linux (4.4.0-173.203) xenial; urgency=medium

  * xenial/linux: 4.4.0-173.203 -proposed tracker (LP: #1859718)

  * CVE-2019-14615
    - drm/i915/gen9: Clear residual context state on context switch

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 14 Jan 2020 22:02:26 -0300

linux (4.4.0-172.202) xenial; urgency=medium

  * xenial/linux: 4.4.0-172.202 -proposed tracker (LP: #1858594)

  * tools/perf fails to build after Xenial update to 4.4.208 upstream stable
    release (LP: #1858798)
    - Revert "perf report: Add warning when libunwind not compiled in"

  * CVE-2019-18885
    - btrfs: refactor btrfs_find_device() take fs_devices as argument
    - btrfs: merge btrfs_find_device and find_device

  *  Integrate Intel SGX driver into linux-azure (LP: #1844245)
    - [Packaging] Add systemd service to load intel_sgx

  * Xenial update: 4.4.208 upstream stable release (LP: #1858462)
    - btrfs: do not leak reloc root if we fail to read the fs root
    - btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    - ALSA: hda/ca0132 - Keep power on during processing DSP response
    - ALSA: hda/ca0132 - Avoid endless loop
    - drm: mst: Fix query_payload ack reply struct
    - iio: light: bh1750: Resolve compiler warning and make code more readable
    - spi: Add call to spi_slave_abort() function when spidev driver is released
    - staging: rtl8188eu: fix possible null dereference
    - rtlwifi: prevent memory leak in rtl_usb_probe
    - IB/iser: bound protection_sg size by data_sg size
    - media: am437x-vpfe: Setting STD to current value is not an error
    - media: i2c: ov2659: fix s_stream return value
    - media: i2c: ov2659: Fix missing 720p register config
    - media: ov6650: Fix stored frame format not in sync with hardware
    - tools/power/cpupower: Fix initializer override in hsw_ext_cstates
    - usb: renesas_usbhs: add suspend event support in gadget mode
    - hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
    - regulator: max8907: Fix the usage of uninitialized variable in
      max8907_regulator_probe()
    - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    - samples: pktgen: fix proc_cmd command result check logic
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
    - media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
    - media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence
      number
    - media: ti-vpe: vpe: Make sure YUYV is set as default format
    - extcon: sm5502: Reset registers during initialization
    - x86/mm: Use the correct function type for native_set_fixmap()
    - perf report: Add warning when libunwind not compiled in
    - iio: adc: max1027: Reset the device at probe time
    - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
    - drm/gma500: fix memory disclosures due to uninitialized bytes
    - x86/ioapic: Prevent inconsistent state when moving an interrupt
    - arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
    - libata: Ensure ata_port probe has completed before detach
    - pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
    - bnx2x: Fix PF-VF communication over multi-cos queues.
    - spi: img-spfi: fix potential double release
    - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    - perf probe: Fix to find range-only function instance
    - perf probe: Fix to list probe event with correct line number
    - perf probe: Walk function lines in lexical blocks
    - perf probe: Fix to probe an inline function which has no entry pc
    - perf probe: Fix to show ranges of variables in functions without entry_pc
    - perf probe: Fix to show inlined function callsite without entry_pc
    - perf probe: Skip overlapped location on searching variables
    - perf probe: Return a better scope DIE if there is no best scope
    - perf probe: Fix to show calling lines of inlined functions
    - perf probe: Skip end-of-sequence and non statement lines
    - perf probe: Filter out instances except for inlined subroutine and
      subprogram
    - ath10k: fix get invalid tx rate for Mesh metric
    - media: pvrusb2: Fix oops on tear-down when radio support is not present
    - media: si470x-i2c: add missed operations in remove
    - EDAC/ghes: Fix grain calculation
    - spi: pxa2xx: Add missed security checks
    - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    - parport: load lowlevel driver if ports not found
    - cpufreq: Register drivers only after CPU devices have been registered
    - x86/crash: Add a forward declaration of struct kimage
    - spi: tegra20-slink: add missed clk_unprepare
    - btrfs: don't prematurely free work in end_workqueue_fn()
    - iwlwifi: check kasprintf() return value
    - fbtft: Make sure string is NULL terminated
    - crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    - crypto: vmx - Avoid weird build failures
    - libtraceevent: Fix memory leakage in copy_filter_type
    - net: phy: initialise phydev speed and duplex sanely
    - Revert "mmc: sdhci: Fix incorrect switch to HS mode"
    - usb: xhci: Fix build warning seen with CONFIG_PM=n
    - btrfs: do not call synchronize_srcu() in inode_tree_del
    - btrfs: return error pointer from alloc_test_extent_buffer
    - btrfs: abort transaction after failed inode updates in create_subvol
    - Btrfs: fix removal logic of the tree mod log that leads to use-after-free
      issues
    - ALSA: pcm: Avoid possible info leaks from PCM stream buffers
    - af_packet: set defaule value for tmo
    - fjes: fix missed check in fjes_acpi_add
    - mod_devicetable: fix PHY module format
    - net: hisilicon: Fix a BUG trigered by wrong bytes_compl
    - net: nfc: nci: fix a possible sleep-in-atomic-context bug in
      nci_uart_tty_receive()
    - net: qlogic: Fix error paths in ql_alloc_large_buffers()
    - net: usb: lan78xx: Fix suspend/resume PHY register access error
    - sctp: fully initialize v4 addr in some functions
    - net: dst: Force 4-byte alignment of dst_metrics
    - usbip: Fix error path of vhci_recv_ret_submit()
    - USB: EHCI: Do not return -EPIPE when hub is disconnected
    - platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
    - staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    - ext4: check for directory entries too close to block end
    - powerpc/irq: fix stack overflow verification
    - mmc: sdhci-of-esdhc: fix P2020 errata handling
    - perf probe: Fix to show function entry line as probe-able
    - scsi: mpt3sas: Fix clear pending bit in ioctl status
    - scsi: lpfc: Fix locking on mailbox command completion
    - Input: atmel_mxt_ts - disable IRQ across suspend
    - iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    - scsi: target: compare full CHAP_A Algorithm strings
    - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    - scsi: csiostor: Don't enable IRQs too early
    - powerpc/pseries: Mark accumulate_stolen_time() as notrace
    - dma-debug: add a schedule point in debug_dma_dump_mappings()
    - clocksource/drivers/asm9260: Add a check for of_clk_get
    - powerpc/security/book3s64: Report L1TF status in sysfs
    - jbd2: Fix statistics for the number of logged blocks
    - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
    - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
    - clk: qcom: Allow constant ratio freq tables for rcg
    - irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
    - irqchip: ingenic: Error out if IRQ domain creation failed
    - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
    - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
    - scsi: ufs: fix potential bug which ends in system hang
    - powerpc/pseries/cmm: Implement release() function for sysfs device
    - powerpc/security: Fix wrong message when RFI Flush is disable
    - clk: pxa: fix one of the pxa RTC clocks
    - bcache: at least try to shrink 1 node in bch_mca_scan()
    - HID: Improve Windows Precision Touchpad detection.
    - ext4: work around deleting a file with i_nlink == 0 safely
    - scsi: pm80xx: Fix for SATA device discovery
    - scsi: target: iscsi: Wait for all commands to finish before freeing a
      session
    - gpio: mpc8xxx: Don't overwrite default irq_set_type callback
    - scripts/kallsyms: fix definitely-lost memory leak
    - cdrom: respect device capabilities during opening action
    - perf regs: Make perf_reg_name() return "unknown" instead of NULL
    - libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
    - s390/cpum_sf: Check for SDBT and SDB consistency
    - ocfs2: fix passing zero to 'PTR_ERR' warning
    - kernel: sysctl: make drop_caches write-only
    - ALSA: hda - Downgrade error message for single-cmd fallback
    - Make filldir[64]() verify the directory entry filename is valid
    - filldir[64]: remove WARN_ON_ONCE() for bad directory entries
    - net: davinci_cpdma: use dma_addr_t for DMA address
    - netfilter: ebtables: compat: reject all padding in matches/watchers
    - 6pack,mkiss: fix possible deadlock
    - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    - net: icmp: fix data-race in cmp_global_allow()
    - hrtimer: Annotate lockless access to timer->state
    - mmc: sdhci: Update the tuning failed messages to pr_debug level
    - tcp: do not send empty skb from tcp_write_xmit()
    - Linux 4.4.208

