus reset - PCI: Init PCIe feature bits for managed host bridge alloc - PCI/AER: Change pci_aer_init() stub to return void - PCI: Factor out pcie_retrain_link() function - PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum - dm cache metadata: Fix loading discard bitset - dm zoned: Fix zone report handling - dm delay: fix a crash when invalid device is specified - dm integrity: correctly calculate the size of metadata area - dm mpath: always free attached_handler_name in parse_path() - fuse: Add FOPEN_STREAM to use stream_open() - xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink - xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module - vti4: ipip tunnel deregistration fixes. - xfrm: clean up xfrm protocol checks - esp4: add length check for UDP encapsulation - xfrm: Honor original L3 slave device in xfrmi policy lookup - xfrm4: Fix uninitialized memory read in _decode_session4 - [armhf,arm64] clk: sunxi-ng: nkmp: Avoid GENMASK(-1, 0) - securityfs: fix use-after-free on symlink traversal - apparmorfs: fix use-after-free on symlink traversal - PCI: Fix issue with "pci=disable_acs_redir" parameter being ignored - [x86] kvm: hyper-v: deal with buggy TLB flush requests from WS2012 - mac80211: Fix kernel panic due to use of txq after free - net: ieee802154: fix missing checks for regmap_update_bits - [armhf,arm64] KVM: Ensure vcpu target is unset on reset failure - bpf: Fix preempt_enable_no_resched() abuse - qmi_wwan: new Wistron, ZTE and D-Link devices - iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb() - sched/cpufreq: Fix kobject memleak - [x86] mm/mem_encrypt: Disable all instrumentation for early SME setup - ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour - perf bench numa: Add define for RUSAGE_THREAD if not present - [x86] perf/intel: Fix race in intel_pmu_disable_event() - md/raid: raid5 preserve the writeback action after the parity check - driver core: Postpone DMA tear-down until after devres release for probe failure - bpf: relax inode permission check for retrieving bpf program - bpf: add map_lookup_elem_sys_only for lookups from syscall side - bpf, lru: avoid messing with eviction heuristics upon syscall lookup https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.47 - [x86] Hide the int3_emulate_call/jmp functions from UML - ext4: do not delete unlinked inode from orphan list on failed truncate - ext4: wait for outstanding dio during truncate in nojournal mode - f2fs: Fix use of number of devices - [x86] KVM: fix return value for reserved EFER - bio: fix improper use of smp_mb__before_atomic() - sbitmap: fix improper use of smp_mb__before_atomic() - Revert "scsi: sd: Keep disk read-only when re-reading partition" - [ppc64el] crypto: vmx - CTR: always increment IV as quadword - [arm*] mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem - [arm*] mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem - [x86] kvm: svm/avic: fix off-by-one in checking host APIC ID - libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead - [arm64] kernel: kaslr: reduce module randomization range to 2 GB - [arm64] iommu: handle non-remapped addresses in ->mmap and ->get_sgtable - gfs2: Fix sign extension bug in gfs2_update_stats - btrfs: don't double unlock on error in btrfs_punch_hole - Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path - Btrfs: avoid fallback to transaction commit during fsync of files with holes - Btrfs: fix race between ranged fsync and writeback of adjacent ranges - btrfs: sysfs: Fix error path kobject memory leak - btrfs: sysfs: don't leak memory when failing add fsid - udlfb: fix some inconsistent NULL checking - fbdev: fix divide error in fb_var_to_videomode - NFSv4.2 fix unnecessary retry in nfs4_copy_file_range - NFSv4.1 fix incorrect return value in copy_file_range - bpf: add bpf_jit_limit knob to restrict unpriv allocations - [arm64] errata: Add workaround for Cortex-A76 erratum #1463225 - btrfs: honor path->skip_locking in backref code - ovl: relax WARN_ON() for overlapping layers use case - fbdev: fix WARNING in __alloc_pages_nodemask bug - media: cpia2: Fix use-after-free in cpia2_exit - media: serial_ir: Fix use-after-free in serial_ir_init_module - media: vb2: add waiting_in_dqbuf flag - media: vivid: use vfree() instead of kfree() for dev->bitmap_cap - ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit - bpf: devmap: fix use-after-free Read in __dev_map_entry_free - batman-adv: mcast: fix multicast tt/tvlv worker locking - at76c50x-usb: Don't register led_trigger if usb_register_driver failed - acct_on(): don't mess with freeze protection - gfs2: Fix lru_count going negative - cxgb4: Fix error path in cxgb4_init_module - NFS: make nfs_match_client killable - IB/hfi1: Fix WQ_MEM_RECLAIM warning - gfs2: Fix occasional glock use-after-free - mmc: core: Verify SD bus width - [arm64] dmaengine: tegra210-dma: free dma controller in remove() - net: ena: gcc 8: fix compilation warning - [x86] hv_netvsc: fix race that may miss tx queue wakeup - Bluetooth: Ignore CC events not matching the last HCI command - [x86] ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE - [armhf,arm64] usb: dwc2: gadget: Increase descriptors count for ISOC's - [armhf,arm64] usb: dwc3: move synchronize_irq() out of the spinlock protected block - ASoC: hdmi-codec: unlock the device on startup errors - [ppc64el] perf: Return accordingly on invalid chip-id in - [ppc64el] boot: Fix missing check of lseek() return value - [ppc64el] perf: Fix loop exit condition in nest_imc_event_init - [armhf] ASoC: imx: fix fiq dependencies - [amd64] spi: pxa2xx: fix SCR (divisor) calculation - brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() - ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() - drm/nouveau/bar/nv50: ensure BAR is mapped - [armel,armhf] vdso: Remove dependency with the arch_timer driver internals - [ppc64el] watchdog: Use hrtimers for per-CPU heartbeat - sched/cpufreq: Fix kobject memleak - scsi: qla2xxx: Fix a qla24xx_enable_msix() error path - scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() - scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session() - scsi: qla2xxx: Fix hardirq-unsafe locking - [x86] modules: Avoid breaking W^X while loading modules - Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve - btrfs: fix panic during relocation after ENOSPC before writeback happens - btrfs: Don't panic when we can't find a root key - iwlwifi: pcie: don't crash on invalid RX interrupt - scsi: qedi: Abort ep termination if offload not scheduled - [s390x] kexec_file: Fix detection of text segment in ELF loader - sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs - w1: fix the resume command API - [s390x] qeth: address type mismatch warning - [armhf,arm64] dmaengine: pl330: _stop: clear interrupt status - mac80211/cfg80211: update bss channel on channel switch - mwifiex: prevent an array overflow - rsi: Fix NULL pointer dereference in kmalloc - nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE - nvme-rdma: fix a NULL deref when an admin connect times out - [armhf,arm64] crypto: sun4i-ss - Fix invalid calculation of hash end - bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set - bcache: return error immediately in bch_journal_replay() - bcache: fix failure in journal relplay - bcache: add failure check to run_cache_set() for journal replay - bcache: avoid clang -Wunintialized warning - RDMA/cma: Consider scope_id while binding to ipv6 ll address - vfio-ccw: Do not call flush_workqueue while holding the spinlock - vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev - [x86] mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() - mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions - Bluetooth: hci_qca: Give enough time to ROME controller to bootup. - HID: logitech-hidpp: use RAP instead of FAP to get the protocol version - [armhf] pinctrl: samsung: fix leaked of_node references - [armhf] clk: rockchip: undo several noc and special clocks as critical on rk3288 - [arm64] perf/arm-cci: Remove broken race mitigation - media: au0828: stop video streaming only when last user stops - audit: fix a memory leak bug - media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() - media: pvrusb2: Prevent a buffer overflow - block: fix use-after-free on gendisk - [ppc64el] numa: improve control of topology updates - [ppc64el] Fix booting large kernels with STRICT_KERNEL_RWX - random: fix CRNG initialization when random.trust_cpu=1 - random: add a spinlock_t to struct batched_entropy - cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock - sched/core: Check quota and period overflow at usec to nsec conversion - sched/rt: Check integer overflow at usec to nsec conversion - sched/core: Handle overflow in cpu_shares_write_u64 - [arm*] staging: vc04_services: handle kzalloc failure - [arm64] drm/msm: a5xx: fix possible object reference leak - irq_work: Do not raise an IPI when queueing work on the local CPU - [x86] thunderbolt: Take domain lock in switch sysfs attribute callbacks - [s390x] qeth: handle error from qeth_update_from_chp_desc() - USB: core: Don't unbind interfaces following device reset failure - [amd64] irq: Limit IST stack overflow check to #DB stack - [armhf] drm: etnaviv: avoid DMA API warning when importing buffers - [armhf,arm64] phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode - i40e: Able to add up to 16 MAC filters on an untrusted VF - i40e: don't allow changes to HW VLAN stripping on active port VLANs - ACPI/IORT: Reject platform device creation on NUMA node mapping failure - [arm64] vdso: Fix clock_getres() for CLOCK_REALTIME - RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure - [x86] perf/msr: Add Icelake support - [x86] perf/intel/rapl: Add Icelake support - [x86] perf/intel/cstate: Add Icelake support - hwmon: (vt1211) Use request_muxed_region for Super-IO accesses - hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses - hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses - hwmon: (pc87427) Use request_muxed_region for Super-IO accesses - hwmon: (f71805f) Use request_muxed_region for Super-IO accesses - scsi: libsas: Do discovery on empty PHY to update PHY info - mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers - [armhf,arm64] mmc_spi: add a status check for spi_sync_locked - drm/amdgpu: fix old fence check in amdgpu_fence_emit - PM / core: Propagate dev->power.wakeup_path when no callbacks - [armhf] clk: rockchip: Fix video codec clocks on rk3288 - [armhf] clk: rockchip: Make rkpwm a critical clock on rk3288 - [s390x] zcrypt: initialize variables before_use - [x86] microcode: Fix the ancient deprecated microcode loading method - [s390x] mm: silence compiler warning when compiling without CONFIG_PGSTE - [s390x] cio: fix cio_irb declaration - qmi_wwan: Add quirk for Quectel dynamic config - block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR - rtlwifi: fix a potential NULL pointer dereference - mwifiex: Fix mem leak in mwifiex_tm_cmd - brcmfmac: fix missing checks for kmemdup - b43: shut up clang -Wuninitialized variable warning - brcmfmac: convert dev_init_lock mutex to completion - brcmfmac: fix WARNING during USB disconnect in case of unempty psq - brcmfmac: fix race during disconnect when USB completion is in progress - brcmfmac: fix Oops when bringing up interface during USB disconnect - [arm64] rtc: xgene: fix possible race condition - rtlwifi: fix potential NULL pointer dereference - scsi: ufs: Fix regulator load and icc-level configuration - scsi: ufs: Avoid configuring regulator with undefined voltage range - [arm64] cpu_ops: fix a leaked reference by adding missing of_node_put - wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext - [x86] uaccess, signal: Fix AC=1 bloat - [amd64] ia32: Fix ia32_restore_sigcontext() AC leak - [x86] uaccess: Fix up the fixup - chardev: add additional check for minor range overlap - [arm64] RDMA/hns: Fix bad endianess of port_pd variable - HID: core: move Usage Page concatenation to Main item - [armhf] ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put - cxgb3/l2t: Fix undefined behaviour - HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent - [armhf] spi: tegra114: reset controller on probe - kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. - [armhf] media: wl128x: prevent two potential buffer overflows - media: gspca: Kill URBs on USB device disconnect - efifb: Omit memory map check on legacy boot - [x86] thunderbolt: property: Fix a missing check of kzalloc - [x86] thunderbolt: Fix to check the return value of kmemdup - timekeeping: Force upper bound for setting CLOCK_REALTIME - scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check - virtio_console: initialize vtermno value for ports - tty: ipwireless: fix missing checks for ioremap - overflow: Fix -Wtype-limits compilation warnings - [x86] mce: Fix machine_check_poll() tests for error types - rcutorture: Fix cleanup path for invalid torture_type strings - [x86] mce: Handle varying MCA bank counts - rcuperf: Fix cleanup path for invalid perf_type strings - usb: core: Add PM runtime calls to usb_hcd_platform_shutdown - scsi: qla4xxx: avoid freeing unallocated dma memory - scsi: lpfc: avoid uninitialized variable warning - selinux: avoid uninitialized variable warning - batman-adv: allow updating DAT entry timeouts on incoming ARP Replies - dmaengine: tegra210-adma: use devm_clk_*() helpers - [armhf] hwrng: omap - Set default quality - [x86] thunderbolt: Fix to check return value of ida_simple_get - [x86] thunderbolt: Fix to check for kmemdup failure - drm/amd/display: fix releasing planes when exiting odm - [x86] thunderbolt: property: Fix a NULL pointer dereference - e1000e: Disable runtime PM on CNP+ - igb: Exclude device from suspend direct complete optimization - media: dvbsky: Avoid leaking dvb frontend - drm/amd/display: Fix Divide by 0 in memory calculations - drm/amd/display: Set stream->mode_changed when connectors change - scsi: ufs: fix a missing check of devm_reset_control_get - media: gspca: do not resubmit URBs when streaming has stopped - media: go7007: avoid clang frame overflow warning with KASAN - scsi: lpfc: Fix FDMI manufacturer attribute value - scsi: lpfc: Fix fc4type information for FDMI - media: saa7146: avoid high stack usage with clang - scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices - [i386] spi : spi-topcliff-pch: Fix to handle empty DMA buffers - [armhf] drm/omap: dsi: Fix PM for display blank with paired dss_pll calls - [armhf] spi: imx: stop buffer overflow in RX FIFO flush - spi: Fix zero length xfer bug - [armhf] ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM - drm/drv: Hold ref on parent device during drm_device lifetime - drm: Wake up next in drm_read() chain if we are forced to putback the event - [s390x] vfio-ccw: Prevent quiesce function going into an infinite loop - NFS: Fix a double unlock from nfs_match,get_client https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.48 - bonding/802.3ad: fix slave link initialization transition states - cxgb4: offload VLAN flows regardless of VLAN ethtype - ipv4/igmp: fix another memory leak in igmpv3_del_delrec() - ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST - ipv6: Consider sk_bound_dev_if when binding a raw socket to an address - ipv6: Fix redirect with VRF - llc: fix skb leak in llc_build_and_send_ui_pkt() - [armhf,arm64] net: dsa: mv88e6xxx: fix handling of upper half of STATS_TYPE_PORT - net-gro: fix use-after-free read in napi_gro_frags() - [armhf,arm64] net: mvneta: Fix err code path of probe - [armhf,arm64] net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value - net: phy: marvell10g: report if the PHY fails to boot firmware - net: sched: don't use tc_action->order during action dump - [armhf,arm64] net: stmmac: fix reset gpio free missing - usbnet: fix kernel crash after disconnect - net/mlx5: Avoid double free in fs init error unwinding path - tipc: Avoid copying bytes beyond the supplied data - net/mlx5: Allocate root ns memory using kzalloc to match kfree - net/mlx5e: Disable rxhash when CQE compress is enabled - [armhf,arm64] net: stmmac: dma channel control register need to be init first - bnxt_en: Fix aggregation buffer leak under OOM condition. - [ppc64el] crypto: vmx - ghash: do nosimd fallback manually - include/linux/compiler*.h: define asm_volatile_goto - compiler.h: give up __compiletime_assert_fallback() - jump_label: move 'asm goto' support test to Kconfig - tipc: fix modprobe tipc failed after switch order of device registration https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.49 - include/linux/bitops.h: sanitize rotate primitives - xhci: update bounce buffer with correct sg num - xhci: Use %zu for printing size_t type - xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic() - usb: xhci: avoid null pointer deref when bos field is NULL - usbip: usbip_host: fix BUG: sleeping function called from invalid context - usbip: usbip_host: fix stub_dev lock context imbalance regression - USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor - USB: sisusbvga: fix oops in error path of sisusb_probe (CVE-2019-15219) - USB: Add LPM quirk for Surface Dock GigE adapter - USB: rio500: refuse more than one device at a time (CVE-2019-15212) - USB: rio500: fix memory leak in close after disconnect - media: usb: siano: Fix general protection fault in smsusb (CVE-2019-15218) - media: usb: siano: Fix false-positive "uninitialized variable" warning - media: smsusb: better handle optional alignment - brcmfmac: fix NULL pointer derefence during USB disconnect - [s390x] scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove - [s390x] scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs) - tracing: Avoid memory leak in predicate_parse() - Btrfs: fix wrong ctime and mtime of a directory after log replay - Btrfs: fix race updating log root item during fsync - Btrfs: fix fsync not persisting changed attributes of a directory - Btrfs: incremental send, fix file corruption when no-holes feature is enabled - [s390x] crypto: fix gcm-aes-s390 selftest failures - [s390x] crypto: fix possible sleep during spinlock aquired - [ppc64el] KVM: Book3S HV: XIVE: Do not clear IRQ data of passthrough interrupts - [ppc64el] perf: Fix MMCRA corruption by bhrb_filter - ALSA: line6: Assure canceling delayed work at disconnection (CVE-2019-15223) - ALSA: hda/realtek - Set default power save node to 0 - [s390x] KVM: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID - drm/nouveau/i2c: Disable i2c bus access after ->fini() - [arm64] tty: serial: msm_serial: Fix XON/XOFF - memcg: make it work on sparse non-0-node systems - kernel/signal.c: trace_signal_deliver when signal_group_exit - [arm64] Fix the arm64_personality() syscall wrapper redirection - vt/fbcon: deinitialize resources in visual_init() after failed memory allocation - [arm*] staging: vc04_services: prevent integer overflow in create_pagelist() - [x86] staging: wlan-ng: fix adapter initialization failure - cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case - CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM - Revert "lockd: Show pid of lockd for remote locks" - [armhf,arm64] drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages() - [x86] drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set - [armhf,arm64] drm/sun4i: Fix sun8i HDMI PHY clock initialization - [armhf,arm64] drm/sun4i: Fix sun8i HDMI PHY configuration for > 148.5 MHz - [armhf,arm64] drm/rockchip: shutdown drm subsystem on shutdown - drm/lease: Make sure implicit planes are leased - [x86] ftrace: Do not call function graph from dynamic trampolines - [x86] ftrace: Set trampoline pages as executable - [x86] kprobes: Set instruction page as executable - scsi: lpfc: Fix backport of faf5a744f4f8 ("scsi: lpfc: avoid uninitialized variable warning") - media: uvcvideo: Fix uvc_alloc_entity() allocation alignment https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.50 - ethtool: fix potential userspace buffer overflow - Fix memory leak in sctp_process_init - ipv4: not do cache for local delivery if bc_forwarding is enabled - ipv6: fix the check before getting the cookie in rt6_get_cookie - neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit - [armhf] net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set - net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query - [armhf,arm64] net: mvpp2: Use strscpy to handle stat strings - net: rds: fix memory leak in rds_ib_flush_mr_pool - net: sfp: read eeprom in maximum 16 byte increments - packet: unconditionally free po->rollover - pktgen: do not sleep with the thread lock held. - ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 - ipv6: fix EFAULT on sendto with icmpv6 and hdrincl - rcu: locking and unlocking need to always be at least barriers - NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter - NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled - fuse: fallocate: fix return with locked inode - pstore: Remove needless lock during console writes - pstore: Convert buf_lock to semaphore - pstore: Set tfm to NULL on free_buf_for_compression - pstore/ram: Run without kernel crash dump region - [x86] power: Fix 'nosmt' vs hibernation triple fault during resume - [s390x] mm: fix address space detection in exception handling - xen-blkfront: switch kcalloc to kvcalloc for large array allocation - [ppc64el] genwqe: Prevent an integer overflow in the ioctl - test_firmware: Use correct snprintf() limit - [x86] drm/gma500/cdv: Check vbt config bits when detecting lvds panels - [arm64] drm/msm: fix fb references in async update - drm: add non-desktop quirk for Valve HMDs - drm: add non-desktop quirks to Sensics and OSVR headsets. - drm/amdgpu/psp: move psp version specific function pointers to early_init - drm/radeon: prefer lower reference dividers - drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in - [x86] drm/i915: Fix I915_EXEC_RING_MASK - [x86] drm/i915/fbc: disable framebuffer compression on GeminiLake - [x86] drm/i915: Maintain consistent documentation subsection ordering - drm: don't block fb changes for async plane updates - [x86] drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack - TTY: serial_core, add ->install - ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled - ethtool: check the return value of get_regs_len https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.51 - fs/fat/file.c: issue flush after the writeback of FAT - sysctl: return -EINVAL if val violates minmax - ipc: prevent lockup on alloc_msg and free_msg - [armhf] prevent tracing IPI_CPU_BACKTRACE - hugetlbfs: on restore reserve error path retain subpool reservation - mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE - mm/cma.c: fix crash on CMA allocation if bitmap allocation fails - initramfs: free initrd memory if opening /initrd.image fails - mm/cma.c: fix the bitmap status to show failed allocation reason - mm: page_mkclean vs MADV_DONTNEED race - mm/cma_debug.c: fix the break condition in cma_maxchunk_get() - mm/slab.c: fix an infinite loop in leaks_show() - kernel/sys.c: prctl: fix false positive in validate_prctl_map() - drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER - [x86] mfd: intel-lpss: Set the device in reset state when init - drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration - [armhf] mfd: twl6040: Fix device init errors for ACCCTL register - [x86] perf/intel: Allow PEBS multi-entry in watermark mode - drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd when encoders change - [arm64] drm/bridge: adv7511: Fix low refresh rate selection - objtool: Don't use ignore flag for fake jumps - drm/nouveau/kms/gv100-: fix spurious window immediate interlocks - bpf: fix undefined behavior in narrow load handling - [arm64] pwm: meson: Use the spin-lock only to protect register modifications - ntp: Allow TAI-UTC offset to be set to zero - f2fs: fix to avoid panic in do_recover_data() - f2fs: fix to avoid panic in f2fs_inplace_write_data() - f2fs: fix to avoid panic in f2fs_remove_inode_page() - f2fs: fix to do sanity check on free nid - f2fs: fix to clear dirty inode in error path of f2fs_iget() - f2fs: fix to avoid panic in dec_valid_block_count() - f2fs: fix to use inline space only if inline_xattr is enable - f2fs: fix to do sanity check on valid block count of segment - f2fs: fix to do checksum even if inode page is uptodate - percpu: remove spurious lock dependency between percpu and sched - configfs: fix possible use-after-free in configfs_register_group - [armhf,arm64] PCI: dwc: Free MSI in dw_pcie_host_init() error path - [armhf,arm64] PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi() - ovl: do not generate duplicate fsnotify events for "fake" path - mmc: mmci: Prevent polling for busy detection in IRQ context - netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast - netfilter: nf_conntrack_h323: restore boundary check correctness - [mips*] Make sure dt memory regions are valid - netfilter: nf_tables: fix base chain stat rcu_dereference usage - [armhf] watchdog: imx2_wdt: Fix set_timeout for big timeout values - watchdog: fix compile time error of pretimeout governors - blk-mq: move cancel of requeue_work into blk_mq_release - [x86] iommu/vt-d: Set intel_iommu_gfx_mapped correctly - nvme-pci: unquiesce admin queue on shutdown - nvme-pci: shutdown on timeout during deletion - netfilter: nf_flow_table: check ttl value in flow offload data path - netfilter: nf_flow_table: fix netdev refcnt leak - ALSA: hda - Register irq handler after the chip initialization - nvmem: core: fix read buffer in place - [armhf,arm64] nvmem: sunxi_sid: Support SID on A83T and H5 - fuse: retrieve: cap requested size to negotiated max_write - nfsd: allow fh_want_write to be called twice - nfsd: avoid uninitialized variable warning - vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING" - [armhf,arm64] iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel - [x86] net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending - [x86] PCI: Fix PCI IRQ routing table memory leak - i40e: Queues are reserved despite "Invalid argument" error - platform/chrome: cros_ec_proto: check for NULL transfer function - [armhf] clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288 - [armhf] soc: rockchip: Set the proper PWM for rk3288 - [armhf] dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA - [armhf] dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA - [armhf] dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA - [armhf] dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA - [armhf] dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA - [armhf] dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA - [armhf] dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA - [armhf] dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA - [ppc64el] PCI: rpadlpar: Fix leaked device_node references in add/remove paths - drm/amd/display: Use plane->color_space for dpp if specified - [armhf] OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using it - [x86] platform: intel_pmc_ipc: adding error handling - [arm64] net: hns3: return 0 and print warning when hit duplicate MAC - scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags - [x86] video: hgafb: fix potential NULL pointer dereference - block, bfq: increase idling for weight-raised queues - [arm64] PCI: xilinx: Check for __get_free_pages() failure - ice: Add missing case in print_link_msg for printing flow control - [x86] dmaengine: idma64: Use actual device for DMA transfers - [armhf] pwm: tiehrpwm: Update shadow register for disabling PWMs - [armhf] dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa - pwm: Fix deadlock warning when removing PWM device - [armhf] exynos: Fix undefined instruction during Exynos5422 resume - [x86] usb: typec: fusb302: Check vconn is off when we start toggling - soc: renesas: Identify R-Car M3-W ES1.3 - percpu: do not search past bitmap when allocating an area - ovl: check the capability before cred overridden - ovl: support stacked SEEK_HOLE/SEEK_DATA - [arm*] drm/vc4: fix fb references in async update - ALSA: seq: Cover unsubscribe_port() in list_mutex https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.52 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.53 - drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3) - nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled - HID: multitouch: handle faulty Elo touch device - HID: wacom: Don't set tool type until we're in range - HID: wacom: Don't report anything prior to the tool entering range - HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact - HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth - HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary - ALSA: oxfw: allow PCM capture for Stanton SCS.1m - ALSA: hda/realtek - Update headset mode for ALC256 - ALSA: firewire-motu: fix destruction of data for isochronous resources - libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk - mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node - fs/ocfs2: fix race in ocfs2_dentry_attach_lock() - mm/vmscan.c: fix trying to reclaim unevictable LRU page - signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO - ptrace: restore smp_rmb() in __ptrace_may_access() - [armhf,arm64] iommu/arm-smmu: Avoid constant zero in TLBI writes - bcache: fix stack corruption by PRECEDING_KEY() - bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached - cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css() - [x86] drm/i915/sdvo: Implement proper HDMI audio support for SDVO - ALSA: seq: Fix race of get-subscription call vs port-delete ioctls - Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var - f2fs: fix to avoid accessing xattr across the boundary - scsi: qedi: remove memset/memcpy to nfunc and use func instead (CVE-2019-15090) - scsi: qedi: remove set but not used variables 'cdev' and 'udev' - scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show - scsi: lpfc: add check for loss of ndlp when sending RRQ - [arm64] mm: Inhibit huge-vmap with ptdump - nvme: fix srcu locking on error return in nvme_get_ns_from_disk - nvme: remove the ifdef around nvme_nvm_ioctl - nvme: merge nvme_ns_ioctl into nvme_ioctl - nvme: release namespace SRCU protection before performing controller ioctls - nvme: fix memory leak for power latency tolerance - [x86] platform: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table - [x86] platform: pmc_atom: Add several Beckhoff Automation boards to critclk_systems DMI table - scsi: bnx2fc: fix incorrect cast to u64 on shift operation - libnvdimm: Fix compilation warnings with W=1 - tracing: Prevent hist_field_var_ref() from accessing NULL tracing_map_elts - usbnet: ipheth: fix racing condition - [armhf,arm64] KVM: Move cc/it checks under hyp's Makefile to avoid instrumentation - [x86] KVM: pmu: mask the result of rdpmc according to the width of the counters - [x86] KVM: pmu: do not mask the value that is written to fixed PMUs - [s390x] KVM: fix memory slot handling for KVM_SET_USER_MEMORY_REGION - [x86] drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read - [x86] drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define() - [armhf,arm64] usb: dwc2: Fix DMA cache alignment issues - [armhf,arm64] usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression) - USB: Fix chipmunk-like voice when using Logitech C270 for recording audio. - USB: usb-storage: Add new ID to ums-realtek - USB: serial: pl2303: add Allied Telesis VT-Kit3 - USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode - USB: serial: option: add Telit 0x1260 and 0x1261 compositions - timekeeping: Repair ktime_get_coarse*() granularity - [x86] microcode, cpuhotplug: Add a microcode loader CPU hotplug callback - [x86] mm/KASLR: Compute the size of the vmemmap section properly - [x86] resctrl: Prevent NULL pointer dereference when local MBM is disabled - drm/edid: abstract override/firmware EDID retrieval - drm: add fallback override/firmware EDID modes workaround - [armhf] rtc: pcf8523: don't return invalid date when battery is low https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.54 - ax25: fix inconsistent lock state in ax25_destroy_timer - be2net: Fix number of Rx queues used for flow hashing - [x86] hv_netvsc: Set probe mode to sync - ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero - lapb: fixed leak of control-blocks. - neigh: fix use-after-free read in pneigh_get_next - net: openvswitch: do not free vport if register_netdevice() is failed. - sctp: Free cookie before we memdup a new one - tipc: purge deferredq list for each grp member in tipc_group_delete - vsock/virtio: set SOCK_DONE on peer shutdown - net/mlx5: Avoid reloading already removed devices - [armhf,arm64] net: mvpp2: prs: Fix parser range for VID filtering - [armhf,arm64] net: mvpp2: prs: Use the correct helpers when removing all VID filters - [arm*] Staging: vc04_services: Fix a couple error codes - [x86] perf/intel/ds: Fix EVENT vs. UEVENT PEBS constraints - netfilter: nf_queue: fix reinject verdict handling - ipvs: Fix use-after-free in ip_vs_in - [armhf] clk: ti: clkctrl: Fix clkdm_clk handling - [ppc64el] powernv: Return for invalid IMC domain - usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint() - mISDN: make sure device name is NUL terminated - [x86] CPU/AMD: Don't force the CPB cap when running under a hypervisor - perf/ring_buffer: Fix exposing a temporarily decreased data_head - perf/ring_buffer: Add ordering to rb->nest increment - perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page data - [armhf,arm64] net: stmmac: update rx tail pointer register to fix rx dma hang issue. - ACPI/PCI: PM: Add missing wakeup.flags.valid checks - [armhf] drm/etnaviv: lock MMU while dumping core - net: aquantia: tx clean budget logic error - net: aquantia: fix LRO with FCS error - i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr - ALSA: hda - Force polling mode on CNL for fixing codec communication - configfs: Fix use-after-free when accessing sd->s_dentry - perf data: Fix 'strncat may truncate' build failure with recent gcc - perf namespace: Protect reading thread's namespace - [s390x] perf record: Fix s390 missing module symbol and warning for non-root users - xenbus: Avoid deadlock during suspend due to open transactions - [ppc64el] KVM: Book3S: Use new mutex to synchronize access to rtas token list - [ppc64el] KVM: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu - [arm64] fix syscall_fn_t type - [arm64] use the correct function type in SYSCALL_DEFINE0 - [arm64] use the correct function type for __arm64_sys_ni_syscall - net: phylink: ensure consistent phy interface mode - net: phy: dp83867: Set up RGMII TX delay - scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() - scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask - scsi: scsi_dh_alua: Fix possible null-ptr-deref - scsi: libsas: delete sas port if expander discover failed - ocfs2: fix error path kobject memory leak - coredump: fix race condition between collapse_huge_page() and core dumping - Abort file_remove_privs() for non-reg. files https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.55 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.56 - tracing: Silence GCC 9 array bounds warning - objtool: Support per-function rodata sections - ovl: support the FS_IOC_FS[SG]ETXATTR ioctls - ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls - ovl: make i_ino consistent with st_ino in more cases - ovl: detect overlapping layers - ovl: don't fail with disconnected lower NFS - ovl: fix bogus -Wmaybe-unitialized warning - [s390x] jump_label: Use "jdd" constraint on gcc9 - [s390x] ap: rework assembler functions to use unions for in/out register variables - mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning - mmc: core: API to temporarily disable retuning for SDIO CRC errors - mmc: core: Add sdio_retune_hold_now() and sdio_retune_release() - mmc: core: Prevent processing SDIO IRQs when the card is suspended - scsi: ufs: Avoid runtime suspend possibly being blocked forever - [armhf,arm64] usb: chipidea: udc: workaround for endpoint conflict issue - xhci: detect USB 3.2 capable host controllers correctly - usb: xhci: Don't try to recover an endpoint if port is in error state. - IB/hfi1: Validate fault injection opcode user input - IB/hfi1: Silence txreq allocation warnings - [x86] Input: synaptics - enable SMBus on ThinkPad E480 and E580 - Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD - [x86] Input: silead - add MSSL0017 to acpi_device_id - apparmor: fix PROFILE_MEDIATES for untrusted input - apparmor: enforce nullbyte at end of tag string - brcmfmac: sdio: Disable auto-tuning around commands expected to fail - brcmfmac: sdio: Don't tune while the card is off - parport: Fix mem leak in parport_register_dev_model - IB/rdmavt: Fix alloc_qpn() WARN_ON() - IB/hfi1: Insure freeze_work work_struct is canceled on shutdown - IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value - IB/hfi1: Validate page aligned for a given virtual address - [mips*] uprobes: remove set but not used variable 'epc' - [armhf,arm64] net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0 - [arm64] net: hns: Fix loopback test failed at copper ports - mdesc: fix a missing-check bug in get_vdev_port_node_info() - [arm64] drm/arm/mali-dp: Add a loop around the second set CVAL and try 5 times - [arm64] drm/arm/hdlcd: Actually validate CRTC modes - [arm64] drm/arm/hdlcd: Allow a bit of clock tolerance - nvmet: fix data_len to 0 for bdev-backed write_zeroes - scsi: ufs: Check that space was properly alloced in copy_query_response - scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous() - net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set - [s390x] qeth: fix VLAN attribute in bridge_hostnotify udev event - hwmon: (core) add thermal sensors only if dev->of_node is present - hwmon: (pmbus/core) Treat parameters as paged if on multiple pages - nvme: Fix u32 overflow in the number of namespace list calculation - btrfs: start readahead also in seed devices - [armhf] can: flexcan: fix timeout when set small bitrate - can: purge socket error queue on sock destruct - [ppc64el] bpf: use unsigned division instruction for 64-bit operations - [armhf] imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX - [armhf] dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values - [armhf] dts: am57xx-idk: Remove support for voltage switching for SD card - [arm64] sve: should not depend on - [arm64] ssbd: explicitly depend on - [x86] drm/vmwgfx: Use the backdoor port if the HB port is not available - Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (CVE-2019-9506) - Bluetooth: Fix regression with minimum encryption key size alignment - SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write - cfg80211: fix memory leak of wiphy device name - mac80211: drop robust management frames from unknown TA - {nl,mac}80211: allow 4addr AP operation on crypto controlled devices - mac80211: handle deauthentication/disassociation from TDLS peer - nl80211: fix station_info pertid memory leak - mac80211: Do not use stack memory with scatterlist for GMAC - [x86] resctrl: Don't stop walking closids when a locksetup group is found https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.57 - perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul - perf help: Remove needless use of strncpy() - perf header: Fix unchecked usage of strncpy() - [arm64] Don't unconditionally add -Wno-psabi to KBUILD_CFLAGS - IB/hfi1: Close PSM sdma_progress sleep window - 9p/xen: fix check for xenbus_read error in front_probe - 9p: Use a slab for allocating requests - 9p: embed fcall in req to round down buffer allocs - 9p: add a per-client fcall kmem_cache - 9p: rename p9_free_req() function - 9p: Add refcount to p9_req_t - 9p/rdma: do not disconnect on down_interruptible EAGAIN - 9p: Rename req to rreq in trans_fd - 9p: acl: fix uninitialized iattr access - 9p/rdma: remove useless check in cm_event_handler - 9p: p9dirent_read: check network-provided name length - 9p: potential NULL dereference - 9p/trans_fd: abort p9_read_work if req status changed - 9p/trans_fd: put worker reqs on destroy - net/9p: include trans_common.h to fix missing prototype warning. - qmi_wwan: Fix out-of-bounds read - [armhf,arm64] Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup" - [armhf,arm64] usb: dwc3: gadget: combine unaligned and zero flags - [armhf,arm64] usb: dwc3: gadget: track number of TRBs per request - [armhf,arm64] usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue() - [armhf,arm64] usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs() - [armhf,arm64] usb: dwc3: gadget: introduce cancelled_list - [armhf,arm64] usb: dwc3: gadget: move requests to cancelled_list - [armhf,arm64] usb: dwc3: gadget: remove wait_end_transfer - [armhf,arm64] usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup - fs/proc/array.c: allow reporting eip/esp for all coredumping threads - mm/mempolicy.c: fix an incorrect rebind node in mpol_rebind_nodemask - fs/binfmt_flat.c: make load_flat_shared_library() work - [armhf] clk: socfpga: stratix10: fix divider entry for the emac clocks - mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails - mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge - mm/page_idle.c: fix oops because end_pfn is larger than max_pfn - dm log writes: make sure super sector log updates are written in order - [x86] scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() - [x86] speculation: Allow guests to use SSBD even if host does not - [x86] microcode: Fix the microcode load on CPU hotplug for real - [x86] resctrl: Prevent possible overrun during bitmap operations - [x86] KVM: mmu: Allocate PAE root array when using SVM's 32-bit NPT - NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O - cpu/speculation: Warn on unsupported mitigations= parameter - SUNRPC: Clean up initialisation of the struct rpc_rqst - [mips*] irqchip/mips-gic: Use the correct local interrupt map registers - eeprom: at24: fix unexpected timeout under high load - af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET - bonding: Always enable vlan tx offload - ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop - net/packet: fix memory leak in packet_set_ring() - net: remove duplicate fetch in sock_getsockopt - [armhf,arm64] net: stmmac: fixed new system time seconds value calculation - [armhf,arm64] net: stmmac: set IC bit when transmitting frames with HW timestamp - sctp: change to hold sk after auth shkey is created successfully - team: Always enable vlan tx offload - tipc: change to use register_pernet_device - tipc: check msg->req data len in tipc_nl_compat_bearer_disable - tun: wake up waitqueues after IFF_UP is set - bpf: simplify definition of BPF_FIB_LOOKUP related flags - bpf: lpm_trie: check left child of last leftmost node for NULL - bpf: fix nested bpf tracepoints with per-cpu data - bpf: fix unconnected udp hooks - bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro - bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err - [arm64] futex: Avoid copying out uninitialised stack in failed cmpxchg() - [arm64] bpf: use more scalable stadd over ldxr / stxr loop in xadd - futex: Update comments and docs about return values of arch futex code - RDMA: Directly cast the sockaddr union to sockaddr - tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb - [armhf,arm64] usb: dwc3: Reset num_trbs after skipping - [arm64] insn: Fix ldadd instruction encoding https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.58 - Bluetooth: Fix faulty expression for minimum encryption key size check - block: Fix a NULL pointer dereference in generic_make_request() - md/raid0: Do not bypass blocking queue entered for raid0 bios - netfilter: nf_flow_table: ignore DF bit setting - netfilter: nft_flow_offload: set liberal tracking mode for tcp - netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment - netfilter: nft_flow_offload: IPCB is only valid for ipv4 family - ASoC: soc-pcm: BE dai needs prepare when pause release after resume - spi: bitbang: Fix NULL pointer dereference in spi_unregister_master - [armhf,arm64] ASoC: max98090: remove 24-bit format support if RJ is 0 - [x86] CPU: Add more Icelake model numbers - ALSA: hdac: fix memory release for SST and SOF drivers - scsi: hpsa: correct ioaccel2 chaining - [x86] drm: panel-orientation-quirks: Add quirk for GPD pocket2 - [x86] drm: panel-orientation-quirks: Add quirk for GPD MicroPC - [x86] platform: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi - [x86] platform: intel-vbtn: Report switch events when event wakes device - [x86] platform: mlx-platform: Fix parent device in i2c-mux-reg device registration - i2c: pca-platform: Fix GPIO lookup code - cpuset: restore sanity to cpuset_cpus_allowed_fallback() - mm/mlock.c: change count_mm_mlocked_page_nr return type - tracing: avoid build warning with HAVE_NOP_MCOUNT - module: Fix livepatch/ftrace module text permissions race - ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() - [x86] drm/i915/dmc: protect against reading random memory - crypto: user - prevent operating on larval algorithms - crypto: cryptd - Fix skcipher instance memory leak - ALSA: seq: fix incorrect order of dest_client/dest_ports arguments - ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages - ALSA: line6: Fix write on zero-sized buffer (CVE-2019-15221) - ALSA: usb-audio: fix sign unintended sign extension on left shifts - [x86] ALSA: hda/realtek: Add quirks for several Clevo notebook barebones - [x86] ALSA: hda/realtek - Change front mic location for Lenovo M710q - lib/mpi: Fix karactx leak in mpi_powm - fs/userfaultfd.c: disable irqs for fault_pending and event locks - tracing/snapshot: Resize spare buffer if size changed - [armhf] dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node - drm/amd/powerplay: use hardware fan control if no powerplay fan table - drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE - [armhf] drm/etnaviv: add missing failure path to destroy suballoc - [armhf] drm/imx: notify drm core before sending event during crtc disable - drm/imx: only send event on crtc disable if kept disabled - [x86] ftrace: Remove possible deadlock between register_kprobe() and ftrace_run_update_code() - mm/vmscan.c: prevent useless kswapd loops - btrfs: Ensure replaced device doesn't have pending chunk allocation - tty: rocket: fix incorrect forward declaration of 'rp_init()' - net/smc: move unhash before release of clcsock - drm/fb-helper: generic: Don't take module ref for fbcon - f2fs: don't access node/meta inode mapping after iput - mac80211: mesh: fix missing unlock on error in table_path_del() - scsi: tcmu: fix use after free - [amd64] boot/compressed: Do not corrupt EDX on EFER.LME=1 setting - [arm64] net: hns: Fixes the missing put_device in positive leg for roce reset - ALSA: hda: Initialize power_state field properly - rds: Fix warning. - ip6: fix skb leak in ip6frag_expire_frag_queue() - netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments - [arm64] net: hns: fix unsigned comparison to less than zero - bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K - netfilter: ipv6: nf_defrag: accept duplicate fragments again - [x86] KVM: degrade WARN to pr_warn_ratelimited - [x86] KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC - nfsd: Fix overflow causing non-working mounts on 1 TB machines - svcrdma: Ignore source port when computing DRC hash - [mips*] Fix bounds check virt_addr_valid - [mips*] Add missing EHB in mtc0 -> mfc0 sequence. - [arm64] dmaengine: qcom: bam_dma: Fix completed descriptors count - [armhf] dmaengine: imx-sdma: remove BD_INTR for channel0 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.59 - [x86] Input: elantech - enable middle button support on 2 ThinkPads - mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he() - bpf: sockmap, fix use after free from sleep in psock backlog workqueue - mac80211: mesh: fix RCU warning - mac80211: free peer keys before vif down in mesh - iwlwifi: Fix double-free problems in iwl_req_fw_callback() - can: af_can: Fix error path of can_init() - net: phy: rename Asix Electronics PHY driver - [armhf] dts: am335x phytec boards: Fix cd-gpios active level - [s390x] boot: disable address-of-packed-member warning - [x86] drm/vmwgfx: Honor the sg list segment size limitation - [x86] drm/vmwgfx: fix a warning due to missing dma_parms - [armhf] Input: imx_keypad - make sure keyboard can always wake up system - [armhf,arm64] KVM: vgic: Fix kvm_device leak in vgic_its_destroy - mac80211: only warn once on chanctx_conf being NULL - mac80211: do not start any work during reconfigure flow - bpf, devmap: Fix premature entry free on destroying map - bpf, devmap: Add missing bulk queue free - bpf, devmap: Add missing RCU read lock on flush - [amd64] bpf: fix stack layout of JITed bpf code - qmi_wwan: add support for QMAP padding in the RX path - qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode - qmi_wwan: extend permitted QMAP mux_id value range - mmc: core: complete HS400 before checking status - md: fix for divide error in status_resync - bnx2x: Check if transceiver implements DDM before access - drm: return -EFAULT if copy_to_user() fails - ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL - net: lio_core: fix potential sign-extension overflow on large shift - scsi: qedi: Check targetname while finding boot target information - quota: fix a problem about transfer quota - [armhf,arm64] net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge() - NFS4: Only set creation opendata if O_CREAT - net :sunrpc :clnt :Fix xps refcount imbalance on the error path - fscrypt: don't set policy for a dead directory - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length - media: stv0297: fix frequency range limit - ALSA: usb-audio: Fix parse of UAC2 Extension Units - ALSA: hda/realtek - Headphone Mic can't record after S3 - block, bfq: NULL out the bic when it's no longer valid - [arm64] perf pmu: Fix uncore PMU alias list for ARM64 - [x86] ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() - [x86] tls: Fix possible spectre-v1 in do_get_thread_area() - USB: serial: ftdi_sio: add ID for isodebug v1 - USB: serial: option: add support for GosunCn ME3630 RNDIS mode - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled" - p54usb: Fix race between disconnect and firmware loading (CVE-2019-15220) - usb: gadget: ether: Fix race between gether_disconnect and rx_submit - [armhf,arm64] usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset() - [x86] drivers/usb/typec/tps6598x.c: fix portinfo width - [x86] drivers/usb/typec/tps6598x.c: fix 4CC cmd write - [i386] staging: comedi: dt282x: fix a null pointer deref on interrupt - [x86] staging: comedi: amplc_pci230: fix null pointer deref on interrupt - HID: Add another Primax PIXART OEM mouse quirk - binder: fix memory leak in error path - carl9170: fix misuse of device driver API - [x86] VMCI: Fix integer overflow in VMCI handle arrays - staging: rtl8712: reduce stack usage, again https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.60 - Revert "e1000e: fix cyclic resets at link up with active tx" - e1000e: start network tx queue only when link is up - [x86] Input: synaptics - enable SMBUS on T480 thinkpad trackpad - nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header - drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT - firmware: improve LSM/IMA security behaviour - [armhf,arm64] irqchip/gic-v3-its: Fix command queue pointer comparison bug - [armhf] clk: ti: clkctrl: Fix returning uninitialized data - [amd64,arm64] efi/bgrt: Drop BGRT status field reserved bits check - perf/core: Fix perf_sample_regs_user() mm check - [armhf] omap2: remove incorrect __init annotation - afs: Fix uninitialised spinlock afs_volume::cb_break_lock - [x86] apic: Fix integer overflow on 10 bit left shift of cpu_khz - be2net: fix link failure after ethtool offline test - ppp: mppe: Add softdep to arc4 - sis900: fix TX completion - [armhf] dts: imx6ul: fix PWM[1-4] interrupts - [armhf] pinctrl: mcp23s08: Fix add_data and irqchip_add_nested call order - dm table: don't copy from a NULL pointer in realloc_argv() - dm verity: use message limit for data block corruption message - [amd64] boot: Fix crash if kernel image crosses page table boundary - [amd64] boot: Add missing fixup_pointer() for next_early_pgt access - HID: chicony: add another quirk for PixArt mouse - HID: multitouch: Add pointstick support for ALPS Touchpad - cpu/hotplug: Fix out-of-bounds read when setting fail state - linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL - genirq: Delay deactivation in free_irq() - genirq: Fix misleading synchronize_irq() documentation - genirq: Add optional hardware synchronization for shutdown - [x86] ioapic: Implement irq_get_irqchip_state() callback - [x86] irq: Handle spurious interrupt after shutdown gracefully - [x86] irq: Seperate unused system vectors from spurious entry again - [s390x] fix stfle zero padding - [s390x] qdio: (re-)initialize tiqdio list entries - [s390x] qdio: don't touch the dsci in tiqdio_add_input_queues() - regmap-irq: do not write mask register if mask_base is zero - drm/udl: introduce a macro to convert dev to udl. - drm/udl: Replace drm_dev_unref with drm_dev_put - drm/udl: move to embedding drm device inside udl device. - [i386] entry: Fix ENDPROC of common_spurious https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.61 - [arm64] efi: Mark __efistub_stext_offset as an absolute symbol explicitly - scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported - [armhf] dmaengine: imx-sdma: fix use-after-free on probe error path - wil6210: fix potential out-of-bounds read - ath10k: Do not send probe response template for mesh - ath9k: Check for errors when reading SREV register - ath6kl: add some bounds checking - ath10k: add peer id check in ath10k_peer_find_by_id - wil6210: fix spurious interrupts in 3-msi - ath: DFS JP domain W56 fixed pulse type 3 RADAR detection - regmap: debugfs: Fix memory leak in regmap_debugfs_init - batman-adv: fix for leaked TVLV handler. - media: dvb: usb: fix use after free in dvb_usb_device_exit - media: marvell-ccic: fix DMA s/g desc number calculation - media: media_device_enum_links32: clean a reserved field - [armhf,arm64] net: stmmac: dwmac1000: Clear unused address entries - [armhf,arm64] net: stmmac: dwmac4/5: Clear unused address entries - qed: Set the doorbell address correctly - signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig - af_key: fix leaks in key_pol_get_resp and dump_sp. - xfrm: Fix xfrm sel prefix length validation - fscrypt: clean up some BUG_ON()s in block encryption/decryption - perf annotate TUI browser: Do not use member from variable within its own initialization - media: mc-device.c: don't memset __user pointer contents - media: saa7164: fix remove_proc_entry warning - net: phy: Check against net_device being NULL - tua6100: Avoid build warnings. - batman-adv: Fix duplicated OGMs on NETDEV_UP - [armhf] media: wl128x: Fix some error handling in fm_v4l2_init_video_device() - [arm64] net: hns3: set ops to null when unregister ad_dev - cpupower : frequency-set -r option misses the last cpu in related cpu list - [armhf,arm64] net: stmmac: dwmac4: fix flow control issue - [armhf,arm64] net: stmmac: modify default value of tx-frames - [arm64] crypto: inside-secure - do not rely on the hardware last bit for result descriptors - [s390x] qdio: handle PENDING state for QEBSM devices - net: sfp: add mutex to prevent concurrent state checks - ipset: Fix memory accounting for hash types on resize - perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode - [s390x] perf report: Fix OOM error in TUI mode on s390 - [arm64] irqchip/meson-gpio: Add support for Meson-G12A SoC - media: uvcvideo: Fix access to uninitialized fields on probe error - iommu: Fix a leak in iommu_insert_resv_region - [armhf] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 - [armhf] gpio: omap: ensure irq is enabled before wakeup - regmap: fix bulk writes on paged registers - bpf: silence warning messages in core - selinux: fix empty write to keycreate file - [x86] cpu: Add Ice Lake NNPI to Intel family - [arm64] ASoC: meson: axg-tdm: fix sample clock inversion - rcu: Force inlining of rcu_read_lock() - [x86] cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS - qed: iWARP - Fix tc for MPA ll2 connection - [arm64] net: hns3: fix for skb leak when doing selftest - block: null_blk: fix race condition for null_del_dev - blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration - xfrm: fix sa selector validation - sched/core: Add __sched tag for io_schedule() - sched/fair: Fix "runnable_avg_yN_inv" not used warnings - [x86] perf/intel/uncore: Handle invalid event coding for free-running counter - [x86] atomic: Fix smp_mb__{before,after}_atomic() - perf evsel: Make perf_evsel__name() accept a NULL argument - vhost_net: disable zerocopy by default - ipoib: correcly show a VF hardware address - [x86] cacheinfo: Fix a -Wtype-limits warning - blk-iolatency: only account submitted bios - ACPICA: Clear status of GPEs on first direct enable - EDAC/sysfs: Fix memory leak when creating a csrow object - nvme: fix possible io failures when removing multipathed ns - nvme-pci: properly report state change failure in nvme_reset_work - nvme-pci: set the errno on ctrl state change error - lightnvm: pblk: fix freeing of merged pages - [arm64] Do not enable IRQs for ct_user_exit - ipsec: select crypto ciphers for xfrm_algo - ipvs: defer hook registration to avoid leaks - media: i2c: fix warning same module names - ntp: Limit TAI-UTC offset - timer_list: Guard procfs specific code - [arm64] acpi: ignore 5.1 FADTs that are reported as 5.0 - media: hdpvr: fix locking and a missing msleep - [armhf] net: stmmac: sun8i: force select external PHY when no internal one - rtlwifi: rtl8192cu: fix error handle when usb probe failed - mt7601u: do not schedule rx_tasklet when the device has been disconnected - mt7601u: fix possible memory leak when the device is disconnected - ipvs: fix tinfo memory leak in start_sync_thread - ath10k: add missing error handling - ath10k: fix PCIE device wake up failed - perf tools: Increase MAX_NR_CPUS and MAX_CACHES - [x86] ASoC: Intel: hdac_hdmi: Set ops to NULL on remove - libata: don't request sense data on !ZAC ATA devices - [armhf] clocksource/drivers/exynos_mct: Increase priority over ARM arch timer - xsk: Properly terminate assignment in xskq_produce_flush_desc - rslib: Fix decoding of shortened codes - rslib: Fix handling of of caller provided syndrome - ixgbe: Check DDM existence in transceiver before access - crypto: serpent - mark __serpent_setkey_sbox noinline - wil6210: drop old event after wmi_call timeout - EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec - bcache: check CACHE_SET_IO_DISABLE in allocator code - bcache: check CACHE_SET_IO_DISABLE bit in bch_journal() - bcache: acquire bch_register_lock later in cached_dev_free() - bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() - bcache: fix potential deadlock in cached_def_free() - [arm64] net: hns3: fix a -Wformat-nonliteral compile warning - [arm64] net: hns3: add some error checking in hclge_tm module - ath10k: destroy sdio workqueue while remove sdio module - [armhf,arm64] net: mvpp2: prs: Don't override the sign bit in SRAM parser shift - igb: clear out skb->tstamp after reading the txtime - iwlwifi: mvm: Drop large non sta frames - perf stat: Make metric event lookup more robust - perf stat: Fix group lookup for metric group - bnx2x: Prevent ptp_task to be rescheduled indefinitely - net: usb: asix: init MAC address buffers - rxrpc: Fix oops in tracepoint - bpf, libbpf, smatch: Fix potential NULL pointer dereference - bonding: validate ip header before check IPPROTO_IGMP - gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants - [ppc64el] tools: bpftool: Fix json dump crash on powerpc - Bluetooth: hci_bcsp: Fix memory leak in rx_skb - Bluetooth: Add new 13d3:3491 QCA_ROME device - Bluetooth: Add new 13d3:3501 QCA_ROME device - Bluetooth: 6lowpan: search for destination address in all peers - [ppc64el] perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64 - Bluetooth: Check state in l2cap_disconnect_rsp - gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() - Bluetooth: validate BLE connection interval updates - gtp: fix suspicious RCU usage - gtp: fix Illegal context switch in RCU read-side critical section. - gtp: fix use-after-free in gtp_encap_destroy() - gtp: fix use-after-free in gtp_newlink() - [armel/marvell,armhf] net: mvmdio: defer probe of orion-mdio if a clock is not ready - iavf: fix dereference of null rx_buffer pointer - floppy: fix out-of-bounds read in next_valid_format - floppy: fix invalid pointer dereference in drive_name - xen: let alloc_xenballooned_pages() fail if not enough memory free - scsi: core: Fix race on creating sense cache - scsi: megaraid_sas: Fix calculation of target ID - crypto: ghash - fix unaligned memory access in ghash_setkey() - [x86] crypto: ccp - Validate the the error value used to index error messages - [arm64] crypto: sha1-ce - correct digest for empty data in finup - [arm64] crypto: sha2-ce - correct digest for empty data in finup - crypto: chacha20poly1305 - fix atomic sleep when using async algorithm - [x86] crypto: ccp - memset structure fields to zero before reuse - [x86] crypto: ccp/gcm - use const time tag comparison. - Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()" - bcache: Revert "bcache: fix high CPU occupancy during journal" - bcache: Revert "bcache: free heap cache_set->flush_btree in bch_journal_free" - bcache: ignore read-ahead request failure on backing device - bcache: fix mistaken sysfs entry for io_error counter - bcache: destroy dc->writeback_write_wq if failed to create dc->writeback_thread - Input: alps - don't handle ALPS cs19 trackpoint-only device - [x86] Input: synaptics - whitelist Lenovo T580 SMBus intertouch - Input: alps - fix a mismatch between a condition check and its comment - [armhf] regulator: s2mps11: Fix buck7 and buck8 wrong voltages - [arm64] tegra: Update Jetson TX1 GPU regulator timings - iwlwifi: pcie: don't service an interrupt that was masked - iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X - iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill - iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices - NFSv4: Handle the special Linux file open access mode - pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error - pNFS: Fix a typo in pnfs_update_layout - pnfs: Fix a problem where we gratuitously start doing I/O through the MDS - lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE - ASoC: dapm: Adapt for debugfs API change - raid5-cache: Need to do start() part job after adding journal device - ALSA: seq: Break too long mutex context in the write loop - [x86] ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform - [x86] ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine - media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() - media: videobuf2-core: Prevent size alignment wrapping buffer size to 0 - media: videobuf2-dma-sg: Prevent size from overflowing - [x86] KVM: vPMU: refine kvm_pmu err msg when event creation failed - [arm64] tegra: Fix AGIC register range - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. - kconfig: fix missing choice values in auto.conf - drm/nouveau/i2c: Enable i2c pads & busses during preinit - padata: use smp_mb in padata_reorder to avoid orphaned padata jobs - dm zoned: fix zone state management race - xen/events: fix binding user event channels to cpus - 9p/xen: Add cleanup path in p9_trans_xen_init - 9p/virtio: Add cleanup path in p9_virtio_init - [x86] boot: Fix memory leak in default_get_smp_config() - [x86] perf/intel: Fix spurious NMI on fixed counter - [x86] perf/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs - [x86] perf/amd/uncore: Set the thread mask for F17h L3 PMCs - drm/edid: parse CEA blocks embedded in DisplayID - [x86] intel_th: pci: Add Ice Lake NNPI support - [x86] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() - PCI: Do not poll for PME if the device is in D3cold - [arm64] PCI: qcom: Ensure that PERST is asserted for at least 100 ms - Btrfs: fix data loss after inode eviction, renaming it, and fsync it - Btrfs: fix fsync not persisting dentry deletions due to inode evictions - Btrfs: add missing inode version, ctime and mtime updates when punching hole - IB/mlx5: Report correctly tag matching rendezvous capability - HID: wacom: generic: only switch the mode on devices with LEDs - HID: wacom: generic: Correct pad syncing - HID: wacom: correct touch resolution x/y typo - libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields - coda: pass the host file in vma->vm_file on mmap - include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures - xfs: fix pagecache truncation prior to reflink - xfs: flush removing page cache in xfs_reflink_remap_prep - xfs: don't overflow xattr listent buffer - xfs: rename m_inotbt_nores to m_finobt_nores - xfs: don't ever put nlink > 0 inodes on the unlinked list - xfs: reserve blocks for ifree transaction during log recovery - xfs: fix reporting supported extra file attributes for statx() - xfs: serialize unaligned dio writes against all other dio writes - xfs: abort unaligned nowait directio early - [ppc64el] watchpoint: Restore NV GPRs while returning from exception - [ppc64el] powernv/npu: Fix reference leak - [ppc64el] pseries: Fix oops in hotplug memory notifier - [arm64] mmc: sdhci-msm: fix mutex while in spinlock - eCryptfs: fix a couple type promotion bugs - [x86] intel_th: msu: Fix single mode with disabled IOMMU - Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug - usb: Handle USB3 remote wakeup for LPM enabled devices correctly - blk-throttle: fix zero wait time for iops throttled group - blk-iolatency: clear use_delay when io.latency is set to zero - blkcg: update blkcg_print_stat() to handle larger outputs - [armel/marvell,armhf] net: mvmdio: allow up to four clocks to be specified for orion-mdio - dm bufio: fix deadlock with loop device https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.62 - bnx2x: Prevent load reordering in tx completion processing - [x86] hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() - igmp: fix memory leak in igmpv3_del_delrec() - ipv4: don't set IPv6 only flags to IPv4 addresses - ipv6: rt6_check should return NULL if 'from' is NULL - ipv6: Unlink sibling route in case of failure - [armhf,arm64] net: dsa: mv88e6xxx: wait after reset deactivation - net: make skb_dst_force return true when dst is refcounted - net: neigh: fix multiple neigh timer scheduling - net: openvswitch: fix csum updates for MPLS actions - net: phy: sfp: hwmon: Fix scaling of RX power - [armhf,arm64] net: stmmac: Re-work the queue selection for TSO packets - nfc: fix potential illegal memory access - r8169: fix issue with confused RX unit after PHY power-down on RTL8411b - rxrpc: Fix send on a connected, but unbound socket - sctp: fix error handling on stream scheduler initialization - [x86] sky2: Disable MSI on ASUS P6T - tcp: be more careful in tcp_fragment() - tcp: fix tcp_set_congestion_control() use from bpf hook - tcp: Reset bytes_acked and bytes_received when disconnecting - vrf: make sure skb->data contains ip header to make routing - net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn - macsec: fix use-after-free of skb during RX - macsec: fix checksumming after decryption - netrom: fix a memory leak in nr_rx_frame() - netrom: hold sock when setting skb->destructor - net_sched: unset TCQ_F_CAN_BYPASS when adding filters - sctp: not bind the socket in sctp_connect - net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling - net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query - net: bridge: don't cache ether dest pointer on input - net: bridge: stp: don't cache eth dest pointer before skb pull - dma-buf: balance refcount inbalance - dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc - perf/core: Fix exclusive events' grouping - perf/core: Fix race between close() and fork() - ext4: don't allow any modifications to an immutable file - ext4: enforce the immutable flag on open files - mm: add filemap_fdatawait_range_keep_errors() - jbd2: introduce jbd2_inode dirty range scoping - ext4: use jbd2_inode dirty range scoping - ext4: allow directory holes - [x86] KVM: nVMX: do not use dangling shadow VMCS after guest reset - [x86] KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested - mm: vmscan: scan anonymous pages on file refaults - net: sched: verify that q!=NULL before setting q->flags https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.63 - [x86] hvsock: fix epollout hang from race condition - [armhf,arm64] drm/panel: simple: Fix panel_simple_dsi_probe - [x86] staging: vt6656: use meaningful error code during buffer allocation - usb: core: hub: Disable hub-initiated U1/U2 - [armhf,arm64] pinctrl: rockchip: fix leaked of_node references - drm/amd/display: Fill prescale_params->scale for RGB565 - drm/amdgpu/sriov: Need to initialize the HDP_NONSURFACE_BAStE - drm/amd/display: Disable ABM before destroy ABM struct - drm/amdkfd: Fix a potential memory leak - drm/amdkfd: Fix sdma queue map issue - drm/edid: Fix a missing-check bug in drm_load_edid_firmware() - PCI: Return error if cannot probe VF - [armhf,arm64] gpu: host1x: Increase maximum DMA segment size - drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry - drm/crc-debugfs: Also sprinkle irqrestore over early exits - memstick: Fix error cleanup path of memstick_init - [arm64] tty: serial: msm_serial: avoid system lockup condition - serial: 8250: Fix TX interrupt handling condition - drm/amd/display: Always allocate initial connector state state - drm/virtio: Add memory barriers for capset cache. - drm/amd/display: fix compilation error - [ppc64el] pseries/mobility: prevent cpu hotplug during DT update - [armhf,arm64] drm/rockchip: Properly adjust to a true clock in adjusted_mode - [armhf] serial: imx: fix locking in set_termios() - tty: serial_core: Set port active bit in uart_port_activate - usb: gadget: Zero ffs_io_data - mmc: sdhci: sdhci-pci-o2micro: Check if controller supports 8-bit width - [ppc64el] pci/of: Fix OF flags parsing for 64bit BARs - [arm64] drm/msm: Depopulate platform on probe failure - [arm64] PCI: xilinx-nwl: Fix Multi MSI data programming - iio: iio-utils: Fix possible incorrect mask calculation - [ppc64el] cacheflush: fix variable set but not used - [ppc64el] xmon: Fix disabling tracing while in xmon - [ppc64el] recordmcount: Fix spurious mcount entries on powerpc - mfd: core: Set fwnode for created devices - [arm64] mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk - mm/swap: fix release_pages() when releasing devmap pages - RDMA/i40iw: Set queue pair state when being queried - IB/mlx5: Fixed reporting counters on 2nd port for Dual port RoCE - [ppc64el] mm: Handle page table allocation failures - IB/ipoib: Add child to parent list only if device initialized - [arm64] assembler: Switch ESB-instruction with a vanilla nop if !ARM64_HAS_RAS - perf stat: Fix use-after-freed pointer detected by the smatch tool - perf top: Fix potential NULL pointer dereference detected by the smatch tool - perf session: Fix potential NULL pointer dereference found by the smatch tool - perf annotate: Fix dereferencing freed memory found by the smatch tool - perf hists browser: Fix potential NULL pointer dereference found by the smatch tool - RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM - [armhf] PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB - [ppc64el] boot: add {get, put}_unaligned_be32 to xz_config.h - block: init flush rq ref count to 1 - f2fs: avoid out-of-range memory access - mailbox: handle failed named mailbox channel request - dlm: check if workqueues are NULL before flushing/destroying - [ppc64el] eeh: Handle hugepages in ioremap space - block/bio-integrity: fix a memory leak bug - 9p: pass the correct prototype to read_cache_page - mm/gup.c: mark undo_dev_pagemap as __maybe_unused - mm/gup.c: remove some BUG_ONs from get_gate_page() - memcg, fsnotify: no oom-kill for remote memcg charging - mm/mmu_notifier: use hlist_add_head_rcu() - proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup - proc: use down_read_killable mmap_sem for /proc/pid/pagemap - proc: use down_read_killable mmap_sem for /proc/pid/clear_refs - proc: use down_read_killable mmap_sem for /proc/pid/map_files - cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() - proc: use down_read_killable mmap_sem for /proc/pid/maps - locking/lockdep: Fix lock used or unused stats error - mm: use down_read_killable for locking mmap_sem in access_remote_vm - locking/lockdep: Hide unused 'class' variable - usb: wusbcore: fix unbalanced get/put cluster_id - [x86] usb: pci-quirks: Correct AMD PLL quirk detection - btrfs: inode: Don't compress if NODATASUM or NODATACOW set - [x86] sysfb_efi: Add quirks for some devices with swapped width and height - [x86] speculation/mds: Apply more accurate check on hypervisor platform - binder: prevent transactions to context manager from its own process. - fpga-manager: altera-ps-spi: Fix build error - [x86] mei: me: add mule creek canyon (EHL) device ids - [x86] hpet: Fix division by zero in hpet_time_div() - ALSA: ac97: Fix double free of ac97_codec_device - ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 - ALSA: hda - Add a conexant codec entry to let mute led work - [ppc64el] xive: Fix loop exit-condition in xive_find_target_in_mask() - libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl() - access: avoid the RCU grace period for the temporary subjective credentials https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.64 - [x86] hv_sock: Add support for delayed close - vsock: correct removal of socket from the list - NFS: Fix dentry revalidation on NFSv4 lookup - NFS: Refactor nfs_lookup_revalidate() - NFSv4: Fix lookup revalidate of regular files - [armhf,arm64] usb: dwc2: Disable all EP's on disconnect - [armhf,arm64] usb: dwc2: Fix disable all EP's on disconnect - [arm64] compat: Provide definition for COMPAT_SIGMINSTKSZ (Closes: #904385). - binder: fix possible UAF when freeing buffer - ISDN: hfcsusb: checking idx of ep configuration - media: au0828: fix null dereference in error path - ath10k: Change the warning message string - media: cpia2_usb: first wake up, then free in disconnect (CVE-2019-15215) - media: pvrusb2: use a different format for warnings - NFS: Cleanup if nfs_match_client is interrupted - media: radio-raremono: change devm_k*alloc to k*alloc (CVE-2019-15211) - [x86] iommu/vt-d: Don't queue_iova() if there is no flush queue - vhost: introduce vhost_exceeds_weight() - vhost_net: fix possible infinite loop (CVE-2019-3900) - vhost: vsock: add weight support - vhost: scsi: add weight support (CVE-2019-3900) - sched/fair: Don't free p->numa_faults with concurrent readers - sched/fair: Use RCU accessors consistently for ->numa_group - /proc//cmdline: remove all the special cases - /proc//cmdline: add back the setproctitle() special case - drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl - Fix allyesconfig output. - ceph: hold i_ceph_lock when removing caps for freeing inode - block, scsi: Change the preempt-only flag into a counter - scsi: core: Avoid that a kernel warning appears during system resume - ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.65 - [armhf] dts: rockchip: Make rk3288-veyron-minnie run at hs200 - [armhf] dts: rockchip: Make rk3288-veyron-mickey's emmc work again - [armhf] dts: rockchip: Mark that the rk3288 timer might stop in suspend - ftrace: Enable trampoline when rec count returns back to one - [armhf,arm64] dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag is unset - [arm64] dts: rockchip: fix isp iommu clocks and power domain - kernel/module.c: Only return -EEXIST for modules that have finished loading - [arm64] clk: tegra210: fix PLLU and PLLU_OUT1 - fs/adfs: super: fix use-after-free bug - btrfs: fix minimum number of chunk errors for DUP - btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit() - cifs: Fix a race condition with cifs_echo_request - ceph: fix improper use of smp_mb__before_atomic() - ceph: return -ERANGE if virtual xattr value didn't fit in buffer - ACPI: blacklist: fix clang warning for unused DMI table - [s390x] scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized - perf version: Fix segfault due to missing OPT_END() - [x86] kvm: avoid constant-conversion warning - ACPI: fix false-positive -Wuninitialized warning - be2net: Signal that the device cannot transmit during reconfiguration - [x86] apic: Silence -Wtype-limits compiler warnings - mm/cma.c: fail if fixed declaration can't be honored - lib/test_overflow.c: avoid tainting the kernel and fix wrap size - lib/test_string.c: avoid masking memset16/32/64 failures - coda: add error handling for fget - coda: fix build using bare-metal toolchain - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers - drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings - ipc/mqueue.c: only perform resource calculation if user valid - [x86] xen/pv: Fix a boot up hang revealed by int3 self test - [x86] kvm: Don't call kvm_spurious_fault() from .fixup - [x86] paravirt: Fix callee-saved function ELF sizes - [x86] boot: Remove multiple copy of static function sanitize_boot_params() - drm/nouveau: fix memory leak in nouveau_conn_reset() - kconfig: Clear "written" flag to avoid data loss - Btrfs: fix incremental send failure after deduplication - Btrfs: fix race leading to fs corruption after transaction abort - [armhf,arm64] mmc: dw_mmc: Fix occasional hang after tuning on eMMC - [arm64] mmc: meson-mx-sdio: Fix misuse of GENMASK macro - gpiolib: fix incorrect IRQ requesting of an active-low lineevent - IB/hfi1: Fix Spectre v1 vulnerability - mtd: rawnand: micron: handle on-die "ECC-off" devices correctly - selinux: fix memory leak in policydb_init() - ALSA: hda: Fix 1-minute detection delay when i915 module is not available (Closes: #931507) - mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker - [s390x] dasd: fix endless loop after read unit address configuration - [arm*] drivers/perf: arm_pmu: Fix failure path in PM notifier - [arm64] compat: Allow single-byte watchpoints on all addresses - [arm64] cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} - nbd: replace kill_bdev() with __invalidate_device() again - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() - IB/mlx5: Fix unreg_umr to ignore the mkey state - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache - IB/mlx5: Fix clean_mr() to work in the expected order - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification - IB/hfi1: Check for error on call to alloc_rsm_map_table - [x86] drm/i915/gvt: fix incorrect cache entry for guest page mapping - eeprom: at24: make spd world-readable again - objtool: Support GCC 9 cold subfunction naming scheme - gcc-9: properly declare the {pv,hv}clock_page storage - [x86] vdso: Prevent segfaults due to hoisted vclock reads - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.66 - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure - gcc-9: don't warn about uninitialized variable - driver core: Establish order of operations for device_add and device_del via bitflag - drivers/base: Introduce kill_device() - libnvdimm/bus: Prevent duplicate device_unregister() calls - libnvdimm/region: Register badblocks before namespaces - libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant - libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock - HID: wacom: fix bit shift for Cintiq Companion 2 - HID: Add quirk for HP X1200 PIXART OEM mouse - IB: directly cast the sockaddr union to aockaddr - atm: iphase: Fix Spectre v1 vulnerability - bnx2x: Disable multi-cos feature. - ife: error out when nla attributes are empty - ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6 - ip6_tunnel: fix possible use-after-free on xmit - ipip: validate header length in ipip_tunnel_xmit - [armhf,arm64] mvpp2: fix panic on module removal - [armhf,arm64] mvpp2: refactor MTU change code - net: bridge: delete local fdb on device init failure - net: bridge: mcast: don't delete permanent entries when fast leave is enabled - net: fix ifindex collision during namespace removal - net/mlx5e: always initialize frag->last_in_page - net/mlx5: Use reversed order when unregister devices - net: phylink: Fix flow control for fixed-link - net: sched: Fix a possible null-pointer dereference in dequeue_func() - net sched: update vlan action for batched events operations - net: sched: use temporary variable for actions indexes - net/smc: do not schedule tx_work in SMC_CLOSED state - tipc: compat: allow tipc commands without arguments - tun: mark small packets as owned by the tap sock - net/mlx5: Fix modify_cq_in alignment - net/mlx5e: Prevent encap flow counter update async to user query - r8169: don't use MSI before RTL8168d - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling - cgroup: Call cgroup_release() before __exit_signal() - cgroup: Implement css_task_iter_skip() - cgroup: Include dying leaders with live threads in PROCS iterations - cgroup: css_task_iter_skip()'d iterators must be advanced before accessed - cgroup: Fix css_task_iter_advance_css_set() cset skip condition - [arm*] spi: bcm2835: Fix 3-wire mode if DMA is enabled https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.67 - [x86] crypto: ccp - Fix oops by properly managing allocated structures - [x86] crypto: ccp - Add support for valid authsize values less than 16 - [x86] crypto: ccp - Ignore tag length when decrypting GCM ciphertext - usb: usbfs: fix double-free of usb memory upon submiturb error - usb: iowarrior: fix deadlock on disconnect - sound: fix a memory leak bug - [arm64,mips*/octeon] mmc: cavium: Set the correct dma max segment size for mmc_host - [arm64,mips*/octeon] mmc: cavium: Add the missing dma unmap when the dma has finished. - loop: set PF_MEMALLOC_NOIO for the worker thread - Input: usbtouchscreen - initialize PM mutex before using it - [x86] Input: elantech - enable SMBus on new (2018+) systems - [x86] Input: synaptics - enable RMI mode for HP Spectre X360 - [x86] mm: Check for pfn instead of page in vmalloc_sync_one() - [x86] mm: Sync also unmappings in vmalloc_sync_all() - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() - [s390x] perf annotate: Fix s390 gap between kernel end and module start - perf db-export: Fix thread__exec_comm() - [s390x] perf record: Fix module size on s390 - [x86] purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS - gfs2: gfs2_walk_metadata fix - usb: yurex: Fix use-after-free in yurex_delete - [x86] usb: typec: tcpm: free log buf memory when remove debug file - [x86] usb: typec: tcpm: remove tcpm dir if no children - [x86] usb: typec: tcpm: Add NULL check before dereferencing config - [x86] usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests - can: peak_usb: fix potential double kfree_skb() - netfilter: nfnetlink: avoid deadlock due to synchronous request_module - [s390x] vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn - netfilter: Fix rpfilter dropping vrf packets by mistake - netfilter: conntrack: always store window size un-scaled - netfilter: nft_hash: fix symhash with modulus one - drm/amd/display: Wait for backlight programming completion in set backlight level - drm/amd/display: use encoder's engine id to find matched free audio device - drm/amd/display: Fix dc_create failure handling and 666 color depths - drm/amd/display: Only enable audio if speaker allocation exists - drm/amd/display: Increase size of audios array - [x86] iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND - nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN - mac80211: don't warn about CW params when not using them - allocate_flower_entry: should check for null deref - hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 - drm: silence variable 'conn' set but not used - [s390x] qdio: add sanity checks to the fast-requeue path - ALSA: compress: Fix regression on compressed capture streams - ALSA: compress: Prevent bypasses of set_params - ALSA: compress: Don't allow paritial drain operations on capture streams - ALSA: compress: Be more restrictive about when a drain is allowed - perf tools: Fix proper buffer size for feature processing - perf probe: Avoid calling freeing routine multiple times for same pointer - drbd: dynamically allocate shash descriptor - ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() - nvme: fix multipath crash when ANA is deactivated - scsi: megaraid_sas: fix panic on loading firmware crashdump - [ppc64el] scsi: ibmvfc: fix WARN_ON during event pool release - scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG - test_firmware: fix a memory leak bug - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop - perf/core: Fix creating kernel counters for PMUs that override event->cpu - [s390x] dma: provide proper ARCH_ZONE_DMA_BITS value - HID: sony: Fix race condition between rumble and device remove. - [x86] purgatory: Do not use __builtin_memcpy and __builtin_memset - ALSA: usb-audio: fix a memory leak bug - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices - hwmon: (nct7802) Fix wrong detection of in4 presence - [x86] drm/i915: Fix wrong escape clock divisor init for GLK - ALSA: firewire: fix a memory leak bug - ALSA: hiface: fix multiple memory leak bugs - ALSA: hda - Don't override global PCM hw info flag - [x86] ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457) - mac80211: don't WARN on short WMM parameters from AP - dax: dax_layout_busy_page() should not unmap cow pages - SMB3: Fix deadlock in validate negotiate hits reconnect - smb3: send CAP_DFS capability during session setup - NFSv4: Fix an Oops in nfs4_do_setattr - [x86] KVM: Fix