linux (4.4.0-187.217) xenial; urgency=medium

  * xenial/linux: 4.4.0-187.217 -proposed tracker (LP: #1888274)

  * Regression in kernel 4.15.0-91 causes kernel panic with Bcache
    (LP: #1867916)
    - bcache: check and adjust logical block size for backing devices

  * Xenial update: v4.4.230 upstream stable release (LP: #1887011)
    - btrfs: cow_file_range() num_bytes and disk_num_bytes are same
    - btrfs: fix data block group relocation failure due to concurrent scrub
    - mm: fix swap cache node allocation mask
    - EDAC/amd64: Read back the scrub rate PCI register on F15h
    - mm/slub: fix stack overruns with SLUB_STATS
    - usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
    - kgdb: Avoid suspicious RCU usage warning
    - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
    - sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in
      milliseconds
    - hwmon: (max6697) Make sure the OVERT mask is set correctly
    - hwmon: (acpi_power_meter) Fix potential memory leak in
      acpi_power_meter_add()
    - virtio-blk: free vblk-vqs in error path of virtblk_probe()
    - i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
    - Revert "ALSA: usb-audio: Improve frames size computation"
    - SMB3: Honor 'seal' flag for multiuser mounts
    - SMB3: Honor persistent/resilient handle flags for multiuser mounts
    - cifs: Fix the target file was deleted when rename failed.
    - MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
    - netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
    - Linux 4.4.230

  * Xenial update: v4.4.229 upstream stable release (LP: #1885932)
    - s390: fix syscall_get_error for compat processes
    - clk: sunxi: Fix incorrect usage of round_down()
    - i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets
    - clk: qcom: msm8916: Fix the address location of pll->config_reg
    - ALSA: isa/wavefront: prevent out of bounds write in ioctl
    - scsi: qla2xxx: Fix issue with adapter's stopping state
    - i2c: pxa: clear all master action bits in i2c_pxa_stop_message()
    - usblp: poison URBs upon disconnect
    - ps3disk: use the default segment boundary
    - vfio/pci: fix memory leaks in alloc_perm_bits()
    - mfd: wm8994: Fix driver operation if loaded as modules
    - scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event
    - nfsd: Fix svc_xprt refcnt leak when setup callback client failed
    - powerpc/crashkernel: Take "mem=" option into account
    - yam: fix possible memory leak in yam_init_driver
    - mksysmap: Fix the mismatch of '.L' symbols in System.map
    - scsi: sr: Fix sr_probe() missing deallocate of device minor
    - scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM
    - ALSA: usb-audio: Improve frames size computation
    - s390/qdio: put thinint indicator after early error
    - tty: hvc: Fix data abort due to race in hvc_open
    - staging: sm750fb: add missing case while setting FB_VISUAL
    - i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output
    - serial: amba-pl011: Make sure we initialize the port.lock spinlock
    - drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a
      driver developer is foolish
    - PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges
    - power: supply: smb347-charger: IRQSTAT_D is volatile
    - scsi: mpt3sas: Fix double free warnings
    - dlm: remove BUG() before panic()
    - clk: ti: composite: fix memory leak
    - tty: n_gsm: Fix SOF skipping
    - tty: n_gsm: Fix waking up upper tty layer when room available
    - powerpc/pseries/ras: Fix FWNMI_VALID off by one
    - powerpc/ps3: Fix kexec shutdown hang
    - vfio-pci: Mask cap zero
    - usb/ohci-platform: Fix a warning when hibernating
    - USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe()
    - tty: n_gsm: Fix bogus i++ in gsm_data_kick
    - clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1
    - watchdog: da9062: No need to ping manually before setting timeout
    - usb: dwc2: gadget: move gadget resume after the core is in L0 state
    - USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in
      s3c2410_udc_nuke
    - usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check
    - usb: gadget: fix potential double-free in m66592_probe.
    - net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'
    - ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed
    - openrisc: Fix issue with argument clobbering for clone/fork
    - gfs2: Allow lock_nolock mount to specify jid=X
    - scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
    - lib/zlib: remove outdated and incorrect pre-increment optimization
    - include/linux/bitops.h: avoid clang shift-count-overflow warnings
    - elfnote: mark all .note sections SHF_ALLOC
    - selftests/net: in timestamping, strncpy needs to preserve null byte
    - scsi: acornscsi: Fix an error handling path in acornscsi_probe()
    - usb/xhci-plat: Set PM runtime as active on resume
    - usb/ehci-platform: Set PM runtime as active on resume
    - perf report: Fix NULL pointer dereference in
      hists__fprintf_nr_sample_events()
    - bcache: fix potential deadlock problem in btree_gc_coalesce
    - block: Fix use-after-free in blkdev_get()
    - drm: encoder_slave: fix refcouting error for modules
    - drm/dp_mst: Reformat drm_dp_check_act_status() a bit
    - drm/qxl: Use correct notify port address when creating cursor ring
    - selinux: fix double free
    - ext4: fix partial cluster initialization when splitting extent
    - drm/dp_mst: Increase ACT retry timeout to 3s
    - sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
    - block: nr_sects_write(): Disable preemption on seqcount write
    - crypto: algboss - don't wait during notifier callback
    - kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex
    - powerpc/kprobes: Fixes for kprobe_lookup_name() on BE
    - x86/kprobes: Avoid kretprobe recursion bug
    - kretprobe: Prevent triggering kretprobe from within kprobe_flush_task
    - e1000e: Do not wake up the system via WOL if device wakeup is disabled
    - sched/rt, net: Use CONFIG_PREEMPTION.patch
    - net: core: device_rename: Use rwsem instead of a seqcount
    - net: Revert "pkt_sched: fq: use proper locking in fq_dump_stats()"
    - scsi: scsi_devinfo: handle non-terminated strings
    - l2tp: Allow duplicate session creation with UDP
    - net: sched: export __netdev_watchdog_up()
    - fix a braino in "sparc32: fix register window handling in
      genregs32_[gs]et()"
    - net: fix memleak in register_netdevice()
    - net: usb: ax88179_178a: fix packet alignment padding
    - tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
    - ip_tunnel: fix use-after-free in ip_tunnel_lookup()
    - tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
    - ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
    - tcp: grow window for OOO packets only for SACK flows
    - sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
    - net: Fix the arp error in some cases
    - net: Do not clear the sock TX queue in sk_set_socket()
    - net: core: reduce recursion limit value
    - mld: fix memory leak in ipv6_mc_destroy_dev()
    - USB: ohci-sm501: Add missed iounmap() in remove
    - usb: dwc2: Postponed gadget registration to the udc class driver
    - usb: add USB_QUIRK_DELAY_INIT for Logitech C922
    - PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports
    - USB: ehci: reopen solution for Synopsys HC bug
    - usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
    - ALSA: usb-audio: add quirk for Denon DCD-1500RE
    - xhci: Fix incorrect EP_STATE_MASK
    - xhci: Fix enumeration issue when setting max packet size for FS devices.
    - cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
    - ALSA: usb-audio: uac1: Invalidate ctl on interrupt
    - ALSA: usb-audio: allow clock source validity interrupts
    - ALSA: usb-audio: Clean up mixer element list traverse
    - ALSA: usb-audio: Fix OOB access of mixer element list
    - xhci: Poll for U0 after disabling USB2 LPM
    - cifs/smb3: Fix data inconsistent when punch hole
    - cifs/smb3: Fix data inconsistent when zero file range
    - efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
    - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
    - ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram()
    - usb: gadget: udc: Potential Oops in error handling code
    - netfilter: ipset: fix unaligned atomic access
    - sched/core: Fix PI boosting between RT and DEADLINE tasks
    - net: alx: fix race condition in alx_remove
    - kbuild: improve cc-option to clean up all temporary files
    - blktrace: break out of blktrace setup on concurrent calls
    - ACPI: sysfs: Fix pm_profile_attr type
    - KVM: X86: Fix MSR range of APIC registers in X2APIC mode
    - mm/slab: use memzero_explicit() in kzfree()
    - ocfs2: load global_inode_alloc
    - ocfs2: fix value of OCFS2_INVALID_SLOT
    - ocfs2: fix panic on nfs server over ocfs2
    - arm64: perf: Report the PC value in REGS_ABI_32 mode
    - tracing: Fix event trigger to accept redundant spaces
    - drm/radeon: fix fb_div check in ni_init_smc_spll_table()
    - sunrpc: fixed rollback in rpc_gssd_dummy_populate()
    - SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
    - pNFS/flexfiles: Fix list corruption if the mirror count changes
    - NFSv4 fix CLOSE not waiting for direct IO compeletion
    - PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode
    - ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
    - Linux 4.4.229

  * Computer is frozen after suspend (LP: #1867983) // Xenial update: v4.4.229
    upstream stable release (LP: #1885932)
    - libata: Use per port sync for detach

 -- Ian May <ian.may@canonical.com>  Mon, 20 Jul 2020 14:24:05 -0500

linux (4.4.0-186.216) xenial; urgency=medium

  * xenial/linux: 4.4.0-186.216 -proposed tracker (LP: #1885514)

  * Xenial update: v4.4.228 upstream stable release (LP: #1884564)
    - ipv6: fix IPV6_ADDRFORM operation logic
    - vxlan: Avoid infinite loop when suppressing NS messages with invalid options
    - scsi: return correct blkprep status code in case scsi_init_io() fails.
    - net: phy: marvell: Limit 88m1101 autoneg errata to 88E1145 as well.
    - pwm: fsl-ftm: Use flat regmap cache
    - ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook
    - sched/fair: Don't NUMA balance for kthreads
    - ath9k_htc: Silence undersized packet warnings
    - x86_64: Fix jiffies ODR violation
    - x86/speculation: Prevent rogue cross-process SSBD shutdown
    - x86/reboot/quirks: Add MacBook6,1 reboot quirk
    - efi/efivars: Add missing kobject_put() in sysfs entry creation error path
    - ALSA: es1688: Add the missed snd_card_free()
    - ALSA: usb-audio: Fix inconsistent card PM state after resume
    - ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile()
    - ACPI: PM: Avoid using power resources if there are none for D0
    - cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages
    - nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
    - spi: bcm2835aux: Fix controller unregister order
    - ALSA: pcm: disallow linking stream to itself
    - x86/speculation: Change misspelled STIPB to STIBP
    - x86/speculation: Add support for STIBP always-on preferred mode
    - x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced
      IBRS.
    - x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches.
    - spi: dw: fix possible race condition
    - spi: dw: Fix controller unregister order
    - spi: No need to assign dummy value in spi_unregister_controller()
    - spi: Fix controller unregister order
    - spi: pxa2xx: Fix controller unregister order
    - spi: bcm2835: Fix controller unregister order
    - ovl: initialize error in ovl_copy_xattr
    - proc: Use new_inode not new_inode_pseudo
    - video: fbdev: w100fb: Fix a potential double free.
    - KVM: nSVM: leave ASID aside in copy_vmcb_control_area
    - KVM: nVMX: Consult only the "basic" exit reason when routing nested exit
    - KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts
    - ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx
    - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
    - ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb
    - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
    - Smack: slab-out-of-bounds in vsscanf
    - mm/slub: fix a memory leak in sysfs_slab_add()
    - fat: don't allow to mount if the FAT length == 0
    - can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
    - spi: dw: Zero DMA Tx and Rx configurations on stack
    - Bluetooth: Add SCO fallback for invalid LMP parameters error
    - kgdb: Prevent infinite recursive entries to the debugger
    - spi: dw: Enable interrupts in accordance with DMA xfer mode
    - clocksource: dw_apb_timer_of: Fix missing clockevent timers
    - btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
    - ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
    - net: vmxnet3: fix possible buffer overflow caused by bad DMA value in
      vmxnet3_get_rss()
    - staging: android: ion: use vmap instead of vm_map_ram
    - e1000: Distribute switch variables for initialization
    - media: dvb: return -EREMOTEIO on i2c transfer failure.
    - MIPS: Make sparse_init() using top-down allocation
    - netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
    - lib/mpi: Fix 64-bit MIPS build with Clang
    - net: lpc-enet: fix error return code in lpc_mii_init()
    - net: allwinner: Fix use correct return type for ndo_start_xmit()
    - powerpc/spufs: fix copy_to_user while atomic
    - mips: cm: Fix an invalid error code of INTVN_*_ERR
    - kgdb: Fix spurious true from in_dbg_master()
    - md: don't flush workqueue unconditionally in md_open
    - mwifiex: Fix memory corruption in dump_station
    - mips: Add udelay lpj numbers adjustment
    - x86/mm: Stop printing BRK addresses
    - m68k: mac: Don't call via_flush_cache() on Mac IIfx
    - macvlan: Skip loopback packets in RX handler
    - PCI: Don't disable decoding when mmio_always_on is set
    - MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe()
    - ixgbe: fix signed-integer-overflow warning
    - spi: dw: Return any value retrieved from the dma_transfer callback
    - cpuidle: Fix three reference count leaks
    - ima: Fix ima digest hash table key calculation
    - ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
    - Btrfs: fix unreplayable log after snapshot delete + parent dir fsync
    - btrfs: send: emit file capabilities after chown
    - btrfs: fix error handling when submitting direct I/O bio
    - ima: Directly assign the ima_default_policy pointer to ima_rules
    - PCI: Program MPS for RCiEP devices
    - e1000e: Relax condition to trigger reset for ME workaround
    - carl9170: remove P2P_GO support
    - media: go7007: fix a miss of snd_card_free
    - b43legacy: Fix case where channel status is corrupted
    - b43: Fix connection problem with WPA3
    - b43_legacy: Fix connection problem with WPA3
    - igb: Report speed and duplex as unknown when device is runtime suspended
    - power: vexpress: add suppress_bind_attrs to true
    - pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
    - sparc32: fix register window handling in genregs32_[gs]et()
    - kernel/cpu_pm: Fix uninitted local in cpu_pm
    - ARM: tegra: Correct PL310 Auxiliary Control Register initialization
    - drivers/macintosh: Fix memleak in windfarm_pm112 driver
    - kbuild: force to build vmlinux if CONFIG_MODVERSION=y
    - sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate
      registrations.
    - sunrpc: clean up properly in gss_mech_unregister()
    - w1: omap-hdq: cleanup to add missing newline for some dev_dbg
    - perf probe: Do not show the skipped events
    - perf symbols: Fix debuginfo search for Ubuntu
    - Linux 4.4.228

