linux (4.4.0-178.208) xenial; urgency=medium

  * xenial/linux: 4.4.0-178.208 -proposed tracker (LP: #1870660)

  * CVE-2019-19768
    - blktrace: Protect q->blk_trace with RCU
    - blktrace: fix dereference after null check

  * Multiple Kexec in AWS Nitro instances fail (LP: #1869948)
    - net: ena: Add PCI shutdown handler to allow safe kexec

  * Insert test_bpf module will report 4 failures for ubuntu_bpf_jit on X s390x
    (LP: #1768452)
    - test_bpf: flag tests that cannot be jited on s390

  * Mounting LVM snapshots with xfs can hit kernel BUG in nvme driver
    (LP: #1869229)
    - block: fix bio_will_gap() for first bvec with offset

  * Xenial update: 4.4.217 upstream stable release (LP: #1868629)
    - NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
    - r8152: check disconnect status after long sleep
    - net: nfc: fix bounds checking bugs on "pipe"
    - bnxt_en: reinitialize IRQs when MTU is modified
    - fib: add missing attribute validation for tun_id
    - nl802154: add missing attribute validation
    - nl802154: add missing attribute validation for dev_type
    - team: add missing attribute validation for port ifindex
    - team: add missing attribute validation for array index
    - nfc: add missing attribute validation for SE API
    - nfc: add missing attribute validation for vendor subcommand
    - ipvlan: add cond_resched_rcu() while processing muticast backlog
    - ipvlan: do not add hardware address of master to its unicast filter list
    - ipvlan: egress mcast packets are not exceptional
    - ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
    - ipvlan: don't deref eth hdr before checking it's set
    - macvlan: add cond_resched() during multicast processing
    - net: fec: validate the new settings in fec_enet_set_coalesce()
    - slip: make slhc_compress() more robust against malicious packets
    - bonding/alb: make sure arp header is pulled before accessing it
    - net: fq: add missing attribute validation for orphan mask
    - iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn +
      add_taint
    - drm/amd/display: remove duplicated assignment to grph_obj_type
    - gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
    - KVM: x86: clear stale x86_emulate_ctxt->intercept value
    - ARC: define __ALIGN_STR and __ALIGN symbols for ARC
    - efi: Fix a race and a buffer overflow while reading efivars via sysfs
    - iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
    - iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
    - nl80211: add missing attribute validation for critical protocol indication
    - nl80211: add missing attribute validation for channel switch
    - netfilter: cthelper: add missing attribute validation for cthelper
    - iommu/vt-d: Fix the wrong printing in RHSA parsing
    - iommu/vt-d: Ignore devices with out-of-spec domain number
    - ipv6: restrict IPV6_ADDRFORM operation
    - efi: Add a sanity check to efivar_store_raw()
    - batman-adv: Fix invalid read while copying bat_iv.bcast_own
    - batman-adv: Only put gw_node list reference when removed
    - batman-adv: Only put orig_node_vlan list reference when removed
    - batman-adv: Avoid endless loop in bat-on-bat netdevice check
    - batman-adv: Fix unexpected free of bcast_own on add_if error
    - batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
    - batman-adv: init neigh node last seen field
    - batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
    - batman-adv: Drop reference to netdevice on last reference
    - batman-adv: Fix reference counting of vlan object for tt_local_entry
    - batman-adv: Avoid duplicate neigh_node additions
    - batman-adv: fix skb deref after free
    - batman-adv: Fix use-after-free/double-free of tt_req_node
    - batman-adv: Fix ICMP RR ethernet access after skb_linearize
    - batman-adv: Clean up untagged vlan when destroying via rtnl-link
    - batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
    - batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
    - batman-adv: Fix orig_node_vlan leak on orig_node_release
    - batman-adv: lock crc access in bridge loop avoidance
    - batman-adv: Fix non-atomic bla_claim::backbone_gw access
    - batman-adv: Fix reference leak in batadv_find_router
    - batman-adv: Free last_bonding_candidate on release of orig_node
    - batman-adv: Fix speedy join in gateway client mode
    - batman-adv: Add missing refcnt for last_candidate
    - batman-adv: Fix double free during fragment merge error
    - batman-adv: Fix transmission of final, 16th fragment
    - batman-adv: Fix rx packet/bytes stats on local ARP reply
    - batman-adv: fix TT sync flag inconsistencies
    - batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
    - batman-adv: Fix internal interface indices types
    - batman-adv: update data pointers after skb_cow()
    - batman-adv: Fix skbuff rcsum on packet reroute
    - batman-adv: Avoid race in TT TVLV allocator helper
    - batman-adv: Fix TT sync flags for intermediate TT responses
    - batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
    - batman-adv: Fix debugfs path for renamed hardif
    - batman-adv: Fix debugfs path for renamed softif
    - batman-adv: Avoid storing non-TT-sync flags on singular entries too
    - batman-adv: Prevent duplicated gateway_node entry
    - batman-adv: Prevent duplicated nc_node entry
    - batman-adv: Prevent duplicated global TT entry
    - batman-adv: Prevent duplicated tvlv handler
    - batman-adv: Reduce claim hash refcnt only for removed entry
    - batman-adv: Reduce tt_local hash refcnt only for removed entry
    - batman-adv: Reduce tt_global hash refcnt only for removed entry
    - batman-adv: Only read OGM tvlv_len after buffer len check
    - batman-adv: Avoid free/alloc race when handling OGM buffer
    - batman-adv: Don't schedule OGM for disabled interface
    - perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
    - net: ks8851-ml: Fix IRQ handling and locking
    - signal: avoid double atomic counter increments for user accounting
    - jbd2: fix data races at struct journal_head
    - ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
    - ARM: 8958/1: rename missed uaccess .fixup section
    - mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
    - ipv4: ensure rcu_read_lock() in cipso_v4_error()
    - Linux 4.4.217

  * Xenial update: 4.4.216 upstream stable release (LP: #1868628)
    - iwlwifi: pcie: fix rb_allocator workqueue allocation
    - ext4: fix potential race between online resizing and write operations
    - ext4: fix potential race between s_flex_groups online resizing and access
    - ext4: fix potential race between s_group_info online resizing and access
    - ipmi:ssif: Handle a possible NULL pointer reference
    - mac80211: consider more elements in parsing CRC
    - cfg80211: check wiphy driver existence for drvinfo report
    - cifs: Fix mode output in debugging statements
    - cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
    - sysrq: Restore original console_loglevel when sysrq disabled
    - sysrq: Remove duplicated sysrq message
    - net: fib_rules: Correctly set table field when table number exceeds 8 bits
    - net: phy: restore mdio regs in the iproc mdio driver
    - ipv6: Fix nlmsg_flags when splitting a multipath route
    - ipv6: Fix route replacement with dev-only route
    - sctp: move the format error check out of __sctp_sf_do_9_1_abort
    - nfc: pn544: Fix occasional HW initialization failure
    - net: sched: correct flower port blocking
    - ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
    - audit: fix error handling in audit_data_to_entry()
    - HID: core: fix off-by-one memset in hid_report_raw_event()
    - HID: core: increase HID report buffer size to 8KiB
    - HID: hiddev: Fix race in in hiddev_disconnect()
    - MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
    - i2c: jz4780: silence log flood on txabrt
    - ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
    - net: netlink: cap max groups which will be considered in netlink_bind()
    - namei: only return -ECHILD from follow_dotdot_rcu()
    - KVM: Check for a bad hva before dropping into the ghc slow path
    - slip: stop double free sl->dev in slip_open
    - mm: make page ref count overflow check tighter and more explicit
    - mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages
    - audit: always check the netlink payload length in audit_receive_msg()
    - serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
    - usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
    - usb: gadget: serial: fix Tx stall after buffer overflow
    - drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
    - drm/msm/dsi: save pll state before dsi host is powered off
    - net: ks8851-ml: Remove 8-bit bus accessors
    - net: ks8851-ml: Fix 16-bit data access
    - net: ks8851-ml: Fix 16-bit IO operation
    - watchdog: da9062: do not ping the hw during stop()
    - s390/cio: cio_ignore_proc_seq_next should increase position index
    - cifs: don't leak -EAGAIN for stat() during reconnect
    - usb: storage: Add quirk for Samsung Fit flash
    - usb: quirks: add NO_LPM quirk for Logitech Screen Share
    - usb: core: hub: do error out if usb_autopm_get_interface() fails
    - usb: core: port: do error out if usb_autopm_get_interface() fails
    - vgacon: Fix a UAF in vgacon_invert_region
    - fat: fix uninit-memory access for partial initialized inode
    - vt: selection, close sel_buffer race
    - vt: selection, push console lock down
    - vt: selection, push sel_lock up
    - dmaengine: tegra-apb: Fix use-after-free
    - dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
    - ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
    - ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
    - ASoC: dapm: Correct DAPM handling of active widgets during shutdown
    - RDMA/iwcm: Fix iwcm work deallocation
    - RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
    - ARM: imx: build v7_cpu_resume() unconditionally
    - hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
    - dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
    - powerpc: fix hardware PMU exception bug on PowerVM compatibility mode
      systems
    - dm cache: fix a crash due to incorrect work item cancelling
    - crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async
    - Linux 4.4.216

  * Xenial update: 4.4.215 upstream stable release (LP: #1868627)
    - ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
    - ecryptfs: fix a memory leak bug in parse_tag_1_packet()
    - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
    - ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
    - ubifs: Fix deadlock in concurrent bulk-read and writepage
    - ext4: fix checksum errors with indexed dirs
    - Btrfs: fix race between using extent maps and merging them
    - btrfs: log message when rw remount is attempted with unclean tree-log
    - padata: Remove broken queue flushing
    - s390/time: Fix clk type in get_tod_clock
    - hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
    - jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
    - jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
    - btrfs: print message when tree-log replay starts
    - scsi: qla2xxx: fix a potential NULL pointer dereference
    - Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs"
    - drm/gma500: Fixup fbdev stolen size usage evaluation
    - brcmfmac: Fix use after free in brcmf_sdio_readframes()
    - gianfar: Fix TX timestamping with a stacked DSA driver
    - pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
    - media: i2c: mt9v032: fix enum mbus codes and frame sizes
    - media: sti: bdisp: fix a possible sleep-in-atomic-context bug in
      bdisp_device_run()
    - efi/x86: Map the entire EFI vendor string before copying it
    - MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
    - uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
    - usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
    - nfs: NFS_SWAP should depend on SWAP
    - jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info
      when load journal
    - tracing: Fix very unlikely race of registering two stat tracers
    - ext4, jbd2: ensure panic when aborting with zero errno
    - kconfig: fix broken dependency in randconfig-generated .config
    - clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
    - drm/amdgpu: remove 4 set but not used variable in
      amdgpu_atombios_get_connector_info_from_object_table
    - regulator: rk808: Lower log level on optional GPIOs being not available
    - NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use
      le16_add_cpu().
    - reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
    - ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
    - b43legacy: Fix -Wcast-function-type
    - ipw2x00: Fix -Wcast-function-type
    - iwlegacy: Fix -Wcast-function-type
    - rtlwifi: rtl_pci: Fix -Wcast-function-type
    - orinoco: avoid assertion in case of NULL pointer
    - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
    - scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
    - ARM: dts: r8a7779: Add device node for ARM global timer
    - x86/vdso: Provide missing include file
    - pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
    - ALSA: sh: Fix compile warning wrt const
    - tools lib api fs: Fix gcc9 stringop-truncation compilation error
    - usbip: Fix unsafe unaligned pointer usage
    - soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
    - rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
    - Input: edt-ft5x06 - work around first register access error
    - wan: ixp4xx_hss: fix compile-testing on 64-bit
    - ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
    - PCI: Don't disable bridge BARs when assigning bus resources
    - driver core: Print device when resources present in really_probe()
    - drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
    - drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
    - iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
    - scsi: iscsi: Don't destroy session if there are outstanding connections
    - cmd64x: potential buffer overflow in cmd64x_program_timings()
    - ide: serverworks: potential overflow in svwks_set_pio_mode()
    - remoteproc: Initialize rproc_class before use
    - s390/ftrace: generate traced function stack frame
    - ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
    - jbd2: switch to use jbd2_journal_abort() when failed to submit the commit
      record
    - ARM: 8951/1: Fix Kexec compilation issue.
    - hostap: Adjust indentation in prism2_hostapd_add_sta
    - iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
    - drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
    - trigger_next should increase position index
    - radeon: insert 10ms sleep in dce5_crtc_load_lut
    - ocfs2: fix a NULL pointer dereference when call
      ocfs2_update_inode_fsync_trans()
    - lib/scatterlist.c: adjust indentation in __sg_alloc_table
    - reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
    - bcache: explicity type cast in bset_bkey_last()
    - irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building
      INVALL
    - microblaze: Prevent the overflow of the start
    - brd: check and limit max_part par
    - selinux: ensure we cleanup the internal AVC counters on error in
      avc_update()
    - enic: prevent waking up stopped tx queues over watchdog reset
    - floppy: check FDC index for errors before assigning it
    - staging: android: ashmem: Disallow ashmem memory from being remapped
    - staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
    - usb: uas: fix a plug & unplug racing
    - USB: Fix novation SourceControl XL after suspend
    - USB: hub: Don't record a connect-change event during reset-resume
    - staging: rtl8188eu: Fix potential security hole
    - staging: rtl8188eu: Fix potential overuse of kernel memory
    - x86/mce/amd: Fix kobject lifetime
    - tty: serial: imx: setup the correct sg entry for tx dma
    - xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
    - VT_RESIZEX: get rid of field-by-field copyin
    - vt: vt_ioctl: fix race in VT_RESIZEX
    - netfilter: xt_bpf: add overflow checks
    - ext4: fix a data race in EXT4_I(inode)->i_disksize
    - ext4: add cond_resched() to __ext4_find_entry()
    - KVM: apic: avoid calculating pending eoi from an uninitialized val
    - Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered
      extents
    - scsi: Revert "RDMA/isert: Fix a recently introduced regression related to
      logout"
    - scsi: Revert "target: iscsi: Wait for all commands to finish before freeing
      a session"
    - ecryptfs: replace BUG_ON with error handling code
    - ALSA: rawmidi: Avoid bit fields for state flags
    - ALSA: seq: Avoid concurrent access to queue flags
    - ALSA: seq: Fix concurrent access to queue current tick/time
    - xen: Enable interrupts when calling _cond_resched()
    - Linux 4.4.215

