UBUNTU: Ubuntu-4.15.0-69.78

[mirror_ubuntu-bionic-kernel.git] / debian.master / changelog

linux (4.15.0-69.78) bionic; urgency=medium

  * KVM NULL pointer deref (LP: #1851205)
    - KVM: nVMX: handle page fault in vmread fix

  * CVE-2018-12207
    - KVM: MMU: drop vcpu param in gpte_access
    - kvm: Convert kvm_lock to a mutex
    - kvm: x86: Do not release the page inside mmu_set_spte()
    - KVM: x86: make FNAME(fetch) and __direct_map more similar
    - KVM: x86: remove now unneeded hugepage gfn adjustment
    - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
    - KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
    - kvm: x86, powerpc: do not allow clearing largepages debugfs entry
    - SAUCE: KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - SAUCE: x86: Add ITLB_MULTIHIT bug infrastructure
    - SAUCE: kvm: mmu: ITLB_MULTIHIT mitigation
    - SAUCE: kvm: Add helper function for creating VM worker threads
    - SAUCE: kvm: x86: mmu: Recovery of shattered NX large pages
    - SAUCE: cpu/speculation: Uninline and export CPU mitigations helpers
    - SAUCE: kvm: x86: mmu: Apply global mitigations knob to ITLB_MULTIHIT

  * CVE-2019-11135
    - KVM: x86: use Intel speculation bugs and features as derived in generic x86
      code
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - SAUCE: x86/speculation/taa: Call tsx_init()
    - SAUCE: x86/cpu: Include cpu header from bugs.c
    - [Config] Disable TSX by default when possible

  * CVE-2019-0154
    - SAUCE: drm/i915: Lower RM timeout to avoid DSI hard hangs
    - SAUCE: drm/i915/gen8+: Add RC6 CTX corruption WA

  * CVE-2019-0155
    - drm/i915/gtt: Add read only pages to gen8_pte_encode
    - drm/i915/gtt: Read-only pages for insert_entries on bdw+
    - drm/i915/gtt: Disable read-only support under GVT
    - drm/i915: Prevent writing into a read-only object via a GGTT mmap
    - drm/i915/cmdparser: Check reg_table_count before derefencing.
    - drm/i915/cmdparser: Do not check past the cmd length.
    - drm/i915: Silence smatch for cmdparser
    - drm/i915: Move engine->needs_cmd_parser to engine->flags
    - SAUCE: drm/i915: Rename gen7 cmdparser tables
    - SAUCE: drm/i915: Disable Secure Batches for gen6+
    - SAUCE: drm/i915: Remove Master tables from cmdparser
    - SAUCE: drm/i915: Add support for mandatory cmdparsing
    - SAUCE: drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - SAUCE: drm/i915: Allow parsing of unsized batches
    - SAUCE: drm/i915: Add gen9 BCS cmdparsing
    - SAUCE: drm/i915/cmdparser: Use explicit goto for error paths
    - SAUCE: drm/i915/cmdparser: Add support for backward jumps
    - SAUCE: drm/i915/cmdparser: Ignore Length operands during command matching

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 06 Nov 2019 10:28:28 +0100

linux (4.15.0-68.77) bionic; urgency=medium

  * bionic/linux: 4.15.0-68.77 -proposed tracker (LP: #1849855)

  * [REGRESSION]  md/raid0: cannot assemble multi-zone RAID0 with default_layout
    setting (LP: #1849682)
    - Revert "md/raid0: avoid RAID0 data corruption due to layout confusion."

 -- Khalid Elmously <khalid.elmously@canonical.com>  Fri, 25 Oct 2019 15:34:31 -0400

linux (4.15.0-67.76) bionic; urgency=medium

  * bionic/linux: 4.15.0-67.76 -proposed tracker (LP: #1849035)

  * Unexpected CFS throttling  (LP: #1832151)
    - sched/fair: Add lsub_positive() and use it consistently
    - sched/fair: Fix low cpu usage with high throttling by removing expiration of
      cpu-local slices
    - sched/fair: Fix -Wunused-but-set-variable warnings

  * [CML] New device IDs for CML-U (LP: #1843774)
    - i2c: i801: Add support for Intel Comet Lake
    - spi: pxa2xx: Add support for Intel Comet Lake

  * CVE-2019-17666
    - SAUCE: rtlwifi: rtl8822b: Fix potential overflow on P2P code
    - SAUCE: rtlwifi: Fix potential overflow on P2P code

  * md raid0/linear doesn't show error state if an array member is removed and
    allows successful writes (LP: #1847773)
    - md raid0/linear: Mark array as 'broken' and fail BIOs if a member is gone

  * Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x from yes
    to no (LP: #1848492)
    - [Config] Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x
      from yes to no

  * [Packaging] Support building Flattened Image Tree (FIT) kernels
    (LP: #1847969)
    - [Packaging] add rules to build FIT image
    - [Packaging] force creation of headers directory

  * bcache: Performance degradation when querying priority_stats (LP: #1840043)
    - bcache: add cond_resched() in __bch_cache_cmp()

  * Add installer support for iwlmvm adapters (LP: #1848236)
    - d-i: Add iwlmvm to nic-modules

  * Check for CPU Measurement sampling (LP: #1847590)
    - s390/cpumsf: Check for CPU Measurement sampling

  * [CML-U] Comet lake platform need ISH driver support (LP: #1843775)
    - HID: intel-ish-hid: Add Comet Lake PCI device ID

  * intel-lpss driver conflicts with write-combining MTRR region (LP: #1845584)
    - SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390 2-in-1

  * Fix non-working Realtek USB ethernet after system resume (LP: #1847063)
    - r8152: remove extra action copying ethernet address
    - r8152: Refresh MAC address during USBDEVFS_RESET
    - r8152: Set macpassthru in reset_resume callback

  * Ubuntu 18.04  - wrong cpu-mf counter number (LP: #1847109)
    - s390/cpum_cf: correct counter number of LAST_HOST_TRANSLATIONS

  * PM / hibernate: fix potential memory corruption (LP: #1847118)
    - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation

  * Microphone-Mute keyboard LED is always on/off on Dell Latitude 3310
    (LP: #1846453)
    - platform/x86: dell-laptop: Add 2-in-1 devices to the DMI whitelist
    - platform/x86: dell-laptop: Removed duplicates in DMI whitelist

  * xHCI on AMD Stoney Ridge cannot detect USB 2.0 or 1.1 devices.
    (LP: #1846470)
    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect

  * CVE-2019-15098
    - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()

  * Bionic update: upstream stable patchset 2019-10-15 (LP: #1848274)
    - tpm: use tpm_try_get_ops() in tpm-sysfs.c.
    - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations
    - drm/bridge: tc358767: Increase AUX transfer length limit
    - drm/panel: simple: fix AUO g185han01 horizontal blanking
    - video: ssd1307fb: Start page range at page_offset
    - drm/stm: attach gem fence to atomic state
    - drm/radeon: Fix EEH during kexec
    - gpu: drm: radeon: Fix a possible null-pointer dereference in
      radeon_connector_set_property()
    - ipmi_si: Only schedule continuously in the thread in maintenance mode
    - clk: qoriq: Fix -Wunused-const-variable
    - clk: sunxi-ng: v3s: add missing clock slices for MMC2 module clocks
    - clk: sirf: Don't reference clk_init_data after registration
    - clk: zx296718: Don't reference clk_init_data after registration
    - powerpc/xmon: Check for HV mode when dumping XIVE info from OPAL
    - powerpc/rtas: use device model APIs and serialization during LPM
    - powerpc/futex: Fix warning: 'oldval' may be used uninitialized in this
      function
    - powerpc/pseries/mobility: use cond_resched when updating device tree
    - pinctrl: tegra: Fix write barrier placement in pmx_writel
    - vfio_pci: Restore original state on release
    - drm/nouveau/volt: Fix for some cards having 0 maximum voltage
    - drm/amdgpu/si: fix ASIC tests
    - powerpc/64s/exception: machine check use correct cfar for late handler
    - powerpc/pseries: correctly track irq state in default idle
    - arm64: fix unreachable code issue with cmpxchg
    - clk: at91: select parent if main oscillator or bypass is enabled
    - scsi: core: Reduce memory required for SCSI logging
    - dma-buf/sw_sync: Synchronize signal vs syncpt free
    - MIPS: tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean
    - i2c-cht-wc: Fix lockdep warning
    - PCI: tegra: Fix OF node reference leak
    - livepatch: Nullify obj->mod in klp_module_coming()'s error path
    - ARM: 8898/1: mm: Don't treat faults reported from cache maintenance as
      writes
    - rtc: snvs: fix possible race condition
    - HID: apple: Fix stuck function keys when using FN
    - PCI: rockchip: Propagate errors for optional regulators
    - PCI: imx6: Propagate errors for optional regulators
    - PCI: exynos: Propagate errors for optional PHYs
    - security: smack: Fix possible null-pointer dereferences in
      smack_socket_sock_rcv_skb()
    - ARM: 8903/1: ensure that usable memory in bank 0 starts from a PMD-aligned
      address
    - fat: work around race with userspace's read via blockdev while mounting
    - pktcdvd: remove warning on attempting to register non-passthrough dev
    - hypfs: Fix error number left in struct pointer member
    - kbuild: clean compressed initramfs image
    - ocfs2: wait for recovering done after direct unlock request
    - kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K
    - bpf: fix use after free in prog symbol exposure
    - cxgb4:Fix out-of-bounds MSI-X info array access
    - erspan: remove the incorrect mtu limit for erspan
    - hso: fix NULL-deref on tty open
    - ipv6: drop incoming packets having a v4mapped source address
    - net: ipv4: avoid mixed n_redirects and rate_tokens usage
    - net: qlogic: Fix memory leak in ql_alloc_large_buffers
    - net: Unpublish sk from sk_reuseport_cb before call_rcu
    - nfc: fix memory leak in llcp_sock_bind()
    - qmi_wwan: add support for Cinterion CLS8 devices
    - sch_dsmark: fix potential NULL deref in dsmark_init()
    - vsock: Fix a lockdep warning in __vsock_release()
    - net/rds: Fix error handling in rds_ib_add_one()
    - xen-netfront: do not use ~0U as error return value for xennet_fill_frags()
    - tipc: fix unlimited bundling of small messages
    - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
    - ipv6: Handle missing host route in __ipv6_ifa_notify
    - Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set
    - smack: use GFP_NOFS while holding inode_smack::smk_lock
    - NFC: fix attrs checks in netlink interface
    - kexec: bail out upon SIGKILL when allocating memory.
    - drm/panel: check failure cases in the probe func
    - drm/amd/display: reprogram VM config when system resume
    - pinctrl: amd: disable spurious-firing GPIO IRQs
    - pstore: fs superblock limits
    - pinctrl: meson-gxbb: Fix wrong pinning definition for uart_c
    - mbox: qcom: add APCS child device for QCS404
    - ARM: 8875/1: Kconfig: default to AEABI w/ Clang
    - arm64: consider stack randomization for mmap base only when necessary
    - mips: properly account for stack randomization and stack guard gap
    - arm: properly account for stack randomization and stack guard gap
    - arm: use STACK_TOP when computing mmap base address

  * Bionic update: upstream stable patchset 2019-10-07 (LP: #1847155)
    - Revert "Bluetooth: validate BLE connection interval updates"
    - powerpc/xive: Fix bogus error code returned by OPAL
    - IB/core: Add an unbound WQ type to the new CQ API
    - HID: prodikeys: Fix general protection fault during probe
    - HID: sony: Fix memory corruption issue on cleanup.
    - HID: logitech: Fix general protection fault caused by Logitech driver
    - HID: hidraw: Fix invalid read in hidraw_ioctl
    - mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
    - crypto: talitos - fix missing break in switch statement
    - iwlwifi: mvm: send BCAST management frames to the right station
    - media: tvp5150: fix switch exit in set control handler
    - ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt()
    - arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field
    - ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
    - ALSA: hda - Apply AMD controller workaround for Raven platform
    - objtool: Clobber user CFLAGS variable
    - pinctrl: sprd: Use define directive for sprd_pinconf_params values
    - power: supply: sysfs: ratelimit property read error message
    - irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
    - f2fs: check all the data segments against all node ones
    - PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it
    - blk-mq: move cancel of requeue_work to the front of blk_exit_queue
    - Revert "f2fs: avoid out-of-range memory access"
    - dm zoned: fix invalid memory access
    - f2fs: fix to do sanity check on segment bitmap of LFS curseg
    - drm: Flush output polling on shutdown
    - net: don't warn in inet diag when IPV6 is disabled
    - ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35
    - xfs: don't crash on null attr fork xfs_bmapi_read
    - Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
    - f2fs: use generic EFSBADCRC/EFSCORRUPTED
    - arcnet: provide a buffer big enough to actually receive packets
    - cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
    - macsec: drop skb sk before calling gro_cells_receive
    - net/phy: fix DP83865 10 Mbps HDX loopback disable function
    - net: qrtr: Stop rx_worker before freeing node
    - net/sched: act_sample: don't push mac header on ip6gre ingress
    - net_sched: add max len check for TCA_KIND
    - openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC
    - ppp: Fix memory leak in ppp_write
    - sch_netem: fix a divide by zero in tabledist()
    - skge: fix checksum byte order
    - usbnet: ignore endpoints with invalid wMaxPacketSize
    - usbnet: sanity checking of packet sizes and device mtu
    - net/mlx5: Add device ID of upcoming BlueField-2
    - mISDN: enforce CAP_NET_RAW for raw sockets
    - appletalk: enforce CAP_NET_RAW for raw sockets
    - ax25: enforce CAP_NET_RAW for raw sockets
    - ieee802154: enforce CAP_NET_RAW for raw sockets
    - nfc: enforce CAP_NET_RAW for raw sockets
    - ALSA: hda: Flush interrupts on disabling
    - regulator: lm363x: Fix off-by-one n_voltages for lm3632 ldo_vpos/ldo_vneg
    - ASoC: sgtl5000: Fix charge pump source assignment
    - dmaengine: bcm2835: Print error in case setting DMA mask fails
    - leds: leds-lp5562 allow firmware files up to the maximum length
    - media: dib0700: fix link error for dibx000_i2c_set_speed
    - media: mtk-cir: lower de-glitch counter for rc-mm protocol
    - media: exynos4-is: fix leaked of_node references
    - media: hdpvr: Add device num check and handling
    - media: i2c: ov5640: Check for devm_gpiod_get_optional() error
    - sched/fair: Fix imbalance due to CPU affinity
    - sched/core: Fix CPU controller for !RT_GROUP_SCHED
    - x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI
      fails
    - x86/apic: Soft disable APIC before initializing it
    - ALSA: hda - Show the fatal CORB/RIRB error more clearly
    - ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in
      build_adc_controls()
    - EDAC/mc: Fix grain_bits calculation
    - media: iguanair: add sanity checks
    - base: soc: Export soc_device_register/unregister APIs
    - ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
    - ia64:unwind: fix double free for mod->arch.init_unw_table
    - EDAC/altera: Use the proper type for the IRQ status bits
    - ASoC: rsnd: don't call clk_get_rate() under atomic context
    - md/raid1: end bio when the device faulty
    - md: don't call spare_active in md_reap_sync_thread if all member devices
      can't work
    - md: don't set In_sync if array is frozen
    - ACPI / processor: don't print errors for processorIDs == 0xff
    - EDAC, pnd2: Fix ioremap() size in dnv_rd_reg()
    - efi: cper: print AER info of PCIe fatal error
    - sched/fair: Use rq_lock/unlock in online_fair_sched_group
    - media: gspca: zero usb_buf on error
    - perf test vfs_getname: Disable ~/.perfconfig to get default output
    - media: mtk-mdp: fix reference count on old device tree
    - media: fdp1: Reduce FCP not found message level to debug
    - media: rc: imon: Allow iMON RC protocol for ffdc 7e device
    - dmaengine: iop-adma: use correct printk format strings
    - perf record: Support aarch64 random socket_id assignment
    - media: i2c: ov5645: Fix power sequence
    - media: omap3isp: Don't set streaming state on random subdevs
    - media: imx: mipi csi-2: Don't fail if initial state times-out
    - net: lpc-enet: fix printk format strings
    - ARM: dts: imx7d: cl-som-imx7: make ethernet work again
    - media: radio/si470x: kill urb on error
    - media: hdpvr: add terminating 0 at end of string
    - nbd: add missing config put
    - media: dvb-core: fix a memory leak bug
    - libperf: Fix alignment trap with xyarray contents in 'perf stat'
    - EDAC/amd64: Recognize DRAM device type ECC capability
    - EDAC/amd64: Decode syndrome before translating address
    - PM / devfreq: passive: Use non-devm notifiers
    - PM / devfreq: exynos-bus: Correct clock enable sequence
    - media: cec-notifier: clear cec_adap in cec_notifier_unregister
    - media: saa7146: add cleanup in hexium_attach()
    - media: cpia2_usb: fix memory leaks
    - media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate()
    - perf trace beauty ioctl: Fix off-by-one error in cmd->string table
    - media: ov9650: add a sanity check
    - ASoC: es8316: fix headphone mixer volume table
    - ACPI / CPPC: do not require the _PSD method
    - arm64: kpti: ensure patched kernel text is fetched from PoU
    - nvmet: fix data units read and written counters in SMART log
    - iommu/amd: Silence warnings under memory pressure
    - iommu/iova: Avoid false sharing on fq_timer_on
    - libtraceevent: Change users plugin directory
    - ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks
    - ACPI: custom_method: fix memory leaks
    - ACPI / PCI: fix acpi_pci_irq_enable() memory leak
    - hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
    - md/raid1: fail run raid1 array when active disk less than one
    - dmaengine: ti: edma: Do not reset reserved paRAM slots
    - kprobes: Prohibit probing on BUG() and WARN() address
    - s390/crypto: xts-aes-s390 fix extra run-time crypto self tests finding
    - ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set
    - raid5: don't set STRIPE_HANDLE to stripe which is in batch list
    - mmc: core: Clarify sdio_irq_pending flag for MMC_CAP2_SDIO_IRQ_NOTHREAD
    - mmc: sdhci: Fix incorrect switch to HS mode
    - raid5: don't increment read_errors on EILSEQ return
    - libertas: Add missing sentinel at end of if_usb.c fw_table
    - ALSA: hda - Drop unsol event handler for Intel HDMI codecs
    - drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2)
    - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
    - ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
    - btrfs: extent-tree: Make sure we only allocate extents from block groups
      with the same type
    - media: omap3isp: Set device on omap3isp subdevs
    - PM / devfreq: passive: fix compiler warning
    - ALSA: firewire-tascam: handle error code when getting current source of
      clock
    - ALSA: firewire-tascam: check intermediate state of clock status and retry
    - scsi: scsi_dh_rdac: zero cdb in send_mode_select()
    - printk: Do not lose last line in kmsg buffer dump
    - IB/hfi1: Define variables as unsigned long to fix KASAN warning
    - randstruct: Check member structs in is_pure_ops_struct()
    - ALSA: hda/realtek - Fixup mute led on HP Spectre x360
    - fuse: fix missing unlock_page in fuse_writepage()
    - parisc: Disable HP HSC-PCI Cards to prevent kernel crash
    - x86/retpolines: Fix up backport of a9d57ef15cbe
    - KVM: x86: always stop emulation on page fault
    - KVM: x86: set ctxt->have_exception in x86_decode_insn()
    - KVM: x86: Manually calculate reserved bits when loading PDPTRS
    - media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
    - binfmt_elf: Do not move brk for INTERP-less ET_EXEC
    - ASoC: Intel: NHLT: Fix debug print format
    - ASoC: Intel: Skylake: Use correct function to access iomem space
    - ASoC: Intel: Fix use of potentially uninitialized variable
    - ARM: samsung: Fix system restart on S3C6410
    - ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up
    - arm64: dts: rockchip: limit clock rate of MMC controllers for RK3328
    - alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP
    - regulator: Defer init completion for a while after late_initcall
    - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps
    - memcg, oom: don't require __GFP_FS when invoking memcg OOM killer
    - memcg, kmem: do not fail __GFP_NOFAIL charges
    - ovl: filter of trusted xattr results in audit
    - Btrfs: fix use-after-free when using the tree modification log
    - btrfs: Relinquish CPUs in btrfs_compare_trees
    - btrfs: qgroup: Fix the wrong target io_tree when freeing reserved data space
    - md/raid6: Set R5_ReadError when there is read failure on parity disk
    - md: don't report active array_state until after revalidate_disk() completes.
    - md: only call set_in_sync() when it is expected to succeed.
    - cfg80211: Purge frame registrations on iftype change
    - /dev/mem: Bail out upon SIGKILL.
    - ext4: fix warning inside ext4_convert_unwritten_extents_endio
    - ext4: fix punch hole for inline_data file systems
    - quota: fix wrong condition in is_quota_modification()
    - hwrng: core - don't wait on add_early_randomness()
    - i2c: riic: Clear NACK in tend isr
    - CIFS: fix max ea value size
    - CIFS: Fix oplock handling for SMB 2.1+ protocols
    - md/raid0: avoid RAID0 data corruption due to layout confusion.
    - mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new
      zone
    - btrfs: qgroup: Drop quota_root and fs_info parameters from
      update_qgroup_status_item
    - Btrfs: fix race setting up and completing qgroup rescan workers
    - net/ibmvnic: free reset work of removed device from queue
    - HID: Add quirk for HP X500 PIXART OEM mouse
    - net/mlx5e: Set ECN for received packets using CQE indication
    - net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets
    - mlx5: fix get_ip_proto()
    - net/mlx5e: Allow reporting of checksum unnecessary
    - net/mlx5e: XDP, Avoid checksum complete when XDP prog is loaded
    - net/mlx5e: Rx, Check ip headers sanity
    - bcache: remove redundant LIST_HEAD(journal) from run_cache_set()
    - initramfs: don't free a non-existent initrd
    - blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs
    - net/ibmvnic: Fix missing { in __ibmvnic_reset
    - net_sched: check cops->tcf_block in tc_bind_tclass()
    - loop: Add LOOP_SET_BLOCK_SIZE in compat ioctl
    - loop: Add LOOP_SET_DIRECT_IO to compat ioctl
    - perf config: Honour $PERF_CONFIG env var to specify alternate .perfconfig
    - ASoC: sun4i-i2s: Don't use the oversample to calculate BCLK
    - posix-cpu-timers: Sanitize bogus WARNONS
    - x86/apic/vector: Warn when vector space exhaustion breaks affinity
    - x86/mm/pti: Do not invoke PTI functions when PTI is disabled
    - x86/mm/pti: Handle unaligned address gracefully in pti_clone_pagetable()
    - libata/ahci: Drop PCS quirk for Denverton and beyond
    - x86/cpu: Add Tiger Lake to Intel family
    - platform/x86: intel_pmc_core: Do not ioremap RAM
    - mmc: core: Add helper function to indicate if SDIO IRQs is enabled
    - mmc: dw_mmc: Re-store SDIO IRQs mask at system resume
    - iwlwifi: fw: don't send GEO_TX_POWER_LIMIT command to FW version 36
    - Revert "ceph: use ceph_evict_inode to cleanup inode's resource"
    - ceph: use ceph_evict_inode to cleanup inode's resource
    - ALSA: hda/realtek - PCI quirk for Medion E4254
    - smb3: allow disabling requesting leases
    - btrfs: fix allocation of free space cache v1 bitmap pages
    - drm/amd/display: Restore backlight brightness after system resume

 -- Khalid Elmously <khalid.elmously@canonical.com>  Mon, 21 Oct 2019 13:02:37 -0400

linux (4.15.0-66.75) bionic; urgency=medium

  * bionic/linux: 4.15.0-66.75 -proposed tracker (LP: #1846131)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * CVE-2018-21008
    - rsi: add fix for crash during assertions

  * ipv6: fix neighbour resolution with raw socket (LP: #1834465)
    - ipv6: constify rt6_nexthop()
    - ipv6: fix neighbour resolution with raw socket

  * run_netsocktests from net in ubuntu_kernel_selftests failed with X-4.15
    (LP: #1842023)
    - SAUCE: selftests: net: replace AF_MAX with INT_MAX in socket.c

  * No sound inputs from the external microphone and headset on a Dell machine
    (LP: #1842265)
    - ALSA: hda - Expand pin_match function to match upcoming new tbls
    - ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family

  * Add -fcf-protection=none when using retpoline flags (LP: #1843291)
    - SAUCE: kbuild: add -fcf-protection=none when using retpoline flags

  * Enhanced Hardware Support - Finalize Naming (LP: #1842774)
    - s390: add support for IBM z15 machines

  * Bionic update: upstream stable patchset 2019-09-24 (LP: #1845266)
    - bridge/mdb: remove wrong use of NLM_F_MULTI
    - cdc_ether: fix rndis support for Mediatek based smartphones
    - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
    - isdn/capi: check message length in capi_write()
    - net: Fix null de-reference of device refcount
    - net: gso: Fix skb_segment splat when splitting gso_size mangled skb having
      linear-headed frag_list
    - net: phylink: Fix flow control resolution
    - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
    - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
    - tipc: add NULL pointer check before calling kfree_rcu
    - tun: fix use-after-free when register netdev failed
    - btrfs: compression: add helper for type to string conversion
    - btrfs: correctly validate compression type
    - Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
    - gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist
    - gpio: fix line flag validation in linehandle_create
    - gpio: fix line flag validation in lineevent_create
    - Btrfs: fix assertion failure during fsync and use of stale transaction
    - genirq: Prevent NULL pointer dereference in resend_irqs()
    - KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
    - KVM: x86: work around leak of uninitialized stack contents
    - KVM: nVMX: handle page fault in vmread
    - MIPS: VDSO: Prevent use of smp_processor_id()
    - MIPS: VDSO: Use same -m%-float cflag as the kernel proper
    - powerpc: Add barrier_nospec to raw_copy_in_user()
    - drm/meson: Add support for XBGR8888 & ABGR8888 formats
    - clk: rockchip: Don't yell about bad mmc phases when getting
    - mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
    - PCI: Always allow probing with driver_override
    - ubifs: Correctly use tnc_next() in search_dh_cookie()
    - driver core: Fix use-after-free and double free on glue directory
    - crypto: talitos - check AES key size
    - crypto: talitos - fix CTR alg blocksize
    - crypto: talitos - check data blocksize in ablkcipher.
    - crypto: talitos - fix ECB algs ivsize
    - crypto: talitos - Do not modify req->cryptlen on decryption.
    - crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
    - firmware: ti_sci: Always request response from firmware
    - drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
    - Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
    - platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to
      critclk_systems DMI table
    - nvmem: Use the same permissions for eeprom as for nvmem
    - x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence
      GCC9 build warning
    - ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
    - x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large
      to fix kexec relocation errors
    - modules: fix BUG when load module with rodata=n
    - modules: fix compile error if don't have strict module rwx
    - HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
    - Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
    - powerpc/mm/radix: Use the right page size for vmemmap mapping
    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
    - media: tm6000: double free if usb disconnect while streaming
    - xen-netfront: do not assume sk_buff_head list is empty in error handling
    - net_sched: let qdisc_put() accept NULL pointer
    - KVM: coalesced_mmio: add bounds checking
    - firmware: google: check if size is valid when decoding VPD data
    - serial: sprd: correct the wrong sequence of arguments
    - tty/serial: atmel: reschedule TX after RX was started
    - mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
    - ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
    - s390/bpf: fix lcgr instruction encoding
    - ARM: OMAP2+: Fix omap4 errata warning on other SoCs
    - ARM: dts: dra74x: Fix iodelay configuration for mmc3
    - s390/bpf: use 32-bit index for tail calls
    - fpga: altera-ps-spi: Fix getting of optional confd gpio
    - netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
    - NFSv4: Fix return values for nfs4_file_open()
    - NFSv4: Fix return value in nfs_finish_open()
    - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    - Kconfig: Fix the reference to the IDT77105 Phy driver in the description of
      ATM_NICSTAR_USE_IDT77105
    - qed: Add cleanup in qed_slowpath_start()
    - ARM: 8874/1: mm: only adjust sections of valid mm structures
    - batman-adv: Only read OGM2 tvlv_len after buffer len check
    - r8152: Set memory to all 0xFFs on failed reg reads
    - x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
    - netfilter: nf_conntrack_ftp: Fix debug output
    - NFSv2: Fix eof handling
    - NFSv2: Fix write regression
    - kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the
      first symbol
    - cifs: set domainName when a domain-key is used in multiuser
    - cifs: Use kzfree() to zero out the password
    - ARM: 8901/1: add a criteria for pfn_valid of arm
    - sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    - i2c: designware: Synchronize IRQs when unregistering slave client
    - perf/x86/intel: Restrict period on Nehalem
    - perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
    - amd-xgbe: Fix error path in xgbe_mod_init()
    - tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at
      -O2
    - tools/power x86_energy_perf_policy: Fix argument parsing
    - tools/power turbostat: fix buffer overrun
    - net: seeq: Fix the function used to release some memory in an error handling
      path
    - dmaengine: ti: dma-crossbar: Fix a memory leak bug
    - dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    - x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation
    - x86/hyper-v: Fix overflow bug in fill_gva_list()
    - keys: Fix missing null pointer check in request_key_auth_describe()
    - iommu/amd: Flush old domains in kdump kernel
    - iommu/amd: Fix race in increase_address_space()
    - PCI: kirin: Fix section mismatch warning
    - floppy: fix usercopy direction
    - binfmt_elf: move brk out of mmap when doing direct loader exec
    - tcp: Reset send_head when removing skb from write-queue
    - tcp: Don't dequeue SYN/FIN-segments from write-queue
    - media: technisat-usb2: break out of loop at end of buffer
    - tools: bpftool: close prog FD before exit on showing a single program
    - netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
    - ibmvnic: Do not process reset during or after device removal
    - net: aquantia: fix out of memory condition on rx side

  * Bionic update: upstream stable patchset 2019-09-18 (LP: #1844558)
    - ALSA: hda - Fix potential endless loop at applying quirks
    - ALSA: hda/realtek - Fix overridden device-specific initialization
    - ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
    - sched/fair: Don't assign runtime for throttled cfs_rq
    - drm/vmwgfx: Fix double free in vmw_recv_msg()
    - xfrm: clean up xfrm protocol checks
    - PCI: designware-ep: Fix find_first_zero_bit() usage
    - PCI: dra7xx: Fix legacy INTD IRQ handling
    - vhost/test: fix build for vhost test
    - batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
    - batman-adv: Only read OGM tvlv_len after buffer len check
    - hv_sock: Fix hang when a connection is closed
    - powerpc/64: mark start_here_multiplatform as __ref
    - arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
    - scripts/decode_stacktrace: match basepath using shell prefix operator, not
      regex
    - clk: s2mps11: Add used attribute to s2mps11_dt_match
    - kernel/module: Fix mem leak in module_add_modinfo_attrs
    - ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
    - {nl,mac}80211: fix interface combinations on crypto controlled devices
    - x86/ftrace: Fix warning and considate ftrace_jmp_replace() and
      ftrace_call_replace()
    - media: stm32-dcmi: fix irq = 0 case
    - modules: always page-align module section allocations
    - scsi: qla2xxx: Move log messages before issuing command to firmware
    - keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
    - Drivers: hv: kvp: Fix two "this statement may fall through" warnings
    - remoteproc: qcom: q6v5-mss: add SCM probe dependency
    - KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS
    - KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv'
      variables
    - drm/i915: Fix intel_dp_mst_best_encoder()
    - drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE
    - drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
    - drm/atomic_helper: Disallow new modesets on unregistered connectors
    - Drivers: hv: kvp: Fix the indentation of some "break" statements
    - Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up
    - drm/amd/dm: Understand why attaching path/tile properties are needed
    - ARM: davinci: da8xx: define gpio interrupts as separate resources
    - ARM: davinci: dm365: define gpio interrupts as separate resources
    - ARM: davinci: dm646x: define gpio interrupts as separate resources
    - ARM: davinci: dm355: define gpio interrupts as separate resources
    - ARM: davinci: dm644x: define gpio interrupts as separate resources
    - media: vim2m: use workqueue
    - media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work
    - drm/i915: Restore sane defaults for KMS on GEM error load
    - KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode
      switch
    - Btrfs: clean up scrub is_dev_replace parameter
    - Btrfs: fix deadlock with memory reclaim during scrub
    - btrfs: Remove extent_io_ops::fill_delalloc
    - btrfs: Fix error handling in btrfs_cleanup_ordered_extents
    - scsi: megaraid_sas: Fix combined reply queue mode detection
    - scsi: megaraid_sas: Add check for reset adapter bit
    - media: vim2m: only cancel work if it is for right context
    - ARC: show_regs: lockdep: re-enable preemption
    - ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while
      handle_mm_fault
    - IB/uverbs: Fix OOPs upon device disassociation
    - drm/vblank: Allow dynamic per-crtc max_vblank_count
    - drm/i915/ilk: Fix warning when reading emon_status with no output
    - mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies
    - tpm: Fix some name collisions with drivers/char/tpm.h
    - bcache: replace hard coded number with BUCKET_GC_GEN_MAX
    - bcache: treat stale && dirty keys as bad keys
    - KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
    - iio: adc: exynos-adc: Add S5PV210 variant
    - iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
    - drm/nouveau: Don't WARN_ON VCPI allocation failures
    - x86/kvmclock: set offset for kvm unstable clock
    - powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
    - mmc: renesas_sdhi: Fix card initialization failure in high speed mode
    - btrfs: scrub: pass fs_info to scrub_setup_ctx
    - btrfs: init csum_list before possible free
    - PCI: qcom: Don't deassert reset GPIO during probe
    - drm: add __user attribute to ptr_to_compat()
    - CIFS: Fix error paths in writeback code
    - CIFS: Fix leaking locked VFS cache pages in writeback retry
    - drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set
    - drm/i915: Sanity check mmap length against object size
    - IB/mlx5: Reset access mask when looping inside page fault handler
    - kvm: mmu: Fix overflow on kvm mmu page limit calculation
    - x86/kvm: move kvm_load/put_guest_xcr0 into atomic context
    - KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels
    - cifs: Fix lease buffer length error
    - ext4: protect journal inode's blocks using block_validity
    - dm mpath: fix missing call of path selector type->end_io
    - blk-mq: free hw queue's resource in hctx's release handler
    - mmc: sdhci-pci: Add support for Intel ICP
    - mmc: sdhci-pci: Add support for Intel CML
    - dm crypt: move detailed message into debug level
    - kvm: Check irqchip mode before assign irqfd
    - drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
    - drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc
    - Btrfs: fix race between block group removal and block group allocation
    - cifs: add spinlock for the openFileList to cifsInodeInfo
    - IB/hfi1: Avoid hardlockup with flushlist_lock
    - apparmor: reset pos on failure to unpack for various functions
    - staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
    - scsi: zfcp: fix request object use-after-free in send path causing wrong
      traces
    - cifs: Properly handle auto disabling of serverino option
    - ceph: use ceph_evict_inode to cleanup inode's resource
    - KVM: x86: optimize check for valid PAT value
    - KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value
    - KVM: VMX: Fix handling of #MC that occurs during VM-Entry
    - KVM: VMX: check CPUID before allowing read/write of IA32_XSS
    - resource: Include resource end in walk_*() interfaces
    - resource: Fix find_next_iomem_res() iteration issue
    - resource: fix locking in find_next_iomem_res()
    - pstore: Fix double-free in pstore_mkfile() failure path
    - dm thin metadata: check if in fail_io mode when setting needs_check
    - drm/panel: Add support for Armadeus ST0700 Adapt
    - ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
    - iommu/iova: Remove stale cached32_node
    - gpio: don't WARN() on NULL descs if gpiolib is disabled
    - i2c: at91: disable TXRDY interrupt after sending data
    - i2c: at91: fix clk_offset for sama5d2
    - mm/migrate.c: initialize pud_entry in migrate_vma()
    - iio: adc: gyroadc: fix uninitialized return code
    - NFSv4: Fix delegation state recovery
    - bcache: only clear BTREE_NODE_dirty bit when it is set
    - bcache: add comments for mutex_lock(&b->write_lock)
    - virtio/s390: fix race on airq_areas[]
    - ext4: don't perform block validity checks on the journal inode
    - ext4: fix block validity checks for journal inodes using indirect blocks
    - ext4: unsigned int compared against zero
    - powerpc/tm: Remove msr_tm_active()

  * Bionic update: upstream stable patchset 2019-09-10 (LP: #1843463)
    - net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ
      context
    - hv_netvsc: Fix a warning of suspicious RCU usage
    - net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    - Bluetooth: btqca: Add a short delay before downloading the NVM
    - ibmveth: Convert multicast list size for little-endian system
    - gpio: Fix build error of function redefinition
    - drm/mediatek: use correct device to import PRIME buffers
    - drm/mediatek: set DMA max segment size
    - cxgb4: fix a memory leak bug
    - liquidio: add cleanup in octeon_setup_iq()
    - net: myri10ge: fix memory leaks
    - lan78xx: Fix memory leaks
    - vfs: fix page locking deadlocks when deduping files
    - cx82310_eth: fix a memory leak bug
    - net: kalmia: fix memory leaks
    - wimax/i2400m: fix a memory leak bug
    - ravb: Fix use-after-free ravb_tstamp_skb
    - kprobes: Fix potential deadlock in kprobe_optimizer()
    - HID: cp2112: prevent sleeping function called from invalid context
    - Input: hyperv-keyboard: Use in-place iterator API in the channel callback
    - Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    - IB/mlx4: Fix memory leaks
    - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    - ceph: fix buffer free while holding i_ceph_lock in
      __ceph_build_xattrs_blob()
    - ceph: fix buffer free while holding i_ceph_lock in fill_inode()
    - KVM: arm/arm64: Only skip MMIO insn once
    - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    - spi: bcm2835aux: unifying code between polling and interrupt driven code
    - spi: bcm2835aux: remove dangerous uncontrolled read of fifo
    - spi: bcm2835aux: fix corruptions for longer spi transfers
    - net: fix skb use after free in netpoll
    - net_sched: fix a NULL pointer deref in ipt action
    - net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
    - tcp: inherit timestamp on mtu probe
    - tcp: remove empty skb from write queue in error cases
    - net: sched: act_sample: fix psample group handling on overwrite
    - mld: fix memory leak in mld_del_delrec()
    - x86/boot: Preserve boot_params.secure_boot from sanitizing
    - tools: bpftool: fix error message (prog -> object)
    - scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
    - afs: Fix leak in afs_lookup_cell_rcu()

  * Bionic update: upstream stable patchset 2019-09-09 (LP: #1843338)
    - dmaengine: ste_dma40: fix unneeded variable warning
    - auxdisplay: panel: need to delete scan_timer when misc_register fails in
      panel_attach
    - iommu/dma: Handle SG length overflow better
    - usb: gadget: composite: Clear "suspended" on reset/disconnect
    - usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
    - xen/blkback: fix memory leaks
    - i2c: rcar: avoid race when unregistering slave client
    - i2c: emev2: avoid race when unregistering slave client
    - drm/ast: Fixed reboot test may cause system hanged
    - usb: host: fotg2: restart hcd after port reset
    - tools: hv: fix KVP and VSS daemons exit code
    - watchdog: bcm2835_wdt: Fix module autoload
    - drm/bridge: tfp410: fix memleak in get_modes()
    - scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
    - drm/tilcdc: Register cpufreq notifier after we have initialized crtc
    - ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
    - ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
    - net/smc: make sure EPOLLOUT is raised
    - tcp: make sure EPOLLOUT wont be missed
    - mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
    - ALSA: line6: Fix memory leak at line6_init_pcm() error path
    - ALSA: seq: Fix potential concurrent access to the deleted pool
    - kvm: x86: skip populating logical dest map if apic is not sw enabled
    - KVM: x86: Don't update RIP or do single-step on faulting emulation
    - x86/apic: Do not initialize LDR and DFR for bigsmp
    - ftrace: Fix NULL pointer dereference in t_probe_next()
    - ftrace: Check for successful allocation of hash
    - ftrace: Check for empty hash and comment the race with registering probes
    - usb-storage: Add new JMS567 revision to unusual_devs
    - USB: cdc-wdm: fix race between write and disconnect due to flag abuse
    - usb: chipidea: udc: don't do hardware access if gadget has stopped
    - usb: host: ohci: fix a race condition between shutdown and irq
    - usb: host: xhci: rcar: Fix typo in compatible string matching
    - USB: storage: ums-realtek: Update module parameter description for
      auto_delink_en
    - uprobes/x86: Fix detection of 32-bit user mode
    - mmc: sdhci-of-at91: add quirk for broken HS200
    - mmc: core: Fix init of SD cards reporting an invalid VDD range
    - stm class: Fix a double free of stm_source_device
    - intel_th: pci: Add support for another Lewisburg PCH
    - intel_th: pci: Add Tiger Lake support
    - drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
    - VMCI: Release resource if the work is already queued
    - crypto: ccp - Ignore unconfigured CCP device on suspend/resume
    - Revert "cfg80211: fix processing world regdomain when non modular"
    - mac80211: fix possible sta leak
    - KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
    - KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
    - KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
    - NFS: Clean up list moves of struct nfs_page
    - NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
    - NFS: Pass error information to the pgio error cleanup routine
    - NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
    - i2c: piix4: Fix port selection for AMD Family 16h Model 30h
    - x86/ptrace: fix up botched merge of spectrev1 fix
    - Revert "ASoC: Fail card instantiation if DAI format setup fails"
    - nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
    - afs: Fix the CB.ProbeUuid service handler to reply correctly
    - dmaengine: stm32-mdma: Fix a possible null-pointer dereference in
      stm32_mdma_irq_handler()
    - omap-dma/omap_vout_vrfb: fix off-by-one fi value
    - arm64: cpufeature: Don't treat granule sizes as strict
    - tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
    - ipv4/icmp: fix rt dst dev null pointer dereference
    - ALSA: hda - Fixes inverted Conexant GPIO mic mute led
    - usb: hcd: use managed device resources
    - lib: logic_pio: Fix RCU usage
    - lib: logic_pio: Avoid possible overlap for unregistering regions
    - lib: logic_pio: Add logic_pio_unregister_range()
    - drm/amdgpu: Add APTX quirk for Dell Latitude 5495
    - drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
    - bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-
      free

  * New ID in ums-realtek module breaks cardreader (LP: #1838886) // Bionic
    update: upstream stable patchset 2019-09-09 (LP: #1843338)
    - USB: storage: ums-realtek: Whitelist auto-delink support

  * TC filters are broken on Mellanox after upstream stable updates
    (LP: #1842502)
    - net/mlx5e: Remove redundant vport context vlan update
    - net/mlx5e: Properly order min inline mode setup while parsing TC matches
    - net/mlx5e: Get the required HW match level while parsing TC flow matches
    - net/mlx5e: Always use the match level enum when parsing TC rule match
    - net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded

 -- Khalid Elmously <khalid.elmously@canonical.com>  Mon, 30 Sep 2019 23:02:24 -0400

linux (4.15.0-65.74) bionic; urgency=medium

  * bionic/linux: 4.15.0-65.74 -proposed tracker (LP: #1844403)

  * arm64: large modules fail to load (LP: #1841109)
    - arm64/kernel: kaslr: reduce module randomization range to 4 GB
    - arm64/kernel: don't ban ADRP to work around Cortex-A53 erratum #843419
    - arm64: fix undefined reference to 'printk'
    - arm64/kernel: rename module_emit_adrp_veneer->module_emit_veneer_for_adrp
    - [config] Remove CONFIG_ARM64_MODULE_CMODEL_LARGE

  * CVE-2018-20976
    - xfs: clear sb->s_fs_info on mount failure

  * br_netfilter: namespace sysctl operations (LP: #1836910)
    - net: bridge: add bitfield for options and convert vlan opts
    - net: bridge: convert nf call options to bits
    - netfilter: bridge: port sysctls to use brnf_net
    - netfilter: bridge: namespace bridge netfilter sysctls
    - netfilter: bridge: prevent UAF in brnf_exit_net()

  * tuntap: correctly set SOCKWQ_ASYNC_NOSPACE (LP: #1830756)
    - tuntap: correctly set SOCKWQ_ASYNC_NOSPACE

  * Bionic update: upstream stable patchset 2019-08-30 (LP: #1842114)
    - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
    - MIPS: kernel: only use i8253 clocksource with periodic clockevent
    - mips: fix cacheinfo
    - netfilter: ebtables: fix a memory leak bug in compat
    - ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
    - bonding: Force slave speed check after link state recovery for 802.3ad
    - can: dev: call netif_carrier_off() in register_candev()
    - ASoC: Fail card instantiation if DAI format setup fails
    - st21nfca_connectivity_event_received: null check the allocation
    - st_nci_hci_connectivity_event_received: null check the allocation
    - ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    - net: usb: qmi_wwan: Add the BroadMobi BM818 card
    - qed: RDMA - Fix the hw_ver returned in device attributes
    - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in
      start_isoc_chain()
    - netfilter: ipset: Fix rename concurrency with listing
    - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
    - perf bench numa: Fix cpu0 binding
    - can: sja1000: force the string buffer NULL-terminated
    - can: peak_usb: force the string buffer NULL-terminated
    - net/ethernet/qlogic/qed: force the string buffer NULL-terminated
    - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    - HID: input: fix a4tech horizontal wheel custom usage
    - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
    - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    - net: hisilicon: make hip04_tx_reclaim non-reentrant
    - net: hisilicon: fix hip04-xmit never return TX_BUSY
    - net: hisilicon: Fix dma_map_single failed on arm64
    - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
    - libata: add SG safety checks in SFF pio transfers
    - x86/lib/cpu: Address missing prototypes warning
    - drm/vmwgfx: fix memory leak when too many retries have occurred
    - perf ftrace: Fix failure to set cpumask when only one cpu is present
    - perf cpumap: Fix writing to illegal memory in handling cpumap mask
    - perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
    - selftests: kvm: Adding config fragments
    - HID: wacom: correct misreported EKR ring values
    - HID: wacom: Correct distance scale for 2nd-gen Intuos devices
    - Revert "dm bufio: fix deadlock with loop device"
    - ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply
    - libceph: fix PG split vs OSD (re)connect race
    - drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX
    - gpiolib: never report open-drain/source lines as 'input' to user-space
    - userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
    - x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    - x86/apic: Handle missing global clockevent gracefully
    - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    - x86/boot: Save fields explicitly, zero out everything else
    - x86/boot: Fix boot regression caused by bootparam sanitizing
    - dm kcopyd: always complete failed jobs
    - dm btree: fix order of block initialization in btree_split_beneath
    - dm space map metadata: fix missing store of apply_bops() return value
    - dm table: fix invalid memory accesses with too high sector number
    - dm zoned: improve error handling in reclaim
    - dm zoned: improve error handling in i/o map code
    - dm zoned: properly handle backing device failure
    - genirq: Properly pair kobject_del() with kobject_add()
    - mm, page_owner: handle THP splits correctly
    - mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
    - mm/zsmalloc.c: fix race condition in zs_destroy_pool
    - xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
    - dm zoned: fix potential NULL dereference in dmz_do_reclaim()
    - powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB
    - can: mcp251x: add error check when wq alloc failed
    - netfilter: ipset: Actually allow destination MAC address for hash:ip,mac
      sets too
    - netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and
      hash:ip,mac sets
    - rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet
    - net: phy: phy_led_triggers: Fix a possible null-pointer dereference in
      phy_led_trigger_change_speed()
    - NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts
    - net: stmmac: Fix issues when number of Queues >= 4
    - KVM: arm64: Don't write junk to sysregs on reset
    - KVM: arm: Don't write junk to CP15 registers on reset
    - xfs: don't trip over uninitialized buffer on extent read of corrupted inode
    - xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h
    - xfs: Add helper function xfs_attr_try_sf_addname
    - xfs: Add attibute remove and helper functions

  * Bionic update: upstream stable patchset 2019-08-27 (LP: #1841652)
    - sh: kernel: hw_breakpoint: Fix missing break in switch statement
    - mm/usercopy: use memory range to be accessed for wraparound check
    - mm/memcontrol.c: fix use after free in mem_cgroup_iter()
    - bpf: get rid of pure_initcall dependency to enable jits
    - bpf: restrict access to core bpf sysctls
    - bpf: add bpf_jit_limit knob to restrict unpriv allocations
    - xtensa: add missing isync to the cpu_reset TLB code
    - ALSA: hda - Apply workaround for another AMD chip 1022:1487
    - ALSA: hda - Fix a memory leak bug
    - HID: holtek: test for sanity of intfdata
    - HID: hiddev: avoid opening a disconnected device
    - HID: hiddev: do cleanup in failure of opening a device
    - Input: kbtab - sanity check for endpoint type
    - Input: iforce - add sanity checks
    - net: usb: pegasus: fix improper read if get_registers() fail
    - netfilter: ebtables: also count base chain policies
    - clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1
    - clk: renesas: cpg-mssr: Fix reset control race condition
    - xen/pciback: remove set but not used variable 'old_state'
    - irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail
    - irqchip/irq-imx-gpcv2: Forward irq type to parent
    - perf header: Fix divide by zero error if f_header.attr_size==0
    - perf header: Fix use of unitialized value warning
    - libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    - drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m
    - scsi: hpsa: correct scsi command status issue after reset
    - scsi: qla2xxx: Fix possible fcport null-pointer dereferences
    - ata: libahci: do not complain in case of deferred probe
    - kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
    - arm64/efi: fix variable 'si' set but not used
    - arm64: unwind: Prohibit probing on return_address()
    - arm64/mm: fix variable 'pud' set but not used
    - IB/core: Add mitigation for Spectre V1
    - IB/mad: Fix use-after-free in ib mad completion handling
    - drm: msm: Fix add_gpu_components
    - ocfs2: remove set but not used variable 'last_hash'
    - asm-generic: fix -Wtype-limits compiler warnings
    - KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block
    - staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
    - staging: comedi: dt3000: Fix rounding up of timer divisor
    - iio: adc: max9611: Fix temperature reading in probe
    - USB: core: Fix races in character device registration and deregistraion
    - usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role"
    - usb: cdc-acm: make sure a refcount is taken early enough
    - USB: CDC: fix sanity checks in CDC union parser
    - USB: serial: option: add D-Link DWM-222 device ID
    - USB: serial: option: Add support for ZTE MF871A
    - USB: serial: option: add the BroadMobi BM818 card
    - USB: serial: option: Add Motorola modem UARTs
    - bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
    - arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side
    - netfilter: conntrack: Use consistent ct id hash calculation
    - Input: psmouse - fix build error of multiple definition
    - iommu/amd: Move iommu_init_pci() to .init section
    - bnx2x: Fix VF's VLAN reconfiguration in reload.
    - net/mlx4_en: fix a memory leak bug
    - net/packet: fix race in tpacket_snd()
    - sctp: fix the transport error_count check
    - xen/netback: Reset nr_frags before freeing skb
    - net/mlx5e: Only support tx/rx pause setting for port owner
    - net/mlx5e: Use flow keys dissector to parse packets for ARFS
    - team: Add vlan tx offload to hw_enc_features
    - bonding: Add vlan tx offload to hw_enc_features
    - mmc: sdhci-of-arasan: Do now show error message in case of deffered probe
    - xfrm: policy: remove pcpu policy cache
    - mm/hmm: fix bad subpage pointer in try_to_unmap_one
    - mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and
      MPOL_MF_STRICT were specified
    - mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind
    - riscv: Make __fstate_clean() work correctly.
    - Revert "kmemleak: allow to coexist with fault injection"
    - sctp: fix memleak in sctp_send_reset_streams

  * Bionic update: upstream stable patchset 2019-08-16 (LP: #1840520)
    - iio: adc: max9611: Fix misuse of GENMASK macro
    - crypto: ccp - Fix oops by properly managing allocated structures
    - crypto: ccp - Ignore tag length when decrypting GCM ciphertext
    - usb: usbfs: fix double-free of usb memory upon submiturb error
    - usb: iowarrior: fix deadlock on disconnect
    - sound: fix a memory leak bug
    - mmc: cavium: Set the correct dma max segment size for mmc_host
    - mmc: cavium: Add the missing dma unmap when the dma has finished.
    - loop: set PF_MEMALLOC_NOIO for the worker thread
    - Input: synaptics - enable RMI mode for HP Spectre X360
    - lkdtm: support llvm-objcopy
    - crypto: ccp - Validate buffer lengths for copy operations
    - crypto: ccp - Add support for valid authsize values less than 16
    - perf annotate: Fix s390 gap between kernel end and module start
    - perf db-export: Fix thread__exec_comm()
    - perf record: Fix module size on s390
    - usb: host: xhci-rcar: Fix timeout in xhci_suspend()
    - usb: yurex: Fix use-after-free in yurex_delete
    - can: rcar_canfd: fix possible IRQ storm on high load
    - can: peak_usb: fix potential double kfree_skb()
    - netfilter: nfnetlink: avoid deadlock due to synchronous request_module
    - vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn
    - netfilter: Fix rpfilter dropping vrf packets by mistake
    - netfilter: nft_hash: fix symhash with modulus one
    - scripts/sphinx-pre-install: fix script for RHEL/CentOS
    - iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
    - mac80211: don't warn about CW params when not using them
    - hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
    - drm: silence variable 'conn' set but not used
    - cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    - s390/qdio: add sanity checks to the fast-requeue path
    - ALSA: compress: Fix regression on compressed capture streams
    - ALSA: compress: Prevent bypasses of set_params
    - ALSA: compress: Don't allow paritial drain operations on capture streams
    - ALSA: compress: Be more restrictive about when a drain is allowed
    - perf tools: Fix proper buffer size for feature processing
    - perf probe: Avoid calling freeing routine multiple times for same pointer
    - drbd: dynamically allocate shash descriptor
    - ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
    - ARM: davinci: fix sleep.S build error on ARMv4
    - scsi: megaraid_sas: fix panic on loading firmware crashdump
    - scsi: ibmvfc: fix WARN_ON during event pool release
    - scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
    - test_firmware: fix a memory leak bug
    - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
    - perf/core: Fix creating kernel counters for PMUs that override event->cpu
    - HID: sony: Fix race condition between rumble and device remove.
    - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    - hwmon: (nct7802) Fix wrong detection of in4 presence
    - drm/i915: Fix wrong escape clock divisor init for GLK
    - ALSA: firewire: fix a memory leak bug
    - ALSA: hda - Don't override global PCM hw info flag
    - ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)
    - mac80211: don't WARN on short WMM parameters from AP
    - SMB3: Fix deadlock in validate negotiate hits reconnect
    - smb3: send CAP_DFS capability during session setup
    - NFSv4: Only pass the delegation to setattr if we're sending a truncate
    - NFSv4: Fix an Oops in nfs4_do_setattr
    - KVM: Fix leak vCPU's VMCS value into other pCPU
    - mwifiex: fix 802.11n/WPA detection
    - iwlwifi: don't unmap as page memory that was mapped as single
    - iwlwifi: mvm: fix an out-of-bound access
    - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
    - iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support
    - iio: cros_ec_accel_legacy: Fix incorrect channel setting
    - staging: android: ion: Bail out upon SIGKILL when allocating memory.
    - x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS
    - usb: typec: tcpm: free log buf memory when remove debug file
    - usb: typec: tcpm: remove tcpm dir if no children
    - usb: typec: tcpm: Add NULL check before dereferencing config
    - netfilter: conntrack: always store window size un-scaled
    - drm/amd/display: Wait for backlight programming completion in set backlight
      level
    - drm/amd/display: use encoder's engine id to find matched free audio device
    - drm/amd/display: Fix dc_create failure handling and 666 color depths
    - drm/amd/display: Only enable audio if speaker allocation exists
    - drm/amd/display: Increase size of audios array
    - allocate_flower_entry: should check for null deref
    - s390/dma: provide proper ARCH_ZONE_DMA_BITS value
    - ALSA: hiface: fix multiple memory leak bugs

  * Bionic update: upstream stable patchset 2019-08-15 (LP: #1840378)
    - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
    - ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV
    - ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo
    - HID: wacom: fix bit shift for Cintiq Companion 2
    - HID: Add quirk for HP X1200 PIXART OEM mouse
    - RDMA: Directly cast the sockaddr union to sockaddr
    - IB: directly cast the sockaddr union to aockaddr
    - atm: iphase: Fix Spectre v1 vulnerability
    - ife: error out when nla attributes are empty
    - ip6_tunnel: fix possible use-after-free on xmit
    - net: bridge: delete local fdb on device init failure
    - net: bridge: mcast: don't delete permanent entries when fast leave is
      enabled
    - net: fix ifindex collision during namespace removal
    - net/mlx5: Use reversed order when unregister devices
    - net: phylink: Fix flow control for fixed-link
    - net: sched: Fix a possible null-pointer dereference in dequeue_func()
    - NFC: nfcmrvl: fix gpio-handling regression
    - tipc: compat: allow tipc commands without arguments
    - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
    - net/mlx5e: Prevent encap flow counter update async to user query
    - tun: mark small packets as owned by the tap sock
    - mvpp2: refactor MTU change code
    - bnx2x: Disable multi-cos feature.
    - cgroup: Call cgroup_release() before __exit_signal()
    - cgroup: Implement css_task_iter_skip()
    - cgroup: Include dying leaders with live threads in PROCS iterations
    - cgroup: css_task_iter_skip()'d iterators must be advanced before accessed
    - cgroup: Fix css_task_iter_advance_css_set() cset skip condition
    - spi: bcm2835: Fix 3-wire mode if DMA is enabled
    - driver core: Establish order of operations for device_add and device_del via
      bitflag
    - drivers/base: Introduce kill_device()
    - libnvdimm/bus: Prevent duplicate device_unregister() calls
    - libnvdimm/region: Register badblocks before namespaces
    - libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant
    - libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock
    - ipip: validate header length in ipip_tunnel_xmit
    - mvpp2: fix panic on module removal
    - net/mlx5: Fix modify_cq_in alignment
    - r8169: don't use MSI before RTL8168d

  * VIMC module not available (CONFIG_VIDEO_VIMC not set) (LP: #1831482)
    - [Config] Enable VIMC module

  * reboot will introduce an alarm 'beep ...' during BIOS phase (LP: #1840395)
    - ALSA: hda - Let all conexant codec enter D3 when rebooting
    - ALSA: hda - Add a generic reboot_notify

  * Include Sunix serial/parallel driver (LP: #1826716)
    - serial: 8250_pci: Add support for Sunix serial boards
    - parport: parport_serial: Add support for Sunix Multi I/O boards

  * Intel HDMI audio print "Unable to sync register" errors (LP: #1840394)
    - ALSA: hda - Don't resume forcibly i915 HDMI/DP codec

  * Support cpufreq, thermal sensors & cooling cells on iMX6Q based Nitrogen6x
    board (LP: #1840437)
    - arm: imx: Add MODULE_ALIAS for cpufreq
    - ARM: dts: imx: Add missing OPP properties for CPUs
    - ARM: dts: imx7d: use operating-points-v2 for cpu
    - ARM: dts: imx7d: remove "operating-points" property for cpu1
    - ARM: dts: imx: add cooling-cells for cpufreq cooling device
    - ARM: dts: imx6: add thermal sensor and cooling cells

  * hns3: ring buffer race leads can cause corruption (LP: #1840717)
    - net: hns3: minor optimization for ring_space
    - net: hns3: fix data race between ring->next_to_clean
    - net: hns3: optimize the barrier using when cleaning TX BD

  * Bionic build broken if CONFIG_MODVERSIONS enabled (LP: #1840321)
    - Revert "genksyms: Teach parser about 128-bit built-in types"

  * [bionic] drm/i915: softpin broken, needs to be fixed for 32bit mesa
    (LP: #1815172)
    - SAUCE: drm/i915: Partially revert d6edad3777c28ea

  * Goodix touchpad may drop first input event (LP: #1840075)
    - mfd: intel-lpss: Remove D3cold delay

  * NULL pointer dereference when Inserting the VIMC module (LP: #1840028)
    - media: vimc: fix component match compare

  * Fix touchpad IRQ storm after S3 (LP: #1841396)
    - pinctrl: intel: remap the pin number to gpio offset for irq enabled pin

  * [SRU][B/OEM-B/OEM-OSP1/D] UBUNTU: SAUCE: enable middle button for one more
    ThinkPad (LP: #1841722)
    - SAUCE: Input: elantech - enable middle button for one more ThinkPad

  * Test 391/u and 391/p from ubuntu_bpf failed on B (LP: #1841704)
    - SAUCE: Fix "bpf: improve verifier branch analysis"

  * crypto/testmgr.o fails to build due to struct cipher_testvec not having data
    members: ctext, ptext, len (LP: #1841264)
    - SAUCE: Revert "crypto: testmgr - add AES-CFB tests"

  * Bionic QEMU with Bionic Kernel hangs in AMD FX-8350 with cpu-host as
    passthrough (LP: #1834522)
    - KVM: SVM: install RSM intercept
    - KVM: x86: SVM: Set EMULTYPE_NO_REEXECUTE for RSM emulation

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 17 Sep 2019 18:12:26 +0200

linux (4.15.0-64.73) bionic; urgency=medium

  * powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts
    (CVE-2019-15031) / powerpc/tm: Fix FP/VMX unavailable exceptions inside a
    transaction (CVE-2019-15030) (LP: #1843533) // CVE-2019-15031
    - powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
    - powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts

  * CVE-2019-14835
    - vhost: fix dirty log buffer overflow

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 12 Sep 2019 11:30:41 +0200

linux (4.15.0-62.69) bionic; urgency=medium

  * bionic/linux: 4.15.0-62.69 -proposed tracker (LP: #1842746)

  * Kernel Panic with linux-image-4.15.0-60-generic when specifying nameserver
    in docker-compose (LP: #1842447)
    - ip: frags: fix crash in ip_do_fragment()

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 04 Sep 2019 16:11:43 -0400

linux (4.15.0-60.67) bionic; urgency=medium

  * bionic/linux: 4.15.0-60.67 -proposed tracker (LP: #1841086)

  * [Regression] net test from ubuntu_kernel_selftests failed due to bpf test
    compilation issue (LP: #1840935)
    - SAUCE: Fix "bpf: relax verifier restriction on BPF_MOV | BPF_ALU"

  * [Regression] failed to compile seccomp test from ubuntu_kernel_selftests
    (LP: #1840932)
    - Revert "selftests: skip seccomp get_metadata test if not real root"

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 22 Aug 2019 18:32:43 +0200

linux (4.15.0-59.66) bionic; urgency=medium

  * bionic/linux: 4.15.0-59.66 -proposed tracker (LP: #1840006)

  * zfs not completely removed from bionic tree (LP: #1840051)
    - SAUCE: (noup) remove completely the zfs code

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * [18.04 FEAT] Enhanced hardware support (LP: #1836857)
    - s390: report new CPU capabilities
    - s390: add alignment hints to vector load and store

  * [18.04 FEAT] Enhanced CPU-MF hardware counters - kernel part (LP: #1836860)
    - s390/cpum_cf: Add support for CPU-MF SVN 6
    - s390/cpumf: Add extended counter set definitions for model 8561 and 8562

  * ideapad_laptop disables WiFi/BT radios on Lenovo Y540 (LP: #1837136)
    - platform/x86: ideapad-laptop: Remove no_hw_rfkill_list

  * Stacked onexec transitions fail when under NO NEW PRIVS restrictions
    (LP: #1839037)
    - SAUCE: apparmor: fix nnp subset check failure when, stacking

  * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) // Tight
    timeout for bcache removal causes spurious failures (LP: #1796292)
    - SAUCE: bcache: fix deadlock in bcache_allocator

  * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665)
    - bcache: never writeback a discard operation
    - bcache: improve bcache_reboot()
    - bcache: fix writeback target calc on large devices
    - bcache: add journal statistic
    - bcache: fix high CPU occupancy during journal
    - bcache: use pr_info() to inform duplicated CACHE_SET_IO_DISABLE set
    - bcache: fix incorrect sysfs output value of strip size
    - bcache: fix error return value in memory shrink
    - bcache: fix using of loop variable in memory shrink
    - bcache: Fix indentation
    - bcache: Add __printf annotation to __bch_check_keys()
    - bcache: Annotate switch fall-through
    - bcache: Fix kernel-doc warnings
    - bcache: Remove an unused variable
    - bcache: Suppress more warnings about set-but-not-used variables
    - bcache: Reduce the number of sparse complaints about lock imbalances
    - bcache: Fix a compiler warning in bcache_device_init()
    - bcache: Move couple of string arrays to sysfs.c
    - bcache: Move couple of functions to sysfs.c
    - bcache: Replace bch_read_string_list() by __sysfs_match_string()

  * linux hwe i386 kernel 5.0.0-21.22~18.04.1 crashes on Lenovo x220
    (LP: #1838115)
    - x86/mm: Check for pfn instead of page in vmalloc_sync_one()
    - x86/mm: Sync also unmappings in vmalloc_sync_all()
    - mm/vmalloc.c: add priority threshold to __purge_vmap_area_lazy()
    - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()

  * [bionic] drm/i915: softpin broken, needs to be fixed for 32bit mesa
    (LP: #1815172)
    - drm/i915: Mark up GTT sizes as u64
    - drm/i915/gvt: Use I915_GTT_PAGE_SIZE
    - drm/i915: Compare user's 64b GTT offset even on 32b

  * Bionic update: upstream stable patchset 2019-08-07 (LP: #1839376)
    - ARM: riscpc: fix DMA
    - ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200
    - ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again
    - ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
    - ftrace: Enable trampoline when rec count returns back to one
    - kernel/module.c: Only return -EEXIST for modules that have finished loading
    - MIPS: lantiq: Fix bitfield masking
    - dmaengine: rcar-dmac: Reject zero-length slave DMA requests
    - clk: tegra210: fix PLLU and PLLU_OUT1
    - fs/adfs: super: fix use-after-free bug
    - btrfs: fix minimum number of chunk errors for DUP
    - cifs: Fix a race condition with cifs_echo_request
    - ceph: fix improper use of smp_mb__before_atomic()
    - ceph: return -ERANGE if virtual xattr value didn't fit in buffer
    - ACPI: blacklist: fix clang warning for unused DMI table
    - scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
    - x86: kvm: avoid constant-conversion warning
    - ACPI: fix false-positive -Wuninitialized warning
    - be2net: Signal that the device cannot transmit during reconfiguration
    - x86/apic: Silence -Wtype-limits compiler warnings
    - x86: math-emu: Hide clang warnings for 16-bit overflow
    - mm/cma.c: fail if fixed declaration can't be honored
    - coda: add error handling for fget
    - coda: fix build using bare-metal toolchain
    - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side
      headers
    - drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings
    - ipc/mqueue.c: only perform resource calculation if user valid
    - xen/pv: Fix a boot up hang revealed by int3 self test
    - x86/kvm: Don't call kvm_spurious_fault() from .fixup
    - x86/paravirt: Fix callee-saved function ELF sizes
    - x86, boot: Remove multiple copy of static function sanitize_boot_params()
    - drm/nouveau: fix memory leak in nouveau_conn_reset()
    - kbuild: initialize CLANG_FLAGS correctly in the top Makefile
    - Btrfs: fix incremental send failure after deduplication
    - Btrfs: fix race leading to fs corruption after transaction abort
    - mmc: dw_mmc: Fix occasional hang after tuning on eMMC
    - gpiolib: fix incorrect IRQ requesting of an active-low lineevent
    - IB/hfi1: Fix Spectre v1 vulnerability
    - selinux: fix memory leak in policydb_init()
    - s390/dasd: fix endless loop after read unit address configuration
    - parisc: Fix build of compressed kernel even with debug enabled
    - drivers/perf: arm_pmu: Fix failure path in PM notifier
    - nbd: replace kill_bdev() with __invalidate_device() again
    - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
    - IB/mlx5: Fix unreg_umr to ignore the mkey state
    - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure
    - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache
    - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
    - IB/hfi1: Check for error on call to alloc_rsm_map_table
    - eeprom: at24: make spd world-readable again
    - objtool: Support GCC 9 cold subfunction naming scheme
    - gcc-9: properly declare the {pv,hv}clock_page storage
    - x86/vdso: Prevent segfaults due to hoisted vclock reads
    - Documentation: Add swapgs description to the Spectre v1 documentation
    - firmware/psci: psci_checker: Park kthreads before stopping them
    - btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit()
    - lib/test_string.c: avoid masking memset16/32/64 failures
    - mmc: meson-mx-sdio: Fix misuse of GENMASK macro
    - arm64: compat: Allow single-byte watchpoints on all addresses
    - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
    - IB/mlx5: Fix clean_mr() to work in the expected order
    - ARC: enable uboot support unconditionally
    - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA

  * Bionic update: upstream stable patchset 2019-08-06 (LP: #1839213)
    - staging: vt6656: use meaningful error code during buffer allocation
    - drm/amd/display: Fill prescale_params->scale for RGB565
    - drm/amd/display: Disable ABM before destroy ABM struct
    - gpu: host1x: Increase maximum DMA segment size
    - drm/amd/display: Always allocate initial connector state state
    - drm/amd/display: fix compilation error
    - mmc: sdhci: sdhci-pci-o2micro: Check if controller supports 8-bit width
    - i2c: stm32f7: fix the get_irq error cases
    - genksyms: Teach parser about 128-bit built-in types
    - powerpc/mm: Handle page table allocation failures
    - arm64: assembler: Switch ESB-instruction with a vanilla nop if
      !ARM64_HAS_RAS
    - dlm: check if workqueues are NULL before flushing/destroying
    - proc: use down_read_killable mmap_sem for /proc/pid/pagemap
    - proc: use down_read_killable mmap_sem for /proc/pid/clear_refs
    - proc: use down_read_killable mmap_sem for /proc/pid/map_files
    - proc: use down_read_killable mmap_sem for /proc/pid/maps
    - mm: use down_read_killable for locking mmap_sem in access_remote_vm
    - ALSA: ac97: Fix double free of ac97_codec_device
    - libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl()
    - vsock: correct removal of socket from the list
    - NFS: Fix dentry revalidation on NFSv4 lookup
    - NFS: Refactor nfs_lookup_revalidate()
    - NFSv4: Fix lookup revalidate of regular files
    - i2c: qup: fixed releasing dma without flush operation completion
    - arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ
    - binder: fix possible UAF when freeing buffer
    - ISDN: hfcsusb: checking idx of ep configuration
    - media: au0828: fix null dereference in error path
    - ath10k: Change the warning message string
    - media: cpia2_usb: first wake up, then free in disconnect
    - media: pvrusb2: use a different format for warnings
    - NFS: Cleanup if nfs_match_client is interrupted
    - media: radio-raremono: change devm_k*alloc to k*alloc
    - iommu/vt-d: Don't queue_iova() if there is no flush queue
    - iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA
    - hv_sock: Add support for delayed close
    - Bluetooth: hci_uart: check for missing tty operations
    - sched/fair: Don't free p->numa_faults with concurrent readers
    - drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
    - Fix allyesconfig output.
    - ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL

  * Bionic update: upstream stable patchset 2019-08-05 (LP: #1839036)
    - e1000e: start network tx queue only when link is up
    - Input: synaptics - enable SMBUS on T480 thinkpad trackpad
    - nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
    - drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT
    - crypto: talitos - rename alternative AEAD algos.
    - samples, bpf: fix to change the buffer size for read()
    - bpf: sockmap, fix use after free from sleep in psock backlog workqueue
    - staging:iio:ad7150: fix threshold mode config bit
    - mac80211: mesh: fix RCU warning
    - mac80211: free peer keys before vif down in mesh
    - iwlwifi: Fix double-free problems in iwl_req_fw_callback()
    - dt-bindings: can: mcp251x: add mcp25625 support
    - can: mcp251x: add support for mcp25625
    - can: m_can: implement errata "Needless activation of MRAF irq"
    - can: af_can: Fix error path of can_init()
    - ibmvnic: Refresh device multicast list after reset
    - ARM: dts: am335x phytec boards: Fix cd-gpios active level
    - Input: imx_keypad - make sure keyboard can always wake up system
    - KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
    - mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
    - ARM: davinci: da850-evm: call regulator_has_full_constraints()
    - ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
    - mac80211: only warn once on chanctx_conf being NULL
    - qmi_wwan: add support for QMAP padding in the RX path
    - qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode
    - qmi_wwan: extend permitted QMAP mux_id value range
    - md: fix for divide error in status_resync
    - bnx2x: Check if transceiver implements DDM before access
    - drm: return -EFAULT if copy_to_user() fails
    - ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
    - net: lio_core: fix potential sign-extension overflow on large shift
    - quota: fix a problem about transfer quota
    - net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge()
    - net :sunrpc :clnt :Fix xps refcount imbalance on the error path
    - fscrypt: don't set policy for a dead directory
    - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
    - ALSA: hda/realtek - Headphone Mic can't record after S3
    - block, bfq: NULL out the bic when it's no longer valid
    - x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
    - x86/tls: Fix possible spectre-v1 in do_get_thread_area()
    - Documentation: Add section about CPU vulnerabilities for Spectre
    - mwifiex: Abort at too short BSS descriptor element
    - mwifiex: Don't abort on small, spec-compliant vendor IEs
    - USB: serial: ftdi_sio: add ID for isodebug v1
    - USB: serial: option: add support for GosunCn ME3630 RNDIS mode
    - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
    - p54usb: Fix race between disconnect and firmware loading
    - usb: gadget: ether: Fix race between gether_disconnect and rx_submit
    - usb: renesas_usbhs: add a workaround for a race condition of workqueue
    - staging: comedi: dt282x: fix a null pointer deref on interrupt
    - staging: comedi: amplc_pci230: fix null pointer deref on interrupt
    - binder: fix memory leak in error path
    - carl9170: fix misuse of device driver API
    - VMCI: Fix integer overflow in VMCI handle arrays
    - MIPS: Remove superfluous check for __linux__
    - clk: ti: clkctrl: Fix returning uninitialized data
    - efi/bgrt: Drop BGRT status field reserved bits check
    - perf/core: Fix perf_sample_regs_user() mm check
    - ARM: omap2: remove incorrect __init annotation
    - be2net: fix link failure after ethtool offline test
    - ppp: mppe: Add softdep to arc4
    - sis900: fix TX completion
    - ARM: dts: imx6ul: fix PWM[1-4] interrupts
    - dm verity: use message limit for data block corruption message
    - x86/boot/64: Fix crash if kernel image crosses page table boundary
    - cpu/hotplug: Fix out-of-bounds read when setting fail state
    - linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL
    - ARC: hide unused function unw_hdr_alloc
    - s390: fix stfle zero padding
    - s390/qdio: (re-)initialize tiqdio list entries
    - s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
    - crypto/NX: Set receive window credits to max number of CRBs in RxFIFO
    - drm/udl: introduce a macro to convert dev to udl.
    - drm/udl: move to embedding drm device inside udl device.
    - drm/vmwgfx: fix a warning due to missing dma_parms
    - riscv: Fix udelay in RV32.
    - mac80211: do not start any work during reconfigure flow
    - bpf, devmap: Fix premature entry free on destroying map
    - NFS4: Only set creation opendata if O_CREAT
    - perf pmu: Fix uncore PMU alias list for ARM64
    - Documentation/admin: Remove the vsyscall=native documentation
    - drivers/usb/typec/tps6598x.c: fix portinfo width
    - staging: bcm2835-camera: Ensure all buffers are returned on disable
    - staging: bcm2835-camera: Remove check of the number of buffers supplied
    - staging: rtl8712: reduce stack usage, again
    - irqchip/gic-v3-its: Fix command queue pointer comparison bug
    - x86/apic: Fix integer overflow on 10 bit left shift of cpu_khz
    - pinctrl: mcp23s08: Fix add_data and irqchip_add_nested call order
    - x86/boot/64: Add missing fixup_pointer() for next_early_pgt access
    - genirq: Delay deactivation in free_irq()
    - genirq: Fix misleading synchronize_irq() documentation
    - genirq: Update code comments wrt recycled thread_mask
    - genirq: Synchronize only with single thread on free_irq()
    - genirq: Add optional hardware synchronization for shutdown
    - x86/ioapic: Implement irq_get_irqchip_state() callback
    - x86/irq: Handle spurious interrupt after shutdown gracefully
    - crypto: talitos - move struct talitos_edesc into talitos.h
    - crypto: talitos - fix hash on SEC1.
    - regmap-irq: do not write mask register if mask_base is zero
    - MIPS: ath79: fix ar933x uart parity mode
    - MIPS: fix build on non-linux hosts
    - arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
    - scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
    - dmaengine: imx-sdma: fix use-after-free on probe error path
    - wil6210: fix potential out-of-bounds read
    - ath10k: Do not send probe response template for mesh
    - ath9k: Check for errors when reading SREV register
    - ath6kl: add some bounds checking
    - ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
    - batman-adv: fix for leaked TVLV handler.
    - media: dvb: usb: fix use after free in dvb_usb_device_exit
    - media: spi: IR LED: add missing of table registration
    - crypto: talitos - fix skcipher failure due to wrong output IV
    - media: marvell-ccic: fix DMA s/g desc number calculation
    - media: vpss: fix a potential NULL pointer dereference
    - media: media_device_enum_links32: clean a reserved field
    - net: stmmac: dwmac1000: Clear unused address entries
    - net: stmmac: dwmac4/5: Clear unused address entries
    - qed: Set the doorbell address correctly
    - signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
    - af_key: fix leaks in key_pol_get_resp and dump_sp.
    - xfrm: Fix xfrm sel prefix length validation
    - fscrypt: clean up some BUG_ON()s in block encryption/decryption
    - media: mc-device.c: don't memset __user pointer contents
    - media: staging: media: davinci_vpfe: - Fix for memory leak if decoder
      initialization fails.
    - net: phy: Check against net_device being NULL
    - crypto: talitos - properly handle split ICV.
    - crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
    - tua6100: Avoid build warnings.
    - locking/lockdep: Fix merging of hlocks with non-zero references
    - media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
    - cpupower : frequency-set -r option misses the last cpu in related cpu list
    - net: stmmac: dwmac4: fix flow control issue
    - net: fec: Do not use netdev messages too early
    - net: axienet: Fix race condition causing TX hang
    - s390/qdio: handle PENDING state for QEBSM devices
    - RAS/CEC: Fix pfn insertion
    - net: sfp: add mutex to prevent concurrent state checks
    - ipset: Fix memory accounting for hash types on resize
    - perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
    - perf tests: Add valid callback for parse-events test
    - perf test 6: Fix missing kvm module load for s390
    - media: fdp1: Support M3N and E3 platforms
    - iommu: Fix a leak in iommu_insert_resv_region
    - gpio: omap: fix lack of irqstatus_raw0 for OMAP4
    - gpio: omap: ensure irq is enabled before wakeup
    - regmap: fix bulk writes on paged registers
    - bpf: silence warning messages in core
    - rcu: Force inlining of rcu_read_lock()
    - x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS
    - blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership
      arbitration
    - xfrm: fix sa selector validation
    - sched/core: Add __sched tag for io_schedule()
    - x86/atomic: Fix smp_mb__{before,after}_atomic()
    - perf evsel: Make perf_evsel__name() accept a NULL argument
    - vhost_net: disable zerocopy by default
    - ipoib: correcly show a VF hardware address
    - EDAC/sysfs: Fix memory leak when creating a csrow object
    - ipsec: select crypto ciphers for xfrm_algo
    - ipvs: defer hook registration to avoid leaks
    - media: s5p-mfc: Make additional clocks optional
    - media: i2c: fix warning same module names
    - ntp: Limit TAI-UTC offset
    - timer_list: Guard procfs specific code
    - acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
    - media: coda: fix mpeg2 sequence number handling
    - media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP
    - media: coda: increment sequence offset for the last returned frame
    - media: vimc: cap: check v4l2_fill_pixfmt return value
    - media: hdpvr: fix locking and a missing msleep
    - rtlwifi: rtl8192cu: fix error handle when usb probe failed
    - mt7601u: do not schedule rx_tasklet when the device has been disconnected
    - x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
    - mt7601u: fix possible memory leak when the device is disconnected
    - ipvs: fix tinfo memory leak in start_sync_thread
    - ath10k: add missing error handling
    - ath10k: fix PCIE device wake up failed
    - perf tools: Increase MAX_NR_CPUS and MAX_CACHES
    - libata: don't request sense data on !ZAC ATA devices
    - clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
    - rslib: Fix decoding of shortened codes
    - rslib: Fix handling of of caller provided syndrome
    - ixgbe: Check DDM existence in transceiver before access
    - crypto: serpent - mark __serpent_setkey_sbox noinline
    - crypto: asymmetric_keys - select CRYPTO_HASH where needed
    - EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
    - bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
    - net: hns3: fix a -Wformat-nonliteral compile warning
    - net: hns3: add some error checking in hclge_tm module
    - ath10k: destroy sdio workqueue while remove sdio module
    - iwlwifi: mvm: Drop large non sta frames
    - perf stat: Make metric event lookup more robust
    - net: usb: asix: init MAC address buffers
    - gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
    - Bluetooth: hci_bcsp: Fix memory leak in rx_skb
    - Bluetooth: 6lowpan: search for destination address in all peers
    - Bluetooth: Check state in l2cap_disconnect_rsp
    - gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
    - Bluetooth: validate BLE connection interval updates
    - gtp: fix suspicious RCU usage
    - gtp: fix Illegal context switch in RCU read-side critical section.
    - gtp: fix use-after-free in gtp_encap_destroy()
    - gtp: fix use-after-free in gtp_newlink()
    - net: mvmdio: defer probe of orion-mdio if a clock is not ready
    - iavf: fix dereference of null rx_buffer pointer
    - floppy: fix out-of-bounds read in next_valid_format
    - floppy: fix invalid pointer dereference in drive_name
    - xen: let alloc_xenballooned_pages() fail if not enough memory free
    - scsi: NCR5380: Reduce goto statements in NCR5380_select()
    - scsi: NCR5380: Always re-enable reselection interrupt
    - Revert "scsi: ncr5380: Increase register polling limit"
    - scsi: core: Fix race on creating sense cache
    - scsi: megaraid_sas: Fix calculation of target ID
    - scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
    - scsi: mac_scsi: Fix pseudo DMA implementation, take 2
    - crypto: ghash - fix unaligned memory access in ghash_setkey()
    - crypto: ccp - Validate the the error value used to index error messages
    - crypto: arm64/sha1-ce - correct digest for empty data in finup
    - crypto: arm64/sha2-ce - correct digest for empty data in finup
    - crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
    - crypto: ccp - memset structure fields to zero before reuse
    - crypto: ccp/gcm - use const time tag comparison.
    - crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
    - Input: gtco - bounds check collection indent level
    - Input: alps - don't handle ALPS cs19 trackpoint-only device
    - Input: synaptics - whitelist Lenovo T580 SMBus intertouch
    - Input: alps - fix a mismatch between a condition check and its comment
    - regulator: s2mps11: Fix buck7 and buck8 wrong voltages
    - arm64: tegra: Update Jetson TX1 GPU regulator timings
    - iwlwifi: pcie: don't service an interrupt that was masked
    - iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
    - NFSv4: Handle the special Linux file open access mode
    - pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
    - lib/scatterlist: Fix mapping iterator when sg->offset is greater than
      PAGE_SIZE
    - ASoC: dapm: Adapt for debugfs API change
    - ALSA: seq: Break too long mutex context in the write loop
    - media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
    - media: coda: Remove unbalanced and unneeded mutex unlock
    - KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
    - arm64: tegra: Fix AGIC register range
    - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys
      inodes.
    - drm/nouveau/i2c: Enable i2c pads & busses during preinit
    - padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
    - dm zoned: fix zone state management race
    - xen/events: fix binding user event channels to cpus
    - 9p/xen: Add cleanup path in p9_trans_xen_init
    - 9p/virtio: Add cleanup path in p9_virtio_init
    - x86/boot: Fix memory leak in default_get_smp_config()
    - perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs
    - perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs
    - intel_th: pci: Add Ice Lake NNPI support
    - PCI: Do not poll for PME if the device is in D3cold
    - Btrfs: fix data loss after inode eviction, renaming it, and fsync it
    - Btrfs: fix fsync not persisting dentry deletions due to inode evictions
    - Btrfs: add missing inode version, ctime and mtime updates when punching hole
    - HID: wacom: generic: only switch the mode on devices with LEDs
    - HID: wacom: correct touch resolution x/y typo
    - libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
    - coda: pass the host file in vma->vm_file on mmap
    - gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
    - PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
    - crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
    - parisc: Ensure userspace privilege for ptraced processes in regset functions
    - parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
    - powerpc/32s: fix suspend/resume when IBATs 4-7 are used
    - powerpc/watchpoint: Restore NV GPRs while returning from exception
    - eCryptfs: fix a couple type promotion bugs
    - intel_th: msu: Fix single mode with disabled IOMMU
    - Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
    - usb: Handle USB3 remote wakeup for LPM enabled devices correctly
    - net: mvmdio: allow up to four clocks to be specified for orion-mdio
    - dt-bindings: allow up to four clocks for orion-mdio
    - dm bufio: fix deadlock with loop device
    - compiler.h, kasan: Avoid duplicating __read_once_size_nocheck()
    - compiler.h: Add read_word_at_a_time() function.
    - lib/strscpy: Shut up KASAN false-positives in strscpy()
    - bnx2x: Prevent load reordering in tx completion processing
    - caif-hsi: fix possible deadlock in cfhsi_exit_module()
    - igmp: fix memory leak in igmpv3_del_delrec()
    - ipv4: don't set IPv6 only flags to IPv4 addresses
    - net: bcmgenet: use promisc for unsupported filters
    - net: dsa: mv88e6xxx: wait after reset deactivation
    - net: neigh: fix multiple neigh timer scheduling
    - net: openvswitch: fix csum updates for MPLS actions
    - nfc: fix potential illegal memory access
    - rxrpc: Fix send on a connected, but unbound socket
    - sky2: Disable MSI on ASUS P6T
    - vrf: make sure skb->data contains ip header to make routing
    - macsec: fix use-after-free of skb during RX
    - macsec: fix checksumming after decryption
    - netrom: fix a memory leak in nr_rx_frame()
    - netrom: hold sock when setting skb->destructor
    - bonding: validate ip header before check IPPROTO_IGMP
    - net: make skb_dst_force return true when dst is refcounted
    - tcp: fix tcp_set_congestion_control() use from bpf hook
    - tcp: Reset bytes_acked and bytes_received when disconnecting
    - net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
    - net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
    - net: bridge: stp: don't cache eth dest pointer before skb pull
    - dma-buf: balance refcount inbalance
    - dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc
    - MIPS: lb60: Fix pin mappings
    - ext4: don't allow any modifications to an immutable file
    - ext4: enforce the immutable flag on open files
    - mm: add filemap_fdatawait_range_keep_errors()
    - jbd2: introduce jbd2_inode dirty range scoping
    - ext4: use jbd2_inode dirty range scoping
    - ext4: allow directory holes
    - mm: vmscan: scan anonymous pages on file refaults
    - hvsock: fix epollout hang from race condition
    - drm/panel: simple: Fix panel_simple_dsi_probe
    - usb: core: hub: Disable hub-initiated U1/U2
    - tty: max310x: Fix invalid baudrate divisors calculator
    - pinctrl: rockchip: fix leaked of_node references
    - tty: serial: cpm_uart - fix init when SMC is relocated
    - drm/edid: Fix a missing-check bug in drm_load_edid_firmware()
    - PCI: Return error if cannot probe VF
    - drm/bridge: tc358767: read display_props in get_modes()
    - drm/bridge: sii902x: pixel clock unit is 10kHz instead of 1kHz
    - drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry
    - memstick: Fix error cleanup path of memstick_init
    - tty/serial: digicolor: Fix digicolor-usart already registered warning
    - tty: serial: msm_serial: avoid system lockup condition
    - serial: 8250: Fix TX interrupt handling condition
    - drm/virtio: Add memory barriers for capset cache.
    - phy: renesas: rcar-gen2: Fix memory leak at error paths
    - powerpc/pseries/mobility: prevent cpu hotplug during DT update
    - drm/rockchip: Properly adjust to a true clock in adjusted_mode
    - tty: serial_core: Set port active bit in uart_port_activate
    - usb: gadget: Zero ffs_io_data
    - powerpc/pci/of: Fix OF flags parsing for 64bit BARs
    - drm/msm: Depopulate platform on probe failure
    - serial: mctrl_gpio: Check if GPIO property exisits before requesting it
    - PCI: sysfs: Ignore lockdep for remove attribute
    - kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS
    - PCI: xilinx-nwl: Fix Multi MSI data programming
    - iio: iio-utils: Fix possible incorrect mask calculation
    - powerpc/xmon: Fix disabling tracing while in xmon
    - recordmcount: Fix spurious mcount entries on powerpc
    - mfd: core: Set fwnode for created devices
    - mfd: arizona: Fix undefined behavior
    - mfd: hi655x-pmic: Fix missing return value check for
      devm_regmap_init_mmio_clk
    - um: Silence lockdep complaint about mmap_sem
    - powerpc/4xx/uic: clear pending interrupt after irq type/pol change
    - RDMA/i40iw: Set queue pair state when being queried
    - serial: sh-sci: Terminate TX DMA during buffer flushing
    - serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
    - kallsyms: exclude kasan local symbols on s390
    - perf test mmap-thread-lookup: Initialize variable to suppress memory
      sanitizer warning
    - perf session: Fix potential NULL pointer dereference found by the smatch
      tool
    - perf annotate: Fix dereferencing freed memory found by the smatch tool
    - RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM
    - PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB
    - powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h
    - f2fs: avoid out-of-range memory access
    - mailbox: handle failed named mailbox channel request
    - powerpc/eeh: Handle hugepages in ioremap space
    - block/bio-integrity: fix a memory leak bug
    - sh: prevent warnings when using iounmap
    - mm/kmemleak.c: fix check for softirq context
    - 9p: pass the correct prototype to read_cache_page
    - mm/gup.c: mark undo_dev_pagemap as __maybe_unused
    - mm/gup.c: remove some BUG_ONs from get_gate_page()
    - mm/mmu_notifier: use hlist_add_head_rcu()
    - locking/lockdep: Fix lock used or unused stats error
    - locking/lockdep: Hide unused 'class' variable
    - drm/crc: Only report a single overflow when a CRC fd is opened
    - drm/crc-debugfs: Also sprinkle irqrestore over early exits
    - usb: wusbcore: fix unbalanced get/put cluster_id
    - usb: pci-quirks: Correct AMD PLL quirk detection
    - KVM: nVMX: do not use dangling shadow VMCS after guest reset
    - btrfs: inode: Don't compress if NODATASUM or NODATACOW set
    - x86/sysfb_efi: Add quirks for some devices with swapped width and height
    - x86/speculation/mds: Apply more accurate check on hypervisor platform
    - binder: prevent transactions to context manager from its own process.
    - fpga-manager: altera-ps-spi: Fix build error
    - hpet: Fix division by zero in hpet_time_div()
    - powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask()
    - powerpc/tm: Fix oops on sigreturn on systems without TM
    - access: avoid the RCU grace period for the temporary subjective credentials
    - batman-adv: Fix duplicated OGMs on NETDEV_UP
    - net: hns3: set ops to null when unregister ad_dev
    - x86/cpu: Add Ice Lake NNPI to Intel family
    - qed: iWARP - Fix tc for MPA ll2 connection
    - net: hns3: fix for skb leak when doing selftest
    - sched/fair: Fix "runnable_avg_yN_inv" not used warnings
    - x86/cacheinfo: Fix a -Wtype-limits warning
    - nvme-pci: properly report state change failure in nvme_reset_work
    - nvme-pci: set the errno on ctrl state change error
    - arm64: Do not enable IRQs for ct_user_exit
    - net: stmmac: sun8i: force select external PHY when no internal one
    - bcache: check CACHE_SET_IO_DISABLE in allocator code
    - bcache: check CACHE_SET_IO_DISABLE bit in bch_journal()
    - bcache: acquire bch_register_lock later in cached_dev_free()
    - bcache: fix potential deadlock in cached_def_free()
    - perf stat: Fix group lookup for metric group
    - tools: bpftool: Fix json dump crash on powerpc
    - Bluetooth: Add a new 13d3:3496 QCA_ROME device
    - Bluetooth: Add new 13d3:3491 QCA_ROME device
    - Bluetooth: Add new 13d3:3501 QCA_ROME device
    - bcache: ignore read-ahead request failure on backing device
    - bcache: fix mistaken sysfs entry for io_error counter
    - bcache: destroy dc->writeback_write_wq if failed to create
      dc->writeback_thread
    - iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill
    - iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices
    - ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform
    - media: videobuf2-core: Prevent size alignment wrapping buffer size to 0
    - media: videobuf2-dma-sg: Prevent size from overflowing
    - perf/x86/intel: Fix spurious NMI on fixed counter
    - drm/edid: parse CEA blocks embedded in DisplayID
    - PCI: qcom: Ensure that PERST is asserted for at least 100 ms
    - IB/mlx5: Report correctly tag matching rendezvous capability
    - include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT
      architectures
    - xfs: fix pagecache truncation prior to reflink
    - xfs: flush removing page cache in xfs_reflink_remap_prep
    - xfs: don't overflow xattr listent buffer
    - xfs: don't ever put nlink > 0 inodes on the unlinked list
    - xfs: fix reporting supported extra file attributes for statx()
    - xfs: serialize unaligned dio writes against all other dio writes
    - xfs: abort unaligned nowait directio early
    - powerpc/powernv/npu: Fix reference leak
    - powerpc/pseries: Fix oops in hotplug memory notifier
    - mmc: sdhci-msm: fix mutex while in spinlock
    - mtd: rawnand: mtk: Correct low level time calculation of r/w cycle
    - blk-throttle: fix zero wait time for iops throttled group
    - tcp: be more careful in tcp_fragment()
    - net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn
    - net_sched: unset TCQ_F_CAN_BYPASS when adding filters
    - net: bridge: don't cache ether dest pointer on input
    - net: sched: verify that q!=NULL before setting q->flags

  * Line 6 POD HD500 driver fault (LP: #1790595) // Bionic update: upstream
    stable patchset 2019-08-05 (LP: #1839036)
    - ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1

  * Bionic update: upstream stable patchset 2019-08-02 (LP: #1838824)
    - rapidio: fix a NULL pointer dereference when create_workqueue() fails
    - fs/fat/file.c: issue flush after the writeback of FAT
    - sysctl: return -EINVAL if val violates minmax
    - ipc: prevent lockup on alloc_msg and free_msg
    - ARM: prevent tracing IPI_CPU_BACKTRACE
    - mm/hmm: select mmu notifier when selecting HMM
    - hugetlbfs: on restore reserve error path retain subpool reservation
    - mem-hotplug: fix node spanned pages when we have a node with only
      ZONE_MOVABLE
    - mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
    - mm/cma.c: fix the bitmap status to show failed allocation reason
    - mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
    - mm/slab.c: fix an infinite loop in leaks_show()
    - kernel/sys.c: prctl: fix false positive in validate_prctl_map()
    - thermal: rcar_gen3_thermal: disable interrupt in .remove
    - drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
    - mfd: tps65912-spi: Add missing of table registration
    - mfd: intel-lpss: Set the device in reset state when init
    - drm/nouveau/disp/dp: respect sink limits when selecting failsafe link
      configuration
    - mfd: twl6040: Fix device init errors for ACCCTL register
    - perf/x86/intel: Allow PEBS multi-entry in watermark mode
    - drm/bridge: adv7511: Fix low refresh rate selection
    - objtool: Don't use ignore flag for fake jumps
    - EDAC/mpc85xx: Prevent building as a module
    - pwm: meson: Use the spin-lock only to protect register modifications
    - ntp: Allow TAI-UTC offset to be set to zero
    - f2fs: fix to avoid panic in do_recover_data()
    - f2fs: fix to clear dirty inode in error path of f2fs_iget()
    - f2fs: fix to avoid panic in dec_valid_block_count()
    - f2fs: fix to do sanity check on valid block count of segment
    - percpu: remove spurious lock dependency between percpu and sched
    - configfs: fix possible use-after-free in configfs_register_group
    - uml: fix a boot splat wrt use of cpu_all_mask
    - mmc: mmci: Prevent polling for busy detection in IRQ context
    - watchdog: imx2_wdt: Fix set_timeout for big timeout values
    - watchdog: fix compile time error of pretimeout governors
    - blk-mq: move cancel of requeue_work into blk_mq_release
    - iommu/vt-d: Set intel_iommu_gfx_mapped correctly
    - misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test
    - nvme-pci: unquiesce admin queue on shutdown
    - ALSA: hda - Register irq handler after the chip initialization
    - nvmem: core: fix read buffer in place
    - fuse: retrieve: cap requested size to negotiated max_write
    - nfsd: allow fh_want_write to be called twice
    - vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING"
    - x86/PCI: Fix PCI IRQ routing table memory leak
    - platform/chrome: cros_ec_proto: check for NULL transfer function
    - PCI: keystone: Prevent ARM32 specific code to be compiled for ARM64
    - soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
    - clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
    - soc: rockchip: Set the proper PWM for rk3288
    - ARM: dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
    - ARM: dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
    - ARM: dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
    - ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
    - ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
    - ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
    - ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
    - ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
    - PCI: rpadlpar: Fix leaked device_node references in add/remove paths
    - platform/x86: intel_pmc_ipc: adding error handling
    - power: supply: max14656: fix potential use-before-alloc
    - PCI: rcar: Fix a potential NULL pointer dereference
    - PCI: rcar: Fix 64bit MSI message address handling
    - video: hgafb: fix potential NULL pointer dereference
    - video: imsttfb: fix potential NULL pointer dereferences
    - block, bfq: increase idling for weight-raised queues
    - PCI: xilinx: Check for __get_free_pages() failure
    - gpio: gpio-omap: add check for off wake capable gpios
    - dmaengine: idma64: Use actual device for DMA transfers
    - pwm: tiehrpwm: Update shadow register for disabling PWMs
    - ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on
      Arndale Octa
    - pwm: Fix deadlock warning when removing PWM device
    - ARM: exynos: Fix undefined instruction during Exynos5422 resume
    - usb: typec: fusb302: Check vconn is off when we start toggling
    - gpio: vf610: Do not share irq_chip
    - percpu: do not search past bitmap when allocating an area
    - drm: don't block fb changes for async plane updates
    - ALSA: seq: Cover unsubscribe_port() in list_mutex
    - initramfs: free initrd memory if opening /initrd.image fails
    - bpf: fix undefined behavior in narrow load handling
    - f2fs: fix to avoid panic in f2fs_remove_inode_page()
    - f2fs: fix to use inline space only if inline_xattr is enable
    - netfilter: nf_conntrack_h323: restore boundary check correctness
    - mips: Make sure dt memory regions are valid
    - nvmem: sunxi_sid: Support SID on A83T and H5
    - nfsd: avoid uninitialized variable warning
    - switchtec: Fix unintended mask of MRPC event
    - net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending
    - i40e: Queues are reserved despite "Invalid argument" error
    - net: hns3: return 0 and print warning when hit duplicate MAC
    - soc: renesas: Identify R-Car M3-W ES1.1
    - soc: renesas: Identify R-Car M3-W ES1.3
    - [Config] updateconfigs for CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT
    - drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
    - nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled
    - HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth
    - HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary
    - ALSA: oxfw: allow PCM capture for Stanton SCS.1m
    - ALSA: hda/realtek - Update headset mode for ALC256
    - ALSA: firewire-motu: fix destruction of data for isochronous resources
    - libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
    - mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
    - fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
    - mm/vmscan.c: fix trying to reclaim unevictable LRU page
    - signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
    - ptrace: restore smp_rmb() in __ptrace_may_access()
    - media: v4l2-ioctl: clear fields in s_parm
    - iommu/arm-smmu: Avoid constant zero in TLBI writes
    - i2c: acorn: fix i2c warning
    - bcache: fix stack corruption by PRECEDING_KEY()
    - cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
    - ASoC: cs42xx8: Add regcache mask dirty
    - ASoC: fsl_asrc: Fix the issue about unsupported rate
    - drm/i915/sdvo: Implement proper HDMI audio support for SDVO
    - x86/uaccess, kcov: Disable stack protector
    - ALSA: seq: Protect in-kernel ioctl calls with mutex
    - ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
    - Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
    - s390/kasan: fix strncpy_from_user kasan checks
    - Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
    - scsi: qedi: remove memset/memcpy to nfunc and use func instead
    - scsi: qedi: remove set but not used variables 'cdev' and 'udev'
    - scsi: lpfc: add check for loss of ndlp when sending RRQ
    - arm64/mm: Inhibit huge-vmap with ptdump
    - nvme: remove the ifdef around nvme_nvm_ioctl
    - platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI
      table
    - platform/x86: pmc_atom: Add several Beckhoff Automation boards to
      critclk_systems DMI table
    - scsi: bnx2fc: fix incorrect cast to u64 on shift operation
    - libnvdimm: Fix compilation warnings with W=1
    - selftests/timers: Add missing fflush(stdout) calls
    - usbnet: ipheth: fix racing condition
    - KVM: x86/pmu: do not mask the value that is written to fixed PMUs
    - KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
    - drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an
      invalid read
    - drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
    - usb: dwc2: Fix DMA cache alignment issues
    - usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
    - USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
    - USB: serial: pl2303: add Allied Telesis VT-Kit3
    - USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
    - USB: serial: option: add Telit 0x1260 and 0x1261 compositions
    - RAS/CEC: Fix binary search function
    - x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
    - x86/kasan: Fix boot with 5-level paging and KASAN
    - rtc: pcf8523: don't return invalid date when battery is low
    - HID: wacom: Don't set tool type until we're in range
    - HID: wacom: Don't report anything prior to the tool entering range
    - HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact
    - bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached
    - f2fs: fix to avoid accessing xattr across the boundary
    - nvme: fix srcu locking on error return in nvme_get_ns_from_disk
    - nvme: merge nvme_ns_ioctl into nvme_ioctl
    - nvme: release namespace SRCU protection before performing controller ioctls
    - nvme: fix memory leak for power latency tolerance
    - KVM: x86/pmu: mask the result of rdpmc according to the width of the
      counters
    - tools/kvm_stat: fix fields filter for child events
    - RAS/CEC: Convert the timer callback to a workqueue
    - x86/mm/KASLR: Compute the size of the vmemmap section properly
    - ax25: fix inconsistent lock state in ax25_destroy_timer
    - be2net: Fix number of Rx queues used for flow hashing
    - ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
    - lapb: fixed leak of control-blocks.
    - neigh: fix use-after-free read in pneigh_get_next
    - net: openvswitch: do not free vport if register_netdevice() is failed.
    - sctp: Free cookie before we memdup a new one
    - sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
    - Staging: vc04_services: Fix a couple error codes
    - perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints
    - netfilter: nf_queue: fix reinject verdict handling
    - ipvs: Fix use-after-free in ip_vs_in
    - selftests: netfilter: missing error check when setting up veth interface
    - clk: ti: clkctrl: Fix clkdm_clk handling
    - powerpc/powernv: Return for invalid IMC domain
    - mISDN: make sure device name is NUL terminated
    - x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
    - perf/ring_buffer: Fix exposing a temporarily decreased data_head
    - perf/ring_buffer: Add ordering to rb->nest increment
    - perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page data
    - gpio: fix gpio-adp5588 build errors
    - net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
    - net: aquantia: fix LRO with FCS error
    - i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
    - ALSA: hda - Force polling mode on CNL for fixing codec communication
    - configfs: Fix use-after-free when accessing sd->s_dentry
    - perf data: Fix 'strncat may truncate' build failure with recent gcc
    - perf record: Fix s390 missing module symbol and warning for non-root users
    - ia64: fix build errors by exporting paddr_to_nid()
    - KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
    - KVM: PPC: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu
    - net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
    - net: phy: dp83867: Set up RGMII TX delay
    - scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
    - scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask
    - scsi: scsi_dh_alua: Fix possible null-ptr-deref
    - scsi: libsas: delete sas port if expander discover failed
    - mlxsw: spectrum: Prevent force of 56G
    - coredump: fix race condition between collapse_huge_page() and core dumping
    - infiniband: fix race condition between infiniband mlx4, mlx5 driver and core
      dumping
    - Abort file_remove_privs() for non-reg. files
    - tipc: purge deferredq list for each grp member in tipc_group_delete
    - vsock/virtio: set SOCK_DONE on peer shutdown
    - usb: xhci: Fix a potential null pointer dereference in
      xhci_debugfs_create_endpoint()
    - ACPI/PCI: PM: Add missing wakeup.flags.valid checks
    - drm/etnaviv: lock MMU while dumping core
    - net: aquantia: tx clean budget logic error
    - perf namespace: Protect reading thread's namespace
    - xen/pvcalls: Remove set but not used variable
    - xen: xenbus: Catch closing of non existent transactions
    - xen: xenbus_dev_frontend: Verify body of XS_TRANSACTION_END
    - xenbus: Avoid deadlock during suspend due to open transactions
    - tracing: Silence GCC 9 array bounds warning
    - objtool: Support per-function rodata sections
    - gcc-9: silence 'address-of-packed-member' warning
    - net: phy: broadcom: Use strlcpy() for ethtool::get_strings
    - mmc: core: Prevent processing SDIO IRQs when the card is suspended
    - scsi: ufs: Avoid runtime suspend possibly being blocked forever
    - usb: chipidea: udc: workaround for endpoint conflict issue
    - IB/hfi1: Silence txreq allocation warnings
    - Input: synaptics - enable SMBus on ThinkPad E480 and E580
    - Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
    - apparmor: enforce nullbyte at end of tag string
    - ARC: fix build warnings
    - ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC node
    - ARC: [plat-hsdk]: Add missing FIFO size entry in GMAC node
    - parport: Fix mem leak in parport_register_dev_model
    - parisc: Fix compiler warnings in float emulation code
    - IB/rdmavt: Fix alloc_qpn() WARN_ON()
    - IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
    - IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
    - IB/hfi1: Validate page aligned for a given virtual address
    - MIPS: uprobes: remove set but not used variable 'epc'
    - xtensa: Fix section mismatch between memblock_reserve and mem_reserve
    - net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
    - net: hns: Fix loopback test failed at copper ports
    - mdesc: fix a missing-check bug in get_vdev_port_node_info()
    - sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
    - net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
    - net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is
      enabled
    - drm/arm/hdlcd: Actually validate CRTC modes
    - drm/arm/hdlcd: Allow a bit of clock tolerance
    - scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
    - scsi: ufs: Check that space was properly alloced in copy_query_response
    - scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous()
    - net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set
    - s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
    - hwmon: (core) add thermal sensors only if dev->of_node is present
    - hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
    - nvme: Fix u32 overflow in the number of namespace list calculation
    - btrfs: start readahead also in seed devices
    - can: flexcan: fix timeout when set small bitrate
    - can: purge socket error queue on sock destruct
    - powerpc/bpf: use unsigned division instruction for 64-bit operations
    - ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
    - ARM: dts: am57xx-idk: Remove support for voltage switching for SD card
    - Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
    - Bluetooth: Fix regression with minimum encryption key size alignment
    - SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write
    - cfg80211: fix memory leak of wiphy device name
    - mac80211: drop robust management frames from unknown TA
    - mac80211: handle deauthentication/disassociation from TDLS peer
    - mac80211: Do not use stack memory with scatterlist for GMAC
    - s390/jump_label: Use "jdd" constraint on gcc9
    - s390/ap: rework assembler functions to use unions for in/out register
      variables
    - mmc: core: API to temporarily disable retuning for SDIO CRC errors
    - mmc: core: Add sdio_retune_hold_now() and sdio_retune_release()
    - Input: silead - add MSSL0017 to acpi_device_id
    - selftests: vm: install test_vmalloc.sh for run_vmtests
    - arm64: Silence gcc warnings about arch ABI drift
    - riscv: mm: synchronize MMU after pte change
    - arm64/sve: <uapi/asm/ptrace.h> should not depend on <uapi/linux/prctl.h>
    - drm/vmwgfx: Use the backdoor port if the HB port is not available
    - {nl,mac}80211: allow 4addr AP operation on crypto controlled devices
    - perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit
      set nul
    - perf help: Remove needless use of strncpy()
    - perf header: Fix unchecked usage of strncpy()
    - IB/hfi1: Close PSM sdma_progress sleep window
    - 9p/xen: fix check for xenbus_read error in front_probe
    - 9p/rdma: do not disconnect on down_interruptible EAGAIN
    - 9p: acl: fix uninitialized iattr access
    - 9p/rdma: remove useless check in cm_event_handler
    - 9p: p9dirent_read: check network-provided name length
    - net/9p: include trans_common.h to fix missing prototype warning.
    - qmi_wwan: Fix out-of-bounds read
    - fs/proc/array.c: allow reporting eip/esp for all coredumping threads
    - mm/mempolicy.c: fix an incorrect rebind node in mpol_rebind_nodemask
    - fs/binfmt_flat.c: make load_flat_shared_library() work
    - dm log writes: make sure super sector log updates are written in order
    - scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
    - x86/speculation: Allow guests to use SSBD even if host does not
    - x86/microcode: Fix the microcode load on CPU hotplug for real
    - NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
    - cpu/speculation: Warn on unsupported mitigations= parameter
    - eeprom: at24: fix unexpected timeout under high load
    - af_packet: Block execution of tasks waiting for transmit to complete in
      AF_PACKET
    - ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
    - net/packet: fix memory leak in packet_set_ring()
    - net: remove duplicate fetch in sock_getsockopt
    - net: stmmac: fixed new system time seconds value calculation
    - sctp: change to hold sk after auth shkey is created successfully
    - tipc: change to use register_pernet_device
    - tipc: check msg->req data len in tipc_nl_compat_bearer_disable
    - tun: wake up waitqueues after IFF_UP is set
    - team: Always enable vlan tx offload
    - bonding: Always enable vlan tx offload
    - bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
    - bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
    - arm64: futex: Avoid copying out uninitialised stack in failed cmpxchg()
    - bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd
    - futex: Update comments and docs about return values of arch futex code
    - tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
    - arm64: insn: Fix ldadd instruction encoding
    - arm64: Don't unconditionally add -Wno-psabi to KBUILD_CFLAGS
    - irqchip/mips-gic: Use the correct local interrupt map registers
    - Bluetooth: Fix faulty expression for minimum encryption key size check
    - ASoC : cs4265 : readable register too low
    - ASoC: soc-pcm: BE dai needs prepare when pause release after resume
    - spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
    - drm/mediatek: fix unbind functions
    - drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
    - drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
    - ASoC: max98090: remove 24-bit format support if RJ is 0
    - ASoC: sun4i-i2s: Fix sun8i tx channel offset mask
    - ASoC: sun4i-i2s: Add offset to RX channel select
    - usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
    - usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
    - SoC: rt274: Fix internal jack assignment in set_jack callback
    - scsi: hpsa: correct ioaccel2 chaining
    - platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device
      registration
    - cpuset: restore sanity to cpuset_cpus_allowed_fallback()
    - scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
    - mm/mlock.c: change count_mm_mlocked_page_nr return type
    - module: Fix livepatch/ftrace module text permissions race
    - ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
    - MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
    - drm/i915/dmc: protect against reading random memory
    - crypto: user - prevent operating on larval algorithms
    - crypto: cryptd - Fix skcipher instance memory leak
    - ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
    - ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
    - ALSA: line6: Fix write on zero-sized buffer
    - ALSA: usb-audio: fix sign unintended sign extension on left shifts
    - ALSA: hda/realtek - Change front mic location for Lenovo M710q
    - lib/mpi: Fix karactx leak in mpi_powm
    - tracing/snapshot: Resize spare buffer if size changed
    - arm64: kaslr: keep modules inside module region when KASAN is enabled
    - drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE
    - drm/imx: notify drm core before sending event during crtc disable
    - drm/imx: only send event on crtc disable if kept disabled
    - ftrace/x86: Remove possible deadlock between register_kprobe() and
      ftrace_run_update_code()
    - mm/vmscan.c: prevent useless kswapd loops
    - btrfs: Ensure replaced device doesn't have pending chunk allocation
    - vhost-net: set packet weight of tx polling to 2 * vq size
    - vhost_net: use packet weight for rx handler, too
    - vhost_net: introduce vhost_exceeds_weight()
    - vhost: introduce vhost_exceeds_weight()
    - vhost_net: fix possible infinite loop
    - vhost: vsock: add weight support
    - vhost: scsi: add weight support
    - tty: rocket: fix incorrect forward declaration of 'rp_init()'
    - KVM: x86: degrade WARN to pr_warn_ratelimited
    - KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
    - svcrdma: Ignore source port when computing DRC hash
    - MIPS: Fix bounds check virt_addr_valid
    - MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
    - dmaengine: imx-sdma: remove BD_INTR for channel0
    - drm/mediatek: unbind components in mtk_drm_unbind()
    - drm/mediatek: clear num_pipes when unbind driver
    - x86/CPU: Add more Icelake model numbers
    - platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from
      asus_nb_wmi
    - platform/x86: intel-vbtn: Report switch events when event wakes device
    - i2c: pca-platform: Fix GPIO lookup code
    - ALSA: hda/realtek: Add quirks for several Clevo notebook barebones
    - ARM: dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node
    - drm/amd/powerplay: use hardware fan control if no powerplay fan table
    - drm/etnaviv: add missing failure path to destroy suballoc
    - mlxsw: spectrum: Handle VLAN device unlinking
    - media: s5p-mfc: fix incorrect bus assignment in virtual child device
    - net: hns: Fixes the missing put_device in positive leg for roce reset
    - ALSA: hda: Initialize power_state field properly
    - rds: Fix warning.
    - ip6: fix skb leak in ip6frag_expire_frag_queue()
    - netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
    - sc16is7xx: move label 'err_spi' to correct section
    - netfilter: ipv6: nf_defrag: accept duplicate fragments again
    - nfsd: Fix overflow causing non-working mounts on 1 TB machines
    - MIPS: have "plain" make calls build dtbs for selected platforms
    - dmaengine: qcom: bam_dma: Fix completed descriptors count