  * Update lockdown patches (LP: #1884159)
    - acpi: Disable ACPI table override if the kernel is locked down
    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
    - Revert "Restrict /dev/mem and /dev/kmem when module loading is restricted"
    - Revert "x86: Lock down IO port access when module security is enabled"
    - SAUCE: (efi-lockdown) Restrict /dev/{mem, kmem, port} when the kernel is
      locked down
    - Annotate module params that specify hardware parameters (eg. ioport)
    - Annotate hardware config module parameters in arch/x86/mm/
    - Annotate hardware config module parameters in drivers/char/ipmi/
    - Annotate hardware config module parameters in drivers/char/mwave/
    - Annotate hardware config module parameters in drivers/char/
    - Annotate hardware config module parameters in drivers/clocksource/
    - Annotate hardware config module parameters in drivers/cpufreq/
    - Annotate hardware config module parameters in drivers/gpio/
    - Annotate hardware config module parameters in drivers/i2c/
    - Annotate hardware config module parameters in drivers/input/
    - Annotate hardware config module parameters in drivers/isdn/
    - Annotate hardware config module parameters in drivers/media/
    - Annotate hardware config module parameters in drivers/misc/
    - Annotate hardware config module parameters in drivers/mmc/host/
    - Annotate hardware config module parameters in drivers/net/appletalk/
    - Annotate hardware config module parameters in drivers/net/arcnet/
    - Annotate hardware config module parameters in drivers/net/can/
    - Annotate hardware config module parameters in drivers/net/ethernet/
    - Annotate hardware config module parameters in drivers/net/hamradio/
    - Annotate hardware config module parameters in drivers/net/irda/
    - Annotate hardware config module parameters in drivers/net/wan/
    - Annotate hardware config module parameters in drivers/net/wireless/
    - Annotate hardware config module parameters in drivers/parport/
    - Annotate hardware config module parameters in drivers/pci/hotplug/
    - Annotate hardware config module parameters in drivers/pcmcia/
    - Annotate hardware config module parameters in drivers/scsi/
    - Annotate hardware config module parameters in drivers/staging/media/
    - Annotate hardware config module parameters in drivers/staging/speakup/
    - Annotate hardware config module parameters in drivers/staging/vme/
    - Annotate hardware config module parameters in drivers/tty/
    - Annotate hardware config module parameters in drivers/video/
    - Annotate hardware config module parameters in drivers/watchdog/
    - Annotate hardware config module parameters in fs/pstore/
    - Annotate hardware config module parameters in sound/drivers/
    - Annotate hardware config module parameters in sound/isa/
    - Annotate hardware config module parameters in sound/oss/
    - Annotate hardware config module parameters in sound/pci/
    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
      parameters (eg. ioport)
    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
      down
    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if the kernel is locked
      down
    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
    - efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
    - debugfs: prevent access to possibly dead file_operations at file open
    - debugfs: prevent access to removed files' private data
    - debugfs: add support for self-protecting attribute file fops
    - debugfs: unproxify integer attribute files
    - debugfs: unproxify files created through debugfs_create_bool()
    - debugfs: unproxify files created through debugfs_create_blob()
    - debugfs: unproxify files created through debugfs_create_u32_array()
    - debugfs: full_proxy_open(): free proxy on ->open() failure
    - debugfs: open_proxy_open(): avoid double fops release
    - SAUCE: (efi-lockdown) debugfs: Disallow use of debugfs files when the kernel
      is locked down

  * Xenial update: v4.4.227 upstream stable release (LP: #1883918)
    - scsi: scsi_devinfo: fixup string compare
    - usb: gadget: f_uac2: fix error handling in afunc_bind (again)
    - platform/x86: acer-wmi: setup accelerometer when ACPI device was found
    - esp6: fix memleak on error path in esp6_input
    - IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
    - ALSA: hda - No loopback on ALC299 codec
    - spi: dw: use "smp_mb()" to avoid sending spi data error
    - s390/ftrace: save traced function caller
    - ARC: Fix ICCM & DCCM runtime size checks
    - x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
    - net: bmac: Fix read of MAC address from ROM
    - net/ethernet/freescale: rework quiesce/activate for ucc_geth
    - net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
    - pppoe: only process PADT targeted at local interfaces
    - mmc: fix compilation of user API
    - slcan: Fix double-free on slcan_open() error path
    - slip: not call free_netdev before rtnl_unlock in slip_open
    - scsi: ufs: Release clock if DMA map fails
    - devinet: fix memleak in inetdev_init()
    - NFC: st21nfca: add missed kfree_skb() in an error path
    - vsock: fix timeout in vsock_accept()
    - l2tp: add sk_family checks to l2tp_validate_socket
    - l2tp: do not use inet_hash()/inet_unhash()
    - USB: serial: qcserial: add DW5816e QDL support
    - USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
    - USB: serial: option: add Telit LE910C1-EUX compositions
    - vt: keyboard: avoid signed integer overflow in k_ascii
    - staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
    - x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
    - x86/speculation: Add SRBDS vulnerability and mitigation documentation
    - x86/speculation: Add Ivy Bridge to affected list
    - iio: vcnl4000: Fix i2c swapped word reading.
    - uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly
      aligned
    - Linux 4.4.227

  * Xenial update: v4.4.226 upstream stable release (LP: #1883917)
    - ax25: fix setsockopt(SO_BINDTODEVICE)
    - net: revert "net: get rid of an signed integer overflow in
      ip_idents_reserve()"
    - sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and
      socket is closed
    - net/mlx5: Add command entry handling completion
    - net: sun: fix missing release regions in cas_init_one().
    - net/mlx4_core: fix a memory leak bug.
    - uapi: fix linux/if_pppol2tp.h userspace compilation errors
    - IB/cma: Fix reference count leak when no ipv4 addresses are set
    - cachefiles: Fix race between read_waiter and read_copier involving op->to_do
    - usb: gadget: legacy: fix redundant initialization warnings
    - cifs: Fix null pointer check in cifs_read
    - Input: usbtouchscreen - add support for BonXeon TP
    - Input: evdev - call input_flush_device() on release(), not flush()
    - Input: xpad - add custom init packet for Xbox One S controllers
    - Input: i8042 - add ThinkPad S230u to i8042 reset list
    - IB/qib: Call kobject_put() when kobject_init_and_add() fails
    - ALSA: hwdep: fix a left shifting 1 by 31 UB bug
    - ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
    - exec: Always set cap_ambient in cap_bprm_set_creds
    - fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
    - include/asm-generic/topology.h: guard cpumask_of_node() macro argument
    - iommu: Fix reference count leak in iommu_group_alloc.
    - parisc: Fix kernel panic in mem_init()
    - x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
    - xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
    - xfrm: fix a warning in xfrm_policy_insert_list
    - xfrm: fix a NULL-ptr deref in xfrm_local_error
    - vti4: eliminated some duplicate code.
    - ip_vti: receive ipip packet by calling ip_tunnel_rcv
    - netfilter: nft_reject_bridge: enable reject with bridge vlan
    - netfilter: ipset: Fix subcounter update skip
    - netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
    - qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
    - bonding: Fix reference count leak in bond_sysfs_slave_add.
    - netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
    - mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
    - genirq/generic_pending: Do not lose pending affinity update
    - usb: renesas_usbhs: gadget: fix spin_lock_init() for &uep->lock
    - mac80211: fix memory leak
    - net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
    - mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
    - asm-prototypes: Clear any CPP defines before declaring the functions
    - sc16is7xx: move label 'err_spi' to correct section
    - drm/msm: Fix possible null dereference on failure of get_pages()
    - printk: help pr_debug and pr_devel to optimize out arguments
    - scsi: zfcp: fix request object use-after-free in send path causing wrong
      traces
    - Linux 4.4.226

  * Xenial update: v4.4.225 upstream stable release (LP: #1883916)
    - igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
    - padata: Remove unused but set variables
    - padata: get_next is never NULL
    - padata: ensure the reorder timer callback runs on the correct CPU
    - padata: ensure padata_do_serial() runs on the correct CPU
    - evm: Check also if *tfm is an error pointer in init_desc()
    - fix multiplication overflow in copy_fdtable()
    - HID: multitouch: add eGalaxTouch P80H84 support
    - ceph: fix double unlock in handle_cap_export()
    - USB: core: Fix misleading driver bug report
    - platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
    - ARM: futex: Address build warning
    - media: Fix media_open() to clear filp->private_data in error leg
    - drivers/media/media-devnode: clear private_data before put_device()
    - media-devnode: add missing mutex lock in error handler
    - media-devnode: fix namespace mess
    - media-device: dynamically allocate struct media_devnode
    - media: fix use-after-free in cdev_put() when app exits after driver unbind
    - media: fix media devnode ioctl/syscall and unregister race
    - i2c: dev: switch from register_chrdev to cdev API
    - i2c: dev: don't start function name with 'return'
    - i2c: dev: use after free in detach
    - i2c-dev: don't get i2c adapter via i2c_dev
    - i2c: dev: Fix the race between the release of i2c_dev and cdev
    - padata: set cpu_index of unused CPUs to -1
    - sched/fair, cpumask: Export for_each_cpu_wrap()
    - padata: Replace delayed timer with immediate workqueue in padata_reorder
    - padata: initialize pd->cpu with effective cpumask
    - padata: purge get_cpu and reorder_via_wq from padata_do_serial
    - ALSA: pcm: fix incorrect hw_base increase
    - platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
    - libnvdimm/btt: Remove unnecessary code in btt_freelist_init
    - l2tp: lock socket before checking flags in connect()
    - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
    - l2tp: hold session while sending creation notifications
    - l2tp: take a reference on sessions used in genetlink handlers
    - l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
    - net: l2tp: export debug flags to UAPI
    - net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
    - net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
    - New kernel function to get IP overhead on a socket.
    - L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
    - l2tp: remove useless duplicate session detection in l2tp_netlink
    - l2tp: remove l2tp_session_find()
    - l2tp: define parameters of l2tp_session_get*() as "const"
    - l2tp: define parameters of l2tp_tunnel_find*() as "const"
    - l2tp: initialise session's refcount before making it reachable
    - l2tp: hold tunnel while looking up sessions in l2tp_netlink
    - l2tp: hold tunnel while processing genl delete command
    - l2tp: hold tunnel while handling genl tunnel updates
    - l2tp: hold tunnel while handling genl TUNNEL_GET commands
    - l2tp: hold tunnel used while creating sessions with netlink
    - l2tp: prevent creation of sessions on terminated tunnels
    - l2tp: fix l2tp_eth module loading
    - l2tp: don't register sessions in l2tp_session_create()
    - l2tp: initialise l2tp_eth sessions before registering them
    - l2tp: protect sock pointer of struct pppol2tp_session with RCU
    - l2tp: initialise PPP sessions before registering them
    - Revert "gfs2: Don't demote a glock until its revokes are written"
    - staging: iio: ad2s1210: Fix SPI reading
    - mei: release me_cl object reference
    - iio: sca3000: Remove an erroneous 'get_device()'
    - l2tp: device MTU setup, tunnel socket needs a lock
    - cpumask: Make for_each_cpu_wrap() available on UP as well
    - Linux 4.4.225

