Package "linux-kvm"

 linux-kvm (4.4.0-1034.40) xenial; urgency=medium
 .
   * linux-kvm: 4.4.0-1034.40 -proposed tracker (LP: #1791751)
 .
   * Xenial update to 4.4.141 stable release (LP: #1790620)
     - [config] updateconfigs for master changes
 .
   * please include the kernel module IPIP (LP: #1790605)
     - kvm: [config] enable CONFIG_NET_IPIP
 .
   [ Ubuntu: 4.4.0-136.162 ]
 .
   * linux: 4.4.0-136.162 -proposed tracker (LP: #1791745)
   * CVE-2017-5753
     - bpf: properly enforce index mask to prevent out-of-bounds speculation
     - Revert "UBUNTU: SAUCE: bpf: Use barrier_nospec() instead of osb()"
     - Revert "bpf: prevent speculative execution in eBPF interpreter"
   * L1TF mitigation not effective in some CPU and RAM combinations
     (LP: #1788563) // CVE-2018-3620 // CVE-2018-3646
     - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
     - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
       much RAM
     - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
   * CVE-2018-15594
     - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
   * Xenial update to 4.4.144 stable release (LP: #1791080)
     - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in
       parallel.
     - x86/MCE: Remove min interval polling limitation
     - fat: fix memory allocation failure handling of match_strdup()
     - ALSA: rawmidi: Change resized buffers atomically
     - ARC: Fix CONFIG_SWAP
     - ARC: mm: allow mprotect to make stack mappings executable
     - mm: memcg: fix use after free in mem_cgroup_iter()
     - ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
     - ipv6: fix useless rol32 call on hash
     - lib/rhashtable: consider param->min_size when setting initial table size
     - net/ipv4: Set oif in fib_compute_spec_dst
     - net: phy: fix flag masking in __set_phy_supported
     - ptp: fix missing break in switch
     - tg3: Add higher cpu clock for 5762.
     - net: Don't copy pfmemalloc flag in __copy_skb_header()
     - skbuff: Unconditionally copy pfmemalloc in __skb_clone()
     - xhci: Fix perceived dead host due to runtime suspend race with event handler
     - x86/paravirt: Make native_save_fl() extern inline
     - SAUCE: Add missing CPUID_7_EDX defines
     - SAUCE: x86/speculation: Expose indirect_branch_prediction_barrier()
     - x86/pti: Mark constant arrays as __initconst
     - x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs
     - x86/entry/64/compat: Clear registers for compat syscalls, to reduce
       speculation attack surface
     - x86/speculation: Clean up various Spectre related details
     - x86/speculation: Fix up array_index_nospec_mask() asm constraint
     - x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
     - x86/mm: Factor out LDT init from context init
     - x86/mm: Give each mm TLB flush generation a unique ID
     - SAUCE: x86/speculation: Use Indirect Branch Prediction Barrier in context
       switch
     - x86/speculation: Use IBRS if available before calling into firmware
     - x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
     - selftest/seccomp: Fix the seccomp(2) signature
     - xen: set cpu capabilities from xen_start_kernel()
     - x86/amd: don't set X86_BUG_SYSRET_SS_ATTRS when running under Xen
     - SAUCE: Preserve SPEC_CTRL MSR in new inlines
     - SAUCE: Add Knights Mill to NO SSB list
     - x86/process: Correct and optimize TIF_BLOCKSTEP switch
     - x86/process: Optimize TIF_NOTSC switch
     - Revert "x86/cpufeatures: Add FEATURE_ZEN"
     - Revert "x86/cpu/AMD: Fix erratum 1076 (CPB bit)"
     - x86/cpu/AMD: Fix erratum 1076 (CPB bit)
     - x86/cpufeatures: Add FEATURE_ZEN
     - x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths
     - x86/cpu: Re-apply forced caps every time CPU caps are re-read
     - block: do not use interruptible wait anywhere
     - clk: tegra: Fix PLL_U post divider and initial rate on Tegra30
     - ubi: Introduce vol_ignored()
     - ubi: Rework Fastmap attach base code
     - ubi: Be more paranoid while seaching for the most recent Fastmap
     - ubi: Fix races around ubi_refill_pools()
     - ubi: Fix Fastmap's update_vol()
     - ubi: fastmap: Erase outdated anchor PEBs during attach
     - Linux 4.4.144
   * CVE-2017-5715 (Spectre v2 s390x)
     - s390: detect etoken facility
     - s390/lib: use expoline for all bcr instructions
     - SAUCE: s390: use expoline thunks for all branches generated by the BPF JIT
   * Xenial update to 4.4.143 stable release (LP: #1790884)
     - compiler, clang: suppress warning for unused static inline functions
     - compiler, clang: properly override 'inline' for clang
     - compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled
     - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations
     - x86/asm: Add _ASM_ARG* constants for argument registers to
     - ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent
     - bcm63xx_enet: correct clock usage
     - bcm63xx_enet: do not write to random DMA channel on BCM6345
     - crypto: crypto4xx - remove bad list_del
     - crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak
     - atm: zatm: Fix potential Spectre v1
     - net: dccp: avoid crash in ccid3_hc_rx_send_feedback()
     - net: dccp: switch rx_tstamp_last_feedback to monotonic clock
     - net/mlx5: Fix incorrect raw command length parsing
     - net: sungem: fix rx checksum support
     - qed: Limit msix vectors in kdump kernel to the minimum required count.