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 05 Apr 2020 18:51:07 -0400

linux (4.4.0-177.207) xenial; urgency=medium

  * xenial/linux: 4.4.0-177.207 -proposed tracker (LP: #1867243)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * Xenial update: 4.4.214 upstream stable release (LP: #1864775)
    - media: iguanair: fix endpoint sanity check
    - x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - sparc32: fix struct ipc64_perm type definition
    - ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node
    - cls_rsvp: fix rsvp_policy
    - net: hsr: fix possible NULL deref in hsr_handle_frame()
    - net_sched: fix an OOB access in cls_tcindex
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
    - mfd: dln2: More sanity checking for endpoints
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: dummy: Fix PCM format loop in proc output
    - lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
    - powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
    - mmc: spi: Toggle SPI polarity, do not hardcode it
    - PCI: keystone: Fix link training retries initiation
    - crypto: api - Check spawn->alg under lock in crypto_drop_spawn
    - scsi: qla2xxx: Fix mtcp dump collection failure
    - power: supply: ltc2941-battery-gauge: fix use-after-free
    - of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
    - dm space map common: fix to ensure new block isn't already in use
    - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
    - crypto: api - Fix race condition in crypto_spawn_alg
    - crypto: picoxcell - adjust the position of tasklet_init and fix missed
      tasklet_kill
    - btrfs: set trans->drity in btrfs_commit_transaction
    - ARM: tegra: Enable PLLP bypass during Tegra124 LP1
    - mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
    - sunrpc: expiry_time should be seconds not timeval
    - KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    - KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
    - KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF
      attacks
    - KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF
      attacks
    - KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks
      in x86.c
    - KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit()
      from Spectre-v1/L1TF attacks
    - KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
    - KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
    - KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
    - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
    - scsi: csiostor: Adjust indentation in csio_device_reset
    - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
    - ext2: Adjust indentation in ext2_fill_super
    - powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
    - NFC: pn544: Adjust indentation in pn544_hci_check_presence
    - ppp: Adjust indentation into ppp_async_input
    - net: smc911x: Adjust indentation in smc911x_phy_configure
    - net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
    - mfd: da9062: Fix watchdog compatible string
    - mfd: rn5t618: Mark ADC control register volatile
    - net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
    - bonding/alb: properly access headers in bond_alb_xmit()
    - NFS: Fix memory leaks and corruption in readdir
    - NFS: Fix bool initialization/comparison
    - NFS: Directory page cache pages need to be locked when read
    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
    - btrfs: remove trivial locking wrappers of tree mod log
    - Btrfs: fix race between adding and putting tree mod seq elements and nodes
    - drm: atmel-hlcdc: enable clock before configuring timing engine
    - KVM: x86: drop picdev_in_range()
    - KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
    - KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
    - KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
    - btrfs: flush write bio if we loop in extent_write_cache_pages
    - KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
    - KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
    - KVM: nVMX: vmread should not set rflags to specify success in case of #PF
    - cifs: fail i/o on soft mounts if sessionsetup errors out
    - clocksource: Prevent double add_timer_on() for watchdog_timer
    - perf/core: Fix mlock accounting in perf_mmap()
    - ASoC: pcm: update FE/BE trigger order based on the command
    - scsi: ufs: Fix ufshcd_probe_hba() reture value in case
      ufshcd_scsi_add_wlus() fails
    - rtc: hym8563: Return -EINVAL if the time is known to be invalid
    - ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
    - ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
    - ARM: dts: at91: sama5d3: define clock rate range for tcb1
    - powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce
      for DDW
    - pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
    - mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
    - mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
    - libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
    - libertas: make lbs_ibss_join_existing() return error code on rates overflow
    - Linux 4.4.214

  * 5.4.0-11 crash on cryptsetup open (LP: #1860231) // Xenial update: 4.4.214
    upstream stable release (LP: #1864775)
    - dm: fix potential for q->make_request_fn NULL pointer

  * Xenial update: 4.4.213 upstream stable release (LP: #1864774)
    - ALSA: pcm: Add missing copy ops check before clearing buffer
    - orinoco_usb: fix interface sanity check
    - rsi_91x_usb: fix interface sanity check
    - USB: serial: ir-usb: add missing endpoint sanity check
    - USB: serial: ir-usb: fix link-speed handling
    - USB: serial: ir-usb: fix IrLAP framing
    - staging: most: net: fix buffer overflow
    - staging: wlan-ng: ensure error return is actually returned
    - staging: vt6656: correct packet types for CTS protect, mode.
    - staging: vt6656: use NULLFUCTION stack on mac80211
    - staging: vt6656: Fix false Tx excessive retries reporting.
    - ath9k: fix storage endpoint lookup
    - brcmfmac: fix interface sanity check
    - rtl8xxxu: fix interface sanity check
    - zd1211rw: fix storage endpoint lookup
    - watchdog: rn5t618_wdt: fix module aliases
    - drivers/net/b44: Change to non-atomic bit operations on pwol_mask
    - net: wan: sdla: Fix cast from pointer to integer of different size
    - atm: eni: fix uninitialized variable warning
    - usb-storage: Disable UAS on JMicron SATA enclosure
    - net_sched: ematch: reject invalid TCF_EM_SIMPLE
    - crypto: af_alg - Use bh_lock_sock in sk_destruct
    - crypto: pcrypt - Fix user-after-free on module unload
    - arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
    - mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
    - reiserfs: Fix memory leak of journal device string
    - media: digitv: don't continue if remote control state can't be read
    - media: gspca: zero usb_buf
    - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
    - ttyprintk: fix a potential deadlock in interrupt context issue
    - usb: dwc3: turn off VBUS when leaving host mode
    - media: si470x-i2c: Move free() past last use of 'radio'
    - clk: mmp2: Fix the order of timer mux parents
    - ixgbevf: Remove limit of 10 entries for unicast filter list
    - ixgbe: Fix calculation of queue with VFs and flow director on interface flap
    - wireless: wext: avoid gcc -O3 warning
    - vti[6]: fix packet tx through bpf_redirect()
    - scsi: fnic: do not queue commands during fwreset
    - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
    - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
    - r8152: get default setting of WOL before initializing
    - qlcnic: Fix CPU soft lockup while collecting firmware dump
    - net/fsl: treat fsl,erratum-a011043
    - net/sonic: Add mutual exclusion for accessing shared state
    - net/sonic: Use MMIO accessors
    - net/sonic: Fix receive buffer handling
    - net/sonic: Quiesce SONIC before re-initializing descriptor memory
    - seq_tab_next() should increase position index
    - l2t_seq_next should increase position index
    - net: Fix skb->csum update in inet_proto_csum_replace16().
    - btrfs: fix mixed block count of available space
    - btrfs: do not zero f_bavail if we have available space
    - Linux 4.4.213