  * smpboot: don't call topology_sane() when Sub-NUMA-Clustering is enabled
    (LP: #1882478)
    - x86, sched: Allow topologies where NUMA nodes share an LLC

  * CVE-2020-11935
    - SAUCE: aufs: do not call i_readcount_inc()
    - SAUCE: aufs: bugfix, IMA i_readcount

  * CVE-2019-12380
    - efi/x86/Add missing error handling to old_memmap 1:1 mapping code

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 01 Jul 2020 00:39:42 -0400

linux (4.4.0-185.215) xenial; urgency=medium

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * CVE-2020-0543
    - UBUNTU/SAUCE: x86/speculation/srbds: do not try to turn mitigation off when
      not supported

  * Xenial update: 4.4.224 upstream stable release (LP: #1881356)
    - USB: serial: qcserial: Add DW5816e support
    - Revert "net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS"
    - dp83640: reverse arguments to list_add_tail
    - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
    - sch_sfq: validate silly quantum values
    - sch_choke: avoid potential panic in choke_reset()
    - enic: do not overwrite error code
    - ipv6: fix cleanup ordering for ip6_mr failure
    - binfmt_elf: move brk out of mmap when doing direct loader exec
    - x86/apm: Don't access __preempt_count with zeroed fs
    - Revert "IB/ipoib: Update broadcast object if PKey value was changed in index
      0"
    - USB: uas: add quirk for LaCie 2Big Quadra
    - USB: serial: garmin_gps: add sanity checking for data length
    - batman-adv: fix batadv_nc_random_weight_tq
    - scripts/decodecode: fix trapping instruction formatting
    - phy: micrel: Ensure interrupts are reenabled on resume
    - binfmt_elf: Do not move brk for INTERP-less ET_EXEC
    - ext4: add cond_resched() to ext4_protect_reserved_inode
    - blktrace: Fix potential deadlock between delete & sysfs ops
    - blktrace: fix unlocked access to init/start-stop/teardown
    - blktrace: fix trace mutex deadlock
    - ptp: do not explicitly set drvdata in ptp_clock_register()
    - ptp: use is_visible method to hide unused attributes
    - ptp: create "pins" together with the rest of attributes
    - chardev: add helper function to register char devs with a struct device
    - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
    - ptp: fix the race between the release of ptp_clock and cdev
    - ptp: free ptp device pin descriptors properly
    - net: handle no dst on skb in icmp6_send
    - net/sonic: Fix a resource leak in an error handling path in
      'jazz_sonic_probe()'
    - net: moxa: Fix a potential double 'free_irq()'
    - drop_monitor: work around gcc-10 stringop-overflow warning
    - scsi: sg: add sg_remove_request in sg_write
    - cifs: Check for timeout on Negotiate stage
    - cifs: Fix a race condition with cifs_echo_request
    - dmaengine: pch_dma.c: Avoid data race between probe and irq handler
    - dmaengine: mmp_tdma: Reset channel error on release
    - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
    - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
    - net: openvswitch: fix csum updates for MPLS actions
    - gre: do not keep the GRE header around in collect medata mode
    - mm/memory_hotplug.c: fix overflow in test_pages_in_a_zone()
    - scsi: qla2xxx: Avoid double completion of abort command
    - i40e: avoid NVM acquire deadlock during NVM update
    - net/mlx5: Fix driver load error flow when firmware is stuck
    - netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
    - IB/mlx4: Test return value of calls to ib_get_cached_pkey
    - pnp: Use list_for_each_entry() instead of open coding
    - gcc-10 warnings: fix low-hanging fruit
    - kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
    - Stop the ad-hoc games with -Wno-maybe-initialized
    - gcc-10: disable 'zero-length-bounds' warning for now
    - gcc-10: disable 'array-bounds' warning for now
    - gcc-10: disable 'stringop-overflow' warning for now
    - gcc-10: disable 'restrict' warning for now
    - blk-mq: sync the update nr_hw_queues with blk_mq_queue_tag_busy_iter
    - blk-mq: Allow blocking queue tag iter callbacks
    - x86/paravirt: Remove the unused irq_enable_sysexit pv op
    - gcc-10: avoid shadowing standard library 'free()' in crypto
    - net: fix a potential recursive NETDEV_FEAT_CHANGE
    - net: ipv4: really enforce backoff for redirects
    - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
    - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
    - ALSA: rawmidi: Initialize allocated buffers
    - ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
    - x86: Fix early boot crash on gcc-10, third try
    - exec: Move would_dump into flush_old_exec
    - usb: gadget: net2272: Fix a memory leak in an error handling path in
      'net2272_plat_probe()'
    - usb: gadget: audio: Fix a missing error return value in audio_bind()
    - usb: gadget: legacy: fix error return code in gncm_bind()
    - usb: gadget: legacy: fix error return code in cdc_bind()
    - ARM: dts: r8a7740: Add missing extal2 to CPG node
    - KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    - Makefile: disallow data races on gcc-10 as well
    - scsi: iscsi: Fix a potential deadlock in the timeout handler
    - Linux 4.4.224

  * upgrading to 4.15.0-99-generic breaks the sound and the trackpad
    (LP: #1875916) // Xenial update: 4.4.224 upstream stable release
    (LP: #1881356)
    - Revert "ALSA: hda/realtek: Fix pop noise on ALC225"

  * CVE-2020-10711
    - netlabel: cope with NULL catmap

  * CVE-2020-13143
    - USB: gadget: fix illegal array access in binding with UDC

  * ext2 build failure on 4.4.0-180.210 (LP: #1880213)
    - ext2: fix debug reference to ext2_xattr_cache

  * test_bpf of ubuntu_kernel_selftests.net ADT test failure with linux
    4.4.0-180.210 (LP: #1879752)
    - bpf, test: fix ld_abs + vlan push/pop stress test

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Mon, 08 Jun 2020 14:45:12 -0300

linux (4.4.0-184.214) xenial; urgency=medium

  * CVE-2020-0543
    - SAUCE: x86/cpu: Add a steppings field to struct x86_cpu_id
    - SAUCE: x86/cpu: Add 'table' argument to cpu_matches()
    - SAUCE: x86/speculation: Add Special Register Buffer Data Sampling (SRBDS)
      mitigation
    - SAUCE: x86/speculation: Add SRBDS vulnerability and mitigation documentation
    - SAUCE: x86/speculation: Add Ivy Bridge to affected list

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 03 Jun 2020 12:51:31 +0200

linux (4.4.0-181.211) xenial; urgency=medium

  * xenial/linux: 4.4.0-181.211 -proposed tracker (LP: #1881170)

  * CVE-2020-12769
    - spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls

  * I2C bus on Dell Edge Gateway stops working after upgrading to
    Ubuntu-4.4.0-180.210 (LP: #1881124)
    - SAUCE: Revert: Revert "ACPI / LPSS: allow to use specific PM domain during
      ->probe()"

 -- Khalid Elmously <khalid.elmously@canonical.com>  Fri, 29 May 2020 02:56:23 -0400

linux (4.4.0-180.210) xenial; urgency=medium

  * xenial/linux: 4.4.0-180.210 -proposed tracker (LP: #1878873)