  * Xenial update: 4.4.207 upstream stable release (LP: #1858489)
    - x86/apic/32: Avoid bogus LDR warnings
    - usb: gadget: u_serial: add missing port entry locking
    - tty: serial: msm_serial: Fix flow control
    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
    - serial: serial_core: Perform NULL checks for break_ctl ops
    - serial: ifx6x60: add missed pm_runtime_disable
    - autofs: fix a leak in autofs_expire_indirect()
    - NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error
    - Input: cyttsp4_core - fix use after free bug
    - ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
    - rsxx: add missed destroy_workqueue calls in remove
    - net: ep93xx_eth: fix mismatch of request_mem_region in remove
    - serial: core: Allow processing sysrq at port unlock time
    - iwlwifi: mvm: Send non offchannel traffic via AP sta
    - ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
    - extcon: max8997: Fix lack of path setting in USB device mode
    - clk: rockchip: fix rk3188 sclk_smc gate data
    - clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
    - dlm: fix missing idr_destroy for recover_idr
    - MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
    - scsi: zfcp: drop default switch case which might paper over missing case
    - pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
    - Staging: iio: adt7316: Fix i2c data reading, set the data field
    - regulator: Fix return value of _set_load() stub
    - MIPS: OCTEON: octeon-platform: fix typing
    - math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
    - rtc: max8997: Fix the returned value in case of error in
      'max8997_rtc_read_alarm()'
    - rtc: dt-binding: abx80x: fix resistance scale
    - ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
    - dmaengine: coh901318: Fix a double-lock bug
    - dmaengine: coh901318: Remove unused variable
    - ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion()
    - dma-mapping: fix return type of dma_set_max_seg_size()
    - altera-stapl: check for a null key before strcasecmp'ing it
    - serial: imx: fix error handling in console_setup
    - i2c: imx: don't print error message on probe defer
    - dlm: NULL check before kmem_cache_destroy is not needed
    - nfsd: fix a warning in __cld_pipe_upcall()
    - ARM: OMAP1/2: fix SoC name printing
    - net/x25: fix called/calling length calculation in x25_parse_address_block
    - net/x25: fix null_x25_address handling
    - ARM: dts: mmp2: fix the gpio interrupt cell number
    - tcp: fix off-by-one bug on aborting window-probing socket
    - modpost: skip ELF local symbols during section mismatch check
    - kbuild: fix single target build for external module
    - ARM: dts: pxa: clean up USB controller nodes
    - dlm: fix invalid cluster name warning
    - powerpc/math-emu: Update macros from GCC
    - MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition
    - nfsd: Return EPERM, not EACCES, in some SETATTR cases
    - mlx4: Use snprintf instead of complicated strcpy
    - ARM: dts: sunxi: Fix PMU compatible strings
    - sched/fair: Scale bandwidth quota and period without losing quota/period
      ratio precision
    - fuse: verify nlink
    - fuse: verify attributes
    - ALSA: pcm: oss: Avoid potential buffer overflows
    - Input: goodix - add upside-down quirk for Teclast X89 tablet
    - CIFS: Fix SMB2 oplock break processing
    - tty: vt: keyboard: reject invalid keycodes
    - can: slcan: Fix use-after-free Read in slcan_open
    - jbd2: Fix possible overflow in jbd2_log_space_left()
    - drm/i810: Prevent underflow in ioctl
    - KVM: x86: do not modify masked bits of shared MSRs
    - KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES
    - crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr
    - spi: atmel: Fix CS high support
    - RDMA/qib: Validate ->show()/store() callbacks before calling them
    - thermal: Fix deadlock in thermal thermal_zone_device_check
    - Revert "KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID
      (CVE-2019-19332)"
    - KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)
    - appletalk: Fix potential NULL pointer dereference in unregister_snap_client
    - appletalk: Set error code if register_snap_client failed
    - ALSA: hda - Fix pending unsol events at shutdown
    - sched/core: Allow putting thread_info into task_struct
    - sched/core: Add try_get_task_stack() and put_task_stack()
    - sched/core, x86: Make struct thread_info arch specific again
    - fs/proc: Stop reporting eip and esp in /proc/PID/stat
    - fs/proc: Report eip/esp in /prod/PID/stat for coredumping
    - proc: fix coredump vs read /proc/*/stat race
    - fs/proc/array.c: allow reporting eip/esp for all coredumping threads
    - usb: gadget: configfs: Fix missing spin_lock_init()
    - usb: Allow USB device to be warm reset in suspended state
    - staging: rtl8188eu: fix interface sanity check
    - staging: rtl8712: fix interface sanity check
    - staging: gigaset: fix general protection fault on probe
    - staging: gigaset: fix illegal free on probe errors
    - staging: gigaset: add endpoint-type sanity check
    - xhci: Increase STS_HALT timeout in xhci_suspend()
    - iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting
    - USB: atm: ueagle-atm: add missing endpoint check
    - USB: idmouse: fix interface sanity checks
    - USB: serial: io_edgeport: fix epic endpoint lookup
    - USB: adutux: fix interface sanity check
    - usb: core: urb: fix URB structure initialization function
    - usb: mon: Fix a deadlock in usbmon between mmap and read
    - mtd: spear_smi: Fix Write Burst mode
    - virtio-balloon: fix managed page counts when migrating pages between zones
    - btrfs: check page->mapping when loading free space cache
    - btrfs: Remove btrfs_bio::flags member
    - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address
    - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer
    - rtlwifi: rtl8192de: Fix missing enable interrupt flag
    - lib: raid6: fix awk build warnings
    - workqueue: Fix spurious sanity check failures in destroy_workqueue()
    - workqueue: Fix pwq ref leak in rescuer_thread()
    - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
    - blk-mq: avoid sysfs buffer overflow with too many CPU cores
    - cgroup: pids: use atomic64_t for pids->limit
    - ar5523: check NULL before memcpy() in ar5523_cmd()
    - media: bdisp: fix memleak on release
    - media: radio: wl1273: fix interrupt masking on release
    - cpuidle: Do not unset the driver if it is there already
    - ACPI: OSL: only free map once in osl.c
    - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
    - ACPI: PM: Avoid attaching ACPI PM domain to certain devices
    - pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup
      controller init
    - pinctrl: samsung: Fix device node refcount leaks in init code
    - powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB
    - video/hdmi: Fix AVI bar unpack
    - quota: Check that quota is not dirty before release
    - quota: fix livelock in dquot_writeback_dquots
    - scsi: zfcp: trace channel log even for FCP command responses
    - usb: xhci: only set D3hot for pci device
    - xhci: Fix memory leak in xhci_add_in_port()
    - xhci: make sure interrupts are restored to correct state
    - iio: adis16480: Add debugfs_reg_access entry
    - Btrfs: fix negative subv_writers counter and data space leak after buffered
      write
    - scsi: lpfc: Cap NPIV vports to 256
    - e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait
    - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
    - ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity
    - pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup
      controller init
    - scsi: qla2xxx: Fix DMA unmap leak
    - scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()
    - scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value
    - powerpc: Fix vDSO clock_getres()
    - mm/shmem.c: cast the type of unmap_start to u64
    - blk-mq: make sure that line break can be printed
    - workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
    - sunrpc: fix crash when cache_head become valid before update
    - kernel/module.c: wakeup processes in module_wq on module unload
    - net: bridge: deny dev_set_mac_address() when unregistering
    - tcp: md5: fix potential overestimation of TCP option space
    - tipc: fix ordering of tipc module init and exit routine
    - inet: protect against too small mtu values.
    - tcp: fix rejected syncookies due to stale timestamps
    - tcp: tighten acceptance of ACKs not matching a child socket
    - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
    - net: ethernet: ti: cpsw: fix extra rx interrupt
    - PCI: Fix Intel ACS quirk UPDCR register address
    - PCI/MSI: Fix incorrect MSI-X masking on resume
    - xtensa: fix TLB sanity checker
    - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
    - ARM: dts: s3c64xx: Fix init order of clock providers
    - ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume()
    - vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    - dm btree: increase rebalance threshold in __rebalance2()
    - drm/radeon: fix r1xx/r2xx register checker for POT textures
    - xhci: fix USB3 device initiated resume race with roothub autosuspend
    - net: stmmac: use correct DMA buffer size in the RX descriptor
    - net: stmmac: don't stop NAPI processing when dropping a packet
    - Linux 4.4.207

  * efivarfs test in ubuntu_kernel_selftest failed on the second run
    (LP: #1809704)
    - selftests: efivarfs: return Kselftest Skip code for skipped tests
    - selftests/efivarfs: clean up test files from test_create*()

  * cifs: kernel NULL pointer dereference, address: 0000000000000038
    (LP: #1856949)
    - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks

  * CVE-2019-19332
    - KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)

  * CVE-2019-19062
    - crypto: user - fix memory leak in crypto_report

  * [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
    - [Packaging] bind hv_kvp_daemon startup to hv_kvp device

  * False positive test result in run_afpackettests from net in
    ubuntu_kernel_selftest  (LP: #1825778)
    - selftests/net: correct the return value for run_afpackettests

  * Xenial update: 4.4.206 upstream stable release (LP: #1855313)
    - ASoC: compress: fix unsigned integer overflow check
    - ASoC: kirkwood: fix external clock probe defer
    - clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
    - reset: fix reset_control_ops kerneldoc comment
    - can: peak_usb: report bus recovery as well
    - can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
    - scripts/gdb: fix debugging modules compiled with hot/cold partitioning
    - block: drbd: remove a stray unlock in __drbd_send_protocol()
    - scsi: lpfc: Fix dif and first burst use in write commands
    - ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
    - ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
    - parisc: Fix serio address output
    - parisc: Fix HP SDC hpa address output
    - arm64: smp: Handle errors reported by the firmware
    - PM / AVS: SmartReflex: NULL check before some freeing functions is not
      needed
    - ARM: ks8695: fix section mismatch warning
    - ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
    - crypto: user - support incremental algorithm dumps
    - mwifiex: fix potential NULL dereference and use after free
    - mwifiex: debugfs: correct histogram spacing, formatting
    - rtl818x: fix potential use after free
    - xfs: require both realtime inodes to mount
    - ubi: Put MTD device after it is not used
    - ubi: Do not drop UBI device reference before using
    - microblaze: adjust the help to the real behavior
    - microblaze: move "... is ready" messages to arch/microblaze/Makefile
    - gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
    - VSOCK: bind to random port for VMADDR_PORT_ANY
    - btrfs: only track ref_heads in delayed_ref_updates
    - xen/pciback: Check dev_data before using it
    - KVM: s390: unregister debug feature on failing arch init
    - pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
    - pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
    - HID: doc: fix wrong data structure reference for UHID_OUTPUT
    - gfs2: take jdata unstuff into account in do_grow
    - xfs: Align compat attrlist_by_handle with native implementation.
    - IB/qib: Fix an error code in qib_sdma_verbs_send()
    - powerpc/book3s/32: fix number of bats in p/v_block_mapped()
    - powerpc/xmon: fix dump_segments()
    - drivers/regulator: fix a missing check of return value
    - serial: max310x: Fix tx_empty() callback
    - openrisc: Fix broken paths to arch/or32
    - RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
    - scsi: qla2xxx: deadlock by configfs_depend_item
    - scsi: csiostor: fix incorrect dma device in case of vport
    - ath6kl: Only use match sets when firmware supports it
    - ath6kl: Fix off by one error in scan completion
    - powerpc/prom: fix early DEBUG messages
    - powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
    - powerpc/44x/bamboo: Fix PCI range
    - drbd: reject attach of unsuitable uuids even if connected
    - drbd: fix print_st_err()'s prototype to match the definition
    - regulator: tps65910: fix a missing check of return value
    - net/net_namespace: Check the return value of register_pernet_subsys()
    - um: Make GCOV depend on !KCOV
    - net: stmicro: fix a missing check of clk_prepare
    - atl1e: checking the status of atl1e_write_phy_reg
    - tipc: fix a missing check of genlmsg_put
    - ocfs2: clear journal dirty flag after shutdown journal
    - lib/genalloc.c: use vzalloc_node() to allocate the bitmap
    - lib/genalloc.c: include vmalloc.h
    - mtd: Check add_mtd_device() ret code
    - tipc: fix memory leak in tipc_nl_compat_publ_dump
    - net/core/neighbour: tell kmemleak about hash tables
    - net/core/neighbour: fix kmemleak minimal reference count for hash tables
    - sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
    - decnet: fix DN_IFREQ_SIZE
    - tipc: fix skb may be leaky in tipc_link_input
    - sfc: initialise found bitmap in efx_ef10_mtd_probe
    - net: fix possible overflow in __sk_mem_raise_allocated()
    - net: dev: Use unsigned integer as an argument to left-shift
    - scsi: libsas: Support SATA PHY connection rate unmatch fixing during
      discovery
    - ACPI / APEI: Switch estatus pool to use vmalloc memory
    - scsi: libsas: Check SMP PHY control function result
    - mtd: Remove a debug trace in mtdpart.c
    - staging: rtl8192e: fix potential use after free
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - mei: bus: prefix device names on bus with the bus name
    - media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
    - net: macb: fix error format in dev_err()
    - pwm: Clear chip_data in pwm_put()
    - macvlan: schedule bc_work even if error
    - openvswitch: fix flow command message size
    - slip: Fix use-after-free Read in slip_open
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - tipc: fix link name length check
    - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
    - HID: core: check whether Usage Page item is after Usage ID items
    - hwrng: stm32 - fix unbalanced pm_runtime_enable
    - platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - Linux 4.4.206
    - [Config] updateconfigs for 4.4.206

  * Xenial update: 4.4.205 upstream stable release (LP: #1854857)
    - Revert "sock: Reset dst when changing sk_mark via setsockopt"
    - Linux 4.4.205