  * Xenial update: 4.4.212 upstream stable release (LP: #1864773)
    - powerpc/archrandom: fix arch_get_random_seed_int()
    - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
    - drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
    - ALSA: hda: fix unused variable warning
    - ALSA: usb-audio: update quirk for B&W PX to remove microphone
    - staging: comedi: ni_mio_common: protect register write overflow
    - pcrypt: use format specifier in kobject_add
    - exportfs: fix 'passing zero to ERR_PTR()' warning
    - drm/dp_mst: Skip validating ports during destruction, just ref
    - pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
    - pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
    - pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
    - pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
    - pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
    - pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
    - pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
    - pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
    - pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
    - Input: nomadik-ske-keypad - fix a loop timeout test
    - clk: highbank: fix refcount leak in hb_clk_init()
    - clk: qoriq: fix refcount leak in clockgen_init()
    - clk: socfpga: fix refcount leak
    - clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
    - clk: imx6q: fix refcount leak in imx6q_clocks_init()
    - clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
    - clk: imx7d: fix refcount leak in imx7d_clocks_init()
    - clk: vf610: fix refcount leak in vf610_clocks_init()
    - clk: armada-370: fix refcount leak in a370_clk_init()
    - clk: kirkwood: fix refcount leak in kirkwood_clk_init()
    - clk: armada-xp: fix refcount leak in axp_clk_init()
    - IB/usnic: Fix out of bounds index check in query pkey
    - RDMA/ocrdma: Fix out of bounds index check in query pkey
    - media: s5p-jpeg: Correct step and max values for
      V4L2_CID_JPEG_RESTART_INTERVAL
    - crypto: tgr192 - fix unaligned memory access
    - ASoC: imx-sgtl5000: put of nodes if finding codec fails
    - rtc: cmos: ignore bogus century byte
    - tty: ipwireless: Fix potential NULL pointer dereference
    - rtc: ds1672: fix unintended sign extension
    - rtc: 88pm860x: fix unintended sign extension
    - rtc: 88pm80x: fix unintended sign extension
    - rtc: pm8xxx: fix unintended sign extension
    - fbdev: chipsfb: remove set but not used variable 'size'
    - pinctrl: sh-pfc: emev2: Add missing pinmux functions
    - pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
    - pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
    - block: don't use bio->bi_vcnt to figure out segment number
    - vfio_pci: Enable memory accesses before calling pci_map_rom
    - cdc-wdm: pass return value of recover_from_urb_loss
    - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
    - drm/nouveau/pmu: don't print reply values if exec is false
    - ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
    - fs/nfs: Fix nfs_parse_devname to not modify it's argument
    - clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
    - ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
    - regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
    - nios2: ksyms: Add missing symbol exports
    - scsi: megaraid_sas: reduce module load time
    - xen, cpu_hotplug: Prevent an out of bounds access
    - net: sh_eth: fix a missing check of of_get_phy_mode
    - media: ivtv: update *pos correctly in ivtv_read_pos()
    - media: cx18: update *pos correctly in cx18_read_pos()
    - media: wl128x: Fix an error code in fm_download_firmware()
    - media: cx23885: check allocation return
    - jfs: fix bogus variable self-initialization
    - m68k: mac: Fix VIA timer counter accesses
    - ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
    - media: davinci-isif: avoid uninitialized variable use
    - spi: tegra114: clear packed bit for unpacked mode
    - spi: tegra114: fix for unpacked mode transfers
    - soc/fsl/qe: Fix an error code in qe_pin_request()
    - spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
    - ehea: Fix a copy-paste err in ehea_init_port_res
    - scsi: qla2xxx: Unregister chrdev if module initialization fails
    - ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
    - hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
    - tipc: set sysctl_tipc_rmem and named_timeout right range
    - powerpc: vdso: Make vdso32 installation conditional in vdso_install
    - media: ov2659: fix unbalanced mutex_lock/unlock
    - 6lowpan: Off by one handling ->nexthdr
    - dmaengine: axi-dmac: Don't check the number of frames for alignment
    - ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
    - packet: in recvmsg msg_name return at least sizeof sockaddr_ll
    - ASoC: fix valid stream condition
    - IB/mlx5: Add missing XRC options to QP optional params mask
    - iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
    - media: omap_vout: potential buffer overflow in vidioc_dqbuf()
    - media: davinci/vpbe: array underflow in vpbe_enum_outputs()
    - platform/x86: alienware-wmi: printing the wrong error code
    - netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
    - ARM: riscpc: fix lack of keyboard interrupts after irq conversion
    - kdb: do a sanity check on the cpu in kdb_per_cpu()
    - backlight: lm3630a: Return 0 on success in update_status functions
    - thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
    - spi: spi-fsl-spi: call spi_finalize_current_message() at the end
    - misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
    - iommu: Use right function to get group for device
    - signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
    - inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
    - media: vivid: fix incorrect assignment operation when setting video mode
    - powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
    - drm/msm/mdp5: Fix mdp5_cfg_init error return
    - net/af_iucv: always register net_device notifier
    - ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
    - rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
    - drm/msm/a3xx: remove TPL1 regs from snapshot
    - iommu/amd: Make iommu_disable safer
    - mfd: intel-lpss: Release IDA resources
    - devres: allow const resource arguments
    - net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
    - scsi: libfc: fix null pointer dereference on a null lport
    - libertas_tf: Use correct channel range in lbtf_geo_init
    - usb: host: xhci-hub: fix extra endianness conversion
    - mic: avoid statically declaring a 'struct device'.
    - x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
    - ALSA: aoa: onyx: always initialize register read value
    - cifs: fix rmmod regression in cifs.ko caused by force_sig changes
    - crypto: caam - free resources in case caam_rng registration failed
    - ext4: set error return correctly when ext4_htree_store_dirent fails
    - ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
    - ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
    - ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
    - signal: Allow cifs and drbd to receive their terminating signals
    - dmaengine: dw: platform: Switch to acpi_dma_controller_register()
    - mac80211: minstrel_ht: fix per-group max throughput rate initialization
    - mips: avoid explicit UB in assignment of mips_io_port_base
    - ahci: Do not export local variable ahci_em_messages
    - Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
    - power: supply: Init device wakeup after device_add()
    - x86, perf: Fix the dependency of the x86 insn decoder selftest
    - bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
    - iio: dac: ad5380: fix incorrect assignment to val
    - ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
    - net: sonic: return NETDEV_TX_OK if failed to map buffer
    - Btrfs: fix hang when loading existing inode cache off disk
    - hwmon: (shtc1) fix shtc1 and shtw1 id mask
    - net: sonic: replace dev_kfree_skb in sonic_send_packet
    - net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
    - iommu/amd: Wait for completion of IOTLB flush in attach_device
    - net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
    - net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
    - net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
    - mac80211: accept deauth frames in IBSS mode
    - llc: fix another potential sk_buff leak in llc_ui_sendmsg()
    - llc: fix sk_buff refcounting in llc_conn_state_process()
    - net: stmmac: fix length of PTP clock's name string
    - drm/msm/dsi: Implement reset correctly
    - dmaengine: imx-sdma: fix size check for sdma script_number
    - net: qca_spi: Move reset_count to struct qcaspi
    - media: ov6650: Fix incorrect use of JPEG colorspace
    - media: ov6650: Fix some format attributes not under control
    - media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
    - MIPS: Loongson: Fix return value of loongson_hwmon_init
    - net: neigh: use long type to store jiffies delta
    - packet: fix data-race in fanout_flow_is_huge()
    - dmaengine: ti: edma: fix missed failure handling
    - drm/radeon: fix bad DMA from INTERRUPT_CNTL2
    - arm64: dts: juno: Fix UART frequency
    - m68k: Call timer_interrupt() with interrupts disabled
    - firestream: fix memory leaks
    - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
    - net, ip_tunnel: fix namespaces move
    - net_sched: fix datalen for ematch
    - net: usb: lan78xx: Add .ndo_features_check
    - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
    - Input: keyspan-remote - fix control-message timeouts
    - ARM: 8950/1: ftrace/recordmcount: filter relocation types
    - mmc: sdhci: fix minimum clock rate for v3 controller
    - Input: sur40 - fix interface sanity checks
    - Input: gtco - fix endpoint sanity check
    - Input: aiptek - fix endpoint sanity check
    - hwmon: (nct7802) Fix voltage limits to wrong registers
    - scsi: RDMA/isert: Fix a recently introduced regression related to logout
    - tracing: xen: Ordered comparison of function pointers
    - iio: buffer: align the size of scan bytes to size of the largest element
    - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
    - md: Avoid namespace collision with bitmap API
    - bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free()
    - netfilter: ipset: use bitmap infrastructure completely
    - net/x25: fix nonblocking connect
    - Revert "UBUNTU: SAUCE: libertas: Fix two buffer overflows at parsing bss
      descriptor"
    - libertas: Fix two buffer overflows at parsing bss descriptor
    - Linux 4.4.212

  * CVE-2020-8428
    - do_last(): fetch directory ->i_mode and ->i_uid before it's too late
    - vfs: fix do_last() regression

  * xfs fill_fs test in fallocate06 from ubuntu_ltp_syscalls failed
    (LP: #1865967)
    - xfs: Fix tail rounding in xfs_alloc_file_space()

  * ipc/sem.c : process loops infinitely in exit_sem() (LP: #1858834)
    - Revert "ipc, sem: remove uneeded sem_undo_list lock usage in exit_sem()"

  * quotactl07 from ubuntu_ltp_syscalls failed (LP: #1864092)
    - xfs: Sanity check flags of Q_XQUOTARM call

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 15 Mar 2020 19:16:50 -0400

linux (4.4.0-176.206) xenial; urgency=medium

  * xenial/linux: 4.4.0-176.206 -proposed tracker (LP: #1865106)

  * CVE-2020-2732
    - x86/vdso: Use RDPID in preference to LSL when available
    - KVM: x86: emulate RDPID
    - KVM: nVMX: Don't emulate instructions in guest mode
    - KVM: nVMX: Refactor IO bitmap checks into helper function
    - KVM: nVMX: Check IO instruction VM-exit conditions

 -- Khalid Elmously <khalid.elmously@canonical.com>  Thu, 27 Feb 2020 23:41:44 -0500

linux (4.4.0-175.205) xenial; urgency=medium

  * xenial/linux: 4.4.0-175.205 -proposed tracker (LP: #1863338)

  * run_afpackettests in ubuntu_kernel_selftests failed with "./in_netns.sh:
    Permission denied" (LP: #1861973)
    - [Debian] autoreconstruct - add resoration of execute permissions

  * pty03 from pty in ubuntu_ltp failed on Eoan (LP: #1862114)
    - can, slip: Protect tty->disc_data in write_wakeup and close with RCU

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Fri, 14 Feb 2020 16:27:12 -0300

linux (4.4.0-174.204) xenial; urgency=medium

  * xenial/linux: 4.4.0-174.204 -proposed tracker (LP: #1861122)

  * Xenial update: 4.4.211 upstream stable release (LP: #1860681)
    - hidraw: Return EPOLLOUT from hidraw_poll
    - HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
    - HID: hidraw, uhid: Always report EPOLLOUT
    - cfg80211/mac80211: make ieee80211_send_layer2_update a public function
    - mac80211: Do not send Layer 2 Update frame before authorization
    - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
    - p54usb: Fix race between disconnect and firmware loading
    - ALSA: line6: Fix write on zero-sized buffer
    - ALSA: line6: Fix memory leak at line6_init_pcm() error path
    - xen: let alloc_xenballooned_pages() fail if not enough memory free
    - wimax: i2400: fix memory leak
    - wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
    - ext4: fix use-after-free race with debug_want_extra_isize
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
    - rtc: mt6397: fix alarm register overwrite
    - iommu: Remove device link to group on failure
    - gpio: Fix error message on out-of-range GPIO in lookup table
    - hsr: reset network header when supervision frame is created
    - cifs: Adjust indentation in smb2_open_file
    - RDMA/srpt: Report the SCSI residual to the initiator
    - scsi: enclosure: Fix stale device oops with hot replug
    - scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI
    - platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0
    - iio: imu: adis16480: assign bias value only if operation succeeded
    - mei: fix modalias documentation
    - clk: samsung: exynos5420: Preserve CPU clocks configuration during
      suspend/resume
    - compat_ioctl: handle SIOCOUTQNSD
    - tty: serial: imx: use the sg count from dma_map_sg
    - tty: serial: pch_uart: correct usage of dma_unmap_sg
    - media: exynos4-is: Fix recursive locking in isp_video_release()
    - spi: atmel: fix handling of cs_change set on non-last xfer
    - rtlwifi: Remove unnecessary NULL check in rtl_regd_init
    - rtc: msm6242: Fix reading of 10-hour digit
    - rseq/selftests: Turn off timeout setting
    - hexagon: work around compiler crash
    - ocfs2: call journal flush to mark journal as empty after journal recovery
      when mount
    - ALSA: seq: Fix racy access for queue timer in proc read
    - Fix built-in early-load Intel microcode alignment
    - block: fix an integer overflow in logical block size
    - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
    - USB: serial: opticon: fix control-message timeouts
    - USB: serial: suppress driver bind attributes
    - USB: serial: ch341: handle unbound port at reset_resume
    - USB: serial: io_edgeport: add missing active-port sanity check
    - USB: serial: quatech2: handle unbound ports
    - scsi: mptfusion: Fix double fetch bug in ioctl
    - usb: core: hub: Improved device recognition on remote wakeup
    - x86/efistub: Disable paging at mixed mode entry
    - mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
    - net: stmmac: 16KB buffer must be 16 byte aligned
    - net: stmmac: Enable 16KB buffer size
    - USB: serial: io_edgeport: use irqsave() in USB's complete callback
    - USB: serial: io_edgeport: handle unbound ports on URB completion
    - USB: serial: keyspan: handle unbound ports
    - scsi: fnic: use kernel's '%pM' format option to print MAC
    - scsi: fnic: fix invalid stack access
    - arm64: dts: agilex/stratix10: fix pmu interrupt numbers
    - netfilter: fix a use-after-free in mtype_destroy()
    - batman-adv: Fix DAT candidate selection on little endian systems
    - macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
    - r8152: add missing endpoint sanity check
    - tcp: fix marked lost packets not being retransmitted
    - net: usb: lan78xx: limit size of local TSO packets
    - xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
    - cw1200: Fix a signedness bug in cw1200_load_firmware()
    - cfg80211: check for set_wiphy_params
    - scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
    - scsi: qla4xxx: fix double free bug
    - scsi: bnx2i: fix potential use after free
    - scsi: target: core: Fix a pr_debug() argument
    - scsi: core: scsi_trace: Use get_unaligned_be*()
    - perf probe: Fix wrong address verification
    - regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
    - Linux 4.4.211