  * Bionic update: upstream stable patchset 2019-08-01 (LP: #1838700)
    - x86: Hide the int3_emulate_call/jmp functions from UML
    - ext4: do not delete unlinked inode from orphan list on failed truncate
    - f2fs: Fix use of number of devices
    - KVM: x86: fix return value for reserved EFER
    - bio: fix improper use of smp_mb__before_atomic()
    - sbitmap: fix improper use of smp_mb__before_atomic()
    - Revert "scsi: sd: Keep disk read-only when re-reading partition"
    - crypto: vmx - CTR: always increment IV as quadword
    - mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time
      problem
    - mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem
    - kvm: svm/avic: fix off-by-one in checking host APIC ID
    - libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead
    - arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable
    - gfs2: Fix sign extension bug in gfs2_update_stats
    - Btrfs: do not abort transaction at btrfs_update_root() after failure to COW
      path
    - Btrfs: avoid fallback to transaction commit during fsync of files with holes
    - Btrfs: fix race between ranged fsync and writeback of adjacent ranges
    - btrfs: sysfs: Fix error path kobject memory leak
    - btrfs: sysfs: don't leak memory when failing add fsid
    - fbdev: fix divide error in fb_var_to_videomode
    - btrfs: honor path->skip_locking in backref code
    - fbdev: fix WARNING in __alloc_pages_nodemask bug
    - media: cpia2: Fix use-after-free in cpia2_exit
    - media: serial_ir: Fix use-after-free in serial_ir_init_module
    - media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
    - ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
    - bpf: devmap: fix use-after-free Read in __dev_map_entry_free
    - batman-adv: mcast: fix multicast tt/tvlv worker locking
    - at76c50x-usb: Don't register led_trigger if usb_register_driver failed
    - net: erspan: fix use-after-free
    - gfs2: Fix lru_count going negative
    - cxgb4: Fix error path in cxgb4_init_module
    - NFS: make nfs_match_client killable
    - IB/hfi1: Fix WQ_MEM_RECLAIM warning
    - gfs2: Fix occasional glock use-after-free
    - mmc: core: Verify SD bus width
    - tools/bpf: fix perf build error with uClibc (seen on ARC)
    - dmaengine: tegra210-dma: free dma controller in remove()
    - net: ena: gcc 8: fix compilation warning
    - pinctrl: zte: fix leaked of_node references
    - ASoC: hdmi-codec: unlock the device on startup errors
    - powerpc/perf: Return accordingly on invalid chip-id in
    - powerpc/boot: Fix missing check of lseek() return value
    - ASoC: imx: fix fiq dependencies
    - spi: pxa2xx: fix SCR (divisor) calculation
    - brcm80211: potential NULL dereference in
      brcmf_cfg80211_vndr_cmds_dcmd_handler()
    - ACPI / property: fix handling of data_nodes in acpi_get_next_subnode()
    - ARM: vdso: Remove dependency with the arch_timer driver internals
    - arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable
    - sched/cpufreq: Fix kobject memleak
    - scsi: qla2xxx: Fix a qla24xx_enable_msix() error path
    - scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending()
    - scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in
      tcm_qla2xxx_close_session()
    - Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota
      reserve
    - btrfs: fix panic during relocation after ENOSPC before writeback happens
    - btrfs: Don't panic when we can't find a root key
    - iwlwifi: pcie: don't crash on invalid RX interrupt
    - rtc: 88pm860x: prevent use-after-free on device remove
    - scsi: qedi: Abort ep termination if offload not scheduled
    - w1: fix the resume command API
    - dmaengine: pl330: _stop: clear interrupt status
    - mac80211/cfg80211: update bss channel on channel switch
    - libbpf: fix samples/bpf build failure due to undefined UINT32_MAX
    - ASoC: fsl_sai: Update is_slave_mode with correct value
    - mwifiex: prevent an array overflow
    - net: cw1200: fix a NULL pointer dereference
    - crypto: sun4i-ss - Fix invalid calculation of hash end
    - bcache: return error immediately in bch_journal_replay()
    - bcache: fix failure in journal relplay
    - bcache: add failure check to run_cache_set() for journal replay
    - bcache: avoid clang -Wunintialized warning
    - vfio-ccw: Do not call flush_workqueue while holding the spinlock
    - vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev
    - smpboot: Place the __percpu annotation correctly
    - x86/mm: Remove in_nmi() warning from 64-bit implementation of
      vmalloc_fault()
    - mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC
      versions
    - HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
    - pinctrl: pistachio: fix leaked of_node references
    - pinctrl: samsung: fix leaked of_node references
    - clk: rockchip: undo several noc and special clocks as critical on rk3288
    - dmaengine: at_xdmac: remove BUG_ON macro in tasklet
    - media: coda: clear error return value before picture run
    - media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
    - media: au0828: stop video streaming only when last user stops
    - media: ov2659: make S_FMT succeed even if requested format doesn't match
    - audit: fix a memory leak bug
    - media: stm32-dcmi: fix crash when subdev do not expose any formats
    - media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
    - media: pvrusb2: Prevent a buffer overflow
    - powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX
    - random: add a spinlock_t to struct batched_entropy
    - cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock
    - sched/core: Check quota and period overflow at usec to nsec conversion
    - sched/rt: Check integer overflow at usec to nsec conversion
    - sched/core: Handle overflow in cpu_shares_write_u64
    - drm/msm: a5xx: fix possible object reference leak
    - USB: core: Don't unbind interfaces following device reset failure
    - x86/irq/64: Limit IST stack overflow check to #DB stack
    - phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
    - i40e: Able to add up to 16 MAC filters on an untrusted VF
    - i40e: don't allow changes to HW VLAN stripping on active port VLANs
    - arm64: vdso: Fix clock_getres() for CLOCK_REALTIME
    - RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
    - hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
    - hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
    - hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
    - hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
    - hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
    - scsi: libsas: Do discovery on empty PHY to update PHY info
    - mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers
    - mmc_spi: add a status check for spi_sync_locked
    - mmc: sdhci-of-esdhc: add erratum eSDHC5 support
    - mmc: sdhci-of-esdhc: add erratum A-009204 support
    - mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
    - drm/amdgpu: fix old fence check in amdgpu_fence_emit
    - PM / core: Propagate dev->power.wakeup_path when no callbacks
    - clk: rockchip: Fix video codec clocks on rk3288
    - extcon: arizona: Disable mic detect if running when driver is removed
    - clk: rockchip: Make rkpwm a critical clock on rk3288
    - s390: zcrypt: initialize variables before_use
    - x86/microcode: Fix the ancient deprecated microcode loading method
    - s390: cio: fix cio_irb declaration
    - cpufreq: ppc_cbe: fix possible object reference leak
    - cpufreq/pasemi: fix possible object reference leak
    - cpufreq: pmac32: fix possible object reference leak
    - cpufreq: kirkwood: fix possible object reference leak
    - block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR
    - x86/build: Keep local relocations with ld.lld
    - iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
    - iio: hmc5843: fix potential NULL pointer dereferences
    - iio: common: ssp_sensors: Initialize calculated_time in
      ssp_common_process_data
    - rtlwifi: fix a potential NULL pointer dereference
    - mwifiex: Fix mem leak in mwifiex_tm_cmd
    - brcmfmac: fix missing checks for kmemdup
    - b43: shut up clang -Wuninitialized variable warning
    - brcmfmac: convert dev_init_lock mutex to completion
    - brcmfmac: fix WARNING during USB disconnect in case of unempty psq
    - brcmfmac: fix race during disconnect when USB completion is in progress
    - brcmfmac: fix Oops when bringing up interface during USB disconnect
    - rtc: xgene: fix possible race condition
    - rtlwifi: fix potential NULL pointer dereference
    - scsi: ufs: Fix regulator load and icc-level configuration
    - scsi: ufs: Avoid configuring regulator with undefined voltage range
    - arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
    - x86/uaccess, signal: Fix AC=1 bloat
    - x86/ia32: Fix ia32_restore_sigcontext() AC leak
    - chardev: add additional check for minor range overlap
    - RDMA/hns: Fix bad endianess of port_pd variable
    - HID: core: move Usage Page concatenation to Main item
    - ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
    - ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
    - cxgb3/l2t: Fix undefined behaviour
    - HID: logitech-hidpp: change low battery level threshold from 31 to 30
      percent
    - spi: tegra114: reset controller on probe
    - kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice.
    - media: video-mux: fix null pointer dereferences
    - media: wl128x: prevent two potential buffer overflows
    - scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload
      check
    - virtio_console: initialize vtermno value for ports
    - tty: ipwireless: fix missing checks for ioremap
    - x86/mce: Fix machine_check_poll() tests for error types
    - rcutorture: Fix cleanup path for invalid torture_type strings
    - rcuperf: Fix cleanup path for invalid perf_type strings
    - usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
    - scsi: qla4xxx: avoid freeing unallocated dma memory
    - batman-adv: allow updating DAT entry timeouts on incoming ARP Replies
    - dmaengine: tegra210-adma: use devm_clk_*() helpers
    - hwrng: omap - Set default quality
    - thunderbolt: Fix to check for kmemdup failure
    - media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
    - media: vimc: stream: fix thread state before sleep
    - media: go7007: avoid clang frame overflow warning with KASAN
    - media: vimc: zero the media_device on probe
    - scsi: lpfc: Fix FDMI manufacturer attribute value
    - scsi: lpfc: Fix fc4type information for FDMI
    - media: saa7146: avoid high stack usage with clang
    - scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
    - spi : spi-topcliff-pch: Fix to handle empty DMA buffers
    - spi: rspi: Fix sequencer reset during initialization
    - spi: Fix zero length xfer bug
    - ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
    - drm/drv: Hold ref on parent device during drm_device lifetime
    - drm: Wake up next in drm_read() chain if we are forced to putback the event
    - vfio-ccw: Prevent quiesce function going into an infinite loop
    - NFS: Fix a double unlock from nfs_match,get_client
    - ext4: wait for outstanding dio during truncate in nojournal mode
    - NFSv4.1 fix incorrect return value in copy_file_range
    - media: vb2: add waiting_in_dqbuf flag
    - acct_on(): don't mess with freeze protection
    - hv_netvsc: fix race that may miss tx queue wakeup
    - Bluetooth: Ignore CC events not matching the last HCI command
    - powerpc/perf: Fix loop exit condition in nest_imc_event_init
    - drm/nouveau/bar/nv50: ensure BAR is mapped
    - media: stm32-dcmi: return appropriate error codes during probe
    - powerpc/watchdog: Use hrtimers for per-CPU heartbeat
    - scsi: qla2xxx: Fix hardirq-unsafe locking
    - x86/modules: Avoid breaking W^X while loading modules
    - sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs
    - s390: qeth: address type mismatch warning
    - rsi: Fix NULL pointer dereference in kmalloc
    - nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE
    - bcache: avoid potential memleak of list of journal_replay(s) in the
      CACHE_SYNC branch of run_cache_set
    - RDMA/cma: Consider scope_id while binding to ipv6 ll address
    - block: fix use-after-free on gendisk
    - staging: vc04_services: handle kzalloc failure
    - irq_work: Do not raise an IPI when queueing work on the local CPU
    - thunderbolt: Take domain lock in switch sysfs attribute callbacks
    - drm: etnaviv: avoid DMA API warning when importing buffers
    - ACPI/IORT: Reject platform device creation on NUMA node mapping failure
    - perf/x86/msr: Add Icelake support
    - perf/x86/intel/rapl: Add Icelake support
    - perf/x86/intel/cstate: Add Icelake support
    - drm/panel: otm8009a: Add delay at the end of initialization
    - thunderbolt: property: Fix a missing check of kzalloc
    - thunderbolt: Fix to check the return value of kmemdup
    - x86/mce: Handle varying MCA bank counts
    - scsi: lpfc: avoid uninitialized variable warning
    - thunderbolt: Fix to check return value of ida_simple_get
    - drm/amd/display: fix releasing planes when exiting odm
    - thunderbolt: property: Fix a NULL pointer dereference
    - e1000e: Disable runtime PM on CNP+
    - igb: Exclude device from suspend direct complete optimization
    - media: si2165: fix a missing check of return value
    - drm/amd/display: Fix Divide by 0 in memory calculations
    - spi: imx: stop buffer overflow in RX FIFO flush
    - bonding/802.3ad: fix slave link initialization transition states
    - cxgb4: offload VLAN flows regardless of VLAN ethtype
    - inet: switch IP ID generator to siphash
    - ipv4/igmp: fix another memory leak in igmpv3_del_delrec()
    - ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST
    - ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
    - llc: fix skb leak in llc_build_and_send_ui_pkt()
    - net: dsa: mv88e6xxx: fix handling of upper half of STATS_TYPE_PORT
    - net: fec: fix the clk mismatch in failed_reset path
    - net-gro: fix use-after-free read in napi_gro_frags()
    - net: mvneta: Fix err code path of probe
    - net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
    - net: phy: marvell10g: report if the PHY fails to boot firmware
    - net: stmmac: fix reset gpio free missing
    - usbnet: fix kernel crash after disconnect
    - tipc: Avoid copying bytes beyond the supplied data
    - net/mlx5: Allocate root ns memory using kzalloc to match kfree
    - bnxt_en: Fix aggregation buffer leak under OOM condition.
    - crypto: vmx - ghash: do nosimd fallback manually
    - include/linux/compiler*.h: define asm_volatile_goto
    - compiler.h: give up __compiletime_assert_fallback()
    - xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
    - tipc: fix modprobe tipc failed after switch order of device registration
    - sparc64: Fix regression in non-hypervisor TLB flush xcall
    - include/linux/bitops.h: sanitize rotate primitives
    - xhci: update bounce buffer with correct sg num
    - xhci: Use %zu for printing size_t type
    - xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
    - usb: xhci: avoid null pointer deref when bos field is NULL
    - usbip: usbip_host: fix BUG: sleeping function called from invalid context
    - usbip: usbip_host: fix stub_dev lock context imbalance regression
    - USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
    - USB: sisusbvga: fix oops in error path of sisusb_probe
    - USB: Add LPM quirk for Surface Dock GigE adapter
    - USB: rio500: refuse more than one device at a time
    - USB: rio500: fix memory leak in close after disconnect
    - media: usb: siano: Fix general protection fault in smsusb
    - media: usb: siano: Fix false-positive "uninitialized variable" warning
    - media: smsusb: better handle optional alignment
    - scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
    - scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
    - Btrfs: fix wrong ctime and mtime of a directory after log replay
    - Btrfs: fix race updating log root item during fsync
    - Btrfs: fix fsync not persisting changed attributes of a directory
    - Btrfs: incremental send, fix file corruption when no-holes feature is
      enabled
    - KVM: PPC: Book3S HV: XIVE: Do not clear IRQ data of passthrough interrupts
    - powerpc/perf: Fix MMCRA corruption by bhrb_filter
    - ALSA: hda/realtek - Set default power save node to 0
    - KVM: s390: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID
    - drm/nouveau/i2c: Disable i2c bus access after ->fini()
    - tty: serial: msm_serial: Fix XON/XOFF
    - tty: max310x: Fix external crystal register setup
    - memcg: make it work on sparse non-0-node systems
    - kernel/signal.c: trace_signal_deliver when signal_group_exit
    - docs: Fix conf.py for Sphinx 2.0
    - doc: Cope with the deprecation of AutoReporter
    - doc: Cope with Sphinx logging deprecations
    - ima: show rules with IMA_INMASK correctly
    - serial: sh-sci: disable DMA for uart_console
    - staging: vc04_services: prevent integer overflow in create_pagelist()
    - staging: wlan-ng: fix adapter initialization failure
    - CIFS: cifs_read_allocate_pages: don't iterate through whole page array on
      ENOMEM
    - gcc-plugins: Fix build failures under Darwin host
    - drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
    - drm/rockchip: shutdown drm subsystem on shutdown
    - Compiler Attributes: add support for __copy (gcc >= 9)
    - include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
    - binder: fix race between munmap() and direct reclaim
    - media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
    - brcmfmac: fix NULL pointer derefence during USB disconnect
    - iio: dac: ds4422/ds4424 fix chip verification
    - s390/crypto: fix possible sleep during spinlock aquired
    - ALSA: line6: Assure canceling delayed work at disconnection
    - vt/fbcon: deinitialize resources in visual_init() after failed memory
      allocation
    - cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case
    - x86/ftrace: Do not call function graph from dynamic trampolines
    - x86/ftrace: Set trampoline pages as executable
    - x86/kprobes: Set instruction page as executable
    - of: overlay: validate overlay properties #address-cells and #size-cells
    - of: overlay: set node fields from properties when add new overlay node
    - ethtool: fix potential userspace buffer overflow
    - Fix memory leak in sctp_process_init
    - neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
    - net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
    - net: rds: fix memory leak in rds_ib_flush_mr_pool
    - pktgen: do not sleep with the thread lock held.
    - ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
    - ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
    - net: sfp: read eeprom in maximum 16 byte increments
    - ipv6: fix the check before getting the cookie in rt6_get_cookie
    - rcu: locking and unlocking need to always be at least barriers
    - parisc: Use implicit space register selection for loading the coherence
      index of I/O pdirs
    - fuse: fallocate: fix return with locked inode
    - pstore: Remove needless lock during console writes
    - pstore: Convert buf_lock to semaphore
    - pstore/ram: Run without kernel crash dump region
    - x86/power: Fix 'nosmt' vs hibernation triple fault during resume
    - i2c: xiic: Add max_read_len quirk
    - MIPS: Bounds check virt_addr_valid
    - MIPS: pistachio: Build uImage.gz by default
    - genwqe: Prevent an integer overflow in the ioctl
    - test_firmware: Use correct snprintf() limit
    - drm/gma500/cdv: Check vbt config bits when detecting lvds panels
    - drm/amdgpu/psp: move psp version specific function pointers to early_init
    - drm/i915: Fix I915_EXEC_RING_MASK
    - drm/i915/fbc: disable framebuffer compression on GeminiLake
    - TTY: serial_core, add ->install
    - qmi_wwan: Add quirk for Quectel dynamic config
    - ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
    - ethtool: check the return value of get_regs_len
    - net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
    - net: mvpp2: Use strscpy to handle stat strings
    - packet: unconditionally free po->rollover
    - NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
    - NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
    - s390/mm: fix address space detection in exception handling
    - drm/msm: fix fb references in async update
    - drm: add non-desktop quirk for Valve HMDs
    - drm: add non-desktop quirks to Sensics and OSVR headsets.
    - drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in

  * CVE-2019-14283
    - floppy: fix out-of-bounds read in copy_buffer

  * CVE-2019-14284
    - floppy: fix div-by-zero in setup_format_params

  * Bionic linux 4.15.0-56.62 fails to build with CONFIG_NVM disabled
    (LP: #1838533)
    - Revert "nvme: warn when finding multi-port subsystems without multipathing
      enabled"

  * Bionic update: upstream stable patchset 2019-07-31 (LP: #1838576)
    - netfilter: compat: initialize all fields in xt_init
    - platform/x86: sony-laptop: Fix unintentional fall-through
    - platform/x86: thinkpad_acpi: Disable Bluetooth for some machines
    - hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
    - kernfs: fix barrier usage in __kernfs_new_node()
    - USB: serial: fix unthrottle races
    - iio: adc: xilinx: fix potential use-after-free on remove
    - libnvdimm/namespace: Fix a potential NULL pointer dereference
    - HID: input: add mapping for Expose/Overview key
    - HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
    - HID: input: add mapping for "Toggle Display" key
    - libnvdimm/btt: Fix a kmemdup failure check
    - s390/dasd: Fix capacity calculation for large volumes
    - mac80211: fix unaligned access in mesh table hash function
    - mac80211: Increase MAX_MSG_LEN
    - mac80211: fix memory accounting with A-MSDU aggregation
    - nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands
    - s390/3270: fix lockdep false positive on view->lock
    - clocksource/drivers/oxnas: Fix OX820 compatible
    - mISDN: Check address length before reading address family
    - s390/pkey: add one more argument space for debug feature entry
    - x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T
    - KVM: fix spectrev1 gadgets
    - KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in
      tracing
    - tools lib traceevent: Fix missing equality check for strcmp
    - mm: fix inactive list balancing between NUMA nodes and cgroups
    - init: initialize jump labels before command line option parsing
    - selftests: netfilter: check icmp pkttoobig errors are set as related
    - ipvs: do not schedule icmp errors from tunnels
    - netfilter: ctnetlink: don't use conntrack/expect object addresses as id
    - s390: ctcm: fix ctcm_new_device error return code
    - drm/sun4i: Set device driver data at bind time for use in unbind
    - gpu: ipu-v3: dp: fix CSC handling
    - drm/imx: don't skip DP channel disable for background plane
    - spi: Micrel eth switch: declare missing of table
    - spi: ST ST95HF NFC: declare missing of table
    - Input: synaptics-rmi4 - fix possible double free
    - MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit
    - ima: open a new file instance if no read permissions
    - drm/i915: Disable LP3 watermarks on all SNB machines
    - net: stmmac: Move debugfs init/exit to ->probe()/->remove()
    - x86/vdso: Pass --eh-frame-hdr to the linker
    - mm/memory.c: fix modifying of page protection by insert_pfn()
    - net: fec: manage ahb clock in runtime pm
    - mlxsw: spectrum_switchdev: Add MDB entries in prepare phase
    - mlxsw: core: Do not use WQ_MEM_RECLAIM for EMAD workqueue
    - mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw ordered workqueue
    - mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw workqueue
    - NFC: nci: Add some bounds checking in nci_hci_cmd_received()
    - nfc: nci: Potential off by one in ->pipes[] array
    - x86/kprobes: Avoid kretprobe recursion bug
    - cw1200: fix missing unlock on error in cw1200_hw_scan()
    - mwl8k: Fix rate_idx underflow
    - rtlwifi: rtl8723ae: Fix missing break in switch statement
    - bonding: fix arp_validate toggling in active-backup mode
    - bridge: Fix error path for kobject_init_and_add()
    - dpaa_eth: fix SG frame cleanup
    - ipv4: Fix raw socket lookup for local traffic
    - net: dsa: Fix error cleanup path in dsa_init_module
    - net: ethernet: stmmac: dwmac-sun8i: enable support of unicast filtering
    - net: seeq: fix crash caused by not set dev.parent
    - net: ucc_geth - fix Oops when changing number of buffers in the ring
    - packet: Fix error path in packet_init
    - vlan: disable SIOCSHWTSTAMP in container
    - vrf: sit mtu should not be updated when vrf netdev is the link
    - tipc: fix hanging clients using poll with EPOLLOUT flag
    - drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
    - drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
    - powerpc/powernv/idle: Restore IAMR after idle
    - powerpc/booke64: set RI in default MSR
    - platform/x86: dell-laptop: fix rfkill functionality
    - iio: adc: xilinx: fix potential use-after-free on probe
    - iio: adc: xilinx: prevent touching unclocked h/w on remove
    - acpi/nfit: Always dump _DSM output payload
    - libnvdimm/pmem: fix a possible OOB access when read and write pmem
    - vxge: fix return of a free'd memblock on a failed dma mapping
    - qede: fix write to free'd pointer error and double free of ptp
    - afs: Unlock pages for __pagevec_release()
    - ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash
    - scsi: aic7xxx: fix EISA support
    - drm/sun4i: Fix component unbinding and component master deletion
    - netfilter: fix nf_l4proto_log_invalid to log invalid packets
    - drm/sun4i: Unbind components before releasing DRM and memory
    - usb: typec: Fix unchecked return value
    - netfilter: nf_tables: use-after-free in dynamic operations
    - um: Don't hardcode path as it is architecture dependent
    - powerpc/book3s/64: check for NULL pointer in pgd_alloc()
    - PCI: hv: Add hv_pci_remove_slots() when we unload the driver
    - PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary
    - net: core: another layer of lists, around PF_MEMALLOC skb handling
    - locking/rwsem: Prevent decrement of reader count before increment
    - PCI: hv: Fix a memory leak in hv_eject_device_work()
    - x86/speculation/mds: Revert CPU buffer clear on double fault exit
    - x86/speculation/mds: Improve CPU buffer clear documentation
    - objtool: Fix function fallthrough detection
    - ARM: dts: exynos: Fix interrupt for shared EINTs on Exynos5260
    - ARM: dts: exynos: Fix audio (microphone) routing on Odroid XU3
    - ARM: exynos: Fix a leaked reference by adding missing of_node_put
    - power: supply: axp288_charger: Fix unchecked return value
    - arm64: compat: Reduce address limit
    - arm64: Clear OSDLR_EL1 on CPU boot
    - arm64: Save and restore OSDLR_EL1 across suspend/resume
    - sched/x86: Save [ER]FLAGS on context switch
    - crypto: chacha20poly1305 - set cra_name correctly
    - crypto: vmx - fix copy-paste error in CTR mode
    - crypto: skcipher - don't WARN on unprocessed data after slow walk step
    - crypto: crct10dif-generic - fix use via crypto_shash_digest()
    - crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
    - crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
    - crypto: rockchip - update IV buffer to contain the next IV
    - crypto: arm/aes-neonbs - don't access already-freed walk.iv
    - ALSA: usb-audio: Fix a memory leak bug
    - ALSA: hda/realtek - EAPD turn on later
    - ASoC: max98090: Fix restore of DAPM Muxes
    - ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
    - bpf, arm64: remove prefetch insn in xadd mapping
    - mm/mincore.c: make mincore() more conservative
    - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
    - userfaultfd: use RCU to free the task struct when fork fails
    - mfd: da9063: Fix OTP control register names to match datasheets for
      DA9063/63L
    - mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
    - mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write
    - tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0
    - tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
    - jbd2: check superblock mapped prior to committing
    - ext4: make sanity check in mballoc more strict
    - ext4: ignore e_value_offs for xattrs with value-in-ea-inode
    - ext4: avoid drop reference to iloc.bh twice
    - Btrfs: do not start a transaction during fiemap
    - Btrfs: do not start a transaction at iterate_extent_inodes()
    - bcache: fix a race between cache register and cacheset unregister
    - bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
    - ext4: fix use-after-free race with debug_want_extra_isize
    - ext4: actually request zeroing of inode table after grow
    - ext4: fix ext4_show_options for file systems w/o journal
    - ipmi:ssif: compare block number correctly for multi-part return messages
    - crypto: arm64/aes-neonbs - don't access already-freed walk.iv
    - crypto: salsa20 - don't access already-freed walk.iv
    - crypto: ccm - fix incompatibility between "ccm" and "ccm_base"
    - fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going
      into workqueue when umount
    - ext4: fix data corruption caused by overlapping unaligned and aligned IO
    - ext4: fix use-after-free in dx_release()
    - ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
    - KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
    - iov_iter: optimize page_copy_sane()
    - ext4: fix compile error when using BUFFER_TRACE
    - arm64: dts: rockchip: Disable DCMDs on RK3399's eMMC controller.
    - arm64: mmap: Ensure file offset is treated as unsigned
    - arm64: arch_timer: Ensure counter register reads occur with seqlock held
    - crypto: crypto4xx - fix ctr-aes missing output IV
    - crypto: crypto4xx - fix cfb and ofb "overran dst buffer" issues
    - ALSA: line6: toneport: Fix broken usage of timer for delayed execution
    - ASoC: fsl_esai: Fix missing break in switch statement
    - mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned
      addresses
    - hugetlb: use same fault hash key for shared and private mappings
    - ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle
    - btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages
      fails
    - ext4: avoid panic during forced reboot due to aborted journal
    - libnvdimm/namespace: Fix label tracking error
    - ext4: don't update s_rev_level if not required
    - net: avoid weird emergency message
    - net/mlx4_core: Change the error print to info print
    - net: test nouarg before dereferencing zerocopy pointers
    - net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions
    - ppp: deflate: Fix possible crash in deflate_init
    - tipc: switch order of device registration to fix a crash
    - vsock/virtio: free packets during the socket release
    - vsock/virtio: Initialize core virtio vsock before registering the driver
    - net: Always descend into dsa/
    - parisc: Export running_on_qemu symbol for modules
    - parisc: Skip registering LED when running in QEMU
    - parisc: Use PA_ASM_LEVEL in boot code
    - parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
    - stm class: Fix channel free in stm output free path
    - md: add mddev->pers to avoid potential NULL pointer dereference
    - intel_th: msu: Fix single mode with IOMMU
    - p54: drop device reference count if fails to enable device
    - of: fix clang -Wunsequenced for be32_to_cpu()
    - media: ov6650: Fix sensor possibly not detected on probe
    - NFS4: Fix v4.0 client state corruption when mount
    - PNFS fallback to MDS if no deviceid found
    - clk: hi3660: Mark clk_gate_ufs_subsys as critical
    - clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
    - clk: rockchip: fix wrong clock definitions for rk3328
    - fuse: fix writepages on 32bit
    - fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
    - iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
    - ceph: flush dirty inodes before proceeding with remount
    - x86_64: Add gap to int3 to allow for call emulation
    - x86_64: Allow breakpoints to emulate call instructions
    - ftrace/x86_64: Emulate call function while updating in breakpoint handler
    - tracing: Fix partial reading of trace event's id file
    - memory: tegra: Fix integer overflow on tick value calculation
    - perf intel-pt: Fix instructions sampling rate
    - perf intel-pt: Fix improved sample timestamp
    - perf intel-pt: Fix sample timestamp wrt non-taken branches
    - objtool: Allow AR to be overridden with HOSTAR
    - fbdev: sm712fb: fix brightness control on reboot, don't set SR30
    - fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
    - fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
    - fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
    - fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping
      VRAM
    - fbdev: sm712fb: fix support for 1024x768-16 mode
    - fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
    - fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
    - PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
    - PCI: Mark Atheros AR9462 to avoid bus reset
    - PCI: Factor out pcie_retrain_link() function
    - PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum
    - dm cache metadata: Fix loading discard bitset
    - dm zoned: Fix zone report handling
    - dm delay: fix a crash when invalid device is specified
    - xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
    - xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
    - vti4: ipip tunnel deregistration fixes.
    - esp4: add length check for UDP encapsulation
    - xfrm4: Fix uninitialized memory read in _decode_session4
    - power: supply: cpcap-battery: Fix division by zero
    - securityfs: fix use-after-free on symlink traversal
    - apparmorfs: fix use-after-free on symlink traversal
    - mac80211: Fix kernel panic due to use of txq after free
    - KVM: arm/arm64: Ensure vcpu target is unset on reset failure
    - power: supply: sysfs: prevent endless uevent loop with
      CONFIG_POWER_SUPPLY_DEBUG
    - iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb()
    - sched/cpufreq: Fix kobject memleak
    - x86/mm/mem_encrypt: Disable all instrumentation for early SME setup
    - ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
    - perf bench numa: Add define for RUSAGE_THREAD if not present
    - md/raid: raid5 preserve the writeback action after the parity check
    - driver core: Postpone DMA tear-down until after devres release for probe
      failure
    - bpf: add map_lookup_elem_sys_only for lookups from syscall side
    - bpf, lru: avoid messing with eviction heuristics upon syscall lookup
    - fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
    - nfp: flower: add rcu locks when accessing netdev for tunnels
    - rtnetlink: always put IFLA_LINK for links with a link-netnsid
    - brd: re-enable __GFP_HIGHMEM in brd_insert_page()
    - proc: prevent changes to overridden credentials
    - md: batch flush requests.
    - phy: ti-pipe3: fix missing bit-wise or operator when assigning val
    - clk: mediatek: Disable tuner_en before change PLL rate
    - PCI: rcar: Add the initialization of PCIe link in resume_noirq()
    - fuse: Add FOPEN_STREAM to use stream_open()
    - qmi_wwan: new Wistron, ZTE and D-Link devices
    - bpf: relax inode permission check for retrieving bpf program

  * Bionic update: upstream stable patchset 2019-07-30 (LP: #1838459)
    - kbuild: simplify ld-option implementation
    - cifs: do not attempt cifs operation on smb2+ rename error
    - tracing: Fix a memory leak by early error exit in trace_pid_write()
    - tracing: Fix buffer_ref pipe ops
    - zram: pass down the bvec we need to read into in the work struct
    - lib/Kconfig.debug: fix build error without CONFIG_BLOCK
    - MIPS: scall64-o32: Fix indirect syscall number load
    - trace: Fix preempt_enable_no_resched() abuse
    - IB/rdmavt: Fix frwr memory registration
    - sched/numa: Fix a possible divide-by-zero
    - ceph: only use d_name directly when parent is locked
    - ceph: ensure d_name stability in ceph_dentry_hash()
    - ceph: fix ci->i_head_snapc leak
    - nfsd: Don't release the callback slot unless it was actually held
    - sunrpc: don't mark uninitialised items as VALID.
    - Input: synaptics-rmi4 - write config register values to the right offset
    - dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
    - ARM: 8857/1: efi: enable CP15 DMB instructions before cleaning the cache
    - drm/vc4: Fix memory leak during gpu reset.
    - drm/vc4: Fix compilation error reported by kbuild test bot
    - ext4: fix some error pointer dereferences
    - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
    - tipc: handle the err returned from cmd header function
    - slip: make slhc_free() silently accept an error pointer
    - intel_th: gth: Fix an off-by-one in output unassigning
    - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
    - ipvs: fix warning on unused variable
    - sched/deadline: Correctly handle active 0-lag timers
    - NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family.
    - netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON
    - fm10k: Fix a potential NULL pointer dereference
    - tipc: check bearer name with right length in tipc_nl_compat_bearer_enable
    - tipc: check link name with right length in tipc_nl_compat_link_set
    - x86, retpolines: Raise limit for generating indirect calls from switch-case
    - x86/retpolines: Disable switch jump tables when retpolines are enabled
    - mm: Fix warning in insert_pfn()
    - ipv4: add sanity checks in ipv4_link_failure()
    - mlxsw: spectrum: Fix autoneg status in ethtool
    - net/mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query
    - net: rds: exchange of 8K and 1M pool
    - net: stmmac: move stmmac_check_ether_addr() to driver probe
    - stmmac: pci: Adjust IOT2000 matching
    - team: fix possible recursive locking when add slaves
    - net/rose: fix unbound loop in rose_loopback_timer()
    - ipv4: set the tcp_min_rtt_wlen range from 0 to one day
    - powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg
    - Documentation: Add nospectre_v1 parameter
    - netfilter: nf_tables: warn when expr implements only one of
      activate/deactivate
    - net/ibmvnic: Fix RTNL deadlock during device reset
    - drm/rockchip: fix for mailbox read validation.
    - powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64
    - perf/x86/intel: Enable C-state residency events for Cannon Lake
    - perf/x86/intel: Update KBL Package C-state events to also include
      PC8/PC9/PC10 counters
    - powerpc/mm/radix: Make Radix require HUGETLB_PAGE
    - workqueue: Try to catch flush_work() without INIT_WORK().
    - mlxsw: pci: Reincrease PCI reset timeout
    - mm: make page ref count overflow check tighter and more explicit
    - mm: add 'try_get_page()' helper function
    - mm: prevent get_user_pages() from overflowing page refcount
    - fs: prevent page refcount overflow in pipe_buf_get
    - ARM: dts: bcm283x: Fix hdmi hpd gpio pull
    - s390: limit brk randomization to 32MB
    - qlcnic: Avoid potential NULL pointer dereference
    - netfilter: nft_set_rbtree: check for inactive element after flag mismatch
    - netfilter: bridge: set skb transport_header before entering
      NF_INET_PRE_ROUTING
    - s390/qeth: fix race when initializing the IP address table
    - sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
    - serial: ar933x_uart: Fix build failure with disabled console
    - KVM: arm/arm64: vgic-its: Take the srcu lock when parsing the memslots
    - usb: gadget: net2280: Fix overrun of OUT messages
    - usb: gadget: net2280: Fix net2280_dequeue()
    - usb: gadget: net2272: Fix net2272_dequeue()
    - ARM: dts: pfla02: increase phy reset duration
    - net: ks8851: Dequeue RX packets explicitly
    - net: ks8851: Reassert reset pin if chip ID check fails
    - net: ks8851: Delay requesting IRQ until opened
    - net: ks8851: Set initial carrier state to down
    - staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc
    - staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer dereference
    - staging: rtl8712: uninitialized memory in read_bbreg_hdl()
    - staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc
    - net: macb: Add null check for PCLK and HCLK
    - net/sched: don't dereference a->goto_chain to read the chain index
    - ARM: dts: imx6qdl: Fix typo in imx6qdl-icore-rqs.dtsi
    - NFS: Fix a typo in nfs_init_timeout_values()
    - net: xilinx: fix possible object reference leak
    - net: ibm: fix possible object reference leak
    - net: ethernet: ti: fix possible object reference leak
    - gpio: aspeed: fix a potential NULL pointer dereference
    - drm/meson: Fix invalid pointer in meson_drv_unbind()
    - drm/meson: Uninstall IRQ handler
    - scsi: qla4xxx: fix a potential NULL pointer dereference
    - usb: usb251xb: fix to avoid potential NULL pointer dereference
    - usb: u132-hcd: fix resource leak
    - ceph: fix use-after-free on symlink traversal
    - scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN
    - libata: fix using DMA buffers on stack
    - gpio: of: Fix of_gpiochip_add() error path
    - kconfig/[mn]conf: handle backspace (^H) key
    - ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK
    - leds: pca9532: fix a potential NULL pointer dereference
    - KVM: arm64: Reset the PMU in preemptible context
    - KVM: arm/arm64: vgic-its: Take the srcu lock when writing to guest memory
    - scsi: aacraid: Insure we don't access PCIe space during AER/EEH
    - x86/realmode: Don't leak the trampoline kernel address
    - x86/mm: Don't exceed the valid physical address space
    - ipv4: ip_do_fragment: Preserve skb_iif during fragmentation
    - ipv6/flowlabel: wait rcu grace period before put_pid()
    - ipv6: invert flowlabel sharing check in process and user mode
    - l2ip: fix possible use-after-free
    - l2tp: use rcu_dereference_sk_user_data() in l2tp_udp_encap_recv()
    - net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc
    - net: phy: marvell: Fix buffer overrun with stats counters
    - sctp: avoid running the sctp state machine recursively
    - packet: validate msg_namelen in send directly
    - bnxt_en: Improve multicast address setup logic.
    - bnxt_en: Free short FW command HWRM memory in error path in bnxt_init_one()
    - ALSA: line6: use dynamic buffers
    - rxrpc: Fix net namespace cleanup
    - kasan: remove redundant initialization of variable 'real_size'
    - kasan: prevent compiler from optimizing away memset in tests
    - caif: reduce stack size with KASAN
    - ALSA: hda/realtek - Add new Dell platform for headset mode
    - USB: yurex: Fix protection fault after device removal
    - USB: w1 ds2490: Fix bug caused by improper use of altsetting array
    - usb: usbip: fix isoc packet num validation in get_pipe
    - USB: core: Fix unterminated string returned by usb_string()
    - USB: core: Fix bug caused by duplicate interface PM usage counter
    - nvme-loop: init nvmet_ctrl fatal_err_work when allocate
    - HID: logitech: check the return value of create_singlethread_workqueue
    - HID: debug: fix race condition with between rdesc_show() and device removal
    - rtc: sh: Fix invalid alarm warning for non-enabled alarm
    - batman-adv: Reduce claim hash refcnt only for removed entry
    - batman-adv: Reduce tt_local hash refcnt only for removed entry
    - batman-adv: Reduce tt_global hash refcnt only for removed entry
    - ARM: dts: rockchip: Fix gpu opp node names for rk3288
    - net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands
    - bonding: show full hw address in sysfs for slave entries
    - net: stmmac: ratelimit RX error logs
    - net: stmmac: don't overwrite discard_frame status
    - net: stmmac: fix dropping of multi-descriptor RX frames
    - net: stmmac: don't log oversized frames
    - jffs2: fix use-after-free on symlink traversal
    - debugfs: fix use-after-free on symlink traversal
    - rtc: da9063: set uie_unsupported when relevant
    - HID: input: add mapping for Assistant key
    - vfio/pci: use correct format characters
    - scsi: core: add new RDAC LENOVO/DE_Series device
    - scsi: storvsc: Fix calculation of sub-channel count
    - net: hns: Fix WARNING when remove HNS driver with SMMU enabled
    - kmemleak: powerpc: skip scanning holes in the .bss section
    - hugetlbfs: fix memory leak for resv_map
    - sh: fix multiple function definition build errors
    - xsysace: Fix error handling in ace_setup
    - ARM: orion: don't use using 64-bit DMA masks
    - ARM: iop: don't use using 64-bit DMA masks
    - perf/x86/amd: Update generic hardware cache events for Family 17h
    - Bluetooth: btusb: request wake pin with NOAUTOEN
    - staging: iio: adt7316: allow adt751x to use internal vref for all dacs
    - staging: iio: adt7316: fix the dac read calculation
    - staging: iio: adt7316: fix the dac write calculation
    - scsi: RDMA/srpt: Fix a credit leak for aborted commands
    - ASoC: stm32: fix sai driver name initialisation
    - IB/core: Unregister notifier before freeing MAD security
    - IB/core: Fix potential memory leak while creating MAD agents
    - IB/core: Destroy QP if XRC QP fails
    - Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ
    - Input: stmfts - acknowledge that setting brightness is a blocking call
    - selinux: never allow relabeling on context mounts
    - powerpc/mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown
      search
    - x86/mce: Improve error message when kernel cannot recover, p2
    - clk: x86: Add system specific quirk to mark clocks as critical
    - i2c: i2c-stm32f7: Fix SDADEL minimum formula
    - media: v4l2: i2c: ov7670: Fix PLL bypass register values
    - mm/kmemleak.c: fix unused-function warning
    - mac80211: don't attempt to rename ERR_PTR() debugfs dirs
    - i2c: Remove unnecessary call to irq_find_mapping
    - i2c: Clear client->irq in i2c_device_remove
    - i2c: Allow recovery of the initial IRQ by an I2C client device.
    - i2c: Prevent runtime suspend of adapter when Host Notify is required
    - USB: dummy-hcd: Fix failure to give back unlinked URBs
    - batman-adv: fix warning in function batadv_v_elp_get_throughput
    - riscv: fix accessing 8-byte variable from RV32
    - net: stmmac: don't stop NAPI processing when dropping a packet
    - mfd: twl-core: Disable IRQ while suspended
    - block: use blk_free_flush_queue() to free hctx->fq in blk_mq_init_hctx
    - arm/mach-at91/pm : fix possible object reference leak
    - fs: stream_open - opener for stream-like files so that read and write can
      run simultaneously without deadlock
    - block: pass no-op callback to INIT_WORK().
    - platform/x86: intel_pmc_core: Fix PCH IP name
    - platform/x86: intel_pmc_core: Handle CFL regmap properly
    - x86/mm: Fix a crash with kmemleak_scan()
    - Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup()
    - ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
    - staging: greybus: power_supply: fix prop-descriptor request size
    - ASoC: hdmi-codec: fix S/PDIF DAI
    - ASoC:soc-pcm:fix a codec fixup issue in TDM case
    - ASoC: nau8824: fix the issue of the widget with prefix name
    - ASoC: nau8810: fix the issue of widget with prefixed name
    - ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate
    - ASoC: wm_adsp: Add locking to wm_adsp2_bus_error
    - ASoC: cs4270: Set auto-increment bit for register writes
    - IB/hfi1: Eliminate opcode tests on mr deref
    - MIPS: KGDB: fix kgdb support for SMP platforms.
    - ASoC: tlv320aic32x4: Fix Common Pins
    - drm/mediatek: Fix an error code in mtk_hdmi_dt_parse_pdata()
    - perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS
    - perf/x86/intel: Initialize TFA MSR
    - linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
    - ASoC: rockchip: pdm: fix regmap_ops hang issue
    - slab: fix a crash by reading /proc/slab_allocators
    - virtio_pci: fix a NULL pointer reference in vp_del_vqs
    - RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove
    - scsi: csiostor: fix missing data copy in csio_scsi_err_handler()
    - drm/mediatek: fix possible object reference leak
    - ASoC: Intel: kbl: fix wrong number of channels
    - virtio-blk: limit number of hw queues by nr_cpu_ids
    - platform/x86: pmc_atom: Drop __initconst on dmi table
    - genirq: Prevent use-after-free and work list corruption
    - usb: dwc3: Fix default lpm_nyet_threshold value
    - USB: serial: f81232: fix interrupt worker not stop
    - USB: cdc-acm: fix unthrottle races
    - usb-storage: Set virt_boundary_mask to avoid SG overflows
    - intel_th: pci: Add Comet Lake support
    - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
    - UAS: fix alignment of scatter/gather segments
    - ASoC: Intel: avoid Oops if DMA setup fails
    - locking/futex: Allow low-level atomic operations to return -EAGAIN
    - arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
    - ASoC: tlv320aic3x: fix reset gpio reference counting
    - ASoC: stm32: sai: fix exposed capabilities in spdif mode
    - ASoC:intel:skl:fix a simultaneous playback & capture issue on hda platform
    - ASoC: dapm: Fix NULL pointer dereference in snd_soc_dapm_free_kcontrol
    - drm/omap: hdmi4_cec: Fix CEC clock handling for PM
    - IB/hfi1: Fix the allocation of RSM table
    - drm/amd/display: fix cursor black issue
    - objtool: Add machine_real_restart() to the noreturn list
    - objtool: Add rewind_stack_do_exit() to the noreturn list
    - RDMA/hns: Fix bug that caused srq creation to fail
    - perf/core: Fix perf_event_disable_inatomic() race
    - soc: sunxi: Fix missing dependency on REGMAP_MMIO
    - scsi: lpfc: change snprintf to scnprintf for possible overflow

  * [ZenBook S UX391UA, Realtek ALC294, Mic, Internal] No sound at all
    (LP: #1784485) // Bionic update: upstream stable patchset 2019-07-30
    (LP: #1838459)
    - ALSA: hda/realtek - Apply the fixup for ASUS Q325UAR

  * Bionic update: upstream stable patchset 2019-07-29 (LP: #1838349)
    - ARC: u-boot args: check that magic number is correct
    - arc: hsdk_defconfig: Enable CONFIG_BLK_DEV_RAM
    - perf/core: Restore mmap record type correctly
    - ext4: add missing brelse() in add_new_gdb_meta_bg()
    - ext4: report real fs size after failed resize
    - ALSA: echoaudio: add a check for ioremap_nocache
    - ALSA: sb8: add a check for request_region
    - auxdisplay: hd44780: Fix memory leak on ->remove()
    - IB/mlx4: Fix race condition between catas error reset and aliasguid flows
    - mmc: davinci: remove extraneous __init annotation
    - ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and
      declaration
    - thermal/intel_powerclamp: fix __percpu declaration of worker_data
    - thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs
    - thermal/int340x_thermal: Add additional UUIDs
    - thermal/int340x_thermal: fix mode setting
    - thermal/intel_powerclamp: fix truncated kthread name
    - scsi: iscsi: flush running unbind operations when removing a session
    - x86/mm: Don't leak kernel addresses
    - tools/power turbostat: return the exit status of a command
    - perf list: Don't forget to drop the reference to the allocated thread_map
    - perf config: Fix an error in the config template documentation
    - perf config: Fix a memory leak in collect_config()
    - perf build-id: Fix memory leak in print_sdt_events()
    - perf top: Fix error handling in cmd_top()
    - perf hist: Add missing map__put() in error case
    - perf evsel: Free evsel->counts in perf_evsel__exit()
    - perf tests: Fix a memory leak of cpu_map object in the
      openat_syscall_event_on_all_cpus test
    - perf tests: Fix memory leak by expr__find_other() in test__expr()
    - perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
    - irqchip/mbigen: Don't clear eventid when freeing an MSI
    - x86/hpet: Prevent potential NULL pointer dereference
    - x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
    - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure
    - iommu/vt-d: Check capability before disabling protected memory
    - x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return
      an error
    - fix incorrect error code mapping for OBJECTID_NOT_FOUND
    - ext4: prohibit fstrim in norecovery mode
    - gpio: pxa: handle corner case of unprobed device
    - rsi: improve kernel thread handling to fix kernel panic
    - 9p: do not trust pdu content for stat item size
    - 9p locks: add mount option for lock retry interval
    - f2fs: fix to do sanity check with current segment number
    - netfilter: xt_cgroup: shrink size of v2 path
    - serial: uartps: console_setup() can't be placed to init section
    - powerpc/pseries: Remove prrn_work workqueue
    - media: au0828: cannot kfree dev before usb disconnect
    - HID: i2c-hid: override HID descriptors for certain devices
    - ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
    - [Config] updateconfigs for CONFIG_SAMSUNG_PM_CHECK
    - usbip: fix vhci_hcd controller counting
    - ACPI / SBS: Fix GPE storm on recent MacBookPro's
    - KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail
    - cifs: fallback to older infolevels on findfirst queryinfo retry
    - kernel: hung_task.c: disable on suspend
    - crypto: sha256/arm - fix crash bug in Thumb2 build
    - crypto: sha512/arm - fix crash bug in Thumb2 build
    - iommu/dmar: Fix buffer overflow during PCI bus notification
    - soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
    - lkdtm: Print real addresses
    - lkdtm: Add tests for NULL pointer dereference
    - drm/panel: panel-innolux: set display off in innolux_panel_unprepare
    - crypto: axis - fix for recursive locking from bottom half
    - Revert "ACPI / EC: Remove old CLEAR_ON_RESUME quirk"
    - coresight: cpu-debug: Support for CA73 CPUs
    - drm/nouveau/volt/gf117: fix speedo readout register
    - ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t
    - drm/amdkfd: use init_mqd function to allocate object for hid_mqd (CI)
    - appletalk: Fix use-after-free in atalk_proc_exit
    - lib/div64.c: off by one in shift
    - include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
    - bpf: fix use after free in bpf_evict_inode
    - dm: disable CRYPTO_TFM_REQ_MAY_SLEEP to fix a GFP_KERNEL recursion deadlock
    - net: stmmac: Set dma ring length before enabling the DMA
    - mm: hide incomplete nr_indirectly_reclaimable in sysfs
    - appletalk: Fix compile regression
    - ext4: avoid panic during forced reboot
    - i40iw: Avoid panic when handling the inetdev event
    - sched/core: Fix buffer overflow in cgroup2 property cpu.max
    - ACPI / utils: Drop reference in test for device presence
    - PM / Domains: Avoid a potential deadlock
    - drm/exynos/mixer: fix MIXER shadow registry synchronisation code
    - Bluetooth: Fix debugfs NULL pointer dereference
    - f2fs: cleanup dirty pages if recover failed
    - [Config] updateconfigs for CONFIG_INTEL_ATOMISP2_PM
    - platform/x86: Add Intel AtomISP2 dummy / power-management driver
    - drm/ttm: Fix bo_global and mem_global kfree error
    - ALSA: hda: fix front speakers on Huawei MBXP
    - ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle
    - net/rds: fix warn in rds_message_alloc_sgs
    - scsi: core: Avoid that system resume triggers a kernel warning
    - PCI: Blacklist power management of Gigabyte X299 DESIGNARE EX PCIe ports
    - rxrpc: Fix client call connect/disconnect race
    - f2fs: fix to dirty inode for i_mode recovery
    - bonding: fix event handling for stacked bonds
    - net: atm: Fix potential Spectre v1 vulnerabilities
    - net: bridge: fix per-port af_packet sockets
    - net: bridge: multicast: use rcu to access port list from
      br_multicast_start_querier
    - net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
    - tcp: tcp_grow_window() needs to respect tcp_space()
    - team: set slave to promisc if team is already in promisc mode
    - vhost: reject zero size iova range
    - ipv4: recompile ip options in ipv4_link_failure
    - ipv4: ensure rcu_read_lock() in ipv4_link_failure()
    - net: thunderx: raise XDP MTU to 1508
    - net: thunderx: don't allow jumbo frames with XDP
    - KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
    - KVM: x86: svm: make sure NMI is injected after nmi_singlestep
    - Staging: iio: meter: fixed typo
    - staging: iio: ad7192: Fix ad7193 channel address
    - iio: gyro: mpu3050: fix chip ID reading
    - iio/gyro/bmg160: Use millidegrees for temperature scale
    - iio: cros_ec: Fix the maths for gyro scale calculation
    - iio: ad_sigma_delta: select channel when reading register
    - iio: dac: mcp4725: add missing powerdown bits in store eeprom
    - iio: Fix scan mask selection
    - iio: adc: at91: disable adc channel interrupt in timeout case
    - iio: core: fix a possible circular locking dependency
    - io: accel: kxcjk1013: restore the range after resume.
    - staging: comedi: vmk80xx: Fix use of uninitialized semaphore
    - staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
    - staging: comedi: ni_usb6501: Fix use of uninitialized mutex
    - staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
    - ALSA: core: Fix card races between register and disconnect
    - scsi: core: set result when the command cannot be dispatched
    - coredump: fix race condition between mmget_not_zero()/get_task_mm() and core
      dumping
    - crypto: x86/poly1305 - fix overflow during partial reduction
    - arm64: futex: Restore oldval initialization to work around buggy compilers
    - x86/kprobes: Verify stack frame on kretprobe
    - kprobes: Mark ftrace mcount handler functions nokprobe
    - kprobes: Fix error check when reusing optimized probes
    - rt2x00: do not increment sequence number while re-transmitting
    - mac80211: do not call driver wake_tx_queue op during reconfig
    - perf/x86/amd: Add event map for AMD Family 17h
    - x86/cpu/bugs: Use __initconst for 'const' init data
    - perf/x86: Fix incorrect PEBS_REGS
    - x86/speculation: Prevent deadlock on ssb_state::lock
    - crypto: crypto4xx - properly set IV after de- and encrypt
    - mmc: sdhci: Fix data command CRC error handling
    - mmc: sdhci: Rename SDHCI_ACMD12_ERR and SDHCI_INT_ACMD12ERR
    - mmc: sdhci: Handle auto-command errors
    - modpost: file2alias: go back to simple devtable lookup
    - modpost: file2alias: check prototype of handler
    - tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
    - ipv6: frags: fix a lockdep false positive
    - Revert "kbuild: use -Oz instead of -Os when using clang"
    - device_cgroup: fix RCU imbalance in error case
    - mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y
      CONFIG_SMP=n
    - ALSA: info: Fix racy addition/deletion of nodes
    - percpu: stop printing kernel addresses
    - iomap: report collisions between directio and buffered writes to userspace
    - i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
    - net: Fix missing meta data in skb with vlan packet
    - nfp: flower: replace CFI with vlan present
    - nfp: flower: remove vlan CFI bit from push vlan action
    - ip: add helpers to process in-order fragments faster.
    - net: IP defrag: encapsulate rbtree defrag code into callable functions
    - ip: process in-order fragments efficiently
    - ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module
    - net: IP6 defrag: use rbtrees for IPv6 defrag
    - net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c
    - cifs: fix handle leak in smb2_query_symlink()
    - Input: elan_i2c - add hardware ID for multiple Lenovo laptops
    - drm/ttm: fix out-of-bounds read in ttm_put_pages() v2
    - timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze()
    - tpm: Fix the type of the return value in calc_tpm2_event_size()

  * Bionic update: upstream stable patchset 2019-07-26 (LP: #1838116)
    - mmc: pxamci: fix enum type confusion
    - drm/vmwgfx: Don't double-free the mode stored in par->set_mode
    - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
    - libceph: wait for latest osdmap in ceph_monc_blacklist_add()
    - udf: Fix crash on IO error during truncate
    - mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
    - MIPS: Ensure ELF appended dtb is relocated
    - MIPS: Fix kernel crash for R6 in jump label branch function
    - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
    - scsi: ibmvscsi: Fix empty event pool access during host removal
    - futex: Ensure that futex address is aligned in handle_futex_death()
    - perf probe: Fix getting the kernel map
    - objtool: Move objtool_file struct off the stack
    - ALSA: x86: Fix runtime PM for hdmi-lpe-audio
    - ext4: fix NULL pointer dereference while journal is aborted
    - ext4: fix data corruption caused by unaligned direct AIO
    - ext4: brelse all indirect buffer in ext4_ind_remove_space()
    - media: v4l2-ctrls.c/uvc: zero v4l2_event
    - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
    - Bluetooth: Fix decrementing reference count twice in releasing socket
    - Bluetooth: hci_ldisc: Initialize hci_dev before open()
    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
      hci_uart_set_proto()
    - drm: Reorder set_property_atomic to avoid returning with an active ww_ctx
    - netfilter: ebtables: remove BUGPRINT messages
    - x86/unwind: Handle NULL pointer calls better in frame unwinder
    - x86/unwind: Add hardcoded ORC entry for NULL
    - locking/lockdep: Add debug_locks check in __lock_downgrade()
    - ALSA: hda - Record the current power state before suspend/resume calls
    - PCI: designware-ep: dw_pcie_ep_set_msi() should only set MMC bits
    - PCI: designware-ep: Read-only registers need DBI_RO_WR_EN to be writable
    - PCI: endpoint: Use EPC's device in dma_alloc_coherent()/dma_free_coherent()
    - rtc: Fix overflow when converting time64_t to rtc_time
    - sched/cpufreq/schedutil: Fix error path mutex unlock
    - pwm-backlight: Enable/disable the PWM before/after LCD enable toggle.
    - power: supply: charger-manager: Fix incorrect return value
    - ath10k: avoid possible string overflow
    - mmc: renesas_sdhi: limit block count to 16 bit for old revisions
    - powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
    - RDMA/cma: Rollback source IP address if failing to acquire device
    - f2fs: fix to avoid deadlock of atomic file operations
    - loop: access lo_backing_file only when the loop device is Lo_bound
    - video: fbdev: Set pixclock = 0 in goldfishfb
    - dccp: do not use ipv6 header for ipv4 flow
    - genetlink: Fix a memory leak on error path
    - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
    - net: datagram: fix unbounded loop in __skb_try_recv_datagram()
    - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
    - net: rose: fix a possible stack overflow
    - net: stmmac: fix memory corruption with large MTUs
    - net-sysfs: call dev_hold if kobject_init_and_add success
    - packets: Always register packet sk in the same order
    - rhashtable: Still do rehash when we get EEXIST
    - tcp: do not use ipv6 header for ipv4 flow
    - thunderx: enable page recycling for non-XDP case
    - thunderx: eliminate extra calls to put_page() for pages held for recycling
    - vxlan: Don't call gro_cells_destroy() before device is unregistered
    - sctp: get sctphdr by offset in sctp_compute_cksum
    - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
    - mac8390: Fix mmio access size probe
    - tun: properly test for IFF_UP
    - tun: add a missing rcu_read_unlock() in error path
    - powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E
    - powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms
    - powerpc/fsl: Add infrastructure to fixup branch predictor flush
    - powerpc/fsl: Add macro to flush the branch predictor
    - powerpc/fsl: Emulate SPRN_BUCSR register
    - powerpc/fsl: Flush the branch predictor at each kernel entry (64bit)
    - powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit)
    - powerpc/fsl: Flush branch predictor when entering KVM
    - powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used
    - powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup'
    - powerpc/fsl: Fix the flush of branch predictor.
    - Btrfs: fix incorrect file size after shrinking truncate and fsync
    - btrfs: remove WARN_ON in log_dir_items
    - ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
    - powerpc: bpf: Fix generation of load/store DW instructions
    - NFSv4.1 don't free interrupted slot on open
    - net: dsa: qca8k: remove leftover phy accessors
    - ALSA: pcm: Fix possible OOB access in PCM oss plugins
    - ALSA: pcm: Don't suspend stream in unrecoverable PCM state
    - kbuild: modversions: Fix relative CRC byte order interpretation
    - fs/open.c: allow opening only regular files during execve()
    - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock
    - scsi: sd: Fix a race between closing an sd device and sd I/O
    - scsi: sd: Quiesce warning if device does not report optimal I/O size
    - scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
    - scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP
      devices
    - tty: atmel_serial: fix a potential NULL pointer dereference
    - staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
    - staging: vt6655: Remove vif check from vnt_interrupt
    - staging: vt6655: Fix interrupt race condition on device start up.
    - serial: max310x: Fix to avoid potential NULL pointer dereference
    - serial: sh-sci: Fix setting SCSCR_TIE while transferring data
    - USB: serial: cp210x: add new device id
    - USB: serial: ftdi_sio: add additional NovaTech products
    - USB: serial: mos7720: fix mos_parport refcount imbalance on error path
    - USB: serial: option: set driver_info for SIM5218 and compatibles
    - USB: serial: option: add support for Quectel EM12
    - USB: serial: option: add Olicard 600
    - Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
    - drm/vgem: fix use-after-free when drm_gem_handle_create() fails
    - gpio: exar: add a check for the return value of ida_simple_get fails
    - gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
    - phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
    - usb: mtu3: fix EXTCON dependency
    - USB: gadget: f_hid: fix deadlock in f_hidg_write()
    - usb: common: Consider only available nodes for dr_mode
    - usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
    - xhci: Fix port resume done detection for SS ports with LPM enabled
    - usb: cdc-acm: fix race during wakeup blocking TX traffic
    - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate
    - perf intel-pt: Fix TSC slip
    - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
    - x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
    - KVM: Reject device ioctls from processes other than the VM's creator
    - KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
    - vfio: ccw: only free cp on final interrupt
    - ipmi_si: Fix crash when using hard-coded device
    - gtp: change NET_UDP_TUNNEL dependency to select
    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
    - NFS: fix mount/umount race in nlmclnt.
    - ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286
    - ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
    - ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
    - ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
    - ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
    - ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
    - ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
    - drm/rockchip: Do not use memcpy for MMIO addresses
    - drm/rockchip: vop: reset scale mode when win is disabled
    - tty: mxs-auart: fix a potential NULL pointer dereference
    - staging: speakup_soft: Fix alternate speech with other synths
    - serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
    - drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check
    - usb: xhci: dbc: Don't free all memory with spinlock held
    - xhci: Don't let USB3 ports stuck in polling state prevent suspend
    - mm: add support for kmem caches in DMA32 zone
    - iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging
    - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
    - perf pmu: Fix parser error for uncore event alias
    - objtool: Query pkg-config for libelf location
    - bpf: do not restore dst_reg when cur_state is freed
    - arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
    - ext4: cleanup bh release code in ext4_ind_remove_space()
    - tty/serial: atmel: Add is_half_duplex helper
    - tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
    - CIFS: fix POSIX lock leak and invalid ptr deref
    - h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
    - f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
    - tracing: kdb: Fix ftdump to not sleep
    - net/mlx5: Avoid panic when setting vport rate
    - net/mlx5: Avoid panic when setting vport mac, getting vport config
    - gpio: gpio-omap: fix level interrupt idling
    - include/linux/relay.h: fix percpu annotation in struct rchan
    - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
    - scsi: hisi_sas: Set PHY linkrate when disconnected
    - iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver
    - perf c2c: Fix c2c report for empty numa node
    - mm/cma.c: cma_declare_contiguous: correct err handling
    - mm/page_ext.c: fix an imbalance with kmemleak
    - mm, mempolicy: fix uninit memory access
    - mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
    - mm/slab.c: kmemleak no scan alien caches
    - ocfs2: fix a panic problem caused by o2cb_ctl
    - f2fs: do not use mutex lock in atomic context
    - fs/file.c: initialize init_files.resize_wait
    - page_poison: play nicely with KASAN
    - cifs: use correct format characters
    - dm thin: add sanity checks to thin-pool and external snapshot creation
    - cifs: Fix NULL pointer dereference of devname
    - jbd2: fix invalid descriptor block checksum
    - fs: fix guard_bio_eod to check for real EOD errors
    - tools lib traceevent: Fix buffer overflow in arg_eval
    - PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove()
    - wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
    - crypto: crypto4xx - add missing of_node_put after of_device_is_available
    - crypto: cavium/zip - fix collision with generic cra_driver_name
    - usb: chipidea: Grab the (legacy) USB PHY by phandle first
    - scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
    - powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc
    - coresight: etm4x: Add support to enable ETMv4.2
    - serial: 8250_pxa: honor the port number from devicetree
    - ARM: 8840/1: use a raw_spinlock_t in unwind
    - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
    - powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area
      callback
    - mmc: omap: fix the maximum timeout setting
    - e1000e: Fix -Wformat-truncation warnings
    - mlxsw: spectrum: Avoid -Wformat-truncation warnings
    - IB/mlx4: Increase the timeout for CM cache
    - clk: fractional-divider: check parent rate only if flag is set
    - cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies
    - efi: cper: Fix possible out-of-bounds access
    - scsi: megaraid_sas: return error when create DMA pool failed
    - scsi: fcoe: make use of fip_mode enum complete
    - perf test: Fix failure of 'evsel-tp-sched' test on s390
    - SoC: imx-sgtl5000: add missing put_device()
    - media: sh_veu: Correct return type for mem2mem buffer helpers
    - media: s5p-jpeg: Correct return type for mem2mem buffer helpers
    - media: s5p-g2d: Correct return type for mem2mem buffer helpers
    - media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
    - media: mtk-jpeg: Correct return type for mem2mem buffer helpers
    - vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
    - HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
    - jbd2: fix race when writing superblock
    - leds: lp55xx: fix null deref on firmware load failure
    - iwlwifi: pcie: fix emergency path
    - ACPI / video: Refactor and fix dmi_is_desktop()
    - kprobes: Prohibit probing on bsearch()
    - netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in
      __nf_conntrack_confirm
    - ARM: 8833/1: Ensure that NEON code always compiles with Clang
    - ALSA: PCM: check if ops are defined before suspending PCM
    - usb: f_fs: Avoid crash due to out-of-scope stack ptr access
    - sched/topology: Fix percpu data types in struct sd_data & struct s_data
    - bcache: fix input overflow to cache set sysfs file io_error_halflife
    - bcache: fix input overflow to sequential_cutoff
    - bcache: improve sysfs_strtoul_clamp()
    - genirq: Avoid summation loops for /proc/stat
    - iw_cxgb4: fix srqidx leak during connection abort
    - fbdev: fbmem: fix memory access if logo is bigger than the screen
    - cdrom: Fix race condition in cdrom_sysctl_register
    - platform/x86: intel_pmc_core: Fix PCH IP sts reading
    - ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
    - sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK
    - efi/memattr: Don't bail on zero VA if it equals the region's PA
    - ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
    - soc: qcom: gsbi: Fix error handling in gsbi_probe()
    - mt7601u: bump supported EEPROM version
    - ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of
    - ARM: avoid Cortex-A9 livelock on tight dmb loops
    - bpf: fix missing prototype warnings
    - cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix
      the accounting
    - backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
    - tty: increase the default flip buffer limit to 2*640K
    - powerpc/pseries: Perform full re-add of CPU for topology update post-
      migration
    - usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded
    - media: mt9m111: set initial frame size other than 0x0
    - hwrng: virtio - Avoid repeated init of completion
    - soc/tegra: fuse: Fix illegal free of IO base address
    - HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR
      busy_clear bit
    - hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
    - cpu/hotplug: Mute hotplug lockdep during init
    - dmaengine: imx-dma: fix warning comparison of distinct pointer types
    - dmaengine: qcom_hidma: assign channel cookie correctly
    - dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_*
    - netfilter: physdev: relax br_netfilter dependency
    - media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
    - regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
    - drm: Auto-set allow_fb_modifiers when given modifiers at plane init
    - drm/nouveau: Stop using drm_crtc_force_disable
    - x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
    - selinux: do not override context on context mounts
    - wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
    - x86/build: Mark per-CPU symbols as absolute explicitly for LLD
    - clk: rockchip: fix frac settings of GPLL clock for rk3328
    - dmaengine: tegra: avoid overflow of byte tracking
    - drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
    - ACPI / video: Extend chassis-type detection with a "Lunch Box" check
    - f2fs: fix to adapt small inline xattr space in __find_inline_xattr()
    - net: stmmac: Avoid sometimes uninitialized Clang warnings
    - libbpf: force fixdep compilation at the start of the build
    - scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO
    - x86/hyperv: Fix kernel panic when kexec on HyperV
    - mm/sparse: fix a bad comparison
    - mm, swap: bounds check swap_info array accesses to avoid NULL derefs
    - memcg: killed threads should not invoke memcg OOM killer
    - cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED
    - netfilter: nf_tables: check the result of dereferencing base_chain->stats
    - netfilter: conntrack: tcp: only close if RST matches exact sequence
    - kbuild: invoke syncconfig if include/config/auto.conf.cmd is missing
    - mwifiex: don't advertise IBSS features without FW support
    - perf report: Don't shadow inlined symbol with different addr range
    - media: rockchip/rga: Correct return type for mem2mem buffer helpers
    - selftests: skip seccomp get_metadata test if not real root
    - kprobes: Prohibit probing on RCU debug routine
    - bcache: fix potential div-zero error of writeback_rate_i_term_inverse
    - drm: rcar-du: add missing of_node_put
    - perf/aux: Make perf_event accessible to setup_aux()
    - e1000e: Exclude device from suspend direct complete optimization
    - i2c: of: Try to find an I2C adapter matching the parent
    - sched/core: Use READ_ONCE()/WRITE_ONCE() in
      move_queued_task()/task_rq_lock()
    - powerpc/64s: Clear on-stack exception marker upon exception return
    - platform/x86: intel-hid: Missing power button release on some Dell models
    - pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins
    - net: stmmac: Avoid one more sometimes uninitialized Clang warning
    - bcache: fix potential div-zero error of writeback_rate_p_term_inverse
    - net: sfp: move sfp_register_socket call from sfp_remove to sfp_probe
    - drm/i915/gvt: do not let pin count of shadow mm go negative
    - powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM
    - kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
    - x86: vdso: Use $LD instead of $CC to link
    - x86/vdso: Drop implicit common-page-size linker flag
    - lib/string.c: implement a basic bcmp
    - stating: ccree: revert "staging: ccree: fix leak of import() after init()"
    - arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region
    - tty: mark Siemens R3964 line discipline as BROKEN
    - [Config] updateconfigs for CONFIG_R3964 (BROKEN)
    - [Config] updateconfigs for CONFIG_LDISC_AUTOLOAD
    - tty: ldisc: add sysctl to prevent autoloading of ldiscs
    - ipv6: Fix dangling pointer when ipv6 fragment
    - ipv6: sit: reset ip header pointer in ipip6_rcv
    - kcm: switch order of device registration to fix a crash
    - net-gro: Fix GRO flush when receiving a GSO packet.
    - net/mlx5: Decrease default mr cache size
    - net/sched: fix ->get helper of the matchall cls
    - qmi_wwan: add Olicard 600
    - sctp: initialize _pad of sockaddr_in before copying to user memory
    - tcp: Ensure DCTCP reacts to losses
    - vrf: check accept_source_route on the original netdevice
    - net/mlx5e: Fix error handling when refreshing TIRs
    - net/mlx5e: Add a lock on tir list
    - nfp: validate the return code from dev_queue_xmit()
    - bnxt_en: Improve RX consumer index validity check.
    - bnxt_en: Reset device on RX buffer errors.
    - net/sched: act_sample: fix divide by zero in the traffic path
    - netns: provide pure entropy for net_hash_mix()
    - net: ethtool: not call vzalloc for zero sized memory request
    - ALSA: seq: Fix OOB-reads from strlcpy
    - ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
    - hv_netvsc: Fix unwanted wakeup after tx_disable
    - arm64: dts: rockchip: fix rk3328 sdmmc0 write errors
    - parisc: Detect QEMU earlier in boot process
    - parisc: regs_return_value() should return gpr28
    - alarmtimer: Return correct remaining time
    - drm/udl: add a release method and delay modeset teardown
    - include/linux/bitrev.h: fix constant bitrev
    - ASoC: fsl_esai: fix channel swap issue when stream starts
    - Btrfs: do not allow trimming when a fs is mounted with the nologreplay
      option
    - btrfs: prop: fix zstd compression parameter validation
    - btrfs: prop: fix vanished compression property after failed set
    - block: do not leak memory in bio_copy_user_iov()
    - block: fix the return errno for direct IO
    - genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
    - genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n
    - virtio: Honour 'may_reduce_num' in vring_create_virtqueue
    - ARM: dts: am335x-evmsk: Correct the regulators for the audio codec
    - ARM: dts: am335x-evm: Correct the regulators for the audio codec
    - ARM: dts: at91: Fix typo in ISC_D0 on PC9
    - arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
    - arm64: dts: rockchip: fix rk3328 rgmii high tx error rate
    - arm64: backtrace: Don't bother trying to unwind the userspace stack
    - xen: Prevent buffer overflow in privcmd ioctl
    - sched/fair: Do not re-read ->h_load_next during hierarchical load
      calculation
    - xtensa: fix return_address
    - x86/perf/amd: Resolve race condition when disabling PMC
    - x86/perf/amd: Resolve NMI latency issues for active PMCs
    - x86/perf/amd: Remove need to check "running" bit in NMI handler
    - PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
    - dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors
    - arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64
    - arm64: dts: rockchip: Fix vcc_host1_5v GPIO polarity on rk3328-rock64
    - tcp: fix a potential NULL pointer dereference in tcp_sk_exit
    - nfp: disable netpoll on representors
    - r8169: disable default rx interrupt coalescing on RTL8168
    - kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used
    - ACPICA: Namespace: remove address node from global list after method
      termination
    - ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
    - mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd()
    - riscv: Fix syscall_get_arguments() and syscall_set_arguments()
    - x86/asm: Remove dead __GNUC__ conditionals
    - dm integrity: change memcmp to strncmp in dm_integrity_ctr

  * Bionic update: upstream stable patchset 2019-07-25 (LP: #1837952)
    - ACPICA: Reference Counts: increase max to 0x4000 for large servers
    - gro_cells: make sure device is up in gro_cells_receive()
    - ipv4/route: fail early when inet dev is missing
    - l2tp: fix infoleak in l2tp_ip6_recvmsg()
    - net: hsr: fix memory leak in hsr_dev_finalize()
    - net/hsr: fix possible crash in add_timer()
    - net: sit: fix UBSAN Undefined behaviour in check_6rd
    - net/x25: fix use-after-free in x25_device_event()
    - net/x25: reset state in x25_connect()
    - pptp: dst_release sk_dst_cache in pptp_sock_destruct
    - ravb: Decrease TxFIFO depth of Q3 and Q2 to one
    - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
    - rxrpc: Fix client call queueing, waiting for channel
    - tcp: Don't access TCP_SKB_CB before initializing it
    - tcp: handle inet_csk_reqsk_queue_add() failures
    - vxlan: Fix GRO cells race condition between receive and link delete
    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
    - net/mlx4_core: Fix reset flow when in command polling mode
    - net/mlx4_core: Fix locking in SRIOV mode when switching between events and
      polling
    - net/mlx4_core: Fix qp mtt size calculation
    - net/x25: fix a race in x25_bind()
    - net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
    - bonding: fix PACKET_ORIGDEV regression
    - missing barriers in some of unix_sock ->addr and ->path accesses
    - ipvlan: disallow userns cap_net_admin to change global mode/flags
    - perf/x86: Fixup typo in stub functions
    - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against
      Liquid Saffire 56
    - ALSA: firewire-motu: fix construction of PCM frame for capture direction
    - perf/x86/intel: Fix memory corruption
    - perf/x86/intel: Make dev_attr_allow_tsx_force_abort static
    - It's wrong to add len to sector_nr in raid10 reshape twice
    - sctp: remove sched init from sctp_stream_init
    - team: use operstate consistently for linkup
    - ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()
    - ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
    - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294
    - i40e: report correct statistics when XDP is enabled
    - 9p: use inode->i_lock to protect i_size_write() under 32-bit
    - 9p/net: fix memory leak in p9_client_create
    - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
    - iio: adc: exynos-adc: Fix NULL pointer exception on unbind
    - stm class: Fix an endless loop in channel allocation
    - crypto: caam - fixed handling of sg list
    - crypto: ahash - fix another early termination in hash walk
    - crypto: rockchip - fix scatterlist nents error
    - crypto: rockchip - update new iv to device in multiple operations
    - drm/imx: ignore plane updates on disabled crtcs
    - gpu: ipu-v3: Fix i.MX51 CSI control registers offset
    - drm/imx: imx-ldb: add missing of_node_puts
    - gpu: ipu-v3: Fix CSI offsets for imx53
    - s390/dasd: fix using offset into zero size array error
    - Input: pwm-vibra - prevent unbalanced regulator
    - Input: pwm-vibra - stop regulator after disabling pwm, not before
    - ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be
      uninitialized
    - ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables
    - ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check
    - KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded
    - ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug
    - Input: cap11xx - switch to using set_brightness_blocking()
    - Input: ps2-gpio - flush TX work when closing port
    - Input: matrix_keypad - use flush_delayed_work()
    - mac80211: Fix Tx aggregation session tear down with ITXQs
    - ipvs: fix dependency on nf_defrag_ipv6
    - floppy: check_events callback should not return a negative number
    - NFS: Don't use page_file_mapping after removing the page
    - mm/gup: fix gup_pmd_range() for dax
    - Revert "mm: use early_pfn_to_nid in page_ext_init"
    - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
    - net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
    - i2c: cadence: Fix the hold bit setting
    - i2c: bcm2835: Clear current buffer pointers and counts after a transfer
    - auxdisplay: ht16k33: fix potential user-after-free on module unload
    - Input: st-keyscan - fix potential zalloc NULL dereference
    - clk: sunxi-ng: v3s: Fix TCON reset de-assert bit
    - clk: sunxi: A31: Fix wrong AHB gate number
    - esp: Skip TX bytes accounting when sending from a request socket
    - ARM: 8824/1: fix a migrating irq bug when hotplug cpu
    - af_key: unconditionally clone on broadcast
    - assoc_array: Fix shortcut creation
    - keys: Fix dependency loop between construction record and auth key
    - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
    - net: systemport: Fix reception of BPDUs
    - pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
    - qmi_wwan: apply SET_DTR quirk to Sierra WP7607
    - net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
    - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue
    - ASoC: topology: free created components in tplg load error
    - qed: Fix iWARP syn packet mac address validation.
    - arm64: Relax GIC version check during early boot
    - net: marvell: mvneta: fix DMA debug warning
    - tmpfs: fix link accounting when a tmpfile is linked in
    - ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN
    - ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
    - ARC: uacces: remove lp_start, lp_end from clobber list
    - ARCv2: support manual regfile save on interrupts
    - phonet: fix building with clang
    - mac80211_hwsim: propagate genlmsg_reply return code
    - net: thunderx: make CFG_DONE message to run through generic send-ack
      sequence
    - nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
    - nfp: bpf: fix ALU32 high bits clearance bug
    - net: set static variable an initial value in atl2_probe()
    - tmpfs: fix uninitialized return value in shmem_link
    - media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
    - stm class: Prevent division by zero
    - libnvdimm/label: Clear 'updating' flag after label-set update
    - libnvdimm, pfn: Fix over-trim in trim_pfn_device()
    - libnvdimm/pmem: Honor force_raw for legacy pmem regions
    - libnvdimm: Fix altmap reservation size calculation
    - fix cgroup_do_mount() handling of failure exits
    - crypto: arm/crct10dif - revert to C code for short inputs
    - crypto: arm64/crct10dif - revert to C code for short inputs
    - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
    - crypto: testmgr - skip crc32c context test for ahash algorithms
    - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
    - crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
    - CIFS: Do not reset lease state to NONE on lease break
    - CIFS: Fix read after write for files with read caching
    - tracing: Use strncpy instead of memcpy for string keys in hist triggers
    - tracing: Do not free iter->trace in fail path of tracing_open_pipe()
    - xen: fix dom0 boot on huge systems
    - ACPI / device_sysfs: Avoid OF modalias creation for removed device
    - mmc: sdhci-esdhc-imx: fix HS400 timing issue
    - spi: ti-qspi: Fix mmap read when more than one CS in use
    - spi: pxa2xx: Setup maximum supported DMA transfer length
    - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
    - regulator: max77620: Initialize values for DT properties
    - regulator: s2mpa01: Fix step values for some LDOs
    - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
    - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
    - s390/setup: fix early warning messages
    - s390/virtio: handle find on invalid queue gracefully
    - scsi: virtio_scsi: don't send sc payload with tmfs
    - scsi: aacraid: Fix performance issue on logical drives
    - scsi: sd: Optimal I/O size should be a multiple of physical block size
    - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
    - fs/devpts: always delete dcache dentry-s in dput()
    - splice: don't merge into linked buffers
    - m68k: Add -ffreestanding to CFLAGS
    - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
    - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
    - Btrfs: fix corruption reading shared and compressed extents after hole
      punching
    - crypto: pcbc - remove bogus memcpy()s with src == dest
    - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
    - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
    - x86/kprobes: Prohibit probing on optprobe template code
    - cpufreq: tegra124: add missing of_node_put()
    - cpufreq: pxa2xx: remove incorrect __init annotation
    - ext4: add mask of ext4 flags to swap
    - ext4: fix crash during online resizing
    - IB/hfi1: Close race condition on user context disable and close
    - cxl: Wrap iterations over afu slices inside 'afu_list_lock'
    - ext2: Fix underflow in ext2_max_size()
    - clk: uniphier: Fix update register for CPU-gear
    - clk: clk-twl6040: Fix imprecise external abort for pdmclk
    - clk: ingenic: Fix round_rate misbehaving with non-integer dividers
    - clk: ingenic: Fix doc of ingenic_cgu_div_info
    - usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
    - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
    - mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
    - mm/vmalloc: fix size check for remap_vmalloc_range_partial()
    - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
    - device property: Fix the length used in PROPERTY_ENTRY_STRING()
    - intel_th: Don't reference unassigned outputs
    - parport_pc: fix find_superio io compare code, should use equal test.
    - i2c: tegra: fix maximum transfer size
    - crypto: arm64/aes-neonbs - fix returning final keystream block
    - drm/i915: Relax mmap VMA check
    - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
    - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
    - serial: 8250_pci: Fix number of ports for ACCES serial cards
    - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954
      chip use the pci_pericom_setup()
    - jbd2: clear dirty flag when revoking a buffer from an older transaction
    - jbd2: fix compile warning when using JBUFFER_TRACE
    - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
    - powerpc/32: Clear on-stack exception marker upon exception return
    - powerpc/wii: properly disable use of BATs when requested.
    - powerpc/powernv: Make opal log only readable by root
    - powerpc/83xx: Also save/restore SPRG4-7 during suspend
    - powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
    - powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
    - powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR
      configuration
    - powerpc/traps: fix recoverability of machine check handling on book3s/32
    - powerpc/traps: Fix the message printed when stack overflows
    - ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
    - arm64: Fix HCR.TGE status for NMI contexts
    - arm64: debug: Ensure debug handlers check triggering exception level
    - arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
    - dm: fix to_sector() for 32bit
    - dm integrity: limit the rate of error messages
    - cpcap-charger: generate events for userspace
    - NFS: Fix I/O request leakages
    - NFS: Fix an I/O request leakage in nfs_do_recoalesce
    - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
    - nfsd: fix memory corruption caused by readdir
    - nfsd: fix wrong check in write_v4_end_grace()
    - NFSv4.1: Reinitialise sequence results before retransmitting a request
    - PM / wakeup: Rework wakeup source timer cancellation
    - x86/unwind/orc: Fix ORC unwind table alignment
    - perf intel-pt: Fix CYC timestamp calculation after OVF
    - perf auxtrace: Define auxtrace record alignment
    - perf intel-pt: Fix overlap detection to identify consecutive buffers
      correctly
    - perf intel-pt: Fix overlap calculation for padding
    - perf intel-pt: Fix divide by zero when TSC is not available
    - md: Fix failed allocation of md_register_thread
    - tpm/tpm_crb: Avoid unaligned reads in crb_recv()
    - tpm: Unify the send callback behaviour
    - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
    - media: imx: prpencvf: Stop upstream before disabling IDMA channel
    - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
    - media: vimc: Add vimc-streamer for stream control
    - media: imx: csi: Disable CSI immediately after last EOF
    - media: imx: csi: Stop upstream before disabling IDMA channel
    - drm/radeon/evergreen_cs: fix missing break in switch statement
    - KVM: Call kvm_arch_memslots_updated() before updating memslots
    - KVM: x86/mmu: Detect MMIO generation wrap in any address space
    - KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
    - KVM: nVMX: Sign extend displacements of VMX instr's mem operands
    - KVM: nVMX: Apply addr size mask to effective address for VMX instructions
    - KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
    - s390/setup: fix boot crash for machine without EDAT-1
    - crypto: caam - fix hash context DMA unmap size
    - crypto: caam - fix DMA mapping of stack memory
    - KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock
    - arm/arm64: KVM: Allow a VCPU to fully reset itself
    - arm/arm64: KVM: Don't panic on failure to properly reset system registers
    - ASoC: samsung: Prevent clk_get_rate() calls in atomic context
    - mac80211: call drv_ibss_join() on restart
    - blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue
    - xprtrdma: Make sure Send CQ is allocated on an existing compvec
    - net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()
    - x86/CPU: Add Icelake model number
    - kallsyms: Handle too long symbols in kallsyms.c
    - ARM: 8835/1: dma-mapping: Clear DMA ops on teardown
    - net: dsa: bcm_sf2: Do not assume DSA master supports WoL
    - qed: Fix iWARP buffer size provided for syn packet processing.
    - mm: handle lru_add_drain_all for UP properly
    - ARCv2: don't assume core 0x54 has dual issue
    - bpf, lpm: fix lookup bug in map_delete_elem
    - acpi/nfit: Fix bus command validation
    - mmc:fix a bug when max_discard is 0
    - netfilter: ipt_CLUSTERIP: fix warning unused variable cn
    - [Config] updateconfigs for CONFIG_SUN50I_ERRATUM_UNKNOWN1
    - clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer
      instability
    - irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
    - ext4: fix check of inode in swap_inode_boot_loader
    - ext4: cleanup pagecache before swap i_data
    - ext4: update quota information while swapping boot loader inode
    - dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
    - mm/memory.c: do_fault: avoid usage of stale vm_area_struct
    - media: i2c: ov5640: Fix post-reset delay
    - powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
    - mfd: sm501: Fix potential NULL pointer dereference
    - nfsd: fix performance-limiting session calculation
    - svcrpc: fix UDP on servers with lots of threads
    - stable-kernel-rules.rst: add link to networking patch queue
    - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata

  * Bionic update: upstream stable patchset 2019-07-24 (LP: #1837813)
    - dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
    - eeprom: at24: add support for 24c2048
    - blk-mq: fix a hung issue when fsync
    - ARM: 8789/1: signal: copy registers using __copy_to_user()
    - ARM: 8790/1: signal: always use __copy_to_user to save iwmmxt context
    - ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
    - ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
    - ARM: 8793/1: signal: replace __put_user_error with __put_user
    - ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
    - ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
    - ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
    - ARM: 8797/1: spectre-v1.1: harden __copy_to_user
    - ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
    - ARM: make lookup_processor_type() non-__init
    - ARM: split out processor lookup
    - ARM: clean up per-processor check_bugs method call
    - ARM: add PROC_VTABLE and PROC_TABLE macros
    - ARM: spectre-v2: per-CPU vtables to work around big.Little systems
    - ARM: ensure that processor vtables is not lost after boot
    - ARM: fix the cockup in the previous patch
    - ACPI: NUMA: Use correct type for printing addresses on i386-PAE
    - perf test shell: Use a fallback to get the pathname in vfs_getname
    - cpufreq: check if policy is inactive early in __cpufreq_get()
    - drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
    - drm/bridge: tc358767: fix single lane configuration
    - drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
    - drm/bridge: tc358767: reject modes which require too much BW
    - drm/bridge: tc358767: fix output H/V syncs
    - nvme-pci: use the same attributes when freeing host_mem_desc_bufs.
    - ARM: dts: da850-evm: Correct the sound card name
    - ARM: dts: da850-lcdk: Correct the sound card name
    - ARM: dts: kirkwood: Fix polarity of GPIO fan lines
    - gpio: pl061: handle failed allocations
    - drm/nouveau: Don't disable polling in fallback mode
    - drm/nouveau/falcon: avoid touching registers if engine is off
    - cifs: Limit memory used by lock request calls to a page
    - Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
    - Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
    - perf/core: Fix impossible ring-buffer sizes warning
    - perf/x86: Add check_period PMU callback
    - ALSA: hda - Add quirk for HP EliteBook 840 G5
    - ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
    - kvm: vmx: Fix entry number check for add_atomic_switch_msr()
    - Input: bma150 - register input device after setting private data
    - Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
    - mm: proc: smaps_rollup: fix pss_locked calculation
    - alpha: fix page fault handling for r16-r18 targets
    - alpha: Fix Eiger NR_IRQS to 128
    - tracing/uprobes: Fix output for multiple string arguments
    - x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
    - signal: Restore the stop PTRACE_EVENT_EXIT
    - md/raid1: don't clear bitmap bits on interrupted recovery.
    - x86/a.out: Clear the dump structure initially
    - dm crypt: don't overallocate the integrity tag space
    - dm thin: fix bug where bio that overwrites thin block ignores FUA
    - drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
    - perf report: Fix wrong iteration count in --branch-history
    - riscv: fix trace_sys_exit hook
    - ARM: dts: da850-lcdk: Correct the audio codec regulators
    - ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type
    - ASoC: hdmi-codec: fix oops on re-probe
    - riscv: Add pte bit to distinguish swap from invalid
    - mmc: sunxi: Filter out unsupported modes declared in the device tree
    - s390/zcrypt: fix specification exception on z196 during ap probe
    - drm/i915: Block fbdev HPD processing during suspend
    - dsa: mv88e6xxx: Ensure all pending interrupts are handled prior to exit
    - net: fix IPv6 prefix route residue
    - net: ipv4: use a dedicated counter for icmp_v4 redirect packets
    - vsock: cope with memory allocation failure at socket creation time
    - vxlan: test dev->flags & IFF_UP before calling netif_rx()
    - hwmon: (lm80) Fix missing unlock on error in set_fan_div()
    - mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable
    - net: Fix for_each_netdev_feature on Big endian
    - net: phy: xgmiitorgmii: Support generic PHY status read
    - net: stmmac: Fix a race in EEE enable callback
    - net: stmmac: handle endianness in dwmac4_get_timestamp
    - vhost: correctly check the return value of translate_desc() in log_used()
    - net: Add header for usage of fls64()
    - net: Do not allocate page fragments that are not skb aligned
    - tcp: clear icsk_backoff in tcp_write_queue_purge()
    - sunrpc: fix 4 more call sites that were using stack memory with a
      scatterlist
    - net/x25: do not hold the cpu too long in x25_new_lci()
    - mISDN: fix a race in dev_expire_timer()
    - ax25: fix possible use-after-free
    - af_packet: fix raw sockets over 6in4 tunnel
    - tcp: tcp_v4_err() should be more careful
    - mmc: meson-gx: fix interrupt name
    - ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction
    - tracing: Fix number of entries in trace header
    - MIPS: eBPF: Always return sign extended 32b values
    - mac80211: Restore vif beacon interval if start ap fails
    - mac80211: Free mpath object when rhashtable insertion fails
    - libceph: handle an empty authorize reply
    - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
    - numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
    - proc, oom: do not report alien mms when setting oom_score_adj
    - KEYS: allow reaching the keys quotas exactly
    - mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
    - pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
    - mfd: twl-core: Fix section annotations on {,un}protect_pm_master
    - mfd: db8500-prcmu: Fix some section annotations
    - mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
    - mfd: ab8500-core: Return zero in get_register_interruptible()
    - mfd: bd9571mwv: Add volatile register to make DVFS work
    - mfd: qcom_rpm: write fw_version to CTRL_REG
    - mfd: wm5110: Add missing ASRC rate register
    - mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in
      probe()
    - mfd: mc13xxx: Fix a missing check of a register-read failure
    - xen/pvcalls: remove set but not used variable 'intf'
    - qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count
    - qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier
    - net: hns: Fix use after free identified by SLUB debug
    - MIPS: ath79: Enable OF serial ports in the default config
    - netfilter: nf_tables: fix leaking object reference count
    - scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
    - scsi: isci: initialize shost fully before calling scsi_add_host()
    - MIPS: jazz: fix 64bit build
    - bpf: correctly set initial window on active Fast Open sender
    - net: stmmac: Fix PCI module removal leak
    - isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
    - scsi: ufs: Fix system suspend status
    - scsi: qedi: Add ep_state for login completion on un-reachable targets
    - always clear the X2APIC_ENABLE bit for PV guest
    - drm/meson: add missing of_node_put
    - atm: he: fix sign-extension overflow on large shift
    - hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute
      in OF device ID table
    - leds: lp5523: fix a missing check of return value of lp55xx_read
    - bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
    - mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
    - net/mlx5e: Fix wrong (zero) TX drop counter indication for representor
    - isdn: avm: Fix string plus integer warning from Clang
    - batman-adv: fix uninit-value in batadv_interface_tx()
    - ipv6: propagate genlmsg_reply return code
    - net/mlx5e: Don't overwrite pedit action when multiple pedit used
    - net/packet: fix 4gb buffer limit due to overflow check
    - net: sfp: do not probe SFP module before we're attached
    - sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment
    - team: avoid complex list operations in team_nl_cmd_options_set()
    - sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
    - net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
    - inet_diag: fix reporting cgroup classid and fallback to priority
    - RDMA/srp: Rework SCSI device reset handling
    - KEYS: user: Align the payload buffer
    - KEYS: always initialize keyring_index_key::desc_len
    - parisc: Fix ptrace syscall number modification
    - ARCv2: Enable unaligned access in early ASM code
    - ARC: U-boot: check arguments paranoidly
    - ARC: define ARCH_SLAB_MINALIGN = 8
    - net: validate untrusted gso packets without csum offload
    - net: avoid false positives in untrusted gso validation
    - Revert "bridge: do not add port to router list when receives query with
      source 0.0.0.0"
    - netfilter: nf_tables: fix flush after rule deletion in the same batch
    - netfilter: nft_compat: use-after-free when deleting targets
    - netfilter: ipv6: Don't preserve original oif for loopback address
    - pinctrl: max77620: Use define directive for max77620_pinconf_param values
    - phy: tegra: remove redundant self assignment of 'map'
    - net: phylink: avoid resolving link state too early
    - gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2
    - pvcalls-front: read all data before closing the connection
    - pvcalls-front: don't try to free unallocated rings
    - pvcalls-front: properly allocate sk
    - mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove
    - bpf: Fix [::] -> [::1] rewrite in sys_sendmsg
    - watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem
    - net/mlx4: Get rid of page operation after dma_alloc_coherent
    - xprtrdma: Double free in rpcrdma_sendctxs_create()
    - RDMA/mthca: Clear QP objects during their allocation
    - powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool.
    - net: stmmac: Fix the logic of checking if RX Watchdog must be enabled
    - scsi: ufs: Fix geometry descriptor size
    - scsi: cxgb4i: add wait_for_completion()
    - afs: Fix key refcounting in file locking code
    - dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start
    - mlxsw: pci: Return error on PCI reset timeout
    - sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate
    - drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime
    - gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime
    - drm/amd/display: Fix MST reboot/poweroff sequence
    - mac80211: allocate tailroom for forwarded mesh packets
    - netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in
      clusterip_config_entry_put()
    - net: stmmac: Fix reception of Broadcom switches tags
    - drm/msm: Unblock writer if reader closes file
    - ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
    - ALSA: compress: prevent potential divide by zero bugs
    - ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized
    - clk: vc5: Abort clock configuration without upstream clock
    - thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
    - usb: dwc3: gadget: synchronize_irq dwc irq in suspend
    - usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
    - usb: gadget: Potential NULL dereference on allocation error
    - genirq: Make sure the initial affinity is not empty
    - ASoC: dapm: change snprintf to scnprintf for possible overflow
    - ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
    - selftests: seccomp: use LDLIBS instead of LDFLAGS
    - selftests: gpio-mockup-chardev: Check asprintf() for error
    - ARC: fix __ffs return value to avoid build warnings
    - drivers: thermal: int340x_thermal: Fix sysfs race condition
    - staging: rtl8723bs: Fix build error with Clang when inlining is disabled
    - mac80211: fix miscounting of ttl-dropped frames
    - sched/wait: Fix rcuwait_wake_up() ordering
    - futex: Fix (possible) missed wakeup
    - locking/rwsem: Fix (possible) missed wakeup
    - drm/amd/powerplay: OD setting fix on Vega10
    - serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
    - staging: android: ion: Support cpu access during dma_buf_detach
    - direct-io: allow direct writes to empty inodes
    - writeback: synchronize sync(2) against cgroup writeback membership switches
    - scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
    - net: altera_tse: fix connect_local_phy error path
    - hv_netvsc: Fix ethtool change hash key error
    - net: usb: asix: ax88772_bind return error when hw_reset fail
    - net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
    - ibmveth: Do not process frames after calling napi_reschedule
    - mac80211: don't initiate TDLS connection if station is not associated to AP
    - mac80211: Add attribute aligned(2) to struct 'action'
    - cfg80211: extend range deviation for DMG
    - KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting
      to L1
    - mmc: spi: Fix card detection during probe
    - mmc: tmio_mmc_core: don't claim spurious interrupts
    - mmc: tmio: fix access width of Block Count Register
    - mmc: sdhci-esdhc-imx: correct the fix of ERR004536
    - MIPS: fix truncation in __cmpxchg_small for short values
    - MIPS: eBPF: Fix icache flush end address
    - x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
    - irq/matrix: Split out the CPU selection code into a helper
    - irq/matrix: Spread managed interrupts on allocation
    - genirq/matrix: Improve target CPU selection for managed interrupts.
    - clk: tegra: dfll: Fix a potential Oop in remove()
    - selftests/vm/gup_benchmark.c: match gup struct to kernel
    - ARC: show_regs: lockdep: avoid page allocator...
    - sched/wake_q: Fix wakeup ordering for wake_q
    - drm/sun4i: hdmi: Fix usage of TMDS clock
    - scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
    - scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport
    - mmc: core: Fix NULL ptr crash from mmc_should_fail_request
    - drm: Block fb changes for async plane updates
    - hugetlbfs: fix races and page leaks during migration
    - MIPS: BCM63XX: provide DMA masks for ethernet devices
    - cpufreq: Use struct kobj_attribute instead of struct global_attr
    - USB: serial: option: add Telit ME910 ECM composition
    - USB: serial: cp210x: add ID for Ingenico 3070
    - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
    - staging: comedi: ni_660x: fix missing break in switch statement
    - staging: wilc1000: fix to set correct value for 'vif_num'
    - staging: android: ion: fix sys heap pool's gfp_flags
    - ip6mr: Do not call __IP6_INC_STATS() from preemptible context
    - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in
      mv88e6xxx_port_set_duplex
    - net-sysfs: Fix mem leak in netdev_register_kobject
    - team: Free BPF filter when unregistering netdev
    - tipc: fix RDM/DGRAM connect() regression
    - bnxt_en: Drop oversize TX packets to prevent errors.
    - hv_netvsc: Fix IP header checksum for coalesced packets
    - net: dsa: mv88e6xxx: Fix statistics on mv88e6161
    - net: dsa: mv88e6xxx: Fix u64 statistics
    - netlabel: fix out-of-bounds memory accesses
    - net: netem: fix skb length BUG_ON in __skb_to_sgvec
    - net: phy: Micrel KSZ8061: link failure after cable connect
    - net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
    - net: sit: fix memory leak in sit_init_net()
    - tipc: fix race condition causing hung sendto
    - tun: fix blocking read
    - xen-netback: don't populate the hash cache on XenBus disconnect
    - xen-netback: fix occasional leak of grant ref mappings under memory pressure
    - tun: remove unnecessary memory barrier
    - net: Add __icmp_send helper.
    - net: avoid use IPCB in cipso_v4_error
    - ipv4: Return error for RTA_VIA attribute
    - ipv6: Return error for RTA_VIA attribute
    - mpls: Return error for RTA_GATEWAY attribute
    - net/sched: act_ipt: fix refcount leak when replace fails
    - x86/CPU/AMD: Set the CPB bit unconditionally on F17h
    - MIPS: irq: Allocate accurate order pages for irq stack
    - xtensa: fix get_wchan
    - Bluetooth: Fix locking in bt_accept_enqueue() for BH context
    - scsi: core: reset host byte in DID_NEXUS_FAILURE case
    - bpf: fix sanitation rewrite in case of non-pointers
    - vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
    - perf core: Fix perf_proc_update_handler() bug
    - perf tools: Handle TOPOLOGY headers with no CPU
    - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
    - iommu/amd: Call free_iova_fast with pfn in map_sg
    - iommu/amd: Unmap all mapped pages in error path of map_sg
    - ipvs: Fix signed integer overflow when setsockopt timeout
    - iommu/amd: Fix IOMMU page flush when detach device from a domain
    - xtensa: SMP: fix ccount_timer_shutdown
    - selftests: cpu-hotplug: fix case where CPUs offline > CPUs present
    - xtensa: SMP: fix secondary CPU initialization
    - xtensa: smp_lx200_defconfig: fix vectors clash
    - xtensa: SMP: mark each possible CPU as present
    - xtensa: SMP: limit number of possible CPUs by NR_CPUS
    - net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
    - net: hns: Fix for missing of_node_put() after of_parse_phandle()
    - net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
    - net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
    - netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are
      present
    - gpio: vf610: Mask all GPIO interrupts
    - selftests: timers: use LDLIBS instead of LDFLAGS
    - nfs: Fix NULL pointer dereference of dev_name
    - qed: Fix bug in tx promiscuous mode settings
    - qed: Fix LACP pdu drops for VFs
    - qed: Fix VF probe failure while FLR
    - qed: Fix system crash in ll2 xmit
    - qed: Fix stack out of bounds bug
    - scsi: libfc: free skb when receiving invalid flogi resp
    - scsi: 53c700: pass correct "dev" to dma_alloc_attrs()
    - platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
    - cifs: fix computation for MAX_SMB2_HDR_SIZE
    - x86/microcode/amd: Don't falsely trick the late loading mechanism
    - arm64: kprobe: Always blacklist the KVM world-switch code
    - apparmor: Fix aa_label_build() error handling for failed merges
    - x86/kexec: Don't setup EFI info if EFI runtime is not enabled
    - x86_64: increase stack size for KASAN_EXTRA
    - mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
    - mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
    - lib/test_kmod.c: potential double free in error handling
    - fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
    - autofs: drop dentry reference only when it is never used
    - autofs: fix error return in autofs_fill_super()
    - ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags
    - arm64: dts: renesas: r8a7796: Enable DMA for SCIF2
    - soc: fsl: qbman: avoid race in clearing QMan interrupt
    - bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
    - ARM: pxa: ssp: unneeded to free devm_ allocated data
    - arm64: dts: add msm8996 compatible to gicv3
    - DTS: CI20: Fix bugs in ci20's device tree.
    - usb: phy: fix link errors
    - irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
    - net: stmmac: Fallback to Platform Data clock in Watchdog conversion
    - net: stmmac: Send TSO packets always from Queue 0
    - net: stmmac: Disable EEE mode earlier in XMIT callback
    - irqchip/gic-v3-its: Fix ITT_entry_size accessor
    - relay: check return of create_buf_file() properly
    - bpf, selftests: fix handling of sparse CPU allocations
    - bpf: fix lockdep false positive in percpu_freelist
    - drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
    - dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
    - vsock/virtio: fix kernel panic after device hot-unplug
    - vsock/virtio: reset connected sockets on device removal
    - dmaengine: dmatest: Abort test in case of mapping error
    - selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET
    - selftests: netfilter: add simple masq/redirect test cases
    - s390/qeth: fix use-after-free in error path
    - perf symbols: Filter out hidden symbols from labels
    - perf trace: Support multiple "vfs_getname" probes
    - MIPS: Remove function size check in get_frame_info()
    - i2c: omap: Use noirq system sleep pm ops to idle device for suspend
    - fs: ratelimit __find_get_block_slow() failure message.
    - qed: Fix EQ full firmware assert.
    - qed: Consider TX tcs while deriving the max num_queues for PF.
    - Input: wacom_serial4 - add support for Wacom ArtPad II tablet
    - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
    - iscsi_ibft: Fix missing break in switch statement
    - scsi: aacraid: Fix missing break in switch statement
    - arm64: dts: hikey: Give wifi some time after power-on
    - ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
    - ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
    - drm: disable uncached DMA optimization for ARM and arm64
    - ARM: 8781/1: Fix Thumb-2 syscall return for binutils 2.29+
    - gfs2: Fix missed wakeups in find_insert_glock
    - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
    - perf/x86/intel: Make cpuc allocations consistent
    - perf/x86/intel: Generalize dynamic constraint creation
    - x86: Add TSX Force Abort CPUID/MSR
    - perf/x86/intel: Implement support for TSX Force Abort
    - perf script: Fix crash with printing mixed trace point and other events
    - clk: ti: Fix error handling in ti_clk_parse_divider_data()
    - riscv: Adjust mmap base address at a third of task size
    - IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start
    - iomap: fix a use after free in iomap_dio_rw
    - selftests: net: use LDLIBS instead of LDFLAGS
    - scsi: scsi_debug: fix write_same with virtual_gb problem
    - scsi: bnx2fc: Fix error handling in probe()
    - ARM: OMAP: dts: N950/N9: fix onenand timings
    - ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2
    - ARM: dts: imx6sx: correct backward compatible of gpt
    - pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18
    - bpftool: Fix prog dump by tag
    - bpftool: fix percpu maps updating
    - batman-adv: release station info tidstats
    - irqchip/gic-v4: Fix occasional VLPI drop
    - s390/qeth: release cmd buffer in error paths
    - nvme-pci: add missing unlock for reset error
    - x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
    - ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4

  * Bionic update: upstream stable patchset 2019-07-23 (LP: #1837664)
    - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs
    - net: bridge: Fix ethernet header pointer before check skb forwardable
    - net: Fix usage of pskb_trim_rcsum
    - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error
      handling
    - net_sched: refetch skb protocol for each filter
    - openvswitch: Avoid OOB read when parsing flow nlattrs
    - vhost: log dirty page correctly
    - net: ipv4: Fix memory leak in network namespace dismantle
    - tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state
    - mei: me: add denverton innovation engine device IDs
    - USB: serial: simple: add Motorola Tetra TPG2200 device id
    - USB: serial: pl2303: add new PID to support PL2303TB
    - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
    - ASoC: rt5514-spi: Fix potential NULL pointer dereference
    - ARCv2: lib: memeset: fix doing prefetchw outside of buffer
    - ARC: adjust memblock_reserve of kernel memory
    - ARC: perf: map generic branches to correct hardware condition
    - s390/smp: fix CPU hotplug deadlock with CPU rescan
    - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
    - tty: Handle problem if line discipline does not have receive_buf
    - uart: Fix crash in uart_write and uart_put_char
    - tty/n_hdlc: fix __might_sleep warning
    - hv_balloon: avoid touching uninitialized struct page during tail onlining
    - Drivers: hv: vmbus: Check for ring when getting debug info
    - CIFS: Fix possible hang during async MTU reads and writes
    - CIFS: Fix credits calculations for reads with errors
    - CIFS: Fix credit calculation for encrypted reads with errors
    - CIFS: Do not reconnect TCP session in add_credits()
    - Input: xpad - add support for SteelSeries Stratus Duo
    - compiler.h: enable builtin overflow checkers and add fallback code
    - Input: uinput - fix undefined behavior in uinput_validate_absinfo()
    - acpi/nfit: Block function zero DSMs
    - acpi/nfit: Fix command-supported detection
    - dm thin: fix passdown_double_checking_shared_status()
    - dm crypt: fix parsing of extended IV arguments
    - KVM: x86: Fix single-step debugging
    - x86/pkeys: Properly copy pkey state at fork()
    - x86/selftests/pkeys: Fork() to check for state being preserved
    - x86/kaslr: Fix incorrect i8254 outb() parameters
    - posix-cpu-timers: Unbreak timer rearming
    - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
    - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by
      removing it
    - can: bcm: check timer values before ktime conversion
    - vt: invoke notifier on screen size change
    - Revert "seccomp: add a selftest for get_metadata"
    - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
    - nvmet-rdma: Add unlikely for response allocated check
    - nvmet-rdma: fix null dereference under heavy load
    - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
    - x86/xen/time: Output xen sched_clock time from 0
    - xen: Fix x86 sched_clock() interface for xen
    - mlxsw: pci: Increase PCI SW reset timeout
    - mlxsw: spectrum_fid: Update dummy FID index
    - ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode
    - s390/mm: always force a load of the primary ASCE on context switch
    - mmc: meson-gx: Free irq in release() callback
    - vgacon: unconfuse vc_origin when using soft scrollback
    - drm/amdgpu: Add APTX quirk for Lenovo laptop
    - vt: always call notifier with the console lock held
    - drm/meson: Fix atomic mode switching regression
    - bpf: improve verifier branch analysis
    - bpf: add per-insn complexity limit
    - ipv6: Consider sk_bound_dev_if when binding a socket to an address
    - ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation
    - l2tp: copy 4 more bytes to linear part if necessary
    - net/mlx4_core: Add masking for a few queries on HCA caps
    - netrom: switch to sock timer API
    - net/rose: fix NULL ax25_cb kernel panic
    - net: set default network namespace in init_dummy_netdev()
    - net/mlx5e: Allow MAC invalidation while spoofchk is ON
    - Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"
    - virtio_net: Don't enable NAPI when interface is down
    - virtio_net: Don't call free_old_xmit_skbs for xdp_frames
    - virtio_net: Fix not restoring real_num_rx_queues
    - sctp: improve the events for sctp stream adding
    - sctp: improve the events for sctp stream reset
    - l2tp: remove l2specific_len dependency in l2tp_core
    - l2tp: fix reading optional fields of L2TPv3
    - ipvlan, l3mdev: fix broken l3s mode wrt local routes
    - CIFS: Do not count -ENODATA as failure for query directory
    - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
    - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions()
    - NFS: Fix up return value on fatal errors in nfs_page_async_flush()
    - ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
    - arm64: kaslr: ensure randomized quantities are clean also when kaslr is off
    - arm64: hyp-stub: Forbid kprobing of the hyp-stub
    - arm64: hibernate: Clean the __hyp_text to PoC after resume
    - gpio: altera-a10sr: Set proper output level for direction_output
    - gpio: pcf857x: Fix interrupts on multiple instances
    - mmc: bcm2835: Fix DMA channel leak on probe error
    - IB/hfi1: Remove overly conservative VM_EXEC flag check
    - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
    - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
    - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
    - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
    - oom, oom_reaper: do not enqueue same task twice
    - mm, oom: fix use-after-free in oom_kill_process
    - mm: hwpoison: use do_send_sig_info() instead of force_sig()
    - mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
    - md/raid5: fix 'out of memory' during raid cache recovery
    - cifs: Always resolve hostname before reconnecting
    - drivers: core: Remove glue dirs from sysfs earlier
    - fanotify: fix handling of events on child sub-directory
    - drm/msm/gpu: fix building without debugfs
    - ravb: expand rx descriptor data to accommodate hw checksum
    - tun: move the call to tun_set_real_num_queues
    - sctp: set chunk transport correctly when it's a new asoc
    - sctp: set flow sport from saddr only when it's 0
    - virtio_net: Don't process redirected XDP frames when XDP is disabled
    - CIFS: Do not consider -ENODATA as stat failure for reads
    - mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay
    - ALSA: usb-audio: Add Opus #3 to quirks for native DSD support
    - Btrfs: fix deadlock when allocating tree block during leaf/node split
    - mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
    - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages
    - of: Convert to using %pOFn instead of device_node.name
    - of: overlay: add tests to validate kfrees from overlay removal
    - of: overlay: add missing of_node_get() in __of_attach_node_sysfs
    - of: overlay: use prop add changeset entry for property in new nodes
    - ucc_geth: Reset BQL queue when stopping device
    - staging: iio: adc: ad7280a: handle error from __ad7280_read32()
    - drm/vgem: Fix vgem_init to get drm device available.
    - pinctrl: bcm2835: Use raw spinlock for RT compatibility
    - ASoC: Intel: mrfld: fix uninitialized variable access
    - gpu: ipu-v3: image-convert: Prevent race between run and unprepare
    - ath9k: dynack: use authentication messages for 'late' ack
    - scsi: lpfc: Correct LCB RJT handling
    - scsi: mpt3sas: Call sas_remove_host before removing the target devices
    - scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event
    - ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
    - clk: boston: fix possible memory leak in clk_boston_setup()
    - dlm: Don't swamp the CPU with callbacks queued during recovery
    - x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
    - powerpc/pseries: add of_node_put() in dlpar_detach_node()
    - crypto: aes_ti - disable interrupts while accessing S-box
    - drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
    - serial: fsl_lpuart: clear parity enable bit when disable parity
    - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
    - MIPS: Boston: Disable EG20T prefetch
    - staging:iio:ad2s90: Make probe handle spi_setup failure
    - fpga: altera-cvp: Fix registration for CvP incapable devices
    - Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1
    - platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup
    - staging: iio: ad7780: update voltage on read
    - usbnet: smsc95xx: fix rx packet alignment
    - drm/rockchip: fix for mailbox read size
    - ARM: OMAP2+: hwmod: Fix some section annotations
    - net/mlx5: EQ, Use the right place to store/read IRQ affinity hint
    - modpost: validate symbol names also in find_elf_symbol
    - perf tools: Add Hygon Dhyana support
    - soc/tegra: Don't leak device tree node reference
    - media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
    - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
    - dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
    - iio: adc: meson-saradc: check for devm_kasprintf failure
    - iio: adc: meson-saradc: fix internal clock names
    - iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
    - media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
    - ACPI: SPCR: Consider baud rate 0 as preconfigured state
    - staging: pi433: fix potential null dereference
    - f2fs: move dir data flush to write checkpoint process
    - f2fs: fix race between write_checkpoint and write_begin
    - f2fs: fix wrong return value of f2fs_acl_create
    - i2c: sh_mobile: add support for r8a77990 (R-Car E3)
    - arm64: io: Ensure calls to delay routines are ordered against prior readX()
    - sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
    - soc: bcm: brcmstb: Don't leak device tree node reference
    - nfsd4: fix crash on writing v4_end_grace before nfsd startup
    - drm: Clear state->acquire_ctx before leaving
      drm_atomic_helper_commit_duplicated_state()
    - arm64: io: Ensure value passed to __iormb() is held in a 64-bit register
    - Thermal: do not clear passive state during system sleep
    - firmware/efi: Add NULL pointer checks in efivars API functions
    - s390/zcrypt: improve special ap message cmd handling
    - arm64: ftrace: don't adjust the LR value
    - ARM: dts: mmp2: fix TWSI2
    - x86/fpu: Add might_fault() to user_insn()
    - media: DaVinci-VPBE: fix error handling in vpbe_initialize()
    - smack: fix access permissions for keyring
    - usb: dwc3: Correct the logic for checking TRB full in
      __dwc3_prepare_one_trb()
    - usb: hub: delay hub autosuspend if USB3 port is still link training
    - timekeeping: Use proper seqcount initializer
    - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)
    - clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
    - driver core: Move async_synchronize_full call
    - kobject: return error code if writing /sys/.../uevent fails
    - IB/hfi1: Unreserve a reserved request when it is completed
    - usb: dwc3: trace: add missing break statement to make compiler happy
    - pinctrl: sx150x: handle failure case of devm_kstrdup
    - iommu/amd: Fix amd_iommu=force_isolation
    - ARM: dts: Fix OMAP4430 SDP Ethernet startup
    - mips: bpf: fix encoding bug for mm_srlv32_op
    - media: coda: fix H.264 deblocking filter controls
    - ARM: dts: Fix up the D-Link DIR-685 MTD partition info
    - watchdog: renesas_wdt: don't set divider while watchdog is running
    - usb: dwc3: gadget: Disable CSP for stream OUT ep
    - iommu/arm-smmu: Add support for qcom,smmu-v2 variant
    - iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
    - sata_rcar: fix deferred probing
    - clk: imx6sl: ensure MMDC CH0 handshake is bypassed
    - cpuidle: big.LITTLE: fix refcount leak
    - OPP: Use opp_table->regulators to verify no regulator case
    - i2c-axxia: check for error conditions first
    - phy: sun4i-usb: add support for missing USB PHY index
    - udf: Fix BUG on corrupted inode
    - switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite
    - selftests/bpf: use __bpf_constant_htons in test_prog.c
    - ARM: pxa: avoid section mismatch warning
    - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
    - KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines
    - mmc: bcm2835: Recover from MMC_SEND_EXT_CSD
    - mmc: bcm2835: reset host on timeout
    - mmc: sdhci-of-esdhc: Fix timeout checks
    - mmc: sdhci-xenon: Fix timeout checks
    - tty: serial: samsung: Properly set flags in autoCTS mode
    - perf test: Fix perf_event_attr test failure
    - perf header: Fix unchecked usage of strncpy()
    - perf probe: Fix unchecked usage of strncpy()
    - arm64: KVM: Skip MMIO insn after emulation
    - usb: musb: dsps: fix otg state machine
    - percpu: convert spin_lock_irq to spin_lock_irqsave.
    - powerpc/uaccess: fix warning/error with access_ok()
    - mac80211: fix radiotap vendor presence bitmap handling
    - xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
    - mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG
    - scsi: smartpqi: correct host serial num for ssa
    - scsi: smartpqi: correct volume status
    - scsi: smartpqi: increase fw status register read timeout
    - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
    - powerpc/perf: Fix thresholding counter data for unknown type
    - drbd: narrow rcu_read_lock in drbd_sync_handshake
    - drbd: disconnect, if the wrong UUIDs are attached on a connected peer
    - drbd: skip spurious timeout (ping-timeo) when failing promote
    - drbd: Avoid Clang warning about pointless switch statment
    - video: clps711x-fb: release disp device node in probe()
    - fbdev: fbmem: behave better with small rotated displays and many CPUs
    - i40e: define proper net_device::neigh_priv_len
    - ACPI/APEI: Clear GHES block_status before panic()
    - fbdev: fbcon: Fix unregister crash when more than one framebuffer
    - powerpc/mm: Fix reporting of kernel execute faults on the 8xx
    - pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
    - pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
    - KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
    - powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.
    - kvm: Change offset in kvm_write_guest_offset_cached to unsigned
    - NFS: nfs_compare_mount_options always compare auth flavors.
    - hwmon: (lm80) fix a missing check of the status of SMBus read
    - hwmon: (lm80) fix a missing check of bus read in lm80 probe
    - seq_buf: Make seq_buf_puts() null-terminate the buffer
    - crypto: ux500 - Use proper enum in cryp_set_dma_transfer
    - crypto: ux500 - Use proper enum in hash_set_dma_transfer
    - MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
    - cifs: check ntwrk_buf_start for NULL before dereferencing it
    - um: Avoid marking pages with "changed protection"
    - niu: fix missing checks of niu_pci_eeprom_read
    - f2fs: fix sbi->extent_list corruption issue
    - cgroup: fix parsing empty mount option string
    - scripts/decode_stacktrace: only strip base path when a prefix of the path
    - ocfs2: don't clear bh uptodate for block read
    - ocfs2: improve ocfs2 Makefile
    - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in
      HFCPCI_l1hw()
    - gdrom: fix a memory leak bug
    - fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
    - block/swim3: Fix -EBUSY error when re-opening device after unmount
    - thermal: bcm2835: enable hwmon explicitly
    - kdb: Don't back trace on a cpu that didn't round up
    - thermal: generic-adc: Fix adc to temp interpolation
    - HID: lenovo: Add checks to fix of_led_classdev_register
    - kernel/hung_task.c: break RCU locks based on jiffies
    - proc/sysctl: fix return error for proc_doulongvec_minmax()
    - kernel/hung_task.c: force console verbose before panic
    - fs/epoll: drop ovflist branch prediction
    - scripts/gdb: fix lx-version string output
    - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
    - dccp: fool proof ccid_hc_[rt]x_parse_options()
    - enic: fix checksum validation for IPv6
    - net: dp83640: expire old TX-skb
    - rxrpc: bad unlock balance in rxrpc_recvmsg
    - skge: potential memory corruption in skge_get_regs()
    - rds: fix refcount bug in rds_sock_addref
    - net: systemport: Fix WoL with password after deep sleep
    - net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
    - net: dsa: slave: Don't propagate flag changes on down slave interfaces
    - ALSA: compress: Fix stop handling on compressed capture streams
    - ALSA: hda - Serialize codec registrations
    - dmaengine: bcm2835: Fix interrupt race on RT
    - dmaengine: bcm2835: Fix abort of transactions
    - dmaengine: imx-dma: fix wrong callback invoke
    - futex: Handle early deadlock return correctly
    - irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID
    - usb: phy: am335x: fix race condition in _probe
    - usb: dwc3: gadget: Handle 0 xfer length for OUT EP
    - usb: gadget: udc: net2272: Fix bitwise and boolean operations
    - usb: gadget: musb: fix short isoc packets with inventra dma
    - staging: speakup: fix tty-operation NULL derefs
    - scsi: cxlflash: Prevent deadlock when adapter probe fails
    - scsi: aic94xx: fix module loading
    - cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
    - perf/x86/intel/uncore: Add Node ID mask
    - x86/MCE: Initialize mce.bank in the case of a fatal error in
      mce_no_way_out()
    - perf/core: Don't WARN() for impossible ring-buffer sizes
    - perf tests evsel-tp-sched: Fix bitwise operator
    - serial: fix race between flush_to_ldisc and tty_open
    - serial: 8250_pci: Make PCI class test non fatal
    - IB/hfi1: Add limit test for RC/UC send via loopback
    - perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
    - ath9k: dynack: make ewma estimation faster
    - ath9k: dynack: check da->enabled first in sampling routines
    - devres: Align data[] to ARCH_KMALLOC_MINALIGN
    - genirq/affinity: Spread IRQs to all available NUMA nodes
    - wil6210: fix memory leak in wil_find_tx_bcast_2
    - fpga: altera-cvp: fix 'bad IO access' on x86_64
    - drm/amd/display: calculate stream->phy_pix_clk before clock mapping
    - net: aquantia: return 'err' if set MPI_DEINIT state fails
    - perf: arm_spe: handle devm_kasprintf() failure
    - xtensa: xtfpga.dtsi: fix dtc warnings about SPI
    - media: imx274: select REGMAP_I2C
    - drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2)
    - tipc: fix node keep alive interval calculation
    - mmc: meson-mx-sdio: check devm_kasprintf for failure
    - mmc: sdhci-omap: Fix timeout checks
    - mmc: jz4740: Get CD/WP GPIOs from descriptors
    - usb: renesas_usbhs: add support for RZ/G2E
    - i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E)
    - livepatch: check kzalloc return values
    - usb: musb: dsps: fix runtime pm for peripheral mode
    - perf header: Fix up argument to ctime()
    - drm/amd/display: Add retry to read ddc_clock pin
    - Bluetooth: hci_bcm: Handle deferred probing for the clock supply
    - mlx5: update timecounter at least twice per counter overflow
    - drm/amd/display: validate extended dongle caps
    - perf build: Don't unconditionally link the libbfd feature test to -liberty
      and -lz
    - PCI: imx: Enable MSI from downstream components
    - arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition
    - kernel/kcov.c: mark write_comp_data() as notrace
    - xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat
    - xfs: Fix error code in 'xfs_ioc_getbmap()'
    - xfs: fix shared extent data corruption due to missing cow reservation
    - xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers
    - xfs: delalloc -> unwritten COW fork allocation can go wrong
    - fs/xfs: fix f_ffree value for statfs when project quota is set
    - lib/test_rhashtable: Make test_insert_dup() allocate its hash table
      dynamically
    - net: dsa: Fix lockdep false positive splat
    - Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x"
    - ALSA: hda/realtek - Fix lose hp_pins for disable auto mute
    - serial: sh-sci: Do not free irqs that have already been freed
    - mtd: rawnand: gpmi: fix MX28 bus master lockup problem
    - iio: adc: axp288: Fix TS-pin handling
    - iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
    - signal: Always notice exiting tasks
    - signal: Better detection of synchronous signals
    - misc: vexpress: Off by one in vexpress_syscfg_exec()
    - samples: mei: use /dev/mei0 instead of /dev/mei
    - debugfs: fix debugfs_rename parameter checking
    - tracing: uprobes: Fix typo in pr_fmt string
    - mips: cm: reprime error cause
    - MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
    - MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds
    - ARM: iop32x/n2100: fix PCI IRQ mapping
    - ARM: tango: Improve ARCH_MULTIPLATFORM compatibility
    - mac80211: ensure that mgmt tx skbs have tailroom for encryption
    - drm/modes: Prevent division by zero htotal
    - drm/vmwgfx: Fix setting of dma masks
    - drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
    - HID: debug: fix the ring buffer implementation
    - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
    - xfrm: refine validation of template and selector families
    - batman-adv: Avoid WARN on net_device without parent in netns
    - batman-adv: Force mac header to start of data on xmit
    - uio: Reduce return paths from uio_write()
    - uio: Prevent device destruction while fds are open
    - uio: change to use the mutex lock instead of the spin lock
    - uio: fix crash after the device is unregistered
    - uio: fix wrong return value from uio_mmap()
    - uio: fix possible circular locking dependency
    - mtd: Make sure mtd->erasesize is valid even if the partition is of size 0
    - libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD
    - mips: loongson64: remove unreachable(), fix loongson_poweroff().
    - SUNRPC: Always drop the XPRT_LOCK on XPRT_CLOSE_WAIT

  * HP ProBook 470 G5, LED's in Hotkeys f5, f8 and f11 without function
    (LP: #1811254) // Bionic update: upstream stable patchset 2019-07-23
    (LP: #1837664)
    - ALSA: hda - Add mute LED support for HP ProBook 470 G5