  * Xenial update: 4.4.204 upstream stable release (LP: #1854855)
    - net/mlx4_en: fix mlx4 ethtool -N insertion
    - sfc: Only cancel the PPS workqueue if it exists
    - net/sched: act_pedit: fix WARN() in the traffic path
    - net: rtnetlink: prevent underflows in do_setvfinfo()
    - Revert "fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()"
    - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
    - asus-wmi: Create quirk for airplane_mode LED
    - asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF
    - asus-wmi: Add quirk_no_rfkill for the Asus N552VW
    - asus-wmi: Add quirk_no_rfkill for the Asus U303LB
    - asus-wmi: Add quirk_no_rfkill for the Asus Z550MA
    - platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A
    - platform/x86: asus-wmi: fix asus ux303ub brightness issue
    - platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB
    - asus-wmi: provide access to ALS control
    - platform/x86: asus-wmi: try to set als by default
    - platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
    - platform/x86: asus-wmi: add SERIO_I8042 dependency
    - mwifiex: Fix NL80211_TX_POWER_LIMITED
    - ALSA: isight: fix leak of reference to firewire unit in error path of .probe
      callback
    - printk: fix integer overflow in setup_log_buf()
    - gfs2: Fix marking bitmaps non-full
    - synclink_gt(): fix compat_ioctl()
    - powerpc: Fix signedness bug in update_flash_db()
    - powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
    - brcmsmac: AP mode: update beacon when TIM changes
    - spi: sh-msiof: fix deferred probing
    - mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail
    - btrfs: handle error of get_old_root
    - gsmi: Fix bug in append_to_eventlog sysfs handler
    - misc: mic: fix a DMA pool free failure
    - amiflop: clean up on errors during setup
    - scsi: ips: fix missing break in switch
    - KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
    - scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
    - scsi: isci: Change sci_controller_start_task's return type to sci_status
    - scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
    - clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
    - scsi: dc395x: fix dma API usage in srb_done
    - scsi: dc395x: fix DMA API usage in sg_update_list
    - net: fix warning in af_unix
    - kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad
      stack
    - ALSA: i2c/cs8427: Fix int to char conversion
    - macintosh/windfarm_smu_sat: Fix debug output
    - USB: misc: appledisplay: fix backlight update_status return code
    - SUNRPC: Fix a compile warning for cmpxchg64()
    - atm: zatm: Fix empty body Clang warnings
    - s390/perf: Return error when debug_register fails
    - spi: omap2-mcspi: Set FIFO DMA trigger level to word length
    - sparc: Fix parport build warnings.
    - ceph: fix dentry leak in ceph_readdir_prepopulate
    - rtc: s35390a: Change buf's type to u8 in s35390a_init
    - mISDN: Fix type of switch control variable in ctrl_teimanager
    - qlcnic: fix a return in qlcnic_dcb_get_capability()
    - mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
    - mfd: max8997: Enale irq-wakeup unconditionally
    - selftests/ftrace: Fix to test kprobe $comm arg only if available
    - thermal: rcar_thermal: Prevent hardware access during system suspend
    - sparc64: Rework xchg() definition to avoid warnings.
    - fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in
      dlm_print_one_mle()
    - mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock
    - um: Make line/tty semantics use true write IRQ
    - linux/bitmap.h: handle constant zero-size bitmaps correctly
    - linux/bitmap.h: fix type of nbits in bitmap_shift_right()
    - hfsplus: fix BUG on bnode parent update
    - hfs: fix BUG on bnode parent update
    - hfsplus: prevent btree data loss on ENOSPC
    - hfs: prevent btree data loss on ENOSPC
    - hfsplus: fix return value of hfsplus_get_block()
    - hfs: fix return value of hfs_get_block()
    - fs/hfs/extent.c: fix array out of bounds read of array extent
    - igb: shorten maximum PHC timecounter update interval
    - ntb_netdev: fix sleep time mismatch
    - ntb: intel: fix return value for ndev_vec_mask()
    - ocfs2: don't put and assigning null to bh allocated outside
    - ocfs2: fix clusters leak in ocfs2_defrag_extent()
    - net: do not abort bulk send on BQL status
    - sched/fair: Don't increase sd->balance_interval on newidle balance
    - audit: print empty EXECVE args
    - wlcore: Fix the return value in case of error in
      'wlcore_vendor_cmd_smart_config_start()'
    - rtl8xxxu: Fix missing break in switch
    - brcmsmac: never log "tid x is not agg'able" by default
    - wireless: airo: potential buffer overflow in sprintf()
    - rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
    - scsi: mpt3sas: Fix Sync cache command failure during driver unload
    - scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11
    - scsi: megaraid_sas: Fix msleep granularity
    - scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
    - dlm: fix invalid free
    - dlm: don't leak kernel pointer to userspace
    - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
    - sock: Reset dst when changing sk_mark via setsockopt
    - pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
    - pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
    - PCI: keystone: Use quirk to limit MRRS for K2G
    - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
    - IB/hfi1: Ensure full Gen3 speed in a Gen4 system
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath9k_hw: fix uninitialized variable data
    - dm: use blk_set_queue_dying() in __dm_destroy()
    - arm64: fix for bad_mode() handler to always result in panic
    - cpufreq: Skip cpufreq resume if it's not suspended
    - ocfs2: remove ocfs2_is_o2cb_active()
    - mmc: block: Fix tag condition with packed writes
    - ARC: perf: Accommodate big-endian CPU
    - x86/insn: Fix awk regexp warnings
    - x86/speculation: Fix incorrect MDS/TAA mitigation status
    - x86/speculation: Fix redundant MDS mitigation message
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - media: b2c2-flexcop-usb: add sanity checking
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - virtio_console: reset on out of memory
    - virtio_console: don't tie bufs to a vq
    - virtio_console: allocate inbufs in add_port() only if it is needed
    - virtio_console: fix uninitialized variable use
    - virtio_console: drop custom control queue cleanup
    - virtio_console: move removal code
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - Linux 4.4.204

 -- Connor Kuehl <connor.kuehl@canonical.com>  Wed, 08 Jan 2020 09:26:38 -0800

linux (4.4.0-171.200) xenial; urgency=medium

  * xenial/linux: 4.4.0-171.200 -proposed tracker (LP: #1854835)

  * CVE-2019-14901
    - SAUCE: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()

  * CVE-2019-14896 // CVE-2019-14897
    - SAUCE: libertas: Fix two buffer overflows at parsing bss descriptor

  * CVE-2019-14895
    - SAUCE: mwifiex: fix possible heap overflow in mwifiex_process_country_ie()

  * CVE-2019-18660: patches for Ubuntu (LP: #1853142) // CVE-2019-18660
    - powerpc/64s: support nospectre_v2 cmdline option
    - powerpc/book3s64: Fix link stack flush on context switch
    - KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel

  * cloudimg: no iavf/i40evf module so no network available with SR-IOV enabled
    cloud (LP: #1848481)
    - [Packaging]: include i40evf in generic

  * update ENA driver for DIMLIB dynamic interrupt moderation (LP: #1853180)
    - net: ena: fix bug that might cause hang after consecutive open/close
      interface.
    - net: ena: add intr_moder_rx_interval to struct ena_com_dev and use it
    - net: ena: switch to dim algorithm for rx adaptive interrupt moderation
    - net: ena: reimplement set/get_coalesce()
    - net: ena: enable the interrupt_moderation in driver_supported_features
    - net: ena: remove code duplication in
      ena_com_update_nonadaptive_moderation_interval _*()
    - net: ena: remove old adaptive interrupt moderation code from ena_netdev
    - net: ena: remove ena_restore_ethtool_params() and relevant fields
    - net: ena: remove all old adaptive rx interrupt moderation code from ena_com
    - net: ena: fix update of interrupt moderation register
    - net: ena: fix retrieval of nonadaptive interrupt moderation intervals
    - net: ena: fix incorrect update of intr_delay_resolution
    - net: ena: Select DIMLIB for ENA_ETHERNET
    - SAUCE: net: ena: fix issues in setting interrupt moderation params in
      ethtool
    - SAUCE: net: ena: fix too long default tx interrupt moderation interval

  * backport DIMLIB (lib/dim/) to pre-5.2 kernels (LP: #1852637)
    - include/linux/bitops.h: introduce BITS_PER_TYPE
    - linux/kernel.h: move DIV_ROUND_DOWN_ULL() macro
    - [Config] enable DIMLIB
    - linux/dim: import DIMLIB (lib/dim/)
    - SAUCE: linux/dim: avoid library object filename clash

  * Enable framebuffer fonts auto selection for HighDPI screen (LP: #1851623)
    - fonts: Fix coding style
    - fonts: Prefer a bigger font for high resolution screens

  * Xenial update: 4.4.203 upstream stable release (LP: #1853881)
    - slip: Fix memory leak in slip_open error path
    - ax88172a: fix information leak on short answers
    - ALSA: usb-audio: Fix missing error check at mixer resolution test
    - ALSA: usb-audio: not submit urb for stopped endpoint
    - Input: ff-memless - kill timer in destroy()
    - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
    - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
    - iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
    - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
    - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
    - mmc: sdhci-of-at91: fix quirk2 overwrite
    - iio: dac: mcp4922: fix error handling in mcp4922_write_raw
    - ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
    - ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
    - ALSA: seq: Do error checks at creating system ports
    - gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
    - ASoC: dpcm: Properly initialise hw->rate_max
    - MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
    - ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
    - i40e: use correct length for strncpy
    - i40e: hold the rtnl lock on clearing interrupt scheme
    - i40e: Prevent deleting MAC address from VF when set by PF
    - ARM: dts: pxa: fix power i2c base address
    - rtl8187: Fix warning generated when strncpy() destination length matches the
      sixe argument
    - net: lan78xx: Bail out if lan78xx_get_endpoints fails
    - ASoC: sgtl5000: avoid division by zero if lo_vag is zero
    - ath10k: wmi: disable softirq's while calling ieee80211_rx
    - mips: txx9: fix iounmap related issue
    - of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
    - ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in
      other DTS files
    - ARM: dts: omap3-gta04: tvout: enable as display1 alias
    - ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot
    - ARM: dts: omap3-gta04: keep vpll2 always on
    - dmaengine: dma-jz4780: Further residue status fix
    - signal: Always ignore SIGKILL and SIGSTOP sent to the global init
    - signal: Properly deliver SIGILL from uprobes
    - signal: Properly deliver SIGSEGV from x86 uprobes
    - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
    - ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set
    - scsi: pm80xx: Corrected dma_unmap_sg() parameter
    - scsi: pm80xx: Fixed system hang issue during kexec boot
    - kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
    - nvmem: core: return error code instead of NULL from nvmem_device_get
    - media: fix: media: pci: meye: validate offset to avoid arbitrary access
    - ALSA: intel8x0m: Register irq handler after register initializations
    - pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map()
    - llc: avoid blocking in llc_sap_close()
    - powerpc/vdso: Correct call frame information
    - ARM: dts: socfpga: Fix I2C bus unit-address error
    - pinctrl: at91: don't use the same irqchip with multiple gpiochips
    - cxgb4: Fix endianness issue in t4_fwcache()
    - power: supply: ab8500_fg: silence uninitialized variable warnings
    - power: supply: max8998-charger: Fix platform data retrieval
    - kernfs: Fix range checks in kernfs_get_target_path
    - s390/qeth: invoke softirqs after napi_schedule()
    - PCI/ACPI: Correct error message for ASPM disabling
    - serial: mxs-auart: Fix potential infinite loop
    - powerpc/iommu: Avoid derefence before pointer check
    - powerpc/64s/hash: Fix stab_rr off by one initialization
    - powerpc/pseries: Disable CPU hotplug across migrations
    - libfdt: Ensure INT_MAX is defined in libfdt_env.h
    - power: supply: twl4030_charger: fix charging current out-of-bounds
    - power: supply: twl4030_charger: disable eoc interrupt on linear charge
    - net: toshiba: fix return type of ndo_start_xmit function
    - net: xilinx: fix return type of ndo_start_xmit function
    - net: broadcom: fix return type of ndo_start_xmit function
    - net: amd: fix return type of ndo_start_xmit function
    - usb: chipidea: Fix otg event handler
    - ARM: dts: am335x-evm: fix number of cpsw
    - ARM: dts: ux500: Correct SCU unit address
    - ARM: dts: ux500: Fix LCDA clock line muxing
    - ARM: dts: ste: Fix SPI controller node names
    - cpufeature: avoid warning when compiling with clang
    - bnx2x: Ignore bandwidth attention in single function mode
    - net: micrel: fix return type of ndo_start_xmit function
    - x86/CPU: Use correct macros for Cyrix calls
    - MIPS: kexec: Relax memory restriction
    - media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init()
    - media: davinci: Fix implicit enum conversion warning
    - usb: gadget: uvc: configfs: Drop leaked references to config items
    - usb: gadget: uvc: configfs: Prevent format changes after linking header
    - usb: gadget: uvc: Factor out video USB request queueing
    - usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
    - misc: kgdbts: Fix restrict error
    - misc: genwqe: should return proper error value.
    - vfio/pci: Fix potential memory leak in vfio_msi_cap_len
    - scsi: libsas: always unregister the old device if going to discover new
    - ARM: dts: tegra30: fix xcvr-setup-use-fuses
    - ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
    - net: smsc: fix return type of ndo_start_xmit function
    - EDAC: Raise the maximum number of memory controllers
    - Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
    - arm64: dts: amd: Fix SPI bus warnings
    - fuse: use READ_ONCE on congestion_threshold and max_background
    - Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data
    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
      hci_uart_set_proto()
    - memfd: Use radix_tree_deref_slot_protected to avoid the warning.
    - slcan: Fix memory leak in error path
    - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
    - x86/atomic: Fix smp_mb__{before,after}_atomic()
    - kprobes/x86: Prohibit probing on exception masking instructions
    - uprobes/x86: Prohibit probing on MOV SS instruction
    - [Config] Remove unused SH-Mobile HDMI driver
    - fbdev: Remove unused SH-Mobile HDMI driver
    - fbdev: Ditch fb_edid_add_monspecs
    - block: introduce blk_rq_is_passthrough
    - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
    - net: ovs: fix return type of ndo_start_xmit function
    - f2fs: return correct errno in f2fs_gc
    - SUNRPC: Fix priority queue fairness
    - ath10k: fix vdev-start timeout on error
    - ath9k: fix reporting calculated new FFT upper max
    - usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in
      fotg210_get_status()
    - nl80211: Fix a GET_KEY reply attribute
    - dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction
    - dmaengine: timb_dma: Use proper enum in td_prep_slave_sg
    - mei: samples: fix a signedness bug in amt_host_if_call()
    - cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update
    - cxgb4: Use proper enum in IEEE_FAUX_SYNC
    - powerpc/pseries: Fix DTL buffer registration
    - powerpc/pseries: Fix how we iterate over the DTL entries
    - mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer
    - ixgbe: Fix crash with VFs and flow director on interface flap
    - IB/mthca: Fix error return code in __mthca_init_one()
    - ata: ep93xx: Use proper enums for directions
    - ALSA: hda/sigmatel - Disable automute for Elo VuPoint
    - KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR
    - USB: serial: cypress_m8: fix interrupt-out transfer length
    - mtd: physmap_of: Release resources on error
    - brcmfmac: fix full timeout waiting for action frame on-channel tx
    - NFSv4.x: fix lock recovery during delegation recall
    - dmaengine: ioat: fix prototype of ioat_enumerate_channels
    - Input: st1232 - set INPUT_PROP_DIRECT property
    - x86/olpc: Fix build error with CONFIG_MFD_CS5535=m
    - crypto: mxs-dcp - Fix SHA null hashes and output length
    - crypto: mxs-dcp - Fix AES issues
    - ACPI / SBS: Fix rare oops when removing modules
    - fbdev: sbuslib: use checked version of put_user()
    - fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
    - bcache: recal cached_dev_sectors on detach
    - proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted()
    - backlight: lm3639: Unconditionally call led_classdev_unregister
    - printk: Give error on attempt to set log buffer length to over 2G
    - media: isif: fix a NULL pointer dereference bug
    - GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads
    - media: cx231xx: fix potential sign-extension overflow on large shift
    - x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error
    - gpio: syscon: Fix possible NULL ptr usage
    - spi: spidev: Fix OF tree warning logic
    - ARM: 8802/1: Call syscall_trace_exit even when system call skipped
    - hwmon: (pwm-fan) Silence error on probe deferral
    - mac80211: minstrel: fix CCK rate group streams value
    - spi: rockchip: initialize dma_slave_config properly
    - arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
    - Linux 4.4.203