  * Xenial update: 4.4.223 upstream stable release (LP: #1878232)
    - mwifiex: fix PCIe register information for 8997 chipset
    - drm/qxl: qxl_release use after free
    - drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
    - staging: rtl8192u: Fix crash due to pointers being "confusing"
    - usb: gadget: f_acm: Fix configfs attr name
    - usb: gadged: pch_udc: get rid of redundant assignments
    - usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
    - usb: gadget: udc: core: don't starve DMA resources
    - MIPS: Fix macro typo
    - MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
    - MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
    - MIPS: smp-cps: Stop printing EJTAG exceptions to UART
    - MIPS: scall: Handle seccomp filters which redirect syscalls
    - MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
    - MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
    - MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
    - MIPS: BMIPS: Pretty print BMIPS5200 processor name
    - MIPS: Fix HTW config on XPA kernel without LPA enabled
    - MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
    - MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
    - MIPS: Fix BC1{EQ,NE}Z return offset calculation
    - MIPS: perf: Fix I6400 event numbers
    - MIPS: KVM: Fix translation of MFC0 ErrCtl
    - MIPS: SMP: Update cpu_foreign_map on CPU disable
    - MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
    - MIPS: Octeon: Off by one in octeon_irq_gpio_map()
    - bpf, mips: fix off-by-one in ctx offset allocation
    - MIPS: RM7000: Double locking bug in rm7k_tc_disable()
    - MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
    - mips/panic: replace smp_send_stop() with kdump friendly version in panic
      path
    - ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
    - ARM: imx: select SRC for i.MX7
    - ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
    - ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
    - ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
    - ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
    - ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
    - ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
    - ARM: dts: kirkwood: use unique machine name for ds112
    - ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
    - ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
    - perf/x86: Fix filter_events() bug with event mappings
    - x86/LDT: Print the real LDT base address
    - x86/apic/uv: Silence a shift wrapping warning
    - ALSA: fm801: explicitly free IRQ line
    - ALSA: fm801: propagate TUNER_ONLY bit when autodetected
    - ALSA: fm801: detect FM-only card earlier
    - netfilter: nfnetlink: use original skbuff when acking batches
    - xfrm: fix crash in XFRM_MSG_GETSA netlink handler
    - mwifiex: fix IBSS data path issue.
    - mwifiex: add missing check for PCIe8997 chipset
    - iwlwifi: set max firmware version of 7265 to 17
    - Bluetooth: btmrvl: fix hung task warning dump
    - dccp: limit sk_filter trim to payload
    - net/mlx4_core: Do not BUG_ON during reset when PCI is offline
    - mlxsw: pci: Correctly determine if descriptor queue is full
    - PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
    - alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not
      IORESOURCE_IO
    - vfio/pci: Allow VPD short read
    - mlxsw: Treat local port 64 as valid
    - IB/mlx4: Initialize hop_limit when creating address handle
    - GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
    - powerpc/pci/of: Parse unassigned resources
    - firmware: actually return NULL on failed request_firmware_nowait()
    - c8sectpfe: Rework firmware loading mechanism
    - net/mlx5: Avoid passing dma address 0 to firmware
    - IB/mlx5: Fix RC transport send queue overhead computation
    - net/mlx5: Make command timeout way shorter
    - IB/mlx5: Fix FW version diaplay in sysfs
    - net/mlx5e: Fix MLX5E_100BASE_T define
    - net/mlx5: Fix the size of modify QP mailbox
    - net/mlx5: Fix masking of reserved bits in XRCD number
    - net/mlx5e: Fix blue flame quota logic
    - net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in
      mlx5_wq_ll_create
    - net/mlx5: Avoid calling sleeping function by the health poll thread
    - net/mlx5: Fix wait_vital for VFs and remove fixed sleep
    - net/mlx5: Fix potential deadlock in command mode change
    - net/mlx5: Add timeout handle to commands with callback
    - net/mlx5: Fix pci error recovery flow
    - net/mlx5e: Copy all L2 headers into inline segment
    - net_sched: keep backlog updated with qlen
    - sch_drr: update backlog as well
    - sch_hfsc: always keep backlog updated
    - sch_prio: update backlog as well
    - sch_qfq: keep backlog updated with qlen
    - sch_sfb: keep backlog updated with qlen
    - sch_tbf: update backlog as well
    - btrfs: cleaner_kthread() doesn't need explicit freeze
    - irda: Free skb on irda_accept error path.
    - phy: fix device reference leaks
    - bonding: prevent out of bound accesses
    - mtd: nand: fix ONFI parameter page layout
    - ath10k: free cached fw bin contents when get board id fails
    - xprtrdma: checking for NULL instead of IS_ERR()
    - xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
    - xprtrdma: xprt_rdma_free() must not release backchannel reqs
    - xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
    - RDMA/cxgb3: device driver frees DMA memory with different size
    - mlxsw: spectrum: Don't forward packets when STP state is DISABLED
    - mlxsw: spectrum: Disable learning according to STP state
    - mlxsw: spectrum: Don't count internal TX header bytes to stats
    - mlxsw: spectrum: Indicate support for autonegotiation
    - mlxsw: spectrum: Fix misuse of hard_header_len
    - net: tcp_memcontrol: properly detect ancestor socket pressure
    - tcp: do not set rtt_min to 1
    - RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting
      t_sock
    - net: ipv6: tcp reset, icmp need to consider L3 domain
    - batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
    - batman-adv: replace WARN with rate limited output on non-existing VLAN
    - tty: serial: msm: Support more bauds
    - serial: samsung: Fix possible out of bounds access on non-DT platform
    - isa: Call isa_bus_init before dependent ISA bus drivers register
    - Btrfs: clean up an error code in btrfs_init_space_info()
    - Input: gpio-keys - fix check for disabling unsupported keys
    - Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
    - net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
    - xfrm_user: propagate sec ctx allocation errors
    - xfrm: Fix memory leak of aead algorithm name
    - mac80211: fix mgmt-tx abort cookie and leak
    - mac80211: TDLS: always downgrade invalid chandefs
    - mac80211: TDLS: change BW calculation for WIDER_BW peers
    - mac80211: Fix BW upgrade for TDLS peers
    - NFS: Fix an LOCK/OPEN race when unlinking an open file
    - net: get rid of an signed integer overflow in ip_idents_reserve()
    - mtd: nand: denali: add missing nand_release() call in denali_remove()
    - ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
    - ASoC: tegra_alc5632: check return value
    - ASoC: fsl_ssi: mark SACNT register volatile
    - Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
    - mmc: sdhci: restore behavior when setting VDD via external regulator
    - mmc: sd: limit SD card power limit according to cards capabilities
    - mmc: debugfs: correct wrong voltage value
    - mmc: block: return error on failed mmc_blk_get()
    - clk: rockchip: Revert "clk: rockchip: reset init state before mmc card
      initialization"
    - mmc: dw_mmc: rockchip: Set the drive phase properly
    - mmc: moxart: fix wait_for_completion_interruptible_timeout return variable
      type
    - mmc: sdhci: Fix regression setting power on Trats2 board
    - perf tools: Fix perf regs mask generation
    - powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
    - sctp: fix the transports round robin issue when init is retransmitted
    - sunrpc: Update RPCBIND_MAXNETIDLEN
    - NFC: nci: memory leak in nci_core_conn_create()
    - net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
    - net: phy: Fix phy_mac_interrupt()
    - net: phy: bcm7xxx: Fix shadow mode 2 disabling
    - of_mdio: fix node leak in of_phy_register_fixed_link error path
    - phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
    - net: dsa: slave: fix of-node leak and phy priority
    - drivers: net: cpsw: don't ignore phy-mode if phy-handle is used
    - iommu/dma: Respect IOMMU aperture when allocating
    - mdio-sun4i: oops in error handling in probe
    - iio:ad7797: Use correct attribute_group
    - selftests/ipc: Fix test failure seen after initial test run
    - wimax/i2400m: Fix potential urb refcnt leak
    - cifs: protect updating server->dstaddr with a spinlock
    - scripts/config: allow colons in option strings for sed
    - lib/mpi: Fix building for powerpc with clang
    - net: bcmgenet: suppress warnings on failed Rx SKB allocations
    - net: systemport: suppress warnings on failed Rx SKB allocations
    - rc: allow rc modules to be loaded if rc-main is not a module
    - lirc_imon: do not leave imon_probe() with mutex held
    - am437x-vpfe: fix an uninitialized variable bug
    - cx23885: uninitialized variable in cx23885_av_work_handler()
    - ath9k_htc: check for underflow in ath9k_htc_rx_msg()
    - VFIO: platform: reset: fix a warning message condition
    - net: moxa: fix an error code
    - mfd: lp8788-irq: Uninitialized variable in irq handler
    - ethernet: micrel: fix some error codes
    - power: ipaq-micro-battery: freeing the wrong variable
    - i40e: fix an uninitialized variable bug
    - qede: uninitialized variable in qede_start_xmit()
    - qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
    - qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
    - target: Fix a memory leak in target_dev_lba_map_store()
    - memory/tegra: Add number of TLB lines for Tegra124
    - pinctrl: bcm2835: Fix memory leak in error path
    - be2net: Don't leak iomapped memory on removal.
    - ipv4: Fix memory leak in exception case for splitting tries
    - flow_dissector: Check for IP fragmentation even if not using IPv4 address
    - ipv4: fix checksum annotation in udp4_csum_init
    - ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()
    - ipv4: accept u8 in IP_TOS ancillary data
    - net: vrf: Fix dev refcnt leak due to IPv6 prefix route
    - ipv6: fix checksum annotation in udp6_csum_init
    - ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()
    - ipv6: add missing netconf notif when 'all' is updated
    - net: ipv6: Fix processing of RAs in presence of VRF
    - netfilter: nf_tables: fix a wrong check to skip the inactive rules
    - netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled
    - netfilter: nf_tables: destroy the set if fail to add transaction
    - netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it
    - udp: restore UDPlite many-cast delivery
    - clk: st: avoid uninitialized variable use
    - clk: gpio: handle error codes for of_clk_get_parent_count()
    - clk: ti: omap3+: dpll: use non-locking version of clk_get_rate
    - clk: multiplier: Prevent the multiplier from under / over flowing
    - clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit
    - clk: xgene: Don't call __pa on ioremaped address
    - cls_bpf: reset class and reuse major in da
    - arm64: bpf: jit JMP_JSET_{X,K}
    - bpf, trace: check event type in bpf_perf_event_read
    - bpf: fix map not being uncharged during map creation failure
    - net/mlx4_core: Fix potential corruption in counters database
    - net/mlx4_core: Fix access to uninitialized index
    - net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
    - net/mlx4_core: Check device state before unregistering it
    - net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW
      spec
    - net/mlx4_en: Process all completions in RX rings after port goes up
    - net/mlx4_core: Do not access comm channel if it has not yet been initialized
    - net/mlx4_en: Fix potential deadlock in port statistics flow
    - net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to
      device managed flow steering
    - net/mlx4_core: Fix QUERY FUNC CAP flags
    - mlxsw: switchx2: Fix misuse of hard_header_len
    - mlxsw: switchx2: Fix ethernet port initialization
    - sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
    - net_sched: flower: Avoid dissection of unmasked keys
    - pkt_sched: fq: use proper locking in fq_dump_stats()
    - sched/preempt: Fix preempt_count manipulations
    - power: bq27xxx: fix reading for bq27000 and bq27010
    - power: bq27xxx: fix register numbers of bq27500
    - power: test_power: correctly handle empty writes
    - power: bq27xxx_battery: Fix bq27541 AveragePower register address
    - power_supply: tps65217-charger: Fix NULL deref during property export
    - net: vrf: Fix dst reference counting
    - net: Don't delete routes in different VRFs
    - vti6: fix input path
    - ipv4: Fix table id reference in fib_sync_down_addr
    - mlx4: do not call napi_schedule() without care
    - xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
    - ALSA: fm801: Initialize chip after IRQ handler is registered
    - bonding: fix length of actor system
    - MIPS: perf: Remove incorrect odd/even counter handling for I6400
    - Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
    - net: dsa: mv88e6xxx: unlock DSA and CPU ports
    - gfs2: fix flock panic issue
    - blk-mq: fix undefined behaviour in order_to_size()
    - dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
    - dmaengine: edma: Add probe callback to edma_tptc_driver
    - openvswitch: update checksum in {push,pop}_mpls
    - cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
    - net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
    - net: bcmgenet: device stats are unsigned long
    - gre: do not assign header_ops in collect metadata mode
    - gre: build header correctly for collect metadata tunnels
    - gre: reject GUE and FOU in collect metadata mode
    - sfc: fix potential stack corruption from running past stat bitmask
    - sfc: clear napi_hash state when copying channels
    - net: bcmsysport: Device stats are unsigned long
    - cxgbi: fix uninitialized flowi6
    - net: macb: add missing free_netdev() on error in macb_probe()
    - macvtap: segmented packet is consumed
    - tipc: fix the error handling in tipc_udp_enable()
    - net: icmp6_send should use dst dev to determine L3 domain
    - et131x: Fix logical vs bitwise check in et131x_tx_timeout()
    - net: ethernet: stmmac: dwmac-sti: fix probe error path
    - rtnl: reset calcit fptr in rtnl_unregister()
    - net: ethernet: stmmac: dwmac-rk: fix probe error path
    - fq_codel: return non zero qlen in class dumps
    - net: ethernet: stmmac: dwmac-generic: fix probe error path
    - bnxt: add a missing rcu synchronization
    - qdisc: fix a module refcount leak in qdisc_create_dflt()
    - net: axienet: Fix return value check in axienet_probe()
    - bnxt_en: Remove locking around txr->dev_state
    - net: ethernet: davinci_emac: Fix devioctl while in fixed link
    - net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
    - net: ethernet: ti: cpsw: fix device and of_node leaks
    - net: ethernet: ti: cpsw: fix secondary-emac probe error path
    - net: hns: fix device reference leaks
    - net: bridge: don't increment tx_dropped in br_do_proxy_arp
    - net: dsa: mv88e6xxx: enable SA learning on DSA ports
    - net: ehea: avoid null pointer dereference
    - l2tp: fix use-after-free during module unload
    - hwrng: exynos - Disable runtime PM on driver unbind
    - net: icmp_route_lookup should use rt dev to determine L3 domain
    - net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
    - net: macb: replace macb_writel() call by queue_writel() to update queue ISR
    - ravb: Add missing free_irq() call to ravb_close()
    - mvpp2: use correct size for memset
    - net: vxlan: lwt: Fix vxlan local traffic.
    - net: ethoc: Fix early error paths
    - net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
    - regulator: core: Rely on regulator_dev_release to free constraints
    - net: dsa: mv88e6xxx: fix port VLAN maps
    - at803x: fix reset handling
    - cxl: Fix DAR check & use REGION_ID instead of opencoding
    - net: ethernet: davinci_emac: Fix platform_data overwrite
    - ata: sata_dwc_460ex: remove incorrect locking
    - pinctrl: tegra: Correctly check the supported configuration
    - brcmfmac: add fallback for devices that do not report per-chain values
    - brcmfmac: restore stopping netdev queue when bus clogs up
    - bridge: Fix problems around fdb entries pointing to the bridge device
    - bna: add missing per queue ethtool stat
    - net: skbuff: Remove errornous length validation in skb_vlan_pop()
    - net: ep93xx_eth: Do not crash unloading module
    - macvlan: Fix potential use-after free for broadcasts
    - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
    - ALSA: hda: Match both PCI ID and SSID for driver blacklist
    - mac80211: add ieee80211_is_any_nullfunc()
    - Linux 4.4.223

  * Xenial update: 4.4.222 upstream stable release (LP: #1878246)
    - ext4: fix special inode number checks in __ext4_iget()
    - drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
    - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
    - PM: ACPI: Output correct message on target power state
    - RDMA/mlx4: Initialize ib_spec on the stack
    - vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
    - ALSA: opti9xx: shut up gcc-10 range warning
    - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
    - dmaengine: dmatest: Fix iteration non-stop logic
    - i2c: designware-pci: use IRQF_COND_SUSPEND flag
    - perf hists: Fix HISTC_MEM_DCACHELINE width setting
    - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
    - perf/x86: Fix uninitialized value usage
    - exynos4-is: fix a format string bug
    - ASoC: wm8960: Fix WM8960_SYSCLK_PLL mode
    - ASoC: imx-spdif: Fix crash on suspend
    - ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
    - selinux: properly handle multiple messages in selinux_netlink_send()
    - Linux 4.4.222