  * Xenial update: 4.4.210 upstream stable release (LP: #1859865)
    - chardev: Avoid potential use-after-free in 'chrdev_open()'
    - usb: chipidea: host: Disable port power only if previously enabled
    - ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
    - kernel/trace: Fix do not unregister tracepoints when register
      sched_migrate_task fail
    - tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
    - HID: Fix slab-out-of-bounds read in hid_field_extract
    - HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
    - HID: hid-input: clear unmapped usages
    - Input: add safety guards to input_set_keycode()
    - drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
    - can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
    - can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling
      to irq mode
    - can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing
      CAN sk_buffs
    - staging: vt6656: set usb_set_intfdata on driver fail.
    - USB: serial: option: add ZLP support for 0x1bc7/0x9010
    - usb: musb: Disable pullup at init
    - usb: musb: dma: Correct parameter passed to IRQ handler
    - staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
    - tty: link tty and port before configuring it as console
    - tty: always relink the port
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
    - scsi: bfa: release allocated memory in case of error
    - rtl8xxxu: prevent leaking urb
    - USB: Fix: Don't skip endpoint descriptors with maxpacket=0
    - netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
    - netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
    - Linux 4.4.210

  * Xenial update: 4.4.209 upstream stable release (LP: #1859640)
    - PM / devfreq: Don't fail devfreq_dev_release if not in list
    - RDMA/cma: add missed unregister_pernet_subsys in init failure
    - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    - scsi: qla2xxx: Don't call qlt_async_event twice
    - scsi: iscsi: qla4xxx: fix double free in probe
    - scsi: libsas: stop discovering if oob mode is disconnected
    - usb: gadget: fix wrong endpoint desc
    - md: raid1: check rdev before reference in raid1_sync_request func
    - s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits
    - s390/cpum_sf: Avoid SBD overflow condition in irq handler
    - xen/balloon: fix ballooned page accounting without hotplug enabled
    - xfs: fix mount failure crash on invalid iclog memory access
    - taskstats: fix data-race
    - ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
    - MIPS: Avoid VDSO ABI breakage due to global register variable
    - locks: print unsigned ino in /proc/locks
    - dmaengine: Fix access to uninitialized dma_slave_caps
    - compat_ioctl: block: handle Persistent Reservations
    - gpiolib: fix up emulated open drain outputs
    - ALSA: cs4236: fix error return comparison of an unsigned integer
    - ftrace: Avoid potential division by zero in function profiler
    - Bluetooth: btusb: fix PM leak in error case of setup
    - Bluetooth: delete a stray unlock
    - tty: serial: msm_serial: Fix lockup for sysrq and oops
    - drm/mst: Fix MST sideband up-reply failure handling
    - powerpc/pseries/hvconsole: Fix stack overread via udbg
    - ath9k_htc: Modify byte order for an error message
    - ath9k_htc: Discard undersized packets
    - net: add annotations on hh->hh_len lockless accesses
    - s390/smp: fix physical to logical CPU map for SMT
    - locking/x86: Remove the unused atomic_inc_short() methd
    - pstore/ram: Write new dumps to start of recycled zones
    - locking/spinlock/debug: Fix various data races
    - netfilter: ctnetlink: netns exit must wait for callbacks
    - ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
    - netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
    - ARM: dts: am437x-gp/epos-evm: fix panel compatible
    - powerpc: Ensure that swiotlb buffer is allocated from low memory
    - bnx2x: Do not handle requests from VFs after parity
    - bnx2x: Fix logic to get total no. of PFs per engine
    - net: usb: lan78xx: Fix error message format specifier
    - rfkill: Fix incorrect check to avoid NULL pointer dereference
    - ASoC: wm8962: fix lambda value
    - regulator: rn5t618: fix module aliases
    - kconfig: don't crash on NULL expressions in expr_eq()
    - parisc: Fix compiler warnings in debug_core.c
    - llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
    - net: stmmac: dwmac-sunxi: Allow all RGMII modes
    - net: usb: lan78xx: fix possible skb leak
    - pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
    - sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
    - tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
    - vlan: vlan_changelink() should propagate errors
    - vlan: fix memory leak in vlan_dev_set_egress_priority
    - vxlan: fix tos value before xmit
    - macvlan: do not assume mac_header is set in macvlan_broadcast()
    - USB: core: fix check for duplicate endpoints
    - USB: serial: option: add Telit ME910G1 0x110a composition
    - Linux 4.4.209

  * overlayfs : broken access to r/w files (LP: #1851243)
    - SAUCE: Revert "ovl: modify ovl_permission() to do checks on two inodes"

  * net selftest psock_fanout fails on xenial s390x due to incorrect queue
    lengths (LP: #1853375)
    - selftests/net: cleanup unused parameter in psock_fanout
    - selftests/net: ignore background traffic in psock_fanout

  * multi-zone raid0 corruption (LP: #1850540)
    - md/raid0: avoid RAID0 data corruption due to layout confusion.
    - md: add feature flag MD_FEATURE_RAID0_LAYOUT
    - md/raid0: fix warning message for parameter default_layout
    - md/raid0: Fix an error message in raid0_make_request()
    - SAUCE: md/raid0: Link to wiki with guidance on multi-zone RAID0 layout
      migration
    - SAUCE: md/raid0: Use kernel specific layout

  * CVE-2019-20096
    - dccp: Fix memleak in __feat_register_sp

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 29 Jan 2020 00:47:22 -0500

linux (4.4.0-173.203) xenial; urgency=medium

  * xenial/linux: 4.4.0-173.203 -proposed tracker (LP: #1859718)

  * CVE-2019-14615
    - drm/i915/gen9: Clear residual context state on context switch

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 14 Jan 2020 22:02:26 -0300

linux (4.4.0-172.202) xenial; urgency=medium

  * xenial/linux: 4.4.0-172.202 -proposed tracker (LP: #1858594)

  * tools/perf fails to build after Xenial update to 4.4.208 upstream stable
    release (LP: #1858798)
    - Revert "perf report: Add warning when libunwind not compiled in"

  * CVE-2019-18885
    - btrfs: refactor btrfs_find_device() take fs_devices as argument
    - btrfs: merge btrfs_find_device and find_device

  *  Integrate Intel SGX driver into linux-azure (LP: #1844245)
    - [Packaging] Add systemd service to load intel_sgx

  * Xenial update: 4.4.208 upstream stable release (LP: #1858462)
    - btrfs: do not leak reloc root if we fail to read the fs root
    - btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    - ALSA: hda/ca0132 - Keep power on during processing DSP response
    - ALSA: hda/ca0132 - Avoid endless loop
    - drm: mst: Fix query_payload ack reply struct
    - iio: light: bh1750: Resolve compiler warning and make code more readable
    - spi: Add call to spi_slave_abort() function when spidev driver is released
    - staging: rtl8188eu: fix possible null dereference
    - rtlwifi: prevent memory leak in rtl_usb_probe
    - IB/iser: bound protection_sg size by data_sg size
    - media: am437x-vpfe: Setting STD to current value is not an error
    - media: i2c: ov2659: fix s_stream return value
    - media: i2c: ov2659: Fix missing 720p register config
    - media: ov6650: Fix stored frame format not in sync with hardware
    - tools/power/cpupower: Fix initializer override in hsw_ext_cstates
    - usb: renesas_usbhs: add suspend event support in gadget mode
    - hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
    - regulator: max8907: Fix the usage of uninitialized variable in
      max8907_regulator_probe()
    - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    - samples: pktgen: fix proc_cmd command result check logic
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
    - media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
    - media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence
      number
    - media: ti-vpe: vpe: Make sure YUYV is set as default format
    - extcon: sm5502: Reset registers during initialization
    - x86/mm: Use the correct function type for native_set_fixmap()
    - perf report: Add warning when libunwind not compiled in
    - iio: adc: max1027: Reset the device at probe time
    - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
    - drm/gma500: fix memory disclosures due to uninitialized bytes
    - x86/ioapic: Prevent inconsistent state when moving an interrupt
    - arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
    - libata: Ensure ata_port probe has completed before detach
    - pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
    - bnx2x: Fix PF-VF communication over multi-cos queues.
    - spi: img-spfi: fix potential double release
    - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    - perf probe: Fix to find range-only function instance
    - perf probe: Fix to list probe event with correct line number
    - perf probe: Walk function lines in lexical blocks
    - perf probe: Fix to probe an inline function which has no entry pc
    - perf probe: Fix to show ranges of variables in functions without entry_pc
    - perf probe: Fix to show inlined function callsite without entry_pc
    - perf probe: Skip overlapped location on searching variables
    - perf probe: Return a better scope DIE if there is no best scope
    - perf probe: Fix to show calling lines of inlined functions
    - perf probe: Skip end-of-sequence and non statement lines
    - perf probe: Filter out instances except for inlined subroutine and
      subprogram
    - ath10k: fix get invalid tx rate for Mesh metric
    - media: pvrusb2: Fix oops on tear-down when radio support is not present
    - media: si470x-i2c: add missed operations in remove
    - EDAC/ghes: Fix grain calculation
    - spi: pxa2xx: Add missed security checks
    - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    - parport: load lowlevel driver if ports not found
    - cpufreq: Register drivers only after CPU devices have been registered
    - x86/crash: Add a forward declaration of struct kimage
    - spi: tegra20-slink: add missed clk_unprepare
    - btrfs: don't prematurely free work in end_workqueue_fn()
    - iwlwifi: check kasprintf() return value
    - fbtft: Make sure string is NULL terminated
    - crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    - crypto: vmx - Avoid weird build failures
    - libtraceevent: Fix memory leakage in copy_filter_type
    - net: phy: initialise phydev speed and duplex sanely
    - Revert "mmc: sdhci: Fix incorrect switch to HS mode"
    - usb: xhci: Fix build warning seen with CONFIG_PM=n
    - btrfs: do not call synchronize_srcu() in inode_tree_del
    - btrfs: return error pointer from alloc_test_extent_buffer
    - btrfs: abort transaction after failed inode updates in create_subvol
    - Btrfs: fix removal logic of the tree mod log that leads to use-after-free
      issues
    - ALSA: pcm: Avoid possible info leaks from PCM stream buffers
    - af_packet: set defaule value for tmo
    - fjes: fix missed check in fjes_acpi_add
    - mod_devicetable: fix PHY module format
    - net: hisilicon: Fix a BUG trigered by wrong bytes_compl
    - net: nfc: nci: fix a possible sleep-in-atomic-context bug in
      nci_uart_tty_receive()
    - net: qlogic: Fix error paths in ql_alloc_large_buffers()
    - net: usb: lan78xx: Fix suspend/resume PHY register access error
    - sctp: fully initialize v4 addr in some functions
    - net: dst: Force 4-byte alignment of dst_metrics
    - usbip: Fix error path of vhci_recv_ret_submit()
    - USB: EHCI: Do not return -EPIPE when hub is disconnected
    - platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
    - staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    - ext4: check for directory entries too close to block end
    - powerpc/irq: fix stack overflow verification
    - mmc: sdhci-of-esdhc: fix P2020 errata handling
    - perf probe: Fix to show function entry line as probe-able
    - scsi: mpt3sas: Fix clear pending bit in ioctl status
    - scsi: lpfc: Fix locking on mailbox command completion
    - Input: atmel_mxt_ts - disable IRQ across suspend
    - iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    - scsi: target: compare full CHAP_A Algorithm strings
    - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    - scsi: csiostor: Don't enable IRQs too early
    - powerpc/pseries: Mark accumulate_stolen_time() as notrace
    - dma-debug: add a schedule point in debug_dma_dump_mappings()
    - clocksource/drivers/asm9260: Add a check for of_clk_get
    - powerpc/security/book3s64: Report L1TF status in sysfs
    - jbd2: Fix statistics for the number of logged blocks
    - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
    - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
    - clk: qcom: Allow constant ratio freq tables for rcg
    - irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
    - irqchip: ingenic: Error out if IRQ domain creation failed
    - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
    - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
    - scsi: ufs: fix potential bug which ends in system hang
    - powerpc/pseries/cmm: Implement release() function for sysfs device
    - powerpc/security: Fix wrong message when RFI Flush is disable
    - clk: pxa: fix one of the pxa RTC clocks
    - bcache: at least try to shrink 1 node in bch_mca_scan()
    - HID: Improve Windows Precision Touchpad detection.
    - ext4: work around deleting a file with i_nlink == 0 safely
    - scsi: pm80xx: Fix for SATA device discovery
    - scsi: target: iscsi: Wait for all commands to finish before freeing a
      session
    - gpio: mpc8xxx: Don't overwrite default irq_set_type callback
    - scripts/kallsyms: fix definitely-lost memory leak
    - cdrom: respect device capabilities during opening action
    - perf regs: Make perf_reg_name() return "unknown" instead of NULL
    - libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
    - s390/cpum_sf: Check for SDBT and SDB consistency
    - ocfs2: fix passing zero to 'PTR_ERR' warning
    - kernel: sysctl: make drop_caches write-only
    - ALSA: hda - Downgrade error message for single-cmd fallback
    - Make filldir[64]() verify the directory entry filename is valid
    - filldir[64]: remove WARN_ON_ONCE() for bad directory entries
    - net: davinci_cpdma: use dma_addr_t for DMA address
    - netfilter: ebtables: compat: reject all padding in matches/watchers
    - 6pack,mkiss: fix possible deadlock
    - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    - net: icmp: fix data-race in cmp_global_allow()
    - hrtimer: Annotate lockless access to timer->state
    - mmc: sdhci: Update the tuning failed messages to pr_debug level
    - tcp: do not send empty skb from tcp_write_xmit()
    - Linux 4.4.208