  * Xenial update: 4.4.202 upstream stable release (LP: #1853177)
    - kvm: mmu: Don't read PDPTEs when paging is not enabled
    - MIPS: BCM63XX: fix switch core reset on BCM6368
    - powerpc/Makefile: Use cflags-y/aflags-y for setting endian options
    - powerpc: Fix compiling a BE kernel with a powerpc64le toolchain
    - powerpc/boot: Request no dynamic linker for boot wrapper
    - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
    - Linux 4.4.202

  * Xenial update: 4.4.201 upstream stable release (LP: #1852335)
    - CDC-NCM: handle incomplete transfer of MTU
    - net: fix data-race in neigh_event_send()
    - NFC: fdp: fix incorrect free object
    - NFC: st21nfca: fix double free
    - qede: fix NULL pointer deref in __qede_remove()
    - nfc: netlink: fix double device reference drop
    - ALSA: bebob: fix to detect configured source of sampling clock for Focusrite
      Saffire Pro i/o series
    - ALSA: hda/ca0132 - Fix possible workqueue stall
    - mm, vmstat: hide /proc/pagetypeinfo from normal users
    - dump_stack: avoid the livelock of the dump_lock
    - perf tools: Fix time sorting
    - drm/radeon: fix si_enable_smc_cac() failed issue
    - ceph: fix use-after-free in __ceph_remove_cap()
    - iio: imu: adis16480: make sure provided frequency is positive
    - netfilter: nf_tables: Align nft_expr private data to 64-bit
    - netfilter: ipset: Fix an error code in ip_set_sockfn_get()
    - can: usb_8dev: fix use-after-free on disconnect
    - can: c_can: c_can_poll(): only read status register after status IRQ
    - can: peak_usb: fix a potential out-of-sync while decoding packets
    - can: gs_usb: gs_can_open(): prevent memory leak
    - can: peak_usb: fix slab info leak
    - drivers: usb: usbip: Add missing break statement to switch
    - configfs: fix a deadlock in configfs_symlink()
    - PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30
    - scsi: qla2xxx: fixup incorrect usage of host_byte
    - scsi: lpfc: Honor module parameter lpfc_use_adisc
    - ipvs: move old_secure_tcp into struct netns_ipvs
    - bonding: fix unexpected IFF_BONDING bit unset
    - usb: fsl: Check memory resource before releasing it
    - usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
    - usb: gadget: composite: Fix possible double free memory bug
    - usb: gadget: configfs: fix concurrent issue between composite APIs
    - perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise
      RIP validity
    - USB: Skip endpoints with 0 maxpacket length
    - scsi: qla2xxx: stop timer in shutdown path
    - net: hisilicon: Fix "Trying to free already-free IRQ"
    - NFSv4: Don't allow a cached open with a revoked delegation
    - igb: Fix constant media auto sense switching when no cable is connected
    - e1000: fix memory leaks
    - can: flexcan: disable completely the ECC mechanism
    - mm/filemap.c: don't initiate writeback if mapping has no dirty pages
    - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is
      dead
    - net: prevent load/store tearing on sk->sk_stamp
    - Linux 4.4.201

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 03 Dec 2019 11:20:54 +0100

linux (4.4.0-170.199) xenial; urgency=medium

  * xenial/linux: 4.4.0-170.199 -proposed tracker (LP: #1852306)

  * update ENA driver to version 2.1.0 (LP: #1850175)
    - net: ena: fix: set freed objects to NULL to avoid failing future allocations
    - net: ena: fix swapped parameters when calling
      ena_com_indirect_table_fill_entry
    - net: ena: fix: Free napi resources when ena_up() fails
    - net: ena: fix incorrect test of supported hash function
    - net: ena: fix return value of ena_com_config_llq_info()
    - net: ena: improve latency by disabling adaptive interrupt moderation by
      default
    - net: ena: fix ena_com_fill_hash_function() implementation
    - net: ena: add handling of llq max tx burst size
    - net: ena: ethtool: add extra properties retrieval via get_priv_flags
    - net: ena: replace free_tx/rx_ids union with single free_ids field in
      ena_ring
    - net: ena: arrange ena_probe() function variables in reverse christmas tree
    - net: ena: add newline at the end of pr_err prints
    - net: ena: allow automatic fallback to polling mode
    - net: ena: add support for changing max_header_size in LLQ mode
    - net: ena: optimise calculations for CQ doorbell
    - net: ena: add good checksum counter
    - net: ena: use dev_info_once instead of static variable
    - net: ena: add MAX_QUEUES_EXT get feature admin command
    - net: ena: enable negotiating larger Rx ring size
    - net: ena: make ethtool show correct current and max queue sizes
    - net: ena: allow queue allocation backoff when low on memory
    - net: ena: add ethtool function for changing io queue sizes
    - net: ena: remove inline keyword from functions in *.c
    - net: ena: update driver version from 2.0.3 to 2.1.0
    - net: ena: Fix bug where ring allocation backoff stopped too late
    - Revert "net: ena: ethtool: add extra properties retrieval via
      get_priv_flags"
    - net: ena: don't wake up tx queue when down
    - net: ena: clean up indentation issue

  * Bionic update: upstream stable patchset 2019-08-01 (LP: #1838700) // update
    ENA driver to version 2.1.0 (LP: #1850175)
    - net: ena: gcc 8: fix compilation warning

  * Skip frame when buffer overflow on UVC camera (LP: #1849871)
    - media: uvcvideo: Mark buffer error where overflow

  * CVE-2018-20784
    - sched/fair: Fix infinite loop in update_blocked_averages() by reverting
      a9e7f6544b9c
    - sched/fair: Fix hierarchical order in rq->leaf_cfs_rq_list
    - sched/fair: Add tmp_alone_branch assertion
    - sched/fair: Fix insertion in rq->leaf_cfs_rq_list
    - sched/fair: Optimize update_blocked_averages()
    - sched/fair: Fix O(nr_cgroups) in the load balancing path

  * Xenial update: 4.4.200 upstream stable release (LP: #1852110)
    - kbuild: add -fcf-protection=none when using retpoline flags
    - regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone
    - regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe()
      could be uninitialized
    - ASoc: rockchip: i2s: Fix RPM imbalance
    - ARM: dts: logicpd-torpedo-som: Remove twl_keypad
    - ARM: mm: fix alignment handler faults under memory pressure
    - scsi: sni_53c710: fix compilation error
    - scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
    - perf kmem: Fix memory leak in compact_gfp_flags()
    - scsi: target: core: Do not overwrite CDB byte 1
    - of: unittest: fix memory leak in unittest_data_add
    - MIPS: bmips: mark exception vectors as char arrays
    - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
    - dccp: do not leak jiffies on the wire
    - net: fix sk_page_frag() recursion from memory reclaim
    - net: hisilicon: Fix ping latency when deal with high throughput
    - SAUCE: Revert "net: Zeroing the structure ethtool_wolinfo in
      ethtool_get_wol()"
    - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
    - net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
    - vxlan: check tun_info options_len properly
    - net/mlx4_core: Dynamically set guaranteed amount of counters per VF
    - inet: stop leaking jiffies on the wire
    - net/flow_dissector: switch to siphash
    - dmaengine: qcom: bam_dma: Fix resource leak
    - ARM: 8051/1: put_user: fix possible data corruption in put_user
    - ARM: 8478/2: arm/arm64: add arm-smccc
    - ARM: 8479/2: add implementation for arm-smccc
    - ARM: 8480/2: arm64: add implementation for arm-smccc
    - ARM: 8481/2: drivers: psci: replace psci firmware calls
    - ARM: uaccess: remove put_user() code duplication
    - ARM: Move system register accessors to asm/cp15.h
    - arm/arm64: KVM: Advertise SMCCC v1.1
    - arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
    - firmware/psci: Expose PSCI conduit
    - firmware/psci: Expose SMCCC version through psci_ops
    - arm/arm64: smccc: Make function identifiers an unsigned quantity
    - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
    - arm/arm64: smccc: Add SMCCC-specific return codes
    - arm/arm64: smccc-1.1: Make return values unsigned long
    - arm/arm64: smccc-1.1: Handle function result as parameters
    - ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs
    - ARM: bugs: prepare processor bug infrastructure
    - ARM: bugs: hook processor bug checking into SMP and suspend paths
    - ARM: bugs: add support for per-processor bug checking
    - ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre
    - ARM: spectre-v2: harden branch predictor on context switches
    - ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit
    - ARM: spectre-v2: harden user aborts in kernel space
    - ARM: spectre-v2: add firmware based hardening
    - ARM: spectre-v2: warn about incorrect context switching functions
    - ARM: spectre-v1: add speculation barrier (csdb) macros
    - ARM: spectre-v1: add array_index_mask_nospec() implementation
    - ARM: spectre-v1: fix syscall entry
    - ARM: signal: copy registers using __copy_from_user()
    - ARM: vfp: use __copy_from_user() when restoring VFP state
    - ARM: oabi-compat: copy semops using __copy_from_user()
    - ARM: use __inttype() in get_user()
    - ARM: spectre-v1: use get_user() for __get_user()
    - ARM: spectre-v1: mitigate user accesses
    - ARM: 8789/1: signal: copy registers using __copy_to_user()
    - ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
    - ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
    - ARM: 8793/1: signal: replace __put_user_error with __put_user
    - ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
    - ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
    - ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
    - ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
    - ARM: make lookup_processor_type() non-__init
    - ARM: split out processor lookup
    - ARM: clean up per-processor check_bugs method call
    - ARM: add PROC_VTABLE and PROC_TABLE macros
    - ARM: spectre-v2: per-CPU vtables to work around big.Little systems
    - ARM: ensure that processor vtables is not lost after boot
    - ARM: fix the cockup in the previous patch
    - alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP
    - fs/dcache: move security_d_instantiate() behind attaching dentry to inode
    - Linux 4.4.200
    - updateconfigs for Linux v4.4.200