  * Xenial update: 4.4.221 upstream stable release (LP: #1878098)
    - ext4: fix extent_status fragmentation for plain files
    - ALSA: hda - Fix incorrect usage of IS_REACHABLE()
    - net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
    - net: ipv4: avoid unused variable warning for sysctl
    - crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash'
      static
    - vti4: removed duplicate log message.
    - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
    - ceph: return ceph_mdsc_do_request() errors from __get_parent()
    - ceph: don't skip updating wanted caps when cap is stale
    - pwm: rcar: Fix late Runtime PM enablement
    - scsi: iscsi: Report unbind session event when the target has been removed
    - ASoC: Intel: atom: Take the drv->lock mutex before calling
      sst_send_slot_map()
    - kernel/gcov/fs.c: gcov_seq_next() should increase position index
    - ipc/util.c: sysvipc_find_ipc() should increase position index
    - s390/cio: avoid duplicated 'ADD' uevents
    - pwm: renesas-tpu: Fix late Runtime PM enablement
    - pwm: bcm2835: Dynamically allocate base
    - ipv6: fix restrict IPV6_ADDRFORM operation
    - macvlan: fix null dereference in macvlan_device_event()
    - net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
    - net/x25: Fix x25_neigh refcnt leak when receiving frame
    - tcp: cache line align MAX_TCP_HEADER
    - team: fix hang in team_mode_get()
    - xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
    - ALSA: hda: Remove ASUS ROG Zenith from the blacklist
    - iio: xilinx-xadc: Fix ADC-B powerdown
    - iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
    - iio: xilinx-xadc: Fix sequencer configuration for aux channels in
      simultaneous mode
    - fs/namespace.c: fix mountpoint reference counter race
    - USB: sisusbvga: Change port variable from signed to unsigned
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70
      RGB RAPIDFIRE
    - drivers: usb: core: Don't disable irqs in usb_sg_wait() during URB submit.
    - drivers: usb: core: Minimize irq disabling in usb_sg_cancel()
    - USB: core: Fix free-while-in-use bug in the USB S-Glibrary
    - USB: hub: Fix handling of connect changes during sleep
    - ALSA: usx2y: Fix potential NULL dereference
    - ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
    - ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
    - KVM: Check validity of resolved slot when searching memslots
    - KVM: VMX: Enable machine check support for 32bit targets
    - tty: hvc: fix buffer overflow during hvc_alloc().
    - tty: rocket, avoid OOB access
    - usb-storage: Add unusual_devs entry for JMicron JMS566
    - audit: check the length of userspace generated audit records
    - ASoC: dapm: fixup dapm kcontrol widget
    - ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
    - staging: comedi: dt2815: fix writing hi byte of analog output
    - staging: comedi: Fix comedi_device refcnt leak in comedi_open
    - staging: vt6656: Fix drivers TBTT timing counter.
    - staging: vt6656: Power save stop wake_up_count wrap around.
    - UAS: no use logging any details in case of ENODEV
    - UAS: fix deadlock in error handling and PM flushing work
    - usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
    - remoteproc: Fix wrong rvring index computation
    - sctp: use right member as the param of list_for_each_entry
    - fuse: fix possibly missed wake-up after abort
    - mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
    - usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
    - net/cxgb4: Check the return from t4_query_params properly
    - perf/core: fix parent pid/tid in task exit events
    - bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
    - scsi: target: fix PR IN / READ FULL STATUS for FC
    - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    - ext4: convert BUG_ON's to WARN_ON's in mballoc.c
    - ext4: avoid declaring fs inconsistent due to invalid file handles
    - ext4: protect journal inode's blocks using block_validity
    - ext4: don't perform block validity checks on the journal inode
    - ext4: fix block validity checks for journal inodes using indirect blocks
    - ext4: unsigned int compared against zero
    - propagate_one(): mnt_set_mountpoint() needs mount_lock
    - Linux 4.4.221

  * Xenial update: 4.4.220 upstream stable release (LP: #1875905)
    - bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
    - net: vxge: fix wrong __VA_ARGS__ usage
    - qlcnic: Fix bad kzalloc null test
    - i2c: st: fix missing struct parameter description
    - irqchip/versatile-fpga: Handle chained IRQs properly
    - selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
    - libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
    - gfs2: Don't demote a glock until its revokes are written
    - x86/boot: Use unsigned comparison for addresses
    - locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
    - btrfs: remove a BUG_ON() from merge_reloc_roots()
    - btrfs: track reloc roots based on their commit root bytenr
    - misc: rtsx: set correct pcr_ops for rts522A
    - ASoC: fix regwmask
    - ASoC: dapm: connect virtual mux with default value
    - ASoC: dpcm: allow start or stop during pause for backend
    - ASoC: topology: use name_prefix for new kcontrol
    - usb: gadget: f_fs: Fix use after free issue as part of queue failure
    - usb: gadget: composite: Inform controller driver of self-powered
    - ALSA: usb-audio: Add mixer workaround for TRX40 and co
    - ALSA: hda: Add driver blacklist
    - ALSA: hda: Fix potential access overflow in beep helper
    - ALSA: ice1724: Fix invalid access for enumerated ctl items
    - ALSA: pcm: oss: Fix regression by buffer overflow fix
    - acpi/x86: ignore unspecified bit positions in the ACPI global lock field
    - thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
    - irqchip/versatile-fpga: Apply clear-mask earlier
    - MIPS: OCTEON: irq: Fix potential NULL pointer dereference
    - ath9k: Handle txpower changes even when TPC is disabled
    - signal: Extend exec_id to 64bits
    - x86/entry/32: Add missing ASM_CLAC to general_protection entry
    - KVM: x86: Allocate new rmap and large page tracking when moving memslot
    - crypto: mxs-dcp - fix scatterlist linearization for hash
    - futex: futex_wake_op, do not fail on invalid op
    - xen-netfront: Rework the fix for Rx stall during OOM and network stress
    - ALSA: hda: Initialize power_state field properly
    - Btrfs: incremental send, fix invalid memory access
    - IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush
    - scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
    - arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
    - ext4: fix a data race at inode->i_blocks
    - ocfs2: no need try to truncate file beyond i_size
    - s390/diag: fix display of diagnose call statistics
    - Input: i8042 - add Acer Aspire 5738z to nomux list
    - kmod: make request_module() return an error when autoloading is disabled
    - hfsplus: fix crash and filesystem corruption when deleting files
    - powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
    - Btrfs: fix crash during unmount due to race with delayed inode workers
    - drm/dp_mst: Fix clearing payload state on topology disable
    - ipmi: fix hung processes in __get_guid()
    - powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
    - misc: echo: Remove unnecessary parentheses and simplify check for zero
    - mfd: dln2: Fix sanity checking for endpoints
    - net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
    - net: ipv6: do not consider routes via gateways for anycast address check
    - scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
    - jbd2: improve comments about freeing data buffers whose page mapping is NULL
    - ext4: fix incorrect group count in ext4_fill_super error message
    - ext4: fix incorrect inodes per group in error message
    - ASoC: Intel: mrfld: fix incorrect check on p->sink
    - ASoC: Intel: mrfld: return error codes when an error occurs
    - ALSA: usb-audio: Don't override ignore_ctl_error value from the map
    - mac80211_hwsim: Use kstrndup() in place of kasprintf()
    - ext4: do not zeroout extents beyond i_disksize
    - dm flakey: check for null arg_name in parse_features()
    - kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
    - x86/mitigations: Clear CPU buffers on the SYSCALL fast path
    - tracing: Fix the race between registering 'snapshot' event trigger and
      triggering 'snapshot' operation
    - scsi: sg: add sg_remove_request in sg_common_write
    - ALSA: hda: Don't release card at firmware loading error
    - video: fbdev: sis: Remove unnecessary parentheses and commented code
    - drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem
    - wil6210: increase firmware ready timeout
    - wil6210: fix temperature debugfs
    - scsi: ufs: ufs-qcom: remove broken hci version quirk
    - wil6210: rate limit wil_rx_refill error
    - rtc: pm8xxx: Fix issue in RTC write path
    - soc: qcom: smem: Use le32_to_cpu for comparison
    - of: fix missing kobject init for !SYSFS && OF_DYNAMIC config
    - of: unittest: kmemleak in of_unittest_platform_populate()
    - clk: at91: usb: continue if clk_hw_round_rate() return zero
    - clk: tegra: Fix Tegra PMC clock out parents
    - NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
    - ext4: do not commit super on read-only bdev
    - percpu_counter: fix a data race at vm_committed_as
    - compiler.h: fix error in BUILD_BUG_ON() reporting
    - NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
    - ext2: fix empty body warnings when -Wextra is used
    - iommu/amd: Fix the configuration of GCR3 table root pointer
    - fbdev: potential information leak in do_fb_ioctl()
    - tty: evh_bytechan: Fix out of bounds accesses
    - locktorture: Print ratio of acquisitions, not failures
    - mtd: lpddr: Fix a double free in probe()
    - mtd: phram: fix a double free issue in error path
    - x86/CPU: Add native CPUID variants returning a single datum
    - x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax)
    - x86/vdso: Fix lsl operand order
    - Linux 4.4.220

  * Panic on suspend/resume Kernel panic - not syncing: stack-protector: Kernel
    stack is corrupted in: sata_pmp_eh_recover+0xa2b/0xa40 (LP: #1821434) //
    Xenial update: 4.4.220 upstream stable release (LP: #1875905)
    - libata: Return correct status in sata_pmp_eh_recover_pm() when
      ATA_DFLAG_DETACH is set

  * psock_tpacket from the net test in ubuntu_kernel_selftests failed on KVM
    kernels (LP: #1812176)
    - selftests/net: skip psock_tpacket test if KALLSYMS was not enabled

  * tunnels over IPv6 are unencrypted when using IPsec (LP: #1876982) //
    CVE-2020-1749
    - net: ipv6: add net argument to ip6_dst_lookup_flow
    - net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup

  * Bionic ubuntu ethtool doesn't check ring parameters boundaries
    (LP: #1874444)
    - ethtool: Ensure new ring parameters are within bounds during SRINGPARAM

  * Improve TSC refinement (and calibration) reliability (LP: #1877858)
    - x86/tsc: Make calibration refinement more robust

  * Do not treat unresolved test case in ftrace from ubuntu_kernel_selftests as
    failure (LP: #1877958)
    - ftrace/selftest: make unresolved cases cause failure if --fail-unresolved
      set

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 15 May 2020 18:03:36 +0200

linux (4.4.0-179.209) xenial; urgency=medium

  * xenial/linux: 4.4.0-179.209 -proposed tracker (LP: #1874804)

  * Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
    - [Packaging] add support to compile/run selftests

  * getitimer returns it_value=0 erroneously (LP: #1349028)
    - [Config] CONTEXT_TRACKING_FORCE policy should be unset

  * CVE-2020-11608
    - media: ov519: add missing endpoint sanity checks

  * CVE-2019-19060
    - iio: imu: adis16400: release allocated memory on failure

  * Xenial update: 4.4.219 upstream stable release (LP: #1874045)
    - drm/bochs: downgrade pci_request_region failure from error to warning
    - ipv4: fix a RCU-list lock in fib_triestat_seq_show
    - net, ip_tunnel: fix interface lookup with no key
    - sctp: fix possibly using a bad saddr with a given dst
    - l2tp: Correctly return -EBADF from pppol2tp_getname.
    - net: l2tp: Make l2tp_ip6 namespace aware
    - l2tp: fix race in l2tp_recv_common()
    - l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
    - l2tp: fix duplicate session creation
    - l2tp: Refactor the codes with existing macros instead of literal number
    - l2tp: ensure sessions are freed after their PPPOL2TP socket
    - l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()
    - usb: gadget: uac2: Drop unused device qualifier descriptor
    - usb: gadget: printer: Drop unused device qualifier descriptor
    - padata: always acquire cpu_hotplug_lock before pinst->lock
    - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
    - net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting
    - random: always use batched entropy for get_random_u{32,64}
    - tools/accounting/getdelays.c: fix netlink attribute length
    - power: supply: axp288_charger: Fix unchecked return value
    - ASoC: jz4740-i2s: Fix divider written at incorrect offset in register
    - IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
    - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
    - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
    - clk: qcom: rcg: Return failure for RCG update
    - drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()
    - Linux 4.4.219