  * Xenial update: 4.4.207 upstream stable release (LP: #1858489)
    - x86/apic/32: Avoid bogus LDR warnings
    - usb: gadget: u_serial: add missing port entry locking
    - tty: serial: msm_serial: Fix flow control
    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
    - serial: serial_core: Perform NULL checks for break_ctl ops
    - serial: ifx6x60: add missed pm_runtime_disable
    - autofs: fix a leak in autofs_expire_indirect()
    - NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error
    - Input: cyttsp4_core - fix use after free bug
    - ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
    - rsxx: add missed destroy_workqueue calls in remove
    - net: ep93xx_eth: fix mismatch of request_mem_region in remove
    - serial: core: Allow processing sysrq at port unlock time
    - iwlwifi: mvm: Send non offchannel traffic via AP sta
    - ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
    - extcon: max8997: Fix lack of path setting in USB device mode
    - clk: rockchip: fix rk3188 sclk_smc gate data
    - clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
    - dlm: fix missing idr_destroy for recover_idr
    - MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
    - scsi: zfcp: drop default switch case which might paper over missing case
    - pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
    - Staging: iio: adt7316: Fix i2c data reading, set the data field
    - regulator: Fix return value of _set_load() stub
    - MIPS: OCTEON: octeon-platform: fix typing
    - math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
    - rtc: max8997: Fix the returned value in case of error in
      'max8997_rtc_read_alarm()'
    - rtc: dt-binding: abx80x: fix resistance scale
    - ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
    - dmaengine: coh901318: Fix a double-lock bug
    - dmaengine: coh901318: Remove unused variable
    - ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion()
    - dma-mapping: fix return type of dma_set_max_seg_size()
    - altera-stapl: check for a null key before strcasecmp'ing it
    - serial: imx: fix error handling in console_setup
    - i2c: imx: don't print error message on probe defer
    - dlm: NULL check before kmem_cache_destroy is not needed
    - nfsd: fix a warning in __cld_pipe_upcall()
    - ARM: OMAP1/2: fix SoC name printing
    - net/x25: fix called/calling length calculation in x25_parse_address_block
    - net/x25: fix null_x25_address handling
    - ARM: dts: mmp2: fix the gpio interrupt cell number
    - tcp: fix off-by-one bug on aborting window-probing socket
    - modpost: skip ELF local symbols during section mismatch check
    - kbuild: fix single target build for external module
    - ARM: dts: pxa: clean up USB controller nodes
    - dlm: fix invalid cluster name warning
    - powerpc/math-emu: Update macros from GCC
    - MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition
    - nfsd: Return EPERM, not EACCES, in some SETATTR cases
    - mlx4: Use snprintf instead of complicated strcpy
    - ARM: dts: sunxi: Fix PMU compatible strings
    - sched/fair: Scale bandwidth quota and period without losing quota/period
      ratio precision
    - fuse: verify nlink
    - fuse: verify attributes
    - ALSA: pcm: oss: Avoid potential buffer overflows
    - Input: goodix - add upside-down quirk for Teclast X89 tablet
    - CIFS: Fix SMB2 oplock break processing
    - tty: vt: keyboard: reject invalid keycodes
    - can: slcan: Fix use-after-free Read in slcan_open
    - jbd2: Fix possible overflow in jbd2_log_space_left()
    - drm/i810: Prevent underflow in ioctl
    - KVM: x86: do not modify masked bits of shared MSRs
    - KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES
    - crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr
    - spi: atmel: Fix CS high support
    - RDMA/qib: Validate ->show()/store() callbacks before calling them
    - thermal: Fix deadlock in thermal thermal_zone_device_check
    - Revert "KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID
      (CVE-2019-19332)"
    - KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)
    - appletalk: Fix potential NULL pointer dereference in unregister_snap_client
    - appletalk: Set error code if register_snap_client failed
    - ALSA: hda - Fix pending unsol events at shutdown
    - sched/core: Allow putting thread_info into task_struct
    - sched/core: Add try_get_task_stack() and put_task_stack()
    - sched/core, x86: Make struct thread_info arch specific again
    - fs/proc: Stop reporting eip and esp in /proc/PID/stat
    - fs/proc: Report eip/esp in /prod/PID/stat for coredumping
    - proc: fix coredump vs read /proc/*/stat race
    - fs/proc/array.c: allow reporting eip/esp for all coredumping threads
    - usb: gadget: configfs: Fix missing spin_lock_init()
    - usb: Allow USB device to be warm reset in suspended state
    - staging: rtl8188eu: fix interface sanity check
    - staging: rtl8712: fix interface sanity check
    - staging: gigaset: fix general protection fault on probe
    - staging: gigaset: fix illegal free on probe errors
    - staging: gigaset: add endpoint-type sanity check
    - xhci: Increase STS_HALT timeout in xhci_suspend()
    - iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting
    - USB: atm: ueagle-atm: add missing endpoint check
    - USB: idmouse: fix interface sanity checks
    - USB: serial: io_edgeport: fix epic endpoint lookup
    - USB: adutux: fix interface sanity check
    - usb: core: urb: fix URB structure initialization function
    - usb: mon: Fix a deadlock in usbmon between mmap and read
    - mtd: spear_smi: Fix Write Burst mode
    - virtio-balloon: fix managed page counts when migrating pages between zones
    - btrfs: check page->mapping when loading free space cache
    - btrfs: Remove btrfs_bio::flags member
    - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address
    - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer
    - rtlwifi: rtl8192de: Fix missing enable interrupt flag
    - lib: raid6: fix awk build warnings
    - workqueue: Fix spurious sanity check failures in destroy_workqueue()
    - workqueue: Fix pwq ref leak in rescuer_thread()
    - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
    - blk-mq: avoid sysfs buffer overflow with too many CPU cores
    - cgroup: pids: use atomic64_t for pids->limit
    - ar5523: check NULL before memcpy() in ar5523_cmd()
    - media: bdisp: fix memleak on release
    - media: radio: wl1273: fix interrupt masking on release
    - cpuidle: Do not unset the driver if it is there already
    - ACPI: OSL: only free map once in osl.c
    - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
    - ACPI: PM: Avoid attaching ACPI PM domain to certain devices
    - pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup
      controller init
    - pinctrl: samsung: Fix device node refcount leaks in init code
    - powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB
    - video/hdmi: Fix AVI bar unpack
    - quota: Check that quota is not dirty before release
    - quota: fix livelock in dquot_writeback_dquots
    - scsi: zfcp: trace channel log even for FCP command responses
    - usb: xhci: only set D3hot for pci device
    - xhci: Fix memory leak in xhci_add_in_port()
    - xhci: make sure interrupts are restored to correct state
    - iio: adis16480: Add debugfs_reg_access entry
    - Btrfs: fix negative subv_writers counter and data space leak after buffered
      write
    - scsi: lpfc: Cap NPIV vports to 256
    - e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait
    - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
    - ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity
    - pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup
      controller init
    - scsi: qla2xxx: Fix DMA unmap leak
    - scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()
    - scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value
    - powerpc: Fix vDSO clock_getres()
    - mm/shmem.c: cast the type of unmap_start to u64
    - blk-mq: make sure that line break can be printed
    - workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
    - sunrpc: fix crash when cache_head become valid before update
    - kernel/module.c: wakeup processes in module_wq on module unload
    - net: bridge: deny dev_set_mac_address() when unregistering
    - tcp: md5: fix potential overestimation of TCP option space
    - tipc: fix ordering of tipc module init and exit routine
    - inet: protect against too small mtu values.
    - tcp: fix rejected syncookies due to stale timestamps
    - tcp: tighten acceptance of ACKs not matching a child socket
    - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
    - net: ethernet: ti: cpsw: fix extra rx interrupt
    - PCI: Fix Intel ACS quirk UPDCR register address
    - PCI/MSI: Fix incorrect MSI-X masking on resume
    - xtensa: fix TLB sanity checker
    - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
    - ARM: dts: s3c64xx: Fix init order of clock providers
    - ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume()
    - vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    - dm btree: increase rebalance threshold in __rebalance2()
    - drm/radeon: fix r1xx/r2xx register checker for POT textures
    - xhci: fix USB3 device initiated resume race with roothub autosuspend
    - net: stmmac: use correct DMA buffer size in the RX descriptor
    - net: stmmac: don't stop NAPI processing when dropping a packet
    - Linux 4.4.207

  * efivarfs test in ubuntu_kernel_selftest failed on the second run
    (LP: #1809704)
    - selftests: efivarfs: return Kselftest Skip code for skipped tests
    - selftests/efivarfs: clean up test files from test_create*()

  * cifs: kernel NULL pointer dereference, address: 0000000000000038
    (LP: #1856949)
    - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks

  * CVE-2019-19332
    - KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)

  * CVE-2019-19062
    - crypto: user - fix memory leak in crypto_report

  * [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
    - [Packaging] bind hv_kvp_daemon startup to hv_kvp device

  * False positive test result in run_afpackettests from net in
    ubuntu_kernel_selftest  (LP: #1825778)
    - selftests/net: correct the return value for run_afpackettests