  * Xenial update: 4.4.199 upstream stable release (LP: #1851549)
    - dm snapshot: use mutex instead of rw_semaphore
    - dm snapshot: introduce account_start_copy() and account_end_copy()
    - dm snapshot: rework COW throttling to fix deadlock
    - dm: Use kzalloc for all structs with embedded biosets/mempools
    - sc16is7xx: Fix for "Unexpected interrupt: 8"
    - x86/cpu: Add Atom Tremont (Jacobsville)
    - scripts/setlocalversion: Improve -dirty check with git-status --no-optional-
      locks
    - usb: handle warm-reset port requests on hub resume
    - exec: load_script: Do not exec truncated interpreter path
    - iio: fix center temperature of bmc150-accel-core
    - perf map: Fix overlapped map handling
    - RDMA/iwcm: Fix a lock inversion issue
    - fs: cifs: mute -Wunused-const-variable message
    - serial: mctrl_gpio: Check for NULL pointer
    - efi/cper: Fix endianness of PCIe class code
    - efi/x86: Do not clean dummy variable in kexec path
    - fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_info_scan_inode_alloc()
    - MIPS: fw: sni: Fix out of bounds init of o32 stack
    - NFSv4: Fix leak of clp->cl_acceptor string
    - tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
    - USB: legousbtower: fix a signedness bug in tower_probe()
    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
    - fuse: flush dirty data/metadata before non-truncate setattr
    - fuse: truncate pending writes on O_TRUNC
    - ALSA: bebob: Fix prototype of helper function to return negative value
    - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather
      segments")
    - USB: gadget: Reject endpoints with 0 maxpacket value
    - USB: ldusb: fix ring-buffer locking
    - USB: ldusb: fix control-message timeout
    - USB: serial: whiteheat: fix potential slab corruption
    - USB: serial: whiteheat: fix line-speed endianness
    - HID: Fix assumption that devices have inputs
    - HID: fix error message in hid_open_report()
    - nl80211: fix validation of mesh path nexthop
    - s390/cmm: fix information leak in cmm_timeout_handler()
    - llc: fix sk_buff leak in llc_sap_state_process()
    - llc: fix sk_buff leak in llc_conn_service()
    - bonding: fix potential NULL deref in bond_update_slave_arr
    - net: usb: sr9800: fix uninitialized local variable
    - sch_netem: fix rcu splat in netem_enqueue()
    - sctp: fix the issue that flags are ignored when using kernel_connect
    - sctp: not bind the socket in sctp_connect
    - xfs: Correctly invert xfs_buftarg LRU isolation logic
    - Revert "ALSA: hda: Flush interrupts on disabling"
    - Linux 4.4.199

  * libmbim-proxy using 100% CPU on a Dell Edge Gateway 3002 (LP: #1851347)
    - USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse

  * Xenial update: v4.4.198 upstream stable release (LP: #1850454)
    - scsi: ufs: skip shutdown if hba is not powered
    - scsi: megaraid: disable device when probe failed after enabled device
    - scsi: qla2xxx: Fix unbound sleep in fcport delete path.
    - ARM: OMAP2+: Fix missing reset done flag for am3 and am43
    - ARM: dts: am4372: Set memory bandwidth limit for DISPC
    - nl80211: fix null pointer dereference
    - mips: Loongson: Fix the link time qualifier of 'serial_exit()'
    - net: hisilicon: Fix usage of uninitialized variable in function
      mdio_sc_cfg_reg_write()
    - namespace: fix namespace.pl script to support relative paths
    - loop: Add LOOP_SET_DIRECT_IO to compat ioctl
    - net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3
    - net: bcmgenet: Set phydev->dev_flags only for internal PHYs
    - sctp: change sctp_prot .no_autobind with true
    - net: avoid potential infinite loop in tc_ctl_action()
    - ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
    - memfd: Fix locking when tagging pins
    - USB: legousbtower: fix memleak on disconnect
    - usb: udc: lpc32xx: fix bad bit shift operation
    - USB: serial: ti_usb_3410_5052: fix port-close races
    - USB: ldusb: fix memleak on disconnect
    - USB: usblp: fix use-after-free on disconnect
    - USB: ldusb: fix read info leaks
    - scsi: core: try to get module before removing device
    - ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting
    - cfg80211: wext: avoid copying malformed SSIDs
    - mac80211: Reject malformed SSID elements
    - scsi: zfcp: fix reaction on bit error threshold notification
    - mm/slub: fix a deadlock in show_slab_objects()
    - xtensa: drop EXPORT_SYMBOL for outs*/ins*
    - parisc: Fix vmap memory leak in ioremap()/iounmap()
    - CIFS: avoid using MID 0xFFFF
    - btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group()
    - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
    - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
    - xen/netback: fix error path of xenvif_connect_data()
    - PCI: PM: Fix pci_power_up()
    - net: sched: Fix memory exposure from short TCA_U32_SEL
    - RDMA/cxgb4: Do not dma memory off of the stack
    - Linux 4.4.198

  * Colour banding in Lenovo G50-80 laptop display (i915) (LP: #1819968) //
    Xenial update: v4.4.198 upstream stable release (LP: #1850454)
    - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50

 -- Connor Kuehl <connor.kuehl@canonical.com>  Wed, 13 Nov 2019 11:18:48 -0800

linux (4.4.0-169.198) xenial; urgency=medium

  * Incomplete i915 fix for 64-bit x86 kernels (LP: #1852141) // CVE-2019-0155
    - SAUCE: drm/i915/cmdparser: Fix jump whitelist clearing

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 12 Nov 2019 11:19:22 +0100

linux (4.4.0-168.197) xenial; urgency=medium

  * CVE-2018-12207
    - KVM: x86: MMU: Encapsulate the type of rmap-chain head in a new struct
    - KVM: x86: MMU: Consolidate quickly_check_mmio_pf() and is_mmio_page_fault()
    - KVM: x86: MMU: Move handle_mmio_page_fault() call to kvm_mmu_page_fault()
    - KVM: MMU: rename has_wrprotected_page to mmu_gfn_lpage_is_disallowed
    - KVM: MMU: introduce kvm_mmu_gfn_{allow,disallow}_lpage
    - KVM: x86: MMU: Make mmu_set_spte() return emulate value
    - KVM: x86: MMU: Move initialization of parent_ptes out from
      kvm_mmu_alloc_page()
    - KVM: x86: MMU: always set accessed bit in shadow PTEs
    - KVM: x86: MMU: Move parent_pte handling from kvm_mmu_get_page() to
      link_shadow_page()
    - KVM: x86: MMU: Remove unused parameter parent_pte from kvm_mmu_get_page()
    - KVM: x86: simplify ept_misconfig
    - KVM: x86: extend usage of RET_MMIO_PF_* constants
    - KVM: MMU: drop vcpu param in gpte_access
    - kvm: Convert kvm_lock to a mutex
    - kvm: x86: Do not release the page inside mmu_set_spte()
    - KVM: x86: make FNAME(fetch) and __direct_map more similar
    - KVM: x86: remove now unneeded hugepage gfn adjustment
    - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
    - KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
    - SAUCE: KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - SAUCE: x86: Add ITLB_MULTIHIT bug infrastructure
    - SAUCE: kvm: mmu: ITLB_MULTIHIT mitigation
    - SAUCE: kvm: Add helper function for creating VM worker threads
    - SAUCE: kvm: x86: mmu: Recovery of shattered NX large pages
    - SAUCE: cpu/speculation: Uninline and export CPU mitigations helpers
    - SAUCE: kvm: x86: mmu: Apply global mitigations knob to ITLB_MULTIHIT

  * CVE-2019-11135
    - KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
    - KVM: x86: use Intel speculation bugs and features as derived in generic x86
      code
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - SAUCE: x86/speculation/taa: Call tsx_init()
    - SAUCE: x86/cpu: Include cpu header from bugs.c
    - [Config] Disable TSX by default when possible

  * CVE-2019-0154
    - SAUCE: i915_bpo: drm/i915: Lower RM timeout to avoid DSI hard hangs
    - SAUCE: i915_bpo: drm/i915/gen8+: Add RC6 CTX corruption WA
    - SAUCE: drm/i915/gen8+: Add RC6 CTX corruption WA

  * CVE-2019-0155
    - SAUCE: i915_bpo: drm/i915/gtt: Add read only pages to gen8_pte_encode
    - SAUCE: i915_bpo: drm/i915/gtt: Read-only pages for insert_entries on bdw+
    - SAUCE: i915_bpo: drm/i915/gtt: Disable read-only support under GVT
    - SAUCE: i915_bpo: drm/i915: Rename gen7 cmdparser tables
    - SAUCE: i915_bpo: drm/i915: Disable Secure Batches for gen6+
    - SAUCE: i915_bpo: drm/i915/cmdparser: Use binary search for faster register
      lookup
    - SAUCE: i915_bpo: drm/i915/cmdparser: Check reg_table_count before
      derefencing.
    - SAUCE: i915_bpo: drm/i915: Remove Master tables from cmdparser
    - SAUCE: i915_bpo: drm/i915: Add support for mandatory cmdparsing
    - SAUCE: i915_bpo: drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - SAUCE: i915_bpo: drm/i915: Allow parsing of unsized batches
    - SAUCE: i915_bpo: drm/i915: Add gen9 BCS cmdparsing
    - SAUCE: i915_bpo: drm/i915/cmdparser: Add support for backward jumps
    - SAUCE: i915_bpo: drm/i915/cmdparser: Ignore Length operands during command
      matching

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 06 Nov 2019 09:50:06 +0100

linux (4.4.0-167.196) xenial; urgency=medium

  * xenial/linux: 4.4.0-167.196 -proposed tracker (LP: #1849051)

  * Xenial update: 4.4.197 upstream stable release (LP: #1848780)
    - KVM: s390: Test for bad access register and size at the start of S390_MEM_OP
    - s390/topology: avoid firing events before kobjs are created
    - s390/cio: avoid calling strlen on null pointer
    - s390/cio: exclude subchannels with no parent from pseudo check
    - KVM: nVMX: handle page fault in vmread fix
    - ASoC: Define a set of DAPM pre/post-up events
    - powerpc/powernv: Restrict OPAL symbol map to only be readable by root
    - can: mcp251x: mcp251x_hw_reset(): allow more time after a reset
    - crypto: qat - Silence smp_processor_id() warning
    - ieee802154: atusb: fix use-after-free at disconnect
    - cfg80211: initialize on-stack chandefs
    - ima: always return negative code for error
    - fs: nfs: Fix possible null-pointer dereferences in encode_attrs()
    - 9p: avoid attaching writeback_fid on mmap with type PRIVATE
    - xen/pci: reserve MCFG areas earlier
    - ceph: fix directories inode i_blkbits initialization
    - drm/amdgpu: Check for valid number of registers to read
    - thermal: Fix use-after-free when unregistering thermal zone device
    - fuse: fix memleak in cuse_channel_open
    - kernel/elfcore.c: include proper prototypes
    - tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure
    - perf stat: Fix a segmentation fault when using repeat forever
    - crypto: caam - fix concurrency issue in givencrypt descriptor
    - cfg80211: add and use strongly typed element iteration macros
    - cfg80211: Use const more consistently in for_each_element macros
    - nl80211: validate beacon head
    - ASoC: sgtl5000: Improve VAG power and mute control
    - panic: ensure preemption is disabled during panic()
    - [Config] updateconfigs for USB_RIO500
    - USB: rio500: Remove Rio 500 kernel driver
    - USB: yurex: Don't retry on unexpected errors
    - USB: yurex: fix NULL-derefs on disconnect
    - USB: usb-skeleton: fix runtime PM after driver unbind
    - USB: usb-skeleton: fix NULL-deref on disconnect
    - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
    - xhci: Check all endpoints for LPM timeout
    - usb: xhci: wait for CNR controller not ready bit in xhci resume
    - USB: adutux: remove redundant variable minor
    - USB: adutux: fix use-after-free on disconnect
    - USB: adutux: fix NULL-derefs on disconnect
    - USB: adutux: fix use-after-free on release
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: iowarrior: fix use-after-free on release
    - USB: iowarrior: fix use-after-free after driver unbind
    - USB: usblp: fix runtime PM after driver unbind
    - USB: chaoskey: fix use-after-free on release
    - USB: ldusb: fix NULL-derefs on driver unbind
    - serial: uartlite: fix exit path null pointer
    - USB: serial: keyspan: fix NULL-derefs on open() and write()
    - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
    - USB: serial: option: add Telit FN980 compositions
    - USB: serial: option: add support for Cinterion CLS8 devices
    - USB: serial: fix runtime PM after driver unbind
    - USB: usblcd: fix I/O after disconnect
    - USB: microtek: fix info-leak at probe
    - USB: dummy-hcd: fix power budget for SuperSpeed mode
    - usb: renesas_usbhs: gadget: Do not discard queues in
      usb_ep_set_{halt,wedge}()
    - usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
    - USB: legousbtower: fix slab info leak at probe
    - USB: legousbtower: fix deadlock on disconnect
    - USB: legousbtower: fix potential NULL-deref on disconnect
    - USB: legousbtower: fix open after failed reset request
    - USB: legousbtower: fix use-after-free on release
    - staging: vt6655: Fix memory leak in vt6655_probe
    - iio: adc: ad799x: fix probe error handling
    - iio: light: opt3001: fix mutex unlock race
    - perf llvm: Don't access out-of-scope array
    - CIFS: Gracefully handle QueryInfo errors during open
    - CIFS: Force reval dentry if LOOKUP_REVAL flag is set
    - kernel/sysctl.c: do not override max_threads provided by userspace
    - arm64: capabilities: Handle sign of the feature bit
    - arm64: Rename cpuid_feature field extract routines
    - Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc
    - cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary
    - CIFS: Force revalidate inode when dentry is stale
    - media: stkwebcam: fix runtime PM after driver unbind
    - tracing: Get trace_array reference for available_tracers files
    - x86/asm: Fix MWAITX C-state hint value
    - Linux 4.4.197
    - [Config] updateconfigs for USB_RIO500