  * Bionic update: upstream stable patchset 2019-07-22 (LP: #1837477)
    - pinctrl: meson: fix pull enable register calculation
    - powerpc: Fix COFF zImage booting on old powermacs
    - powerpc/mm: Fix linux page tables build with some configs
    - HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
    - ARM: imx: update the cpu power up timing setting on i.mx6sx
    - ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
    - Input: restore EV_ABS ABS_RESERVED
    - checkstack.pl: fix for aarch64
    - xfrm: Fix error return code in xfrm_output_one()
    - xfrm: Fix bucket count reported to userspace
    - xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears
      the dst_entry.
    - netfilter: seqadj: re-load tcp header pointer after possible head
      reallocation
    - scsi: bnx2fc: Fix NULL dereference in error handling
    - Input: omap-keypad - fix idle configuration to not block SoC idle states
    - Input: synaptics - enable RMI on ThinkPad T560
    - ibmvnic: Fix non-atomic memory allocation in IRQ context
    - ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
    - i40e: fix mac filter delete when setting mac address
    - netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
    - netfilter: nat: can't use dst_hold on noref dst
    - bnx2x: Clear fip MAC when fcoe offload support is disabled
    - bnx2x: Remove configured vlans as part of unload sequence.
    - bnx2x: Send update-svid ramrod with retry/poll flags enabled
    - scsi: target: iscsi: cxgbit: add missing spin_lock_init()
    - x86, hyperv: remove PCI dependency
    - drivers: net: xgene: Remove unnecessary forward declarations
    - w90p910_ether: remove incorrect __init annotation
    - SUNRPC: Fix a race with XPRT_CONNECTING
    - qed: Fix an error code qed_ll2_start_xmit()
    - net: macb: fix random memory corruption on RX with 64-bit DMA
    - net: macb: fix dropped RX frames due to a race
    - lan78xx: Resolve issue with changing MAC address
    - vxge: ensure data0 is initialized in when fetching firmware version
      information
    - mac80211: free skb fraglist before freeing the skb
    - kbuild: fix false positive warning/error about missing libelf
    - virtio: fix test build after uio.h change
    - gpio: mvebu: only fail on missing clk if pwm is actually to be used
    - Input: synaptics - enable SMBus for HP EliteBook 840 G4
    - net: netxen: fix a missing check and an uninitialized use
    - qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
    - serial/sunsu: fix refcount leak
    - scsi: zfcp: fix posting too many status read buffers leading to adapter
      shutdown
    - scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is
      invalid
    - tools: fix cross-compile var clobbering
    - zram: fix double free backing device
    - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
    - mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
    - mm, devm_memremap_pages: kill mapping "System RAM" support
    - mm, hmm: use devm semantics for hmm_devmem_{add, remove}
    - mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
    - mm, swap: fix swapoff with KSM pages
    - sunrpc: fix cache_head leak due to queued request
    - powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer
    - powerpc: Disable -Wbuiltin-requires-header when setjmp is used
    - ftrace: Build with CPPFLAGS to get -Qunused-arguments
    - kbuild: add -no-integrated-as Clang option unconditionally
    - kbuild: consolidate Clang compiler flags
    - Makefile: Export clang toolchain variables
    - powerpc/boot: Set target when cross-compiling for clang
    - raid6/ppc: Fix build for clang
    - ALSA: cs46xx: Potential NULL dereference in probe
    - ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
    - ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
    - dlm: fixed memory leaks after failed ls_remove_names allocation
    - dlm: possible memory leak on error path in create_lkb()
    - dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
    - dlm: memory leaks on error path in dlm_user_request()
    - gfs2: Get rid of potential double-freeing in gfs2_create_inode
    - b43: Fix error in cordic routine
    - selinux: policydb - fix byte order and alignment issues
    - scripts/kallsyms: filter arm64's __efistub_ symbols
    - arm64: drop linker script hack to hide __efistub_ symbols
    - arm64: relocatable: fix inconsistencies in linker script and options
    - powerpc/tm: Set MSR[TS] just prior to recheckpoint
    - 9p/net: put a lower bound on msize
    - rxe: fix error completion wr_id and qp_num
    - iommu/vt-d: Handle domain agaw being less than iommu agaw
    - sched/fair: Fix infinite loop in update_blocked_averages() by reverting
      a9e7f6544b9c
    - ceph: don't update importing cap's mseq when handing cap export
    - genwqe: Fix size check
    - intel_th: msu: Fix an off-by-one in attribute store
    - power: supply: olpc_battery: correct the temperature units
    - lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
    - drm/vc4: Set ->is_yuv to false when num_planes == 1
    - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
    - tools: power/acpi, revert to LD = gcc
    - ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V
    - arm64: dts: mt7622: fix no more console output on rfb1
    - ibmvnic: Convert reset work item mutex to spin lock
    - ixgbe: Fix race when the VF driver does a reset
    - net: macb: add missing barriers when reading descriptors
    - powerpc: remove old GCC version checks
    - Fix failure path in alloc_pid()
    - block: deactivate blk_stat timer in wbt_disable_default()
    - PCI / PM: Allow runtime PM without callback functions
    - leds: pwm: silently error out on EPROBE_DEFER
    - Revert "powerpc/tm: Unset MSR[TS] if not recheckpointing"
    - iio: dac: ad5686: fix bit shift read register
    - video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data"
    - drivers/perf: hisi: Fixup one DDRC PMU register offset
    - drm/nouveau/drm/nouveau: Check rc from drm_dp_mst_topology_mgr_resume()
    - drm/rockchip: psr: do not dereference encoder before it is null checked.
    - CIFS: Fix adjustment of credits for MTU requests
    - CIFS: Do not hide EINTR after sending network packets
    - cifs: Fix potential OOB access of lock element array
    - usb: cdc-acm: send ZLP for Telit 3G Intel based modems
    - USB: storage: don't insert sane sense for SPC3+ when bad sense specified
    - USB: storage: add quirk for SMI SM3350
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
    - slab: alien caches must not be initialized if the allocation of the alien
      cache failed
    - mm: page_mapped: don't assume compound page is huge or THP
    - mm, memcg: fix reclaim deadlock with writeback
    - ACPI: power: Skip duplicate power resource references in _PRx
    - ACPI / PMIC: xpower: Fix TS-pin current-source handling
    - i2c: dev: prevent adapter retries and timeout being set as minus value
    - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
    - rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
    - ext4: make sure enough credits are reserved for dioread_nolock writes
    - ext4: fix a potential fiemap/page fault deadlock w/ inline_data
    - ext4: avoid kernel warning when writing the superblock to a dead device
    - ext4: track writeback errors using the generic tracking infrastructure
    - KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
    - Btrfs: fix deadlock when using free space tree due to block group creation
    - mm/usercopy.c: no check page span for stack objects
    - vfio/type1: Fix unmap overflow off-by-one
    - drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume()
    - ext4: fix special inode number checks in __ext4_iget()
    - Btrfs: fix access to available allocation bits when starting balance
    - Btrfs: use nofs context when initializing security xattrs to avoid deadlock
    - tty/ldsem: Wake up readers after timed out down_write()
    - can: gw: ensure DLC boundaries after CAN frame modification
    - mmc: sdhci-msm: Disable CDR function on TX
    - media: em28xx: Fix misplaced reset of dev->v4l::field_count
    - scsi: target: iscsi: cxgbit: fix csk leak
    - scsi: target: iscsi: cxgbit: fix csk leak
    - arm64/kvm: consistently handle host HCR_EL2 flags
    - arm64: Don't trap host pointer auth use to EL2
    - ipv6: fix kernel-infoleak in ipv6_local_error()
    - net: bridge: fix a bug on using a neighbour cache entry without checking its
      state
    - packet: Do not leak dev refcounts on error exit
    - bonding: update nest level on unlink
    - ip: on queued skb use skb_header_pointer instead of pskb_may_pull
    - crypto: caam - fix zero-length buffer DMA mapping
    - crypto: authencesn - Avoid twice completion call in decrypt path
    - crypto: bcm - convert to use crypto_authenc_extractkeys()
    - btrfs: wait on ordered extents on abort cleanup
    - Yama: Check for pid death before checking ancestry
    - scsi: core: Synchronize request queue PM status only on successful resume
    - scsi: sd: Fix cache_type_store()
    - crypto: talitos - reorder code in talitos_edesc_alloc()
    - crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK
    - mips: fix n32 compat_ipc_parse_version
    - MIPS: lantiq: Fix IPI interrupt handling
    - OF: properties: add missing of_node_put
    - mfd: tps6586x: Handle interrupts on suspend
    - media: v4l: ioctl: Validate num_planes for debug messages
    - pstore/ram: Avoid allocation and leak of platform data
    - arm64: kaslr: ensure randomized quantities are clean to the PoC
    - Disable MSI also when pcie-octeon.pcie_disable on
    - omap2fb: Fix stack memory disclosure
    - media: vivid: fix error handling of kthread_run
    - media: vivid: set min width/height to a value > 0
    - bpf: in __bpf_redirect_no_mac pull mac only if present
    - LSM: Check for NULL cred-security on free
    - media: vb2: vb2_mmap: move lock up
    - sunrpc: handle ENOMEM in rpcb_getport_async
    - netfilter: ebtables: account ebt_table_info to kmemcg
    - selinux: fix GPF on invalid policy
    - blockdev: Fix livelocks on loop device
    - sctp: allocate sctp_sockaddr_entry with kzalloc
    - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats
    - tipc: fix uninit-value in tipc_nl_compat_bearer_enable
    - tipc: fix uninit-value in tipc_nl_compat_link_set
    - tipc: fix uninit-value in tipc_nl_compat_name_table_dump
    - tipc: fix uninit-value in tipc_nl_compat_doit
    - block/loop: Don't grab "struct file" for vfs_getattr() operation.
    - loop: drop caches if offset or block_size are changed
    - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
    - media: vb2: be sure to unlock mutex on errors
    - nbd: Use set_blocksize() to set device blocksize
    - tun: publish tfile after it's fully initialized
    - crypto: sm3 - fix undefined shift by >= width of value
    - MIPS: BCM47XX: Setup struct device for the SoC
    - RDMA/vmw_pvrdma: Return the correct opcode when creating WR
    - arm64: dts: marvell: armada-ap806: reserve PSCI area
    - ipv6: make icmp6_send() robust against null skb->dev
    - block: use rcu_work instead of call_rcu to avoid sleep in softirq
    - selftests: Fix test errors related to lib.mk khdr target
    - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address
    - mlxsw: spectrum: Disable lag port TX before removing it
    - mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion
    - net, skbuff: do not prefer skb allocation fails early
    - qmi_wwan: add MTU default to qmap network interface
    - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
    - net: dsa: mv88x6xxx: mv88e6390 errata
    - gpio: pl061: Move irq_chip definition inside struct pl061
    - platform/x86: asus-wmi: Tell the EC the OS will handle the display off
      hotkey
    - e1000e: allow non-monotonic SYSTIM readings
    - writeback: don't decrement wb->refcnt if !wb->bdi
    - serial: set suppress_bind_attrs flag only if builtin
    - ALSA: oxfw: add support for APOGEE duet FireWire
    - x86/mce: Fix -Wmissing-prototypes warnings
    - MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur
    - arm64: perf: set suppress_bind_attrs flag to true
    - usb: gadget: udc: renesas_usb3: add a safety connection way for
      forced_b_device
    - selinux: always allow mounting submounts
    - rxe: IB_WR_REG_MR does not capture MR's iova field
    - jffs2: Fix use of uninitialized delayed_work, lockdep breakage
    - clk: imx: make mux parent strings const
    - pstore/ram: Do not treat empty buffers as valid
    - powerpc/xmon: Fix invocation inside lock region
    - powerpc/pseries/cpuidle: Fix preempt warning
    - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info
    - media: venus: core: Set dma maximum segment size
    - net: call sk_dst_reset when set SO_DONTROUTE
    - scsi: target: use consistent left-aligned ASCII INQUIRY data
    - selftests: do not macro-expand failed assertion expressions
    - clk: imx6q: reset exclusive gates on init
    - arm64: Fix minor issues with the dcache_by_line_op macro
    - kconfig: fix file name and line number of warn_ignored_character()
    - kconfig: fix memory leak when EOF is encountered in quotation
    - mmc: atmel-mci: do not assume idle after atmci_request_end
    - btrfs: improve error handling of btrfs_add_link
    - tty/serial: do not free trasnmit buffer page under port lock
    - perf intel-pt: Fix error with config term "pt=0"
    - perf svghelper: Fix unchecked usage of strncpy()
    - perf parse-events: Fix unchecked usage of strncpy()
    - netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set
    - dm crypt: use u64 instead of sector_t to store iv_offset
    - dm kcopyd: Fix bug causing workqueue stalls
    - tools lib subcmd: Don't add the kernel sources to the include path
    - dm snapshot: Fix excessive memory usage and workqueue stalls
    - quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls.
    - clocksource/drivers/integrator-ap: Add missing of_node_put()
    - ALSA: bebob: fix model-id of unit for Apogee Ensemble
    - sysfs: Disable lockdep for driver bind/unbind files
    - IB/usnic: Fix potential deadlock
    - scsi: smartpqi: correct lun reset issues
    - scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown()
    - scsi: megaraid: fix out-of-bound array accesses
    - ocfs2: fix panic due to unrecovered local alloc
    - mm/page-writeback.c: don't break integrity writeback on ->writepage() error
    - mm/swap: use nr_node_ids for avail_lists in swap_info_struct
    - mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps
    - cifs: allow disabling insecure dialects in the config
    - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
    - PCI: dwc: Move interrupt acking into the proper callback
    - ipmi:ssif: Fix handling of multi-part return messages
    - net: clear skb->tstamp in bridge forwarding path
    - netfilter: ipset: Allow matching on destination MAC address for mac and
      ipmac sets
    - drm/amdkfd: fix interrupt spin lock
    - of: overlay: add missing of_node_put() after add new node to changeset
    - drm/atomic-helper: Complete fake_commit->flip_done potentially earlier
    - ASoC: pcm3168a: Don't disable pcm3168a when CONFIG_PM defined
    - efi/libstub: Disable some warnings for x86{,_64}
    - media: uvcvideo: Refactor teardown of uvc on USB disconnect
    - arm64: kasan: Increase stack size for KASAN_EXTRA
    - bpf: relax verifier restriction on BPF_MOV | BPF_ALU
    - perf vendor events intel: Fix Load_Miss_Real_Latency on SKL/SKX
    - netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE in netns exit routine
    - netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine
    - x86/topology: Use total_cpus for max logical packages calculation
    - perf stat: Avoid segfaults caused by negated options
    - perf tools: Add missing sigqueue() prototype for systems lacking it
    - perf tools: Add missing open_memstream() prototype for systems lacking it
    - dm: Check for device sector overflow if CONFIG_LBDAF is not set
    - userfaultfd: clear flag if remap event not enabled

  * Bionic update: upstream stable patchset 2019-07-19 (LP: #1837257)
    - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
    - userfaultfd: check VM_MAYWRITE was set after verifying the uffd is
      registered
    - arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing
    - MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
    - mmc: sdhci: fix the timeout check window for clock and reset
    - ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt
    - dm thin: send event about thin-pool state change _after_ making it
    - dm cache metadata: verify cache has blocks in
      blocks_are_clean_separate_dirty()
    - tracing: Fix memory leak in set_trigger_filter()
    - tracing: Fix memory leak of instance function hash filters
    - powerpc/msi: Fix NULL pointer access in teardown code
    - drm/nouveau/kms: Fix memory leak in nv50_mstm_del()
    - drm/i915/execlists: Apply a full mb before execution for Braswell
    - drm/amdgpu: update SMC firmware image for polaris10 variants
    - x86/build: Fix compiler support check for CONFIG_RETPOLINE
    - locking: Remove smp_read_barrier_depends() from queued_spin_lock_slowpath()
    - locking/qspinlock: Ensure node is initialised before updating prev->next
    - locking/qspinlock: Bound spinning on pending->locked transition in slowpath
    - locking/qspinlock: Merge 'struct __qspinlock' into 'struct qspinlock'
    - locking/qspinlock: Remove unbounded cmpxchg() loop from locking slowpath
    - locking/qspinlock: Remove duplicate clear_pending() function from PV code
    - locking/qspinlock: Kill cmpxchg() loop when claiming lock from head of queue
    - locking/qspinlock: Re-order code
    - locking/qspinlock/x86: Increase _Q_PENDING_LOOPS upper bound
    - locking/qspinlock, x86: Provide liveness guarantee
    - mac80211: don't WARN on bad WMM parameters from buggy APs
    - mac80211: Fix condition validating WMM IE
    - IB/hfi1: Remove race conditions in user_sdma send path
    - locking/qspinlock: Fix build for anonymous union in older GCC compilers
    - mac80211_hwsim: fix module init error paths for netlink
    - Input: hyper-v - fix wakeup from suspend-to-idle
    - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
    - scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during
      unload
    - x86/earlyprintk/efi: Fix infinite loop on some screen widths
    - drm/msm: Grab a vblank reference when waiting for commit_done
    - ARC: io.h: Implement reads{x}()/writes{x}()
    - bonding: fix 802.3ad state sent to partner when unbinding slave
    - bpf: Fix verifier log string check for bad alignment.
    - nfs: don't dirty kernel pages read by direct-io
    - SUNRPC: Fix a potential race in xprt_connect()
    - sbus: char: add of_node_put()
    - drivers/sbus/char: add of_node_put()
    - drivers/tty: add missing of_node_put()
    - ide: pmac: add of_node_put()
    - drm/msm: Fix error return checking
    - clk: mvebu: Off by one bugs in cp110_of_clk_get()
    - clk: mmp: Off by one in mmp_clk_add()
    - Input: synaptics - enable SMBus for HP 15-ay000
    - Input: omap-keypad - fix keyboard debounce configuration
    - libata: whitelist all SAMSUNG MZ7KM* solid-state disks
    - mv88e6060: disable hardware level MAC learning
    - net/mlx4_en: Fix build break when CONFIG_INET is off
    - ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address
      handling
    - ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart
    - ethernet: fman: fix wrong of_node_put() in probe function
    - drm/ast: Fix connector leak during driver unload
    - vhost/vsock: fix reset orphans race with close timeout
    - mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl
    - i2c: axxia: properly handle master timeout
    - i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
    - i2c: uniphier: fix violation of tLOW requirement for Fast-mode
    - i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode
    - nvmet-rdma: fix response use after free
    - rtc: snvs: Add timeouts to avoid kernel lockups
    - bpf, arm: fix emit_ldx_r and emit_mov_i using TMP_REG_1
    - scsi: raid_attrs: fix unused variable warning
    - staging: olpc_dcon: add a missing dependency
    - ARM: dts: qcom-apq8064-arrow-sd-600eval fix graph_endpoint warning
    - mmc: core: use mrq->sbc when sending CMD23 for RPMB
    - dm: call blk_queue_split() to impose device limits on bios
    - media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed
    - powerpc: Look for "stdout-path" when setting up legacy consoles
    - dm zoned: Fix target BIO completion handling
    - block: fix infinite loop if the device loses discard capability
    - ASoC: sta32x: set ->component pointer in private struct
    - perf record: Synthesize features before events in pipe mode
    - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
    - xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
    - USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd
    - USB: serial: option: add GosunCn ZTE WeLink ME3630
    - USB: serial: option: add HP lt4132
    - USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
    - USB: serial: option: add Fibocom NL668 series
    - USB: serial: option: add Telit LN940 series
    - scsi: sd: use mempool for discard special page
    - mmc: core: Reset HPI enabled state during re-init and in case of errors
    - mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support
    - mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl
    - mmc: omap_hsmmc: fix DMA API warning
    - gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
    - gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers
    - posix-timers: Fix division by zero bug
    - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs
    - Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
    - x86/mtrr: Don't copy uninitialized gentry fields back to userspace
    - panic: avoid deadlocks in re-entrant console drivers
    - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares
    - iwlwifi: add new cards for 9560, 9462, 9461 and killer series
    - ubifs: Handle re-linking of inodes correctly while recovery
    - mm: don't miss the last page because of round-off error
    - proc/sysctl: don't return ENOMEM on lookup when a table is unregistering
    - i2c: rcar: check bus state before reinitializing
    - drm/amd/display: Fix 6x4K displays light-up on Vega20 (v2)
    - drm/msm: Fix task dump in gpu recovery
    - drm/msm: fix handling of cmdstream offset
    - net: aquantia: fix rx checksum offload bits
    - liquidio: read sc->iq_no before release sc
    - drm/msm/hdmi: Enable HPD after HDMI IRQ is set up
    - macvlan: return correct error value
    - bpf: check pending signals while verifying programs
    - ARM: 8816/1: dma-mapping: fix potential uninitialized return
    - tools/testing/nvdimm: Align test resources to 128M
    - Btrfs: fix missing delayed iputs on unmount
    - ax25: fix a use-after-free in ax25_fillin_cb()
    - gro_cell: add napi_disable in gro_cells_destroy
    - ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
    - ieee802154: lowpan_header_create check must check daddr
    - ipv6: explicitly initialize udp6_addr in udp_sock_create6()
    - ipv6: tunnels: fix two use-after-free
    - isdn: fix kernel-infoleak in capi_unlocked_ioctl
    - net: macb: restart tx after tx used bit read
    - net: phy: Fix the issue that netif always links up after resuming
    - netrom: fix locking in nr_find_socket()
    - net/wan: fix a double free in x25_asy_open_tty()
    - packet: validate address length
    - packet: validate address length if non-zero
    - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
    - qmi_wwan: Added support for Telit LN940 series
    - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
    - tcp: fix a race in inet_diag_dump_icsk()
    - tipc: fix a double kfree_skb()
    - vhost: make sure used idx is seen before log in vhost_add_used_n()
    - VSOCK: Send reset control packet when socket is partially bound
    - xen/netfront: tolerate frags with no data
    - net/mlx5: Typo fix in del_sw_hw_rule
    - net/mlx5e: RX, Fix wrong early return in receive queue poll
    - mlxsw: core: Increase timeout during firmware flash process
    - net/mlx5e: Remove the false indication of software timestamping support
    - tipc: use lock_sock() in tipc_sk_reinit()
    - tipc: compare remote and local protocols in tipc_udp_enable()
    - qmi_wwan: Added support for Fibocom NL668 series
    - qmi_wwan: Add support for Fibocom NL678 series
    - net/smc: fix TCP fallback socket release
    - sock: Make sock->sk_stamp thread-safe
    - IB/hfi1: Incorrect sizing of sge for PIO will OOPs
    - mtd: atmel-quadspi: disallow building on ebsa110
    - ALSA: hda: add mute LED support for HP EliteBook 840 G4
    - ALSA: fireface: fix for state to fetch PCM frames
    - ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
    - ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header'
      tracepoint
    - ALSA: firewire-lib: use the same print format for 'without_header'
      tracepoints
    - ALSA: hda/tegra: clear pending irq handlers
    - USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
    - USB: serial: option: add Fibocom NL678 series
    - usb: r8a66597: Fix a possible concurrency use-after-free bug in
      r8a66597_endpoint_disable()
    - staging: wilc1000: fix missing read_write setting when reading data
    - qmi_wwan: apply SET_DTR quirk to the SIMCOM shared device ID
    - s390/pci: fix sleeping in atomic during hotplug
    - x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
    - KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
    - KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails
    - platform-msi: Free descriptors in platform_msi_domain_free()
    - perf pmu: Suppress potential format-truncation warning
    - ext4: add ext4_sb_bread() to disambiguate ENOMEM cases
    - ext4: fix possible use after free in ext4_quota_enable
    - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
    - ext4: fix EXT4_IOC_GROUP_ADD ioctl
    - ext4: include terminating u32 in size of xattr entries when expanding inodes
    - ext4: force inode writes when nfsd calls commit_metadata()
    - ext4: check for shutdown and r/o file system in ext4_write_inode()
    - spi: bcm2835: Fix race on DMA termination
    - spi: bcm2835: Fix book-keeping of DMA termination
    - spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
    - clk: rockchip: fix typo in rk3188 spdif_frac parent
    - crypto: cavium/nitrox - fix a DMA pool free failure
    - cgroup: fix CSS_TASK_ITER_PROCS
    - cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
    - Btrfs: fix fsync of files with multiple hard links in new directories
    - f2fs: fix validation of the block count in sanity_check_raw_super
    - serial: uartps: Fix interrupt mask issue to handle the RX interrupts
      properly
    - media: vivid: free bitmap_cap when updating std/timings/etc.
    - media: v4l2-tpg: array index could become negative
    - MIPS: math-emu: Write-protect delay slot emulation pages
    - MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3
    - MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
    - MIPS: Align kernel load address to 64KB
    - MIPS: Expand MIPS32 ASIDs to 64 bits
    - MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
    - CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
    - arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
    - arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3
      PPIs/SGIs
    - rtc: m41t80: Correct alarm month range with RTC reads
    - tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
    - spi: bcm2835: Unbreak the build of esoteric configs
    - MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
    - KVM: X86: Fix NULL deref in vcpu_scan_ioapic
    - futex: Cure exit race
    - x86/mm: Fix decoy address handling vs 32-bit builds
    - x86/intel_rdt: Ensure a CPU remains online for the region's pseudo-locking
      sequence
    - mm: add mm_pxd_folded checks to pgtable_bytes accounting functions
    - mm: make the __PAGETABLE_PxD_FOLDED defines non-empty
    - mm: introduce mm_[p4d|pud|pmd]_folded
    - ip: validate header length on virtual device xmit
    - net: clear skb->tstamp in forwarding paths
    - net/hamradio/6pack: use mod_timer() to rearm timers
    - tipc: check tsk->group in tipc_wait_for_cond()
    - tipc: check group dests after tipc_wait_for_cond()
    - ipv6: frags: Fix bogus skb->sk in reassembled packets
    - ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
    - ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
    - ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook
      Clapper
    - ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook
      Gnawty
    - Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
    - arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
    - DRM: UDL: get rid of useless vblank initialization
    - clocksource/drivers/arc_timer: Utilize generic sched_clock
    - ocxl: Fix endiannes bug in ocxl_link_update_pe()
    - ocxl: Fix endiannes bug in read_afu_name()
    - ext4: add verifier check for symlink with append/immutable flags
    - ext4: avoid declaring fs inconsistent due to invalid file handles
    - clk: sunxi-ng: Use u64 for calculation of NM rate
    - crypto: testmgr - add AES-CFB tests
    - btrfs: dev-replace: go back to suspended state if target device is missing
    - btrfs: run delayed items before dropping the snapshot
    - powerpc/tm: Unset MSR[TS] if not recheckpointing
    - f2fs: read page index before freeing
    - f2fs: sanity check of xattr entry size
    - media: cec: keep track of outstanding transmits
    - media: imx274: fix stack corruption in imx274_read_reg
    - media: vb2: check memory model for VIDIOC_CREATE_BUFS
    - MIPS: Fix a R10000_LLSC_WAR logic in atomic.h
    - KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled
    - KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum

  * alsa/hda: neither mute led nor mic-mute led work on several Lenovo laptops
    (LP: #1837963)
    - SAUCE: ALSA: hda - Add a conexant codec entry to let mute led work

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 14 Aug 2019 11:51:40 +0200

linux (4.15.0-58.64) bionic; urgency=medium

  * unable to handle kernel NULL pointer dereference at 000000000000002c (IP:
    iget5_locked+0x9e/0x1f0) (LP: #1838982)
    - Revert "ovl: set I_CREATING on inode being created"
    - Revert "new primitive: discard_new_inode()"

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 06 Aug 2019 12:45:37 +0200

linux (4.15.0-57.63) bionic; urgency=medium

  * CVE-2019-1125
    - x86/cpufeatures: Carve out CQM features retrieval
    - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word
    - x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
    - x86/speculation: Enable Spectre v1 swapgs mitigations
    - x86/entry/64: Use JMP instead of JMPQ
    - x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS

  * Packaging resync (LP: #1786013)
    - update dkms package versions

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 01 Aug 2019 12:25:25 +0200

linux (4.15.0-56.62) bionic; urgency=medium

  * bionic/linux: 4.15.0-56.62 -proposed tracker (LP: #1837626)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] update helper scripts

  * CVE-2019-2101
    - media: uvcvideo: Fix 'type' check leading to overflow

  * hibmc-drm Causes Unreadable Display for Huawei amd64 Servers (LP: #1762940)
    - [Config] Set CONFIG_DRM_HISI_HIBMC to arm64 only
    - SAUCE: Make CONFIG_DRM_HISI_HIBMC depend on ARM64

  * Bionic: support for Solarflare X2542 network adapter (sfc driver)
    (LP: #1836635)
    - sfc: make mem_bar a function rather than a constant
    - sfc: support VI strides other than 8k
    - sfc: add Medford2 (SFC9250) PCI Device IDs
    - sfc: improve PTP error reporting
    - sfc: update EF10 register definitions
    - sfc: populate the timer reload field
    - sfc: update MCDI protocol headers
    - sfc: support variable number of MAC stats
    - sfc: expose FEC stats on Medford2
    - sfc: expose CTPIO stats on NICs that support them
    - sfc: basic MCDI mapping of 25/50/100G link speeds
    - sfc: support the ethtool ksettings API properly so that 25/50/100G works
    - sfc: add bits for 25/50/100G supported/advertised speeds
    - sfc: remove tx and MCDI handling from NAPI budget consideration
    - sfc: handle TX timestamps in the normal data path
    - sfc: add function to determine which TX timestamping method to use
    - sfc: use main datapath for HW timestamps if available
    - sfc: only enable TX timestamping if the adapter is licensed for it
    - sfc: MAC TX timestamp handling on the 8000 series
    - sfc: on 8000 series use TX queues for TX timestamps
    - sfc: only advertise TX timestamping if we have the license for it
    - sfc: simplify RX datapath timestamping
    - sfc: support separate PTP and general timestamping
    - sfc: support second + quarter ns time format for receive datapath
    - sfc: support Medford2 frequency adjustment format
    - sfc: add suffix to large constant in ptp
    - sfc: mark some unexported symbols as static
    - sfc: update MCDI protocol headers
    - sfc: support FEC configuration through ethtool
    - sfc: remove ctpio_dmabuf_start from stats
    - sfc: stop the TX queue before pushing new buffers

  * [18.04 FEAT] zKVM: Add hardware CPU Model - kernel part (LP: #1836153)
    - KVM: s390: add debug logging for cpu model subfunctions
    - KVM: s390: implement subfunction processor calls
    - KVM: s390: add vector enhancements facility 2 to cpumodel
    - KVM: s390: add vector BCD enhancements facility to cpumodel
    - KVM: s390: add MSA9 to cpumodel
    - KVM: s390: provide query function for instructions returning 32 byte
    - KVM: s390: add enhanced sort facilty to cpu model
    - KVM: s390: add deflate conversion facilty to cpu model
    - KVM: s390: enable MSA9 keywrapping functions depending on cpu model

  * Intel ethernet I219 has slow RX speed (LP: #1836152)
    - SAUCE: e1000e: add workaround for possible stalled packet
    - SAUCE: e1000e: disable force K1-off feature

  * Intel ethernet I219 may wrongly detect connection speed as 10Mbps
    (LP: #1836177)
    - SAUCE: e1000e: Make watchdog use delayed work

  * Unhide Nvidia HDA audio controller (LP: #1836308)
    - PCI: Enable NVIDIA HDA controllers

  * selftests: Remove broken Power9 paste tests and fix compilation issue
    (LP: #1836715)
    - selftests/powerpc: Remove Power9 paste tests
    - selftests/powerpc: Fix Makefiles for headers_install change

  * ixgbe{vf} - Physical Function gets IRQ when VF checks link state
    (LP: #1836760)
    - ixgbevf: Use cached link state instead of re-reading the value for ethtool

  * Fix nf_conntrack races when dealing with same origin requests in NAT
    environments (LP: #1836816)
    - netfilter: nf_conntrack: resolve clash for matching conntracks
    - netfilter: nf_nat: skip nat clash resolution for same-origin entries

  * CVE-2018-5383
    - crypto: ecdh - add public key verification test

  * sched: Prevent CPU lockups when task groups take longer than the period
    (LP: #1836971)
    - sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup

  * depmod may prefer unsigned l-r-m nvidia modules to signed modules
    (LP: #1834479)
    - [Packaging] dkms-build--nvidia-N -- clean up unsigned ko files
    - [Packaging] Add update-version-dkms
    - update dkms package versions

  * Build Nvidia drivers in conjunction with kernel (LP: #1764792) // zfs/spl
    build in conjunction with the kernel from DKMS source (LP: #1807378)
    - [Packaging] dkms-build--nvidia-* -- convert to generic -N form

  * zfs/spl build in conjunction with the kernel from DKMS source (LP: #1807378)
    - [Packaging] dkms -- dkms package build packaging support
    - [Packaging] dkms -- build zfs/spl packages
    - [Packaging] dkms -- drop zfs/spl source code from kernel

  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
    - [Packaging] dkms -- introduce dkms package versions
    - [Packaging] dkms -- add per package post-process step
    - [Packaging] dkms -- switch to a consistent build prefix length and strip
    - [Packaging] dkms-build -- support building against packages in PPAs
    - [Packaging] dkms-build: do not redownload files on subsequent passes
    - [Packaging] dkms-build -- add support for unversioned overrides
    - [Packaging] dkms-build -- backport latest version from disco
    - [Packaging] nvidia -- build and sign nvidia packages and ship signatures
    - [Packaging] nvidia -- make nvidia package version explicit

  * CVE-2019-13233
    - x86/insn-eval: Fix use-after-free access to LDT entry

  * kernel panic using CIFS share in smb2_push_mandatory_locks() (LP: #1795659)
    - CIFS: keep FileInfo handle live during oplock break

  * cifs set_oplock buffer overflow in strcat (LP: #1824981)
    - cifs: fix strcat buffer overflow and reduce raciness in
      smb21_set_oplock_level()

  * CVE-2019-13272
    - ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME

  * Bionic update: upstream stable patchset 2019-07-18 (LP: #1837161)
    - Kbuild: suppress packed-not-aligned warning for default setting only
    - disable stringop truncation warnings for now
    - test_hexdump: use memcpy instead of strncpy
    - kobject: Replace strncpy with memcpy
    - ALSA: intel_hdmi: Use strlcpy() instead of strncpy()
    - unifdef: use memcpy instead of strncpy
    - kernfs: Replace strncpy with memcpy
    - ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
    - scsi: bfa: convert to strlcpy/strlcat
    - kdb: use memmove instead of overlapping memcpy
    - iser: set sector for ambiguous mr status errors
    - uprobes: Fix handle_swbp() vs. unregister() + register() race once more
    - MIPS: ralink: Fix mt7620 nd_sd pinmux
    - mips: fix mips_get_syscall_arg o32 check
    - IB/mlx5: Avoid load failure due to unknown link width
    - drm/ast: Fix incorrect free on ioregs
    - drm: set is_master to 0 upon drm_new_set_master() failure
    - drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config
    - drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()
    - ALSA: trident: Suppress gcc string warning
    - kgdboc: Fix restrict error
    - kgdboc: Fix warning with module build
    - svm: Add mutex_lock to protect apic_access_page_done on AMD systems
    - drm/msm: fix OF child-node lookup
    - Input: xpad - quirk all PDP Xbox One gamepads
    - Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
    - Input: matrix_keypad - check for errors from of_get_named_gpio()
    - Input: cros_ec_keyb - fix button/switch capability reports
    - Input: elan_i2c - add ELAN0620 to the ACPI table
    - Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
    - Input: elan_i2c - add support for ELAN0621 touchpad
    - btrfs: tree-checker: Don't check max block group size as current max chunk
      size limit is unreliable
    - ARC: change defconfig defaults to ARCv2
    - arc: [devboards] Add support of NFSv3 ACL
    - reset: make device_reset_optional() really optional
    - reset: remove remaining WARN_ON() in <linux/reset.h>
    - mm: hide incomplete nr_indirectly_reclaimable in /proc/zoneinfo
    - net: qed: use correct strncpy() size
    - tipc: use destination length for copy string
    - arm64: ftrace: Fix to enable syscall events on arm64
    - sched, trace: Fix prev_state output in sched_switch tracepoint
    - tracing/fgraph: Fix set_graph_function from showing interrupts
    - drm/meson: Fixes for drm_crtc_vblank_on/off support
    - scsi: lpfc: fix block guard enablement on SLI3 adapters
    - media: omap3isp: Unregister media device as first
    - iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
    - brcmutil: really fix decoding channel info for 160 MHz bandwidth
    - iommu/ipmmu-vmsa: Fix crash on early domain free
    - can: rcar_can: Fix erroneous registration
    - test_firmware: fix error return getting clobbered
    - HID: input: Ignore battery reported by Symbol DS4308
    - batman-adv: Use explicit tvlv padding for ELP packets
    - batman-adv: Expand merged fragment buffer for full packet
    - amd/iommu: Fix Guest Virtual APIC Log Tail Address Register
    - bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
    - qed: Fix PTT leak in qed_drain()
    - qed: Fix reading wrong value in loop condition
    - net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
    - net/mlx4_core: Fix uninitialized variable compilation warning
    - net/mlx4: Fix UBSAN warning of signed integer overflow
    - gpio: mockup: fix indicated direction
    - mtd: rawnand: qcom: Namespace prefix some commands
    - mtd: spi-nor: Fix Cadence QSPI page fault kernel panic
    - qed: Fix bitmap_weight() check
    - qed: Fix QM getters to always return a valid pq
    - net: faraday: ftmac100: remove netif_running(netdev) check before disabling
      interrupts
    - iommu/vt-d: Use memunmap to free memremap
    - flexfiles: use per-mirror specified stateid for IO
    - ibmvnic: Fix RX queue buffer cleanup
    - team: no need to do team_notify_peers or team_mcast_rejoin when disabling
      port
    - net: amd: add missing of_node_put()
    - usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
    - usb: appledisplay: Add 27" Apple Cinema Display
    - USB: check usb_get_extra_descriptor for proper size
    - ALSA: hda: Add support for AMD Stoney Ridge
    - ALSA: pcm: Fix starvation on down_write_nonblock()
    - ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
    - ALSA: pcm: Fix interval evaluation with openmin/max
    - ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570
    - SUNRPC: Fix leak of krb5p encode pages
    - dmaengine: dw: Fix FIFO size for Intel Merrifield
    - dmaengine: cppi41: delete channel from pending list when stop channel
    - ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE
    - xhci: Prevent U1/U2 link pm states if exit latency is too long
    - f2fs: fix to do sanity check with block address in main area v2
    - swiotlb: clean up reporting
    - Staging: lustre: remove two build warnings
    - staging: atomisp: remove "fun" strncpy warning
    - cifs: Fix separator when building path from dentry
    - staging: rtl8712: Fix possible buffer overrun
    - Revert commit ef9209b642f "staging: rtl8723bs: Fix indenting errors and an
      off-by-one mistake in core/rtw_mlme_ext.c"
    - drm/amdgpu: update mc firmware image for polaris12 variants
    - drm/amdgpu/gmc8: update MC firmware for polaris
    - tty: serial: 8250_mtk: always resume the device in probe.
    - kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
    - libnvdimm, pfn: Pad pfn namespaces relative to other regions
    - mac80211: Clear beacon_int in ieee80211_do_stop
    - mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
    - mac80211: fix reordering of buffered broadcast packets
    - mac80211: ignore NullFunc frames in the duplicate detection
    - qed: Fix rdma_info structure allocation
    - drm/amdgpu: Add amdgpu "max bpc" connector property (v2)
    - drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo
    - gpio: pxa: fix legacy non pinctrl aware builds again
    - tc-testing: tdc.py: ignore errors when decoding stdout/stderr
    - NFSv4: Fix a NFSv4 state manager deadlock
    - USB: serial: console: fix reported terminal settings
    - ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support
    - ALSA: hda/realtek: ALC286 mic and headset-mode fixups for Acer Aspire
      U27-880
    - ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic
    - ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G
    - ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G
    - media: dvb-pll: don't re-validate tuner frequencies
    - parisc: Enable -ffunction-sections for modules on 32-bit kernel
    - Revert "x86/e820: put !E820_TYPE_RAM regions into memblock.reserved"
    - drm/lease: Send a distinct uevent
    - drm/msm: Move fence put to where failure occurs
    - drm/amdgpu/gmc8: always load MC firmware in the driver
    - drm/i915: Downgrade Gen9 Plane WM latency error
    - x86/efi: Allocate e820 buffer before calling efi_exit_boot_service
    - cfg80211: Fix busy loop regression in ieee80211_ie_split_ric()
    - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes
    - ipv6: Check available headroom in ip6_xmit() even without options
    - neighbour: Avoid writing before skb->head in neigh_hh_output()
    - ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output
    - net: 8139cp: fix a BUG triggered by changing mtu with network traffic
    - net/mlx4_core: Correctly set PFC param if global pause is turned off.
    - net/mlx4_en: Change min MTU size to ETH_MIN_MTU
    - net: phy: don't allow __set_phy_supported to add unsupported modes
    - net: Prevent invalid access to skb->prev in __qdisc_drop_all
    - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
    - sctp: kfree_rcu asoc
    - tcp: Do not underestimate rwnd_limited
    - tcp: fix NULL ref in tail loss probe
    - tun: forbid iface creation with rtnl ops
    - virtio-net: keep vnet header zeroed after processing XDP
    - ARM: OMAP2+: prm44xx: Fix section annotation on
      omap44xx_prm_enable_io_wakeup
    - ASoC: rsnd: fixup clock start checker
    - staging: rtl8723bs: Fix the return value in case of error in
      'rtw_wx_read32()'
    - ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1
    - ARM: OMAP1: ams-delta: Fix possible use of uninitialized field
    - sysv: return 'err' instead of 0 in __sysv_write_inode
    - selftests: add script to stress-test nft packet path vs. control plane
    - netfilter: nf_tables: fix use-after-free when deleting compat expressions
    - hwmon (ina2xx) Fix NULL id pointer in probe()
    - ASoC: wm_adsp: Fix dma-unsafe read of scratch registers
    - s390/cpum_cf: Reject request for sampling in event initialization
    - hwmon: (ina2xx) Fix current value calculation
    - ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing
    - ASoC: dapm: Recalculate audio map forcely when card instantiated
    - netfilter: xt_hashlimit: fix a possible memory leak in htable_create()
    - hwmon: (w83795) temp4_type has writable permission
    - perf tools: Restore proper cwd on return from mnt namespace
    - PCI: imx6: Fix link training status detection in link up check
    - objtool: Fix double-free in .cold detection error path
    - objtool: Fix segfault in .cold detection with -ffunction-sections
    - ARM: dts: at91: sama5d2: use the divided clock for SMC
    - Btrfs: send, fix infinite loop due to directory rename dependencies
    - RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR
    - RDMA/rdmavt: Fix rvt_create_ah function signature
    - ASoC: omap-mcbsp: Fix latency value calculation for pm_qos
    - ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
    - ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
    - exportfs: do not read dentry after free
    - bpf: fix check of allowed specifiers in bpf_trace_printk
    - ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf
    - USB: omap_udc: use devm_request_irq()
    - USB: omap_udc: fix crashes on probe error and module removal
    - USB: omap_udc: fix omap_udc_start() on 15xx machines
    - USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
    - USB: omap_udc: fix rejection of out transfers when DMA is used
    - drm/meson: add support for 1080p25 mode
    - netfilter: ipv6: Preserve link scope traffic original oif
    - IB/mlx5: Fix page fault handling for MW
    - KVM: x86: fix empty-body warnings
    - x86/kvm/vmx: fix old-style function declaration
    - net: thunderx: fix NULL pointer dereference in nic_remove
    - usb: gadget: u_ether: fix unsafe list iteration
    - netfilter: nf_tables: deactivate expressions in rule replecement routine
    - igb: fix uninitialized variables
    - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps
    - net: hisilicon: remove unexpected free_netdev
    - drm/amdgpu: Add delay after enable RLC ucode
    - drm/ast: fixed reading monitor EDID not stable issue
    - xen: xlate_mmu: add missing header to fix 'W=1' warning
    - Revert "xen/balloon: Mark unallocated host memory as UNUSABLE"
    - pstore/ram: Correctly calculate usable PRZ bytes
    - fscache, cachefiles: remove redundant variable 'cache'
    - nvme: flush namespace scanning work just before removing namespaces
    - ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value
    - ocfs2: fix deadlock caused by ocfs2_defrag_extent()
    - mm/page_alloc.c: fix calculation of pgdat->nr_zones
    - hfs: do not free node before using
    - hfsplus: do not free node before using
    - debugobjects: avoid recursive calls with kmemleak
    - ocfs2: fix potential use after free
    - printk: Add console owner and waiter logic to load balance console writes
    - printk: Hide console waiter logic into helpers
    - printk: Never set console_may_schedule in console_trylock()
    - printk: Wake klogd when passing console_lock owner
    - flexfiles: enforce per-mirror stateid only for v4 DSes
    - staging: speakup: Replace strncpy with memcpy
    - ALSA: fireface: fix reference to wrong register for clock configuration
    - IB/hfi1: Fix an out-of-bounds access in get_hw_stats
    - tcp: lack of available data can also cause TSO defer
    - Revert "net/ibm/emac: wrong bit is used for STA control"
    - tools: bpftool: prevent infinite loop in get_fdinfo()
    - ASoC: sun8i-codec: fix crash on module removal
    - ASoC: acpi: fix: continue searching when machine is ignored
    - RDMA/bnxt_re: Fix system hang when registration with L2 driver fails
    - RDMA/bnxt_re: Avoid accessing the device structure after it is freed
    - RDMA/hns: Bugfix pbl configuration for rereg mr
    - thunderbolt: Prevent root port runtime suspend during NVM upgrade
    - netfilter: add missing error handling code for register functions
    - netfilter: nat: fix double register in masquerade modules
    - cachefiles: Fix an assertion failure when trying to update a failed object
    - fscache: Fix race in fscache_op_complete() due to split atomic_sub & read
    - pvcalls-front: fixes incorrect error handling
    - nvme: warn when finding multi-port subsystems without multipathing enabled
    - kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace
    - ALSA: hda/realtek: ALC294 mic and headset-mode fixups for ASUS X542UN
    - ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294
    - ALSA: hda/realtek: Enable audio jacks of ASUS UX433FN/UX333FA with ALC294

  * Bionic update: upstream stable patchset 2019-07-17 (LP: #1836968)
    - flow_dissector: do not dissect l4 ports for fragments
    - ibmvnic: fix accelerated VLAN handling
    - ip_tunnel: don't force DF when MTU is locked
    - ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
    - net-gro: reset skb->pkt_type in napi_reuse_skb()
    - sctp: not allow to set asoc prsctp_enable by sockopt
    - tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
    - tuntap: fix multiqueue rx
    - net: systemport: Protect stop from timeout
    - net: qualcomm: rmnet: Fix incorrect assignment of real_dev
    - net: dsa: microchip: initialize mutex before use
    - sctp: fix strchange_flags name for Stream Change Event
    - net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
    - sctp: not increase stream's incnt before sending addstrm_in request
    - mlxsw: spectrum: Fix IP2ME CPU policer configuration
    - net: smsc95xx: Fix MTU range
    - usbnet: smsc95xx: disable carrier check while suspending
    - inet: frags: better deal with smp races
    - ARM: dts: r8a7791: Correct critical CPU temperature
    - ARM: dts: r8a7793: Correct critical CPU temperature
    - net: bcmgenet: protect stop from timeout
    - tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP
      coalescing
    - tipc: don't assume linear buffer when reading ancillary data
    - tipc: fix link re-establish failure
    - net/mlx5e: Claim TC hw offloads support only under a proper build config
    - net/mlx5e: Adjust to max number of channles when re-attaching
    - net/mlx5e: Fix selftest for small MTUs
    - l2tp: fix a sock refcnt leak in l2tp_tunnel_register
    - net/mlx5e: IPoIB, Reset QP after channels are closed
    - net: dsa: mv88e6xxx: Fix clearing of stats counters
    - net: phy: realtek: fix RTL8201F sysfs name
    - sctp: define SCTP_SS_DEFAULT for Stream schedulers
    - rxrpc: Fix lockup due to no error backoff after ack transmit error
    - cifs: don't dereference smb_file_target before null check
    - cifs: fix return value for cifs_listxattr
    - arm64: kprobe: make page to RO mode when allocate it
    - ixgbe: fix MAC anti-spoofing filter after VFLR
    - reiserfs: propagate errors from fill_with_dentries() properly
    - hfs: prevent btree data loss on root split
    - hfsplus: prevent btree data loss on root split
    - um: Give start_idle_thread() a return code
    - drm/edid: Add 6 bpc quirk for BOE panel.
    - platform/x86: intel_telemetry: report debugfs failure
    - clk: fixed-rate: fix of_node_get-put imbalance
    - perf symbols: Set PLT entry/header sizes properly on Sparc
    - fs/exofs: fix potential memory leak in mount option parsing
    - clk: samsung: exynos5420: Enable PERIS clocks for suspend
    - apparmor: Fix uninitialized value in aa_split_fqname
    - x86/earlyprintk: Add a force option for pciserial device
    - platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
    - arm64: percpu: Initialize ret in the default case
    - s390/vdso: add missing FORCE to build targets
    - netfilter: ipset: list:set: Decrease refcount synchronously on deletion and
      replace
    - netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
    - s390/mm: Fix ERROR: "__node_distance" undefined!
    - netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
    - netfilter: xt_IDLETIMER: add sysfs filename checking routine
    - s390/qeth: fix HiperSockets sniffer
    - hwmon: (ibmpowernv) Remove bogus __init annotations
    - Revert "drm/exynos/decon5433: implement frame counter"
    - clk: fixed-factor: fix of_node_get-put imbalance
    - lib/raid6: Fix arm64 test build
    - s390/perf: Change CPUM_CF return code in event init function
    - sched/core: Take the hotplug lock in sched_init_smp()
    - i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
    - qed: Fix memory/entry leak in qed_init_sp_request()
    - qed: Fix blocking/unlimited SPQ entries leak
    - qed: Fix potential memory corruption
    - net: stmmac: Fix RX packet size > 8191
    - SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
    - ACPI / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM
    - perf machine: Add machine__is() to identify machine arch
    - perf tools: Fix kernel_start for PTI on x86
    - perf machine: Add nr_cpus_avail()
    - perf machine: Workaround missing maps for x86 PTI entry trampolines
    - perf test code-reading: Fix perf_env setup for PTI entry trampolines
    - media: v4l: event: Add subscription to list before calling "add" operation
    - MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver
    - uio: Fix an Oops on load
    - usb: cdc-acm: add entry for Hiro (Conexant) modem
    - usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
    - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
    - USB: misc: appledisplay: add 20" Apple Cinema Display
    - ACPI / platform: Add SMB0001 HID to forbidden_id_list
    - HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
    - libceph: fall back to sendmsg for slab pages
    - drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE
    - perf unwind: Take pgoff into account when reporting elf to libdwfl
    - netfilter: bridge: define INT_MIN & INT_MAX in userspace
    - s390/decompressor: add missing FORCE to build targets
    - Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
    - HID: alps: allow incoming reports when only the trackstick is opened
    - s390/mm: fix mis-accounting of pgtable_bytes
    - drm/amd/display: Stop leaking planes
    - drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
    - ceph: quota: fix null pointer dereference in quota check
    - nvme: make sure ns head inherits underlying device limits
    - i2c: omap: Enable for ARCH_K3
    - net: aquantia: fix potential IOMMU fault after driver unbind
    - net: aquantia: fixed enable unicast on 32 macvlan
    - net: aquantia: invalid checksumm offload implementation
    - mtd: rawnand: atmel: fix OF child-node lookup
    - efi/libstub: arm: support building with clang
    - ARM: 8766/1: drop no-thumb-interwork in EABI mode
    - ARM: 8767/1: add support for building ARM kernel with clang
    - bus: arm-cci: remove unnecessary unreachable()
    - ARM: trusted_foundations: do not use naked function
    - usb: core: Fix hub port connection events lost
    - usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
    - usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
    - usb: dwc3: core: Clean up ULPI device
    - xhci: Add check for invalid byte size error when UAS devices are connected.
    - ALSA: oss: Use kvzalloc() for local buffer allocations
    - MAINTAINERS: Add Sasha as a stable branch maintainer
    - mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
    - gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
    - iwlwifi: mvm: support sta_statistics() even on older firmware
    - iwlwifi: mvm: fix regulatory domain update when the firmware starts
    - iwlwifi: mvm: don't use SAR Geo if basic SAR is not used
    - brcmfmac: fix reporting support for 160 MHz channels
    - tools/power/cpupower: fix compilation with STATIC=true
    - v9fs_dir_readdir: fix double-free on p9stat_read error
    - selinux: Add __GFP_NOWARN to allocation at str_read()
    - Input: synaptics - avoid using uninitialized variable when probing
    - bfs: add sanity check at bfs_fill_super()
    - sctp: clear the transport of some out_chunk_list chunks in
      sctp_assoc_rm_peer
    - gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
    - llc: do not use sk_eat_skb()
    - mm: don't warn about large allocations for slab
    - mm/memory.c: recheck page table entry with page table lock held
    - IB/core: Perform modify QP on real one
    - usb: xhci: Prevent bus suspend if a port connect change or polling state is
      detected
    - drm/ast: change resolution may cause screen blurred
    - drm/ast: fixed cursor may disappear sometimes
    - can: dev: can_get_echo_skb(): factor out non sending code to
      __can_get_echo_skb()
    - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to
      access frame length
    - can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb
      is accessed out of bounds
    - can: dev: __can_get_echo_skb(): print error message, if trying to echo non
      existing skb
    - can: rx-offload: introduce can_rx_offload_get_echo_skb() and
      can_rx_offload_queue_sorted() functions
    - can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to
      can_rx_offload_queue_tail()
    - can: raw: check for CAN FD capable netdev in raw_sendmsg()
    - can: hi311x: Use level-triggered interrupt
    - IB/hfi1: Eliminate races in the SDMA send error path
    - pinctrl: meson: fix pinconf bias disable
    - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
    - cpufreq: imx6q: add return value check for voltage scale
    - rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
    - crypto: simd - correctly take reqsize of wrapped skcipher into account
    - floppy: fix race condition in __floppy_read_block_0()
    - powerpc/io: Fix the IO workarounds code to work with Radix
    - perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
    - SUNRPC: Fix a bogus get/put in generic_key_to_expire()
    - kdb: Use strscpy with destination buffer size
    - powerpc/numa: Suppress "VPHN is not supported" messages
    - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
    - mm, page_alloc: check for max order in hot path
    - arm64: remove no-op -p linker flag
    - ubi: fastmap: Check each mapping only once
    - Input: xpad - add PDP device id 0x02a4
    - Input: xpad - fix some coding style issues
    - Input: xpad - avoid using __set_bit() for capabilities
    - Input: xpad - add support for Xbox1 PDP Camo series gamepad
    - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
    - kbuild: allow to use GCC toolchain not in Clang search path
    - PCI: endpoint: Populate func_no before calling pci_epc_add_epf()
    - i40iw: Fix memory leak in error path of create QP
    - clk: samsung: exynos5250: Add missing clocks for FIMC LITE SYSMMU devices
    - ARM: dts: exynos: Fix invalid node referenced by i2c20 alias in Peach Pit
      and Pi
    - include/linux/pfn_t.h: force '~' to be parsed as an unary operator
    - tty: wipe buffer.
    - tty: wipe buffer if not echoing data
    - lan78xx: Read MAC address from DT if present
    - s390/mm: Check for valid vma before zapping in gmap_discard
    - rcu: Make need_resched() respond to urgent RCU-QS needs
    - net: ieee802154: 6lowpan: fix frag reassembly
    - EVM: Add support for portable signature format
    - ima: re-introduce own integrity cache lock
    - ima: re-initialize iint->atomic_flags
    - xhci: Fix leaking USB3 shared_hcd at xhci removal
    - Documentation/security-bugs: Clarify treatment of embargoed information
    - Documentation/security-bugs: Postpone fix publication in exceptional cases
    - ACPICA: AML interpreter: add region addresses in global list during
      initialization
    - fsnotify: generalize handling of extra event flags
    - pinctrl: meson: fix gxbb ao pull register bits
    - pinctrl: meson: fix gxl ao pull register bits
    - pinctrl: meson: fix meson8 ao pull register bits
    - pinctrl: meson: fix meson8b ao pull register bits
    - riscv: add missing vdso_install target
    - media: ov5640: fix wrong binning value in exposure calculation
    - media: ov5640: fix auto controls values when switching to manual mode
    - mm/huge_memory: rename freeze_page() to unmap_page()
    - mm/huge_memory.c: reorder operations in __split_huge_page_tail()
    - mm/huge_memory: splitting set mapping+index before unfreeze
    - mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
    - mm/khugepaged: collapse_shmem() stop if punched or truncated
    - mm/khugepaged: fix crashes due to misaccounted holes
    - mm/khugepaged: collapse_shmem() remember to clear holes
    - mm/khugepaged: minor reorderings in collapse_shmem()
    - mm/khugepaged: collapse_shmem() without freezing new_page
    - mm/khugepaged: collapse_shmem() do not crash on Compound
    - media: em28xx: Fix use-after-free when disconnecting
    - ubi: Initialize Fastmap checkmapping correctly
    - libceph: store ceph_auth_handshake pointer in ceph_connection
    - libceph: factor out __prepare_write_connect()
    - libceph: factor out __ceph_x_decrypt()
    - libceph: factor out encrypt_authorizer()
    - libceph: add authorizer challenge
    - libceph: implement CEPHX_V2 calculation mode
    - net/tls: Fixed return value when tls_complete_pending_work() fails
    - wil6210: missing length check in wmi_set_ie
    - btrfs: validate type when reading a chunk
    - btrfs: Verify that every chunk has corresponding block group at mount time
    - btrfs: tree-checker: Add checker for dir item
    - btrfs: tree-checker: use %zu format string for size_t
    - btrfs: tree-check: reduce stack consumption in check_dir_item
    - btrfs: tree-checker: Verify block_group_item
    - btrfs: tree-checker: Detect invalid and empty essential trees
    - btrfs: Check that each block group has corresponding chunk at mount time
    - btrfs: tree-checker: Check level for leaves and nodes
    - btrfs: tree-checker: Fix misleading group system information
    - f2fs: check blkaddr more accuratly before issue a bio
    - f2fs: enhance sanity_check_raw_super() to avoid potential overflow
    - f2fs: clean up with is_valid_blkaddr()
    - f2fs: introduce and spread verify_blkaddr
    - f2fs: fix to do sanity check with secs_per_zone
    - f2fs: fix to do sanity check with user_block_count
    - f2fs: fix to do sanity check with node footer and iblocks
    - f2fs: fix to do sanity check with block address in main area
    - f2fs: fix to do sanity check with i_extra_isize
    - f2fs: fix to do sanity check with cp_pack_start_sum
    - net: skb_scrub_packet(): Scrub offload_fwd_mark
    - net: thunderx: set xdp_prog to NULL if bpf_prog_add fails
    - virtio-net: disable guest csum during XDP set
    - virtio-net: fail XDP set if guest csum is negotiated
    - net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue
    - packet: copy user buffers before orphan or clone
    - rapidio/rionet: do not free skb before reading its length
    - usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
    - kvm: mmu: Fix race in emulated page table writes
    - KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
    - xtensa: enable coprocessors that are being flushed
    - xtensa: fix coprocessor context offset definitions
    - xtensa: fix coprocessor part of ptrace_{get,set}xregs
    - Btrfs: ensure path name is null terminated at btrfs_control_ioctl
    - btrfs: relocation: set trans to be NULL after ending transaction
    - PCI: layerscape: Fix wrong invocation of outbound window disable accessor
    - arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou.
    - x86/fpu: Disable bottom halves while loading FPU registers
    - perf/x86/intel: Move branch tracing setup to the Intel-specific source file
    - perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
    - fs: fix lost error code in dio_complete
    - ALSA: wss: Fix invalid snd_free_pages() at error path
    - ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
    - ALSA: control: Fix race between adding and removing a user element
    - ALSA: sparc: Fix invalid snd_free_pages() at error path
    - ALSA: hda/realtek - Support ALC300
    - ALSA: hda/realtek - fix headset mic detection for MSI MS-B171
    - ext2: fix potential use after free
    - ARM: dts: rockchip: Remove @0 from the veyron memory node
    - dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
    - dmaengine: at_hdmac: fix module unloading
    - staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
    - staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
    - usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
    - Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
    - iio:st_magn: Fix enable device after trigger
    - lib/test_kmod.c: fix rmmod double free
    - mm: use swp_offset as key in shmem_replace_page()
    - misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
    - binder: fix race that allows malicious free of live buffer
    - libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
    - libceph: check authorizer reply/challenge length before reading
    - f2fs: fix missing up_read
    - net: don't keep lonely packets forever in the gro hash
    - net: phy: add workaround for issue where PHY driver doesn't bind to the
      device
    - KVM: nVMX/nSVM: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset
    - udf: Allow mounting volumes with incorrect identification strings
    - btrfs: Always try all copies when reading extent buffers
    - Btrfs: fix rare chances for data loss when doing a fast fsync
    - Btrfs: fix race between enabling quotas and subvolume creation
    - perf/x86/intel: Disallow precise_ip on BTS events
    - ALSA: hda: Add ASRock H81M-HDS to the power_save blacklist
    - ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist
    - function_graph: Create function_graph_enter() to consolidate architecture
      code
    - ARM: function_graph: Simplify with function_graph_enter()
    - microblaze: function_graph: Simplify with function_graph_enter()
    - x86/function_graph: Simplify with function_graph_enter()
    - powerpc/function_graph: Simplify with function_graph_enter()
    - sh/function_graph: Simplify with function_graph_enter()
    - sparc/function_graph: Simplify with function_graph_enter()
    - parisc: function_graph: Simplify with function_graph_enter()
    - s390/function_graph: Simplify with function_graph_enter()
    - arm64: function_graph: Simplify with function_graph_enter()
    - MIPS: function_graph: Simplify with function_graph_enter()
    - function_graph: Make ftrace_push_return_trace() static
    - function_graph: Use new curr_ret_depth to manage depth instead of
      curr_ret_stack
    - function_graph: Have profiler use curr_ret_stack and not depth
    - function_graph: Move return callback before update of curr_ret_stack
    - function_graph: Reverse the order of pushing the ret_stack and the callback
    - ext2: initialize opts.s_mount_opt as zero before using it
    - ASoC: intel: cht_bsw_max98090_ti: Add quirk for boards using pmc_plt_clk_0
    - staging: most: use format specifier "%s" in snprintf
    - iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed
      numbers
    - mm: cleancache: fix corruption on missed inode invalidation

  * Bionic update: upstream stable patchset 2019-07-17 (LP: #1836968) //
    CVE-2000-1134 // CVE-2007-3852 // CVE-2008-0525 // CVE-2009-0416 //
    CVE-2011-4834 // CVE-2015-1838 // CVE-2015-7442 // CVE-2016-7489
    - namei: allow restricted O_CREAT of FIFOs and regular files

  * bcache: risk of data loss on I/O errors in backing or caching devices
    (LP: #1829563)
    - bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags
    - bcache: add stop_when_cache_set_failed option to backing device
    - bcache: fix inaccurate io state for detached bcache devices
    - bcache: add backing_request_endio() for bi_end_io
    - bcache: add io_disable to struct cached_dev
    - bcache: store disk name in struct cache and struct cached_dev
    - bcache: count backing device I/O error for writeback I/O
    - bcache: add wait_for_kthread_stop() in bch_allocator_thread()
    - bcache: set dc->io_disable to true in conditional_stop_bcache_device()
    - bcache: stop bcache device when backing device is offline
    - bcache: fix ioctl in flash device

  * Bionic update: upstream stable patchset 2019-07-16 (LP: #1836802)
    - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB
    - spi: bcm-qspi: switch back to reading flash using smaller chunks
    - bcache: trace missed reading by cache_missed
    - bcache: fix miss key refill->end in writeback
    - hwmon: (pmbus) Fix page count auto-detection.
    - jffs2: free jffs2_sb_info through jffs2_kill_sb()
    - cpufreq: conservative: Take limits changes into account properly
    - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
    - parisc: Fix address in HPMC IVA
    - parisc: Fix map_pages() to not overwrite existing pte entries
    - parisc: Fix exported address of os_hpmc handler
    - ALSA: hda - Add quirk for ASUS G751 laptop
    - ALSA: hda - Fix headphone pin config for ASUS G751
    - ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
    - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
    - x86/xen: Fix boot loader version reported for PVH guests
    - x86/corruption-check: Fix panic in memory_corruption_check() when boot
      option without value is provided
    - ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
    - bpf: do not blindly change rlimit in reuseport net selftest
    - Revert "perf tools: Fix PMU term format max value calculation"
    - xfrm: policy: use hlist rcu variants on insert
    - perf vendor events intel: Fix wrong filter_band* values for uncore events
    - sched/fair: Fix the min_vruntime update logic in dequeue_entity()
    - perf tools: Fix use of alternatives to find JDIR
    - perf cpu_map: Align cpu map synthesized events properly.
    - x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
    - net: qla3xxx: Remove overflowing shift statement
    - selftests: ftrace: Add synthetic event syntax testcase
    - i2c: rcar: cleanup DMA for all kinds of failure
    - locking/lockdep: Fix debug_locks off performance problem
    - ataflop: fix error handling during setup
    - swim: fix cleanup on setup error
    - nfp: devlink port split support for 1x100G CXP NIC
    - tun: Consistently configure generic netdev params via rtnetlink
    - s390/sthyi: Fix machine name validity indication
    - hwmon: (pwm-fan) Set fan speed to 0 on suspend
    - lightnvm: pblk: fix two sleep-in-atomic-context bugs
    - spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
    - perf tools: Free temporary 'sys' string in read_event_files()
    - perf tools: Cleanup trace-event-info 'tdata' leak
    - perf strbuf: Match va_{add,copy} with va_end
    - cpupower: Fix coredump on VMWare
    - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
    - iwlwifi: pcie: avoid empty free RB queue
    - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
    - x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
    - ACPI / processor: Fix the return value of acpi_processor_ids_walk()
    - cpufreq: dt: Try freeing static OPPs only if we have added them
    - mtd: rawnand: atmel: Fix potential NULL pointer dereference
    - signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
    - Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
    - x86: boot: Fix EFI stub alignment
    - pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
    - brcmfmac: fix for proper support of 160MHz bandwidth
    - net: phy: phylink: ensure the carrier is off when starting phylink
    - block, bfq: correctly charge and reset entity service in all cases
    - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
    - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
    - pinctrl: qcom: spmi-mpp: Fix drive strength setting
    - pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
    - pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
    - net: dsa: mv88e6xxx: Fix writing to a PHY page.
    - iwlwifi: mvm: fix BAR seq ctrl reporting
    - ixgbevf: VF2VF TCP RSS
    - ath10k: schedule hardware restart if WMI command times out
    - thermal: da9062/61: Prevent hardware access during system suspend
    - cgroup, netclassid: add a preemption point to write_classid
    - scsi: esp_scsi: Track residual for PIO transfers
    - UAPI: ndctl: Fix g++-unsupported initialisation in headers
    - KVM: nVMX: Clear reserved bits of #DB exit qualification
    - scsi: megaraid_sas: fix a missing-check bug
    - RDMA/core: Do not expose unsupported counters
    - IB/ipoib: Clear IPCB before icmp_send
    - RDMA/bnxt_re: Fix recursive lock warning in debug kernel
    - usb: host: ohci-at91: fix request of irq for optional gpio
    - PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
    - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
    - Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
    - VMCI: Resource wildcard match fixed
    - PCI / ACPI: Enable wake automatically for power managed bridges
    - usb: gadget: udc: atmel: handle at91sam9rl PMC
    - ext4: fix argument checking in EXT4_IOC_MOVE_EXT
    - MD: fix invalid stored role for a disk
    - f2fs: fix to recover inode's i_flags during POR
    - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
    - coresight: etb10: Fix handling of perf mode
    - PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
    - crypto: caam - fix implicit casts in endianness helpers
    - usb: chipidea: Prevent unbalanced IRQ disable
    - driver/dma/ioat: Call del_timer_sync() without holding prep_lock
    - uio: ensure class is registered before devices
    - scsi: lpfc: Correct soft lockup when running mds diagnostics
    - scsi: lpfc: Correct race with abort on completion path
    - f2fs: report error if quota off error during umount
    - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace
      init
    - mfd: menelaus: Fix possible race condition and leak
    - dmaengine: dma-jz4780: Return error if not probed from DT
    - IB/rxe: fix for duplicate request processing and ack psns
    - ALSA: hda: Check the non-cached stream buffers more explicitly
    - cpupower: Fix AMD Family 0x17 msr_pstate size
    - f2fs: fix to account IO correctly
    - ARM: dts: exynos: Remove "cooling-{min|max}-level" for CPU nodes
    - arm: dts: exynos: Add missing cooling device properties for CPUs
    - ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
    - ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
    - xen-swiotlb: use actually allocated size on check physical continuous
    - tpm: Restore functionality to xen vtpm driver.
    - xen/blkfront: avoid NULL blkfront_info dereference on device removal
    - xen/balloon: Support xend-based toolstack
    - xen: fix race in xen_qlock_wait()
    - xen: make xen_qlock_wait() nestable
    - xen/pvh: increase early stack size
    - xen/pvh: don't try to unplug emulated devices
    - libertas: don't set URB_ZERO_PACKET on IN USB transfer
    - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
    - usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround"
    - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
    - net/ipv4: defensive cipso option parsing
    - dmaengine: ppc4xx: fix off-by-one build failure
    - dmaengine: stm32-dma: fix incomplete configuration in cyclic mode
    - libnvdimm: Hold reference on parent while scheduling async init
    - libnvdimm, region: Fail badblocks listing for inactive regions
    - ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
    - IB/mlx5: Fix MR cache initialization
    - jbd2: fix use after free in jbd2_log_do_checkpoint()
    - gfs2_meta: ->mount() can get NULL dev_name
    - ext4: initialize retries variable in ext4_da_write_inline_data_begin()
    - ext4: fix setattr project check in fssetxattr ioctl
    - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
    - ext4: fix use-after-free race in ext4_remount()'s error path
    - EDAC, amd64: Add Family 17h, models 10h-2fh support
    - EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
    - EDAC, skx_edac: Fix logical channel intermediate decoding
    - ARM: dts: dra7: Fix up unaligned access setting for PCIe EP
    - PCI/ASPM: Fix link_state teardown on device removal
    - PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
    - PCI: vmd: White list for fast interrupt handlers
    - signal/GenWQE: Fix sending of SIGKILL
    - signal: Guard against negative signal numbers in copy_siginfo_from_user32
    - crypto: lrw - Fix out-of bounds access on counter overflow
    - crypto: tcrypt - fix ghash-generic speed test
    - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range()
    - ima: fix showing large 'violations' or 'runtime_measurements_count'
    - hugetlbfs: dirty pages as they are added to pagecache
    - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly
    - KVM: arm64: Fix caching of host MDCR_EL2 value
    - kbuild: fix kernel/bounds.c 'W=1' warning
    - iio: ad5064: Fix regulator handling
    - iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
    - iio: adc: at91: fix acking DRDY irq on simple conversions
    - iio: adc: at91: fix wrong channel number in triggered buffer mode
    - w1: omap-hdq: fix missing bus unregister at removal
    - smb3: allow stats which track session and share reconnects to be reset
    - smb3: do not attempt cifs operation in smb3 query info error path
    - smb3: on kerberos mount if server doesn't specify auth type use krb5
    - printk: Fix panic caused by passing log_buf_len to command line
    - genirq: Fix race on spurious interrupt detection
    - NFSv4.1: Fix the r/wsize checking
    - nfs: Fix a missed page unlock after pg_doio()
    - nfsd: Fix an Oops in free_session()
    - lockd: fix access beyond unterminated strings in prints
    - dm ioctl: harden copy_params()'s copy_from_user() from malicious users
    - dm zoned: fix metadata block ref counting
    - dm zoned: fix various dmz_get_mblock() issues
    - powerpc/msi: Fix compile error on mpc83xx
    - MIPS: OCTEON: fix out of bounds array access on CN68XX
    - iommu/arm-smmu: Ensure that page-table updates are visible before TLBI
    - TC: Set DMA masks for devices
    - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
    - kgdboc: Passing ekgdboc to command line causes panic
    - xen: fix xen_qlock_wait()
    - xen-blkfront: fix kernel panic with negotiate_mq error path
    - media: em28xx: use a default format if TRY_FMT fails
    - media: tvp5150: avoid going past array on v4l2_querymenu()
    - media: em28xx: fix input name for Terratec AV 350
    - media: em28xx: make v4l2-compliance happier by starting sequence on zero
    - media: media colorspaces*.rst: rename AdobeRGB to opRGB
    - arm64: lse: remove -fcall-used-x0 flag
    - rpmsg: smd: fix memory leak on channel create
    - Cramfs: fix abad comparison when wrap-arounds occur
    - ARM: dts: socfpga: Fix SDRAM node address for Arria10
    - arm64: dts: stratix10: Correct System Manager register size
    - soc/tegra: pmc: Fix child-node lookup
    - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled
    - btrfs: Handle owner mismatch gracefully when walking up tree
    - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
    - btrfs: fix error handling in free_log_tree
    - btrfs: Enhance btrfs_trim_fs function to handle error better
    - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
    - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
    - btrfs: don't attempt to trim devices that don't support it
    - btrfs: wait on caching when putting the bg cache
    - btrfs: protect space cache inode alloc with GFP_NOFS
    - btrfs: reset max_extent_size on clear in a bitmap
    - btrfs: make sure we create all new block groups
    - Btrfs: fix warning when replaying log after fsync of a tmpfile
    - Btrfs: fix wrong dentries after fsync of file that got its parent replaced
    - btrfs: qgroup: Dirty all qgroups before rescan
    - Btrfs: fix null pointer dereference on compressed write path error
    - Btrfs: fix assertion on fsync of regular file when using no-holes feature
    - btrfs: set max_extent_size properly
    - btrfs: don't use ctl->free_space for max_extent_size
    - btrfs: only free reserved extent if we didn't insert it
    - btrfs: don't run delayed_iputs in commit
    - btrfs: move the dio_sem higher up the callchain
    - Btrfs: fix use-after-free during inode eviction
    - Btrfs: fix use-after-free when dumping free space
    - Btrfs: fix fsync after hole punching when using no-holes feature
    - net: sched: Remove TCA_OPTIONS from policy
    - bpf: wait for running BPF programs when updating map-in-map
    - MD: fix invalid stored role for a disk - try2
    - mtd: spi-nor: intel-spi: Add support for Intel Ice Lake SPI serial flash
    - mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus
    - bcache: correct dirty data statistics
    - block: don't deal with discard limit in blkdev_issue_discard()
    - block: make sure discard bio is aligned with logical block size
    - block: make sure writesame bio is aligned with logical block size
    - dma-mapping: fix panic caused by passing empty cma command line argument
    - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer()
    - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended
      opcodes
    - kprobes/x86: Use preempt_enable() in optimized_callback()
    - mailbox: PCC: handle parse error
    - ALSA: hda: Add 2 more models to the power_save blacklist
    - drm: fix use of freed memory in drm_mode_setcrtc
    - nvme: remove ns sibling before clearing path
    - nfp: flower: fix pedit set actions for multiple partial masks
    - nfp: flower: use offsets provided by pedit instead of index for ipv6
    - perf report: Don't crash on invalid inline debug information
    - drm: Get ref on CRTC commit object when waiting for flip_done
    - net: socionext: Reset tx queue in ndo_stop
    - lightnvm: pblk: fix race on sysfs line state
    - lightnvm: pblk: fix race condition on metadata I/O
    - bcache: Populate writeback_rate_minimum attribute
    - sdhci: acpi: add free_slot callback
    - mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset
    - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI
    - ACPI/PPTT: Handle architecturally unknown cache types
    - ACPI / PM: LPIT: Register sysfs attributes based on FADT
    - pinctrl: sunxi: fix 'pctrl->functions' allocation in
      sunxi_pinctrl_build_state
    - arm64: entry: Allow handling of undefined instructions from EL1
    - bpf/verifier: fix verifier instability
    - gpio: brcmstb: allow 0 width GPIO banks
    - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9
    - thermal: rcar_thermal: Prevent doing work after unbind
    - net: stmmac: dwmac-sun8i: fix OF child-node lookup
    - f2fs: clear PageError on the read path
    - xprtrdma: Reset credit grant properly after a disconnect
    - nvmem: check the return value of nvmem_add_cells()
    - f2fs: avoid sleeping under spin_lock
    - f2fs: fix to recover cold bit of inode block during POR
    - OPP: Free OPP table properly on performance state irregularities
    - IB/rxe: Revise the ib_wr_opcode enum
    - ext4: fix EXT4_IOC_SWAP_BOOT
    - selinux: fix mounting of cgroup2 under older policies
    - KVM: arm/arm64: Ensure only THP is candidate for adjustment
    - NFC: nfcmrvl_uart: fix OF child-node lookup
    - media: ov7670: make "xclk" clock optional
    - powerpc/tm: Fix HFSCR bit for no suspend case
    - powerpc/64s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9
    - MIPS: memset: Fix CPU_DADDI_WORKAROUNDS `small_fixup' regression
    - power: supply: twl4030-charger: fix OF sibling-node lookup
    - ocxl: Fix access to the AFU Descriptor Data
    - net: bcmgenet: fix OF child-node lookup
    - media: cec: make cec_get_edid_spa_location() an inline function
    - media: cec: integrate cec_validate_phys_addr() in cec-api.c
    - media: adv7604: when the EDID is cleared, unconfigure CEC as well
    - media: adv7842: when the EDID is cleared, unconfigure CEC as well
    - drm/mediatek: fix OF sibling-node lookup
    - media: replace ADOBERGB by OPRGB
    - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC
    - btrfs: fix error handling in btrfs_dev_replace_start
    - btrfs: keep trim from interfering with transaction commits
    - Btrfs: don't clean dirty pages during buffered writes
    - btrfs: release metadata before running delayed refs
    - Btrfs: fix deadlock when writing out free space caches
    - btrfs: reset max_extent_size properly
    - btrfs: fix insert_reserved error handling
    - powerpc/traps: restore recoverability of machine_check interrupts
    - powerpc/64/module: REL32 relocation range check
    - powerpc/mm: Fix page table dump to work on Radix
    - powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
    - tty: check name length in tty_find_polling_driver()
    - ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
    - powerpc/nohash: fix undefined behaviour when testing page size support
    - powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak
    - drm/omap: fix memory barrier bug in DMM driver
    - drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
    - media: pci: cx23885: handle adding to list failure
    - media: coda: don't overwrite h.264 profile_idc on decoder instance
    - MIPS: kexec: Mark CPU offline before disabling local IRQ
    - powerpc/boot: Ensure _zimage_start is a weak symbol
    - powerpc/memtrace: Remove memory in chunks
    - MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
    - sc16is7xx: Fix for multi-channel stall
    - media: tvp5150: fix width alignment during set_selection()
    - powerpc/selftests: Wait all threads to join
    - staging:iio:ad7606: fix voltage scales
    - 9p locks: fix glock.client_id leak in do_lock
    - 9p: clear dangling pointers in p9stat_free
    - ovl: fix error handling in ovl_verify_set_fh()
    - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
    - scsi: qla2xxx: Fix process response queue for ISP26XX and above
    - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
    - scsi: qla2xxx: shutdown chip if reset fail
    - scsi: qla2xxx: Fix re-using LoopID when handle is in use
    - ovl: fix recursive oi->lock in ovl_link()
    - MIPS: Loongson-3: Fix CPU UART irq delivery problem
    - MIPS: Loongson-3: Fix BRIDGE irq delivery problem
    - xtensa: add NOTES section to the linker script
    - xtensa: make sure bFLT stack is 16 byte aligned
    - xtensa: fix boot parameters address translation
    - um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
    - clk: s2mps11: Fix matching when built as module and DT node contains
      compatible
    - clk: at91: Fix division by zero in PLL recalc_rate()
    - clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
    - clk: mvebu: use correct bit for 98DX3236 NAND
    - libceph: bump CEPH_MSG_MAX_DATA_LEN
    - mach64: fix display corruption on big endian machines
    - mach64: fix image corruption due to reading accelerator registers
    - reset: hisilicon: fix potential NULL pointer dereference
    - vhost/scsi: truncate T10 PI iov_iter to prot_bytes
    - scsi: qla2xxx: Initialize port speed to avoid setting lower speed
    - SCSI: fix queue cleanup race before queue initialization is done
    - soc: ti: QMSS: Fix usage of irq_set_affinity_hint
    - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
    - ocfs2: free up write context when direct IO failed
    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
    - netfilter: conntrack: fix calculation of next bucket number in early_drop
    - ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
    - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
    - of, numa: Validate some distance map rules
    - x86/cpu/vmware: Do not trace vmware_sched_clock()
    - x86/hyper-v: Enable PIT shutdown quirk
    - termios, tty/tty_baudrate.c: fix buffer overrun
    - arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
    - watchdog/core: Add missing prototypes for weak functions
    - btrfs: fix pinned underflow after transaction aborted
    - Btrfs: fix cur_offset in the error case for nocow
    - Btrfs: fix infinite loop on inode eviction after deduplication of eof block
    - Btrfs: fix data corruption due to cloning of eof block
    - clockevents/drivers/i8253: Add support for PIT shutdown quirk
    - ext4: add missing brelse() update_backups()'s error path
    - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
    - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
    - ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
    - ext4: missing !bh check in ext4_xattr_inode_write()
    - ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
    - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
    - ext4: avoid buffer leak in ext4_orphan_add() after prior errors
    - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
    - ext4: avoid possible double brelse() in add_new_gdb() on error path
    - ext4: fix possible leak of sbi->s_group_desc_leak in error path
    - ext4: fix possible leak of s_journal_flag_rwsem in error path
    - ext4: fix buffer leak in ext4_xattr_get_block() on error path
    - ext4: release bs.bh before re-using in ext4_xattr_block_find()
    - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
    - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
    - ext4: fix buffer leak in __ext4_read_dirblock() on error path
    - mount: Prevent MNT_DETACH from disconnecting locked mounts
    - kdb: use correct pointer when 'btc' calls 'btt'
    - kdb: print real address of pointers instead of hashed addresses
    - sunrpc: correct the computation for page_ptr when truncating
    - rtc: hctosys: Add missing range error reporting
    - configfs: replace strncpy with memcpy
    - gfs2: Put bitmap buffers in put_super
    - lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
    - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
    - mm/swapfile.c: use kvzalloc for swap_info_struct allocation
    - efi/arm/libstub: Pack FDT after populating it
    - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
    - drm/nouveau: Check backlight IDs are >= 0, not > 0
    - drm/dp_mst: Check if primary mstb is null
    - drm/i915: Restore vblank interrupts earlier
    - drm/i915: Don't unset intel_connector->mst_port
    - drm/i915: Skip vcpi allocation for MSTB ports that are gone
    - drm/i915: Large page offsets for pread/pwrite
    - drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
    - drm/i915: Don't oops during modeset shutdown after lpe audio deinit
    - drm/i915: Mark pin flags as u64
    - drm/i915/execlists: Force write serialisation into context image vs
      execution
    - CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM
    - ovl: check whiteout in ovl_create_over_whiteout()
    - nvme-loop: fix kernel oops in case of unhandled command
    - Input: wm97xx-ts - fix exit path
    - powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
    - tracing/kprobes: Check the probe on unloaded module correctly
    - drm/amdgpu/powerplay: fix missing break in switch statements
    - udf: Prevent write-unsupported filesystem to be remounted read-write
    - serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
    - zram: close udev startup race condition as default groups
    - clk: rockchip: fix wrong mmc sample phase shift for rk3328
    - bonding/802.3ad: fix link_failure_count tracking
    - hwmon: (core) Fix double-free in __hwmon_device_register()
    - perf stat: Handle different PMU names with common prefix
    - mnt: fix __detach_mounts infinite loop
    - NFSv4: Don't exit the state manager without clearing
      NFS4CLNT_MANAGER_RUNNING
    - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD
    - drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit
      panel's native mode
    - drm/i915: Fix ilk+ watermarks when disabling pipes
    - drm/i915: Fix possible race in intel_dp_add_mst_connector()

  * [SRU][B/B-OEM]Fix resume failure on some TPM chips (LP: #1836031)
    - tpm: tpm_try_transmit() refactor error flow.

  * Linux md raid-10 freezes during resync (LP: #1767992)
    - md: fix raid10 hang issue caused by barrier

  * hda/realtek: can't detect external mic on a Dell machine (LP: #1836755)
    - ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine

  * CVE-2019-12614
    - powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()

  * x86: mm: early boot problem on i386 with KPTI enabled (LP: #1827884)
    - Revert "perf/core: Make sure the ring-buffer is mapped in all page-tables"
    - x86/mm: Clarify hardware vs. software "error_code"
    - x86/mm: Break out kernel address space handling
    - x86/mm: Break out user address space handling
    - x86/mm/fault: Allow stack access below %rsp

  * bnx2x driver causes 100% CPU load (LP: #1832082)
    - bnx2x: Prevent ptp_task to be rescheduled indefinitely

  * Sometimes touchpad detected as mouse(i2c designware fails to get adapter
    number) (LP: #1835150)
    - i2c: i2c-designware-platdrv: Cleanup setting of the adapter number
    - i2c: i2c-designware-platdrv: Always use a dynamic adapter number

  * HP EliteBook 745 G5 (Ryzen 2500U) fails to boot unless `mce=off` is set on
    command line (LP: #1796443)
    - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
    - x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk
    - x86/MCE: Add an MCE-record filtering function
    - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models

  * Bionic update: upstream stable patchset 2019-07-15 (LP: #1836654)
    - media: af9035: prevent buffer overflow on write
    - batman-adv: Avoid probe ELP information leak
    - batman-adv: Fix segfault when writing to throughput_override
    - batman-adv: Fix segfault when writing to sysfs elp_interval
    - batman-adv: Prevent duplicated gateway_node entry
    - batman-adv: Prevent duplicated nc_node entry
    - batman-adv: Prevent duplicated softif_vlan entry
    - batman-adv: Prevent duplicated global TT entry
    - batman-adv: Prevent duplicated tvlv handler
    - batman-adv: fix backbone_gw refcount on queue_work() failure
    - batman-adv: fix hardif_neigh refcount on queue_work() failure
    - clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-
      am43 SoCs
    - scsi: ibmvscsis: Fix a stringop-overflow warning
    - scsi: ibmvscsis: Ensure partition name is properly NUL terminated
    - intel_th: pci: Add Ice Lake PCH support
    - Input: atakbd - fix Atari keymap
    - Input: atakbd - fix Atari CapsLock behaviour
    - net: emac: fix fixed-link setup for the RTL8363SB switch
    - ravb: do not write 1 to reserved bits
    - PCI: dwc: Fix scheduling while atomic issues
    - drm: mali-dp: Call drm_crtc_vblank_reset on device init
    - scsi: ipr: System hung while dlpar adding primary ipr adapter back
    - scsi: sd: don't crash the host on invalid commands
    - net/mlx4: Use cpumask_available for eq->affinity_mask
    - clocksource/drivers/fttmr010: Fix set_next_event handler
    - powerpc/tm: Fix userspace r13 corruption
    - powerpc/tm: Avoid possible userspace r1 corruption on reclaim
    - iommu/amd: Return devid as alias for ACPI HID devices
    - ARC: build: Get rid of toolchain check
    - ARC: build: Don't set CROSS_COMPILE in arch's Makefile
    - HID: quirks: fix support for Apple Magic Keyboards
    - staging: ccree: check DMA pool buf !NULL before free
    - net/smc: fix sizeof to int comparison
    - qed: Fix populating the invalid stag value in multi function mode.
    - RDMA/uverbs: Fix validity check for modify QP
    - bpf: test_maps, only support ESTABLISHED socks
    - RDMA/bnxt_re: Fix system crash during RDMA resource initialization
    - RISC-V: include linux/ftrace.h in asm-prototypes.h
    - powerpc/numa: Use associativity if VPHN hcall is successful
    - x86/boot: Fix kexec booting failure in the SEV bit detection code
    - xfrm: Validate address prefix lengths in the xfrm selector.
    - xfrm6: call kfree_skb when skb is toobig
    - xfrm: reset transport header back to network header after all input
      transforms ahave been applied
    - xfrm: reset crypto_done when iterating over multiple input xfrms
    - mac80211: Always report TX status
    - cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
    - mac80211: fix pending queue hang due to TX_DROP
    - cfg80211: Address some corner cases in scan result channel updating
    - mac80211: TDLS: fix skb queue/priority assignment
    - mac80211: fix TX status reporting for ieee80211s
    - ARM: 8799/1: mm: fix pci_ioremap_io() offset check
    - xfrm: validate template mode
    - netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev
    - arm64: hugetlb: Fix handling of young ptes
    - ARM: dts: BCM63xx: Fix incorrect interrupt specifiers
    - net: macb: Clean 64b dma addresses if they are not detected
    - soc: fsl: qbman: qman: avoid allocating from non existing gen_pool
    - soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift()
    - mac80211_hwsim: do not omit multicast announce of first added radio
    - Bluetooth: SMP: fix crash in unpairing
    - pxa168fb: prepare the clock
    - qed: Avoid implicit enum conversion in qed_set_tunn_cls_info
    - qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv
    - qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor
    - qed: Avoid constant logical operation warning in qed_vf_pf_acquire
    - qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt
    - asix: Check for supported Wake-on-LAN modes
    - ax88179_178a: Check for supported Wake-on-LAN modes
    - lan78xx: Check for supported Wake-on-LAN modes
    - sr9800: Check for supported Wake-on-LAN modes
    - r8152: Check for supported Wake-on-LAN Modes
    - smsc75xx: Check for Wake-on-LAN modes
    - smsc95xx: Check for Wake-on-LAN modes
    - cfg80211: fix use-after-free in reg_process_hint()
    - perf/core: Fix perf_pmu_unregister() locking
    - perf/ring_buffer: Prevent concurent ring buffer access
    - perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX
    - perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events
    - net: fec: fix rare tx timeout
    - declance: Fix continuation with the adapter identification message
    - locking/ww_mutex: Fix runtime warning in the WW mutex selftest
    - be2net: don't flip hw_features when VXLANs are added/deleted
    - net: cxgb3_main: fix a missing-check bug
    - yam: fix a missing-check bug
    - ocfs2: fix crash in ocfs2_duplicate_clusters_by_page()
    - iwlwifi: mvm: check for short GI only for OFDM
    - iwlwifi: dbg: allow wrt collection before ALIVE
    - iwlwifi: fix the ALIVE notification layout
    - usbip: vhci_hcd: update 'status' file header and format
    - net/mlx5: Fix mlx5_get_vector_affinity function
    - powerpc/pseries: Add empty update_numa_cpu_lookup_table() for NUMA=n
    - dm integrity: fail early if required HMAC key is not available
    - net: phy: realtek: Use the dummy stubs for MMD register access for rtl8211b
    - net: phy: Add general dummy stubs for MMD register access
    - scsi: qla2xxx: Avoid double completion of abort command
    - kbuild: set no-integrated-as before incl. arch Makefile
    - IB/mlx5: Avoid passing an invalid QP type to firmware
    - l2tp: remove configurable payload offset
    - cifs: Use ULL suffix for 64-bit constant
    - KVM: x86: Update the exit_qualification access bits while walking an address
    - sparc64: Fix regression in pmdp_invalidate().
    - tpm: move the delay_msec increment after sleep in tpm_transmit()
    - bpf: sockmap, map_release does not hold refcnt for pinned maps
    - tpm: tpm_crb: relinquish locality on error path.
    - IB/usnic: Update with bug fixes from core code
    - mmc: dw_mmc-rockchip: correct property names in debug
    - MIPS: Workaround GCC __builtin_unreachable reordering bug
    - iio: buffer: fix the function signature to match implementation
    - selftests/powerpc: Add ptrace hw breakpoint test
    - scsi: ibmvfc: Avoid unnecessary port relogin
    - scsi: sd: Remember that READ CAPACITY(16) succeeded
    - btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf
    - net: phy: phylink: Don't release NULL GPIO
    - x86/paravirt: Fix some warning messages
    - net: stmmac: mark PM functions as __maybe_unused
    - kconfig: fix the rule of mainmenu_stmt symbol
    - libertas: call into generic suspend code before turning off power
    - compiler.h: Allow arch-specific asm/compiler.h
    - ARM: dts: imx53-qsb: disable 1.2GHz OPP
    - perf python: Use -Wno-redundant-decls to build with PYTHON=python3
    - rxrpc: Don't check RXRPC_CALL_TX_LAST after calling rxrpc_rotate_tx_window()
    - rxrpc: Only take the rwind and mtu values from latest ACK
    - rxrpc: Fix connection-level abort handling
    - selftests: rtnetlink.sh explicitly requires bash.
    - fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
    - mtd: spi-nor: Add support for is25wp series chips
    - ARM: dts: r8a7790: Correct critical CPU temperature
    - media: uvcvideo: Fix driver reference counting
    - Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing"
    - perf tools: Disable parallelism for 'make clean'
    - drm/i915/gvt: fix memory leak of a cmd_entry struct on error exit path
    - bridge: do not add port to router list when receives query with source
      0.0.0.0
    - net: bridge: remove ipv6 zero address check in mcast queries
    - ipv6: mcast: fix a use-after-free in inet6_mc_check
    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
      called
    - llc: set SOCK_RCU_FREE in llc_sap_add_socket()
    - net: fec: don't dump RX FIFO register when not available
    - net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
    - net: sched: gred: pass the right attribute to gred_change_table_def()
    - net: socket: fix a missing-check bug
    - net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
    - net: udp: fix handling of CHECKSUM_COMPLETE packets
    - r8169: fix NAPI handling under high load
    - sctp: fix race on sctp_id2asoc
    - udp6: fix encap return code for resubmitting
    - virtio_net: avoid using netif_tx_disable() for serializing tx routine
    - ethtool: fix a privilege escalation bug
    - bonding: fix length of actor system
    - ip6_tunnel: Fix encapsulation layout
    - openvswitch: Fix push/pop ethernet validation
    - net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type
    - net: sched: Fix for duplicate class dump
    - net: drop skb on failure in ip_check_defrag()
    - net: fix pskb_trim_rcsum_slow() with odd trim offset
    - net/mlx5e: fix csum adjustments caused by RXFCS
    - rtnetlink: Disallow FDB configuration for non-Ethernet device
    - net: ipmr: fix unresolved entry dumps
    - net: bcmgenet: Poll internal PHY for GENETv5
    - net/sched: cls_api: add missing validation of netlink attributes
    - net/mlx5: Fix build break when CONFIG_SMP=n
    - mac80211_hwsim: fix locking when iterating radios during ns exit
    - rxrpc: Fix checks as to whether we should set up a new call
    - rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket
    - thunderbolt: Do not handle ICM events after domain is stopped
    - thunderbolt: Initialize after IOMMUs
    - RISCV: Fix end PFN for low memory
    - drm/amd/display: Signal hw_done() after waiting for flip_done()
    - powerpc/numa: Skip onlining a offline node in kdump path
    - mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl
    - perf report: Don't try to map ip to invalid map
    - perf record: Use unmapped IP for inline callchain cursors
    - rxrpc: Carry call state out of locked section in rxrpc_rotate_tx_window()
    - gpio: Assign gpio_irq_chip::parents to non-stack pointer
    - IB/mlx5: Unmap DMA addr from HCA before IOMMU
    - rds: RDS (tcp) hangs on sendto() to unresponding address
    - sparc64: Export __node_distance.
    - sparc64: Make corrupted user stacks more debuggable.
    - sparc64: Make proc_id signed.
    - sparc64: Set %l4 properly on trap return after handling signals.
    - sparc: Fix single-pcr perf event counter management.
    - sparc: Fix syscall fallback bugs in VDSO.
    - sparc: Throttle perf events properly.
    - eeprom: at24: Add support for address-width property
    - vfs: swap names of {do,vfs}_clone_file_range()
    - bpf: fix partial copy of map_ptr when dst is scalar
    - gpio: mxs: Get rid of external API call
    - xfs: truncate transaction does not modify the inobt
    - cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
    - drm/edid: VSDB yCBCr420 Deep Color mode bit definitions
    - drm: fb-helper: Reject all pixel format changing requests
    - cdc-acm: do not reset notification buffer index upon urb unlinking
    - cdc-acm: correct counting of UART states in serial state notification
    - cdc-acm: fix race between reset and control messaging
    - usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
    - USB: fix the usbfs flag sanitization for control transfers
    - Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
    - sched/fair: Fix throttle_list starvation with low CFS quota
    - x86/tsc: Force inlining of cyc2ns bits
    - x86, hibernate: Fix nosave_regions setup for hibernation
    - x86/percpu: Fix this_cpu_read()
    - x86/time: Correct the attribute on jiffies' definition
    - x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context
      switch if there is an FPU
    - clk: sunxi-ng: sun4i: Set VCO and PLL bias current to lowest setting
    - drm/sun4i: Fix an ulong overflow in the dotclock driver
    - x86/swiotlb: Enable swiotlb for > 4GiG RAM on 32-bit kernels

  * Colour banding in HP Pavilion 15-n233sl integrated display (LP: #1794387) //
    Bionic update: upstream stable patchset 2019-07-15 (LP: #1836654)
    - drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl

  * Bionic update: upstream stable patchset 2019-07-12 (LP: #1836426)
    - drm/amd/pp: initialize result to before or'ing in data
    - drm/amdgpu: add another ATPX quirk for TOPAZ
    - tools/power turbostat: fix possible sprintf buffer overflow
    - mac80211: Run TXQ teardown code before de-registering interfaces
    - mac80211_hwsim: require at least one channel
    - btrfs: btrfs_shrink_device should call commit transaction at the end
    - scsi: csiostor: add a check for NULL pointer after kmalloc()
    - mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
    - mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
    - gpio: adp5588: Fix sleep-in-atomic-context bug
    - mac80211: mesh: fix HWMP sequence numbering to follow standard
    - mac80211: avoid kernel panic when building AMSDU from non-linear SKB
    - gpiolib: acpi: Switch to cansleep version of GPIO library call
    - gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall
    - cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
    - mac80211: do not convert to A-MSDU if frag/subframe limited
    - mac80211: always account for A-MSDU header changes
    - tools/kvm_stat: fix handling of invalid paths in debugfs provider
    - gpio: Fix crash due to registration race
    - ARC: atomics: unbork atomic_fetch_##op()
    - md/raid5-cache: disable reshape completely
    - RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
    - i2c: uniphier: issue STOP only for last message or I2C_M_STOP
    - i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
    - net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
    - fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
    - mac80211: fix an off-by-one issue in A-MSDU max_subframe computation
    - cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
    - mac80211: fix a race between restart and CSA flows
    - mac80211: Fix station bandwidth setting after channel switch
    - mac80211: don't Tx a deauth frame if the AP forbade Tx
    - mac80211: shorten the IBSS debug messages
    - tools/vm/slabinfo.c: fix sign-compare warning
    - tools/vm/page-types.c: fix "defined but not used" warning
    - mm: madvise(MADV_DODUMP): allow hugetlbfs pages
    - netfilter: xt_cluster: add dependency on conntrack module
    - HID: add support for Apple Magic Keyboards
    - usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
    - HID: hid-saitek: Add device ID for RAT 7 Contagion
    - scsi: qedi: Add the CRC size within iSCSI NVM image
    - perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx()
    - perf util: Fix bad memory access in trace info.
    - perf probe powerpc: Ignore SyS symbols irrespective of endianness
    - netfilter: nf_tables: release chain in flushing set
    - Revert "iio: temperature: maxim_thermocouple: add MAX31856 part"
    - RDMA/ucma: check fd type in ucma_migrate_id()
    - HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report
    - USB: yurex: Check for truncation in yurex_read()
    - nvmet-rdma: fix possible bogus dereference under heavy load
    - net/mlx5: Consider PCI domain in search for next dev
    - drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
    - drm/nouveau/disp: fix DP disable race
    - dm raid: fix rebuild of specific devices by updating superblock
    - fs/cifs: suppress a string overflow warning
    - perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing
      CPUs
    - dm thin metadata: try to avoid ever aborting transactions
    - arch/hexagon: fix kernel/dma.c build warning
    - hexagon: modify ffs() and fls() to return int
    - arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
    - drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk
    - r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
    - s390/qeth: don't dump past end of unknown HW header
    - cifs: read overflow in is_valid_oplock_break()
    - xen/manage: don't complain about an empty value in control/sysrq node
    - xen: avoid crash in disable_hotplug_cpu
    - xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
    - ovl: fix access beyond unterminated strings
    - ovl: fix memory leak on unlink of indexed file
    - ovl: fix format of setxattr debug
    - sysfs: Do not return POSIX ACL xattrs via listxattr
    - smb2: fix missing files in root share directory listing
    - iommu/amd: Clear memory encryption mask from physical address
    - crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
    - crypto: mxs-dcp - Fix wait logic on chan threads
    - crypto: caam/jr - fix ablkcipher_edesc pointer arithmetic
    - gpiolib: Free the last requested descriptor
    - Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()
    - tools: hv: fcopy: set 'error' in case an unknown operation was requested
    - ocfs2: fix locking for res->tracking and dlm->tracking_list
    - ixgbe: check return value of napi_complete_done()
    - dm thin metadata: fix __udivdi3 undefined on 32-bit
    - Btrfs: fix unexpected failure of nocow buffered writes after snapshotting
      when low on space
    - scsi: aacraid: fix a signedness bug
    - tipc: switch to rhashtable iterator
    - net: mvpp2: initialize port of_node pointer
    - tc-testing: add test-cases for numeric and invalid control action
    - tools/kvm_stat: fix updates for dead guests
    - ibmvnic: Include missing return code checks in reset function
    - net/ibm/emac: wrong emac_calc_base call was used by typo
    - ceph: avoid a use-after-free in ceph_destroy_options()
    - afs: Fix cell specification to permit an empty address list
    - netfilter: xt_checksum: ignore gso skbs
    - HID: intel-ish-hid: Enable Sunrise Point-H ish driver
    - iio: imu: st_lsm6dsx: take into account ts samples in wm configuration
    - riscv: Do not overwrite initrd_start and initrd_end
    - drm/nouveau: fix oops in client init failure path
    - drm/nouveau/mmu: don't attempt to dereference vmm without valid instance
      pointer
    - drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for LVDS/eDP
      panels
    - sched/topology: Set correct NUMA topology type
    - drm/amdgpu: Fix SDMA hang in prt mode v2
    - asm-generic: io: Fix ioport_map() for !CONFIG_GENERIC_IOMAP &&
      CONFIG_INDIRECT_PIO
    - x86/APM: Fix build warning when PROC_FS is not enabled
    - new primitive: discard_new_inode()
    - ovl: set I_CREATING on inode being created
    - crypto: chelsio - Fix memory corruption in DMA Mapped buffers.
    - perf/core: Add sanity check to deal with pinned event failure
    - mm: migration: fix migration of huge PMD shared pages
    - mm, thp: fix mlocking THP page with migration enabled
    - mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly
    - KVM: x86: fix L1TF's MMIO GFN calculation
    - blk-mq: I/O and timer unplugs are inverted in blktrace
    - clocksource/drivers/timer-atmel-pit: Properly handle error cases
    - fbdev/omapfb: fix omapfb_memory_read infoleak
    - drm/amdgpu: Fix vce work queue was not cancelled when suspend
    - x86/vdso: Fix asm constraints on vDSO syscall fallbacks
    - selftests/x86: Add clock_gettime() tests to test_vdso
    - x86/vdso: Only enable vDSO retpolines when enabled and supported
    - x86/vdso: Fix vDSO syscall fallback asm constraint regression
    - mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys
    - PM / core: Clear the direct_complete flag on errors
    - dm cache metadata: ignore hints array being too small during resize
    - dm cache: fix resize crash if user doesn't reload cache table
    - xhci: Add missing CAS workaround for Intel Sunrise Point xHCI
    - usb: xhci-mtk: resume USB3 roothub first
    - USB: serial: simple: add Motorola Tetra MTP6550 id
    - usb: cdc_acm: Do not leak URB buffers
    - of: unittest: Disable interrupt node tests for old world MAC systems
    - perf annotate: Use asprintf when formatting objdump command line
    - perf tools: Fix python extension build for gcc 8
    - ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
    - ath10k: fix kernel panic issue during pci probe
    - nvme_fc: fix ctrl create failures racing with workq items
    - powerpc/lib: fix book3s/32 boot failure due to code patching
    - ARC: clone syscall to setp r25 as thread pointer
    - perf utils: Move is_directory() to path.h
    - f2fs: fix invalid memory access
    - ucma: fix a use-after-free in ucma_resolve_ip()
    - ubifs: Check for name being NULL while mounting
    - rds: rds_ib_recv_alloc_cache() should call alloc_percpu_gfp() instead
    - ath10k: fix scan crash due to incorrect length calculation
    - pstore/ram: Fix failure-path memory leak in ramoops_init
    - mac80211: allocate TXQs for active monitor interfaces
    - drm: fix use-after-free read in drm_mode_create_lease_ioctl()
    - USB: serial: option: improve Quectel EP06 detection
    - USB: serial: option: add two-endpoints device-id flag
    - tipc: call start and done ops directly in __tipc_nl_compat_dumpit()
    - bnxt_en: Fix TX timeout during netpoll.
    - bnxt_en: free hwrm resources, if driver probe fails.
    - bonding: avoid possible dead-lock
    - ip6_tunnel: be careful when accessing the inner header
    - ip_tunnel: be careful when accessing the inner header
    - ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
    - ipv6: take rcu lock in rawv6_send_hdrinc()
    - net: dsa: bcm_sf2: Call setup during switch resume
    - net: hns: fix for unmapping problem when SMMU is on
    - net: ipv4: update fnhe_pmtu when first hop's MTU changes
    - net/ipv6: Display all addresses in output of /proc/net/if_inet6
    - netlabel: check for IPV4MASK in addrinfo_get
    - net: mvpp2: Extract the correct ethtype from the skb for tx csum offload
    - net: mvpp2: fix a txq_done race condition
    - net: sched: Add policy validation for tc attributes
    - net: systemport: Fix wake-up interrupt race during resume
    - net/usb: cancel pending work when unbinding smsc75xx
    - qmi_wwan: Added support for Gemalto's Cinterion ALASxx WWAN interface
    - rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096
    - sctp: update dst pmtu with the correct daddr
    - team: Forbid enslaving team device to itself
    - tipc: fix flow control accounting for implicit connect
    - udp: Unbreak modules that rely on external __skb_recv_udp() availability
    - net: stmmac: Fixup the tail addr setting in xmit path
    - net/packet: fix packet drop as of virtio gso
    - net: dsa: bcm_sf2: Fix unbind ordering
    - net/mlx5e: Set vlan masks for all offloaded TC rules
    - net: aquantia: memory corruption on jumbo frames
    - net/mlx5: E-Switch, Fix out of bound access when setting vport rate
    - bonding: pass link-local packets to bonding master also.
    - bonding: fix warning message
    - nfp: avoid soft lockups under control message storm
    - bnxt_en: don't try to offload VLAN 'modify' action
    - net-ethtool: ETHTOOL_GUFO did not and should not require CAP_NET_ADMIN
    - tcp/dccp: fix lockdep issue when SYN is backlogged
    - inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
    - ASoC: rt5514: Fix the issue of the delay volume applied again
    - ASoC: wm8804: Add ACPI support
    - ASoC: sigmadsp: safeload should not have lower byte limit
    - selftests/efivarfs: add required kernel configs
    - selftests: memory-hotplug: add required configs
    - ASoC: rsnd: adg: care clock-frequency size
    - ASoC: rsnd: don't fallback to PIO mode when -EPROBE_DEFER
    - Bluetooth: hci_ldisc: Free rw_semaphore on close
    - mfd: omap-usb-host: Fix dts probe of children
    - scsi: iscsi: target: Don't use stack buffer for scatterlist
    - scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted()
    - sound: enable interrupt after dma buffer initialization
    - sound: don't call skl_init_chip() to reset intel skl soc
    - stmmac: fix valid numbers of unicast filter entries
    - net: macb: disable scatter-gather for macb on sama5d3
    - ARM: dts: at91: add new compatibility string for macb on sama5d3
    - PCI: hv: support reporting serial number as slot information
    - clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail
    - clk: x86: Stop marking clocks as CLK_IS_CRITICAL
    - x86/kvm/lapic: always disable MMIO interface in x2APIC mode
    - drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
    - mm/vmstat.c: fix outdated vmstat_text
    - MIPS: VDSO: Always map near top of user memory
    - mach64: detect the dot clock divider correctly on sparc
    - percpu: stop leaking bitmap metadata blocks
    - perf script python: Fix export-to-postgresql.py occasional failure
    - perf script python: Fix export-to-sqlite.py sample columns
    - s390/cio: Fix how vfio-ccw checks pinned pages
    - dm cache: destroy migration_cache if cache target registration failed
    - dm: fix report zone remapping to account for partition offset
    - dm linear: eliminate linear_end_io call if CONFIG_DM_ZONED disabled
    - dm linear: fix linear_end_io conditional definition
    - cgroup: Fix dom_cgrp propagation when enabling threaded mode
    - mmc: block: avoid multiblock reads for the last sector in SPI mode
    - pinctrl: mcp23s08: fix irq and irqchip setup order
    - arm64: perf: Reject stand-alone CHAIN events for PMUv3
    - mm/thp: fix call to mmu_notifier in set_pmd_migration_entry() v2
    - mm: Preserve _PAGE_DEVMAP across mprotect() calls
    - i2c: i2c-scmi: fix for i2c_smbus_write_block_data
    - xhci: Don't print a warning when setting link state for disabled ports
    - mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES
    - mm: treat indirectly reclaimable memory as available in MemAvailable
    - dcache: account external names as indirectly reclaimable memory
    - mm: treat indirectly reclaimable memory as free in overcommit logic
    - mm: don't show nr_indirectly_reclaimable in /proc/vmstat
    - ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs
    - ARM: bugs: prepare processor bug infrastructure
    - ARM: bugs: hook processor bug checking into SMP and suspend paths
    - ARM: bugs: add support for per-processor bug checking
    - [Config] updateconfigs for CPU_SPECTRE
    - ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre
    - ARM: spectre-v2: harden branch predictor on context switches
    - ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit
    - ARM: spectre-v2: harden user aborts in kernel space
    - ARM: spectre-v2: add firmware based hardening
    - ARM: spectre-v2: warn about incorrect context switching functions
    - ARM: KVM: invalidate BTB on guest exit for Cortex-A12/A17
    - ARM: KVM: invalidate icache on guest exit for Cortex-A15
    - ARM: spectre-v2: KVM: invalidate icache on guest exit for Brahma B15
    - ARM: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
    - ARM: KVM: report support for SMCCC_ARCH_WORKAROUND_1
    - ARM: spectre-v1: add speculation barrier (csdb) macros
    - ARM: spectre-v1: add array_index_mask_nospec() implementation
    - ARM: spectre-v1: fix syscall entry
    - ARM: signal: copy registers using __copy_from_user()
    - ARM: vfp: use __copy_from_user() when restoring VFP state
    - ARM: oabi-compat: copy semops using __copy_from_user()
    - ARM: use __inttype() in get_user()
    - ARM: spectre-v1: use get_user() for __get_user()
    - ARM: spectre-v1: mitigate user accesses
    - perf tools: Fix snprint warnings for gcc 8
    - net: sched: cls_u32: fix hnode refcounting
    - net: qualcomm: rmnet: Skip processing loopback packets
    - net: qualcomm: rmnet: Fix incorrect allocation flag in transmit
    - tun: remove unused parameters
    - tun: initialize napi_mutex unconditionally
    - tun: napi flags belong to tfile
    - net: dsa: b53: Keep CPU port as tagged in all VLANs
    - rtnetlink: Fail dump if target netnsid is invalid
    - net: ipv4: don't let PMTU updates increase route MTU
    - ASoC: dapm: Fix NULL pointer deference on CODEC to CODEC DAIs
    - selftests: android: move config up a level
    - selftests: add headers_install to lib.mk
    - Bluetooth: SMP: Fix trying to use non-existent local OOB data
    - Bluetooth: Use correct tfm to generate OOB data
    - net: ethernet: ti: add missing GENERIC_ALLOCATOR dependency
    - afs: Fix afs_server struct leak
    - afs: Fix clearance of reply

  * Volume control not working Dell XPS 27 (7760) (LP: #1775068) // Bionic
    update: upstream stable patchset 2019-07-12 (LP: #1836426)
    - ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760

  * Bionic update: upstream stable patchset 2019-07-11 (LP: #1836287)
    - perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so
    - gso_segment: Reset skb->mac_len after modifying network header
    - ipv6: fix possible use-after-free in ip6_xmit()
    - net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
    - net: hp100: fix always-true check for link up state
    - pppoe: fix reception of frames with no mac header
    - qmi_wwan: set DTR for modems in forced USB2 mode
    - udp4: fix IP_CMSG_CHECKSUM for connected sockets
    - neighbour: confirm neigh entries when ARP packet is received
    - udp6: add missing checks on edumux packet processing
    - net/sched: act_sample: fix NULL dereference in the data path
    - tls: don't copy the key out of tls12_crypto_info_aes_gcm_128
    - tls: zero the crypto information from tls_context before freeing
    - tls: clear key material from kernel memory when do_tls_setsockopt_conf fails
    - NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
    - NFC: Fix the number of pipes
    - ASoC: cs4265: fix MMTLR Data switch control
    - ASoC: rsnd: fixup not to call clk_get/set under non-atomic
    - ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error
      path
    - ALSA: bebob: use address returned by kmalloc() instead of kernel stack for
      streaming DMA mapping
    - ALSA: emu10k1: fix possible info leak to userspace on
      SNDRV_EMU10K1_IOCTL_INFO
    - ALSA: fireface: fix memory leak in ff400_switch_fetching_mode()
    - ALSA: firewire-digi00x: fix memory leak of private data
    - ALSA: firewire-tascam: fix memory leak of private data
    - ALSA: fireworks: fix memory leak of response buffer at error path
    - ALSA: oxfw: fix memory leak for model-dependent data at error path
    - ALSA: oxfw: fix memory leak of discovered stream formats at error path
    - ALSA: oxfw: fix memory leak of private data
    - platform/x86: alienware-wmi: Correct a memory leak
    - xen/netfront: don't bug in case of too many frags
    - xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
    - spi: fix IDR collision on systems with both fixed and dynamic SPI bus
      numbers
    - ring-buffer: Allow for rescheduling when removing pages
    - mm: shmem.c: Correctly annotate new inodes for lockdep
    - scsi: target: iscsi: Use bin2hex instead of a re-implementation
    - ocfs2: fix ocfs2 read block panic
    - drm/nouveau: Fix deadlocks in nouveau_connector_detect()
    - drm/nouveau/drm/nouveau: Don't forget to cancel hpd_work on suspend/unload
    - drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement
    - drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
    - drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early
    - drm/vc4: Fix the "no scaling" case on multi-planar YUV formats
    - drm: udl: Destroy framebuffer only if it was initialized
    - drm/amdgpu: add new polaris pci id
    - ext4: check to make sure the rename(2)'s destination is not freed
    - ext4: avoid divide by zero fault when deleting corrupted inline directories
    - ext4: avoid arithemetic overflow that can trigger a BUG
    - ext4: recalucate superblock checksum after updating free blocks/inodes
    - ext4: fix online resize's handling of a too-small final block group
    - ext4: fix online resizing for bigalloc file systems with a 1k block size
    - ext4: don't mark mmp buffer head dirty
    - ext4: show test_dummy_encryption mount option in /proc/mounts
    - sched/fair: Fix vruntime_normalized() for remote non-migration wakeup
    - PCI: aardvark: Size bridges before resources allocation
    - vmw_balloon: include asm/io.h
    - iw_cxgb4: only allow 1 flush on user qps
    - tick/nohz: Prevent bogus softirq pending warning
    - spi: Fix double IDR allocation with DT aliases
    - hv_netvsc: fix schedule in RCU context
    - bnxt_en: Fix VF mac address regression.
    - net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
    - mtd: rawnand: denali: fix a race condition when DMA is kicked
    - platform/x86: dell-smbios-wmi: Correct a memory leak
    - fork: report pid exhaustion correctly
    - mm: disable deferred struct page for 32-bit arches
    - libata: mask swap internal and hardware tag
    - drm/i915/bdw: Increase IPS disable timeout to 100ms
    - drm/nouveau: Reset MST branching unit before enabling
    - drm/nouveau: Only write DP_MSTM_CTRL when needed
    - drm/nouveau: Remove duplicate poll_enable() in pmops_runtime_suspend()
    - ext4, dax: set ext4_dax_aops for dax files
    - crypto: skcipher - Fix -Wstringop-truncation warnings
    - iio: adc: ina2xx: avoid kthread_stop() with stale task_struct
    - tsl2550: fix lux1_input error in low light
    - vmci: type promotion bug in qp_host_get_user_memory()
    - x86/numa_emulation: Fix emulated-to-physical node mapping
    - staging: rts5208: fix missing error check on call to rtsx_write_register
    - power: supply: axp288_charger: Fix initial constant_charge_current value
    - misc: sram: enable clock before registering regions
    - serial: sh-sci: Stop RX FIFO timer during port shutdown
    - uwb: hwa-rc: fix memory leak at probe
    - power: vexpress: fix corruption in notifier registration
    - iommu/amd: make sure TLB to be flushed before IOVA freed
    - Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
    - USB: serial: kobil_sct: fix modem-status error handling
    - 6lowpan: iphc: reset mac_header after decompress to fix panic
    - iommu/msm: Don't call iommu_device_{,un}link from atomic context
    - s390/mm: correct allocate_pgste proc_handler callback
    - power: remove possible deadlock when unregistering power_supply
    - md-cluster: clear another node's suspend_area after the copy is finished
    - RDMA/bnxt_re: Fix a couple off by one bugs
    - RDMA/i40w: Hold read semaphore while looking after VMA
    - IB/core: type promotion bug in rdma_rw_init_one_mr()
    - media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
    - IB/mlx4: Test port number before querying type.
    - powerpc/kdump: Handle crashkernel memory reservation failure
    - media: fsl-viu: fix error handling in viu_of_probe()
    - media: staging/imx: fill vb2_v4l2_buffer field entry
    - x86/tsc: Add missing header to tsc_msr.c
    - ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled
    - x86/entry/64: Add two more instruction suffixes
    - ARM: dts: ls1021a: Add missing cooling device properties for CPUs
    - scsi: target/iscsi: Make iscsit_ta_authentication() respect the output
      buffer size
    - scsi: klist: Make it safe to use klists in atomic context
    - scsi: ibmvscsi: Improve strings handling
    - scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion
    - usb: wusbcore: security: cast sizeof to int for comparison
    - ath10k: sdio: use same endpoint id for all packets in a bundle
    - ath10k: sdio: set skb len for all rx packets
    - powerpc/powernv/ioda2: Reduce upper limit for DMA window size
    - s390/sysinfo: add missing #ifdef CONFIG_PROC_FS
    - alarmtimer: Prevent overflow for relative nanosleep
    - s390/dasd: correct numa_node in dasd_alloc_queue
    - s390/scm_blk: correct numa_node in scm_blk_dev_setup
    - s390/extmem: fix gcc 8 stringop-overflow warning
    - mtd: rawnand: atmel: add module param to avoid using dma
    - iio: accel: adxl345: convert address field usage in iio_chan_spec
    - posix-timers: Make forward callback return s64
    - ALSA: snd-aoa: add of_node_put() in error path
    - media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
    - media: soc_camera: ov772x: correct setting of banding filter
    - media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data
    - staging: android: ashmem: Fix mmap size validation
    - drivers/tty: add error handling for pcmcia_loop_config
    - media: tm6000: add error handling for dvb_register_adapter
    - net: phy: xgmiitorgmii: Check read_status results
    - ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
    - net: phy: xgmiitorgmii: Check phy_driver ready before accessing
    - drm/sun4i: Fix releasing node when enumerating enpoints
    - ath10k: transmit queued frames after processing rx packets
    - rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
    - brcmsmac: fix wrap around in conversion from constant to s16
    - ARM: mvebu: declare asm symbols as character arrays in pmsu.c
    - arm: dts: mediatek: Add missing cooling device properties for CPUs
    - HID: hid-ntrig: add error handling for sysfs_create_group
    - MIPS: boot: fix build rule of vmlinux.its.S
    - perf/x86/intel/lbr: Fix incomplete LBR call stack
    - scsi: bnx2i: add error handling for ioremap_nocache
    - iomap: complete partial direct I/O writes synchronously
    - scsi: megaraid_sas: Update controller info during resume
    - EDAC, i7core: Fix memleaks and use-after-free on probe and remove
    - ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
    - module: exclude SHN_UNDEF symbols from kallsyms api
    - gpio: Fix wrong rounding in gpio-menz127
    - nfsd: fix corrupted reply to badly ordered compound
    - EDAC: Fix memleak in module init error path
    - fs/lock: skip lock owner pid translation in case we are in init_pid_ns
    - Input: xen-kbdfront - fix multi-touch XenStore node's locations
    - iio: 104-quad-8: Fix off-by-one error in register selection
    - ARM: dts: dra7: fix DCAN node addresses
    - x86/mm: Expand static page table for fixmap space
    - tty: serial: lpuart: avoid leaking struct tty_struct
    - serial: cpm_uart: return immediately from console poll
    - intel_th: Fix device removal logic
    - spi: tegra20-slink: explicitly enable/disable clock
    - spi: sh-msiof: Fix invalid SPI use during system suspend
    - spi: sh-msiof: Fix handling of write value for SISTR register
    - spi: rspi: Fix invalid SPI use during system suspend
    - spi: rspi: Fix interrupted DMA transfers
    - regulator: fix crash caused by null driver data
    - USB: fix error handling in usb_driver_claim_interface()
    - USB: handle NULL config in usb_find_alt_setting()
    - usb: musb: dsps: do not disable CPPI41 irq in driver teardown
    - slub: make ->cpu_partial unsigned int
    - USB: usbdevfs: sanitize flags more
    - USB: usbdevfs: restore warning for nonsensical flags
    - USB: remove LPM management from usb_driver_claim_interface()
    - IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
    - IB/hfi1: Fix SL array bounds check
    - IB/hfi1: Invalid user input can result in crash
    - IB/hfi1: Fix context recovery when PBC has an UnsupportedVL
    - RDMA/uverbs: Atomically flush and mark closed the comp event queue
    - ovl: hash non-dir by lower inode for fsnotify
    - drm/i915: Remove vma from object on destroy, not close
    - serial: imx: restore handshaking irq for imx1
    - qed: Wait for ready indication before rereading the shmem
    - qed: Wait for MCP halt and resume commands to take place
    - qed: Prevent a possible deadlock during driver load and unload
    - qed: Avoid sending mailbox commands when MFW is not responsive
    - thermal: of-thermal: disable passive polling when thermal zone is disabled
    - isofs: reject hardware sector size > 2048 bytes
    - tls: possible hang when do_tcp_sendpages hits sndbuf is full case
    - bpf: sockmap: write_space events need to be passed to TCP handler
    - net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
    - e1000: check on netif_running() before calling e1000_up()
    - e1000: ensure to free old tx/rx rings in set_ringparam()
    - crypto: cavium/nitrox - fix for command corruption in queue full case with
      backlog submissions.
    - hwmon: (ina2xx) fix sysfs shunt resistor read access
    - hwmon: (adt7475) Make adt7475_read_word() return errors
    - Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping"
    - drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode
    - drm/amdgpu: Update power state at the end of smu hw_init.
    - ata: ftide010: Add a quirk for SQ201
    - nvme-fcloop: Fix dropped LS's to removed target port
    - ARM: dts: omap4-droid4: Fix emmc errors seen on some devices
    - arm/arm64: smccc-1.1: Make return values unsigned long
    - arm/arm64: smccc-1.1: Handle function result as parameters
    - i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
    - x86/pti: Fix section mismatch warning/error
    - media: v4l: event: Prevent freeing event subscriptions while accessed
    - drm/amd/display/dc/dce: Fix multiple potential integer overflows
    - drm/amd/display: fix use of uninitialized memory
    - RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c
    - vhost_net: Avoid tx vring kicks during busyloop
    - thermal: i.MX: Allow thermal probe to fail gracefully in case of bad
      calibration.
    - platform/x86: asus-wireless: Fix uninitialized symbol usage
    - ACPI / button: increment wakeup count only when notified
    - media: ov772x: add checks for register read errors
    - media: ov772x: allow i2c controllers without I2C_FUNC_PROTOCOL_MANGLING
    - drm/omap: gem: Fix mm_list locking
    - ASoC: rsnd: SSI parent cares SWSP bit
    - staging: pi433: fix race condition in pi433_ioctl
    - perf tests: Fix indexing when invoking subtests
    - gpio: tegra: Fix tegra_gpio_irq_set_type()
    - block: fix deadline elevator drain for zoned block devices
    - serial: mvebu-uart: Fix reporting of effective CSIZE to userspace
    - intel_th: Fix resource handling for ACPI glue layer
    - ext2, dax: set ext2_dax_aops for dax files
    - IB/hfi1: Fix destroy_qp hang after a link down
    - ARM: OMAP2+: Fix null hwmod for ti-sysc debug
    - ARM: OMAP2+: Fix module address for modules using mpu_rt_idx
    - bus: ti-sysc: Fix module register ioremap for larger offsets
    - drm/amdgpu: fix preamble handling
    - amdgpu: fix multi-process hang issue
    - tcp_bbr: add bbr_check_probe_rtt_done() helper
    - tcp_bbr: in restart from idle, see if we should exit PROBE_RTT
    - net: hns3: fix page_offset overflow when CONFIG_ARM64_64K_PAGES
    - ixgbe: fix driver behaviour after issuing VFLR
    - powerpc/pseries: Fix unitialized timer reset on migration