  * Xenial update: 4.4.206 upstream stable release (LP: #1855313)
    - ASoC: compress: fix unsigned integer overflow check
    - ASoC: kirkwood: fix external clock probe defer
    - clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
    - reset: fix reset_control_ops kerneldoc comment
    - can: peak_usb: report bus recovery as well
    - can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
    - scripts/gdb: fix debugging modules compiled with hot/cold partitioning
    - block: drbd: remove a stray unlock in __drbd_send_protocol()
    - scsi: lpfc: Fix dif and first burst use in write commands
    - ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
    - ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
    - parisc: Fix serio address output
    - parisc: Fix HP SDC hpa address output
    - arm64: smp: Handle errors reported by the firmware
    - PM / AVS: SmartReflex: NULL check before some freeing functions is not
      needed
    - ARM: ks8695: fix section mismatch warning
    - ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
    - crypto: user - support incremental algorithm dumps
    - mwifiex: fix potential NULL dereference and use after free
    - mwifiex: debugfs: correct histogram spacing, formatting
    - rtl818x: fix potential use after free
    - xfs: require both realtime inodes to mount
    - ubi: Put MTD device after it is not used
    - ubi: Do not drop UBI device reference before using
    - microblaze: adjust the help to the real behavior
    - microblaze: move "... is ready" messages to arch/microblaze/Makefile
    - gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
    - VSOCK: bind to random port for VMADDR_PORT_ANY
    - btrfs: only track ref_heads in delayed_ref_updates
    - xen/pciback: Check dev_data before using it
    - KVM: s390: unregister debug feature on failing arch init
    - pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
    - pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
    - HID: doc: fix wrong data structure reference for UHID_OUTPUT
    - gfs2: take jdata unstuff into account in do_grow
    - xfs: Align compat attrlist_by_handle with native implementation.
    - IB/qib: Fix an error code in qib_sdma_verbs_send()
    - powerpc/book3s/32: fix number of bats in p/v_block_mapped()
    - powerpc/xmon: fix dump_segments()
    - drivers/regulator: fix a missing check of return value
    - serial: max310x: Fix tx_empty() callback
    - openrisc: Fix broken paths to arch/or32
    - RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
    - scsi: qla2xxx: deadlock by configfs_depend_item
    - scsi: csiostor: fix incorrect dma device in case of vport
    - ath6kl: Only use match sets when firmware supports it
    - ath6kl: Fix off by one error in scan completion
    - powerpc/prom: fix early DEBUG messages
    - powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
    - powerpc/44x/bamboo: Fix PCI range
    - drbd: reject attach of unsuitable uuids even if connected
    - drbd: fix print_st_err()'s prototype to match the definition
    - regulator: tps65910: fix a missing check of return value
    - net/net_namespace: Check the return value of register_pernet_subsys()
    - um: Make GCOV depend on !KCOV
    - net: stmicro: fix a missing check of clk_prepare
    - atl1e: checking the status of atl1e_write_phy_reg
    - tipc: fix a missing check of genlmsg_put
    - ocfs2: clear journal dirty flag after shutdown journal
    - lib/genalloc.c: use vzalloc_node() to allocate the bitmap
    - lib/genalloc.c: include vmalloc.h
    - mtd: Check add_mtd_device() ret code
    - tipc: fix memory leak in tipc_nl_compat_publ_dump
    - net/core/neighbour: tell kmemleak about hash tables
    - net/core/neighbour: fix kmemleak minimal reference count for hash tables
    - sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
    - decnet: fix DN_IFREQ_SIZE
    - tipc: fix skb may be leaky in tipc_link_input
    - sfc: initialise found bitmap in efx_ef10_mtd_probe
    - net: fix possible overflow in __sk_mem_raise_allocated()
    - net: dev: Use unsigned integer as an argument to left-shift
    - scsi: libsas: Support SATA PHY connection rate unmatch fixing during
      discovery
    - ACPI / APEI: Switch estatus pool to use vmalloc memory
    - scsi: libsas: Check SMP PHY control function result
    - mtd: Remove a debug trace in mtdpart.c
    - staging: rtl8192e: fix potential use after free
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - mei: bus: prefix device names on bus with the bus name
    - media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
    - net: macb: fix error format in dev_err()
    - pwm: Clear chip_data in pwm_put()
    - macvlan: schedule bc_work even if error
    - openvswitch: fix flow command message size
    - slip: Fix use-after-free Read in slip_open
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - tipc: fix link name length check
    - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
    - HID: core: check whether Usage Page item is after Usage ID items
    - hwrng: stm32 - fix unbalanced pm_runtime_enable
    - platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - Linux 4.4.206
    - [Config] updateconfigs for 4.4.206

  * Xenial update: 4.4.205 upstream stable release (LP: #1854857)
    - Revert "sock: Reset dst when changing sk_mark via setsockopt"
    - Linux 4.4.205

  * Xenial update: 4.4.204 upstream stable release (LP: #1854855)
    - net/mlx4_en: fix mlx4 ethtool -N insertion
    - sfc: Only cancel the PPS workqueue if it exists
    - net/sched: act_pedit: fix WARN() in the traffic path
    - net: rtnetlink: prevent underflows in do_setvfinfo()
    - Revert "fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()"
    - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
    - asus-wmi: Create quirk for airplane_mode LED
    - asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF
    - asus-wmi: Add quirk_no_rfkill for the Asus N552VW
    - asus-wmi: Add quirk_no_rfkill for the Asus U303LB
    - asus-wmi: Add quirk_no_rfkill for the Asus Z550MA
    - platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A
    - platform/x86: asus-wmi: fix asus ux303ub brightness issue
    - platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB
    - asus-wmi: provide access to ALS control
    - platform/x86: asus-wmi: try to set als by default
    - platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
    - platform/x86: asus-wmi: add SERIO_I8042 dependency
    - mwifiex: Fix NL80211_TX_POWER_LIMITED
    - ALSA: isight: fix leak of reference to firewire unit in error path of .probe
      callback
    - printk: fix integer overflow in setup_log_buf()
    - gfs2: Fix marking bitmaps non-full
    - synclink_gt(): fix compat_ioctl()
    - powerpc: Fix signedness bug in update_flash_db()
    - powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
    - brcmsmac: AP mode: update beacon when TIM changes
    - spi: sh-msiof: fix deferred probing
    - mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail
    - btrfs: handle error of get_old_root
    - gsmi: Fix bug in append_to_eventlog sysfs handler
    - misc: mic: fix a DMA pool free failure
    - amiflop: clean up on errors during setup
    - scsi: ips: fix missing break in switch
    - KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
    - scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
    - scsi: isci: Change sci_controller_start_task's return type to sci_status
    - scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
    - clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
    - scsi: dc395x: fix dma API usage in srb_done
    - scsi: dc395x: fix DMA API usage in sg_update_list
    - net: fix warning in af_unix
    - kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad
      stack
    - ALSA: i2c/cs8427: Fix int to char conversion
    - macintosh/windfarm_smu_sat: Fix debug output
    - USB: misc: appledisplay: fix backlight update_status return code
    - SUNRPC: Fix a compile warning for cmpxchg64()
    - atm: zatm: Fix empty body Clang warnings
    - s390/perf: Return error when debug_register fails
    - spi: omap2-mcspi: Set FIFO DMA trigger level to word length
    - sparc: Fix parport build warnings.
    - ceph: fix dentry leak in ceph_readdir_prepopulate
    - rtc: s35390a: Change buf's type to u8 in s35390a_init
    - mISDN: Fix type of switch control variable in ctrl_teimanager
    - qlcnic: fix a return in qlcnic_dcb_get_capability()
    - mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
    - mfd: max8997: Enale irq-wakeup unconditionally
    - selftests/ftrace: Fix to test kprobe $comm arg only if available
    - thermal: rcar_thermal: Prevent hardware access during system suspend
    - sparc64: Rework xchg() definition to avoid warnings.
    - fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in
      dlm_print_one_mle()
    - mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock
    - um: Make line/tty semantics use true write IRQ
    - linux/bitmap.h: handle constant zero-size bitmaps correctly
    - linux/bitmap.h: fix type of nbits in bitmap_shift_right()
    - hfsplus: fix BUG on bnode parent update
    - hfs: fix BUG on bnode parent update
    - hfsplus: prevent btree data loss on ENOSPC
    - hfs: prevent btree data loss on ENOSPC
    - hfsplus: fix return value of hfsplus_get_block()
    - hfs: fix return value of hfs_get_block()
    - fs/hfs/extent.c: fix array out of bounds read of array extent
    - igb: shorten maximum PHC timecounter update interval
    - ntb_netdev: fix sleep time mismatch
    - ntb: intel: fix return value for ndev_vec_mask()
    - ocfs2: don't put and assigning null to bh allocated outside
    - ocfs2: fix clusters leak in ocfs2_defrag_extent()
    - net: do not abort bulk send on BQL status
    - sched/fair: Don't increase sd->balance_interval on newidle balance
    - audit: print empty EXECVE args
    - wlcore: Fix the return value in case of error in
      'wlcore_vendor_cmd_smart_config_start()'
    - rtl8xxxu: Fix missing break in switch
    - brcmsmac: never log "tid x is not agg'able" by default
    - wireless: airo: potential buffer overflow in sprintf()
    - rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
    - scsi: mpt3sas: Fix Sync cache command failure during driver unload
    - scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11
    - scsi: megaraid_sas: Fix msleep granularity
    - scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
    - dlm: fix invalid free
    - dlm: don't leak kernel pointer to userspace
    - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
    - sock: Reset dst when changing sk_mark via setsockopt
    - pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
    - pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
    - PCI: keystone: Use quirk to limit MRRS for K2G
    - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
    - IB/hfi1: Ensure full Gen3 speed in a Gen4 system
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath9k_hw: fix uninitialized variable data
    - dm: use blk_set_queue_dying() in __dm_destroy()
    - arm64: fix for bad_mode() handler to always result in panic
    - cpufreq: Skip cpufreq resume if it's not suspended
    - ocfs2: remove ocfs2_is_o2cb_active()
    - mmc: block: Fix tag condition with packed writes
    - ARC: perf: Accommodate big-endian CPU
    - x86/insn: Fix awk regexp warnings
    - x86/speculation: Fix incorrect MDS/TAA mitigation status
    - x86/speculation: Fix redundant MDS mitigation message
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - media: b2c2-flexcop-usb: add sanity checking
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - virtio_console: reset on out of memory
    - virtio_console: don't tie bufs to a vq
    - virtio_console: allocate inbufs in add_port() only if it is needed
    - virtio_console: fix uninitialized variable use
    - virtio_console: drop custom control queue cleanup
    - virtio_console: move removal code
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - Linux 4.4.204

 -- Connor Kuehl <connor.kuehl@canonical.com>  Wed, 08 Jan 2020 09:26:38 -0800

linux (4.4.0-171.200) xenial; urgency=medium

  * xenial/linux: 4.4.0-171.200 -proposed tracker (LP: #1854835)

  * CVE-2019-14901
    - SAUCE: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()

  * CVE-2019-14896 // CVE-2019-14897
    - SAUCE: libertas: Fix two buffer overflows at parsing bss descriptor

  * CVE-2019-14895
    - SAUCE: mwifiex: fix possible heap overflow in mwifiex_process_country_ie()

  * CVE-2019-18660: patches for Ubuntu (LP: #1853142) // CVE-2019-18660
    - powerpc/64s: support nospectre_v2 cmdline option
    - powerpc/book3s64: Fix link stack flush on context switch
    - KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel

  * cloudimg: no iavf/i40evf module so no network available with SR-IOV enabled
    cloud (LP: #1848481)
    - [Packaging]: include i40evf in generic

  * update ENA driver for DIMLIB dynamic interrupt moderation (LP: #1853180)
    - net: ena: fix bug that might cause hang after consecutive open/close
      interface.
    - net: ena: add intr_moder_rx_interval to struct ena_com_dev and use it
    - net: ena: switch to dim algorithm for rx adaptive interrupt moderation
    - net: ena: reimplement set/get_coalesce()
    - net: ena: enable the interrupt_moderation in driver_supported_features
    - net: ena: remove code duplication in
      ena_com_update_nonadaptive_moderation_interval _*()
    - net: ena: remove old adaptive interrupt moderation code from ena_netdev
    - net: ena: remove ena_restore_ethtool_params() and relevant fields
    - net: ena: remove all old adaptive rx interrupt moderation code from ena_com
    - net: ena: fix update of interrupt moderation register
    - net: ena: fix retrieval of nonadaptive interrupt moderation intervals
    - net: ena: fix incorrect update of intr_delay_resolution
    - net: ena: Select DIMLIB for ENA_ETHERNET
    - SAUCE: net: ena: fix issues in setting interrupt moderation params in
      ethtool
    - SAUCE: net: ena: fix too long default tx interrupt moderation interval