  * CVE-2019-17666
    - SAUCE: rtlwifi: Fix potential overflow on P2P code

  * Suspend stopped working from 4.4.0-157 onwards (LP: #1844021) // Xenial
    update: 4.4.197 upstream stable release (LP: #1848780)
    - xhci: Increase STS_SAVE timeout in xhci_suspend()

  * Ubuntu 16.04.6 - Shared CEX7C cards defined in z/VM guest not established by
    zcrypt device driver (LP: #1848173)
    - SAUCE: s390/zcrypt: CEX7 toleration support

  * Xenial update: 4.4.196 upstream stable release (LP: #1848598)
    - video: ssd1307fb: Start page range at page_offset
    - gpu: drm: radeon: Fix a possible null-pointer dereference in
      radeon_connector_set_property()
    - ipmi_si: Only schedule continuously in the thread in maintenance mode
    - clk: qoriq: Fix -Wunused-const-variable
    - clk: sirf: Don't reference clk_init_data after registration
    - powerpc/rtas: use device model APIs and serialization during LPM
    - powerpc/futex: Fix warning: 'oldval' may be used uninitialized in this
      function
    - powerpc/pseries/mobility: use cond_resched when updating device tree
    - pinctrl: tegra: Fix write barrier placement in pmx_writel
    - vfio_pci: Restore original state on release
    - powerpc/64s/exception: machine check use correct cfar for late handler
    - powerpc/pseries: correctly track irq state in default idle
    - scsi: core: Reduce memory required for SCSI logging
    - mfd: intel-lpss: Remove D3cold delay
    - ARM: 8898/1: mm: Don't treat faults reported from cache maintenance as
      writes
    - HID: apple: Fix stuck function keys when using FN
    - security: smack: Fix possible null-pointer dereferences in
      smack_socket_sock_rcv_skb()
    - fat: work around race with userspace's read via blockdev while mounting
    - hypfs: Fix error number left in struct pointer member
    - ocfs2: wait for recovering done after direct unlock request
    - kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K
    - ANDROID: binder: remove waitqueue when thread exits.
    - ANDROID: binder: synchronize_rcu() when using POLLFREE.
    - hso: fix NULL-deref on tty open
    - ipv6: drop incoming packets having a v4mapped source address
    - net: ipv4: avoid mixed n_redirects and rate_tokens usage
    - net: qlogic: Fix memory leak in ql_alloc_large_buffers
    - nfc: fix memory leak in llcp_sock_bind()
    - sch_dsmark: fix potential NULL deref in dsmark_init()
    - xen-netfront: do not use ~0U as error return value for xennet_fill_frags()
    - net/rds: Fix error handling in rds_ib_add_one()
    - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
    - Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set
    - smack: use GFP_NOFS while holding inode_smack::smk_lock
    - NFC: fix attrs checks in netlink interface
    - Linux 4.4.196

  * Xenial update: 4.4.195 upstream stable release (LP: #1848589)
    - Revert "Bluetooth: validate BLE connection interval updates"
    - HID: prodikeys: Fix general protection fault during probe
    - HID: lg: make transfer buffers DMA capable
    - HID: logitech: Fix general protection fault caused by Logitech driver
    - HID: hidraw: Fix invalid read in hidraw_ioctl
    - mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
    - crypto: talitos - fix missing break in switch statement
    - net: rds: Fix NULL ptr use in rds_tcp_kill_sock
    - ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt()
    - ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
    - SAUCE: Revert "mac80211: handle deauthentication/disassociation from TDLS
      peer"
    - mac80211: Print text for disassociation reason
    - mac80211: handle deauthentication/disassociation from TDLS peer
    - locking/lockdep: Add debug_locks check in __lock_downgrade()
    - irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
    - f2fs: check all the data segments against all node ones
    - Revert "f2fs: avoid out-of-range memory access"
    - f2fs: fix to do sanity check on segment bitmap of LFS curseg
    - drm: Flush output polling on shutdown
    - Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
    - arcnet: provide a buffer big enough to actually receive packets
    - cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
    - net/phy: fix DP83865 10 Mbps HDX loopback disable function
    - openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC
    - sch_netem: fix a divide by zero in tabledist()
    - skge: fix checksum byte order
    - usbnet: ignore endpoints with invalid wMaxPacketSize
    - usbnet: sanity checking of packet sizes and device mtu
    - ALSA: hda: Flush interrupts on disabling
    - ASoC: sgtl5000: Fix charge pump source assignment
    - dmaengine: bcm2835: Print error in case setting DMA mask fails
    - leds: leds-lp5562 allow firmware files up to the maximum length
    - media: dib0700: fix link error for dibx000_i2c_set_speed
    - media: hdpvr: Add device num check and handling
    - sched/fair: Fix imbalance due to CPU affinity
    - sched/core: Fix CPU controller for !RT_GROUP_SCHED
    - x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI
      fails
    - x86/apic: Soft disable APIC before initializing it
    - ALSA: hda - Show the fatal CORB/RIRB error more clearly
    - ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in
      build_adc_controls()
    - media: iguanair: add sanity checks
    - base: soc: Export soc_device_register/unregister APIs
    - ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
    - ia64:unwind: fix double free for mod->arch.init_unw_table
    - md: don't call spare_active in md_reap_sync_thread if all member devices
      can't work
    - md: don't set In_sync if array is frozen
    - efi: cper: print AER info of PCIe fatal error
    - media: gspca: zero usb_buf on error
    - dmaengine: iop-adma: use correct printk format strings
    - media: omap3isp: Don't set streaming state on random subdevs
    - net: lpc-enet: fix printk format strings
    - media: radio/si470x: kill urb on error
    - media: hdpvr: add terminating 0 at end of string
    - media: saa7146: add cleanup in hexium_attach()
    - media: cpia2_usb: fix memory leaks
    - media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate()
    - media: ov9650: add a sanity check
    - ACPI / CPPC: do not require the _PSD method
    - libtraceevent: Change users plugin directory
    - ACPI: custom_method: fix memory leaks
    - hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
    - md/raid1: fail run raid1 array when active disk less than one
    - dmaengine: ti: edma: Do not reset reserved paRAM slots
    - kprobes: Prohibit probing on BUG() and WARN() address
    - ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set
    - mmc: sdhci: Fix incorrect switch to HS mode
    - libertas: Add missing sentinel at end of if_usb.c fw_table
    - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
    - ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
    - btrfs: extent-tree: Make sure we only allocate extents from block groups
      with the same type
    - media: omap3isp: Set device on omap3isp subdevs
    - ALSA: firewire-tascam: handle error code when getting current source of
      clock
    - ALSA: firewire-tascam: check intermediate state of clock status and retry
    - printk: Do not lose last line in kmsg buffer dump
    - fuse: fix missing unlock_page in fuse_writepage()
    - parisc: Disable HP HSC-PCI Cards to prevent kernel crash
    - KVM: x86: always stop emulation on page fault
    - KVM: x86: set ctxt->have_exception in x86_decode_insn()
    - KVM: x86: Manually calculate reserved bits when loading PDPTRS
    - media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
    - ASoC: Intel: Fix use of potentially uninitialized variable
    - ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up
    - alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP
    - md/raid6: Set R5_ReadError when there is read failure on parity disk
    - cfg80211: Purge frame registrations on iftype change
    - /dev/mem: Bail out upon SIGKILL.
    - ext4: fix punch hole for inline_data file systems
    - quota: fix wrong condition in is_quota_modification()
    - hwrng: core - don't wait on add_early_randomness()
    - i2c: riic: Clear NACK in tend isr
    - CIFS: Fix oplock handling for SMB 2.1+ protocols
    - ovl: filter of trusted xattr results in audit
    - Btrfs: fix use-after-free when using the tree modification log
    - btrfs: Relinquish CPUs in btrfs_compare_trees
    - Btrfs: fix race setting up and completing qgroup rescan workers
    - Linux 4.4.195

  * [Packaging] Support building Flattened Image Tree (FIT) kernels
    (LP: #1847969)
    - [Packaging] add rules to build FIT image
    - [Packaging] force creation of headers directory

  * bcache: Performance degradation when querying priority_stats (LP: #1840043)
    - bcache: add cond_resched() in __bch_cache_cmp()

  * Add installer support for iwlmvm adapters (LP: #1848236)
    - d-i: Add iwlmvm to nic-modules

  * Bad posix clock speculation mitigation backport (LP: #1847189)
    - SAUCE: Fix posix clock speculation mitigation backport

  * PM / hibernate: fix potential memory corruption (LP: #1847118)
    - PM / hibernate: memory_bm_find_bit -- tighten node optimisation

  * CVE-2019-17056
    - nfc: enforce CAP_NET_RAW for raw sockets

  * CVE-2019-17055
    - mISDN: enforce CAP_NET_RAW for raw sockets

  * CVE-2019-17054
    - appletalk: enforce CAP_NET_RAW for raw sockets

  * CVE-2019-17053
    - ieee802154: enforce CAP_NET_RAW for raw sockets

  * CVE-2019-17052
    - ax25: enforce CAP_NET_RAW for raw sockets

  * CVE-2019-15098
    - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()

  * arm64: sigaltstack fails with MINSIGSTKSZ for 32-bit processes
    (LP: #1844155)
    - signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
    - arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ

 -- Khalid Elmously <khalid.elmously@canonical.com>  Mon, 21 Oct 2019 14:56:55 -0400

linux (4.4.0-166.195) xenial; urgency=medium

  * xenial/linux: 4.4.0-166.195 -proposed tracker (LP: #1846069)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * CVE-2017-18232
    - scsi: libsas: direct call probe and destruct