  * Kernel 4.15.0-50 or newer wont boot as Xen-DomU with PVH (LP: #1829378)
    - SAUCE: ACPI / bus: Fix NULL pointer dereference in
      acpi_quirk_matches_bios_ids()

  * CVE-2019-10126
    - mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()

  * CVE-2019-3846
    - mwifiex: Fix possible buffer overflows at parsing bss descriptor

  * CVE-2019-12818
    - net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails

  * CVE-2019-12984
    - nfc: Ensure presence of required attributes in the deactivate_target handler

  * Bionic update: upstream stable patchset 2019-07-10 (LP: #1836117)
    - i2c: xiic: Make the start and the byte count write atomic
    - i2c: i801: fix DNV's SMBCTRL register offset
    - scsi: lpfc: Correct MDS diag and nvmet configuration
    - nbd: don't allow invalid blocksize settings
    - block: bfq: swap puts in bfqg_and_blkg_put
    - android: binder: fix the race mmap and alloc_new_buf_locked
    - MIPS: VDSO: Match data page cache colouring when D$ aliases
    - SMB3: Backup intent flag missing for directory opens with backupuid mounts
    - smb3: check for and properly advertise directory lease support
    - Btrfs: fix data corruption when deduplicating between different files
    - KVM: s390: vsie: copy wrapping keys to right place
    - KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr
    - ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
    - cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun()
    - cpu/hotplug: Prevent state corruption on error rollback
    - x86/microcode: Make sure boot_cpu_data.microcode is up-to-date
    - x86/microcode: Update the new microcode revision unconditionally
    - crypto: aes-generic - fix aes-generic regression on powerpc
    - tpm: separate cmd_ready/go_idle from runtime_pm
    - ARC: [plat-axs*]: Enable SWAP
    - misc: mic: SCIF Fix scif_get_new_port() error handling
    - ethtool: Remove trailing semicolon for static inline
    - i2c: aspeed: Add an explicit type casting for *get_clk_reg_val
    - Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV
    - gpio: tegra: Move driver registration to subsys_init level
    - selftests/bpf: fix a typo in map in map test
    - media: davinci: vpif_display: Mix memory leak on probe error path
    - media: dw2102: Fix memleak on sequence of probes
    - net: phy: Fix the register offsets in Broadcom iProc mdio mux driver
    - blk-mq: fix updating tags depth
    - scsi: target: fix __transport_register_session locking
    - md/raid5: fix data corruption of replacements after originals dropped
    - timers: Clear timer_base::must_forward_clk with timer_base::lock held
    - media: camss: csid: Configure data type and decode format properly
    - gpu: ipu-v3: default to id 0 on missing OF alias
    - misc: ti-st: Fix memory leak in the error path of probe()
    - uio: potential double frees if __uio_register_device() fails
    - firmware: vpd: Fix section enabled flag on vpd_section_destroy
    - Drivers: hv: vmbus: Cleanup synic memory free path
    - tty: rocket: Fix possible buffer overwrite on register_PCI
    - f2fs: fix to active page in lru list for read path
    - f2fs: do not set free of current section
    - f2fs: fix defined but not used build warnings
    - perf tools: Allow overriding MAX_NR_CPUS at compile time
    - NFSv4.0 fix client reference leak in callback
    - perf c2c report: Fix crash for empty browser
    - perf evlist: Fix error out while applying initial delay and LBR
    - macintosh/via-pmu: Add missing mmio accessors
    - ath9k: report tx status on EOSP
    - ath9k_hw: fix channel maximum power level test
    - ath10k: prevent active scans on potential unusable channels
    - wlcore: Set rx_status boottime_ns field on rx
    - MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET
    - scsi: 3ware: fix return 0 on the error path of probe
    - tools/testing/nvdimm: kaddr and pfn can be NULL to ->direct_access()
    - ath10k: disable bundle mgmt tx completion event support
    - Bluetooth: hidp: Fix handling of strncpy for hid->name information
    - pinctrl: imx: off by one in imx_pinconf_group_dbg_show()
    - gpio: ml-ioh: Fix buffer underwrite on probe error path
    - pinctrl/amd: only handle irq if it is pending and unmasked
    - net: mvneta: fix mtu change on port without link
    - f2fs: try grabbing node page lock aggressively in sync scenario
    - f2fs: fix to skip GC if type in SSA and SIT is inconsistent
    - tpm_tis_spi: Pass the SPI IRQ down to the driver
    - tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
    - f2fs: fix to do sanity check with reserved blkaddr of inline inode
    - MIPS: Octeon: add missing of_node_put()
    - MIPS: generic: fix missing of_node_put()
    - net: dcb: For wild-card lookups, use priority -1, not 0
    - dm cache: only allow a single io_mode cache feature to be requested
    - Input: atmel_mxt_ts - only use first T9 instance
    - media: s5p-mfc: Fix buffer look up in s5p_mfc_handle_frame_{new, copy_time}
      functions
    - media: helene: fix xtal frequency setting at power on
    - f2fs: fix to wait on page writeback before updating page
    - f2fs: Fix uninitialized return in f2fs_ioc_shutdown()
    - iommu/ipmmu-vmsa: Fix allocation in atomic context
    - mfd: ti_am335x_tscadc: Fix struct clk memory leak
    - f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
    - NFSv4.1: Fix a potential layoutget/layoutrecall deadlock
    - MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
    - RDMA/cma: Do not ignore net namespace for unbound cm_id
    - inet: frags: change inet_frags_init_net() return value
    - inet: frags: add a pointer to struct netns_frags
    - inet: frags: refactor ipfrag_init()
    - inet: frags: refactor ipv6_frag_init()
    - inet: frags: refactor lowpan_net_frag_init()
    - ipv6: export ip6 fragments sysctl to unprivileged users
    - rhashtable: add schedule points
    - inet: frags: use rhashtables for reassembly units
    - inet: frags: remove some helpers
    - inet: frags: get rif of inet_frag_evicting()
    - inet: frags: remove inet_frag_maybe_warn_overflow()
    - inet: frags: break the 2GB limit for frags storage
    - inet: frags: do not clone skb in ip_expire()
    - ipv6: frags: rewrite ip6_expire_frag_queue()
    - rhashtable: reorganize struct rhashtable layout
    - inet: frags: reorganize struct netns_frags
    - inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
    - inet: frags: fix ip6frag_low_thresh boundary
    - ip: discard IPv4 datagrams with overlapping segments.
    - net: modify skb_rbtree_purge to return the truesize of all purged skbs.
    - ipv6: defrag: drop non-last frags smaller than min mtu
    - net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
    - mtd: ubi: wl: Fix error return code in ubi_wl_init()
    - tun: fix use after free for ptr_ring
    - tuntap: fix use after free during release
    - autofs: fix autofs_sbi() does not check super block type
    - KVM: PPC: Book3S HV: Use correct pagesize in kvm_unmap_radix()
    - ARC: [plat-axs*/plat-hsdk]: Allow U-Boot to pass MAC-address to the kernel
    - x86/apic/vector: Make error return value negative
    - tc-testing: flush gact actions on test teardown
    - pinctrl: berlin: fix 'pctrl->functions' allocation in
      berlin_pinctrl_build_state
    - powerpc/4xx: Fix error return path in ppc4xx_msi_probe()
    - scsi: qla2xxx: Fix unintended Logout
    - iwlwifi: pcie: don't access periphery registers when not available
    - f2fs: Keep alloc_valid_block_count in sync
    - f2fs: issue discard align to section in LFS mode
    - device-dax: avoid hang on error before devm_memremap_pages()
    - regulator: tps65217: Fix NULL pointer dereference on probe
    - gpio: pxa: disable pinctrl calls for PXA3xx
    - thermal_hwmon: Sanitize attribute name passed to hwmon
    - f2fs: fix to do sanity check with extra_attr feature
    - RDMA/hns: Add illegal hop_num judgement
    - RDMA/hns: Update the data type of immediate data
    - be2net: Fix memory leak in be_cmd_get_profile_config()
    - net/mlx5: Fix use-after-free in self-healing flow
    - net: qca_spi: Fix race condition in spi transfers
    - rds: fix two RCU related problems
    - net/mlx5: Check for error in mlx5_attach_interface
    - net/mlx5: Fix debugfs cleanup in the device init/remove flow
    - net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables
    - net/tls: Set count of SG entries if sk_alloc_sg returns -ENOSPC
    - erspan: fix error handling for erspan tunnel
    - erspan: return PACKET_REJECT when the appropriate tunnel is not found
    - tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY
    - usb: dwc3: change stream event enable bit back to 13
    - iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the
      PTE
    - ALSA: msnd: Fix the default sample sizes
    - ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
    - xfrm: fix 'passing zero to ERR_PTR()' warning
    - amd-xgbe: use dma_mapping_error to check map errors
    - gfs2: Special-case rindex for gfs2_grow
    - clk: imx6ul: fix missing of_node_put()
    - clk: core: Potentially free connection id
    - clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure
    - kbuild: add .DELETE_ON_ERROR special target
    - media: tw686x: Fix oops on buffer alloc failure
    - dmaengine: pl330: fix irq race with terminate_all
    - MIPS: ath79: fix system restart
    - media: videobuf2-core: check for q->error in vb2_core_qbuf()
    - IB/rxe: Drop QP0 silently
    - block: allow max_discard_segments to be stacked
    - IB/ipoib: Fix error return code in ipoib_dev_init()
    - mtd/maps: fix solutionengine.c printk format warnings
    - media: ov5645: Supported external clock is 24MHz
    - perf test: Fix subtest number when showing results
    - gfs2: Don't reject a supposedly full bitmap if we have blocks reserved
    - perf tools: Synthesize GROUP_DESC feature in pipe mode
    - fbdev: omapfb: off by one in omapfb_register_client()
    - perf tools: Fix struct comm_str removal crash
    - video: goldfishfb: fix memory leak on driver remove
    - fbdev/via: fix defined but not used warning
    - perf powerpc: Fix callchain ip filtering when return address is in a
      register
    - video: fbdev: pxafb: clear allocated memory for video modes
    - fbdev: Distinguish between interlaced and progressive modes
    - ARM: exynos: Clear global variable on init error path
    - perf powerpc: Fix callchain ip filtering
    - nvme-rdma: unquiesce queues when deleting the controller
    - powerpc/powernv: opal_put_chars partial write fix
    - staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout
    - staging: bcm2835-camera: handle wait_for_completion_timeout return properly
    - ASoC: rt5514: Fix the issue of the delay volume applied
    - MIPS: jz4740: Bump zload address
    - mac80211: restrict delayed tailroom needed decrement
    - Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets
    - wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc
    - reset: imx7: Fix always writing bits as 0
    - nfp: avoid buffer leak when FW communication fails
    - xen-netfront: fix queue name setting
    - arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
    - ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci
    - s390/qeth: fix race in used-buffer accounting
    - s390/qeth: reset layer2 attribute on layer switch
    - platform/x86: toshiba_acpi: Fix defined but not used build warnings
    - KVM: arm/arm64: Fix vgic init race
    - drivers/base: stop new probing during shutdown
    - i2c: aspeed: Fix initial values of master and slave state
    - dmaengine: mv_xor_v2: kill the tasklets upon exit
    - crypto: sharah - Unregister correct algorithms for SAHARA 3
    - xen-netfront: fix warn message as irq device name has '/'
    - RDMA/cma: Protect cma dev list with lock
    - pstore: Fix incorrect persistent ram buffer mapping
    - xen/netfront: fix waiting for xenbus state change
    - IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
    - mmc: omap_hsmmc: fix wakeirq handling on removal
    - ipmi: Fix I2C client removal in the SSIF driver
    - Tools: hv: Fix a bug in the key delete code
    - xhci: Fix use after free for URB cancellation on a reallocated endpoint
    - usb: Don't die twice if PCI xhci host is not responding in resume
    - mei: ignore not found client in the enumeration
    - mei: bus: need to unlink client before freeing
    - USB: Add quirk to support DJI CineSSD
    - usb: uas: add support for more quirk flags
    - usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
    - usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
    - USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
    - usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0
    - USB: net2280: Fix erroneous synchronization change
    - USB: serial: io_ti: fix array underflow in completion handler
    - usb: misc: uss720: Fix two sleep-in-atomic-context bugs
    - USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
    - USB: yurex: Fix buffer over-read in yurex_write()
    - Revert "cdc-acm: implement put_char() and flush_chars()"
    - cifs: prevent integer overflow in nxt_dir_entry()
    - CIFS: fix wrapping bugs in num_entries()
    - xtensa: ISS: don't allocate memory in platform_setup
    - perf/core: Force USER_DS when recording user stack data
    - NFSv4.1 fix infinite loop on I/O.
    - binfmt_elf: Respect error return from `regset->active'
    - net/mlx5: Add missing SET_DRIVER_VERSION command translation
    - arm64: dts: uniphier: Add missing cooling device properties for CPUs
    - audit: fix use-after-free in audit_add_watch
    - mtdchar: fix overflows in adjustment of `count`
    - Bluetooth: Use lock_sock_nested in bt_accept_enqueue
    - evm: Don't deadlock if a crypto algorithm is unavailable
    - KVM: PPC: Book3S HV: Add of_node_put() in success path
    - security: check for kstrdup() failure in lsm_append()
    - MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
    - configfs: fix registered group removal
    - pinctrl: rza1: Fix selector use for groups and functions
    - sched/core: Use smp_mb() in wake_woken_function()
    - efi/esrt: Only call efi_mem_reserve() for boot services memory
    - ARM: hisi: handle of_iomap and fix missing of_node_put
    - ARM: hisi: fix error handling and missing of_node_put
    - ARM: hisi: check of_iomap and fix missing of_node_put
    - liquidio: fix hang when re-binding VF host drv after running DPDK VF driver
    - gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes
    - tty: fix termios input-speed encoding when using BOTHER
    - tty: fix termios input-speed encoding
    - mmc: sdhci-of-esdhc: set proper dma mask for ls104x chips
    - mmc: tegra: prevent HS200 on Tegra 3
    - mmc: sdhci: do not try to use 3.3V signaling if not supported
    - drm/nouveau: Fix runtime PM leak in drm_open()
    - drm/nouveau/debugfs: Wake up GPU before doing any reclocking
    - drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
    - parport: sunbpp: fix error return code
    - sched/fair: Fix util_avg of new tasks for asymmetric systems
    - coresight: Handle errors in finding input/output ports
    - coresight: tpiu: Fix disabling timeouts
    - coresight: ETM: Add support for Arm Cortex-A73 and Cortex-A35
    - staging: bcm2835-audio: Don't leak workqueue if open fails
    - gpio: pxa: Fix potential NULL dereference
    - gpiolib: Mark gpio_suffixes array with __maybe_unused
    - mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
    - input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
    - drm/amdkfd: Fix error codes in kfd_get_process
    - rtc: bq4802: add error handling for devm_ioremap
    - ALSA: pcm: Fix snd_interval_refine first/last with open min/max
    - scsi: libfc: fixup 'sleeping function called from invalid context'
    - drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
    - blk-mq: only attempt to merge bio if there is rq in sw queue
    - blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()
    - pinctrl: msm: Fix msm_config_group_get() to be compliant
    - pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
    - clk: tegra: bpmp: Don't crash when a clock fails to register
    - mei: bus: type promotion bug in mei_nfc_if_version()
    - earlycon: Initialize port->uartclk based on clock-frequency property
    - earlycon: Remove hardcoded port->uartclk initialization in of_setup_earlycon
    - net/ipv6: prevent use after free in ip6_route_mpath_notify
    - Partial revert "e1000e: Avoid receiver overrun interrupt bursts"
    - e1000e: Fix queue interrupt re-raising in Other interrupt
    - e1000e: Avoid missed interrupts following ICR read
    - Revert "e1000e: Separate signaling for link check/link up"
    - e1000e: Fix link check race condition
    - e1000e: Fix check_for_link return value with autoneg off
    - tipc: orphan sock in tipc_release()
    - net/mlx5: Fix not releasing read lock when adding flow rules
    - iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
    - iwlwifi: cancel the injective function between hw pointers to tfd entry
      index
    - kbuild: do not update config when running install targets
    - omapfb: rename omap2 module to omap2fb.ko
    - [Config] Rename omapfb to omap2fb
    - perf script: Show correct offsets for DWARF-based unwinding
    - iommu/ipmmu-vmsa: IMUCTRn.TTSEL needs a special usage on R-Car Gen3
    - ipmi: Move BT capabilities detection to the detect call
    - ovl: fix oopses in ovl_fill_super() failure paths
    - usb: xhci: fix interrupt transfer error happened on MTK platforms
    - usb: mtu3: fix error of xhci port id when enable U3 dual role
    - dm verity: fix crash on bufio buffer that was allocated with vmalloc
    - cifs: integer overflow in in SMB2_ioctl()
    - perf tools: Fix maps__find_symbol_by_name()
    - NFSv4: Fix a tracepoint Oops in initiate_file_draining()
    - of: add helper to lookup compatible child node
    - mmc: meson-mx-sdio: fix OF child-node lookup
    - bpf: fix rcu annotations in compute_effective_progs()
    - spi: dw: fix possible race condition
    - PM / devfreq: use put_device() instead of kfree()
    - ASoC: hdmi-codec: fix routing
    - drm/amd/display: support access ddc for mst branch
    - rcutorture: Use monotonic timestamp for stall detection
    - selftests: vDSO - fix to return KSFT_SKIP when test couldn't be run
    - selftests/android: initialize heap_type to avoid compiling warning
    - scsi: lpfc: Fix NVME Target crash in defer rcv logic
    - scsi: lpfc: Fix panic if driver unloaded when port is offline
    - arm64: perf: Disable PMU while processing counter overflows
    - staging: fsl-dpaa2/eth: Fix DMA mapping direction
    - block/DAC960.c: fix defined but not used build warnings
    - IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlers

  * Bionic update: upstream stable patchset 2019-07-09 (LP: #1835972)
    - vti6: fix PMTU caching and reporting on xmit
    - xfrm: fix missing dst_release() after policy blocking lbcast and multicast
    - xfrm: free skb if nlsk pointer is NULL
    - esp6: fix memleak on error path in esp6_input
    - mac80211: add stations tied to AP_VLANs during hw reconfig
    - ext4: clear mmp sequence number when remounting read-only
    - nl80211: Add a missing break in parse_station_flags
    - drm/bridge: adv7511: Reset registers on hotplug
    - scsi: target: iscsi: cxgbit: fix max iso npdu calculation
    - scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
    - drm/imx: imx-ldb: disable LDB on driver bind
    - drm/imx: imx-ldb: check if channel is enabled before printing warning
    - nbd: don't requeue the same request twice.
    - nbd: handle unexpected replies better
    - usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in
      init_controller()
    - usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in
      r8a66597_queue()
    - usb: gadget: f_uac2: fix error handling in afunc_bind (again)
    - usb: gadget: u_audio: fix pcm/card naming in g_audio_setup()
    - usb: gadget: u_audio: update hw_ptr in iso_complete after data copied
    - usb: gadget: u_audio: remove caching of stream buffer parameters
    - usb: gadget: u_audio: remove cached period bytes value
    - usb: gadget: u_audio: protect stream runtime fields with stream spinlock
    - usb/phy: fix PPC64 build errors in phy-fsl-usb.c
    - tools: usb: ffs-test: Fix build on big endian systems
    - usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3'
    - netfilter: nft_set_hash: add rcu_barrier() in the nft_rhash_destroy()
    - bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd
    - netfilter: nf_tables: fix memory leaks on chain rename
    - netfilter: nf_tables: don't allow to rename to already-pending name
    - KVM: vmx: use local variable for current_vmptr when emulating VMPTRST
    - tools/power turbostat: fix -S on UP systems
    - net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
    - qed: Fix link flap issue due to mismatching EEE capabilities.
    - qed: Fix possible race for the link state value.
    - qed: Correct Multicast API to reflect existence of 256 approximate buckets.
    - atl1c: reserve min skb headroom
    - net: prevent ISA drivers from building on PPC32
    - can: mpc5xxx_can: check of_iomap return before use
    - can: m_can: Move accessing of message ram to after clocks are enabled
    - i2c: davinci: Avoid zero value of CLKH
    - perf/x86/amd/ibs: Don't access non-started event
    - media: staging: omap4iss: Include asm/cacheflush.h after generic includes
    - bnx2x: Fix invalid memory access in rss hash config path.
    - net: axienet: Fix double deregister of mdio
    - locking/rtmutex: Allow specifying a subclass for nested locking
    - i2c/mux, locking/core: Annotate the nested rt_mutex usage
    - sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE
    - x86/boot: Fix if_changed build flip/flop bug
    - selftests/ftrace: Add snapshot and tracing_on test case
    - ipc/sem.c: prevent queue.status tearing in semop
    - zswap: re-check zswap_is_full() after do zswap_shrink()
    - tools/power turbostat: Read extended processor family from CPUID
    - ARC: dma [non-IOC] setup SMP_CACHE_BYTES and cache_line_size
    - bpf: use GFP_ATOMIC instead of GFP_KERNEL in bpf_parse_prog()
    - nfp: flower: fix port metadata conversion bug
    - enic: handle mtu change for vf properly
    - ARC: [plat-eznps] Add missing struct nps_host_reg_aux_dpc
    - arc: [plat-eznps] fix data type errors in platform headers
    - arc: [plat-eznps] fix printk warning in arc/plat-eznps/mtm.c
    - arc: fix build errors in arc/include/asm/delay.h
    - arc: fix type warnings in arc/mm/cache.c
    - sparc/time: Add missing __init to init_tick_ops()
    - sparc: use asm-generic version of msi.h
    - enic: do not call enic_change_mtu in enic_probe
    - mm: delete historical BUG from zap_pmd_range()
    - drivers: net: lmc: fix case value for target abort error
    - memcg: remove memcg_cgroup::id from IDR on mem_cgroup_css_alloc() failure
    - gpiolib-acpi: make sure we trigger edge events at least once on boot
    - scsi: fcoe: fix use-after-free in fcoe_ctlr_els_send
    - scsi: fcoe: drop frames in ELS LOGO error path
    - scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED
    - mm/memory.c: check return value of ioremap_prot
    - mei: don't update offset in write
    - cifs: add missing debug entries for kconfig options
    - cifs: check kmalloc before use
    - smb3: enumerating snapshots was leaving part of the data off end
    - smb3: Do not send SMB3 SET_INFO if nothing changed
    - smb3: don't request leases in symlink creation and query
    - smb3: fill in statfs fsid and correct namelen
    - btrfs: use correct compare function of dirty_metadata_bytes
    - btrfs: don't leak ret from do_chunk_alloc
    - Btrfs: fix btrfs_write_inode vs delayed iput deadlock
    - iommu/arm-smmu: Error out only if not enough context interrupts
    - printk: Split the code for storing a message into the log buffer
    - printk: Create helper function to queue deferred console handling
    - printk/nmi: Prevent deadlock when accessing the main log buffer in NMI
    - kprobes/arm64: Fix %p uses in error messages
    - arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
    - arm64: dts: rockchip: corrected uart1 clock-names for rk3328
    - KVM: arm/arm64: Skip updating PMD entry if no change
    - KVM: arm/arm64: Skip updating PTE entry if no change
    - stop_machine: Reflow cpu_stop_queue_two_works()
    - ext4: check for NUL characters in extended attribute's name
    - ext4: sysfs: print ext4_super_block fields as little-endian
    - ext4: reset error code in ext4_find_entry in fallback
    - platform/x86: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too
    - x86/vdso: Fix vDSO build if a retpoline is emitted
    - x86/process: Re-export start_thread()
    - x86/kvm/vmx: Remove duplicate l1d flush definitions
    - fuse: Add missed unlock_page() to fuse_readpages_fill()
    - udl-kms: change down_interruptible to down
    - udl-kms: handle allocation failure
    - udl-kms: fix crash due to uninitialized memory
    - udl-kms: avoid division
    - b43legacy/leds: Ensure NUL-termination of LED name string
    - b43/leds: Ensure NUL-termination of LED name string
    - ASoC: dpcm: don't merge format from invalid codec dai
    - ASoC: zte: Fix incorrect PCM format bit usages
    - ASoC: sirf: Fix potential NULL pointer dereference
    - pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
    - x86/vdso: Fix lsl operand order
    - x86/irqflags: Mark native_restore_fl extern inline
    - x86/entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit()
    - s390/mm: fix addressing exception after suspend/resume
    - s390/numa: move initial setup of node_to_cpumask_map
    - kprobes/arm: Fix %p uses in error messages
    - kprobes: Make list and blacklist root user read only
    - MIPS: Correct the 64-bit DSP accumulator register size
    - MIPS: Always use -march=<arch>, not -<arch> shortcuts
    - MIPS: Change definition of cpu_relax() for Loongson-3
    - MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
    - tpm: Return the actual size when receiving an unsupported command
    - scsi: mpt3sas: Fix _transport_smp_handler() error path
    - scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
    - scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
    - clk: rockchip: fix clk_i2sout parent selection bits on rk3399
    - PM / clk: signedness bug in of_pm_clk_add_clks()
    - power: generic-adc-battery: fix out-of-bounds write when copying channel
      properties
    - power: generic-adc-battery: check for duplicate properties copied from iio
      channels
    - watchdog: Mark watchdog touch functions as notrace
    - gcc-plugins: Add include required by GCC release 8
    - gcc-plugins: Use dynamic initializers
    - Btrfs: fix send failure when root has deleted files still open
    - Btrfs: send, fix incorrect file layout after hole punching beyond eof
    - hwmon: (k10temp) 27C Offset needed for Threadripper2
    - KVM: arm/arm64: Fix potential loss of ptimer interrupts
    - KVM: arm/arm64: Fix lost IRQs from emulated physcial timer when blocked
    - perf kvm: Fix subcommands on s390
    - ext4: use ext4_warning() for sb_getblk failure
    - platform/x86: wmi: Do not mix pages and kmalloc
    - KVM: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd
    - lib/vsprintf: Do not handle %pO[^F] as %px
    - soc: qcom: rmtfs-mem: fix memleak in probe error paths
    - kprobes: Show blacklist addresses as same as kallsyms does
    - kprobes: Replace %p with other pointer types
    - MIPS: memset.S: Fix byte_fixup for MIPSr6
    - mtd: rawnand: qcom: wait for desc completion in all BAM channels
    - net: 6lowpan: fix reserved space for single frames
    - net: mac802154: tx: expand tailroom if necessary
    - 9p/net: Fix zero-copy path in the 9p virtio transport
    - spi: davinci: fix a NULL pointer dereference
    - spi: pxa2xx: Add support for Intel Ice Lake
    - spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe
    - spi: cadence: Change usleep_range() to udelay(), for atomic context
    - mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS
    - readahead: stricter check for bdi io_pages
    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case
    - block: really disable runtime-pm for blk-mq
    - drm/i915/userptr: reject zero user_size
    - libertas: fix suspend and resume for SDIO connected cards
    - media: Revert "[media] tvp5150: fix pad format frame height"
    - mailbox: xgene-slimpro: Fix potential NULL pointer dereference
    - Replace magic for trusting the secondary keyring with #define
    - powerpc/fadump: handle crash memory ranges array index overflow
    - powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
    - PCI: Add wrappers for dev_printk()
    - cxl: Fix wrong comparison in cxl_adapter_context_get()
    - ib_srpt: Fix a use-after-free in srpt_close_ch()
    - RDMA/rxe: Set wqe->status correctly if an unexpected response is received
    - 9p: fix multiple NULL-pointer-dereferences
    - fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
    - 9p/virtio: fix off-by-one error in sg list bounds check
    - net/9p/client.c: version pointer uninitialized
    - net/9p/trans_fd.c: fix race-condition by flushing workqueue before the
      kfree()
    - dm integrity: change 'suspending' variable from bool to int
    - dm thin: stop no_space_timeout worker when switching to write-mode
    - dm cache metadata: save in-core policy_hint_size to on-disk superblock
    - dm cache metadata: set dirty on all cache blocks after a crash
    - dm crypt: don't decrease device limits
    - uart: fix race between uart_put_char() and uart_shutdown()
    - Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind()
    - iio: sca3000: Fix missing return in switch
    - iio: ad9523: Fix displayed phase
    - iio: ad9523: Fix return value for ad952x_store()
    - extcon: Release locking when sending the notification of connector state
    - vmw_balloon: fix inflation of 64-bit GFNs
    - vmw_balloon: do not use 2MB without batching
    - vmw_balloon: VMCI_DOORBELL_SET does not check status
    - vmw_balloon: fix VMCI use when balloon built into kernel
    - rtc: omap: fix potential crash on power off
    - tracing: Do not call start/stop() functions when tracing_on does not change
    - tracing/blktrace: Fix to allow setting same value
    - printk/tracing: Do not trace printk_nmi_enter()
    - livepatch: Validate module/old func name length
    - uprobes: Use synchronize_rcu() not synchronize_sched()
    - mfd: hi655x: Fix regmap area declared size for hi655x
    - ovl: fix wrong use of impure dir cache in ovl_iterate()
    - drivers/block/zram/zram_drv.c: fix bug storing backing_dev
    - cpufreq: governor: Avoid accessing invalid governor_data
    - PM / sleep: wakeup: Fix build error caused by missing SRCU support
    - KVM: PPC: Book3S: Fix guest DMA when guest partially backed by THP pages
    - xtensa: limit offsets in __loop_cache_{all,page}
    - xtensa: increase ranges in ___invalidate_{i,d}cache_all
    - block, bfq: return nbytes and not zero from struct cftype .write() method
    - pnfs/blocklayout: off by one in bl_map_stripe()
    - NFSv4 client live hangs after live data migration recovery
    - NFSv4: Fix locking in pnfs_generic_recover_commit_reqs
    - NFSv4: Fix a sleep in atomic context in nfs4_callback_sequence()
    - ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
    - iommu/vt-d: Add definitions for PFSID
    - iommu/vt-d: Fix dev iotlb pfsid use
    - sys: don't hold uts_sem while accessing userspace memory
    - userns: move user access out of the mutex
    - ubifs: Fix memory leak in lprobs self-check
    - ubifs: Check data node size before truncate
    - ubifs: Fix synced_i_size calculation for xattr inodes
    - pwm: tiehrpwm: Don't use emulation mode bits to control PWM output
    - pwm: tiehrpwm: Fix disabling of output of PWMs
    - fb: fix lost console when the user unplugs a USB adapter
    - udlfb: set optimal write delay
    - libnvdimm: fix ars_status output length calculation
    - bcache: release dc->writeback_lock properly in bch_writeback_thread()
    - perf auxtrace: Fix queue resize
    - crypto: caam - fix DMA mapping direction for RSA forms 2 & 3
    - crypto: caam/jr - fix descriptor DMA unmapping
    - crypto: caam/qi - fix error path in xts setkey
    - arm64: mm: always enable CONFIG_HOLES_IN_ZONE
    - mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts
    - blkcg: Introduce blkg_root_lookup()
    - powerpc64/ftrace: Include ftrace.h needed for enable/disable calls
    - IB/mlx5: Fix leaking stack memory to userspace
    - rtc: omap: fix resource leak in registration error path
    - ACPICA: AML Parser: skip opcodes that open a scope upon parse failure
    - ALSA: ac97: fix device initialization in the compat layer
    - ALSA: ac97: fix check of pm_runtime_get_sync failure
    - ALSA: ac97: fix unbalanced pm_runtime_enable
    - nfsd: fix leaked file lock with nfs exported overlayfs
    - ubifs: Fix directory size calculation for symlinks
    - mm, dev_pagemap: Do not clear ->mapping on final put
    - act_ife: fix a potential use-after-free
    - ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT
      state
    - net: bcmgenet: use MAC link status for fixed phy
    - net: macb: do not disable MDIO bus at open/close time
    - qlge: Fix netdev features configuration.
    - r8169: add support for NCube 8168 network card
    - tcp: do not restart timewait timer on rst reception
    - vti6: remove !skb->ignore_df check from vti6_xmit()
    - net/sched: act_pedit: fix dump of extended layered op
    - tipc: fix a missing rhashtable_walk_exit()
    - nfp: wait for posted reconfigs when disabling the device
    - sctp: hold transport before accessing its asoc in sctp_transport_get_next
    - mlxsw: spectrum_switchdev: Do not leak RIFs when removing bridge
    - vhost: correctly check the iova range when waking virtqueue
    - hv_netvsc: ignore devices that are not PCI
    - act_ife: move tcfa_lock down to where necessary
    - act_ife: fix a potential deadlock
    - net: sched: action_ife: take reference to meta module
    - cifs: check if SMB2 PDU size has been padded and suppress the warning
    - hfsplus: don't return 0 when fill_super() failed
    - hfs: prevent crash on exit from failed search
    - sunrpc: Don't use stack buffer with scatterlist
    - fork: don't copy inconsistent signal handler state to child
    - reiserfs: change j_timestamp type to time64_t
    - hfsplus: fix NULL dereference in hfsplus_lookup()
    - fs/proc/kcore.c: use __pa_symbol() for KCORE_TEXT list entries
    - fat: validate ->i_start before using
    - scripts: modpost: check memory allocation results
    - virtio: pci-legacy: Validate queue pfn
    - x86/mce: Add notifier_block forward declaration
    - IB/hfi1: Invalid NUMA node information can cause a divide by zero
    - pwm: meson: Fix mux clock names
    - mm/fadvise.c: fix signed overflow UBSAN complaint
    - fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot()
    - platform/x86: intel_punit_ipc: fix build errors
    - netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses
    - s390/kdump: Fix memleak in nt_vmcoreinfo
    - ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
    - mfd: sm501: Set coherent_dma_mask when creating subdevices
    - platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360
    - netfilter: fix memory leaks on netlink_dump_start error
    - tcp, ulp: add alias for all ulp modules
    - RDMA/hns: Fix usage of bitmap allocation functions return values
    - net: hns3: Fix for command format parsing error in
      hclge_is_all_function_id_zero
    - perf tools: Check for null when copying nsinfo.
    - irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP
    - net/9p/trans_fd.c: fix race by holding the lock
    - net/9p: fix error path of p9_virtio_probe
    - powerpc/uaccess: Enable get_user(u64, *p) on 32-bit
    - powerpc: Fix size calculation using resource_size()
    - perf probe powerpc: Fix trace event post-processing
    - block: bvec_nr_vecs() returns value for wrong slab
    - s390/dasd: fix hanging offline processing due to canceled worker
    - s390/dasd: fix panic for failed online processing
    - ACPI / scan: Initialize status to ACPI_STA_DEFAULT
    - scsi: aic94xx: fix an error code in aic94xx_init()
    - NFSv4: Fix error handling in nfs4_sp4_select_mode()
    - Input: do not use WARN() in input_alloc_absinfo()
    - xen/balloon: fix balloon initialization for PVH Dom0
    - PCI: mvebu: Fix I/O space end address calculation
    - dm kcopyd: avoid softlockup in run_complete_job
    - staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice
    - ASoC: rt5677: Fix initialization of rt5677_of_match.data
    - iommu/omap: Fix cache flushes on L2 table entries
    - selftests/powerpc: Kill child processes on SIGINT
    - RDS: IB: fix 'passing zero to ERR_PTR()' warning
    - cfq: Suppress compiler warnings about comparisons
    - smb3: fix reset of bytes read and written stats
    - SMB3: Number of requests sent should be displayed for SMB3 not just CIFS
    - powerpc/platforms/85xx: fix t1042rdb_diu.c build errors & warning
    - powerpc/64s: Make rfi_flush_fallback a little more robust
    - powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX.
    - clk: rockchip: Add pclk_rkpwm_pmu to PMU critical clocks in rk3399
    - KVM: vmx: track host_state.loaded using a loaded_vmcs pointer
    - kvm: nVMX: Fix fault vector for VMX operation at CPL > 0
    - btrfs: Exit gracefully when chunk map cannot be inserted to the tree
    - btrfs: replace: Reset on-disk dev stats value after replace
    - btrfs: relocation: Only remove reloc rb_trees if reloc control has been
      initialized
    - btrfs: Don't remove block group that still has pinned down bytes
    - arm64: rockchip: Force CONFIG_PM on Rockchip systems
    - ARM: rockchip: Force CONFIG_PM on Rockchip systems
    - drm/i915/lpe: Mark LPE audio runtime pm as "no callbacks"
    - drm/amdgpu: Fix RLC safe mode test in gfx_v9_0_enter_rlc_safe_mode
    - drm/amd/pp/Polaris12: Fix a chunk of registers missed to program
    - drm/amdgpu: update tmr mc address
    - drm/amdgpu:add tmr mc address into amdgpu_firmware_info
    - drm/amdgpu:add new firmware id for VCN
    - drm/amdgpu:add VCN support in PSP driver
    - drm/amdgpu:add VCN booting with firmware loaded by PSP
    - debugobjects: Make stack check warning more informative
    - mm: Fix devm_memremap_pages() collision handling
    - HID: add quirk for another PIXART OEM mouse used by HP
    - usb: dwc3: core: Fix ULPI PHYs and prevent phy_get/ulpi_init during
      suspend/resume
    - x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear
    - x86/xen: don't write ptes directly in 32-bit PV guests
    - drm/i915: Increase LSPCON timeout
    - kbuild: make missing $DEPMOD a Warning instead of an Error
    - kvm: x86: Set highest physical address bits in non-present/reserved SPTEs
    - x86: kvm: avoid unused variable warning
    - arm64: cpu_errata: include required headers
    - ASoC: wm8994: Fix missing break in switch
    - arm64: Fix mismatched cache line size detection
    - arm64: Handle mismatched cache type
    - tipc: fix the big/little endian issue in tipc_dest
    - ip6_vti: fix a null pointer deference when destroy vti6 tunnel
    - workqueue: skip lockdep wq dependency in cancel_work_sync()
    - workqueue: re-add lockdep dependencies for flushing
    - apparmor: fix an error code in __aa_create_ns()
    - tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach
    - netfilter: x_tables: do not fail xt_alloc_table_info too easilly
    - ACPICA: ACPICA: add status check for acpi_hw_read before assigning return
      value
    - PCI: Match Root Port's MPS to endpoint's MPSS as necessary
    - coccicheck: return proper error code on fail
    - RISC-V: Use KBUILD_CFLAGS instead of KCFLAGS when building the vDSO
    - blk-mq: count the hctx as active before allocating tag
    - selinux: cleanup dentry and inodes on error in selinuxfs
    - drm/amd/display: Read back max backlight value at boot
    - btrfs: check-integrity: Fix NULL pointer dereference for degraded mount
    - btrfs: lift uuid_mutex to callers of btrfs_open_devices
    - btrfs: Fix a C compliance issue
    - drm/i915: Nuke the LVDS lid notifier
    - drm/edid: Quirk Vive Pro VR headset non-desktop.
    - drm/amd/display: fix type of variable
    - drm/amd/display: Don't share clk source between DP and HDMI
    - drm/amd/display: update clk for various HDMI color depths
    - drm/amd/display: Use requested HDMI aspect ratio
    - drm/rockchip: lvds: add missing of_node_put
    - drm/amd/display: Pass connector id when executing VBIOS CT
    - drm/amd/display: Check if clock source in use before disabling
    - drm/amdgpu: fix incorrect use of fcheck
    - drm/amdgpu: fix incorrect use of drm_file->pid
    - drm/i915: set DP Main Stream Attribute for color range on DDI platforms
    - x86/tsc: Prevent result truncation on 32bit

  * [Regression] Colour banding appears on Lenovo B50-80 integrated display
    (LP: #1788308) // Bionic update: upstream stable patchset 2019-07-09
    (LP: #1835972)
    - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo B50-80

  * CVE-2019-12819
    - mdio_bus: Fix use-after-free on device_register fails

  * proc_thermal flooding dmesg (LP: #1824690)
    - drivers: thermal: processor_thermal: Downgrade error message

  * Bionic update: upstream stable patchset 2019-07-08 (LP: #1835845)
    - bonding: avoid lockdep confusion in bond_get_stats()
    - inet: frag: enforce memory limits earlier
    - ipv4: frags: handle possible skb truesize change
    - net: dsa: Do not suspend/resume closed slave_dev
    - net: stmmac: Fix WoL for PCI-based setups
    - rxrpc: Fix user call ID check in rxrpc_service_prealloc_one
    - can: ems_usb: Fix memory leak on ems_usb_disconnect()
    - virtio_balloon: fix another race between migration and ballooning
    - x86/apic: Future-proof the TSC_DEADLINE quirk for SKX
    - kvm: x86: vmx: fix vpid leak
    - audit: fix potential null dereference 'context->module.name'
    - userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails
    - RDMA/uverbs: Expand primary and alt AV port checks
    - crypto: padlock-aes - Fix Nano workaround data corruption
    - drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats
    - scsi: sg: fix minor memory leak in error path
    - net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager
    - net/mlx5e: Set port trust mode to PCP as default
    - x86/efi: Access EFI MMIO data as unencrypted when SEV is active
    - drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check()
    - drm/atomic: Initialize variables in drm_atomic_helper_async_check() to make
      gcc happy
    - scsi: qla2xxx: Fix unintialized List head crash
    - scsi: qla2xxx: Fix NPIV deletion by calling wait_for_sess_deletion
    - scsi: qla2xxx: Fix ISP recovery on unload
    - scsi: qla2xxx: Return error when TMF returns
    - genirq: Make force irq threading setup more robust
    - nohz: Fix local_timer_softirq_pending()
    - nohz: Fix missing tick reprogram when interrupting an inline softirq
    - ring_buffer: tracing: Inherit the tracing setting to next ring buffer
    - i2c: imx: Fix reinit_completion() use
    - Btrfs: fix file data corruption after cloning a range and fsync
    - nvme-pci: allocate device queues storage space at probe
    - nvme-pci: Fix queue double allocations
    - xfs: catch inode allocation state mismatch corruption
    - xfs: validate cached inodes are free when allocated
    - perf/x86/intel/uncore: Fix hardcoded index of Broadwell extra PCI devices
    - parisc: Enable CONFIG_MLONGCALLS by default
    - parisc: Define mb() and add memory barriers to assembler unlock sequences
    - kasan: add no_sanitize attribute for clang builds
    - Mark HI and TASKLET softirq synchronous
    - xen/netfront: don't cache skb_shinfo()
    - scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management
      enabled
    - scsi: qla2xxx: Fix memory leak for allocating abort IOCB
    - init: rename and re-order boot_cpu_state_init()
    - root dentries need RCU-delayed freeing
    - make sure that __dentry_kill() always invalidates d_seq, unhashed or not
    - fix mntput/mntput race
    - fix __legitimize_mnt()/mntput() race
    - mtd: nand: qcom: Add a NULL check for devm_kasprintf()
    - phy: phy-mtk-tphy: use auto instead of force to bypass utmi signals
    - ARM: dts: imx6sx: fix irq for pcie bridge
    - kprobes/x86: Fix %p uses in error messages
    - x86/irqflags: Provide a declaration for native_save_fl
    - x86/apic: Ignore secondary threads if nosmt=force
    - x86/mm/kmmio: Make the tracer robust against L1TF
    - tools headers: Synchronise x86 cpufeatures.h for L1TF additions
    - x86/microcode: Allow late microcode loading with SMT disabled
    - x86/smp: fix non-SMP broken build due to redefinition of
      apic_id_is_primary_thread
    - cpu/hotplug: Non-SMP machines do not make use of booted_once
    - sched/deadline: Update rq_clock of later_rq when pushing a task
    - zram: remove BD_CAP_SYNCHRONOUS_IO with writeback feature
    - x86/l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled
    - x86: i8259: Add missing include file
    - kbuild: verify that $DEPMOD is installed
    - crypto: x86/sha256-mb - fix digest copy in sha256_mb_mgr_get_comp_job_avx2()
    - crypto: vmac - require a block cipher with 128-bit block size
    - crypto: vmac - separate tfm and request context
    - crypto: blkcipher - fix crash flushing dcache in error path
    - crypto: ablkcipher - fix crash flushing dcache in error path
    - crypto: skcipher - fix aligning block size in skcipher_copy_iv()
    - crypto: skcipher - fix crash flushing dcache in error path
    - x86/platform/UV: Mark memblock related init code and data correctly
    - dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()
    - l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
    - llc: use refcount_inc_not_zero() for llc_sap_find()
    - vsock: split dwork to avoid reinitializations
    - net_sched: Fix missing res info when create new tc_index filter
    - vhost: reset metadata cache when initializing new IOTLB
    - ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit
    - net: aquantia: Fix IFF_ALLMULTI flag functionality
    - ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
    - ALSA: hda - Turn CX8200 into D3 as well upon reboot
    - ALSA: vx222: Fix invalid endian conversions
    - ALSA: virmidi: Fix too long output trigger loop
    - ALSA: cs5535audio: Fix invalid endian conversion
    - ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
    - ALSA: memalloc: Don't exceed over the requested size
    - ALSA: vxpocket: Fix invalid endian conversions
    - USB: serial: sierra: fix potential deadlock at close
    - USB: serial: pl2303: add a new device id for ATEN
    - ACPI / PM: save NVS memory for ASUS 1025C laptop
    - tty: serial: 8250: Revert NXP SC16C2552 workaround
    - serial: 8250_exar: Read INT0 from slave device, too
    - serial: 8250_dw: always set baud rate in dw8250_set_termios
    - serial: 8250_dw: Add ACPI support for uart on Broadcom SoC
    - misc: sram: fix resource leaks in probe error path
    - Bluetooth: avoid killing an already killed socket
    - isdn: Disable IIOCDBGVAR
    - cls_matchall: fix tcf_unbind_filter missing
    - mlxsw: core_acl_flex_actions: Return error for conflicting actions
    - ip_vti: fix a null pointer deferrence when create vti fallback tunnel
    - net: ethernet: mvneta: Fix napi structure mixup on armada 3700
    - net: mvneta: fix mvneta_config_rss on armada 3700
    - EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
    - pty: fix O_CLOEXEC for TIOCGPTPEER
    - arm: dts: armada: Fix "#cooling-cells" property's name
    - vfio: ccw: fix error return in vfio_ccw_sch_event
    - perf tools: Fix error index for pmu event parser
    - Input: synaptics-rmi4 - fix axis-swap behavior
    - IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
    - drm/bridge/sii8620: fix loops in EDID fetch logic
    - drm/bridge/sii8620: fix potential buffer overflow
    - ARC: Explicitly add -mmedium-calls to CFLAGS
    - hwmon: (nct6775) Fix loop limit
    - soc: imx: gpcv2: correct PGC offset
    - usb: dwc3: pci: add support for Intel IceLake
    - usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc()
    - usb: dwc3: of-simple: fix use-after-free on remove
    - ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th
    - netfilter: ipv6: nf_defrag: reduce struct net memory waste
    - netfilter: nf_ct_helper: Fix possible panic after
      nf_conntrack_helper_unregister
    - selftests: pstore: return Kselftest Skip code for skipped tests
    - selftests: static_keys: return Kselftest Skip code for skipped tests
    - selftests: sysctl: return Kselftest Skip code for skipped tests
    - selftests: zram: return Kselftest Skip code for skipped tests
    - selftests: vm: return Kselftest Skip code for skipped tests
    - selftests: sync: add config fragment for testing sync framework
    - ARM: dts: NSP: Fix i2c controller interrupt type
    - ARM: dts: NSP: Fix PCIe controllers interrupt types
    - ARM: dts: BCM5301x: Fix i2c controller interrupt type
    - ARM: dts: Cygnus: Fix I2C controller interrupt type
    - ARM: dts: Cygnus: Fix PCIe controller interrupt type
    - arm64: dts: specify 1.8V EMMC capabilities for bcm958742k
    - arm64: dts: specify 1.8V EMMC capabilities for bcm958742t
    - arm64: dts: ns2: Fix I2C controller interrupt type
    - arm64: dts: ns2: Fix PCIe controller interrupt type
    - arm64: dts: Stingray: Fix I2C controller interrupt type
    - drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error
    - drm: mali-dp: Enable Global SE interrupts mask for DP500
    - drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format
    - IB/rxe: Fix missing completion for mem_reg work requests
    - usb: dwc2: alloc dma aligned buffer for isoc split in
    - usb: dwc2: fix isoc split in transfer with no data
    - usb: gadget: composite: fix delayed_status race condition when set_interface
    - usb: gadget: dwc2: fix memory leak in gadget_init()
    - dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation
    - xen: add error handling for xenbus_printf
    - pNFS: Always free the session slot on error in
      nfs4_layoutget_handle_exception
    - scsi: xen-scsifront: add error handling for xenbus_printf
    - xen/scsiback: add error handling for xenbus_printf
    - arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag
    - arm64: make secondary_start_kernel() notrace
    - qed: Fix possible memory leak in Rx error path handling.
    - qed: Add sanity check for SIMD fastpath handler.
    - qed: Do not advertise DCBX_LLD_MANAGED capability.
    - enic: initialize enic->rfs_h.lock in enic_probe
    - net: hamradio: use eth_broadcast_addr
    - net: propagate dev_get_valid_name return code
    - net: stmmac: socfpga: add additional ocp reset line for Stratix10
    - nvmet: reset keep alive timer in controller enable
    - block: sed-opal: Fix a couple off by one bugs
    - ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
    - nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag.
    - net: davinci_emac: match the mdio device against its compatible if possible
    - sctp: fix erroneous inc of snmp SctpFragUsrMsgs
    - KVM: arm/arm64: Drop resource size check for GICV window
    - drm/bridge/sii8620: fix display of packed pixel modes in MHL2
    - locking/lockdep: Do not record IRQ state within lockdep code
    - selftests: bpf: notification about privilege required to run test_kmod.sh
      testing script
    - mtd: dataflash: Use ULL suffix for 64-bit constants
    - x86/microcode/intel: Fix memleak in save_microcode_patch()
    - ipv6: mcast: fix unsolicited report interval after receiving querys
    - Smack: Mark inode instant in smack_task_to_inode
    - arm64: dts: msm8916: fix Coresight ETF graph connections
    - batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump
    - batman-adv: Fix bat_v best gw refcnt after netlink dump
    - batman-adv: Avoid storing non-TT-sync flags on singular entries too
    - batman-adv: Fix multicast TT issues with bogus ROAM flags
    - cxgb4: when disabling dcb set txq dcb priority to 0
    - iio: pressure: bmp280: fix relative humidity unit
    - brcmfmac: stop watchdog before detach and free everything
    - ARM: dts: am437x: make edt-ft5x06 a wakeup source
    - ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl
    - usb: xhci: remove the code build warning
    - usb: xhci: increase CRS timeout value
    - NFC: pn533: Fix wrong GFP flag usage
    - typec: tcpm: Fix a msecs vs jiffies bug
    - kconfig: fix line numbers for if-entries in menu tree
    - perf record: Support s390 random socket_id assignment
    - perf test session topology: Fix test on s390
    - perf report powerpc: Fix crash if callchain is empty
    - perf tools: Fix a clang 7.0 compilation error
    - perf bench: Fix numa report output code
    - ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD
    - netfilter: nf_log: fix uninit read in nf_log_proc_dostring
    - net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager
    - nfp: cast sizeof() to int when comparing with error code
    - selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
    - selftests/x86/sigreturn: Do minor cleanups
    - ARM: dts: da850: Fix interrups property for gpio
    - ARM64: dts: meson-gxl: fix Mali GPU compatible string
    - dmaengine: pl330: report BURST residue granularity
    - dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
    - ath10k: update the phymode along with bandwidth change request
    - md/raid10: fix that replacement cannot complete recovery after reassemble
    - dev-dax: check_vma: ratelimit dev_info-s
    - nl80211: relax ht operation checks for mesh
    - nl80211: check nla_parse_nested() return values
    - drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
    - drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
    - drm/exynos: decon5433: Fix WINCONx reset value
    - drbd: Fix drbd_request_prepare() discard handling
    - bpf, s390: fix potential memleak when later bpf_jit_prog fails
    - PCI: xilinx: Add missing of_node_put()
    - PCI: xilinx-nwl: Add missing of_node_put()
    - PCI: faraday: Add missing of_node_put()
    - bnx2x: Fix receiving tx-timeout in error or recovery state.
    - fsl/fman: fix parser reporting bad checksum on short frames
    - dpaa_eth: DPAA SGT needs to be 256B
    - acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value
    - openrisc: entry: Fix delay slot exception detection
    - m68k: fix "bad page state" oops on ColdFire boot
    - objtool: Support GCC 8 '-fnoreorder-functions'
    - ipvlan: call dev_change_flags when ipvlan mode is reset
    - drm/amdgpu: fix swapped emit_ib_size in vce3
    - x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all()
    - HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
    - ARM: imx_v4_v5_defconfig: Select ULPI support
    - bpf: hash map: decrement counter on error
    - tracing: Use __printf markup to silence compiler
    - kasan: fix shadow_size calculation error in kasan_module_alloc
    - smsc75xx: Add workaround for gigabit link up hardware errata.
    - drm/bridge/sii8620: Fix display of packed pixel modes
    - samples/bpf: add missing <linux/if_vlan.h>
    - samples/bpf: Check the result of system()
    - samples/bpf: Check the error of write() and read()
    - ieee802154: 6lowpan: set IFLA_LINK
    - netfilter: x_tables: set module owner for icmp(6) matches
    - ipv6: make ipv6_renew_options() interrupt/kernel safe
    - net: qrtr: Broadcast messages only from control port
    - sh_eth: fix invalid context bug while calling auto-negotiation by ethtool
    - sh_eth: fix invalid context bug while changing link options by ethtool
    - ravb: fix invalid context bug while calling auto-negotiation by ethtool
    - ravb: fix invalid context bug while changing link options by ethtool
    - ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
    - net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
    - nvmem: Don't let a NULL cell_id for nvmem_cell_get() crash us
    - ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
    - ieee802154: at86rf230: use __func__ macro for debug messages
    - ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
    - gpu: host1x: Check whether size of unpin isn't 0
    - drm/tegra: Fix comparison operator for buffer size
    - drm/armada: fix colorkey mode property
    - drm/armada: fix irq handling
    - netfilter: nft_compat: explicitly reject ERROR and standard target
    - netfilter: nf_conntrack: Fix possible possible crash on module loading.
    - ARC: Improve cmpxchg syscall implementation
    - bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic.
    - bnxt_en: Always set output parameters in bnxt_get_max_rings().
    - bnxt_en: Fix for system hang if request_irq fails
    - scsi: qedf: Send the driver state to MFW
    - scsi: qedi: Send driver state to MFW
    - perf llvm-utils: Remove bashism from kernel include fetch script
    - perf tools: Fix compilation errors on gcc8
    - perf script python: Fix dict reference counting
    - nfit: fix unchecked dereference in acpi_nfit_ctl
    - RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path
    - ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
    - ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary
      cores
    - ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
    - ixgbe: Be more careful when modifying MAC filters
    - tools: build: Use HOSTLDFLAGS with fixdep
    - kbuild: suppress warnings from 'getconf LFS_*'
    - packet: reset network header if packet shorter than ll reserved space
    - qlogic: check kstrtoul() for errors
    - tcp: remove DELAYED ACK events in DCTCP
    - pinctrl: ingenic: Fix inverted direction for < JZ4770
    - pinctrl: nsp: off by ones in nsp_pinmux_enable()
    - pinctrl: nsp: Fix potential NULL dereference
    - drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
    - net/ethernet/freescale/fman: fix cross-build error
    - ibmvnic: Fix error recovery on login failure
    - btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block()
    - octeon_mgmt: Fix MIX registers configuration on MTU setup
    - net: usb: rtl8150: demote allmulti message to dev_dbg()
    - PCI: OF: Fix I/O space page leak
    - PCI: versatile: Fix I/O space page leak
    - net: qca_spi: Avoid packet drop during initial sync
    - net: qca_spi: Make sure the QCA7000 reset is triggered
    - net: qca_spi: Fix log level if probe fails
    - tcp: identify cryptic messages as TCP seq # bugs
    - soc: imx: gpc: restrict register range for regmap access
    - ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems
    - ARM: dts: imx6: RDU2: fix irq type for mv88e6xxx switch
    - nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD
    - parisc: Remove ordered stores from syscall.S
    - xfrm_user: prevent leaking 2 bytes of kernel memory
    - netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
    - packet: refine ring v3 block size test to hold one frame
    - net/smc: no shutdown in state SMC_LISTEN
    - parisc: Remove unnecessary barriers from spinlock.h
    - PCI: hotplug: Don't leak pci_slot on registration failure
    - PCI: Skip MPS logic for Virtual Functions (VFs)
    - PCI: pciehp: Fix use-after-free on unplug
    - PCI: pciehp: Fix unprotected list iteration in IRQ handler
    - i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
    - i2c: imx: Fix race condition in dma read
    - reiserfs: fix broken xattr handling (heap corruption, bad retval)
    - updateconfigs for v4.14.67
    - IB/rxe: avoid double kfree skb
    - RDMA/qedr: Fix NULL pointer dereference when running over iWARP without
      RDMA-CM
    - smb3: increase initial number of credits requested to allow write
    - hwmon: (dell-smm) Disable fan support for Dell XPS13 9333
    - ARM: dts: HR2: Fix interrupt types for i2c and PCIe
    - drm/arm/malidp: Ensure that the crtcs are shutdown before removing any
      encoder/connector
    - drm/mali-dp: Rectify the width and height passed to rotmem_required()
    - dmaengine: ti: omap-dma: Fix OMAP1510 incorrect residue_granularity
    - nvme-rdma: fix possible double free condition when failing to create a
      controller
    - nvme-rdma: Fix command completion race at error recovery
    - nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl
    - clk: sunxi-ng: replace lib-y with obj-y
    - batman-adv: Fix debugfs path for renamed hardif
    - batman-adv: Fix debugfs path for renamed softif
    - nfp: bpf: don't stop offload if replace failed
    - perf tests: Add event parsing error handling to parse events test
    - perf script: Fix crash because of missing evsel->priv
    - perf tools: Fix crash caused by accessing feat_ops[HEADER_LAST_FEATURE]
    - s390/qeth: consistently re-enable device features
    - sched/fair: Fix bandwidth timer clock drift condition
    - r8169: fix mac address change
    - RISC-V: Don't include irq-riscv-intc.h
    - RISC-V: Fix PTRACE_SETREGSET bug.
    - net: qrtr: Reset the node and port ID of broadcast messages
    - cxgb4: assume flash part size to be 4MB, if it can't be determined
    - bpf: fix sk_skb programs without skb->dev assigned
    - ipfrag: really prevent allocation on netns exit
    - gpu: host1x: Skip IOMMU initialization if firewall is enabled
    - ARC: [plat-hsdk]: Configure APB GPIO controller on ARC HSDK platform
    - bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs.
    - scsi: hpsa: correct enclosure sas address
    - perf tools: Use python-config --includes rather than --cflags
    - sfp: ensure we clean up properly on bus registration failure
    - amd/dc/dce100: On dce100, set clocks to 0 on suspend
    - tools: build: Fixup host c flags
    - kvm: nVMX: Restore exit qual for VM-entry failure due to MSR loading
    - ibmvnic: Revise RX/TX queue error messages
    - net/smc: reset recv timeout after clc handshake
    - PCI: xgene: Fix I/O space page leak
    - PCI: designware: Fix I/O space page leak
    - PCI: aardvark: Fix I/O space page leak
    - PCI: faraday: Fix I/O space page leak
    - PCI: mediatek: Fix I/O space page leak
    - PCI: v3-semi: Fix I/O space page leak
    - platform/x86: dell-laptop: Fix backlight detection
    - mm: use helper functions for allocating and freeing vm_area structs
    - mm: make vm_area_dup() actually copy the old vma data
    - mm: make vm_area_alloc() initialize core fields
    - PCI / ACPI / PM: Resume all bridges on suspend-to-RAM

 -- Sultan Alsawaf <sultan.alsawaf@canonical.com>  Wed, 24 Jul 2019 09:50:49 -0600

linux (4.15.0-55.60) bionic; urgency=medium

  * linux: 4.15.0-55.60 -proposed tracker (LP: #1834954)

  * Request backport of ceph commits into bionic (LP: #1834235)
    - ceph: use atomic_t for ceph_inode_info::i_shared_gen
    - ceph: define argument structure for handle_cap_grant
    - ceph: flush pending works before shutdown super
    - ceph: send cap releases more aggressively
    - ceph: single workqueue for inode related works
    - ceph: avoid dereferencing invalid pointer during cached readdir
    - ceph: quota: add initial infrastructure to support cephfs quotas
    - ceph: quota: support for ceph.quota.max_files
    - ceph: quota: don't allow cross-quota renames
    - ceph: fix root quota realm check
    - ceph: quota: support for ceph.quota.max_bytes
    - ceph: quota: update MDS when max_bytes is approaching
    - ceph: quota: add counter for snaprealms with quota
    - ceph: avoid iput_final() while holding mutex or in dispatch thread

  * QCA9377 isn't being recognized sometimes (LP: #1757218)
    - SAUCE: USB: Disable USB2 LPM at shutdown

  * hns: fix ICMP6 neighbor solicitation messages discard problem (LP: #1833140)
    - net: hns: fix ICMP6 neighbor solicitation messages discard problem
    - net: hns: fix unsigned comparison to less than zero

  * Fix occasional boot time crash in hns driver (LP: #1833138)
    - net: hns: Fix probabilistic memory overwrite when HNS driver initialized

  *  use-after-free in hns_nic_net_xmit_hw (LP: #1833136)
    - net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()

  * hns: attempt to restart autoneg when disabled should report error
    (LP: #1833147)
    - net: hns: Restart autoneg need return failed when autoneg off

  * systemd 237-3ubuntu10.14 ADT test failure on Bionic ppc64el (test-seccomp)
    (LP: #1821625)
    - powerpc: sys_pkey_alloc() and sys_pkey_free() system calls
    - powerpc: sys_pkey_mprotect() system call

  * [UBUNTU] pkey: Indicate old mkvp only if old and curr. mkvp are different
    (LP: #1832625)
    - pkey: Indicate old mkvp only if old and current mkvp are different

  * [UBUNTU] kernel: Fix gcm-aes-s390 wrong scatter-gather list processing
    (LP: #1832623)
    - s390/crypto: fix gcm-aes-s390 selftest failures

  * System crashes on hot adding a core with drmgr command (4.15.0-48-generic)
    (LP: #1833716)
    - powerpc/numa: improve control of topology updates
    - powerpc/numa: document topology_updates_enabled, disable by default

  * Kernel modules generated incorrectly when system is localized to a non-
    English language (LP: #1828084)
    - scripts: override locale from environment when running recordmcount.pl

  * [UBUNTU] kernel: Fix wrong dispatching for control domain CPRBs
    (LP: #1832624)
    - s390/zcrypt: Fix wrong dispatching for control domain CPRBs

  * CVE-2019-11815
    - net: rds: force to destroy connection if t_sock is NULL in
      rds_tcp_kill_sock().

  * Sound device not detected after resume from hibernate (LP: #1826868)
    - drm/i915: Force 2*96 MHz cdclk on glk/cnl when audio power is enabled
    - drm/i915: Save the old CDCLK atomic state
    - drm/i915: Remove redundant store of logical CDCLK state
    - drm/i915: Skip modeset for cdclk changes if possible

  * Handle overflow in proc_get_long of sysctl (LP: #1833935)
    - sysctl: handle overflow in proc_get_long

  * Dell XPS 13 (9370) defaults to s2idle sleep/suspend instead of deep, NVMe
    drains lots of power under s2idle (LP: #1808957)
    - Revert "UBUNTU: SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3
      and being disabled"
    - Revert "UBUNTU: SAUCE: nvme: add quirk to not call disable function when
      suspending"
    - Revert "UBUNTU: SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3"
    - Revert "SAUCE: nvme: add quirk to not call disable function when suspending"
    - Revert "SAUCE: pci: prevent sk hynix nvme from entering D3"
    - PCI: PM: Avoid possible suspend-to-idle issue
    - PCI: PM: Skip devices in D0 for suspend-to-idle
    - nvme-pci: Sync queues on reset
    - nvme: Export get and set features
    - nvme-pci: Use host managed power state for suspend

  * linux v4.15 ftbfs on a newer host kernel (e.g. hwe) (LP: #1823429)
    - selinux: use kernel linux/socket.h for genheaders and mdp

  * 32-bit x86 kernel 4.15.0-50 crash in vmalloc_sync_all (LP: #1830433)
    - x86/mm/pat: Disable preemption around __flush_tlb_all()
    - x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
    - x86/mm: Disable ioremap free page handling on x86-PAE
    - ioremap: Update pgtable free interfaces with addr
    - x86/mm: Add TLB purge to free pmd/pte page interfaces
    - x86/init: fix build with CONFIG_SWAP=n
    - x86/mm: provide pmdp_establish() helper
    - x86/mm: Use WRITE_ONCE() when setting PTEs

  * hinic: fix oops due to race in set_rx_mode (LP: #1832048)
    - hinic: fix a bug in set rx mode

  * ubuntu 18.04 flickering screen with Radeon X1600 (LP: #1791312)
    - drm/radeon: prefer lower reference dividers

  * Login screen never appears on vmwgfx using bionic kernel 4.15 (LP: #1832138)
    - drm/vmwgfx: use monotonic event timestamps

  * [linux-azure] Block Layer Commits Requested in Azure Kernels (LP: #1834499)
    - block: Clear kernel memory before copying to user
    - block/bio: Do not zero user pages

  * CONFIG_LOG_BUF_SHIFT set to 14 is too low on arm64 (LP: #1824864)
    - [Config] CONFIG_LOG_BUF_SHIFT=18 on all 64bit arches

  * Handle overflow for file-max (LP: #1834310)
    - sysctl: handle overflow for file-max
    - kernel/sysctl.c: fix out-of-bounds access when setting file-max

  * [ALSA] [PATCH] Headset fixup for System76 Gazelle (gaze14) (LP: #1827555)
    - ALSA: hda/realtek - Headset fixup for System76 Gazelle (gaze14)
    - ALSA: hda/realtek - Corrected fixup for System76 Gazelle (gaze14)

  * crashdump fails on HiSilicon D06 (LP: #1828868)
    - iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in kdump kernel
    - iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel

  * CVE-2019-11833
    - ext4: zero out the unused memory region in the extent tree block

  * zfs 0.7.9 fixes a bug (https://github.com/zfsonlinux/zfs/pull/7343) that
    hangs the system completely (LP: #1772412)
    - SAUCE: (noup) Update zfs to 0.7.5-1ubuntu16.6

  * does not detect headphone when there is no other output devices
    (LP: #1831065)
    - ALSA: hda/realtek - Fixed hp_pin no value
    - ALSA: hda/realtek - Use a common helper for hp pin reference

  * kernel crash : net_sched  race condition in tcindex_destroy() (LP: #1825942)
    - net_sched: fix NULL pointer dereference when delete tcindex filter
    - RCU, workqueue: Implement rcu_work
    - net_sched: switch to rcu_work
    - net_sched: fix a race condition in tcindex_destroy()
    - net_sched: fix a memory leak in cls_tcindex
    - net_sched: initialize net pointer inside tcf_exts_init()
    - net_sched: fix two more memory leaks in cls_tcindex

  * Support new ums-realtek device (LP: #1831840)
    - USB: usb-storage: Add new ID to ums-realtek

  * amd_iommu possible data corruption (LP: #1823037)
    - iommu/amd: Reserve exclusion range in iova-domain
    - iommu/amd: Set exclusion range correctly

  * Add new sound card PCIID into the alsa driver (LP: #1832299)
    - ALSA: hda: Add Icelake PCI ID
    - ALSA: hda/intel: add CometLake PCI IDs

  * sky2 ethernet card doesn't work after returning from suspend
    (LP: #1807259) // sky2 ethernet card link not up after suspend
    (LP: #1809843)
    - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79

  * idle-page oopses when accessing page frames that are out of range
    (LP: #1833410)
    - mm/page_idle.c: fix oops because end_pfn is larger than max_pfn

  * Add pointstick support on HP ZBook 17 G5 (LP: #1833387)
    - Revert "HID: multitouch: Support ALPS PTP stick with pid 0x120A"
    - SAUCE: HID: multitouch: Add pointstick support for ALPS Touchpad

  * [SRU][B/B-OEM/B-OEM-OSP-1/C/D/E] Add trackpoint middle button support of 2
    new thinpads (LP: #1833637)
    - Input: elantech - enable middle button support on 2 ThinkPads

  * CVE-2019-11085
    - drm/i915/gvt: Fix mmap range check
    - drm/i915: make mappable struct resource centric
    - drm/i915/gvt: Fix aperture read/write emulation when enable x-no-mmap=on

  * CVE-2019-11884
    - Bluetooth: hidp: fix buffer overflow

  * af_alg06 test from crypto test suite in LTP failed with kernel oops on B/C
    (LP: #1829725)
    - crypto: authenc - fix parsing key with misaligned rta_len

  * CVE-2018-12126 // CVE-2018-12127 // CVE-2018-12130 // CVE-2019-11091
    - SAUCE: Synchronize MDS mitigations with upstream
    - Documentation: Correct the possible MDS sysfs values
    - x86/speculation/mds: Fix documentation typo

  * CVE-2019-11091
    - x86/mds: Add MDSUM variant to the MDS documentation

  * alignment test in powerpc from ubuntu_kernel_selftests failed on B/C Power9
    (LP: #1813118)
    - selftests/powerpc: Remove Power9 copy_unaligned test

  * TRACE_syscall.ptrace_syscall_dropped in seccomp from ubuntu_kernel_selftests
    failed on B/C PowerPC (LP: #1812796)
    - selftests/seccomp: Enhance per-arch ptrace syscall skip tests

  * Add powerpc/alignment_handler test for selftests (LP: #1828935)
    - selftests/powerpc: Add alignment handler selftest
    - selftests/powerpc: Fix to use ucontext_t instead of struct ucontext

  * Cannot build kernel 4.15.0-48.51 due to an in-source-tree ZFS module.
    (LP: #1828763)
    - SAUCE: (noup) Update zfs to 0.7.5-1ubuntu16.5

  * Eletrical noise occurred when external headset enter powersaving mode on a
    DEll machine (LP: #1828798)
    - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone
    - ALSA: hda/realtek - Fixup headphone noise via runtime suspend

  * [18.04/18.10] File libperf-jvmti.so is missing in linux-tools-common deb on
    Ubuntu (LP: #1761379)
    - [Packaging] Support building libperf-jvmti.so

  * TCP : race condition on socket ownership in tcp_close() (LP: #1830813)
    - tcp: do not release socket ownership in tcp_close()

  * bionic: netlink: potential shift overflow in netlink_bind() (LP: #1831103)
    - netlink: Don't shift on 64 for ngroups

  * Add support to Comet Lake LPSS (LP: #1830175)
    - mfd: intel-lpss: Add Intel Comet Lake PCI IDs

  * Reduce NAPI weight in hns driver from 256 to 64 (LP: #1830587)
    - net: hns: Use NAPI_POLL_WEIGHT for hns driver

  * x86: add support for AMD Rome (LP: #1819485)
    - x86: irq_remapping: Move irq remapping mode enum
    - iommu/amd: Add support for higher 64-bit IOMMU Control Register
    - iommu/amd: Add support for IOMMU XT mode
    - hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs
    - hwmon/k10temp: Add support for AMD family 17h, model 30h CPUs
    - x86/amd_nb: Add PCI device IDs for family 17h, model 30h
    - x86/MCE/AMD: Fix the thresholding machinery initialization order
    - x86/amd_nb: Add support for newer PCI topologies

  * nx842 - CRB request time out (-110) when uninstall NX modules and initiate
    NX request (LP: #1827755)
    - crypto/nx: Initialize 842 high and normal RxFIFO control registers

  * Require improved hypervisor detection patch in Ubuntu 18.04 (LP: #1829972)
    - s390/early: improve machine detection

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 02 Jul 2019 18:41:49 +0200

linux (4.15.0-54.58) bionic; urgency=medium

  * linux: 4.15.0-54.58 -proposed tracker (LP: #1833987)

  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()

  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 24 Jun 2019 11:39:50 +0200

linux (4.15.0-52.56) bionic; urgency=medium

  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638)
    - SAUCE: tcp: tcp_fragment() should apply sane memory limits

  * Remote denial of service (system crash) caused by integer overflow in TCP
    SACK handling (LP: #1831637)
    - SAUCE: tcp: limit payload size of sacked skbs

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 04 Jun 2019 17:33:24 -0300

linux (4.15.0-51.55) bionic; urgency=medium

  * linux: 4.15.0-51.55 -proposed tracker (LP: #1829219)

  * disable a.out support (LP: #1818552)
    - [Config] Disable a.out support

  * [UBUNTU] qdio: clear intparm during shutdown (LP: #1828394)
    - s390/qdio: clear intparm during shutdown

  * ftrace in ubuntu_kernel_selftests hang with Cosmic kernel (LP: #1826385)
    - kprobes/x86: Fix instruction patching corruption when copying more than one
      RIP-relative instruction

  * touchpad not working on lenovo yoga 530 (LP: #1787775)
    - Revert "UBUNTU: SAUCE: i2c:amd Depends on ACPI"
    - Revert "UBUNTU: SAUCE: i2c:amd move out pointer in union i2c_event_base"
    - Revert "UBUNTU: SAUCE: i2c:amd I2C Driver based on PCI Interface for
      upcoming platform"
    - i2c: add helpers to ease DMA handling
    - i2c: add a message flag for DMA safe buffers
    - i2c: add extra check to safe DMA buffer helper
    - i2c: Add drivers for the AMD PCIe MP2 I2C controller
    - [Config] Update config for AMD MP2 I2C driver
    - [Config] Update I2C_AMD_MP2 annotations

  * tm-unavailable in powerpc/tm failed on Bionic Power9 (LP: #1813129)
    - selftests/powerpc: Check for pthread errors in tm-unavailable
    - selftests/powerpc: Skip tm-unavailable if TM is not enabled

  * cp_abort in powerpc/context_switch from ubunut_kernel_selftests failed on
    Bionic P9 (LP: #1813134)
    - selftests/powerpc: Remove redundant cp_abort test

  * bionic/linux: completely remove snapdragon files from sources (LP: #1827880)
    - [Packaging] remove snapdragon dead files
    - [Config] update configs after snapdragon removal

  * The noise keeps occurring when Headset is plugged in on a Dell machine
    (LP: #1827972)
    - ALSA: hda/realtek - Fixed Dell AIO speaker noise

  * Geneve tunnels don't work when ipv6 is disabled (LP: #1794232)
    - geneve: correctly handle ipv6.disable module parameter

  * There are 4 HDMI/Displayport audio output listed in sound setting without
    attach any HDMI/DP monitor (LP: #1827967)
    - ALSA: hda/hdmi - Read the pin sense from register when repolling
    - ALSA: hda/hdmi - Consider eld_valid when reporting jack event

  * Headphone jack switch sense is inverted: plugging in headphones disables
    headphone output (LP: #1824259)
    - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board

  * CTAUTO:DevOps:860.50:devops4fp1:Error occurred during LINUX Dmesg error
    Checking for all LINUX clients for devops4p10 (LP: #1766201)
    - SAUCE: integrity: downgrade error to warning

  * Screen freeze after resume from S3 when HDMI monitor plugged on Dell
    Precision 7740 (LP: #1825958)
    - PCI: Restore resized BAR state on resume

  * potential memory corruption on arm64 on dev release (LP: #1827437)
    - driver core: Postpone DMA tear-down until after devres release

  * powerpc/pmu/ebb test in ubuntu_kernel_selftest failed with "error while
    loading shared libraries" on Bionic/Cosmic PowerPC (LP: #1812805)
    - selftests/powerpc/pmu: Link ebb tests with -no-pie

  * unnecessary request_queue freeze (LP: #1815733)
    - block: avoid setting nr_requests to current value
    - block: avoid setting none scheduler if it's already none

  * Kprobe event string type argument failed in ftrace from
    ubuntu_kernel_selftests on B/C i386 (LP: #1825780)
    - selftests/ftrace: Fix kprobe string testcase to not probe notrace function

  * hns: fix socket accounting (LP: #1826911)
    - net: hns: fix skb->truesize underestimation

  * False positive test result in run_netsocktests from net in
    ubuntu_kernel_selftest (LP: #1825777)
    - selftests/net: correct the return value for run_netsocktests

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 15 May 2019 14:48:35 +0200

linux (4.15.0-50.54) bionic; urgency=medium

  * CVE-2018-12126 // CVE-2018-12127 // CVE-2018-12130
    - Documentation/l1tf: Fix small spelling typo
    - x86/cpu: Sanitize FAM6_ATOM naming
    - kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
    - locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a
      new <linux/bits.h> file
    - tools include: Adopt linux/bits.h
    - x86/msr-index: Cleanup bit defines
    - x86/speculation: Consolidate CPU whitelists
    - x86/speculation/mds: Add basic bug infrastructure for MDS
    - x86/speculation/mds: Add BUG_MSBDS_ONLY
    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
    - x86/speculation/mds: Add mds_clear_cpu_buffers()
    - x86/speculation/mds: Clear CPU buffers on exit to user
    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
    - x86/speculation/mds: Add mitigation control for MDS
    - x86/speculation/mds: Add sysfs reporting for MDS
    - x86/speculation/mds: Add mitigation mode VMWERV
    - Documentation: Move L1TF to separate directory
    - Documentation: Add MDS vulnerability documentation
    - x86/speculation/mds: Add mds=full,nosmt cmdline option
    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
    - x86/speculation/mds: Add SMT warning message
    - x86/speculation/mds: Fix comment
    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
    - x86/speculation/mds: Add 'mitigations=' support for MDS

  * CVE-2017-5715 // CVE-2017-5753
    - s390/speculation: Support 'mitigations=' cmdline option

  * CVE-2017-5715 // CVE-2017-5753 // CVE-2017-5754 // CVE-2018-3639
    - powerpc/speculation: Support 'mitigations=' cmdline option

  * CVE-2017-5715 // CVE-2017-5754 // CVE-2018-3620 // CVE-2018-3639 //
    CVE-2018-3646
    - cpu/speculation: Add 'mitigations=' cmdline option
    - x86/speculation: Support 'mitigations=' cmdline option

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 06 May 2019 18:59:24 +0200

linux (4.15.0-49.53) bionic; urgency=medium

  * linux: 4.15.0-49.53 -proposed tracker (LP: #1826358)

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870)
    - powerpc/64s: Add support for ori barrier_nospec patching
    - powerpc/64s: Patch barrier_nospec in modules
    - powerpc/64s: Enable barrier_nospec based on firmware settings
    - powerpc: Use barrier_nospec in copy_from_user()
    - powerpc/64: Use barrier_nospec in syscall entry
    - powerpc/64s: Enhance the information in cpu_show_spectre_v1()
    - powerpc/64: Disable the speculation barrier from the command line
    - powerpc/64: Make stf barrier PPC_BOOK3S_64 specific.
    - powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
    - powerpc/64: Call setup_barrier_nospec() from setup_arch()
    - powerpc/64: Make meltdown reporting Book3S 64 specific
    - powerpc/lib/code-patching: refactor patch_instruction()
    - powerpc/lib/feature-fixups: use raw_patch_instruction()
    - powerpc/asm: Add a patch_site macro & helpers for patching instructions
    - powerpc/64s: Add new security feature flags for count cache flush
    - powerpc/64s: Add support for software count cache flush
    - powerpc/pseries: Query hypervisor for count cache flush settings
    - powerpc/powernv: Query firmware for count cache flush settings
    - powerpc/fsl: Add nospectre_v2 command line argument
    - KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char()
    - [Config] Add CONFIG_PPC_BARRIER_NOSPEC

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

  * autopkgtests run too often, too much and don't skip enough (LP: #1823056)
    - [Debian] Set +x on rebuild testcase.
    - [Debian] Skip rebuild test, for regression-suite deps.
    - [Debian] Make ubuntu-regression-suite skippable on unbootable kernels.
    - [Debian] make rebuild use skippable error codes when skipping.
    - [Debian] Only run regression-suite, if requested to.

  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
    - [Packaging] remove arm64 snapdragon from getabis
    - [Config] config changes for snapdragon split
    - packaging: arm64: disable building the snapdragon flavour
    - [Packaging] arm64: Drop snapdragon from kernel-versions

  * CVE-2017-5753
    - KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()
    - media: dvb_ca_en50221: prevent using slot_info for Spectre attacs
    - sysvipc/sem: mitigate semnum index against spectre v1
    - libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
    - s390/keyboard: sanitize array index in do_kdsk_ioctl
    - arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
    - KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr()
    - pktcdvd: Fix possible Spectre-v1 for pkt_devs
    - net: socket: fix potential spectre v1 gadget in socketcall
    - net: socket: Fix potential spectre v1 gadget in sock_is_registered
    - drm/amdgpu/pm: Fix potential Spectre v1
    - netlink: Fix spectre v1 gadget in netlink_create()
    - ext4: fix spectre gadget in ext4_mb_regular_allocator()
    - drm/i915/kvmgt: Fix potential Spectre v1
    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
    - fs/quota: Fix spectre gadget in do_quotactl
    - hwmon: (nct6775) Fix potential Spectre v1
    - mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom
    - switchtec: Fix Spectre v1 vulnerability
    - misc: hmc6352: fix potential Spectre v1
    - tty: vt_ioctl: fix potential Spectre v1
    - nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
    - IB/ucm: Fix Spectre v1 vulnerability
    - RDMA/ucma: Fix Spectre v1 vulnerability
    - drm/bufs: Fix Spectre v1 vulnerability
    - usb: gadget: storage: Fix Spectre v1 vulnerability
    - ptp: fix Spectre v1 vulnerability
    - HID: hiddev: fix potential Spectre v1
    - vhost: Fix Spectre V1 vulnerability
    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
    - ipv4: Fix potential Spectre v1 vulnerability
    - aio: fix spectre gadget in lookup_ioctx
    - ALSA: emux: Fix potential Spectre v1 vulnerabilities
    - ALSA: pcm: Fix potential Spectre v1 vulnerability
    - ip6mr: Fix potential Spectre v1 vulnerability
    - ALSA: rme9652: Fix potential Spectre v1 vulnerability
    - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
    - KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
    - drm/ioctl: Fix Spectre v1 vulnerabilities
    - char/mwave: fix potential Spectre v1 vulnerability
    - applicom: Fix potential Spectre v1 vulnerabilities
    - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities
    - powerpc/ptrace: Mitigate potential Spectre v1
    - cfg80211: prevent speculation on cfg80211_classify8021d() return
    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
    - ALSA: seq: oss: Fix Spectre v1 vulnerability

  * Bionic: Sync to Xenial (Spectre) (LP: #1822760)
    - x86/speculation/l1tf: Suggest what to do on systems with too much RAM
    - KVM: SVM: Add MSR-based feature support for serializing LFENCE
    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
    - KVM: X86: Allow userspace to define the microcode version
    - SAUCE: [Fix] x86/KVM/VMX: Add L1D flush logic
    - SAUCE: [Fix] x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on
      vmentry

  * [SRU] [B/OEM] Fix ACPI bug that causes boot failure (LP: #1819921)
    - SAUCE: ACPI / bus: Add some Lenovo laptops in list of acpi table term list

  * Bionic update: upstream stable patchset for fuse 2019-04-12 (LP: #1824553)
    - fuse: fix double request_end()
    - fuse: fix unlocked access to processing queue
    - fuse: umount should wait for all requests
    - fuse: Fix oops at process_init_reply()
    - fuse: Don't access pipe->buffers without pipe_lock()
    - fuse: Fix use-after-free in fuse_dev_do_read()
    - fuse: Fix use-after-free in fuse_dev_do_write()
    - fuse: set FR_SENT while locked
    - fuse: fix blocked_waitq wakeup
    - fuse: fix leaked notify reply
    - fuse: fix possibly missed wake-up after abort
    - fuse: fix use-after-free in fuse_direct_IO()
    - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS
    - fuse: handle zero sized retrieve correctly
    - fuse: call pipe_buf_release() under pipe lock
    - fuse: decrement NR_WRITEBACK_TEMP on the right page

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870) // Backport support for software
    count cache flush Spectre v2 mitigation. (CVE) (required for POWER9 DD2.3)
    (LP: #1822870)
    - powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
    - powerpc/fsl: Fix spectre_v2 mitigations reporting
    - powerpc: Avoid code patching freed init sections

  * Backport support for software count cache flush Spectre v2 mitigation. (CVE)
    (required for POWER9 DD2.3) (LP: #1822870) // Backport support for software
    count cache flush Spectre v2 mitigation. (CVE) (required for POWER9 DD2.3)
    (LP: #1822870) // Backport support for software count cache flush Spectre v2
    mitigation. (CVE) (required for POWER9 DD2.3) (LP: #1822870)
    - powerpc/security: Fix spectre_v2 reporting

  * CVE-2019-3874
    - sctp: use sk_wmem_queued to check for writable space
    - sctp: implement memory accounting on tx path
    - sctp: implement memory accounting on rx path

  * NULL pointer dereference when using z3fold and zswap (LP: #1814874)
    - z3fold: fix possible reclaim races

  * Kprobe event argument syntax in ftrace from ubuntu_kernel_selftests failed
    on B PowerPC (LP: #1812809)
    - selftests/ftrace: Add ppc support for kprobe args tests

  * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487)
    - misc: rtsx: make various functions static
    - misc: rtsx: Enable OCP for rts522a rts524a rts525a rts5260
    - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch

  * headset-mic doesn't work on two Dell laptops. (LP: #1825272)
    - ALSA: hda/realtek - add two more pin configuration sets to quirk table

  * CVE-2018-16884
    - sunrpc: use SVC_NET() in svcauth_gss_* functions
    - sunrpc: use-after-free in svc_process_common()

  * sky2 ethernet card don't work after returning from suspension (LP: #1798921)
    - sky2: Increase D3 delay again

  * CVE-2019-9500
    - brcmfmac: assure SSID length from firmware is limited

  * CVE-2019-9503
    - brcmfmac: add subtype check for event handling in data path

  * CVE-2019-3882
    - vfio/type1: Limit DMA mappings per container

  * Intel I210 Ethernet card not working after hotplug [8086:1533]
    (LP: #1818490)
    - igb: Fix WARN_ONCE on runtime suspend

  * bionic, xenial/hwe: misses "fuse: fix initial parallel dirops" patch
    (LP: #1823972)
    - fuse: fix initial parallel dirops

  * amdgpu resume failure: failed to allocate wb slot (LP: #1825074)
    - drm/amdgpu: fix&cleanups for wb_clear

  * Pop noise when headset is plugged in or removed from GHS/Line-out jack
    (LP: #1821290)
    - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode
      for ALC225
    - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
    - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
    - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB

  * mac80211_hwsim unable to handle kernel NULL pointer dereference
    at0000000000000000  (LP: #1825058)
    - mac80211_hwsim: Timer should be initialized before device registered

  * [regression][snd_hda_codec_realtek] repeating crackling noise after 19.04
    upgrade (LP: #1821663)
    - ALSA: hda: Add Intel NUC7i3BNB to the power_save blacklist
    - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist
    - ALSA: hda - Add two more machines to the power_save_blacklist

  * ubuntu_nbd_smoke_test failed on P9 with Bionic kernel (LP: #1822247)
    - nbd: fix how we set bd_invalidated

  * TSC clocksource not available in nested guests (LP: #1822821)
    - kvmclock: fix TSC calibration for nested guests

  * 4.15 kernel ip_vs --ops causes performance and hang problem (LP: #1819786)
    - ipvs: fix refcount usage for conns in ops mode

  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
    6db23a14" on Cosmic i386 (LP: #1813244) // systemd cause kernel trace "BUG:
    unable to handle kernel paging request at 6db23a14" on Cosmic i386
    (LP: #1813244)
    - openvswitch: fix flow actions reallocation

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 25 Apr 2019 10:40:22 +0200

linux (4.15.0-48.51) bionic; urgency=medium

  * linux: 4.15.0-48.51 -proposed tracker (LP: #1822820)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction

  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
    triggers system hang on i386 (LP: #1812845)
    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()

  * [P9][LTCTest][Opal][FW910] cpupower monitor shows multiple stop Idle_Stats
    (LP: #1719545)
    - cpupower : Fix header name to read idle state name

  * [amdgpu] screen corruption when using touchpad (LP: #1818617)
    - drm/amdgpu/gmc: steal the appropriate amount of vram for fw hand-over (v3)
    - drm/amdgpu: Free VGA stolen memory as soon as possible.

  * [SRU][B/C/OEM]IOMMU: add kernel dma protection (LP: #1820153)
    - ACPICA: AML parser: attempt to continue loading table after error
    - ACPI / property: Allow multiple property compatible _DSD entries
    - PCI / ACPI: Identify untrusted PCI devices
    - iommu/vt-d: Force IOMMU on for platform opt in hint
    - iommu/vt-d: Do not enable ATS for untrusted devices
    - thunderbolt: Export IOMMU based DMA protection support to userspace
    - iommu/vt-d: Disable ATS support on untrusted devices

  * Add basic support to NVLink2 passthrough (LP: #1819989)
    - powerpc/powernv/npu: Do not try invalidating 32bit table when 64bit table is
      enabled
    - powerpc/powernv: call OPAL_QUIESCE before OPAL_SIGNAL_SYSTEM_RESET
    - powerpc/powernv: Export opal_check_token symbol
    - powerpc/powernv: Make possible for user to force a full ipl cec reboot
    - powerpc/powernv/idoa: Remove unnecessary pcidev from pci_dn
    - powerpc/powernv: Move npu struct from pnv_phb to pci_controller
    - powerpc/powernv/npu: Move OPAL calls away from context manipulation
    - powerpc/pseries/iommu: Use memory@ nodes in max RAM address calculation
    - powerpc/pseries/npu: Enable platform support
    - powerpc/pseries: Remove IOMMU API support for non-LPAR systems
    - powerpc/powernv/npu: Check mmio_atsd array bounds when populating
    - powerpc/powernv/npu: Fault user page into the hypervisor's pagetable

  * Huawei Hi1822 NIC has poor performance (LP: #1820187)
    - net-next: hinic: fix a problem in free_tx_poll()
    - hinic: remove ndo_poll_controller
    - net-next/hinic: add checksum offload and TSO support
    - hinic: Fix l4_type parameter in hinic_task_set_tunnel_l4
    - net-next/hinic:replace multiply and division operators
    - net-next/hinic:add rx checksum offload for HiNIC
    - net-next/hinic:fix a bug in set mac address
    - net-next/hinic: fix a bug in rx data flow
    - net: hinic: fix null pointer dereference on pointer hwdev
    - hinic: optmize rx refill buffer mechanism
    - net-next/hinic:add shutdown callback
    - net-next/hinic: replace disable_irq_nosync/enable_irq

  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
    - Fonts: New Terminus large console font
    - [Config]: enable highdpi Terminus 16x32 font support

  * [19.04 FEAT] qeth: Enhanced link speed - kernel part (LP: #1814892)
    - s390/qeth: report 25Gbit link speed

  * CVE-2017-5754
    - x86/nmi: Fix NMI uaccess race against CR3 switching
    - x86/mm: Fix documentation of module mapping range with 4-level paging
    - x86/pti: Enable global pages for shared areas
    - x86/pti: Never implicitly clear _PAGE_GLOBAL for kernel image
    - x86/pti: Leave kernel text global for !PCID
    - x86/pti: Fix boot problems from Global-bit setting
    - x86/pti: Fix boot warning from Global-bit setting
    - x86/pti: Reduce amount of kernel text allowed to be Global
    - x86/pti: Disallow global kernel text with RANDSTRUCT
    - x86/entry/32: Add explicit 'l' instruction suffix
    - x86/asm-offsets: Move TSS_sp0 and TSS_sp1 to asm-offsets.c
    - x86/entry/32: Rename TSS_sysenter_sp0 to TSS_entry2task_stack
    - x86/entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler
    - x86/entry/32: Put ESPFIX code into a macro
    - x86/entry/32: Unshare NMI return path
    - x86/entry/32: Split off return-to-kernel path
    - x86/entry/32: Enter the kernel via trampoline stack
    - x86/entry/32: Leave the kernel via trampoline stack
    - x86/entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI
    - x86/entry/32: Handle Entry from Kernel-Mode on Entry-Stack
    - x86/entry/32: Simplify debug entry point
    - x86/entry/32: Add PTI cr3 switch to non-NMI entry/exit points
    - x86/entry/32: Add PTI CR3 switches to NMI handler code
    - x86/entry: Rename update_sp0 to update_task_stack
    - x86/pgtable: Rename pti_set_user_pgd() to pti_set_user_pgtbl()
    - x86/pgtable/pae: Unshare kernel PMDs when PTI is enabled
    - x86/pgtable/32: Allocate 8k page-tables when PTI is enabled
    - x86/pgtable: Move pgdp kernel/user conversion functions to pgtable.h
    - x86/pgtable: Move pti_set_user_pgtbl() to pgtable.h
    - x86/pgtable: Move two more functions from pgtable_64.h to pgtable.h
    - x86/mm/pae: Populate valid user PGD entries
    - x86/mm/pae: Populate the user page-table with user pgd's
    - x86/mm/pti: Add an overflow check to pti_clone_pmds()
    - x86/mm/pti: Define X86_CR3_PTI_PCID_USER_BIT on x86_32
    - x86/mm/pti: Clone CPU_ENTRY_AREA on PMD level on x86_32
    - x86/mm/pti: Make pti_clone_kernel_text() compile on 32 bit
    - x86/mm/pti: Keep permissions when cloning kernel text in
      pti_clone_kernel_text()
    - x86/mm/pti: Introduce pti_finalize()
    - x86/mm/pti: Clone entry-text again in pti_finalize()
    - x86/mm/dump_pagetables: Define INIT_PGD
    - x86/pgtable/pae: Use separate kernel PMDs for user page-table
    - x86/ldt: Reserve address-space range on 32 bit for the LDT
    - x86/ldt: Define LDT_END_ADDR
    - x86/ldt: Split out sanity check in map_ldt_struct()
    - x86/ldt: Enable LDT user-mapping for PAE
    - x86/pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32
    - [Config] Update PAGE_TABLE_ISOLATION annotations
    - x86/mm/pti: Add Warning when booting on a PCID capable CPU
    - x86/entry/32: Add debug code to check entry/exit CR3
    - x86/pti: Check the return value of pti_user_pagetable_walk_p4d()
    - x86/pti: Check the return value of pti_user_pagetable_walk_pmd()
    - perf/core: Make sure the ring-buffer is mapped in all page-tables
    - x86/entry/32: Check for VM86 mode in slow-path check
    - x86/mm: Remove in_nmi() warning from vmalloc_fault()
    - x86/kexec: Allocate 8k PGDs for PTI
    - x86/mm/pti: Clear Global bit more aggressively
    - mm: Allow non-direct-map arguments to free_reserved_area()
    - x86/mm/init: Pass unconverted symbol addresses to free_init_pages()
    - x86/mm/init: Add helper for freeing kernel image pages
    - x86/mm/init: Remove freed kernel image areas from alias mapping
    - x86/mm/pti: Fix 32 bit PCID check
    - x86/mm/pti: Don't clear permissions in pti_clone_pmd()
    - x86/mm/pti: Clone kernel-image on PTE level for 32 bit
    - x86/relocs: Add __end_rodata_aligned to S_REL
    - x86/mm/pti: Move user W+X check into pti_finalize()
    - x86/efi: Load fixmap GDT in efi_call_phys_epilog()
    - x86/efi: Load fixmap GDT in efi_call_phys_epilog() before setting %cr3
    - x86/mm/doc: Clean up the x86-64 virtual memory layout descriptions
    - x86/mm/doc: Enhance the x86-64 virtual memory layout descriptions
    - x86/entry/32: Clear the CS high bits
    - x86/mm: Move LDT remap out of KASLR region on 5-level paging
    - x86/ldt: Unmap PTEs for the slot before freeing LDT pages
    - x86/ldt: Remove unused variable in map_ldt_struct()
    - x86/mm: Fix guard hole handling
    - x86/dump_pagetables: Fix LDT remap address marker

  * Avoid potential memory corruption on HiSilicon SoCs (LP: #1819546)
    - iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads

  * Ubuntu18.04.01: [Power9] power8 Compat guest(RHEL7.6) crashes during guest
    boot with > 256G of memory (kernel/kvm) (LP: #1818645)
    - ]PATCH] KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function

  * Fix for dual Intel NVMes (LP: #1821961)
    - SAUCE: nvme: Merge two quirk entries into one for Intel 760p/Pro 7600p

  * CVE-2017-5715
    - tools headers: Synchronize prctl.h ABI header
    - x86/spectre: Add missing family 6 check to microcode check
    - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
    - x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
    - x86/speculation: Propagate information about RSB filling mitigation to sysfs
    - x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC
      variant
    - x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
    - x86/retpoline: Remove minimal retpoline support
    - x86/speculation: Update the TIF_SSBD comment
    - x86/speculation: Clean up spectre_v2_parse_cmdline()
    - x86/speculation: Remove unnecessary ret variable in cpu_show_common()
    - x86/speculation: Move STIPB/IBPB string conditionals out of
      cpu_show_common()
    - x86/speculation: Disable STIBP when enhanced IBRS is in use
    - x86/speculation: Rename SSBD update functions
    - x86/speculation: Reorganize speculation control MSRs update
    - sched/smt: Make sched_smt_present track topology
    - x86/Kconfig: Select SCHED_SMT if SMP enabled
    - sched/smt: Expose sched_smt_present static key
    - x86/speculation: Rework SMT state change
    - x86/l1tf: Show actual SMT state
    - x86/speculation: Reorder the spec_v2 code
    - x86/speculation: Mark string arrays const correctly
    - x86/speculataion: Mark command line parser data __initdata
    - x86/speculation: Unify conditional spectre v2 print functions
    - x86/speculation: Add command line control for indirect branch speculation
    - x86/speculation: Prepare for per task indirect branch speculation control
    - x86/process: Consolidate and simplify switch_to_xtra() code
    - x86/speculation: Avoid __switch_to_xtra() calls
    - x86/speculation: Prepare for conditional IBPB in switch_mm()
    - ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
    - x86/speculation: Split out TIF update
    - x86/speculation: Prevent stale SPEC_CTRL msr content
    - x86/speculation: Prepare arch_smt_update() for PRCTL mode
    - x86/speculation: Add prctl() control for indirect branch speculation
    - x86/speculation: Enable prctl mode for spectre_v2_user
    - x86/speculation: Add seccomp Spectre v2 user space protection mode
    - x86/speculation: Provide IBPB always command line options
    - kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
    - x86/speculation: Change misspelled STIPB to STIBP
    - x86/speculation: Add support for STIBP always-on preferred mode
    - x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
    - s390: remove closung punctuation from spectre messages
    - x86/speculation: Simplify the CPU bug detection logic

  * CVE-2018-3639
    - x86/bugs: Add AMD's variant of SSB_NO
    - x86/bugs: Add AMD's SPEC_CTRL MSR usage
    - x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
    - x86/bugs: Update when to check for the LS_CFG SSBD mitigation
    - x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled

  * [Ubuntu] vfio-ap: add subsystem to matrix device to avoid libudev failures
    (LP: #1818854)
    - s390: vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem

  * Kernel regularly logs: Bluetooth: hci0: last event is not cmd complete
    (0x0f) (LP: #1748565)
    - Bluetooth: Fix unnecessary error message for HCI request completion

  * HiSilicon HNS ethernet broken in 4.15.0-45 (LP: #1818294)
    - net: hns: Fix WARNING when hns modules installed

  * rtl8723be wifi does not work under linux-modules-extra-4.15.0-33-generic
    (LP: #1788997)
    - SAUCE: Revert "rtlwifi: cleanup 8723be ant_sel definition"

  * Crash from :i915 module with 4.15.0-46-generic using multi-display
    (LP: #1819486)
    - SAUCE: Revert "drm/i915: Fix hotplug irq ack on i965/g4x"

  * kernel linux-image-4.15.0-44 not booting on Hyperv Server 2008R2
    (LP: #1814069)
    - hv/netvsc: fix handling of fallback to single queue mode
    - hv/netvsc: Fix NULL dereference at single queue mode fallback

  * Lenovo ideapad 330-15ICH Wifi rfkill hard blocked (LP: #1811815)
    - platform/x86: ideapad: Add ideapad 330-15ICH to no_hw_rfkill

  * Qualcomm Atheros QCA9377 wireless does not work (LP: #1818204)
    - platform/x86: ideapad-laptop: Add Ideapad 530S-14ARR to no_hw_rfkill list

  * fscache: jobs might hang when fscache disk is full (LP: #1821395)
    - fscache: fix race between enablement and dropping of object

  * hns3: fix oops in hns3_clean_rx_ring() (LP: #1821064)
    - net: hns3: add dma_rmb() for rx description

  * Hard lockup in 2 CPUs due to deadlock in cpu_stoppers (LP: #1821259)
    - stop_machine: Disable preemption after queueing stopper threads
    - stop_machine: Atomically queue and wake stopper threads

  * tcm_loop.ko: move from modules-extra into main modules package
    (LP: #1817786)
    - [Packaging] move tcm_loop.lo to main linux-modules package

  * tcmu user space crash results in kernel module hang. (LP: #1819504)
    - scsi: tcmu: delete unused __wait
    - scsi: tcmu: track nl commands
    - scsi: tcmu: simplify nl interface
    - scsi: tcmu: add module wide block/reset_netlink support

  * Intel XL710 - i40e driver does not work with kernel 4.15 (Ubuntu 18.04)
    (LP: #1779756)
    - i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled
    - i40e: prevent overlapping tx_timeout recover

  * some codecs stop working after S3 (LP: #1820930)
    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec

  * i40e xps management broken when > 64 queues/cpus (LP: #1820948)
    - i40e: Do not allow use more TC queue pairs than MSI-X vectors exist
    - i40e: Fix the number of queues available to be mapped for use

  * 4.15 s390x kernel BUG at /build/linux-
    Gycr4Z/linux-4.15.0/drivers/block/virtio_blk.c:565! (LP: #1788432)
    - virtio/s390: avoid race on vcdev->config
    - virtio/s390: fix race in ccw_io_helper()

  * [SRU][B/B-OEM/C/D] Fix AMD IOMMU NULL dereference (LP: #1820990)
    - iommu/amd: Fix NULL dereference bug in match_hid_uid

  * New Intel Wireless-AC 9260 [8086:2526] card not correctly probed in Ubuntu
    system (LP: #1821271)
    - iwlwifi: add new card for 9260 series

  * Add support for MAC address pass through on RTL8153-BD (LP: #1821276)
    - r8152: Add support for MAC address pass through on RTL8153-BD
    - r8152: Fix an error on RTL8153-BD MAC Address Passthrough support

 -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Apr 2019 18:31:55 +0200

linux (4.15.0-47.50) bionic; urgency=medium

  * linux: 4.15.0-47.50 -proposed tracker (LP: #1819716)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
    - [Packaging] resync retpoline extraction

  * C++ demangling support missing from perf (LP: #1396654)
    - [Packaging] fix a mistype

  * arm-smmu-v3 arm-smmu-v3.3.auto: CMD_SYNC timeout (LP: #1818162)
    - iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout

  * Crash in nvme_irq_check() when using threaded interrupts (LP: #1818747)
    - nvme-pci: fix out of bounds access in nvme_cqe_pending

  * CVE-2019-9213
    - mm: enforce min addr even if capable() in expand_downwards()

  * CVE-2019-3460
    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt

  * amdgpu with mst WARNING on blanking (LP: #1814308)
    - drm/amd/display: Don't use dc_link in link_encoder
    - drm/amd/display: Move wait for hpd ready out from edp power control.
    - drm/amd/display: eDP sequence BL off first then DP blank.
    - drm/amd/display: Fix unused variable compilation error
    - drm/amd/display: Fix warning about misaligned code
    - drm/amd/display: Fix MST dp_blank REG_WAIT timeout

  * tun/tap: unable to manage carrier state from userland (LP: #1806392)
    - tun: implement carrier change

  * CVE-2019-8980
    - exec: Fix mem leak in kernel_read_file

  * raw_skew in timer from the ubuntu_kernel_selftests failed on Bionic
    (LP: #1811194)
    - selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock
      adjustments are in progress

  * [Packaging] Allow overlay of config annotations (LP: #1752072)
    - [Packaging] config-check: Add an include directive

  * CVE-2019-7308
    - bpf: move {prev_,}insn_idx into verifier env
    - bpf: move tmp variable into ax register in interpreter
    - bpf: enable access to ax register also from verifier rewrite
    - bpf: restrict map value pointer arithmetic for unprivileged
    - bpf: restrict stack pointer arithmetic for unprivileged
    - bpf: restrict unknown scalars of mixed signed bounds for unprivileged
    - bpf: fix check_map_access smin_value test when pointer contains offset
    - bpf: prevent out of bounds speculation on pointer arithmetic
    - bpf: fix sanitation of alu op with pointer / scalar type from different
      paths
    - bpf: add various test cases to selftests

  * CVE-2017-5753
    - bpf: properly enforce index mask to prevent out-of-bounds speculation
    - bpf: fix inner map masking to prevent oob under speculation

  * BPF: kernel pointer leak to unprivileged userspace (LP: #1815259)
    - bpf/verifier: disallow pointer subtraction

  * squashfs hardening (LP: #1816756)
    - squashfs: more metadata hardening
    - squashfs metadata 2: electric boogaloo
    - squashfs: more metadata hardening
    - Squashfs: Compute expected length from inode size rather than block length

  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted

  * Update ENA driver to version 2.0.3K (LP: #1816806)
    - net: ena: update driver version from 2.0.2 to 2.0.3
    - net: ena: fix race between link up and device initalization
    - net: ena: fix crash during failed resume from hibernation

  * ipset kernel error: 4.15.0-43-generic (LP: #1811394)
    - netfilter: ipset: Fix wraparound in hash:*net* types

  * Silent "Unknown key" message when pressing keyboard backlight hotkey
    (LP: #1817063)
    - platform/x86: dell-wmi: Ignore new keyboard backlight change event

  * CVE-2018-18021
    - arm64: KVM: Tighten guest core register access from userspace
    - KVM: arm/arm64: Introduce vcpu_el1_is_32bit
    - arm64: KVM: Sanitize PSTATE.M when being set from userspace

  * CVE-2018-14678
    - x86/entry/64: Remove %ebx handling from error_entry/exit

  * CVE-2018-19824
    - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

  * CVE-2019-3459
    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer

  * Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234)
    - fork: unconditionally clear stack on fork
    - spi: spi-s3c64xx: Fix system resume support
    - Input: elan_i2c - add ACPI ID for lenovo ideapad 330
    - Input: i8042 - add Lenovo LaVie Z to the i8042 reset list
    - Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST
    - kvm, mm: account shadow page tables to kmemcg
    - delayacct: fix crash in delayacct_blkio_end() after delayacct init failure
    - tracing: Fix double free of event_trigger_data
    - tracing: Fix possible double free in event_enable_trigger_func()
    - kthread, tracing: Don't expose half-written comm when creating kthreads
    - tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure
    - tracing: Quiet gcc warning about maybe unused link variable
    - arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups
    - mlxsw: spectrum_switchdev: Fix port_vlan refcounting
    - kcov: ensure irq code sees a valid area
    - xen/netfront: raise max number of slots in xennet_get_responses()
    - skip LAYOUTRETURN if layout is invalid
    - ALSA: emu10k1: add error handling for snd_ctl_add
    - ALSA: fm801: add error handling for snd_ctl_add
    - NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY
    - nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo
    - vfio: platform: Fix reset module leak in error path
    - vfio/mdev: Check globally for duplicate devices
    - vfio/type1: Fix task tracking for QEMU vCPU hotplug
    - kernel/hung_task.c: show all hung tasks before panic
    - mm: /proc/pid/pagemap: hide swap entries from unprivileged users
    - mm: vmalloc: avoid racy handling of debugobjects in vunmap
    - mm/slub.c: add __printf verification to slab_err()
    - rtc: ensure rtc_set_alarm fails when alarms are not supported
    - perf tools: Fix pmu events parsing rule
    - netfilter: ipset: forbid family for hash:mac sets
    - netfilter: ipset: List timing out entries with "timeout 1" instead of zero
    - irqchip/ls-scfg-msi: Map MSIs in the iommu
    - watchdog: da9063: Fix updating timeout value
    - printk: drop in_nmi check from printk_safe_flush_on_panic()
    - bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}
    - ceph: fix alignment of rasize
    - e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes
    - powerpc/lib: Adjust .balign inside string functions for PPC32
    - powerpc/64s: Add barrier_nospec
    - powerpc/eeh: Fix use-after-release of EEH driver
    - hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()
    - powerpc/64s: Fix compiler store ordering to SLB shadow area
    - RDMA/mad: Convert BUG_ONs to error flows
    - lightnvm: pblk: warn in case of corrupted write buffer
    - netfilter: nf_tables: check msg_type before nft_trans_set(trans)
    - pnfs: Don't release the sequence slot until we've processed layoutget on
      open
    - disable loading f2fs module on PAGE_SIZE > 4KB
    - f2fs: fix error path of move_data_page
    - f2fs: fix to don't trigger writeback during recovery
    - f2fs: fix to wait page writeback during revoking atomic write
    - f2fs: Fix deadlock in shutdown ioctl
    - f2fs: fix to detect failure of dquot_initialize
    - f2fs: fix race in between GC and atomic open
    - block, bfq: remove wrong lock in bfq_requests_merged
    - usbip: usbip_detach: Fix memory, udev context and udev leak
    - usbip: dynamically allocate idev by nports found in sysfs
    - perf/x86/intel/uncore: Correct fixed counter index check in generic code
    - perf/x86/intel/uncore: Correct fixed counter index check for NHM
    - selftests/intel_pstate: Improve test, minor fixes
    - selftests: memfd: return Kselftest Skip code for skipped tests
    - selftests: intel_pstate: return Kselftest Skip code for skipped tests
    - PCI: Fix devm_pci_alloc_host_bridge() memory leak
    - iwlwifi: pcie: fix race in Rx buffer allocator
    - Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
    - Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011
    - ASoC: dpcm: fix BE dai not hw_free and shutdown
    - mfd: cros_ec: Fail early if we cannot identify the EC
    - mwifiex: handle race during mwifiex_usb_disconnect
    - wlcore: sdio: check for valid platform device data before suspend
    - media: tw686x: Fix incorrect vb2_mem_ops GFP flags
    - media: videobuf2-core: don't call memop 'finish' when queueing
    - Btrfs: don't return ino to ino cache if inode item removal fails
    - Btrfs: don't BUG_ON() in btrfs_truncate_inode_items()
    - btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups
    - btrfs: qgroup: Finish rescan when hit the last leaf of extent tree
    - x86/microcode: Make the late update update_lock a raw lock for RT
    - PM / wakeup: Make s2idle_lock a RAW_SPINLOCK
    - PCI: Prevent sysfs disable of device while driver is attached
    - nvme-rdma: stop admin queue before freeing it
    - nvme-pci: Fix AER reset handling
    - ath: Add regulatory mapping for FCC3_ETSIC
    - ath: Add regulatory mapping for ETSI8_WORLD
    - ath: Add regulatory mapping for APL13_WORLD
    - ath: Add regulatory mapping for APL2_FCCA
    - ath: Add regulatory mapping for Uganda
    - ath: Add regulatory mapping for Tanzania
    - ath: Add regulatory mapping for Serbia
    - ath: Add regulatory mapping for Bermuda
    - ath: Add regulatory mapping for Bahamas
    - powerpc/32: Add a missing include header
    - powerpc/chrp/time: Make some functions static, add missing header include
    - powerpc/powermac: Add missing prototype for note_bootable_part()
    - powerpc/powermac: Mark variable x as unused
    - powerpc: Add __printf verification to prom_printf
    - spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC
    - powerpc/8xx: fix invalid register expression in head_8xx.S
    - pinctrl: at91-pio4: add missing of_node_put
    - bpf: powerpc64: pad function address loads with NOPs
    - PCI: pciehp: Request control of native hotplug only if supported
    - net: dsa: qca8k: Add support for QCA8334 switch
    - mwifiex: correct histogram data with appropriate index
    - ima: based on policy verify firmware signatures (pre-allocated buffer)
    - drivers/perf: arm-ccn: don't log to dmesg in event_init
    - spi: Add missing pm_runtime_put_noidle() after failed get
    - fscrypt: use unbound workqueue for decryption
    - scsi: ufs: ufshcd: fix possible unclocked register access
    - scsi: ufs: fix exception event handling
    - scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger
    - drm/nouveau/fifo/gk104-: poll for runlist update completion
    - Bluetooth: btusb: add ID for LiteOn 04ca:301a
    - rtc: tps6586x: fix possible race condition
    - rtc: vr41xx: fix possible race condition
    - rtc: tps65910: fix possible race condition
    - ALSA: emu10k1: Rate-limit error messages about page errors
    - regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
    - md/raid1: add error handling of read error from FailFast device
    - md: fix NULL dereference of mddev->pers in remove_and_add_spares()
    - ixgbevf: fix MAC address changes through ixgbevf_set_mac()
    - media: smiapp: fix timeout checking in smiapp_read_nvm
    - net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value
    - ALSA: usb-audio: Apply rate limit to warning messages in URB complete
      callback
    - media: atomisp: ov2680: don't declare unused vars
    - arm64: cmpwait: Clear event register before arming exclusive monitor
    - HID: hid-plantronics: Re-resend Update to map button for PTT products
    - arm64: dts: renesas: salvator-common: use audio-graph-card for Sound
    - drm/radeon: fix mode_valid's return type
    - drm/amdgpu: Remove VRAM from shared bo domains.
    - powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by
      Starlet
    - HID: i2c-hid: check if device is there before really probing
    - EDAC, altera: Fix ARM64 build warning
    - ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage
    - ARM: dts: emev2: Add missing interrupt-affinity to PMU node
    - ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node
    - nvmem: properly handle returned value nvmem_reg_read
    - i40e: free the skb after clearing the bitlock
    - tty: Fix data race in tty_insert_flip_string_fixed_flag
    - dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
    - net: phy: phylink: Release link GPIO
    - media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()
    - libata: Fix command retry decision
    - ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2
    - media: media-device: fix ioctl function types
    - media: saa7164: Fix driver name in debug output
    - mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages
    - brcmfmac: Add support for bcm43364 wireless chipset
    - s390/cpum_sf: Add data entry sizes to sampling trailer entry
    - perf: fix invalid bit in diagnostic entry
    - bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only.
    - scsi: 3w-9xxx: fix a missing-check bug
    - scsi: 3w-xxxx: fix a missing-check bug
    - scsi: megaraid: silence a static checker bug
    - scsi: qedf: Set the UNLOADING flag when removing a vport
    - staging: lustre: o2iblnd: fix race at kiblnd_connect_peer
    - staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5
    - thermal: exynos: fix setting rising_threshold for Exynos5433
    - bpf: fix references to free_bpf_prog_info() in comments
    - f2fs: avoid fsync() failure caused by EAGAIN in writepage()
    - media: siano: get rid of __le32/__le16 cast warnings
    - drm/atomic: Handling the case when setting old crtc for plane
    - ALSA: hda/ca0132: fix build failure when a local macro is defined
    - mmc: dw_mmc: update actual clock for mmc debugfs
    - mmc: pwrseq: Use kmalloc_array instead of stack VLA
    - dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC
    - spi: meson-spicc: Fix error handling in meson_spicc_probe()
    - dt-bindings: net: meson-dwmac: new compatible name for AXG SoC
    - backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction
    - stop_machine: Use raw spinlocks
    - delayacct: Use raw_spinlocks
    - memory: tegra: Do not handle spurious interrupts
    - memory: tegra: Apply interrupts mask per SoC
    - nvme: lightnvm: add granby support
    - arm64: defconfig: Enable Rockchip io-domain driver
    - igb: Fix queue selection on MAC filters on i210
    - drm/gma500: fix psb_intel_lvds_mode_valid()'s return type
    - ipconfig: Correctly initialise ic_nameservers
    - rsi: Fix 'invalid vdd' warning in mmc
    - rsi: fix nommu_map_sg overflow kernel panic
    - audit: allow not equal op for audit by executable
    - staging: vchiq_core: Fix missing semaphore release in error case
    - staging: lustre: llite: correct removexattr detection
    - staging: lustre: ldlm: free resource when ldlm_lock_create() fails.
    - serial: core: Make sure compiler barfs for 16-byte earlycon names
    - soc: imx: gpcv2: Do not pass static memory as platform data
    - microblaze: Fix simpleImage format generation
    - usb: hub: Don't wait for connect state at resume for powered-off ports
    - crypto: authencesn - don't leak pointers to authenc keys
    - crypto: authenc - don't leak pointers to authenc keys
    - media: omap3isp: fix unbalanced dma_iommu_mapping
    - regulator: Don't return or expect -errno from of_map_mode()
    - scsi: scsi_dh: replace too broad "TP9" string with the exact models
    - scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs
    - media: atomisp: compat32: fix __user annotations
    - media: si470x: fix __be16 annotations
    - ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format()
    - ASoC: topology: Add missing clock gating parameter when parsing hw_configs
    - drm: Add DP PSR2 sink enable bit
    - drm/atomic-helper: Drop plane->fb references only for
      drm_atomic_helper_shutdown()
    - drm/dp/mst: Fix off-by-one typo when dump payload table
    - block: reset bi_iter.bi_done after splitting bio
    - random: mix rdrand with entropy sent in from userspace
    - squashfs: be more careful about metadata corruption
    - ext4: fix inline data updates with checksums enabled
    - ext4: fix check to prevent initializing reserved inodes
    - PCI: xgene: Remove leftover pci_scan_child_bus() call
    - RDMA/uverbs: Protect from attempts to create flows on unsupported QP
    - net: dsa: qca8k: Force CPU port to its highest bandwidth
    - net: dsa: qca8k: Enable RXMAC when bringing up a port
    - net: dsa: qca8k: Add QCA8334 binding documentation
    - net: dsa: qca8k: Allow overwriting CPU port setting
    - ipv4: remove BUG_ON() from fib_compute_spec_dst
    - net: fix amd-xgbe flow-control issue
    - net: lan78xx: fix rx handling before first packet is send
    - net: mdio-mux: bcm-iproc: fix wrong getter and setter pair
    - NET: stmmac: align DMA stuff to largest cache line length
    - tcp_bbr: fix bw probing to raise in-flight data for very small BDPs
    - xen-netfront: wait xenbus state change when load module manually
    - netlink: Do not subscribe to non-existent groups
    - netlink: Don't shift with UB on nlk->ngroups
    - tcp: do not force quickack when receiving out-of-order packets
    - tcp: add max_quickacks param to tcp_incr_quickack and
      tcp_enter_quickack_mode
    - tcp: do not aggressively quick ack after ECN events
    - tcp: refactor tcp_ecn_check_ce to remove sk type cast
    - tcp: add one more quick ack after after ECN events
    - mm: disallow mappings that conflict for devm_memremap_pages()
    - drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.
    - mm: check for SIGKILL inside dup_mmap() loop
    - rxrpc: Fix terminal retransmission connection ID to include the channel
    - ceph: fix use-after-free in ceph_statfs()
    - lightnvm: proper error handling for pblk_bio_add_pages
    - f2fs: don't drop dentry pages after fs shutdown
    - selftests: filesystems: return Kselftest Skip code for skipped tests
    - selftests/filesystems: devpts_pts included wrong header
    - iwlwifi: mvm: open BA session only when sta is authorized
    - drm/amd/display: Do not program interrupt status on disabled crtc
    - soc: qcom: smem: fix qcom_smem_set_global_partition()
    - soc: qcom: smem: byte swap values properly
    - pinctrl: msm: fix gpio-hog related boot issues
    - net: mvpp2: Add missing VLAN tag detection
    - drm/nouveau: remove fence wait code from deferred client work handler
    - drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl
    - clocksource: Move inline keyword to the beginning of function declarations
    - media: staging: atomisp: Comment out several unused sensor resolutions
    - IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS
    - rsi: Add null check for virtual interfaces in wowlan config
    - ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage
    - ARM: dts: imx53: Fix LDB OF graph warning
    - soc/tegra: pmc: Don't allocate struct tegra_powergate on stack
    - mlxsw: spectrum_router: Return an error for non-default FIB rules
    - i40e: Add advertising 10G LR mode
    - i40e: avoid overflow in i40e_ptp_adjfreq()
    - ath10k: fix kernel panic while reading tpc_stats
    - ASoC: fsl_ssi: Use u32 variable type when using regmap_read()
    - platform/x86: dell-smbios: Match on www.dell.com in OEM strings too
    - staging: ks7010: fix error handling in ks7010_upload_firmware
    - media: rc: mce_kbd decoder: low timeout values cause double keydowns
    - ath10k: search all IEs for variant before falling back
    - PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR
    - ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl
    - drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier
    - nvmet-fc: fix target sgl list on large transfers
    - i2c: rcar: handle RXDMA HW behaviour on Gen3
    - gpio: uniphier: set legitimate irq trigger type in .to_irq hook
    - tcp: ack immediately when a cwr packet arrives
    - ACPICA: AML Parser: ignore control method status in module-level code