  * Xenial update: 4.4.218 upstream stable release (LP: #1873852)
    - spi: qup: call spi_qup_pm_resume_runtime before suspending
    - powerpc: Include .BTF section
    - ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
    - spi/zynqmp: remove entry that causes a cs glitch
    - drm/exynos: dsi: propagate error value and silence meaningless warning
    - drm/exynos: dsi: fix workaround for the legacy clock name
    - altera-stapl: altera_get_note: prevent write beyond end of 'key'
    - USB: Disable LPM on WD19's Realtek Hub
    - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
    - USB: serial: option: add ME910G1 ECM composition 0x110b
    - usb: host: xhci-plat: add a shutdown
    - USB: serial: pl2303: add device-id for HP LD381
    - ALSA: line6: Fix endless MIDI read loop
    - ALSA: seq: virmidi: Fix running status after receiving sysex
    - ALSA: seq: oss: Fix running status after receiving sysex
    - ALSA: pcm: oss: Avoid plugin buffer overflow
    - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
    - staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
    - staging/speakup: fix get_word non-space look-ahead
    - intel_th: Fix user-visible error codes
    - rtc: max8907: add missing select REGMAP_IRQ
    - memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
    - mm: slub: be more careful about the double cmpxchg of freelist
    - mm, slub: prevent kmalloc_node crashes and memory leaks
    - x86/mm: split vmalloc_sync_all()
    - USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
    - USB: cdc-acm: fix rounding error in TIOCSSERIAL
    - kbuild: Disable -Wpointer-to-enum-cast
    - futex: Fix inode life-time issue
    - futex: Unbreak futex hashing
    - arm64: smp: fix smp_send_stop() behaviour
    - Revert "drm/dp_mst: Skip validating ports during destruction, just ref"
    - hsr: fix general protection fault in hsr_addr_is_self()
    - net: dsa: Fix duplicate frames flooded by learning
    - net_sched: cls_route: remove the right filter from hashtable
    - net_sched: keep alloc_hash updated after hash allocation
    - NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
    - slcan: not call free_netdev before rtnl_unlock in slcan_open
    - vxlan: check return value of gro_cells_init()
    - hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
    - hsr: add restart routine into hsr_get_node_list()
    - hsr: set .netnsok flag
    - vhost: Check docket sk_family instead of call getname
    - IB/ipoib: Do not warn if IPoIB debugfs doesn't exist
    - uapi glibc compat: fix outer guard of net device flags enum
    - KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr
    - drivers/hwspinlock: use correct radix tree API
    - net: ipv4: don't let PMTU updates increase route MTU
    - cpupower: avoid multiple definition with gcc -fno-common
    - dt-bindings: net: FMan erratum A050385
    - scsi: ipr: Fix softlockup when rescanning devices in petitboot
    - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
    - sxgbe: Fix off by one in samsung driver strncpy size arg
    - i2c: hix5hd2: add missed clk_disable_unprepare in remove
    - perf probe: Do not depend on dwfl_module_addrsym()
    - scripts/dtc: Remove redundant YYLOC global declaration
    - scsi: sd: Fix optimal I/O size for devices that change reported values
    - mac80211: mark station unauthorized before key removal
    - genirq: Fix reference leaks on irq affinity notifiers
    - vti[6]: fix packet tx through bpf_redirect() in XinY cases
    - xfrm: fix uctx len check in verify_sec_ctx_len
    - xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
    - xfrm: policy: Fix doulbe free in xfrm_policy_timer
    - vti6: Fix memory leak of skb if input policy check fails
    - tools: Let O= makes handle a relative path with -C option
    - USB: serial: option: add support for ASKEY WWHC050
    - USB: serial: option: add BroadMobi BM806U
    - USB: serial: option: add Wistron Neweb D19Q1
    - USB: cdc-acm: restore capability check order
    - USB: serial: io_edgeport: fix slab-out-of-bounds read in
      edge_interrupt_callback
    - usb: musb: fix crash with highmen PIO and usbmon
    - media: flexcop-usb: fix endpoint sanity check
    - media: usbtv: fix control-message timeouts
    - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
    - staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
    - libfs: fix infoleak in simple_attr_read()
    - media: ov519: add missing endpoint sanity checks
    - media: dib0700: fix rc endpoint lookup
    - media: stv06xx: add missing descriptor sanity checks
    - media: xirlink_cit: add missing descriptor sanity checks
    - vt: selection, introduce vc_is_sel
    - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
    - vt: switch vt_dont_switch to bool
    - vt: vt_ioctl: remove unnecessary console allocation checks
    - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
    - locking/atomic, kref: Add kref_read()
    - vt: vt_ioctl: fix use-after-free in vt_in_use()
    - bpf: Explicitly memset the bpf_attr structure
    - net: ks8851-ml: Fix IO operations, again
    - perf map: Fix off by one in strncpy() size argument
    - Linux 4.4.218

  * Pop sound from build-in speaker during cold boot and resume from S3
    (LP: #1866357) // Xenial update: 4.4.218 upstream stable release
    (LP: #1873852)
    - ALSA: hda/realtek: Fix pop noise on ALC225

  * CVE-2020-11494
    - slcan: Don't transmit uninitialized stack data in padding

  * add_key05 from ubuntu_ltp_syscalls failed (LP: #1869644)
    - KEYS: reaching the keys quotas correctly

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 24 Apr 2020 19:06:47 +0200

linux (4.4.0-178.208) xenial; urgency=medium

  * xenial/linux: 4.4.0-178.208 -proposed tracker (LP: #1870660)

  * CVE-2019-19768
    - blktrace: Protect q->blk_trace with RCU
    - blktrace: fix dereference after null check

  * Multiple Kexec in AWS Nitro instances fail (LP: #1869948)
    - net: ena: Add PCI shutdown handler to allow safe kexec

  * Insert test_bpf module will report 4 failures for ubuntu_bpf_jit on X s390x
    (LP: #1768452)
    - test_bpf: flag tests that cannot be jited on s390

  * Mounting LVM snapshots with xfs can hit kernel BUG in nvme driver
    (LP: #1869229)
    - block: fix bio_will_gap() for first bvec with offset

  * Xenial update: 4.4.217 upstream stable release (LP: #1868629)
    - NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
    - r8152: check disconnect status after long sleep
    - net: nfc: fix bounds checking bugs on "pipe"
    - bnxt_en: reinitialize IRQs when MTU is modified
    - fib: add missing attribute validation for tun_id
    - nl802154: add missing attribute validation
    - nl802154: add missing attribute validation for dev_type
    - team: add missing attribute validation for port ifindex
    - team: add missing attribute validation for array index
    - nfc: add missing attribute validation for SE API
    - nfc: add missing attribute validation for vendor subcommand
    - ipvlan: add cond_resched_rcu() while processing muticast backlog
    - ipvlan: do not add hardware address of master to its unicast filter list
    - ipvlan: egress mcast packets are not exceptional
    - ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
    - ipvlan: don't deref eth hdr before checking it's set
    - macvlan: add cond_resched() during multicast processing
    - net: fec: validate the new settings in fec_enet_set_coalesce()
    - slip: make slhc_compress() more robust against malicious packets
    - bonding/alb: make sure arp header is pulled before accessing it
    - net: fq: add missing attribute validation for orphan mask
    - iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn +
      add_taint
    - drm/amd/display: remove duplicated assignment to grph_obj_type
    - gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
    - KVM: x86: clear stale x86_emulate_ctxt->intercept value
    - ARC: define __ALIGN_STR and __ALIGN symbols for ARC
    - efi: Fix a race and a buffer overflow while reading efivars via sysfs
    - iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
    - iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
    - nl80211: add missing attribute validation for critical protocol indication
    - nl80211: add missing attribute validation for channel switch
    - netfilter: cthelper: add missing attribute validation for cthelper
    - iommu/vt-d: Fix the wrong printing in RHSA parsing
    - iommu/vt-d: Ignore devices with out-of-spec domain number
    - ipv6: restrict IPV6_ADDRFORM operation
    - efi: Add a sanity check to efivar_store_raw()
    - batman-adv: Fix invalid read while copying bat_iv.bcast_own
    - batman-adv: Only put gw_node list reference when removed
    - batman-adv: Only put orig_node_vlan list reference when removed
    - batman-adv: Avoid endless loop in bat-on-bat netdevice check
    - batman-adv: Fix unexpected free of bcast_own on add_if error
    - batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
    - batman-adv: init neigh node last seen field
    - batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
    - batman-adv: Drop reference to netdevice on last reference
    - batman-adv: Fix reference counting of vlan object for tt_local_entry
    - batman-adv: Avoid duplicate neigh_node additions
    - batman-adv: fix skb deref after free
    - batman-adv: Fix use-after-free/double-free of tt_req_node
    - batman-adv: Fix ICMP RR ethernet access after skb_linearize
    - batman-adv: Clean up untagged vlan when destroying via rtnl-link
    - batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
    - batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
    - batman-adv: Fix orig_node_vlan leak on orig_node_release
    - batman-adv: lock crc access in bridge loop avoidance
    - batman-adv: Fix non-atomic bla_claim::backbone_gw access
    - batman-adv: Fix reference leak in batadv_find_router
    - batman-adv: Free last_bonding_candidate on release of orig_node
    - batman-adv: Fix speedy join in gateway client mode
    - batman-adv: Add missing refcnt for last_candidate
    - batman-adv: Fix double free during fragment merge error
    - batman-adv: Fix transmission of final, 16th fragment
    - batman-adv: Fix rx packet/bytes stats on local ARP reply
    - batman-adv: fix TT sync flag inconsistencies
    - batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
    - batman-adv: Fix internal interface indices types
    - batman-adv: update data pointers after skb_cow()
    - batman-adv: Fix skbuff rcsum on packet reroute
    - batman-adv: Avoid race in TT TVLV allocator helper
    - batman-adv: Fix TT sync flags for intermediate TT responses
    - batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
    - batman-adv: Fix debugfs path for renamed hardif
    - batman-adv: Fix debugfs path for renamed softif
    - batman-adv: Avoid storing non-TT-sync flags on singular entries too
    - batman-adv: Prevent duplicated gateway_node entry
    - batman-adv: Prevent duplicated nc_node entry
    - batman-adv: Prevent duplicated global TT entry
    - batman-adv: Prevent duplicated tvlv handler
    - batman-adv: Reduce claim hash refcnt only for removed entry
    - batman-adv: Reduce tt_local hash refcnt only for removed entry
    - batman-adv: Reduce tt_global hash refcnt only for removed entry
    - batman-adv: Only read OGM tvlv_len after buffer len check
    - batman-adv: Avoid free/alloc race when handling OGM buffer
    - batman-adv: Don't schedule OGM for disabled interface
    - perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
    - net: ks8851-ml: Fix IRQ handling and locking
    - signal: avoid double atomic counter increments for user accounting
    - jbd2: fix data races at struct journal_head
    - ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
    - ARM: 8958/1: rename missed uaccess .fixup section
    - mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
    - ipv4: ensure rcu_read_lock() in cipso_v4_error()
    - Linux 4.4.217