  * CVE-2018-21008
    - rsi: add fix for crash during assertions

  * Xenial update: 4.4.194 upstream stable release (LP: #1845405)
    - bridge/mdb: remove wrong use of NLM_F_MULTI
    - cdc_ether: fix rndis support for Mediatek based smartphones
    - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
    - isdn/capi: check message length in capi_write()
    - net: Fix null de-reference of device refcount
    - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
    - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
    - tipc: add NULL pointer check before calling kfree_rcu
    - tun: fix use-after-free when register netdev failed
    - Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
    - Btrfs: fix assertion failure during fsync and use of stale transaction
    - genirq: Prevent NULL pointer dereference in resend_irqs()
    - KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
    - KVM: x86: work around leak of uninitialized stack contents
    - KVM: nVMX: handle page fault in vmread
    - MIPS: VDSO: Prevent use of smp_processor_id()
    - MIPS: VDSO: Use same -m%-float cflag as the kernel proper
    - clk: rockchip: Don't yell about bad mmc phases when getting
    - driver core: Fix use-after-free and double free on glue directory
    - crypto: talitos - check AES key size
    - crypto: talitos - check data blocksize in ablkcipher.
    - x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence
      GCC9 build warning
    - MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
    - ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
    - media: tm6000: double free if usb disconnect while streaming
    - x86/boot: Add missing bootparam that breaks boot on some platforms
    - xen-netfront: do not assume sk_buff_head list is empty in error handling
    - serial: sprd: correct the wrong sequence of arguments
    - tty/serial: atmel: reschedule TX after RX was started
    - mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
    - s390/bpf: fix lcgr instruction encoding
    - ARM: OMAP2+: Fix omap4 errata warning on other SoCs
    - s390/bpf: use 32-bit index for tail calls
    - NFSv4: Fix return values for nfs4_file_open()
    - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    - Kconfig: Fix the reference to the IDT77105 Phy driver in the description of
      ATM_NICSTAR_USE_IDT77105
    - ARM: 8874/1: mm: only adjust sections of valid mm structures
    - r8152: Set memory to all 0xFFs on failed reg reads
    - x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
    - netfilter: nf_conntrack_ftp: Fix debug output
    - NFSv2: Fix eof handling
    - NFSv2: Fix write regression
    - cifs: set domainName when a domain-key is used in multiuser
    - cifs: Use kzfree() to zero out the password
    - sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    - tools/power turbostat: fix buffer overrun
    - net: seeq: Fix the function used to release some memory in an error handling
      path
    - dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    - keys: Fix missing null pointer check in request_key_auth_describe()
    - floppy: fix usercopy direction
    - media: technisat-usb2: break out of loop at end of buffer
    - ARC: export "abort" for modules
    - net_sched: let qdisc_put() accept NULL pointer
    - Linux 4.4.194

  * CVE-2019-14821
    - KVM: coalesced_mmio: add bounds checking

  * Xenial update: 4.4.193 upstream stable release (LP: #1845395)
    - ALSA: hda - Fix potential endless loop at applying quirks
    - ALSA: hda/realtek - Fix overridden device-specific initialization
    - xfrm: clean up xfrm protocol checks
    - vhost/test: fix build for vhost test
    - scripts/decode_stacktrace: match basepath using shell prefix operator, not
      regex
    - clk: s2mps11: Add used attribute to s2mps11_dt_match
    - x86, boot: Remove multiple copy of static function sanitize_boot_params()
    - af_packet: tone down the Tx-ring unsupported spew.
    - Linux 4.4.193

  * Xenial update: 4.4.192 upstream stable release (LP: #1845374)
    - net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ
      context
    - net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    - Bluetooth: btqca: Add a short delay before downloading the NVM
    - ibmveth: Convert multicast list size for little-endian system
    - gpio: Fix build error of function redefinition
    - cxgb4: fix a memory leak bug
    - net: myri10ge: fix memory leaks
    - cx82310_eth: fix a memory leak bug
    - net: kalmia: fix memory leaks
    - wimax/i2400m: fix a memory leak bug
    - ravb: Fix use-after-free ravb_tstamp_skb
    - Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    - IB/mlx4: Fix memory leaks
    - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    - KVM: arm/arm64: Only skip MMIO insn once
    - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    - spi: bcm2835aux: ensure interrupts are enabled for shared handler
    - spi: bcm2835aux: unifying code between polling and interrupt driven code
    - spi: bcm2835aux: remove dangerous uncontrolled read of fifo
    - spi: bcm2835aux: fix corruptions for longer spi transfers
    - Revert "x86/apic: Include the LDR when clearing out APIC registers"
    - net: fix skb use after free in netpoll
    - net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
    - Linux 4.4.192

  * Xenial update: 4.4.191 upstream stable release (LP: #1845036)
    - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
    - MIPS: kernel: only use i8253 clocksource with periodic clockevent
    - netfilter: ebtables: fix a memory leak bug in compat
    - bonding: Force slave speed check after link state recovery for 802.3ad
    - can: dev: call netif_carrier_off() in register_candev()
    - st21nfca_connectivity_event_received: null check the allocation
    - st_nci_hci_connectivity_event_received: null check the allocation
    - ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    - net: usb: qmi_wwan: Add the BroadMobi BM818 card
    - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in
      start_isoc_chain()
    - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
    - perf bench numa: Fix cpu0 binding
    - can: sja1000: force the string buffer NULL-terminated
    - can: peak_usb: force the string buffer NULL-terminated
    - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    - net: hisilicon: make hip04_tx_reclaim non-reentrant
    - net: hisilicon: fix hip04-xmit never return TX_BUSY
    - net: hisilicon: Fix dma_map_single failed on arm64
    - libata: add SG safety checks in SFF pio transfers
    - selftests: kvm: Adding config fragments
    - HID: wacom: correct misreported EKR ring values
    - Revert "dm bufio: fix deadlock with loop device"
    - userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
    - x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    - x86/apic: Handle missing global clockevent gracefully
    - x86/boot: Save fields explicitly, zero out everything else
    - x86/boot: Fix boot regression caused by bootparam sanitizing
    - dm btree: fix order of block initialization in btree_split_beneath
    - dm space map metadata: fix missing store of apply_bops() return value
    - dm table: fix invalid memory accesses with too high sector number
    - cgroup: Disable IRQs while holding css_set_lock
    - net: arc_emac: fix koops caused by sk_buff free
    - siphash: implement HalfSipHash1-3 for hash tables
    - netfilter: ctnetlink: don't use conntrack/expect object addresses as id
    - netfilter: conntrack: Use consistent ct id hash calculation
    - x86/pm: Introduce quirk framework to save/restore extra MSR registers around
      suspend/resume
    - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    - scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
    - dmaengine: ste_dma40: fix unneeded variable warning
    - usb: gadget: composite: Clear "suspended" on reset/disconnect
    - usb: host: fotg2: restart hcd after port reset
    - tools: hv: fix KVP and VSS daemons exit code
    - watchdog: bcm2835_wdt: Fix module autoload
    - tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
    - ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
    - ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
    - tcp: make sure EPOLLOUT wont be missed
    - ALSA: seq: Fix potential concurrent access to the deleted pool
    - KVM: x86: Don't update RIP or do single-step on faulting emulation
    - x86/apic: Do not initialize LDR and DFR for bigsmp
    - x86/apic: Include the LDR when clearing out APIC registers
    - usb-storage: Add new JMS567 revision to unusual_devs
    - USB: cdc-wdm: fix race between write and disconnect due to flag abuse
    - usb: host: ohci: fix a race condition between shutdown and irq
    - USB: storage: ums-realtek: Update module parameter description for
      auto_delink_en
    - ptrace,x86: Make user_64bit_mode() available to 32-bit builds
    - uprobes/x86: Fix detection of 32-bit user mode
    - mmc: sdhci-of-at91: add quirk for broken HS200
    - mmc: core: Fix init of SD cards reporting an invalid VDD range
    - stm class: Fix a double free of stm_source_device
    - VMCI: Release resource if the work is already queued
    - Revert "cfg80211: fix processing world regdomain when non modular"
    - mac80211: fix possible sta leak
    - x86/ptrace: fix up botched merge of spectrev1 fix
    - Linux 4.4.191

  * New ID in ums-realtek module breaks cardreader (LP: #1838886) // Xenial
    update: 4.4.191 upstream stable release (LP: #1845036)
    - USB: storage: ums-realtek: Whitelist auto-delink support

  * Xenial update: 4.4.190 upstream stable release (LP: #1845038)
    - usb: iowarrior: fix deadlock on disconnect
    - sound: fix a memory leak bug
    - x86/mm: Check for pfn instead of page in vmalloc_sync_one()
    - x86/mm: Sync also unmappings in vmalloc_sync_all()
    - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
    - perf db-export: Fix thread__exec_comm()
    - usb: yurex: Fix use-after-free in yurex_delete
    - can: peak_usb: fix potential double kfree_skb()
    - netfilter: nfnetlink: avoid deadlock due to synchronous request_module
    - iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
    - mac80211: don't warn about CW params when not using them
    - hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
    - cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    - s390/qdio: add sanity checks to the fast-requeue path
    - ALSA: compress: Fix regression on compressed capture streams
    - ALSA: compress: Prevent bypasses of set_params
    - ALSA: compress: Be more restrictive about when a drain is allowed
    - perf probe: Avoid calling freeing routine multiple times for same pointer
    - ARM: davinci: fix sleep.S build error on ARMv4
    - scsi: megaraid_sas: fix panic on loading firmware crashdump
    - scsi: ibmvfc: fix WARN_ON during event pool release
    - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
    - perf/core: Fix creating kernel counters for PMUs that override event->cpu
    - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    - hwmon: (nct7802) Fix wrong detection of in4 presence
    - ALSA: firewire: fix a memory leak bug
    - mac80211: don't WARN on short WMM parameters from AP
    - SMB3: Fix deadlock in validate negotiate hits reconnect
    - smb3: send CAP_DFS capability during session setup
    - mwifiex: fix 802.11n/WPA detection
    - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
    - sh: kernel: hw_breakpoint: Fix missing break in switch statement
    - mm/memcontrol.c: fix use after free in mem_cgroup_iter()
    - ALSA: hda - Fix a memory leak bug
    - HID: holtek: test for sanity of intfdata
    - HID: hiddev: avoid opening a disconnected device
    - HID: hiddev: do cleanup in failure of opening a device
    - Input: kbtab - sanity check for endpoint type
    - Input: iforce - add sanity checks
    - net: usb: pegasus: fix improper read if get_registers() fail
    - xen/pciback: remove set but not used variable 'old_state'
    - irqchip/irq-imx-gpcv2: Forward irq type to parent
    - perf header: Fix divide by zero error if f_header.attr_size==0
    - perf header: Fix use of unitialized value warning
    - libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    - scsi: hpsa: correct scsi command status issue after reset
    - ata: libahci: do not complain in case of deferred probe
    - kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
    - IB/core: Add mitigation for Spectre V1
    - ocfs2: remove set but not used variable 'last_hash'
    - asm-generic: fix -Wtype-limits compiler warnings
    - staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
    - staging: comedi: dt3000: Fix rounding up of timer divisor
    - USB: core: Fix races in character device registration and deregistraion
    - usb: cdc-acm: make sure a refcount is taken early enough
    - USB: serial: option: add D-Link DWM-222 device ID
    - USB: serial: option: Add support for ZTE MF871A
    - USB: serial: option: add the BroadMobi BM818 card
    - USB: serial: option: Add Motorola modem UARTs
    - Backport minimal compiler_attributes.h to support GCC 9
    - include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
    - arm64: compat: Allow single-byte watchpoints on all addresses
    - Input: psmouse - fix build error of multiple definition
    - asm-generic: default BUG_ON(x) to if(x)BUG()
    - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
    - RDMA: Directly cast the sockaddr union to sockaddr
    - IB/mlx5: Make coding style more consistent
    - x86/vdso: Remove direct HPET access through the vDSO
    - iommu/amd: Move iommu_init_pci() to .init section
    - x86/boot: Disable the address-of-packed-member compiler warning
    - net/packet: fix race in tpacket_snd()
    - xen/netback: Reset nr_frags before freeing skb
    - net/mlx5e: Only support tx/rx pause setting for port owner
    - sctp: fix the transport error_count check
    - bonding: Add vlan tx offload to hw_enc_features
    - Linux 4.4.190

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 01 Oct 2019 10:23:59 +0200

linux (4.4.0-165.193) xenial; urgency=medium

  * xenial/linux: 4.4.0-165.193 -proposed tracker (LP: #1844416)