  * Bionic update: upstream stable patchset 2019-02-05 (LP: #1814813)
    - MIPS: ath79: fix register address in ath79_ddr_wb_flush()
    - MIPS: Fix off-by-one in pci_resource_to_user()
    - xen/PVH: Set up GS segment for stack canary
    - drm/nouveau/drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit()
    - drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs
    - bonding: set default miimon value for non-arp modes if not set
    - ip: hash fragments consistently
    - ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull
    - net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper
    - net: skb_segment() should not return NULL
    - net/mlx5: Adjust clock overflow work period
    - net/mlx5e: Don't allow aRFS for encapsulated packets
    - net/mlx5e: Fix quota counting in aRFS expire flow
    - net/ipv6: Fix linklocal to global address with VRF
    - multicast: do not restore deleted record source filter mode to new one
    - net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv
    - sock: fix sg page frag coalescing in sk_alloc_sg
    - rtnetlink: add rtnl_link_state check in rtnl_configure_link
    - vxlan: add new fdb alloc and create helpers
    - vxlan: make netlink notify in vxlan_fdb_destroy optional
    - vxlan: fix default fdb entry netlink notify ordering during netdev create
    - tcp: fix dctcp delayed ACK schedule
    - tcp: helpers to send special DCTCP ack
    - tcp: do not cancel delay-AcK on DCTCP special ACK
    - tcp: do not delay ACK in DCTCP upon CE status change
    - staging: speakup: fix wraparound in uaccess length check
    - usb: cdc_acm: Add quirk for Castles VEGA3000
    - usb: core: handle hub C_PORT_OVER_CURRENT condition
    - usb: dwc2: Fix DMA alignment to start at allocated boundary
    - usb: gadget: f_fs: Only return delayed status when len is 0
    - driver core: Partially revert "driver core: correct device's shutdown order"
    - can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK
    - can: xilinx_can: fix power management handling
    - can: xilinx_can: fix recovery from error states not being propagated
    - can: xilinx_can: fix device dropping off bus on RX overrun
    - can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting
    - can: xilinx_can: fix incorrect clear of non-processed interrupts
    - can: xilinx_can: fix RX overflow interrupt not being enabled
    - can: peak_canfd: fix firmware < v3.3.0: limit allocation to 32-bit DMA addr
      only
    - can: m_can.c: fix setup of CCCR register: clear CCCR NISO bit before
      checking can.ctrlmode
    - turn off -Wattribute-alias
    - net-next/hinic: fix a problem in hinic_xmit_frame()
    - net/mlx5e: Refine ets validation function
    - nfp: flower: ensure dead neighbour entries are not offloaded
    - usb: gadget: Fix OS descriptors support
    - ACPICA: AML Parser: ignore dispatcher error status during table load

  * installer does not support iSCSI iBFT (LP: #1817321)
    - d-i: add iscsi_ibft to scsi-modules

  * CVE-2019-7222
    - KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)

  * CVE-2019-7221
    - KVM: nVMX: unconditionally cancel preemption timer in free_nested
      (CVE-2019-7221)

  * CVE-2019-6974
    - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

  * Regular D-state processes impacting LXD containers (LP: #1817628)
    - mm: do not stall register_shrinker()

  * hns3 nic speed may not match optical port speed (LP: #1817969)
    - net: hns3: Config NIC port speed same as that of optical module

  * [Hyper-V] srcu: Lock srcu_data structure in srcu_gp_start() (LP: #1802021)
    - srcu: Prohibit call_srcu() use under raw spinlocks
    - srcu: Lock srcu_data structure in srcu_gp_start()

  * libsas disks can have non-unique by-path names (LP: #1817784)
    - scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached

  * Bluetooth not working (Intel CyclonePeak) (LP: #1817518)
    - Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029

  * CVE-2019-8912
    - net: crypto set sk to NULL when af_alg_release.
    - net: socket: set sock->sk to NULL after calling proto_ops::release()

  * Trackpad is not recognized. (LP: #1817200)
    - pinctrl: cannonlake: Fix gpio base for GPP-E

  * [ALSA] [PATCH] System76 darp5 and oryp5 fixups (LP: #1815831)
    - ALSA: hda/realtek - Headset microphone support for System76 darp5
    - ALSA: hda/realtek - Headset microphone and internal speaker support for
      System76 oryp5

  * Constant noise in the headphone on Lenovo X1 machines (LP: #1817263)
    - ALSA: hda/realtek: Disable PC beep in passthrough on alc285

  * AC adapter status not detected on Asus ZenBook UX410UAK (LP: #1745032)
    - Revert "ACPI / battery: Add quirk for Asus GL502VSK and UX305LA"
    - ACPI / AC: Remove initializer for unused ident dmi_system_id
    - ACPI / battery: Remove initializer for unused ident dmi_system_id
    - ACPI / battery: Add handling for devices which wrongly report discharging
      state
    - ACPI / battery: Ignore AC state in handle_discharging on systems where it is
      broken

  * TPM intermittently fails after cold-boot (LP: #1762672)
    - tpm: fix intermittent failure with self tests

  * qlcnic: Firmware aborts/hangs in QLogic NIC (LP: #1815033)
    - qlcnic: fix Tx descriptor corruption on 82xx devices

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 13 Mar 2019 04:37:49 +0000

linux (4.15.0-46.49) bionic; urgency=medium

  * linux: 4.15.0-46.49 -proposed tracker (LP: #1814726)

  * mprotect fails on ext4 with dax (LP: #1799237)
    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion

  * kernel BUG at /build/linux-vxxS7y/linux-4.15.0/mm/slub.c:296! (LP: #1812086)
    - iscsi target: fix session creation failure handling
    - scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values
      fails
    - scsi: iscsi: target: Fix conn_ops double free

  * user_copy in user from ubuntu_kernel_selftests failed on KVM kernel
    (LP: #1812198)
    - selftests: user: return Kselftest Skip code for skipped tests
    - selftests: kselftest: change KSFT_SKIP=4 instead of KSFT_PASS
    - selftests: kselftest: Remove outdated comment

  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
    - SAUCE: staging: rtlwifi: allow RTLWIFI_DEBUG_ST to be disabled
    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
    - SAUCE: Add r8822be to signature inclusion list

  * kernel oops in bcache module (LP: #1793901)
    - SAUCE: bcache: never writeback a discard operation

  * CVE-2018-18397
    - userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
    - userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    - userfaultfd: shmem: add i_size checks
    - userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set

  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
    - HID: i2c-hid: Ignore input report if there's no data present on Elan
      touchpanels

  * Vsock connect fails with ENODEV for large CID (LP: #1813934)
    - vhost/vsock: fix vhost vsock cid hashing inconsistent

  * SRU: Fix thinkpad 11e 3rd boot hang (LP: #1804604)
    - ACPI / LPSS: Force LPSS quirks on boot

  * Bionic update: upstream stable patchset 2019-01-17 (LP: #1812229)
    - scsi: sd_zbc: Fix variable type and bogus comment
    - KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in
      parallel.
    - x86/apm: Don't access __preempt_count with zeroed fs
    - x86/events/intel/ds: Fix bts_interrupt_threshold alignment
    - x86/MCE: Remove min interval polling limitation
    - fat: fix memory allocation failure handling of match_strdup()
    - ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk
    - ARCv2: [plat-hsdk]: Save accl reg pair by default
    - ARC: Fix CONFIG_SWAP
    - ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    - ARC: mm: allow mprotect to make stack mappings executable
    - mm: memcg: fix use after free in mem_cgroup_iter()
    - mm/huge_memory.c: fix data loss when splitting a file pmd
    - cpufreq: intel_pstate: Register when ACPI PCCH is present
    - vfio/pci: Fix potential Spectre v1
    - stop_machine: Disable preemption when waking two stopper threads
    - drm/i915: Fix hotplug irq ack on i965/g4x
    - drm/nouveau: Use drm_connector_list_iter_* for iterating connectors
    - drm/nouveau: Avoid looping through fake MST connectors
    - gen_stats: Fix netlink stats dumping in the presence of padding
    - ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
    - ipv6: fix useless rol32 call on hash
    - ipv6: ila: select CONFIG_DST_CACHE
    - lib/rhashtable: consider param->min_size when setting initial table size
    - net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort
    - net: Don't copy pfmemalloc flag in __copy_skb_header()
    - skbuff: Unconditionally copy pfmemalloc in __skb_clone()
    - net/ipv4: Set oif in fib_compute_spec_dst
    - net: phy: fix flag masking in __set_phy_supported
    - ptp: fix missing break in switch
    - qmi_wwan: add support for Quectel EG91
    - tg3: Add higher cpu clock for 5762.
    - hv_netvsc: Fix napi reschedule while receive completion is busy
    - net/mlx4_en: Don't reuse RX page when XDP is set
    - net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite
    - ipv6: make DAD fail with enhanced DAD when nonce length differs
    - net: usb: asix: replace mii_nway_restart in resume path
    - alpha: fix osf_wait4() breakage
    - cxl_getfile(): fix double-iput() on alloc_file() failures
    - powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from stop (idle)
    - xhci: Fix perceived dead host due to runtime suspend race with event handler
    - KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
    - x86/kvmclock: set pvti_cpu0_va after enabling kvmclock
    - ALSA: hda/realtek - Yet another Clevo P950 quirk entry
    - drm/amdgpu: Reserve VM root shared fence slot for command submission (v3)
    - rhashtable: add restart routine in rhashtable_free_and_destroy()
    - sch_fq_codel: zero q->flows_cnt when fq_codel_init fails
    - sctp: introduce sctp_dst_mtu
    - sctp: fix the issue that pathmtu may be set lower than MINSEGMENT
    - net: aquantia: vlan unicast address list correct handling
    - drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open()

  * Bionic update: upstream stable patchset 2019-01-15 (LP: #1811877)
    - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations
    - x86/asm: Add _ASM_ARG* constants for argument registers to <asm/asm.h>
    - x86/paravirt: Make native_save_fl() extern inline
    - Btrfs: fix duplicate extents after fsync of file with prealloc extents
    - cpufreq / CPPC: Set platform specific transition_delay_us
    - PCI: exynos: Fix a potential init_clk_resources NULL pointer dereference
    - alx: take rtnl before calling __alx_open from resume
    - atm: Preserve value of skb->truesize when accounting to vcc
    - atm: zatm: Fix potential Spectre v1
    - ipv6: sr: fix passing wrong flags to crypto_alloc_shash()
    - ipvlan: fix IFLA_MTU ignored on NEWLINK
    - ixgbe: split XDP_TX tail and XDP_REDIRECT map flushing
    - net: dccp: avoid crash in ccid3_hc_rx_send_feedback()
    - net: dccp: switch rx_tstamp_last_feedback to monotonic clock
    - net: fix use-after-free in GRO with ESP
    - net: macb: Fix ptp time adjustment for large negative delta
    - net/mlx5e: Avoid dealing with vport representors if not being e-switch
      manager
    - net/mlx5: E-Switch, Avoid setup attempt if not being e-switch manager
    - net/mlx5: Fix command interface race in polling mode
    - net/mlx5: Fix incorrect raw command length parsing
    - net/mlx5: Fix required capability for manipulating MPFS
    - net/mlx5: Fix wrong size allocation for QoS ETC TC regitster
    - net: mvneta: fix the Rx desc DMA address in the Rx path
    - net/packet: fix use-after-free
    - net_sched: blackhole: tell upper qdisc about dropped packets
    - net: sungem: fix rx checksum support
    - net/tcp: Fix socket lookups with SO_BINDTODEVICE
    - qede: Adverstise software timestamp caps when PHC is not available.
    - qed: Fix setting of incorrect eswitch mode.
    - qed: Fix use of incorrect size in memcpy call.
    - qed: Limit msix vectors in kdump kernel to the minimum required count.
    - r8152: napi hangup fix after disconnect
    - stmmac: fix DMA channel hang in half-duplex mode
    - strparser: Remove early eaten to fix full tcp receive buffer stall
    - tcp: fix Fast Open key endianness
    - tcp: prevent bogus FRTO undos with non-SACK flows
    - vhost_net: validate sock before trying to put its fd
    - VSOCK: fix loopback on big-endian systems
    - net: cxgb3_main: fix potential Spectre v1
    - rtlwifi: Fix kernel Oops "Fw download fail!!"
    - rtlwifi: rtl8821ae: fix firmware is not ready to run
    - net: lan78xx: Fix race in tx pending skb size calculation
    - crypto: af_alg - Initialize sg_num_bytes in error code path
    - mtd: rawnand: denali_dt: set clk_x_rate to 200 MHz unconditionally
    - PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg()
    - netfilter: ebtables: reject non-bridge targets
    - reiserfs: fix buffer overflow with long warning messages
    - KEYS: DNS: fix parsing multiple options
    - tls: Stricter error checking in zerocopy sendmsg path
    - autofs: fix slab out of bounds read in getname_kernel()
    - nsh: set mac len based on inner packet
    - bdi: Fix another oops in wb_workfn()
    - rds: avoid unenecessary cong_update in loop transport
    - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.
    - string: drop __must_check from strscpy() and restore strscpy() usages in
      cgroup
    - nfsd: COPY and CLONE operations require the saved filehandle to be set
    - net/sched: act_ife: fix recursive lock and idr leak
    - net/sched: act_ife: preserve the action control in case of error
    - hinic: reset irq affinity before freeing irq
    - nfp: flower: fix mpls ether type detection
    - net: macb: initialize bp->queues[0].bp for at91rm9200
    - enic: do not overwrite error code
    - virtio_net: fix memory leak in XDP_REDIRECT
    - netfilter: ipv6: nf_defrag: drop skb dst before queueing
    - ipvs: initialize tbl->entries after allocation
    - ipvs: initialize tbl->entries in ip_vs_lblc_init_svc()
    - bpf: enforce correct alignment for instructions
    - bpf, arm32: fix to use bpf_jit_binary_lock_ro api

  * Fix non-working pinctrl-intel (LP: #1811777)
    - pinctrl: intel: Implement intel_gpio_get_direction callback
    - pinctrl: intel: Do pin translation in other GPIO operations as well

  * ip6_gre: fix tunnel list corruption for x-netns (LP: #1812875)
    - ip6_gre: fix tunnel list corruption for x-netns

  * Userspace break as a result of missing patch backport (LP: #1813873)
    - tty: Don't hold ldisc lock in tty_reopen() if ldisc present

  * kvm_stat : missing python dependency (LP: #1798776)
    - tools/kvm_stat: fix python3 issues
    - tools/kvm_stat: switch to python3

  * [SRU] Fix Xorg crash with nomodeset when BIOS enable 64-bit fb addr
    (LP: #1812797)
    - vgaarb: Add support for 64-bit frame buffer address
    - vgaarb: Keep adding VGA device in queue

  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
    - USB: Add new USB LPM helpers
    - USB: Consolidate LPM checks to avoid enabling LPM twice

  * ptrace-tm-spd-gpr in powerpc/ptrace from ubuntu_kerenl_selftests failed on
    Bionic P8 (LP: #1813127)
    - selftests/powerpc: Fix ptrace tm failure

  * [SRU] IO's are issued with incorrect Scatter Gather Buffer (LP: #1795453)
    - scsi: megaraid_sas: Use 63-bit DMA addressing

  * Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
    - [Config] Enable timestamping in network PHY devices

  * CVE-2018-19854
    - crypto: user - fix leaking uninitialized memory to userspace

  * x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000
    (LP: #1813532)
    - x86/mm: Do not warn about PCI BIOS W+X mappings

  * CVE-2019-6133
    - fork: record start_time late

  * Fix not working Goodix touchpad (LP: #1811929)
    - HID: i2c-hid: Disable runtime PM on Goodix touchpad

  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y

  * X1 Extreme: only one of the two SSDs is loaded (LP: #1811755)
    - nvme-core: rework a NQN copying operation
    - nvme: pad fake subsys NQN vid and ssvid with zeros
    - nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN

  * Crash on "ip link add foo type ipip" (LP: #1811803)
    - SAUCE: fan: Fix NULL pointer dereference

 -- Khalid Elmously <khalid.elmously@canonical.com>  Wed, 06 Feb 2019 04:57:21 +0000

linux (4.15.0-45.48) bionic; urgency=medium

  * linux: 4.15.0-45.48 -proposed tracker (LP: #1813779)

  * External monitors does not work anymore 4.15.0-44 (LP: #1813663)
    - SAUCE: Revert "drm/i915/dp: Send DPCD ON for MST before phy_up"

  * kernel 4.15.0-44 cannot mount ext4 fs with meta_bg enabled (LP: #1813727)
    - ext4: fix false negatives *and* false positives in ext4_check_descriptors()

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 29 Jan 2019 16:39:15 +0100

linux (4.15.0-44.47) bionic; urgency=medium

  * linux: 4.15.0-44.47 -proposed tracker (LP: #1811419)

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  * CPU hard lockup with rigorous writes to NVMe drive (LP: #1810998)
    - blk-wbt: pass in enum wbt_flags to get_rq_wait()
    - blk-wbt: Avoid lock contention and thundering herd issue in wbt_wait
    - blk-wbt: move disable check into get_limit()
    - blk-wbt: use wq_has_sleeper() for wq active check
    - blk-wbt: fix has-sleeper queueing check
    - blk-wbt: abstract out end IO completion handler
    - blk-wbt: improve waking of tasks

  * To reduce the Realtek USB cardreader power consumption (LP: #1811337)
    - mmc: sdhci: Disable 1.8v modes (HS200/HS400/UHS) if controller can't support
      1.8v
    - mmc: core: Introduce MMC_CAP_SYNC_RUNTIME_PM
    - mmc: rtsx_usb_sdmmc: Don't runtime resume the device while changing led
    - mmc: rtsx_usb: Use MMC_CAP2_NO_SDIO
    - mmc: rtsx_usb: Enable MMC_CAP_ERASE to allow erase/discard/trim requests
    - mmc: rtsx_usb_sdmmc: Re-work runtime PM support
    - mmc: rtsx_usb_sdmmc: Re-work card detection/removal support
    - memstick: rtsx_usb_ms: Add missing pm_runtime_disable() in probe function
    - misc: rtsx_usb: Use USB remote wakeup signaling for card insertion detection
    - memstick: Prevent memstick host from getting runtime suspended during card
      detection
    - memstick: rtsx_usb_ms: Use ms_dev() helper
    - memstick: rtsx_usb_ms: Support runtime power management

  * Support non-strict iommu mode on arm64 (LP: #1806488)
    - iommu/io-pgtable-arm: Fix race handling in split_blk_unmap()
    - iommu/arm-smmu-v3: Implement flush_iotlb_all hook
    - iommu/dma: Add support for non-strict mode
    - iommu: Add "iommu.strict" command line option
    - iommu/io-pgtable-arm: Add support for non-strict mode
    - iommu/arm-smmu-v3: Add support for non-strict mode
    - iommu/io-pgtable-arm-v7s: Add support for non-strict mode
    - iommu/arm-smmu: Support non-strict mode

  * ELAN900C:00 04F3:2844 touchscreen doesn't work (LP: #1811335)
    - pinctrl: cannonlake: Fix community ordering for H variant
    - pinctrl: cannonlake: Fix HOSTSW_OWN register offset of H variant

  * Add Cavium ThunderX2 SoC UNCORE PMU driver (LP: #1811200)
    - perf: Export perf_event_update_userpage
    - Documentation: perf: Add documentation for ThunderX2 PMU uncore driver
    - drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver
    - [Config] New config CONFIG_THUNDERX2_PMU=m

  * Update hisilicon SoC-specific drivers (LP: #1810457)
    - SAUCE: Revert "net: hns3: Updates RX packet info fetch in case of multi BD"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
      resetting"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Use roce handle when calling roce
      callback function"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add calling roce callback
      function when link status change"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: optimize the process of notifying
      roce client"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE"
    - scsi: hisi_sas: Remove depends on HAS_DMA in case of platform dependency
    - ethernet: hisilicon: hns: hns_dsaf_mac: Use generic eth_broadcast_addr
    - scsi: hisi_sas: consolidate command check in hisi_sas_get_ata_protocol()
    - scsi: hisi_sas: remove some unneeded structure members
    - scsi: hisi_sas: Introduce hisi_sas_phy_set_linkrate()
    - net: hns: Fix the process of adding broadcast addresses to tcam
    - net: hns3: remove redundant variable 'protocol'
    - scsi: hisi_sas: Drop hisi_sas_slot_abort()
    - net: hns: Make many functions static
    - net: hns: make hns_dsaf_roce_reset non static
    - net: hisilicon: hns: Replace mdelay() with msleep()
    - net: hns3: fix return value error while hclge_cmd_csq_clean failed
    - net: hns: remove redundant variables 'max_frm' and 'tmp_mac_key'
    - net: hns: Mark expected switch fall-through
    - net: hns3: Mark expected switch fall-through
    - net: hns3: Remove tx ring BD len register in hns3_enet
    - net: hns: modify variable type in hns_nic_reuse_page
    - net: hns: use eth_get_headlen interface instead of hns_nic_get_headlen
    - net: hns3: modify variable type in hns3_nic_reuse_page
    - net: hns3: Fix for vf vlan delete failed problem
    - net: hns3: Fix for multicast failure
    - net: hns3: Fix error of checking used vlan id
    - net: hns3: Implement shutdown ops in hns3 pci driver
    - net: hns3: Fix for loopback selftest failed problem
    - net: hns3: Fix ping exited problem when doing lp selftest
    - net: hns3: Preserve vlan 0 in hardware table
    - net: hns3: Only update mac configuation when necessary
    - net: hns3: Change the dst mac addr of loopback packet
    - net: hns3: Remove redundant codes of query advertised flow control abilitiy
    - net: hns3: Refine hns3_get_link_ksettings()
    - net: hns: make function hns_gmac_wait_fifo_clean() static
    - net: hns3: Add default irq affinity
    - net: hns3: Add unlikely for buf_num check
    - net: hns3: Remove tx budget to clean more TX descriptors in a napi
    - net: hns3: Remove packet statistics of public
    - net: hns3: Add support for hns3_nic_netdev_ops.ndo_do_ioctl
    - net: hns3: Set STATE_DOWN bit of hdev state when stopping net
    - net: hns3: Check hdev state when getting link status
    - net: hns3: Fix for setting speed for phy failed problem
    - net: hns3: Fix cmdq registers initialization issue for vf
    - net: hns3: Clear client pointer when initialize client failed or unintialize
      finished
    - net: hns3: Fix client initialize state issue when roce client initialize
      failed
    - net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg()
    - net: hns3: Fix ets validate issue
    - net: hns3: Unify the type convert for desc.data
    - net: hns3: Adjust prefix of tx/rx statistic names
    - net: hns3: Fix tqp array traversal condition for vf
    - net: hns3: Unify the prefix of vf functions
    - net: hns3: Add handle for default case
    - net: hns3: Add nic state check before calling netif_tx_wake_queue
    - net: hns3: Add unlikely for dma_mapping_error check
    - net: hns3: Remove print messages for error packet
    - net: hns3: Add get_media_type ops support for VF
    - net: hns3: Fix speed/duplex information loss problem when executing ethtool
      ethx cmd of VF
    - net: hns3: Remove redundant hclge_get_port_type()
    - net: hns3: Add support for sctp checksum offload
    - net: hns3: Set extra mac address of pause param for HW
    - net: hns3: Rename loop mode
    - net: hns3: Rename mac loopback to app loopback
    - net: hns3: Add serdes parallel inner loopback support
    - net: hns3: Fix for packet buffer setting bug
    - net: hns3: Fix for netdev not up problem when setting mtu
    - net: hns3: Change return type of hclge_tm_schd_info_update()
    - net: hns3: Modify hns3_get_max_available_channels
    - net: hns3: Fix loss of coal configuration while doing reset
    - net: hns: remove ndo_poll_controller
    - hns3: Fix the build.
    - hns3: Another build fix.
    - net: hns3: Add flow director initialization
    - net: hns3: Add input key and action config support for flow director
    - net: hns3: Add support for rule add/delete for flow director
    - net: hns3: Add support for rule query of flow director
    - net: hns3: Add reset handle for flow director
    - net: hns3: Remove all flow director rules when unload hns3 driver
    - net: hns3: Add support for enable/disable flow director
    - net: hns3: Remove the default mask configuration for mac vlan table
    - net: hns3: Clear mac vlan table entries when unload driver or function reset
    - net: hns3: Optimize for unicast mac vlan table
    - net: hns3: Drop depricated mta table support
    - net: hns3: Add egress/ingress vlan filter for revision 0x21
    - net: hns3: Fix for rx vlan id handle to support Rev 0x21 hardware
    - net: hns3: Add new RSS hash algorithm support for PF
    - net: hns3: Add RSS general configuration support for VF
    - net: hns3: Add RSS tuples support for VF
    - net: hns3: Add HW RSS hash information to RX skb
    - net: hns3: Enable promisc mode when mac vlan table is full
    - net: hns3: Resume promisc mode and vlan filter status after reset
    - net: hns3: Resume promisc mode and vlan filter status after loopback test
    - scsi: hisi_sas: Feed back linkrate(max/min) when re-attached
    - scsi: hisi_sas: Move evaluation of hisi_hba in hisi_sas_task_prep()
    - scsi: hisi_sas: Fix the race between IO completion and timeout for
      SMP/internal IO
    - scsi: hisi_sas: Free slot later in slot_complete_vx_hw()
    - scsi: hisi_sas: unmask interrupts ent72 and ent74
    - scsi: hisi_sas: Use block layer tag instead for IPTT
    - scsi: hisi_sas: Update v3 hw AIP_LIMIT and CFG_AGING_TIME register values
    - net: hns3: remove hns3_fill_desc_tso
    - net: hns3: move DMA map into hns3_fill_desc
    - net: hns3: add handling for big TX fragment
    - net: hns3: rename hns_nic_dma_unmap
    - net: hns3: fix for multiple unmapping DMA problem
    - scsi: hisi_sas: Fix spin lock management in slot_index_alloc_quirk_v2_hw()
    - scsi: hisi_sas: Fix NULL pointer dereference
    - net: hns3: Add PCIe AER callback error_detected
    - net: hns3: Add PCIe AER error recovery
    - net: hns3: Add support to enable and disable hw errors
    - net: hns3: Add enable and process common ecc errors
    - net: hns3: Add enable and process hw errors from IGU, EGU and NCSI
    - net: hns3: Add enable and process hw errors from PPP
    - net: hns3: Add enable and process hw errors of TM scheduler
    - net: hns3: Fix for warning uninitialized symbol hw_err_lst3
    - net: hns3: fix spelling mistake "intrerrupt" -> "interrupt"
    - net: hns3: add error handler for hns3_nic_init_vector_data()
    - net: hns3: bugfix for buffer not free problem during resetting
    - net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem
    - net: hns3: bugfix for the initialization of command queue's spin lock
    - net: hns3: remove unnecessary queue reset in the hns3_uninit_all_ring()
    - net: hns3: bugfix for is_valid_csq_clean_head()
    - net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read
    - net: hns3: fix incorrect return value/type of some functions
    - net: hns3: bugfix for handling mailbox while the command queue reinitialized
    - net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
    - net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
    - net: hns3: Fix for out-of-bounds access when setting pfc back pressure
    - scsi: hisi_sas: Remove set but not used variable 'dq_list'
    - net: hns3: bugfix for not checking return value
    - net: hns: Incorrect offset address used for some registers.
    - net: hns: All ports can not work when insmod hns ko after rmmod.
    - net: hns: Some registers use wrong address according to the datasheet.
    - net: hns: Fixed bug that netdev was opened twice
    - net: hns: Clean rx fbd when ae stopped.
    - net: hns: Free irq when exit from abnormal branch
    - net: hns: Avoid net reset caused by pause frames storm
    - net: hns: Fix ntuple-filters status error.
    - net: hns: Add mac pcs config when enable|disable mac
    - net: hns: Fix ping failed when use net bridge and send multicast
    - net: hns3: use HNS3_NIC_STATE_INITED to indicate the initialization state of
      enet
    - net: hns3: add set_default_reset_request in the hnae3_ae_ops
    - net: hns3: provide some interface & information for the client
    - net: hns3: adjust the location of clearing the table when doing reset
    - net: hns3: enable/disable ring in the enet while doing UP/DOWN
    - net: hns3: use HNS3_NIC_STATE_RESETTING to indicate resetting
    - net: hns3: ignore new coming low-level reset while doing high-level reset
    - net: hns3: move some reset information from hnae3_handle into
      hclge_dev/hclgevf_dev
    - net: hns3: adjust the process of PF reset
    - net: hns3: call roce's reset notify callback when resetting
    - net: hns3: add error handler for hclge_reset()
    - net: hns3: fix for cmd queue memory not freed problem during reset
    - net: hns3: Remove set but not used variable 'reset_level'
    - net: hns3: fix spelling mistake, "assertting" -> "asserting"
    - net: hns3: add reset_hdev to reinit the hdev in VF's reset process
    - net: hns3: adjust VF's reset process
    - net: hns3: add reset handling for VF when doing PF reset
    - net: hns3: add reset handling for VF when doing Core/Global/IMP reset
    - net: hns3: stop handling command queue while resetting VF
    - net: hns3: add error handler for hclgevf_reset()
    - net: hns3: stop napi polling when HNS3_NIC_STATE_DOWN is set
    - net: hns3: implement the IMP reset processing for PF
    - net: hns3: add PCIe FLR support for PF
    - net: hns3: do VF's pci re-initialization while PF doing FLR
    - net: hns3: add PCIe FLR support for VF
    - net: hns3: Enable HW GRO for Rev B(=0x21) HNS3 hardware
    - net: hns3: Add handling of GRO Pkts not fully RX'ed in NAPI poll
    - net: hns3: Add skb chain when num of RX buf exceeds MAX_SKB_FRAGS
    - net: hns3: Adds GRO params to SKB for the stack
    - scsi: hisi_sas: use dma_set_mask_and_coherent
    - scsi: hisi_sas: Create separate host attributes per HBA
    - scsi: hisi_sas: Add support for interrupt converge for v3 hw
    - scsi: hisi_sas: Add support for interrupt coalescing for v3 hw
    - scsi: hisi_sas: Relocate some codes to avoid an unused check
    - scsi: hisi_sas: change the time of SAS SSP connection
    - net: hns3: fix spelling mistake "failded" -> "failed"
    - net: hns3: Support two vlan header when setting mtu
    - net: hns3: Refactor mac mtu setting related functions
    - net: hns3: Add vport alive state checking support
    - net: hns3: Add mtu setting support for vf
    - net: hns3: up/down netdev in hclge module when setting mtu
    - net: hns3: add common validation in hclge_dcb
    - net: hns3: Add debugfs framework registration
    - net: hns3: Add "queue info" query function
    - net: hns3: Add "FD flow table" info query function
    - net: hns3: Add "tc config" info query function
    - net: hns3: Add "tm config" info query function
    - net: hns3: Add "qos pause" config info query function
    - net: hns3: Add "qos prio map" info query function
    - net: hns3: Add "qos buffer" config info query function
    - net: hns3: Support "ethtool -d" for HNS3 VF driver
    - net: hns3: Adds support to dump(using ethool-d) PCIe regs in HNS3 PF driver
    - net: hns3: remove existing process error functions and reorder hw_blk table
    - net: hns3: rename enable error interrupt functions
    - net: hns3: re-enable error interrupts on hw reset
    - net: hns3: deletes unnecessary settings of the descriptor data
    - net: hns3: rename process_hw_error function
    - net: hns3: add optimization in the hclge_hw_error_set_state
    - net: hns3: add handling of hw ras errors using new set of commands
    - net: hns3: deleted logging 1 bit errors
    - net: hns3: add handling of hw errors reported through MSIX
    - net: hns3: add handling of hw errors of MAC
    - net: hns3: handle hw errors of PPP PF
    - net: hns3: handle hw errors of PPU(RCB)
    - net: hns3: handle hw errors of SSU
    - net: hns3: add handling of RDMA RAS errors
    - net: hns3: fix spelling mistake "offser" -> "offset"
    - scsi: hisi_sas: Fix warnings detected by sparse
    - scsi: hisi_sas: Relocate some code to reduce complexity
    - scsi: hisi_sas: Make sg_tablesize consistent value
    - hns3: prevent building without CONFIG_INET
    - net: hns3: Add "bd info" query function
    - net: hns3: Add "manager table" information query function
    - net: hns3: Add "status register" information query function
    - net: hns3: Add "dcb register" status information query function
    - net: hns3: Add "queue map" information query function
    - net: hns3: Add "tm map" status information query function
    - net: hns3: fix error handling int the hns3_get_vector_ring_chain
    - net: hns3: uninitialize pci in the hclgevf_uninit
    - net: hns3: fix napi_disable not return problem
    - net: hns3: update some variables while hclge_reset()/hclgevf_reset() done
    - net: hns3: remove unnecessary configuration recapture while resetting
    - net: hns3: fix incomplete uninitialization of IRQ in the
      hns3_nic_uninit_vector_data()
    - net: hns3: update coalesce param per second
    - net: hns3: remove 1000M/half support of phy
    - net: hns3: synchronize speed and duplex from phy when phy link up
    - net: hns3: getting tx and dv buffer size through firmware
    - net: hns3: aligning buffer size in SSU to 256 bytes
    - net: hns3: fix a SSU buffer checking bug
    - scsi: hisi_sas: Add support for DIF feature for v2 hw
    - net: hns3: refine the handle for hns3_nic_net_open/stop()
    - net: hns3: change default tc state to close
    - net: hns3: fix a bug caused by udelay
    - net: hns3: add max vector number check for pf
    - net: hns3: reset tqp while doing DOWN operation
    - net: hns3: fix vf id check issue when add flow director rule
    - net: hns3: don't restore rules when flow director is disabled
    - net: hns3: fix the descriptor index when get rss type
    - net: hns3: remove redundant variable initialization
    - net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT

  * iptables connlimit allows more connections than the limit when using
    multiple CPUs (LP: #1811094)
    - SAUCE: netfilter: xt_connlimit: remove the 'addr' parameter in add_hlist()
    - netfilter: nf_conncount: expose connection list interface
    - netfilter: nf_conncount: Fix garbage collection with zones
    - netfilter: nf_conncount: fix garbage collection confirm race
    - netfilter: nf_conncount: don't skip eviction when age is negative

  * CVE-2018-16882
    - KVM: Fix UAF in nested posted interrupt processing

  * Cannot initialize ATA disk if IDENTIFY command fails (LP: #1809046)
    - scsi: libsas: check the ata device status by ata_dev_enabled()

  * scsi: libsas: fix a race condition when smp task timeout (LP: #1808912)
    - scsi: libsas: fix a race condition when smp task timeout

  * CVE-2018-14625
    - vhost/vsock: fix use-after-free in network stack callers

  * Fix and issue that LG I2C touchscreen stops working after reboot
    (LP: #1805085)
    - HID: i2c-hid: Disable runtime PM for LG touchscreen

  * powerpc/powernv/pci: Work around races in PCI bridge enabling (LP: #1805245)
    - powerpc/powernv/pci: Work around races in PCI bridge enabling

  * Drivers: hv: vmbus: Offload the handling of channels to two workqueues
    (LP: #1807757)
    - hv_netvsc: fix network namespace issues with VF support
    - hv_netvsc: split sub-channel setup into async and sync
    - Drivers: hv: vmbus: Fix the offer_in_progress in vmbus_process_offer()
    - hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()
    - vmbus: don't return values for uninitalized channels
    - Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
    - Drivers: hv: vmbus: Offload the handling of channels to two workqueues

  * Disable LPM for Raydium Touchscreens (LP: #1802248)
    - USB: quirks: Add no-lpm quirk for Raydium touchscreens

  * Power leakage at S5 with Qualcomm Atheros QCA9377 802.11ac Wireless Network
    Adapter (LP: #1805607)
    - SAUCE: ath10k: provide reset function for QCA9377 chip

  * CVE-2018-17972
    - proc: restrict kernel stack dumps to root

  * CVE-2018-19407
    - KVM: X86: Fix scan ioapic use-before-initialization

  * CVE-2018-18281
    - mremap: properly flush TLB before releasing the page

  * Fix USB2 device wrongly detected as USB1 (LP: #1806534)
    - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc

  * armhf guests fail to boot in EFI mode (LP: #1809488)
    - efi/arm: Revert deferred unmap of early memmap mapping

  * Bionic shows incorrect warning about number of pointers in TFD
    (LP: #1801102)
    - iwlwifi: pcie: don't warn if we use all the transmit pointers

  * audio output has constant noise on a Dell machine (LP: #1810891)
    - ALSA: hda/realtek - Fixed headphone issue for ALC700

  * ldisc crash on reopened tty (LP: #1791758)
    - tty: Drop tty->count on tty_reopen() failure
    - tty: Hold tty_ldisc_lock() during tty_reopen()
    - tty: Don't block on IO when ldisc change is pending
    - tty: Simplify tty->count math in tty_reopen()

  * SATA device is not going to DEVSLP (LP: #1781533)
    - ahci: Allow setting a default LPM policy for mobile chipsets
    - ata: libahci: Correct setting of DEVSLP register
    - ata: libahci: Allow reconfigure of DEVSLP register
    - ata: ahci: Support state with min power but Partial low power state
    - ata: ahci: Enable DEVSLP by default on x86 with SLP_S0
    - [Config] set CONFIG_SATA_MOBILE_LPM_POLICY=0

  * Console got stuck using serial tty after logout (LP: #1808097)
    - tty: do not set TTY_IO_ERROR flag if console port

  * fanotify10 in ubuntu_ltp_syscalls failed (LP: #1802454)
    - fsnotify: fix ignore mask logic in fsnotify()

  * SRU: Fix kernel xhci hang when resume from S3 (LP: #1805344)
    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
    - usb: xhci: fix timeout for transition from RExit to U0

  * Add pointstick support for Cirque Touchpad (LP: #1805081)
    - HID: multitouch: Add pointstick support for Cirque Touchpad

  * Intel NVMe drives timeout when nvme format is attempted (LP: #1797587)
    - nvme: Use admin command effects for admin commands

  * lineout jack can't work on a Dell machine (LP: #1810892)
    - ALSA: hda/realtek - Support Dell headset mode for New AIO platform

  * Bionic update: upstream stable patchset 2019-01-04 (LP: #1810554)
    - MIPS: Call dump_stack() from show_regs()
    - MIPS: Use async IPIs for arch_trigger_cpumask_backtrace()
    - MIPS: Fix ioremap() RAM check
    - mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states
    - mmc: dw_mmc: fix card threshold control configuration
    - ibmasm: don't write out of bounds in read handler
    - staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
    - staging: r8822be: Fix RTL8822be can't find any wireless AP
    - ata: Fix ZBC_OUT command block check
    - ata: Fix ZBC_OUT all bit handling
    - vmw_balloon: fix inflation with batching
    - ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
    - USB: serial: ch341: fix type promotion bug in ch341_control_in()
    - USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
    - USB: serial: keyspan_pda: fix modem-status error handling
    - USB: serial: mos7840: fix status-register error handling
    - usb: quirks: add delay quirks for Corsair Strafe
    - xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
    - ALSA: hda - Handle pm failure during hotplug
    - fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps*
    - fs, elf: make sure to page align bss in load_elf_library
    - mm: do not bug_on on incorrect length in __mm_populate()
    - tracing: Reorder display of TGID to be after PID
    - kbuild: delete INSTALL_FW_PATH from kbuild documentation
    - arm64: neon: Fix function may_use_simd() return error status
    - tools build: fix # escaping in .cmd files for future Make
    - IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values
    - i2c: tegra: Fix NACK error handling
    - iw_cxgb4: correctly enforce the max reg_mr depth
    - xen: setup pv irq ops vector earlier
    - nvme-pci: Remap CMB SQ entries on every controller reset
    - crypto: x86/salsa20 - remove x86 salsa20 implementations
    - uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
    - netfilter: nf_queue: augment nfqa_cfg_policy
    - netfilter: x_tables: initialise match/target check parameter struct
    - loop: add recursion validation to LOOP_CHANGE_FD
    - PM / hibernate: Fix oops at snapshot_write()
    - RDMA/ucm: Mark UCM interface as BROKEN
    - loop: remember whether sysfs_create_group() was done
    - f2fs: give message and set need_fsck given broken node id
    - mm: do not drop unused pages when userfaultd is running
    - bpf: reject passing modified ctx to helper functions
    - mei: discard messages from not connected client during power down.
    - mm: zero unavailable pages before memmap init
    - xen: remove global bit from __default_kernel_pte_mask for pv guests
    - f2fs: return error during fill_super
    - f2fs: avoid bug_on on corrupted inode
    - f2fs: sanity check on sit entry
    - f2fs: sanity check for total valid node blocks
    - ARM: dts: armada-38x: use the new thermal binding
    - mm: don't do zero_resv_unavail if memmap is not allocated

  * Blacklist Realtek Virtual IPMI device (LP: #1808353)
    - ipmi:pci: Blacklist a Realtek "IPMI" device

  * Ethernet[10ec:8136] doesn't work after S3 with kernel 4.15.0.43.64
    (LP: #1809847)
    - SAUCE: Revert "r8169: don't use MSI-X on RTL8106e"
    - r8169: re-enable MSI-X on RTL8168g

  * Killer 802.11ac 2x2 (1550 or 1550i) [8086:2526][1a56:1550] is not supported
    (LP: #1809219)
    - iwlwifi: add more card IDs for 9000 series

  * Support new Realtek ethernet chips (LP: #1811055)
    - r8169: Add support for new Realtek Ethernet

  * PC SN720 NVMe WDC 256GB consumes more power in S2Idle than during long idle
    (LP: #1805775)
    - SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3 and being
      disabled

  * Power consumption during s2idle is higher than long idle (Intel SSDPEKKF)
    (LP: #1804588)
    - SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3
    - SAUCE: nvme: add quirk to not call disable function when suspending

  * mpt3sas - driver using the wrong register to update a queue index in FW
    (LP: #1810781)
    - scsi: mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5
      controllers when HBA supports more than 16 MSI-x vectors.

  * HP mobile workstations with hybrid graphics support, can not directly output
    to external monitors by dGPU (LP: #1810702)
    - ACPI / OSI: Add OEM _OSI string to enable dGPU direct output

  * broken touchpad after i2c-i801 blacklist change (LP: #1802135)
    - i2c: i801: Don't restore config registers on runtime PM

  * Enable new Realtek card reader (LP: #1806335)
    - USB: usb-storage: Add new IDs to ums-realtek
    - SAUCE: (noup) USB: usb-storage: Make MMC support optional on ums-realtek

  * The line-out on the Dell Dock station can't work (LP: #1806532)
    - ALSA: usb-audio: Allow to override the longname string
    - ALSA: usb-audio: Give proper vendor/product name for Dell WD15 Dock
    - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] getabis -- handle all known package combinations
    - [Packaging] getabis -- support parsing a simple version

  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
    - igb: Fix an issue that PME is not enabled during runtime suspend

  * Fix Terminus USB hub that may breaks connected USB devices after S3
    (LP: #1806850)
    - USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub

  * Add support for Dell DW5821e WWAN/GPS module (LP: #1807342)
    - qmi_wwan: add support for the Dell Wireless 5821e module
    - qmi_wwan: fix interface number for DW5821e production firmware
    - USB: option: add support for DW5821e

  * Add support for 0cf3:535b QCA_ROME device (LP: #1807333)
    - Bluetooth: btusb: Add support for 0cf3:535b QCA_ROME device

  * The mute led can't work anymore on the lenovo x1 carbon (LP: #1808465)
    - ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon

  * click/pop noise in the headphone on several lenovo laptops (LP: #1805079) //
    click/pop noise in the headphone on several lenovo laptops (LP: #1805079)
    - ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops

  * Touchpad stops working after reboot on Apollo Lake (LP: #1728244)
    - HID: i2c-hid: disable runtime PM operations on hantick touchpad

  * MAC address pass through on RTL8153-BND for docking station (LP: #1808729)
    - r8152: Add support for MAC address pass through on RTL8153-BND

  * [Ubuntu] kernel: zcrypt: reinit ap queue state machine (LP: #1805414)
    - s390/zcrypt: reinit ap queue state machine during device probe

  * [UBUNTU] qeth: fix length check in SNMP processing (LP: #1805802)
    - s390/qeth: fix length check in SNMP processing

  * ASPEED server console output extremely slow after upgrade to 18.04
    (LP: #1808183)
    - drm/ast: Remove existing framebuffers before loading driver

  * Bionic update: upstream stable patchset 2018-12-13 (LP: #1808399)
    - userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access
    - mm: hugetlb: yield when prepping struct pages
    - tracing: Fix missing return symbol in function_graph output
    - scsi: target: Fix truncated PR-in ReadKeys response
    - s390: Correct register corruption in critical section cleanup
    - drbd: fix access after free
    - vfio: Use get_user_pages_longterm correctly
    - cifs: Fix use after free of a mid_q_entry
    - cifs: Fix memory leak in smb2_set_ea()
    - cifs: Fix infinite loop when using hard mount option
    - drm: Use kvzalloc for allocating blob property memory
    - drm/udl: fix display corruption of the last line
    - jbd2: don't mark block as modified if the handle is out of credits
    - ext4: add corruption check in ext4_xattr_set_entry()
    - ext4: always verify the magic number in xattr blocks
    - ext4: make sure bitmaps and the inode table don't overlap with bg
      descriptors
    - ext4: always check block group bounds in ext4_init_block_bitmap()
    - ext4: only look at the bg_flags field if it is valid
    - ext4: verify the depth of extent tree in ext4_find_extent()
    - ext4: include the illegal physical block in the bad map ext4_error msg
    - ext4: never move the system.data xattr out of the inode body
    - ext4: avoid running out of journal credits when appending to an inline file
    - ext4: add more inode number paranoia checks
    - ext4: add more mount time checks of the superblock
    - ext4: check superblock mapped prior to committing
    - HID: i2c-hid: Fix "incomplete report" noise
    - HID: hiddev: fix potential Spectre v1
    - HID: debug: check length before copy_to_user()
    - media: vb2: core: Finish buffers at the end of the stream
    - f2fs: truncate preallocated blocks in error case
    - Revert "dpaa_eth: fix error in dpaa_remove()"
    - Kbuild: fix # escaping in .cmd files for future Make
    - media: cx25840: Use subdev host data for PLL override
    - fs: allow per-device dax status checking for filesystems
    - dax: change bdev_dax_supported() to support boolean returns
    - dax: check for QUEUE_FLAG_DAX in bdev_dax_supported()
    - dm: set QUEUE_FLAG_DAX accordingly in dm_table_set_restrictions()
    - dm: prevent DAX mounts if not supported
    - mtd: cfi_cmdset_0002: Change definition naming to retry write operation
    - mtd: cfi_cmdset_0002: Change erase functions to retry for error
    - mtd: cfi_cmdset_0002: Change erase functions to check chip good only
    - netfilter: nf_log: don't hold nf_log_mutex during user access
    - staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
    - sched, tracing: Fix trace_sched_pi_setprio() for deboosting
    - PCI / ACPI / PM: Resume bridges w/o drivers on suspend-to-RAM
    - drm/amdgpu: Make struct amdgpu_atif private to amdgpu_acpi.c
    - scsi: aacraid: Fix PD performance regression over incorrect qd being set
    - ARM: dts: imx51-zii-rdu1: fix touchscreen pinctrl
    - drm/amdgpu: Add amdgpu_atpx_get_dhandle()
    - drm/amdgpu: Dynamically probe for ATIF handle (v2)
    - i2c: core: smbus: fix a potential missing-check bug

  * Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185)
    - usb: cdc_acm: Add quirk for Uniden UBC125 scanner
    - USB: serial: cp210x: add CESINEL device ids
    - USB: serial: cp210x: add Silicon Labs IDs for Windows Update
    - usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub
    - acpi: Add helper for deactivating memory region
    - usb: typec: ucsi: acpi: Workaround for cache mode issue
    - usb: typec: ucsi: Fix for incorrect status data issue
    - xhci: Fix kernel oops in trace_xhci_free_virt_device
    - n_tty: Fix stall at n_tty_receive_char_special().
    - n_tty: Access echo_* variables carefully.
    - staging: android: ion: Return an ERR_PTR in ion_map_kernel
    - serial: 8250_pci: Remove stalled entries in blacklist
    - serdev: fix memleak on module unload
    - vt: prevent leaking uninitialized data to userspace via /dev/vcs*
    - drm/amdgpu: Add APU support in vi_set_uvd_clocks
    - drm/amdgpu: Add APU support in vi_set_vce_clocks
    - drm/amdgpu: fix the missed vcn fw version report
    - drm/qxl: Call qxl_bo_unref outside atomic context
    - drm/atmel-hlcdc: check stride values in the first plane
    - drm/amdgpu: Use kvmalloc_array for allocating VRAM manager nodes array
    - drm/amdgpu: Refactor amdgpu_vram_mgr_bo_invisible_size helper
    - drm/i915: Enable provoking vertex fix on Gen9 systems.
    - netfilter: nf_tables: nft_compat: fix refcount leak on xt module
    - netfilter: nft_compat: prepare for indirect info storage
    - netfilter: nft_compat: fix handling of large matchinfo size
    - netfilter: nf_tables: don't assume chain stats are set when jumplabel is set
    - netfilter: nf_tables: bogus EBUSY in chain deletions
    - netfilter: nft_meta: fix wrong value dereference in nft_meta_set_eval
    - netfilter: nf_tables: disable preemption in nft_update_chain_stats()
    - netfilter: nf_tables: increase nft_counters_enabled in
      nft_chain_stats_replace()
    - netfilter: nf_tables: fix memory leak on error exit return
    - netfilter: nf_tables: add missing netlink attrs to policies
    - netfilter: nf_tables: fix NULL-ptr in nf_tables_dump_obj()
    - netfilter: don't set F_IFACE on ipv6 fib lookups
    - netfilter: ip6t_rpfilter: provide input interface for route lookup
    - netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
    - ARM: dts: imx6q: Use correct SDMA script for SPI5 core
    - xfrm6: avoid potential infinite loop in _decode_session6()
    - afs: Fix directory permissions check
    - netfilter: ebtables: handle string from userspace with care
    - s390/dasd: use blk_mq_rq_from_pdu for per request data
    - netfilter: nft_limit: fix packet ratelimiting
    - ipvs: fix buffer overflow with sync daemon and service
    - iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
    - atm: zatm: fix memcmp casting
    - net: qmi_wwan: Add Netgear Aircard 779S
    - perf test: "Session topology" dumps core on s390
    - perf bpf: Fix NULL return handling in bpf__prepare_load()
    - fs: clear writeback errors in inode_init_always
    - sched/core: Fix rules for running on online && !active CPUs
    - sched/core: Require cpu_active() in select_task_rq(), for user tasks
    - platform/x86: asus-wmi: Fix NULL pointer dereference
    - net/sonic: Use dma_mapping_error()
    - net: dsa: b53: Add BCM5389 support
    - usb: typec: tcpm: fix logbuffer index is wrong if _tcpm_log is re-entered
    - iio: mma8452: Fix ignoring MMA8452_INT_DRDY
    - drm/amdgpu: fix clear_all and replace handling in the VM (v2)
    - drm/amd/display: Clear connector's edid pointer
    - drm/i915/dp: Send DPCD ON for MST before phy_up
    - drm/amdgpu: remove DC special casing for KB/ML
    - drm/amdgpu: Don't default to DC support for Kaveri and older
    - drm/amdgpu: GPU vs CPU page size fixes in amdgpu_vm_bo_split_mapping
    - drm/amd/display: release spinlock before committing updates to stream
    - drm/i915: Fix PIPESTAT irq ack on i965/g4x
    - ARM64: dts: meson-gxl-s905x-p212: Add phy-supply for usb0
    - x86/mm: Don't free P4D table when it is folded at runtime

  * Bionic update: upstream stable patchset 2018-12-07 (LP: #1807469)
    - x86/spectre_v1: Disable compiler optimizations over
      array_index_mask_nospec()
    - x86/mce: Improve error message when kernel cannot recover
    - x86/mce: Check for alternate indication of machine check recovery on Skylake
    - x86/mce: Fix incorrect "Machine check from unknown source" message
    - x86/mce: Do not overwrite MCi_STATUS in mce_no_way_out()
    - x86: Call fixup_exception() before notify_die() in math_error()
    - m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
    - m68k/mac: Fix SWIM memory resource end address
    - serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
    - signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
    - PM / Domains: Fix error path during attach in genpd
    - PM / core: Fix supplier device runtime PM usage counter imbalance
    - PM / OPP: Update voltage in case freq == old_freq
    - usb: do not reset if a low-speed or full-speed device timed out
    - 1wire: family module autoload fails because of upper/lower case mismatch.
    - ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
    - ASoC: cs35l35: Add use_single_rw to regmap config
    - ASoC: cirrus: i2s: Fix LRCLK configuration
    - ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
    - thermal: bcm2835: Stop using printk format %pCr
    - clk: renesas: cpg-mssr: Stop using printk format %pCr
    - lib/vsprintf: Remove atomic-unsafe support for %pCr
    - ftrace/selftest: Have the reset_trigger code be a bit more careful
    - mips: ftrace: fix static function graph tracing
    - branch-check: fix long->int truncation when profiling branches
    - ipmi:bt: Set the timeout before doing a capabilities check
    - Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
    - printk: fix possible reuse of va_list variable
    - fuse: fix congested state leak on aborted connections
    - fuse: atomic_o_trunc should truncate pagecache
    - fuse: don't keep dead fuse_conn at fuse_fill_super().
    - fuse: fix control dir setup and teardown
    - powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
    - powerpc/ptrace: Fix setting 512B aligned breakpoints with
      PTRACE_SET_DEBUGREG
    - powerpc/ptrace: Fix enforcement of DAWR constraints
    - powerpc/powernv/ioda2: Remove redundant free of TCE pages
    - powerpc/powernv: copy/paste - Mask SO bit in CR
    - powerpc/fadump: Unregister fadump on kexec down path.
    - soc: rockchip: power-domain: Fix wrong value when power up pd with writemask
    - ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
    - ARM: dts: Fix SPI node for Arria10
    - ARM: dts: socfpga: Fix NAND controller node compatible
    - ARM: dts: socfpga: Fix NAND controller clock supply
    - ARM: dts: socfpga: Fix NAND controller node compatible for Arria10
    - arm64: Fix syscall restarting around signal suppressed by tracer
    - arm64: kpti: Use early_param for kpti= command-line option
    - arm64: mm: Ensure writes to swapper are ordered wrt subsequent cache
      maintenance
    - ARM64: dts: meson: disable sd-uhs modes on the libretech-cc
    - of: overlay: validate offset from property fixups
    - of: unittest: for strings, account for trailing \0 in property length field
    - of: platform: stop accessing invalid dev in of_platform_device_destroy
    - tpm: fix use after free in tpm2_load_context()
    - tpm: fix race condition in tpm_common_write()
    - IB/qib: Fix DMA api warning with debug kernel
    - IB/{hfi1, qib}: Add handling of kernel restart
    - IB/mlx4: Mark user MR as writable if actual virtual memory is writable
    - IB/core: Make testing MR flags for writability a static inline function
    - IB/mlx5: Fetch soft WQE's on fatal error state
    - IB/isert: Fix for lib/dma_debug check_sync warning
    - IB/isert: fix T10-pi check mask setting
    - IB/hfi1: Fix fault injection init/exit issues
    - IB/hfi1: Reorder incorrect send context disable
    - IB/hfi1: Optimize kthread pointer locking when queuing CQ entries
    - IB/hfi1: Fix user context tail allocation for DMA_RTAIL
    - RDMA/mlx4: Discard unknown SQP work requests
    - xprtrdma: Return -ENOBUFS when no pages are available
    - mtd: cfi_cmdset_0002: Change write buffer to check correct value
    - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
    - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
    - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
    - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
    - PCI: hv: Make sure the bus domain is really unique
    - PCI: Add ACS quirk for Intel 7th & 8th Gen mobile
    - PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on
      resume
    - auxdisplay: fix broken menu
    - pinctrl: samsung: Correct EINTG banks order
    - pinctrl: devicetree: Fix pctldev pointer overwrite
    - cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0
    - MIPS: io: Add barrier after register read in inX()
    - time: Make sure jiffies_to_msecs() preserves non-zero time periods
    - irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
    - X.509: unpack RSA signatureValue field from BIT STRING
    - Btrfs: fix return value on rename exchange failure
    - iio: adc: ad7791: remove sample freq sysfs attributes
    - iio: sca3000: Fix an error handling path in 'sca3000_probe()'
    - mm: fix __gup_device_huge vs unmap
    - scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
    - scsi: qla2xxx: Mask off Scope bits in retry delay
    - scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
    - scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
    - scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
    - scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for
      ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
    - scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
    - linvdimm, pmem: Preserve read-only setting for pmem devices
    - clk: at91: PLL recalc_rate() now using cached MUL and DIV values
    - rtc: sun6i: Fix bit_idx value for clk_register_gate
    - md: fix two problems with setting the "re-add" device state.
    - rpmsg: smd: do not use mananged resources for endpoints and channels
    - ubi: fastmap: Cancel work upon detach
    - ubi: fastmap: Correctly handle interrupted erasures in EBA
    - backlight: as3711_bl: Fix Device Tree node lookup
    - backlight: max8925_bl: Fix Device Tree node lookup
    - backlight: tps65217_bl: Fix Device Tree node lookup
    - mfd: intel-lpss: Program REMAP register in PIO mode
    - arm: dts: mt7623: fix invalid memory node being generated
    - perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
    - perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
    - perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
    - perf intel-pt: Fix MTC timing after overflow
    - perf intel-pt: Fix "Unexpected indirect branch" error
    - perf intel-pt: Fix packet decoding of CYC packets
    - media: vsp1: Release buffers for each video node
    - media: v4l2-compat-ioctl32: prevent go past max size
    - media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
    - nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
    - NFSv4: Fix possible 1-byte stack overflow in
      nfs_idmap_read_and_verify_message
    - NFSv4: Revert commit 5f83d86cf531d ("NFSv4.x: Fix wraparound issues..")
    - NFSv4: Fix a typo in nfs41_sequence_process
    - ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
    - Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
    - pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume
    - rbd: flush rbd_dev->watch_dwork after watch is unregistered
    - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm()
    - mm: fix devmem_is_allowed() for sub-page System RAM intersections
    - xen: Remove unnecessary BUG_ON from __unbind_from_irq()
    - udf: Detect incorrect directory size
    - Input: xpad - fix GPD Win 2 controller name
    - Input: elan_i2c_smbus - fix more potential stack buffer overflows
    - ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl
    - ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co
    - ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
    - slub: fix failure when we delete and create a slab cache
    - block: Fix transfer when chunk sectors exceeds max
    - block: Fix cloning of requests with a special payload
    - x86/efi: Fix efi_call_phys_epilog() with CONFIG_X86_5LEVEL=y
    - dm zoned: avoid triggering reclaim from inside dmz_map()
    - dm thin: handle running out of data space vs concurrent discard
    - x86/platform/UV: Use new set memory block size function
    - x86/platform/UV: Add kernel parameter to set memory block size
    - platform/chrome: cros_ec_lpc: Register the driver if ACPI entry is missing.
    - platform/chrome: cros_ec_lpc: do not try DMI match when ACPI device found
    - hwmon: (k10temp) Add support for Stoney Ridge and Bristol Ridge CPUs
    - spi-nor: intel-spi: Remove unused preopcodes field
    - mtd: spi-nor: intel-spi: Fix atomic sequence handling
    - PCI / PM: Do not clear state_saved for devices that remain suspended
    - ASoC: mediatek: preallocate pages use platform device
    - libnvdimm, pmem: Do not flush power-fail protected CPU caches
    - powerpc/64s: Set assembler machine type to POWER4
    - powerpc/e500mc: Set assembler machine type to e500mc
    - hwrng: core - Always drop the RNG in hwrng_unregister()
    - softirq: Reorder trace_softirqs_on to prevent lockdep splat
    - ARM64: dts: meson-gx: fix ATF reserved memory region
    - mtd: rawnand: fix return value check for bad block status
    - mtd: rawnand: mxc: set spare area size register explicitly
    - PCI: Account for all bridges on bus when distributing bus numbers
    - pinctrl: armada-37xx: Fix spurious irq management
    - MIPS: pb44: Fix i2c-gpio GPIO descriptor table
    - locking/rwsem: Fix up_read_non_owner() warning with DEBUG_RWSEMS
    - scsi: scsi_debug: Fix memory leak on module unload
    - scsi: qla2xxx: Spinlock recursion in qla_target
    - libnvdimm, pmem: Unconditionally deep flush on *sync
    - f2fs: don't use GFP_ZERO for page caches
    - mfd: twl-core: Fix clock initialization
    - remoteproc: Prevent incorrect rproc state on xfer mem ownership failure
    - media: rc: mce_kbd decoder: fix stuck keys
    - Input: silead - add Chuwi Hi8 support
    - Input: silead - add MSSL0002 ACPI HID
    - ALSA: hda - Force to link down at runtime suspend on ATI/AMD HDMI
    - i2c: gpio: initialize SCL to HIGH again
    - kasan: depend on CONFIG_SLUB_DEBUG
    - dm: ensure bio submission follows a depth-first tree walk
    - dm: rename 'bio' member of dm_io structure to 'orig_bio'
    - dm: use bio_split() when splitting out the already processed bio
    - x86/e820: put !E820_TYPE_RAM regions into memblock.reserved

  * Support AverMedia DVD EZMaker 7 USB video capture dongle (LP: #1620762) //
    Bionic update: upstream stable patchset 2018-12-07 (LP: #1807469)
    - media: cx231xx: Add support for AverMedia DVD EZMaker 7

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 14 Jan 2019 09:38:05 +0000

linux (4.15.0-43.46) bionic; urgency=medium

  * linux: 4.15.0-43.46 -proposed tracker (LP: #1806659)

  * System randomly hangs during suspend when mei_wdt is loaded (LP: #1803942)
    - SAUCE: base/dd: limit release function changes to vfio driver only

  * Workaround CSS timeout on AMD SNPS 3.0 xHC (LP: #1806838)
    - xhci: Allow more than 32 quirks
    - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC

  * linux-buildinfo: pull out ABI information into its own package
    (LP: #1806380)
    - [Packaging] limit preparation to linux-libc-dev in headers
    - [Packaging] commonise debhelper invocation
    - [Packaging] ABI -- accumulate abi information at the end of the build
    - [Packaging] buildinfo -- add basic build information
    - [Packaging] buildinfo -- add firmware information to the flavour ABI
    - [Packaging] buildinfo -- add compiler information to the flavour ABI
    - [Packaging] buildinfo -- add buildinfo support to getabis
    - [Config] buildinfo -- add retpoline version markers

  * linux packages should own /usr/lib/linux/triggers (LP: #1770256)
    - [Packaging] own /usr/lib/linux/triggers

  * CVE-2018-12896
    - posix-timers: Sanitize overrun handling

  * CVE-2018-16276
    - USB: yurex: fix out-of-bounds uaccess in read handler

  * CVE-2018-10902
    - ALSA: rawmidi: Change resized buffers atomically

  * CVE-2018-18710
    - cdrom: fix improper type cast, which can leat to information leak.

  * CVE-2018-18690
    - xfs: don't fail when converting shortform attr to long form during
      ATTR_REPLACE

  * CVE-2018-14734
    - infiniband: fix a possible use-after-free bug

  * CVE-2018-18445
    - bpf: 32-bit RSH verification must truncate input before the ALU op

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 06 Dec 2018 13:52:12 +0000

linux (4.15.0-42.45) bionic; urgency=medium

  * linux: 4.15.0-42.45 -proposed tracker (LP: #1803592)

  * [FEAT] Guest-dedicated Crypto Adapters (LP: #1787405)
    - KVM: s390: reset crypto attributes for all vcpus
    - KVM: s390: vsie: simulate VCPU SIE entry/exit
    - KVM: s390: introduce and use KVM_REQ_VSIE_RESTART
    - KVM: s390: refactor crypto initialization
    - s390: vfio-ap: base implementation of VFIO AP device driver
    - s390: vfio-ap: register matrix device with VFIO mdev framework
    - s390: vfio-ap: sysfs interfaces to configure adapters
    - s390: vfio-ap: sysfs interfaces to configure domains
    - s390: vfio-ap: sysfs interfaces to configure control domains
    - s390: vfio-ap: sysfs interface to view matrix mdev matrix
    - KVM: s390: interface to clear CRYCB masks
    - s390: vfio-ap: implement mediated device open callback
    - s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
    - s390: vfio-ap: zeroize the AP queues
    - s390: vfio-ap: implement VFIO_DEVICE_RESET ioctl
    - KVM: s390: Clear Crypto Control Block when using vSIE
    - KVM: s390: vsie: Do the CRYCB validation first
    - KVM: s390: vsie: Make use of CRYCB FORMAT2 clear
    - KVM: s390: vsie: Allow CRYCB FORMAT-2
    - KVM: s390: vsie: allow CRYCB FORMAT-1
    - KVM: s390: vsie: allow CRYCB FORMAT-0
    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-1
    - KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2
    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-2
    - KVM: s390: device attrs to enable/disable AP interpretation
    - KVM: s390: CPU model support for AP virtualization
    - s390: doc: detailed specifications for AP virtualization
    - KVM: s390: fix locking for crypto setting error path
    - KVM: s390: Tracing APCB changes
    - s390: vfio-ap: setup APCB mask using KVM dedicated function
    - s390/zcrypt: Add ZAPQ inline function.
    - s390/zcrypt: Review inline assembler constraints.
    - s390/zcrypt: Integrate ap_asm.h into include/asm/ap.h.
    - s390/zcrypt: fix ap_instructions_available() returncodes
    - s390/zcrypt: remove VLA usage from the AP bus
    - s390/zcrypt: Remove deprecated ioctls.
    - s390/zcrypt: Remove deprecated zcrypt proc interface.
    - s390/zcrypt: Support up to 256 crypto adapters.
    - [Config:] Enable CONFIG_S390_AP_IOMMU and set CONFIG_VFIO_AP to module.

  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
    - mount: Retest MNT_LOCKED in do_umount
    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts

  *  CVE-2018-18955: nested user namespaces with more than five extents
    incorrectly grant privileges over inode (LP: #1801924) // CVE-2018-18955
    - userns: also map extents in the reverse map to kernel IDs

  * kdump fail due to an IRQ storm (LP: #1797990)
    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
    - SAUCE: x86/quirks: Scan all busses for early PCI quirks

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 15 Nov 2018 17:01:46 -0200

linux (4.15.0-40.43) bionic; urgency=medium

  * linux: 4.15.0-40.43 -proposed tracker (LP: #1802554)

  * crash in ENA driver on removing an interface (LP: #1802341)
    - SAUCE: net: ena: fix crash during ena_remove()

  * Ubuntu 18.04.1 - [s390x] Kernel panic while stressing network bonding
    (LP: #1797367)
    - s390/qeth: don't keep track of MAC address's cast type
    - s390/qeth: consolidate qeth MAC address helpers
    - s390/qeth: avoid using is_multicast_ether_addr_64bits on (u8 *)[6]
    - s390/qeth: remove outdated portname debug msg
    - s390/qeth: reduce hard-coded access to ccw channels
    - s390/qeth: sanitize strings in debug messages

  * [18.04 FEAT] zcrypt DD: introduce APQN tags to support deterministic driver
    binding (LP: #1799184)
    - s390/zcrypt: code beautify
    - s390/zcrypt: AP bus support for alternate driver(s)
    - s390/zcrypt: hex string mask improvements for apmask and aqmask.
    - s390/zcrypt: remove unused functions and declarations
    - s390/zcrypt: Show load of cards and queues in sysfs

  * [GLK/CLX] Enhanced IBRS (LP: #1786139)
    - x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
    - x86/speculation: Support Enhanced IBRS on future CPUs

  * Allow signed kernels to be kexec'ed under lockdown (LP: #1798441)
    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
      boot

  * Overlayfs in user namespace leaks directory content of inaccessible
    directories (LP: #1793458) // CVE-2018-6559
    - SAUCE: overlayfs: ensure mounter privileges when reading directories

  * Update ENA driver to version 2.0.1K (LP: #1798182)
    - net: ena: remove ndo_poll_controller
    - net: ena: fix warning in rmmod caused by double iounmap
    - net: ena: fix rare bug when failed restart/resume is followed by driver
      removal
    - net: ena: fix NULL dereference due to untimely napi initialization
    - net: ena: fix auto casting to boolean
    - net: ena: minor performance improvement
    - net: ena: complete host info to match latest ENA spec
    - net: ena: introduce Low Latency Queues data structures according to ENA spec
    - net: ena: add functions for handling Low Latency Queues in ena_com
    - net: ena: add functions for handling Low Latency Queues in ena_netdev
    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
    - net: ena: explicit casting and initialization, and clearer error handling
    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
    - net: ena: change rx copybreak default to reduce kernel memory pressure
    - net: ena: remove redundant parameter in ena_com_admin_init()
    - net: ena: update driver version to 2.0.1
    - net: ena: fix indentations in ena_defs for better readability
    - net: ena: Fix Kconfig dependency on X86
    - net: ena: enable Low Latency Queues
    - net: ena: fix compilation error in xtensa architecture

  * Bionic update: upstream stable patchset 2018-10-29 (LP: #1800537)
    - bonding: re-evaluate force_primary when the primary slave name changes
    - cdc_ncm: avoid padding beyond end of skb
    - ipv6: allow PMTU exceptions to local routes
    - net: dsa: add error handling for pskb_trim_rcsum
    - net/sched: act_simple: fix parsing of TCA_DEF_DATA
    - tcp: verify the checksum of the first data segment in a new connection
    - udp: fix rx queue len reported by diag and proc interface
    - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds
      vlan
    - tls: fix use-after-free in tls_push_record
    - ext4: fix hole length detection in ext4_ind_map_blocks()
    - ext4: update mtime in ext4_punch_hole even if no blocks are released
    - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget()
    - ext4: fix fencepost error in check for inode count overflow during resize
    - driver core: Don't ignore class_dir_create_and_add() failure.
    - Btrfs: fix clone vs chattr NODATASUM race
    - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2()
    - btrfs: return error value if create_io_em failed in cow_file_range
    - btrfs: scrub: Don't use inode pages for device replace
    - ALSA: hda/conexant - Add fixup for HP Z2 G4 workstation
    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
    - ALSA: hda: add dock and led support for HP ProBook 640 G4
    - x86/MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read()
    - smb3: fix various xid leaks
    - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session
      expiry
    - cifs: For SMB2 security informaion query, check for minimum sized security
      descriptor instead of sizeof FileAllInformation class
    - nbd: fix nbd device deletion
    - nbd: update size when connected
    - nbd: use bd_set_size when updating disk size
    - blk-mq: reinit q->tag_set_list entry only after grace period
    - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue
    - cpufreq: Fix new policy initialization during limits updates via sysfs
    - cpufreq: governors: Fix long idle detection logic in load calculation
    - libata: zpodd: small read overflow in eject_tray()
    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
    - x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
    - iwlwifi: fw: harden page loading code
    - orangefs: set i_size on new symlink
    - orangefs: report attributes_mask and attributes for statx
    - HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
    - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
    - net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
    - cpufreq: ti-cpufreq: Fix an incorrect error return value
    - x86/vector: Fix the args of vector_alloc tracepoint
    - x86/apic/vector: Prevent hlist corruption and leaks
    - x86/apic: Provide apic_ack_irq()
    - x86/ioapic: Use apic_ack_irq()
    - x86/platform/uv: Use apic_ack_irq()
    - irq_remapping: Use apic_ack_irq()
    - genirq/generic_pending: Do not lose pending affinity update
    - genirq/affinity: Defer affinity setting if irq chip is busy
    - genirq/migration: Avoid out of line call if pending is not set

  * [bionic]mlx5: reading SW stats through ifstat cause kernel crash
    (LP: #1799049)
    - net/mlx5e: Don't attempt to dereference the ppriv struct if not being
      eswitch manager

  * [Bionic][Cosmic]  ipmi: Fix timer race with module unload (LP: #1799281)
    - ipmi: Fix timer race with module unload

  * [Bionic] ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driver
    (LP: #1799276)
    - ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driver

  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()

  * [Bionic][Cosmic] Fix to ipmi to support vendor specific messages greater
    than 255 bytes (LP: #1799794)
    - ipmi:ssif: Add support for multi-part transmit messages > 2 parts

  * libvirtd is unable to configure bridge devices inside of LXD containers
    (LP: #1784501)
    - kernfs: allow creating kernfs objects with arbitrary uid/gid
    - sysfs, kobject: allow creating kobject belonging to arbitrary users
    - kobject: kset_create_and_add() - fetch ownership info from parent
    - driver core: set up ownership of class devices in sysfs
    - net-sysfs: require net admin in the init ns for setting tx_maxrate
    - net-sysfs: make sure objects belong to container's owner
    - net: create reusable function for getting ownership info of sysfs inodes
    - bridge: make sure objects belong to container's owner
    - sysfs: Fix regression when adding a file to an existing group

  * [Ubuntu] kvm: fix deadlock when killed by oom (LP: #1800849)
    - s390/kvm: fix deadlock when killed by oom

  * [Ubuntu] net/af_iucv: fix skb leaks for HiperTransport (LP: #1800639)
    - net/af_iucv: drop inbound packets with invalid flags
    - net/af_iucv: fix skb handling on HiperTransport xmit error

  * Power consumption during s2idle is higher than long idle(sk hynix)
    (LP: #1801875)
    - SAUCE: pci: prevent sk hynix nvme from entering D3
    - SAUCE: nvme: add quirk to not call disable function when suspending

  * Enable keyboard wakeup for S2Idle laptops (LP: #1798552)
    - Input: i8042 - enable keyboard wakeups by default when s2idle is used

  * NULL pointer dereference at 0000000000000020 when access
    dst_orig->ops->family in function  xfrm_lookup_with_ifid() (LP: #1801878)
    - xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.

  * [Ubuntu] qdio: reset old sbal_state flags (LP: #1801686)
    - s390/qdio: reset old sbal_state flags

  * hns3: map tx ring to tc (LP: #1802023)
    - net: hns3: Set tx ring' tc info when netdev is up

  * [Ubuntu] qeth: Fix potential array overrun in cmd/rc lookup (LP: #1800641)
    - s390: qeth_core_mpc: Use ARRAY_SIZE instead of reimplementing its function
    - s390: qeth: Fix potential array overrun in cmd/rc lookup

  * Vulkan applications cause permanent memory leak with Intel GPU
    (LP: #1798165)
    - drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set

  * Mounting SOFS SMB shares fails (LP: #1792580)
    - cifs: connect to servername instead of IP for IPC$ share

  * Packaging resync (LP: #1786013)
    - [Package] add support for specifying the primary makefile

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 09 Nov 2018 17:29:18 -0200

linux (4.15.0-39.42) bionic; urgency=medium

  * linux: 4.15.0-39.42 -proposed tracker (LP: #1799411)

  * Linux: insufficient shootdown for paging-structure caches (LP: #1798897)
    - mm: move tlb_table_flush to tlb_flush_mmu_free
    - mm/tlb: Remove tlb_remove_table() non-concurrent condition
    - mm/tlb, x86/mm: Support invalidating TLB caches for RCU_TABLE_FREE
    - [Config] CONFIG_HAVE_RCU_TABLE_INVALIDATE=y

  * Ubuntu18.04: GPU total memory is reduced (LP: #1792102)
    - Revert "powerpc/powernv: Increase memory block size to 1GB on radix"

  * arm64: snapdragon: reduce boot noise (LP: #1797154)
    - [Config] arm64: snapdragon: DRM_MSM=m
    - [Config] arm64: snapdragon: SND*=m
    - [Config] arm64: snapdragon: disable ARM_SDE_INTERFACE
    - [Config] arm64: snapdragon: disable DRM_I2C_ADV7511_CEC
    - [Config] arm64: snapdragon: disable VIDEO_ADV7511, VIDEO_COBALT

  * [Bionic] CPPC bug fixes (LP: #1796949)
    - ACPI / CPPC: Update all pr_(debug/err) messages to log the susbspace id
    - cpufreq: CPPC: Don't set transition_latency
    - ACPI / CPPC: Fix invalid PCC channel status errors

  * regression in 'ip --family bridge neigh' since linux v4.12 (LP: #1796748)
    - rtnetlink: fix rtnl_fdb_dump() for ndmsg header

  * screen displays abnormally on the lenovo M715 with the AMD GPU (Radeon Vega
    8 Mobile, rev ca, 1002:15dd) (LP: #1796786)
    - drm/amd/display: Fix takover from VGA mode
    - drm/amd/display: early return if not in vga mode in disable_vga
    - drm/amd/display: Refine disable VGA

  * arm64: snapdragon: WARNING: CPU: 0 PID: 1 arch/arm64/kernel/setup.c:271
    reserve_memblock_reserved_regions (LP: #1797139)
    - SAUCE: arm64: Fix /proc/iomem for reserved but not memory regions

  * The front MIC can't work on the Lenovo M715 (LP: #1797292)
    - ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715

  * Keyboard backlight sysfs sometimes is missing on Dell laptops (LP: #1797304)
    - platform/x86: dell-smbios: Correct some style warnings
    - platform/x86: dell-smbios: Rename dell-smbios source to dell-smbios-base
    - platform/x86: dell-smbios: Link all dell-smbios-* modules together
    - [Config] CONFIG_DELL_SMBIOS_SMM=y, CONFIG_DELL_SMBIOS_WMI=y

  * rpi3b+: ethernet not working (LP: #1797406)
    - lan78xx: Don't reset the interface on open

  * 87cdf3148b11 was never backported to 4.15  (LP: #1795653)
    - xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto

  * [Ubuntu18.04][Power9][DD2.2]package installation segfaults inside debian
    chroot env in P9 KVM guest with HTM enabled (kvm) (LP: #1792501)
    - KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds

  * Provide mode where all vCPUs on a core must be the same VM (LP: #1792957)
    - KVM: PPC: Book3S HV: Provide mode where all vCPUs on a core must be the same
      VM

  * fscache: bad refcounting in fscache_op_complete leads to OOPS (LP: #1797314)
    - SAUCE: fscache: Fix race in decrementing refcount of op->npages

  * CVE-2018-9363
    - Bluetooth: hidp: buffer overflow in hidp_process_report

  * CVE-2017-13168
    - scsi: sg: mitigate read/write abuse

  * [Bionic] ACPI / PPTT: use ACPI ID whenever ACPI_PPTT_ACPI_PROCESSOR_ID_VALID
    is set (LP: #1797200)
    - ACPI / PPTT: use ACPI ID whenever ACPI_PPTT_ACPI_PROCESSOR_ID_VALID is set

  * [Bionic] arm64: topology: Avoid checking numa mask for scheduler MC
    selection (LP: #1797202)
    - arm64: topology: Avoid checking numa mask for scheduler MC selection

  * crypto/vmx - Backport of Fix sleep-in-atomic bugs patch for 18.04
    (LP: #1790832)
    - crypto: vmx - Fix sleep-in-atomic bugs

  * hns3: autoneg settings get lost on down/up (LP: #1797654)
    - net: hns3: Fix for information of phydev lost problem when down/up

  * not able to unwind the stack from within __kernel_clock_gettime in the Linux
    vDSO (LP: #1797963)
    - powerpc/vdso: Correct call frame information

  * Signal 7 error when running GPFS tracing in cluster (LP: #1792195)
    - powerpc/mm/books3s: Add new pte bit to mark pte temporarily invalid.
    - powerpc/mm/radix: Only need the Nest MMU workaround for R -> RW transition

  * Support Edge Gateway's WIFI LED (LP: #1798330)
    - SAUCE: mwifiex: Switch WiFi LED state according to the device status

  * Support Edge Gateway's Bluetooth LED (LP: #1798332)
    - SAUCE: Bluetooth: Support for LED on Edge Gateways

  * USB cardreader (0bda:0328) make the system can't enter s3 or hang
    (LP: #1798328)
    - usb: Don't disable Latency tolerance Messaging (LTM) before port reset

  * CVE-2018-15471
    - xen-netback: fix input validation in xenvif_set_hash_mapping()

  * CVE-2018-16658
    - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status

  * [Bionic] Update ThunderX2 implementation defined pmu core events
    (LP: #1796904)
    - perf vendor events arm64: Update ThunderX2 implementation defined pmu core
      events

  * the machine of lenovo M715 with the AMD GPU (Radeon Vega 8 Mobile, rev ca,
    1002:15dd) often hangs randomly (LP: #1796789)
    - drm/amd: Add missing fields in atom_integrated_system_info_v1_11

  * [18.04] GLK hang after a while (LP: #1760545)
    - drm/i915/glk: Add MODULE_FIRMWARE for Geminilake

  * Fix usbcore.quirks when used at boot (LP: #1795784)
    - usb: core: safely deal with the dynamic quirk lists

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 23 Oct 2018 14:44:55 +0000

linux (4.15.0-38.41) bionic; urgency=medium

  * linux: 4.15.0-38.41 -proposed tracker (LP: #1797061)

  * Silent data corruption in Linux kernel 4.15 (LP: #1796542)
    - block: add a lower-level bio_add_page interface
    - block: bio_iov_iter_get_pages: fix size of last iovec
    - blkdev: __blkdev_direct_IO_simple: fix leak in error case
    - block: bio_iov_iter_get_pages: pin more pages for multi-segment IOs

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 10 Oct 2018 11:20:35 +0200

linux (4.15.0-37.40) bionic; urgency=medium

  * linux: 4.15.0-37.40 -proposed tracker (LP: #1795564)

  * hns3: enable ethtool rx-vlan-filter on supported hw (LP: #1793394)
    - net: hns3: Add vlan filter setting by ethtool command -K

  * hns3: Modifying channel parameters will reset ring parameters back to
    defaults (LP: #1793404)
    - net: hns3: Fix desc num set to default when setting channel

  * hisi_sas: Add SATA FIX check for v3 hw (LP: #1794151)
    - scsi: hisi_sas: Add SATA FIS check for v3 hw

  * Fix potential corruption using SAS controller on HiSilicon arm64 boards
    (LP: #1794156)
    - scsi: hisi_sas: add memory barrier in task delivery function

  * hisi_sas: Reduce unnecessary spin lock contention (LP: #1794165)
    - scsi: hisi_sas: Tidy hisi_sas_task_prep()

  * Add functional level reset support for the SAS controller on HiSilicon D06
    systems (LP: #1794166)
    - scsi: hisi_sas: tidy host controller reset function a bit
    - scsi: hisi_sas: relocate some common code for v3 hw
    - scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw

  * HiSilicon SAS controller doesn't recover from PHY STP link timeout
    (LP: #1794172)
    - scsi: hisi_sas: tidy channel interrupt handler for v3 hw
    - scsi: hisi_sas: Fix the failure of recovering PHY from STP link timeout

  * getxattr: always handle namespaced attributes (LP: #1789746)
    - getxattr: use correct xattr length

  * Fix unusable NVIDIA GPU after S3 (LP: #1793338)
    - PCI: Reprogram bridge prefetch registers on resume

  * Fails to boot under Xen PV: BUG: unable to handle kernel paging request at
    edc21fd9 (LP: #1789118)
    - x86/EISA: Don't probe EISA bus for Xen PV guests

  * qeth: use vzalloc for QUERY OAT buffer (LP: #1793086)
    - s390/qeth: use vzalloc for QUERY OAT buffer

  * SRU: Enable middle button of touchpad on ThinkPad P72 (LP: #1793463)
    - Input: elantech - enable middle button of touchpad on ThinkPad P72

  * Dell new AIO requires a new uart backlight driver (LP: #1727235)
    - SAUCE: platform/x86: dell-uart-backlight: new backlight driver for DELL AIO
    - updateconfigs for Dell UART backlight driver

  * [Ubuntu] s390/crypto: Fix return code checking in cbc_paes_crypt.
    (LP: #1794294)
    - s390/crypto: Fix return code checking in cbc_paes_crypt()

  * hns3: Retrieve RoCE MSI-X config from firmware (LP: #1793221)
    - net: hns3: Fix MSIX allocation issue for VF
    - net: hns3: Refine the MSIX allocation for PF

  * net: hns: Avoid hang when link is changed while handling packets
    (LP: #1792209)
    - net: hns: add the code for cleaning pkt in chip
    - net: hns: add netif_carrier_off before change speed and duplex

  * Page leaking in cachefiles_read_backing_file while vmscan is active
    (LP: #1793430)
    - SAUCE: cachefiles: Page leaking in cachefiles_read_backing_file while vmscan
      is active

  * some nvidia p1000 graphic cards hang during the boot (LP: #1791569)
    - drm/nouveau/gr/gf100-: virtualise tpc_mask + apply fixes from traces

  * Error reported when creating ZFS pool with "-t" option, despite successful
    pool creation (LP: #1769937)
    - SAUCE: (noup) Update zfs to 0.7.5-1ubuntu16.4

  * Fix I2C touchpanels' interrupt storms after system suspend (LP: #1792309)
    - HID: i2c-hid: Fix flooded incomplete report after S3 on Rayd touchscreen
    - HID: i2c-hid: Don't reset device upon system resume

  * ipmmu is always registered (LP: #1783746)
    - iommu/ipmmu-vmsa: Don't register as BUS IOMMU if machine doesn't have IPMMU-
      VMSA

  * Bionic update: upstream stable patchset 2018-09-27 (LP: #1794889)
    - clocksource/drivers/imx-tpm: Correct some registers operation flow
    - Input: synaptics-rmi4 - fix an unchecked out of memory error path
    - KVM: X86: fix incorrect reference of trace_kvm_pi_irte_update
    - x86: Add check for APIC access address for vmentry of L2 guests
    - MIPS: io: Prevent compiler reordering writeX()
    - nfp: ignore signals when communicating with management FW
    - perf report: Fix switching to another perf.data file
    - fsnotify: fix ignore mask logic in send_to_group()
    - MIPS: io: Add barrier after register read in readX()
    - s390/smsgiucv: disable SMSG on module unload
    - isofs: fix potential memory leak in mount option parsing
    - MIPS: dts: Boston: Fix PCI bus dtc warnings:
    - spi: sh-msiof: Fix bit field overflow writes to TSCR/RSCR
    - doc: Add vendor prefix for Kieback & Peter GmbH
    - dt-bindings: pinctrl: sunxi: Fix reference to driver
    - dt-bindings: serial: sh-sci: Add support for r8a77965 (H)SCIF
    - dt-bindings: dmaengine: rcar-dmac: document R8A77965 support
    - clk: honor CLK_MUX_ROUND_CLOSEST in generic clk mux
    - ASoC: rt5514: Add the missing register in the readable table
    - eCryptfs: don't pass up plaintext names when using filename encryption
    - soc: bcm: raspberrypi-power: Fix use of __packed
    - soc: bcm2835: Make !RASPBERRYPI_FIRMWARE dummies return failure
    - PCI: kirin: Fix reset gpio name
    - ASoC: topology: Fix bugs of freeing soc topology
    - xen: xenbus_dev_frontend: Really return response string
    - ASoC: topology: Check widget kcontrols before deref.
    - spi: cadence: Add usleep_range() for cdns_spi_fill_tx_fifo()
    - blkcg: don't hold blkcg lock when deactivating policy
    - tipc: fix infinite loop when dumping link monitor summary
    - scsi: iscsi: respond to netlink with unicast when appropriate
    - scsi: megaraid_sas: Do not log an error if FW successfully initializes.
    - scsi: target: fix crash with iscsi target and dvd
    - netfilter: nf_tables: NAT chain and extensions require NF_TABLES
    - netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update
    - ASoC: msm8916-wcd-analog: use threaded context for mbhc events
    - drm/msm: Fix possible null dereference on failure of get_pages()
    - drm/msm/dsi: use correct enum in dsi_get_cmd_fmt
    - drm/msm: don't deref error pointer in the msm_fbdev_create error path
    - blkcg: init root blkcg_gq under lock
    - vfs: Undo an overly zealous MS_RDONLY -> SB_RDONLY conversion
    - parisc: time: Convert read_persistent_clock() to read_persistent_clock64()
    - scsi: storvsc: Set up correct queue depth values for IDE devices
    - scsi: isci: Fix infinite loop in while loop
    - mm, pagemap: fix swap offset value for PMD migration entry
    - proc: revalidate kernel thread inodes to root:root
    - kexec_file: do not add extra alignment to efi memmap
    - mm: memcg: add __GFP_NOWARN in __memcg_schedule_kmem_cache_create()
    - usb: typec: ucsi: fix tracepoint related build error
    - ACPI / PM: Blacklist Low Power S0 Idle _DSM for ThinkPad X1 Tablet(2016)
    - dt-bindings: meson-uart: DT fix s/clocks-names/clock-names/
    - net: phy: marvell: clear wol event before setting it
    - ARM: dts: da850: fix W=1 warnings with pinmux node
    - ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70
    - drm/amdkfd: fix clock counter retrieval for node without GPU
    - thermal: int3403_thermal: Fix NULL pointer deref on module load / probe
    - net: ethtool: Add missing kernel doc for FEC parameters
    - arm64: ptrace: remove addr_limit manipulation
    - HID: lenovo: Add support for IBM/Lenovo Scrollpoint mice
    - HID: wacom: Release device resource data obtained by devres_alloc()
    - selftests: ftrace: Add a testcase for multiple actions on trigger
    - rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
    - perf/x86/intel: Don't enable freeze-on-smi for PerfMon V1
    - remoteproc: qcom: Fix potential device node leaks
    - rpmsg: added MODULE_ALIAS for rpmsg_char
    - HID: intel-ish-hid: use put_device() instead of kfree()
    - blk-mq: fix sysfs inflight counter
    - arm64: fix possible spectre-v1 in ptrace_hbp_get_event()
    - KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_mmio_read_apr()
    - libahci: Allow drivers to override stop_engine
    - ata: ahci: mvebu: override ahci_stop_engine for mvebu AHCI
    - x86/cpu/intel: Add missing TLB cpuid values
    - bpf: fix uninitialized variable in bpf tools
    - i2c: sprd: Prevent i2c accesses after suspend is called
    - i2c: sprd: Fix the i2c count issue
    - tipc: fix bug in function tipc_nl_node_dump_monitor
    - nvme: depend on INFINIBAND_ADDR_TRANS
    - nvmet-rdma: depend on INFINIBAND_ADDR_TRANS
    - ib_srpt: depend on INFINIBAND_ADDR_TRANS
    - ib_srp: depend on INFINIBAND_ADDR_TRANS
    - IB: make INFINIBAND_ADDR_TRANS configurable
    - IB/uverbs: Fix validating mandatory attributes
    - RDMA/cma: Fix use after destroy access to net namespace for IPoIB
    - RDMA/iwpm: fix memory leak on map_info
    - IB/rxe: add RXE_START_MASK for rxe_opcode IB_OPCODE_RC_SEND_ONLY_INV
    - IB/rxe: avoid double kfree_skb
    - <linux/stringhash.h>: fix end_name_hash() for 64bit long
    - IB/core: Make ib_mad_client_id atomic
    - ARM: davinci: board-da830-evm: fix GPIO lookup for MMC/SD
    - ARM: davinci: board-da850-evm: fix GPIO lookup for MMC/SD
    - ARM: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup
    - ARM: davinci: board-dm355-evm: fix broken networking
    - dt-bindings: panel: lvds: Fix path to display timing bindings
    - ARM: OMAP2+: powerdomain: use raw_smp_processor_id() for trace
    - ARM: dts: logicpd-som-lv: Fix WL127x Startup Issues
    - ARM: dts: logicpd-som-lv: Fix Audio Mute
    - Input: atmel_mxt_ts - fix the firmware update
    - hexagon: add memset_io() helper
    - hexagon: export csum_partial_copy_nocheck
    - scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts
    - bpf, x64: fix memleak when not converging after image
    - parisc: drivers.c: Fix section mismatches
    - stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock
    - kthread, sched/wait: Fix kthread_parkme() wait-loop
    - arm64: tegra: Make BCM89610 PHY interrupt as active low
    - iommu/vt-d: fix shift-out-of-bounds in bug checking
    - nvme: fix potential memory leak in option parsing
    - nvme: Set integrity flag for user passthrough commands
    - ARM: OMAP1: ams-delta: fix deferred_fiq handler
    - smc: fix sendpage() call
    - IB/hfi1 Use correct type for num_user_context
    - IB/hfi1: Fix memory leak in exception path in get_irq_affinity()
    - RDMA/cma: Do not query GID during QP state transition to RTR
    - spi: bcm2835aux: ensure interrupts are enabled for shared handler
    - sched/core: Introduce set_special_state()
    - sh: fix build failure for J2 cpu with SMP disabled
    - tee: check shm references are consistent in offset/size
    - mac80211: Adjust SAE authentication timeout
    - drm/omap: silence unititialized variable warning
    - drm/omap: fix uninitialized ret variable
    - drm/omap: fix possible NULL ref issue in tiler_reserve_2d
    - drm/omap: check return value from soc_device_match
    - drm/omap: handle alloc failures in omap_connector
    - driver core: add __printf verification to __ata_ehi_pushv_desc
    - ARM: dts: cygnus: fix irq type for arm global timer
    - mac80211: use timeout from the AddBA response instead of the request
    - net: aquantia: driver should correctly declare vlan_features bits
    - can: dev: increase bus-off message severity
    - arm64: Add MIDR encoding for NVIDIA CPUs
    - cifs: smb2ops: Fix listxattr() when there are no EAs
    - agp: uninorth: make two functions static
    - tipc: eliminate KMSAN uninit-value in strcmp complaint
    - qed: Fix l2 initializations over iWARP personality
    - qede: Fix gfp flags sent to rdma event node allocation
    - rxrpc: Fix error reception on AF_INET6 sockets
    - rxrpc: Fix the min security level for kernel calls
    - KVM: Extend MAX_IRQ_ROUTES to 4096 for all archs
    - x86: Delay skip of emulated hypercall instruction
    - ixgbe: return error on unsupported SFP module when resetting
    - net sched actions: fix invalid pointer dereferencing if skbedit flags
      missing
    - proc/kcore: don't bounds check against address 0
    - ocfs2: take inode cluster lock before moving reflinked inode from orphan dir
    - kprobes/x86: Prohibit probing on exception masking instructions
    - uprobes/x86: Prohibit probing on MOV SS instruction
    - objtool, kprobes/x86: Sync the latest <asm/insn.h> header with
      tools/objtool/arch/x86/include/asm/insn.h
    - x86/pkeys/selftests: Adjust the self-test to fresh distros that export the
      pkeys ABI
    - x86/mpx/selftests: Adjust the self-test to fresh distros that export the MPX
      ABI
    - x86/selftests: Add mov_to_ss test
    - x86/pkeys/selftests: Give better unexpected fault error messages
    - x86/pkeys/selftests: Stop using assert()
    - x86/pkeys/selftests: Remove dead debugging code, fix dprint_in_signal
    - x86/pkeys/selftests: Allow faults on unknown keys
    - x86/pkeys/selftests: Factor out "instruction page"
    - x86/pkeys/selftests: Add PROT_EXEC test
    - x86/pkeys/selftests: Fix pkey exhaustion test off-by-one
    - x86/pkeys/selftests: Fix pointer math
    - x86/pkeys/selftests: Save off 'prot' for allocations
    - x86/pkeys/selftests: Add a test for pkey 0
    - mtd: Fix comparison in map_word_andequal()
    - afs: Fix the non-encryption of calls
    - usb: musb: fix remote wakeup racing with suspend
    - ARM: keystone: fix platform_domain_notifier array overrun
    - i2c: pmcmsp: return message count on master_xfer success
    - i2c: pmcmsp: fix error return from master_xfer
    - i2c: viperboard: return message count on master_xfer success
    - ARM: davinci: dm646x: fix timer interrupt generation
    - ARM: davinci: board-dm646x-evm: pass correct I2C adapter id for VPIF
    - ARM: davinci: board-dm646x-evm: set VPIF capture card name
    - clk: imx6ull: use OSC clock during AXI rate change
    - locking/rwsem: Add a new RWSEM_ANONYMOUSLY_OWNED flag
    - locking/percpu-rwsem: Annotate rwsem ownership transfer by setting
      RWSEM_OWNER_UNKNOWN
    - drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
    - sched/debug: Move the print_rt_rq() and print_dl_rq() declarations to
      kernel/sched/sched.h
    - sched/deadline: Make the grub_reclaim() function static
    - parisc: Move setup_profiling_timer() out of init section
    - efi/libstub/arm64: Handle randomized TEXT_OFFSET
    - ARM: 8753/1: decompressor: add a missing parameter to the addruart macro
    - ARM: 8758/1: decompressor: restore r1 and r2 just before jumping to the
      kernel
    - ARM: kexec: fix kdump register saving on panic()
    - Revert "Btrfs: fix scrub to repair raid6 corruption"
    - Btrfs: fix scrub to repair raid6 corruption
    - Btrfs: make raid6 rebuild retry more
    - tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
    - ibmvnic: Do not notify peers on parameter change resets
    - dt-bindings: net: ravb: Add support for r8a77965 SoC
    - X86/KVM: Properly update 'tsc_offset' to represent the running guest
    - kvm: x86: move MSR_IA32_TSC handling to x86.c
    - ARM: dts: Fix cm2 and prm sizes for omap4
    - powerpc/64s: Default l1d_size to 64K in RFI fallback flush
    - KVM: arm/arm64: vgic: Kick new VCPU on interrupt migration
    - arm64: kasan: avoid pfn_to_nid() before page array is initialized
    - ARM64: dts: meson-gxl: add USB host support
    - ARM64: dts: meson-gxm: add GXM specific USB host configuration
    - ARM64: dts: meson-gxl-s905x-p212: enable the USB controller
    - ARM64: dts: meson-gx-p23x-q20x: enable the USB controller
    - ARM64: dts: meson-gxl-s905x-libretech-cc: enable the USB controller
    - ARM64: dts: meson-gxl-nexbox-a95x: enable the USB controller
    - ARM64: dts: meson-gxm-khadas-vim2: enable the USB controller
    - arm64: dts: correct SATA addresses for Stingray
    - afs: Fix server record deletion
    - proc: fix /proc/loadavg regression
    - s390/qeth: fix request-side race during cmd IO timeout
    - ACPI / scan: Initialize watchdog before PNP
    - CIFS: set *resp_buf_type to NO_BUFFER on error
    - arm64: dts: uniphier: fix input delay value for legacy mode of eMMC
    - igb: Fix the transmission mode of queue 0 for Qav mode
    - RISC-V: build vdso-dummy.o with -no-pie
    - arm64: only advance singlestep for user instruction traps
    - perf pmu: Fix core PMU alias list for X86 platform
    - bpf, x64: fix JIT emission for dead code
    - powerpc/kvm/booke: Fix altivec related build break
    - reset: uniphier: fix USB clock line for LD20
    - nfp: don't depend on eth_tbl being available
    - net: mvpp2: Fix clk error path in mvpp2_probe
    - kvm: apic: Flush TLB after APIC mode/address change if VPIDs are in use
    - IB/uverbs: Fix validating mandatory attributes
    - RDMA/hns: Intercept illegal RDMA operation when use inline data
    - pinctrl: cherryview: Associate IRQ descriptors to irqdomain
    - kthread, sched/wait: Fix kthread_parkme() completion issue
    - iommu/vt-d: Fix usage of force parameter in intel_ir_reconfigure_irte()
    - nvme/multipath: Disable runtime writable enabling parameter
    - ARM: dts: correct missing "compatible" entry for ti81xx SoCs
    - usb: typec: tps6598x: handle block reads separately with plain-I2C adapters
    - IB/mlx4: Fix integer overflow when calculating optimal MTT size
    - bpf: add map_alloc_check callback
    - bpf: fix possible spectre-v1 in find_and_alloc_map()
    - drm/exynos/mixer: fix synchronization check in interlaced mode
    - drm/exynos: mixer: avoid Oops in vp_video_buffer()
    - bpf: use array_index_nospec in find_prog_type
    - gcc-plugins: fix build condition of SANCOV plugin
    - drm/vc4: Fix oops dereferencing DPI's connector since panel_bridge.
    - nvme: fix use-after-free in nvme_free_ns_head
    - powerpc/pseries: Fix CONFIG_NUMA=n build
    - HID: i2c-hid: Add RESEND_REPORT_DESCR quirk for Toshiba Click Mini L9W-B
    - cifs: Allocate validate negotiation request through kmalloc
    - drm/amdgpu: Switch to interruptable wait to recover from ring hang.
    - rxrpc: Fix missing start of call timeout
    - ARM: dts: imx51-zii-rdu1: fix touchscreen bindings
    - sh: switch to NO_BOOTMEM
    - lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()
    - x86/pkeys/selftests: Avoid printf-in-signal deadlocks
    - afs: Fix address list parsing
    - afs: Fix refcounting in callback registration
    - afs: Fix server rotation's handling of fileserver probe failure
    - afs: Fix VNOVOL handling in address rotation
    - afs: Fix the handling of CB.InitCallBackState3 to find the server by UUID
    - afs: Fix afs_find_server search loop
    - KVM: X86: Lower the default timer frequency limit to 200us
    - platform/x86: DELL_WMI use depends on instead of select for DELL_SMBIOS
    - ARM: replace unnecessary perl with sed and the shell $(( )) operator

  * Improvements to the kernel source package preparation (LP: #1793461)
    - [Packaging] startnewrelease: add support for backport kernels

  * Kernel 4.15.0-35.38 fails to build with CONFIG_XFS_ONLINE_SCRUB enabled
    (LP: #1792393)
    - SAUCE: xfs: fix build error with CONFIG_XFS_ONLINE_SCRUB enabled

  * update ENA driver to latest mainline version (LP: #1792044)
    - net: ena: add detection and recovery mechanism for handling missed/misrouted
      MSI-X
    - net: ena: increase ena driver version to 1.5.0
    - net: ena: Eliminate duplicate barriers on weakly-ordered archs
    - SAUCE: ena: devm_kzalloc() -> devm_kcalloc()
    - net: ena: Fix use of uninitialized DMA address bits field
    - net: ena: fix surprise unplug NULL dereference kernel crash
    - net: ena: fix driver when PAGE_SIZE == 64kB
    - net: ena: fix device destruction to gracefully free resources
    - net: ena: fix potential double ena_destroy_device()
    - net: ena: fix missing lock during device destruction
    - net: ena: fix missing calls to READ_ONCE
    - net: ena: fix incorrect usage of memory barriers

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 02 Oct 2018 14:33:09 +0200

linux (4.15.0-36.39) bionic; urgency=medium

  * CVE-2018-14633
    - iscsi target: Use hex2bin instead of a re-implementation

  * CVE-2018-17182
    - mm: get rid of vmacache_flush_all() entirely

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 24 Sep 2018 16:08:41 +0200

linux (4.15.0-35.38) bionic; urgency=medium

  * linux: 4.15.0-35.38 -proposed tracker (LP: #1791719)

  * device hotplug of vfio devices can lead to deadlock in vfio_pci_release
    (LP: #1792099)
    - SAUCE: vfio -- release device lock before userspace requests

  * L1TF mitigation not effective in some CPU and RAM combinations
    (LP: #1788563)
    - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
    - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
      much RAM
    - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+

  * CVE-2018-15594
    - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests

  * CVE-2017-5715 (Spectre v2 s390x)
    - KVM: s390: implement CPU model only facilities
    - s390: detect etoken facility
    - KVM: s390: add etoken support for guests
    - s390/lib: use expoline for all bcr instructions
    - s390: fix br_r1_trampoline for machines without exrl
    - SAUCE: s390: use expoline thunks for all branches generated by the BPF JIT

  * Ubuntu18.04.1: cpuidle: powernv: Fix promotion from snooze if next state
    disabled (performance) (LP: #1790602)
    - cpuidle: powernv: Fix promotion from snooze if next state disabled

  * Watchdog CPU:19 Hard LOCKUP when kernel crash was triggered (LP: #1790636)
    - powerpc: hard disable irqs in smp_send_stop loop
    - powerpc: Fix deadlock with multiple calls to smp_send_stop
    - powerpc: smp_send_stop do not offline stopped CPUs
    - powerpc/powernv: Fix opal_event_shutdown() called with interrupts disabled

  * Security fix: check if IOMMU page is contained in the pinned physical page
    (LP: #1785675)
    - vfio/spapr: Use IOMMU pageshift rather than pagesize
    - KVM: PPC: Check if IOMMU page is contained in the pinned physical page

  * Missing Intel GPU pci-id's (LP: #1789924)
    - drm/i915/kbl: Add KBL GT2 sku
    - drm/i915/whl: Introducing Whiskey Lake platform
    - drm/i915/aml: Introducing Amber Lake platform
    - drm/i915/cfl: Add a new CFL PCI ID.