leak vCPU's VMCS value into other pCPU - mwifiex: fix 802.11n/WPA detection - iwlwifi: don't unmap as page memory that was mapped as single - iwlwifi: mvm: fix an out-of-bound access - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41 - iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support [ Steve McIntyre ] * [arm64] Improve support for the Huawei TaiShan server platform (Closes: #930554): - Enable the HNS/ROCE Infiniband driver - Backport fixes from 4.20 and 4.21 for HNS3 networking, hisi_sas SAS and HNS/ROCE Infiniband - Add module:drivers/scsi/hisi_sas/* to the ABI ignore list [ Uwe Kleine-König ] * [armhf] Add support for all i.MX6 variants. * rtc-s35390a: backport fix to make hwclock able to read the time (Closes: #932845) [ Ben Hutchings ] * [rt] Update to 4.19.59-rt24: - Fix build failure after "genirq: Prevent use-after-free and work list corruption": + Update "genirq: Do not invoke the affinity callback via a workqueue on RT" + kthread: add a global worker thread. + genirq: Do not invoke the affinity callback via a workqueue on RT + genirq: Handle missing work_struct in irq_set_affinity_notifier() - Update "irqwork: push most work into softirq context" to resolve conflict with "irq_work: Do not raise an IPI when queueing work on the local CPU" - Drop "random: avoid preempt_disable()ed section" - arm: imx6: cpuidle: Use raw_spinlock_t - rcu: Don't allow to change rcu_normal_after_boot on RT - sched/core: Drop a preempt_disable_rt() statement - timers: Redo the notification of canceling timers on -RT - Fix futex regression in 4.19.21: + Revert "futex: Ensure lock/unlock symetry versus pi_lock and hash bucket lock" + Revert "futex: Fix bug on when a requeued RT task times out" + Revert "rtmutex: Handle the various new futex race conditions" + Revert "futex: workaround migrate_disable/enable in different context" + futex: Make the futex_hash_bucket lock raw + futex: Delay deallocation of pi_state - mm/zswap: Do not disable preemption in zswap_frontswap_store() * Bump ABI to 6 -- Ben Hutchings Wed, 21 Aug 2019 17:44:57 +0100 linux (4.19.37-5+deb10u2) buster-security; urgency=high [ Romain Perier ] * [x86] x86/insn-eval: Fix use-after-free access to LDT entry (CVE-2019-13233) * [powerpc*] mm/64s/hash: Reallocate context ids on fork (CVE-2019-12817) * nfc: Ensure presence of required attributes in the deactivate_target handler (CVE-2019-12984) * binder: fix race between munmap() and direct reclaim (CVE-2019-1999) * scsi: libsas: fix a race condition when smp task timeout (CVE-2018-20836) * Input: gtco - bounds check collection indent level (CVE-2019-13631) * floppy: fix out-of-bounds read in copy_buffer (CVE-2019-14283) * inet: switch IP ID generator to siphash (CVE-2019-10638) * floppy: fix div-by-zero in setup_format_params (CVE-2019-14284) * Bluetooth: hci_uart: check for missing tty operations (CVE-2019-10207) * [powerpc/tm] Fix oops on sigreturn on systems without TM (CVE-2019-13648) [ Salvatore Bonaccorso ] * [x86] cpufeatures: Carve out CQM features retrieval * [x86] cpufeatures: Combine word 11 and 12 into a new scattered features word * [x86] speculation: Prepare entry code for Spectre v1 swapgs mitigations * [x86] speculation: Enable Spectre v1 swapgs mitigations (CVE-2019-1125) * [amd64] entry: Use JMP instead of JMPQ * [x86] speculation/swapgs: Exclude ATOMs from speculation through SWAPGS * Documentation: Add section about CPU vulnerabilities for Spectre * Documentation: Add swapgs description to the Spectre v1 documentation [ Ben Hutchings ] * [x86] cpufeatures: Avoid ABI change for swapgs mitigations: - Move swapgs feature bits to existing scattered words - Revert "x86/cpufeatures: Combine word 11 and 12 into a new scattered features word" * inet: Avoid ABI change for IP ID hash change -- Ben Hutchings Thu, 08 Aug 2019 03:02:38 +0100 linux (4.19.37-5+deb10u1) buster-security; urgency=high * tcp: refine memory limit test in tcp_fragment() (Closes: #930904) * ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (CVE-2019-13272) -- Salvatore Bonaccorso Fri, 19 Jul 2019 10:45:17 +0200 linux (4.19.37-5) unstable; urgency=medium [ Romain Perier ] * [sparc64] Fix device naming inconsistency between sunhv_console and sunhv_reg (Closes: #926539) [ Ben Hutchings ] * tcp: Avoid ABI change for DoS fixes (Closes: #930743) * Add ABI reference for 4.19.0-5 -- Ben Hutchings Wed, 19 Jun 2019 23:16:58 +0100 linux (4.19.37-4) unstable; urgency=high [ Ben Hutchings ] * libbpf: Fix various build bugs: - Drop unnecessary changes from "libbpf: add SONAME to shared object" - libbpf: Use only 2 components in soversion, matching package name (Closes: #929187) - libbpf: Build out-of-tree * README.source: Document the various makefiles and use of out-of-tree builds * [x86] lockdown,sysrq: Enable ALLOW_LOCKDOWN_LIFT_BY_SYSRQ (Closes: #929583) * mwifiex: Fix possible buffer overflows at parsing bss descriptor (CVE-2019-3846) * mwifiex: Abort at too short BSS descriptor element * mwifiex: Don't abort on small, spec-compliant vendor IEs * mm/mincore.c: make mincore() more conservative (CVE-2019-5489) * mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (CVE-2019-10126) * tcp: limit payload size of sacked skbs (CVE-2019-11477) * tcp: tcp_fragment() should apply sane memory limits (CVE-2019-11478) * tcp: add tcp_min_snd_mss sysctl (CVE-2019-11479) * tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() [ Romain Perier ] * [rt] Update to 4.19.37-rt20: - powerpc/pseries/iommu: Use a locallock instead local_irq_save() - powerpc: reshuffle TIF bits - tty/sysrq: Convert show_lock to raw_spinlock_t - drm/i915: Don't disable interrupts independently of the lock - sched/completion: Fix a lockup in wait_for_completion() [ Salvatore Bonaccorso ] * brcmfmac: assure SSID length from firmware is limited (CVE-2019-9500) * brcmfmac: add subtype check for event handling in data path (CVE-2019-9503) * ext4: zero out the unused memory region in the extent tree block (CVE-2019-11833) * Bluetooth: hidp: fix buffer overflow (CVE-2019-11884) [ Aurelien Jarno ] * [mips] Correctly bounds check virt_addr_valid (Closes: #929366) [ John Paul Adrian Glaubitz ] * [sparc64] udeb: Disable suffix for kernel-image [ Alper Nebi Yasak ] * udeb: input-modules: Include all keyboard driver modules * [arm64] udeb: kernel-image: Include cros_ec_spi and SPI drivers * [arm64] udeb: kernel-image: Include phy-rockchip-pcie * [arm64] udeb: usb-modules: Include phy-rockchip-typec, extcon-usbc-cros-ec * [arm64] udeb: mmc-modules: Include phy-rockchip-emmc * [arm64] udeb: fb-modules: Include rockchipdrm, panel-simple, pwm_bl and pwm-cros-ec -- Ben Hutchings Mon, 17 Jun 2019 20:00:22 +0100 linux (4.19.37-3) unstable; urgency=medium * [powerpc*] 64s: Include cpu header (fixes FTBFS) -- Ben Hutchings Wed, 15 May 2019 23:07:16 +0100 linux (4.19.37-2) unstable; urgency=high * debian/bin: Fix Python static checker regressions (Closes: #928618) * Clean up speculation mitigations: - Documentation/l1tf: Fix small spelling typo - x86/cpu: Sanitize FAM6_ATOM naming - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID - x86/msr-index: Cleanup bit defines - x86/speculation: Consolidate CPU whitelists - Documentation: Move L1TF to separate directory - cpu/speculation: Add 'mitigations=' cmdline option - x86/speculation: Support 'mitigations=' cmdline option - powerpc/speculation: Support 'mitigations=' cmdline option - s390/speculation: Support 'mitigations=' cmdline option - x86/speculation/mds: Add 'mitigations=' support for MDS * [x86] Mitigate Microarchitectural Data Sampling (MDS) vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091): - x86/speculation/mds: Add basic bug infrastructure for MDS - x86/speculation/mds: Add BUG_MSBDS_ONLY - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests - x86/speculation/mds: Add mds_clear_cpu_buffers() - x86/speculation/mds: Clear CPU buffers on exit to user - x86/kvm/vmx: Add MDS protection when L1D Flush is not active - x86/speculation/mds: Conditionally clear CPU buffers on idle entry - x86/speculation/mds: Add mitigation control for MDS - x86/speculation/mds: Add sysfs reporting for MDS - x86/speculation/mds: Add mitigation mode VMWERV - Documentation: Add MDS vulnerability documentation - x86/speculation/mds: Add mds=full,nosmt cmdline option - x86/speculation: Move arch_smt_update() call to after mitigation decisions - x86/speculation/mds: Add SMT warning message - x86/speculation/mds: Fix comment - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off - x86/mds: Add MDSUM variant to the MDS documentation - Documentation: Correct the possible MDS sysfs values - x86/speculation/mds: Fix documentation typo * [x86] linux-cpupower: Update CPPFLAGS for change in -- Ben Hutchings Tue, 14 May 2019 17:34:37 +0100 linux (4.19.37-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.29 - media: uvcvideo: Fix 'type' check leading to overflow - vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel - perf script: Fix crash with printing mixed trace point and other events - perf core: Fix perf_proc_update_handler() bug - perf tools: Handle TOPOLOGY headers with no CPU - perf script: Fix crash when processing recorded stat data - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM - [amd64] iommu/amd: Call free_iova_fast with pfn in map_sg - [amd64] iommu/amd: Unmap all mapped pages in error path of map_sg - [riscv64] fixup max_low_pfn with PFN_DOWN. - ipvs: Fix signed integer overflow when setsockopt timeout - [amd64] iommu/amd: Fix IOMMU page flush when detach device from a domain - [armhf] clk: ti: Fix error handling in ti_clk_parse_divider_data() - [arm64] clk: qcom: gcc: Use active only source for CPUSS clocks - [riscv64] Adjust mmap base address at a third of task size - IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start - iomap: get/put the page in iomap_page_create/release() - iomap: fix a use after free in iomap_dio_rw - [arm64] net: hns: Fix for missing of_node_put() after of_parse_phandle() - [arm64] net: hns: Restart autoneg need return failed when autoneg off - [arm64] net: hns: Fix wrong read accesses via Clause 45 MDIO protocol - [armhf,arm64] net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() - netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present - nfs: Fix NULL pointer dereference of dev_name - qed: Fix bug in tx promiscuous mode settings - qed: Fix LACP pdu drops for VFs - qed: Fix VF probe failure while FLR - qed: Fix system crash in ll2 xmit - qed: Fix stack out of bounds bug - scsi: libfc: free skb when receiving invalid flogi resp - scsi: scsi_debug: fix write_same with virtual_gb problem - scsi: bnx2fc: Fix error handling in probe() - scsi: 53c700: pass correct "dev" to dma_alloc_attrs() - net: macb: Apply RXUBR workaround only to versions with errata - [amd64] boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode - cifs: fix computation for MAX_SMB2_HDR_SIZE - [x86] microcode/amd: Don't falsely trick the late loading mechanism - [arm64] kprobe: Always blacklist the KVM world-switch code - apparmor: Fix aa_label_build() error handling for failed merges - [x86] kexec: Don't setup EFI info if EFI runtime is not enabled - proc: fix /proc/net/* after setns(2) - mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone - mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone - fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() - autofs: drop dentry reference only when it is never used - autofs: fix error return in autofs_fill_super() - mm, memory_hotplug: fix off-by-one in is_pageblock_removable - [armhf] OMAP: dts: N950/N9: fix onenand timings - [armhf] dts: omap4-droid4: Fix typo in cpcap IRQ flags - [armhf] dts: sun8i: h3: Add ethernet0 alias to Beelink X2 - [arm64] dts: meson: Fix IRQ trigger type for macirq - [arm64] dts: meson8b: odroidc1: mark the SD card detection GPIO active-low - [arm64] dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low - [arm64] dts: imx6sx: correct backward compatible of gpt - [armhf] pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 - wlcore: sdio: Fixup power on/off sequence - bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt() - [arm64] dts: add msm8996 compatible to gicv3 - batman-adv: release station info tidstats - [armhf,arm64] irqchip/gic-v4: Fix occasional VLPI drop - [armhf,arm64] irqchip/gic-v3-its: Gracefully fail on LPI exhaustion - drm/amdgpu: Add missing power attribute to APU check - drm/radeon: check if device is root before getting pci speed caps - drm/amdgpu: Transfer fences to dmabuf importer - [armhf,arm64] net: stmmac: Fallback to Platform Data clock in Watchdog conversion - [armhf,arm64] net: stmmac: Disable EEE mode earlier in XMIT callback - [armhf,arm64] irqchip/gic-v3-its: Fix ITT_entry_size accessor - relay: check return of create_buf_file() properly - bpf: fix potential deadlock in bpf_prog_register - bpf: Fix syscall's stackmap lookup potential deadlock - [armhf,arm64] drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init - vsock/virtio: fix kernel panic after device hot-unplug - vsock/virtio: reset connected sockets on device removal - netfilter: nf_nat: skip nat clash resolution for same-origin entries - [s390x] qeth: release cmd buffer in error paths - [s390x] qeth: fix use-after-free in error path - [s390x] qeth: cancel close_dev work before removing a card - perf symbols: Filter out hidden symbols from labels - perf trace: Support multiple "vfs_getname" probes - [mips*] Remove function size check in get_frame_info() - Revert "scsi: libfc: Add WARN_ON() when deleting rports" - [armhf] i2c: omap: Use noirq system sleep pm ops to idle device for suspend - drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr - nvme: lock NS list changes while handling command effects - nvme-pci: fix rapid add remove sequence - fs: ratelimit __find_get_block_slow() failure message. - qed: Fix EQ full firmware assert. - qed: Consider TX tcs while deriving the max num_queues for PF. - qede: Fix system crash on configuring channels. - blk-iolatency: fix IO hang due to negative inflight counter - nvme-pci: add missing unlock for reset error - Input: wacom_serial4 - add support for Wacom ArtPad II tablet - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 - [x86] iscsi_ibft: Fix missing break in switch statement - scsi: aacraid: Fix missing break in switch statement - [x86] PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub - [arm64] dts: zcu100-revC: Give wifi some time after power-on - [arm64] dts: hikey: Give wifi some time after power-on - [arm64] dts: hikey: Revert "Enable HS200 mode on eMMC" - [armhf] dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3 - [armhf] dts: exynos: Add minimal clkout parameters to Exynos3250 PMU - [armhf] dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4 - drm: disable uncached DMA optimization for ARM and arm64 (Closes: #923723) - netfilter: xt_TEE: fix wrong interface selection - netfilter: xt_TEE: add missing code to get interface index in checkentry. - gfs2: Fix missed wakeups in find_insert_glock - cifs: allow calling SMB2_xxx_free(NULL) (Closes: #919290) - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom - driver core: Postpone DMA tear-down until after devres release - [x86] perf/intel: Make cpuc allocations consistent - [x86] perf/intel: Generalize dynamic constraint creation - [x86] Add TSX Force Abort CPUID/MSR - [x86] perf/intel: Implement support for TSX Force Abort https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.30 - connector: fix unsafe usage of ->real_parent - gro_cells: make sure device is up in gro_cells_receive() - ipv4/route: fail early when inet dev is missing - l2tp: fix infoleak in l2tp_ip6_recvmsg() - lan743x: Fix RX Kernel Panic - lan743x: Fix TX Stall Issue - net: sit: fix UBSAN Undefined behaviour in check_6rd - net/x25: fix use-after-free in x25_device_event() - net/x25: reset state in x25_connect() - pptp: dst_release sk_dst_cache in pptp_sock_destruct - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race - rxrpc: Fix client call queueing, waiting for channel - sctp: remove sched init from sctp_stream_init - tcp: do not report TCP_CM_INQ of 0 for closed connections - tcp: Don't access TCP_SKB_CB before initializing it - tcp: handle inet_csk_reqsk_queue_add() failures - vxlan: Fix GRO cells race condition between receive and link delete - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() - net/mlx4_core: Fix reset flow when in command polling mode - net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling - net/mlx4_core: Fix qp mtt size calculation - net/x25: fix a race in x25_bind() - mdio_bus: Fix use-after-free on device_register fails - net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 - ipv6: route: purge exception on removal - team: use operstate consistently for linkup - ipvlan: disallow userns cap_net_admin to change global mode/flags - ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt() - ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink() - bonding: fix PACKET_ORIGDEV regression - net/smc: fix smc_poll in SMC_INIT state - af_unix: missing barriers in some of unix_sock ->addr and ->path accesses - net: sched: flower: insert new filter to idr after setting its mask - f2fs: wait on atomic writes to count F2FS_CP_WB_DATA - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 - ALSA: firewire-motu: fix construction of PCM frame for capture direction - [x86] ALSA: hda: Extend i915 component bind timeout - [x86] ALSA: hda - add more quirks for HP Z2 G4 and HP Z240 - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone - ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255 - [x86] perf/intel: Fix memory corruption - [x86] perf/intel: Make dev_attr_allow_tsx_force_abort static - md: It's wrong to add len to sector_nr in raid10 reshape twice - drm: Block fb changes for async plane updates - i40e: report correct statistics when XDP is enabled - vhost/vsock: fix vhost vsock cid hashing inconsistent https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.31 - media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() - 9p: use inode->i_lock to protect i_size_write() under 32-bit - 9p/net: fix memory leak in p9_client_create - [armhf] iio: adc: exynos-adc: Fix NULL pointer exception on unbind - [x86] mei: hbm: clean the feature flags on link reset - [x86] mei: bus: move hw module get/put to probe/release - crypto: cfb - add missing 'chunksize' property - crypto: cfb - remove bogus memcpy() with src == dest - crypto: ahash - fix another early termination in hash walk - [armhf] drm/imx: ignore plane updates on disabled crtcs - [armhf] drm/imx: imx-ldb: add missing of_node_puts - [x86] ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter - [armhf] clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting - [armhf,arm64] KVM: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock - [arm64] dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator - [s390x] dasd: fix using offset into zero size array error - Input: pwm-vibra - prevent unbalanced regulator - Input: pwm-vibra - stop regulator after disabling pwm, not before - [armhf] dts: Configure clock parent for pwm vibra - [armhf] OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized - ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables - [armhf,arm64] KVM: Reset the VCPU without preemption and vcpu state loaded - [armhf,arm64] KVM: Allow a VCPU to fully reset itself - [armhf,arm64] KVM: Don't panic on failure to properly reset system registers - [armhf,arm64] KVM: vgic: Always initialize the group of private IRQs - [arm64] KVM: Forbid kprobing of the VHE world-switch code - [armhf] OMAP2+: fix lack of timer interrupts on CPU1 after hotplug - mac80211: call drv_ibss_join() on restart - mac80211: Fix Tx aggregation session tear down with ITXQs - netfilter: compat: initialize all fields in xt_init - blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue - ipvs: fix dependency on nf_defrag_ipv6 - floppy: check_events callback should not return a negative number - xprtrdma: Make sure Send CQ is allocated on an existing compvec - NFS: Don't use page_file_mapping after removing the page - mm/gup: fix gup_pmd_range() for dax - Revert "mm: use early_pfn_to_nid in page_ext_init" - scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd - [armhf] net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend() - [x86] CPU: Add Icelake model number - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs - [arm64] net: hns: Fix object reference leaks in hns_dsaf_roce_reset() - [arm*] i2c: bcm2835: Clear current buffer pointers and counts after a transfer - [armhf] clk: sunxi-ng: v3s: Fix TCON reset de-assert bit - kallsyms: Handle too long symbols in kallsyms.c - [armhf] clk: sunxi: A31: Fix wrong AHB gate number - esp: Skip TX bytes accounting when sending from a request socket - [armhf] 8824/1: fix a migrating irq bug when hotplug cpu - bpf: only adjust gso_size on bytestream protocols - bpf: fix lockdep false positive in stackmap - af_key: unconditionally clone on broadcast - [armhf] 8835/1: dma-mapping: Clear DMA ops on teardown - assoc_array: Fix shortcut creation - keys: Fix dependency loop between construction record and auth key - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task - [armhf] net: dsa: bcm_sf2: Do not assume DSA master supports WoL - [arm64] pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins - qmi_wwan: apply SET_DTR quirk to Sierra WP7607 - net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() - xfrm: Fix inbound traffic via XFRM interfaces across network namespaces - ASoC: topology: free created components in tplg load error - qed: Fix iWARP buffer size provided for syn packet processing. - qed: Fix iWARP syn packet mac address validation. - [armhf] dts: armada-xp: fix Armada XP boards NAND description - [arm64] Relax GIC version check during early boot - [armhf] tegra: Restore DT ABI on Tegra124 Chromebooks - [armhf,arm64] net: marvell: mvneta: fix DMA debug warning - mm: handle lru_add_drain_all for UP properly - tmpfs: fix link accounting when a tmpfile is linked in - ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN - phonet: fix building with clang - mac80211_hwsim: propagate genlmsg_reply return code - bpf, lpm: fix lookup bug in map_delete_elem - [arm64] net: thunderx: make CFG_DONE message to run through generic send-ack sequence - [arm64] net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task - nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K - nfp: bpf: fix ALU32 high bits clearance bug - bnxt_en: Fix typo in firmware message timeout logic. - bnxt_en: Wait longer for the firmware message response to complete. - net: set static variable an initial value in atl2_probe() - tmpfs: fix uninitialized return value in shmem_link - stm class: Prevent division by zero - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place - acpi/nfit: Fix bus command validation - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot - nfit/ars: Attempt short-ARS even in the no_init_ars case - [amd64] libnvdimm/label: Clear 'updating' flag after label-set update - [amd64] libnvdimm, pfn: Fix over-trim in trim_pfn_device() - [amd64] libnvdimm/pmem: Honor force_raw for legacy pmem regions - [amd64] libnvdimm: Fix altmap reservation size calculation - cgroupfs: fix cgroup_do_mount() handling of failure exits - crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails - crypto: aegis - fix handling chunked inputs - [arm64] crypto: aes-neonbs - fix returning final keystream block - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails - crypto: morus - fix handling chunked inputs - crypto: pcbc - remove bogus memcpy()s with src == dest - crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails - crypto: testmgr - skip crc32c context test for ahash algorithms - [x86] crypto: aegis - fix handling chunked inputs and MAY_SLEEP - [x86] crypto: aesni-gcm - fix crash on empty plaintext - [x86] crypto: morus - fix handling chunked inputs and MAY_SLEEP - [arm64] crypto: aes-ccm - fix logical bug in AAD MAC handling - [arm64] crypto: aes-ccm - fix bugs in non-NEON fallback routine - CIFS: Do not reset lease state to NONE on lease break - CIFS: Do not skip SMB2 message IDs on send failures - CIFS: Fix read after write for files with read caching - tracing: Use strncpy instead of memcpy for string keys in hist triggers - tracing: Do not free iter->trace in fail path of tracing_open_pipe() - tracing/perf: Use strndup_user() instead of buggy open-coded version - xen: fix dom0 boot on huge systems - ACPI / device_sysfs: Avoid OF modalias creation for removed device - [armhf] mmc: sdhci-esdhc-imx: fix HS400 timing issue - mmc:fix a bug when max_discard is 0 - netfilter: ipt_CLUSTERIP: fix warning unused variable cn - [armhf] spi: ti-qspi: Fix mmap read when more than one CS in use - [amd64] spi: pxa2xx: Setup maximum supported DMA transfer length - [armhf] regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 - [arm64] regulator: max77620: Initialize values for DT properties - [armhf] regulator: s2mpa01: Fix step values for some LDOs - [armhf] clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR - [armhf] clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown - [arm64] clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability (Closes: #928457) - [s390x] setup: fix early warning messages - [s390x] virtio: handle find on invalid queue gracefully - scsi: virtio_scsi: don't send sc payload with tmfs - scsi: aacraid: Fix performance issue on logical drives - scsi: sd: Optimal I/O size should be a multiple of physical block size - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock - scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware - fs/devpts: always delete dcache dentry-s in dput() - splice: don't merge into linked buffers - ovl: During copy up, first copy up data and then xattrs - ovl: Do not lose security.capability xattr over metadata file copy-up - Btrfs: setup a nofs context for memory allocation at btrfs_create_tree() - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes - Btrfs: fix corruption reading shared and compressed extents after hole punching - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer - [armhf,arm64] irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table - [x86] kprobes: Prohibit probing on optprobe template code - [armhf,arm64] cpufreq: tegra124: add missing of_node_put() - ext4: fix check of inode in swap_inode_boot_loader - ext4: cleanup pagecache before swap i_data - ext4: update quota information while swapping boot loader inode - ext4: add mask of ext4 flags to swap - ext4: fix crash during online resizing - PCI/ASPM: Use LTR if already enabled by platform - PCI/DPC: Fix print AER status in DPC event handling - [armhf,arm64] PCI: dwc: skip MSI init if MSIs have been explicitly disabled - IB/hfi1: Close race condition on user context disable and close - [armhf] clk: clk-twl6040: Fix imprecise external abort for pdmclk - [armhf] clk: samsung: exynos5: Fix possible NULL pointer exception on platform_device_alloc() failure - [armhf] clk: samsung: exynos5: Fix kfree() of const memory on setting driver_override - [armhf,arm64] usb: chipidea: tegra: Fix missed ci_hdrc_remove_device() - [x86] usb: typec: tps6598x: handle block writes separately with plain-I2C adapters - mm: hwpoison: fix thp split handing in soft_offline_in_use_page() - mm/vmalloc: fix size check for remap_vmalloc_range_partial() - mm/memory.c: do_fault: avoid usage of stale vm_area_struct - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv - device property: Fix the length used in PROPERTY_ENTRY_STRING() - [x86] intel_th: Don't reference unassigned outputs - parport_pc: fix find_superio io compare code, should use equal test. - [armhf,arm64] i2c: tegra: fix maximum transfer size - [armhf,arm64] gpio: pca953x: Fix dereference of irq data in shutdown - [armhf] can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument - [x86] drm/i915: Relax mmap VMA check - bpf: only test gso type on gso packets - [arm64] serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart - serial: 8250_pci: Fix number of ports for ACCES serial cards - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() - jbd2: clear dirty flag when revoking a buffer from an older transaction - jbd2: fix compile warning when using JBUFFER_TRACE - selinux: add the missing walk_size + len check in selinux_sctp_bind_connect - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock - [powerpc*] powerpc/32: Clear on-stack exception marker upon exception return - [powerpc*] powernv: Make opal log only readable by root - [powerpc*] powernv: Don't reprogram SLW image on every KVM guest entry/exit - [powerpc*] Fix 32-bit KVM-PR lockup and host crash with MacOS guest - [powerpc*] ptrace: Simplify vr_get/set() to avoid GCC warning - [powerpc*] hugetlb: Don't do runtime allocation of 16G pages in LPAR configuration - [powerpc*] traps: fix recoverability of machine check handling on book3s/32 - [powerpc*] traps: Fix the message printed when stack overflows - [arm64] Fix HCR.TGE status for NMI contexts - [arm64] debug: Ensure debug handlers check triggering exception level - [arm64] KVM: Fix architecturally invalid reset value for FPEXC32_EL2 - ipmi_si: fix use-after-free of resource->name - dm: fix to_sector() for 32bit - dm integrity: limit the rate of error messages - mfd: sm501: Fix potential NULL pointer dereference - NFS: Fix I/O request leakages - NFS: Fix an I/O request leakage in nfs_do_recoalesce - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() - nfsd: fix performance-limiting session calculation - nfsd: fix memory corruption caused by readdir - nfsd: fix wrong check in write_v4_end_grace() - NFSv4.1: Reinitialise sequence results before retransmitting a request - svcrpc: fix UDP on servers with lots of threads - PM / wakeup: Rework wakeup source timer cancellation - bcache: never writeback a discard operation - vt: perform safe console erase in the right order - [x86] unwind/orc: Fix ORC unwind table alignment - [x86] perf intel-pt: Fix CYC timestamp calculation after OVF - perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols - perf auxtrace: Define auxtrace record alignment - [x86] perf intel-pt: Fix overlap calculation for padding - [x86] perf/intel/uncore: Fix client IMC events return huge result - [x86] perf intel-pt: Fix divide by zero when TSC is not available - md: Fix failed allocation of md_register_thread - [x86] tpm/tpm_crb: Avoid unaligned reads in crb_recv() - tpm: Unify the send callback behaviour - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt - media: lgdt330x: fix lock status reporting - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming - drm/fb-helper: generic: Fix drm_fbdev_client_restore() - drm/radeon/evergreen_cs: fix missing break in switch statement - drm/amd/powerplay: correct power reading on fiji - drm/amd/display: don't call dm_pp_ function from an fpu block - KVM: Call kvm_arch_memslots_updated() before updating memslots - [x86] KVM: mmu: Detect MMIO generation wrap in any address space - [x86] KVM: mmu: Do not cache MMIO accesses while memslots are in flux - [x86] KVM: nVMX: Sign extend displacements of VMX instr's mem operands - [x86] KVM: nVMX: Apply addr size mask to effective address for VMX instructions - [x86] KVM: nVMX: Ignore limit checks on VMX instructions using flat segments - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata - [s390x] setup: fix boot crash for machine without EDAT-1 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.32 - [x86] ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist - ALSA: firewire-motu: use 'version' field of unit directory to identify model - [x86] drm/vmwgfx: Don't double-free the mode stored in par->set_mode - [x86] drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's - [amd64] iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE - libceph: wait for latest osdmap in ceph_monc_blacklist_add() - udf: Fix crash on IO error during truncate - [mips64*/loongson-3] lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. - [mips*] Ensure ELF appended dtb is relocated - [mips*r6] Fix kernel crash for R6 in jump label branch function - [powerpc*] vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 - [powerpc*] scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton - [powerpc*] scsi: ibmvscsi: Fix empty event pool access during host removal - futex: Ensure that futex address is aligned in handle_futex_death() - cifs: allow guest mounts to work for smb3.11 - perf probe: Fix getting the kernel map - [x86] objtool: Move objtool_file struct off the stack - [armhf,arm64] irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp - SMB3: Fix SMB3.1.1 guest mounts to Samba - [x86] ALSA: Fix runtime PM for hdmi-lpe-audio - ALSA: hda/ca0132 - make pci_iounmap() call conditional - ALSA: ac97: Fix of-node refcount unbalance - ext4: fix NULL pointer dereference while journal is aborted - ext4: fix data corruption caused by unaligned direct AIO - ext4: brelse all indirect buffer in ext4_ind_remove_space() - media: v4l2-ctrls.c/uvc: zero v4l2_event - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() - Bluetooth: Fix decrementing reference count twice in releasing socket - Bluetooth: hci_ldisc: Initialize hci_dev before open() - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() - drm: Reorder set_property_atomic to avoid returning with an active ww_ctx - RDMA/cma: Rollback source IP address if failing to acquire device - f2fs: fix to avoid deadlock of atomic file operations - netfilter: ebtables: remove BUGPRINT messages - loop: access lo_backing_file only when the loop device is Lo_bound - [x86] unwind: Handle NULL pointer calls better in frame unwinder - [x86] unwind: Add hardcoded ORC entry for NULL - ALSA: hda - Record the current power state before suspend/resume calls - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec - power: supply: charger-manager: Fix incorrect return value https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.33 - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt (CVE-2019-3460) - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer (CVE-2019-3459) - ipmi_si: Fix crash when using hard-coded device - dccp: do not use ipv6 header for ipv4 flow - genetlink: Fix a memory leak on error path - ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL - mac8390: Fix mmio access size probe - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6 - net: datagram: fix unbounded loop in __skb_try_recv_datagram() - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec - [arm64] net: phy: meson-gxl: fix interrupt support - net: rose: fix a possible stack overflow - [armhf,arm64] net: stmmac: fix memory corruption with large MTUs - net-sysfs: call dev_hold if kobject_init_and_add success - packets: Always register packet sk in the same order - rhashtable: Still do rehash when we get EEXIST - sctp: get sctphdr by offset in sctp_compute_cksum - sctp: use memdup_user instead of vmemdup_user - tcp: do not use ipv6 header for ipv4 flow - tipc: allow service ranges to be connect()'ed on RDM/DGRAM - tipc: change to check tipc_own_id to return in tipc_net_stop - tipc: fix cancellation of topology subscriptions - tun: properly test for IFF_UP - vrf: prevent adding upper devices - vxlan: Don't call gro_cells_destroy() before device is unregistered - ila: Fix rhashtable walker list corruption - net: sched: fix cleanup NULL pointer exception in act_mirr - [arm64] thunderx: enable page recycling for non-XDP case - [arm64] thunderx: eliminate extra calls to put_page() for pages held for recycling - tun: add a missing rcu_read_unlock() in error path - [powerpcspe] fsl: Add infrastructure to fixup branch predictor flush - [powerpcspe] fsl: Add macro to flush the branch predictor - [powerpcspe] fsl: Emulate SPRN_BUCSR register - [powerpcspe] fsl: Add nospectre_v2 command line argument - [powerpcspe] fsl: Flush the branch predictor at each kernel entry (32 bit) - [powerpcspe] fsl: Enable runtime patching if nospectre_v2 boot arg is used - [powerpcspe] fsl: Update Spectre v2 reporting - [powerpcspe] fsl: Fixed warning: orphan section `__btb_flush_fixup' - [powerpc*] security: Fix spectre_v2 reporting - Btrfs: fix incorrect file size after shrinking truncate and fsync - btrfs: remove WARN_ON in log_dir_items - btrfs: don't report readahead errors and don't update statistics - btrfs: raid56: properly unmap parity page in finish_parity_scrub() - btrfs: Avoid possible qgroup_rsv_size overflow in btrfs_calculate_inode_block_rsv_size - Btrfs: fix assertion failure on fsync with NO_HOLES enabled - [armhf] imx6q: cpuidle: fix bug that CPU might not wake up at expected time - [powerpc*] bpf: Fix generation of load/store DW instructions - [s390x] vfio: ccw: only free cp on final interrupt - NFS: fix mount/umount race in nlmclnt. - NFSv4.1 don't free interrupted slot on open - ALSA: rawmidi: Fix potential Spectre v1 vulnerability - ALSA: seq: oss: Fix Spectre v1 vulnerability - ALSA: pcm: Fix possible OOB access in PCM oss plugins - ALSA: pcm: Don't suspend stream in unrecoverable PCM state - [x86] ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO - [x86] ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB - [x86] ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286 - [x86] ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 - [x86] ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic - [x86] ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 - [x86] ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 - [x86] ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256 - [x86] ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops - kbuild: modversions: Fix relative CRC byte order interpretation - fs/open.c: allow opening only regular files during execve() - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock - scsi: sd: Fix a race between closing an sd device and sd I/O - scsi: sd: Quiesce warning if device does not report optimal I/O size - [s390x] scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host - [s390x] scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices - [armhf,arm64] drm/rockchip: vop: reset scale mode when win is disabled - [x86] staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest - staging: speakup_soft: Fix alternate speech with other synths - staging: vt6655: Remove vif check from vnt_interrupt - staging: vt6655: Fix interrupt race condition on device start up. - [arm64] serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference - [sh4] serial: sh-sci: Fix setting SCSCR_TIE while transferring data - USB: serial: cp210x: add new device id - USB: serial: ftdi_sio: add additional NovaTech products - USB: serial: mos7720: fix mos_parport refcount imbalance on error path - USB: serial: option: set driver_info for SIM5218 and compatibles - USB: serial: option: add support for Quectel EM12 - USB: serial: option: add Olicard 600 - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links - drm/vgem: fix use-after-free when drm_gem_handle_create() fails - [x86] drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check - gpio: exar: add a check for the return value of ida_simple_get fails - [armhf,arm64] phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs - USB: gadget: f_hid: fix deadlock in f_hidg_write() - usb: common: Consider only available nodes for dr_mode - xhci: Fix port resume done detection for SS ports with LPM enabled - usb: xhci: dbc: Don't free all memory with spinlock held - xhci: Don't let USB3 ports stuck in polling state prevent suspend - usb: cdc-acm: fix race during wakeup blocking TX traffic - mm: add support for kmem caches in DMA32 zone - [armhf,arm64] iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate - perf pmu: Fix parser error for uncore event alias - [x86] perf intel-pt: Fix TSC slip - [x86] objtool: Query pkg-config for libelf location - [powerpc*] pseries/energy: Use OF accessor functions to read ibm,drc-indexes - [powerpc*] powerpc/64: Fix memcmp reading past the end of src/dest - watchdog: Respect watchdog cpumask on CPU hotplug - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n - KVM: Reject device ioctls from processes other than the VM's creator - [x86] KVM: update %rip after emulating IO - [x86] KVM: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts - bpf: do not restore dst_reg when cur_state is freed - [x86] platform: intel_cht_int33fe: Register all connections at once - [x86] platform: intel_cht_int33fe: Add connection for the DP alt mode - [x86] platform: intel_cht_int33fe: Add connections for the USB Type-C port - usb: typec: class: Don't use port parent for getting mux handles - [x86] platform: intel_cht_int33fe: Remove the old connections for the muxes https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.34 - [arm64] debug: Don't propagate UNKNOWN FAR into si_code for debug signals - ext4: cleanup bh release code in ext4_ind_remove_space() - CIFS: fix POSIX lock leak and invalid ptr deref - f2fs: fix to adapt small inline xattr space in __find_inline_xattr() - f2fs: fix to avoid deadlock in f2fs_read_inline_dir() - tracing: kdb: Fix ftdump to not sleep - net/mlx5: Avoid panic when setting vport rate - net/mlx5: Avoid panic when setting vport mac, getting vport config - [armhf] gpio: gpio-omap: fix level interrupt idling - sysctl: handle overflow for file-max - [armhf,arm64] net: stmmac: Avoid sometimes uninitialized Clang warnings - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK - [arm64] scsi: hisi_sas: Set PHY linkrate when disconnected - [arm64] scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO - iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver - [x86] hyperv: Fix kernel panic when kexec on HyperV - perf c2c: Fix c2c report for empty numa node - mm/sparse: fix a bad comparison - mm/cma.c: cma_declare_contiguous: correct err handling - mm/page_ext.c: fix an imbalance with kmemleak - mm, swap: bounds check swap_info array accesses to avoid NULL derefs - mm,oom: don't kill global init via memory.oom.group - memcg: killed threads should not invoke memcg OOM killer - mm, mempolicy: fix uninit memory access - mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! - mm/slab.c: kmemleak no scan alien caches - ocfs2: fix a panic problem caused by o2cb_ctl - f2fs: do not use mutex lock in atomic context - fs/file.c: initialize init_files.resize_wait - page_poison: play nicely with KASAN - cifs: use correct format characters - dm thin: add sanity checks to thin-pool and external snapshot creation - f2fs: fix to check inline_xattr_size boundary correctly - cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED - cifs: Fix NULL pointer dereference of devname - netfilter: nf_tables: check the result of dereferencing base_chain->stats - netfilter: conntrack: tcp: only close if RST matches exact sequence - jbd2: fix invalid descriptor block checksum - fs: fix guard_bio_eod to check for real EOD errors - tools lib traceevent: Fix buffer overflow in arg_eval - PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() - wil6210: check null pointer in _wil_cfg80211_merge_extra_ies - mt76: fix a leaked reference by adding a missing of_node_put - [armhf,arm64] usb: chipidea: Grab the (legacy) USB PHY by phandle first - [powerpc*] powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables - scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c - [powerpc*] xmon: Fix opcode being uninitialized in print_insn_powerpc - [armhf,arm64] coresight: etm4x: Add support to enable ETMv4.2 - [armhf] 8840/1: use a raw_spinlock_t in unwind - [armhf,arm64] iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables - [powerpc*] hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback - btrfs: qgroup: Make qgroup async transaction commit more aggressive - [armhf] mmc: omap: fix the maximum timeout setting - [armhf.arm64] net: dsa: mv88e6xxx: Add lockdep classes to fix false positive splat - e1000e: Fix -Wformat-truncation warnings - [x86] platform: ideapad-laptop: Fix no_hw_rfkill_list for Lenovo RESCUER R720-15IKBN - loop: set GENHD_FL_NO_PART_SCAN after blkdev_reread_part() - IB/mlx4: Increase the timeout for CM cache - clk: fractional-divider: check parent rate only if flag is set - perf annotate: Fix getting source line failure - [arm64] ASoC: qcom: Fix of-node refcount unbalance in qcom_snd_parse_of() - cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies - efi: cper: Fix possible out-of-bounds access - [s390x] ism: ignore some errors during deregistration - scsi: megaraid_sas: return error when create DMA pool failed - scsi: fcoe: make use of fip_mode enum complete - drm/amd/display: Clear stream->mode_changed after commit - [s390x] perf test: Fix failure of 'evsel-tp-sched' test on s390 - mwifiex: don't advertise IBSS features without FW support - perf report: Don't shadow inlined symbol with different addr range - [armhf] SoC: imx-sgtl5000: add missing put_device() - mt76: usb: do not run mt76u_queues_deinit twice - xen/gntdev: Do not destroy context while dma-bufs are in use - vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1 - [x86] HID: intel-ish-hid: avoid binding wrong ishtp_cl_device - cgroup, rstat: Don't flush subtree root unless necessary - jbd2: fix race when writing superblock - [s390x] perf report: Add s390 diagnosic sampling descriptor size - iwlwifi: pcie: fix emergency path - ACPI / video: Refactor and fix dmi_is_desktop() - kprobes: Prohibit probing on bsearch() - kprobes: Prohibit probing on RCU debug routine - netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm - [armhf] 8833/1: Ensure that NEON code always compiles with Clang - ALSA: PCM: check if ops are defined before suspending PCM - ath10k: fix shadow register implementation for WCN3990 - usb: f_fs: Avoid crash due to out-of-scope stack ptr access - sched/topology: Fix percpu data types in struct sd_data & struct s_data - bcache: fix input overflow to cache set sysfs file io_error_halflife - bcache: fix input overflow to sequential_cutoff - bcache: fix potential div-zero error of writeback_rate_i_term_inverse - bcache: improve sysfs_strtoul_clamp() - genirq: Avoid summation loops for /proc/stat - [armhf,arm64] net: marvell: mvpp2: fix stuck in-band SGMII negotiation - iw_cxgb4: fix srqidx leak during connection abort - net: phy: consider latched link-down status in polling mode - fbdev: fbmem: fix memory access if logo is bigger than the screen - cdrom: Fix race condition in cdrom_sysctl_register - drm: rcar-du: add missing of_node_put - drm/amd/display: Don't re-program planes for DPMS changes - drm/amd/display: Disconnect mpcc when changing tg - perf/aux: Make perf_event accessible to setup_aux() - e1000e: fix cyclic resets at link up with active tx - e1000e: Exclude device from suspend direct complete optimization - [x86] platform: intel_pmc_core: Fix PCH IP sts reading - i2c: of: Try to find an I2C adapter matching the parent - iwlwifi: mvm: fix RFH config command with >=10 CPUs - sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK - efi/memattr: Don't bail on zero VA if it equals the region's PA - sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/ task_rq_lock() - drm/vkms: Bugfix extra vblank frame - [armhf] dts: lpc32xx: Remove leading 0x and 0s from bindings notation - [armhf,arm64] efi: Allow SetVirtualAddressMap() to be omitted - [arm64] soc: qcom: gsbi: Fix error handling in gsbi_probe() - mt7601u: bump supported EEPROM version - [armhf] 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of - [armhf] avoid Cortex-A9 livelock on tight dmb loops - block, bfq: fix in-service-queue check for queue merging - [powerpc*] 64s: Clear on-stack exception marker upon exception return - cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting - [armhf,arm64] backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state - tty: increase the default flip buffer limit to 2*640K - [powerpc*] pseries: Perform full re-add of CPU for topology update post-migration - drm/amd/display: Enable vblank interrupt during CRC capture - ALSA: dice: add support for Solid State Logic Duende Classic/Mini - [armhf,arm64] usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded - [x86] platform: intel-hid: Missing power button release on some Dell models - perf script python: Use PyBytes for attr in trace-event-python - perf script python: Add trace_context extension module to sys.modules - hwrng: virtio - Avoid repeated init of completion - [armhf,arm64] soc/tegra: fuse: Fix illegal free of IO base address - [x86] HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit - f2fs: UBSAN: set boolean value iostat_enable correctly - hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable - [armhf] dmaengine: imx-dma: fix warning comparison of distinct pointer types - [arm64] dmaengine: qcom_hidma: assign channel cookie correctly - [arm64] dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_* - netfilter: physdev: relax br_netfilter dependency - [armhf] regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting - [arm64] pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins - drm: Auto-set allow_fb_modifiers when given modifiers at plane init - drm/nouveau: Stop using drm_crtc_force_disable - selinux: do not override context on context mounts - brcmfmac: Use firmware_request_nowarn for the clm_blob - [armhf,arm64] wlcore: Fix memory leak in case wl12xx_fetch_firmware failure - drm/fb-helper: fix leaks in error path of drm_fb_helper_fbdev_setup - [arm64] clk: rockchip: fix frac settings of GPLL clock for rk3328 - [armhf,arm64] dmaengine: tegra: avoid overflow of byte tracking - [x86] Input: soc_button_array - fix mapping of the 5th GPIO in a PNP0C40 device - drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers - ACPI / video: Extend chassis-type detection with a "Lunch Box" check - bcache: fix potential div-zero error of writeback_rate_p_term_inverse - [x86] kprobes: Blacklist non-attachable interrupt functions https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.35 - [x86] kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT - [powerpc*] tm: Limit TM code inside PPC_TRANSACTIONAL_MEM - [x86] hv_netvsc: Fix unwanted wakeup after tx_disable - ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type - ipv6: Fix dangling pointer when ipv6 fragment - ipv6: sit: reset ip header pointer in ipip6_rcv - net: ethtool: not call vzalloc for zero sized memory request - net-gro: Fix GRO flush when receiving a GSO packet. - net/mlx5: Decrease default mr cache size - netns: provide pure entropy for net_hash_mix() - net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock(). - net/sched: act_sample: fix divide by zero in the traffic path - net/sched: fix ->get helper of the matchall cls - openvswitch: fix flow actions reallocation - qmi_wwan: add Olicard 600 - r8169: disable ASPM again - sctp: initialize _pad of sockaddr_in before copying to user memory - tcp: Ensure DCTCP reacts to losses - tcp: fix a potential NULL pointer dereference in tcp_sk_exit - vrf: check accept_source_route on the original netdevice - net/mlx5e: Fix error handling when refreshing TIRs - net/mlx5e: Add a lock on tir list - nfp: validate the return code from dev_queue_xmit() - nfp: disable netpoll on representors - bnxt_en: Improve RX consumer index validity check. - bnxt_en: Reset device on RX buffer errors. - net: ip_gre: fix possible use-after-free in erspan_rcv - net: ip6_gre: fix possible use-after-free in ip6erspan_rcv - net: core: netif_receive_skb_list: unlist skb before passing to pt->func - r8169: disable default rx interrupt coalescing on RTL8168 (Closes: #925496) - net: mlx5: Add a missing check on idr_find, free buf - net/mlx5e: Update xoff formula - net/mlx5e: Update xon formula - kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used - netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr - netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too - [arm64] kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region - [x86] tty: mark Siemens R3964 line discipline as BROKEN (CVE-2019-11486) - tty: ldisc: add sysctl to prevent autoloading of ldiscs - ACPICA: Clear status of GPEs before enabling them - ACPICA: Namespace: remove address node from global list after method termination - ALSA: seq: Fix OOB-reads from strlcpy - [x86] ALSA: hda/realtek: Enable headset MIC of Acer TravelMate B114-21 with ALC233 - [x86] ALSA: hda/realtek - Add quirk for Tuxedo XC 1509 - [x86] ALSA: hda - Add two more machines to the power_save_blacklist - mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd() - [arm64] dts: rockchip: fix rk3328 sdmmc0 write errors - [hppa] Detect QEMU earlier in boot process - [hppa] regs_return_value() should return gpr28 - [hppa] also set iaoq_b in instruction_pointer_set() - alarmtimer: Return correct remaining time - drm/udl: add a release method and delay modeset teardown - [x86] kvm: svm: fix potential get_num_contig_pages overflow - include/linux/bitrev.h: fix constant bitrev - mm: writeback: use exact memcg dirty counts - [x86] ASoC: intel: Fix crash at suspend/resume after failed codec registration - Btrfs: do not allow trimming when a fs is mounted with the nologreplay option - btrfs: prop: fix zstd compression parameter validation - btrfs: prop: fix vanished compression property after failed set - [riscv64] Fix syscall_get_arguments() and syscall_set_arguments() - block: do not leak memory in bio_copy_user_iov() - block: fix the return errno for direct IO - genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent() - genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n - virtio: Honour 'may_reduce_num' in vring_create_virtqueue - [armhf] dts: rockchip: fix rk3288 cpu opp node reference - [armhf] dts: am335x-evmsk: Correct the regulators for the audio codec - [armhf] dts: am335x-evm: Correct the regulators for the audio codec - [arm64] futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value - [arm64] dts: rockchip: fix rk3328 rgmii high tx error rate - [arm64] backtrace: Don't bother trying to unwind the userspace stack - xen: Prevent buffer overflow in privcmd ioctl - sched/fair: Do not re-read ->h_load_next during hierarchical load calculation - [x86] asm: Use stricter assembly constraints in bitops - [x86] perf/amd: Resolve race condition when disabling PMC - [x86] perf/amd: Resolve NMI latency issues for active PMCs - [x86] perf/amd: Remove need to check "running" bit in NMI handler - PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller - PCI: pciehp: Ignore Link State Changes after powering off a slot - dm integrity: change memcmp to strncmp in dm_integrity_ctr - dm: revert 8f50e358153d ("dm: limit the max bio size as BIO_MAX_PAGES * PAGE_SIZE") - dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors - dm integrity: fix deadlock with overlapping I/O - [arm64] dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64 - [arm64] dts: rockchip: Fix vcc_host1_5v GPIO polarity on rk3328-rock64 - ACPICA: AML interpreter: add region addresses in global list during initialization - [x86] KVM: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) - [x86] KVM: nVMX: fix x2APIC VTPR read intercept https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.36 - inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch() (CVE-2019-9857) - perf/core: Restore mmap record type correctly - ext4: avoid panic during forced reboot - ext4: add missing brelse() in add_new_gdb_meta_bg() - ext4: report real fs size after failed resize - ALSA: echoaudio: add a check for ioremap_nocache - [i386,alpha] ALSA: sb8: add a check for request_region - drm/udl: use drm_gem_object_put_unlocked. - IB/mlx4: Fix race condition between catas error reset and aliasguid flows - i40iw: Avoid panic when handling the inetdev event - [i386,alpha] ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration - [x86] thermal/intel_powerclamp: fix __percpu declaration of worker_data - [arm*] thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs - [x86] thermal/int340x_thermal: Add additional UUIDs - [x86] thermal/int340x_thermal: fix mode setting - [x86] thermal/intel_powerclamp: fix truncated kthread name - scsi: iscsi: flush running unbind operations when removing a session - sched/cpufreq: Fix 32-bit math overflow - sched/core: Fix buffer overflow in cgroup2 property cpu.max - [x86] mm: Don't leak kernel addresses - [x86] tools/power turbostat: return the exit status of a command - perf list: Don't forget to drop the reference to the allocated thread_map - perf config: Fix an error in the config template documentation - perf config: Fix a memory leak in collect_config() - perf build-id: Fix memory leak in print_sdt_events() - perf top: Fix error handling in cmd_top() - perf hist: Add missing map__put() in error case - perf evsel: Free evsel->counts in perf_evsel__exit() - ACPI / utils: Drop reference in test for device presence - PM / Domains: Avoid a potential deadlock - [armhf] drm/exynos/mixer: fix MIXER shadow registry synchronisation code - [arm64] irqchip/mbigen: Don't clear eventid when freeing an MSI - [x86] hpet: Prevent potential NULL pointer dereference - [x86] hyperv: Prevent potential NULL pointer dereference - [i386] cpu/cyrix: Use correct macros for Cyrix calls on Geode processors - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure - [x86] iommu/vt-d: Check capability before disabling protected memory - [x86] hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error - fix incorrect error code mapping for OBJECTID_NOT_FOUND - [x86] gart: Exclude GART aperture from kcore - ext4: prohibit fstrim in norecovery mode - drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up - rsi: improve kernel thread handling to fix kernel panic - f2fs: fix to avoid NULL pointer dereference on se->discard_map - 9p: do not trust pdu content for stat item size - 9p locks: add mount option for lock retry interval - ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx() - f2fs: fix to do sanity check with current segment number - netfilter: xt_cgroup: shrink size of v2 path - [arm64] serial: uartps: console_setup() can't be placed to init section - [powerpc*] pseries: Remove prrn_work workqueue - media: au0828: cannot kfree dev before usb disconnect - Bluetooth: Fix debugfs NULL pointer dereference - HID: i2c-hid: override HID descriptors for certain devices - pinctrl: core: make sure strcmp() doesn't get a null parameter - usbip: fix vhci_hcd controller counting - [x86] ACPI / SBS: Fix GPE storm on recent MacBookPro's - HID: usbhid: Add quirk for Redragon/Dragonrise Seymur 2 - [x86] KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail - netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine - f2fs: cleanup dirty pages if recover failed - [armhf,arm64] net: stmmac: Set OWN bit for jumbo frames - cifs: fallback to older infolevels on findfirst queryinfo retry - kernel: hung_task.c: disable on suspend - drm/ttm: Fix bo_global and mem_global kfree error - [x86] ALSA: hda: fix front speakers on Huawei MBXP - ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle - net/rds: fix warn in rds_message_alloc_sgs - xfrm: destroy xfrm_state synchronously on net exit path - net: ip6_gre: fix possible NULL pointer dereference in ip6erspan_set_version - [x86] iommu/dmar: Fix buffer overflow during PCI bus notification - scsi: core: Avoid that system resume triggers a kernel warning - [armhf,arm64] soc/tegra: pmc: Drop locking from tegra_powergate_is_powered() - Revert "ACPI / EC: Remove old CLEAR_ON_RESUME quirk" - [arm64] coresight: cpu-debug: Support for CA73 CPUs - [x86] PCI: Blacklist power management of Gigabyte X299 DESIGNARE EX PCIe ports - drm/nouveau/volt/gf117: fix speedo readout register - [armel,armhf] 8839/1: kprobe: make patch_lock a raw_spinlock_t - [x86] drm/amdkfd: use init_mqd function to allocate object for hid_mqd (CI) - appletalk: Fix use-after-free in atalk_proc_exit - lib/div64.c: off by one in shift - rxrpc: Fix client call connect/disconnect race - f2fs: fix to dirty inode for i_mode recovery - include/linux/swap.h: use offsetof() instead of custom __swapoffset macro - bpf: fix use after free in bpf_evict_inode - IB/hfi1: Failed to drain send queue when QP is put into error state - mm: hide incomplete nr_indirectly_reclaimable in /proc/zoneinfo - mm: hide incomplete nr_indirectly_reclaimable in sysfs https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37 - bonding: fix event handling for stacked bonds - failover: allow name change on IFF_UP slave interfaces - net: atm: Fix potential Spectre v1 vulnerabilities (CVE-2017-5715) - net: bridge: fix per-port af_packet sockets - net: bridge: multicast: use rcu to access port list from br_multicast_start_querier - net: Fix missing meta data in skb with vlan packet - net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv - tcp: tcp_grow_window() needs to respect tcp_space() - team: set slave to promisc if team is already in promisc mode - tipc: missing entries in name table of publications - vhost: reject zero size iova range - ipv4: recompile ip options in ipv4_link_failure - ipv4: ensure rcu_read_lock() in ipv4_link_failure() - [arm64] net: thunderx: raise XDP MTU to 1508 - [arm64] net: thunderx: don't allow jumbo frames with XDP - net/mlx5: FPGA, tls, hold rcu read lock a bit longer - net/mlx5: FPGA, tls, idr remove on flow delete - route: Avoid crash from dereferencing NULL rt->from - sch_cake: Use tc_skb_protocol() helper for getting packet protocol - sch_cake: Make sure we can write the IP header before changing DSCP bits - nfp: flower: replace CFI with vlan present - nfp: flower: remove vlan CFI bit from push vlan action - sch_cake: Simplify logic in cake_select_tin() - net: IP defrag: encapsulate rbtree defrag code into callable functions - net: IP6 defrag: use rbtrees for IPv6 defrag - net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c - CIFS: keep FileInfo handle live during oplock break - cifs: Fix use-after-free in SMB2_write - cifs: Fix use-after-free in SMB2_read - cifs: fix handle leak in smb2_query_symlink() - [x86] KVM: Don't clear EFER during SMM transitions for 32-bit vCPU - [x86] KVM: svm: make sure NMI is injected after nmi_singlestep - [x86] iio/gyro/bmg160: Use millidegrees for temperature scale - iio: Fix scan mask selection - iio: core: fix a possible circular locking dependency - [x86] iio: accel: kxcjk-1013: restore the range after resume. - [x86] staging: comedi: vmk80xx: Fix use of uninitialized semaphore - [x86] staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf - [x86] staging: comedi: ni_usb6501: Fix use of uninitialized mutex - [x86] staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf - [x86] ALSA: hda/realtek - add two more pin configuration sets to quirk table - ALSA: core: Fix card races between register and disconnect - [x86] Input: elan_i2c - add hardware ID for multiple Lenovo laptops - vt: fix cursor when clearing the screen - scsi: core: set result when the command cannot be dispatched - Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO" - [x86] Revert "svm: Fix AVIC incomplete IPI emulation" - coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599) - ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier - [x86] crypto: poly1305 - fix overflow during partial reduction - drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 - [arm64] futex: Restore oldval initialization to work around buggy compilers - [x86] kprobes: Verify stack frame on kretprobe - kprobes: Mark ftrace mcount handler functions nokprobe - kprobes: Fix error check when reusing optimized probes - rt2x00: do not increment sequence number while re-transmitting - mac80211: do not call driver wake_tx_queue op during reconfig - drm/amdgpu/gmc9: fix VM_L2_CNTL3 programming - [x86] perf/amd: Add event map for AMD Family 17h - [x86] cpu/bugs: Use __initconst for 'const' init data - [x86] perf: Fix incorrect PEBS_REGS - [x86] speculation: Prevent deadlock on ssb_state::lock - timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze() - nfit/ars: Remove ars_start_flags - nfit/ars: Introduce scrub_flags - nfit/ars: Allow root to busy-poll the ARS state machine - nfit/ars: Avoid stale ARS results - mmc: sdhci: Fix data command CRC error handling - mmc: sdhci: Handle auto-command errors - modpost: file2alias: go back to simple devtable lookup - modpost: file2alias: check prototype of handler - [x86] tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete - tpm: Fix the type of the return value in calc_tpm2_event_size() - sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup - device_cgroup: fix RCU imbalance in error case - ALSA: info: Fix racy addition/deletion of nodes - [armhf] ASoC: rockchip: add missing INTERLEAVED PCM attribute - i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array - kernel/sysctl.c: fix out-of-bounds access when setting file-max [ Ben Hutchings ] * debian/bin/abiupdate.py: Automatically select the correct archive to fetch from * debian/bin/abiupdate.py: Change default URLs to use https: scheme * [powerpc*] vdso: Make vdso32 installation conditional in vdso_install (Closes: #785065) * Bump ABI to 5 * [rt] Add new signing subkey for Steven Rostedt * [rt] Update to 4.19.31-rt18 (no functional change) * [armhf,arm64] Revert "net: stmmac: Send TSO packets always from Queue 0" * [riscv64] linux-image-dbg: Include vdso debug symbols * [ia64] linux-image: Recommend grub-efi-ia64 instead of (removed) elilo * [armel/marvell] Disable HW_RANDOM as no HWRNG drivers are usable here * udeb: Add all HWRNG drivers to kernel-image (see #923675) * lockdown: Refer to Debian wiki until manual page exists * [sparc64] linux-image: Recommend grub-ieee1275 instead of (removed) silo * [sparc64] linux-image: Install uncompressed kernel image * [powerpc,ppc64,ppc64el] linux-image: Recommend grub-ieee1275 * [i386] Add grub-efi-ia32 as an alternate recommended bootloader * linux-source: Recommend bison and flex, always needed to build the kernel * [armel/marvell,sh4] linux-image: Recommend apparmor, like all other configs * udeb: Drop unused ntfs-modules packages * ntfs: Disable NTFS_FS due to lack of upstream security support (CVE-2018-12929, CVE-2018-12930, CVE-2018-12931) * [x86] platform: Enable INTEL_ATOMISP2_PM as module * drivers/firmware/google: Adjust configuration for 4.19 * MODSIGN: Make shash allocation failure fatal * aio: Apply fixes from 4.19.38: - aio: clear IOCB_HIPRI - aio: use assigned completion handler - aio: separate out ring reservation from req allocation - aio: don't zero entire aio_kiocb aio_get_req() - aio: use iocb_put() instead of open coding it - aio: split out iocb copy from io_submit_one() - aio: abstract out io_event filler helper - aio: initialize kiocb private in case any filesystems expect it. - aio: simplify - and fix - fget/fput for io_submit() (CVE-2019-10125) - pin iocb through aio. - aio: fold lookup_kiocb() into its sole caller - aio: keep io_event in aio_kiocb - aio: store event at final iocb_put() - Fix aio_poll() races * tracing: Fix buffer_ref pipe ops * mm,fs: Prevent page refcount overflow (CVE-2019-11487): - mm: make page ref count overflow check tighter and more explicit - mm: add 'try_get_page()' helper function - mm: prevent get_user_pages() from overflowing page refcount - fs: prevent page refcount overflow in pipe_buf_get [ YunQiang Su ] * [mips*r6] Re-enable CONFIG_JUMP_LABEL, which has been fixed in upstream. [ Stefan Fritsch ] * [armhf] Enable SND_SOC_SPDIF for Cubietruck (Closes: #884562) [ Luca Boccassi ] * libbpf-dev: generate pkg-config file for libbpf by backporting libbpf-generate-pkg-config.patch from bpf-next. * Import patches to enable loading keys from UEFI db and MOK from http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git to allow kernel modules built by users (eg: by dkms) to be verified, and to load dbx and MOKX for the equivalent blacklisting functionality. [ Bastian Blank ] * Don't longer recommend irqbalance. (closes: #926967) [ Salvatore Bonaccorso ] * xen/pciback: Don't disable PCI_COMMAND on PCI device reset. (CVE-2015-8553) * [x86] Disable R3964 due to lack of security support * [amd64,arm64] vfio/type1: Limit DMA mappings per container (CVE-2019-3882) [ Aurelien Jarno ] * [mips] Fix indirect syscall tracing & seccomp filtering for big endian MIPS64 kernels with 32-bit userland. [ Romain Perier ] * [rt] Update to 4.19.37-rt19 * Enable coreboot memconsole (Closes: #872069) [ Uwe Kleine-König ] * [armhf] Disable MVNETA_BM_ENABLE again as it break networking on DB-MV784MP-GP. Thanks to Steve McIntyre for providing access such a machine for testing. (Closes: #927825) [ Alper Nebi Yasak ] * [arm64] Enable configs for Samsung Chromebook Plus (v1) and other rk3399-gru based devices: - Enable PL330_DMA, CROS_EC_SPI, SPI_ROCKCHIP as modules. - Enable EXTCON_USBC_CROS_EC, PHY_ROCKCHIP_TYPEC, PHY_ROCKCHIP_USB as modules. - Enable KEYBOARD_CROS_EC as module. - Enable PWM_CROS_EC, PHY_ROCKCHIP_DP as modules and enable ROCKCHIP_CDN_DP - Enable SND_SOC_ROCKCHIP, SND_SOC_ROCKCHIP_I2S, SND_SOC_ROCKCHIP_SPDIF, SND_SOC_ROCKCHIP_RT5645, SND_SOC_RK3399_GRU_SOUND as modules. - Enable INPUT_TOUCHSCREEN, enable TOUCHSCREEN_ATMEL_MXT as module, and enable TOUCHSCREEN_ATMEL_MXT_T37. - Enable TOUCHSCREEN_ELAN, MOUSE_ELAN_I2C as modules. - Enable I2C_HID as module. - Enable MWIFIEX, MWIFIEX_PCIE as modules. - Enable TCG_TPM, TCG_TIS_I2C_INFINEON as modules. - Enable PM_DEVFREQ_EVENT, enable DEVFREQ_EVENT_ROCKCHIP_DFI and ARM_RK3399_DMC_DEVFREQ as modules. - Enable REGULATOR_VCTRL as module. - Enable MFD_CROS_EC_CHARDEV, IIO_CROS_EC_ACCEL_LEGACY, IIO_CROS_EC_SENSORS_CORE, IIO_CROS_EC_SENSORS, IIO_CROS_EC_LIGHT_PROX, IIO_CROS_EC_BARO, RTC_DRV_CROS_EC as modules. - Enable BATTERY_SBS, CHARGER_CROS_USBPD as modules. [ Vagrant Cascadian ] * debian/bin/gencontrol_signed.py: Sort list of modules before adding to .json file, fixing reproducibility issues. -- Ben Hutchings Sun, 05 May 2019 19:32:32 +0100 linux (4.19.28-2) unstable; urgency=medium [ Ben Hutchings ] * [x86,alpha,m68k] binfmt: Disable BINFMT_AOUT, IA32_AOUT, OSF4_COMPAT * [x86] Drop fix for #865303, which no longer affects Debian's OpenJDK * udeb: Make serial_cs optional in serial-modules * [ppc64el] Disable PCMCIA (fixes FTBFS) [ Vagrant Cascadian ] * [arm64] Enable DRM_SUN4I and DRM_SUN8I_DW_HDMI as modules. * [arm64] Enable I2C_GPIO as a module. * [arm64] Enable MESON_EFUSE as a module. [ Yves-Alexis Perez ] * certs: include both root CA and direct signing certificate. closes: #924545 -- Ben Hutchings Fri, 15 Mar 2019 02:16:04 +0000 linux (4.19.28-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 - devres: Align data[] to ARCH_KMALLOC_MINALIGN - drm/bufs: Fix Spectre v1 vulnerability - drm/vgem: Fix vgem_init to get drm device available. - [arm*] pinctrl: bcm2835: Use raw spinlock for RT compatibility - [x86] ASoC: Intel: mrfld: fix uninitialized variable access - gpiolib: Fix possible use after free on label - [armhf] drm/sun4i: Initialize registers in tcon-top driver - genirq/affinity: Spread IRQs to all available NUMA nodes - [armhf] gpu: ipu-v3: image-convert: Prevent race between run and unprepare - wil6210: fix reset flow for Talyn-mb - wil6210: fix memory leak in wil_find_tx_bcast_2 - ath10k: assign 'n_cipher_suites' for WCN3990 - ath9k: dynack: use authentication messages for 'late' ack - scsi: lpfc: Correct LCB RJT handling - scsi: mpt3sas: Call sas_remove_host before removing the target devices - scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event - [armhf] 8808/1: kexec:offline panic_smp_self_stop CPU - [mips] clk: boston: fix possible memory leak in clk_boston_setup() - dlm: Don't swamp the CPU with callbacks queued during recovery - [x86] PCI: Fix Broadcom CNB20LE unintended sign extension (redux) - [powerpc] pseries: add of_node_put() in dlpar_detach_node() - [arm*] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl - [mips] Boston: Disable EG20T prefetch - iwlwifi: fw: do not set sgi bits for HE connection - fpga: altera-cvp: Fix registration for CvP incapable devices - [x86] fpga: altera-cvp: fix 'bad IO access' on x86_64 - [x86] vbox: fix link error with 'gcc -Og' - platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup - i40e: prevent overlapping tx_timeout recover - scsi: hisi_sas: change the time of SAS SSP connection - usbnet: smsc95xx: fix rx packet alignment - [armhf,arm64] drm/rockchip: fix for mailbox read size - [arm*] OMAP2+: hwmod: Fix some section annotations - drm/amd/display: fix gamma not being applied correctly - drm/amd/display: calculate stream->phy_pix_clk before clock mapping - bpf: libbpf: retry map creation without the name - net/mlx5: EQ, Use the right place to store/read IRQ affinity hint - modpost: validate symbol names also in find_elf_symbol - perf tools: Add Hygon Dhyana support - [armhf] soc/tegra: Don't leak device tree node reference - media: rc: ensure close() is called on rc_unregister_device - media: video-i2c: avoid accessing released memory area when removing driver - [armhf] media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register - dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll - [powerpc] 32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly - media: adv*/tc358743/ths8200: fill in min width/height/pixelclock - ACPI: SPCR: Consider baud rate 0 as preconfigured state - f2fs: move dir data flush to write checkpoint process - f2fs: fix race between write_checkpoint and write_begin - f2fs: fix wrong return value of f2fs_acl_create - [arm64] io: Ensure calls to delay routines are ordered against prior readX() - net: aquantia: return 'err' if set MPI_DEINIT state fails - [sparc*] sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN - nfsd4: fix crash on writing v4_end_grace before nfsd startup - drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() - [arm64] io: Ensure value passed to __iormb() is held in a 64-bit register - Thermal: do not clear passive state during system sleep - thermal: Fix locking in cooling device sysfs update cur_state - firmware/efi: Add NULL pointer checks in efivars API functions - [s390] zcrypt: improve special ap message cmd handling - [arm64] ftrace: don't adjust the LR value - [x86] fpu: Add might_fault() to user_insn() - usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb() - usb: dwc2: Disable power down feature on Samsung SoCs - usb: hub: delay hub autosuspend if USB3 port is still link training - timekeeping: Use proper seqcount initializer - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) - [armhf] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks - media: imx274: select REGMAP_I2C - drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) - tipc: fix node keep alive interval calculation - driver core: Move async_synchronize_full call - kobject: return error code if writing /sys/.../uevent fails - IB/hfi1: Unreserve a reserved request when it is completed - usb: dwc3: trace: add missing break statement to make compiler happy - [mips] gpio: mt7621: report failure of devm_kasprintf() - [mips] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack - [x86] iommu/amd: Fix amd_iommu=force_isolation - [armhf] dts: Fix OMAP4430 SDP Ethernet startup - [mips] bpf: fix encoding bug for mm_srlv32_op - media: coda: fix H.264 deblocking filter controls - [armel] dts: Fix up the D-Link DIR-685 MTD partition info - watchdog: renesas_wdt: don't set divider while watchdog is running - [armhf] dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 - usb: dwc3: gadget: Disable CSP for stream OUT ep - [arm64] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads - [arm64] iommu/arm-smmu: Add support for qcom,smmu-v2 variant - [arm64] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer - [armhf] clk: imx6sl: ensure MMDC CH0 handshake is bypassed - OPP: Use opp_table->regulators to verify no regulator case - [arm64] tee: optee: avoid possible double list_del() - [arm64] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver - [arm64] drm/msm: dpu: Only check flush register against pending flushes - lightnvm: pblk: fix resubmission of overwritten write err lbas - lightnvm: pblk: add lock protection to list operations - i2c-axxia: check for error conditions first - [armhf] phy: sun4i-usb: add support for missing USB PHY index - udf: Fix BUG on corrupted inode - selftests/bpf: use __bpf_constant_htons in test_prog.c - [armel] pxa: avoid section mismatch warning - [armhf] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M - [powerpc] KVM: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines - [arm*] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD - [arm*] mmc: bcm2835: reset host on timeout - memstick: Prevent memstick host from getting runtime suspended during card detection - [arm64] mmc: sdhci-xenon: Fix timeout checks - btrfs: harden agaist duplicate fsid on scanned devices - serial: sh-sci: Fix locking in sci_submit_rx() - serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure - tty: serial: samsung: Properly set flags in autoCTS mode - perf test: Fix perf_event_attr test failure - perf dso: Fix unchecked usage of strncpy() - perf header: Fix unchecked usage of strncpy() - btrfs: use tagged writepage to mitigate livelock of snapshot - perf probe: Fix unchecked usage of strncpy() - i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) - bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings. - [x86] tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file - livepatch: check kzalloc return values - [arm64] KVM: Skip MMIO insn after emulation - usb: musb: dsps: fix otg state machine - usb: musb: dsps: fix runtime pm for peripheral mode - perf header: Fix up argument to ctime() - perf tools: Cast off_t to s64 to avoid warning on bionic libc - percpu: convert spin_lock_irq to spin_lock_irqsave. - [arm64] net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() - drm/amd/display: Add retry to read ddc_clock pin - Bluetooth: hci_bcm: Handle deferred probing for the clock supply - drm/amd/display: fix YCbCr420 blank color - [powerpc] uaccess: fix warning/error with access_ok() - mac80211: fix radiotap vendor presence bitmap handling - xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi - scsi: smartpqi: correct host serial num for ssa - scsi: smartpqi: correct volume status - scsi: smartpqi: increase fw status register read timeout - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() - [arm64] net: hns3: add max vector number check for pf - [powerpc] perf: Fix thresholding counter data for unknown type - iwlwifi: mvm: fix setting HE ppe FW config - [powerpc] powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand - mlx5: update timecounter at least twice per counter overflow - drbd: narrow rcu_read_lock in drbd_sync_handshake - drbd: disconnect, if the wrong UUIDs are attached on a connected peer - drbd: skip spurious timeout (ping-timeo) when failing promote - drbd: Avoid Clang warning about pointless switch statment - drm/amd/display: validate extended dongle caps - md: fix raid10 hang issue caused by barrier - fbdev: fbmem: behave better with small rotated displays and many CPUs - i40e: define proper net_device::neigh_priv_len - ice: Do not enable NAPI on q_vectors that have no rings - igb: Fix an issue that PME is not enabled during runtime suspend - ACPI/APEI: Clear GHES block_status before panic() - fbdev: fbcon: Fix unregister crash when more than one framebuffer - [powerpc] mm: Fix reporting of kernel execute faults on the 8xx - [x86] KVM: svm: report MSR_IA32_MCG_EXT_CTL as unsupported - [powerpc] fadump: Do not allow hot-remove memory from fadump reserved area. - kvm: Change offset in kvm_write_guest_offset_cached to unsigned - NFS: nfs_compare_mount_options always compare auth flavors. - perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz - hwmon: (lm80) fix a missing check of the status of SMBus read - hwmon: (lm80) fix a missing check of bus read in lm80 probe - seq_buf: Make seq_buf_puts() null-terminate the buffer - cifs: check ntwrk_buf_start for NULL before dereferencing it - f2fs: fix use-after-free issue when accessing sbi->stat_info - niu: fix missing checks of niu_pci_eeprom_read - f2fs: fix sbi->extent_list corruption issue - cgroup: fix parsing empty mount option string - perf python: Do not force closing original perf descriptor in evlist.get_pollfd() - scripts/decode_stacktrace: only strip base path when a prefix of the path - arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning - ocfs2: don't clear bh uptodate for block read - ocfs2: improve ocfs2 Makefile - mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init - zram: fix lockdep warning of free block handling - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() - [m68k] block/swim3: Fix -EBUSY error when re-opening device after unmount - [arm*] thermal: bcm2835: enable hwmon explicitly - [armhf] PCI: imx: Enable MSI from downstream components - thermal: generic-adc: Fix adc to temp interpolation - [arm64] sve: ptrace: Fix SVE_PT_REGS_OFFSET definition - kernel/hung_task.c: break RCU locks based on jiffies - proc/sysctl: fix return error for proc_doulongvec_minmax() - kernel/hung_task.c: force console verbose before panic - fs/epoll: drop ovflist branch prediction - exec: load_script: don't blindly truncate shebang string - xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat - xfs: cancel COW blocks before swapext - xfs: Fix error code in 'xfs_ioc_getbmap()' - xfs: fix overflow in xfs_attr3_leaf_verify - xfs: fix shared extent data corruption due to missing cow reservation - xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers - xfs: delalloc -> unwritten COW fork allocation can go wrong - fs/xfs: fix f_ffree value for statfs when project quota is set - xfs: fix PAGE_MASK usage in xfs_free_file_space - xfs: fix inverted return from xfs_btree_sblock_verify_crc - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set - dccp: fool proof ccid_hc_[rt]x_parse_options() - enic: fix checksum validation for IPv6 - lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically - net: dsa: Fix lockdep false positive splat - net: dsa: Fix NULL checking in dsa_slave_set_eee() - [armhf,arm64] net: dsa: mv88e6xxx: Fix counting of ATU violations - net: dsa: slave: Don't propagate flag changes on down slave interfaces - net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames - rds: fix refcount bug in rds_sock_addref - Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" - rxrpc: bad unlock balance in rxrpc_recvmsg - sctp: check and update stream->out_curr when allocating stream_out - sctp: walk the list of asoc safely (CVE-2019-8956) - skge: potential memory corruption in skge_get_regs() - virtio_net: Account for tx bytes and packets on sending xdp_frames - net/mlx5e: FPGA, fix Innova IPsec TX offload data path performance - xfs: eof trim writeback mapping as soon as it is cached - ALSA: compress: Fix stop handling on compressed capture streams - ALSA: usb-audio: Add support for new T+A USB DAC - ALSA: hda - Serialize codec registrations - ALSA: hda/realtek - Fix lose hp_pins for disable auto mute - ALSA: hda/realtek - Use a common helper for hp pin reference - ALSA: hda/realtek - Headset microphone support for System76 darp5 - fuse: call pipe_buf_release() under pipe lock - fuse: decrement NR_WRITEBACK_TEMP on the right page - fuse: handle zero sized retrieve correctly - [arm*] dmaengine: bcm2835: Fix interrupt race on RT - [arm*] dmaengine: bcm2835: Fix abort of transactions - [armhf] dmaengine: imx-dma: fix wrong callback invoke - futex: Handle early deadlock return correctly - [arm64] irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID - [armhf] usb: phy: am335x: fix race condition in _probe - usb: dwc3: gadget: Handle 0 xfer length for OUT EP - usb: gadget: udc: net2272: Fix bitwise and boolean operations - usb: gadget: musb: fix short isoc packets with inventra dma - staging: speakup: fix tty-operation NULL derefs - scsi: cxlflash: Prevent deadlock when adapter probe fails - scsi: aic94xx: fix module loading - cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM - [x86] perf/x86/intel/uncore: Add Node ID mask - [x86] MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() - perf/core: Don't WARN() for impossible ring-buffer sizes - perf tests evsel-tp-sched: Fix bitwise operator - serial: fix race between flush_to_ldisc and tty_open - serial: 8250_pci: Make PCI class test non fatal - serial: sh-sci: Do not free irqs that have already been freed - cacheinfo: Keep the old value if of_property_read_u32 fails - IB/hfi1: Add limit test for RC/UC send via loopback - [x86] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() - ath9k: dynack: make ewma estimation faster - ath9k: dynack: check da->enabled first in sampling routines https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.22 - mtd: Make sure mtd->erasesize is valid even if the partition is of size 0 - mtd: rawnand: gpmi: fix MX28 bus master lockup problem - libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD - [armhf, arm64] iio: adc: axp288: Fix TS-pin handling - signal: Always notice exiting tasks - signal: Better detection of synchronous signals - [armhf, arm64] misc: vexpress: Off by one in vexpress_syscfg_exec() - [x86] mei: me: add ice lake point device id. - debugfs: fix debugfs_rename parameter checking - [arm64] pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller - [x86] pinctrl: cherryview: fix Strago DMI workaround - tracing: uprobes: Fix typo in pr_fmt string - [mips*] cm: reprime error cause - [mips*] OCTEON: don't set octeon_dma_bar_type if PCI is disabled - [mips*] VDSO: Use same -m%-float cflag as the kernel proper - [mips*] loongson64: remove unreachable(), fix loongson_poweroff(). - [mips*] VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds - [arm64] firmware: arm_scmi: provide the mandatory device release callback - [powerpc*] radix: Fix kernel crash with mremap() - [amd64] mic: vop: Fix use-after-free on remove - mac80211: ensure that mgmt tx skbs have