     - r8152: napi hangup fix after disconnect
     - tcp: fix Fast Open key endianness
     - tcp: prevent bogus FRTO undos with non-SACK flows
     - vhost_net: validate sock before trying to put its fd
     - net_sched: blackhole: tell upper qdisc about dropped packets
     - net/mlx5: Fix command interface race in polling mode
     - net: cxgb3

 linux-kvm (4.4.0-1033.39) xenial; urgency=medium
 .
   * linux-kvm: 4.4.0-1033.39 -proposed tracker (LP: #1788771)
 .
   * zram module not found in 4.4/4.15 KVM kernel (LP: #1766823)
     - [Config]: enable CONFIG_ZRAM
     - [Config]: enable CONFIG_ZRAM (continued)
 .
   [ Ubuntu: 4.4.0-135.161 ]
 .
   * linux: 4.4.0-135.161 -proposed tracker (LP: #1788766)
   * [Regression] APM Merlin boards fail to recover link after interface down/up
     (LP: #1785739)
     - net: phylib: fix interrupts re-enablement in phy_start
     - net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
   * qeth: don't clobber buffer on async TX completion (LP: #1786057)
     - s390/qeth: don't clobber buffer on async TX completion
   * nvme: avoid cqe corruption (LP: #1788035)
     - nvme: avoid cqe corruption when update at the same time as read
   * CacheFiles: Error: Overlong wait for old active object to go away.
     (LP: #1776254)
     - cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag
     - cachefiles: Wait rather than BUG'ing on "Unexpected object collision"
   * fscache cookie refcount updated incorrectly during fscache object allocation
     (LP: #1776277) // fscache cookie refcount updated incorrectly during fscache
     object allocation (LP: #1776277)
     - fscache: Fix reference overput in fscache_attach_object() error handling
   * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
     - Revert "UBUNTU: SAUCE: CacheFiles: fix a read_waiter/read_copier race"
     - fscache: Allow cancelled operations to be enqueued
     - cachefiles: Fix refcounting bug in backing-file read monitoring
   * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
     walinuxagent.service (LP: #1739107)
     - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
       walinuxagent.service

 linux-kvm (4.4.0-1032.38) xenial; urgency=medium
 .
   * linux-kvm: 4.4.0-1032.38 -proposed tracker (LP: #1787182)
 .
   * Xenial update to 4.4.136 stable release (LP: #1776177)
     - [Config] Add CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
 .
   * DEBUG_WX is not set in Bionic KVM kernel (LP: #1782721)
     - kvm: [Config] enable CONFIG_DEBUG_WX
 .
   [ Ubuntu: 4.4.0-134.160 ]
 .
   * linux: 4.4.0-134.160 -proposed tracker (LP: #1787177)
   * locking sockets broken due to missing AppArmor socket mediation patches
     (LP: #1780227)
     - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets
   * Backport namespaced fscaps to xenial 4.4 (LP: #1778286)
     - Introduce v3 namespaced file capabilities
     - commoncap: move assignment of fs_ns to avoid null pointer dereference
     - capabilities: fix buffer overread on very short xattr
     - commoncap: Handle memory allocation failure.
   * Xenial update to 4.4.140 stable release (LP: #1784409)
     - usb: cdc_acm: Add quirk for Uniden UBC125 scanner
     - USB: serial: cp210x: add CESINEL device ids
     - USB: serial: cp210x: add Silicon Labs IDs for Windows Update
     - n_tty: Fix stall at n_tty_receive_char_special().
     - staging: android: ion: Return an ERR_PTR in ion_map_kernel
     - n_tty: Access echo_* variables carefully.