  * CVE-2018-15572
    - x86/speculation: Protect against userspace-userspace spectreRSB

  * Support Power Management for Thunderbolt Controller  (LP: #1789358)
    - thunderbolt: Handle NULL boot ACL entries properly
    - thunderbolt: Notify userspace when boot_acl is changed
    - thunderbolt: Use 64-bit DMA mask if supported by the platform
    - thunderbolt: Do not unnecessarily call ICM get route
    - thunderbolt: No need to take tb->lock in domain suspend/complete
    - thunderbolt: Use correct ICM commands in system suspend
    - thunderbolt: Add support for runtime PM

  * random oopses on s390 systems using NVMe devices (LP: #1790480)
    - s390/pci: fix out of bounds access during irq setup

  * [Bionic] Spectre v4 mitigation (Speculative Store Bypass Disable) support
    for arm64 using SMC firmware call to set a hardware chicken bit
    (LP: #1787993) // CVE-2018-3639 (arm64)
    - arm64: alternatives: Add dynamic patching feature
    - KVM: arm/arm64: Do not use kern_hyp_va() with kvm_vgic_global_state
    - KVM: arm64: Avoid storing the vcpu pointer on the stack
    - arm/arm64: smccc: Add SMCCC-specific return codes
    - arm64: Call ARCH_WORKAROUND_2 on transitions between EL0 and EL1
    - arm64: Add per-cpu infrastructure to call ARCH_WORKAROUND_2
    - arm64: Add ARCH_WORKAROUND_2 probing
    - arm64: Add 'ssbd' command-line option
    - arm64: ssbd: Add global mitigation state accessor
    - arm64: ssbd: Skip apply_ssbd if not using dynamic mitigation
    - arm64: ssbd: Restore mitigation status on CPU resume
    - arm64: ssbd: Introduce thread flag to control userspace mitigation
    - arm64: ssbd: Add prctl interface for per-thread mitigation
    - arm64: KVM: Add HYP per-cpu accessors
    - arm64: KVM: Add ARCH_WORKAROUND_2 support for guests
    - arm64: KVM: Handle guest's ARCH_WORKAROUND_2 requests
    - arm64: KVM: Add ARCH_WORKAROUND_2 discovery through ARCH_FEATURES_FUNC_ID
    - [Config] ARM64_SSBD=y

  * Reconcile hns3 SAUCE patches with upstream (LP: #1787477)
    - Revert "UBUNTU: SAUCE: net: hns3: Optimize PF CMDQ interrupt switching
      process"
    - Revert "UBUNTU: SAUCE: net: hns3: Fix for VF mailbox receiving unknown
      message"
    - Revert "UBUNTU: SAUCE: net: hns3: Fix for VF mailbox cannot receiving PF
      response"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix comments for
      hclge_get_ring_chain_from_mbx"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for using wrong mask and
      shift in hclge_get_ring_chain_from_mbx"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for reset_level default
      assignment probelm"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unnecessary ring
      configuration operation while resetting"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix return value error in
      hns3_reset_notify_down_enet"
    - Revert "UBUNTU: SAUCE: net: hns3: Fix for phy link issue when using marvell
      phy driver"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
      resetting"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: correct reset event status
      register"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent to request reset
      frequently"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: reset net device with rtnl_lock"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify the order of initializeing
      command queue register"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent sending command during
      global or core reset"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the warning when clear
      reset cause"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix get_vector ops in
      hclgevf_main module"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix warning bug when doing lp
      selftest"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add configure for mac minimal
      frame size"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mailbox message truncated
      problem"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for l4 checksum offload bug"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for waterline not setting
      correctly"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mac pause not disable in
      pfc mode"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix tc setup when netdev is first
      up"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused struct member and
      definition"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix mislead parameter name"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify inconsistent bit mask
      macros"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use decimal for bit offset
      macros"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix unreasonable code comments"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove extra space and brackets"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: standardize the handle of return
      value"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
      assignments"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix unused function warning in VF
      driver"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify hnae_ to hnae3_"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead
      of kzalloc/dma_map_single"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: give default option while
      dependency HNS3 set"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some unused members of
      some structures"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove a redundant
      hclge_cmd_csq_done"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: using modulo for cyclic counters
      in hclge_cmd_send"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
      assignments"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove useless code in
      hclge_cmd_send"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused
      hclge_ring_to_dma_dir"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use lower_32_bits and
      upper_32_bits"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove back in struct hclge_hw"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add unlikely for error check"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the Redundant put_vector
      in hns3_client_uninit"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: print the ret value in error
      information"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: extraction an interface for state
      state init|uninit"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused head file in
      hnae3.c"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add l4_type check for both ipv4
      and ipv6"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add vector status check before
      free vector"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: rename the interface for
      init_client_instance and uninit_client_instance"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove hclge_get_vector_index
      from hclge_bind_ring_with_vector"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: RX BD information valid only in
      last BD except VLD bit and buffer size"
    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add support for serdes loopback
      selftest"
    - net: hns3: Updates RX packet info fetch in case of multi BD
    - net: hns3: remove unused hclgevf_cfg_func_mta_filter
    - net: hns3: Fix for VF mailbox cannot receiving PF response
    - net: hns3: Fix for VF mailbox receiving unknown message
    - net: hns3: Optimize PF CMDQ interrupt switching process
    - net: hns3: remove hclge_get_vector_index from hclge_bind_ring_with_vector
    - net: hns3: rename the interface for init_client_instance and
      uninit_client_instance
    - net: hns3: add vector status check before free vector
    - net: hns3: add l4_type check for both ipv4 and ipv6
    - net: hns3: add unlikely for error check
    - net: hns3: remove unused head file in hnae3.c
    - net: hns3: extraction an interface for state init|uninit
    - net: hns3: print the ret value in error information
    - net: hns3: remove the Redundant put_vector in hns3_client_uninit
    - net: hns3: remove back in struct hclge_hw
    - net: hns3: use lower_32_bits and upper_32_bits
    - net: hns3: remove unused hclge_ring_to_dma_dir
    - net: hns3: remove useless code in hclge_cmd_send
    - net: hns3: remove some redundant assignments
    - net: hns3: simplify hclge_cmd_csq_clean
    - net: hns3: remove a redundant hclge_cmd_csq_done
    - net: hns3: remove some unused members of some structures
    - net: hns3: give default option while dependency HNS3 set
    - net: hns3: use dma_zalloc_coherent instead of kzalloc/dma_map_single
    - net: hns3: modify hnae_ to hnae3_
    - net: hns3: Fix tc setup when netdev is first up
    - net: hns3: Fix for mac pause not disable in pfc mode
    - net: hns3: Fix for waterline not setting correctly
    - net: hns3: Fix for l4 checksum offload bug
    - net: hns3: Fix for mailbox message truncated problem
    - net: hns3: Add configure for mac minimal frame size
    - net: hns3: Fix warning bug when doing lp selftest
    - net: hns3: Fix get_vector ops in hclgevf_main module
    - net: hns3: Remove the warning when clear reset cause
    - net: hns3: Prevent sending command during global or core reset
    - net: hns3: Modify the order of initializing command queue register
    - net: hns3: Reset net device with rtnl_lock
    - net: hns3: Prevent to request reset frequently
    - net: hns3: Correct reset event status register
    - net: hns3: Fix return value error in hns3_reset_notify_down_enet
    - net: hns3: remove unnecessary ring configuration operation while resetting
    - net: hns3: Fix for reset_level default assignment probelm
    - net: hns3: Fix for using wrong mask and shift in
      hclge_get_ring_chain_from_mbx
    - net: hns3: Fix comments for hclge_get_ring_chain_from_mbx
    - net: hns3: Remove some redundant assignments
    - net: hns3: Standardize the handle of return value
    - net: hns3: Remove extra space and brackets
    - net: hns3: Correct unreasonable code comments
    - net: hns3: Use decimal for bit offset macros
    - net: hns3: Modify inconsistent bit mask macros
    - net: hns3: Fix misleading parameter name
    - net: hns3: Remove unused struct member and definition
    - net: hns3: Add SPDX tags to HNS3 PF driver
    - net: hns3: Add support for serdes loopback selftest
    - net: hns3: Fix for phy link issue when using marvell phy driver
    - SAUCE: {topost} net: hns3: separate roce from nic when resetting

  * CVE-2018-6555
    - SAUCE: irda: Only insert new objects into the global database via setsockopt

  * CVE-2018-6554
    - SAUCE: irda: Fix memory leak caused by repeated binds of irda socket

  * Bionic update: upstream stable patchset 2018-08-31 (LP: #1790188)
    - netfilter: nf_tables: fix NULL pointer dereference on
      nft_ct_helper_obj_dump()
    - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers
    - af_key: Always verify length of provided sadb_key
    - gpio: No NULL owner
    - KVM: X86: Fix reserved bits check for MOV to CR3
    - KVM: x86: introduce linear_{read,write}_system
    - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and
      kvm_write_guest_virt_system
    - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
    - NFC: pn533: don't send USB data off of the stack
    - usbip: vhci_sysfs: fix potential Spectre v1
    - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
    - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
    - Input: xpad - add GPD Win 2 Controller USB IDs
    - phy: qcom-qusb2: Fix crash if nvmem cell not specified
    - usb: gadget: function: printer: avoid wrong list handling in printer_write()
    - usb: gadget: udc: renesas_usb3: disable the controller's irqs for
      reconnecting
    - serial: sh-sci: Stop using printk format %pCr
    - tty/serial: atmel: use port->name as name in request_irq()
    - serial: samsung: fix maxburst parameter for DMA transactions
    - serial: 8250: omap: Fix idling of clocks for unused uarts
    - vmw_balloon: fixing double free when batching mode is off
    - tty: pl011: Avoid spuriously stuck-off interrupts
    - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
    - Input: goodix - add new ACPI id for GPD Win 2 touch screen
    - crypto: caam - strip input zeros from RSA input buffer
    - crypto: caam - fix DMA mapping dir for generated IV
    - crypto: caam - fix IV DMA mapping and updating
    - crypto: caam/qi - fix IV DMA mapping and updating
    - crypto: caam - fix size of RSA prime factor q
    - crypto: vmx - Remove overly verbose printk from AES init routines
    - crypto: vmx - Remove overly verbose printk from AES XTS init
    - crypto: omap-sham - fix memleak
    - usb: typec: wcove: Remove dependency on HW FSM
    - usb: gadget: udc: renesas_usb3: fix double phy_put()
    - usb: gadget: udc: renesas_usb3: should remove debugfs
    - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add
      udc
    - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc
    - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error

  * Bionic update: upstream stable patchset 2018-08-29 (LP: #1789666)
    - scsi: sd_zbc: Avoid that resetting a zone fails sporadically
    - mmap: introduce sane default mmap limits
    - mmap: relax file size limit for regular files
    - btrfs: define SUPER_FLAG_METADUMP_V2
    - kconfig: Avoid format overflow warning from GCC 8.1
    - be2net: Fix error detection logic for BE3
    - bnx2x: use the right constant
    - dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()
    - enic: set DMA mask to 47 bit
    - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
    - ip6_tunnel: remove magic mtu value 0xFFF8
    - ipmr: properly check rhltable_init() return value
    - ipv4: remove warning in ip_recv_error
    - ipv6: omit traffic class when calculating flow hash
    - isdn: eicon: fix a missing-check bug
    - kcm: Fix use-after-free caused by clonned sockets
    - netdev-FAQ: clarify DaveM's position for stable backports
    - net: ipv4: add missing RTA_TABLE to rtm_ipv4_policy
    - net: metrics: add proper netlink validation
    - net/packet: refine check for priv area size
    - net: phy: broadcom: Fix bcm_write_exp()
    - net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
    - packet: fix reserve calculation
    - qed: Fix mask for physical address in ILT entry
    - sctp: not allow transport timeout value less than HZ/5 for hb_timer
    - team: use netdev_features_t instead of u32
    - vhost: synchronize IOTLB message with dev cleanup
    - vrf: check the original netdevice for generating redirect
    - ipv6: sr: fix memory OOB access in seg6_do_srh_encap/inline
    - net: phy: broadcom: Fix auxiliary control register reads
    - net-sysfs: Fix memory leak in XPS configuration
    - virtio-net: correctly transmit XDP buff after linearizing
    - net/mlx4: Fix irq-unsafe spinlock usage
    - tun: Fix NULL pointer dereference in XDP redirect
    - virtio-net: correctly check num_buf during err path
    - net/mlx5e: When RXFCS is set, add FCS data into checksum calculation
    - virtio-net: fix leaking page for gso packet during mergeable XDP
    - rtnetlink: validate attributes in do_setlink()
    - cls_flower: Fix incorrect idr release when failing to modify rule
    - PCI: hv: Do not wait forever on a device that has disappeared
    - drm: set FMODE_UNSIGNED_OFFSET for drm files
    - l2tp: fix refcount leakage on PPPoL2TP sockets
    - mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG
    - net: ethernet: ti: cpdma: correct error handling for chan create
    - net: ethernet: davinci_emac: fix error handling in probe()
    - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC
    - net : sched: cls_api: deal with egdev path only if needed

  * Bionic update: upstream stable patchset 2018-08-24 (LP: #1788897)
    - fix io_destroy()/aio_complete() race
    - mm: fix the NULL mapping case in __isolate_lru_page()
    - objtool: Support GCC 8's cold subfunctions
    - objtool: Support GCC 8 switch tables
    - objtool: Detect RIP-relative switch table references
    - objtool: Detect RIP-relative switch table references, part 2
    - objtool: Fix "noreturn" detection for recursive sibling calls
    - xfs: convert XFS_AGFL_SIZE to a helper function
    - xfs: detect agfl count corruption and reset agfl
    - Input: synaptics - Lenovo Carbon X1 Gen5 (2017) devices should use RMI
    - Input: synaptics - add Lenovo 80 series ids to SMBus
    - Input: elan_i2c_smbus - fix corrupted stack
    - tracing: Fix crash when freeing instances with event triggers
    - tracing: Make the snapshot trigger work with instances
    - selinux: KASAN: slab-out-of-bounds in xattr_getsecurity
    - cfg80211: further limit wiphy names to 64 bytes
    - drm/amd/powerplay: Fix enum mismatch
    - rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c
    - platform/chrome: cros_ec_lpc: remove redundant pointer request
    - kbuild: clang: disable unused variable warnings only when constant
    - tcp: avoid integer overflows in tcp_rcv_space_adjust()
    - iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ
    - iio:buffer: make length types match kfifo types
    - iio:kfifo_buf: check for uint overflow
    - iio: adc: select buffer for at91-sama5d2_adc
    - MIPS: lantiq: gphy: Drop reboot/remove reset asserts
    - MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs
    - MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests
    - scsi: scsi_transport_srp: Fix shost to rport translation
    - stm class: Use vmalloc for the master map
    - hwtracing: stm: fix build error on some arches
    - IB/core: Fix error code for invalid GID entry
    - mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty()
    - Revert "rt2800: use TXOP_BACKOFF for probe frames"
    - intel_th: Use correct device when freeing buffers
    - drm/psr: Fix missed entry in PSR setup time table.
    - drm/i915/lvds: Move acpi lid notification registration to registration phase
    - drm/i915: Disable LVDS on Radiant P845
    - drm/vmwgfx: Use kasprintf
    - drm/vmwgfx: Fix host logging / guestinfo reading error paths
    - nvme: fix extended data LBA supported setting
    - iio: hid-sensor-trigger: Fix sometimes not powering up the sensor after
      resume
    - x86/MCE/AMD: Define a function to get SMCA bank type
    - x86/mce/AMD: Pass the bank number to smca_get_bank_type()
    - x86/mce/AMD, EDAC/mce_amd: Enumerate Reserved SMCA bank type
    - x86/mce/AMD: Carve out SMCA get_block_address() code
    - x86/MCE/AMD: Cache SMCA MISC block addresses

  * errors when scanning partition table of corrupted AIX disk (LP: #1787281)
    - partitions/aix: fix usage of uninitialized lv_info and lvname structures
    - partitions/aix: append null character to print data from disk

  * tlbie master timeout checkstop (using NVidia/GPU) (LP: #1789772)
    - powerpc/mm/hugetlb: Update huge_ptep_set_access_flags to call
      __ptep_set_access_flags directly
    - powerpc/mm/radix: Move function from radix.h to pgtable-radix.c
    - powerpc/mm: Change function prototype
    - powerpc/mm/radix: Change pte relax sequence to handle nest MMU hang

  * performance drop with ATS enabled (LP: #1788097)
    - powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage

  * [Regression] kernel crashdump fails on arm64 (LP: #1786878)
    - arm64: export memblock_reserve()d regions via /proc/iomem
    - drivers: acpi: add dependency of EFI for arm64
    - efi/arm: preserve early mapping of UEFI memory map longer for BGRT
    - efi/arm: map UEFI memory map even w/o runtime services enabled
    - arm64: acpi: fix alignment fault in accessing ACPI
    - [Config] CONFIG_ARCH_SUPPORTS_ACPI=y
    - arm64: fix ACPI dependencies
    - ACPI: fix menuconfig presentation of ACPI submenu

  * TB 16 issue on Dell Lattitude 7490 with large amount of data (LP: #1785780)
    - r8152: disable RX aggregation on new Dell TB16 dock

  * dell_wmi: Unknown key codes (LP: #1762385)
    - platform/x86: dell-wmi: Ignore new rfkill and fn-lock events

  * Enable AMD PCIe MP2 for AMDI0011 (LP: #1773940)
    - SAUCE: i2c:amd I2C Driver based on PCI Interface for upcoming platform
    - SAUCE: i2c:amd move out pointer in union i2c_event_base
    - SAUCE: i2c:amd Depends on ACPI
    - [Config] i2c: CONFIG_I2C_AMD_MP2=y on x86

  * r8169 no internet after suspending (LP: #1779817)
    - r8169: restore previous behavior to accept BIOS WoL settings
    - r8169: don't use MSI-X on RTL8168g
    - r8169: don't use MSI-X on RTL8106e

  * Fix Intel Cannon Lake LPSS I2C input clock (LP: #1789790)
    - mfd: intel-lpss: Fix Intel Cannon Lake LPSS I2C input clock

  * Microphone cannot be detected with front panel audio combo jack on HP Z8-G4
    machine (LP: #1789145)
    - ALSA: hda/realtek - Fix HP Headset Mic can't record

  * Tango platform uses __initcall without further checks (LP: #1787945)
    - [Config] disable ARCH_TANGO

  * [18.10 FEAT] Add kernel config option "CONFIG_SCLP_OFB" (LP: #1787898)
    - [Config] CONFIG_SCLP_OFB=y for s390x

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 12 Sep 2018 11:39:17 +0200

linux (4.15.0-34.37) bionic; urgency=medium

  * linux: 4.15.0-34.37 -proposed tracker (LP: #1788744)

  * Bionic update: upstream stable patchset 2018-08-09 (LP: #1786352)
    - MIPS: c-r4k: Fix data corruption related to cache coherence
    - MIPS: ptrace: Expose FIR register through FP regset
    - MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs
    - KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"
    - affs_lookup(): close a race with affs_remove_link()
    - fs: don't scan the inode cache before SB_BORN is set
    - aio: fix io_destroy(2) vs. lookup_ioctx() race
    - ALSA: timer: Fix pause event notification
    - do d_instantiate/unlock_new_inode combinations safely
    - mmc: sdhci-iproc: remove hard coded mmc cap 1.8v
    - mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register
    - mmc: sdhci-iproc: add SDHCI_QUIRK2_HOST_OFF_CARD_ON for cygnus
    - libata: Blacklist some Sandisk SSDs for NCQ
    - libata: blacklist Micron 500IT SSD with MU01 firmware
    - xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent
    - drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros
    - arm64: lse: Add early clobbers to some input/output asm operands
    - powerpc/64s: Clear PCR on boot
    - IB/hfi1: Use after free race condition in send context error path
    - IB/umem: Use the correct mm during ib_umem_release
    - idr: fix invalid ptr dereference on item delete
    - Revert "ipc/shm: Fix shmat mmap nil-page protection"
    - ipc/shm: fix shmat() nil address after round-down when remapping
    - mm/kasan: don't vfree() nonexistent vm_area
    - kasan: free allocated shadow memory on MEM_CANCEL_ONLINE
    - kasan: fix memory hotplug during boot
    - kernel/sys.c: fix potential Spectre v1 issue
    - KVM: s390: vsie: fix < 8k check for the itdba
    - KVM: x86: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed
    - kvm: x86: IA32_ARCH_CAPABILITIES is always supported
    - powerpc/64s: Improve RFI L1-D cache flush fallback
    - powerpc/pseries: Restore default security feature flags on setup
    - powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
    - MIPS: generic: Fix machine compatible matching
    - mac80211: mesh: fix wrong mesh TTL offset calculation
    - ARC: Fix malformed ARC_EMUL_UNALIGNED default
    - ptr_ring: prevent integer overflow when calculating size
    - arm64: dts: rockchip: fix rock64 gmac2io stability issues
    - arm64: dts: rockchip: correct ep-gpios for rk3399-sapphire
    - libata: Fix compile warning with ATA_DEBUG enabled
    - selftests: sync: missing CFLAGS while compiling
    - selftest/vDSO: fix O=
    - selftests: pstore: Adding config fragment CONFIG_PSTORE_RAM=m
    - selftests: memfd: add config fragment for fuse
    - ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt
    - ARM: OMAP3: Fix prm wake interrupt for resume
    - ARM: OMAP2+: Fix sar_base inititalization for HS omaps
    - ARM: OMAP1: clock: Fix debugfs_create_*() usage
    - tls: retrun the correct IV in getsockopt
    - xhci: workaround for AMD Promontory disabled ports wakeup
    - IB/uverbs: Fix method merging in uverbs_ioctl_merge
    - IB/uverbs: Fix possible oops with duplicate ioctl attributes
    - IB/uverbs: Fix unbalanced unlock on error path for rdma_explicit_destroy
    - arm64: dts: rockchip: Fix DWMMC clocks
    - ARM: dts: rockchip: Fix DWMMC clocks
    - iwlwifi: mvm: fix security bug in PN checking
    - iwlwifi: mvm: fix IBSS for devices that support station type API
    - iwlwifi: mvm: always init rs with 20mhz bandwidth rates
    - NFC: llcp: Limit size of SDP URI
    - rxrpc: Work around usercopy check
    - MD: Free bioset when md_run fails
    - md: fix md_write_start() deadlock w/o metadata devices
    - s390/dasd: fix handling of internal requests
    - xfrm: do not call rcu_read_unlock when afinfo is NULL in xfrm_get_tos
    - mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
    - mac80211: fix a possible leak of station stats
    - mac80211: fix calling sleeping function in atomic context
    - cfg80211: clear wep keys after disconnection
    - mac80211: Do not disconnect on invalid operating class
    - mac80211: Fix sending ADDBA response for an ongoing session
    - gpu: ipu-v3: pre: fix device node leak in ipu_pre_lookup_by_phandle
    - gpu: ipu-v3: prg: fix device node leak in ipu_prg_lookup_by_phandle
    - md raid10: fix NULL deference in handle_write_completed()
    - drm/exynos: g2d: use monotonic timestamps
    - drm/exynos: fix comparison to bitshift when dealing with a mask
    - drm/meson: fix vsync buffer update
    - arm64: perf: correct PMUVer probing
    - RDMA/bnxt_re: Unpin SQ and RQ memory if QP create fails
    - RDMA/bnxt_re: Fix system crash during load/unload
    - net/mlx5e: Return error if prio is specified when offloading eswitch vlan
      push
    - locking/xchg/alpha: Add unconditional memory barrier to cmpxchg()
    - md: raid5: avoid string overflow warning
    - virtio_net: fix XDP code path in receive_small()
    - kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
    - bug.h: work around GCC PR82365 in BUG()
    - selftests/memfd: add run_fuse_test.sh to TEST_FILES
    - seccomp: add a selftest for get_metadata
    - soc: imx: gpc: de-register power domains only if initialized
    - powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access
    - s390/cio: fix ccw_device_start_timeout API
    - s390/cio: fix return code after missing interrupt
    - s390/cio: clear timer when terminating driver I/O
    - selftests/bpf/test_maps: exit child process without error in ENOMEM case
    - PKCS#7: fix direct verification of SignerInfo signature
    - arm64: dts: cavium: fix PCI bus dtc warnings
    - nfs: system crashes after NFS4ERR_MOVED recovery
    - ARM: OMAP: Fix dmtimer init for omap1
    - smsc75xx: fix smsc75xx_set_features()
    - regulatory: add NUL to request alpha2
    - integrity/security: fix digsig.c build error with header file
    - x86/intel_rdt: Fix incorrect returned value when creating rdgroup sub-
      directory in resctrl file system
    - locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs
    - x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across
      CPU hotplug operations
    - mac80211: drop frames with unexpected DS bits from fast-rx to slow path
    - arm64: fix unwind_frame() for filtered out fn for function graph tracing
    - macvlan: fix use-after-free in macvlan_common_newlink()
    - KVM: nVMX: Don't halt vcpu when L1 is injecting events to L2
    - kvm: fix warning for CONFIG_HAVE_KVM_EVENTFD builds
    - ARM: dts: imx6dl: Include correct dtsi file for Engicam i.CoreM6
      DualLite/Solo RQS
    - fs: dcache: Avoid livelock between d_alloc_parallel and __d_add
    - fs: dcache: Use READ_ONCE when accessing i_dir_seq
    - md: fix a potential deadlock of raid5/raid10 reshape
    - md/raid1: fix NULL pointer dereference
    - batman-adv: fix packet checksum in receive path
    - batman-adv: invalidate checksum on fragment reassembly
    - netfilter: ipt_CLUSTERIP: put config struct if we can't increment ct
      refcount
    - netfilter: ipt_CLUSTERIP: put config instead of freeing it
    - netfilter: ebtables: convert BUG_ONs to WARN_ONs
    - batman-adv: Ignore invalid batadv_iv_gw during netlink send
    - batman-adv: Ignore invalid batadv_v_gw during netlink send
    - batman-adv: Fix netlink dumping of BLA claims
    - batman-adv: Fix netlink dumping of BLA backbones
    - nvme-pci: Fix nvme queue cleanup if IRQ setup fails
    - clocksource/drivers/fsl_ftm_timer: Fix error return checking
    - libceph, ceph: avoid memory leak when specifying same option several times
    - ceph: fix dentry leak when failing to init debugfs
    - xen/pvcalls: fix null pointer dereference on map->sock
    - ARM: orion5x: Revert commit 4904dbda41c8.
    - qrtr: add MODULE_ALIAS macro to smd
    - selftests/futex: Fix line continuation in Makefile
    - r8152: fix tx packets accounting
    - virtio-gpu: fix ioctl and expose the fixed status to userspace.
    - dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3
    - bcache: fix kcrashes with fio in RAID5 backend dev
    - ip_gre: fix IFLA_MTU ignored on NEWLINK
    - ip6_tunnel: fix IFLA_MTU ignored on NEWLINK
    - sit: fix IFLA_MTU ignored on NEWLINK
    - nbd: fix return value in error handling path
    - ARM: dts: NSP: Fix amount of RAM on BCM958625HR
    - ARM: dts: bcm283x: Fix unit address of local_intc
    - powerpc/boot: Fix random libfdt related build errors
    - clocksource/drivers/mips-gic-timer: Use correct shift count to extract data
    - gianfar: Fix Rx byte accounting for ndev stats
    - net/tcp/illinois: replace broken algorithm reference link
    - nvmet: fix PSDT field check in command format
    - net/smc: use link_id of server in confirm link reply
    - mlxsw: core: Fix flex keys scratchpad offset conflict
    - mlxsw: spectrum: Treat IPv6 unregistered multicast as broadcast
    - spectrum: Reference count VLAN entries
    - ARC: mcip: halt GFRC counter when ARC cores halt
    - ARC: mcip: update MCIP debug mask when the new cpu came online
    - ARC: setup cpu possible mask according to possible-cpus dts property
    - ipvs: remove IPS_NAT_MASK check to fix passive FTP
    - IB/mlx: Set slid to zero in Ethernet completion struct
    - RDMA/bnxt_re: Unconditionly fence non wire memory operations
    - RDMA/bnxt_re: Fix incorrect DB offset calculation
    - RDMA/bnxt_re: Fix the ib_reg failure cleanup
    - xen/pirq: fix error path cleanup when binding MSIs
    - drm/amd/amdgpu: Correct VRAM width for APUs with GMC9
    - xfrm: Fix ESN sequence number handling for IPsec GSO packets.
    - arm64: dts: rockchip: Fix rk3399-gru-* s2r (pinctrl hogs, wifi reset)
    - drm/sun4i: Fix dclk_set_phase
    - btrfs: use kvzalloc to allocate btrfs_fs_info
    - Btrfs: send, fix issuing write op when processing hole in no data mode
    - Btrfs: fix log replay failure after linking special file and fsync
    - ceph: fix potential memory leak in init_caches()
    - block: display the correct diskname for bio
    - selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable
    - net: ethtool: don't ignore return from driver get_fecparam method
    - iwlwifi: mvm: fix TX of CCMP 256
    - iwlwifi: mvm: Fix channel switch for count 0 and 1
    - iwlwifi: mvm: fix assert 0x2B00 on older FWs
    - iwlwifi: avoid collecting firmware dump if not loaded
    - iwlwifi: mvm: Direct multicast frames to the correct station
    - iwlwifi: mvm: Correctly set the tid for mcast queue
    - rds: Incorrect reference counting in TCP socket creation
    - watchdog: f71808e_wdt: Fix magic close handling
    - batman-adv: Fix multicast packet loss with a single WANT_ALL_IPV4/6 flag
    - hv_netvsc: use napi_schedule_irqoff
    - hv_netvsc: filter multicast/broadcast
    - hv_netvsc: propagate rx filters to VF
    - ARM: dts: rockchip: Add missing #sound-dai-cells on rk3288
    - e1000e: Fix check_for_link return value with autoneg off
    - e1000e: allocate ring descriptors with dma_zalloc_coherent
    - ia64/err-inject: Use get_user_pages_fast()
    - RDMA/qedr: Fix kernel panic when running fio over NFSoRDMA
    - RDMA/qedr: Fix iWARP write and send with immediate
    - IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs
    - IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE
    - IB/mlx5: Fix an error code in __mlx5_ib_modify_qp()
    - fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
      sbusfb_ioctl_helper().
    - fsl/fman: avoid sleeping in atomic context while adding an address
    - qed: Free RoCE ILT Memory on rmmod qedr
    - net: qcom/emac: Use proper free methods during TX
    - net: smsc911x: Fix unload crash when link is up
    - IB/core: Fix possible crash to access NULL netdev
    - cxgb4: do not set needs_free_netdev for mgmt dev's
    - xen-blkfront: move negotiate_mq to cover all cases of new VBDs
    - xen: xenbus: use put_device() instead of kfree()
    - hv_netvsc: fix filter flags
    - hv_netvsc: fix locking for rx_mode
    - hv_netvsc: fix locking during VF setup
    - ARM: davinci: fix the GPIO lookup for omapl138-hawk
    - arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery
    - selftests/vm/run_vmtests: adjust hugetlb size according to nr_cpus
    - lib/test_kmod.c: fix limit check on number of test devices created
    - dmaengine: mv_xor_v2: Fix clock resource by adding a register clock
    - netfilter: ebtables: fix erroneous reject of last rule
    - can: m_can: change comparison to bitshift when dealing with a mask
    - can: m_can: select pinctrl state in each suspend/resume function
    - bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa().
    - workqueue: use put_device() instead of kfree()
    - ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
    - sunvnet: does not support GSO for sctp
    - KVM: arm/arm64: vgic: Add missing irq_lock to vgic_mmio_read_pending
    - gpu: ipu-v3: prg: avoid possible array underflow
    - drm/imx: move arming of the vblank event to atomic_flush
    - drm/nouveau/bl: fix backlight regression
    - xfrm: fix rcu_read_unlock usage in xfrm_local_error
    - iwlwifi: mvm: set the correct tid when we flush the MCAST sta
    - iwlwifi: mvm: Correctly set IGTK for AP
    - iwlwifi: mvm: fix error checking for multi/broadcast sta
    - net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off
    - vlan: Fix out of order vlan headers with reorder header off
    - batman-adv: fix header size check in batadv_dbg_arp()
    - batman-adv: Fix skbuff rcsum on packet reroute
    - vti4: Don't count header length twice on tunnel setup
    - ip_tunnel: Clamp MTU to bounds on new link
    - vti6: Fix dev->max_mtu setting
    - iwlwifi: mvm: Increase session protection time after CS
    - iwlwifi: mvm: clear tx queue id when unreserving aggregation queue
    - iwlwifi: mvm: make sure internal station has a valid id
    - iwlwifi: mvm: fix array out of bounds reference
    - drm/tegra: Shutdown on driver unbind
    - perf/cgroup: Fix child event counting bug
    - brcmfmac: Fix check for ISO3166 code
    - kbuild: make scripts/adjust_autoksyms.sh robust against timestamp races
    - RDMA/ucma: Correct option size check using optlen
    - RDMA/qedr: fix QP's ack timeout configuration
    - RDMA/qedr: Fix rc initialization on CNQ allocation failure
    - RDMA/qedr: Fix QP state initialization race
    - net/sched: fix idr leak on the error path of tcf_bpf_init()
    - net/sched: fix idr leak in the error path of tcf_simp_init()
    - net/sched: fix idr leak in the error path of tcf_act_police_init()
    - net/sched: fix idr leak in the error path of tcp_pedit_init()
    - net/sched: fix idr leak in the error path of __tcf_ipt_init()
    - net/sched: fix idr leak in the error path of tcf_skbmod_init()
    - net: dsa: Fix functional dsa-loop dependency on FIXED_PHY
    - drm/ast: Fixed 1280x800 Display Issue
    - mm/mempolicy.c: avoid use uninitialized preferred_node
    - mm, thp: do not cause memcg oom for thp
    - xfrm: Fix transport mode skb control buffer usage.
    - selftests: ftrace: Add probe event argument syntax testcase
    - selftests: ftrace: Add a testcase for string type with kprobe_event
    - selftests: ftrace: Add a testcase for probepoint
    - drm/amdkfd: Fix scratch memory with HWS enabled
    - batman-adv: fix multicast-via-unicast transmission with AP isolation
    - batman-adv: fix packet loss for broadcasted DHCP packets to a server
    - ARM: 8748/1: mm: Define vdso_start, vdso_end as array
    - lan78xx: Set ASD in MAC_CR when EEE is enabled.
    - net: qmi_wwan: add BroadMobi BM806U 2020:2033
    - bonding: fix the err path for dev hwaddr sync in bond_enslave
    - net: dsa: mt7530: fix module autoloading for OF platform drivers
    - net/mlx5: Make eswitch support to depend on switchdev
    - perf/x86/intel: Fix linear IP of PEBS real_ip on Haswell and later CPUs
    - x86/alternatives: Fixup alternative_call_2
    - llc: properly handle dev_queue_xmit() return value
    - builddeb: Fix header package regarding dtc source links
    - qede: Fix barrier usage after tx doorbell write.
    - mm, slab: memcg_link the SLAB's kmem_cache
    - mm/page_owner: fix recursion bug after changing skip entries
    - mm/kmemleak.c: wait for scan completion before disabling free
    - hv_netvsc: enable multicast if necessary
    - qede: Do not drop rx-checksum invalidated packets.
    - net: Fix untag for vlan packets without ethernet header
    - vlan: Fix vlan insertion for packets without ethernet header
    - net: mvneta: fix enable of all initialized RXQs
    - sh: fix debug trap failure to process signals before return to user
    - firmware: dmi_scan: Fix UUID length safety check
    - nvme: don't send keep-alives to the discovery controller
    - Btrfs: clean up resources during umount after trans is aborted
    - Btrfs: fix loss of prealloc extents past i_size after fsync log replay
    - x86/pgtable: Don't set huge PUD/PMD on non-leaf entries
    - fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl
      table
    - swap: divide-by-zero when zero length swap file on ssd
    - z3fold: fix memory leak
    - sr: get/drop reference to device in revalidate and check_events
    - Force log to disk before reading the AGF during a fstrim
    - cpufreq: CPPC: Initialize shared perf capabilities of CPUs
    - powerpc/fscr: Enable interrupts earlier before calling get_user()
    - perf tools: Fix perf builds with clang support
    - perf clang: Add support for recent clang versions
    - dp83640: Ensure against premature access to PHY registers after reset
    - ibmvnic: Zero used TX descriptor counter on reset
    - mm/ksm: fix interaction with THP
    - mm: fix races between address_space dereference and free in page_evicatable
    - mm: thp: fix potential clearing to referenced flag in
      page_idle_clear_pte_refs_one()
    - Btrfs: bail out on error during replay_dir_deletes
    - Btrfs: fix NULL pointer dereference in log_dir_items
    - btrfs: Fix possible softlock on single core machines
    - IB/rxe: Fix for oops in rxe_register_device on ppc64le arch
    - ocfs2/dlm: don't handle migrate lockres if already in shutdown
    - powerpc/64s/idle: Fix restore of AMOR on POWER9 after deep sleep
    - sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning
    - x86/mm: Fix bogus warning during EFI bootup, use boot_cpu_has() instead of
      this_cpu_has() in build_cr3_noflush()
    - KVM: VMX: raise internal error for exception during invalid protected mode
      state
    - lan78xx: Connect phy early
    - sparc64: Make atomic_xchg() an inline function rather than a macro.
    - net: bgmac: Fix endian access in bgmac_dma_tx_ring_free()
    - net: bgmac: Correctly annotate register space
    - btrfs: tests/qgroup: Fix wrong tree backref level
    - Btrfs: fix copy_items() return value when logging an inode
    - btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers
    - btrfs: qgroup: Fix root item corruption when multiple same source snapshots
      are created with quota enabled
    - rxrpc: Fix Tx ring annotation after initial Tx failure
    - rxrpc: Don't treat call aborts as conn aborts
    - xen/acpi: off by one in read_acpi_id()
    - drivers: macintosh: rack-meter: really fix bogus memsets
    - ACPI: acpi_pad: Fix memory leak in power saving threads
    - powerpc/mpic: Check if cpu_possible() in mpic_physmask()
    - ieee802154: ca8210: fix uninitialised data read
    - ath10k: advertize beacon_int_min_gcd
    - iommu/amd: Take into account that alloc_dev_data() may return NULL
    - intel_th: Use correct method of finding hub
    - m68k: set dma and coherent masks for platform FEC ethernets
    - iwlwifi: mvm: check if mac80211_queue is valid in iwl_mvm_disable_txq
    - parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
    - hwmon: (nct6775) Fix writing pwmX_mode
    - powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer
    - powerpc/perf: Fix kernel address leak via sampling registers
    - rsi: fix kernel panic observed on 64bit machine
    - tools/thermal: tmon: fix for segfault
    - selftests: Print the test we're running to /dev/kmsg
    - net/mlx5: Protect from command bit overflow
    - watchdog: davinci_wdt: fix error handling in davinci_wdt_probe()
    - ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk)
    - nvme-pci: disable APST for Samsung NVMe SSD 960 EVO + ASUS PRIME Z370-A
    - ath9k: fix crash in spectral scan
    - cxgb4: Setup FW queues before registering netdev
    - ima: Fix Kconfig to select TPM 2.0 CRB interface
    - ima: Fallback to the builtin hash algorithm
    - watchdog: aspeed: Allow configuring for alternate boot
    - arm: dts: socfpga: fix GIC PPI warning
    - ext4: don't complain about incorrect features when probing
    - drm/vmwgfx: Unpin the screen object backup buffer when not used
    - iommu/mediatek: Fix protect memory setting
    - cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path
    - IB/mlx5: Set the default active rate and width to QDR and 4X
    - zorro: Set up z->dev.dma_mask for the DMA API
    - bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set
    - remoteproc: imx_rproc: Fix an error handling path in 'imx_rproc_probe()'
    - dt-bindings: add device tree binding for Allwinner H6 main CCU
    - ACPICA: Events: add a return on failure from acpi_hw_register_read
    - ACPICA: Fix memory leak on unusual memory leak
    - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
    - cxgb4: Fix queue free path of ULD drivers
    - i2c: mv64xxx: Apply errata delay only in standard mode
    - KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use
    - perf top: Fix top.call-graph config option reading
    - perf stat: Fix core dump when flag T is used
    - IB/core: Honor port_num while resolving GID for IB link layer
    - drm/amdkfd: add missing include of mm.h
    - coresight: Use %px to print pcsr instead of %p
    - regulator: gpio: Fix some error handling paths in 'gpio_regulator_probe()'
    - spi: bcm-qspi: fIX some error handling paths
    - net/smc: pay attention to MAX_ORDER for CQ entries
    - MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset
    - watchdog: dw: RMW the control register
    - watchdog: aspeed: Fix translation of reset mode to ctrl register
    - drm/meson: Fix some error handling paths in 'meson_drv_bind_master()'
    - drm/meson: Fix an un-handled error path in 'meson_drv_bind_master()'
    - powerpc: Add missing prototype for arch_irq_work_raise()
    - f2fs: fix to set KEEP_SIZE bit in f2fs_zero_range
    - f2fs: fix to clear CP_TRIMMED_FLAG
    - f2fs: fix to check extent cache in f2fs_drop_extent_tree
    - perf/core: Fix installing cgroup events on CPU
    - max17042: propagate of_node to power supply device
    - perf/core: Fix perf_output_read_group()
    - drm/panel: simple: Fix the bus format for the Ontat panel
    - hwmon: (pmbus/max8688) Accept negative page register values
    - hwmon: (pmbus/adm1275) Accept negative page register values
    - perf/x86/intel: Properly save/restore the PMU state in the NMI handler
    - cdrom: do not call check_disk_change() inside cdrom_open()
    - efi/arm*: Only register page tables when they exist
    - perf/x86/intel: Fix large period handling on Broadwell CPUs
    - perf/x86/intel: Fix event update for auto-reload
    - arm64: dts: qcom: Fix SPI5 config on MSM8996
    - soc: qcom: wcnss_ctrl: Fix increment in NV upload
    - gfs2: Fix fallocate chunk size
    - x86/devicetree: Initialize device tree before using it
    - x86/devicetree: Fix device IRQ settings in DT
    - phy: rockchip-emmc: retry calpad busy trimming
    - ALSA: vmaster: Propagate slave error
    - phy: qcom-qmp: Fix phy pipe clock gating
    - drm/bridge: sii902x: Retry status read after DDI I2C
    - tools: hv: fix compiler warnings about major/target_fname
    - block: null_blk: fix 'Invalid parameters' when loading module
    - dmaengine: pl330: fix a race condition in case of threaded irqs
    - dmaengine: rcar-dmac: Check the done lists in rcar_dmac_chan_get_residue()
    - enic: enable rq before updating rq descriptors
    - watchdog: asm9260_wdt: fix error handling in asm9260_wdt_probe()
    - hwrng: stm32 - add reset during probe
    - pinctrl: devicetree: Fix dt_to_map_one_config handling of hogs
    - pinctrl: artpec6: dt: add missing pin group uart5nocts
    - vfio-ccw: fence off transport mode
    - dmaengine: qcom: bam_dma: get num-channels and num-ees from dt
    - drm: omapdrm: dss: Move initialization code from component bind to probe
    - ARM: dts: dra71-evm: Correct evm_sd regulator max voltage
    - drm/amdgpu: disable GFX ring and disable PQ wptr in hw_fini
    - drm/amdgpu: adjust timeout for ib_ring_tests(v2)
    - net: stmmac: ensure that the device has released ownership before reading
      data
    - net: stmmac: ensure that the MSS desc is the last desc to set the own bit
    - cpufreq: Reorder cpufreq_online() error code path
    - dpaa_eth: fix SG mapping
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9220
    - udf: Provide saner default for invalid uid / gid
    - ixgbe: prevent ptp_rx_hang from running when in FILTER_ALL mode
    - sh_eth: fix TSU init on SH7734/R8A7740
    - power: supply: ltc2941-battery-gauge: Fix temperature units
    - ARM: dts: bcm283x: Fix probing of bcm2835-i2s
    - ARM: dts: bcm283x: Fix pin function of JTAG pins
    - PCMCIA / PM: Avoid noirq suspend aborts during suspend-to-idle
    - audit: return on memory error to avoid null pointer dereference
    - net: stmmac: call correct function in stmmac_mac_config_rx_queues_routing()
    - rcu: Call touch_nmi_watchdog() while printing stall warnings
    - pinctrl: sh-pfc: r8a7796: Fix MOD_SEL register pin assignment for SSI pins
      group
    - dpaa_eth: fix pause capability advertisement logic
    - MIPS: Octeon: Fix logging messages with spurious periods after newlines
    - drm/rockchip: Respect page offset for PRIME mmap calls
    - x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic'
      specified
    - perf test: Fix test case inet_pton to accept inlines.
    - perf report: Fix wrong jump arrow
    - perf tests: Use arch__compare_symbol_names to compare symbols
    - perf report: Fix memory corruption in --branch-history mode --branch-history
    - perf tests: Fix dwarf unwind for stripped binaries
    - selftests/net: fixes psock_fanout eBPF test case
    - netlabel: If PF_INET6, check sk_buff ip header version
    - drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen3
    - drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen2
    - ARM: dts: at91: tse850: use the correct compatible for the eeprom
    - regmap: Correct comparison in regmap_cached
    - i40e: Add delay after EMP reset for firmware to recover
    - ARM: dts: imx7d: cl-som-imx7: fix pinctrl_enet
    - ARM: dts: porter: Fix HDMI output routing
    - regulator: of: Add a missing 'of_node_put()' in an error handling path of
      'of_regulator_match()'
    - pinctrl: mcp23s08: spi: Fix regmap debugfs entries
    - kdb: make "mdr" command repeat
    - drm/vmwgfx: Set dmabuf_size when vmw_dmabuf_init is successful
    - perf tools: Add trace/beauty/generated/ into .gitignore
    - tools: sync up .h files with the repective arch and uapi .h files
    - MIPS: xilfpga: Stop generating useless dtb.o
    - MIPS: xilfpga: Actually include FDT in fitImage
    - MIPS: Fix build with DEBUG_ZBOOT and MACH_JZ4770
    - fix breakage caused by d_find_alias() semantics change
    - Btrfs: fix error handling in btrfs_truncate()
    - mmc: block: propagate correct returned value in mmc_rpmb_ioctl
    - arm64: export tishift functions to modules
    - bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
    - PM / core: Fix direct_complete handling for devices with no callbacks
    - ARM: dts: sun4i: Fix incorrect clocks for displays
    - bnxt_en: Ignore src port field in decap filter nodes
    - kasan, slub: fix handling of kasan_slab_free hook
    - riscv/spinlock: Strengthen implementations with fences
    - platform/x86: dell-smbios: Fix memory leaks in build_tokens_sysfs()
    - rxrpc: Fix resend event time calculation
    - i40e: hold the RTNL lock while changing interrupt schemes
    - hv_netvsc: Fix the return status in RX path
    - firmware: fix checking for return values for fw_add_devm_name()
    - bcache: set writeback_rate_update_seconds in range [1, 60] seconds
    - bcache: fix cached_dev->count usage for bch_cache_set_error()
    - bcache: stop dc->writeback_rate_update properly
    - ibmvnic: Fix reset return from closed state
    - powerpc/vas: Fix cleanup when VAS is not configured
    - f2fs: flush cp pack except cp pack 2 page at first
    - drm/amdgpu: Clean sdma wptr register when only enable wptr polling
    - powerpc/mm/slice: Remove intermediate bitmap copy
    - powerpc/mm/slice: create header files dedicated to slices
    - powerpc/mm/slice: Enhance for supporting PPC32
    - powerpc/mm/slice: Fix hugepage allocation at hint address on 8xx
    - ibmvnic: Allocate statistics buffers during probe
    - dt-bindings: display: msm/dsi: Fix the PHY regulator supply props
    - drm/amd/display: Set vsc pack revision when DPCD revision is >= 1.2
    - soc: renesas: r8a77970-sysc: fix power area parents
    - drm/vblank: Data type fixes for 64-bit vblank sequences.
    - selftests: Add FIB onlink tests
    - soc: amlogic: meson-gx-pwrc-vpu: fix error on shutdown when domain is
      powered off

  * arm-smmu-v3 arm-smmu-v3.1.auto: failed to allocate MSIs (LP: #1785282)
    - ACPICA: iasl: Add SMMUv3 device ID mapping index support
    - ACPI/IORT: Remove temporary iort_get_id_mapping_index() ACPICA guard

  * Driver iwlwifi for Intel Wireless-AC 9560 is slow and unreliable in kernel
    4.15.0-20-generic (LP: #1772467)
    - scsi: hpsa: disable device during shutdown

  * [Bionic] i2c: xlp9xx: Add SMBAlert support  (LP: #1786981)
    - i2c: xlp9xx: Add support for SMBAlert

  * qeth: don't clobber buffer on async TX completion (LP: #1786057)
    - s390/qeth: don't clobber buffer on async TX completion

  * Linux 4.15.0-23 crashes during the boot process with a "Unable to handle
    kernel NULL pointer dereference" message (LP: #1777338)
    - x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths

  * ThinkPad systems have no HDMI sound when using the nvidia GPU (LP: #1787058)
    - ACPI / OSI: Add OEM _OSI string to enable NVidia HDMI audio

  * [Bionic] i2c: xlp9xx: Fix case where SSIF read transaction completes early
    (LP: #1787240)
    - i2c: xlp9xx: Fix case where SSIF read transaction completes early

  * [Bionic] integrate upstream fix for Cavium zram driver (LP: #1787469)
    - Revert "UBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from
      CONFIG_VMAP_STACK"
    - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK
    - crypto: cavium - Limit result reading attempts
    - crypto: cavium - Prevent division by zero
    - crypto: cavium - Fix statistics pending request value
    - crypto: cavium - Fix smp_processor_id() warnings

  * Bugfix for handling of shadow doorbell buffer (LP: #1788222)
    - nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event

  * nvme devices namespace assigned to the wrong controller (LP: #1789227)
    - nvme/multipath: Fix multipath disabled naming collisions

  * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
    walinuxagent.service (LP: #1739107)
    - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
      walinuxagent.service

  * hinic interfaces aren't getting predictable names (LP: #1783138)
    - hinic: Link the logical network device to the pci device in sysfs

  * Suspend fails in Ubuntu and Kubuntu 18.04 but works fine in Ubuntu and
    Kubuntu 17.10 (and on Kubuntu 18.04 using kernel 4.14.47) (LP: #1774950)
    - ACPI / LPSS: Avoid PM quirks on suspend and resume from S3
    - ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation

  * [Bionic] Bluetooth: Support RTL8723D and RTL8821C Devices (LP: #1784835)
    - Bluetooth: btrtl: Add RTL8723D and RTL8821C devices

  * CacheFiles: Error: Overlong wait for old active object to go away.
    (LP: #1776254)
    - cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag
    - cachefiles: Wait rather than BUG'ing on "Unexpected object collision"

  * fscache cookie refcount updated incorrectly during fscache object allocation
    (LP: #1776277) // fscache cookie refcount updated incorrectly during fscache
    object allocation (LP: #1776277)
    - fscache: Fix reference overput in fscache_attach_object() error handling

  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
    - Revert "UBUNTU: SAUCE: CacheFiles: fix a read_waiter/read_copier race"
    - fscache: Allow cancelled operations to be enqueued
    - cachefiles: Fix refcounting bug in backing-file read monitoring

  * SMB3: Fix regression in server reconnect detection (LP: #1786110)
    - smb3: on reconnect set PreviousSessionId field

  * CVE-2018-1118
    - vhost: fix info leak due to uninitialized memory

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 27 Aug 2018 16:45:36 +0200

linux (4.15.0-33.36) bionic; urgency=medium

  * linux: 4.15.0-33.36 -proposed tracker (LP: #1787149)

  * RTNL assertion failure on ipvlan (LP: #1776927)
    - ipvlan: drop ipv6 dependency
    - ipvlan: use per device spinlock to protect addrs list updates
    - SAUCE: fix warning from "ipvlan: drop ipv6 dependency"

  * ubuntu_bpf_jit test failed on Bionic s390x systems (LP: #1753941)
    - test_bpf: flag tests that cannot be jited on s390

  * HDMI/DP audio can't work on the laptop of Dell Latitude 5495 (LP: #1782689)
    - drm/nouveau: fix nouveau_dsm_get_client_id()'s return type
    - drm/radeon: fix radeon_atpx_get_client_id()'s return type
    - drm/amdgpu: fix amdgpu_atpx_get_client_id()'s return type
    - platform/x86: apple-gmux: fix gmux_get_client_id()'s return type
    - ALSA: hda: use PCI_BASE_CLASS_DISPLAY to replace PCI_CLASS_DISPLAY_VGA
    - vga_switcheroo: set audio client id according to bound GPU id

  * locking sockets broken due to missing AppArmor socket mediation patches
    (LP: #1780227)
    - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets

  * Update2 for ocxl driver (LP: #1781436)
    - ocxl: Fix page fault handler in case of fault on dying process

  * netns: unable to follow an interface that moves to another netns
    (LP: #1774225)
    - net: core: Expose number of link up/down transitions
    - dev: always advertise the new nsid when the netns iface changes
    - dev: advertise the new ifindex when the netns iface changes

  * [Bionic] Disk IO hangs when using BFQ as io scheduler (LP: #1780066)
    - block, bfq: fix occurrences of request finish method's old name
    - block, bfq: remove batches of confusing ifdefs
    - block, bfq: add requeue-request hook

  * HP ProBook 455 G5 needs mute-led-gpio fixup (LP: #1781763)
    - ALSA: hda: add mute led support for HP ProBook 455 G5

  * [Bionic] bug fixes to improve stability of the ThunderX2 i2c driver
    (LP: #1781476)
    - i2c: xlp9xx: Fix issue seen when updating receive length
    - i2c: xlp9xx: Make sure the transfer size is not more than
      I2C_SMBUS_BLOCK_SIZE

  * x86/kvm: fix LAPIC timer drift when guest uses periodic mode (LP: #1778486)
    - x86/kvm: fix LAPIC timer drift when guest uses periodic mode

  * Please include ax88179_178a and r8152 modules in d-i udeb (LP: #1771823)
    - [Config:] d-i: Add ax88179_178a and r8152 to nic-modules

  * Nvidia fails after switching its mode (LP: #1778658)
    - PCI: Restore config space on runtime resume despite being unbound

  * Kernel error "task zfs:pid blocked for more than 120 seconds" (LP: #1781364)
    - SAUCE: (noup) zfs to 0.7.5-1ubuntu16.3

  * CVE-2018-12232
    - PATCH 1/1] socket: close race condition between sock_close() and
      sockfs_setattr()

  * CVE-2018-10323
    - xfs: set format back to extents if xfs_bmap_extents_to_btree

  * change front mic location for more lenovo m7/8/9xx machines (LP: #1781316)
    - ALSA: hda/realtek - Fix the problem of two front mics on more machines
    - ALSA: hda/realtek - two more lenovo models need fixup of MIC_LOCATION

  * Cephfs + fscache: unable to handle kernel NULL pointer dereference at
    0000000000000000 IP: jbd2__journal_start+0x22/0x1f0 (LP: #1783246)
    - ceph: track read contexts in ceph_file_info

  * Touchpad of ThinkPad P52 failed to work with message "lost sync at byte"
    (LP: #1779802)
    - Input: elantech - fix V4 report decoding for module with middle key
    - Input: elantech - enable middle button of touchpads on ThinkPad P52

  * xhci_hcd 0000:00:14.0: Root hub is not suspended (LP: #1779823)
    - usb: xhci: dbc: Fix lockdep warning
    - usb: xhci: dbc: Don't decrement runtime PM counter if DBC is not started

  * CVE-2018-13406
    - video: uvesafb: Fix integer overflow in allocation

  * CVE-2018-10840
    - ext4: correctly handle a zero-length xattr with a non-zero e_value_offs

  * CVE-2018-11412
    - ext4: do not allow external inodes for inline data

  * CVE-2018-10881
    - ext4: clear i_data in ext4_inode_info when removing inline data

  * CVE-2018-12233
    - jfs: Fix inconsistency between memory allocation and ea_buf->max_size

  * CVE-2018-12904
    - kvm: nVMX: Enforce cpl=0 for VMX instructions

  * Error parsing PCC subspaces from PCCT (LP: #1528684)
    - mailbox: PCC: erroneous error message when parsing ACPI PCCT

  * CVE-2018-13094
    - xfs: don't call xfs_da_shrink_inode with NULL bp

  * other users' coredumps can be read via setgid directory and killpriv bypass
    (LP: #1779923) // CVE-2018-13405
    - Fix up non-directory creation in SGID directories

  * Invoking obsolete 'firmware_install' target breaks snap build (LP: #1782166)
    - snapcraft.yaml: stop invoking the obsolete (and non-existing)
      'firmware_install' target

  * snapcraft.yaml: missing ubuntu-retpoline-extract-one script breaks the build
    (LP: #1782116)
    - snapcraft.yaml: copy retpoline-extract-one to scripts before build

  * Allow Raven Ridge's audio controller to be runtime suspended (LP: #1782540)
    - ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge

  * CVE-2018-11506
    - sr: pass down correctly sized SCSI sense buffer

  * Bionic update: upstream stable patchset 2018-07-24 (LP: #1783418)
    - net: Fix a bug in removing queues from XPS map
    - net/mlx4_core: Fix error handling in mlx4_init_port_info.
    - net/sched: fix refcnt leak in the error path of tcf_vlan_init()
    - net: sched: red: avoid hashing NULL child
    - net/smc: check for missing nlattrs in SMC_PNETID messages
    - net: test tailroom before appending to linear skb
    - packet: in packet_snd start writing at link layer allocation
    - sock_diag: fix use-after-free read in __sk_free
    - tcp: purge write queue in tcp_connect_init()
    - vmxnet3: set the DMA mask before the first DMA map operation
    - vmxnet3: use DMA memory barriers where required
    - hv_netvsc: empty current transmit aggregation if flow blocked
    - hv_netvsc: Use the num_online_cpus() for channel limit
    - hv_netvsc: avoid retry on send during shutdown
    - hv_netvsc: only wake transmit queue if link is up
    - hv_netvsc: fix error unwind handling if vmbus_open fails
    - hv_netvsc: cancel subchannel setup before halting device
    - hv_netvsc: fix race in napi poll when rescheduling
    - hv_netvsc: defer queue selection to VF
    - hv_netvsc: disable NAPI before channel close
    - hv_netvsc: use RCU to fix concurrent rx and queue changes
    - hv_netvsc: change GPAD teardown order on older versions
    - hv_netvsc: common detach logic
    - hv_netvsc: Use Windows version instead of NVSP version on GPAD teardown
    - hv_netvsc: Split netvsc_revoke_buf() and netvsc_teardown_gpadl()
    - hv_netvsc: Ensure correct teardown message sequence order
    - hv_netvsc: Fix a network regression after ifdown/ifup
    - sparc: vio: use put_device() instead of kfree()
    - ext2: fix a block leak
    - s390: add assembler macros for CPU alternatives
    - s390: move expoline assembler macros to a header
    - s390/crc32-vx: use expoline for indirect branches
    - s390/lib: use expoline for indirect branches
    - s390/ftrace: use expoline for indirect branches
    - s390/kernel: use expoline for indirect branches
    - s390: move spectre sysfs attribute code
    - s390: extend expoline to BC instructions
    - s390: use expoline thunks in the BPF JIT
    - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
    - scsi: zfcp: fix infinite iteration on ERP ready list
    - loop: don't call into filesystem while holding lo_ctl_mutex
    - loop: fix LOOP_GET_STATUS lock imbalance
    - cfg80211: limit wiphy names to 128 bytes
    - hfsplus: stop workqueue when fill_super() failed
    - x86/kexec: Avoid double free_page() upon do_kexec_load() failure
    - usb: gadget: f_uac2: fix bFirstInterface in composite gadget
    - usb: dwc3: Undo PHY init if soft reset fails
    - usb: dwc3: omap: don't miss events during suspend/resume
    - usb: gadget: core: Fix use-after-free of usb_request
    - usb: gadget: fsl_udc_core: fix ep valid checks
    - usb: dwc2: Fix dwc2_hsotg_core_init_disconnected()
    - usb: cdc_acm: prevent race at write to acm while system resumes
    - net: usbnet: fix potential deadlock on 32bit hosts
    - ARM: dts: imx7d-sdb: Fix regulator-usb-otg2-vbus node name
    - usb: host: xhci-plat: revert "usb: host: xhci-plat: enable clk in resume
      timing"
    - USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM
    - net/usb/qmi_wwan.c: Add USB id for lt4120 modem
    - net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
    - Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB
    - ALSA: usb-audio: Add native DSD support for Luxman DA-06
    - usb: dwc3: Add SoftReset PHY synchonization delay
    - usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields
    - usb: dwc3: Makefile: fix link error on randconfig
    - xhci: zero usb device slot_id member when disabling and freeing a xhci slot
    - usb: dwc2: Fix interval type issue
    - usb: dwc2: hcd: Fix host channel halt flow
    - usb: dwc2: host: Fix transaction errors in host mode
    - usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS
    - usb: gadget: ffs: Execute copy_to_user() with USER_DS set
    - usbip: Correct maximum value of CONFIG_USBIP_VHCI_HC_PORTS
    - usb: gadget: udc: change comparison to bitshift when dealing with a mask
    - usb: gadget: composite: fix incorrect handling of OS desc requests
    - media: lgdt3306a: Fix module count mismatch on usb unplug
    - media: em28xx: USB bulk packet size fix
    - Bluetooth: btusb: Add device ID for RTL8822BE
    - xhci: Show what USB release number the xHC supports from protocol capablity
    - staging: bcm2835-audio: Release resources on module_exit()
    - staging: lustre: fix bug in osc_enter_cache_try
    - staging: fsl-dpaa2/eth: Fix incorrect casts
    - staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr
    - staging: ks7010: Use constants from ieee80211_eid instead of literal ints.
    - staging: lustre: lmv: correctly iput lmo_root
    - crypto: inside-secure - wait for the request to complete if in the backlog
    - crypto: atmel-aes - fix the keys zeroing on errors
    - crypto: ccp - don't disable interrupts while setting up debugfs
    - crypto: inside-secure - do not process request if no command was issued
    - crypto: inside-secure - fix the cache_len computation
    - crypto: inside-secure - fix the extra cache computation
    - crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss
    - crypto: inside-secure - fix the invalidation step during cra_exit
    - scsi: mpt3sas: fix an out of bound write
    - scsi: ufs: Enable quirk to ignore sending WRITE_SAME command
    - scsi: bnx2fc: Fix check in SCSI completion handler for timed out request
    - scsi: sym53c8xx_2: iterator underflow in sym_getsync()
    - scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
    - scsi: qla2xxx: Avoid triggering undefined behavior in
      qla2x00_mbx_completion()
    - scsi: storvsc: Increase cmd_per_lun for higher speed devices
    - scsi: qedi: Fix truncation of CHAP name and secret
    - scsi: aacraid: fix shutdown crash when init fails
    - scsi: qla4xxx: skip error recovery in case of register disconnect.
    - scsi: qedi: Fix kernel crash during port toggle
    - scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM
    - scsi: sd: Keep disk read-only when re-reading partition
    - scsi: iscsi_tcp: set BDI_CAP_STABLE_WRITES when data digest enabled
    - scsi: aacraid: Insure command thread is not recursively stopped
    - scsi: core: Make SCSI Status CONDITION MET equivalent to GOOD
    - scsi: mvsas: fix wrong endianness of sgpio api
    - ASoC: hdmi-codec: Fix module unloading caused kernel crash
    - ASoC: rockchip: rk3288-hdmi-analog: Select needed codecs
    - ASoC: samsung: odroid: Fix 32000 sample rate handling
    - ASoC: topology: create TLV data for dapm widgets
    - ASoC: samsung: i2s: Ensure the RCLK rate is properly determined
    - clk: rockchip: Fix wrong parent for SDMMC phase clock for rk3228
    - clk: Don't show the incorrect clock phase
    - clk: hisilicon: mark wdt_mux_p[] as const
    - clk: tegra: Fix pll_u rate configuration
    - clk: rockchip: Prevent calculating mmc phase if clock rate is zero
    - clk: samsung: s3c2410: Fix PLL rates
    - clk: samsung: exynos7: Fix PLL rates
    - clk: samsung: exynos5260: Fix PLL rates
    - clk: samsung: exynos5433: Fix PLL rates
    - clk: samsung: exynos5250: Fix PLL rates
    - clk: samsung: exynos3250: Fix PLL rates
    - media: dmxdev: fix error code for invalid ioctls
    - media: Don't let tvp5150_get_vbi() go out of vbi_ram_default array
    - media: ov5645: add missing of_node_put() in error path
    - media: cx23885: Override 888 ImpactVCBe crystal frequency
    - media: cx23885: Set subdev host data to clk_freq pointer
    - media: s3c-camif: fix out-of-bounds array access
    - media: lgdt3306a: Fix a double kfree on i2c device remove
    - media: em28xx: Add Hauppauge SoloHD/DualHD bulk models
    - media: v4l: vsp1: Fix display stalls when requesting too many inputs
    - media: i2c: adv748x: fix HDMI field heights
    - media: vb2: Fix videobuf2 to map correct area
    - media: vivid: fix incorrect capabilities for radio
    - media: cx25821: prevent out-of-bounds read on array card
    - serial: xuartps: Fix out-of-bounds access through DT alias
    - serial: sh-sci: Fix out-of-bounds access through DT alias
    - serial: samsung: Fix out-of-bounds access through serial port index
    - serial: mxs-auart: Fix out-of-bounds access through serial port index
    - serial: imx: Fix out-of-bounds access through serial port index
    - serial: fsl_lpuart: Fix out-of-bounds access through DT alias
    - serial: arc_uart: Fix out-of-bounds access through DT alias
    - serial: 8250: Don't service RX FIFO if interrupts are disabled
    - serial: altera: ensure port->regshift is honored consistently
    - rtc: snvs: Fix usage of snvs_rtc_enable
    - rtc: hctosys: Ensure system time doesn't overflow time_t
    - rtc: rk808: fix possible race condition
    - rtc: m41t80: fix race conditions
    - rtc: tx4939: avoid unintended sign extension on a 24 bit shift
    - rtc: rp5c01: fix possible race condition
    - rtc: goldfish: Add missing MODULE_LICENSE
    - cxgb4: Correct ntuple mask validation for hash filters
    - net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule
    - net: dsa: Do not register devlink for unused ports
    - net: dsa: bcm_sf2: Fix IPv6 rules and chain ID
    - net: dsa: bcm_sf2: Fix IPv6 rule half deletion
    - 3c59x: convert to generic DMA API
    - net: ip6_gre: Request headroom in __gre6_xmit()
    - net: ip6_gre: Split up ip6gre_tnl_link_config()
    - net: ip6_gre: Split up ip6gre_tnl_change()
    - net: ip6_gre: Split up ip6gre_newlink()
    - net: ip6_gre: Split up ip6gre_changelink()
    - qed: LL2 flush isles when connection is closed
    - qed: Fix possibility of list corruption during rmmod flows
    - qed: Fix LL2 race during connection terminate
    - powerpc: Move default security feature flags
    - Bluetooth: btusb: Add support for Intel Bluetooth device 22560 [8087:0026]
    - staging: fsl-dpaa2/eth: Fix incorrect kfree
    - crypto: inside-secure - move the digest to the request context
    - scsi: lpfc: Fix NVME Initiator FirstBurst
    - serial: mvebu-uart: fix tx lost characters

  * Bionic update: upstream stable patchset 2018-07-20 (LP: #1782846)
    - usbip: usbip_host: refine probe and disconnect debug msgs to be useful
    - usbip: usbip_host: delete device from busid_table after rebind
    - usbip: usbip_host: run rebind from exit when module is removed
    - usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
    - usbip: usbip_host: fix bad unlock balance during stub_probe()
    - ALSA: usb: mixer: volume quirk for CM102-A+/102S+
    - ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist
    - ALSA: control: fix a redundant-copy issue
    - spi: pxa2xx: Allow 64-bit DMA
    - spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master
    - spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL
    - KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls
    - KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock
    - vfio: ccw: fix cleanup if cp_prefetch fails
    - tracing/x86/xen: Remove zero data size trace events
      trace_xen_mmu_flush_tlb{_all}
    - tee: shm: fix use-after-free via temporarily dropped reference
    - netfilter: nf_tables: free set name in error path
    - netfilter: nf_tables: can't fail after linking rule into active rule list
    - netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}
    - i2c: designware: fix poll-after-enable regression
    - powerpc/powernv: Fix NVRAM sleep in invalid context when crashing
    - drm: Match sysfs name in link removal to link creation
    - lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly
    - radix tree: fix multi-order iteration race
    - mm: don't allow deferred pages with NEED_PER_CPU_KM
    - drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk
    - s390/qdio: fix access to uninitialized qdio_q fields
    - s390/qdio: don't release memory in qdio_setup_irq()
    - s390: remove indirect branch from do_softirq_own_stack
    - x86/pkeys: Override pkey when moving away from PROT_EXEC
    - x86/pkeys: Do not special case protection key 0
    - efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32'
      definition for mixed mode
    - ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
    - x86/mm: Drop TS_COMPAT on 64-bit exec() syscall
    - tick/broadcast: Use for_each_cpu() specially on UP kernels
    - ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
    - ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
    - ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions
    - Btrfs: fix xattr loss after power failure
    - Btrfs: send, fix invalid access to commit roots due to concurrent
      snapshotting
    - btrfs: property: Set incompat flag if lzo/zstd compression is set
    - btrfs: fix crash when trying to resume balance without the resume flag
    - btrfs: Split btrfs_del_delalloc_inode into 2 functions
    - btrfs: Fix delalloc inodes invalidation during transaction abort
    - btrfs: fix reading stale metadata blocks after degraded raid1 mounts
    - xhci: Fix USB3 NULL pointer dereference at logical disconnect.
    - KVM: arm/arm64: Properly protect VGIC locks from IRQs
    - KVM: arm/arm64: VGIC/ITS: Promote irq_lock() in update_affinity
    - hwmon: (k10temp) Fix reading critical temperature register
    - hwmon: (k10temp) Use API function to access System Management Network
    - vsprintf: Replace memory barrier with static_key for random_ptr_key update
    - x86/amd_nb: Add support for Raven Ridge CPUs
    - x86/apic/x2apic: Initialize cluster ID properly

  * Bionic update: upstream stable patchset 2018-07-09 (LP: #1780858)
    - 8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
    - bridge: check iface upper dev when setting master via ioctl
    - dccp: fix tasklet usage
    - ipv4: fix fnhe usage by non-cached routes
    - ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
    - llc: better deal with too small mtu
    - net: ethernet: sun: niu set correct packet size in skb
    - net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode
    - net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'
    - net/mlx4_en: Verify coalescing parameters are in range
    - net/mlx5e: Err if asked to offload TC match on frag being first
    - net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
    - net sched actions: fix refcnt leak in skbmod
    - net_sched: fq: take care of throttled flows before reuse
    - net: support compat 64-bit time in {s,g}etsockopt
    - net/tls: Don't recursively call push_record during tls_write_space callbacks
    - net/tls: Fix connection stall on partial tls record
    - openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
    - qmi_wwan: do not steal interfaces from class drivers
    - r8169: fix powering up RTL8168h
    - rds: do not leak kernel memory to user land
    - sctp: delay the authentication for the duplicated cookie-echo chunk
    - sctp: fix the issue that the cookie-ack with auth can't get processed
    - sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
    - sctp: remove sctp_chunk_put from fail_mark err path in
      sctp_ulpevent_make_rcvmsg
    - sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
    - tcp_bbr: fix to zero idle_restart only upon S/ACKed data
    - tcp: ignore Fast Open on repair mode
    - tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
    - bonding: do not allow rlb updates to invalid mac
    - bonding: send learning packets for vlans on slave
    - net: sched: fix error path in tcf_proto_create() when modules are not
      configured
    - net/mlx5e: TX, Use correct counter in dma_map error flow
    - net/mlx5: Avoid cleaning flow steering table twice during error flow
    - hv_netvsc: set master device
    - ipv6: fix uninit-value in ip6_multipath_l3_keys()
    - net/mlx5e: Allow offloading ipv4 header re-write for icmp
    - nsh: fix infinite loop
    - udp: fix SO_BINDTODEVICE
    - l2tp: revert "l2tp: fix missing print session offset info"
    - proc: do not access cmdline nor environ from file-backed areas
    - net/smc: restrict non-blocking connect finish
    - mlxsw: spectrum_switchdev: Do not remove mrouter port from MDB's ports list
    - net/mlx5e: DCBNL fix min inline header size for dscp
    - net: systemport: Correclty disambiguate driver instances
    - sctp: clear the new asoc's stream outcnt in sctp_stream_update
    - tcp: restore autocorking
    - tipc: fix one byte leak in tipc_sk_set_orig_addr()
    - hv_netvsc: Fix net device attach on older Windows hosts

  * Bionic update: upstream stable patchset 2018-07-06 (LP: #1780499)
    - ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS
    - ipvs: fix rtnl_lock lockups caused by start_sync_thread
    - netfilter: ebtables: don't attempt to allocate 0-sized compat array
    - kcm: Call strp_stop before strp_done in kcm_attach
    - crypto: af_alg - fix possible uninit-value in alg_bind()
    - netlink: fix uninit-value in netlink_sendmsg
    - net: fix rtnh_ok()
    - net: initialize skb->peeked when cloning
    - net: fix uninit-value in __hw_addr_add_ex()
    - dccp: initialize ireq->ir_mark
    - ipv4: fix uninit-value in ip_route_output_key_hash_rcu()
    - soreuseport: initialise timewait reuseport field
    - inetpeer: fix uninit-value in inet_getpeer
    - memcg: fix per_node_info cleanup
    - perf: Remove superfluous allocation error check
    - tcp: fix TCP_REPAIR_QUEUE bound checking
    - bdi: wake up concurrent wb_shutdown() callers.
    - bdi: Fix oops in wb_workfn()
    - gpioib: do not free unrequested descriptors
    - gpio: fix aspeed_gpio unmask irq
    - gpio: fix error path in lineevent_create
    - rfkill: gpio: fix memory leak in probe error path
    - libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs
    - dm integrity: use kvfree for kvmalloc'd memory
    - tracing: Fix regex_match_front() to not over compare the test string
    - z3fold: fix reclaim lock-ups
    - mm: sections are not offlined during memory hotremove
    - mm, oom: fix concurrent munlock and oom reaper unmap, v3
    - ceph: fix rsize/wsize capping in ceph_direct_read_write()
    - can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg()
    - can: hi311x: Acquire SPI lock on ->do_get_berr_counter
    - can: hi311x: Work around TX complete interrupt erratum
    - drm/vc4: Fix scaling of uni-planar formats
    - drm/i915: Fix drm:intel_enable_lvds ERROR message in kernel log
    - drm/atomic: Clean old_state/new_state in drm_atomic_state_default_clear()
    - drm/atomic: Clean private obj old_state/new_state in
      drm_atomic_state_default_clear()
    - net: atm: Fix potential Spectre v1
    - atm: zatm: Fix potential Spectre v1
    - cpufreq: schedutil: Avoid using invalid next_freq
    - Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174"
    - Bluetooth: btusb: Only check needs_reset_resume DMI table for QCA rome
      chipsets
    - thermal: exynos: Reading temperature makes sense only when TMU is turned on
    - thermal: exynos: Propagate error value from tmu_read()
    - nvme: add quirk to force medium priority for SQ creation
    - smb3: directory sync should not return an error
    - sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
    - tracing/uprobe_event: Fix strncpy corner case
    - perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
    - perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
    - perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
    - perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
    - perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
    - i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()
    - bdi: Fix use after free bug in debugfs_remove()
    - drm/ttm: Use GFP_TRANSHUGE_LIGHT for allocating huge pages
    - drm/i915: Adjust eDP's logical vco in a reliable place.
    - drm/nouveau/ttm: don't dereference nvbo::cli, it can outlive client
    - sched/core: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]

  * Bionic update: upstream stable patchset 2018-06-26 (LP: #1778759)
    - percpu: include linux/sched.h for cond_resched()
    - ACPI / button: make module loadable when booted in non-ACPI mode
    - USB: serial: option: Add support for Quectel EP06
    - ALSA: hda - Fix incorrect usage of IS_REACHABLE()
    - ALSA: pcm: Check PCM state at xfern compat ioctl
    - ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
    - ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation
      for array index
    - ALSA: aloop: Mark paused device as inactive
    - ALSA: aloop: Add missing cable lock to ctl API callbacks
    - tracepoint: Do not warn on ENOMEM
    - scsi: target: Fix fortify_panic kernel exception
    - Input: leds - fix out of bound access
    - Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
    - rtlwifi: btcoex: Add power_on_setting routine
    - rtlwifi: cleanup 8723be ant_sel definition
    - xfs: prevent creating negative-sized file via INSERT_RANGE
    - RDMA/cxgb4: release hw resources on device removal
    - RDMA/ucma: Allow resolving address w/o specifying source address
    - RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow
    - RDMA/mlx5: Protect from shift operand overflow
    - NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
    - IB/mlx5: Use unlimited rate when static rate is not supported
    - IB/hfi1: Fix handling of FECN marked multicast packet
    - IB/hfi1: Fix loss of BECN with AHG
    - IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
    - iw_cxgb4: Atomically flush per QP HW CQEs
    - drm/vmwgfx: Fix a buffer object leak
    - drm/bridge: vga-dac: Fix edid memory leak
    - test_firmware: fix setting old custom fw path back on exit, second try
    - errseq: Always report a writeback error once
    - USB: serial: visor: handle potential invalid device configuration
    - usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
    - USB: Accept bulk endpoints with 1024-byte maxpacket
    - USB: serial: option: reimplement interface masking
    - USB: serial: option: adding support for ublox R410M
    - usb: musb: host: fix potential NULL pointer dereference
    - usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
    - platform/x86: asus-wireless: Fix NULL pointer dereference
    - irqchip/qcom: Fix check for spurious interrupts
    - tracing: Fix bad use of igrab in trace_uprobe.c
    - [Config] CONFIG_ARM64_ERRATUM_1024718=y
    - arm64: Add work around for Arm Cortex-A55 Erratum 1024718
    - Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
    - infiniband: mlx5: fix build errors when INFINIBAND_USER_ACCESS=m
    - btrfs: Take trans lock before access running trans in check_delayed_ref
    - drm/vc4: Make sure vc4_bo_{inc,dec}_usecnt() calls are balanced
    - xhci: Fix use-after-free in xhci_free_virt_device
    - platform/x86: Kconfig: Fix dell-laptop dependency chain.
    - KVM: x86: remove APIC Timer periodic/oneshot spikes
    - clocksource: Allow clocksource_mark_unstable() on unregistered clocksources
    - clocksource: Initialize cs->wd_list
    - clocksource: Consistent de-rate when marking unstable

  * Bionic update: upstream stable patchset 2018-06-22 (LP: #1778265)
    - ext4: set h_journal if there is a failure starting a reserved handle
    - ext4: add MODULE_SOFTDEP to ensure crc32c is included in the initramfs
    - ext4: add validity checks for bitmap block numbers
    - ext4: fix bitmap position validation
    - random: fix possible sleeping allocation from irq context
    - random: rate limit unseeded randomness warnings
    - usbip: usbip_event: fix to not print kernel pointer address
    - usbip: usbip_host: fix to hold parent lock for device_attach() calls
    - usbip: vhci_hcd: Fix usb device and sockfd leaks
    - usbip: vhci_hcd: check rhport before using in vhci_hub_control()
    - Revert "xhci: plat: Register shutdown for xhci_plat"
    - USB: serial: simple: add libtransistor console
    - USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster
    - USB: serial: cp210x: add ID for NI USB serial console
    - usb: core: Add quirk for HP v222w 16GB Mini
    - USB: Increment wakeup count on remote wakeup.
    - ALSA: usb-audio: Skip broken EU on Dell dock USB-audio
    - virtio: add ability to iterate over vqs
    - virtio_console: don't tie bufs to a vq
    - virtio_console: free buffers after reset
    - virtio_console: drop custom control queue cleanup
    - virtio_console: move removal code
    - virtio_console: reset on out of memory
    - drm/virtio: fix vq wait_event condition
    - tty: Don't call panic() at tty_ldisc_init()
    - tty: n_gsm: Fix long delays with control frame timeouts in ADM mode
    - tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set
    - tty: Avoid possible error pointer dereference at tty_ldisc_restore().
    - tty: Use __GFP_NOFAIL for tty_ldisc_get()
    - ALSA: dice: fix OUI for TC group
    - ALSA: dice: fix error path to destroy initialized stream data
    - ALSA: hda - Skip jack and others for non-existing PCM streams
    - ALSA: opl3: Hardening for potential Spectre v1
    - ALSA: asihpi: Hardening for potential Spectre v1
    - ALSA: hdspm: Hardening for potential Spectre v1
    - ALSA: rme9652: Hardening for potential Spectre v1
    - ALSA: control: Hardening for potential Spectre v1
    - ALSA: pcm: Return negative delays from SNDRV_PCM_IOCTL_DELAY.
    - ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr
    - ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device
    - ALSA: seq: oss: Hardening for potential Spectre v1
    - ALSA: hda: Hardening for potential Spectre v1
    - ALSA: hda/realtek - Add some fixes for ALC233
    - ALSA: hda/realtek - Update ALC255 depop optimize
    - ALSA: hda/realtek - change the location for one of two front mics
    - mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic
    - mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
    - mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
    - mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
    - mtd: rawnand: tango: Fix struct clk memory leak
    - kobject: don't use WARN for registration failures
    - scsi: sd: Defer spinning up drive while SANITIZE is in progress
    - bfq-iosched: ensure to clear bic/bfqq pointers when preparing request
    - vfio: ccw: process ssch with interrupts disabled
    - ANDROID: binder: prevent transactions into own process.
    - PCI: aardvark: Fix logic in advk_pcie_{rd,wr}_conf()
    - PCI: aardvark: Set PIO_ADDR_LS correctly in advk_pcie_rd_conf()
    - PCI: aardvark: Use ISR1 instead of ISR0 interrupt in legacy irq mode
    - PCI: aardvark: Fix PCIe Max Read Request Size setting
    - ARM: amba: Make driver_override output consistent with other buses
    - ARM: amba: Fix race condition with driver_override
    - ARM: amba: Don't read past the end of sysfs "driver_override" buffer
    - ARM: socfpga_defconfig: Remove QSPI Sector 4K size force
    - KVM: arm/arm64: Close VMID generation race
    - crypto: drbg - set freed buffers to NULL
    - ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
    - libceph: un-backoff on tick when we have a authenticated session
    - libceph: reschedule a tick in finish_hunting()
    - libceph: validate con->state at the top of try_write()
    - fpga-manager: altera-ps-spi: preserve nCONFIG state
    - earlycon: Use a pointer table to fix __earlycon_table stride
    - drm/amdgpu: set COMPUTE_PGM_RSRC1 for SGPR/VGPR clearing shaders
    - drm/i915: Enable display WA#1183 from its correct spot
    - objtool, perf: Fix GCC 8 -Wrestrict error
    - tools/lib/subcmd/pager.c: do not alias select() params
    - x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds
    - x86/smpboot: Don't use mwait_play_dead() on AMD systems
    - x86/microcode/intel: Save microcode patch unconditionally
    - x86/microcode: Do not exit early from __reload_late()
    - tick/sched: Do not mess with an enqueued hrtimer
    - arm/arm64: KVM: Add PSCI version selection API
    - powerpc/eeh: Fix race with driver un/bind
    - serial: mvebu-uart: Fix local flags handling on termios update
    - block: do not use interruptible wait anywhere
    - ASoC: dmic: Fix clock parenting
    - PCI / PM: Do not clear state_saved in pci_pm_freeze() when smart suspend is
      set
    - module: Fix display of wrong module .text address
    - drm/edid: Reset more of the display info
    - drm/i915/fbdev: Enable late fbdev initial configuration
    - drm/i915/audio: set minimum CD clock to twice the BCLK
    - drm/amd/display: Fix deadlock when flushing irq
    - drm/amd/display: Disallow enabling CRTC without primary plane with FB

  * Bionic update: upstream stable patchset 2018-06-22 (LP: #1778265) //
    CVE-2018-1108.
    - random: set up the NUMA crng instances after the CRNG is fully initialized

  * Ryzen/Raven Ridge USB ports do not work (LP: #1756700)
    - xhci: Fix USB ports for Dell Inspiron 5775

  * [Ubuntu 1804][boston][ixgbe] EEH causes kernel BUG at /build/linux-
    jWa1Fv/linux-4.15.0/drivers/pci/msi.c:352 (i2S) (LP: #1776389)
    - ixgbe/ixgbevf: Free IRQ when PCI error recovery removes the device

  * Need fix to aacraid driver to prevent panic (LP: #1770095)
    - scsi: aacraid: Correct hba_send to include iu_type

  * kernel: Fix arch random implementation (LP: #1775391)
    - s390/archrandom: Rework arch random implementation.

  * kernel: Fix memory leak on CCA and EP11 CPRB processing. (LP: #1775390)
    - s390/zcrypt: Fix CCA and EP11 CPRB processing failure memory leak.

  * Various fixes for CXL kernel module (LP: #1774471)
    - cxl: Remove function write_timebase_ctrl_psl9() for PSL9
    - cxl: Set the PBCQ Tunnel BAR register when enabling capi mode
    - cxl: Report the tunneled operations status
    - cxl: Configure PSL to not use APC virtual machines
    - cxl: Disable prefault_mode in Radix mode

  * Bluetooth not working (LP: #1764645)
    - Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models

  * linux-snapdragon: wcn36xx: mac address generation on boot (LP: #1776491)
    - [Config] arm64: snapdragon: WCN36XX_SNAPDRAGON_HACKS=y
    - SAUCE: wcn36xx: read MAC from file or randomly generate one

  * fscache: Fix hanging wait on page discarded by writeback (LP: #1777029)
    - fscache: Fix hanging wait on page discarded by writeback

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 15 Aug 2018 14:50:38 +0200

linux (4.15.0-32.35) bionic; urgency=medium

  [ Stefan Bader ]
  * CVE-2018-3620 // CVE-2018-3646
    - x86/Centaur: Initialize supported CPU features properly
    - x86/Centaur: Report correct CPU/cache topology
    - x86/CPU/AMD: Have smp_num_siblings and cpu_llc_id always be present
    - perf/events/amd/uncore: Fix amd_uncore_llc ID to use pre-defined cpu_llc_id
    - x86/CPU: Rename intel_cacheinfo.c to cacheinfo.c
    - x86/CPU/AMD: Calculate last level cache ID from number of sharing threads
    - x86/CPU: Modify detect_extended_topology() to return result
    - x86/CPU/AMD: Derive CPU topology from CPUID function 0xB when available
    - x86/CPU: Move cpu local function declarations to local header
    - x86/CPU: Make intel_num_cpu_cores() generic
    - x86/CPU: Move cpu_detect_cache_sizes() into init_intel_cacheinfo()
    - x86/CPU: Move x86_cpuinfo::x86_max_cores assignment to
      detect_num_cpu_cores()
    - x86/CPU/AMD: Fix LLC ID bit-shift calculation
    - x86/mm: Factor out pageattr _PAGE_GLOBAL setting
    - x86/mm: Undo double _PAGE_PSE clearing
    - x86/mm: Introduce "default" kernel PTE mask
    - x86/espfix: Document use of _PAGE_GLOBAL
    - x86/mm: Do not auto-massage page protections
    - x86/mm: Remove extra filtering in pageattr code
    - x86/mm: Comment _PAGE_GLOBAL mystery
    - x86/mm: Do not forbid _PAGE_RW before init for __ro_after_init
    - x86/ldt: Fix support_pte_mask filtering in map_ldt_struct()
    - x86/power/64: Fix page-table setup for temporary text mapping
    - x86/pti: Filter at vma->vm_page_prot population
    - x86/boot/64/clang: Use fixup_pointer() to access '__supported_pte_mask'
    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
    - x86/speculation/l1tf: Change order of offset/type in swap entry
    - x86/speculation/l1tf: Protect swap entries against L1TF
    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
    - x86/speculation/l1tf: Make sure the first page is always reserved
    - x86/speculation/l1tf: Add sysfs reporting for l1tf
    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2
    - x86/bugs: Move the l1tf function and define pr_fmt properly
    - sched/smt: Update sched_smt_present at runtime
    - x86/smp: Provide topology_is_primary_thread()
    - x86/topology: Provide topology_smt_supported()
    - cpu/hotplug: Make bringup/teardown of smp threads symmetric
    - cpu/hotplug: Split do_cpu_down()
    - cpu/hotplug: Provide knobs to control SMT
    - x86/cpu: Remove the pointless CPU printout
    - x86/cpu/AMD: Remove the pointless detect_ht() call
    - x86/cpu/common: Provide detect_ht_early()
    - x86/cpu/topology: Provide detect_extended_topology_early()
    - x86/cpu/intel: Evaluate smp_num_siblings early
    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
    - x86/cpu/AMD: Evaluate smp_num_siblings early
    - x86/apic: Ignore secondary threads if nosmt=force
    - x86/speculation/l1tf: Extend 64bit swap file size limit
    - x86/cpufeatures: Add detection of L1D cache flush support.
    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
    - x86/speculation/l1tf: Protect PAE swap entries against L1TF
    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
    - Revert "x86/apic: Ignore secondary threads if nosmt=force"
    - cpu/hotplug: Boot HT siblings at least once
    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
    - x86/KVM/VMX: Add module argument for L1TF mitigation
    - x86/KVM/VMX: Add L1D flush algorithm
    - x86/KVM/VMX: Add L1D MSR based flush
    - x86/KVM/VMX: Add L1D flush logic
    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
    - x86/KVM/VMX: Add find_msr() helper function
    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
    - cpu/hotplug: Online siblings when SMT control is turned on
    - x86/litf: Introduce vmx status variable
    - x86/kvm: Drop L1TF MSR list approach
    - x86/l1tf: Handle EPT disabled state proper
    - x86/kvm: Move l1tf setup function
    - x86/kvm: Add static key for flush always
    - x86/kvm: Serialize L1D flush parameter setter
    - x86/kvm: Allow runtime control of L1D flush
    - cpu/hotplug: Expose SMT control init function
    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
    - Documentation: Add section about CPU vulnerabilities
    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures
    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
    - Documentation/l1tf: Fix typos
    - cpu/hotplug: detect SMT disabled by BIOS
    - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
    - x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
    - x86: Don't include linux/irq.h from asm/hardirq.h
    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
    - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
    - Documentation/l1tf: Remove Yonah processors from not vulnerable list
    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
    - KVM: x86: Add a framework for supporting MSR-based features
    - KVM: X86: Introduce kvm_get_msr_feature()
    - KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR
    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
    - cpu/hotplug: Fix SMT supported evaluation
    - x86/speculation/l1tf: Invert all not present mappings
    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
    - x86/mm/pat: Make set_memory_np() L1TF safe
    - cpu: Fix per-cpu regression on ARM64

  * CVE-2018-5391
    - Revert "net: increase fragment memory usage limits"

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 10 Aug 2018 14:22:53 -0300

linux (4.15.0-30.32) bionic; urgency=medium

  * CVE-2018-5390
    - tcp: free batches of packets in tcp_prune_ofo_queue()
    - tcp: avoid collapses in tcp_prune_queue() if possible
    - tcp: detect malicious patterns in tcp_collapse_ofo_queue()
    - tcp: call tcp_drop() from tcp_data_queue_ofo()
    - tcp: add tcp_ooo_try_coalesce() helper

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 26 Jul 2018 17:20:29 +0200

linux (4.15.0-29.31) bionic; urgency=medium

  * linux: 4.15.0-29.31 -proposed tracker (LP: #1782173)

  * [SRU Bionic][Cosmic] kernel panic in ipmi_ssif at msg_done_handler
    (LP: #1777716)
    - ipmi_ssif: Fix kernel panic at msg_done_handler

  * Update to ocxl driver for 18.04.1 (LP: #1775786)
    - misc: ocxl: use put_device() instead of device_unregister()
    - powerpc: Add TIDR CPU feature for POWER9
    - powerpc: Use TIDR CPU feature to control TIDR allocation
    - powerpc: use task_pid_nr() for TID allocation
    - ocxl: Rename pnv_ocxl_spa_remove_pe to clarify it's action
    - ocxl: Expose the thread_id needed for wait on POWER9
    - ocxl: Add an IOCTL so userspace knows what OCXL features are available
    - ocxl: Document new OCXL IOCTLs
    - ocxl: Fix missing unlock on error in afu_ioctl_enable_p9_wait()

  * Critical upstream bugfix missing in Ubuntu 18.04 - frequent Xorg crash after
    suspend (LP: #1776887)
    - ocxl: Document the OCXL_IOCTL_GET_METADATA IOCTL

  * Hard LOCKUP observed on stressing Ubuntu 18 04 (LP: #1777194)
    - powerpc: use NMI IPI for smp_send_stop
    - powerpc: Fix smp_send_stop NMI IPI handling

  * IPL: ppc64_cpu --frequency hang with INFO: rcu_sched detected stalls on
    CPUs/tasks on w34 and wsbmc016 with 920.1714.20170330n (LP: #1773964)
    - rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops

  * [Regression] EXT4-fs error (device sda2): ext4_validate_block_bitmap:383:
    comm stress-ng: bg 4705: bad block bitmap checksum (LP: #1781709)
    - SAUCE: Revert "UBUNTU: SAUCE: ext4: fix ext4_validate_inode_bitmap: comm
      stress-ng: Corrupt inode bitmap"
    - SAUCE: ext4: check for allocation block validity with block group locked

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 17 Jul 2018 10:57:50 +0200

linux (4.15.0-28.30) bionic; urgency=medium

  * linux: 4.15.0-28.30 -proposed tracker (LP: #1781433)

  * Cannot set MTU higher than 1500 in Xen instance (LP: #1781413)
    - xen-netfront: Fix mismatched rtnl_unlock
    - xen-netfront: Update features after registering netdev

 -- Kamal Mostafa <kamal@canonical.com>  Thu, 12 Jul 2018 09:47:07 -0700

linux (4.15.0-27.29) bionic; urgency=medium

  * linux: 4.15.0-27.29 -proposed tracker (LP: #1781062)

  * [Regression] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:99:
    comm stress-ng: Corrupt inode bitmap (LP: #1780137)
    - SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode
      bitmap

 -- Khalid Elmously <khalid.elmously@canonical.com>  Tue, 10 Jul 2018 19:05:00 -0400

linux (4.15.0-26.28) bionic; urgency=medium

  * linux: 4.15.0-26.28 -proposed tracker (LP: #1780112)

  * failure to boot with linux-image-4.15.0-24-generic (LP: #1779827) // Cloud-
    init causes potentially huge boot delays with 4.15 kernels (LP: #1780062)
    - random: Make getrandom() ready earlier

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 04 Jul 2018 17:52:52 +0200

linux (4.15.0-25.27) bionic; urgency=medium

  * linux: 4.15.0-25.27 -proposed tracker (LP: #1779354)

  * hisi_sas_v3_hw: internal task abort: timeout and not done. (LP: #1777736)
    - scsi: hisi_sas: Update a couple of register settings for v3 hw

  * hisi_sas: Add missing PHY spinlock init (LP: #1777734)
    - scsi: hisi_sas: Add missing PHY spinlock init

  * hisi_sas: improve read performance by pre-allocating slot DMA buffers
    (LP: #1777727)
    - scsi: hisi_sas: use dma_zalloc_coherent()
    - scsi: hisi_sas: Use dmam_alloc_coherent()
    - scsi: hisi_sas: Pre-allocate slot DMA buffers

  * hisi_sas: Failures during host reset (LP: #1777696)
    - scsi: hisi_sas: Only process broadcast change in phy_bcast_v3_hw()
    - scsi: hisi_sas: Fix the conflict between dev gone and host reset
    - scsi: hisi_sas: Adjust task reject period during host reset
    - scsi: hisi_sas: Add a flag to filter PHY events during reset
    - scsi: hisi_sas: Release all remaining resources in clear nexus ha

  * Fake SAS addresses for SATA disks on HiSilicon D05 are non-unique
    (LP: #1776750)
    - scsi: hisi_sas: make SAS address of SATA disks unique

  * Vcs-Git header on bionic linux source package points to zesty git tree
    (LP: #1766055)
    - [Packaging]: Update Vcs-Git

  * large KVM instances run out of IRQ routes (LP: #1778261)
    - SAUCE: kvm -- increase KVM_MAX_IRQ_ROUTES to 2048 on x86

 -- Khalid Elmously <khalid.elmously@canonical.com>  Sun, 01 Jul 2018 23:10:18 +0000

linux (4.15.0-24.26) bionic; urgency=medium

  * linux: 4.15.0-24.26 -proposed tracker (LP: #1776338)

  * Bionic update: upstream stable patchset 2018-06-06 (LP: #1775483)
    - drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs
    - i40e: Fix attach VF to VM issue
    - tpm: cmd_ready command can be issued only after granting locality
    - tpm: tpm-interface: fix tpm_transmit/_cmd kdoc
    - tpm: add retry logic
    - Revert "ath10k: send (re)assoc peer command when NSS changed"
    - bonding: do not set slave_dev npinfo before slave_enable_netpoll in
      bond_enslave
    - ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
    - ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts
    - KEYS: DNS: limit the length of option strings
    - l2tp: check sockaddr length in pppol2tp_connect()
    - net: validate attribute sizes in neigh_dump_table()
    - llc: delete timers synchronously in llc_sk_free()
    - tcp: don't read out-of-bounds opsize
    - net: af_packet: fix race in PACKET_{R|T}X_RING
    - tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
    - net: fix deadlock while clearing neighbor proxy table
    - team: avoid adding twice the same option to the event list
    - net/smc: fix shutdown in state SMC_LISTEN
    - team: fix netconsole setup over team
    - packet: fix bitfield update race
    - tipc: add policy for TIPC_NLA_NET_ADDR
    - pppoe: check sockaddr length in pppoe_connect()
    - vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
    - amd-xgbe: Add pre/post auto-negotiation phy hooks
    - sctp: do not check port in sctp_inet6_cmp_addr
    - amd-xgbe: Improve KR auto-negotiation and training
    - strparser: Do not call mod_delayed_work with a timeout of LONG_MAX
    - amd-xgbe: Only use the SFP supported transceiver signals
    - strparser: Fix incorrect strp->need_bytes value.
    - net: sched: ife: signal not finding metaid
    - tcp: clear tp->packets_out when purging write queue
    - net: sched: ife: handle malformed tlv length
    - net: sched: ife: check on metadata length
    - llc: hold llc_sap before release_sock()
    - llc: fix NULL pointer deref for SOCK_ZAPPED
    - net: ethernet: ti: cpsw: fix tx vlan priority mapping
    - virtio_net: split out ctrl buffer
    - virtio_net: fix adding vids on big-endian
    - KVM: s390: force bp isolation for VSIE
    - s390: correct module section names for expoline code revert
    - microblaze: Setup dependencies for ASM optimized lib functions
    - commoncap: Handle memory allocation failure.
    - scsi: mptsas: Disable WRITE SAME
    - cdrom: information leak in cdrom_ioctl_media_changed()
    - m68k/mac: Don't remap SWIM MMIO region
    - block/swim: Check drive type
    - block/swim: Don't log an error message for an invalid ioctl
    - block/swim: Remove extra put_disk() call from error path
    - block/swim: Rename macros to avoid inconsistent inverted logic
    - block/swim: Select appropriate drive on device open
    - block/swim: Fix array bounds check
    - block/swim: Fix IO error at end of medium
    - tracing: Fix missing tab for hwlat_detector print format
    - s390/cio: update chpid descriptor after resource accessibility event
    - s390/dasd: fix IO error for newly defined devices
    - s390/uprobes: implement arch_uretprobe_is_alive()
    - ACPI / video: Only default only_lcd to true on Win8-ready _desktops_
    - docs: ip-sysctl.txt: fix name of some ipv6 variables
    - net: mvpp2: Fix DMA address mask size
    - net: stmmac: Disable ACS Feature for GMAC >= 4
    - l2tp: hold reference on tunnels in netlink dumps
    - l2tp: hold reference on tunnels printed in pppol2tp proc file
    - l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file
    - l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow
    - s390/qeth: fix error handling in adapter command callbacks
    - s390/qeth: avoid control IO completion stalls
    - s390/qeth: handle failure on workqueue creation
    - bnxt_en: Fix memory fault in bnxt_ethtool_init()
    - virtio-net: add missing virtqueue kick when flushing packets
    - VSOCK: make af_vsock.ko removable again
    - hwmon: (k10temp) Add temperature offset for Ryzen 2700X
    - hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics
    - s390/cpum_cf: rename IBM z13/z14 counter names
    - kprobes: Fix random address output of blacklist file
    - Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip"

  * Lenovo V330 needs patch in ideapad_laptop module for rfkill (LP: #1774636)
    - SAUCE: Add Lenovo V330 to the ideapad_laptop rfkill blacklist

  * bluetooth controller fail after suspend with USB autosuspend on XPS 13 9360
    (LP: #1775217)
    - Bluetooth: btusb: Add Dell XPS 13 9360 to btusb_needs_reset_resume_table

  * [Hyper-V] PCI: hv: Fix 2 hang issues in hv_compose_msi_msg (LP: #1758378)
    - PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary
    - PCI: hv: Remove the bogus test in hv_eject_device_work()
    - PCI: hv: Fix a comment typo in _hv_pcifront_read_config()

  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
    - fs/binfmt_misc.c: do not allow offset overflow

  * CVE-2018-11508
    - compat: fix 4-byte infoleak via uninitialized struct field

  * Network installs fail on SocioNext board (LP: #1775884)
    - net: netsec: reduce DMA mask to 40 bits
    - net: socionext: reset hardware in ndo_stop
    - net: netsec: enable tx-irq during open callback

  * r8169 ethernet card don't work after returning from suspension
    (LP: #1752772)
    - PCI: Add pcim_set_mwi(), a device-managed pci_set_mwi()
    - r8169: switch to device-managed functions in probe
    - r8169: remove netif_napi_del in probe error path
    - r8169: remove some WOL-related dead code
    - r8169: disable WOL per default
    - r8169: improve interrupt handling
    - r8169: fix interrupt number after adding support for MSI-X interrupts

  * ISST-LTE:KVM:Ubuntu18.04:BostonLC:boslcp3:boslcp3g3:Guest conosle hangs
    after hotplug CPU add operation. (LP: #1759723)
    - genirq/affinity: assign vectors to all possible CPUs
    - genirq/affinity: Don't return with empty affinity masks on error
    - genirq/affinity: Rename *node_to_possible_cpumask as *node_to_cpumask
    - genirq/affinity: Move actual irq vector spreading into a helper function
    - genirq/affinity: Allow irq spreading from a given starting point
    - genirq/affinity: Spread irq vectors among present CPUs as far as possible
    - blk-mq: simplify queue mapping & schedule with each possisble CPU
    - blk-mq: make sure hctx->next_cpu is set correctly
    - blk-mq: Avoid that blk_mq_delay_run_hw_queue() introduces unintended delays
    - blk-mq: make sure that correct hctx->next_cpu is set
    - blk-mq: avoid to write intermediate result to hctx->next_cpu
    - blk-mq: introduce blk_mq_hw_queue_first_cpu() to figure out first cpu
    - blk-mq: don't check queue mapped in __blk_mq_delay_run_hw_queue()
    - nvme: pci: pass max vectors as num_possible_cpus() to pci_alloc_irq_vectors
    - scsi: hpsa: fix selection of reply queue
    - scsi: megaraid_sas: fix selection of reply queue
    - scsi: core: introduce force_blk_mq
    - scsi: virtio_scsi: fix IO hang caused by automatic irq vector affinity
    - scsi: virtio_scsi: unify scsi_host_template

  * Fix several bugs in RDMA/hns driver (LP: #1770974)
    - RDMA/hns: Use structs to describe the uABI instead of opencoding
    - RDMA/hns: Remove unnecessary platform_get_resource() error check
    - RDMA/hns: Remove unnecessary operator
    - RDMA/hns: Add names to function arguments in function pointers
    - RDMA/hns: Fix misplaced call to hns_roce_cleanup_hem_table
    - RDMA/hns: Fix a bug with modifying mac address
    - RDMA/hns: Use free_pages function instead of free_page
    - RDMA/hns: Replace __raw_write*(cpu_to_le*()) with LE write*()
    - RDMA/hns: Bugfix for init hem table
    - RDMA/hns: Intercept illegal RDMA operation when use inline data
    - RDMA/hns: Fix the qp context state diagram
    - RDMA/hns: Only assign mtu if IB_QP_PATH_MTU bit is set
    - RDMA/hns: Remove some unnecessary attr_mask judgement
    - RDMA/hns: Only assign dqpn if IB_QP_PATH_DEST_QPN bit is set
    - RDMA/hns: Adjust the order of cleanup hem table
    - RDMA/hns: Update assignment method for owner field of send wqe
    - RDMA/hns: Submit bad wr
    - RDMA/hns: Fix a couple misspellings
    - RDMA/hns: Add rq inline flags judgement
    - RDMA/hns: Bugfix for rq record db for kernel
    - RDMA/hns: Load the RoCE dirver automatically
    - RDMA/hns: Update convert function of endian format
    - RDMA/hns: Add return operation when configured global param fail
    - RDMA/hns: Not support qp transition from reset to reset for hip06
    - RDMA/hns: Fix the bug with rq sge
    - RDMA/hns: Set desc_dma_addr for zero when free cmq desc
    - RDMA/hns: Enable inner_pa_vld filed of mpt
    - RDMA/hns: Set NULL for __internal_mr
    - RDMA/hns: Fix the bug with NULL pointer
    - RDMA/hns: Bugfix for cq record db for kernel
    - RDMA/hns: Move the location for initializing tmp_len
    - RDMA/hns: Drop local zgid in favor of core defined variable
    - RDMA/hns: Add 64KB page size support for hip08
    - RDMA/hns: Rename the idx field of db
    - RDMA/hns: Modify uar allocation algorithm to avoid bitmap exhaust
    - RDMA/hns: Increase checking CMQ status timeout value
    - RDMA/hns: Add reset process for RoCE in hip08
    - RDMA/hns: Fix the illegal memory operation when cross page
    - RDMA/hns: Implement the disassociate_ucontext API

  * powerpc/livepatch: Implement reliable stack tracing for the consistency
    model (LP: #1771844)
    - powerpc/livepatch: Implement reliable stack tracing for the consistency
      model

  * vmxnet3: update to latest ToT (LP: #1768143)
    - vmxnet3: avoid xmit reset due to a race in vmxnet3
    - vmxnet3: use correct flag to indicate LRO feature
    - vmxnet3: fix incorrect dereference when rxvlan is disabled

  * 4.15.0-22-generic fails to boot on IBM S822LC (POWER8 (raw), altivec
    supported) (LP: #1773162)
    - Revert "powerpc/64s: Add support for a store forwarding barrier at kernel
      entry/exit"
    - powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit

  * Decode ARM CPER records in kernel (LP: #1770244)
    - [Config] CONFIG_UEFI_CPER_ARM=y
    - efi: Move ARM CPER code to new file
    - efi: Parse ARM error information value

  * Adding back alx WoL feature (LP: #1772610)
    - SAUCE: Revert "alx: remove WoL support"
    - SAUCE: alx: add enable_wol paramenter

  * Lancer A0 Asic HBA's won't boot with 18.04 (LP: #1768103)
    - scsi: lpfc: Fix WQ/CQ creation for older asic's.
    - scsi: lpfc: Fix 16gb hbas failing cq create.

  * [LTCTest][OPAL][OP920] cpupower idle-info is not listing stop4 and stop5
    idle states when all CORES are guarded (LP: #1771780)
    - SAUCE: cpuidle/powernv : init all present cpus for deep states

  * Huawei 25G/100G Network Adapters Unsupported (LP: #1770970)
    - net-next/hinic: add pci device ids for 25ge and 100ge card

  * [Ubuntu 18.04.1] POWER9 - Nvidia Volta - Kernel changes to enable Nvidia
    driver on bare metal (LP: #1772991)
    - powerpc/powernv/npu: Fix deadlock in mmio_invalidate()
    - powerpc/powernv/mce: Don't silently restart the machine
    - powerpc/npu-dma.c: Fix crash after __mmu_notifier_register failure
    - powerpc/mm: Flush cache on memory hot(un)plug
    - powerpc/powernv/memtrace: Let the arch hotunplug code flush cache
    - powerpc/powernv/npu: Add lock to prevent race in concurrent context
      init/destroy
    - powerpc/powernv/npu: Prevent overwriting of pnv_npu2_init_contex() callback
      parameters
    - powerpc/powernv/npu: Do a PID GPU TLB flush when invalidating a large
      address range
    - powerpc/mce: Fix a bug where mce loops on memory UE.

  * cpum_sf: ensure sample freq is non-zero (LP: #1772593)
    - s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero

  * PCIe link speeds of 16 GT/s are shown as "Unknown speed" (LP: #1773243)
    - PCI: Add decoding for 16 GT/s link speed

  * False positive ACPI _PRS error messages (LP: #1773295)
    - ACPI / PCI: pci_link: Allow the absence of _PRS and change log level

  * Dell systems crash when disabling Nvidia dGPU (LP: #1773299)
    - ACPI / OSI: Add OEM _OSI strings to disable NVidia RTD3

  * wlp3s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-22)
    (LP: #1720930)
    - iwlwifi: mvm: fix "failed to remove key" message

  * Expose arm64 CPU topology to userspace (LP: #1770231)
    - ACPICA: ACPI 6.2: Additional PPTT flags
    - drivers: base: cacheinfo: move cache_setup_of_node()
    - drivers: base: cacheinfo: setup DT cache properties early
    - cacheinfo: rename of_node to fw_token
    - arm64/acpi: Create arch specific cpu to acpi id helper
    - ACPI/PPTT: Add Processor Properties Topology Table parsing
    - [Config] CONFIG_ACPI_PPTT=y
    - ACPI: Enable PPTT support on ARM64
    - drivers: base cacheinfo: Add support for ACPI based firmware tables
    - arm64: Add support for ACPI based firmware tables
    - arm64: topology: rename cluster_id
    - arm64: topology: enable ACPI/PPTT based CPU topology
    - ACPI: Add PPTT to injectable table list
    - arm64: topology: divorce MC scheduling domain from core_siblings

  * hisi_sas robustness fixes (LP: #1774466)
    - scsi: hisi_sas: delete timer when removing hisi_sas driver
    - scsi: hisi_sas: print device id for errors
    - scsi: hisi_sas: Add some checks to avoid free'ing a sas_task twice
    - scsi: hisi_sas: check host frozen before calling "done" function
    - scsi: hisi_sas: check sas_dev gone earlier in hisi_sas_abort_task()
    - scsi: hisi_sas: stop controller timer for reset
    - scsi: hisi_sas: update PHY linkrate after a controller reset
    - scsi: hisi_sas: change slot index allocation mode
    - scsi: hisi_sas: Change common allocation mode of device id
    - scsi: hisi_sas: Reset disks when discovered
    - scsi: hisi_sas: Create a scsi_host_template per HW module
    - scsi: hisi_sas: Init disks after controller reset
    - scsi: hisi_sas: Try wait commands before before controller reset
    - scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
    - scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
    - scsi: hisi_sas: Terminate STP reject quickly for v2 hw
    - scsi: hisi_sas: Fix return value when get_free_slot() failed
    - scsi: hisi_sas: Mark PHY as in reset for nexus reset

  * hisi_sas: Support newer v3 hardware (LP: #1774467)
    - scsi: hisi_sas: update RAS feature for later revision of v3 HW
    - scsi: hisi_sas: check IPTT is valid before using it for v3 hw
    - scsi: hisi_sas: fix PI memory size
    - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
    - scsi: hisi_sas: remove redundant handling to event95 for v3
    - scsi: hisi_sas: add readl poll timeout helper wrappers
    - scsi: hisi_sas: workaround a v3 hw hilink bug
    - scsi: hisi_sas: Add LED feature for v3 hw

  * hisi_sas: improve performance by optimizing DQ locking (LP: #1774472)
    - scsi: hisi_sas: initialize dq spinlock before use
    - scsi: hisi_sas: optimise the usage of DQ locking
    - scsi: hisi_sas: relocate smp sg map
    - scsi: hisi_sas: make return type of prep functions void
    - scsi: hisi_sas: allocate slot buffer earlier
    - scsi: hisi_sas: Don't lock DQ for complete task sending
    - scsi: hisi_sas: Use device lock to protect slot alloc/free
    - scsi: hisi_sas: add check of device in hisi_sas_task_exec()
    - scsi: hisi_sas: fix a typo in hisi_sas_task_prep()

  * Request to revert SAUCE patches in the 18.04 SRU and update with upstream
    version (LP: #1768431)
    - scsi: cxlflash: Handle spurious interrupts
    - scsi: cxlflash: Remove commmands from pending list on timeout
    - scsi: cxlflash: Synchronize reset and remove ops
    - SAUCE: (no-up) cxlflash: OCXL diff between v2 and v3

  * After update to 4.13-43 Intel Graphics are Laggy (LP: #1773520)
    - SAUCE: Revert "drm/i915/edp: Allow alternate fixed mode for eDP if
      available."

  * ELANPAD ELAN0612 does not work, patch available (LP: #1773509)
    - SAUCE: Input: elan_i2c - add ELAN0612 to the ACPI table

  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
    - SAUCE: CacheFiles: fix a read_waiter/read_copier race

  * hns3 driver updates (LP: #1768670)
    - net: hns3: VF should get the real rss_size instead of rss_size_max
    - net: hns3: set the cmdq out_vld bit to 0 after used
    - net: hns3: fix endian issue when PF get mbx message flag
    - net: hns3: fix the queue id for tqp enable&&reset
    - net: hns3: set the max ring num when alloc netdev
    - net: hns3: add support for VF driver inner interface
      hclgevf_ops.get_tqps_and_rss_info
    - net: hns3: refactor the hclge_get/set_rss function
    - net: hns3: refactor the hclge_get/set_rss_tuple function
    - net: hns3: fix for RSS configuration loss problem during reset
    - net: hns3: fix for pause configuration lost during reset
    - net: hns3: fix for use-after-free when setting ring parameter
    - net: hns3: refactor the get/put_vector function
    - net: hns3: fix for coalesce configuration lost during reset
    - net: hns3: refactor the coalesce related struct
    - net: hns3: fix for coal configuation lost when setting the channel
    - net: hns3: add existence check when remove old uc mac address
    - net: hns3: fix for netdev not running problem after calling net_stop and
      net_open
    - net: hns3: fix for ipv6 address loss problem after setting channels
    - net: hns3: unify the pause params setup function
    - net: hns3: fix rx path skb->truesize reporting bug
    - net: hns3: add support for querying pfc puase packets statistic
    - net: hns3: fix for loopback failure when vlan filter is enable
    - net: hns3: fix for buffer overflow smatch warning
    - net: hns3: fix error type definition of return value
    - net: hns3: fix return value error of hclge_get_mac_vlan_cmd_status()
    - net: hns3: add existence checking before adding unicast mac address
    - net: hns3: add result checking for VF when modify unicast mac address
    - net: hns3: reallocate tx/rx buffer after changing mtu
    - net: hns3: fix the VF queue reset flow error
    - net: hns3: fix for vlan table lost problem when resetting
    - net: hns3: increase the max time for IMP handle command
    - net: hns3: change GL update rate
    - net: hns3: change the time interval of int_gl calculating
    - net: hns3: fix for getting wrong link mode problem
    - net: hns3: add get_link support to VF
    - net: hns3: add querying speed and duplex support to VF
    - net: hns3: fix for not returning problem in get_link_ksettings when phy
      exists
    - net: hns3: Changes to make enet watchdog timeout func common for PF/VF
    - net: hns3: Add VF Reset Service Task to support event handling
    - net: hns3: Add VF Reset device state and its handling
    - net: hns3: Add support to request VF Reset to PF
    - net: hns3: Add support to reset the enet/ring mgmt layer
    - net: hns3: Add support to re-initialize the hclge device
    - net: hns3: Changes to support ARQ(Asynchronous Receive Queue)
    - net: hns3: Add *Asserting Reset* mailbox message & handling in VF
    - net: hns3: Changes required in PF mailbox to support VF reset
    - net: hns3: hclge_inform_reset_assert_to_vf() can be static
    - net: hns3: fix for returning wrong value problem in hns3_get_rss_key_size
    - net: hns3: fix for returning wrong value problem in hns3_get_rss_indir_size
    - net: hns3: fix for the wrong shift problem in hns3_set_txbd_baseinfo
    - net: hns3: fix for not initializing VF rss_hash_key problem
    - net: hns3: never send command queue message to IMP when reset
    - net: hns3: remove unnecessary pci_set_drvdata() and devm_kfree()
    - net: hns3: fix length overflow when CONFIG_ARM64_64K_PAGES
    - net: hns3: Remove error log when getting pfc stats fails
    - net: hns3: fix to correctly fetch l4 protocol outer header
    - net: hns3: Fixes the out of bounds access in hclge_map_tqp
    - net: hns3: Fixes the error legs in hclge_init_ae_dev function
    - net: hns3: fix for phy_addr error in hclge_mac_mdio_config
    - net: hns3: Fix to support autoneg only for port attached with phy
    - net: hns3: fix a dead loop in hclge_cmd_csq_clean
    - net: hns3: Fix for packet loss due wrong filter config in VLAN tbls
    - net: hns3: Remove packet statistics in the range of 8192~12287
    - net: hns3: Add support of hardware rx-vlan-offload to HNS3 VF driver
    - net: hns3: Fix for setting mac address when resetting
    - net: hns3: remove add/del_tunnel_udp in hns3_enet module
    - net: hns3: fix for cleaning ring problem
    - net: hns3: refactor the loopback related function
    - net: hns3: Fix for deadlock problem occurring when unregistering ae_algo
    - net: hns3: Fix for the null pointer problem occurring when initializing
      ae_dev failed
    - net: hns3: Add a check for client instance init state
    - net: hns3: Change return type of hnae3_register_ae_dev
    - net: hns3: Change return type of hnae3_register_ae_algo
    - net: hns3: Change return value in hnae3_register_client
    - net: hns3: Fixes the back pressure setting when sriov is enabled
    - net: hns3: Fix for fiber link up problem
    - net: hns3: Add support of .sriov_configure in HNS3 driver
    - net: hns3: Fixes the missing PCI iounmap for various legs
    - net: hns3: Fixes error reported by Kbuild and internal review
    - net: hns3: Fixes API to fetch ethernet header length with kernel default
    - net: hns3: cleanup of return values in hclge_init_client_instance()
    - net: hns3: Fix the missing client list node initialization
    - net: hns3: Fix for hns3 module is loaded multiple times problem
    - net: hns3: Use enums instead of magic number in hclge_is_special_opcode
    - net: hns3: Fix for netdev not running problem after calling net_stop and
      net_open
    - net: hns3: Fixes kernel panic issue during rmmod hns3 driver
    - net: hns3: Fix for CMDQ and Misc. interrupt init order problem
    - net: hns3: Updates RX packet info fetch in case of multi BD
    - net: hns3: Add support for tx_accept_tag2 and tx_accept_untag2 config
    - net: hns3: Add STRP_TAGP field support for hardware revision 0x21
    - net: hns3: Add support to enable TX/RX promisc mode for H/W rev(0x21)
    - net: hns3: Fix for PF mailbox receving unknown message
    - net: hns3: Fixes the state to indicate client-type initialization
    - net: hns3: Fixes the init of the VALID BD info in the descriptor
    - net: hns3: Removes unnecessary check when clearing TX/RX rings
    - net: hns3: Clear TX/RX rings when stopping port & un-initializing client
    - net: hns3: Remove unused led control code
    - net: hns3: Adds support for led locate command for copper port
    - net: hns3: Fixes initalization of RoCE handle and makes it conditional
    - net: hns3: Disable vf vlan filter when vf vlan table is full
    - net: hns3: Add support for IFF_ALLMULTI flag
    - net: hns3: Add repeat address checking for setting mac address
    - net: hns3: Fix setting mac address error
    - net: hns3: Fix for service_task not running problem after resetting
    - net: hns3: Fix for hclge_reset running repeatly problem
    - net: hns3: Fix for phy not link up problem after resetting
    - net: hns3: Add missing break in misc_irq_handle
    - net: hns3: Fix for vxlan tx checksum bug
    - net: hns3: Optimize the PF's process of updating multicast MAC
    - net: hns3: Optimize the VF's process of updating multicast MAC
    - SAUCE: {topost} net: hns3: add support for serdes loopback selftest
    - SAUCE: {topost} net: hns3: RX BD information valid only in last BD except
      VLD bit and buffer size
    - SAUCE: {topost} net: hns3: remove hclge_get_vector_index from
      hclge_bind_ring_with_vector
    - SAUCE: {topost} net: hns3: rename the interface for init_client_instance and
      uninit_client_instance
    - SAUCE: {topost} net: hns3: add vector status check before free vector
    - SAUCE: {topost} net: hns3: add l4_type check for both ipv4 and ipv6
    - SAUCE: {topost} net: hns3: remove unused head file in hnae3.c
    - SAUCE: {topost} net: hns3: extraction an interface for state state
      init|uninit
    - SAUCE: {topost} net: hns3: print the ret value in error information
    - SAUCE: {topost} net: hns3: remove the Redundant put_vector in
      hns3_client_uninit
    - SAUCE: {topost} net: hns3: add unlikely for error check
    - SAUCE: {topost} net: hns3: remove back in struct hclge_hw
    - SAUCE: {topost} net: hns3: use lower_32_bits and upper_32_bits
    - SAUCE: {topost} net: hns3: remove unused hclge_ring_to_dma_dir
    - SAUCE: {topost} net: hns3: remove useless code in hclge_cmd_send
    - SAUCE: {topost} net: hns3: remove some redundant assignments
    - SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean
    - SAUCE: {topost} net: hns3: using modulo for cyclic counters in
      hclge_cmd_send
    - SAUCE: {topost} net: hns3: remove a redundant hclge_cmd_csq_done
    - SAUCE: {topost} net: hns3: remove some unused members of some structures
    - SAUCE: {topost} net: hns3: give default option while dependency HNS3 set
    - SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead of
      kzalloc/dma_map_single
    - SAUCE: {topost} net: hns3: modify hnae_ to hnae3_
    - SAUCE: {topost} net: hns3: fix unused function warning in VF driver
    - SAUCE: {topost} net: hns3: remove some redundant assignments
    - SAUCE: {topost} net: hns3: standardize the handle of return value
    - SAUCE: {topost} net: hns3: remove extra space and brackets
    - SAUCE: {topost} net: hns3: fix unreasonable code comments
    - SAUCE: {topost} net: hns3: use decimal for bit offset macros
    - SAUCE: {topost} net: hns3: modify inconsistent bit mask macros
    - SAUCE: {topost} net: hns3: fix mislead parameter name
    - SAUCE: {topost} net: hns3: remove unused struct member and definition
    - SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver
    - SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE
    - SAUCE: {topost} net: hns3: optimize the process of notifying roce client
    - SAUCE: {topost} net: hns3: Add calling roce callback function when link
      status change
    - SAUCE: {topost} net: hns3: fix tc setup when netdev is first up
    - SAUCE: {topost} net: hns3: fix for mac pause not disable in pfc mode
    - SAUCE: {topost} net: hns3: fix for waterline not setting correctly
    - SAUCE: {topost} net: hns3: fix for l4 checksum offload bug
    - SAUCE: {topost} net: hns3: fix for mailbox message truncated problem
    - SAUCE: {topost} net: hns3: Add configure for mac minimal frame size
    - SAUCE: {topost} net: hns3: fix warning bug when doing lp selftest
    - SAUCE: {topost} net: hns3: fix get_vector ops in hclgevf_main module
    - SAUCE: {topost} net: hns3: remove the warning when clear reset cause
    - SAUCE: {topost} net: hns3: Use roce handle when calling roce callback
      function
    - SAUCE: {topost} net: hns3: prevent sending command during global or core
      reset
    - SAUCE: {topost} net: hns3: modify the order of initializeing command queue
      register
    - SAUCE: {topost} net: hns3: reset net device with rtnl_lock
    - SAUCE: {topost} net: hns3: prevent to request reset frequently
    - SAUCE: {topost} net: hns3: correct reset event status register
    - SAUCE: {topost} net: hns3: separate roce from nic when resetting
    - SAUCE: net: hns3: Fix for phy link issue when using marvell phy driver
    - SAUCE: {topost} net: hns3: fix return value error in
      hns3_reset_notify_down_enet
    - SAUCE: {topost} net: hns3: remove unnecessary ring configuration operation
      while resetting
    - SAUCE: {topost} net: hns3: fix for reset_level default assignment probelm
    - SAUCE: {topost} net: hns3: fix for using wrong mask and shift in
      hclge_get_ring_chain_from_mbx
    - SAUCE: {topost} net: hns3: fix comments for hclge_get_ring_chain_from_mbx
    - SAUCE: net: hns3: Fix for VF mailbox cannot receiving PF response
    - SAUCE: net: hns3: Fix for VF mailbox receiving unknown message
    - SAUCE: net: hns3: Optimize PF CMDQ interrupt switching process

  * enable mic-mute hotkey and led on Lenovo M820z and M920z (LP: #1774306)
    - ALSA: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs

  * Bionic update: upstream stable patchset 2018-05-29 (LP: #1774063)
    - cifs: do not allow creating sockets except with SMB1 posix exensions
    - btrfs: fix unaligned access in readdir
    - x86/acpi: Prevent X2APIC id 0xffffffff from being accounted
    - clocksource/imx-tpm: Correct -ETIME return condition check
    - x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
    - drm/vc4: Fix memory leak during BO teardown
    - drm/i915/gvt: throw error on unhandled vfio ioctls
    - drm/i915/audio: Fix audio detection issue on GLK
    - drm/i915: Do no use kfree() to free a kmem_cache_alloc() return value
    - drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state
    - drm/i915/bxt, glk: Increase PCODE timeouts during CDCLK freq changing
    - usb: musb: fix enumeration after resume
    - usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers
    - usb: musb: Fix external abort in musb_remove on omap2430
    - firewire-ohci: work around oversized DMA reads on JMicron controllers
    - x86/tsc: Allow TSC calibration without PIT
    - NFSv4: always set NFS_LOCK_LOST when a lock is lost.
    - ACPI / LPSS: Do not instiate platform_dev for devs without MMIO resources
    - ALSA: hda - Use IS_REACHABLE() for dependency on input
    - ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read()
    - kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
    - RDMA/core: Clarify rdma_ah_find_type
    - KVM: PPC: Book3S HV: Enable migration of decrementer register
    - netfilter: ipv6: nf_defrag: Pass on packets to stack per RFC2460
    - tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into
      account
    - KVM: s390: use created_vcpus in more places
    - platform/x86: dell-laptop: Filter out spurious keyboard backlight change
      events
    - xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
    - selftest: ftrace: Fix to pick text symbols for kprobes
    - PCI: Add function 1 DMA alias quirk for Marvell 9128
    - Input: psmouse - fix Synaptics detection when protocol is disabled
    - libbpf: Makefile set specified permission mode
    - Input: synaptics - reset the ABS_X/Y fuzz after initializing MT axes
    - i40iw: Free IEQ resources
    - i40iw: Zero-out consumer key on allocate stag for FMR
    - perf unwind: Do not look just at the global callchain_param.record_mode
    - tools lib traceevent: Simplify pointer print logic and fix %pF
    - perf callchain: Fix attr.sample_max_stack setting
    - tools lib traceevent: Fix get_field_str() for dynamic strings
    - perf record: Fix failed memory allocation for get_cpuid_str
    - iommu/exynos: Don't unconditionally steal bus ops
    - powerpc: System reset avoid interleaving oops using die synchronisation
    - iommu/vt-d: Use domain instead of cache fetching
    - dm thin: fix documentation relative to low water mark threshold
    - dm mpath: return DM_MAPIO_REQUEUE on blk-mq rq allocation failure
    - ubifs: Fix uninitialized variable in search_dh_cookie()
    - net: stmmac: dwmac-meson8b: fix setting the RGMII TX clock on Meson8b
    - net: stmmac: dwmac-meson8b: propagate rate changes to the parent clock
    - spi: a3700: Clear DATA_OUT when performing a read
    - IB/cq: Don't force IB_POLL_DIRECT poll context for ib_process_cq_direct
    - nfs: Do not convert nfs_idmap_cache_timeout to jiffies
    - MIPS: Fix clean of vmlinuz.{32,ecoff,bin,srec}
    - PCI: Add dummy pci_irqd_intx_xlate() for CONFIG_PCI=n build
    - watchdog: sp5100_tco: Fix watchdog disable bit
    - kconfig: Don't leak main menus during parsing
    - kconfig: Fix automatic menu creation mem leak
    - kconfig: Fix expr_free() E_NOT leak
    - ipmi/powernv: Fix error return code in ipmi_powernv_probe()
    - Btrfs: set plug for fsync
    - btrfs: Fix out of bounds access in btrfs_search_slot
    - Btrfs: fix scrub to repair raid6 corruption
    - btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP
    - Btrfs: fix unexpected EEXIST from btrfs_get_extent
    - Btrfs: raid56: fix race between merge_bio and rbio_orig_end_io
    - RDMA/cma: Check existence of netdevice during port validation
    - f2fs: avoid hungtask when GC encrypted block if io_bits is set
    - scsi: devinfo: fix format of the device list
    - scsi: fas216: fix sense buffer initialization
    - Input: stmfts - set IRQ_NOAUTOEN to the irq flag
    - HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()
    - nfp: fix error return code in nfp_pci_probe()
    - block: Set BIO_TRACE_COMPLETION on new bio during split
    - bpf: test_maps: cleanup sockmaps when test ends
    - i40evf: Don't schedule reset_task when device is being removed
    - i40evf: ignore link up if not running
    - platform/x86: thinkpad_acpi: suppress warning about palm detection
    - KVM: s390: vsie: use READ_ONCE to access some SCB fields
    - blk-mq-debugfs: don't allow write on attributes with seq_operations set
    - ASoC: rockchip: Use dummy_dai for rt5514 dsp dailink
    - igb: Allow to remove administratively set MAC on VFs
    - igb: Clear TXSTMP when ptp_tx_work() is timeout
    - fm10k: fix "failed to kill vid" message for VF
    - x86/hyperv: Stop suppressing X86_FEATURE_PCID
    - tty: serial: exar: Relocate sleep wake-up handling
    - device property: Define type of PROPERTY_ENRTY_*() macros
    - crypto: artpec6 - remove select on non-existing CRYPTO_SHA384
    - RDMA/uverbs: Use an unambiguous errno for method not supported
    - jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
    - ixgbe: don't set RXDCTL.RLPML for 82599
    - i40e: program fragmented IPv4 filter input set
    - i40e: fix reported mask for ntuple filters
    - samples/bpf: Partially fixes the bpf.o build
    - powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes
    - powerpc/numa: Ensure nodes initialized for hotplug
    - RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure
    - ntb_transport: Fix bug with max_mw_size parameter
    - gianfar: prevent integer wrapping in the rx handler
    - x86/hyperv: Check for required priviliges in hyperv_init()
    - netfilter: x_tables: fix pointer leaks to userspace
    - tcp_nv: fix potential integer overflow in tcpnv_acked
    - kvm: Map PFN-type memory regions as writable (if possible)
    - x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when
      running nested
    - fs/dax.c: release PMD lock even when there is no PMD support in DAX
    - ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid
    - ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute
    - ocfs2: return error when we attempt to access a dirty bh in jbd2
    - mm/mempolicy: fix the check of nodemask from user
    - mm/mempolicy: add nodes_empty check in SYSC_migrate_pages
    - asm-generic: provide generic_pmdp_establish()
    - sparc64: update pmdp_invalidate() to return old pmd value
    - mm: thp: use down_read_trylock() in khugepaged to avoid long block
    - mm: pin address_space before dereferencing it while isolating an LRU page
    - mm/fadvise: discard partial page if endbyte is also EOF
    - openvswitch: Remove padding from packet before L3+ conntrack processing
    - blk-mq: fix discard merge with scheduler attached
    - IB/hfi1: Re-order IRQ cleanup to address driver cleanup race
    - IB/hfi1: Fix for potential refcount leak in hfi1_open_file()
    - IB/ipoib: Fix for potential no-carrier state
    - IB/core: Map iWarp AH type to undefined in rdma_ah_find_type
    - drm/nouveau/pmu/fuc: don't use movw directly anymore
    - s390/eadm: fix CONFIG_BLOCK include dependency
    - netfilter: ipv6: nf_defrag: Kill frag queue on RFC2460 failure
    - x86/power: Fix swsusp_arch_resume prototype
    - x86/dumpstack: Avoid uninitlized variable
    - firmware: dmi_scan: Fix handling of empty DMI strings
    - ACPI: processor_perflib: Do not send _PPC change notification if not ready
    - ACPI / bus: Do not call _STA on battery devices with unmet dependencies
    - ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs
    - MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS
    - perf record: Fix period option handling
    - MIPS: Generic: Support GIC in EIC mode
    - perf evsel: Fix period/freq terms setup
    - xen-netfront: Fix race between device setup and open
    - xen/grant-table: Use put_page instead of free_page
    - bpf: sockmap, fix leaking maps with attached but not detached progs
    - RDS: IB: Fix null pointer issue
    - arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics
    - proc: fix /proc/*/map_files lookup
    - PM / domains: Fix up domain-idle-states OF parsing
    - cifs: silence compiler warnings showing up with gcc-8.0.0
    - bcache: properly set task state in bch_writeback_thread()
    - bcache: fix for allocator and register thread race
    - bcache: fix for data collapse after re-attaching an attached device
    - bcache: return attach error when no cache set exist
    - cpufreq: intel_pstate: Enable HWP during system resume on CPU0
    - selftests/ftrace: Add some missing glob checks
    - rxrpc: Don't put crypto buffers on the stack
    - svcrdma: Fix Read chunk round-up
    - net: Extra '_get' in declaration of arch_get_platform_mac_address
    - tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
    - SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
    - net: stmmac: discard disabled flags in interrupt status register
    - bpf: fix rlimit in reuseport net selftest
    - ACPI / EC: Restore polling during noirq suspend/resume phases
    - PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
    - vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page
    - powerpc/mm/hash64: Zero PGD pages on allocation
    - x86/platform/UV: Fix GAM Range Table entries less than 1GB
    - locking/qspinlock: Ensure node->count is updated before initialising node
    - powerpc/powernv: IMC fix out of bounds memory access at shutdown
    - perf test: Fix test trace+probe_libc_inet_pton.sh for s390x
    - irqchip/gic-v3: Ignore disabled ITS nodes
    - cpumask: Make for_each_cpu_wrap() available on UP as well
    - irqchip/gic-v3: Change pr_debug message to pr_devel
    - RDMA/core: Reduce poll batch for direct cq polling
    - alarmtimer: Init nanosleep alarm timer on stack
    - netfilter: x_tables: cap allocations at 512 mbyte
    - netfilter: x_tables: add counters allocation wrapper
    - netfilter: compat: prepare xt_compat_init_offsets to return errors
    - netfilter: compat: reject huge allocation requests
    - netfilter: x_tables: limit allocation requests for blob rule heads
    - perf: Fix sample_max_stack maximum check
    - perf: Return proper values for user stack errors
    - RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs
    - Revert "KVM: X86: Fix SMRAM accessing even if VM is shutdown"
    - mac80211_hwsim: fix use-after-free bug in hwsim_exit_net
    - btrfs: Fix race condition between delayed refs and blockgroup removal
    - mm,vmscan: Allow preallocating memory for register_shrinker().