  * Xenial update: 4.4.216 upstream stable release (LP: #1868628)
    - iwlwifi: pcie: fix rb_allocator workqueue allocation
    - ext4: fix potential race between online resizing and write operations
    - ext4: fix potential race between s_flex_groups online resizing and access
    - ext4: fix potential race between s_group_info online resizing and access
    - ipmi:ssif: Handle a possible NULL pointer reference
    - mac80211: consider more elements in parsing CRC
    - cfg80211: check wiphy driver existence for drvinfo report
    - cifs: Fix mode output in debugging statements
    - cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
    - sysrq: Restore original console_loglevel when sysrq disabled
    - sysrq: Remove duplicated sysrq message
    - net: fib_rules: Correctly set table field when table number exceeds 8 bits
    - net: phy: restore mdio regs in the iproc mdio driver
    - ipv6: Fix nlmsg_flags when splitting a multipath route
    - ipv6: Fix route replacement with dev-only route
    - sctp: move the format error check out of __sctp_sf_do_9_1_abort
    - nfc: pn544: Fix occasional HW initialization failure
    - net: sched: correct flower port blocking
    - ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
    - audit: fix error handling in audit_data_to_entry()
    - HID: core: fix off-by-one memset in hid_report_raw_event()
    - HID: core: increase HID report buffer size to 8KiB
    - HID: hiddev: Fix race in in hiddev_disconnect()
    - MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
    - i2c: jz4780: silence log flood on txabrt
    - ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
    - net: netlink: cap max groups which will be considered in netlink_bind()
    - namei: only return -ECHILD from follow_dotdot_rcu()
    - KVM: Check for a bad hva before dropping into the ghc slow path
    - slip: stop double free sl->dev in slip_open
    - mm: make page ref count overflow check tighter and more explicit
    - mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages
    - audit: always check the netlink payload length in audit_receive_msg()
    - serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
    - usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
    - usb: gadget: serial: fix Tx stall after buffer overflow
    - drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
    - drm/msm/dsi: save pll state before dsi host is powered off
    - net: ks8851-ml: Remove 8-bit bus accessors
    - net: ks8851-ml: Fix 16-bit data access
    - net: ks8851-ml: Fix 16-bit IO operation
    - watchdog: da9062: do not ping the hw during stop()
    - s390/cio: cio_ignore_proc_seq_next should increase position index
    - cifs: don't leak -EAGAIN for stat() during reconnect
    - usb: storage: Add quirk for Samsung Fit flash
    - usb: quirks: add NO_LPM quirk for Logitech Screen Share
    - usb: core: hub: do error out if usb_autopm_get_interface() fails
    - usb: core: port: do error out if usb_autopm_get_interface() fails
    - vgacon: Fix a UAF in vgacon_invert_region
    - fat: fix uninit-memory access for partial initialized inode
    - vt: selection, close sel_buffer race
    - vt: selection, push console lock down
    - vt: selection, push sel_lock up
    - dmaengine: tegra-apb: Fix use-after-free
    - dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
    - ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
    - ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
    - ASoC: dapm: Correct DAPM handling of active widgets during shutdown
    - RDMA/iwcm: Fix iwcm work deallocation
    - RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
    - ARM: imx: build v7_cpu_resume() unconditionally
    - hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
    - dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
    - powerpc: fix hardware PMU exception bug on PowerVM compatibility mode
      systems
    - dm cache: fix a crash due to incorrect work item cancelling
    - crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async
    - Linux 4.4.216

  * Xenial update: 4.4.215 upstream stable release (LP: #1868627)
    - ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
    - ecryptfs: fix a memory leak bug in parse_tag_1_packet()
    - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
    - ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
    - ubifs: Fix deadlock in concurrent bulk-read and writepage
    - ext4: fix checksum errors with indexed dirs
    - Btrfs: fix race between using extent maps and merging them
    - btrfs: log message when rw remount is attempted with unclean tree-log
    - padata: Remove broken queue flushing
    - s390/time: Fix clk type in get_tod_clock
    - hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
    - jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
    - jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
    - btrfs: print message when tree-log replay starts
    - scsi: qla2xxx: fix a potential NULL pointer dereference
    - Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs"
    - drm/gma500: Fixup fbdev stolen size usage evaluation
    - brcmfmac: Fix use after free in brcmf_sdio_readframes()
    - gianfar: Fix TX timestamping with a stacked DSA driver
    - pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
    - media: i2c: mt9v032: fix enum mbus codes and frame sizes
    - media: sti: bdisp: fix a possible sleep-in-atomic-context bug in
      bdisp_device_run()
    - efi/x86: Map the entire EFI vendor string before copying it
    - MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
    - uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
    - usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
    - nfs: NFS_SWAP should depend on SWAP
    - jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info
      when load journal
    - tracing: Fix very unlikely race of registering two stat tracers
    - ext4, jbd2: ensure panic when aborting with zero errno
    - kconfig: fix broken dependency in randconfig-generated .config
    - clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
    - drm/amdgpu: remove 4 set but not used variable in
      amdgpu_atombios_get_connector_info_from_object_table
    - regulator: rk808: Lower log level on optional GPIOs being not available
    - NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use
      le16_add_cpu().
    - reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
    - ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
    - b43legacy: Fix -Wcast-function-type
    - ipw2x00: Fix -Wcast-function-type
    - iwlegacy: Fix -Wcast-function-type
    - rtlwifi: rtl_pci: Fix -Wcast-function-type
    - orinoco: avoid assertion in case of NULL pointer
    - ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
    - scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
    - ARM: dts: r8a7779: Add device node for ARM global timer
    - x86/vdso: Provide missing include file
    - pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
    - ALSA: sh: Fix compile warning wrt const
    - tools lib api fs: Fix gcc9 stringop-truncation compilation error
    - usbip: Fix unsafe unaligned pointer usage
    - soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
    - rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
    - Input: edt-ft5x06 - work around first register access error
    - wan: ixp4xx_hss: fix compile-testing on 64-bit
    - ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
    - PCI: Don't disable bridge BARs when assigning bus resources
    - driver core: Print device when resources present in really_probe()
    - drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
    - drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
    - iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
    - scsi: iscsi: Don't destroy session if there are outstanding connections
    - cmd64x: potential buffer overflow in cmd64x_program_timings()
    - ide: serverworks: potential overflow in svwks_set_pio_mode()
    - remoteproc: Initialize rproc_class before use
    - s390/ftrace: generate traced function stack frame
    - ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
    - jbd2: switch to use jbd2_journal_abort() when failed to submit the commit
      record
    - ARM: 8951/1: Fix Kexec compilation issue.
    - hostap: Adjust indentation in prism2_hostapd_add_sta
    - iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
    - drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
    - trigger_next should increase position index
    - radeon: insert 10ms sleep in dce5_crtc_load_lut
    - ocfs2: fix a NULL pointer dereference when call
      ocfs2_update_inode_fsync_trans()
    - lib/scatterlist.c: adjust indentation in __sg_alloc_table
    - reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
    - bcache: explicity type cast in bset_bkey_last()
    - irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building
      INVALL
    - microblaze: Prevent the overflow of the start
    - brd: check and limit max_part par
    - selinux: ensure we cleanup the internal AVC counters on error in
      avc_update()
    - enic: prevent waking up stopped tx queues over watchdog reset
    - floppy: check FDC index for errors before assigning it
    - staging: android: ashmem: Disallow ashmem memory from being remapped
    - staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
    - usb: uas: fix a plug & unplug racing
    - USB: Fix novation SourceControl XL after suspend
    - USB: hub: Don't record a connect-change event during reset-resume
    - staging: rtl8188eu: Fix potential security hole
    - staging: rtl8188eu: Fix potential overuse of kernel memory
    - x86/mce/amd: Fix kobject lifetime
    - tty: serial: imx: setup the correct sg entry for tx dma
    - xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
    - VT_RESIZEX: get rid of field-by-field copyin
    - vt: vt_ioctl: fix race in VT_RESIZEX
    - netfilter: xt_bpf: add overflow checks
    - ext4: fix a data race in EXT4_I(inode)->i_disksize
    - ext4: add cond_resched() to __ext4_find_entry()
    - KVM: apic: avoid calculating pending eoi from an uninitialized val
    - Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered
      extents
    - scsi: Revert "RDMA/isert: Fix a recently introduced regression related to
      logout"
    - scsi: Revert "target: iscsi: Wait for all commands to finish before freeing
      a session"
    - ecryptfs: replace BUG_ON with error handling code
    - ALSA: rawmidi: Avoid bit fields for state flags
    - ALSA: seq: Avoid concurrent access to queue flags
    - ALSA: seq: Fix concurrent access to queue current tick/time
    - xen: Enable interrupts when calling _cond_resched()
    - Linux 4.4.215

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 05 Apr 2020 18:51:07 -0400

linux (4.4.0-177.207) xenial; urgency=medium

  * xenial/linux: 4.4.0-177.207 -proposed tracker (LP: #1867243)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * Xenial update: 4.4.214 upstream stable release (LP: #1864775)
    - media: iguanair: fix endpoint sanity check
    - x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - sparc32: fix struct ipc64_perm type definition
    - ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node
    - cls_rsvp: fix rsvp_policy
    - net: hsr: fix possible NULL deref in hsr_handle_frame()
    - net_sched: fix an OOB access in cls_tcindex
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
    - mfd: dln2: More sanity checking for endpoints
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: dummy: Fix PCM format loop in proc output
    - lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
    - powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
    - mmc: spi: Toggle SPI polarity, do not hardcode it
    - PCI: keystone: Fix link training retries initiation
    - crypto: api - Check spawn->alg under lock in crypto_drop_spawn
    - scsi: qla2xxx: Fix mtcp dump collection failure
    - power: supply: ltc2941-battery-gauge: fix use-after-free
    - of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
    - dm space map common: fix to ensure new block isn't already in use
    - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
    - crypto: api - Fix race condition in crypto_spawn_alg
    - crypto: picoxcell - adjust the position of tasklet_init and fix missed
      tasklet_kill
    - btrfs: set trans->drity in btrfs_commit_transaction
    - ARM: tegra: Enable PLLP bypass during Tegra124 LP1
    - mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
    - sunrpc: expiry_time should be seconds not timeval
    - KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    - KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
    - KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF
      attacks
    - KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF
      attacks
    - KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks
      in x86.c
    - KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
    - KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit()
      from Spectre-v1/L1TF attacks
    - KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
    - KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
    - KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
    - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
    - scsi: csiostor: Adjust indentation in csio_device_reset
    - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
    - ext2: Adjust indentation in ext2_fill_super
    - powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
    - NFC: pn544: Adjust indentation in pn544_hci_check_presence
    - ppp: Adjust indentation into ppp_async_input
    - net: smc911x: Adjust indentation in smc911x_phy_configure
    - net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
    - mfd: da9062: Fix watchdog compatible string
    - mfd: rn5t618: Mark ADC control register volatile
    - net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
    - bonding/alb: properly access headers in bond_alb_xmit()
    - NFS: Fix memory leaks and corruption in readdir
    - NFS: Fix bool initialization/comparison
    - NFS: Directory page cache pages need to be locked when read
    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
    - btrfs: remove trivial locking wrappers of tree mod log
    - Btrfs: fix race between adding and putting tree mod seq elements and nodes
    - drm: atmel-hlcdc: enable clock before configuring timing engine
    - KVM: x86: drop picdev_in_range()
    - KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
    - KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
    - KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
    - btrfs: flush write bio if we loop in extent_write_cache_pages
    - KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
    - KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
    - KVM: nVMX: vmread should not set rflags to specify success in case of #PF
    - cifs: fail i/o on soft mounts if sessionsetup errors out
    - clocksource: Prevent double add_timer_on() for watchdog_timer
    - perf/core: Fix mlock accounting in perf_mmap()
    - ASoC: pcm: update FE/BE trigger order based on the command
    - scsi: ufs: Fix ufshcd_probe_hba() reture value in case
      ufshcd_scsi_add_wlus() fails
    - rtc: hym8563: Return -EINVAL if the time is known to be invalid
    - ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
    - ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
    - ARM: dts: at91: sama5d3: define clock rate range for tcb1
    - powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce
      for DDW
    - pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
    - mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
    - mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
    - libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
    - libertas: make lbs_ibss_join_existing() return error code on rates overflow
    - Linux 4.4.214

  * 5.4.0-11 crash on cryptsetup open (LP: #1860231) // Xenial update: 4.4.214
    upstream stable release (LP: #1864775)
    - dm: fix potential for q->make_request_fn NULL pointer