     - x86/boot: Fix early command-line parsing when matching at end
     - ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
     - i2c: rcar: fix resume by always initializing registers before transfer
     - ipv4: Fix error return value in fib_convert_metrics()
     - kprobes/x86: Do not modify singlestep buffer while resuming
     - nvme-pci: initialize queue memory before interrupts
     - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
     - ARM: dts: imx6q: Use correct SDMA script for SPI5 core
     - ubi: fastmap: Correctly handle interrupted erasures in EBA
     - mm: hugetlb: yield when prepping struct pages
     - tracing: Fix missing return symbol in function_graph output
     - scsi: sg: mitigate read/write abuse
     - s390: Correct register corruption in critical section cleanup
     - drbd: fix access after free
     - cifs: Fix infinite loop when using hard mount option
     - jbd2: don't mark block as modified if the handle is out of credits
     - ext4: make sure bitmaps and the inode table don't overlap with bg
       descriptors
     - ext4: always check block group bounds in ext4_init_block_bitmap()
     - ext4: only look at the bg_flags field if it is valid
     - ext4: verify the depth of extent tree in ext4_find_extent()
     - ext4: include the illegal physical block in the bad map ext4_error msg
     - ext4: clear i_data in ext4_inode_info when removing inline data
     - ext4: add more inode number paranoia checks
     - ext4: add more mount time checks of the superblock
     - ext4: check superblock mapped prior to committing
     - HID: i2c-hid: Fix "incomplete report" noise
     - HID: hiddev: fix potential Spectre v1
     - HID: debug: check length before copy_to_user()
     - x86/mce: Detect local MCEs properly
     - x86/mce: Fix incorrect "Machine check from unknown source" message
     - media: cx25840: Use subdev host data for PLL override
     - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
     - dm bufio: avoid sleeping while holding the dm_bufio lock
     - dm bufio: drop the lock when doing GFP_NOIO allocation
     - mtd: rawnand: mxc: set spare area size register explicitly
     - dm bufio: don't take the lock in dm_bufio_shrink_count
     - mtd: cfi_cmdset_0002: Change definition naming to retry write operation
     - mtd: cfi_cmdset_0002: Change erase functions to retry for error
     - mtd: cfi_cmdset_0002: Change erase functions to check chip good only
     - netfilter: nf_log: don't hold nf_log_mutex during user access
     - staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
     - Linux 4.4.140
   * Xenial update to 4.4.139 stable release (LP: #1784382)
     - xfrm6: avoid potential infinite loop in _decode_session6()
     - netfilter: ebtables: handle string from userspace with care
     - ipvs: fix buffer overflow with sync daemon and service
     - atm: zatm: fix memcmp casting
     - net: qmi_wwan: Add Netgear Aircard 779S
     - net/sonic: Use dma_mapping_error()
     - Revert "Btrfs: fix scrub to repair raid6 corruption"
     - tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
     - Btrfs: make raid6 rebuild retry more
     - usb: musb: fix remote wakeup racing with suspend
     - bonding: re-evaluate force_primary when the primary slave name changes
     - tcp: verify the checksum of the first data segment in a new connection
     - ext4: update mtime in ext4_punch_hole even if no blocks are released
     - ext4: fix fencepost error in check for inode count overflow during resize
     - driver core: Don't ignore class_dir_create_and_add() failure.
     - btrfs: scrub: Don't use inode pages for device replace
     - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
     - ALSA: hda: add dock and led support for HP EliteBook 830 G5
     - ALSA: hda: add dock and led support for HP ProBook 640 G4
     - cpufreq: Fix new policy initialization during limits updates via sysfs
     - libata: zpodd: make arrays cdb static, reduces object code size
     - libata: zpodd: small read overflow in eject_tray()
     - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
     - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
     - x86/spectre_v1: Disable compiler optimizations over
       array_index_mask_nospec()
     - m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
     - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
     - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
     - usb: do not reset if a low-speed or full-speed device timed out
     - 1wire: family module au

 linux-kvm (4.4.0-1030.36) xenial; urgency=medium
 .
   * linux-kvm: 4.4.0-1030.36 -proposed tracker (LP: #1784310)
 .
   * Xenial update to 4.4.136 stable release (LP: #1776177)
     - [Config] Add CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
 .
   * DEBUG_WX is not set in Bionic KVM kernel (LP: #1782721)
     - kvm: [Config] enable CONFIG_DEBUG_WX
 .
 .
   [ Ubuntu: 4.4.0-132.158 ]
 .
   * linux: 4.4.0-132.158 -proposed tracker (LP: #1784302)
   * locking sockets broken due to missing AppArmor socket mediation patches
     (LP: #1780227)
     - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets
   * Backport namespaced fscaps to xenial 4.4 (LP: #1778286)
     - Introduce v3 namespaced file capabilities
     - commoncap: move assignment of fs_ns to avoid null pointer dereference
     - capabilities: fix buffer overread on very short xattr
     - commoncap: Handle memory allocation failure.
   * Xenial update to 4.4.140 stable release (LP: #1784409)
     - usb: cdc_acm: Add quirk for Uniden UBC125 scanner
     - USB: serial: cp210x: add CESINEL device ids
     - USB: serial: cp210x: add Silicon Labs IDs for Windows Update
     - n_tty: Fix stall at n_tty_receive_char_special().
     - staging: android: ion: Return an ERR_PTR in ion_map_kernel
     - n_tty: Access echo_* variables carefully.