  * Bionic update: upstream stable patchset 2018-05-24 (LP: #1773233)
    - tty: make n_tty_read() always abort if hangup is in progress
    - cpufreq: CPPC: Use transition_delay_us depending transition_latency
    - ubifs: Check ubifs_wbuf_sync() return code
    - ubi: fastmap: Don't flush fastmap work on detach
    - ubi: Fix error for write access
    - ubi: Reject MLC NAND
    - mm/ksm.c: fix inconsistent accounting of zero pages
    - mm/hmm: hmm_pfns_bad() was accessing wrong struct
    - task_struct: only use anon struct under randstruct plugin
    - fs/reiserfs/journal.c: add missing resierfs_warning() arg
    - resource: fix integer overflow at reallocation
    - ipc/shm: fix use-after-free of shm file via remap_file_pages()
    - mm, slab: reschedule cache_reap() on the same CPU
    - usb: musb: gadget: misplaced out of bounds check
    - phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS
    - usb: gadget: udc: core: update usb_ep_queue() documentation
    - ARM64: dts: meson: reduce odroid-c2 eMMC maximum rate
    - KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list
    - ARM: EXYNOS: Fix coupled CPU idle freeze on Exynos4210
    - arm: dts: mt7623: fix USB initialization fails on bananapi-r2
    - ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
    - ARM: dts: exynos: Fix IOMMU support for GScaler devices on Exynos5250
    - ARM: dts: at91: sama5d4: fix pinctrl compatible string
    - spi: atmel: init FIFOs before spi enable
    - spi: Fix scatterlist elements size in spi_map_buf
    - spi: Fix unregistration of controller with fixed SPI bus number
    - media: atomisp_fops.c: disable atomisp_compat_ioctl32
    - media: vivid: check if the cec_adapter is valid
    - media: vsp1: Fix BRx conditional path in WPF
    - x86/xen: Delay get_cpu_cap until stack canary is established
    - regmap: Fix reversed bounds check in regmap_raw_write()
    - ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
    - ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
    - USB: gadget: f_midi: fixing a possible double-free in f_midi
    - USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
    - usb: dwc3: prevent setting PRTCAP to OTG from debugfs
    - usb: dwc3: pci: Properly cleanup resource
    - usb: dwc3: gadget: never call ->complete() from ->ep_queue()
    - cifs: fix memory leak in SMB2_open()
    - fix smb3-encryption breakage when CONFIG_DEBUG_SG=y
    - smb3: Fix root directory when server returns inode number of zero
    - HID: i2c-hid: fix size check and type usage
    - i2c: i801: Save register SMBSLVCMD value only once
    - i2c: i801: Restore configuration at shutdown
    - CIFS: refactor crypto shash/sdesc allocation&free
    - CIFS: add sha512 secmech
    - CIFS: fix sha512 check in cifs_crypto_secmech_release
    - powerpc/64s: Fix dt_cpu_ftrs to have restore_cpu clear unwanted LPCR bits
    - powerpc/64: Call H_REGISTER_PROC_TBL when running as a HPT guest on POWER9
    - powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
    - powerpc/kprobes: Fix call trace due to incorrect preempt count
    - powerpc/kexec_file: Fix error code when trying to load kdump kernel
    - powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops
    - powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
    - HID: Fix hid_report_len usage
    - HID: core: Fix size as type u32
    - soc: mediatek: fix the mistaken pointer accessed when subdomains are added
    - ASoC: ssm2602: Replace reg_default_raw with reg_default
    - ASoC: topology: Fix kcontrol name string handling
    - irqchip/gic: Take lock when updating irq type
    - random: use a tighter cap in credit_entropy_bits_safe()
    - extcon: intel-cht-wc: Set direction and drv flags for V5 boost GPIO
    - block: use 32-bit blk_status_t on Alpha
    - jbd2: if the journal is aborted then don't allow update of the log tail
    - ext4: shutdown should not prevent get_write_access
    - ext4: eliminate sleep from shutdown ioctl
    - ext4: pass -ESHUTDOWN code to jbd2 layer
    - ext4: don't update checksum of new initialized bitmaps
    - ext4: protect i_disksize update by i_data_sem in direct write path
    - ext4: limit xattr size to INT_MAX
    - ext4: always initialize the crc32c checksum driver
    - ext4: don't allow r/w mounts if metadata blocks overlap the superblock
    - ext4: move call to ext4_error() into ext4_xattr_check_block()
    - ext4: add bounds checking to ext4_xattr_find_entry()
    - ext4: add extra checks to ext4_xattr_block_get()
    - dm crypt: limit the number of allocated pages
    - RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
    - RDMA/mlx5: Protect from NULL pointer derefence
    - RDMA/rxe: Fix an out-of-bounds read
    - ALSA: pcm: Fix UAF at PCM release via PCM timer access
    - IB/srp: Fix srp_abort()
    - IB/srp: Fix completion vector assignment algorithm
    - dmaengine: at_xdmac: fix rare residue corruption
    - cxl: Fix possible deadlock when processing page faults from cxllib
    - tpm: self test failure should not cause suspend to fail
    - libnvdimm, dimm: fix dpa reservation vs uninitialized label area
    - libnvdimm, namespace: use a safe lookup for dimm device name
    - nfit, address-range-scrub: fix scrub in-progress reporting
    - nfit: skip region registration for incomplete control regions
    - ring-buffer: Check if memory is available before allocation
    - um: Compile with modern headers
    - um: Use POSIX ucontext_t instead of struct ucontext
    - iommu/vt-d: Fix a potential memory leak
    - mmc: jz4740: Fix race condition in IRQ mask update
    - mmc: tmio: Fix error handling when issuing CMD23
    - PCI: Mark Broadcom HT1100 and HT2000 Root Port Extended Tags as broken
    - clk: mvebu: armada-38x: add support for missing clocks
    - clk: fix false-positive Wmaybe-uninitialized warning
    - clk: mediatek: fix PWM clock source by adding a fixed-factor clock
    - clk: bcm2835: De-assert/assert PLL reset signal when appropriate
    - pwm: rcar: Fix a condition to prevent mismatch value setting to duty
    - thermal: imx: Fix race condition in imx_thermal_probe()
    - dt-bindings: clock: mediatek: add binding for fixed-factor clock axisel_d4
    - watchdog: f71808e_wdt: Fix WD_EN register read
    - ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
    - ALSA: pcm: Avoid potential races between OSS ioctls and read/write
    - ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
    - ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
    - ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
    - drm/amdgpu: Add an ATPX quirk for hybrid laptop
    - drm/amdgpu: Fix always_valid bos multiple LRU insertions.
    - drm/amdgpu/sdma: fix mask in emit_pipeline_sync
    - drm/amdgpu: Fix PCIe lane width calculation
    - drm/amdgpu/si: implement get/set pcie_lanes asic callback
    - drm/rockchip: Clear all interrupts before requesting the IRQ
    - drm/radeon: add PX quirk for Asus K73TK
    - drm/radeon: Fix PCIe lane width calculation
    - ALSA: line6: Use correct endpoint type for midi output
    - ALSA: rawmidi: Fix missing input substream checks in compat ioctls
    - ALSA: hda - New VIA controller suppor no-snoop path
    - random: fix crng_ready() test
    - random: use a different mixing algorithm for add_device_randomness()
    - random: crng_reseed() should lock the crng instance that it is modifying
    - random: add new ioctl RNDRESEEDCRNG
    - HID: input: fix battery level reporting on BT mice
    - HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
    - HID: wacom: bluetooth: send exit report for recent Bluetooth devices
    - MIPS: uaccess: Add micromips clobbers to bzero invocation
    - MIPS: memset.S: EVA & fault support for small_memset
    - MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
    - MIPS: memset.S: Fix clobber of v1 in last_fixup
    - powerpc/eeh: Fix enabling bridge MMIO windows
    - powerpc/lib: Fix off-by-one in alternate feature patching
    - udf: Fix leak of UTF-16 surrogates into encoded strings
    - fanotify: fix logic of events on child
    - mmc: sdhci-pci: Only do AMD tuning for HS200
    - drm/i915: Correctly handle limited range YCbCr data on VLV/CHV
    - jffs2_kill_sb(): deal with failed allocations
    - hypfs_kill_super(): deal with failed allocations
    - orangefs_kill_sb(): deal with allocation failures
    - rpc_pipefs: fix double-dput()
    - Don't leak MNT_INTERNAL away from internal mounts
    - autofs: mount point create should honour passed in mode
    - mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
    - Revert "media: lirc_zilog: driver only sends LIRCCODE"
    - media: staging: lirc_zilog: incorrect reference counting
    - writeback: safer lock nesting
    - Bluetooth: hci_bcm: Add irq_polarity module option
    - mm: hwpoison: disable memory error handling on 1GB hugepage
    - media: rc: oops in ir_timer_keyup after device unplug
    - acpi, nfit: rework NVDIMM leaf method detection
    - ceph: always update atime/mtime/ctime for new inode
    - ext4: fix offset overflow on 32-bit archs in ext4_iomap_begin()
    - ext4: force revalidation of directory pointer after seekdir(2)
    - RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access
    - xprtrdma: Fix latency regression on NUMA NFS/RDMA clients
    - xprtrdma: Fix corner cases when handling device removal
    - IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()
    - drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4
    - drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4
    - mmc: core: Prevent bus reference leak in mmc_blk_init()
    - drm/amd/display: HDMI has no sound after Panel power off/on
    - trace_uprobe: Use %lx to display offset
    - clk: tegra: Mark HCLK, SCLK and EMC as critical
    - pwm: mediatek: Fix up PWM4 and PWM5 malfunction on MT7623
    - pwm: mediatek: Improve precision in rate calculation
    - HID: i2c-hid: Fix resume issue on Raydium touchscreen device
    - s390: add support for IBM z14 Model ZR1
    - drm/i915: Fix hibernation with ACPI S0 target state
    - libnvdimm, dimm: handle EACCES failures from label reads
    - device-dax: allow MAP_SYNC to succeed
    - HID: i2c-hid: fix inverted return value from i2c_hid_command()

  * CVE-2018-7755
    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 12 Jun 2018 18:09:35 +0200

linux (4.15.0-23.25) bionic; urgency=medium

  * linux: 4.15.0-23.25 -proposed tracker (LP: #1772927)

  * arm64 SDEI support needs trampoline code for KPTI (LP: #1768630)
    - arm64: mmu: add the entry trampolines start/end section markers into
      sections.h
    - arm64: sdei: Add trampoline code for remapping the kernel

  * Some PCIe errors not surfaced through rasdaemon (LP: #1769730)
    - ACPI: APEI: handle PCIe AER errors in separate function
    - ACPI: APEI: call into AER handling regardless of severity

  * qla2xxx: Fix page fault at kmem_cache_alloc_node() (LP: #1770003)
    - scsi: qla2xxx: Fix session cleanup for N2N
    - scsi: qla2xxx: Remove unused argument from qlt_schedule_sess_for_deletion()
    - scsi: qla2xxx: Serialize session deletion by using work_lock
    - scsi: qla2xxx: Serialize session free in qlt_free_session_done
    - scsi: qla2xxx: Don't call dma_free_coherent with IRQ disabled.
    - scsi: qla2xxx: Fix warning in qla2x00_async_iocb_timeout()
    - scsi: qla2xxx: Prevent relogin trigger from sending too many commands
    - scsi: qla2xxx: Fix double free bug after firmware timeout
    - scsi: qla2xxx: Fixup locking for session deletion

  * Several hisi_sas bug fixes (LP: #1768974)
    - scsi: hisi_sas: dt-bindings: add an property of signal attenuation
    - scsi: hisi_sas: support the property of signal attenuation for v2 hw
    - scsi: hisi_sas: fix the issue of link rate inconsistency
    - scsi: hisi_sas: fix the issue of setting linkrate register
    - scsi: hisi_sas: increase timer expire of internal abort task
    - scsi: hisi_sas: remove unused variable hisi_sas_devices.running_req
    - scsi: hisi_sas: fix return value of hisi_sas_task_prep()
    - scsi: hisi_sas: Code cleanup and minor bug fixes

  * [bionic] machine stuck and bonding not working well when nvmet_rdma module
    is loaded (LP: #1764982)
    - nvmet-rdma: Don't flush system_wq by default during remove_one
    - nvme-rdma: Don't flush delete_wq by default during remove_one

  * Warnings/hang during error handling of SATA disks on SAS controller
    (LP: #1768971)
    - scsi: libsas: defer ata device eh commands to libata

  * Hotplugging a SATA disk into a SAS controller may cause crash (LP: #1768948)
    - ata: do not schedule hot plug if it is a sas host

  * ISST-LTE:pKVM:Ubuntu1804: rcu_sched self-detected stall on CPU follow by CPU
    ATTEMPT TO RE-ENTER FIRMWARE! (LP: #1767927)
    - powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
    - powerpc/64s: return more carefully from sreset NMI
    - powerpc/64s: sreset panic if there is no debugger or crash dump handlers

  * fsnotify: Fix fsnotify_mark_connector race (LP: #1765564)
    - fsnotify: Fix fsnotify_mark_connector race

  * Hang on network interface removal in Xen virtual machine (LP: #1771620)
    - xen-netfront: Fix hang on device removal

  * HiSilicon HNS NIC names are truncated in /proc/interrupts (LP: #1765977)
    - net: hns: Avoid action name truncation

  * Ubuntu 18.04 kernel crashed while in degraded mode (LP: #1770849)
    - SAUCE: powerpc/perf: Fix memory allocation for core-imc based on
      num_possible_cpus()

  * Switch Build-Depends: transfig to fig2dev (LP: #1770770)
    - [Config] update Build-Depends: transfig to fig2dev

  * smp_call_function_single/many core hangs with stop4 alone (LP: #1768898)
    - cpufreq: powernv: Fix hardlockup due to synchronous smp_call in timer
      interrupt

  * Add d-i support for Huawei NICs (LP: #1767490)
    - d-i: add hinic to nic-modules udeb

  * unregister_netdevice: waiting for eth0 to become free. Usage count = 5
    (LP: #1746474)
    - xfrm: reuse uncached_list to track xdsts

  * Include nfp driver in linux-modules (LP: #1768526)
    - [Config] Add nfp.ko to generic inclusion list

  * Kernel panic on boot (m1.small in cn-north-1) (LP: #1771679)
    - x86/xen: Reset VCPU0 info pointer after shared_info remap

  * CVE-2018-3639 (x86)
    - x86/bugs: Fix the parameters alignment and missing void
    - KVM: SVM: Move spec control call after restore of GS
    - x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
    - x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS
    - x86/cpufeatures: Disentangle SSBD enumeration
    - x86/cpufeatures: Add FEATURE_ZEN
    - x86/speculation: Handle HT correctly on AMD
    - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
    - x86/speculation: Add virtualized speculative store bypass disable support
    - x86/speculation: Rework speculative_store_bypass_update()
    - x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host}
    - x86/bugs: Expose x86_spec_ctrl_base directly
    - x86/bugs: Remove x86_spec_ctrl_set()
    - x86/bugs: Rework spec_ctrl base and mask logic
    - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG
    - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
    - x86/bugs: Rename SSBD_NO to SSB_NO
    - bpf: Prevent memory disambiguation attack
    - KVM: VMX: Expose SSBD properly to guests.

  * Suspend to idle: Open lid didn't resume (LP: #1771542)
    - ACPI / PM: Do not reconfigure GPEs for suspend-to-idle

  * Fix initialization failure detection in SDEI for device-tree based systems
    (LP: #1768663)
    - firmware: arm_sdei: Fix return value check in sdei_present_dt()

  * No driver for Huawei network adapters on arm64 (LP: #1769899)
    - net-next/hinic: add arm64 support

  * CVE-2018-1092
    - ext4: fail ext4_iget for root directory if unallocated

  * kernel 4.15 breaks nouveau on Lenovo P50 (LP: #1763189)
    - drm/nouveau: Fix deadlock in nv50_mstm_register_connector()

  * update-initramfs not adding i915 GuC firmware for Kaby Lake, firmware fails
    to load (LP: #1728238)
    - Revert "UBUNTU: SAUCE: (no-up) i915: Remove MODULE_FIRMWARE statements for
      unreleased firmware"

  * Battery drains when laptop is off  (shutdown) (LP: #1745646)
    - PCI / PM: Check device_may_wakeup() in pci_enable_wake()

  * Dell Latitude 5490/5590 BIOS update 1.1.9 causes black screen at boot
    (LP: #1764194)
    - drm/i915/bios: filter out invalid DDC pins from VBT child devices

  * Intel 9462 A370:42A4 doesn't work (LP: #1748853)
    - iwlwifi: add shared clock PHY config flag for some devices
    - iwlwifi: add a bunch of new 9000 PCI IDs

  * Fix an issue that some PCI devices get incorrectly suspended (LP: #1764684)
    - PCI / PM: Always check PME wakeup capability for runtime wakeup support

  * [SRU][Bionic/Artful] fix false positives in W+X checking (LP: #1769696)
    - init: fix false positives in W+X checking

  * Bionic update to v4.15.18 stable release (LP: #1769723)
    - netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is added to
      ip_set_net_exit()
    - cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
    - rds: MP-RDS may use an invalid c_path
    - slip: Check if rstate is initialized before uncompressing
    - vhost: fix vhost_vq_access_ok() log check
    - l2tp: fix races in tunnel creation
    - l2tp: fix race in duplicate tunnel detection
    - ip_gre: clear feature flags when incompatible o_flags are set
    - vhost: Fix vhost_copy_to_user()
    - lan78xx: Correctly indicate invalid OTP
    - media: v4l2-compat-ioctl32: don't oops on overlay
    - media: v4l: vsp1: Fix header display list status check in continuous mode
    - ipmi: Fix some error cleanup issues
    - parisc: Fix out of array access in match_pci_device()
    - parisc: Fix HPMC handler by increasing size to multiple of 16 bytes
    - Drivers: hv: vmbus: do not mark HV_PCIE as perf_device
    - PCI: hv: Serialize the present and eject work items
    - PCI: hv: Fix 2 hang issues in hv_compose_msi_msg()
    - KVM: PPC: Book3S HV: trace_tlbie must not be called in realmode
    - perf/core: Fix use-after-free in uprobe_perf_close()
    - x86/mce/AMD: Get address from already initialized block
    - hwmon: (ina2xx) Fix access to uninitialized mutex
    - ath9k: Protect queue draining by rcu_read_lock()
    - x86/apic: Fix signedness bug in APIC ID validity checks
    - f2fs: fix heap mode to reset it back
    - block: Change a rcu_read_{lock,unlock}_sched() pair into
      rcu_read_{lock,unlock}()
    - nvme: Skip checking heads without namespaces
    - lib: fix stall in __bitmap_parselist()
    - blk-mq: order getting budget and driver tag
    - blk-mq: don't keep offline CPUs mapped to hctx 0
    - ovl: fix lookup with middle layer opaque dir and absolute path redirects
    - xen: xenbus_dev_frontend: Fix XS_TRANSACTION_END handling
    - hugetlbfs: fix bug in pgoff overflow checking
    - nfsd: fix incorrect umasks
    - scsi: qla2xxx: Fix small memory leak in qla2x00_probe_one on probe failure
    - block/loop: fix deadlock after loop_set_status
    - nfit: fix region registration vs block-data-window ranges
    - s390/qdio: don't retry EQBS after CCQ 96
    - s390/qdio: don't merge ERROR output buffers
    - s390/ipl: ensure loadparm valid flag is set
    - get_user_pages_fast(): return -EFAULT on access_ok failure
    - mm/gup_benchmark: handle gup failures
    - getname_kernel() needs to make sure that ->name != ->iname in long case
    - Bluetooth: Fix connection if directed advertising and privacy is used
    - Bluetooth: hci_bcm: Treat Interrupt ACPI resources as always being active-
      low
    - rtl8187: Fix NULL pointer dereference in priv->conf_mutex
    - ovl: set lower layer st_dev only if setting lower st_ino
    - Linux 4.15.18

  * Kernel bug when unplugging Thunderbolt 3 cable, leaves xHCI host controller
    dead (LP: #1768852)
    - xhci: Fix Kernel oops in xhci dbgtty

  * Incorrect blacklist of bcm2835_wdt (LP: #1766052)
    - [Packaging] Fix missing watchdog for Raspberry Pi

  * CVE-2018-8087
    - mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()

  * Integrated Webcam Realtek Integrated_Webcam_HD (0bda:58f4) not working in
    DELL XPS 13 9370 with firmware 1.50 (LP: #1763748)
    - SAUCE: media: uvcvideo: Support realtek's UVC 1.5 device

  * [ALSA] [PATCH] Clevo P950ER ALC1220 Fixup (LP: #1769721)
    - SAUCE: ALSA: hda/realtek - Clevo P950ER ALC1220 Fixup

  * Bionic: Intermittently sent to Emergency Mode on boot with unhandled kernel
    NULL pointer dereference at  0000000000000980 (LP: #1768292)
    - thunderbolt: Prevent crash when ICM firmware is not running

  * linux-snapdragon: reduce EPROBEDEFER noise during boot (LP: #1768761)
    - [Config] snapdragon: DRM_I2C_ADV7511=y

  * regression Aquantia Corp. AQC107 4.15.0-13-generic -> 4.15.0-20-generic ?
    (LP: #1767088)
    - net: aquantia: Regression on reset with 1.x firmware
    - net: aquantia: oops when shutdown on already stopped device

  * e1000e msix interrupts broken in linux-image-4.15.0-15-generic
    (LP: #1764892)
    - e1000e: Remove Other from EIAC

  * Acer Swift sf314-52 power button not managed  (LP: #1766054)
    - SAUCE: platform/x86: acer-wmi: add another KEY_POWER keycode

  * set PINCFG_HEADSET_MIC to parse_flags for Dell precision 3630 (LP: #1766398)
    - ALSA: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags

  * Change the location for one of two front mics on a lenovo thinkcentre
    machine (LP: #1766477)
    - ALSA: hda/realtek - adjust the location of one mic

  * SRU: bionic: apply 50 ZFS upstream bugfixes (LP: #1764690)
    - SAUCE: (noup) Update zfs to 0.7.5-1ubuntu15 (LP: #1764690)

  * [8086:3e92] display becomes blank after S3 (LP: #1763271)
    - drm/i915/edp: Do not do link training fallback or prune modes on EDP

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 23 May 2018 18:54:55 +0200

linux (4.15.0-22.24) bionic; urgency=medium

  * CVE-2018-3639 (powerpc)
    - powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit
    - stf-barrier: set eieio instruction bit 6 for future optimisations

  * CVE-2018-3639 (x86)
    - x86/nospec: Simplify alternative_msr_write()
    - x86/bugs: Concentrate bug detection into a separate function
    - x86/bugs: Concentrate bug reporting into a separate function
    - x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits
    - x86/bugs, KVM: Support the combination of guest and host IBRS
    - x86/bugs: Expose /sys/../spec_store_bypass
    - x86/cpufeatures: Add X86_FEATURE_RDS
    - x86/bugs: Provide boot parameters for the spec_store_bypass_disable
      mitigation
    - x86/bugs/intel: Set proper CPU features and setup RDS
    - x86/bugs: Whitelist allowed SPEC_CTRL MSR values
    - x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested
    - x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
    - x86/speculation: Create spec-ctrl.h to avoid include hell
    - prctl: Add speculation control prctls
    - x86/process: Allow runtime control of Speculative Store Bypass
    - x86/speculation: Add prctl for Speculative Store Bypass mitigation
    - nospec: Allow getting/setting on non-current task
    - proc: Provide details on speculation flaw mitigations
    - seccomp: Enable speculation flaw mitigations
    - x86/bugs: Make boot modes __ro_after_init
    - prctl: Add force disable speculation
    - seccomp: Use PR_SPEC_FORCE_DISABLE
    - seccomp: Add filter flag to opt-out of SSB mitigation
    - seccomp: Move speculation migitation control to arch code
    - x86/speculation: Make "seccomp" the default mode for Speculative Store
      Bypass
    - x86/bugs: Rename _RDS to _SSBD
    - proc: Use underscores for SSBD in 'status'
    - Documentation/spec_ctrl: Do some minor cleanups
    - x86/bugs: Fix __ssb_select_mitigation() return type
    - x86/bugs: Make cpu_show_common() static

  * LSM Stacking prctl values should be redefined as to not collide with
    upstream prctls (LP: #1769263) // CVE-2018-3639
    - SAUCE: LSM stacking: adjust prctl values

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 15 May 2018 07:41:28 +0200

linux (4.15.0-21.22) bionic; urgency=medium

  * linux: 4.15.0-21.22 -proposed tracker (LP: #1767397)

  * initramfs-tools exception during pm.DoInstall with  do-release-upgrade from
    16.04 to 18.04  (LP: #1766727)
    - Add linux-image-* Breaks on s390-tools (<< 2.3.0-0ubuntu3)

  * linux-image-4.15.0-20-generic install after upgrade from xenial breaks
    (LP: #1767133)
    - Packaging: Depends on linux-base that provides the necessary tools

  * linux-image packages need to Breaks flash-kernel << 3.90ubuntu2
    (LP: #1766629)
    - linux-image-* breaks on flash-kernel (<< 3.90ubuntu2)

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 30 Apr 2018 14:58:35 -0300

linux (4.15.0-20.21) bionic; urgency=medium

  * linux: 4.15.0-20.21 -proposed tracker (LP: #1766452)

  * package shim-signed (not installed) failed to install/upgrade: installed
    shim-signed package post-installation script subprocess returned error exit
    status 5 (LP: #1766391)
    - [Packaging] fix invocation of header postinst hooks

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Apr 2018 23:56:17 -0500

linux (4.15.0-19.20) bionic; urgency=medium

  * linux: 4.15.0-19.20 -proposed tracker (LP: #1766021)

  * Kernel 4.15.0-15 breaks Dell PowerEdge 12th Gen servers (LP: #1765232)
    - Revert "blk-mq: simplify queue mapping & schedule with each possisble CPU"
    - Revert "genirq/affinity: assign vectors to all possible CPUs"

 -- Seth Forshee <seth.forshee@canonical.com>  Sat, 21 Apr 2018 17:19:00 -0500

linux (4.15.0-18.19) bionic; urgency=medium

  * linux: 4.15.0-18.19 -proposed tracker (LP: #1765490)

  * [regression] Ubuntu 18.04:[4.15.0-17-generic #18] KVM Guest Kernel:
    meltdown: rfi/fallback displacement flush not enabled bydefault (kvm)
    (LP: #1765429)
    - powerpc/pseries: Fix clearing of security feature flags

  * signing: only install a signed kernel (LP: #1764794)
    - [Packaging] update to Debian like control scripts
    - [Packaging] switch to triggers for postinst.d postrm.d handling
    - [Packaging] signing -- switch to raw-signing tarballs
    - [Packaging] signing -- switch to linux-image as signed when available
    - [Config] signing -- enable Opal signing for ppc64el
    - [Packaging] printenv -- add signing options

  * [18.04 FEAT] Sign POWER host/NV kernels (LP: #1696154)
    - [Packaging] signing -- add support for signing Opal kernel binaries

  * Please cherrypick s390 unwind fix (LP: #1765083)
    - s390/compat: fix setup_frame32

  * Ubuntu 18.04 installer does not detect any IPR based HDD/RAID array [S822L]
    [ipr] (LP: #1751813)
    - d-i: move ipr to storage-core-modules on ppc64el

  * drivers/gpu/drm/bridge/adv7511/adv7511.ko missing (LP: #1764816)
    - SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm

  * Miscellaneous Ubuntu changes
    - [Packaging] Add linux-oem to rebuild test blacklist.

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 19 Apr 2018 18:06:46 -0300

linux (4.15.0-17.18) bionic; urgency=medium

  * linux: 4.15.0-17.18 -proposed tracker (LP: #1764498)

  * Eventual OOM with profile reloads (LP: #1750594)
    - SAUCE: apparmor: fix memory leak when duplicate profile load

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 16 Apr 2018 14:48:18 -0500

linux (4.15.0-16.17) bionic; urgency=medium

  * linux: 4.15.0-16.17 -proposed tracker (LP: #1763785)

  * [18.04] [bug] CFL-S(CNP)/CNL GPIO testing failed (LP: #1757346)
    - [Config]: Set CONFIG_PINCTRL_CANNONLAKE=y

  * [Ubuntu 18.04] USB Type-C test failed on GLK (LP: #1758797)
    - SAUCE: usb: typec: ucsi: Increase command completion timeout value

  * Fix trying to "push" an already active pool VP (LP: #1763386)
    - SAUCE: powerpc/xive: Fix trying to "push" an already active pool VP

  * hisi_sas: Revert and replace SAUCE patches w/ upstream (LP: #1762824)
    - Revert "UBUNTU: SAUCE: scsi: hisi_sas: export device table of v3 hw to
      userspace"
    - Revert "UBUNTU: SAUCE: scsi: hisi_sas: config for hip08 ES"
    - scsi: hisi_sas: modify some register config for hip08
    - scsi: hisi_sas: add v3 hw MODULE_DEVICE_TABLE()

  * Realtek card reader - RTS5243 [VEN_10EC&DEV_5260] (LP: #1737673)
    - misc: rtsx: Move Realtek Card Reader Driver to misc
    - updateconfigs for Realtek Card Reader Driver
    - misc: rtsx: Add support for RTS5260
    - misc: rtsx: Fix symbol clashes

  * Mellanox [mlx5] [bionic] UBSAN: Undefined behaviour in
    ./include/linux/net_dim.h (LP: #1763269)
    - net/mlx5e: Fix int overflow

  * apparmor bug fixes for bionic (LP: #1763427)
    - apparmor: fix logging of the existence test for signals
    - apparmor: make signal label match work when matching stacked labels
    - apparmor: audit unknown signal numbers
    - apparmor: fix memory leak on buffer on error exit path
    - apparmor: fix mediation of prlimit

  * dangling symlinks to loaded apparmor policy (LP: #1755563) // apparmor bug
    fixes for bionic (LP: #1763427)
    - apparmor: fix dangling symlinks to policy rawdata after replacement

  * [OPAL] Assert fail:
    core/mem_region.c:447:lock_held_by_me(&region->free_list_lock)
    (LP: #1762913)
    - powerpc/watchdog: remove arch_trigger_cpumask_backtrace

  * [LTC Test] Ubuntu 18.04: tm_trap_test failed on P8 compat mode guest
    (LP: #1762928)
    - powerpc/tm: Fix endianness flip on trap

  * Add support for RT5660 codec based sound cards on Baytrail (LP: #1657674)
    - SAUCE: (no-up) ASoC: Intel: Support machine driver for RT5660 on Baytrail
    - SAUCE: (no-up) ASoC: rt5660: Add ACPI support
    - SAUCE: (no-up): ASoC: Intel: bytcr-rt5660: Add MCLK, quirks
    - [Config] CONFIG_SND_SOC_INTEL_BYTCR_RT5660_MACH=m, CONFIG_SND_SOC_RT5660=m

  * /dev/ipmi enumeration flaky on Cavium Sabre nodes (LP: #1762812)
    - i2c: xlp9xx: return ENXIO on slave address NACK
    - i2c: xlp9xx: Handle transactions with I2C_M_RECV_LEN properly
    - i2c: xlp9xx: Check for Bus state before every transfer
    - i2c: xlp9xx: Handle NACK on DATA properly

  * [18.04 FEAT] Add kvm_stat from kernel tree (LP: #1734130)
    - tools/kvm_stat: simplify the sortkey function
    - tools/kvm_stat: use a namedtuple for storing the values
    - tools/kvm_stat: use a more pythonic way to iterate over dictionaries
    - tools/kvm_stat: avoid 'is' for equality checks
    - tools/kvm_stat: fix crash when filtering out all non-child trace events
    - tools/kvm_stat: print error on invalid regex
    - tools/kvm_stat: fix debugfs handling
    - tools/kvm_stat: mark private methods as such
    - tools/kvm_stat: eliminate extra guest/pid selection dialog
    - tools/kvm_stat: separate drilldown and fields filtering
    - tools/kvm_stat: group child events indented after parent
    - tools/kvm_stat: print 'Total' line for multiple events only
    - tools/kvm_stat: Fix python3 syntax
    - tools/kvm_stat: Don't use deprecated file()
    - tools/kvm_stat: Remove unused function
    - [Packaging] Add linux-tools-host package for VM host tools
    - [Config] do_tools_host=true for amd64

  * Bionic update to v4.15.17 stable release (LP: #1763366)
    - i40iw: Fix sequence number for the first partial FPDU
    - i40iw: Correct Q1/XF object count equation
    - i40iw: Validate correct IRD/ORD connection parameters
    - clk: meson: mpll: use 64-bit maths in params_from_rate
    - ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
    - Bluetooth: Add a new 04ca:3015 QCA_ROME device
    - ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
    - thermal: power_allocator: fix one race condition issue for thermal_instances
      list
    - perf probe: Find versioned symbols from map
    - perf probe: Add warning message if there is unexpected event name
    - perf evsel: Fix swap for samples with raw data
    - perf evsel: Enable ignore_missing_thread for pid option
    - l2tp: fix missing print session offset info
    - rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
    - ACPI / video: Default lcd_only to true on Win8-ready and newer machines
    - IB/mlx5: Report inner RSS capability
    - VFS: close race between getcwd() and d_move()
    - watchdog: dw_wdt: add stop watchdog operation
    - clk: divider: fix incorrect usage of container_of
    - PM / devfreq: Fix potential NULL pointer dereference in governor_store
    - gpiolib: don't dereference a desc before validation
    - net_sch: red: Fix the new offload indication
    - selftests/net: fix bugs in address and port initialization
    - thermal/drivers/hisi: Remove bogus const from function return type
    - RDMA/cma: Mark end of CMA ID messages
    - hwmon: (ina2xx) Make calibration register value fixed
    - f2fs: fix lock dependency in between dio_rwsem & i_mmap_sem
    - clk: sunxi-ng: a83t: Add M divider to TCON1 clock
    - media: videobuf2-core: don't go out of the buffer range
    - ASoC: Intel: Skylake: Disable clock gating during firmware and library
      download
    - ASoC: Intel: cht_bsw_rt5645: Analog Mic support
    - drm/msm: Fix NULL deref in adreno_load_gpu
    - IB/ipoib: Fix for notify send CQ failure messages
    - spi: sh-msiof: Fix timeout failures for TX-only DMA transfers
    - scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
    - irqchip/ompic: fix return value check in ompic_of_init()
    - irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
    - ACPI: EC: Fix debugfs_create_*() usage
    - mac80211: Fix setting TX power on monitor interfaces
    - vfb: fix video mode and line_length being set when loaded
    - crypto: crypto4xx - perform aead icv check in the driver
    - gpio: label descriptors using the device name
    - arm64: asid: Do not replace active_asids if already 0
    - powernv-cpufreq: Add helper to extract pstate from PMSR
    - IB/rdmavt: Allocate CQ memory on the correct node
    - blk-mq: avoid to map CPU into stale hw queue
    - blk-mq: fix race between updating nr_hw_queues and switching io sched
    - backlight: tdo24m: Fix the SPI CS between transfers
    - nvme-fabrics: protect against module unload during create_ctrl
    - nvme-fabrics: don't check for non-NULL module in nvmf_register_transport
    - pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
    - nvme_fcloop: disassocate local port structs
    - nvme_fcloop: fix abort race condition
    - tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented
    - perf report: Fix a no annotate browser displayed issue
    - staging: lustre: disable preempt while sampling processor id.
    - ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
    - power: supply: axp288_charger: Properly stop work on probe-error / remove
    - rt2x00: do not pause queue unconditionally on error path
    - wl1251: check return from call to wl1251_acx_arp_ip_filter
    - net/mlx5: Fix race for multiple RoCE enable
    - bcache: ret IOERR when read meets metadata error
    - bcache: stop writeback thread after detaching
    - bcache: segregate flash only volume write streams
    - net: Fix netdev_WARN_ONCE macro
    - net/mlx5e: IPoIB, Use correct timestamp in child receive flow
    - blk-mq: fix kernel oops in blk_mq_tag_idle()
    - tty: n_gsm: Allow ADM response in addition to UA for control dlci
    - block, bfq: put async queues for root bfq groups too
    - serdev: Fix serdev_uevent failure on ACPI enumerated serdev-controllers
    - EDAC, mv64x60: Fix an error handling path
    - uio_hv_generic: check that host supports monitor page
    - Bluetooth: hci_bcm: Mandate presence of shutdown and device wake GPIO
    - Bluetooth: hci_bcm: Validate IRQ before using it
    - Bluetooth: hci_bcm: Make shutdown and device wake GPIO optional
    - i40evf: don't rely on netif_running() outside rtnl_lock()
    - drm/amd/powerplay: fix memory leakage when reload (v2)
    - cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
    - PM / domains: Don't skip driver's ->suspend|resume_noirq() callbacks
    - scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware
      in RAID map
    - scsi: megaraid_sas: unload flag should be set after scsi_remove_host is
      called
    - RDMA/cma: Fix rdma_cm path querying for RoCE
    - gpio: thunderx: fix error return code in thunderx_gpio_probe()
    - x86/gart: Exclude GART aperture from vmcore
    - sdhci: Advertise 2.0v supply on SDIO host controller
    - Input: goodix - disable IRQs while suspended
    - mtd: mtd_oobtest: Handle bitflips during reads
    - crypto: aes-generic - build with -Os on gcc-7+
    - perf tools: Fix copyfile_offset update of output offset
    - tcmu: release blocks for partially setup cmds
    - thermal: int3400_thermal: fix error handling in int3400_thermal_probe()
    - drm/i915/cnp: Ignore VBT request for know invalid DDC pin.
    - drm/i915/cnp: Properly handle VBT ddc pin out of bounds.
    - x86/microcode: Propagate return value from updating functions
    - x86/CPU: Add a microcode loader callback
    - x86/CPU: Check CPU feature bits after microcode upgrade
    - x86/microcode: Get rid of struct apply_microcode_ctx
    - x86/microcode/intel: Check microcode revision before updating sibling
      threads
    - x86/microcode/intel: Writeback and invalidate caches before updating
      microcode
    - x86/microcode: Do not upload microcode if CPUs are offline
    - x86/microcode/intel: Look into the patch cache first
    - x86/microcode: Request microcode on the BSP
    - x86/microcode: Synchronize late microcode loading
    - x86/microcode: Attempt late loading only when new microcode is present
    - x86/microcode: Fix CPU synchronization routine
    - arp: fix arp_filter on l3slave devices
    - ipv6: the entire IPv6 header chain must fit the first fragment
    - lan78xx: Crash in lan78xx_writ_reg (Workqueue: events
      lan78xx_deferred_multicast_write)
    - net: dsa: Discard frames from unused ports
    - net: fix possible out-of-bound read in skb_network_protocol()
    - net/ipv6: Fix route leaking between VRFs
    - net/ipv6: Increment OUTxxx counters after netfilter hook
    - netlink: make sure nladdr has correct size in netlink_connect()
    - net/mlx5e: Verify coalescing parameters in range
    - net sched actions: fix dumping which requires several messages to user space
    - net/sched: fix NULL dereference in the error path of tcf_bpf_init()
    - pptp: remove a buggy dst release in pptp_connect()
    - r8169: fix setting driver_data after register_netdev
    - sctp: do not leak kernel memory to user space
    - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
    - vhost: correctly remove wait queue during poll failure
    - vlan: also check phy_driver ts_info for vlan's real device
    - vrf: Fix use after free and double free in vrf_finish_output
    - bonding: fix the err path for dev hwaddr sync in bond_enslave
    - bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
    - bonding: process the err returned by dev_set_allmulti properly in
      bond_enslave
    - net: fool proof dev_valid_name()
    - ip_tunnel: better validate user provided tunnel names
    - ipv6: sit: better validate user provided tunnel names
    - ip6_gre: better validate user provided tunnel names
    - ip6_tunnel: better validate user provided tunnel names
    - vti6: better validate user provided tunnel names
    - net/mlx5e: Set EQE based as default TX interrupt moderation mode
    - net_sched: fix a missing idr_remove() in u32_delete_key()
    - net/sched: fix NULL dereference in the error path of tcf_vlan_init()
    - net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path
    - net/mlx5e: Fix memory usage issues in offloading TC flows
    - net/sched: fix NULL dereference in the error path of tcf_sample_init()
    - nfp: use full 40 bits of the NSP buffer address
    - ipv6: sr: fix seg6 encap performances with TSO enabled
    - net/mlx5e: Don't override vport admin link state in switchdev mode
    - net/mlx5e: Sync netdev vxlan ports at open
    - net/sched: fix NULL dereference in the error path of tunnel_key_init()
    - net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
    - strparser: Fix sign of err codes
    - net/mlx4_en: Fix mixed PFC and Global pause user control requests
    - net/mlx5e: Fix traffic being dropped on VF representor
    - vhost: validate log when IOTLB is enabled
    - route: check sysctl_fib_multipath_use_neigh earlier than hash
    - team: move dev_mc_sync after master_upper_dev_link in team_port_add
    - vhost_net: add missing lock nesting notation
    - net/mlx4_core: Fix memory leak while delete slave's resources
    - Linux 4.15.17

  * sky2 gigabit ethernet driver sometimes stops working after lid-open resume
    from sleep (88E8055) (LP: #1758507) // Bionic update to v4.15.17 stable
    release (LP: #1763366)
    - sky2: Increase D3 delay to sky2 stops working after suspend

  * [Featire] CNL: Enable RAPL support (LP: #1685712)
    - powercap: RAPL: Add support for Cannon Lake

  * System Z {kernel} UBUNTU18.04 wrong kernel config (LP: #1762719)
    - s390: move nobp parameter functions to nospec-branch.c
    - s390: add automatic detection of the spectre defense
    - s390: report spectre mitigation via syslog
    - s390: add sysfs attributes for spectre
    - [Config] CONFIG_EXPOLINE_AUTO=y, CONFIG_KERNEL_NOBP=n for s390
    - s390: correct nospec auto detection init order

  * Merge the linux-snapdragon kernel into bionic master/snapdragon
    (LP: #1763040)
    - drm/msm: fix spelling mistake: "ringubffer" -> "ringbuffer"
    - drm/msm: fix msm_rd_dump_submit prototype
    - drm/msm: gpu: Only sync fences on rings that exist
    - wcn36xx: set default BTLE coexistence config
    - wcn36xx: Add hardware scan offload support
    - wcn36xx: Reduce spinlock in indication handler
    - wcn36xx: fix incorrect assignment to msg_body.min_ch_time
    - wcn36xx: release DMA memory in case of error
    - mailbox: qcom: Convert APCS IPC driver to use regmap
    - mailbox: qcom: Create APCS child device for clock controller
    - clk: qcom: Add A53 PLL support
    - clk: qcom: Add regmap mux-div clocks support
    - clk: qcom: Add APCS clock controller support
    - clk: qcom: msm8916: Fix return value check in qcom_apcs_msm8916_clk_probe()
    - media: venus: venc: set correctly GOP size and number of B-frames
    - media: venus: venc: configure entropy mode
    - media: venus: venc: Apply inloop deblocking filter
    - media: venus: cleanup set_property controls
    - arm64: defconfig: enable REMOTEPROC
    - arm64: defconfig: enable QCOM audio drivers for APQ8016 and DB410c
    - kernel: configs; add distro.config
    - arm64: configs: enable WCN36xx
    - kernel: distro.config: enable debug friendly USB network adpater
    - arm64: configs: enable QCOM Venus
    - arm64: defconfig: Enable a53/apcs and avs
    - arm64: defconfig: enable ondemand governor as default
    - arm64: defconfig: enable QCOM_TSENS
    - arm64: defconfig: enable new trigger modes for leds
    - kernel: configs: enable dm_mod and dm_crypt
    - Force the SMD regulator driver to be compiled-in
    - arm64: defconfig: enable CFG80211_DEFAULT_PS by default
    - arm64: configs: enable BT_QCOMSMD
    - kernel: configs: add more USB net drivers
    - arm64: defconfig: disable ANALOG_TV and DIGITAL_TV
    - arm64: configs: Enable camera drivers
    - kernel: configs: add freq stat to sysfs
    - arm64: defconfig: enable CONFIG_USB_CONFIGFS_F_FS by default
    - arm64: defconfig: Enable QRTR features
    - kernel: configs: set USB_CONFIG_F_FS in distro.config
    - kernel: distro.config: enable 'schedutil' CPUfreq governor
    - kernel: distro.config: enable 'fq' and 'fq_codel' qdiscs
    - kernel: distro.config: enable 'BBR' TCP congestion algorithm
    - arm64: defconfig: enable LEDS_QCOM_LPG
    - HACK: drm/msm/iommu: Remove runtime_put calls in map/unmap
    - power: avs: Add support for CPR (Core Power Reduction)
    - power: avs: cpr: Use raw mem access for qfprom
    - power: avs: cpr: fix with new reg_sequence structures
    - power: avs: cpr: Register with cpufreq-dt
    - regulator: smd: Add floor and corner operations
    - PM / OPP: Support adjusting OPP voltages at runtime
    - PM / OPP: Drop RCU usage in dev_pm_opp_adjust_voltage()
    - PM / OPP: HACK: Allow to set regulator without opp_list
    - PM / OPP: Add a helper to get an opp regulator for device
    - cpufreq: Add apq8016 to cpufreq-dt-platdev blacklist
    - regulator: smd: Allow REGULATOR_QCOM_SMD_RPM=m
    - ov5645: I2C address change
    - i2c: Add Qualcomm Camera Control Interface driver
    - camss: vfe: Skip first four frames from sensor
    - camss: Do not register if no cameras are present
    - i2c-qcom-cci: Fix run queue completion timeout
    - i2c-qcom-cci: Fix I2C address bug
    - media: ov5645: Fix I2C address
    - drm/bridge/adv7511: Delay clearing of HPD interrupt status
    - HACK: drm/msm/adv7511: Don't rely on interrupts for EDID parsing
    - leds: Add driver for Qualcomm LPG
    - wcn36xx: Fix warning due to duplicate scan_completed notification
    - arm64: dts: Add CPR DT node for msm8916
    - arm64: dts: add spmi-regulator nodes
    - arm64: dts: msm8916: Add cpufreq support
    - arm64: dts: msm8916: Add a shared CPU opp table
    - arm64: dts: msm8916: Add cpu cooling maps
    - arm64: dts: pm8916: Mark the s2 regulator as always-on
    - dt-bindings: mailbox: qcom: Document the APCS clock binding
    - arm64: dts: qcom: msm8916: Add msm8916 A53 PLL DT node
    - arm64: dts: qcom: msm8916: Use the new APCS mailbox driver
    - arm64: dts: qcom: msm8916: Add clock properties to the APCS node
    - arm64: dts: qcom: apq8016-sbc: Allow USR4 LED to notify kernel panic
    - dt-bindings: media: Binding document for Qualcomm Camera Control Interface
      driver
    - MAINTAINERS: Add Qualcomm Camera Control Interface driver
    - DT: leds: Add Qualcomm Light Pulse Generator binding
    - arm64: dts: qcom: msm8996: Add mpp and lpg blocks
    - arm64: dts: qcom: Add pwm node for pm8916
    - arm64: dts: qcom: Add user LEDs on db820c
    - arm64: dts: qcom: Add WiFI/BT LEDs on db820c
    - ARM: dts: qcom: Add LPG node to pm8941
    - ARM: dts: qcom: honami: Add LPG node and RGB LED
    - arm64: dts: qcom: Add Camera Control Interface support
    - arm64: dts: qcom: Add apps_iommu vfe child node
    - arm64: dts: qcom: Add camss device node
    - arm64: dts: qcom: Add ov5645 device nodes
    - arm64: dts: msm8916: Fix camera sensors I2C addresses
    - arm: dts: qcom: db410c: Enable PWM signal on MPP4
    - packaging: arm64: add a uboot flavour - part1
    - packaging: arm64: add a uboot flavour - part2
    - packaging: arm64: add a uboot flavour - part3
    - packaging: arm64: add a uboot flavour - part4
    - packaging: arm64: add a uboot flavour - part5
    - packaging: arm64: rename uboot flavour to snapdragon
    - [Config] updateconfigs after qcomlt import
    - [Config] arm64: snapdragon: COMMON_CLK_QCOM=y
    - [Config] arm64: snapdragon: MSM_GCC_8916=y
    - [Config] arm64: snapdragon: REGULATOR_FIXED_VOLTAGE=y
    - [Config] arm64: snapdragon: PINCTRL_MSM8916=y
    - [Config] arm64: snapdragon: HWSPINLOCK_QCOM=y
    - [Config] arm64: snapdragon: SPMI=y, SPMI_MSM_PMIC_ARB=y
    - [Config] arm64: snapdragon: REGMAP_SPMI=y, PINCTRL_QCOM_SPMI_PMIC=y
    - [Config] arm64: snapdragon: REGULATOR_QCOM_SPMI=y
    - [Config] arm64: snapdragon: MFD_SPMI_PMIC=y
    - [Config] arm64: snapdragon: QCOM_SMEM=y
    - [Config] arm64: snapdragon: RPMSG=y, RPMSG_QCOM_SMD=y
    - [Config] arm64: snapdragon: QCOM_SMD_RPM=y, REGULATOR_QCOM_SMD_RPM=y
    - [Config] arm64: snapdragon: QCOM_CLK_SMD_RPM=y
    - [Config] arm64: snapdragon: QCOM_BAM_DMA=y
    - [Config] arm64: snapdragon: QCOM_HIDMA=y, QCOM_HIDMA_MGMT=y
    - [Config] arm64: snapdragon: QCOM_CPR=y
    - [Config] arm64: snapdragon: QCOM_QFPROM=y, QCOM_TSENS=y
    - [Config] arm64: snapdragon: MMC_SDHCI=y, MMC_SDHCI_PLTFM=y, MMC_SDHCI_MSM=y
    - [Config] turn off DRM_MSM_REGISTER_LOGGING
    - [Config] arm64: snapdragon: I2C_QUP=y
    - [Config] arm64: snapdragon: SPI_QUP=y
    - [Config] arm64: snapdragon: USB_ULPI_BUS=y, PHY_QCOM_USB_HS=y
    - [Config] arm64: snapdragon: QCOM_APCS_IPC=y
    - [Config] arm64: snapdragon: QCOM_WCNSS_CTRL=y
    - [Config] arm64: snapdragon: QCOM_SMSM=y
    - [Config] arm64: snapdragon: QCOM_SMP2P=y
    - [Config] arm64: snapdragon: DRM_MSM=y
    - [Config] arm64: snapdragon: SND_SOC=y
    - [Config] arm64: snapdragon: QCOM_WCNSS_PIL=m
    - [Config] arm64: snapdragon: QCOM_A53PLL=y, QCOM_CLK_APCS_MSM8916=y
    - [Config] arm64: snapdragon: INPUT_PM8941_PWRKEY=y
    - [Config] arm64: snapdragon: MEDIA_SUBDRV_AUTOSELECT=y, VIDEO_OV5645=m
    - [Config] arm64: snapdragon: SND_SOC_APQ8016_SBC=y, SND_SOC_LPASS_APQ8016=y
    - [Config] arm64: snapdragon: SND_SOC_MSM8916_WCD_ANALOG=y,
      SND_SOC_MSM8916_WCD_DIGITAL=y
    - SAUCE: media: ov5645: skip address change if dt addr == default addr
    - SAUCE: drm/msm/adv7511: wrap hacks under CONFIG_ADV7511_SNAPDRAGON_HACKS
      #ifdefs
    - [Config] arm64: snapdragon: ADV7511_SNAPDRAGON_HACKS=y
    - packaging: snapdragon: fixup ABI paths

  * LSM stacking patches for bionic (LP: #1763062)
    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
    - SAUCE: LSM stacking: LSM: Manage credential security blobs
    - SAUCE: LSM stacking: LSM: Manage file security blobs
    - SAUCE: LSM stacking: LSM: Manage task security blobs
    - SAUCE: LSM stacking: LSM: Manage remaining security blobs
    - SAUCE: LSM stacking: LSM: General stacking
    - SAUCE: LSM stacking: fixup initialize task->security
    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
    - SAUCE: LSM stacking: fixup apparmor stacking enablement
    - SAUCE: LSM stacking: fixup stacking kconfig
    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
    - SAUCE: LSM stacking: provide prctl interface for setting context
    - SAUCE: LSM stacking: inherit current display LSM
    - SAUCE: LSM stacking: keep an index for each registered LSM
    - SAUCE: LSM stacking: verify display LSM
    - SAUCE: LSM stacking: provide a way to specify the default display lsm
    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
    - SAUCE: LSM stacking: add Kconfig to set default display LSM
    - SAUCE: LSM stacking: add configs for LSM stacking
    - SAUCE: LSM stacking: add apparmor and selinux proc dirs
    - SAUCE: LSM stacking: remove procfs context interface

  * linux 4.13.0-13.14 ADT test failure with linux 4.13.0-13.14
    (LP: #1720779) // LSM stacking patches for bionic (LP: #1763062)
    - SAUCE: LSM stacking: check for invalid zero sized writes

  * RDMA/hns: ensure for-loop actually iterates and free's buffers
    (LP: #1762757)
    - RDMA/hns: ensure for-loop actually iterates and free's buffers

  * Support cq/rq record doorbell for RDMA on HSilicon hip08 systems
    (LP: #1762755)
    - RDMA/hns: Fix the endian problem for hns
    - RDMA/hns: Support rq record doorbell for the user space
    - RDMA/hns: Support cq record doorbell for the user space
    - RDMA/hns: Support rq record doorbell for kernel space
    - RDMA/hns: Support cq record doorbell for kernel space
    - RDMA/hns: Fix cqn type and init resp
    - RDMA/hns: Fix init resp when alloc ucontext
    - RDMA/hns: Fix cq record doorbell enable in kernel

  * Replace LPC patchset with upstream version (LP: #1762758)
    - Revert "UBUNTU: SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver"
    - Revert "UBUNTU: SAUCE: HISI LPC: Add ACPI support"
    - Revert "UBUNTU: SAUCE: ACPI / scan: do not enumerate Indirect IO host
      children"
    - Revert "UBUNTU: SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT
      bindings"
    - Revert "UBUNTU: SAUCE: OF: Add missing I/O range exception for indirect-IO
      devices"
    - Revert "UBUNTU: SAUCE: PCI: Apply the new generic I/O management on PCI IO
      hosts"
    - Revert "UBUNTU: SAUCE: PCI: Add fwnode handler as input param of
      pci_register_io_range()"
    - Revert "UBUNTU: SAUCE: PCI: Remove unused __weak attribute in
      pci_register_io_range()"
    - Revert "UBUNTU: SAUCE: LIB: Introduce a generic PIO mapping method"
    - lib: Add generic PIO mapping method
    - PCI: Remove __weak tag from pci_register_io_range()
    - PCI: Add fwnode handler as input param of pci_register_io_range()
    - PCI: Apply the new generic I/O management on PCI IO hosts
    - of: Add missing I/O range exception for indirect-IO devices
    - HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
    - ACPI / scan: Rename acpi_is_serial_bus_slave() for more general use
    - ACPI / scan: Do not enumerate Indirect IO host children
    - HISI LPC: Add ACPI support
    - MAINTAINERS: Add John Garry as maintainer for HiSilicon LPC driver

  * Enable Tunneled Operations on POWER9 (LP: #1762448)
    - powerpc/powernv: Enable tunneled operations
    - cxl: read PHB indications from the device tree

  * PSL traces reset after PERST for debug AFU image (LP: #1762462)
    - cxl: Enable NORST bit in PSL_DEBUG register for PSL9

  * NFS + sec=krb5 is broken (LP: #1759791)
    - sunrpc: remove incorrect HMAC request initialization

  * Raspberry Pi 3 microSD support missing from the installer (LP: #1729128)
    - d-i: add bcm2835 to block-modules

  * Backport USB core quirks (LP: #1762695)
    - usb: core: Add "quirks" parameter for usbcore
    - usb: core: Copy parameter string correctly and remove superfluous null check
    - usb: core: Add USB_QUIRK_DELAY_CTRL_MSG to usbcore quirks

  * [Ubuntu 18.04] cryptsetup: 'device-mapper: reload ioctl on  failed' when
    setting up a second end-to-end encrypted disk (LP: #1762353)
    - SAUCE: s390/crypto: Adjust s390 aes and paes cipher

  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715
    - powerpc/64s: Wire up cpu_show_spectre_v2()

  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5753
    - powerpc/64s: Wire up cpu_show_spectre_v1()

  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5754
    - powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
    - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
    - powerpc/rfi-flush: Always enable fallback flush on pseries
    - powerpc/rfi-flush: Differentiate enabled and patched flush types
    - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
    - powerpc/64s: Move cpu_show_meltdown()
    - powerpc/64s: Enhance the information in cpu_show_meltdown()
    - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
    - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()

  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715 //
    CVE-2017-5753 // CVE-2017-5754
    - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
    - powerpc: Add security feature flags for Spectre/Meltdown
    - powerpc/pseries: Set or clear security feature flags
    - powerpc/powernv: Set or clear security feature flags

  * Hisilicon network subsystem 3 support (LP: #1761610)
    - net: hns3: export pci table of hclge and hclgevf to userspace
    - d-i: Add hns3 drivers to nic-modules

  * "ip a" command on a guest VM shows UNKNOWN status (LP: #1761534)
    - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS

  * perf vendor events arm64: Enable JSON events for ThunderX2 B0 (LP: #1760712)
    - perf vendor events aarch64: Add JSON metrics for ARM Cortex-A53 Processor
    - perf vendor events: Drop incomplete multiple mapfile support
    - perf vendor events: Fix error code in json_events()
    - perf vendor events: Drop support for unused topic directories
    - perf vendor events: Add support for pmu events vendor subdirectory
    - perf vendor events arm64: Relocate ThunderX2 JSON to cavium subdirectory
    - perf vendor events arm64: Relocate Cortex A53 JSONs to arm subdirectory
    - perf vendor events: Add support for arch standard events
    - perf vendor events arm64: Add armv8-recommended.json
    - perf vendor events arm64: Fixup ThunderX2 to use recommended events
    - perf vendor events arm64: fixup A53 to use recommended events
    - perf vendor events arm64: add HiSilicon hip08 JSON file
    - perf vendor events arm64: Enable JSON events for ThunderX2 B0

  * Warning "cache flush timed out!" seen when unloading the cxl driver
    (LP: #1762367)
    - cxl: Check if PSL data-cache is available before issue flush request

  * Bionic update to 4.15.16 stable release (LP: #1762370)
    - ARM: OMAP: Fix SRAM W+X mapping
    - ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
    - ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
    - ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
    - mtd: jedec_probe: Fix crash in jedec_read_mfr()
    - mtd: nand: atmel: Fix get_sectorsize() function
    - ALSA: usb-audio: Add native DSD support for TEAC UD-301
    - ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
    - ALSA: pcm: potential uninitialized return values
    - x86/platform/uv/BAU: Add APIC idt entry
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation
    - ceph: only dirty ITER_IOVEC pages for direct read
    - ipc/shm.c: add split function to shm_vm_ops
    - i2c: i2c-stm32f7: fix no check on returned setup
    - powerpc/mm: Add tracking of the number of coprocessors using a context
    - powerpc/mm: Workaround Nest MMU bug with TLB invalidations
    - powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
    - partitions/msdos: Unable to mount UFS 44bsd partitions
    - xfrm_user: uncoditionally validate esn replay attribute struct
    - RDMA/ucma: Check AF family prior resolving address
    - RDMA/ucma: Fix use-after-free access in ucma_close
    - RDMA/ucma: Ensure that CM_ID exists prior to access it
    - RDMA/rdma_cm: Fix use after free race with process_one_req
    - RDMA/ucma: Check that device is connected prior to access it
    - RDMA/ucma: Check that device exists prior to accessing it
    - RDMA/ucma: Introduce safer rdma_addr_size() variants
    - ipv6: fix possible deadlock in rt6_age_examine_exception()
    - net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
    - xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
    - percpu: add __GFP_NORETRY semantics to the percpu balancing path
    - netfilter: x_tables: make allocation less aggressive
    - netfilter: bridge: ebt_among: add more missing match size checks
    - l2tp: fix races with ipv4-mapped ipv6 addresses
    - netfilter: drop template ct when conntrack is skipped.
    - netfilter: x_tables: add and use xt_check_proc_name
    - phy: qcom-ufs: add MODULE_LICENSE tag
    - Bluetooth: Fix missing encryption refresh on Security Request
    - drm/i915/dp: Write to SET_POWER dpcd to enable MST hub.
    - bitmap: fix memset optimization on big-endian systems
    - USB: serial: ftdi_sio: add RT Systems VX-8 cable
    - USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
    - USB: serial: cp210x: add ELDAT Easywave RX09 id
    - serial: 8250: Add Nuvoton NPCM UART
    - mei: remove dev_err message on an unsupported ioctl
    - /dev/mem: Avoid overwriting "err" in read_mem()
    - media: usbtv: prevent double free in error case
    - parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
    - crypto: lrw - Free rctx->ext with kzfree
    - crypto: talitos - don't persistently map req_ctx->hw_context and
      req_ctx->buf
    - crypto: inside-secure - fix clock management
    - crypto: testmgr - Fix incorrect values in PKCS#1 test vector
    - crypto: talitos - fix IPsec cipher in length
    - crypto: ahash - Fix early termination in hash walk
    - crypto: caam - Fix null dereference at error path
    - crypto: ccp - return an actual key size from RSA max_size callback
    - crypto: arm,arm64 - Fix random regeneration of S_shipped
    - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
    - Btrfs: fix unexpected cow in run_delalloc_nocow
    - staging: comedi: ni_mio_common: ack ai fifo error interrupts.
    - Revert "base: arch_topology: fix section mismatch build warnings"
    - Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
    - Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
    - Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
    - vt: change SGR 21 to follow the standards
    - ARM: dts: DRA76-EVM: Set powerhold property for tps65917
    - net: hns: Fix ethtool private flags
    - Fix slab name "biovec-(1<<(21-12))"
    - Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
    - Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
    - Revert "cpufreq: Fix governor module removal race"
    - Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
    - Linux 4.15.16

  * [18.04][config] regression: nvme and nvme_core couldn't be built as modules
    starting 4.15-rc2 (LP: #1759893)
    - SAUCE: Revert "lightnvm: include NVM Express driver if OCSSD is selected for
      build"
    - [Config] CONFIG_BLK_DEV_NMVE=m

  * Miscellaneous Ubuntu changes
    - [Packaging] Only install cloud init files when do_tools_common=true

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 13 Apr 2018 14:40:52 -0300

linux (4.15.0-15.16) bionic; urgency=medium

  * linux: 4.15.0-15.16 -proposed tracker (LP: #1761177)

  * FFe: Enable configuring resume offset via sysfs (LP: #1760106)
    - PM / hibernate: Make passing hibernate offsets more friendly

  * /dev/bcache/by-uuid links not created after reboot (LP: #1729145)
    - SAUCE: (no-up) bcache: decouple emitting a cached_dev CHANGE uevent

  * Ubuntu18.04:POWER9:DD2.2 - Unable to start a KVM guest with default machine
    type(pseries-bionic) complaining "KVM implementation does not support
    Transactional Memory, try cap-htm=off" (kvm) (LP: #1752026)
    - powerpc: Use feature bit for RTC presence rather than timebase presence
    - powerpc: Book E: Remove unused CPU_FTR_L2CSR bit
    - powerpc: Free up CPU feature bits on 64-bit machines
    - powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2
    - powerpc/powernv: Provide a way to force a core into SMT4 mode
    - KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9
    - KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode
    - KVM: PPC: Book3S HV: Work around TEXASR bug in fake suspend state

  * Important Kernel fixes to be backported for Power9 (kvm) (LP: #1758910)
    - powerpc/mm: Fixup tlbie vs store ordering issue on POWER9

  * Ubuntu 18.04 - IO Hang on some namespaces when running HTX with 16
    namespaces  (Bolt / NVMe) (LP: #1757497)
    - powerpc/64s: Fix lost pending interrupt due to race causing lost update to
      irq_happened

  * fwts-efi-runtime-dkms 18.03.00-0ubuntu1: fwts-efi-runtime-dkms kernel module
    failed to build (LP: #1760876)
    - [Packaging] include the retpoline extractor in the headers

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 04 Apr 2018 08:26:19 -0500

linux (4.15.0-14.15) bionic; urgency=medium

  * linux: 4.15.0-14.15 -proposed tracker (LP: #1760678)

  * [Bionic] mlx4 ETH - mlnx_qos failed when set some TC to vendor
    (LP: #1758662)
    - net/mlx4_en: Change default QoS settings

  * AT_BASE_PLATFORM in AUXV is absent on kernels available on Ubuntu 17.10
    (LP: #1759312)
    - powerpc/64s: Fix NULL AT_BASE_PLATFORM when using DT CPU features

  * Bionic update to 4.15.15 stable release (LP: #1760585)
    - net: dsa: Fix dsa_is_user_port() test inversion
    - openvswitch: meter: fix the incorrect calculation of max delta_t
    - qed: Fix MPA unalign flow in case header is split across two packets.
    - tcp: purge write queue upon aborting the connection
    - qed: Fix non TCP packets should be dropped on iWARP ll2 connection
    - sysfs: symlink: export sysfs_create_link_nowarn()
    - net: phy: relax error checking when creating sysfs link netdev->phydev
    - devlink: Remove redundant free on error path
    - macvlan: filter out unsupported feature flags
    - net: ipv6: keep sk status consistent after datagram connect failure
    - ipv6: old_dport should be a __be16 in __ip6_datagram_connect()
    - ipv6: sr: fix NULL pointer dereference when setting encap source address
    - ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
    - mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic
    - net: phy: Tell caller result of phy_change()
    - ipv6: Reflect MTU changes on PMTU of exceptions for MTU-less routes
    - net sched actions: return explicit error when tunnel_key mode is not
      specified
    - ppp: avoid loop in xmit recursion detection code
    - rhashtable: Fix rhlist duplicates insertion
    - test_rhashtable: add test case for rhltable with duplicate objects
    - kcm: lock lower socket in kcm_attach
    - sch_netem: fix skb leak in netem_enqueue()
    - ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
    - net: use skb_to_full_sk() in skb_update_prio()
    - net: Fix hlist corruptions in inet_evict_bucket()
    - s390/qeth: free netdevice when removing a card
    - s390/qeth: when thread completes, wake up all waiters
    - s390/qeth: lock read device while queueing next buffer
    - s390/qeth: on channel error, reject further cmd requests
    - soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
    - dpaa_eth: fix error in dpaa_remove()
    - dpaa_eth: remove duplicate initialization
    - dpaa_eth: increment the RX dropped counter when needed
    - dpaa_eth: remove duplicate increment of the tx_errors counter
    - dccp: check sk for closed state in dccp_sendmsg()
    - ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
    - l2tp: do not accept arbitrary sockets
    - net: ethernet: arc: Fix a potential memory leak if an optional regulator is
      deferred
    - net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY
      interface
    - net: fec: Fix unbalanced PM runtime calls
    - net/iucv: Free memory obtained by kzalloc
    - netlink: avoid a double skb free in genlmsg_mcast()
    - net: Only honor ifindex in IP_PKTINFO if non-0
    - net: systemport: Rewrite __bcm_sysport_tx_reclaim()
    - qede: Fix qedr link update
    - skbuff: Fix not waking applications when errors are enqueued
    - team: Fix double free in error path
    - Linux 4.15.15

  * Ubuntu 18.04 [ WSP DD2.2 with stop4 and stop5 enabled ]: kdump fails to
    capture dump when smt=2 or off. (LP: #1758206)
    - powerpc/crash: Remove the test for cpu_online in the IPI callback
    - powernv/kdump: Fix cases where the kdump kernel can get HMI's
    - powerpc/kdump: Fix powernv build break when KEXEC_CORE=n

  * [Intel Ubuntu 18.04 Bug] Null pointer dereference, when disconnecting RAID
    rebuild target (LP: #1759279)
    - md: document lifetime of internal rdev pointer.

  * [Feature]Crystal Ridge:add support for the platform capabilities NFIT sub-
    table in ACPI 6.2A (LP: #1730829)
    - ACPICA: ACPI 6.0A: Changes to the NFIT ACPI table
    - acpi: nfit: Add support for detect platform CPU cache flush on power loss
    - acpi: nfit: add persistent memory control flag for nd_region
    - libnvdimm: expose platform persistence attribute for nd_region
    - libnvdimm: re-enable deep flush for pmem devices via fsync()
    - libnvdimm, nfit: fix persistence domain reporting

  * Allow multiple mounts of zfs datasets (LP: #1759848)
    - SAUCE: Allow mounting datasets more than once (LP: #1759848)

  * Update Aquantia driver to fix various issues (LP: #1759303)
    - net: aquantia: Eliminate AQ_DIMOF, replace with ARRAY_SIZE
    - net: aquantia: Cleanup status flags accesses
    - net: aquantia: Cleanup hardware access modules
    - net: aquantia: Remove duplicate hardware descriptors declarations
    - net: aquantia: Add const qualifiers for hardware ops tables
    - net: aquantia: Simplify dependencies between pci modules
    - net: aquantia: Eliminate aq_nic structure abstraction
    - net: aquantia: Fix register definitions to linux style
    - net: aquantia: Prepend hw access functions declarations with prefix
    - net: aquantia: Fix internal stats calculation on rx
    - net: aquantia: Introduce new device ids and constants
    - net: aquantia: Introduce new AQC devices and capabilities
    - net: aquantia: Convert hw and caps structures to const static pointers
    - net: aquantia: Cleanup pci functions module
    - net: aquantia: Remove create/destroy from hw ops
    - net: aquantia: Change confusing no_ff_addr to more meaningful name
    - net: aquantia: Introduce firmware ops callbacks
    - net: aquantia: Introduce support for new firmware on AQC cards
    - net: aquantia: Introduce global AQC hardware reset sequence
    - net: aquantia: Report correct mediatype via ethtool
    - net: aquantia: bump driver version to match aquantia internal numbering
    - net: aquantia: Fix hardware reset when SPI may rarely hangup
    - net: aquantia: Fix a regression with reset on old firmware
    - net: aquantia: Change inefficient wait loop on fw data reads
    - net: aquantia: Add tx clean budget and valid budget handling logic
    - net: aquantia: Allow live mac address changes
    - net: aquantia: Implement pci shutdown callback
    - net: aquantia: driver version bump

  * ISST-LTE:KVM:Ubuntu1804:BostonLC:boslcp3: cpu hotplug on boslcp3g4 guest
    dumping call traces continuously. (LP: #1759722)
    - blk-mq: turn WARN_ON in __blk_mq_run_hw_queue into printk

  * ISST-LTE:KVM:Ubuntu18.04:BostonLC:boslcp3:boslcp3g3:Guest conosle hangs
    after hotplug CPU add operation. (LP: #1759723)
    - genirq/affinity: assign vectors to all possible CPUs
    - blk-mq: simplify queue mapping & schedule with each possisble CPU

  * test_bpf fails (LP: #1756150)
    - test_bpf: Fix testing with CONFIG_BPF_JIT_ALWAYS_ON=y on other arches

  * Bionic update to v4.15.14 stable release (LP: #1759655)
    - MIPS: ralink: Remove ralink_halt()
    - MIPS: ralink: Fix booting on MT7621
    - MIPS: lantiq: Fix Danube USB clock
    - MIPS: lantiq: Enable AHB Bus for USB
    - MIPS: lantiq: ase: Enable MFD_SYSCON
    - iio: chemical: ccs811: Corrected firmware boot/application mode transition
    - iio: st_pressure: st_accel: pass correct platform data to init
    - iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()
    - ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
    - ALSA: aloop: Sync stale timer before release
    - ALSA: aloop: Fix access to not-yet-ready substream via cable
    - ALSA: hda - Force polling mode on CFL for fixing codec communication
    - ALSA: hda/realtek - Fix speaker no sound after system resume
    - ALSA: hda/realtek - Fix Dell headset Mic can't record
    - ALSA: hda/realtek - Always immediately update mute LED with pin VREF
    - mmc: core: Fix tracepoint print of blk_addr and blksz
    - mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
    - mmc: block: fix updating ext_csd caches on ioctl call
    - mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
    - mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
    - mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
    - PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
    - ahci: Add PCI-id for the Highpoint Rocketraid 644L card
    - lockdep: fix fs_reclaim warning
    - clk: bcm2835: Fix ana->maskX definitions
    - clk: bcm2835: Protect sections updating shared registers
    - clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
    - RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory
    - Drivers: hv: vmbus: Fix ring buffer signaling
    - pinctrl: samsung: Validate alias coming from DT
    - Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table
    - Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table
    - Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
    - libata: fix length validation of ATAPI-relayed SCSI commands
    - libata: remove WARN() for DMA or PIO command without data
    - libata: don't try to pass through NCQ commands to non-NCQ devices
    - libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
    - libata: Enable queued TRIM for Samsung SSD 860
    - libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
    - libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
    - libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
    - sched, cgroup: Don't reject lower cpu.max on ancestors
    - cgroup: fix rule checking for threaded mode switching
    - nfsd: remove blocked locks on client teardown
    - media: tegra-cec: reset rx_buf_cnt when start bit detected
    - hugetlbfs: check for pgoff value overflow
    - h8300: remove extraneous __BIG_ENDIAN definition
    - mm/vmalloc: add interfaces to free unmapped page table
    - x86/mm: implement free pmd/pte page interfaces
    - mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
    - mm/thp: do not wait for lock_page() in deferred_split_scan()
    - mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
    - Revert "mm: page_alloc: skip over regions of invalid pfns where possible"
    - drm/vmwgfx: Fix black screen and device errors when running without fbdev
    - drm/vmwgfx: Fix a destoy-while-held mutex problem.
    - drm/radeon: Don't turn off DP sink when disconnected
    - drm/amd/display: We shouldn't set format_default on plane as atomic driver
    - drm/amd/display: Add one to EDID's audio channel count when passing to DC
    - drm: Reject getfb for multi-plane framebuffers
    - drm: udl: Properly check framebuffer mmap offsets
    - mm/vmscan: wake up flushers for legacy cgroups too
    - module: propagate error in modules_open()
    - acpi, numa: fix pxm to online numa node associations
    - ACPI / watchdog: Fix off-by-one error at resource assignment
    - libnvdimm, {btt, blk}: do integrity setup before add_disk()
    - brcmfmac: fix P2P_DEVICE ethernet address generation
    - rtlwifi: rtl8723be: Fix loss of signal
    - tracing: probeevent: Fix to support minus offset from symbol
    - mtdchar: fix usage of mtd_ooblayout_ecc()
    - mtd: nand: fsl_ifc: Fix nand waitfunc return value
    - mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
    - mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
    - staging: ncpfs: memory corruption in ncp_read_kernel()
    - can: peak/pcie_fd: fix echo_skb is occupied! bug
    - can: peak/pcie_fd: remove useless code when interface starts
    - can: ifi: Repair the error handling
    - can: ifi: Check core revision upon probe
    - can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
    - can: cc770: Fix queue stall & dropped RTR reply
    - can: cc770: Fix use after free in cc770_tx_interrupt()
    - tty: vt: fix up tabstops properly
    - x86/entry/64: Don't use IST entry for #BP stack
    - selftests/x86/ptrace_syscall: Fix for yet more glibc interference
    - x86/vsyscall/64: Use proper accessor to update P4D entry
    - x86/efi: Free efi_pgd with free_pages()
    - posix-timers: Protect posix clock array access against speculation
    - kvm/x86: fix icebp instruction handling
    - x86/build/64: Force the linker to use 2MB page size
    - x86/boot/64: Verify alignment of the LOAD segment
    - hwmon: (k10temp) Only apply temperature offset if result is positive
    - hwmon: (k10temp) Add temperature offset for Ryzen 1900X
    - perf/x86/intel/uncore: Fix Skylake UPI event format
    - perf stat: Fix CVS output format for non-supported counters
    - perf/core: Fix ctx_event_type in ctx_resched()
    - trace/bpf: remove helper bpf_perf_prog_read_value from tracepoint type
      programs
    - perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
    - perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake
      servers
    - iio: ABI: Fix name of timestamp sysfs file
    - iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
    - iio: imu: st_lsm6dsx: introduce conf_lock mutex
    - staging: android: ion: Zero CMA allocated memory
    - kbuild: disable clang's default use of -fmerge-all-constants
    - bpf: skip unnecessary capability check
    - bpf, x64: increase number of passes
    - Linux 4.15.14

  * System fails to start (boot) on battery due to read-only root file-system
    (LP: #1726930) // Bionic update to v4.15.14 stable release (LP: #1759655)
    - libata: disable LPM for Crucial BX100 SSD 500GB drive

  * [Feature][CFL][ICL] [CNL]Thunderbolt support (Titan Ridge) (LP: #1730775)
    - thunderbolt: Resume control channel after hibernation image is created
    - thunderbolt: Serialize PCIe tunnel creation with PCI rescan
    - thunderbolt: Handle connecting device in place of host properly
    - thunderbolt: Do not overwrite error code when domain adding fails
    - thunderbolt: Wait a bit longer for root switch config space
    - thunderbolt: Wait a bit longer for ICM to authenticate the active NVM
    - thunderbolt: Handle rejected Thunderbolt devices
    - thunderbolt: Factor common ICM add and update operations out
    - thunderbolt: Correct function name in kernel-doc comment
    - thunderbolt: Add tb_switch_get()
    - thunderbolt: Add tb_switch_find_by_route()
    - thunderbolt: Add tb_xdomain_find_by_route()
    - thunderbolt: Add constant for approval timeout
    - thunderbolt: Move driver ready handling to struct icm
    - thunderbolt: Add 'boot' attribute for devices
    - thunderbolt: Add support for preboot ACL
    - Documentation/admin-guide: fixes for thunderbolt.rst
    - thunderbolt: Introduce USB only (SL4) security level
    - thunderbolt: Add support for Intel Titan Ridge

  * QCA9377 requires more IRAM banks for its new firmware (LP: #1748345)
    - ath10k: update the IRAM bank number for QCA9377

  * nfp: fix disabling on hw-tc-offload in flower (LP: #1752828)
    - nfp: bpf: require ETH table
    - nfp: don't advertise hw-tc-offload on non-port netdevs
    - nfp: forbid disabling hw-tc-offload on representors while offload active

  * Fix an issue that when system in S3, USB keyboard can't wake up the system.
    (LP: #1759511)
    - ACPI / PM: Allow deeper wakeup power states with no _SxD nor _SxW

  * retpoline hints: primary infrastructure and initial hints (LP: #1758856)
    - [Packaging] retpoline -- add safe usage hint support
    - [Packaging] retpoline-check -- only report additions
    - [Packaging] retpoline -- widen indirect call/jmp detection
    - [Packaging] retpoline -- elide %rip relative indirections
    - [Packaging] retpoline -- clear hint information from packages
    - SAUCE: apm -- annotate indirect calls within
      firmware_restrict_branch_speculation_{start,end}
    - SAUCE: EFI -- annotate indirect calls within
      firmware_restrict_branch_speculation_{start,end}
    - SAUCE: early/late -- annotate indirect calls in early/late initialisation
      code
    - SAUCE: vga_set_mode -- avoid jump tables
    - [Config] retpoine -- switch to new format

  * zfs system process hung on container stop/delete (LP: #1754584)
    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
    - Revert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"
    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)

  * Important KVM fixes for ppc64el (LP: #1759045)
    - KVM: PPC: Book3S HV: Do SLB load/unload with guest LPCR value loaded
    - KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code
    - KVM: PPC: Book3S HV: Make HPT resizing work on POWER9
    - KVM: PPC: Book3S: Add MMIO emulation for VMX instructions
    - KVM: PPC: Book3S: Fix compile error that occurs with some gcc versions
    - KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry
    - KVM: PPC: Book3S HV: Fix duplication of host SLB entries

  * ubuntu_zram_smoke test will cause soft lockup on Artful ThunderX ARM64
    (LP: #1755073)
    - SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK

  * Update to ocxl driver (LP: #1755161)
    - ocxl: fix signed comparison with less than zero
    - ocxl: Fix potential bad errno on irq allocation
    - ocxl: Add get_metadata IOCTL to share OCXL information to userspace

  * CAPI Flash (cxlflash) update (LP: #1752672)
    - scsi: cxlflash: Update cxl-specific arguments to generic cookie
    - scsi: cxlflash: Explicitly cache number of interrupts per context
    - scsi: cxlflash: Remove embedded CXL work structures
    - scsi: cxlflash: Adapter context init can return error
    - scsi: cxlflash: Staging to support future accelerators
    - SAUCE: cxlflash: Preserve number of interrupts for master contexts
    - SAUCE: cxlflash: Avoid clobbering context control register value
    - SAUCE: cxlflash: Add argument identifier names
    - SAUCE: cxlflash: Introduce OCXL backend
    - SAUCE: cxlflash: Hardware AFU for OCXL
    - SAUCE: cxlflash: Read host function configuration
    - SAUCE: cxlflash: Setup function acTag range
    - SAUCE: cxlflash: Read host AFU configuration
    - SAUCE: cxlflash: Setup AFU acTag range
    - SAUCE: cxlflash: Setup AFU PASID
    - SAUCE: cxlflash: Adapter context support for OCXL
    - SAUCE: cxlflash: Use IDR to manage adapter contexts
    - SAUCE: cxlflash: Support adapter file descriptors for OCXL
    - SAUCE: cxlflash: Support adapter context discovery
    - SAUCE: cxlflash: Support image reload policy modification
    - SAUCE: cxlflash: MMIO map the AFU
    - SAUCE: cxlflash: Support starting an adapter context
    - SAUCE: cxlflash: Support process specific mappings
    - SAUCE: cxlflash: Support AFU state toggling
    - SAUCE: cxlflash: Support reading adapter VPD data
    - SAUCE: cxlflash: Setup function OCXL link
    - SAUCE: cxlflash: Setup OCXL transaction layer
    - SAUCE: cxlflash: Support process element lifecycle
    - SAUCE: cxlflash: Support AFU interrupt management
    - SAUCE: cxlflash: Support AFU interrupt mapping and registration
    - SAUCE: cxlflash: Support starting user contexts
    - SAUCE: cxlflash: Support adapter context polling
    - SAUCE: cxlflash: Support adapter context reading
    - SAUCE: cxlflash: Support adapter context mmap and release
    - SAUCE: cxlflash: Support file descriptor mapping
    - SAUCE: cxlflash: Introduce object handle fop
    - SAUCE: cxlflash: Setup LISNs for user contexts
    - SAUCE: cxlflash: Setup LISNs for master contexts
    - SAUCE: cxlflash: Update synchronous interrupt status bits
    - SAUCE: cxlflash: Introduce OCXL context state machine
    - SAUCE: cxlflash: Register for translation errors
    - SAUCE: cxlflash: Support AFU reset
    - SAUCE: cxlflash: Enable OCXL operations

  * [Feature][CFL] Enable pmc_core driver for H, S, and U SKUs (LP: #1730770)
    - platform/x86: intel_pmc_core: Remove unused EXPORTED API
    - platform/x86: intel_pmc_core: Change driver to a module
    - platform/x86: intel_pmc_core: Fix file permission warnings
    - platform/x86: intel_pmc_core: Refactor debugfs entries
    - platform/x86: intel_pmc_core: Substitute PCI with CPUID enumeration
    - platform/x86: intel_pmc_core: Convert to ICPU macro
    - platform/x86: intel_pmc_core: Remove unused header file
    - ACPI / LPIT: Export lpit_read_residency_count_address()
    - platform/x86: intel_pmc_core: Read base address from LPIT
    - x86/cpu: Add Cannonlake to Intel family
    - platform/x86: intel_pmc_core: Add CannonLake PCH support
    - platform/x86: intel_pmc_core: Special case for Coffeelake

  * Cpu utilization showing system time for kvm guests (performance) (sysstat)
    (LP: #1755979)
    - KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN

  * [Artful][Wyse 3040] System hang when trying to enable an offlined CPU core
    (LP: #1736393)
    - SAUCE: drm/i915:Don't set chip specific data
    - SAUCE: drm/i915: make previous commit affects Wyse 3040 only

  * [Bug] ISH support for CFL-H (LP: #1739522)
    - HID: intel-ish-hid: Enable Cannon Lake and Coffee Lake laptop/desktop

  * ath9k can't connect to wifi AP (LP: #1727228)
    - ath9k: add MSI support
    - ath9k: add a quirk to set use_msi automatically

  * [P9,Power NV][Witherspoon][Ubuntu 18.04][Perf] : PMU events by name it is
    not listed under perf list (LP: #1755470)
    - iperf vendor events: Use more flexible pattern matching for CPU
      identification for mapfile.csv

  * zed process consuming 100% cpu (LP: #1751796)
    - SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)

  * Bionic update to 4.15.13 stable release (LP: #1758886)
    - scsi: megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura
      controllers
    - staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
    - drm/amdgpu: use polling mem to set SDMA3 wptr for VF
    - Bluetooth: hci_qca: Avoid setup failure on missing rampatch
    - Bluetooth: btqcomsmd: Fix skb double free corruption
    - cpufreq: longhaul: Revert transition_delay_us to 200 ms
    - media: c8sectpfe: fix potential NULL pointer dereference in
      c8sectpfe_timer_interrupt
    - drm/msm: fix leak in failed get_pages
    - IB/ipoib: Warn when one port fails to initialize
    - RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()
    - hv_netvsc: Fix the receive buffer size limit
    - hv_netvsc: Fix the TX/RX buffer default sizes
    - tcp: allow TLP in ECN CWR
    - spi: sh-msiof: Avoid writing to registers from spi_master.setup()
    - libbpf: prefer global symbols as bpf program name source
    - rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.
    - rtlwifi: always initialize variables given to RT_TRACE()
    - media: bt8xx: Fix err 'bt878_probe()'
    - ath10k: handling qos at STA side based on AP WMM enable/disable
    - media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
    - qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect
    - tty: goldfish: Enable 'earlycon' only if built-in
    - serial: 8250_dw: Disable clock on error
    - cros_ec: fix nul-termination for firmware build info
    - watchdog: Fix potential kref imbalance when opening watchdog
    - watchdog: Fix kref imbalance seen if handle_boot_enabled=0
    - platform/chrome: Use proper protocol transfer function
    - dmaengine: zynqmp_dma: Fix race condition in the probe
    - drm/tilcdc: ensure nonatomic iowrite64 is not used
    - mmc: avoid removing non-removable hosts during suspend
    - mmc: block: fix logical error to avoid memory leak
    - /dev/mem: Add bounce buffer for copy-out
    - net: phy: meson-gxl: check phy_write return value
    - sfp: fix EEPROM reading in the case of non-SFF8472 SFPs
    - sfp: fix non-detection of PHY
    - media: s5p-mfc: Fix lock contention - request_firmware() once
    - rtc: ac100: Fix multiple race conditions
    - IB/ipoib: Avoid memory leak if the SA returns a different DGID
    - RDMA/cma: Use correct size when writing netlink stats
    - IB/umem: Fix use of npages/nmap fields
    - iser-target: avoid reinitializing rdma contexts for isert commands
    - bpf/cgroup: fix a verification error for a CGROUP_DEVICE type prog
    - vgacon: Set VGA struct resource types
    - omapdrm: panel: fix compatible vendor string for td028ttec1
    - mmc: sdhci-xenon: wait 5ms after set 1.8V signal enable
    - drm/omap: DMM: Check for DMM readiness after successful transaction commit
    - pty: cancel pty slave port buf's work in tty_release
    - coresight: Fix disabling of CoreSight TPIU
    - PCI: designware-ep: Fix ->get_msi() to check MSI_EN bit
    - PCI: endpoint: Fix find_first_zero_bit() usage
    - PCI: rcar: Handle rcar_pcie_parse_request_of_pci_ranges() failures
    - media: davinci: fix a debug printk
    - clk: check ops pointer on clock register
    - dt-bindings: display: panel: Fix compatible string for Toshiba LT089AC29000
    - clk: use round rate to bail out early in set_rate
    - pinctrl: Really force states during suspend/resume
    - pinctrl: rockchip: enable clock when reading pin direction register
    - iommu/vt-d: clean up pr_irq if request_threaded_irq fails
    - ip6_vti: adjust vti mtu according to mtu of lower device
    - ip_gre: fix error path when erspan_rcv failed
    - ip_gre: fix potential memory leak in erspan_rcv
    - soc: qcom: smsm: fix child-node lookup
    - RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
    - ARM: dts: aspeed-evb: Add unit name to memory node
    - nfsd4: permit layoutget of executable-only files
    - clk: at91: pmc: Wait for clocks when resuming
    - clk: Don't touch hardware when reparenting during registration
    - clk: axi-clkgen: Correctly handle nocount bit in recalc_rate()
    - clk: si5351: Rename internal plls to avoid name collisions
    - crypto: artpec6 - set correct iv size for gcm(aes)
    - hwrng: core - Clean up RNG list when last hwrng is unregistered
    - dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
    - IB/mlx5: Fix integer overflows in mlx5_ib_create_srq
    - IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq
    - RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file
    - serial: 8250_pci: Don't fail on multiport card class
    - RDMA/core: Do not use invalid destination in determining port reuse
    - clk: migrate the count of orphaned clocks at init
    - RDMA/ucma: Fix access to non-initialized CM_ID object
    - RDMA/ucma: Don't allow join attempts for unsupported AF family
    - Linux 4.15.13

  * Ubuntu18.04:PowerPC - Set Transparent Huge Pages (THP) by default to
    "always" (LP: #1753708)
    - Config: Set TRANSPARENT_HUGEPAGE_ALWAYS=y on ppc64el

  * Bionic update to 4.15.12 stable release (LP: #1757465)
    - x86/cpufeatures: Add Intel Total Memory Encryption cpufeature
    - x86/cpufeatures: Add Intel PCONFIG cpufeature
    - selftests/x86/entry_from_vm86: Exit with 1 if we fail
    - selftests/x86/entry_from_vm86: Add test cases for POPF
    - x86/vm86/32: Fix POPF emulation
    - x86/speculation, objtool: Annotate indirect calls/jumps for objtool on
      32-bit kernels
    - x86/speculation: Remove Skylake C2 from Speculation Control microcode
      blacklist
    - KVM: x86: Fix device passthrough when SME is active
    - x86/mm: Fix vmalloc_fault to use pXd_large
    - parisc: Handle case where flush_cache_range is called with no context
    - ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
    - ALSA: hda - Revert power_save option default value
    - ALSA: seq: Fix possible UAF in snd_seq_check_queue()
    - ALSA: seq: Clear client entry before deleting else at closing
    - drm/nouveau/bl: Fix oops on driver unbind
    - drm/nouveau/mmu: ALIGN_DOWN correct variable
    - drm/amdgpu: fix prime teardown order
    - drm/radeon: fix prime teardown order
    - drm/amdgpu/dce: Don't turn off DP sink when disconnected
    - fs: Teach path_connected to handle nfs filesystems with multiple roots.
    - KVM: arm/arm64: Reduce verbosity of KVM init log
    - KVM: arm/arm64: Reset mapped IRQs on VM reset
    - kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3
    - KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid
    - lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
    - fs/aio: Add explicit RCU grace period when freeing kioctx
    - fs/aio: Use RCU accessors for kioctx_table->table[]
    - RDMAVT: Fix synchronization around percpu_ref
    - irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
    - nvme: fix subsystem multiple controllers support check
    - xfs: preserve i_rdev when recycling a reclaimable inode
    - btrfs: Fix NULL pointer exception in find_bio_stripe
    - btrfs: add missing initialization in btrfs_check_shared
    - btrfs: alloc_chunk: fix DUP stripe size handling
    - btrfs: Fix use-after-free when cleaning up fs_devs with a single stale
      device
    - btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes
    - btrfs: Fix memory barriers usage with device stats counters
    - scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que
    - scsi: qla2xxx: Fix NULL pointer access for fcport structure
    - scsi: qla2xxx: Fix logo flag for qlt_free_session_done()
    - scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure
    - usb: dwc2: fix STM32F7 USB OTG HS compatible
    - dt-bindings: usb: fix the STM32F7 DWC2 OTG HS core binding
    - USB: gadget: udc: Add missing platform_device_put() on error in
      bdc_pci_probe()
    - usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
    - usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode
    - usb: dwc3: of-simple: fix oops by unbalanced clk disable call
    - usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove()
    - phy: phy-brcm-usb: Fix two DT properties to match bindings doc
    - phy: phy-brcm-usb-init: Some Low Speed keyboards fail on 7271
    - phy: phy-brcm-usb-init: DRD mode can cause crash on startup
    - phy: phy-brcm-usb-init: Power down USB 3.0 PHY when XHCI disabled
    - Linux 4.15.12

  * cxl: Fix timebase synchronization status on POWER9 missing (CAPI)
    (LP: #1757228)
    - cxl: Fix timebase synchronization status on P9

  * [Feature][GLK] Enable L2 CDP (Code and Data Prioritization) (LP: #1737873)
    - x86/intel_rdt: Enumerate L2 Code and Data Prioritization (CDP) feature
    - x86/intel_rdt: Add command line parameter to control L2_CDP

  * [Feature] Crystal Ridge-Restrict DAX to configurations with struct page
    (LP: #1751724)
    - mm, dax: introduce pfn_t_special()
    - ext2: auto disable dax instead of failing mount
    - ext4: auto disable dax instead of failing mount
    - dax: require 'struct page' by default for filesystem dax
    - Config: Enable CONFIG_FS_DAX_LIMITED

  * Bionic update to 4.15.11 stable release (LP: #1756978)
    - x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
    - ASoC: sun4i-i2s: Fix RX slot number of SUN8I
    - ASoC: sgtl5000: Fix suspend/resume
    - ASoC: wm_adsp: For TLV controls only register TLV get/set
    - ASoC: rt5651: Fix regcache sync errors on resume
    - usb: host: xhci-rcar: add support for r8a77965
    - xhci: Fix front USB ports on ASUS PRIME B350M-A
    - xhci: fix endpoint context tracer output
    - serial: sh-sci: prevent lockup on full TTY buffers
    - tty/serial: atmel: add new version check for usart
    - uas: fix comparison for error code
    - staging: comedi: fix comedi_nsamples_left.
    - staging: android: ashmem: Fix lockdep issue during llseek
    - scsi: sd_zbc: Fix potential memory leak
    - USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
    - usbip: vudc: fix null pointer dereference on udc->lock
    - usb: quirks: add control message delay for 1b1c:1b20
    - usb: usbmon: Read text within supplied buffer size
    - usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
    - usb: dwc3: Fix lock-up on ID change during system suspend/resume
    - serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
    - serial: core: mark port as initialized in autoconfig
    - earlycon: add reg-offset to physical address before mapping
    - dm mpath: fix passing integrity data
    - Revert "btrfs: use proper endianness accessors for super_copy"
    - gfs2: Clean up {lookup,fillup}_metapath
    - gfs2: Fixes to "Implement iomap for block_map" (2)
    - drm/panel: rpi-touchscreen: propagate errors in rpi_touchscreen_i2c_read()
    - spi: imx: Fix failure path leak on GPIO request error correctly
    - HID: multitouch: Only look at non touch fields in first packet of a frame
    - KVM: PPC: Book3S HV: Avoid shifts by negative amounts
    - drm/edid: set ELD connector type in drm_edid_to_eld()
    - dma-buf/fence: Fix lock inversion within dma-fence-array
    - video/hdmi: Allow "empty" HDMI infoframes
    - KVM: PPC: Book3S HV: Fix typo in kvmppc_hv_get_dirty_log_radix()
    - HID: elo: clear BTN_LEFT mapping
    - iwlwifi: mvm: rs: don't override the rate history in the search cycle
    - ARM: dts: koelsch: Move cec_clock to root node
    - clk: meson: gxbb: fix wrong clock for SARADC/SANA
    - ARM: dts: exynos: Correct Trats2 panel reset line
    - drm/amdgpu: fix get_max_engine_clock_in_mhz
    - staging: rtl8822be: fix missing null check on dev_alloc_skb return
    - typec: tcpm: fusb302: Resolve out of order messaging events
    - USB: ledtrig-usbport: fix of-node leak
    - dt-bindings: serial: Add common rs485 binding for RTS polarity
    - sched: Stop switched_to_rt() from sending IPIs to offline CPUs
    - sched: Stop resched_cpu() from sending IPIs to offline CPUs
    - crypto: chelsio - Fix an error code in chcr_hash_dma_map()
    - crypto: ecc - Fix NULL pointer deref. on no default_rng
    - crypto: keywrap - Add missing ULL suffixes for 64-bit constants
    - crypto: cavium - fix memory leak on info
    - test_firmware: fix setting old custom fw path back on exit
    - drm/vblank: Fix vblank timestamp debugs
    - net: ieee802154: adf7242: Fix bug if defined DEBUG
    - rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
    - perf report: Fix -D output for user metadata events
    - net: xfrm: allow clearing socket xfrm policies.
    - gpiolib: don't allow OPEN_DRAIN & OPEN_SOURCE flags simultaneously
    - mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
    - net: thunderx: Set max queue count taking XDP_TX into account
    - ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
    - ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
    - mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
    - userns: Don't fail follow_automount based on s_user_ns
    - xfrm: Fix xfrm_replay_overflow_offload_esn
    - leds: pm8058: Silence pointer to integer size warning
    - bpf: fix stack state printing in verifier log
    - power: supply: sbs-message: double left shift bug in sbsm_select()
    - power: supply: ab8500_charger: Fix an error handling path
    - power: supply: ab8500_charger: Bail out in case of error in
      'ab8500_charger_init_hw_registers()'
    - drm/etnaviv: make THERMAL selectable
    - iio: adc: ina2xx: Shift bus voltage register to mask flag bits
    - iio: health: max30102: Add power enable parameter to get_temp function
    - ath10k: update tdls teardown state to target
    - cpufreq: Fix governor module removal race
    - KVM: X86: Restart the guest when insn_len is zero and SEV is enabled
    - drm/amdgpu:fix random missing of FLR NOTIFY
    - scsi: ses: don't ask for diagnostic pages repeatedly during probe
    - pwm: stmpe: Fix wrong register offset for hwpwm=2 case
    - drm/sun4i: Fix format mask in DE2 driver
    - pinctrl: sh-pfc: r8a7791: Add can_clk function
    - pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using
      STP_ISEN_1_D
    - perf annotate: Fix unnecessary memory allocation for s390x
    - perf annotate: Fix objdump comment parsing for Intel mov dissassembly
    - iwlwifi: mvm: avoid dumping assert log when device is stopped
    - drm/amdgpu:fix virtual dce bug
    - drm/amdgpu: fix amdgpu_sync_resv v2
    - bnxt_en: Uninitialized variable in bnxt_tc_parse_actions()
    - clk: qcom: msm8916: fix mnd_width for codec_digcodec
    - mwifiex: cfg80211: do not change virtual interface during scan processing
    - ath10k: fix invalid STS_CAP_OFFSET_MASK
    - tools/usbip: fixes build with musl libc toolchain
    - spi: sun6i: disable/unprepare clocks on remove
    - bnxt_en: Don't print "Link speed -1 no longer supported" messages.
    - scsi: core: scsi_get_device_flags_keyed(): Always return device flags
    - scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
    - scsi: dh: add new rdac devices
    - clk: renesas: r8a77970: Add LVDS clock
    - staging: fsl-dpaa2/eth: Fix access to FAS field
    - media: vsp1: Prevent suspending and resuming DRM pipelines
    - dm raid: fix raid set size revalidation
    - media: cpia2: Fix a couple off by one bugs
    - media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
    - virtio_net: Disable interrupts if napi_complete_done rescheduled napi
    - net: sched: drop qdisc_reset from dev_graft_qdisc
    - veth: set peer GSO values
    - drm/amdkfd: Fix memory leaks in kfd topology
    - powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled
      context
    - arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
    - agp/intel: Flush all chipset writes after updating the GGTT
    - mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
    - mac80211: remove BUG() when interface type is invalid
    - crypto: caam/qi - use correct print specifier for size_t
    - ASoC: nuc900: Fix a loop timeout test
    - mmc: mmc_test: Ensure command queue is disabled for testing
    - Fix misannotated out-of-line _copy_to_user()
    - ipvlan: add L2 check for packets arriving via virtual devices
    - rcutorture/configinit: Fix build directory error message
    - locking/locktorture: Fix num reader/writer corner cases
    - ima: relax requiring a file signature for new files with zero length
    - IB/mlx5: revisit -Wmaybe-uninitialized warning
    - dmaengine: qcom_hidma: check pending interrupts
    - drm/i915/glk: Disable Guc and HuC on GLK
    - Linux 4.15.11
    - Config: Enable CONFIG_DRM_ETNAVIV_THERMAL=y

  * [FFE][Feature] KVM CLX avx512_vnni (LP: #1739665)
    - KVM: x86: add support for UMIP
    - KVM: Expose new cpu features to guest

  * Ubuntu18.04[P9 DD2.2 Boston]:Unable to boot power8 compat mode
    guests(ubuntu14.04.5) (kvm) (LP: #1756254)
    - KVM: PPC: Book3S HV: Allow HPT and radix on the same core for POWER9 v2.2

  * Allow hugepage backing for "p8compat" mode kvm guests (LP: #1754206)
    - KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing

  * [Bug][KVM][Crystal Ridge] Terrible performance of vNVDIMM on QEMU with
    device DAX backend (LP: #1745899)
    - x86/mm: add a function to check if a pfn is UC/UC-/WC
    - KVM: MMU: consider host cache mode in MMIO page check

  * nfp: read ME frequency from vNIC ctrl memory (LP: #1752818)
    - nfp: add TLV capabilities to the BAR
    - nfp: read ME frequency from vNIC ctrl memory
    - nfp: fix TLV offset calculation

  * Miscellaneous Ubuntu changes
    - [Packaging] skip cloud tools packaging when not building package
    - [Packaging] final-checks -- remove check for empty retpoline files

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 02 Apr 2018 15:43:20 -0300

linux (4.15.0-13.14) bionic; urgency=medium

  * linux: 4.15.0-13.14 -proposed tracker (LP: #1756408)

  * devpts: handle bind-mounts (LP: #1755857)
    - SAUCE: devpts: hoist out check for DEVPTS_SUPER_MAGIC
    - SAUCE: devpts: resolve devpts bind-mounts
    - SAUCE: devpts: comment devpts_mntget()
    - SAUCE: selftests: add devpts selftests

  * [bionic][arm64] d-i: add hisi_sas_v3_hw to scsi-modules (LP: #1756103)
    - d-i: add hisi_sas_v3_hw to scsi-modules

  * [Bionic][ARM64] enable ROCE and HNS3 driver support for hip08 SoC
    (LP: #1756097)
    - RDMA/hns: Refactor eq code for hip06
    - RDMA/hns: Add eq support of hip08
    - RDMA/hns: Add detailed comments for mb() call
    - RDMA/hns: Add rq inline data support for hip08 RoCE
    - RDMA/hns: Update the usage of sr_max and rr_max field
    - RDMA/hns: Set access flags of hip08 RoCE
    - RDMA/hns: Filter for zero length of sge in hip08 kernel mode
    - RDMA/hns: Fix QP state judgement before sending work requests
    - RDMA/hns: Assign dest_qp when deregistering mr
    - RDMA/hns: Fix endian problems around imm_data and rkey
    - RDMA/hns: Assign the correct value for tx_cqn
    - RDMA/hns: Create gsi qp in hip08
    - RDMA/hns: Add gsi qp support for modifying qp in hip08
    - RDMA/hns: Fill sq wqe context of ud type in hip08
    - RDMA/hns: Assign zero for pkey_index of wc in hip08
    - RDMA/hns: Update the verbs of polling for completion
    - RDMA/hns: Set the guid for hip08 RoCE device
    - net: hns3: Refactor of the reset interrupt handling logic
    - net: hns3: Add reset service task for handling reset requests
    - net: hns3: Refactors the requested reset & pending reset handling code
    - net: hns3: Add HNS3 VF IMP(Integrated Management Proc) cmd interface
    - net: hns3: Add mailbox support to VF driver
    - net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support
    - net: hns3: Add HNS3 VF driver to kernel build framework
    - net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC
    - net: hns3: Add mailbox support to PF driver
    - net: hns3: Change PF to add ring-vect binding & resetQ to mailbox
    - net: hns3: Add mailbox interrupt handling to PF driver
    - net: hns3: add support to query tqps number
    - net: hns3: add support to modify tqps number
    - net: hns3: change the returned tqp number by ethtool -x
    - net: hns3: free the ring_data structrue when change tqps
    - net: hns3: get rss_size_max from configuration but not hardcode
    - net: hns3: add a mask initialization for mac_vlan table
    - net: hns3: add vlan offload config command
    - net: hns3: add ethtool related offload command
    - net: hns3: add handling vlan tag offload in bd
    - net: hns3: cleanup mac auto-negotiation state query
    - net: hns3: fix for getting auto-negotiation state in hclge_get_autoneg
    - net: hns3: add support for set_pauseparam
    - net: hns3: add support to update flow control settings after autoneg
    - net: hns3: add Asym Pause support to phy default features
    - net: hns3: add support for querying advertised pause frame by ethtool ethx
    - net: hns3: Increase the default depth of bucket for TM shaper
    - net: hns3: change TM sched mode to TC-based mode when SRIOV enabled
    - net: hns3: hns3_get_channels() can be static
    - net: hns3: Add ethtool interface for vlan filter
    - net: hns3: Disable VFs change rxvlan offload status
    - net: hns3: Unify the strings display of packet statistics
    - net: hns3: Fix spelling errors
    - net: hns3: Remove repeat statistic of rx_errors
    - net: hns3: Modify the update period of packet statistics
    - net: hns3: Mask the packet statistics query when NIC is down
    - net: hns3: Fix an error of total drop packet statistics
    - net: hns3: Fix a loop index error of tqp statistics query
    - net: hns3: Fix an error macro definition of HNS3_TQP_STAT
    - net: hns3: Remove a useless member of struct hns3_stats
    - net: hns3: Add packet statistics of netdev
    - net: hns3: Fix a response data read error of tqp statistics query
    - net: hns3: fix for updating fc_mode_last_time
    - net: hns3: fix for setting MTU
    - net: hns3: fix for changing MTU
    - net: hns3: add MTU initialization for hardware
    - net: hns3: fix for not setting pause parameters
    - net: hns3: remove redundant semicolon
    - net: hns3: Add more packet size statisctics
    - Revert "net: hns3: Add packet statistics of netdev"
    - net: hns3: report the function type the same line with hns3_nic_get_stats64
    - net: hns3: add ethtool_ops.get_channels support for VF
    - net: hns3: remove TSO config command from VF driver
    - net: hns3: add ethtool_ops.get_coalesce support to PF
    - net: hns3: add ethtool_ops.set_coalesce support to PF
    - net: hns3: refactor interrupt coalescing init function
    - net: hns3: refactor GL update function
    - net: hns3: remove unused GL setup function
    - net: hns3: change the unit of GL value macro
    - net: hns3: add int_gl_idx setup for TX and RX queues
    - net: hns3: add feature check when feature changed
    - net: hns3: check for NULL function pointer in hns3_nic_set_features
    - net: hns: Fix for variable may be used uninitialized warnings
    - net: hns3: add support for get_regs
    - net: hns3: add manager table initialization for hardware
    - net: hns3: add ethtool -p support for fiber port
    - net: hns3: add net status led support for fiber port
    - net: hns3: converting spaces into tabs to avoid checkpatch.pl warning
    - net: hns3: add get/set_coalesce support to VF
    - net: hns3: add int_gl_idx setup for VF
    - [Config]: enable CONFIG_HNS3_HCLGEVF as module.

  * [Bionic][ARM64] add RAS extension and SDEI features (LP: #1756096)
    - KVM: arm64: Store vcpu on the stack during __guest_enter()
    - KVM: arm/arm64: Convert kvm_host_cpu_state to a static per-cpu allocation
    - KVM: arm64: Change hyp_panic()s dependency on tpidr_el2
    - arm64: alternatives: use tpidr_el2 on VHE hosts
    - KVM: arm64: Stop save/restoring host tpidr_el1 on VHE
    - Docs: dt: add devicetree binding for describing arm64 SDEI firmware
    - firmware: arm_sdei: Add driver for Software Delegated Exceptions
    - arm64: Add vmap_stack header file
    - arm64: uaccess: Add PAN helper
    - arm64: kernel: Add arch-specific SDEI entry code and CPU masking
    - firmware: arm_sdei: Add support for CPU and system power states
    - firmware: arm_sdei: add support for CPU private events
    - arm64: acpi: Remove __init from acpi_psci_use_hvc() for use by SDEI
    - firmware: arm_sdei: Discover SDEI support via ACPI
    - arm64: sysreg: Move to use definitions for all the SCTLR bits
    - arm64: cpufeature: Detect CPU RAS Extentions
    - arm64: kernel: Survive corrected RAS errors notified by SError
    - arm64: Unconditionally enable IESB on exception entry/return for firmware-
      first
    - arm64: kernel: Prepare for a DISR user
    - KVM: arm/arm64: mask/unmask daif around VHE guests
    - KVM: arm64: Set an impdef ESR for Virtual-SError using VSESR_EL2.
    - KVM: arm64: Save/Restore guest DISR_EL1
    - KVM: arm64: Save ESR_EL2 on guest SError
    - KVM: arm64: Handle RAS SErrors from EL1 on guest exit
    - KVM: arm64: Handle RAS SErrors from EL2 on guest exit
    - KVM: arm64: Emulate RAS error registers and set HCR_EL2's TERR & TEA
    - [Config]: enable RAS_EXTN and ARM_SDE_INTERFACE

  * [Bionic][ARM64] PCI and SAS driver patches for hip08 SoCs (LP: #1756094)
    - scsi: hisi_sas: fix dma_unmap_sg() parameter
    - scsi: ata: enhance the definition of SET MAX feature field value
    - scsi: hisi_sas: relocate clearing ITCT and freeing device
    - scsi: hisi_sas: optimise port id refresh function
    - scsi: hisi_sas: some optimizations of host controller reset
    - scsi: hisi_sas: modify hisi_sas_dev_gone() for reset
    - scsi: hisi_sas: add an mechanism to do reset work synchronously
    - scsi: hisi_sas: change ncq process for v3 hw
    - scsi: hisi_sas: add RAS feature for v3 hw
    - scsi: hisi_sas: add some print to enhance debugging
    - scsi: hisi_sas: improve int_chnl_int_v2_hw() consistency with v3 hw
    - scsi: hisi_sas: add v2 hw port AXI error handling support
    - scsi: hisi_sas: use an general way to delay PHY work
    - scsi: hisi_sas: do link reset for some CHL_INT2 ints
    - scsi: hisi_sas: judge result of internal abort
    - scsi: hisi_sas: add internal abort dev in some places
    - scsi: hisi_sas: fix SAS_QUEUE_FULL problem while running IO
    - scsi: hisi_sas: re-add the lldd_port_deformed()
    - scsi: hisi_sas: add v3 hw suspend and resume
    - scsi: hisi_sas: Change frame type for SET MAX commands
    - scsi: hisi_sas: make local symbol host_attrs static
    - scsi: hisi_sas: fix a bug in hisi_sas_dev_gone()
    - SAUCE: scsi: hisi_sas: config for hip08 ES
    - SAUCE: scsi: hisi_sas: export device table of v3 hw to userspace
    - PM / core: Add LEAVE_SUSPENDED driver flag
    - PCI / PM: Support for LEAVE_SUSPENDED driver flag
    - PCI/AER: Skip recovery callbacks for correctable errors from ACPI APEI
    - PCI/ASPM: Calculate LTR_L1.2_THRESHOLD from device characteristics
    - PCI/ASPM: Enable Latency Tolerance Reporting when supported
    - PCI/ASPM: Unexport internal ASPM interfaces
    - PCI: Make PCI_SCAN_ALL_PCIE_DEVS work for Root as well as Downstream Ports
    - PCI/AER: Return error if AER is not supported
    - PCI/DPC: Enable DPC only if AER is available

  * [CVE] Spectre: System Z {kernel} UBUNTU18.04 (LP: #1754580)
    - s390: scrub registers on kernel entry and KVM exit
    - s390: add optimized array_index_mask_nospec
    - s390/alternative: use a copy of the facility bit mask
    - s390: add options to change branch prediction behaviour for the kernel
    - s390: run user space and KVM guests with modified branch prediction
    - s390: introduce execute-trampolines for branches
    - s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*)
    - s390: do not bypass BPENTER for interrupt system calls
    - s390/entry.S: fix spurious zeroing of r0

  * s390/crypto: Fix kernel crash on aes_s390 module remove (LP: #1753424)
    - SAUCE: s390/crypto: Fix kernel crash on aes_s390 module remove.

  * [Feature]Update Ubuntu 18.04 lpfc FC driver with 32/64GB HBA support and bug
    fixes (LP: #1752182)
    - scsi: lpfc: FLOGI failures are reported when connected to a private loop.
    - scsi: lpfc: Expand WQE capability of every NVME hardware queue
    - scsi: lpfc: Handle XRI_ABORTED_CQE in soft IRQ
    - scsi: lpfc: Fix NVME LS abort_xri
    - scsi: lpfc: Raise maximum NVME sg list size for 256 elements
    - scsi: lpfc: Driver fails to detect direct attach storage array
    - scsi: lpfc: Fix display for debugfs queInfo
    - scsi: lpfc: Adjust default value of lpfc_nvmet_mrq
    - scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN
    - scsi: lpfc: Linux LPFC driver does not process all RSCNs
    - scsi: lpfc: correct port registrations with nvme_fc
    - scsi: lpfc: Correct driver deregistrations with host nvme transport
    - scsi: lpfc: Fix crash during driver unload with running nvme traffic
    - scsi: lpfc: Fix driver handling of nvme resources during unload
    - scsi: lpfc: small sg cnt cleanup
    - scsi: lpfc: Fix random heartbeat timeouts during heavy IO
    - scsi: lpfc: update driver version to 11.4.0.5
    - scsi: lpfc: Fix -EOVERFLOW behavior for NVMET and defer_rcv
    - scsi: lpfc: Fix receive PRLI handling
    - scsi: lpfc: Increase SCSI CQ and WQ sizes.
    - scsi: lpfc: Fix SCSI LUN discovery when SCSI and NVME enabled
    - scsi: lpfc: Fix issues connecting with nvme initiator
    - scsi: lpfc: Fix infinite wait when driver unregisters a remote NVME port.
    - scsi: lpfc: Beef up stat counters for debug
    - scsi: lpfc: update driver version to 11.4.0.6
    - scsi: lpfc: correct sg_seg_cnt attribute min vs default
    - scsi: scsi_transport_fc: fix typos on 64/128 GBit define names
    - scsi: lpfc: don't dereference localport before it has been null checked
    - scsi: lpfc: fix a couple of minor indentation issues
    - treewide: Use DEVICE_ATTR_RW
    - treewide: Use DEVICE_ATTR_RO
    - treewide: Use DEVICE_ATTR_WO
    - scsi: lpfc: Fix frequency of Release WQE CQEs
    - scsi: lpfc: Increase CQ and WQ sizes for SCSI
    - scsi: lpfc: move placement of target destroy on driver detach
    - scsi: lpfc: correct debug counters for abort
    - scsi: lpfc: Add WQ Full Logic for NVME Target
    - scsi: lpfc: Fix PRLI handling when topology type changes
    - scsi: lpfc: Fix IO failure during hba reset testing with nvme io.
    - scsi: lpfc: Fix RQ empty firmware trap
    - scsi: lpfc: Allow set of maximum outstanding SCSI cmd limit for a target
    - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
    - scsi: lpfc: Fix issue_lip if link is disabled
    - scsi: lpfc: Indicate CONF support in NVMe PRLI
    - scsi: lpfc: Fix SCSI io host reset causing kernel crash
    - scsi: lpfc: Validate adapter support for SRIU option
    - scsi: lpfc: Fix header inclusion in lpfc_nvmet
    - scsi: lpfc: Treat SCSI Write operation Underruns as an error
    - scsi: lpfc: Fix nonrecovery of NVME controller after cable swap.
    - scsi: lpfc: update driver version to 11.4.0.7
    - scsi: lpfc: Update 11.4.0.7 modified files for 2018 Copyright
    - scsi: lpfc: Rework lpfc to allow different sli4 cq and eq handlers
    - scsi: lpfc: Rework sli4 doorbell infrastructure
    - scsi: lpfc: Add SLI-4 if_type=6 support to the code base
    - scsi: lpfc: Add push-to-adapter support to sli4
    - scsi: lpfc: Add PCI Ids for if_type=6 hardware
    - scsi: lpfc: Add 64G link speed support
    - scsi: lpfc: Add if_type=6 support for cycling valid bits
    - scsi: lpfc: Enable fw download on if_type=6 devices
    - scsi: lpfc: Add embedded data pointers for enhanced performance
    - scsi: lpfc: Fix nvme embedded io length on new hardware
    - scsi: lpfc: Work around NVME cmd iu SGL type
    - scsi: lpfc: update driver version to 12.0.0.0
    - scsi: lpfc: Change Copyright of 12.0.0.0 modified files to 2018
    - scsi: lpfc: use __raw_writeX on DPP copies
    - scsi: lpfc: Add missing unlock in WQ full logic

  * CVE-2018-8043
    - net: phy: mdio-bcm-unimac: fix potential NULL dereference in
      unimac_mdio_probe()

  * Bionic update to 4.15.10 stable release (LP: #1756100)
    - Revert "UBUNTU: SAUCE: ALSA: hda/realtek - Add support headset mode for DELL
      WYSE"
    - RDMA/ucma: Limit possible option size
    - RDMA/ucma: Check that user doesn't overflow QP state
    - RDMA/mlx5: Fix integer overflow while resizing CQ
    - bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in __cpu_map_entry_alloc()
    - IB/uverbs: Improve lockdep_check
    - mac80211_hwsim: don't use WQ_MEM_RECLAIM
    - net/smc: fix NULL pointer dereference on sock_create_kern() error path
    - regulator: stm32-vrefbuf: fix check on ready flag
    - drm/i915: Check for fused or unused pipes
    - drm/i915/audio: fix check for av_enc_map overflow
    - drm/i915: Fix rsvd2 mask when out-fence is returned
    - drm/i915: Clear the in-use marker on execbuf failure
    - drm/i915: Disable DC states around GMBUS on GLK
    - drm/i915: Update watermark state correctly in sanitize_watermarks
    - drm/i915: Try EDID bitbanging on HDMI after failed read
    - drm/i915/perf: fix perf stream opening lock
    - scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
    - scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
    - drm/i915: Always call to intel_display_set_init_power() in resume_early.
    - workqueue: Allow retrieval of current task's work struct
    - drm: Allow determining if current task is output poll worker
    - drm/nouveau: Fix deadlock on runtime suspend
    - drm/radeon: Fix deadlock on runtime suspend
    - drm/amdgpu: Fix deadlock on runtime suspend
    - drm/nouveau: prefer XBGR2101010 for addfb ioctl
    - drm/amd/powerplay/smu7: allow mclk switching with no displays
    - drm/amd/powerplay/vega10: allow mclk switching with no displays
    - Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
    - drm/amd/display: check for ipp before calling cursor operations
    - drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
    - drm/amd/powerplay: fix power over limit on Fiji
    - drm/amd/display: Default HDMI6G support to true. Log VBIOS table error.
    - drm/amdgpu: used cached pcie gen info for SI (v2)
    - drm/amdgpu: Notify sbios device ready before send request
    - drm/radeon: fix KV harvesting
    - drm/amdgpu: fix KV harvesting
    - drm/amdgpu:Correct max uvd handles
    - drm/amdgpu:Always save uvd vcpu_bo in VM Mode
    - ovl: redirect_dir=nofollow should not follow redirect for opaque lower
    - MIPS: BMIPS: Do not mask IPIs during suspend
    - MIPS: ath25: Check for kzalloc allocation failure
    - MIPS: OCTEON: irq: Check for null return on kzalloc allocation
    - PCI: dwc: Fix enumeration end when reaching root subordinate
    - Input: matrix_keypad - fix race when disabling interrupts
    - Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI"
    - bug: use %pB in BUG and stack protector failure
    - lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
    - mm/memblock.c: hardcode the end_pfn being -1
    - Documentation/sphinx: Fix Directive import error
    - loop: Fix lost writes caused by missing flag
    - virtio_ring: fix num_free handling in error case
    - KVM: s390: fix memory overwrites when not using SCA entries
    - arm64: mm: fix thinko in non-global page table attribute check
    - IB/core: Fix missing RDMA cgroups release in case of failure to register
      device
    - Revert "nvme: create 'slaves' and 'holders' entries for hidden controllers"
    - kbuild: Handle builtin dtb file names containing hyphens
    - dm bufio: avoid false-positive Wmaybe-uninitialized warning
    - IB/mlx5: Fix incorrect size of klms in the memory region
    - bcache: fix crashes in duplicate cache device register
    - bcache: don't attach backing with duplicate UUID
    - x86/MCE: Save microcode revision in machine check records
    - x86/MCE: Serialize sysfs changes
    - perf tools: Fix trigger class trigger_on()
    - x86/spectre_v2: Don't check microcode versions when running under
      hypervisors
    - ALSA: hda/realtek - Add support headset mode for DELL WYSE
    - ALSA: hda/realtek - Add headset mode support for Dell laptop
    - ALSA: hda/realtek: Limit mic boost on T480
    - ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
    - ALSA: hda/realtek - Make dock sound work on ThinkPad L570
    - ALSA: seq: More protection for concurrent write and ioctl races
    - ALSA: hda: add dock and led support for HP EliteBook 820 G3
    - ALSA: hda: add dock and led support for HP ProBook 640 G2
    - scsi: qla2xxx: Fix NULL pointer crash due to probe failure
    - scsi: qla2xxx: Fix recursion while sending terminate exchange
    - dt-bindings: Document mti,mips-cpc binding
    - MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
    - nospec: Kill array_index_nospec_mask_check()
    - nospec: Include <asm/barrier.h> dependency
    - x86/entry: Reduce the code footprint of the 'idtentry' macro
    - x86/entry/64: Use 'xorl' for faster register clearing
    - x86/mm: Remove stale comment about KMEMCHECK
    - x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
    - x86/IO-APIC: Avoid warning in 32-bit builds
    - x86/LDT: Avoid warning in 32-bit builds with older gcc
    - x86-64/realmode: Add instruction suffix
    - Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
    - x86/speculation: Use IBRS if available before calling into firmware
    - x86/retpoline: Support retpoline builds with Clang
    - x86/speculation, objtool: Annotate indirect calls/jumps for objtool
    - x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
    - x86/paravirt, objtool: Annotate indirect calls
    - x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
    - x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
    - objtool: Use existing global variables for options
    - objtool: Add retpoline validation
    - objtool: Add module specific retpoline rules
    - objtool, retpolines: Integrate objtool with retpoline support more closely
    - objtool: Fix another switch table detection issue
    - objtool: Fix 32-bit build
    - x86/kprobes: Fix kernel crash when probing .entry_trampoline code
    - watchdog: hpwdt: SMBIOS check
    - watchdog: hpwdt: Check source of NMI
    - watchdog: hpwdt: fix unused variable warning
    - watchdog: hpwdt: Remove legacy NMI sourcing.
    - netfilter: add back stackpointer size checks
    - netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
    - netfilter: xt_hashlimit: fix lock imbalance
    - netfilter: x_tables: fix missing timer initialization in xt_LED
    - netfilter: nat: cope with negative port range
    - netfilter: IDLETIMER: be syzkaller friendly
    - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
    - netfilter: bridge: ebt_among: add missing match size checks
    - netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
    - netfilter: use skb_to_full_sk in ip6_route_me_harder
    - tpm_tis: Move ilb_base_addr to tpm_tis_data
    - tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
    - tpm: delete the TPM_TIS_CLK_ENABLE flag
    - tpm: remove unused variables
    - tpm: only attempt to disable the LPC CLKRUN if is already enabled
    - x86/xen: Calculate __max_logical_packages on PV domains
    - scsi: qla2xxx: Fix system crash for Notify ack timeout handling
    - scsi: qla2xxx: Fix gpnid error processing
    - scsi: qla2xxx: Move session delete to driver work queue
    - scsi: qla2xxx: Skip IRQ affinity for Target QPairs
    - scsi: qla2xxx: Fix re-login for Nport Handle in use
    - scsi: qla2xxx: Retry switch command on time out
    - scsi: qla2xxx: Serialize GPNID for multiple RSCN
    - scsi: qla2xxx: Fix login state machine stuck at GPDB
    - scsi: qla2xxx: Fix NPIV host cleanup in target mode
    - scsi: qla2xxx: Relogin to target port on a cable swap
    - scsi: qla2xxx: Fix Relogin being triggered too fast
    - scsi: qla2xxx: Fix PRLI state check
    - scsi: qla2xxx: Fix abort command deadlock due to spinlock
    - scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
    - scsi: qla2xxx: Fix scan state field for fcport
    - scsi: qla2xxx: Clear loop id after delete
    - scsi: qla2xxx: Defer processing of GS IOCB calls
    - scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
    - scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
    - scsi: qla2xxx: Fix memory leak in dual/target mode
    - NFS: Fix an incorrect type in struct nfs_direct_req
    - pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
    - NFS: Fix unstable write completion
    - Linux 4.15.10

  * Bionic update to 4.15.10 stable release (LP: #1756100) // CVE-2018-1000004.
    - ALSA: seq: Don't allow resizing pool in use

  * nfp: prioritize stats updates (LP: #1752061)
    - nfp: flower: prioritize stats updates

  * Ubuntu 18.04 - Kernel crash on nvme subsystem-reset /dev/nvme0 (Bolt / NVMe)
    (LP: #1753371)
    - nvme-pci: Fix EEH failure on ppc

  * sbsa watchdog crashes thunderx2 system (LP: #1755595)
    - watchdog: sbsa: use 32-bit read for WCV

  * KVM: s390: add vcpu stat counters for many instruction (LP: #1755132)
    - KVM: s390: diagnoses are instructions as well
    - KVM: s390: add vcpu stat counters for many instruction

  * CIFS SMB2/SMB3 does not work for domain based DFS (LP: #1747572)
    - CIFS: make IPC a regular tcon
    - CIFS: use tcon_ipc instead of use_ipc parameter of SMB2_ioctl
    - CIFS: dump IPC tcon in debug proc file

  * i2c-thunderx: erroneous error message "unhandled state: 0" (LP: #1754076)
    - i2c: octeon: Prevent error message on bus error

  * Boston-LC:bos1u1: Stress test on Qlogic Fibre Channel on Ubuntu KVM guest
    that caused KVM host crashed in qlt_free_session_done call (LP: #1750441)
    - scsi: qla2xxx: Fix memory corruption during hba reset test

  * Ubuntu 18.04 - Performance: Radix page fault handler bug in KVM
    (LP: #1752236)
    - KVM: PPC: Book3S HV: Fix handling of large pages in radix page fault handler

  * Fix ARC hit rate (LP: #1755158)
    - SAUCE: Fix ARC hit rate (LP: #1755158)

  * Bionic update to 4.15.9 stable release (LP: #1755275)
    - bpf: fix mlock precharge on arraymaps
    - bpf: fix memory leak in lpm_trie map_free callback function
    - bpf: fix rcu lockdep warning for lpm_trie map_free callback
    - bpf, x64: implement retpoline for tail call
    - bpf, arm64: fix out of bounds access in tail call
    - bpf: add schedule points in percpu arrays management
    - bpf: allow xadd only on aligned memory
    - bpf, ppc64: fix out of bounds access in tail call
    - scsi: mpt3sas: fix oops in error handlers after shutdown/unload
    - scsi: mpt3sas: wait for and flush running commands on shutdown/unload
    - KVM: x86: fix backward migration with async_PF
    - Linux 4.15.9

  * Bionic update to 4.15.8 stable release (LP: #1755179)
    - hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)
    - ipmi_si: Fix error handling of platform device
    - platform/x86: dell-laptop: Allocate buffer on heap rather than globally
    - powerpc/pseries: Enable RAS hotplug events later
    - Bluetooth: btusb: Use DMI matching for QCA reset_resume quirking
    - ixgbe: fix crash in build_skb Rx code path
    - tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the
      bus
    - tpm: fix potential buffer overruns caused by bit glitches on the bus
    - tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on
      the bus
    - tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the
      bus
    - tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
    - ALSA: usb-audio: Add a quirck for B&W PX headphones
    - ALSA: control: Fix memory corruption risk in snd_ctl_elem_read
    - ALSA: x86: Fix missing spinlock and mutex initializations
    - ALSA: hda: Add a power_save blacklist
    - ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
    - mmc: sdhci-pci: Fix S0i3 for Intel BYT-based controllers
    - mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
    - mmc: dw_mmc: Avoid accessing registers in runtime suspended state
    - mmc: dw_mmc: Factor out dw_mci_init_slot_caps
    - mmc: dw_mmc: Fix out-of-bounds access for slot's caps
    - timers: Forward timer base before migrating timers
    - parisc: Use cr16 interval timers unconditionally on qemu
    - parisc: Reduce irq overhead when run in qemu
    - parisc: Fix ordering of cache and TLB flushes
    - parisc: Hide virtual kernel memory layout
    - btrfs: use proper endianness accessors for super_copy
    - block: fix the count of PGPGOUT for WRITE_SAME
    - block: kyber: fix domain token leak during requeue
    - block: pass inclusive 'lend' parameter to truncate_inode_pages_range
    - vfio: disable filesystem-dax page pinning
    - cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
    - dax: fix vma_is_fsdax() helper
    - direct-io: Fix sleep in atomic due to sync AIO
    - x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
    - x86/platform/intel-mid: Handle Intel Edison reboot correctly
    - x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table
    - bridge: check brport attr show in brport_show
    - fib_semantics: Don't match route with mismatching tclassid
    - hdlc_ppp: carrier detect ok, don't turn off negotiation
    - ipv6 sit: work around bogus gcc-8 -Wrestrict warning
    - net: amd-xgbe: fix comparison to bitshift when dealing with a mask
    - net: ethernet: ti: cpsw: fix net watchdog timeout
    - net: fix race on decreasing number of TX queues
    - net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
    - netlink: ensure to loop over all netns in genlmsg_multicast_allns()
    - net: sched: report if filter is too large to dump
    - ppp: prevent unregistered channels from connecting to PPP units
    - sctp: verify size of a new chunk in _sctp_make_chunk()
    - udplite: fix partial checksum initialization
    - net/mlx5e: Fix TCP checksum in LRO buffers
    - sctp: fix dst refcnt leak in sctp_v4_get_dst
    - mlxsw: spectrum_switchdev: Check success of FDB add operation
    - net/mlx5e: Specify numa node when allocating drop rq
    - net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
    - tcp: Honor the eor bit in tcp_mtu_probe
    - rxrpc: Fix send in rxrpc_send_data_packet()
    - tcp_bbr: better deal with suboptimal GSO
    - doc: Change the min default value of tcp_wmem/tcp_rmem.
    - net/mlx5e: Fix loopback self test when GRO is off
    - net_sched: gen_estimator: fix broken estimators based on percpu stats
    - net/sched: cls_u32: fix cls_u32 on filter replace
    - sctp: do not pr_err for the duplicated node in transport rhlist
    - mlxsw: spectrum_router: Fix error path in mlxsw_sp_vr_create
    - net: ipv4: Set addr_type in hash_keys for forwarded case
    - sctp: fix dst refcnt leak in sctp_v6_get_dst()
    - bridge: Fix VLAN reference count problem
    - net/mlx5e: Verify inline header size do not exceed SKB linear size
    - tls: Use correct sk->sk_prot for IPV6
    - amd-xgbe: Restore PCI interrupt enablement setting on resume
    - cls_u32: fix use after free in u32_destroy_key()
    - mlxsw: spectrum_router: Do not unconditionally clear route offload
      indication
    - netlink: put module reference if dump start fails
    - tcp: purge write queue upon RST
    - tuntap: correctly add the missing XDP flush
    - tuntap: disable preemption during XDP processing
    - virtio-net: disable NAPI only when enabled during XDP set
    - cxgb4: fix trailing zero in CIM LA dump
    - net/mlx5: Fix error handling when adding flow rules
    - net: phy: Restore phy_resume() locking assumption
    - tcp: tracepoint: only call trace_tcp_send_reset with full socket
    - l2tp: don't use inet_shutdown on tunnel destroy
    - l2tp: don't use inet_shutdown on ppp session destroy
    - l2tp: fix races with tunnel socket close
    - l2tp: fix race in pppol2tp_release with session object destroy
    - l2tp: fix tunnel lookup use-after-free race
    - s390/qeth: fix underestimated count of buffer elements
    - s390/qeth: fix SETIP command handling
    - s390/qeth: fix overestimated count of buffer elements
    - s390/qeth: fix IP removal on offline cards
    - s390/qeth: fix double-free on IP add/remove race
    - Revert "s390/qeth: fix using of ref counter for rxip addresses"
    - s390/qeth: fix IP address lookup for L3 devices
    - s390/qeth: fix IPA command submission race
    - tcp: revert F-RTO middle-box workaround
    - tcp: revert F-RTO extension to detect more spurious timeouts
    - blk-mq: don't call io sched's .requeue_request when requeueing rq to
      ->dispatch
    - media: m88ds3103: don't call a non-initalized function
    - EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL
    - KVM: s390: take care of clock-comparator sign control
    - KVM: s390: provide only a single function for setting the tod (fix SCK)
    - KVM: s390: consider epoch index on hotplugged CPUs
    - KVM: s390: consider epoch index on TOD clock syncs
    - nospec: Allow index argument to have const-qualified type
    - x86/mm: Fix {pmd,pud}_{set,clear}_flags()
    - ARM: orion: fix orion_ge00_switch_board_info initialization
    - ARM: dts: rockchip: Remove 1.8 GHz operation point from phycore som
    - ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
    - ARM: kvm: fix building with gcc-8
    - KVM: X86: Fix SMRAM accessing even if VM is shutdown
    - KVM: mmu: Fix overlap between public and private memslots
    - KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
    - KVM: x86: move LAPIC initialization after VMCS creation
    - KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR
      path as unlikely()
    - KVM: x86: fix vcpu initialization with userspace lapic
    - KVM/x86: remove WARN_ON() for when vm_munmap() fails
    - ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
    - ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
    - ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
    - powerpc/64s/radix: Boot-time NULL pointer protection using a guard-PID
    - md: only allow remove_and_add_spares when no sync_thread running.
    - platform/x86: dell-laptop: fix kbd_get_state's request value
    - Linux 4.15.8

  * ZFS setgid broken on 0.7 (LP: #1753288)
    - SAUCE: Fix ZFS setgid

  * /proc/kallsyms prints "(null)" for null addresses in 4.15 (LP: #1754297)
    - vsprintf: avoid misleading "(null)" for %px

  * Miscellaneous Ubuntu changes
    - d-i: Add netsec to nic-modules
    - [Config] fix up retpoline abi files
    - [Config] set NOBP and expoline options for s390

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 16 Mar 2018 14:49:27 -0300

linux (4.15.0-12.13) bionic; urgency=medium

  * linux: 4.15.0-12.13 -proposed tracker (LP: #1754059)

  * CONFIG_EFI=y on armhf (LP: #1726362)
    - [Config] CONFIG_EFI=y on armhf, reconcile secureboot EFI settings

  * ppc64el: Support firmware disable of RFI flush (LP: #1751994)
    - powerpc/pseries: Support firmware disable of RFI flush
    - powerpc/powernv: Support firmware disable of RFI flush

  * [Feature] CFL/CNL (PCH:CNP-H): New GPIO Commit added (GPIO Driver needed)
    (LP: #1751714)
    - gpio / ACPI: Drop unnecessary ACPI GPIO to Linux GPIO translation
    - pinctrl: intel: Allow custom GPIO base for pad groups
    - pinctrl: cannonlake: Align GPIO number space with Windows

  * [Feature] Add xHCI debug device support in the driver (LP: #1730832)
    - usb: xhci: Make some static functions global
    - usb: xhci: Add DbC support in xHCI driver
    - [Config] USB_XHCI_DBGCAP=y for commit mainline dfba2174dc42.