  * backport DIMLIB (lib/dim/) to pre-5.2 kernels (LP: #1852637)
    - include/linux/bitops.h: introduce BITS_PER_TYPE
    - linux/kernel.h: move DIV_ROUND_DOWN_ULL() macro
    - [Config] enable DIMLIB
    - linux/dim: import DIMLIB (lib/dim/)
    - SAUCE: linux/dim: avoid library object filename clash

  * Enable framebuffer fonts auto selection for HighDPI screen (LP: #1851623)
    - fonts: Fix coding style
    - fonts: Prefer a bigger font for high resolution screens

  * Xenial update: 4.4.203 upstream stable release (LP: #1853881)
    - slip: Fix memory leak in slip_open error path
    - ax88172a: fix information leak on short answers
    - ALSA: usb-audio: Fix missing error check at mixer resolution test
    - ALSA: usb-audio: not submit urb for stopped endpoint
    - Input: ff-memless - kill timer in destroy()
    - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
    - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
    - iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
    - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
    - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
    - mmc: sdhci-of-at91: fix quirk2 overwrite
    - iio: dac: mcp4922: fix error handling in mcp4922_write_raw
    - ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
    - ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
    - ALSA: seq: Do error checks at creating system ports
    - gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
    - ASoC: dpcm: Properly initialise hw->rate_max
    - MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
    - ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
    - i40e: use correct length for strncpy
    - i40e: hold the rtnl lock on clearing interrupt scheme
    - i40e: Prevent deleting MAC address from VF when set by PF
    - ARM: dts: pxa: fix power i2c base address
    - rtl8187: Fix warning generated when strncpy() destination length matches the
      sixe argument
    - net: lan78xx: Bail out if lan78xx_get_endpoints fails
    - ASoC: sgtl5000: avoid division by zero if lo_vag is zero
    - ath10k: wmi: disable softirq's while calling ieee80211_rx
    - mips: txx9: fix iounmap related issue
    - of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
    - ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in
      other DTS files
    - ARM: dts: omap3-gta04: tvout: enable as display1 alias
    - ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot
    - ARM: dts: omap3-gta04: keep vpll2 always on
    - dmaengine: dma-jz4780: Further residue status fix
    - signal: Always ignore SIGKILL and SIGSTOP sent to the global init
    - signal: Properly deliver SIGILL from uprobes
    - signal: Properly deliver SIGSEGV from x86 uprobes
    - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
    - ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set
    - scsi: pm80xx: Corrected dma_unmap_sg() parameter
    - scsi: pm80xx: Fixed system hang issue during kexec boot
    - kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
    - nvmem: core: return error code instead of NULL from nvmem_device_get
    - media: fix: media: pci: meye: validate offset to avoid arbitrary access
    - ALSA: intel8x0m: Register irq handler after register initializations
    - pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map()
    - llc: avoid blocking in llc_sap_close()
    - powerpc/vdso: Correct call frame information
    - ARM: dts: socfpga: Fix I2C bus unit-address error
    - pinctrl: at91: don't use the same irqchip with multiple gpiochips
    - cxgb4: Fix endianness issue in t4_fwcache()
    - power: supply: ab8500_fg: silence uninitialized variable warnings
    - power: supply: max8998-charger: Fix platform data retrieval
    - kernfs: Fix range checks in kernfs_get_target_path
    - s390/qeth: invoke softirqs after napi_schedule()
    - PCI/ACPI: Correct error message for ASPM disabling
    - serial: mxs-auart: Fix potential infinite loop
    - powerpc/iommu: Avoid derefence before pointer check
    - powerpc/64s/hash: Fix stab_rr off by one initialization
    - powerpc/pseries: Disable CPU hotplug across migrations
    - libfdt: Ensure INT_MAX is defined in libfdt_env.h
    - power: supply: twl4030_charger: fix charging current out-of-bounds
    - power: supply: twl4030_charger: disable eoc interrupt on linear charge
    - net: toshiba: fix return type of ndo_start_xmit function
    - net: xilinx: fix return type of ndo_start_xmit function
    - net: broadcom: fix return type of ndo_start_xmit function
    - net: amd: fix return type of ndo_start_xmit function
    - usb: chipidea: Fix otg event handler
    - ARM: dts: am335x-evm: fix number of cpsw
    - ARM: dts: ux500: Correct SCU unit address
    - ARM: dts: ux500: Fix LCDA clock line muxing
    - ARM: dts: ste: Fix SPI controller node names
    - cpufeature: avoid warning when compiling with clang
    - bnx2x: Ignore bandwidth attention in single function mode
    - net: micrel: fix return type of ndo_start_xmit function
    - x86/CPU: Use correct macros for Cyrix calls
    - MIPS: kexec: Relax memory restriction
    - media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init()
    - media: davinci: Fix implicit enum conversion warning
    - usb: gadget: uvc: configfs: Drop leaked references to config items
    - usb: gadget: uvc: configfs: Prevent format changes after linking header
    - usb: gadget: uvc: Factor out video USB request queueing
    - usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
    - misc: kgdbts: Fix restrict error
    - misc: genwqe: should return proper error value.
    - vfio/pci: Fix potential memory leak in vfio_msi_cap_len
    - scsi: libsas: always unregister the old device if going to discover new
    - ARM: dts: tegra30: fix xcvr-setup-use-fuses
    - ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
    - net: smsc: fix return type of ndo_start_xmit function
    - EDAC: Raise the maximum number of memory controllers
    - Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
    - arm64: dts: amd: Fix SPI bus warnings
    - fuse: use READ_ONCE on congestion_threshold and max_background
    - Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data
    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
      hci_uart_set_proto()
    - memfd: Use radix_tree_deref_slot_protected to avoid the warning.
    - slcan: Fix memory leak in error path
    - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
    - x86/atomic: Fix smp_mb__{before,after}_atomic()
    - kprobes/x86: Prohibit probing on exception masking instructions
    - uprobes/x86: Prohibit probing on MOV SS instruction
    - [Config] Remove unused SH-Mobile HDMI driver
    - fbdev: Remove unused SH-Mobile HDMI driver
    - fbdev: Ditch fb_edid_add_monspecs
    - block: introduce blk_rq_is_passthrough
    - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
    - net: ovs: fix return type of ndo_start_xmit function
    - f2fs: return correct errno in f2fs_gc
    - SUNRPC: Fix priority queue fairness
    - ath10k: fix vdev-start timeout on error
    - ath9k: fix reporting calculated new FFT upper max
    - usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in
      fotg210_get_status()
    - nl80211: Fix a GET_KEY reply attribute
    - dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction
    - dmaengine: timb_dma: Use proper enum in td_prep_slave_sg
    - mei: samples: fix a signedness bug in amt_host_if_call()
    - cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update
    - cxgb4: Use proper enum in IEEE_FAUX_SYNC
    - powerpc/pseries: Fix DTL buffer registration
    - powerpc/pseries: Fix how we iterate over the DTL entries
    - mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer
    - ixgbe: Fix crash with VFs and flow director on interface flap
    - IB/mthca: Fix error return code in __mthca_init_one()
    - ata: ep93xx: Use proper enums for directions
    - ALSA: hda/sigmatel - Disable automute for Elo VuPoint
    - KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR
    - USB: serial: cypress_m8: fix interrupt-out transfer length
    - mtd: physmap_of: Release resources on error
    - brcmfmac: fix full timeout waiting for action frame on-channel tx
    - NFSv4.x: fix lock recovery during delegation recall
    - dmaengine: ioat: fix prototype of ioat_enumerate_channels
    - Input: st1232 - set INPUT_PROP_DIRECT property
    - x86/olpc: Fix build error with CONFIG_MFD_CS5535=m
    - crypto: mxs-dcp - Fix SHA null hashes and output length
    - crypto: mxs-dcp - Fix AES issues
    - ACPI / SBS: Fix rare oops when removing modules
    - fbdev: sbuslib: use checked version of put_user()
    - fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
    - bcache: recal cached_dev_sectors on detach
    - proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted()
    - backlight: lm3639: Unconditionally call led_classdev_unregister
    - printk: Give error on attempt to set log buffer length to over 2G
    - media: isif: fix a NULL pointer dereference bug
    - GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads
    - media: cx231xx: fix potential sign-extension overflow on large shift
    - x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error
    - gpio: syscon: Fix possible NULL ptr usage
    - spi: spidev: Fix OF tree warning logic
    - ARM: 8802/1: Call syscall_trace_exit even when system call skipped
    - hwmon: (pwm-fan) Silence error on probe deferral
    - mac80211: minstrel: fix CCK rate group streams value
    - spi: rockchip: initialize dma_slave_config properly
    - arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
    - Linux 4.4.203

  * Xenial update: 4.4.202 upstream stable release (LP: #1853177)
    - kvm: mmu: Don't read PDPTEs when paging is not enabled
    - MIPS: BCM63XX: fix switch core reset on BCM6368
    - powerpc/Makefile: Use cflags-y/aflags-y for setting endian options
    - powerpc: Fix compiling a BE kernel with a powerpc64le toolchain
    - powerpc/boot: Request no dynamic linker for boot wrapper
    - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
    - Linux 4.4.202

  * Xenial update: 4.4.201 upstream stable release (LP: #1852335)
    - CDC-NCM: handle incomplete transfer of MTU
    - net: fix data-race in neigh_event_send()
    - NFC: fdp: fix incorrect free object
    - NFC: st21nfca: fix double free
    - qede: fix NULL pointer deref in __qede_remove()
    - nfc: netlink: fix double device reference drop
    - ALSA: bebob: fix to detect configured source of sampling clock for Focusrite
      Saffire Pro i/o series
    - ALSA: hda/ca0132 - Fix possible workqueue stall
    - mm, vmstat: hide /proc/pagetypeinfo from normal users
    - dump_stack: avoid the livelock of the dump_lock
    - perf tools: Fix time sorting
    - drm/radeon: fix si_enable_smc_cac() failed issue
    - ceph: fix use-after-free in __ceph_remove_cap()
    - iio: imu: adis16480: make sure provided frequency is positive
    - netfilter: nf_tables: Align nft_expr private data to 64-bit
    - netfilter: ipset: Fix an error code in ip_set_sockfn_get()
    - can: usb_8dev: fix use-after-free on disconnect
    - can: c_can: c_can_poll(): only read status register after status IRQ
    - can: peak_usb: fix a potential out-of-sync while decoding packets
    - can: gs_usb: gs_can_open(): prevent memory leak
    - can: peak_usb: fix slab info leak
    - drivers: usb: usbip: Add missing break statement to switch
    - configfs: fix a deadlock in configfs_symlink()
    - PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30
    - scsi: qla2xxx: fixup incorrect usage of host_byte
    - scsi: lpfc: Honor module parameter lpfc_use_adisc
    - ipvs: move old_secure_tcp into struct netns_ipvs
    - bonding: fix unexpected IFF_BONDING bit unset
    - usb: fsl: Check memory resource before releasing it
    - usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
    - usb: gadget: composite: Fix possible double free memory bug
    - usb: gadget: configfs: fix concurrent issue between composite APIs
    - perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise
      RIP validity
    - USB: Skip endpoints with 0 maxpacket length
    - scsi: qla2xxx: stop timer in shutdown path
    - net: hisilicon: Fix "Trying to free already-free IRQ"
    - NFSv4: Don't allow a cached open with a revoked delegation
    - igb: Fix constant media auto sense switching when no cable is connected
    - e1000: fix memory leaks
    - can: flexcan: disable completely the ECC mechanism
    - mm/filemap.c: don't initiate writeback if mapping has no dirty pages
    - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is
      dead
    - net: prevent load/store tearing on sk->sk_stamp
    - Linux 4.4.201

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 03 Dec 2019 11:20:54 +0100

linux (4.4.0-170.199) xenial; urgency=medium

  * xenial/linux: 4.4.0-170.199 -proposed tracker (LP: #1852306)