  * Xenial update: 4.4.187 upstream stable release (LP: #1840081)
    - MIPS: ath79: fix ar933x uart parity mode
    - MIPS: fix build on non-linux hosts
    - dmaengine: imx-sdma: fix use-after-free on probe error path
    - ath10k: Do not send probe response template for mesh
    - ath9k: Check for errors when reading SREV register
    - ath6kl: add some bounds checking
    - ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
    - batman-adv: fix for leaked TVLV handler.
    - media: dvb: usb: fix use after free in dvb_usb_device_exit
    - crypto: talitos - fix skcipher failure due to wrong output IV
    - media: marvell-ccic: fix DMA s/g desc number calculation
    - media: vpss: fix a potential NULL pointer dereference
    - net: stmmac: dwmac1000: Clear unused address entries
    - signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
    - af_key: fix leaks in key_pol_get_resp and dump_sp.
    - xfrm: Fix xfrm sel prefix length validation
    - media: staging: media: davinci_vpfe: - Fix for memory leak if decoder
      initialization fails.
    - net: phy: Check against net_device being NULL
    - tua6100: Avoid build warnings.
    - locking/lockdep: Fix merging of hlocks with non-zero references
    - media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
    - cpupower : frequency-set -r option misses the last cpu in related cpu list
    - net: fec: Do not use netdev messages too early
    - net: axienet: Fix race condition causing TX hang
    - s390/qdio: handle PENDING state for QEBSM devices
    - perf test 6: Fix missing kvm module load for s390
    - gpio: omap: fix lack of irqstatus_raw0 for OMAP4
    - gpio: omap: ensure irq is enabled before wakeup
    - regmap: fix bulk writes on paged registers
    - bpf: silence warning messages in core
    - rcu: Force inlining of rcu_read_lock()
    - xfrm: fix sa selector validation
    - perf evsel: Make perf_evsel__name() accept a NULL argument
    - vhost_net: disable zerocopy by default
    - EDAC/sysfs: Fix memory leak when creating a csrow object
    - media: i2c: fix warning same module names
    - ntp: Limit TAI-UTC offset
    - timer_list: Guard procfs specific code
    - acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
    - media: coda: fix mpeg2 sequence number handling
    - media: coda: increment sequence offset for the last returned frame
    - mt7601u: do not schedule rx_tasklet when the device has been disconnected
    - x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
    - mt7601u: fix possible memory leak when the device is disconnected
    - ath10k: fix PCIE device wake up failed
    - rslib: Fix decoding of shortened codes
    - rslib: Fix handling of of caller provided syndrome
    - ixgbe: Check DDM existence in transceiver before access
    - EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
    - bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
    - Bluetooth: hci_bcsp: Fix memory leak in rx_skb
    - Bluetooth: 6lowpan: search for destination address in all peers
    - Bluetooth: Check state in l2cap_disconnect_rsp
    - Bluetooth: validate BLE connection interval updates
    - crypto: ghash - fix unaligned memory access in ghash_setkey()
    - crypto: arm64/sha1-ce - correct digest for empty data in finup
    - crypto: arm64/sha2-ce - correct digest for empty data in finup
    - Input: gtco - bounds check collection indent level
    - regulator: s2mps11: Fix buck7 and buck8 wrong voltages
    - tracing/snapshot: Resize spare buffer if size changed
    - NFSv4: Handle the special Linux file open access mode
    - lib/scatterlist: Fix mapping iterator when sg->offset is greater than
      PAGE_SIZE
    - ALSA: seq: Break too long mutex context in the write loop
    - media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
    - media: coda: Remove unbalanced and unneeded mutex unlock
    - KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
    - drm/nouveau/i2c: Enable i2c pads & busses during preinit
    - padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
    - 9p/virtio: Add cleanup path in p9_virtio_init
    - PCI: Do not poll for PME if the device is in D3cold
    - take floppy compat ioctls to sodding floppy.c
    - floppy: fix out-of-bounds read in next_valid_format
    - floppy: fix invalid pointer dereference in drive_name
    - coda: pass the host file in vma->vm_file on mmap
    - gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
    - parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
    - powerpc/32s: fix suspend/resume when IBATs 4-7 are used
    - powerpc/watchpoint: Restore NV GPRs while returning from exception
    - eCryptfs: fix a couple type promotion bugs
    - intel_th: msu: Fix single mode with disabled IOMMU
    - Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
    - usb: Handle USB3 remote wakeup for LPM enabled devices correctly
    - dm bufio: fix deadlock with loop device
    - bnx2x: Prevent load reordering in tx completion processing
    - caif-hsi: fix possible deadlock in cfhsi_exit_module()
    - ipv4: don't set IPv6 only flags to IPv4 addresses
    - net: bcmgenet: use promisc for unsupported filters
    - net: neigh: fix multiple neigh timer scheduling
    - nfc: fix potential illegal memory access
    - sky2: Disable MSI on ASUS P6T
    - netrom: fix a memory leak in nr_rx_frame()
    - netrom: hold sock when setting skb->destructor
    - tcp: Reset bytes_acked and bytes_received when disconnecting
    - bonding: validate ip header before check IPPROTO_IGMP
    - net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
    - net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
    - net: bridge: stp: don't cache eth dest pointer before skb pull
    - elevator: fix truncation of icq_cache_name
    - NFSv4: Fix open create exclusive when the server reboots
    - nfsd: increase DRC cache limit
    - nfsd: give out fewer session slots as limit approaches
    - nfsd: fix performance-limiting session calculation
    - nfsd: Fix overflow causing non-working mounts on 1 TB machines
    - drm/panel: simple: Fix panel_simple_dsi_probe
    - usb: core: hub: Disable hub-initiated U1/U2
    - tty: max310x: Fix invalid baudrate divisors calculator
    - pinctrl: rockchip: fix leaked of_node references
    - tty: serial: cpm_uart - fix init when SMC is relocated
    - memstick: Fix error cleanup path of memstick_init
    - tty/serial: digicolor: Fix digicolor-usart already registered warning
    - tty: serial: msm_serial: avoid system lockup condition
    - drm/virtio: Add memory barriers for capset cache.
    - phy: renesas: rcar-gen2: Fix memory leak at error paths
    - usb: gadget: Zero ffs_io_data
    - powerpc/pci/of: Fix OF flags parsing for 64bit BARs
    - PCI: sysfs: Ignore lockdep for remove attribute
    - iio: iio-utils: Fix possible incorrect mask calculation
    - recordmcount: Fix spurious mcount entries on powerpc
    - mfd: core: Set fwnode for created devices
    - mfd: arizona: Fix undefined behavior
    - um: Silence lockdep complaint about mmap_sem
    - powerpc/4xx/uic: clear pending interrupt after irq type/pol change
    - serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
    - kallsyms: exclude kasan local symbols on s390
    - perf test mmap-thread-lookup: Initialize variable to suppress memory
      sanitizer warning
    - f2fs: avoid out-of-range memory access
    - mailbox: handle failed named mailbox channel request
    - powerpc/eeh: Handle hugepages in ioremap space
    - sh: prevent warnings when using iounmap
    - mm/kmemleak.c: fix check for softirq context
    - 9p: pass the correct prototype to read_cache_page
    - mm/mmu_notifier: use hlist_add_head_rcu()
    - locking/lockdep: Fix lock used or unused stats error
    - locking/lockdep: Hide unused 'class' variable
    - usb: wusbcore: fix unbalanced get/put cluster_id
    - usb: pci-quirks: Correct AMD PLL quirk detection
    - x86/sysfb_efi: Add quirks for some devices with swapped width and height
    - x86/speculation/mds: Apply more accurate check on hypervisor platform
    - hpet: Fix division by zero in hpet_time_div()
    - ALSA: hda - Add a conexant codec entry to let mute led work
    - access: avoid the RCU grace period for the temporary subjective credentials
    - vmstat: Remove BUG_ON from vmstat_update
    - mm, vmstat: make quiet_vmstat lighter
    - ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
    - tcp: reset sk_send_head in tcp_write_queue_purge
    - ISDN: hfcsusb: checking idx of ep configuration
    - media: cpia2_usb: first wake up, then free in disconnect
    - media: radio-raremono: change devm_k*alloc to k*alloc
    - Bluetooth: hci_uart: check for missing tty operations
    - sched/fair: Don't free p->numa_faults with concurrent readers
    - drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
    - ceph: hold i_ceph_lock when removing caps for freeing inode
    - Linux 4.4.187
    - perf tests: Add valid callback for parse-events test
    - SAUCE: Fix perf test 6: Fix missing kvm module load for s390

  * CVE-2018-20976
    - xfs: clear sb->s_fs_info on mount failure

  * Xenial update: 4.4.189 upstream stable release (LP: #1840335)
    - arm64: cpufeature: Fix CTR_EL0 field definitions
    - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
    - netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
    - HID: Add quirk for HP X1200 PIXART OEM mouse
    - tcp: be more careful in tcp_fragment()
    - atm: iphase: Fix Spectre v1 vulnerability
    - net: bridge: delete local fdb on device init failure
    - net: fix ifindex collision during namespace removal
    - tipc: compat: allow tipc commands without arguments
    - net: sched: Fix a possible null-pointer dereference in dequeue_func()
    - net/mlx5: Use reversed order when unregister devices
    - bnx2x: Disable multi-cos feature.
    - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
    - spi: bcm2835: Fix 3-wire mode if DMA is enabled
    - x86: cpufeatures: Sort feature word 7
    - x86/entry/64: Fix context tracking state warning when load_gs_index fails
    - Linux 4.4.189

  * CVE-2019-0136
    - mac80211: handle deauthentication/disassociation from TDLS peer

  * skb_warn_bad_offload kernel splat due to CHECKSUM target not compatible with
    GSO skbs (LP: #1840619)
    - netfilter: xt_checksum: ignore gso skbs

  * CVE-2018-20961
    - usb: gadget: f_midi: fail if set_alt fails to allocate requests
    - USB: gadget: f_midi: fixing a possible double-free in f_midi

  * CVE-2019-11487
    - pipe: add pipe_buf_get() helper
    - mm: add 'try_get_page()' helper function
    - fs: prevent page refcount overflow in pipe_buf_get
    - mm: make page ref count overflow check tighter and more explicit
    - mm, gup: ensure real head page is ref-counted when using hugepages
    - mm: prevent get_user_pages() from overflowing page refcount

  * Xenial update: 4.4.188 upstream stable release (LP: #1840289)
    - ARM: riscpc: fix DMA
    - ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
    - kernel/module.c: Only return -EEXIST for modules that have finished loading
    - MIPS: lantiq: Fix bitfield masking
    - dmaengine: rcar-dmac: Reject zero-length slave DMA requests
    - fs/adfs: super: fix use-after-free bug
    - btrfs: fix minimum number of chunk errors for DUP
    - ceph: fix improper use of smp_mb__before_atomic()
    - scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
    - ACPI: fix false-positive -Wuninitialized warning
    - be2net: Signal that the device cannot transmit during reconfiguration
    - x86/apic: Silence -Wtype-limits compiler warnings
    - x86: math-emu: Hide clang warnings for 16-bit overflow
    - mm/cma.c: fail if fixed declaration can't be honored
    - coda: add error handling for fget
    - coda: fix build using bare-metal toolchain
    - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side
      headers
    - ipc/mqueue.c: only perform resource calculation if user valid
    - x86/kvm: Don't call kvm_spurious_fault() from .fixup
    - selinux: fix memory leak in policydb_init()
    - s390/dasd: fix endless loop after read unit address configuration
    - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
    - Linux 4.4.188

  * Line 6 POD HD500 driver fault (LP: #1790595) // Xenial update: 4.4.187
    upstream stable release (LP: #1840081)
    - ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1

  * CVE-2016-10905
    - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 17 Sep 2019 18:24:13 +0200

linux (4.4.0-164.192) xenial; urgency=medium

  * CVE-2019-14835
    - SAUCE: vhost: make sure log_num < in_num

 -- Juerg Haefliger <juergh@canonical.com>  Fri, 13 Sep 2019 12:55:05 +0200

# For older changelog entries, run 'apt-get changelog linux-tools-common'