tailroom for encryption - drm/modes: Prevent division by zero htotal - drm/amd/powerplay: Fix missing break in switch - [x86] drm/i915: always return something on DDI clock selection - [x86] drm/vmwgfx: Fix setting of dma masks - [x86] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user - SUNRPC: Always drop the XPRT_LOCK on XPRT_CLOSE_WAIT - xfrm: Make set-mark default behavior backward compatible - Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal" - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() - xfrm: refine validation of template and selector families - batman-adv: Avoid WARN on net_device without parent in netns - batman-adv: Force mac header to start of data on xmit - svcrdma: Reduce max_send_sges - svcrdma: Remove max_sge check at connect time https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.23 - Revert "exec: load_script: don't blindly truncate shebang string" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.24 - dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string - eeprom: at24: add support for 24c2048 - blk-mq: fix a hung issue when fsync (Closes: #913119, #913138) - [armel, armhf] 8789/1: signal: copy registers using __copy_to_user() - [armel, armhf] 8790/1: signal: always use __copy_to_user to save iwmmxt context - [armel, armhf] 8791/1: vfp: use __copy_to_user() when saving VFP state - [armel, armhf] 8792/1: oabi-compat: copy oabi events using __copy_to_user() - [armel, armhf] 8793/1: signal: replace __put_user_error with __put_user - [armel, armhf] 8794/1: uaccess: Prevent speculative use of the current addr_limit - [armel, armhf] 8795/1: spectre-v1.1: use put_user() for __put_user() - [armel, armhf] 8796/1: spectre-v1,v1.1: provide helpers for address sanitization - [armel, armhf] 8797/1: spectre-v1.1: harden __copy_to_user - [armel, armhf] 8810/1: vfp: Fix wrong assignement to ufp_exc - [armel, armhfl armhf] make lookup_processor_type() non-__init - [armel, armhf] split out processor lookup - [armel, armhf] clean up per-processor check_bugs method call - [armel, armhf] add PROC_VTABLE and PROC_TABLE macros - [armel, armhf] spectre-v2: per-CPU vtables to work around big.Little systems - [armel, armhf] ensure that processor vtables is not lost after boot - [armel, armhf] fix the cockup in the previous patch - drm/amdgpu/sriov:Correct pfvf exchange logic - [i386] ACPI: NUMA: Use correct type for printing addresses on i386-PAE - perf report: Fix wrong iteration count in --branch-history - perf test shell: Use a fallback to get the pathname in vfs_getname - [riscv64] riscv: fix trace_sys_exit hook - cpufreq: check if policy is inactive early in __cpufreq_get() - nvme-pci: use the same attributes when freeing host_mem_desc_bufs. - nvme-pci: fix out of bounds access in nvme_cqe_pending - nvme-multipath: zero out ANA log buffer - nvme: pad fake subsys NQN vid and ssvid with zeros - drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang - [armel] dts: kirkwood: Fix polarity of GPIO fan lines - [armel, armhf] gpio: pl061: handle failed allocations - drm/nouveau: Don't disable polling in fallback mode - drm/nouveau/falcon: avoid touching registers if engine is off - cifs: Limit memory used by lock request calls to a page - [x86] kvm: sev: Fail KVM_SEV_INIT if already initialized - CIFS: Do not assume one credit for async responses - [arm*] gpio: mxc: move gpio noirq suspend/resume to syscore phase - [x86] Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" - [x86] Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK - [armhf] OMAP5+: Fix inverted nirq pin interrupts with irq_set_type - perf/core: Fix impossible ring-buffer sizes warning - [x86] perf: Add check_period PMU callback - [x86] ALSA: hda - Add quirk for HP EliteBook 840 G5 - ALSA: usb-audio: Fix implicit fb endpoint setup by quirk - ASoC: hdmi-codec: fix oops on re-probe - [alpha] tools uapi: fix Alpha support - [riscv64] Add pte bit to distinguish swap from invalid - [x86] kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available - [x86] kvm: vmx: Fix entry number check for add_atomic_switch_msr() - [arm*] mmc: sunxi: Filter out unsupported modes declared in the device tree - mmc: block: handle complete_work on separate workqueue - [x86] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 - Revert "nfsd4: return default lease period" - Revert "mm: don't reclaim inodes with many attached pages" - Revert "mm: slowly shrink slabs with a relatively small number of objects" - [alpha] fix page fault handling for r16-r18 targets - [alpha] Fix Eiger NR_IRQS to 128 - [s390*] zcrypt: fix specification exception on z196 during ap probe - tracing/uprobes: Fix output for multiple string arguments - [x86] platform/UV: Use efi_runtime_lock to serialise BIOS calls - scsi: sd: fix entropy gathering for most rotational disks - signal: Restore the stop PTRACE_EVENT_EXIT - md/raid1: don't clear bitmap bits on interrupted recovery. - [x86] a.out: Clear the dump structure initially - dm crypt: don't overallocate the integrity tag space - dm thin: fix bug where bio that overwrites thin block ignores FUA - drm: Use array_size() when creating lease - [x86] drm/i915: Block fbdev HPD processing during suspend - [x86] drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set - mm: proc: smaps_rollup: fix pss_locked calculation https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.25 - af_packet: fix raw sockets over 6in4 tunnel - [arm64, armhf] dsa: mv88e6xxx: Ensure all pending interrupts are handled prior to exit - net: crypto set sk to NULL when af_alg_release. (CVE-2019-8912) - net: Fix for_each_netdev_feature on Big endian - net: fix IPv6 prefix route residue - net: ip6_gre: initialize erspan_ver just for erspan tunnels - net: ipv4: use a dedicated counter for icmp_v4 redirect packets - net: phy: xgmiitorgmii: Support generic PHY status read - net: stmmac: Fix a race in EEE enable callback - net: stmmac: handle endianness in dwmac4_get_timestamp - sky2: Increase D3 delay again - vhost: correctly check the return value of translate_desc() in log_used() - vsock: cope with memory allocation failure at socket creation time - vxlan: test dev->flags & IFF_UP before calling netif_rx() - net: Add header for usage of fls64() - tcp: clear icsk_backoff in tcp_write_queue_purge() - tcp: tcp_v4_err() should be more careful - net: Do not allocate page fragments that are not skb aligned - hwmon: (lm80) Fix missing unlock on error in set_fan_div() - scsi: target/core: Use kmem_cache_free() instead of kfree() - PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter - sunrpc: fix 4 more call sites that were using stack memory with a scatterlist - netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs (CVE-2019-9162) - net/x25: do not hold the cpu too long in x25_new_lci() - ax25: fix possible use-after-free https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.26 - [armel armhf] 8834/1: Fix: kprobes: optimized kprobes illegal instruction - tracing: Fix number of entries in trace header - [mips*] eBPF: Always return sign extended 32b values - mac80211: Restore vif beacon interval if start ap fails - mac80211: Use linked list instead of rhashtable walk for mesh tables - mac80211: Free mpath object when rhashtable insertion fails - libceph: handle an empty authorize reply - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list - numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES - proc, oom: do not report alien mms when setting oom_score_adj - [x86] ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 - [x86] ALSA: hda/realtek: Disable PC beep in passthrough on alc285 - KEYS: allow reaching the keys quotas exactly - [armhf,arm64] backlight: pwm_bl: Fix devicetree parsing with auto- generated brightness tables - [armhf] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells - [armhf] mfd: twl-core: Fix section annotations on {,un}protect_pm_master - [arm64] mfd: qcom_rpm: write fw_version to CTRL_REG - mfd: axp20x: Add AC power supply cell for AXP813 - mfd: axp20x: Re-align MFD cell entries - mfd: axp20x: Add supported cells for AXP803 - mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove probe() - [armhf] mfd: mc13xxx: Fix a missing check of a register-read failure - qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count - qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier - [arm64] net: hns: Fix use after free identified by SLUB debug - bpf: Fix [::] -> [::1] rewrite in sys_sendmsg - selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr - net/mlx4: Get rid of page operation after dma_alloc_coherent - xprtrdma: Double free in rpcrdma_sendctxs_create() - selftests: forwarding: Add a test for VLAN deletion - netfilter: nf_tables: fix leaking object reference count - scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param - scsi: isci: initialize shost fully before calling scsi_add_host() - include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR - netfilter: nft_flow_offload: Fix reverse route lookup - bpf: correctly set initial window on active Fast Open sender - bpf: fix panic in stack_map_get_build_id() on i386 and arm32 - netfilter: nft_flow_offload: fix interaction with vrf slave device - RDMA/mthca: Clear QP objects during their allocation - [powerpcspe] 8xx: fix setting of pagetable for Abatron BDI debug tool. - acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() - net: stmmac: Fix PCI module removal leak - net: stmmac: dwxgmac2: Only clear interrupts that are active - net: stmmac: Check if CBS is supported before configuring - net: stmmac: Fix the logic of checking if RX Watchdog must be enabled - net: stmmac: Prevent RX starvation in stmmac_napi_poll() - scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes - scsi: ufs: Fix system suspend status - scsi: qedi: Add ep_state for login completion on un-reachable targets - scsi: ufs: Fix geometry descriptor size - scsi: cxgb4i: add wait_for_completion() - netfilter: nft_flow_offload: fix checking method of conntrack helper - always clear the X2APIC_ENABLE bit for PV guest - [armhf, arm64] drm/meson: add missing of_node_put - drm/amdkfd: Don't assign dGPUs to APU topology devices - drm/amd/display: fix PME notification not working in RV desktop - vhost: return EINVAL if iovecs size does not match the message size - [armhf, arm64] drm/sun4i: backend: add missing of_node_puts - bpf: don't assume build-id length is always 20 bytes - bpf: zero out build_id for BPF_STACK_BUILD_ID_IP - atm: he: fix sign-extension overflow on large shift - hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table - [armhf] leds: lp5523: fix a missing check of return value of lp55xx_read - bpf: bpf_setsockopt: reset sock dst on SO_MARK changes - net: bridge: Mark FDB entries that were added by user as such - net/mlx5e: Fix wrong (zero) TX drop counter indication for representor - isdn: avm: Fix string plus integer warning from Clang - batman-adv: fix uninit-value in batadv_interface_tx() - inet_diag: fix reporting cgroup classid and fallback to priority - ipv6: propagate genlmsg_reply return code - net: ena: fix race between link up and device initalization - net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames - net/mlx5e: Don't overwrite pedit action when multiple pedit used - net/packet: fix 4gb buffer limit due to overflow check - net: sfp: do not probe SFP module before we're attached - sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment - sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate - team: avoid complex list operations in team_nl_cmd_options_set() - Revert "socket: fix struct ifreq size in compat ioctl" - Revert "kill dev_ifsioc()" - net: socket: fix SIOCGIFNAME in compat - net: socket: make bond ioctls go through compat_ifreq_ioctl() - geneve: should not call rt6_lookup() when ipv6 was disabled - sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() - net_sched: fix a race condition in tcindex_destroy() (Closes: #921542) - net_sched: fix a memory leak in cls_tcindex - net_sched: fix two more memory leaks in cls_tcindex - net/mlx5e: XDP, fix redirect resources availability check - RDMA/srp: Rework SCSI device reset handling - KEYS: user: Align the payload buffer - KEYS: always initialize keyring_index_key::desc_len - drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime - gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime - [x86] drm/i915/fbdev: Actually configure untiled displays - drm/amd/display: Fix MST reboot/poweroff sequence - mac80211: allocate tailroom for forwarded mesh packets - [x86] kvm: Return LA57 feature based on hardware capability - net: validate untrusted gso packets without csum offload - net: avoid false positives in untrusted gso validation - Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" - netfilter: nf_tables: fix flush after rule deletion in the same batch - netfilter: nft_compat: use-after-free when deleting targets - netfilter: ipv6: Don't preserve original oif for loopback address - netfilter: nfnetlink_osf: add missing fmatch check - netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in clusterip_config_entry_put() - udlfb: handle unplug properly - [armhf arm64] pinctrl: max77620: Use define directive for max77620_pinconf_param values - net: phylink: avoid resolving link state too early https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.27 - irq/matrix: Split out the CPU selection code into a helper - irq/matrix: Spread managed interrupts on allocation - genirq/matrix: Improve target CPU selection for managed interrupts (Closes: #922182) - mac80211: Change default tx_sk_pacing_shift to 7 - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached - [arm64] drm/msm: Unblock writer if reader closes file - [x86] ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field - [armhf] clk: tegra: dfll: Fix a potential Oop in remove() - [x86] thermal: int340x_thermal: Fix a NULL vs IS_ERR() check - [arm64, armhf] usb: dwc3: gadget: synchronize_irq dwc irq in suspend - [arm64, armhf] usb: dwc3: gadget: Fix the uninitialized link_state when udc starts - genirq: Make sure the initial affinity is not empty - [arm64, armel, x86, armhf] ASoC: dapm: change snprintf to scnprintf for possible overflow - [x86] drivers: thermal: int340x_thermal: Fix sysfs race condition - mac80211: fix miscounting of ttl-dropped frames - sched/wait: Fix rcuwait_wake_up() ordering - sched/wake_q: Fix wakeup ordering for wake_q - futex: Fix (possible) missed wakeup - drm/amd/powerplay: OD setting fix on Vega10 - [armhf] drm/sun4i: hdmi: Fix usage of TMDS clock - direct-io: allow direct writes to empty inodes - writeback: synchronize sync(2) against cgroup writeback membership switches - scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport - scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport - scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() - [x86] hv_netvsc: Fix ethtool change hash key error - [x86] hv_netvsc: Refactor assignments of struct netvsc_device_info - [x86] hv_netvsc: Fix hash key value reset after other ops - nvme-rdma: fix timeout handler - nvme-multipath: drop optimization for static ANA group IDs - [arm64] drm/msm: Fix A6XX support for opp-level - net: usb: asix: ax88772_bind return error when hw_reset fail - net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP - [powerpc*] ibmveth: Do not process frames after calling napi_reschedule - mac80211: don't initiate TDLS connection if station is not associated to AP - mac80211: Add attribute aligned(2) to struct 'action' - cfg80211: extend range deviation for DMG - [x86] svm: Fix AVIC incomplete IPI emulation - [x86] KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 - [arm64, armhf] mmc: spi: Fix card detection during probe - mmc: core: Fix NULL ptr crash from mmc_should_fail_request - [armhf] mmc: sdhci-esdhc-imx: correct the fix of ERR004536 - mm: enforce min addr even if capable() in expand_downwards() (CVE-2019-9213) - hugetlbfs: fix races and page leaks during migration - [mips*] fix truncation in __cmpxchg_small for short values - [x86] uaccess: Don't leak the AC flag into __put_user() value evaluation https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.28 - cpufreq: Use struct kobj_attribute instead of struct global_attr - staging: erofs: fix mis-acted TAIL merging behavior - USB: serial: option: add Telit ME910 ECM composition - USB: serial: cp210x: add ID for Ingenico 3070 - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 - [x86] staging: comedi: ni_660x: fix missing break in switch statement - [x86, arm64, armhf] staging: android: ashmem: Don't call fallocate() with ashmem_mutex held. - [x86, arm64, armhf] staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex held. - ip6mr: Do not call __IP6_INC_STATS() from preemptible context - [arm64, armhf] net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex - [arm64, armhf] net: dsa: mv88e6xxx: fix number of internal PHYs for 88E6x90 family - net: sched: put back q.qlen into a single location - net-sysfs: Fix mem leak in netdev_register_kobject - qmi_wwan: Add support for Quectel EG12/EM12 - sctp: call iov_iter_revert() after sending ABORT - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 - team: Free BPF filter when unregistering netdev - tipc: fix RDM/DGRAM connect() regression - bnxt_en: Drop oversize TX packets to prevent errors. - geneve: correctly handle ipv6.disable module parameter - [x86] hv_netvsc: Fix IP header checksum for coalesced packets - ipv4: Add ICMPv6 support when parse route ipproto - lan743x: Fix TX Stall Issue - [arm64, armhf] net: dsa: mv88e6xxx: Fix statistics on mv88e6161 - [arm64, armhf] net: dsa: mv88e6xxx: Fix u64 statistics - net: netem: fix skb length BUG_ON in __skb_to_sgvec - net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails - net: phy: Micrel KSZ8061: link failure after cable connect - [arm64, armhf] net: phy: phylink: fix uninitialized variable in phylink_get_mac_state - net: sit: fix memory leak in sit_init_net() - net: socket: set sock->sk to NULL after calling proto_ops::release() - tipc: fix race condition causing hung sendto - tun: fix blocking read - [x86, arm64, armhf] xen-netback: don't populate the hash cache on XenBus disconnect - [x86, arm64, armhf] xen-netback: fix occasional leak of grant ref mappings under memory pressure - tun: remove unnecessary memory barrier - net: Add __icmp_send helper. - ipv4: Return error for RTA_VIA attribute - ipv6: Return error for RTA_VIA attribute - mpls: Return error for RTA_GATEWAY attribute - ipv4: Pass original device to ip_rcv_finish_core - [arm64, armhf] net: dsa: mv88e6xxx: power serdes on/off for 10G interfaces on 6390X - [arm64, armhf] net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode - net/sched: act_ipt: fix refcount leak when replace fails - net/sched: act_skbedit: fix refcount leak when replace fails - net: sched: act_tunnel_key: fix NULL pointer dereference during init - [x86] CPU/AMD: Set the CPB bit unconditionally on F17h - [x86] boot/compressed/64: Do not read legacy ROM on EFI system - tracing: Fix event filters and triggers to handle negative numbers - usb: xhci: Fix for Enabling USB ROLE SWITCH QUIRK on INTEL_SUNRISEPOINT_LP_XHCI - [x86, powerpc*] applicom: Fix potential Spectre v1 vulnerabilities - [mips*] irq: Allocate accurate order pages for irq stack - aio: Fix locking in aio_poll() - xtensa: fix get_wchan - gnss: sirf: fix premature wakeup interrupt enable - USB: serial: cp210x: fix GPIO in autosuspend - Bluetooth: btrtl: Restore old logic to assume firmware is already loaded - Bluetooth: Fix locking in bt_accept_enqueue() for BH context - exec: Fix mem leak in kernel_read_file (CVE-2019-8980) - scsi: core: reset host byte in DID_NEXUS_FAILURE case - bpf: fix sanitation rewrite in case of non-pointers [ Ben Hutchings ] * [sparc64] udeb: Use standard module list in nic-modules; add i2c-modules and nic-shared-modules to avoid duplication * mt76: Use the correct hweight8() function (fixes FTBFS on ia64) * [armel] udeb: Add mmc-core-modules * udeb: Make nic-wireless-modules depend on mmc-core-modules, not mmc-modules; move crc7 to crc-modules to avoid duplication * [powerpc*] udeb: Add i2c-modules, mmc-core-modules, nic-wireless-modules * [arm64,armhf] udeb: Add mmc-core-modules to Provides of kernel-image * udeb: Add fb-modules and include drm and drm_kms_helper on most architectures * udeb: Move basic PV modules from {hyperv,virtio}-modules to kernel-image * udeb: Move drivers from {hyperv,virtio}-modules to {fb,input,nic,scsi}-modules * debian/bin/gencontrol.py: Add rules to build debian/build/config.* * certs: Replace test signing certificate with production signing certificate * debian/bin/gencontrol_signed.py: Put all files.json fields under "packages" * Bump ABI to 4 [ Wookey ] * linux-perf: Enable coresight trace (libopencsd) support in perf (Closes: #895131) [ Vagrant Cascadian ] * [armhf] Add patch from upstream fixing stability issues when cpufreq is enabled on Orange Pi Plus. * [armhf] Enable REGULATOR_SY8106A as module. * [arm64] Add patch working around A64 timer issues. [ dann frazier ] * arm64: lockdown: Move init_lockdown() call after uefi_init() [ Salvatore Bonaccorso ] * Btrfs: fix corruption reading shared and compressed extents after hole punching (Closes: #922306) [ Vagrant Cascadian ] * [arm64] Add patch from v4.20 to enable device-tree for Pine64-LTS. [ Romain Perier ] * [rt] Update to 4.19.25-rt16: - Add zram_slot_trylock() to "drivers/block/zram: Replace bit spinlocks with rtmutex for -rt" - Refresh "futex: workaround migrate_disable/enable in different context" - softirq: Avoid "local_softirq_pending" messages if ksoftirqd is blocked - softirq: Avoid "local_softirq_pending" messages if task is in cpu_chill() - hrtimer: Don't lose state in cpu_chill() - hrtimer: cpu_chill(): save task state in ->saved_state() - [x86] lazy-preempt: properly check against preempt-mask - [i386] lazy-preempt: use proper return label on 32bit-x86 * [armel/rpi] Add flavour for Raspberry Pi and Raspberry Pi Zero * [armel, armhf] Enable CRASH_DUMP * Enable STRICT_MODULE_RWX [ Marcin Juszkiewicz ] * [arm64] udeb: Use generic ata-modules * [arm64] udeb: Remove redundant lines from nic-modules [ YunQiang Su ] * [mips r6] Disable JUMP_LABEL for now: it will cause Reserved Instruction. Enable SERIAL_OF_PLATFORM, if not, userland shows nothing. Enable CPU_HAS_MSA, HIGHMEM, CRYPTO_CRC32_MIPS, and NR_CPUS to 16. Support some boston drivers: IMG_ASCII_LCD, I2C_EG20T, PCH_PHUB, MMC, PCIE_XILINX, RTC_DRV_M41T80, SPI_TOPCLIFF_PCH. * [mipsel/mips64el] Backport MIPS: Loongson: Introduce and use loongson_llsc_mb() -- Ben Hutchings Tue, 12 Mar 2019 05:06:28 +0000 linux (4.19.20-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.17 - tty/ldsem: Wake up readers after timed out down_write() - tty: Hold tty_ldisc_lock() during tty_reopen() - tty: Simplify tty->count math in tty_reopen() - tty: Don't hold ldisc lock in tty_reopen() if ldisc present - can: gw: ensure DLC boundaries after CAN frame modification (CVE-2019-3701) - netfilter: nf_conncount: don't skip eviction when age is negative - netfilter: nf_conncount: split gc in two phases - netfilter: nf_conncount: restart search when nodes have been erased (Closes: #921616) - netfilter: nf_conncount: merge lookup and add functions - netfilter: nf_conncount: move all list iterations under spinlock - netfilter: nf_conncount: speculative garbage collection on empty lists - netfilter: nf_conncount: fix argument order to find_next_bit - [arm64] mmc: sdhci-msm: Disable CDR function on TX - Revert "scsi: target: iscsi: cxgbit: fix csk leak" - scsi: target: iscsi: cxgbit: fix csk leak - scsi: target: iscsi: cxgbit: fix csk leak - [arm64] kvm: consistently handle host HCR_EL2 flags - [arm64] Don't trap host pointer auth use to EL2 - ipv6: fix kernel-infoleak in ipv6_local_error() - net: bridge: fix a bug on using a neighbour cache entry without checking its state - packet: Do not leak dev refcounts on error exit - tcp: change txhash on SYN-data timeout - tun: publish tfile after it's fully initialized - r8169: don't try to read counters if chip is in a PCI power-save state - bonding: update nest level on unlink - ip: on queued skb use skb_header_pointer instead of pskb_may_pull - r8169: load Realtek PHY driver module before r8169 - crypto: authencesn - Avoid twice completion call in decrypt path - crypto: authenc - fix parsing key with misaligned rta_len - [x86] xen: Fix x86 sched_clock() interface for xen - Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" - btrfs: wait on ordered extents on abort cleanup - Yama: Check for pid death before checking ancestry - scsi: core: Synchronize request queue PM status only on successful resume - [x86] scsi: sd: Fix cache_type_store() - [mips*] fix n32 compat_ipc_parse_version - [mips*] BCM47XX: Setup struct device for the SoC - [mips*] lantiq: Fix IPI interrupt handling - of: properties: add missing of_node_put - RDMA/nldev: Don't expose unsafe global rkey to regular user - [arm64] kaslr: ensure randomized quantities are clean to the PoC - [arm64] dts: marvell: armada-ap806: reserve PSCI area - [mips*] Disable MSI also when pcie-octeon.pcie_disable on - fix int_sqrt64() for very large numbers - media: vivid: fix error handling of kthread_run - media: vivid: set min width/height to a value > 0 - bpf: in __bpf_redirect_no_mac pull mac only if present - ipv6: make icmp6_send() robust against null skb->dev - LSM: Check for NULL cred-security on free - netfilter: ebtables: account ebt_table_info to kmemcg - block: use rcu_work instead of call_rcu to avoid sleep in softirq - selinux: fix GPF on invalid policy - blockdev: Fix livelocks on loop device - sctp: allocate sctp_sockaddr_entry with kzalloc - tipc: fix uninit-value in in tipc_conn_rcv_sub - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats - tipc: fix uninit-value in tipc_nl_compat_bearer_enable - tipc: fix uninit-value in tipc_nl_compat_link_set - tipc: fix uninit-value in tipc_nl_compat_name_table_dump - tipc: fix uninit-value in tipc_nl_compat_doit - block/loop: Don't grab "struct file" for vfs_getattr() operation. - block/loop: Use global lock for ioctl() operation. - loop: Fold __loop_release into loop_release - loop: Get rid of loop_index_mutex - loop: Push lo_ctl_mutex down into individual ioctls - loop: Split setting of lo_state from loop_clr_fd - loop: Push loop_ctl_mutex down into loop_clr_fd() - loop: Push loop_ctl_mutex down to loop_get_status() - loop: Push loop_ctl_mutex down to loop_set_status() - loop: Push loop_ctl_mutex down to loop_set_fd() - loop: Push loop_ctl_mutex down to loop_change_fd() - loop: Move special partition reread handling in loop_clr_fd() - loop: Move loop_reread_partitions() out of loop_ctl_mutex - loop: Fix deadlock when calling blkdev_reread_part() - loop: Avoid circular locking dependency between loop_ctl_mutex and bd_mutex - loop: Get rid of 'nested' acquisition of loop_ctl_mutex - loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() - loop: drop caches if offset or block_size are changed - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock - nbd: Use set_blocksize() to set device blocksize https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.18 - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address - [armhf, arm64 net: dsa: mv88x6xxx: mv88e6390 errata - net, skbuff: do not prefer skb allocation fails early - qmi_wwan: add MTU default to qmap network interface - r8169: Add support for new Realtek Ethernet - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses - net: clear skb->tstamp in bridge forwarding path - netfilter: ipset: Allow matching on destination MAC address for mac and ipmac sets - [arm64] gpio: pl061: Move irq_chip definition inside struct pl061 - drm/amd/display: Guard against null stream_state in set_crc_source - [x86] drm/amdkfd: fix interrupt spin lock - ixgbe: allow IPsec Tx offload in VEPA mode - [x86] platform: asus-wmi: Tell the EC the OS will handle the display off hotkey - e1000e: allow non-monotonic SYSTIM readings - [x86] usb: typec: tcpm: Do not disconnect link for self powered devices - of: overlay: add missing of_node_put() after add new node to changeset - writeback: don't decrement wb->refcnt if !wb->bdi - serial: set suppress_bind_attrs flag only if builtin - bpf: Allow narrow loads with offset > 0 - ALSA: oxfw: add support for APOGEE duet FireWire - [x86] mce: Fix -Wmissing-prototypes warnings - [mips] SiByte: Enable swiotlb for SWARM, LittleSur and BigSur - [arm64] perf: set suppress_bind_attrs flag to true - drm/atomic-helper: Complete fake_commit->flip_done potentially earlier - [arm64] clk: meson: meson8b: fix incorrect divider mapping in cpu_scale_table - samples: bpf: fix: error handling regarding kprobe_events - usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device - fpga: altera-cvp: fix probing for multiple FPGAs on the bus - selinux: always allow mounting submounts - ASoC: pcm3168a: Don't disable pcm3168a when CONFIG_PM defined - scsi: qedi: Check for session online before getting iSCSI TLV data. - drm/amdgpu: Reorder uvd ring init before uvd resume - rxe: IB_WR_REG_MR does not capture MR's iova field - efi/libstub: Disable some warnings for x86{,_64} - jffs2: Fix use of uninitialized delayed_work, lockdep breakage - clk: imx: make mux parent strings const - pstore/ram: Do not treat empty buffers as valid - media: uvcvideo: Refactor teardown of uvc on USB disconnect - powerpc/xmon: Fix invocation inside lock region - powerpc/pseries/cpuidle: Fix preempt warning - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info - ASoC: use dma_ops of parent device for acp_audio_dma - media: venus: core: Set dma maximum segment size - staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io' - net: call sk_dst_reset when set SO_DONTROUTE - scsi: target: use consistent left-aligned ASCII INQUIRY data - scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough - [arm64] kasan: Increase stack size for KASAN_EXTRA - clk: imx6q: reset exclusive gates on init - [arm64] Fix minor issues with the dcache_by_line_op macro - bpf: relax verifier restriction on BPF_MOV | BPF_ALU - mmc: atmel-mci: do not assume idle after atmci_request_end - btrfs: volumes: Make sure there is no overlap of dev extents at mount time - btrfs: alloc_chunk: fix more DUP stripe size handling - btrfs: fix use-after-free due to race between replace start and cancel - btrfs: improve error handling of btrfs_add_link - tty/serial: do not free trasnmit buffer page under port lock - perf intel-pt: Fix error with config term "pt=0" - perf tests ARM: Disable breakpoint tests 32-bit - perf svghelper: Fix unchecked usage of strncpy() - perf parse-events: Fix unchecked usage of strncpy() - perf vendor events intel: Fix Load_Miss_Real_Latency on SKL/SKX - netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set - netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE in netns exit routine - netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine - [x86] topology: Use total_cpus for max logical packages calculation - dm crypt: use u64 instead of sector_t to store iv_offset - dm kcopyd: Fix bug causing workqueue stalls - perf stat: Avoid segfaults caused by negated options - tools lib subcmd: Don't add the kernel sources to the include path - dm snapshot: Fix excessive memory usage and workqueue stalls - perf cs-etm: Correct packets swapping in cs_etm__flush() - perf tools: Add missing sigqueue() prototype for systems lacking it - perf tools: Add missing open_memstream() prototype for systems lacking it - quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls. - clocksource/drivers/integrator-ap: Add missing of_node_put() - dm: Check for device sector overflow if CONFIG_LBDAF is not set - Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029 - ALSA: bebob: fix model-id of unit for Apogee Ensemble - sysfs: Disable lockdep for driver bind/unbind files - IB/usnic: Fix potential deadlock - scsi: mpt3sas: fix memory ordering on 64bit writes - scsi: smartpqi: correct lun reset issues - ath10k: fix peer stats null pointer dereference - scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() - scsi: megaraid: fix out-of-bound array accesses - iomap: don't search past page end in iomap_is_partially_uptodate - ocfs2: fix panic due to unrecovered local alloc - mm/page-writeback.c: don't break integrity writeback on ->writepage() error - mm/swap: use nr_node_ids for avail_lists in swap_info_struct - userfaultfd: clear flag if remap event not enabled - mm, proc: be more verbose about unstable VMA flags in /proc//smaps - iwlwifi: mvm: Send LQ command as async when necessary - Bluetooth: Fix unnecessary error message for HCI request completion - ipmi: fix use-after-free of user->release_barrier.rda - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities - ipmi: Prevent use-after-free in deliver_response - ipmi:ssif: Fix handling of multi-part return messages - ipmi: Don't initialize anything in the core until something uses it https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.19 - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs - net: bridge: Fix ethernet header pointer before check skb forwardable - net: Fix usage of pskb_trim_rcsum - net: phy: marvell: Errata for mv88e6390 internal PHYs - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling - net/sched: act_tunnel_key: fix memory leak in case of action replace - net_sched: refetch skb protocol for each filter - openvswitch: Avoid OOB read when parsing flow nlattrs - vhost: log dirty page correctly - net: ipv4: Fix memory leak in network namespace dismantle - net/sched: cls_flower: allocate mask dynamically in fl_change() - udp: with udp_segment release on error path - ip6_gre: fix tunnel list corruption for x-netns - erspan: build the header with the right proto according to erspan_ver - net: phy: marvell: Fix deadlock from wrong locking - ip6_gre: update version related info when changing link - tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state - mei: me: mark LBG devices as having dma support - mei: me: add denverton innovation engine device IDs - USB: leds: fix regression in usbport led trigger - USB: serial: simple: add Motorola Tetra TPG2200 device id - USB: serial: pl2303: add new PID to support PL2303TB - ceph: clear inode pointer when snap realm gets dropped by its inode - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages - ASoC: rt5514-spi: Fix potential NULL pointer dereference - ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode - clk: socfpga: stratix10: fix rate calculation for pll clocks - clk: socfpga: stratix10: fix naming convention for the fixed-clocks - inotify: Fix fd refcount leak in inotify_add_watch(). - ALSA: hda/realtek - Fix typo for ALC225 model - ALSA: hda - Add mute LED support for HP ProBook 470 G5 - ARCv2: lib: memeset: fix doing prefetchw outside of buffer - ARC: adjust memblock_reserve of kernel memory - ARC: perf: map generic branches to correct hardware condition - s390/mm: always force a load of the primary ASCE on context switch - s390/early: improve machine detection - s390/smp: fix CPU hotplug deadlock with CPU rescan - misc: ibmvsm: Fix potential NULL pointer dereference - char/mwave: fix potential Spectre v1 vulnerability - [arm64] mmc: dw_mmc-bluefield: : Fix the license information - [arm64] mmc: meson-gx: Free irq in release() callback - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 - tty: Handle problem if line discipline does not have receive_buf - uart: Fix crash in uart_write and uart_put_char - tty/n_hdlc: fix __might_sleep warning - hv_balloon: avoid touching uninitialized struct page during tail onlining - Drivers: hv: vmbus: Check for ring when getting debug info - vgacon: unconfuse vc_origin when using soft scrollback - CIFS: Fix possible hang during async MTU reads and writes - CIFS: Fix credits calculations for reads with errors - CIFS: Fix credit calculation for encrypted reads with errors - CIFS: Do not reconnect TCP session in add_credits() - smb3: add credits we receive from oplock/break PDUs - Input: xpad - add support for SteelSeries Stratus Duo - Input: input_event - provide override for sparc64 - Input: uinput - fix undefined behavior in uinput_validate_absinfo() - acpi/nfit: Block function zero DSMs - acpi/nfit: Fix command-supported detection - scsi: ufs: Use explicit access size in ufshcd_dump_regs - dm thin: fix passdown_double_checking_shared_status() - dm crypt: fix parsing of extended IV arguments - [x86] drm/amdgpu: Add APTX quirk for Lenovo laptop - [x86] KVM: Fix single-step debugging - [x86] KVM: Fix PV IPIs for 32-bit KVM host - [x86] KVM: WARN_ONCE if sending a PV IPI returns a fatal error - [x86] kvm: vmx: Use kzalloc for cached_vmcs12 - [x86] KVM/nVMX: Do not validate that posted_intr_desc_addr is page aligned - [x86] pkeys: Properly copy pkey state at fork() - [x86] selftests/pkeys: Fork() to check for state being preserved - [x86] kaslr: Fix incorrect i8254 outb() parameters - [x86] entry/64/compat: Fix stack switching for XEN PV - [arm64] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it - can: bcm: check timer values before ktime conversion - can: flexcan: fix NULL pointer exception during bringup - vt: make vt_console_print() compatible with the unicode screen buffer - vt: always call notifier with the console lock held - vt: invoke notifier on screen size change - [arm64] drm/meson: Fix atomic mode switching regression - bpf: improve verifier branch analysis - bpf: add per-insn complexity limit - bpf: move {prev_,}insn_idx into verifier env - bpf: move tmp variable into ax register in interpreter - bpf: enable access to ax register also from verifier rewrite - bpf: restrict map value pointer arithmetic for unprivileged - bpf: restrict stack pointer arithmetic for unprivileged - bpf: restrict unknown scalars of mixed signed bounds for unprivileged - bpf: fix check_map_access smin_value test when pointer contains offset - bpf: prevent out of bounds speculation on pointer arithmetic (CVE-2019-7308) - bpf: fix sanitation of alu op with pointer / scalar type from different paths (CVE-2019-7308) - bpf: fix inner map masking to prevent oob under speculation - [s390*] smp: Fix calling smp_call_ipl_cpu() from ipl CPU - nvmet-rdma: Add unlikely for response allocated check - nvmet-rdma: fix null dereference under heavy load - Revert "mm, memory_hotplug: initialize struct pages for the full memory section" - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup - ide: fix a typo in the settings proc file name - Input: input_event - fix the CONFIG_SPARC64 mixup https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.20 - Fix "net: ipv4: do not handle duplicate fragments as overlapping" - ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation - ipvlan, l3mdev: fix broken l3s mode wrt local routes - l2tp: copy 4 more bytes to linear part if necessary - l2tp: fix reading optional fields of L2TPv3 - net: ip_gre: always reports o_key to userspace - net: ip_gre: use erspan key field for tunnel lookup - net/mlx4_core: Add masking for a few queries on HCA caps - netrom: switch to sock timer API - net/rose: fix NULL ax25_cb kernel panic - net: set default network namespace in init_dummy_netdev() - sctp: improve the events for sctp stream reset - tun: move the call to tun_set_real_num_queues - vhost: fix OOB in get_rx_bufs() (CVE-2018-16880) - net: ip6_gre: always reports o_key to userspace - sctp: improve the events for sctp stream adding - net/mlx5e: Allow MAC invalidation while spoofchk is ON - ip6mr: Fix notifiers call on mroute_clean_tables() - sctp: set chunk transport correctly when it's a new asoc - sctp: set flow sport from saddr only when it's 0 - virtio_net: Don't enable NAPI when interface is down - virtio_net: Don't call free_old_xmit_skbs for xdp_frames - virtio_net: Fix not restoring real_num_rx_queues - virtio_net: Fix out of bounds access of sq - virtio_net: Don't process redirected XDP frames when XDP is disabled - virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs - virtio_net: Differentiate sk_buff and xdp_frame on freeing - CIFS: Do not count -ENODATA as failure for query directory - CIFS: Fix trace command logging for SMB2 reads and writes - CIFS: Do not consider -ENODATA as stat failure for reads - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() - NFS: Fix up return value on fatal errors in nfs_page_async_flush() - [arm64] kaslr: ensure randomized quantities are clean also when kaslr is off - [arm64] Do not issue IPIs for user executable ptes - [arm64] hyp-stub: Forbid kprobing of the hyp-stub - [arm64] hibernate: Clean the __hyp_text to PoC after resume - gpiolib: fix line event timestamps for nested irqs - gpio: pcf857x: Fix interrupts on multiple instances - gfs2: Revert "Fix loop in gfs2_rbm_find" - [arm*] mmc: bcm2835: Fix DMA channel leak on probe error - mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay - ALSA: usb-audio: Add Opus #3 to quirks for native DSD support - ALSA: hda/realtek - Fixed hp_pin no value - IB/hfi1: Remove overly conservative VM_EXEC flag check - [x86] platform: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK - [x86] platform: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe - Btrfs: fix deadlock when allocating tree block during leaf/node split - btrfs: On error always free subvol_name in btrfs_mount - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes - mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT - oom, oom_reaper: do not enqueue same task twice - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages - mm, oom: fix use-after-free in oom_kill_process - mm: hwpoison: use do_send_sig_info() instead of force_sig() - mm: migrate: don't rely on __PageMovable() of newpage after unlocking it - of: Convert to using %pOFn instead of device_node.name - of: overlay: add tests to validate kfrees from overlay removal - of: overlay: add missing of_node_get() in __of_attach_node_sysfs - of: overlay: use prop add changeset entry for property in new nodes - of: overlay: do not duplicate properties from overlay for new nodes - md/raid5: fix 'out of memory' during raid cache recovery - cifs: Always resolve hostname before reconnecting [ Luca Boccassi ] * Do not generate linux-source-$ver stanza in debian/control if source is set to disabled in debian/config/defines. * linux-perf: explicitly disable the jvmti feature and shared library. * Document pkg.linux.nosource in debian/README.source. * [amd64] enable UIO_HV_GENERIC for Azure's VMBus access. * [cloud-amd64] enable UIO for Azure's VMBus access, and VFIO for guests running on an hypervisor that exposes a vIOMMU. [ Ben Hutchings ] * debian/rules.d, debian/rules.real: Restore build of userland headers for tools * debian/rules.d: Delete now-unused recursive makefiles * debian/rules.d/tools/perf/Makefile: Delete redundant arch/profile checks * debian/control: Add !pkg.linux.nokernel to qualification for compiler build-deps * [i386] debian/control: Fix cross-compiler build-dependency * debian/README.source: Document how to run kconfigeditor2 * [armhf,arm64] serial: 8250: Disable SERIAL_8250_DEPRECATED_OPTIONS * percpu: convert spin_lock_irq to spin_lock_irqsave (fixes boot failure with alpha-generic flavour) * debian/tests/python: Fix spurious failure due to misuse of stderr * Update "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for ..." to not duplicate the conditional warning/error * Bump ABI to 3 * drivers/firmware: Enable FW_CFG_SYSFS as module (Closes: #882208) * [arm64,armhf,ia64,riscv64,sparc64] udeb: Add usb-serial-modules (Closes: #903824) * [powerpc*,sparc64] udeb: Add nic-usb-modules * [armhf,riscv64,s390x] udeb: Add cdrom-core-modules * 9p: Enable NET_9P_XEN as module * ACPI: Enable ACPI_TAD as module * amd-xgbe: Enable AMD_XGBE_DCB * ath9k: Enable ATH9K_CHANNEL_CONTEXT * block: Enable BLK_DEV_ZONED (except armel/marvell) * bluetooth: Enable BT_HCIUART_RTL; BT_HCIUART_NOKIA, BT_MTKUART as modules * bnxt: Enable BNXT_DCB * ethernet: Enable HINIC, ICE, LAN743X, LIQUIDIO_VF as modules * can: Enable CAN_VXCAN, CAN_MCBA_USB, CAN_UCAN as modules * dm: Enable DM_UNSTRIPED, DM_WRITECACHE, DM_ZONED as modules * [arm64,armhf] drm: Enable DRM_PANEL_RASPBERRYPI_TOUCHSCREEN as module * dvb-usb-v2: Enable DVB_USB_ZD1301 as module * gnss: Enable GNSS, GNSS_SIRF_SERIAL, GNSS_UBX_SERIAL as modules * gpio: Enable GPIO_EXAR, GPIO_PCI_IDIO_16, GPIO_PCIE_IDIO_24 as modules * HID: Enable HID_ACCUTOUCH, HID_COUGAR, HID_ELAN, HID_ITE, HID_JABRA, HID_MAYFLASH, HID_REDRAGON, HID_RETRODE, HID_STEAM, HID_UDRAW_PS3 as modules * [x86] i2c: Enable I2C_DESIGNWARE_BAYTRAIL * IB: Enable CGROUP_RDMA (except armel/marvell) * ieee802154: Enable IEEE802154_HWSIM as module * inet: Enable INET_RAW_DIAG as module * input: Enable INPUT_AXP20X_PEK as module * IPMI: Enable IPMI_SSIF as module * joystick: Enable JOYSTICK_PXRC as module * media/rc: Enable IR_IMON_DECODER, IR_IMON_RAW as modules * [x86] mfd: Enable INTEL_SOC_PMIC_BXTWC, INTEL_SOC_PMIC_CHTDC_TI as modules * mlx5: Enable MLX5_FPGA, MLX5_CORE_IPOIB; MLXFW as module * net: Enable BPF_STREAM_PARSER, XDP_SOCKETS (except armel/marvell) (Closes: #908860); NET_FAILOVER, SMC, SMC_DIAG, VSOCKMON as modules * net/phy: Enable LED_TRIGGER_PHY; CORTINA_PHY, DP83822_PHY, DP83TC811_PHY, MARVELL_10G_PHY, MICROCHIP_T1_PHY, RENESAS_PHY, ROCKCHIP_PHY as modules * net/sched: Enable NET_SCH_CBS, NET_SCH_ETF, NET_SCH_SKBPRIO, NET_EMATCH_IPT as modules * PCMCIA: Enable SCR24X as module * [x86] pinctrl: Enable PINCTRL_CANNONLAKE, PINCTRL_CEDARFORK, PINCTRL_DENVERTON, PINCTRL_GEMINILAKE, PINCTRL_ICELAKE, PINCTRL_LEWISBURG * [x86] rmi4: Re-enable RMI4_CORE, RMI4_SMB as modules (Closes: #875621); RMI4_F03, RMI4_F11, RMI4_F12, RMI4_F30, RMI4_F34, RMI4_F55 * xfrm: Enable XFRM_INTERFACE as module * PCI: Enable PCI_PF_STUB as module * ptp: Change PTP_1588_CLOCK_KVM from built-in to module * random: Enable RANDOM_TRUST_CPU. This can be reverted using the kernel parameter: random.trust_cpu=off * SCSI: Enable QEDF, QEDI as modules * serial: Enable SERIAL_8250_EXAR, USB_SERIAL_F8153X, USB_SERIAL_UPD78F0730 as modules * sound: Enable SND_FIREWIRE_MOTU, SND_FIREFACE, SND_XEN_FRONTEND as modules * [x86] sound: Enable SND_SOC_AMD_CZ_DA7219MX98357_MACH, SND_SOC_AMD_CZ_RT5645_MACH, SND_SOC_INTEL_CHT_BSW_NAU8824_MACH, SND_SOC_INTEL_BYT_CHT_DA7213_MACH, SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH, SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH, SND_SOC_INTEL_KBL_DA7219_MAX98357A_MACH, SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH as modules * thermal: Enable DEVFREQ_THERMAL, THERMAL_STATISTICS * tpm: Enable TCG_TIS_SPI, TCG_VTPM_PROXY as modules * usbtouchscreen: Enable TOUCHSCREEN_USB_EASYTOUCH * watchdog: Enable WATCHDOG_PRETIMEOUT_GOV, WATCHDOG_PRETIMEOUT_GOV_NOOP, WATCHDOG_PRETIMEOUT_DEFAULT_GOV_NOOP; WATCHDOG_PRETIMEOUT_GOV_PANIC, WDAT_WDT as modules * [x86] watchdog: Enable INTEL_MEI_WDT, NI903X_WDT, NIC7018_WDT as modules * wireless: Enable MT76x0U, MT76x2E, MT76x2U, QTNFMAC_PEARL_PCIE as modules (Closes: #918331) * zram: Enable ZRAM_WRITEBACK, ZRAM_MEMORY_TRACKING * udeb: Add scsi-nic-modules containing Chelsio and Qlogic iSCSI/FC drivers [ Marcin Juszkiewicz ] * [arm64] enable ARM_CCI_PMU so ARM_CCI400_PMU and ARM_CCI5xx_PMU options get really enabled. * [arm64] enable PCI_PRI, PCI_PASID as PCI can be behind IOMMU in servers. * udeb: Add virtio-gpu into d-i to get graphical output in VM instances. * [arm64] Enable ARM64_ERRATUM_843419 (Closes: #920866) [ Salvatore Bonaccorso ] * [x86] kvmclock: set offset for kvm unstable clock (Closes: #918036) * kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) * [x86] KVM: work around leak of uninitialized stack contents (CVE-2019-7222) * [x86] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) * HID: debug: fix the ring buffer implementation (CVE-2019-3819) [ Hideki Yamane ] * [x86] Enable Touchpad support on Gemini Lake via CONFIG_PINCTRL_GEMINILAKE (Closes: #917388) * [x86] Enable SND_SOC_ES8316 and Baytrail & Cherrytrail with ES8316 codec, too (Closes: #918589) * hwmon: Enable CONFIG_SENSORS_NCT7802,NCT7904,NPCM7XX,ASPEED and W83773G to use HWMON hardware (Closes: #912597) * net: can: Enable CONFIG_CAN_PEAK_PCIEFD for a PCI express CAN Bus adapter (Closes: #920809) * [armhf] Enable CONFIG_SENSORS_LM75 for armhf (Closes: #918114) * [armhf] Enable CONFIG_IMX_THERMAL for armhf (Closes: #883023) * [arm64] Enable CONFIG_ARM_ARMADA_37XX_CPUFREQ for arm64 (Closes: #917939) [ Vagrant Cascadian ] * [armhf] Enable CONFIG_MMC_SDHCI_OMAP=m, used on DRA7 and related SoCs. [ Uwe Kleine-König ] * [armel] add spi-orion to mtd.udeb to be able to access spi flash on e.g. qnap ts-21x. (Closes: #920607) -- Ben Hutchings Mon, 11 Feb 2019 16:55:59 +0000 linux (4.19.16-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.14 - ax25: fix a use-after-free in ax25_fillin_cb() - gro_cell: add napi_disable in gro_cells_destroy - ip6mr: Fix potential Spectre v1 vulnerability - ipv4: Fix potential Spectre v1 vulnerability - ipv6: explicitly initialize udp6_addr in udp_sock_create6() - ipv6: tunnels: fix two use-after-free - ip: validate header length on virtual device xmit - isdn: fix kernel-infoleak in capi_unlocked_ioctl - net/wan: fix a double free in x25_asy_open_tty() - packet: validate address length - packet: validate address length if non-zero - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event - tipc: compare remote and local protocols in tipc_udp_enable() - tipc: fix a double free in tipc_enable_bearer() - tipc: fix a double kfree_skb() - ipv6: frags: Fix bogus skb->sk in reassembled packets - ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error - ALSA: rme9652: Fix potential Spectre v1 vulnerability - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities - ALSA: pcm: Fix potential Spectre v1 vulnerability - ALSA: emux: Fix potential Spectre v1 vulnerabilities - powerpc/fsl: Fix spectre_v2 mitigations reporting - usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() - [s390x] s390/pci: fix sleeping in atomic during hotplug - [x86] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off - [x86] x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() - [x86] KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup - [arm64] arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible - perf pmu: Suppress potential format-truncation warning - perf env: Also consider env->arch == NULL as local operation - ext4: fix possible use after free in ext4_quota_enable - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data() - ext4: include terminating u32 in size of xattr entries when expanding inodes - ext4: force inode writes when nfsd calls commit_metadata() - ext4: check for shutdown and r/o file system in ext4_write_inode() - [armhf,arm64] spi: bcm2835: Fix race on DMA termination - [armhf,arm64] spi: bcm2835: Fix book-keeping of DMA termination - [armhf,arm64] spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode - btrfs: dev-replace: go back to suspended state if target device is missing - btrfs: dev-replace: go back to suspend state if another EXCL_OP is running - btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow - Btrfs: fix fsync of files with multiple hard links in new directories - btrfs: run delayed items before dropping the snapshot - Btrfs: send, fix race with transaction commits that create snapshots - brcmfmac: Fix out of bounds memory access during fw load - dax: Don't access a freed inode - f2fs: read page index before freeing - f2fs: sanity check of xattr entry size - media: imx274: fix stack corruption in imx274_read_reg - media: v4l2-tpg: array index could become negative - tools lib traceevent: Fix processing of dereferenced args in bprintk events - [mips*] MIPS: math-emu: Write-protect delay slot emulation pages - [mips*] MIPS: Ensure pmd_present() returns false after pmd_mknotpresent() - [mips*] MIPS: Align kernel load address to 64KB - [mips*] MIPS: Expand MIPS32 ASIDs to 64 bits - CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem - smb3: fix large reads on encrypted connections - [arm*] KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum - [arm*] KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state - [arm*] KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.15 - IB/core: Fix oops in netdev_next_upper_dev_rcu() - xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. - ieee802154: hwsim: fix off-by-one in parse nested - netfilter: seqadj: re-load tcp header pointer after possible head reallocation - scsi: bnx2fc: Fix NULL dereference in error handling - [ppc64el] ibmvnic: Convert reset work item mutex to spin lock - [ppc64el] ibmvnic: Fix non-atomic memory allocation in IRQ context - [x86] x86/mm: Fix guard hole handling - i40e: fix mac filter delete when setting mac address - ixgbe: Fix race when the VF driver does a reset - netfilter: nat: can't use dst_hold on noref dst - bnx2x: Clear fip MAC when fcoe offload support is disabled - bnx2x: Remove configured vlans as part of unload sequence. - bnx2x: Send update-svid ramrod with retry/poll flags enabled - mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues - [x86] x86, hyperv: remove PCI dependency - [arm64] net: hns: All ports can not work when insmod hns ko after rmmod. - [arm64] net: hns: Fixed bug that netdev was opened twice - [arm64] net: hns: Clean rx fbd when ae stopped. - [arm64] net: hns: Avoid net reset caused by pause frames storm - [arm64] net: hns: Add mac pcs config when enable|disable mac - [arm64] net: hns: Fix ping failed when use net bridge and send multicast - mac80211: fix a kernel panic when TXing after TXQ teardown - [arm64,riscv64] net: macb: fix random memory corruption on RX with 64-bit DMA - [arm64.risvv64] net: macb: fix dropped RX frames due to a race - lan78xx: Resolve issue with changing MAC address - [s390x] scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown - fork: record start_time late - zram: fix double free backing device - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined - mm, devm_memremap_pages: kill mapping "System RAM" support - memcg, oom: notify on oom killer invocation from the charge path - mt76x0: init hw capabilities - [amd64] media: cx23885: only reset DMA on problematic CPUs - ALSA: cs46xx: Potential NULL dereference in probe - ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() - ALSA: usb-audio: Check mixer unit descriptors more strictly - ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks - ALSA: usb-audio: Always check descriptor sizes in parser code - Fix failure path in alloc_pid() - block: deactivate blk_stat timer in wbt_disable_default() - gfs2: Get rid of potential double-freeing in gfs2_create_inode - gfs2: Fix loop in gfs2_rbm_find - b43: Fix error in cordic routine - nfsd4: zero-length WRITE should succeed - [ppc*] powerpc/tm: Set MSR[TS] just prior to recheckpoint - RDMA/srpt: Fix a use-after-free in the channel release code - sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c - [s390x] genwqe: Fix size check - [x86] intel_th: msu: Fix an off-by-one in attribute store - [armhf,arm64] drm/rockchip: psr: do not dereference encoder before it is null checked. - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16 - Btrfs: fix deadlock when using free space tree due to block group creation - staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption - staging: rtl8188eu: Fix module loading from tasklet for WEP encryption - cpufreq: scmi: Fix frequency invariance in slow path - [x86] modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE - ALSA: hda/realtek - Support Dell headset mode for New AIO platform - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225 - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 - CIFS: Fix adjustment of credits for MTU requests - CIFS: Do not set credits to 1 if the server didn't grant anything - CIFS: Do not hide EINTR after sending network packets - CIFS: Fix credit computation for compounded requests - cifs: Fix potential OOB access of lock element array - usb: cdc-acm: send ZLP for Telit 3G Intel based modems - USB: storage: don't insert sane sense for SPC3+ when bad sense specified - USB: storage: add quirk for SMI SM3350 - USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB - slab: alien caches must not be initialized if the allocation of the alien cache failed - mm/usercopy.c: no check page span for stack objects - mm, memcg: fix reclaim deadlock with writeback - ACPI: power: Skip duplicate power resource references in _PRx - ACPI / PMIC: xpower: Fix TS-pin current-source handling - ACPI/IORT: Fix rc_dma_get_range() - i2c: dev: prevent adapter retries and timeout being set as minus value - vfio/type1: Fix unmap overflow off-by-one - drm/amdgpu: Add new VegaM pci id - PCI: dwc: Use interrupt masking instead of disabling - PCI: dwc: Take lock when ACKing an interrupt - PCI: dwc: Move interrupt acking into the proper callback - drm/amd/display: Fix MST dp_blank REG_WAIT timeout - drm/fb_helper: Allow leaking fbdev smem_start - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 - [x86] drm/i915: Unwind failure on pinning the gen7 ppgtt - drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume() - drm/amdgpu: Don't fail resume process if resuming atomic state fails - rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set - ext4: make sure enough credits are reserved for dioread_nolock writes - ext4: fix a potential fiemap/page fault deadlock w/ inline_data - ext4: avoid kernel warning when writing the superblock to a dead device - ext4: use ext4_write_inode() when fsyncing w/o a journal - ext4: track writeback errors using the generic tracking infrastructure - ext4: fix special inode number checks in __ext4_iget() - mm: page_mapped: don't assume compound page is huge or THP - sunrpc: use-after-free in svc_process_common() - [armhf,arm64] KVM: Fix VMID alloc race by reverting to lock-less - [arm64] compat: Don't pull syscall number from regs in arm_compat_syscall - Btrfs: fix access to available allocation bits when starting balance - Btrfs: fix deadlock when enabling quotas due to concurrent snapshot creation - Btrfs: use nofs context when initializing security xattrs to avoid deadlock [ John Paul Adrian Glaubitz ] * [m68k] Add patch to build with -ffreestanding to fix FTBFS [ Ben Hutchings ] * [ia64,m68k] libbpf: Really don't build on architectures without perf events * Use dh_listpackages to determine which packages to build * Add pkg.linux.nokernel build profile that excludes kernel image and header packages [ Yves-Alexis Perez ] * Bump ABI to 2 because of changes in struct sock_common from 60f05dddf1eb * [rt] Update to 4.19.15-rt12 - rtmutex/rwlock: preserve state like a sleeping lock [ Salvatore Bonaccorso ] * ipv6: Consider sk_bound_dev_if when binding a socket to an address (Closes: #918103) * posix-cpu-timers: Unbreak timer rearming (Closes: #919019, #919049) [ Michal Simek ] * [arm64] Enable Xilinx ZynqMP SoC and drivers [ YunQiang Su ] * [mipsel, mips64el] Enable DRM_AST and FB_SM750 for loongson-3 install ast and sm750fb to loongson-3's fb-modules [ Romain Perier ] * [rt] Update to 4.19.13-rt10 [ Luigi Baldoni ] * [x86] Enable LEDS_APU to support leds on PC Engines APU SBC series -- Ben Hutchings Thu, 17 Jan 2019 18:56:17 +0000 linux (4.19.13-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.13 - Revert "vfs: Allow userns root to call mknod on owned filesystems." - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data (CVE-2018-19985) - xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only - USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd - USB: serial: option: add GosunCn ZTE WeLink ME3630 - USB: serial: option: add HP lt4132 - USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) - USB: serial: option: add Fibocom NL668 series - USB: serial: option: add Telit LN940 series - ubifs: Handle re-linking of inodes correctly while recovery - scsi: t10-pi: Return correct ref tag when queue has no integrity profile - scsi: sd: use mempool for discard special page - mmc: core: Reset HPI enabled state during re-init and in case of errors - mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support - mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl - [armhf] mmc: omap_hsmmc: fix DMA API warning - gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers - posix-timers: Fix division by zero bug - [x86] KVM: Fix NULL deref in vcpu_scan_ioapic - [x86] kvm: Add AMD's EX_CFG to the list of ignored MSRs - [x86] KVM: Fix UAF in nested posted interrupt processing - [x86] Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels - futex: Cure exit race - [x86] mtrr: Don't copy uninitialized gentry fields back to userspace - [x86] mm: Fix decoy address handling vs 32-bit builds (Closes: #917569) - [x86] vdso: Pass --eh-frame-hdr to the linker - panic: avoid deadlocks in re-entrant console drivers - mm: add mm_pxd_folded checks to pgtable_bytes accounting functions - mm: make the __PAGETABLE_PxD_FOLDED defines non-empty - mm: introduce mm_[p4d|pud|pmd]_folded - xfrm_user: fix freeing of xfrm states on acquire - rtlwifi: Fix leak of skb when processing C2H_BT_INFO - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares - Revert "mwifiex: restructure rx_reorder_tbl_lock usage" - iwlwifi: add new cards for 9560, 9462, 9461 and killer series - mm, memory_hotplug: initialize struct pages for the full memory section - mm: thp: fix flags for pmd migration when split - mm, page_alloc: fix has_unmovable_pages for HugePages - mm: don't miss the last page because of round-off error - Input: elantech - disable elan-i2c for P52 and P72 - proc/sysctl: don't return ENOMEM on lookup when a table is unregistering - drm/ioctl: Fix Spectre v1 vulnerabilities [ Uwe Kleine-König ] * [armhf] enable some kconfig items for Allwinner SoCs (SUNXI_CCU=y, SUN8I_DE2_CCU=y, DRM_SUN8I_DW_HDMI=m, SND_SUN8I_CODEC=m, SND_SUN8I_CODEC_ANALOG=m). (Closes: #915899) [ Ben Hutchings ] * linux-image-*-unsigned: Remove Provides field (Closes: #916927) * [ia64,m68k] libbpf: Don't build on architectures without performance events * [riscv64] tools uapi: fix RISC-V 64-bit support * [powerpc,powerpcspe,ppc64] linux-config: Eliminate config.*_bootwrapper.gz files * [powerpcspe] Fix -mcpu= options for SPE-only compiler * debian/lib/python/debian_linux/debian.py: Fix deprecated import of MutableSet * Fix pycodestyle "line break after binary operator" warnings * Fix pycodestyle "inalid escape sequence" warnings [ Romain Perier ] * [rt] Update to 4.19.10-rt8 -- Salvatore Bonaccorso Sun, 30 Dec 2018 10:04:03 +0100 linux (4.19.12-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.10 - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes - ipv6: Check available headroom in ip6_xmit() even without options - ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output - [arm64, hppa, powerpc, x86, alpha, armhf, mips*] net: 8139cp: fix a BUG triggered by changing mtu with network traffic - net: phy: don't allow __set_phy_supported to add unsupported modes - net: Prevent invalid access to skb->prev in __qdisc_drop_all - net: use skb_list_del_init() to remove from RX sublists - Revert "net/ibm/emac: wrong bit is used for STA control" - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices - sctp: kfree_rcu asoc - tcp: Do not underestimate rwnd_limited - tcp: fix NULL ref in tail loss probe - tun: forbid iface creation with rtnl ops - virtio-net: keep vnet header zeroed after processing XDP - net: phy: sfp: correct store of detected link modes - sctp: update frag_point when stream_interleave is set - net: restore call to netdev_queue_numa_node_write when resetting XPS - net: fix XPS static_key accounting - [armhf] OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup - [arm64, x86] staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()' - [armhf] dts: am3517: Fix pinmuxing for CD on MMC1 - [armhf] dts: LogicPD Torpedo: Fix mmc3_dat1 interrupt - [armhf] dts: logicpd-somlv: Fix interrupt on mmc3_dat1 - [armhf] dts: am3517-som: Fix WL127x Wifi interrupt - tools: bpftool: prevent infinite loop in get_fdinfo() - [arm64] dts: sdm845-mtp: Reserve reserved gpios - sysv: return 'err' instead of 0 in __sysv_write_inode - netfilter: nf_tables: don't skip inactive chains during update - perf tools: Fix crash on synthesizing the unit - netfilter: xt_RATEEST: remove netns exit routine - netfilter: nf_tables: fix use-after-free when deleting compat expressions - [armhf] ASoC: rockchip: add missing slave_config setting for I2S - s390/cpum_cf: Reject request for sampling in event initialization - [arm64, armel, x86, armhf] ASoC: dapm: Recalculate audio map forcely when card instantiated - [armhf] spi: omap2-mcspi: Add missing suspend and resume calls - bpf: allocate local storage buffers using GFP_ATOMIC - aio: fix failure to put the file pointer - netfilter: xt_hashlimit: fix a possible memory leak in htable_create() - hwmon: (w83795) temp4_type has writable permission - perf tools: Restore proper cwd on return from mnt namespace - [armhf] PCI: imx6: Fix link training status detection in link up check - objtool: Fix double-free in .cold detection error path - objtool: Fix segfault in .cold detection with -ffunction-sections - [arm64] phy: qcom-qusb2: Use HSTX_TRIM fused value as is - [arm64] phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845 - Btrfs: send, fix infinite loop due to directory rename dependencies - RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR - RDMA/core: Add GIDs while changing MAC addr only for registered ndev - RDMA/rdmavt: Fix rvt_create_ah function signature - tools: bpftool: fix potential NULL pointer dereference in do_load - ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf - [x86] thunderbolt: Prevent root port runtime suspend during NVM upgrade - [arm64] drm/meson: add support for 1080p25 mode - netfilter: ipv6: Preserve link scope traffic original oif - IB/mlx5: Fix page fault handling for MW - netfilter: add missing error handling code for register functions - [x86] KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes - [x86] kvm/vmx: fix old-style function declaration - [arm64] net: thunderx: fix NULL pointer dereference in nic_remove - netfilter: nf_tables: deactivate expressions in rule replecement routine - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock - cachefiles: Fix an assertion failure when trying to update a failed object - fscache: Fix race in fscache_op_complete() due to split atomic_sub & read - cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active - igb: fix uninitialized variables - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps - [arm64] net: hisilicon: remove unexpected free_netdev - drm/amdgpu: Add delay after enable RLC ucode - [arm64, powerpc, x86] drm/ast: fixed reading monitor EDID not stable issue - Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" - afs: Fix validation/callback interaction - fscache: fix race between enablement and dropping of object - cachefiles: Explicitly cast enumerated type in put_object - fscache, cachefiles: remove redundant variable 'cache' - nvme: warn when finding multi-port subsystems without multipathing enabled - ocfs2: fix deadlock caused by ocfs2_defrag_extent() - mm/page_alloc.c: fix calculation of pgdat->nr_zones - hfs: do not free node before using - hfsplus: do not free node before using - initramfs: clean old path before creating a hardlink - ocfs2: fix potential use after free - dax: Check page->mapping isn't NULL - ALSA: hda/realtek - Fixed headphone issue for ALC700 - ALSA: hda/realtek: ALC294 mic and headset-mode fixups for ASUS X542UN - ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294 - ALSA: hda/realtek: Enable audio jacks of ASUS UX433FN/UX333FA with ALC294 - ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon - IB/hfi1: Fix an out-of-bounds access in get_hw_stats - bpf: fix off-by-one error in adjust_subprog_starts - tcp: lack of available data can also cause TSO defer https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.11 - sched/pelt: Fix warning and clean up IRQ PELT config - scsi: raid_attrs: fix unused variable warning - [i386] staging: olpc_dcon: add a missing dependency - [arm64] dts: qcom-apq8064-arrow-sd-600eval fix graph_endpoint warning - [arm64] drm/msm: fix address space warning - aio: fix spectre gadget in lookup_ioctx - fs/iomap.c: get/put the page in iomap_page_create/release() - userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered - [arm64] dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing - block/bio: Do not zero user pages - ovl: fix decode of dir file handle with multi lower layers - ovl: fix missing override creds in link of a metacopy upper - [armhf] MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 - mmc: core: use mrq->sbc when sending CMD23 for RPMB - mmc: sdhci: fix the timeout check window for clock and reset - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS - [arm] mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt - [arm] dts: bcm2837: Fix polarity of wifi reset GPIOs (Closes: #911443) - dm thin: send event about thin-pool state change _after_ making it - dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty() - dm: call blk_queue_split() to impose device limits on bios - tracing: Fix memory leak of instance function hash filters - [powerpc*] msi: Fix NULL pointer access in teardown code - drm/nouveau/kms: Fix memory leak in nv50_mstm_del() - drm/nouveau/kms/nv50-: also flush fb writes when rewinding push buffer - Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" - [x86] drm/i915/execlists: Apply a full mb before execution for Braswell - [amd64] drm/amdkfd: add new vega10 pci ids - drm/amdgpu: add some additional vega10 pci ids - drm/amdgpu: update smu firmware images for VI variants (v2) - drm/amdgpu: update SMC firmware image for polaris10 variants - [x86] build: Fix compiler support check for CONFIG_RETPOLINE https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.12 - locking/qspinlock: Re-order code - [x86] locking/qspinlock, x86: Provide liveness guarantee - [amd64] IB/hfi1: Remove race conditions in user_sdma send path - mac80211_hwsim: fix module init error paths for netlink - [x86] Input: hyper-v - fix wakeup from suspend-to-idle - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset - [x86] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload - [x86] earlyprintk/efi: Fix infinite loop on some screen widths - [arm64] drm/msm: Fix task dump in gpu recovery - [arm64] drm/msm/gpu: Fix a couple memory leaks in debugfs - [arm64] drm/msm: fix handling of cmdstream offset - [arm64] drm/msm/dsi: configure VCO rate for 10nm PLL driver - [arm64] drm/msm: Grab a vblank reference when waiting for commit_done - drm/ttm: fix LRU handling in ttm_buffer_object_transfer - drm/amdgpu: wait for IB test on first device open - [arm64,armhf] net: stmmac: Move debugfs init/exit to ->probe()/->remove() - [amd64] net: aquantia: fix rx checksum offload bits - bonding: fix 802.3ad state sent to partner when unbinding slave - liquidio: read sc->iq_no before release sc - nfs: don't dirty kernel pages read by direct-io - SUNRPC: Fix a potential race in xprt_connect() - [sparc64] sbus: char: add of_node_put() - [sparc64] drivers/sbus/char: add of_node_put() - [sparc64] drivers/tty: add missing of_node_put() - [arm64] drm/msm/hdmi: Enable HPD after HDMI IRQ is set up - [amr64] drm/msm: dpu: Don't set legacy plane->crtc pointer - [arm64] drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data" - [arm64] drm/msm: Fix error return checking - [arm64] clk: mvebu: Off by one bugs in cp110_of_clk_get() - Input: synaptics - enable SMBus for HP 15-ay000 - [armhf] Input: omap-keypad - fix keyboard debounce configuration - libata: whitelist all SAMSUNG MZ7KM* solid-state disks - macvlan: return correct error value - [arm64,armhf] mv88e6060: disable hardware level MAC learning - net/mlx4_en: Fix build break when CONFIG_INET is off - bpf: check pending signals while verifying programs - [arm*] 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling - [arm*] 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart - [arm*] 8816/1: dma-mapping: fix potential uninitialized return - [arm64,armhf] thermal: armada: fix legacy validity test sense - [arm64,armhf] net: mvpp2: fix detection of 10G SFP modules - [arm64,armhf] net: mvpp2: fix phylink handling of invalid PHY modes - drm/amdgpu/vcn: Update vcn.cur_state during suspend - [amd64,arm64] acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" - drm/ast: Fix connector leak during driver unload - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) - vhost/vsock: fix reset orphans race with close timeout - [x86] i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node - nvme: validate controller state before rescheduling keep alive - nvmet-rdma: fix response use after free - Btrfs: fix missing delayed iputs on unmount [ Uwe Kleine-König ] * [arm] Fix probing of 3rd gpio device on Armada 370. [ Ben Hutchings ] * linux-perf: Fix build-time check for unversioned files * linux-perf: Fix installation directories for BPF headers and examples (Closes: #916774) [ Noah Meyerhans ] * drivers/net/ethernet/amazon: Backport v2.0.2 from Linux 4.20 [ Bastian Blank ] * Ignore various ABI changes. [ Salvatore Bonaccorso ] * iomap: Revert "fs/iomap.c: get/put the page in iomap_page_create/release()" -- Salvatore Bonaccorso Sat, 22 Dec 2018 09:06:45 +0100 linux (4.19.9-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.6 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.7 - [x86] KVM: LAPIC: Fix pv ipis use-before-initialization (CVE-2018-19406) - mm: cleancache: fix corruption on missed inode invalidation (CVE-2018-16862) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.8 - blk-mq: fix corruption with direct issue (Closes: #915666) - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (CVE-2018-18397) - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (CVE-2018-18397) - userfaultfd: shmem: add i_size checks (CVE-2018-18397) - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set (CVE-2018-18397) - blk-mq: punt failed direct issue to dispatch list https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9 - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (CVE-2018-19824) - vhost/vsock: fix use-after-free in network stack callers (CVE-2018-14625) [ Marcin Juszkiewicz ] * [arm64] Enable ACPI IMPI * [arm64] Enable IPMI watchdog and power off support * [arm64] Enable PCI Express hotplug * [arm64] Enable PMU for several server cpus * [arm64] Enable HiSilicon LPC for serial/ipmi access [ Romain Perier ] * [x86] Enable support for error detection and correction on the Intel Pondicherry2 Integrated Memory Controller (Closes: #914946) * [rt] Update to 4.19.8-rt6 [ Uwe Kleine-König ] * Enable usb support for ATH10K (Closes: #915083) [ Luca Boccassi ] * debian/rules.real: Split the rules so that the [un]versioned_tools knobs can be used to avoid building them. Fixes FTBFS with unversioned tools disabled. * perf: do not ship python2-only call-graph-from-sql script. * Override Lintian warning dbg-package-missing-depends in source too. [ Ben Hutchings ] * debian/rules.real: Mark most targets as phony * debian/rules: Mark more targets as phony * libcpupower: Hide private function and drop it from .symbols file * integrity: Disable INTEGRITY_TRUSTED_KEYRING (Closes: #865277) [ Vagrant Cascadian ] * debian/config/config: Enable Z3FOLD as a module. [ Salvatore Bonaccorso ] * Set ABI to 1 [ Nicolas Schier ] * ovl: permit overlayfs mounts in user namespaces (Closes: #913880) [ Hilko Bengen ] * Add patches to build libbpf.so with SONAME, link against libelf * Add versioned libbpf, libbpf-dev package (Closes: #914428) [ Hans van Kranenburg ] * [x86] Add patch to repair booting as Xen dom0 (Closes: #914951) * [x86] Add patches to support booting a Xen PVH guest via Grub2 [ Christoph Anton Mitterer ] * crypto: Enable MORUS and AEGIS AEAD ciphers (Closes: #914136) * [amd64]: Enable AES-NI/SSE2/AVX2 optimised implementations of the MORUS and AEGIS AEAD ciphers [ Bastian Blank ] * Enable NFT_CONNLIMIT, NFT_TUNNEL, NFT_SOCKET, NFT_OSF, NFT_TPROXY, IP_VS_MH. * Enable netfilter flow table support. * [x86] Enable DRM_XEN_FRONTEND. * Enable EFI_BOOTLOADER_CONTROL, EFI_CAPSULE_LOADER. -- Bastian Blank Sun, 16 Dec 2018 19:45:54 +0100 linux (4.19.5-1~exp1) experimental; urgency=medium * New upstream release: https://kernelnewbies.org/Linux_4.19 * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.1 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.3 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.4 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.5 [ Ben Hutchings ] * linux-perf: Enable verbose output for build-time feature detection * udeb: Define mtd-core-modules package to contain MTD core if not built-in * udeb: Move MTD core from nic-modules to mtd-core-modules * debian/changelog: Move older entries to changelog.old * debian/rules: Checksum only the source name and version from debian/changelog * Move generation of CONFIG_BUILD_SALT to gencontrol.py * [x86] hyperv-daemons: Make all services conditional on device existence * debian/rules.real: Fix build failure with pkg.linux.nosource profile * debian/source/options: Delete redundant compression setting; satisfy lintian * Documentation/media: uapi: Explicitly say there are no Invariant Sections (Closes: #698668) [ Karsten Merker ] * [riscv64] Build a kernel image and udebs for riscv64 (Closes: #908161) [ Uwe Kleine-König ] * [armhf,arm64] enable SND_BCM2835 as a module (Closes: #911121) * Enable Orange filesystem (Closes: #911743) * [arm64] Enable hns3 network driver as a module. (Closes: #914422) [ Noah Meyerhans ] * [cloud-amd64] Enable Amazon ENA ethernet driver (Closes: #910049) [ Romain Perier ] * [rt] Update to 4.19.1-rt3 * [rt] Update patch arm-disable-NEON-in-kernel-mode.patch, so it can be applied onto 4.19.2 * [rt] Update patch irq-allow-disabling-of-softirq-processing-in-irq-thread-context.patch, so it can be applied onto 4.19.2 * [amd64] Enable AMD pinctrl driver (Closes: #908954) * Enable Diffie-Hellman operations on retained keys (Closes: #911998) * Update patch features/all/lockdown/enable-cold-boot-attack-mitigation.patch, so it can be applied onto 4.19.2 * [x86] Enable DisplayPort CEC-Tunneling-over-AUX HDMI support (Closes: #913199) -- Bastian Blank Tue, 27 Nov 2018 20:06:42 +0100 linux (4.19~rc7-1~exp1) experimental; urgency=medium * New upstream release candidate [ Uwe Kleine-König ] * [armhf] enable MVNETA_BM_ENABLE and CAN_FLEXCAN as a module * enable NET_SCH_CAKE as a module (Closes: #908709) * enable HID_NTI as a module (Closes: #910260) [ Ben Hutchings ] * linux-kbuild: Include scripts/subarch.include (Closes: #910348) -- Ben Hutchings Sun, 07 Oct 2018 23:48:27 +0100 linux (4.19~rc6-1~exp1) experimental; urgency=medium * New upstream release candidate [ Ben Hutchings ] * [ppc64el] udeb: Fix relative #include filenames in kernel-image module list (really fixes FTBFS?) * debian/bin, debian/lib/python: Fix most errors reported by pycodestyle * debian/bin, debian/rules.real: Add symlink to Python package directory instead of editing path * debian/bin, debian/lib/python: Clean up imports based on pyflakes report * debian/bin, debian/lib/python: Delete write-only vars reported by pyflakes * debian/lib/python/debian_linux/gencontrol.py: Delete broken methods * debian/lib/python/debian_linux/config.py: Fix undefined exception type * Add Python static checks and unit tests to autopkgtest tests -- Ben Hutchings Wed, 03 Oct 2018 18:57:08 +0100 linux (4.19~rc4-1~exp1) experimental; urgency=medium * New upstream release candidate [ Ben Hutchings ] * debian/control: Add arch-qualification to build-dependencies for linux-perf (Closes: #908519) * debian/control: Build-depend on libunwind-dev instead of libunwind8-dev * [hppa,mips*,powerpc*,sh4] debian/control: Build-depend on libunwind-dev for linux-perf * debian/control: Build-depend on libnuma-dev for linux-perf on all arches * debian/control: Remove "cross" from profiles for build-dep on libssl-dev * [mips64*] debian/control: Build-depend on gcc-multilib for linux-perf * debian/lib/python: Use raw strings for all regexes * debian/control: Fix restrictions for build-deps on asciidoctor and patchutils * Add support for specifying build-dependencies in binary package templates * debian/templates: Move various build-dependencies to binary package templates * linux-perf: Fix generation of Perl and Python interpreter dependencies (Closes: #908547) * lockdep, lib{cpupower,lockdep}-dev: Remove bogus deps on ${shlibs:Depends} * debian/rules.d/tools/power/linux-cpupower: Add "+" to recursive make commands * tools: x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2 * tools: turbostat: Add checks for failure of fgets() and fscanf() * debian/control: Build-depend on texlive-latex-{base,extra}, dvipng for linux-doc * debian/rules{,.real}: Use /usr/share/dpkg/architecture.mk * debian/signing_templates/rules: Use /usr/share/dpkg/architecture.mk * linux-image-*-signed-template: Add ${misc:Depends} to Depends * linux-image-*-signed-template: Include changelog and copyright files * linux-image-*-signed-template: Depend on dpkg-dev * linux-image-*-signed-template: Override lintian warnings about non- executable scripts * [ia64] udeb: Fix priority of sn-modules * Revert "Revert "net: increase fragment memory usage limits"", as 4.19 includes a better fix for CVE-2018-5391 * debian/patches: Add Forwarded fields to several patches * [ppc64el] udeb: Fix relative #include filenames in module lists (fixes FTBFS) * [ppc64] udeb: Revert accidental change to nic-pcmcia-modules dependencies (fixes FTBFS) -- Ben Hutchings Tue, 18 Sep 2018 15:52:02 +0100 linux (4.19~rc3-1~exp1) experimental; urgency=medium * New upstream release candidate [ Ben Hutchings ] * [s390x] linux-image: Install compressed kernel image (fixes FTBFS) * [powerpc*] boot: Fix missing crc32poly.h when building with KERNEL_XZ (fixes FTBFS) * [x86] boot: Fix EFI stub alignment * wireless: Update "wireless: Disable regulatory.db direct loading" for 4.19-rc3 * aufs: Update support patchset to aufs4.x-rcN 20180910 -- Ben Hutchings Mon, 10 Sep 2018 20:13:55 +0100 linux (4.19~rc2-1~exp1) experimental; urgency=medium * New upstream release candidate [ Ben Hutchings ] * aufs: Disable until it is updated for Linux 4.19 * debian/rules.d: Update for move of bin2c back up to scripts * locking/lockdep: Delete unnecesary #include (fixes liblockdep build) * [hppa] debian/control: Simplify build-dependencies for 64-bit toolchain * Compile with gcc-8 on all architectures * udeb: Merge configuration directories and files across architectures * [alpha,hppa] udeb: Remove incorrect dependency overrides -- Ben Hutchings Mon, 03 Sep 2018 21:34:41 +0100 linux (4.18.20-2) unstable; urgency=medium * linux-kbuild: Include scripts/subarch.include (Closes: #910348) -- Ben Hutchings Fri, 23 Nov 2018 19:15:55 +0000 linux (4.18.20-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.11 - gso_segment: Reset skb->mac_len after modifying network header - ipv6: fix possible use-after-free in ip6_xmit() - net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT - [alpha, hppa, x86] net: hp100: fix always-true check for link up state - pppoe: fix reception of frames with no mac header - qmi_wwan: set DTR for modems in forced USB2 mode - udp4: fix IP_CMSG_CHECKSUM for connected sockets - neighbour: confirm neigh entries when ARP packet is received - udp6: add missing checks on edumux packet processing - net/sched: act_sample: fix NULL dereference in the data path - hv_netvsc: fix schedule in RCU context - [arm64, armhf] net: dsa: mv88e6xxx: Fix ATU Miss Violation - socket: fix struct ifreq size in compat ioctl - bnxt_en: Fix VF mac address regression. - ipv6: use rt6_info members when dst is set in rt6_fill_node - net/ipv6: do not copy dst flags on rt init - [arm64, armhf] net: mvpp2: let phylink manage the carrier state - net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags - NFC: Fix possible memory corruption when handling SHDLC I-Frame commands - NFC: Fix the number of pipes - ASoC: uapi: fix sound/skl-tplg-interface.h userspace compilation errors - ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error path - ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping - [powerpc*, mips*, x86, alpha, sparc*] ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO - ALSA: firewire-digi00x: fix memory leak of private data - ALSA: firewire-tascam: fix memory leak of private data - ALSA: fireworks: fix memory leak of response buffer at error path - ALSA: oxfw: fix memory leak for model-dependent data at error path - ALSA: oxfw: fix memory leak of discovered stream formats at error path - ALSA: oxfw: fix memory leak of private data - mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able - [x86] platform: dell-smbios-wmi: Correct a memory leak - [x86] platform: alienware-wmi: Correct a memory leak - xen/netfront: don't bug in case of too many frags - Revert "PCI: Add ACS quirk for Intel 300 series" - crypto: x86/aegis,morus - Do not require OSXSAVE for SSE2 - fork: report pid exhaustion correctly - mm: disable deferred struct page for 32-bit arches - mm: shmem.c: Correctly annotate new inodes for lockdep - bpf/verifier: disallow pointer subtraction - Revert "ubifs: xattr: Don't operate on deleted inodes" - libata: mask swap internal and hardware tag - ocfs2: fix ocfs2 read block panic - drm/i915/bdw: Increase IPS disable timeout to 100ms - drm/nouveau: Reset MST branching unit before enabling - drm/nouveau: Only write DP_MSTM_CTRL when needed - drm/nouveau: Remove duplicate poll_enable() in pmops_runtime_suspend() - drm/nouveau: Fix deadlocks in nouveau_connector_detect() - drm/nouveau/drm/nouveau: Don't forget to cancel hpd_work on suspend/unload - drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement - drm/nouveau/drm/nouveau: Fix deadlock with fb_helper with async RPM requests - drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect() - drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early - drm/vc4: Fix the "no scaling" case on multi-planar YUV formats - drm: udl: Destroy framebuffer only if it was initialized - drm/amdgpu: add new polaris pci id - tty: vt_ioctl: fix potential Spectre v1 - ext4: check to make sure the rename(2)'s destination is not freed - ext4: avoid divide by zero fault when deleting corrupted inline directories - ext4: avoid arithemetic overflow that can trigger a BUG - ext4: recalucate superblock checksum after updating free blocks/inodes - ext4: fix online resize's handling of a too-small final block group - ext4: fix online resizing for bigalloc file systems with a 1k block size - ext4: don't mark mmp buffer head dirty - ext4: show test_dummy_encryption mount option in /proc/mounts - ext4, dax: add ext4_bmap to ext4_dax_aops - ext4, dax: set ext4_dax_aops for dax files - sched/fair: Fix vruntime_normalized() for remote non-migration wakeup - [x86] vmw_balloon: include asm/io.h - iw_cxgb4: only allow 1 flush on user qps https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.12 - tsl2550: fix lux1_input error in low light - vmci: type promotion bug in qp_host_get_user_memory() - [x86] numa_emulation: Fix emulated-to-physical node mapping - staging: rts5208: fix missing error check on call to rtsx_write_register - [armhf] power: supply: axp288_charger: Fix initial constant_charge_current value - [sh4] serial: sh-sci: Stop RX FIFO timer during port shutdown - [arm64] power: vexpress: fix corruption in notifier registration - [x86] iommu/amd: make sure TLB to be flushed before IOVA freed - Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 - USB: serial: kobil_sct: fix modem-status error handling - 6lowpan: iphc: reset mac_header after decompress to fix panic - [s390x] mm: correct allocate_pgste proc_handler callback - power: remove possible deadlock when unregistering power_supply - cxgb4: Fix the condition to check if the card is T5 - RDMA/bnxt_re: Fix a couple off by one bugs - RDMA/i40w: Hold read semaphore while looking after VMA - RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c - IB/core: type promotion bug in rdma_rw_init_one_mr() - IB/mlx4: Test port number before querying type. - vhost_net: Avoid tx vring kicks during busyloop - IB/mlx5: Fix GRE flow specification - include/rdma/opa_addr.h: Fix an endianness issue - x86/tsc: Add missing header to tsc_msr.c - ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled - [x86] entry/64: Add two more instruction suffixes - scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size - scsi: klist: Make it safe to use klists in atomic context - [powerpc*] scsi: ibmvscsi: Improve strings handling - scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion - usb: wusbcore: security: cast sizeof to int for comparison - ath10k: sdio: use same endpoint id for all packets in a bundle - ath10k: sdio: set skb len for all rx packets - [powerpc*] powerpc/powernv/ioda2: Reduce upper limit for DMA window size - [x86] platform/x86: asus-wireless: Fix uninitialized symbol usage - [x86] ACPI / button: increment wakeup count only when notified - alarmtimer: Prevent overflow for relative nanosleep (CVE-2018-13053) - [s390x] s390/dasd: correct numa_node in dasd_alloc_queue - [s390x] s390/scm_blk: correct numa_node in scm_blk_dev_setup - posix-timers: Make forward callback return s64 - posix-timers: Sanitize overrun handling (CVE-2018-12896) - [powerpc*] ALSA: snd-aoa: add of_node_put() in error path - ath10k: use locked skb_dequeue for rx completions - [armhf] media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data - staging: android: ashmem: Fix mmap size validation - staging: mt7621-eth: Fix memory leak in mtk_add_mac() error path - [powerpc*, x86, alpha, m68k, hppa] drivers/tty: add error handling for pcmcia_loop_config - [arm64] dts: renesas: salvator-common: Fix adv7482 decimal unit addresses - [x86] media: tm6000: add error handling for dvb_register_adapter - [powerpc*, mips*, arm64, x86, alpha] ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge - ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock - [armhf] drm/sun4i: Enable DW HDMI PHY clock - [armhf] drm/sun4i: Fix releasing node when enumerating enpoints - ath10k: transmit queued frames after processing rx packets - mt76x2: fix mrr idx/count estimation in mt76x2_mac_fill_tx_status() - rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() - brcmsmac: fix wrap around in conversion from constant to s16 - bitfield: fix *_encode_bits() - [arm64]wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() - [armhf] drm/omap: gem: Fix mm_list locking - [armhf] mvebu: declare asm symbols as character arrays in pmsu.c - RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR - HID: hid-ntrig: add error handling for sysfs_create_group - [x86] HID: i2c-hid: Use devm to allocate i2c_hid struct - [arm64] dts: renesas: Fix VSPD registers range - drm/v3d: Take a lock across GPU scheduler job creation and queuing. - scsi: bnx2i: add error handling for ioremap_nocache - [arm64] scsi: hisi_sas: Fix the conflict between dev gone and host reset - [armhf] spi: orion: fix CS GPIO handling again - scsi: megaraid_sas: Update controller info during resume - [x86] ASoC: Intel: bytcr_rt5640: Fix Acer Iconia 8 over-current detect threshold - [x86] EDAC, i7core: Fix memleaks and use-after-free on probe and remove - [x86, arm64, armhf] ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs - module: exclude SHN_UNDEF symbols from kallsyms api - nfsd: fix corrupted reply to badly ordered compound - [mips*, arm64, x86] EDAC: Fix memleak in module init error path - ath10k: fix incorrect size of dma_free_coherent in ath10k_ce_alloc_src_ring_64 - ath10k: snoc: use correct bus-specific pointer in RX retry - fs/lock: skip lock owner pid translation in case we are in init_pid_ns - ath10k: fix memory leak of tpc_stats - Input: xen-kbdfront - fix multi-touch XenStore node's locations - drm/vc4: Add missing formats to vc4_format_mod_supported(). - [armhf] ARM: dts: dra7: fix DCAN node addresses - drm/vc4: plane: Expand the lower bits by repeating the higher bits - block: fix deadline elevator drain for zoned block devices - [x86] mm: Expand static page table for fixmap space - [armhf] serial: imx: restore handshaking irq for imx1 - [arm64] serial: mvebu-uart: Fix reporting of effective CSIZE to userspace - [x86] intel_th: Fix device removal logic - [x86] intel_th: Fix resource handling for ACPI glue layer - spi: tegra20-slink: explicitly enable/disable clock - [mips*, 'arm64', x86, armhf] regulator: fix crash caused by null driver data - [mips*, 'arm64', x86, armhf] regulator: Fix 'do-nothing' value for regulators without suspend state - USB: fix error handling in usb_driver_claim_interface() - USB: handle NULL config in usb_find_alt_setting() - usb: core: safely deal with the dynamic quirk lists - [armhf] usb: musb: dsps: do not disable CPPI41 irq in driver teardown - USB: usbdevfs: sanitize flags more - USB: usbdevfs: restore warning for nonsensical flags - Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" - USB: remove LPM management from usb_driver_claim_interface() - uaccess: Fix is_source param for check_copy_size() in copy_to_iter_mcsafe() - filesystem-dax: Fix use of zero page - Input: elantech - enable middle button of touchpad on ThinkPad P72 - IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop - IB/hfi1: Fix SL array bounds check - IB/hfi1: Invalid user input can result in crash - IB/hfi1: Fix context recovery when PBC has an UnsupportedVL - IB/hfi1: Fix destroy_qp hang after a link down - [x86] ACPI / hotplug / PCI: Don't scan for non-hotplug bridges if slot is not bridge - RDMA/uverbs: Atomically flush and mark closed the comp event queue - ARM: OMAP2+: Fix null hwmod for ti-sysc debug - ARM: OMAP2+: Fix module address for modules using mpu_rt_idx - bus: ti-sysc: Fix module register ioremap for larger offsets - qed: Wait for ready indication before rereading the shmem - qed: Wait for MCP halt and resume commands to take place - qed: Prevent a possible deadlock during driver load and unload - qed: Avoid sending mailbox commands when MFW is not responsive - thermal: of-thermal: disable passive polling when thermal zone is disabled - isofs: reject hardware sector size > 2048 bytes - mmc: atmel-mci: fix bad logic of sg_copy_{from,to}_buffer conversion - mmc: android-goldfish: fix bad logic of sg_copy_{from,to}_buffer conversion - bus: ti-sysc: Fix no_console_suspend handling - [armhf] dts: omap4-droid4: fix vibrations on Droid 4 - bpf, sockmap: fix sock_hash_alloc and reject zero-sized keys - bpf, sockmap: fix sock hash count in alloc_sock_hash_elem - tls: possible hang when do_tcp_sendpages hits sndbuf is full case - bpf: sockmap: write_space events need to be passed to TCP handler - drm/amdgpu: fix VM clearing for the root PD - drm/amdgpu: fix preamble handling - amdgpu: fix multi-process hang issue - net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler - tcp_bbr: add bbr_check_probe_rtt_done() helper - tcp_bbr: in restart from idle, see if we should exit PROBE_RTT - net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES - net: hns: fix skb->truesize underestimation - tools: bpftool: return from do_event_pipe() on bad arguments - e1000: check on netif_running() before calling e1000_up() - e1000: ensure to free old tx/rx rings in set_ringparam() - ixgbe: fix driver behaviour after issuing VFLR - i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled - i40e: fix condition of WARN_ONCE for stat strings - [arm64] crypto: cavium/nitrox - fix for command corruption in queue full case with backlog submissions. - hwmon: (ina2xx) fix sysfs shunt resistor read access - hwmon: (adt7475) Make adt7475_read_word() return errors - Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping" - drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode - drm/amdgpu: Update power state at the end of smu hw_init. - ata: ftide010: Add a quirk for SQ201 - nvme-fcloop: Fix dropped LS's to removed target port - [armhf] dts: omap4-droid4: Fix emmc errors seen on some devices - drm/amdgpu: Need to set moved to true when evict bo - [arm64, armhf] smccc-1.1: Make return values unsigned long - [arm64, armhf] smccc-1.1: Handle function result as parameters - i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus - clk: x86: Set default parent to 48Mhz - [x86] pti: Fix section mismatch warning/error - [powerpc*] KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds - [powerpc*] fix csum_ipv6_magic() on little endian platforms - [powerpc*] pkeys: Fix reading of ibm, processor-storage-keys property - [powerpc*] pseries: Fix unitialized timer reset on migration https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13 - mac80211: Run TXQ teardown code before de-registering interfaces - mac80211_hwsim: require at least one channel - Btrfs: fix unexpected failure of nocow buffered writes after snapshotting when low on space - [powerpc*] KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function - cfg80211: remove division by size of sizeof(struct ieee80211_wmm_rule) - btrfs: btrfs_shrink_device should call commit transaction at the end - scsi: csiostor: add a check for NULL pointer after kmalloc() - scsi: csiostor: fix incorrect port capabilities - scsi: libata: Add missing newline at end of file - scsi: aacraid: fix a signedness bug - bpf, sockmap: fix potential use after free in bpf_tcp_close - bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg - bpf: sockmap, decrement copied count correctly in redirect error case - mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X - mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X - cfg80211: make wmm_rule part of the reg_rule structure - mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom - nl80211: Fix nla_put_u8 to u16 for NL80211_WMMR_TXOP - nl80211: Pass center frequency in kHz instead of MHz - bpf: fix several offset tests in bpf_msg_pull_data - mac80211: mesh: fix HWMP sequence numbering to follow standard - mac80211: avoid kernel panic when building AMSDU from non-linear SKB - bpf: fix msg->data/data_end after sg shift repair in bpf_msg_pull_data - bpf: fix shift upon scatterlist ring wrap-around in bpf_msg_pull_data - bpf: fix sg shift repair start offset in bpf_msg_pull_data - [arm64] net: hns: add the code for cleaning pkt in chip - [arm64] net: hns: add netif_carrier_off before change speed and duplex - [arm64, armhf] net: mvpp2: initialize port of_node pointer - cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE - mac80211: do not convert to A-MSDU if frag/subframe limited - mac80211: always account for A-MSDU header changes - Revert "blk-throttle: fix race between blkcg_bio_issue_check() and cgroup_rmdir()" - md/raid5-cache: disable reshape completely - RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0 - bpf: Fix bpf_msg_pull_data() - bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP - fs/cifs: don't translate SFM_SLASH (U+F026) to backslash - mac80211: fix an off-by-one issue in A-MSDU max_subframe computation - cfg80211: fix a type issue in ieee80211_chandef_to_operating_class() - mac80211: fix WMM TXOP calculation - mac80211: fix a race between restart and CSA flows - mac80211: Fix station bandwidth setting after channel switch - mac80211: don't Tx a deauth frame if the AP forbade Tx - mac80211: shorten the IBSS debug messages - [powerpc*] net/ibm/emac: wrong emac_calc_base call was used by typo - ceph: avoid a use-after-free in ceph_destroy_options() - firmware: arm_scmi: fix divide by zero when sustained_perf_level is zero - afs: Fix cell specification to permit an empty address list - mm: madvise(MADV_DODUMP): allow hugetlbfs pages - bpf: 32-bit RSH verification must truncate input before the ALU op (CVE-2018-18445) - netfilter: xt_cluster: add dependency on conntrack module - [x86] HID: intel-ish-hid: Enable Sunrise Point-H ish driver - HID: add support for Apple Magic Keyboards - HID: hid-saitek: Add device ID for RAT 7 Contagion - scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails - scsi: iscsi: target: Fix conn_ops double free - perf annotate: Properly interpret indirect call - perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx() - perf util: Fix bad memory access in trace info. - [powerpc*] perf probe: Ignore SyS symbols irrespective of endianness - [arm64] perf annotate: Fix parsing aarch64 branch instructions after objdump update - netfilter: nf_tables: release chain in flushing set - HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report - USB: yurex: Check for truncation in yurex_read() - nvmet-rdma: fix possible bogus dereference under heavy load - net/mlx5: Consider PCI domain in search for next dev - [x86] HID: i2c-hid: Don't reset device upon system resume - dm raid: fix reshape race on small devices - drm/nouveau: fix oops in client init failure path - drm/nouveau/mmu: don't attempt to dereference vmm without valid instance pointer - drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS - drm/nouveau/disp: fix DP disable race - drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for LVDS/eDP panels - dm raid: fix stripe adding reshape deadlock - dm raid: fix rebuild of specific devices by updating superblock - dm raid: fix RAID leg rebuild errors - r8169: set TxConfig register after TX / RX is enabled, just like RxConfig - fs/cifs: suppress a string overflow warning - net: ena: fix surprise unplug NULL dereference kernel crash - net: ena: fix driver when PAGE_SIZE == 64kB - net: ena: fix device destruction to gracefully free resources - net: ena: fix potential double ena_destroy_device() - net: ena: fix missing lock during device destruction - net: ena: fix missing calls to READ_ONCE - sched/topology: Set correct NUMA topology type - dm thin metadata: try to avoid ever aborting transactions - netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT - netfilter: xt_hashlimit: use s->file instead of s->private - drm/amdgpu: Fix SDMA hang in prt mode v2 - drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk - r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED - [s390x] qeth: use vzalloc for QUERY OAT buffer - [s390x] qeth: don't dump past end of unknown HW header - cifs: read overflow in is_valid_oplock_break() - asm-generic: io: Fix ioport_map() for !CONFIG_GENERIC_IOMAP && CONFIG_INDIRECT_PIO - xen/manage: don't complain about an empty value in control/sysrq node - [mips*, x86, s390x] xen: avoid crash in disable_hotplug_cpu - new primitive: discard_new_inode() - vfs: don't evict uninitialized inode - ovl: set I_CREATING on inode being created - ovl: fix access beyond unterminated strings - ovl: fix memory leak on unlink of indexed file - ovl: fix format of setxattr debug - sysfs: Do not return POSIX ACL xattrs via listxattr - b43: fix DMA error related regression with proprietary firmware - firmware: Fix security issue with request_firmware_into_buf() - firmware: Always initialize the fw_priv list object - smb2: fix missing files in root share directory listing - [x86] iommu/amd: Clear memory encryption mask from physical address - ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 - [x86] crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe() - crypto: chelsio - Fix memory corruption in DMA Mapped buffers. - [arm64, armhf, x86, powerpc*] gpiolib: Free the last requested descriptor - [x86] Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect() - proc: restrict kernel stack dumps to root (CVE-2018-17972) - ocfs2: fix locking for res->tracking and dlm->tracking_list - [x86] HID: i2c-hid: disable runtime PM operations on hantick touchpad - ixgbe: check return value of napi_complete_done() - dm thin metadata: fix __udivdi3 undefined on 32-bit - Revert "drm/amd/pp: Send khz clock values to DC for smu7/8" https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.14 - perf/core: Add sanity check to deal with pinned event failure - mm: migration: fix migration of huge PMD shared pages - mm, thp: fix mlocking THP page with migration enabled - mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly - [x86] KVM: fix L1TF's MMIO GFN calculation - [x86] KVM: VMX: check for existence of secondary exec controls before accessing - blk-mq: I/O and timer unplugs are inverted in blktrace - [powerpc*, mips*, arm64, x86, alpha, armhf] mmc: core: Fix debounce time to use microseconds - [powerpc*, mips*, arm64, x86, alpha, armhf] mmc: slot-gpio: Fix debounce time to use miliseconds again - mac80211: allocate TXQs for active monitor interfaces - drm/amdgpu: Fix vce work queue was not cancelled when suspend - [x86] vdso: Fix asm constraints on vDSO syscall fallbacks - [x86] vdso: Only enable vDSO retpolines when enabled and supported - [x86] vdso: Fix vDSO syscall fallback asm constraint regression - [powerpc*, mips*, arm64, x86, s390x, armhf, sparc, hppa] PCI: Reprogram bridge prefetch registers on resume - mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys - dm mpath: fix attached_handler_name leak and dangling hw_handler_name pointer - dm cache metadata: ignore hints array being too small during resize - dm cache: fix resize crash if user doesn't reload cache table - USB: serial: simple: add Motorola Tetra MTP6550 id - USB: serial: option: improve Quectel EP06 detection - USB: serial: option: add two-endpoints device-id flag - usb: cdc_acm: Do not leak URB buffers - tty: Drop tty->count on tty_reopen() failure - [powerpc*] Avoid code patching freed init sections - [powerpc*] lib: fix book3s/32 boot failure due to code patching - f2fs: fix invalid memory access - tipc: call start and done ops directly in __tipc_nl_compat_dumpit() - ubifs: Check for name being NULL while mounting - rds: rds_ib_recv_alloc_cache() should call alloc_percpu_gfp() instead - ath10k: fix scan crash due to incorrect length calculation https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.15 - bnxt_en: Fix TX timeout during netpoll. - bnxt_en: free hwrm resources, if driver probe fails. - bonding: avoid possible dead-lock - ip6_tunnel: be careful when accessing the inner header - ip_tunnel: be careful when accessing the inner header - ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() - ipv6: take rcu lock in rawv6_send_hdrinc() - [armhf] net: dsa: bcm_sf2: Call setup during switch resume - [arm64] net: hns: fix for unmapping problem when SMMU is on - net: ipv4: update fnhe_pmtu when first hop's MTU changes - net/ipv6: Display all addresses in output of /proc/net/if_inet6 - netlabel: check for IPV4MASK in addrinfo_get - [armhf,arm64] net: mvpp2: Extract the correct ethtype from the skb for tx csum offload - [armhf,arm64] net: mvpp2: fix a txq_done race condition - net: sched: Add policy validation for tc attributes - net: sched: cls_u32: fix hnode refcounting - net/usb: cancel pending work when unbinding smsc75xx - qlcnic: fix Tx descriptor corruption on 82xx devices - qmi_wwan: Added support for Gemalto's Cinterion ALASxx WWAN interface - rtnetlink: fix rtnl_fdb_dump() for ndmsg header - rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096 - sctp: update dst pmtu with the correct daddr - team: Forbid enslaving team device to itself - tipc: fix flow control accounting for implicit connect - udp: Unbreak modules that rely on external __skb_recv_udp() availability - tun: remove unused parameters - tun: initialize napi_mutex unconditionally - tun: napi flags belong to tfile - [armhf,arm64] net: stmmac: Fixup the tail addr setting in xmit path - net/packet: fix packet drop as of virtio gso - [armhf] net: dsa: bcm_sf2: Fix unbind ordering - net/mlx5e: Set vlan masks for all offloaded TC rules - net: aquantia: memory corruption on jumbo frames - net/mlx5: E-Switch, Fix out of bound access when setting vport rate - bonding: pass link-local packets to bonding master also. - bonding: fix warning message - [armhf,arm64] net: stmmac: Rework coalesce timer and fix multi-queue races - nfp: avoid soft lockups under control message storm - bnxt_en: don't try to offload VLAN 'modify' action - net-ethtool: ETHTOOL_GUFO did not and should not require CAP_NET_ADMIN - net: phy: phylink: fix SFP interface autodetection - sfp: fix oops with ethtool -m - tcp/dccp: fix lockdep issue when SYN is backlogged - inet: make sure to grab rcu_read_lock before using ireq->ireq_opt - [armhf] net: dsa: b53: Keep CPU port as tagged in all VLANs - rtnetlink: Fail dump if target netnsid is invalid - bnxt_en: Fix VNIC reservations on the PF. - net: ipv4: don't let PMTU updates increase route MTU - net/mlx5: Check for SQ and not RQ state when modifying hairpin SQ - bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request - bnxt_en: get the reduced max_irqs by the ones used by RDMA - net/ipv6: Remove extra call to ip6_convert_metrics for multipath case - net/ipv6: stop leaking percpu memory in fib6 info - qed: Fix shmem structure inconsistency between driver and the mfw. - r8169: fix network stalls due to missing bit TXCFG_AUTO_FIFO - r8169: set RX_MULTI_EN bit in RxConfig for 8168F-family chips - vxlan: fill ttl inherit info - ASoC: dapm: Fix NULL pointer deference on CODEC to CODEC DAIs - hwmon: (nct6775) Fix access to fan pulse registers - [x86] ASoC: AMD: Ensure reset bit is cleared before configuring - Bluetooth: SMP: Fix trying to use non-existent local OOB data - Bluetooth: Use correct tfm to generate OOB data - Bluetooth: hci_ldisc: Free rw_semaphore on close - [armhf] mfd: omap-usb-host: Fix dts probe of children - [powerpc*] KVM: Book3S HV: Don't use compound_order to determine host mapping size - scsi: iscsi: target: Don't use stack buffer for scatterlist - scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted() - sound: enable interrupt after dma buffer initialization - sound: don't call skl_init_chip() to reset intel skl soc - bpf: btf: Fix end boundary calculation for type section - bpf: use __GFP_COMP while allocating page - hwmon: (nct6775) Fix virtual temperature sources for NCT6796D - hwmon: (nct6775) Fix RPM output for fan7 on NCT6796D - [armhf,arm64] stmmac: fix valid numbers of unicast filter entries - hwmon: (nct6775) Use different register to get fan RPM for fan7 - [x86] PCI: hv: support reporting serial number as slot information - [x86] clk: add "ether_clk" alias for Bay Trail / Cherry Trail - [x86] clk: Stop marking clocks as CLK_IS_CRITICAL - [x86] pinctrl: cannonlake: Fix gpio base for GPP-E - [x86] kvm/lapic: always disable MMIO interface in x2APIC mode - drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 - drm/amdkfd: Change the control stack MTYPE from UC to NC on GFX9 - drm/amdkfd: Fix ATS capablity was not reported correctly on some APUs - mm/vmstat.c: fix outdated vmstat_text - afs: Fix afs_server struct leak - afs: Fix clearance of reply - [mips*] Fix CONFIG_CMDLINE handling - [mips*] VDSO: Always map near top of user memory - [sparc64] mach64: detect the dot clock divider correctly on sparc - vsprintf: Fix off-by-one bug in bstr_printf() processing dereferenced pointers - percpu: stop leaking bitmap metadata blocks - perf script python: Fix export-to-postgresql.py occasional failure - perf script python: Fix export-to-sqlite.py sample columns - [s390x] cio: Fix how vfio-ccw checks pinned pages - dm cache: destroy migration_cache if cache target registration failed - dm: fix report zone remapping to account for partition offset - dm linear: eliminate linear_end_io call if CONFIG_DM_ZONED disabled - dm linear: fix linear_end_io conditional definition - cgroup: Fix dom_cgrp propagation when enabling threaded mode - drm/nouveau/drm/nouveau: Grab runtime PM ref in nv50_mstc_detect() - mmc: block: avoid multiblock reads for the last sector in SPI mode - [armhf] pinctrl: mcp23s08: fix irq and irqchip setup order - [arm64] perf: Reject stand-alone CHAIN events for PMUv3 - mm/mmap.c: don't clobber partially overlapping VMA with MAP_FIXED_NOREPLACE - mm/thp: fix call to mmu_notifier in set_pmd_migration_entry() v2 - filesystem-dax: Fix dax_layout_busy_page() livelock - mm: Preserve _PAGE_DEVMAP across mprotect() calls - [x86] i2c: i2c-scmi: fix for i2c_smbus_write_block_data - [powerpc*] KVM: Book3S HV: Avoid crash from THP collapse during radix page fault https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16 - media: af9035: prevent buffer overflow on write - spi: gpio: Fix copy-and-paste error - batman-adv: Avoid probe ELP information leak - batman-adv: Fix segfault when writing to throughput_override - batman-adv: Fix segfault when writing to sysfs elp_interval - batman-adv: Prevent duplicated gateway_node entry - batman-adv: Prevent duplicated nc_node entry - batman-adv: Prevent duplicated softif_vlan entry - batman-adv: Prevent duplicated global TT entry - batman-adv: Prevent duplicated tvlv handler - batman-adv: fix backbone_gw refcount on queue_work() failure - batman-adv: fix hardif_neigh refcount on queue_work() failure - cxgb4: fix abort_req_rss6 struct - [armhf] clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs - [powerpc*] scsi: ibmvscsis: Fix a stringop-overflow warning - [powerpc*] scsi: ibmvscsis: Ensure partition name is properly NUL terminated - [x86] intel_th: pci: Add Ice Lake PCH support - [m68k] Input: atakbd - fix Atari keymap - [m68k] Input: atakbd - fix Atari CapsLock behaviour - [powerpc*] net: emac: fix fixed-link setup for the RTL8363SB switch - qed: Fix populating the invalid stag value in multi function mode. - qed: Do not add VLAN 0 tag to untagged frames in multi-function mode. - [armhf,arm64] PCI: dwc: Fix scheduling while atomic issues - RDMA/uverbs: Fix validity check for modify QP - scsi: lpfc: Synchronize access to remoteport via rport - [arm64] drm: mali-dp: Call drm_crtc_vblank_reset on device init - scsi: ipr: System hung while dlpar adding primary ipr adapter back - scsi: sd: don't crash the host on invalid commands - bpf: sockmap only allow ESTABLISHED sock state - bpf: sockmap, fix transition through disconnect without close - bpf: test_maps, only support ESTABLISHED socks - net/mlx4: Use cpumask_available for eq->affinity_mask - clocksource/drivers/fttmr010: Fix set_next_event handler - RDMA/bnxt_re: Fix system crash during RDMA resource initialization - [armhf,arm64] iommu/rockchip: Free irqs in shutdown handler - [x86] pinctrl/amd: poll InterruptEnable bits in amd_gpio_irq_set_type - [powerpc*] tm: Fix userspace r13 corruption - [powerpc*] tm: Avoid possible userspace r1 corruption on reclaim - [powerpc*] numa: Use associativity if VPHN hcall is successful - [x86] iommu/amd: Return devid as alias for ACPI HID devices - [x86] boot: Fix kexec booting failure in the SEV bit detection code - Revert "vfs: fix freeze protection in mnt_want_write_file() for overlayfs" - mremap: properly flush TLB before releasing the page https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.17 - xfrm: Validate address prefix lengths in the xfrm selector. - xfrm6: call kfree_skb when skb is toobig - xfrm: reset transport header back to network header after all input transforms ahave been applied - xfrm: reset crypto_done when iterating over multiple input xfrms - mac80211: Always report TX status - cfg80211: reg: Init wiphy_idx in regulatory_hint_core() - mac80211: fix pending queue hang due to TX_DROP - cfg80211: Address some corner cases in scan result channel updating - mac80211: TDLS: fix skb queue/priority assignment - mac80211: fix TX status reporting for ieee80211s - xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry. - [armel,armhf] 8799/1: mm: fix pci_ioremap_io() offset check - xfrm: validate template mode - netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev - netfilter: conntrack: get rid of double sizeof - [arm64] hugetlb: Fix handling of young ptes - nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT - mac80211_hwsim: fix locking when iterating radios during ns exit - mac80211_hwsim: fix race in radio destruction from netlink notifier - mac80211_hwsim: do not omit multicast announce of first added radio - Bluetooth: SMP: fix crash in unpairing - qed: Avoid implicit enum conversion in qed_set_tunn_cls_info - qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv - qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor - qed: Avoid constant logical operation warning in qed_vf_pf_acquire - qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds - scsi: qedi: Initialize the stats mutex lock - rxrpc: Fix checks as to whether we should set up a new call - rxrpc: Fix RTT gathering - rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket - rxrpc: Fix error distribution - netfilter: nft_set_rbtree: add missing rb_erase() in GC routine - netfilter: avoid erronous array bounds warning - asix: Check for supported Wake-on-LAN modes - ax88179_178a: Check for supported Wake-on-LAN modes - lan78xx: Check for supported Wake-on-LAN modes - sr9800: Check for supported Wake-on-LAN modes - r8152: Check for supported Wake-on-LAN Modes - smsc75xx: Check for Wake-on-LAN modes - smsc95xx: Check for Wake-on-LAN modes - cfg80211: fix use-after-free in reg_process_hint() - [x86] KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled - [x86] KVM: Do not use kvm_x86_ops->mpx_supported() directly - [x86] KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS - perf/core: Fix perf_pmu_unregister() locking - [x86] perf/intel/uncore: Use boot_cpu_data.phys_proc_id instead of hardcorded physical package ID 0 - perf/ring_buffer: Prevent concurent ring buffer access - [x86] perf/intel/uncore: Fix PCI BDF address of M3UPI on SKX - [x86] perf/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events - thunderbolt: Do not handle ICM events after domain is stopped - thunderbolt: Initialize after IOMMUs - Revert "serial: 8250_dw: Fix runtime PM handling" - locking/ww_mutex: Fix runtime warning in the WW mutex selftest - drm/amd/display: Signal hw_done() after waiting for flip_done() - be2net: don't flip hw_features when VXLANs are added/deleted - [powerpc*] numa: Skip onlining a offline node in kdump path - net: cxgb3_main: fix a missing-check bug - yam: fix a missing-check bug - ocfs2: fix crash in ocfs2_duplicate_clusters_by_page() - mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl - mm/migrate.c: split only transparent huge pages when allocation fails - [x86] paravirt: Fix some warning messages - [arm64] clk: mvebu: armada-37xx-periph: Remove unused var num_parents - libertas: call into generic suspend code before turning off power - perf report: Don't try to map ip to invalid map - HID: i2c-hid: Remove RESEND_REPORT_DESCR quirk and its handling - [armhf] dts: imx53-qsb: disable 1.2GHz OPP - perf record: Use unmapped IP for inline callchain cursors - rxrpc: Don't check RXRPC_CALL_TX_LAST after calling rxrpc_rotate_tx_window() - rxrpc: Carry call state out of locked section in rxrpc_rotate_tx_window() - rxrpc: Only take the rwind and mtu values from latest ACK - rxrpc: Fix connection-level abort handling - [x86] net: ena: fix warning in rmmod caused by double iounmap - [x86] net: ena: fix rare bug when failed restart/resume is followed by driver removal - [x86] net: ena: fix NULL dereference due to untimely napi initialization - gpio: Assign gpio_irq_chip::parents to non-stack pointer - IB/mlx5: Unmap DMA addr from HCA before IOMMU - rds: RDS (tcp) hangs on sendto() to unresponding address - afs: Fix cell proc list - fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() - Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing" - bridge: do not add port to router list when receives query with source 0.0.0.0 - ipv6: mcast: fix a use-after-free in inet6_mc_check - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called - ipv6: rate-limit probes for neighbourless routes - llc: set SOCK_RCU_FREE in llc_sap_add_socket() - net: fec: don't dump RX FIFO register when not available - net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs - net/mlx5e: fix csum adjustments caused by RXFCS - net: sched: gred: pass the right attribute to gred_change_table_def() - net: socket: fix a missing-check bug - [armhf,arm64] net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules - net: udp: fix handling of CHECKSUM_COMPLETE packets - r8169: fix NAPI handling under high load - rtnetlink: Disallow FDB configuration for non-Ethernet device - sctp: fix race on sctp_id2asoc - tipc: fix unsafe rcu locking when accessing publication list - udp6: fix encap return code for resubmitting - vhost: Fix Spectre V1 vulnerability - virtio_net: avoid using netif_tx_disable() for serializing tx routine - ethtool: fix a privilege escalation bug - bonding: fix length of actor system - ip6_tunnel: Fix encapsulation layout - openvswitch: Fix push/pop ethernet validation - net: ipmr: fix unresolved entry dumps - net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type - net: sched: Fix for duplicate class dump - net/sched: cls_api: add missing validation of netlink attributes - net/ipv6: Allow onlink routes to have a device mismatch if it is the default route - sctp: fix the data size calculation in sctp_data_size - sctp: not free the new asoc when sctp_wait_for_connect returns err - net/mlx5: Fix memory leak when setting fpga ipsec caps - net: bpfilter: use get_pid_task instead of pid_task - net: drop skb on failure in ip_check_defrag() - net: fix pskb_trim_rcsum_slow() with odd trim offset - net/mlx5: WQ, fixes for fragmented WQ buffers API - [sparc64] Make corrupted user stacks more debuggable. - [sparc64] Set %l4 properly on trap return after handling signals. - [sparc64] Wire up compat getpeername and getsockname. - [sparc64] Fix single-pcr perf event counter management. - [sparc64] Fix syscall fallback bugs in VDSO. - [sparc64] Throttle perf events properly. - net: bridge: remove ipv6 zero address check in mcast queries https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.18 - vfs: swap names of {do,vfs}_clone_file_range() - bpf: fix partial copy of map_ptr when dst is scalar - [armhf,arm64] clk: sunxi-ng: sun4i: Set VCO and PLL bias current to lowest setting - fscache: Fix incomplete initialisation of inline key space - cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) - fscache: Fix out of bound read in long cookie keys - ptp: fix Spectre v1 vulnerability - drm/edid: VSDB yCBCr420 Deep Color mode bit definitions - drm: fb-helper: Reject all pixel format changing requests - RDMA/ucma: Fix Spectre v1 vulnerability (CVE-2017-5753) - IB/ucm: Fix Spectre v1 vulnerability (CVE-2017-5753) - cdc-acm: do not reset notification buffer index upon urb unlinking - cdc-acm: correct counting of UART states in serial state notification - cdc-acm: fix race between reset and control messaging - usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() - usb: gadget: storage: Fix Spectre v1 vulnerability - usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable - usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms - USB: fix the usbfs flag sanitization for control transfers - tracing: Fix synthetic event to accept unsigned modifier - tracing: Fix synthetic event to allow semicolon at end - [armhf] drm/sun4i: Fix an ulong overflow in the dotclock driver - sched/fair: Fix throttle_list starvation with low CFS quota - [x86] tsc: Force inlining of cyc2ns bits - [x86] hibernate: Fix nosave_regions setup for hibernation - [x86] percpu: Fix this_cpu_read() - [x86] time: Correct the attribute on jiffies' definition https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19 - [armhf] mtd: rawnand: marvell: fix the IRQ handler complete() condition - spi: spi-mem: Adjust op len based on message/transfer size limitations - bcache: trace missed reading by cache_missed - bcache: correct dirty data statistics - bcache: fix miss key refill->end in writeback - hwmon: (pmbus) Fix page count auto-detection. - jffs2: free jffs2_sb_info through jffs2_kill_sb() - block: setup bounce bio_sets properly - block: don't deal with discard limit in blkdev_issue_discard() - block: make sure discard bio is aligned with logical block size - block: make sure writesame bio is aligned with logical block size - cpufreq: conservative: Take limits changes into account properly - dma-mapping: fix panic caused by passing empty cma command line argument - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer() - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended opcodes - [x86] kprobes: Use preempt_enable() in optimized_callback() - ipmi: Fix timer race with module unload - acpi, nfit: Fix Address Range Scrub completion tracking - [hppa] Fix address in HPMC IVA - [hppa] Fix map_pages() to not overwrite existing pte entries - [hppa] Fix exported address of os_hpmc handler - [x86] ALSA: hda - Add quirk for ASUS G751 laptop - [x86] ALSA: hda - Fix headphone pin config for ASUS G751 - [x86] ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715 - [x86] ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) - ALSA: hda: Add 2 more models to the power_save blacklist - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops - [x86] speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (CVE-2017-5715) - [x86] xen: Fix boot loader version reported for PVH guests - [x86] corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided - [x86] mm/pat: Disable preemption around __flush_tlb_all() - [x86] speculation: Support Enhanced IBRS on future CPUs (CVE-2017-5715) - [armhf] dts: exynos: Disable pull control for MAX8997 interrupts on Origen - drm: fix use of freed memory in drm_mode_setcrtc - bpf: do not blindly change rlimit in reuseport net selftest - nvme: remove ns sibling before clearing path - Revert "perf tools: Fix PMU term format max value calculation" - xsk: do not call synchronize_net() under RCU read lock - xfrm: policy: use hlist rcu variants on insert - [x86] perf vendor events intel: Fix wrong filter_band* values for uncore events - r8169: Enable MSI-X on RTL8106e - nfp: flower: fix pedit set actions for multiple partial masks - nfp: flower: use offsets provided by pedit instead of index for ipv6 - sched/fair: Fix the min_vruntime update logic in dequeue_entity() - perf evsel: Store ids for events with their own cpus perf_event__synthesize_event_update_cpus - perf tools: Fix use of alternatives to find JDIR - perf cpu_map: Align cpu map synthesized events properly. - perf report: Don't crash on invalid inline debug information - [x86] fpu: Remove second definition of fpu in __fpu__restore_sig() - net: qla3xxx: Remove overflowing shift statement - r8169: re-enable MSI-X on RTL8168g - drm: Get ref on CRTC commit object when waiting for flip_done - [arm64] net: socionext: Reset tx queue in ndo_stop - netfilter: xt_nat: fix DNAT target for shifted portmap ranges - [m68k] ataflop: fix error handling during setup - [m68k] swim: fix cleanup on setup error - [arm64] cpufeature: ctr: Fix cpu capability check for late CPUs - nfp: devlink port split support for 1x100G CXP NIC - tun: Consistently configure generic netdev params via rtnetlink - [s390x] sthyi: Fix machine name validity indication - hwmon: (pwm-fan) Set fan speed to 0 on suspend - lightnvm: pblk: fix race on sysfs line state - lightnvm: pblk: fix two sleep-in-atomic-context bugs - lightnvm: pblk: fix race condition on metadata I/O - perf tools: Free temporary 'sys' string in read_event_files() - perf tools: Cleanup trace-event-info 'tdata' leak - perf strbuf: Match va_{add,copy} with va_end - [x86] cpupower: Fix coredump on VMWare - bcache: Populate writeback_rate_minimum attribute - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 - sdhci: acpi: add free_slot callback - iwlwifi: pcie: avoid empty free RB queue - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI - [i386] olpc: Indicate that legacy PC XO-1 platform should not register RTC - ACPI/PPTT: Handle architecturally unknown cache types - ACPI / PM: LPIT: Register sysfs attributes based on FADT - ACPI / processor: Fix the return value of acpi_processor_ids_walk() - cpufreq: dt: Try freeing static OPPs only if we have added them - [x86] intel_rdt: Show missing resctrl mount options - [arm64] signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack - [arm64] net: hns3: Fix for packet buffer setting bug - [x86] boot: Fix EFI stub alignment - [arm64] net: hns3: Add nic state check before calling netif_tx_wake_queue - [arm64] net: hns3: Fix ets validate issue - [armhf,arm64] pinctrl: sunxi: fix 'pctrl->functions' allocation in sunxi_pinctrl_build_state - [arm64] pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux - brcmfmac: fix for proper support of 160MHz bandwidth - [arm64] net: hns3: Check hdev state when getting link status - [arm64] net: hns3: Set STATE_DOWN bit of hdev state when stopping net - net: phy: phylink: ensure the carrier is off when starting phylink - block, bfq: correctly charge and reset entity service in all cases - [arm64] entry: Allow handling of undefined instructions from EL1 - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() - spi: gpio: No MISO does not imply no RX - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers - [arm64] pinctrl: qcom: spmi-mpp: Fix drive strength setting - bpf/verifier: fix verifier instability - failover: Add missing check to validate 'slave_dev' in net_failover_slave_unregister - perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo - [arm64] pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant - [arm64] pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant - [arm64] net: hns3: Preserve vlan 0 in hardware table - [arm64] net: hns3: Fix ping exited problem when doing lp selftest - [arm64] net: hns3: Fix for vf vlan delete failed problem - [armhf,arm64] net: dsa: mv88e6xxx: Fix writing to a PHY page. - rsi: fix memory alignment issue in ARM32 platforms - iwlwifi: mvm: fix BAR seq ctrl reporting - ixgbe: disallow IPsec Tx offload when in SR-IOV mode - ixgbevf: VF2VF TCP RSS - ath10k: schedule hardware restart if WMI command times out - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 - cgroup, netclassid: add a preemption point to write_classid - [armhf,arm64] net: stmmac: dwmac-sun8i: fix OF child-node lookup - f2fs: fix to account IO correctly for cgroup writeback - MD: Memory leak when flush bio size is zero - md: fix memleak for mempool - scsi: esp_scsi: Track residual for PIO transfers - scsi: ufs: Schedule clk gating work on correct queue - UAPI: ndctl: Fix g++-unsupported initialisation in headers - [x86] KVM: nVMX: Clear reserved bits of #DB exit qualification - scsi: megaraid_sas: fix a missing-check bug - RDMA/core: Do not expose unsupported counters - IB/ipoib: Clear IPCB before icmp_send - usb: host: ohci-at91: fix request of irq for optional gpio - usb: typec: tcpm: Report back negotiated PPS voltage and current - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/ deactivated - f2fs: clear PageError on the read path - [x86] Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask - [x86] VMCI: Resource wildcard match fixed - PCI / ACPI: Enable wake automatically for power managed bridges - xprtrdma: Reset credit grant properly after a disconnect - irqchip/pdc: Setup all edge interrupts as rising edge at GIC - [armhf,arm64] usb: dwc2: fix a race with external vbus supply - ext4: fix argument checking in EXT4_IOC_MOVE_EXT - MD: fix invalid stored role for a disk - nvmem: check the return value of nvmem_add_cells() - xhci: Avoid USB autosuspend when resuming USB2 ports. - f2fs: fix to recover inode's crtime during POR - f2fs: fix to recover inode's i_flags during POR - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice - [armhf.arm64] usb: chipidea: Prevent unbalanced IRQ disable - [x86] driver/dma/ioat: Call del_timer_sync() without holding prep_lock - IB/mlx5: Allow transition of DCI QP to reset - uio: ensure class is registered before devices - scsi: lpfc: Correct soft lockup when running mds diagnostics - scsi: lpfc: Correct race with abort on completion path - f2fs: avoid sleeping under spin_lock - f2fs: report error if quota off error during umount - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init - IB/rxe: fix for duplicate request processing and ack psns - ALSA: hda: Check the non-cached stream buffers more explicitly - [x86] cpupower: Fix AMD Family 0x17 msr_pstate size - Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()" - f2fs: fix to recover cold bit of inode block during POR - f2fs: fix to account IO correctly - OPP: Free OPP table properly on performance state irregularities - [armhf] dts: exynos: Add missing cooling device properties for CPUs - [armhf] dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings - [armhf] dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250 - xen-swiotlb: use actually allocated size on check physical continuous - tpm: Restore functionality to xen vtpm driver. - xen/blkfront: avoid NULL blkfront_info dereference on device removal - xen/balloon: Support xend-based toolstack - xen: fix race in xen_qlock_wait() - xen: make xen_qlock_wait() nestable - xen/pvh: increase early stack size - xen/pvh: don't try to unplug emulated devices - libertas: don't set URB_ZERO_PACKET on IN USB transfer - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten - usb: typec: tcpm: Fix APDO PPS order checking to be based on voltage - mt76: mt76x2: fix multi-interface beacon configuration - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate() - net/ipv4: defensive cipso option parsing - libnvdimm: Hold reference on parent while scheduling async init - libnvdimm, region: Fail badblocks listing for inactive regions - libnvdimm, pmem: Fix badblocks population for 'raw' namespaces - [x86] ASoC: intel: skylake: Add missing break in skl_tplg_get_token() - IB/mlx5: Fix MR cache initialization - IB/rxe: Revise the ib_wr_opcode enum - jbd2: fix use after free in jbd2_log_do_checkpoint() - gfs2_meta: ->mount() can get NULL dev_name - ext4: fix EXT4_IOC_SWAP_BOOT - ext4: initialize retries variable in ext4_da_write_inline_data_begin() - ext4: fix setattr project check in fssetxattr ioctl - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR - ext4: fix use-after-free race in ext4_remount()'s error path - selinux: fix mounting of cgroup2 under older policies - HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452 - HID: hiddev: fix potential Spectre v1 - [x86] EDAC, amd64: Add Family 17h, models 10h-2fh support - [x86] EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting - [x86] EDAC, skx_edac: Fix logical channel intermediate decoding - PCI/ASPM: Fix link_state teardown on device removal - [x86] PCI: vmd: White list for fast interrupt handlers - [powerpc*] signal/GenWQE: Fix sending of SIGKILL - signal: Guard against negative signal numbers in copy_siginfo_from_user32 - crypto: lrw - Fix out-of bounds access on counter overflow - crypto: tcrypt - fix ghash-generic speed test - [x86] crypto: aesni - don't use GFP_ATOMIC allocation if the request doesn't cross a page in gcm - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range() - ima: fix showing large 'violations' or 'runtime_measurements_count' - hugetlbfs: dirty pages as they are added to pagecache - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly - mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback - [armhf,arm64] KVM: Ensure only THP is candidate for adjustment - [arm64] KVM: Fix caching of host MDCR_EL2 value - [armhf] w1: omap-hdq: fix missing bus unregister at removal - smb3: allow stats which track session and share reconnects to be reset - smb3: do not attempt cifs operation in smb3 query info error path - smb3: on kerberos mount if server doesn't specify auth type use krb5 - printk: Fix panic caused by passing log_buf_len to command line - genirq: Fix race on spurious interrupt detection - NFSv4.1: Fix the r/wsize checking - nfs: Fix a missed page unlock after pg_doio() - nfsd: correctly decrement odstate refcount in error path - nfsd: Fix an Oops in free_session() - lockd: fix access beyond unterminated strings in prints - dm ioctl: harden copy_params()'s copy_from_user() from malicious users - dm zoned: fix metadata block ref counting - dm zoned: fix various dmz_get_mblock() issues - media: ov7670: make "xclk" clock optional - fsnotify: Fix busy inodes during unmount - [powerpc*] msi: Fix compile error on mpc83xx - [powerpc*] tm: Fix HFSCR bit for no suspend case - [powerpc*] 4s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9 - [mips*] memset: Fix CPU_DADDI_WORKAROUNDS `small_fixup' regression - [mips*/octeon] fix out of bounds array access on CN68XX - rtc: ds1307: fix ds1339 wakealarm support - rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt' - rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI - [armhf] power: supply: twl4030-charger: fix OF sibling-node lookup - [armhf,arm64] iommu/arm-smmu: Ensure that page-table updates are visible before TLBI - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD - Revert "media: dvbsky: use just one mutex for serializing device R/W ops" - media: cec: make cec_get_edid_spa_location() an inline function - media: cec: integrate cec_validate_phys_addr() in cec-api.c - xen: fix xen_qlock_wait() - xen: remove size limit of privcmd-buf mapping interface - xen-blkfront: fix kernel panic with negotiate_mq error path - media: cec: add new tx/rx status bits to detect aborts/timeouts - media: cec: fix the Signal Free Time calculation - media: cec: forgot to cancel delayed work - media: em28xx: use a default format if TRY_FMT fails - media: tvp5150: avoid going past array on v4l2_querymenu() - media: em28xx: fix input name for Terratec AV 350 - media: em28xx: make v4l2-compliance happier by starting sequence on zero - media: em28xx: fix handler for vidioc_s_input() - media: media colorspaces*.rst: rename AdobeRGB to opRGB - media: replace ADOBERGB by OPRGB - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC - [arm64] lse: remove -fcall-used-x0 flag - [arm64] rpmsg: smd: fix memory leak on channel create - Cramfs: fix abad comparison when wrap-arounds occur - [armhf,arm64] soc/tegra: pmc: Fix child-node lookup - tracing: Return -ENOENT if there is no target synthetic event - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled - btrfs: Handle owner mismatch gracefully when walking up tree - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock - btrfs: fix error handling in free_log_tree - btrfs: fix error handling in btrfs_dev_replace_start - btrfs: Enhance btrfs_trim_fs function to handle error better - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list - btrfs: don't attempt to trim devices that don't support it - btrfs: keep trim from interfering with transaction commits - btrfs: wait on caching when putting the bg cache - Btrfs: don't clean dirty pages during buffered writes - btrfs: release metadata before running delayed refs - btrfs: protect space cache inode alloc with GFP_NOFS - btrfs: reset max_extent_size on clear in a bitmap - btrfs: make sure we create all new block groups - Btrfs: fix warning when replaying log after fsync of a tmpfile - Btrfs: fix wrong dentries after fsync of file that got its parent replaced - btrfs: qgroup: Dirty all qgroups before rescan - Btrfs: fix null pointer dereference on compressed write path error - Btrfs: fix assertion on fsync of regular file when using no-holes feature - Btrfs: fix deadlock when writing out free space caches - btrfs: reset max_extent_size properly - btrfs: set max_extent_size properly - btrfs: don't use ctl->free_space for max_extent_size - btrfs: only free reserved extent if we didn't insert it - btrfs: fix insert_reserved error handling - btrfs: don't run delayed_iputs in commit - btrfs: move the dio_sem higher up the callchain - Btrfs: fix use-after-free during inode eviction - Btrfs: fix use-after-free when dumping free space - net: sched: Remove TCA_OPTIONS from policy - userns: also map extents in the reverse map to kernel IDs - bpf: wait for running BPF programs when updating map-in-map - MD: fix invalid stored role for a disk - try2 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.20 - [powerpc*] traps: restore recoverability of machine_check interrupts - [powerpc*] 64/module: REL32 relocation range check - [powerpc*] mm: Fix page table dump to work on Radix - [powerpc*] mm: fix always true/false warning in slice.c - drm/amd/display: fix bug of accessing invalid memory - Input: wm97xx-ts - fix exit path - [powerpc*] eeh: Fix possible null deref in eeh_dump_dev_log() - tty: check name length in tty_find_polling_driver() - tracing/kprobes: Check the probe on unloaded module correctly - drm/amdgpu/powerplay: fix missing break in switch statements - [powerpc*] nohash: fix undefined behaviour when testing page size support - [powerpc*] mm: Don't report hugepage tables as memory leaks when using kmemleak - [armhf] drm/omap: fix memory barrier bug in DMM driver - drm/amd/display: fix gamma not being applied - [arm64] drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer - media: pci: cx23885: handle adding to list failure - [mips*] kexec: Mark CPU offline before disabling local IRQ - [powerpc*] memtrace: Remove memory in chunks - [mips*] PCI: Call pcie_bus_configure_settings() to set MPS/MRRS - media: tvp5150: fix width alignment during set_selection() - drm/amdgpu: Fix SDMA TO after GPU reset v3 - 9p locks: fix glock.client_id leak in do_lock - udf: Prevent write-unsupported filesystem to be remounted read-write - 9p: clear dangling pointers in p9stat_free - cdrom: fix improper type cast, which can leat to information leak. - ovl: fix error handling in ovl_verify_set_fh() - ovl: check whiteout in ovl_create_over_whiteout() - [sh4] serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters - scsi: qla2xxx: Fix process response queue for ISP26XX and above - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx - scsi: qla2xxx: shutdown chip if reset fail - scsi: qla2xxx: Fix duplicate switch database entries - scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured - fuse: Fix use-after-free in fuse_dev_do_read() - fuse: Fix use-after-free in fuse_dev_do_write() - fuse: fix blocked_waitq wakeup - fuse: set FR_SENT while locked - ovl: fix recursive oi->lock in ovl_link() - scsi: qla2xxx: Fix re-using LoopID when handle is in use - scsi: qla2xxx: Fix NVMe session hang on unload - [arm64] clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL - [arm64] clk: meson: axg: mark fdiv2 and fdiv3 as critical - zram: close udev startup race condition as default groups - [mips*el/loonsgon-3] Fix CPU UART irq delivery problem - [mips*el/loongson-3] Fix BRIDGE irq delivery problem - [armhf] clk: s2mps11: Fix matching when built as module and DT node contains compatible - [armhf,arm64] clk: sunxi-ng: h6: fix bus clocks' divider position - [arm64] clk: rockchip: fix wrong mmc sample phase shift for rk3328 - [armhf,arm64] clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call - libceph: bump CEPH_MSG_MAX_DATA_LEN - Revert "ceph: fix dentry leak in splice_dentry()" - thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs - mach64: fix display corruption on big endian machines - mach64: fix image corruption due to reading accelerator registers - acpi/nfit, x86/mce: Handle only uncorrectable machine checks - acpi/nfit, x86/mce: Validate a MCE's address before using it - acpi, nfit: Fix ARS overflow continuation - [arm64] reset: hisilicon: fix potential NULL pointer dereference - vhost/scsi: truncate T10 PI iov_iter to prot_bytes - scsi: qla2xxx: Initialize port speed to avoid setting lower speed - SCSI: fix queue cleanup race before queue initialization is done - [powerpc*] Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP" - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry - ocfs2: free up write context when direct IO failed - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings - memory_hotplug: cond_resched in __remove_pages - netfilter: conntrack: fix calculation of next bucket number in early_drop - [armhf] 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm - bonding/802.3ad: fix link_failure_count tracking - mtd: nand: Fix nanddev_neraseblocks() - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option - hwmon: (core) Fix double-free in __hwmon_device_register() - perf stat: Handle different PMU names with common prefix - of, numa: Validate some distance map rules - [x86] hyper-v: Enable PIT shutdown quirk - termios, tty/tty_baudrate.c: fix buffer overrun - watchdog/core: Add missing prototypes for weak functions - btrfs: fix pinned underflow after transaction aborted - Btrfs: fix cur_offset in the error case for nocow - Btrfs: fix infinite loop on inode eviction after deduplication of eof block - Btrfs: fix data corruption due to cloning of eof block - clockevents/drivers/i8253: Add support for PIT shutdown quirk - ext4: add missing brelse() update_backups()'s error path - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path - ext4: avoid potential extra brelse in setup_new_flex_group_blocks() - ext4: missing !bh check in ext4_xattr_inode_write() - ext4: fix possible inode leak in the retry loop of ext4_resize_fs() - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty() - ext4: avoid buffer leak in ext4_orphan_add() after prior errors - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing - ext4: avoid possible double brelse() in add_new_gdb() on error path - ext4: fix possible leak of sbi->s_group_desc_leak in error path - ext4: fix possible leak of s_journal_flag_rwsem in error path - ext4: fix buffer leak in ext4_xattr_get_block() on error path - ext4: release bs.bh before re-using in ext4_xattr_block_find() - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path - ext4: fix buffer leak in __ext4_read_dirblock() on error path - mount: Retest MNT_LOCKED in do_umount - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts - mount: Prevent MNT_DETACH from disconnecting locked mounts - mnt: fix __detach_mounts infinite loop - sunrpc: correct the computation for page_ptr when truncating - NFSv4: Don't exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING - nfsd: COPY and CLONE operations require the saved filehandle to be set - rtc: hctosys: Add missing range error reporting - fuse: fix use-after-free in fuse_direct_IO() - fuse: fix leaked notify reply - selinux: check length properly in SCTP bind hook - configfs: replace strncpy with memcpy - gfs2: Put bitmap buffers in put_super - gfs2: Fix metadata read-ahead during truncate (2) - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD - crypto: user - fix leaking uninitialized memory to userspace - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! - mm/swapfile.c: use kvzalloc for swap_info_struct allocation - [armhf,arm64] efi/libstub: Pack FDT after populating it - [armhf,arm64] drm/rockchip: Allow driver to be shutdown on reboot/kexec - [arm64] drm/msm: fix OF child-node lookup - drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type - drm/nouveau: Check backlight IDs are >= 0, not > 0 - drm/nouveau: Fix nv50_mstc->best_encoder() - drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD - [armhf] drm/etnaviv: fix bogus fence complete check in timeout handler - drm/dp_mst: Check if primary mstb is null - drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003) - [x86] drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode - [x86] drm/i915: Restore vblank interrupts earlier - [x86] drm/i915: Don't unset intel_connector->mst_port - [x86] drm/i915: Skip vcpi allocation for MSTB ports that are gone - [x86] drm/i915: Large page offsets for pread/pwrite - [x86] drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse() - [x86] drm/i915/dp: Restrict link retrain workaround to external monitors - [x86] drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values - [x86] drm/i915: Fix error handling for the NV12 fb dimensions check - [x86] drm/i915: Fix ilk+ watermarks when disabling pipes - [x86] drm/i915: Compare user's 64b GTT offset even on 32b - [x86] drm/i915: Don't oops during modeset shutdown after lpe audio deinit - [x86] drm/i915: Mark pin flags as u64 - [x86] drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5 - [x86] drm/i915/execlists: Force write serialisation into context image vs execution - [x86] drm/i915: Fix possible race in intel_dp_add_mst_connector() - [armhf,arm64] CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM [ Ben Hutchings ] * linux-perf: Fix BPF feature detection * [rt] Update to 4.18.16-rt9: - Revert "rcu: Use cpus_read_lock() while looking at cpu_online_mask" - EXP rcu: Revert expedited GP parallelization cleverness [ Romain Perier ] * [rt] Update to 4.18.12-rt7 * Fixed FTBFS caused by wireless-disable-regulatory.db-direct-loading.patch, due to conflicting types for 'reg_query_regdb_wmm' [ Vagrant Cascadian ] * [arm64] Update pinebook/teres-i device-tree patches to 4.19.x: - Enables the lid to wakeup from suspend. [ Salvatore Bonaccorso ] * [x86] swiotlb: Enable swiotlb for > 4GiG RAM on 32-bit kernels (Closes: #908924) * mremap: properly flush TLB before releasing the page (CVE-2018-18281) * cdrom: fix improper type cast, which can leat to information leak (CVE-2018-18710) -- Ben Hutchings Wed, 21 Nov 2018 20:55:46 +0000 linux (4.18.10-2) unstable; urgency=medium [ Ben Hutchings ] * [rt][arm64,armhf] Fix build failure after rebasing onto 4.18.10 * xen-netback: fix input validation in xenvif_set_hash_mapping() (CVE-2018-15471) * Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name" (Closes: #909813) [ Salvatore Bonaccorso ] * [arm64] KVM: Tighten guest core register access from userspace (CVE-2018-18021) * [arm64] KVM: Sanitize PSTATE.M when being set from userspace (CVE-2018-18021) -- Ben Hutchings Sun, 07 Oct 2018 21:57:06 +0100 linux (4.18.10-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.9 - i2c: xiic: Make the start and the byte count write atomic - i2c: i801: fix DNV's SMBCTRL register offset - HID: multitouch: fix Elan panels with 2 input modes declaration - HID: core: fix grouping by application - HID: i2c-hid: Fix flooded incomplete report after S3 on Rayd touchscreen - HID: input: fix leaking custom input node name - mm/hugetlb: filter out hugetlb pages if HUGEPAGE migration is not supported. - mac80211: don't update the PM state of a peer upon a multicast frame - scsi: lpfc: Correct MDS diag and nvmet configuration - nbd: don't allow invalid blocksize settings - block: don't warn when doing fsync on read-only devices - block: bfq: swap puts in bfqg_and_blkg_put - android: binder: fix the race mmap and alloc_new_buf_locked - [mips*] VDSO: Match data page cache colouring when D$ aliases - smb3: Backup intent flag missing for directory opens with backupuid mounts - smb3: check for and properly advertise directory lease support - cifs: connect to servername instead of IP for IPC$ share - btrfs: fix qgroup_free wrong num_bytes in btrfs_subvolume_reserve_metadata - btrfs: fix data corruption when deduplicating between different files - [arm64] KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD - [armhf, arm64] KVM: Clean dcache to PoC when changing PTE due to CoW - [[powerpc*] KVM: Book3S HV: Use correct pagesize in kvm_unmap_radix() - [s390x] KVM: vsie: copy wrapping keys to right place - [x86] KVM: SVM: Set EMULTYPE_NO_REEXECUTE for RSM emulation - [x86] KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr - [x86] KVM: Invert emulation re-execute behavior to make it opt-in - [x86] KVM: Merge EMULTYPE_RETRY and EMULTYPE_ALLOW_REEXECUTE - [x86] KVM: Default to not allowing emulation retry in kvm_mmu_page_fault - [x86] KVM: Do not re-{try,execute} after failed emulation in L2 - ACPI / LPSS: Force LPSS quirks on boot - memory: ti-aemif: fix a potential NULL-pointer dereference - ALSA: hda - Fix cancel_work_sync() stall from jackpoll work - cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun() - cpu/hotplug: Prevent state corruption on error rollback - [x86] microcode: Make sure boot_cpu_data.microcode is up-to-date - [x86] microcode: Update the new microcode revision unconditionally - [x86] process: Don't mix user/kernel regs in 64bit __show_regs() - [x86] apic/vector: Make error return value negative - switchtec: Fix Spectre v1 vulnerability - misc: mic: SCIF Fix scif_get_new_port() error handling - ALSA: hda/realtek - Add mute LED quirk for HP Spectre x360 - ethtool: Remove trailing semicolon for static inline - i2c: aspeed: Add an explicit type casting for *get_clk_reg_val - Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV - gpio: tegra: Move driver registration to subsys_init level - [powerpc*] powernv: Fix concurrency issue with npu->mmio_atsd_usage - [powerpc*] 4xx: Fix error return path in ppc4xx_msi_probe() - media: davinci: vpif_display: Mix memory leak on probe error path - media: dw2102: Fix memleak on sequence of probes - net: phy: Fix the register offsets in Broadcom iProc mdio mux driver - scsi: qla2xxx: Fix unintended Logout - scsi: qla2xxx: Fix session state stuck in Get Port DB - scsi: qla2xxx: Silent erroneous message - clk: scmi: Fix the rounding of clock rate - blk-mq: fix updating tags depth - scsi: lpfc: Fix driver crash when re-registering NVME rports. - scsi: target: fix __transport_register_session locking - md/raid5: fix data corruption of replacements after originals dropped - timers: Clear timer_base::must_forward_clk with timer_base::lock held - gpu: ipu-v3: default to id 0 on missing OF alias - misc: ti-st: Fix memory leak in the error path of probe() - uio: potential double frees if __uio_register_device() fails - firmware: vpd: Fix section enabled flag on vpd_section_destroy - [x86] Drivers: hv: vmbus: Cleanup synic memory free path - tty: rocket: Fix possible buffer overwrite on register_PCI - uio: fix possible circular locking dependency - iwlwifi: pcie: don't access periphery registers when not available - IB/IPoIB: Set ah valid flag in multicast send flow - f2fs: fix to active page in lru list for read path - f2fs: do not set free of current section - f2fs: Keep alloc_valid_block_count in sync - f2fs: issue discard align to section in LFS mode - f2fs: fix defined but not used build warnings - f2fs: fix to detect looped node chain correctly - ASoC: soc-pcm: Use delay set in component pointer function - perf tools: Allow overriding MAX_NR_CPUS at compile time - device-dax: avoid hang on error before devm_memremap_pages() - NFSv4.0 fix client reference leak in callback - perf c2c report: Fix crash for empty browser - perf evlist: Fix error out while applying initial delay and LBR - [powerpc*] pseries: fix EEH recovery of some IOV devices - [powerpc*] macintosh/via-pmu: Add missing mmio accessors - ath9k: report tx status on EOSP - ath9k_hw: fix channel maximum power level test - ath10k: prevent active scans on potential unusable channels - wlcore: Set rx_status boottime_ns field on rx - rpmsg: core: add support to power domains for devices - mtd: rawnand: make subop helpers return unsigned values - scsi: tcmu: do not set max_blocks if data_bitmap has been setup - [mips*] Fix ISA virt/bus conversion for non-zero PHYS_OFFSET - ata: libahci: Allow reconfigure of DEVSLP register - ata: libahci: Correct setting of DEVSLP register - nfs: Referrals not inheriting proto setting from parent - scsi: 3ware: fix return 0 on the error path of probe - tools/testing/nvdimm: kaddr and pfn can be NULL to ->direct_access() - ath10k: disable bundle mgmt tx completion event support - media: em28xx: explicitly disable TS packet filter - PCI: mobiveil: Fix struct mobiveil_pcie.pcie_reg_base address type - [powerpc*] mm: Don't report PUDs as memory leaks when using kmemleak - Bluetooth: hidp: Fix handling of strncpy for hid->name information - [x86] mm: Remove in_nmi() warning from vmalloc_fault() - [armhf] pinctrl: imx: off by one in imx_pinconf_group_dbg_show() - gpio: pxa: disable pinctrl calls for PXA3xx - gpio: ml-ioh: Fix buffer underwrite on probe error path - [x86, arm64] pinctrl/amd: only handle irq if it is pending and unmasked - [armhf, arm64] net: mvneta: fix mtu change on port without link - f2fs: try grabbing node page lock aggressively in sync scenario - pktcdvd: Fix possible Spectre-v1 for pkt_devs - f2fs: fix to skip GC if type in SSA and SIT is inconsistent - [x86] tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) - f2fs: fix to do sanity check with reserved blkaddr of inline inode (CVE-2018-13099) - [mips*] Octeon: add missing of_node_put() - [mips*] generic: fix missing of_node_put() - thermal: rcar_thermal: avoid NULL dereference in absence of IRQ resources - thermal_hwmon: Sanitize attribute name passed to hwmon - net: dcb: For wild-card lookups, use priority -1, not 0 - dm cache: only allow a single io_mode cache feature to be requested - Input: atmel_mxt_ts - only use first T9 instance - [powerpc*] partitions/aix: append null character to print data from disk - [powerpc*] partitions/aix: fix usage of uninitialized lv_info and lvname structures - drm/amd/display: Prevent PSR from being enabled if initialization fails - media: em28xx: Fix dual transport stream operation - [arm64] iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in kdump kernel - f2fs: fix to wait on page writeback before updating page - f2fs: Fix uninitialized return in f2fs_ioc_shutdown() - media: em28xx: Fix DualHD disconnect oops - f2fs: avoid potential deadlock in f2fs_sbi_store - f2fs: fix to do sanity check with secs_per_zone (CVE-2018-13100) - [armhf] mfd: ti_am335x_tscadc: Fix struct clk memory leak - f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize - f2fs: fix to propagate return value of scan_nat_page() - f2fs: fix to do sanity check with extra_attr feature (CVE-2018-13098) - RDMA/hns: Add illegal hop_num judgement - NFSv4.1: Fix a potential layoutget/layoutrecall deadlock - RDMA/hns: Update the data type of immediate data - [mips*] WARN_ON invalid DMA cache maintenance, not BUG_ON - [mips*] mscc: ocelot: fix length of memory address space for MIIM - RDMA/cma: Do not ignore net namespace for unbound cm_id - clocksource: Revert "Remove kthread" - autofs: fix autofs_sbi() does not check super block type - mm: get rid of vmacache_flush_all() entirely (CVE-2018-17182) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.10 - be2net: Fix memory leak in be_cmd_get_profile_config() - net/mlx5: Fix use-after-free in self-healing flow - rds: fix two RCU related problems - tipc: orphan sock in tipc_release() - net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables - net/tls: Set count of SG entries if sk_alloc_sg returns -ENOSPC - net/mlx5: Check for error in mlx5_attach_interface - net/mlx5: Fix debugfs cleanup in the device init/remove flow - erspan: fix error handling for erspan tunnel - erspan: return PACKET_REJECT when the appropriate tunnel is not found - tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY - net/mlx5: Fix not releasing read lock when adding flow rules - net/mlx5: Fix possible deadlock from lockdep when adding fte to fg - net/mlx5: Use u16 for Work Queue buffer fragment size - [armhf, arm64] usb: dwc3: change stream event enable bit back to 13 - [arm64] iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register - [armhf] iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE - [armhf] iommu/io-pgtable-arm: Fix pgtable allocation in selftest - ALSA: msnd: Fix the default sample sizes - ALSA: usb-audio: Add support for Encore mDSD USB DAC - ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro - xfrm: fix 'passing zero to ERR_PTR()' warning - [amd64, arm64] amd-xgbe: use dma_mapping_error to check map errors - nfp: don't fail probe on pci_sriov_set_totalvfs() errors - iwlwifi: cancel the injective function between hw pointers to tfd entry index - gfs2: Special-case rindex for gfs2_grow - [armhf] clk: imx6ul: fix missing of_node_put() - [armhf] clk: imx6sll: fix missing of_node_put() - [arm64] clk: mvebu: armada-37xx-periph: Fix wrong return value in get_parent - Input: pxrc - fix freeing URB on device teardown - clk: core: Potentially free connection id - clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure - media: tw686x: Fix oops on buffer alloc failure - [armhf] dmaengine: pl330: fix irq race with terminate_all - [mips*] ath79: fix system restart - media: videobuf2-core: check for q->error in vb2_core_qbuf() - IB/rxe: Drop QP0 silently - block: allow max_discard_segments to be stacked - IB/ipoib: Fix error return code in ipoib_dev_init() - mtd/maps: fix solutionengine.c printk format warnings - gfs2: Don't reject a supposedly full bitmap if we have blocks reserved - perf tools: Synthesize GROUP_DESC feature in pipe mode - perf tools: Fix struct comm_str removal crash - [powerpc*] perf: Fix callchain ip filtering when return address is in a register - fbdev: Distinguish between interlaced and progressive modes - [armhf] exynos: Clear global variable on init error path - [powerpc*] perf: Fix callchain ip filtering - nvmet: fix file discard return status - nvme-rdma: unquiesce queues when deleting the controller - [armhf, arm64] KVM: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr() - [powerpc*] powerpc/powernv: opal_put_chars partial write fix - perf script: Show correct offsets for DWARF-based unwinding - ASoC: rt5514: Fix the issue of the delay volume applied - [mips*] jz4740: Bump zload address - mac80211: restrict delayed tailroom needed decrement - Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets - wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc - [arm64] fix possible spectre-v1 write in ptrace_hbp_set_event() - reset: imx7: Fix always writing bits as 0 - efi/arm: preserve early mapping of UEFI memory map longer for BGRT - ALSA: usb-audio: Generic DSD detection for Thesycon-based implementations - nfp: avoid buffer leak when FW communication fails - xen-netfront: fix queue name setting - [arm64] dts: qcom: db410c: Fix Bluetooth LED trigger - ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci - soc: qcom: smem: Correct check for global partition - [s390x] qeth: fix race in used-buffer accounting - [s390x] qeth: reset layer2 attribute on layer switch - platform/x86: toshiba_acpi: Fix defined but not used build warnings - KVM: arm/arm64: Fix vgic init race - drivers/base: stop new probing during shutdown - i2c: aspeed: Fix initial values of master and slave state - drm/amd/pp: Set Max clock level to display by default - regulator: qcom_spmi: Use correct regmap when checking for error - regulator: qcom_spmi: Fix warning Bad of_node_put() - iommu/ipmmu-vmsa: IMUCTRn.TTSEL needs a special usage on R-Car Gen3 - dmaengine: mv_xor_v2: kill the tasklets upon exit - crypto: sharah - Unregister correct algorithms for SAHARA 3 - [x86] pti: Check the return value of pti_user_pagetable_walk_p4d() - [x86] pti: Check the return value of pti_user_pagetable_walk_pmd() - [x86} mm/pti: Add an overflow check to pti_clone_pmds() - PCI/AER: Honor "pcie_ports=native" even if HEST sets FIRMWARE_FIRST - xen-netfront: fix warn message as irq device name has '/' - RDMA/cma: Protect cma dev list with lock - pstore: Fix incorrect persistent ram buffer mapping - xen/netfront: fix waiting for xenbus state change - IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler - [s390x] crypto: Fix return code checking in cbc_paes_crypt() - [armhf] mmc: omap_hsmmc: fix wakeirq handling on removal - ipmi: Rework SMI registration failure - ipmi: Move BT capabilities detection to the detect call - ipmi: Fix I2C client removal in the SSIF driver - ovl: fix oopses in ovl_fill_super() failure paths - vmbus: don't return values for uninitalized channels - tools: hv: Fix a bug in the key delete code - misc: ibmvsm: Fix wrong assignment of return code - misc: hmc6352: fix potential Spectre v1 - xhci: Fix use after free for URB cancellation on a reallocated endpoint - usb: Don't die twice if PCI xhci host is not responding in resume - usb: xhci: fix interrupt transfer error happened on MTK platforms - usb: mtu3: fix error of xhci port id when enable U3 dual role - mei: ignore not found client in the enumeration - mei: bus: fix hw module get/put balance - mei: bus: need to unlink client before freeing - dm verity: fix crash on bufio buffer that was allocated with vmalloc - usb: Add quirk to support DJI CineSSD - usb: uas: add support for more quirk flags - usb: Avoid use-after-free by flushing endpoints early in usb_set_interface() - usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() - usb: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller - usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0 - usb: net2280: Fix erroneous synchronization change - usb: serial: io_ti: fix array underflow in completion handler - usb: misc: uss720: Fix two sleep-in-atomic-context bugs - usb: serial: ti_usb_3410_5052: fix array underflow in completion handler - usb: yurex: Fix buffer over-read in yurex_write() - usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt() - Revert "cdc-acm: implement put_char() and flush_chars()" - cifs: prevent integer overflow in nxt_dir_entry() - CIFS: fix wrapping bugs in num_entries() - cifs: integer overflow in in SMB2_ioctl() - xtensa: ISS: don't allocate memory in platform_setup - perf/core: Force USER_DS when recording user stack data - perf tools: Fix maps__find_symbol_by_name() - of: fix phandle cache creation for DTs with no phandles - x86/EISA: Don't probe EISA bus for Xen PV guests - NFSv4: Fix a tracepoint Oops in initiate_file_draining() - NFSv4.1 fix infinite loop on I/O. - of: add helper to lookup compatible child node - mmc: meson-mx-sdio: fix OF child-node lookup - binfmt_elf: Respect error return from `regset->active' - net/mlx5: Add missing SET_DRIVER_VERSION command translation - audit: fix use-after-free in audit_add_watch - mtdchar: fix overflows in adjustment of `count` - vfs: fix freeze protection in mnt_want_write_file() for overlayfs - bpf: fix rcu annotations in compute_effective_progs() - spi: dw: fix possible race condition - Bluetooth: Use lock_sock_nested in bt_accept_enqueue - evm: Don't deadlock if a crypto algorithm is unavailable - [powerpc*] KVM: Book3S HV: Add of_node_put() in success path - security: check for kstrdup() failure in lsm_append() - PM / devfreq: use put_device() instead of kfree() - [powerpc*] KVM: Book3S: Fix matching of hardware and emulated TCE tables - configfs: fix registered group removal - sched/core: Use smp_mb() in wake_woken_function() - efi/esrt: Only call efi_mem_reserve() for boot services memory - [arm64] net: hns3: Reset net device with rtnl_lock - [arm64] net: hns3: Fix for reset_level default assignment probelm - [arm64] hisi: handle of_iomap and fix missing of_node_put - [arm64] hisi: fix error handling and missing of_node_put - [arm64] net: hns3: Fix return value error in hns3_reset_notify_down_enet - [arm64] hisi: check of_iomap and fix missing of_node_put - liquidio: fix hang when re-binding VF host drv after running DPDK VF driver - [armhf] gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes - ASoC: hdmi-codec: fix routing - serial: 8250: of: Correct of_platform_serial_setup() error handling - tty: fix termios input-speed encoding when using BOTHER - tty: fix termios input-speed encoding - [armhf, arm64] mmc: tegra: prevent HS200 on Tegra 3 - mmc: sdhci: do not try to use 3.3V signaling if not supported - drm/nouveau: Fix runtime PM leak in drm_open() - drm/nouveau/debugfs: Wake up GPU before doing any reclocking - [armhf, arm64] drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping - tls: Fix zerocopy_from_iter iov handling - parport: sunbpp: fix error return code - sched/fair: Fix util_avg of new tasks for asymmetric systems - f2fs: do checkpoint in kill_sb - drm/amd/display: support access ddc for mst branch - gpiolib: Mark gpio_suffixes array with __maybe_unused - [armhf, arm64] net: mvpp2: make sure we use single queue mode on PPv2.1 - mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) - input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) - [x86] drm/amdkfd: Fix kernel queue 64 bit doorbell offset calculation - [x86] drm/amdkfd: Fix error codes in kfd_get_process - ALSA: pcm: Fix snd_interval_refine first/last with open min/max - scsi: libfc: fixup 'sleeping function called from invalid context' - scsi: lpfc: Fix NVME Target crash in defer rcv logic - scsi: lpfc: Fix panic if driver unloaded when port is offline - [arm64] perf: Disable PMU while processing counter overflows - drm/amd/pp: Send khz clock values to DC for smu7/8 - IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlers - blk-mq: only attempt to merge bio if there is rq in sw queue - blk-mq: avoid to synchronize rcu inside blk_cleanup_queue() - [arm64] pinctrl: msm: Fix msm_config_group_get() to be compliant - [arm64] pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant - [armhf, arm64] clk: tegra: bpmp: Don't crash when a clock fails to register - [x86] mei: bus: type promotion bug in mei_nfc_if_version() - [x86] crypto: ccp - add timeout support in the SEV command [ Vagrant Cascadian ] * debian/rules.real: Generate linux-source tarball with root user and group specified, to fix reproducibility issues. [ Ben Hutchings ] * drivers/net/ethernet: Ignore ABI changes * [arm64] ACPI: Change ACPI_NFIT from built-in to module * [i386/686] Enable MGEODE_LX instead of M686 (regression in 4.16) - x86-32: Disable 3D-Now in generic config * Bump ABI to 2 [ Yves-Alexis Perez ] * [x86] enable PINCTRL_AMD for touchpad support on Lenovo IdeaPad. (closes: #876141) [ Geoff Levand ] * [arm64] Add support for new server hardware (Closes: #900581): - Enable SCHED_SMT for hardware multithreading processors - Enable ARM64_LSE_ATOMICS for v8.1 processors - ACPI: Enable ACPI_PCI_SLOT, ACPI_HED, ACPI_BGRT, ACPI_APEI, ACPI_APEI_GHES, ACPI_APEI_PCIEAER, ACPI_APEI_SEA, ACPI_APEI_MEMORY_FAILURE as built-in; ACPI_APEI_EINJ, WDAT_WDT as modules * [arm64] acpi: Add fixup for HPE m400 quirks [ Salvatore Bonaccorso ] * floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (CVE-2018-7755) * scsi: target: iscsi: Use hex2bin instead of a re-implementation (CVE-2018-14633) * scsi: target: iscsi: Use bin2hex instead of a re-implementation -- Ben Hutchings Sun, 30 Sep 2018 18:02:51 +0100 linux (4.18.8-1) unstable; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7 - rcu: Make expedited GPs handle CPU 0 being offline - net: 6lowpan: fix reserved space for single frames - net: mac802154: tx: expand tailroom if necessary - 9p/net: Fix zero-copy path in the 9p virtio transport - spi: pxa2xx: Add support for Intel Ice Lake - mmc: block: Fix unsupported parallel dispatch of requests - readahead: stricter check for bdi io_pages - block: fix infinite loop if the device loses discard capability - block: blk_init_allocated_queue() set q->fq as NULL in the fail case - block: really disable runtime-pm for blk-mq - blkcg: Introduce blkg_root_lookup() - block: Introduce blk_exit_queue() - block: Ensure that a request queue is dissociated from the cgroup controller - apparmor: fix bad debug check in apparmor_secid_to_secctx() - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace - libertas: fix suspend and resume for SDIO connected cards - media: Revert "[media] tvp5150: fix pad format frame height" - [arm64] mailbox: xgene-slimpro: Fix potential NULL pointer dereference - Replace magic for trusting the secondary keyring with #define - Fix kexec forbidding kernels signed with keys in the secondary keyring to boot - [powerpc*] fadump: handle crash memory ranges array index overflow - [powerpc*] 64s: Fix page table fragment refcount race vs speculative references - [powerpc*] pseries: Fix endianness while restoring of r3 in MCE handler. - [powerpc*] pkeys: Give all threads control of their key permissions - [powerpc*] pkeys: Deny read/write/execute by default - [powerpc*] pkeys: key allocation/deallocation must not change pkey registers - [powerpc*] pkeys: Save the pkey registers before fork - [powerpc*] pkeys: Fix calculation of total pkeys. - [powerpc*] pkeys: Preallocate execute-only key - [powerpc*] nohash: fix pte_access_permitted() - [powerpc64] ftrace: Include ftrace.h needed for enable/disable calls - [p