  * update ENA driver to version 2.1.0 (LP: #1850175)
    - net: ena: fix: set freed objects to NULL to avoid failing future allocations
    - net: ena: fix swapped parameters when calling
      ena_com_indirect_table_fill_entry
    - net: ena: fix: Free napi resources when ena_up() fails
    - net: ena: fix incorrect test of supported hash function
    - net: ena: fix return value of ena_com_config_llq_info()
    - net: ena: improve latency by disabling adaptive interrupt moderation by
      default
    - net: ena: fix ena_com_fill_hash_function() implementation
    - net: ena: add handling of llq max tx burst size
    - net: ena: ethtool: add extra properties retrieval via get_priv_flags
    - net: ena: replace free_tx/rx_ids union with single free_ids field in
      ena_ring
    - net: ena: arrange ena_probe() function variables in reverse christmas tree
    - net: ena: add newline at the end of pr_err prints
    - net: ena: allow automatic fallback to polling mode
    - net: ena: add support for changing max_header_size in LLQ mode
    - net: ena: optimise calculations for CQ doorbell
    - net: ena: add good checksum counter
    - net: ena: use dev_info_once instead of static variable
    - net: ena: add MAX_QUEUES_EXT get feature admin command
    - net: ena: enable negotiating larger Rx ring size
    - net: ena: make ethtool show correct current and max queue sizes
    - net: ena: allow queue allocation backoff when low on memory
    - net: ena: add ethtool function for changing io queue sizes
    - net: ena: remove inline keyword from functions in *.c
    - net: ena: update driver version from 2.0.3 to 2.1.0
    - net: ena: Fix bug where ring allocation backoff stopped too late
    - Revert "net: ena: ethtool: add extra properties retrieval via
      get_priv_flags"
    - net: ena: don't wake up tx queue when down
    - net: ena: clean up indentation issue

  * Bionic update: upstream stable patchset 2019-08-01 (LP: #1838700) // update
    ENA driver to version 2.1.0 (LP: #1850175)
    - net: ena: gcc 8: fix compilation warning

  * Skip frame when buffer overflow on UVC camera (LP: #1849871)
    - media: uvcvideo: Mark buffer error where overflow

  * CVE-2018-20784
    - sched/fair: Fix infinite loop in update_blocked_averages() by reverting
      a9e7f6544b9c
    - sched/fair: Fix hierarchical order in rq->leaf_cfs_rq_list
    - sched/fair: Add tmp_alone_branch assertion
    - sched/fair: Fix insertion in rq->leaf_cfs_rq_list
    - sched/fair: Optimize update_blocked_averages()
    - sched/fair: Fix O(nr_cgroups) in the load balancing path

  * Xenial update: 4.4.200 upstream stable release (LP: #1852110)
    - kbuild: add -fcf-protection=none when using retpoline flags
    - regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone
    - regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe()
      could be uninitialized
    - ASoc: rockchip: i2s: Fix RPM imbalance
    - ARM: dts: logicpd-torpedo-som: Remove twl_keypad
    - ARM: mm: fix alignment handler faults under memory pressure
    - scsi: sni_53c710: fix compilation error
    - scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
    - perf kmem: Fix memory leak in compact_gfp_flags()
    - scsi: target: core: Do not overwrite CDB byte 1
    - of: unittest: fix memory leak in unittest_data_add
    - MIPS: bmips: mark exception vectors as char arrays
    - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
    - dccp: do not leak jiffies on the wire
    - net: fix sk_page_frag() recursion from memory reclaim
    - net: hisilicon: Fix ping latency when deal with high throughput
    - SAUCE: Revert "net: Zeroing the structure ethtool_wolinfo in
      ethtool_get_wol()"
    - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
    - net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
    - vxlan: check tun_info options_len properly
    - net/mlx4_core: Dynamically set guaranteed amount of counters per VF
    - inet: stop leaking jiffies on the wire
    - net/flow_dissector: switch to siphash
    - dmaengine: qcom: bam_dma: Fix resource leak
    - ARM: 8051/1: put_user: fix possible data corruption in put_user
    - ARM: 8478/2: arm/arm64: add arm-smccc
    - ARM: 8479/2: add implementation for arm-smccc
    - ARM: 8480/2: arm64: add implementation for arm-smccc
    - ARM: 8481/2: drivers: psci: replace psci firmware calls
    - ARM: uaccess: remove put_user() code duplication
    - ARM: Move system register accessors to asm/cp15.h
    - arm/arm64: KVM: Advertise SMCCC v1.1
    - arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
    - firmware/psci: Expose PSCI conduit
    - firmware/psci: Expose SMCCC version through psci_ops
    - arm/arm64: smccc: Make function identifiers an unsigned quantity
    - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
    - arm/arm64: smccc: Add SMCCC-specific return codes
    - arm/arm64: smccc-1.1: Make return values unsigned long
    - arm/arm64: smccc-1.1: Handle function result as parameters
    - ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs
    - ARM: bugs: prepare processor bug infrastructure
    - ARM: bugs: hook processor bug checking into SMP and suspend paths
    - ARM: bugs: add support for per-processor bug checking
    - ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre
    - ARM: spectre-v2: harden branch predictor on context switches
    - ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit
    - ARM: spectre-v2: harden user aborts in kernel space
    - ARM: spectre-v2: add firmware based hardening
    - ARM: spectre-v2: warn about incorrect context switching functions
    - ARM: spectre-v1: add speculation barrier (csdb) macros
    - ARM: spectre-v1: add array_index_mask_nospec() implementation
    - ARM: spectre-v1: fix syscall entry
    - ARM: signal: copy registers using __copy_from_user()
    - ARM: vfp: use __copy_from_user() when restoring VFP state
    - ARM: oabi-compat: copy semops using __copy_from_user()
    - ARM: use __inttype() in get_user()
    - ARM: spectre-v1: use get_user() for __get_user()
    - ARM: spectre-v1: mitigate user accesses
    - ARM: 8789/1: signal: copy registers using __copy_to_user()
    - ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
    - ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
    - ARM: 8793/1: signal: replace __put_user_error with __put_user
    - ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
    - ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
    - ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
    - ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
    - ARM: make lookup_processor_type() non-__init
    - ARM: split out processor lookup
    - ARM: clean up per-processor check_bugs method call
    - ARM: add PROC_VTABLE and PROC_TABLE macros
    - ARM: spectre-v2: per-CPU vtables to work around big.Little systems
    - ARM: ensure that processor vtables is not lost after boot
    - ARM: fix the cockup in the previous patch
    - alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP
    - fs/dcache: move security_d_instantiate() behind attaching dentry to inode
    - Linux 4.4.200
    - updateconfigs for Linux v4.4.200

  * Xenial update: 4.4.199 upstream stable release (LP: #1851549)
    - dm snapshot: use mutex instead of rw_semaphore
    - dm snapshot: introduce account_start_copy() and account_end_copy()
    - dm snapshot: rework COW throttling to fix deadlock
    - dm: Use kzalloc for all structs with embedded biosets/mempools
    - sc16is7xx: Fix for "Unexpected interrupt: 8"
    - x86/cpu: Add Atom Tremont (Jacobsville)
    - scripts/setlocalversion: Improve -dirty check with git-status --no-optional-
      locks
    - usb: handle warm-reset port requests on hub resume
    - exec: load_script: Do not exec truncated interpreter path
    - iio: fix center temperature of bmc150-accel-core
    - perf map: Fix overlapped map handling
    - RDMA/iwcm: Fix a lock inversion issue
    - fs: cifs: mute -Wunused-const-variable message
    - serial: mctrl_gpio: Check for NULL pointer
    - efi/cper: Fix endianness of PCIe class code
    - efi/x86: Do not clean dummy variable in kexec path
    - fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_info_scan_inode_alloc()
    - MIPS: fw: sni: Fix out of bounds init of o32 stack
    - NFSv4: Fix leak of clp->cl_acceptor string
    - tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
    - USB: legousbtower: fix a signedness bug in tower_probe()
    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
    - fuse: flush dirty data/metadata before non-truncate setattr
    - fuse: truncate pending writes on O_TRUNC
    - ALSA: bebob: Fix prototype of helper function to return negative value
    - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather
      segments")
    - USB: gadget: Reject endpoints with 0 maxpacket value
    - USB: ldusb: fix ring-buffer locking
    - USB: ldusb: fix control-message timeout
    - USB: serial: whiteheat: fix potential slab corruption
    - USB: serial: whiteheat: fix line-speed endianness
    - HID: Fix assumption that devices have inputs
    - HID: fix error message in hid_open_report()
    - nl80211: fix validation of mesh path nexthop
    - s390/cmm: fix information leak in cmm_timeout_handler()
    - llc: fix sk_buff leak in llc_sap_state_process()
    - llc: fix sk_buff leak in llc_conn_service()
    - bonding: fix potential NULL deref in bond_update_slave_arr
    - net: usb: sr9800: fix uninitialized local variable
    - sch_netem: fix rcu splat in netem_enqueue()
    - sctp: fix the issue that flags are ignored when using kernel_connect
    - sctp: not bind the socket in sctp_connect
    - xfs: Correctly invert xfs_buftarg LRU isolation logic
    - Revert "ALSA: hda: Flush interrupts on disabling"
    - Linux 4.4.199

  * libmbim-proxy using 100% CPU on a Dell Edge Gateway 3002 (LP: #1851347)
    - USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse

  * Xenial update: v4.4.198 upstream stable release (LP: #1850454)
    - scsi: ufs: skip shutdown if hba is not powered
    - scsi: megaraid: disable device when probe failed after enabled device
    - scsi: qla2xxx: Fix unbound sleep in fcport delete path.
    - ARM: OMAP2+: Fix missing reset done flag for am3 and am43
    - ARM: dts: am4372: Set memory bandwidth limit for DISPC
    - nl80211: fix null pointer dereference
    - mips: Loongson: Fix the link time qualifier of 'serial_exit()'
    - net: hisilicon: Fix usage of uninitialized variable in function
      mdio_sc_cfg_reg_write()
    - namespace: fix namespace.pl script to support relative paths
    - loop: Add LOOP_SET_DIRECT_IO to compat ioctl
    - net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3
    - net: bcmgenet: Set phydev->dev_flags only for internal PHYs
    - sctp: change sctp_prot .no_autobind with true
    - net: avoid potential infinite loop in tc_ctl_action()
    - ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
    - memfd: Fix locking when tagging pins
    - USB: legousbtower: fix memleak on disconnect
    - usb: udc: lpc32xx: fix bad bit shift operation
    - USB: serial: ti_usb_3410_5052: fix port-close races
    - USB: ldusb: fix memleak on disconnect
    - USB: usblp: fix use-after-free on disconnect
    - USB: ldusb: fix read info leaks
    - scsi: core: try to get module before removing device
    - ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting
    - cfg80211: wext: avoid copying malformed SSIDs
    - mac80211: Reject malformed SSID elements
    - scsi: zfcp: fix reaction on bit error threshold notification
    - mm/slub: fix a deadlock in show_slab_objects()
    - xtensa: drop EXPORT_SYMBOL for outs*/ins*
    - parisc: Fix vmap memory leak in ioremap()/iounmap()
    - CIFS: avoid using MID 0xFFFF
    - btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group()
    - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
    - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
    - xen/netback: fix error path of xenvif_connect_data()
    - PCI: PM: Fix pci_power_up()
    - net: sched: Fix memory exposure from short TCA_U32_SEL
    - RDMA/cxgb4: Do not dma memory off of the stack
    - Linux 4.4.198

  * Colour banding in Lenovo G50-80 laptop display (i915) (LP: #1819968) //
    Xenial update: v4.4.198 upstream stable release (LP: #1850454)
    - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50

 -- Connor Kuehl <connor.kuehl@canonical.com>  Wed, 13 Nov 2019 11:18:48 -0800

linux (4.4.0-169.198) xenial; urgency=medium

  * Incomplete i915 fix for 64-bit x86 kernels (LP: #1852141) // CVE-2019-0155
    - SAUCE: drm/i915/cmdparser: Fix jump whitelist clearing

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 12 Nov 2019 11:19:22 +0100

# For older changelog entries, run 'apt-get changelog linux-buildinfo-4.4.0-178-powerpc64-smp'