  * [SRU] Lenovo E41 Mic mute hotkey is not responding (LP: #1753347)
    - platform/x86: ideapad-laptop: Increase timeout to wait for EC answer

  * headset mic can't be detected on two Dell machines (LP: #1748807)
    - ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines

  * hisi_sas: Add disk LED support (LP: #1752695)
    - scsi: hisi_sas: directly attached disk LED feature for v2 hw

  * [Feature] [Graphics]Whiskey Lake (Coffelake-U 4+2) new PCI Device ID adds
    (LP: #1742561)
    - drm/i915/cfl: Adding more Coffee Lake PCI IDs.

  * [Bug] [USB Function][CFL-CNL PCH]Stall Error and USB Transaction Error in
    trace, Disable of device-initiated U1/U2 failed and rebind failed: -517
    during suspend/resume with usb storage. (LP: #1730599)
    - usb: Don't print a warning if interface driver rebind is deferred at resume

  * retpoline: ignore %cs:0xNNN constant indirections (LP: #1752655)
    - [Packaging] retpoline -- elide %cs:0xNNNN constants on i386
    - [Config] retpoline -- clean up i386 retpoline files

  * hisilicon hibmc regression due to ea642c3216cb ("drm/ttm: add io_mem_pfn
    callback") (LP: #1738334)
    - drm/ttm: add ttm_bo_io_mem_pfn to check io_mem_pfn

  * [Asus UX360UA] battery status in unity-panel is not changing when battery is
    being charged (LP: #1661876) // AC adapter status not detected on Asus
    ZenBook UX410UAK (LP: #1745032)
    - ACPI / battery: Add quirk for Asus UX360UA and UX410UAK

  * ASUS UX305LA - Battery state not detected correctly (LP: #1482390)
    - ACPI / battery: Add quirk for Asus GL502VSK and UX305LA

  * [18.04 FEAT] Automatically detect layer2 setting in the qeth device driver
    (LP: #1747639)
    - s390/diag: add diag26c support for VNIC info
    - s390/qeth: support early setup for z/VM NICs

  * Bionic update to v4.15.7 stable release (LP: #1752317)
    - netfilter: drop outermost socket lock in getsockopt()
    - arm64: mm: don't write garbage into TTBR1_EL1 register
    - kconfig.h: Include compiler types to avoid missed struct attributes
    - MIPS: boot: Define __ASSEMBLY__ for its.S build
    - xtensa: fix high memory/reserved memory collision
    - scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info
    - MIPS: Drop spurious __unused in struct compat_flock
    - cfg80211: fix cfg80211_beacon_dup
    - i2c: designware: must wait for enable
    - i2c: bcm2835: Set up the rising/falling edge delays
    - X.509: fix BUG_ON() when hash algorithm is unsupported
    - X.509: fix NULL dereference when restricting key with unsupported_sig
    - PKCS#7: fix certificate chain verification
    - PKCS#7: fix certificate blacklisting
    - extcon: int3496: process id-pin first so that we start with the right status
    - genirq/matrix: Handle CPU offlining proper
    - RDMA/uverbs: Protect from races between lookup and destroy of uobjects
    - RDMA/uverbs: Protect from command mask overflow
    - RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd
    - RDMA/uverbs: Fix circular locking dependency
    - RDMA/uverbs: Sanitize user entered port numbers prior to access it
    - iio: adc: stm32: fix stm32h7_adc_enable error handling
    - iio: srf08: fix link error "devm_iio_triggered_buffer_setup" undefined
    - iio: buffer: check if a buffer has been set up when poll is called
    - iio: adis_lib: Initialize trigger before requesting interrupt
    - Kbuild: always define endianess in kconfig.h
    - x86/apic/vector: Handle vector release on CPU unplug correctly
    - x86/oprofile: Fix bogus GCC-8 warning in nmi_setup()
    - mm, swap, frontswap: fix THP swap if frontswap enabled
    - mm: don't defer struct page initialization for Xen pv guests
    - uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define
    - irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()
    - irqchip/mips-gic: Avoid spuriously handling masked interrupts
    - PCI/cxgb4: Extend T3 PCI quirk to T4+ devices
    - net: thunderbolt: Tear down connection properly on suspend
    - net: thunderbolt: Run disconnect flow asynchronously when logout is received
    - ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and
      io_watchdog_func()
    - usb: ohci: Proper handling of ed_rm_list to handle race condition between
      usb_kill_urb() and finish_unlinks()
    - arm64: Remove unimplemented syscall log message
    - arm64: Disable unhandled signal log messages by default
    - arm64: cpufeature: Fix CTR_EL0 field definitions
    - Add delay-init quirk for Corsair K70 RGB keyboards
    - usb: host: ehci: use correct device pointer for dma ops
    - usb: dwc3: gadget: Set maxpacket size for ep0 IN
    - usb: dwc3: ep0: Reset TRB counter for ep0 IN
    - usb: phy: mxs: Fix NULL pointer dereference on i.MX23/28
    - usb: ldusb: add PIDs for new CASSY devices supported by this driver
    - Revert "usb: musb: host: don't start next rx urb if current one failed"
    - usb: gadget: f_fs: Process all descriptors during bind
    - usb: gadget: f_fs: Use config_ep_by_speed()
    - usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path
    - drm/cirrus: Load lut in crtc_commit
    - drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits
    - drm: Handle unexpected holes in color-eviction
    - drm/amdgpu: disable MMHUB power gating on raven
    - drm/amdgpu: fix VA hole handling on Vega10 v3
    - drm/amdgpu: Add dpm quirk for Jet PRO (v2)
    - drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji
    - drm/amdgpu: Avoid leaking PM domain on driver unbind (v2)
    - drm/amdgpu: add new device to use atpx quirk
    - arm64: __show_regs: Only resolve kernel symbols when running at EL1
    - drm/i915/breadcrumbs: Ignore unsubmitted signalers
    - microblaze: fix endian handling
    - Linux 4.15.7

  * [regression] Colour banding and artefacts appear system-wide on an Asus
    Zenbook UX303LA with Intel HD 4400 graphics (LP: #1749420) // Bionic update
    to v4.15.7 stable release (LP: #1752317)
    - drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA

  * errors with sas hotplug (LP: #1752146)
    - scsi: libsas: fix memory leak in sas_smp_get_phy_events()
    - scsi: libsas: fix error when getting phy events
    - scsi: libsas: initialize sas_phy status according to response of DISCOVER
    - scsi: libsas: Use dynamic alloced work to avoid sas event lost
    - scsi: libsas: shut down the PHY if events reached the threshold
    - scsi: libsas: make the event threshold configurable
    - scsi: libsas: Use new workqueue to run sas event and disco event
    - scsi: libsas: use flush_workqueue to process disco events synchronously
    - scsi: libsas: direct call probe and destruct
    - scsi: libsas: notify event PORTE_BROADCAST_RCVD in sas_enable_revalidation()

  * rtnetlink: enable namespace identifying properties in rtnetlink requests
    (LP: #1748232)
    - rtnetlink: enable IFLA_IF_NETNSID in do_setlink()
    - rtnetlink: enable IFLA_IF_NETNSID for RTM_SETLINK
    - rtnetlink: enable IFLA_IF_NETNSID for RTM_DELLINK
    - rtnetlink: enable IFLA_IF_NETNSID for RTM_NEWLINK
    - rtnetlink: remove check for IFLA_IF_NETNSID
    - rtnetlink: require unique netns identifier

  * Bionic update to v4.15.6 stable release (LP: #1752119)
    - tun: fix tun_napi_alloc_frags() frag allocator
    - ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
    - ptr_ring: try vmalloc() when kmalloc() fails
    - selinux: ensure the context is NUL terminated in
      security_context_to_sid_core()
    - selinux: skip bounded transition processing if the policy isn't loaded
    - media: pvrusb2: properly check endpoint types
    - crypto: x86/twofish-3way - Fix %rbp usage
    - staging: android: ion: Add __GFP_NOWARN for system contig heap
    - staging: android: ion: Switch from WARN to pr_warn
    - blk_rq_map_user_iov: fix error override
    - KVM: x86: fix escape of guest dr6 to the host
    - kcov: detect double association with a single task
    - netfilter: x_tables: fix int overflow in xt_alloc_table_info()
    - netfilter: x_tables: avoid out-of-bounds reads in
      xt_request_find_{match|target}
    - netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
    - netfilter: on sockopt() acquire sock lock only in the required scope
    - netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()
    - netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
    - rds: tcp: correctly sequence cleanup on netns deletion.
    - rds: tcp: atomically purge entries from rds_tcp_conn_list during netns
      delete
    - net: avoid skb_warn_bad_offload on IS_ERR
    - net_sched: gen_estimator: fix lockdep splat
    - soc: qcom: rmtfs_mem: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - ASoC: ux500: add MODULE_LICENSE tag
    - video: fbdev/mmp: add MODULE_LICENSE
    - ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag
    - arm64: dts: add #cooling-cells to CPU nodes
    - dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
    - ANDROID: binder: remove WARN() for redundant txn error
    - ANDROID: binder: synchronize_rcu() when using POLLFREE.
    - staging: android: ashmem: Fix a race condition in pin ioctls
    - binder: check for binder_thread allocation failure in binder_poll()
    - binder: replace "%p" with "%pK"
    - staging: fsl-mc: fix build testing on x86
    - staging: iio: adc: ad7192: fix external frequency setting
    - staging: iio: ad5933: switch buffer mode to software
    - xhci: Fix NULL pointer in xhci debugfs
    - xhci: Fix xhci debugfs devices node disappearance after hibernation
    - xhci: xhci debugfs device nodes weren't removed after device plugged out
    - xhci: fix xhci debugfs errors in xhci_stop
    - usbip: keep usbip_device sockfd state in sync with tcp_socket
    - crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
    - mei: me: add cannon point device ids
    - mei: me: add cannon point device ids for 4th device
    - vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems
    - Linux 4.15.6

  * Unable to insert test_bpf module on Bionic s390x (LP: #1751234)
    - bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y

  * [Ubuntu 18.04 FEAT] OpenCAPI enabling (LP: #1746988)
    - powerpc/powernv: Introduce new PHB type for opencapi links
    - powerpc/powernv: Set correct configuration space size for opencapi devices
    - powerpc/powernv: Add opal calls for opencapi
    - powerpc/powernv: Add platform-specific services for opencapi
    - powerpc/powernv: Capture actag information for the device
    - ocxl: Driver code for 'generic' opencapi devices
    - ocxl: Add AFU interrupt support
    - ocxl: Add a kernel API for other opencapi drivers
    - ocxl: Add trace points
    - ocxl: Add Makefile and Kconfig
    - [Config] CONFIG_OCXL=m for ppc64el
    - cxl: Remove support for "Processing accelerators" class
    - ocxl: Documentation
    - ocxl: add MAINTAINERS entry
    - cxl: Add support for ASB_Notify on POWER9

  * Request to update 18.04 kernel aacraid to upstream 4.16 version
    (LP: #1746801)
    - scsi: aacraid: remove unused variable managed_request_id
    - scsi: aacraid: Do not attempt abort when Fw panicked
    - scsi: aacraid: Do not remove offlined devices
    - scsi: aacraid: Fix ioctl reset hang
    - scsi: aacraid: Allow reset_host sysfs var to recover Panicked Fw
    - scsi: aacraid: Refactor reset_host store function
    - scsi: aacraid: Move code to wait for IO completion to shutdown func
    - scsi: aacraid: Create bmic submission function from bmic identify
    - scsi: aacraid: Change phy luns function to use common bmic function
    - scsi: aacraid: Refactor and rename to make mirror existing changes
    - scsi: aacraid: Add target setup helper function
    - scsi: aacraid: Untangle targets setup from report phy luns
    - scsi: aacraid: Move function around to match existing code
    - scsi: aacraid: Create helper functions to get lun info
    - scsi: aacraid: Save bmic phy information for each phy
    - scsi: aacraid: Add helper function to set queue depth
    - scsi: aacraid: Merge func to get container information
    - scsi: aacraid: Process hba and container hot plug events in single function
    - scsi: aacraid: Added macros to help loop through known buses and targets
    - scsi: aacraid: Refactor resolve luns code and scsi functions
    - scsi: aacraid: Merge adapter setup with resolve luns
    - scsi: aacraid: Block concurrent hotplug event handling
    - scsi: aacraid: Use hotplug handling function in place of scsi_scan_host
    - scsi: aacraid: Reschedule host scan in case of failure
    - scsi: aacraid: Fix hang while scanning in eh recovery
    - scsi: aacraid: Skip schedule rescan in case of kdump
    - scsi: aacraid: Remove unused rescan variable
    - scsi: aacraid: Remove AAC_HIDE_DISK check in queue command
    - scsi: aacraid: Update driver version to 50877
    - scsi: aacraid: Fix driver oops with dead battery
    - scsi: aacraid: remove redundant setting of variable c
    - scsi: aacraid: Get correct lun count
    - scsi: aacraid: Delay for rescan worker needs to be 10 seconds

  * [18.04] kpatch - Add livepatch hook support for ppc64le (LP: #1741992)
    - powerpc/modules: Add REL24 relocation support of livepatch symbols
    - powerpc/modules: Don't try to restore r2 after a sibling call
    - powerpc/modules: Improve restore_r2() error message

  * Ubuntu 18.04 - Include latest ibmvnic fixes in Ubuntu kernel (LP: #1748517)
    - ibmvnic: Rename IBMVNIC_MAX_TX_QUEUES to IBMVNIC_MAX_QUEUES
    - ibmvnic: Increase maximum number of RX/TX queues
    - ibmvnic: Include header descriptor support for ARP packets
    - ibmvnic: Don't handle RX interrupts when not up.
    - ibmvnic: Wait for device response when changing MAC
    - ibmvnic: fix firmware version when no firmware level has been provided by
      the VIOS server
    - ibmvnic: fix empty firmware version and errors cleanup
    - ibmvnic: Fix rx queue cleanup for non-fatal resets
    - ibmvnic: Ensure that buffers are NULL after free
    - ibmvnic: queue reset when CRQ gets closed during reset
    - ibmvnic: Reset long term map ID counter
    - ibmvnic: Remove skb->protocol checks in ibmvnic_xmit
    - ibmvnic: Wait until reset is complete to set carrier on
    - ibmvnic: Fix login buffer memory leaks
    - ibmvnic: Fix NAPI structures memory leak
    - ibmvnic: Free RX socket buffer in case of adapter error
    - ibmvnic: Clean RX pool buffers during device close
    - ibmvnic: Check for NULL skb's in NAPI poll routine
    - ibmvnic: Fix early release of login buffer

  * Power9 DD 2.2 needs HMI fixup backport of upstream
    patch(d075745d893c78730e4a3b7a60fca23c2f764081) into kernel (LP: #1751834)
    - KVM: PPC: Book3S HV: Improve handling of debug-trigger HMIs on POWER9

  * Driver not found in Ubuntu kernel does not detect interface (LP: #1745927)
    - d-i: add cxgb4 to nic-modules

  * BCM5719/tg3 loses connectivity due to missing heartbeats between fw and
    driver (LP: #1751337)
    - tg3: APE heartbeat changes

  * Miscellaneous Ubuntu changes
    - ubuntu: vbox -- update to 5.2.6-dfsg-5
    - Revert "UBUNTU: SAUCE: Import aufs driver"
    - SAUCE: Import aufs driver
    - Revert "UBUNTU: SAUCE: (no-up) Convert bnx2x firmware files to ihex format"
    - [Packaging] retpoline-extract: flag *0xNNN(%reg) branches
    - [Config] fix up retpoline abi files
    - ubuntu: vbox -- update to 5.2.8-dfsg-2

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 07 Mar 2018 17:36:23 +0100

linux (4.15.0-11.12) bionic; urgency=medium

  * linux: 4.15.0-11.12 -proposed tracker (LP: #1751285)

  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
    - [Config] CONFIG_INDIRECT_PIO=y
    - SAUCE: LIB: Introduce a generic PIO mapping method
    - SAUCE: PCI: Remove unused __weak attribute in pci_register_io_range()
    - SAUCE: PCI: Add fwnode handler as input param of pci_register_io_range()
    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
    - [Config] CONFIG_HISILICON_LPC=y
    - SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
    - SAUCE: ACPI / scan: do not enumerate Indirect IO host children
    - SAUCE: HISI LPC: Add ACPI support
    - SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver

  * Bionic update to v4.15.5 stable release (LP: #1751131)
    - scsi: smartpqi: allow static build ("built-in")
    - IB/umad: Fix use of unprotected device pointer
    - IB/qib: Fix comparison error with qperf compare/swap test
    - IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
    - IB/core: Fix two kernel warnings triggered by rxe registration
    - IB/core: Fix ib_wc structure size to remain in 64 bytes boundary
    - IB/core: Avoid a potential OOPs for an unused optional parameter
    - selftests: seccomp: fix compile error seccomp_bpf
    - kselftest: fix OOM in memory compaction test
    - RDMA/rxe: Fix a race condition related to the QP error state
    - RDMA/rxe: Fix a race condition in rxe_requester()
    - RDMA/rxe: Fix rxe_qp_cleanup()
    - cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
    - PM / devfreq: Propagate error from devfreq_add_device()
    - mwifiex: resolve reset vs. remove()/shutdown() deadlocks
    - ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
    - trace_uprobe: Display correct offset in uprobe_events
    - powerpc/radix: Remove trace_tlbie call from radix__flush_tlb_all
    - powerpc/kernel: Block interrupts when updating TIDR
    - powerpc/vas: Don't set uses_vas for kernel windows
    - powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove
    - powerpc/mm: Flush radix process translations when setting MMU type
    - powerpc/xive: Use hw CPU ids when configuring the CPU queues
    - dma-buf: fix reservation_object_wait_timeout_rcu once more v2
    - s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
    - arm64: dts: msm8916: Correct ipc references for smsm
    - ARM: lpc3250: fix uda1380 gpio numbers
    - ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
    - ARM: dts: nomadik: add interrupt-parent for clcd
    - arm: dts: mt7623: fix card detection issue on bananapi-r2
    - arm: spear600: Add missing interrupt-parent of rtc
    - arm: spear13xx: Fix dmas cells
    - arm: spear13xx: Fix spics gpio controller's warning
    - x86/gpu: add CFL to early quirks
    - x86/kexec: Make kexec (mostly) work in 5-level paging mode
    - x86/xen: init %gs very early to avoid page faults with stack protector
    - x86: PM: Make APM idle driver initialize polling state
    - mm, memory_hotplug: fix memmap initialization
    - x86/entry/64: Clear extra registers beyond syscall arguments, to reduce
      speculation attack surface
    - x86/entry/64/compat: Clear registers for compat syscalls, to reduce
      speculation attack surface
    - compiler-gcc.h: Introduce __optimize function attribute
    - compiler-gcc.h: __nostackprotector needs gcc-4.4 and up
    - crypto: sun4i_ss_prng - fix return value of sun4i_ss_prng_generate
    - crypto: sun4i_ss_prng - convert lock to _bh in sun4i_ss_prng_generate
    - powerpc/mm/radix: Split linear mapping on hot-unplug
    - x86/mm/pti: Fix PTI comment in entry_SYSCALL_64()
    - x86/speculation: Update Speculation Control microcode blacklist
    - x86/speculation: Correct Speculation Control microcode blacklist again
    - Revert "x86/speculation: Simplify indirect_branch_prediction_barrier()"
    - KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(),
      by always inlining iterator helper methods
    - X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
    - KVM/nVMX: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR
      bitmap
    - x86/speculation: Clean up various Spectre related details
    - PM / runtime: Update links_count also if !CONFIG_SRCU
    - PM: cpuidle: Fix cpuidle_poll_state_init() prototype
    - platform/x86: wmi: fix off-by-one write in wmi_dev_probe()
    - x86/entry/64: Clear registers for exceptions/interrupts, to reduce
      speculation attack surface
    - x86/entry/64: Merge SAVE_C_REGS and SAVE_EXTRA_REGS, remove unused
      extensions
    - x86/entry/64: Merge the POP_C_REGS and POP_EXTRA_REGS macros into a single
      POP_REGS macro
    - x86/entry/64: Interleave XOR register clearing with PUSH instructions
    - x86/entry/64: Introduce the PUSH_AND_CLEAN_REGS macro
    - x86/entry/64: Use PUSH_AND_CLEAN_REGS in more cases
    - x86/entry/64: Get rid of the ALLOC_PT_GPREGS_ON_STACK and
      SAVE_AND_CLEAR_REGS macros
    - x86/entry/64: Indent PUSH_AND_CLEAR_REGS and POP_REGS properly
    - x86/entry/64: Fix paranoid_entry() frame pointer warning
    - x86/entry/64: Remove the unused 'icebp' macro
    - selftests/x86: Fix vDSO selftest segfault for vsyscall=none
    - selftests/x86: Clean up and document sscanf() usage
    - selftests/x86/pkeys: Remove unused functions
    - selftests/x86: Fix build bug caused by the 5lvl test which has been moved to
      the VM directory
    - selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c
    - gfs2: Fixes to "Implement iomap for block_map"
    - selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c
    - selftests/x86: Disable tests requiring 32-bit support on pure 64-bit systems
    - objtool: Fix segfault in ignore_unreachable_insn()
    - x86/debug, objtool: Annotate WARN()-related UD2 as reachable
    - x86/debug: Use UD2 for WARN()
    - x86/speculation: Fix up array_index_nospec_mask() asm constraint
    - nospec: Move array_index_nospec() parameter checking into separate macro
    - x86/speculation: Add <asm/msr-index.h> dependency
    - x86/mm: Rename flush_tlb_single() and flush_tlb_one() to
      __flush_tlb_one_[user|kernel]()
    - selftests/x86/mpx: Fix incorrect bounds with old _sigfault
    - x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
    - x86/spectre: Fix an error message
    - x86/cpu: Change type of x86_cache_size variable to unsigned int
    - x86/entry/64: Fix CR3 restore in paranoid_exit()
    - drm/ttm: Don't add swapped BOs to swap-LRU list
    - drm/ttm: Fix 'buf' pointer update in ttm_bo_vm_access_kmap() (v2)
    - drm/qxl: unref cursor bo when finished with it
    - drm/qxl: reapply cursor after resetting primary
    - drm/amd/powerplay: Fix smu_table_entry.handle type
    - drm/ast: Load lut in crtc_commit
    - drm: Check for lessee in DROP_MASTER ioctl
    - arm64: Add missing Falkor part number for branch predictor hardening
    - drm/radeon: Add dpm quirk for Jet PRO (v2)
    - drm/radeon: adjust tested variable
    - x86/smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a
      physical CPU
    - rtc-opal: Fix handling of firmware error codes, prevent busy loops
    - mbcache: initialize entry->e_referenced in mb_cache_entry_create()
    - mmc: sdhci: Implement an SDHCI-specific bounce buffer
    - mmc: bcm2835: Don't overwrite max frequency unconditionally
    - Revert "mmc: meson-gx: include tx phase in the tuning process"
    - mlx5: fix mlx5_get_vector_affinity to start from completion vector 0
    - Revert "apple-gmux: lock iGP IO to protect from vgaarb changes"
    - jbd2: fix sphinx kernel-doc build warnings
    - ext4: fix a race in the ext4 shutdown path
    - ext4: save error to disk in __ext4_grp_locked_error()
    - ext4: correct documentation for grpid mount option
    - mm: hide a #warning for COMPILE_TEST
    - mm: Fix memory size alignment in devm_memremap_pages_release()
    - MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN
    - MIPS: CPS: Fix MIPS_ISA_LEVEL_RAW fallout
    - MIPS: Fix incorrect mem=X@Y handling
    - PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode
    - PCI: iproc: Fix NULL pointer dereference for BCMA
    - PCI: pciehp: Assume NoCompl+ for Thunderbolt ports
    - PCI: keystone: Fix interrupt-controller-node lookup
    - video: fbdev: atmel_lcdfb: fix display-timings lookup
    - console/dummy: leave .con_font_get set to NULL
    - rbd: whitelist RBD_FEATURE_OPERATIONS feature bit
    - xen: Fix {set,clear}_foreign_p2m_mapping on autotranslating guests
    - xenbus: track caller request id
    - seq_file: fix incomplete reset on read from zero offset
    - tracing: Fix parsing of globs with a wildcard at the beginning
    - mpls, nospec: Sanitize array index in mpls_label_ok()
    - rtlwifi: rtl8821ae: Fix connection lost problem correctly
    - arm64: proc: Set PTE_NG for table entries to avoid traversing them twice
    - xprtrdma: Fix calculation of ri_max_send_sges
    - xprtrdma: Fix BUG after a device removal
    - blk-wbt: account flush requests correctly
    - target/iscsi: avoid NULL dereference in CHAP auth error path
    - iscsi-target: make sure to wake up sleeping login worker
    - dm: correctly handle chained bios in dec_pending()
    - Btrfs: fix deadlock in run_delalloc_nocow
    - Btrfs: fix crash due to not cleaning up tree log block's dirty bits
    - Btrfs: fix extent state leak from tree log
    - Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly
    - Btrfs: fix use-after-free on root->orphan_block_rsv
    - Btrfs: fix unexpected -EEXIST when creating new inode
    - 9p/trans_virtio: discard zero-length reply
    - mtd: nand: vf610: set correct ooblayout
    - ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
    - ALSA: hda/realtek - Add headset mode support for Dell laptop
    - ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform
    - ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
    - ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
    - ALSA: usb: add more device quirks for USB DSD devices
    - ALSA: seq: Fix racy pool initializations
    - mvpp2: fix multicast address filter
    - usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT
    - x86/mm, mm/hwpoison: Don't unconditionally unmap kernel 1:1 pages
    - ARM: dts: exynos: fix RTC interrupt for exynos5410
    - ARM: pxa/tosa-bt: add MODULE_LICENSE tag
    - arm64: dts: msm8916: Add missing #phy-cells
    - ARM: dts: s5pv210: add interrupt-parent for ohci
    - arm: dts: mt7623: Update ethsys binding
    - arm: dts: mt2701: Add reset-cells
    - ARM: dts: Delete bogus reference to the charlcd
    - media: r820t: fix r820t_write_reg for KASAN
    - mmc: sdhci-of-esdhc: fix eMMC couldn't work after kexec
    - mmc: sdhci-of-esdhc: fix the mmc error after sleep on ls1046ardb
    - Linux 4.15.5

  * retpoline abi files are empty on i386 (LP: #1751021)
    - [Packaging] retpoline-extract -- instantiate retpoline files for i386
    - [Packaging] final-checks -- sanity checking ABI contents
    - [Packaging] final-checks -- check for empty retpoline files
    - [Config] Disable i386 retpoline check for next upload

  * Bionic update to v4.15.4 stable release (LP: #1751064)
    - watchdog: indydog: Add dependency on SGI_HAS_INDYDOG
    - cifs: Fix missing put_xid in cifs_file_strict_mmap
    - cifs: Fix autonegotiate security settings mismatch
    - CIFS: zero sensitive data when freeing
    - cpufreq: mediatek: add mediatek related projects into blacklist
    - dmaengine: dmatest: fix container_of member in dmatest_callback
    - ssb: Do not disable PCI host on non-Mips
    - watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop
    - Revert "drm/i915: mark all device info struct with __initconst"
    - sched/rt: Use container_of() to get root domain in rto_push_irq_work_func()
    - sched/rt: Up the root domain ref count when passing it around via IPIs
    - media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
    - media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
    - media: hdpvr: Fix an error handling path in hdpvr_probe()
    - arm64: mm: Use non-global mappings for kernel space
    - arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN
    - arm64: mm: Move ASID from TTBR0 to TTBR1
    - arm64: mm: Remove pre_ttbr0_update_workaround for Falkor erratum #E1003
    - arm64: mm: Rename post_ttbr0_update_workaround
    - arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN
    - arm64: mm: Allocate ASIDs in pairs
    - arm64: mm: Add arm64_kernel_unmapped_at_el0 helper
    - arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI
    - arm64: entry: Add exception trampoline page for exceptions from EL0
    - arm64: mm: Map entry trampoline into trampoline and kernel page tables
    - arm64: entry: Explicitly pass exception level to kernel_ventry macro
    - arm64: entry: Hook up entry trampoline to exception vectors
    - arm64: erratum: Work around Falkor erratum #E1003 in trampoline code
    - arm64: cpu_errata: Add Kryo to Falkor 1003 errata
    - arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks
    - arm64: entry: Add fake CPU feature for unmapping the kernel at EL0
    - arm64: kaslr: Put kernel vectors address in separate data page
    - arm64: use RET instruction for exiting the trampoline
    - arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0
    - arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry
    - arm64: Take into account ID_AA64PFR0_EL1.CSV3
    - arm64: capabilities: Handle duplicate entries for a capability
    - arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR
    - arm64: kpti: Fix the interaction between ASID switching and software PAN
    - arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs
    - arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()
    - arm64: mm: Permit transitioning from Global to Non-Global without BBM
    - arm64: kpti: Add ->enable callback to remap swapper using nG mappings
    - arm64: Force KPTI to be disabled on Cavium ThunderX
    - arm64: entry: Reword comment about post_ttbr_update_workaround
    - arm64: idmap: Use "awx" flags for .idmap.text .pushsection directives
    - perf: arm_spe: Fail device probe when arm64_kernel_unmapped_at_el0()
    - arm64: barrier: Add CSDB macros to control data-value prediction
    - arm64: Implement array_index_mask_nospec()
    - arm64: Make USER_DS an inclusive limit
    - arm64: Use pointer masking to limit uaccess speculation
    - arm64: entry: Ensure branch through syscall table is bounded under
      speculation
    - arm64: uaccess: Prevent speculative use of the current addr_limit
    - arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user
    - arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
    - arm64: futex: Mask __user pointers prior to dereference
    - arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early
    - arm64: Run enable method for errata work arounds on late CPUs
    - arm64: cpufeature: Pass capability structure to ->enable callback
    - drivers/firmware: Expose psci_get_version through psci_ops structure
    - arm64: Move post_ttbr_update_workaround to C code
    - arm64: Add skeleton to harden the branch predictor against aliasing attacks
    - arm64: Move BP hardening to check_and_switch_context
    - arm64: KVM: Use per-CPU vector when BP hardening is enabled
    - arm64: entry: Apply BP hardening for high-priority synchronous exceptions
    - arm64: entry: Apply BP hardening for suspicious interrupts from EL0
    - arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75
    - arm64: Implement branch predictor hardening for affected Cortex-A CPUs
    - arm64: Implement branch predictor hardening for Falkor
    - arm64: Branch predictor hardening for Cavium ThunderX2
    - arm64: KVM: Increment PC after handling an SMC trap
    - arm/arm64: KVM: Consolidate the PSCI include files
    - arm/arm64: KVM: Add PSCI_VERSION helper
    - arm/arm64: KVM: Add smccc accessors to PSCI code
    - arm/arm64: KVM: Implement PSCI 1.0 support
    - arm/arm64: KVM: Advertise SMCCC v1.1
    - arm64: KVM: Make PSCI_VERSION a fast path
    - arm/arm64: KVM: Turn kvm_psci_version into a static inline
    - arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
    - arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
    - firmware/psci: Expose PSCI conduit
    - firmware/psci: Expose SMCCC version through psci_ops
    - arm/arm64: smccc: Make function identifiers an unsigned quantity
    - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
    - arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
    - arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
    - mtd: cfi: convert inline functions to macros
    - mtd: nand: brcmnand: Disable prefetch by default
    - mtd: nand: Fix nand_do_read_oob() return value
    - mtd: nand: sunxi: Fix ECC strength choice
    - ubi: Fix race condition between ubi volume creation and udev
    - ubi: fastmap: Erase outdated anchor PEBs during attach
    - ubi: block: Fix locking for idr_alloc/idr_remove
    - ubifs: free the encrypted symlink target
    - nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
    - nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE
    - NFS: Add a cond_resched() to nfs_commit_release_pages()
    - NFS: Fix nfsstat breakage due to LOOKUPP
    - NFS: commit direct writes even if they fail partially
    - NFS: reject request for id_legacy key without auxdata
    - NFS: Fix a race between mmap() and O_DIRECT
    - nfsd: Detect unhashed stids in nfsd4_verify_open_stid()
    - kernfs: fix regression in kernfs_fop_write caused by wrong type
    - ahci: Annotate PCI ids for mobile Intel chipsets as such
    - ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
    - ahci: Add Intel Cannon Lake PCH-H PCI ID
    - crypto: hash - introduce crypto_hash_alg_has_setkey()
    - crypto: cryptd - pass through absence of ->setkey()
    - crypto: mcryptd - pass through absence of ->setkey()
    - crypto: poly1305 - remove ->setkey() method
    - crypto: hash - annotate algorithms taking optional key
    - crypto: hash - prevent using keyed hashes without setting key
    - media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt
    - media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
    - media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
    - media: v4l2-compat-ioctl32.c: fix the indentation
    - media: v4l2-compat-ioctl32.c: move 'helper' functions to
      __get/put_v4l2_format32
    - media: v4l2-compat-ioctl32.c: avoid sizeof(type)
    - media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
    - media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
    - media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
    - media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
    - media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
    - media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
    - media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
    - crypto: caam - fix endless loop when DECO acquire fails
    - crypto: sha512-mb - initialize pending lengths correctly
    - crypto: talitos - fix Kernel Oops on hashing an empty file
    - arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
    - KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2
    - KVM: nVMX: Fix bug of injecting L2 exception into L1
    - KVM: PPC: Book3S HV: Make sure we don't re-enter guest without XIVE loaded
    - KVM: PPC: Book3S HV: Drop locks before reading guest memory
    - KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED
    - KVM: PPC: Book3S PR: Fix broken select due to misspelling
    - ASoC: acpi: fix machine driver selection based on quirk
    - ASoC: rockchip: i2s: fix playback after runtime resume
    - ASoC: skl: Fix kernel warning due to zero NHTL entry
    - ASoC: compress: Correct handling of copy callback
    - watchdog: imx2_wdt: restore previous timeout after suspend+resume
    - afs: Add missing afs_put_cell()
    - afs: Need to clear responded flag in addr cursor
    - afs: Fix missing cursor clearance
    - afs: Fix server list handling
    - btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
    - Btrfs: raid56: iterate raid56 internal bio with bio_for_each_segment_all
    - kasan: don't emit builtin calls when sanitization is off
    - kasan: rework Kconfig settings
    - media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code
    - media: dvb-frontends: fix i2c access helpers for KASAN
    - media: dt-bindings/media/cec-gpio.txt: mention the CEC/HPD max voltages
    - media: ts2020: avoid integer overflows on 32 bit machines
    - media: vivid: fix module load error when enabling fb and no_error_inj=1
    - media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
    - fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
    - kernel/async.c: revert "async: simplify lowest_in_progress()"
    - kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
    - pipe: actually allow root to exceed the pipe buffer limits
    - pipe: fix off-by-one error when checking buffer limits
    - HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
    - Bluetooth: btsdio: Do not bind to non-removable BCM43341
    - ipmi: use dynamic memory for DMI driver override
    - signal/openrisc: Fix do_unaligned_access to send the proper signal
    - signal/sh: Ensure si_signo is initialized in do_divide_error
    - alpha: fix crash if pthread_create races with signal delivery
    - alpha: osf_sys.c: fix put_tv32 regression
    - alpha: Fix mixed up args in EXC macro in futex operations
    - alpha: fix reboot on Avanti platform
    - alpha: fix formating of stack content
    - xtensa: fix futex_atomic_cmpxchg_inatomic
    - EDAC, octeon: Fix an uninitialized variable warning
    - genirq: Make legacy autoprobing work again
    - pinctrl: intel: Initialize GPIO properly when used through irqchip
    - pinctrl: mcp23s08: fix irq setup order
    - pinctrl: sx150x: Unregister the pinctrl on release
    - pinctrl: sx150x: Register pinctrl before adding the gpiochip
    - pinctrl: sx150x: Add a static gpio/pinctrl pin range mapping
    - pktcdvd: Fix pkt_setup_dev() error path
    - pktcdvd: Fix a recently introduced NULL pointer dereference
    - blk-mq: quiesce queue before freeing queue
    - clocksource/drivers/stm32: Fix kernel panic with multiple timers
    - lib/ubsan.c: s/missaligned/misaligned/
    - lib/ubsan: add type mismatch handler for new GCC/Clang
    - objtool: Fix switch-table detection
    - arm64: dts: marvell: add Ethernet aliases
    - drm/i915: Avoid PPS HW/SW state mismatch due to rounding
    - ACPI: sbshc: remove raw pointer from printk() message
    - acpi, nfit: fix register dimm error handling
    - ovl: force r/o mount when index dir creation fails
    - ovl: fix failure to fsync lower dir
    - ovl: take mnt_want_write() for work/index dir setup
    - ovl: take mnt_want_write() for removing impure xattr
    - ovl: hash directory inodes for fsnotify
    - mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy
    - devpts: fix error handling in devpts_mntget()
    - ftrace: Remove incorrect setting of glob search field
    - scsi: core: Ensure that the SCSI error handler gets woken up
    - scsi: lpfc: Fix crash after bad bar setup on driver attachment
    - scsi: cxlflash: Reset command ioasc
    - rcu: Export init_rcu_head() and destroy_rcu_head() to GPL modules
    - Linux 4.15.4
    - updateconfigs after v4.14.4 stable updates

  * Bionic update to v4.15.4 stable release (LP: #1751064) // CVE-2017-5754 and
    do not need KPTI when KASLR is off.
    - arm64: Turn on KPTI only on CPUs that need it

  * Miscellaneous Ubuntu changes
    - [Config] fix up removed retpoline call sites

 -- Seth Forshee <seth.forshee@canonical.com>  Fri, 23 Feb 2018 08:31:06 -0600

linux (4.15.0-10.11) bionic; urgency=medium

  * linux: 4.15.0-10.11 -proposed tracker (LP: #1749250)

  * "swiotlb: coherent allocation failed" dmesg spam with linux 4.15.0-9.10
    (LP: #1749202)
    - swiotlb: suppress warning when __GFP_NOWARN is set
    - drm/ttm: specify DMA_ATTR_NO_WARN for huge page pools

  * linux-tools: perf incorrectly linking libbfd (LP: #1748922)
    - SAUCE: tools -- add ability to disable libbfd
    - [Packaging] correct disablement of libbfd

  * [Artful] Realtek ALC225: 2 secs noise when a headset plugged in
    (LP: #1744058)
    - ALSA: hda/realtek - update ALC225 depop optimize

  * [Artful] Support headset mode for DELL WYSE (LP: #1723913)
    - SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE

  * headset mic can't be detected on two Dell machines (LP: #1748807)
    - ALSA: hda/realtek - Support headset mode for ALC215/ALC285/ALC289
    - ALSA: hda - Fix headset mic detection problem for two Dell machines

  * Bionic update to v4.15.3 stable release (LP: #1749191)
    - ip6mr: fix stale iterator
    - net: igmp: add a missing rcu locking section
    - qlcnic: fix deadlock bug
    - qmi_wwan: Add support for Quectel EP06
    - r8169: fix RTL8168EP take too long to complete driver initialization.
    - tcp: release sk_frag.page in tcp_disconnect
    - vhost_net: stop device during reset owner
    - ipv6: addrconf: break critical section in addrconf_verify_rtnl()
    - ipv6: change route cache aging logic
    - Revert "defer call to mem_cgroup_sk_alloc()"
    - net: ipv6: send unsolicited NA after DAD
    - rocker: fix possible null pointer dereference in
      rocker_router_fib_event_work
    - tcp_bbr: fix pacing_gain to always be unity when using lt_bw
    - cls_u32: add missing RCU annotation.
    - ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only
    - soreuseport: fix mem leak in reuseport_add_sock()
    - net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
    - net: sched: fix use-after-free in tcf_block_put_ext
    - media: mtk-vcodec: add missing MODULE_LICENSE/DESCRIPTION
    - media: soc_camera: soc_scale_crop: add missing
      MODULE_DESCRIPTION/AUTHOR/LICENSE
    - media: tegra-cec: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - gpio: uniphier: fix mismatch between license text and MODULE_LICENSE
    - crypto: tcrypt - fix S/G table for test_aead_speed()
    - Linux 4.15.3

  * bnx2x_attn_int_deasserted3:4323 MC assert! (LP: #1715519) //
    CVE-2018-1000026
    - net: create skb_gso_validate_mac_len()
    - bnx2x: disable GSO where gso_size is too big for hardware

  * ethtool -p fails to light NIC LED on HiSilicon D05 systems (LP: #1748567)
    - net: hns: add ACPI mode support for ethtool -p

  * CVE-2017-5715 (Spectre v2 Intel)
    - [Packaging] retpoline files must be sorted
    - [Packaging] pull in retpoline files

  * [Feature] PXE boot with Intel Omni-Path (LP: #1712031)
    - d-i: Add hfi1 to nic-modules

  * CVE-2017-5715 (Spectre v2 retpoline)
    - [Packaging] retpoline -- add call site validation
    - [Config] disable retpoline checks for first upload

  * Do not duplicate changelog entries assigned to more than one bug or CVE
    (LP: #1743383)
    - [Packaging] git-ubuntu-log -- handle multiple bugs/cves better

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Feb 2018 11:33:58 -0600

linux (4.15.0-9.10) bionic; urgency=medium

  * linux: 4.15.0-9.10 -proposed tracker (LP: #1748244)

  * Miscellaneous Ubuntu changes
    - [Debian] tests -- remove gcc-multilib dependency for arm64

 -- Seth Forshee <seth.forshee@canonical.com>  Thu, 08 Feb 2018 11:25:04 -0600

linux (4.15.0-8.9) bionic; urgency=medium

  * linux: 4.15.0-8.9 -proposed tracker (LP: #1748075)

  * Bionic update to v4.15.2 stable release (LP: #1748072)
    - KVM: x86: Make indirect calls in emulator speculation safe
    - KVM: VMX: Make indirect call speculation safe
    - module/retpoline: Warn about missing retpoline in module
    - x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
    - x86/cpufeatures: Add Intel feature bits for Speculation Control
    - x86/cpufeatures: Add AMD feature bits for Speculation Control
    - x86/msr: Add definitions for new speculation control MSRs
    - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
    - x86/alternative: Print unadorned pointers
    - x86/nospec: Fix header guards names
    - x86/bugs: Drop one "mitigation" from dmesg
    - x86/cpu/bugs: Make retpoline module warning conditional
    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags
    - x86/retpoline: Simplify vmexit_fill_RSB()
    - x86/speculation: Simplify indirect_branch_prediction_barrier()
    - auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - iio: adc/accel: Fix up module licenses
    - pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - KVM: nVMX: Eliminate vmcs02 pool
    - KVM: VMX: introduce alloc_loaded_vmcs
    - objtool: Improve retpoline alternative handling
    - objtool: Add support for alternatives at the end of a section
    - objtool: Warn on stripped section symbol
    - x86/mm: Fix overlap of i386 CPU_ENTRY_AREA with FIX_BTMAP
    - x86/spectre: Check CONFIG_RETPOLINE in command line parser
    - x86/entry/64: Remove the SYSCALL64 fast path
    - x86/entry/64: Push extra regs right away
    - x86/asm: Move 'status' from thread_struct to thread_info
    - Documentation: Document array_index_nospec
    - array_index_nospec: Sanitize speculative array de-references
    - x86: Implement array_index_mask_nospec
    - x86: Introduce barrier_nospec
    - x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
    - x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
    - x86/get_user: Use pointer masking to limit speculation
    - x86/syscall: Sanitize syscall table de-references under speculation
    - vfs, fdtable: Prevent bounds-check bypass via speculative execution
    - nl80211: Sanitize array index in parse_txq_params
    - x86/spectre: Report get_user mitigation for spectre_v1
    - x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
    - x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
    - x86/speculation: Use Indirect Branch Prediction Barrier in context switch
    - x86/paravirt: Remove 'noreplace-paravirt' cmdline option
    - KVM: VMX: make MSR bitmaps per-VCPU
    - x86/kvm: Update spectre-v1 mitigation
    - x86/retpoline: Avoid retpolines for built-in __init functions
    - x86/spectre: Simplify spectre_v2 command line parsing
    - x86/pti: Mark constant arrays as __initconst
    - x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
    - KVM/x86: Update the reverse_cpuid list to include CPUID_7_EDX
    - KVM/x86: Add IBPB support
    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
    - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
    - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
    - serial: core: mark port as initialized after successful IRQ change
    - fpga: region: release of_parse_phandle nodes after use
    - Linux 4.15.2

  * Add support for the NIC on SynQuacer E-Series boards (LP: #1747792)
    - net: phy: core: remove now uneeded disabling of interrupts
    - [Config] CONFIG_NET_VENDOR_SOCIONEXT=y & CONFIG_SNI_NETSEC=m
    - net: socionext: Add Synquacer NetSec driver
    - net: socionext: include linux/io.h to fix build
    - net: socionext: Fix error return code in netsec_netdev_open()

  * [Artful/Bionic] [Config] enable EDAC_GHES for ARM64 (LP: #1747746)
    - [Config] CONFIG_EDAC_GHES=y

  * support thunderx2 vendor pmu events (LP: #1747523)
    - perf pmu: Pass pmu as a parameter to get_cpuid_str()
    - perf tools arm64: Add support for get_cpuid_str function.
    - perf pmu: Add helper function is_pmu_core to detect PMU CORE devices
    - perf vendor events arm64: Add ThunderX2 implementation defined pmu core
      events
    - perf pmu: Add check for valid cpuid in perf_pmu__find_map()

  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
    - SAUCE: mm: disable vma based swap readahead by default
    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM

  * Miscellaneous Ubuntu changes
    - [Config] Fix CONFIG_PROFILE_ALL_BRANCHES annotations

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 07 Feb 2018 21:13:27 -0600

linux (4.15.0-7.8) bionic; urgency=medium

  * Bionic update to v4.15.1 stable release (LP: #1747169)
    - Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops
    - tools/gpio: Fix build error with musl libc
    - gpio: stmpe: i2c transfer are forbiden in atomic context
    - gpio: Fix kernel stack leak to userspace
    - ALSA: hda - Reduce the suspend time consumption for ALC256
    - crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
    - crypto: aesni - handle zero length dst buffer
    - crypto: aesni - fix typo in generic_gcmaes_decrypt
    - crypto: aesni - add wrapper for generic gcm(aes)
    - crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-
      aesni
    - crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-
      aesni
    - crypto: inside-secure - fix hash when length is a multiple of a block
    - crypto: inside-secure - avoid unmapping DMA memory that was not mapped
    - crypto: sha3-generic - fixes for alignment and big endian operation
    - crypto: af_alg - whitelist mask and type
    - HID: wacom: EKR: ensure devres groups at higher indexes are released
    - HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
    - power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
    - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
    - igb: Free IRQs when device is hotplugged
    - ima/policy: fix parsing of fsuuid
    - scsi: aacraid: Fix udev inquiry race condition
    - scsi: aacraid: Fix hang in kdump
    - scsi: storvsc: missing error code in storvsc_probe()
    - staging: lustre: separate a connection destroy from free struct kib_conn
    - staging: ccree: NULLify backup_info when unused
    - staging: ccree: fix fips event irq handling build
    - tty: fix data race between tty_init_dev and flush of buf
    - usb: option: Add support for FS040U modem
    - USB: serial: pl2303: new device id for Chilitag
    - USB: cdc-acm: Do not log urb submission errors on disconnect
    - CDC-ACM: apply quirk for card reader
    - USB: serial: io_edgeport: fix possible sleep-in-atomic
    - usbip: prevent bind loops on devices attached to vhci_hcd
    - usbip: list: don't list devices attached to vhci_hcd
    - USB: serial: simple: add Motorola Tetra driver
    - usb: f_fs: Prevent gadget unbind if it is already unbound
    - usb: uas: unconditionally bring back host after reset
    - usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
    - ANDROID: binder: remove waitqueue when thread exits.
    - android: binder: use VM_ALLOC to get vm area
    - mei: me: allow runtime pm for platform with D0i3
    - serial: 8250_of: fix return code when probe function fails to get reset
    - serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
    - serial: 8250_dw: Revert "Improve clock rate setting"
    - serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
    - spi: imx: do not access registers while clocks disabled
    - iio: adc: stm32: fix scan of multiple channels with DMA
    - iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
    - test_firmware: fix missing unlock on error in config_num_requests_store()
    - Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
    - Input: synaptics-rmi4 - do not delete interrupt memory too early
    - x86/efi: Clarify that reset attack mitigation needs appropriate userspace
    - Linux 4.15.1

  * Dell XPS 13 9360 bluetooth (Atheros) won't connect after resume
    (LP: #1744712)
    - Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
    - Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten"
      version

  * apparmor profile load in stacked policy container fails (LP: #1746463)
    - SAUCE: apparmor: fix display of .ns_name for containers

 -- Seth Forshee <seth.forshee@canonical.com>  Sun, 04 Feb 2018 11:56:32 +0100

linux (4.15.0-6.7) bionic; urgency=low

  * upload urgency should be medium by default (LP: #1745338)
    - [Packaging] update urgency to medium by default

  * Shutdown hang on 16.04 with iscsi targets (LP: #1569925)
    - scsi: libiscsi: Allow sd_shutdown on bad transport

  * Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu1, zfs to 0.7.5-1ubuntu1
    - Revert "UBUNTU: SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM"
    - Revert "UBUNTU: SAUCE: mm: disable vma based swap readahead by default"

  [ Upstream Kernel Changes ]

  * Rebase to v4.15

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jan 2018 08:47:07 -0600

linux (4.15.0-5.6) bionic; urgency=low

  * $(LOCAL_ENV_CC) and $(LOCAL_ENV_DISTCC_HOSTS) should be properly quoted
    (LP: #1744077)
    - [Debian] pass LOCAL_ENV_CC and LOCAL_ENV_DISTCC_HOSTS properly

  * Missing install-time driver for QLogic QED 25/40/100Gb Ethernet NIC
    (LP: #1743638)
    - [d-i] Add qede to nic-modules udeb

  * boot failure on AMD Raven + WesternXT (LP: #1742759)
    - SAUCE: drm/amdgpu: add atpx quirk handling (v2)

  * Unable to handle kernel NULL pointer dereference at isci_task_abort_task
    (LP: #1726519)
    - SAUCE: Revert "scsi: libsas: allow async aborts"

  * Update Ubuntu-4.15.0 config to support Intel Atom devices (LP: #1739939)
    - [Config] CONFIG_SERIAL_DEV_BUS=y, CONFIG_SERIAL_DEV_CTRL_TTYPORT=y

  * Miscellaneous Ubuntu changes
    - Rebase to v4.15-rc7
    - [Config] CONFIG_CPU_ISOLATION=y
    - [Config] Update annotations following config review
    - Revert "UBUNTU: SAUCE: Import aufs driver"
    - SAUCE: Import aufs driver
    - ubuntu: vbox -- update to 5.2.6-dfsg-1
    - ubuntu: vbox: build fixes for 4.15
    - ubuntu: vbox -- update to 5.2.6-dfsg-2
    - hio: updates for timer api changes in 4.15
    - enable hio build
    - Rebase to v4.15-rc9

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc9

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jan 2018 10:16:05 -0600

linux (4.15.0-4.5) bionic; urgency=low

  * [0cf3:e010] QCA6174A XR failed to pair with bt 4.0 device  (LP: #1741166)
    - SAUCE: Bluetooth: btusb: Add support for 0cf3:e010

  * External HDMI monitor failed to show screen on Lenovo X1 series
    (LP: #1738523)
    - SAUCE: drm/i915: Disable writing of TMDS_OE on Lenovo ThinkPad X1 series

  * Miscellaneous Ubuntu changes
    - [Debian] autoreconstruct - add resoration of execute permissions

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc4

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 10 Jan 2018 10:24:22 -0600

linux (4.15.0-3.4) bionic; urgency=low

  * ubuntu/xr-usb-serial didn't get built in zesty and artful (LP: #1733281)
    - SAUCE: make sure ubuntu/xr-usb-serial builds for x86

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc6

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 03 Jan 2018 20:20:43 -0600

linux (4.15.0-2.3) bionic; urgency=low

  * nvidia-graphics-drivers-384 384.90-0ubuntu6 ADT test failure with linux
    4.15.0-1.2 (LP: #1737752)
    - x86/mm: Unbreak modules that use the DMA API

  * Ubuntu 17.10 corrupting BIOS - many LENOVO laptops models (LP: #1734147)
    - [Config] CONFIG_SPI_INTEL_SPI_*=n

  * power: commonise configs IBMVETH/IBMVSCSI and ensure both are in linux-image
    and udebs (LP: #1521712)
    - [Config] Include ibmvnic in nic-modules

  * Enable arm64 emulation of removed ARMv7 instructions (LP: #1545542)
    - [Config] Enable support for emulation of deprecated ARMv8 instructions

  * Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl with 4.15 compat fix (LP:#1737761)
    - Enable zfs build
    - [Debian] add icp to zfs-modules.ignore

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc4

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Dec 2017 09:27:13 -0600

linux (4.15.0-1.2) bionic; urgency=low

  * Disabling zfs does not always disable module checks for the zfs modules
    (LP: #1737176)
    - [Packaging] disable zfs module checks when zfs is disabled

  * Miscellaneous Ubuntu changes
    - [Config] CONFIG_UNWINDER_FRAME_POINTER=y for amd64

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc3

 -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Dec 2017 22:07:19 -0600

linux (4.15.0-0.1) bionic; urgency=low

  * Miscellaneous Ubuntu changes
    - ubuntu: vbox -- update to 5.2.2-dfsg-2
    - ubuntu: vbox: build fixes for 4.15
    - disable hio build
    - [Config] Update kernel lockdown options to fix build errors
    - Disable zfs build
    - SAUCE: Import aufs driver
    - [Config] Enable AUFS config options

  [ Upstream Kernel Changes ]

  * Rebase to v4.15-rc2

 -- Seth Forshee <seth.forshee@canonical.com>  Fri, 08 Dec 2017 13:55:42 -0600

linux (4.14.0-11.13) bionic; urgency=low

  * linux: 4.14.0-11.13 -proposed tracker (LP: #1736168)

  * CVE-2017-1000405
    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()

  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
    - SAUCE: mm: disable vma based swap readahead by default
    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM

  * Bionic update to v4.14.3 stable release (LP: #1735843)
    - s390: fix transactional execution control register handling
    - s390/noexec: execute kexec datamover without DAT
    - s390/runtime instrumention: fix possible memory corruption
    - s390/guarded storage: fix possible memory corruption
    - s390/disassembler: add missing end marker for e7 table
    - s390/disassembler: increase show_code buffer size
    - ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
    - ACPI / EC: Fix regression related to triggering source of EC event handling
    - cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
    - serdev: fix registration of second slave
    - sched: Make resched_cpu() unconditional
    - lib/mpi: call cond_resched() from mpi_powm() loop
    - x86/boot: Fix boot failure when SMP MP-table is based at 0
    - x86/decoder: Add new TEST instruction pattern
    - x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
    - x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
    - perf/x86/intel: Hide TSX events when RTM is not supported
    - arm64: Implement arch-specific pte_access_permitted()
    - ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
    - ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
    - uapi: fix linux/tls.h userspace compilation error
    - uapi: fix linux/rxrpc.h userspace compilation errors
    - MIPS: cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work for 32-bit SMP
    - MIPS: ralink: Fix MT7628 pinmux
    - MIPS: ralink: Fix typo in mt7628 pinmux function
    - net: mvneta: fix handling of the Tx descriptor counter
    - nbd: wait uninterruptible for the dead timeout
    - nbd: don't start req until after the dead connection logic
    - PM / OPP: Add missing of_node_put(np)
    - PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
    - PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
    - PCI: hv: Use effective affinity mask
    - PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
    - PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
    - ALSA: hda: Add Raven PCI ID
    - dm integrity: allow unaligned bv_offset
    - dm cache: fix race condition in the writeback mode overwrite_bio
      optimisation
    - dm crypt: allow unaligned bv_offset
    - dm zoned: ignore last smaller runt zone
    - dm mpath: remove annoying message of 'blk_get_request() returned -11'
    - dm bufio: fix integer overflow when limiting maximum cache size
    - ovl: Put upperdentry if ovl_check_origin() fails
    - dm: allocate struct mapped_device with kvzalloc
    - sched/rt: Simplify the IPI based RT balancing logic
    - MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
    - dm: fix race between dm_get_from_kobject() and __dm_destroy()
    - dm: discard support requires all targets in a table support discards
    - MIPS: Fix odd fp register warnings with MIPS64r2
    - MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
    - MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
    - MIPS: Fix an n32 core file generation regset support regression
    - MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
    - MIPS: math-emu: Fix final emulation phase for certain instructions
    - rt2x00usb: mark device removed when get ENOENT usb error
    - mm/z3fold.c: use kref to prevent page free/compact race
    - autofs: don't fail mount for transient error
    - nilfs2: fix race condition that causes file system corruption
    - fscrypt: lock mutex before checking for bounce page pool
    - eCryptfs: use after free in ecryptfs_release_messaging()
    - libceph: don't WARN() if user tries to add invalid key
    - bcache: check ca->alloc_thread initialized before wake up it
    - fs: guard_bio_eod() needs to consider partitions
    - fanotify: fix fsnotify_prepare_user_wait() failure
    - isofs: fix timestamps beyond 2027
    - btrfs: change how we decide to commit transactions during flushing
    - f2fs: expose some sectors to user in inline data or dentry case
    - NFS: Fix typo in nomigration mount option
    - NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
    - nfs: Fix ugly referral attributes
    - NFS: Avoid RCU usage in tracepoints
    - NFS: revalidate "." etc correctly on "open".
    - nfsd: deal with revoked delegations appropriately
    - rtlwifi: rtl8192ee: Fix memory leak when loading firmware
    - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
    - iwlwifi: fix firmware names for 9000 and A000 series hw
    - md: fix deadlock error in recent patch.
    - md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
    - Bluetooth: btqcomsmd: Add support for BD address setup
    - md/bitmap: revert a patch
    - fsnotify: clean up fsnotify_prepare/finish_user_wait()
    - fsnotify: pin both inode and vfsmount mark
    - fsnotify: fix pinning group in fsnotify_prepare_user_wait()
    - ata: fixes kernel crash while tracing ata_eh_link_autopsy event
    - ext4: fix interaction between i_size, fallocate, and delalloc after a crash
    - ext4: prevent data corruption with inline data + DAX
    - ext4: prevent data corruption with journaling + DAX
    - ALSA: pcm: update tstamp only if audio_tstamp changed
    - ALSA: usb-audio: Add sanity checks to FE parser
    - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
    - ALSA: usb-audio: Add sanity checks in v2 clock parsers
    - ALSA: timer: Remove kernel warning at compat ioctl error paths
    - ALSA: hda/realtek - Fix ALC275 no sound issue
    - ALSA: hda: Fix too short HDMI/DP chmap reporting
    - ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
    - ALSA: hda/realtek - Fix ALC700 family no sound issue
    - ASoC: sun8i-codec: Invert Master / Slave condition
    - ASoC: sun8i-codec: Fix left and right channels inversion
    - ASoC: sun8i-codec: Set the BCLK divider
    - mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
    - fix a page leak in vhost_scsi_iov_to_sgl() error recovery
    - 9p: Fix missing commas in mount options
    - fs/9p: Compare qid.path in v9fs_test_inode
    - net/9p: Switch to wait_event_killable()
    - scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
    - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
    - scsi: lpfc: fix pci hot plug crash in timer management routines
    - scsi: lpfc: fix pci hot plug crash in list_add call
    - scsi: lpfc: Fix crash receiving ELS while detaching driver
    - scsi: lpfc: Fix FCP hba_wqidx assignment
    - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
    - iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
    - iscsi-target: Fix non-immediate TMR reference leak
    - target: fix null pointer regression in core_tmr_drain_tmr_list
    - target: fix buffer offset in core_scsi3_pri_read_full_status
    - target: Fix QUEUE_FULL + SCSI task attribute handling
    - target: Fix caw_sem leak in transport_generic_request_failure
    - target: Fix quiese during transport_write_pending_qf endless loop
    - target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
    - mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
    - mtd: nand: Export nand_reset() symbol
    - mtd: nand: atmel: Actually use the PM ops
    - mtd: nand: omap2: Fix subpage write
    - mtd: nand: Fix writing mtdoops to nand flash.
    - mtd: nand: mtk: fix infinite ECC decode IRQ issue
    - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence
    - p54: don't unregister leds when they are not initialized
    - block: Fix a race between blk_cleanup_queue() and timeout handling
    - raid1: prevent freeze_array/wait_all_barriers deadlock
    - genirq: Track whether the trigger type has been set
    - irqchip/gic-v3: Fix ppi-partitions lookup
    - lockd: double unregister of inetaddr notifiers
    - KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not
      enabled
    - KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
    - KVM: SVM: obey guest PAT
    - kvm: vmx: Reinstate support for CPUs without virtual NMI
    - dax: fix PMD faults on zero-length files
    - dax: fix general protection fault in dax_alloc_inode
    - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
    - clk: ti: dra7-atl-clock: fix child-node lookups
    - libnvdimm, dimm: clear 'locked' status on successful DIMM enable
    - libnvdimm, pfn: make 'resource' attribute only readable by root
    - libnvdimm, namespace: fix label initialization to use valid seq numbers
    - libnvdimm, region : make 'resource' attribute only readable by root
    - libnvdimm, namespace: make 'resource' attribute only readable by root
    - svcrdma: Preserve CB send buffer across retransmits
    - IB/srpt: Do not accept invalid initiator port names
    - IB/cm: Fix memory corruption in handling CM request
    - IB/hfi1: Fix incorrect available receive user context count
    - IB/srp: Avoid that a cable pull can trigger a kernel crash
    - IB/core: Avoid crash on pkey enforcement failed in received MADs
    - IB/core: Only maintain real QPs in the security lists
    - NFC: fix device-allocation error return
    - spi-nor: intel-spi: Fix broken software sequencing codes
    - i40e: Use smp_rmb rather than read_barrier_depends
    - igb: Use smp_rmb rather than read_barrier_depends
    - igbvf: Use smp_rmb rather than read_barrier_depends
    - ixgbevf: Use smp_rmb rather than read_barrier_depends
    - i40evf: Use smp_rmb rather than read_barrier_depends
    - fm10k: Use smp_rmb rather than read_barrier_depends
    - ixgbe: Fix skb list corruption on Power systems
    - parisc: Fix validity check of pointer size argument in new CAS
      implementation
    - powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
    - powerpc/mm/radix: Fix crashes on Power9 DD1 with radix MMU and STRICT_RWX
    - powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
    - powerpc/signal: Properly handle return value from uprobe_deny_signal()
    - powerpc/64s: Fix masking of SRR1 bits on instruction fault
    - powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
    - powerpc/64s/hash: Fix 512T hint detection to use >= 128T
    - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
    - powerpc/64s/hash: Fix fork() with 512TB process address space
    - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
    - media: Don't do DMA on stack for firmware upload in the AS102 driver
    - media: rc: check for integer overflow
    - media: rc: nec decoder should not send both repeat and keycode
    - cx231xx-cards: fix NULL-deref on missing association descriptor
    - media: v4l2-ctrl: Fix flags field on Control events
    - media: venus: fix wrong size on dma_free
    - media: venus: venc: fix bytesused v4l2_plane field
    - media: venus: reimplement decoder stop command
    - ARM64: dts: meson-gxl: Add alternate ARM Trusted Firmware reserved memory
      zone
    - iwlwifi: fix wrong struct for a000 device
    - iwlwifi: add a new a000 device
    - iwlwifi: pcie: sort IDs for the 9000 series for easier comparisons
    - iwlwifi: add new cards for a000 series
    - iwlwifi: add new cards for 8265 series
    - iwlwifi: add new cards for 8260 series
    - iwlwifi: fix PCI IDs and configuration mapping for 9000 series
    - iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
    - e1000e: Fix error path in link detection
    - e1000e: Fix return value test
    - e1000e: Separate signaling for link check/link up
    - e1000e: Avoid receiver overrun interrupt bursts
    - e1000e: fix buffer overrun while the I219 is processing DMA transactions
    - Linux 4.14.3

  * Miscellaneous Ubuntu changes
    - SAUCE: s390/topology: don't inline cpu_to_node
    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Dec 2017 09:08:07 -0600

linux (4.14.0-10.12) bionic; urgency=low

  * linux: 4.14.0-10.12 -proposed tracker (LP: #1734901)

  * Miscellaneous Ubuntu changes
    - SAUCE: Enable the ACPI kernel debugger and acpidbg tool
    - [Packaging] Include arch/arm64/kernel/ftrace-mod.o in headers package

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Nov 2017 08:46:49 -0600

linux (4.14.0-9.11) bionic; urgency=low

  * linux: 4.14.0-9.11 -proposed tracker (LP: #1734728)

  * Miscellaneous Ubuntu changes
    - Revert "UBUNTU: SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to
      0.7.3-1ubuntu1"

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 12:44:48 -0600

linux (4.14.0-8.10) bionic; urgency=low

  * linux: 4.14.0-8.10 -proposed tracker (LP: #1734695)

  * Bionic update to v4.14.2 stable release (LP: #1734694)
    - bio: ensure __bio_clone_fast copies bi_partno
    - af_netlink: ensure that NLMSG_DONE never fails in dumps
    - vxlan: fix the issue that neigh proxy blocks all icmpv6 packets
    - net: cdc_ncm: GetNtbFormat endian fix
    - fealnx: Fix building error on MIPS
    - net/sctp: Always set scope_id in sctp_inet6_skb_msgname
    - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
    - serial: omap: Fix EFR write on RTS deassertion
    - serial: 8250_fintek: Fix finding base_port with activated SuperIO
    - tpm-dev-common: Reject too short writes
    - rcu: Fix up pending cbs check in rcu_prepare_for_idle
    - mm/pagewalk.c: report holes in hugetlb ranges
    - ocfs2: fix cluster hang after a node dies
    - ocfs2: should wait dio before inode lock in ocfs2_setattr()
    - ipmi: fix unsigned long underflow
    - mm/page_alloc.c: broken deferred calculation
    - mm/page_ext.c: check if page_ext is not prepared
    - coda: fix 'kernel memory exposure attempt' in fsync
    - ipmi: Prefer ACPI system interfaces over SMBIOS ones
    - Linux 4.14.2

  * Bionic update to v4.14.1 stable release (LP: #1734693)
    - EDAC, sb_edac: Don't create a second memory controller if HA1 is not present
    - dmaengine: dmatest: warn user when dma test times out
    - media: imon: Fix null-ptr-deref in imon_probe
    - media: dib0700: fix invalid dvb_detach argument
    - crypto: dh - Fix double free of ctx->p
    - crypto: dh - Don't permit 'p' to be 0
    - crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
    - crypto: brcm - Explicity ACK mailbox message
    - USB: early: Use new USB product ID and strings for DbC device
    - USB: usbfs: compute urb->actual_length for isochronous
    - USB: Add delay-init quirk for Corsair K70 LUX keyboards
    - usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
    - USB: serial: metro-usb: stop I/O after failed open
    - USB: serial: Change DbC debug device binding ID
    - USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
    - USB: serial: garmin_gps: fix I/O after failed probe and remove
    - USB: serial: garmin_gps: fix memory leak on probe errors
    - selftests/x86/protection_keys: Fix syscall NR redefinition warnings
    - x86/MCE/AMD: Always give panic severity for UC errors in kernel context
    - platform/x86: peaq-wmi: Add DMI check before binding to the WMI interface
    - platform/x86: peaq_wmi: Fix missing terminating entry for peaq_dmi_table
    - HID: cp2112: add HIDRAW dependency
    - HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection
    - rpmsg: glink: Add missing MODULE_LICENSE
    - staging: wilc1000: Fix bssid buffer offset in Txq
    - staging: sm750fb: Fix parameter mistake in poke32
    - staging: ccree: fix 64 bit scatter/gather DMA ops
    - staging: greybus: spilib: fix use-after-free after deregistration
    - staging: rtl8188eu: Revert 4 commits breaking ARP
    - spi: fix use-after-free at controller deregistration
    - sparc32: Add cmpxchg64().
    - sparc64: mmu_context: Add missing include files
    - sparc64: Fix page table walk for PUD hugepages
    - Linux 4.14.1

  * Set PANIC_TIMEOUT=10 on Power Systems (LP: #1730660)
    - [Config]: Set PANIC_TIMEOUT=10 on ppc64el

  * enable CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH easily confuse users
    (LP: #1732627)
    - [Config] CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH=n

  * Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 07:43:44 -0600

linux (4.14.0-7.9) bionic; urgency=low

  * Miscellaneous Ubuntu changes
    - SAUCE: apparmor: add base infastructure for socket mediation
    - SAUCE: apparmor: af_unix mediation
    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
    - SAUCE: LSM stacking: LSM: manage credential security blobs
    - SAUCE: LSM stacking: LSM: Manage file security blobs
    - SAUCE: LSM stacking: LSM: manage task security blobs
    - SAUCE: LSM stacking: LSM: Infrastructure management of the remaining blobs
    - SAUCE: LSM stacking: LSM: general but not extreme module stacking
    - SAUCE: LSM stacking: LSM: Complete task_alloc hook
    - SAUCE: LSM stacking: fixup procsfs: add smack subdir to attrs
    - SAUCE: LSM stacking: fixup initialize task->security
    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
    - SAUCE: LSM stacking: fixup apparmor stacking enablement
    - SAUCE: LSM stacking: fixup stacking kconfig
    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
    - SAUCE: LSM stacking: provide prctl interface for setting context
    - SAUCE: LSM stacking: inherit current display LSM
    - SAUCE: LSM stacking: keep an index for each registered LSM
    - SAUCE: LSM stacking: verify display LSM
    - SAUCE: LSM stacking: provide a way to specify the default display lsm
    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
    - SAUCE: LSM stacking: add Kconfig to set default display LSM
    - SAUCE: LSM stacking: add configs for LSM stacking
    - SAUCE: LSM stacking: check for invalid zero sized writes
    - [Config] Run updateconfigs after merging LSM stacking
    - [Config] CONFIG_AMD_MEM_ENCRYPT=y

  [ Upstream Kernel Changes ]

  * Rebase to v4.14

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Nov 2017 08:12:08 -0600

linux (4.14.0-6.8) bionic; urgency=low

  * Miscellaneous Ubuntu changes
    - SAUCE: add workarounds to enable ZFS for 4.14

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc8

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Nov 2017 11:39:00 -0600

linux (4.14.0-5.7) bionic; urgency=low

  * Miscellaneous Ubuntu changes
    - [Debian] Fix invocation of dh_prep for dbgsym packages

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 31 Oct 2017 07:07:23 -0500

linux (4.14.0-4.5) bionic; urgency=low

  * Miscellaneous Ubuntu changes
    - [Packaging] virtualbox -- reduce in kernel module versions
    - vbox-update: Fix up KERN_DIR definitions
    - ubuntu: vbox -- update to 5.2.0-dfsg-2
    - [Config] CONFIG_AMD_MEM_ENCRYPT=n

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc7

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Oct 2017 13:29:20 -0500

linux (4.14.0-3.4) artful; urgency=low

  * Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
    - SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
    - SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
    - SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280

  * powerpc/64s: Add workaround for P9 vector CI load issuenext (LP: #1721070)
    - powerpc/64s: Add workaround for P9 vector CI load issue

  * Miscellaneous Ubuntu changes
    - SAUCE: staging: vboxvideo: Fix reporting invalid suggested-offset-properties
    - [Config] CONFIG_DRM_VBOXVIDEO=m
    - SAUCE: Import aufs driver
    - [Config] Enable aufs
    - [Config] Reorder annotations file after enabling aufs
    - vbox-update: Disable imported vboxvideo module
    - ubuntu: vbox -- update to 5.1.30-dfsg-1
    - Enable vbox
    - hio: Use correct sizes when initializing ssd_index_bits* arrays
    - hio: Update io stat accounting for 4.14
    - Enable hio

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc5
  * Rebase to v4.14-rc6

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Oct 2017 13:53:52 -0500

linux (4.14.0-2.3) artful; urgency=low

  * [Bug] USB controller failed to respond on Denverton after loading
    intel_th_pci module (LP: #1715833)
    - SAUCE: PCI: Disable broken RTIT_BAR of Intel TH

  * CONFIG_DEBUG_FS is not enabled by "make zfcpdump_defconfig" with Ubuntu
    17.10 (kernel 4.13) (LP: #1719290)
    - SAUCE: s390: update zfcpdump_defconfig

  * Add installer support for Broadcom BCM573xx network drivers. (LP: #1720466)
    - d-i: Add bnxt_en to nic-modules.

  * Miscellaneous Ubuntu changes
    - [Config] Update annotations for 4.14-rc2

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc3
  * Rebase to v4.14-rc4

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 11 Oct 2017 16:04:27 -0500

linux (4.14.0-1.2) artful; urgency=low

  * [Bug] USB 3.1 Gen2 works as 5Gbps (LP: #1720045)
    - xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor

  * Please make linux-libc-dev Provide: aufs-dev (LP: #1716091)
    - [Packaging] Add aufs-dev to the Provides: for linux-libc-dev

  * Upgrade to 4.13.0-11.12 in artful amd64 VM breaks display on wayland
    (LP: #1718679)
    - [Config] CONFIG_DRM_VBOXVIDEO=n

  * ipmmu-vmsa driver breaks arm64 boots (LP: #1718734)
    - [Config] Disable CONFIG_IPMMU_VMSA on arm64

  * autopkgtest profile fails to build on armhf (LP: #1717920)
    - [Packaging] autopkgtest -- disable d-i when dropping flavours

  * Miscellaneous Ubuntu changes
    - [Config] CONFIG_I2C_XLP9XX=m
    - [Packaging] Use SRCPKGNAME rather than hard-coding the source package name

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc2

 -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Sep 2017 09:09:11 -0400

linux (4.14.0-0.1) artful; urgency=low

  * Miscellaneous Ubuntu changes
    - Disable vbox build
    - Disable hio build
    - Disable zfs build

  [ Upstream Kernel Changes ]

  * Rebase to v4.14-rc1

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 19 Sep 2017 20:22:29 -0500

linux (4.13.0-11.12) artful; urgency=low

  * linux: 4.13.0-11.12 -proposed tracker (LP: #1716699)

  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
    - s390/mm: fix local TLB flushing vs. detach of an mm address space
    - s390/mm: fix race on mm->context.flush_mm

  * CVE-2017-1000251
    - Bluetooth: Properly check L2CAP config option output buffer length

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Sep 2017 10:18:38 -0500

linux (4.13.0-10.11) artful; urgency=low

  * linux: 4.13.0-10.11 -proposed tracker (LP: #1716287)

  * please add aufs-dkms to the Provides: for the kernel packages (LP: #1716093)
    - [Packaging] Add aufs-dkms to the Provides: for kernel packages

  * Artful update to v4.13.1 stable release (LP: #1716284)
    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
    - USB: serial: option: add support for D-Link DWM-157 C1
    - usb: Add device quirk for Logitech HD Pro Webcam C920-C
    - usb:xhci:Fix regression when ATI chipsets detected
    - USB: musb: fix external abort on suspend
    - ANDROID: binder: add padding to binder_fd_array_object.
    - ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
    - USB: core: Avoid race of async_completed() w/ usbdev_release()
    - staging/rts5208: fix incorrect shift to extract upper nybble
    - staging: ccree: save ciphertext for CTS IV
    - staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
    - iio: adc: ti-ads1015: fix incorrect data rate setting update
    - iio: adc: ti-ads1015: fix scale information for ADS1115
    - iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
    - iio: adc: ti-ads1015: avoid getting stale result after runtime resume
    - iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
    - iio: adc: ti-ads1015: add adequate wait time to get correct conversion
    - driver core: bus: Fix a potential double free
    - HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage
    - binder: free memory on error
    - crypto: caam/qi - fix compilation with CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
    - crypto: caam/qi - fix compilation with DEBUG enabled
    - thunderbolt: Fix reset response_type
    - fpga: altera-hps2fpga: fix multiple init of l3_remap_lock
    - intel_th: pci: Add Cannon Lake PCH-H support
    - intel_th: pci: Add Cannon Lake PCH-LP support
    - ath10k: fix memory leak in rx ring buffer allocation
    - drm/vgem: Pin our pages for dmabuf exports
    - drm/ttm: Fix accounting error when fail to get pages for pool
    - drm/dp/mst: Handle errors from drm_atomic_get_private_obj_state() correctly
    - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
    - Bluetooth: Add support of 13d3:3494 RTL8723BE device
    - iwlwifi: pci: add new PCI ID for 7265D
    - dlm: avoid double-free on error path in dlm_device_{register,unregister}
    - mwifiex: correct channel stat buffer overflows
    - MCB: add support for SC31 to mcb-lpc
    - s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
    - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
    - drm/nouveau: Fix error handling in nv50_disp_atomic_commit
    - workqueue: Fix flag collision
    - ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme
    - cs5536: add support for IDE controller variant
    - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
    - scsi: sg: recheck MMAP_IO request length with lock held
    - of/device: Prevent buffer overflow in of_device_modalias()
    - rtlwifi: Fix memory leak when firmware request fails
    - rtlwifi: Fix fallback firmware loading
    - Linux 4.13.1

  * Kernel has trouble recognizing Corsair Strafe RGB keyboard (LP: #1678477)
    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard

  * SRIOV: warning if unload VFs (LP: #1715073)
    - PCI: Disable VF decoding before pcibios_sriov_disable() updates resources

  * [Patch] network-i40e:NVM bug fixes (cherrypick from 4.14) (LP: #1715578)
    - i40e: avoid NVM acquire deadlock during NVM update
    - i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq

  * [P9,POwer NV] Perf PMU event : pm_br_2path and pm_ld_miss_l1 is counted
    twice when perf stat is done (perf:) (LP: #1714571)
    - perf vendor events powerpc: Remove duplicate events

  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
    (LP: #1703339)
    - [Config] Include vmd in storage-core-modules udeb

  * 17.10 fails to boot on POWER9 DD2.0 with Deep stop states (LP: #1715064)
    - powerpc/powernv: Save/Restore additional SPRs for stop4 cpuidle
    - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug
    - SAUCE: powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state
      offline

  * Miscellaneous Ubuntu changes
    - SAUCE: selftests/seccomp: Support glibc 2.26 siginfo_t.h
    - Revert "UBUNTU: SAUCE: Import aufs driver"
    - SAUCE: Import aufs driver

 -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Sep 2017 17:48:59 -0500

linux (4.13.0-9.10) artful; urgency=low

  * linux: 4.13.0-9.10 -proposed tracker (LP: #1715145)

  * EDAC sbridge: Failed to register device with error -22. (LP: #1714112)
    - [Config] CONFIG_EDAC_GHES=n

  * Miscellaneous Ubuntu changes
    - ubuntu: vbox -- update to 5.1.26-dfsg-2

  [ Upstream Kernel Changes ]

  * Rebase to v4.13

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Sep 2017 07:51:19 -0500

linux (4.13.0-8.9) artful; urgency=low

  * snapd 2.27.3+17.10 ADT test failure with linux 4.13.0-6.7 (LP: #1713103)
    - SAUCE: apparmor: fix apparmorfs DAC access, permissions

  * enable ARCH_SUNXI (and friends) in arm64 kernel .config (LP: #1701137)
    - [Config] Enable CONFIG_ARCH_SUNXI and related options for arm64

  * [Bug] Harrisonville: pnd2_edac always fail to load on B1 stepping
    Harrisonville SDP (LP: #1709257)
    - EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake
    - EDAC, pnd2: Mask off the lower four bits of a BAR
    - EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR
    - EDAC, pnd2: Properly toggle hidden state for P2SB PCI device
    - SAUCE: i2c: i801: Restore the presence state of P2SB PCI device after
      reading BAR

  * Miscellaneous Ubuntu changes
    - Revert "UBUNTU: SAUCE: Import aufs driver"
    - SAUCE: Import aufs driver
    - SAUCE: selftests/powerpc: Disable some ptrace selftests
    - [Config] CONFIG_CRYPTO_DEV_NITROX_CNN55XX=n for s390x
    - [Config] CONFIG_I2C_SLAVE=n for amd64, i386, ppc64el
    - [Config] Disable CONFIG_MDIO_* options for s390x
    - [Config] CONFIG_SCSI_MQ_DEFAULT=n for s390x
    - [Config] Update annotations for 4.13

 -- Seth Forshee <seth.forshee@canonical.com>  Thu, 31 Aug 2017 14:27:09 -0500

linux (4.13.0-7.8) artful; urgency=low

  * linux 4.12.0-11.12 ADT test failure with linux 4.12.0-11.12 (LP: #1710904)
    - SAUCE: selftests/powerpc: Use snprintf to construct DSCR sysfs interface
      paths

  * Miscellaneous Ubuntu changes
    - Revert "UBUNTU: SAUCE: seccomp: log actions even when audit is disabled"

  * Miscellaneous upstream changes
    - seccomp: Provide matching filter for introspection
    - seccomp: Sysctl to display available actions
    - seccomp: Operation for checking if an action is available
    - seccomp: Sysctl to configure actions that are allowed to be logged
    - seccomp: Selftest for detection of filter flag support
    - seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW
    - seccomp: Action to log before allowing

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc7

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 28 Aug 2017 08:12:24 -0500

linux (4.13.0-6.7) artful; urgency=low

  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A

  * sort ABI files with C.UTF-8 locale (LP: #1712345)
    - [Packaging] sort ABI files with C.UTF-8 locale

  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
    - SAUCE: igb: add support for using Broadcom 54616 as PHY

  * RPT related fixes missing in Ubuntu 16.04.3 (LP: #1709220)
    - powerpc/mm/radix: Improve _tlbiel_pid to be usable for PWC flushes
    - powerpc/mm/radix: Improve TLB/PWC flushes
    - powerpc/mm/radix: Avoid flushing the PWC on every flush_tlb_range

  * Linux 4.12 refuses to load self-signed modules under Secure Boot with
    properly enrolled keys (LP: #1712168)
    - SAUCE: (efi-lockdown) MODSIGN: Fix module signature verification

  * [17.10 FEAT] Enable NVMe driver - kernel (LP: #1708432)
    - [Config] CONFIG_BLK_DEV_NVME=m for s390

  * Artful: 4.12.0-11.12: Boot panic in vlv2_plat_configure_clock+0x3b/0xa0
    (LP: #1711298)
    - [Config] CONFIG_INTEL_ATOMISP=n

  * Miscellaneous Ubuntu changes
    - SAUCE: apparmor: af_unix mediation

  * Miscellaneous upstream changes
    - apparmor: Fix shadowed local variable in unpack_trans_table()
    - apparmor: Fix logical error in verify_header()
    - apparmor: Fix an error code in aafs_create()
    - apparmor: Redundant condition: prev_ns. in [label.c:1498]
    - apparmor: add the ability to mediate signals
    - apparmor: add mount mediation
    - apparmor: cleanup conditional check for label in label_print
    - apparmor: add support for absolute root view based labels
    - apparmor: make policy_unpack able to audit different info messages
    - apparmor: add more debug asserts to apparmorfs
    - apparmor: add base infastructure for socket mediation
    - apparmor: move new_null_profile to after profile lookup fns()
    - apparmor: fix race condition in null profile creation
    - apparmor: ensure unconfined profiles have dfas initialized
    - apparmor: fix incorrect type assignment when freeing proxies

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc6

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 23 Aug 2017 08:10:38 -0500

linux (4.13.0-5.6) artful; urgency=low

  * Ubuntu17.10 - perf: Update Power9 PMU event JSON files (LP: #1708630)
    - perf pmu-events: Support additional POWER8+ PVR in mapfile
    - perf vendor events: Add POWER9 PMU events
    - perf vendor events: Add POWER9 PVRs to mapfile
    - SAUCE: perf vendor events powerpc: remove suffix in mapfile
    - SAUCE: perf vendor events powerpc: Update POWER9 events

  * Disable CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE (LP: #1709171)
    - [Config] CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=n for ppc64el

  * Please only recommend or suggest initramfs-tools | linux-initramfs-tool for
    kernels able to boot without initramfs (LP: #1700972)
    - [Debian] Don't depend on initramfs-tools

  * Miscellaneous Ubuntu changes
    - SAUCE: Import aufs driver
    - SAUCE: aufs -- Add missing argument to loop_switch() call
    - [Config] Enable aufs
    - SAUCE: (noup) Update spl to 0.6.5.11-ubuntu1, zfs to 0.6.5.11-1ubuntu3
    - Enable zfs build
    - SAUCE: powerpc: Always initialize input array when calling epapr_hypercall()
    - [Packaging] switch up to debhelper 9

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc5

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 15 Aug 2017 09:24:16 -0500

linux (4.13.0-4.5) artful; urgency=low

  * Lenovo Yoga 910 Sensors (LP: #1708120)
    - SAUCE: (no-up) HID: Add quirk for Lenovo Yoga 910 with ITE Chips

  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
    (LP: #1703339)
    - [Config] Add vmd driver to generic inclusion list

  * Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
    - [Config] CONFIG_SATA_HIGHBANK=y

  * Miscellaneous Ubuntu changes
    - ubuntu: vbox -- update to 5.1.26-dfsg-1
    - SAUCE: hio: Build fixes for 4.13
    - Enable hio build
    - SAUCE: (noup) Update spl to 0.6.5.11-1, zfs to 0.6.5.11-1ubuntu1
    - [debian] use all rather than amd64 dkms debs for sync

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc4

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Aug 2017 11:31:48 -0500

linux (4.13.0-3.4) artful; urgency=low

  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
    - [Packaging] tests -- reduce rebuild test to one flavour
    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter

  * snapd 2.26.8+17.10 ADT test failure with linux 4.12.0-6.7 (LP: #1704158)
    - SAUCE: virtio_net: Revert mergeable buffer handling rework

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc3

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 31 Jul 2017 10:08:16 -0500

linux (4.13.0-2.3) artful; urgency=low

  * Change CONFIG_IBMVETH to module (LP: #1704479)
    - [Config] CONFIG_IBMVETH=m

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc2

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 24 Jul 2017 13:58:08 -0500

linux (4.13.0-1.2) artful; urgency=low

  * Miscellaneous Ubuntu changes
    - [Debian] Support sphinx-based kernel documentation

 -- Seth Forshee <seth.forshee@canonical.com>  Thu, 20 Jul 2017 09:18:33 -0500

linux (4.13.0-0.1) artful; urgency=low

  * Miscellaneous Ubuntu changes
    - Disable hio
    - Disable zfs build
    - ubuntu: vbox -- update to 5.1.24-dfsg-1

  [ Upstream Kernel Changes ]

  * Rebase to v4.13-rc1

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 19 Jul 2017 15:09:31 -0500

linux (4.12.0-7.8) artful; urgency=low

  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
    (LP: #1673564)
    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
    - arm64: Add MIDR values for Cavium cn83XX SoCs
    - arm64: Add workaround for Cavium Thunder erratum 30115
    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access

  * hns: under heavy load, NIC may fail and require reboot (LP: #1704146)
    - net: hns: Bugfix for Tx timeout handling in hns driver

  * New ACPI identifiers for ThunderX SMMU (LP: #1703437)
    - iommu/arm-smmu: Plumb in new ACPI identifiers

  * Transparent hugepages should default to enabled=madvise (LP: #1703742)
    - SAUCE: use CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y as default

  * Artful update to v4.12.1 stable release (LP: #1703858)
    - driver core: platform: fix race condition with driver_override
    - RDMA/uverbs: Check port number supplied by user verbs cmds
    - usb: dwc3: replace %p with %pK
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - usb: usbip: set buffer pointers to NULL after free
    - Add USB quirk for HVR-950q to avoid intermittent device resets
    - usb: Fix typo in the definition of Endpoint[out]Request
    - USB: core: fix device node leak
    - USB: serial: option: add two Longcheer device ids
    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
    - xhci: Limit USB2 port wake support for AMD Promontory hosts
    - gfs2: Fix glock rhashtable rcu bug
    - Add "shutdown" to "struct class".
    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
    - tpm: fix a kernel memory leak in tpm-sysfs.c
    - powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
    - sched/fair, cpumask: Export for_each_cpu_wrap()
    - sched/core: Implement new approach to scale select_idle_cpu()
    - sched/numa: Use down_read_trylock() for the mmap_sem
    - sched/numa: Override part of migrate_degrades_locality() when idle balancing
    - sched/fair: Simplify wake_affine() for the single socket case
    - sched/numa: Implement NUMA node level wake_affine()
    - sched/fair: Remove effective_load()
    - sched/numa: Hide numa_wake_affine() from UP build
    - xen: avoid deadlock in xenbus driver
    - crypto: drbg - Fixes panic in wait_for_completion call
    - Linux 4.12.1

  * cxlflash update request in the Xenial SRU stream (LP: #1702521)
    - scsi: cxlflash: Combine the send queue locks
    - scsi: cxlflash: Update cxlflash_afu_sync() to return errno
    - scsi: cxlflash: Reset hardware queue context via specified register
    - scsi: cxlflash: Schedule asynchronous reset of the host
    - scsi: cxlflash: Handle AFU sync failures
    - scsi: cxlflash: Track pending scsi commands in each hardware queue
    - scsi: cxlflash: Flush pending commands in cleanup path
    - scsi: cxlflash: Add scsi command abort handler
    - scsi: cxlflash: Create character device to provide host management interface
    - scsi: cxlflash: Separate AFU internal command handling from AFU sync
      specifics
    - scsi: cxlflash: Introduce host ioctl support
    - scsi: cxlflash: Refactor AFU capability checking
    - scsi: cxlflash: Support LUN provisioning
    - scsi: cxlflash: Support AFU debug
    - scsi: cxlflash: Support WS16 unmap
    - scsi: cxlflash: Remove zeroing of private command data
    - scsi: cxlflash: Update TMF command processing
    - scsi: cxlflash: Avoid double free of character device
    - scsi: cxlflash: Update send_tmf() parameters
    - scsi: cxlflash: Update debug prints in reset handlers

  * make snap-pkg support (LP: #1700747)
    - make snap-pkg support

  * Quirk for non-compliant PCI bridge on HiSilicon D05 board (LP: #1698706)
    - SAUCE: PCI: Support hibmc VGA cards behind a misbehaving HiSilicon bridge

  * arm64: fix crash reading /proc/kcore (LP: #1702749)
    - fs/proc: kcore: use kcore_list type to check for vmalloc/module address
    - arm64: mm: select CONFIG_ARCH_PROC_KCORE_TEXT

  * Opal and POWER9 DD2 (LP: #1702159)
    - SAUCE: powerpc/powernv: Tell OPAL about our MMU mode on POWER9

  * Data corruption with hio driver  (LP: #1701316)
    - SAUCE: hio: Fix incorrect use of enum req_opf values

  * Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl to 0.6.5.10-1, zfs to 0.6.5.10-1ubuntu2
    - snapcraft.yaml: Sync with xenial
    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y

  * Miscellaneous upstream changes
    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and
      MokSBState"

 -- Seth Forshee <seth.forshee@canonical.com>  Fri, 14 Jul 2017 15:25:41 -0500

linux (4.12.0-6.7) artful; urgency=low

  * update ENA driver to 1.2.0k from net-next (LP: #1701575)
    - net: ena: change return value for unsupported features unsupported return
      value
    - net: ena: add hardware hints capability to the driver
    - net: ena: change sizeof() argument to be the type pointer
    - net: ena: add reset reason for each device FLR
    - net: ena: add support for out of order rx buffers refill
    - net: ena: allow the driver to work with small number of msix vectors
    - net: ena: use napi_schedule_irqoff when possible
    - net: ena: separate skb allocation to dedicated function
    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
    - net: ena: update driver's rx drop statistics
    - net: ena: update ena driver to version 1.2.0

  * APST gets enabled against explicit kernel option (LP: #1699004)
    - nvme: explicitly disable APST on quirked devices

  * Miscellaneous Ubuntu changes
    - SAUCE: hio: Update to Huawei ES3000_V2 (2.1.0.40)
    - SAUCE: hio updates for 4.12
    - SAUCE: Enable hio build

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Jul 2017 14:23:20 -0500

linux (4.12.0-5.6) artful; urgency=low

  * ERAT invalidate on context switch removal (LP: #1700819)
    - powerpc: Only do ERAT invalidate on radix context switch on P9 DD1

  * powerpc: Invalidate ERAT on powersave wakeup for POWER9 (LP: #1700521)
    - SAUCE: powerpc: Invalidate ERAT on powersave wakeup for POWER9

  * Miscellaneous Ubuntu changes
    - d-i: Move qcom-emac from arm64 to shared nic-modules

  [ Upstream Kernel Changes ]

  * Rebase to v4.12

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 03 Jul 2017 07:52:02 -0500

linux (4.12.0-4.5) artful; urgency=low

  * aacraid driver may return uninitialized stack data to userspace
    (LP: #1700077)
    - SAUCE: scsi: aacraid: Don't copy uninitialized stack memory to userspace

  * KILLER1435-S[0489:e0a2] BT cannot search BT 4.0 device (LP: #1699651)
    - Bluetooth: btusb: Add support for 0489:e0a2 QCA_ROME device

  * AACRAID for power9 platform (LP: #1689980)
    - scsi: aacraid: Remove __GFP_DMA for raw srb memory
    - scsi: aacraid: Fix DMAR issues with iommu=pt
    - scsi: aacraid: Added 32 and 64 queue depth for arc natives
    - scsi: aacraid: Set correct Queue Depth for HBA1000 RAW disks
    - scsi: aacraid: Remove reset support from check_health
    - scsi: aacraid: Change wait time for fib completion
    - scsi: aacraid: Log count info of scsi cmds before reset
    - scsi: aacraid: Print ctrl status before eh reset
    - scsi: aacraid: Using single reset mask for IOP reset
    - scsi: aacraid: Rework IOP reset
    - scsi: aacraid: Add periodic checks to see IOP reset status
    - scsi: aacraid: Rework SOFT reset code
    - scsi: aacraid: Rework aac_src_restart
    - scsi: aacraid: Use correct function to get ctrl health
    - scsi: aacraid: Make sure ioctl returns on controller reset
    - scsi: aacraid: Enable ctrl reset for both hba and arc
    - scsi: aacraid: Add reset debugging statements
    - scsi: aacraid: Remove reference to Series-9
    - scsi: aacraid: Update driver version to 50834

  * hibmc driver does not include "pci:" prefix in bus ID (LP: #1698700)
    - SAUCE: drm: hibmc: Use set_busid function from drm core

  * HiSilicon D05: installer doesn't appear on VGA (LP: #1698954)
    - d-i: Add hibmc-drm to kernel-image udeb

  * Fix /proc/cpuinfo revision for POWER9 DD2 (LP: #1698844)
    - SAUCE: powerpc: Fix /proc/cpuinfo revision for POWER9 DD2

  * Miscellaneous Ubuntu changes
    - [Config] CONFIG_SATA_MV=n and CONFIG_GENERIC_PHY=n for s390x
    - [Config] CONFIG_ATA=n for s390x
    - [Config] Update annotations for 4.12

  [ Upstream Kernel Changes ]

  * Rebase to v4.12-rc7

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Jun 2017 11:27:29 -0500

linux (4.12.0-3.4) artful; urgency=low

  * Miscellaneous upstream changes
    - ufs: fix the logics for tail relocation

  [ Upstream Kernel Changes ]

  * Rebase to v4.12-rc6

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Jun 2017 14:50:39 -0500

linux (4.12.0-2.3) artful; urgency=low

  * CVE-2014-9900
    - SAUCE: (no-up) net: Zeroing the structure ethtool_wolinfo in
      ethtool_get_wol()

  * System doesn't boot properly on Gigabyte AM4 motherboards (AMD Ryzen)
    (LP: #1671360)
    - pinctrl/amd: Use regular interrupt instead of chained

  * extend-diff-ignore should use exact matches (LP: #1693504)
    - [Packaging] exact extend-diff-ignore matches

  * Miscellaneous Ubuntu changes
    - SAUCE: efi: Don't print secure boot state from the efi stub
    - ubuntu: vbox -- Update to 5.1.22-dfsg-1
    - SAUCE: vbox fixes for 4.12
    - Re-enable virtualbox build
    - [Config] CONFIG_ORANGEFS_FS=m
    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu2, zfs to 0.6.5.9-5ubuntu7
    - Enable zfs build

  [ Upstream Kernel Changes ]

  * Rebase to v4.12-rc4
  * Rebase to v4.12-rc5

 -- Seth Forshee <seth.forshee@canonical.com>  Sun, 11 Jun 2017 22:25:13 -0500

linux (4.12.0-1.2) artful; urgency=low

  * Enable Matrox driver for Ubuntu 16.04.3 (LP: #1693337)
    - [Config] Enable CONFIG_DRM_MGAG200 as module

  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
    - [Config] CONFIG_LIBIO=y on arm64 only
    - SAUCE: LIBIO: Introduce a generic PIO mapping method
    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
    - [Config] CONFIG_HISILICON_LPC=y
    - SAUCE: LPC: Support the device-tree LPC host on Hip06/Hip07
    - SAUCE: LIBIO: Support the dynamically logical PIO registration of ACPI host
      I/O
    - SAUCE: LPC: Add the ACPI LPC support
    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
    - SAUCE: PCI: Restore codepath for !CONFIG_LIBIO

  * POWER9: Additional patches for TTY and CPU_IDLE (LP: #1674325)
    - SAUCE: tty: Fix ldisc crash on reopened tty

  * Miscellaneous Ubuntu changes
    - [Debian] Add build-dep on libnuma-dev to enable 'perf bench numa'
    - Rebase to v4.12-rc3

  [ Upstream Kernel Changes ]

  * Rebase to v4.12-rc3

 -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 May 2017 20:56:29 -0500

linux (4.12.0-0.1) artful; urgency=low

  * please enable CONFIG_ARM64_LSE_ATOMICS (LP: #1691614)
    - [Config] CONFIG_ARM64_LSE_ATOMICS=y

  * [Regression] NUMA_BALANCING disabled on arm64 (LP: #1690914)
    - [Config] CONFIG_NUMA_BALANCING{,_DEFAULT_ENABLED}=y on arm64

  * exec'ing a setuid binary from a threaded program sometimes fails to setuid
    (LP: #1672819)
    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct

  * Miscellaneous Ubuntu changes
    - Update find-missing-sauce.sh to compare to artful
    - Update dropped.txt
    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
      kernel image
    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
      mode
    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
      locked down
    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
      reboot
    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
      set
    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
      down
    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
      locked down
    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
      down
    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
      is locked down
    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
      locked down
    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
      has been locked down
    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
      locked down
    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
      locked down
    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
      kernel is locked down
    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
      down
    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
      secondary keyring
    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
      MokSBState
    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
    - [Config] Set values for UEFI secure boot lockdown options
    - Disable virtualbox build
    - Disable hio build
    - SAUCE: securityfs: Replace CURRENT_TIME with current_time()
    - Disable zfs build
    - [Debian] Work out upstream tag for use with gen-auto-reconstruct
    - SAUCE: Import aufs driver
    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
    - [Config] Enable aufs
    - SAUCE: perf callchain: Include errno.h on x86 unconditinally

  [ Upstream Kernel Changes ]

  * Rebase to v4.12-rc2

 -- Seth Forshee <seth.forshee@canonical.com>  Sun, 21 May 2017 23:44:44 -0500

linux (4.11.0-3.8) artful; urgency=low

  [ Seth Forshee ]

  * Release Tracking Bug
    - LP: #1690999

  * apparmor_parser hangs indefinitely when called by multiple threads
    (LP: #1645037)
    - SAUCE: apparmor: fix lock ordering for mkdir

  * apparmor leaking securityfs pin count (LP: #1660846)
    - SAUCE: apparmor: fix leak on securityfs pin count

  * apparmor reference count leak when securityfs_setup_d_inode\ () fails
    (LP: #1660845)
    - SAUCE: apparmor: fix reference count leak when securityfs_setup_d_inode()
      fails

  * apparmor not checking error if security_pin_fs() fails (LP: #1660842)
    - SAUCE: apparmor: fix not handling error case when securityfs_pin_fs() fails

  * libvirt profile is blocking global setrlimit despite having no rlimit rule
    (LP: #1679704)
    - SAUCE: apparmor: fix complain mode failure for rlimit mediation
    - apparmor: update auditing of rlimit check to provide capability information

  * apparmor: does not provide a way to detect policy updataes (LP: #1678032)
    - SAUCE: apparmor: add policy revision file interface

  * apparmor does not make support of query data visible (LP: #1678023)
    - SAUCE: apparmor: add label data availability to the feature set

  * apparmor query interface does not make supported query info available
    (LP: #1678030)
    - SAUCE: apparmor: add information about the query inteface to the feature set

  * change_profile incorrect when using namespaces with a compound stack
    (LP: #1677959)
    - SAUCE: apparmor: fix label parse for stacked labels

  * Regression in 4.4.0-65-generic causes very frequent system crashes
    (LP: #1669611)
    - apparmor: sync of apparmor 3.6+ (17.04)

  * Artful update to 4.11.1 stable release (LP: #1690814)
    - dm ioctl: prevent stack leak in dm ioctl call
    - drm/sti: fix GDP size to support up to UHD resolution
    - power: supply: lp8788: prevent out of bounds array access
    - brcmfmac: Ensure pointer correctly set if skb data location changes
    - brcmfmac: Make skb header writable before use
    - sparc64: fix fault handling in NGbzero.S and GENbzero.S
    - refcount: change EXPORT_SYMBOL markings
    - net: macb: fix phy interrupt parsing
    - tcp: fix access to sk->sk_state in tcp_poll()
    - geneve: fix incorrect setting of UDP checksum flag
    - bpf: enhance verifier to understand stack pointer arithmetic
    - bpf, arm64: fix jit branch offset related to ldimm64
    - tcp: fix wraparound issue in tcp_lp
    - net: ipv6: Do not duplicate DAD on link up
    - net: usb: qmi_wwan: add Telit ME910 support
    - tcp: do not inherit fastopen_req from parent
    - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
    - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
    - ipv6: initialize route null entry in addrconf_init()
    - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
    - tcp: randomize timestamps on syncookies
    - bnxt_en: allocate enough space for ->ntp_fltr_bmap
    - bpf: don't let ldimm64 leak map addresses on unprivileged
    - net: mdio-mux: bcm-iproc: call mdiobus_free() in error path
    - f2fs: sanity check segment count
    - xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..."
    - xen: Revert commits da72ff5bfcb0 and 72a9b186292d
    - block: get rid of blk_integrity_revalidate()
    - Linux 4.11.1

  * Module signing exclusion for staging drivers does not work properly
    (LP: #1690908)
    - SAUCE: Fix module signing exclusion in package builds

  * perf: qcom: Add L3 cache PMU driver (LP: #1689856)
    - [Config] CONFIG_QCOM_L3_PMU=y
    - perf: qcom: Add L3 cache PMU driver

  * No PMU support for ACPI-based arm64 systems (LP: #1689661)
    - drivers/perf: arm_pmu: rework per-cpu allocation
    - drivers/perf: arm_pmu: manage interrupts per-cpu
    - drivers/perf: arm_pmu: split irq request from enable
    - drivers/perf: arm_pmu: remove pointless PMU disabling
    - drivers/perf: arm_pmu: define armpmu_init_fn
    - drivers/perf: arm_pmu: fold init into alloc
    - drivers/perf: arm_pmu: factor out pmu registration
    - drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs()
    - drivers/perf: arm_pmu: handle no platform_device
    - drivers/perf: arm_pmu: rename irq request/free functions
    - drivers/perf: arm_pmu: split cpu-local irq request/free
    - drivers/perf: arm_pmu: move irq request/free into probe
    - drivers/perf: arm_pmu: split out platform device probe logic
    - arm64: add function to get a cpu's MADT GICC table
    - [Config] CONFIG_ARM_PMU_ACPI=y
    - drivers/perf: arm_pmu: add ACPI framework
    - arm64: pmuv3: handle !PMUv3 when probing
    - arm64: pmuv3: use arm_pmu ACPI framework

  * Fix NVLINK2 TCE route (LP: #1690155)
    - powerpc/powernv: Fix TCE kill on NVLink2

  * CVE-2017-0605
    - tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline()

  * Miscellaneous Ubuntu changes
    - [Config] Restore powerpc arch to annotations file
    - [Config] Disable runtime testing modules
    - [Config] Disable drivers not needed on s390x
    - [Config] Update annotations for 4.11
    - [Config] updateconfigs after apparmor updates

  * Miscellaneous upstream changes
    - apparmor: use SHASH_DESC_ON_STACK
    - apparmor: fix invalid reference to index variable of iterator line 836
    - apparmor: fix parameters so that the permission test is bypassed at boot
    - apparmor: Make path_max parameter readonly
    - apparmorfs: Combine two function calls into one in aa_fs_seq_raw_abi_show()
    - apparmorfs: Use seq_putc() in two functions
    - apparmor: provide information about path buffer size at boot
    - apparmor: add/use fns to print hash string hex value

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 16 May 2017 00:39:13 -0500

linux (4.11.0-2.7) artful; urgency=low

  * kernel-wedge fails in artful due to leftover squashfs-modules d-i files
    (LP: #1688259)
    - Remove squashfs-modules files from d-i
    - [Config] as squashfs-modules is builtin kernel-image must Provides: it

  * [Zesty] d-i: replace msm_emac with qcom_emac (LP: #1677297)
    - Revert "UBUNTU: d-i: initrd needs msm_emac on amberwing platform."
    - d-i: initrd needs qcom_emac on amberwing platform.

  * update for V3 kernel bits and improved multiple fan slice support
    (LP: #1470091)
    - SAUCE: fan: tunnel multiple mapping mode (v3)

  * Miscellaneous Ubuntu changes
    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu1, zfs to 0.6.5.9-5ubuntu5
    - Enable zfs
    - SAUCE: fan: add VXLAN implementation
    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
      kernel image
    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
      mode
    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
      locked down
    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
      reboot
    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
      set
    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
      down
    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
      locked down
    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
      down
    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
      is locked down
    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
      locked down
    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
      has been locked down
    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
      locked down
    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
      locked down
    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
      kernel is locked down
    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
      down
    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
    - SAUCE: (efi-lockdown) Add EFI signature data types
    - SAUCE: (efi-lockdown) Add an EFI signature blob parser and key loader.
    - SAUCE: (efi-lockdown) KEYS: Add a system blacklist keyring
    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
    - SAUCE: (efi-lockdown) MODSIGN: Support not importing certs from db
    - SAUCE: (efi-lockdown) MODSIGN: Don't try secure boot if EFI runtime is
      disabled
    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
      MokSBState
    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
    - [Config] Set values for UEFI secure boot lockdown options
    - Update dropped.txt

  [ Upstream Kernel Changes ]

  * rebase to v4.11

 -- Seth Forshee <seth.forshee@canonical.com>  Fri, 05 May 2017 07:43:14 -0500

linux (4.11.0-1.6) artful; urgency=low

  * Miscellaneous Ubuntu changes
    - [Debian] Use default compression for all packages
    - SAUCE: (namespace) block_dev: Support checking inode permissions in
      lookup_bdev()
    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
      when mounting
    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
      when mounting
    - SAUCE: (namespace) fs: Allow superblock owner to change ownership of inodes
    - SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root
    - SAUCE: (namespace) fs: Allow superblock owner to access do_remount_sb()
    - SAUCE: (namespace) capabilities: Allow privileged user in s_user_ns to set
      security.* xattrs
    - SAUCE: (namespace) fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw
      filesystems
    - SAUCE: (namespace) fuse: Add support for pid namespaces
    - SAUCE: (namespace) fuse: Support fuse filesystems outside of init_user_ns
    - SAUCE: (namespace) fuse: Restrict allow_other to the superblock's namespace
      or a descendant
    - SAUCE: (namespace) fuse: Allow user namespace mounts
    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
      namespaces
    - SAUCE: (namespace) evm: Don't update hmacs in user ns mounts
    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
      mounts
    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
      opened for writing

 -- Seth Forshee <seth.forshee@canonical.com>  Wed, 26 Apr 2017 10:08:29 -0500

linux (4.11.0-0.5) artful; urgency=low

  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
    (LP: #1684971)
    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain

  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
    (LP: #1470250)
    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails

  * Enable virtual scsi server driver for Power (LP: #1615665)
    - SAUCE: Return TCMU-generated sense data to fabric module

  * include/linux/security.h header syntax error with !CONFIG_SECURITYFS
    (LP: #1630990)
    - SAUCE: (no-up) include/linux/security.h -- fix syntax error with
      CONFIG_SECURITYFS=n

  * Miscellaneous Ubuntu changes
    - SAUCE: Import aufs driver
    - [Config] Enable aufs
    - [Debian] Add script to update virtualbox
    - ubuntu: vbox -- Update to 5.1.20-dfsg-2
    - Enable vbox
    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h

  [ Upstream Kernel Changes ]

  * rebase to v4.11-rc8

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Apr 2017 13:42:54 -0500

linux (4.11.0-0.4) zesty; urgency=low

  * POWER9: Improve performance on memory management (LP: #1681429)
    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
      flush
    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync

  * Miscellaneous Ubuntu changes
    - find-missing-sauce.sh

  [ Upstream Kernel Changes ]

  * rebase to v4.11-rc7

 -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Apr 2017 08:19:43 -0500

linux (4.11.0-0.3) zesty; urgency=low

  * Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
    - [Config] Disable CONFIG_HVC_UDBG on ppc64el

  * smartpqi driver needed in initram disk and installer (LP: #1680156)
    - [Config] Add smartpqi to d-i

  * Disable CONFIG_SECURITY_SELINUX_DISABLE (LP: #1680315)
    - [Config] CONFIG_SECURITY_SELINUX_DISABLE=n

  * Miscellaneous Ubuntu changes
    - [Config] flash-kernel should be a Breaks
    - [Config] drop the info directory
    - [Config] drop NOTES as obsolete
    - [Config] drop changelog.historical as obsolete
    - rebase to v4.11-rc6

  [ Upstream Kernel Changes ]

  * rebase to v4.11-rc6

 -- Tim Gardner <tim.gardner@canonical.com>  Tue, 11 Apr 2017 07:16:52 -0600

linux (4.11.0-0.2) zesty; urgency=low

  [ Upstream Kernel Changes ]

  * rebase to v4.11-rc5

 -- Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Apr 2017 08:26:07 +0100

linux (4.11.0-0.1) zesty; urgency=low

  [ Upstream Kernel Changes ]

  * rebase to v4.11-rc4
    - LP: #1591053

 -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600

linux (4.11.0-0.0) zesty; urgency=low

  * dummy entry

 -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600