     - x86/boot: Fix early command-line parsing when matching at end
     - ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
     - i2c: rcar: fix resume by always initializing registers before transfer
     - ipv4: Fix error return value in fib_convert_metrics()
     - kprobes/x86: Do not modify singlestep buffer while resuming
     - nvme-pci: initialize queue memory before interrupts
     - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
     - ARM: dts: imx6q: Use correct SDMA script for SPI5 core
     - ubi: fastmap: Correctly handle interrupted erasures in EBA
     - mm: hugetlb: yield when prepping struct pages
     - tracing: Fix missing return symbol in function_graph output
     - scsi: sg: mitigate read/write abuse
     - s390: Correct register corruption in critical section cleanup
     - drbd: fix access after free
     - cifs: Fix infinite loop when using hard mount option
     - jbd2: don't mark block as modified if the handle is out of credits
     - ext4: make sure bitmaps and the inode table don't overlap with bg
       descriptors
     - ext4: always check block group bounds in ext4_init_block_bitmap()
     - ext4: only look at the bg_flags field if it is valid
     - ext4: verify the depth of extent tree in ext4_find_extent()
     - ext4: include the illegal physical block in the bad map ext4_error msg
     - ext4: clear i_data in ext4_inode_info when removing inline data
     - ext4: add more inode number paranoia checks
     - ext4: add more mount time checks of the superblock
     - ext4: check superblock mapped prior to committing
     - HID: i2c-hid: Fix "incomplete report" noise
     - HID: hiddev: fix potential Spectre v1
     - HID: debug: check length before copy_to_user()
     - x86/mce: Detect local MCEs properly
     - x86/mce: Fix incorrect "Machine check from unknown source" message
     - media: cx25840: Use subdev host data for PLL override
     - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
     - dm bufio: avoid sleeping while holding the dm_bufio lock
     - dm bufio: drop the lock when doing GFP_NOIO allocation
     - mtd: rawnand: mxc: set spare area size register explicitly
     - dm bufio: don't take the lock in dm_bufio_shrink_count
     - mtd: cfi_cmdset_0002: Change definition naming to retry write operation
     - mtd: cfi_cmdset_0002: Change erase functions to retry for error
     - mtd: cfi_cmdset_0002: Change erase functions to check chip good only
     - netfilter: nf_log: don't hold nf_log_mutex during user access
     - staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
     - Linux 4.4.140
   * Xenial update to 4.4.139 stable release (LP: #1784382)
     - xfrm6: avoid potential infinite loop in _decode_session6()
     - netfilter: ebtables: handle string from userspace with care
     - ipvs: fix buffer overflow with sync daemon and service
     - atm: zatm: fix memcmp casting
     - net: qmi_wwan: Add Netgear Aircard 779S
     - net/sonic: Use dma_mapping_error()
     - Revert "Btrfs: fix scrub to repair raid6 corruption"
     - tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
     - Btrfs: make raid6 rebuild retry more
     - usb: musb: fix remote wakeup racing with suspend
     - bonding: re-evaluate force_primary when the primary slave name changes
     - tcp: verify the checksum of the first data segment in a new connection
     - ext4: update mtime in ext4_punch_hole even if no blocks are released
     - ext4: fix fencepost error in check for inode count overflow during resize
     - driver core: Don't ignore class_dir_create_and_add() failure.
     - btrfs: scrub: Don't use inode pages for device replace
     - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
     - ALSA: hda: add dock and led support for HP EliteBook 830 G5
     - ALSA: hda: add dock and led support for HP ProBook 640 G4
     - cpufreq: Fix new policy initialization during limits updates via sysfs
     - libata: zpodd: make arrays cdb static, reduces object code size
     - libata: zpodd: small read overflow in eject_tray()
     - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
     - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
     - x86/spectre_v1: Disable compiler optimizations over
       array_index_mask_nospec()
     - m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
     - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
     - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
     - usb: do not reset if a low-speed or full-speed device timed out
     - 1wire: family module

 linux-kvm (4.4.0-1029.34) xenial; urgency=medium
 .
   * linux-kvm: 4.4.0-1029.34 -proposed tracker (LP: #1776826)
 .
   [ Ubuntu: 4.4.0-130.156 ]
 .
   * linux: 4.4.0-130.156 -proposed tracker (LP: #1776822)
   * CVE-2018-3665 (x86)
     - x86/fpu: Fix early FPU command-line parsing
     - x86/fpu: Fix 'no387' regression
     - x86/fpu: Disable MPX when eagerfpu is off
     - x86/fpu: Default eagerfpu=on on all CPUs
     - x86/fpu: Fix FNSAVE usage in eagerfpu mode
     - x86/fpu: Fix math emulation in eager fpu mode
     - x86/fpu: Fix eager-FPU handling on legacy FPU machines
 .