  * Xenial update: 4.4.213 upstream stable release (LP: #1864774)
    - ALSA: pcm: Add missing copy ops check before clearing buffer
    - orinoco_usb: fix interface sanity check
    - rsi_91x_usb: fix interface sanity check
    - USB: serial: ir-usb: add missing endpoint sanity check
    - USB: serial: ir-usb: fix link-speed handling
    - USB: serial: ir-usb: fix IrLAP framing
    - staging: most: net: fix buffer overflow
    - staging: wlan-ng: ensure error return is actually returned
    - staging: vt6656: correct packet types for CTS protect, mode.
    - staging: vt6656: use NULLFUCTION stack on mac80211
    - staging: vt6656: Fix false Tx excessive retries reporting.
    - ath9k: fix storage endpoint lookup
    - brcmfmac: fix interface sanity check
    - rtl8xxxu: fix interface sanity check
    - zd1211rw: fix storage endpoint lookup
    - watchdog: rn5t618_wdt: fix module aliases
    - drivers/net/b44: Change to non-atomic bit operations on pwol_mask
    - net: wan: sdla: Fix cast from pointer to integer of different size
    - atm: eni: fix uninitialized variable warning
    - usb-storage: Disable UAS on JMicron SATA enclosure
    - net_sched: ematch: reject invalid TCF_EM_SIMPLE
    - crypto: af_alg - Use bh_lock_sock in sk_destruct
    - crypto: pcrypt - Fix user-after-free on module unload
    - arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
    - mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
    - reiserfs: Fix memory leak of journal device string
    - media: digitv: don't continue if remote control state can't be read
    - media: gspca: zero usb_buf
    - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
    - ttyprintk: fix a potential deadlock in interrupt context issue
    - usb: dwc3: turn off VBUS when leaving host mode
    - media: si470x-i2c: Move free() past last use of 'radio'
    - clk: mmp2: Fix the order of timer mux parents
    - ixgbevf: Remove limit of 10 entries for unicast filter list
    - ixgbe: Fix calculation of queue with VFs and flow director on interface flap
    - wireless: wext: avoid gcc -O3 warning
    - vti[6]: fix packet tx through bpf_redirect()
    - scsi: fnic: do not queue commands during fwreset
    - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
    - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
    - r8152: get default setting of WOL before initializing
    - qlcnic: Fix CPU soft lockup while collecting firmware dump
    - net/fsl: treat fsl,erratum-a011043
    - net/sonic: Add mutual exclusion for accessing shared state
    - net/sonic: Use MMIO accessors
    - net/sonic: Fix receive buffer handling
    - net/sonic: Quiesce SONIC before re-initializing descriptor memory
    - seq_tab_next() should increase position index
    - l2t_seq_next should increase position index
    - net: Fix skb->csum update in inet_proto_csum_replace16().
    - btrfs: fix mixed block count of available space
    - btrfs: do not zero f_bavail if we have available space
    - Linux 4.4.213

  * Xenial update: 4.4.212 upstream stable release (LP: #1864773)
    - powerpc/archrandom: fix arch_get_random_seed_int()
    - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
    - drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
    - ALSA: hda: fix unused variable warning
    - ALSA: usb-audio: update quirk for B&W PX to remove microphone
    - staging: comedi: ni_mio_common: protect register write overflow
    - pcrypt: use format specifier in kobject_add
    - exportfs: fix 'passing zero to ERR_PTR()' warning
    - drm/dp_mst: Skip validating ports during destruction, just ref
    - pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
    - pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
    - pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
    - pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
    - pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
    - pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
    - pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
    - pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
    - pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
    - Input: nomadik-ske-keypad - fix a loop timeout test
    - clk: highbank: fix refcount leak in hb_clk_init()
    - clk: qoriq: fix refcount leak in clockgen_init()
    - clk: socfpga: fix refcount leak
    - clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
    - clk: imx6q: fix refcount leak in imx6q_clocks_init()
    - clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
    - clk: imx7d: fix refcount leak in imx7d_clocks_init()
    - clk: vf610: fix refcount leak in vf610_clocks_init()
    - clk: armada-370: fix refcount leak in a370_clk_init()
    - clk: kirkwood: fix refcount leak in kirkwood_clk_init()
    - clk: armada-xp: fix refcount leak in axp_clk_init()
    - IB/usnic: Fix out of bounds index check in query pkey
    - RDMA/ocrdma: Fix out of bounds index check in query pkey
    - media: s5p-jpeg: Correct step and max values for
      V4L2_CID_JPEG_RESTART_INTERVAL
    - crypto: tgr192 - fix unaligned memory access
    - ASoC: imx-sgtl5000: put of nodes if finding codec fails
    - rtc: cmos: ignore bogus century byte
    - tty: ipwireless: Fix potential NULL pointer dereference
    - rtc: ds1672: fix unintended sign extension
    - rtc: 88pm860x: fix unintended sign extension
    - rtc: 88pm80x: fix unintended sign extension
    - rtc: pm8xxx: fix unintended sign extension
    - fbdev: chipsfb: remove set but not used variable 'size'
    - pinctrl: sh-pfc: emev2: Add missing pinmux functions
    - pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
    - pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
    - block: don't use bio->bi_vcnt to figure out segment number
    - vfio_pci: Enable memory accesses before calling pci_map_rom
    - cdc-wdm: pass return value of recover_from_urb_loss
    - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
    - drm/nouveau/pmu: don't print reply values if exec is false
    - ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
    - fs/nfs: Fix nfs_parse_devname to not modify it's argument
    - clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
    - ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
    - regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
    - nios2: ksyms: Add missing symbol exports
    - scsi: megaraid_sas: reduce module load time
    - xen, cpu_hotplug: Prevent an out of bounds access
    - net: sh_eth: fix a missing check of of_get_phy_mode
    - media: ivtv: update *pos correctly in ivtv_read_pos()
    - media: cx18: update *pos correctly in cx18_read_pos()
    - media: wl128x: Fix an error code in fm_download_firmware()
    - media: cx23885: check allocation return
    - jfs: fix bogus variable self-initialization
    - m68k: mac: Fix VIA timer counter accesses
    - ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
    - media: davinci-isif: avoid uninitialized variable use
    - spi: tegra114: clear packed bit for unpacked mode
    - spi: tegra114: fix for unpacked mode transfers
    - soc/fsl/qe: Fix an error code in qe_pin_request()
    - spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
    - ehea: Fix a copy-paste err in ehea_init_port_res
    - scsi: qla2xxx: Unregister chrdev if module initialization fails
    - ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
    - hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
    - tipc: set sysctl_tipc_rmem and named_timeout right range
    - powerpc: vdso: Make vdso32 installation conditional in vdso_install
    - media: ov2659: fix unbalanced mutex_lock/unlock
    - 6lowpan: Off by one handling ->nexthdr
    - dmaengine: axi-dmac: Don't check the number of frames for alignment
    - ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
    - packet: in recvmsg msg_name return at least sizeof sockaddr_ll
    - ASoC: fix valid stream condition
    - IB/mlx5: Add missing XRC options to QP optional params mask
    - iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
    - media: omap_vout: potential buffer overflow in vidioc_dqbuf()
    - media: davinci/vpbe: array underflow in vpbe_enum_outputs()
    - platform/x86: alienware-wmi: printing the wrong error code
    - netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
    - ARM: riscpc: fix lack of keyboard interrupts after irq conversion
    - kdb: do a sanity check on the cpu in kdb_per_cpu()
    - backlight: lm3630a: Return 0 on success in update_status functions
    - thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
    - spi: spi-fsl-spi: call spi_finalize_current_message() at the end
    - misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
    - iommu: Use right function to get group for device
    - signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
    - inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
    - media: vivid: fix incorrect assignment operation when setting video mode
    - powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
    - drm/msm/mdp5: Fix mdp5_cfg_init error return
    - net/af_iucv: always register net_device notifier
    - ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
    - rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
    - drm/msm/a3xx: remove TPL1 regs from snapshot
    - iommu/amd: Make iommu_disable safer
    - mfd: intel-lpss: Release IDA resources
    - devres: allow const resource arguments
    - net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
    - scsi: libfc: fix null pointer dereference on a null lport
    - libertas_tf: Use correct channel range in lbtf_geo_init
    - usb: host: xhci-hub: fix extra endianness conversion
    - mic: avoid statically declaring a 'struct device'.
    - x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
    - ALSA: aoa: onyx: always initialize register read value
    - cifs: fix rmmod regression in cifs.ko caused by force_sig changes
    - crypto: caam - free resources in case caam_rng registration failed
    - ext4: set error return correctly when ext4_htree_store_dirent fails
    - ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
    - ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
    - ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
    - signal: Allow cifs and drbd to receive their terminating signals
    - dmaengine: dw: platform: Switch to acpi_dma_controller_register()
    - mac80211: minstrel_ht: fix per-group max throughput rate initialization
    - mips: avoid explicit UB in assignment of mips_io_port_base
    - ahci: Do not export local variable ahci_em_messages
    - Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
    - power: supply: Init device wakeup after device_add()
    - x86, perf: Fix the dependency of the x86 insn decoder selftest
    - bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
    - iio: dac: ad5380: fix incorrect assignment to val
    - ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
    - net: sonic: return NETDEV_TX_OK if failed to map buffer
    - Btrfs: fix hang when loading existing inode cache off disk
    - hwmon: (shtc1) fix shtc1 and shtw1 id mask
    - net: sonic: replace dev_kfree_skb in sonic_send_packet
    - net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
    - iommu/amd: Wait for completion of IOTLB flush in attach_device
    - net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
    - net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
    - net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
    - mac80211: accept deauth frames in IBSS mode
    - llc: fix another potential sk_buff leak in llc_ui_sendmsg()
    - llc: fix sk_buff refcounting in llc_conn_state_process()
    - net: stmmac: fix length of PTP clock's name string
    - drm/msm/dsi: Implement reset correctly
    - dmaengine: imx-sdma: fix size check for sdma script_number
    - net: qca_spi: Move reset_count to struct qcaspi
    - media: ov6650: Fix incorrect use of JPEG colorspace
    - media: ov6650: Fix some format attributes not under control
    - media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
    - MIPS: Loongson: Fix return value of loongson_hwmon_init
    - net: neigh: use long type to store jiffies delta
    - packet: fix data-race in fanout_flow_is_huge()
    - dmaengine: ti: edma: fix missed failure handling
    - drm/radeon: fix bad DMA from INTERRUPT_CNTL2
    - arm64: dts: juno: Fix UART frequency
    - m68k: Call timer_interrupt() with interrupts disabled
    - firestream: fix memory leaks
    - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
    - net, ip_tunnel: fix namespaces move
    - net_sched: fix datalen for ematch
    - net: usb: lan78xx: Add .ndo_features_check
    - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
    - Input: keyspan-remote - fix control-message timeouts
    - ARM: 8950/1: ftrace/recordmcount: filter relocation types
    - mmc: sdhci: fix minimum clock rate for v3 controller
    - Input: sur40 - fix interface sanity checks
    - Input: gtco - fix endpoint sanity check
    - Input: aiptek - fix endpoint sanity check
    - hwmon: (nct7802) Fix voltage limits to wrong registers
    - scsi: RDMA/isert: Fix a recently introduced regression related to logout
    - tracing: xen: Ordered comparison of function pointers
    - iio: buffer: align the size of scan bytes to size of the largest element
    - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
    - md: Avoid namespace collision with bitmap API
    - bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free()
    - netfilter: ipset: use bitmap infrastructure completely
    - net/x25: fix nonblocking connect
    - Revert "UBUNTU: SAUCE: libertas: Fix two buffer overflows at parsing bss
      descriptor"
    - libertas: Fix two buffer overflows at parsing bss descriptor
    - Linux 4.4.212

  * CVE-2020-8428
    - do_last(): fetch directory ->i_mode and ->i_uid before it's too late
    - vfs: fix do_last() regression

  * xfs fill_fs test in fallocate06 from ubuntu_ltp_syscalls failed
    (LP: #1865967)
    - xfs: Fix tail rounding in xfs_alloc_file_space()

  * ipc/sem.c : process loops infinitely in exit_sem() (LP: #1858834)
    - Revert "ipc, sem: remove uneeded sem_undo_list lock usage in exit_sem()"

  * quotactl07 from ubuntu_ltp_syscalls failed (LP: #1864092)
    - xfs: Sanity check flags of Q_XQUOTARM call

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 15 Mar 2020 19:16:50 -0400

linux (4.4.0-176.206) xenial; urgency=medium

  * xenial/linux: 4.4.0-176.206 -proposed tracker (LP: #1865106)

  * CVE-2020-2732
    - x86/vdso: Use RDPID in preference to LSL when available
    - KVM: x86: emulate RDPID
    - KVM: nVMX: Don't emulate instructions in guest mode
    - KVM: nVMX: Refactor IO bitmap checks into helper function
    - KVM: nVMX: Check IO instruction VM-exit conditions

 -- Khalid Elmously <khalid.elmously@canonical.com>  Thu, 27 Feb 2020 23:41:44 -0500

# For older changelog entries, run 'apt-get changelog linux-tools-host'
