Bug #747090 “wrong return address sometimes pushed for INT in kv...” : Bugs : qemu-kvm package : Ubuntu

Timo Jyrinki (timo-jyrinki) on 2011-04-01

description:

updated

Colin Watson (cjwatson) on 2011-04-02

Changed in gfxboot-theme-ubuntu (Ubuntu):
importance:	Undecided → High
status:	New → Confirmed

Colin Watson (cjwatson) on 2011-04-02

Changed in gfxboot-theme-ubuntu (Ubuntu Natty):
assignee:	nobody → Colin Watson (cjwatson)
milestone:	none → ubuntu-11.04-beta-2
description:	updated

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-02:

#1

This seems to be broken in maverick too. I expect it has something to do with switching to the gfxboot com32 module in syslinux, although I thought I'd fixed that in 0.10.0.

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-04:

#2

The findfile primitive is failing mysteriously. But only sometimes. Argh.

Timo Jyrinki (timo-jyrinki) on 2011-04-05

summary:

- No translations in natty
+ No translations in natty - inside kvm only

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-05: Re: No translations in natty - inside kvm only

#3

Download full text (5.1 KiB)

Believe it or not, this appears to be a kvm bug. It is reproducible with kvm but not with 'qemu -no-kvm'.

The problem appears to be that the return address is sometimes wrong when calling INT in real mode. Here's how to reproduce it in GDB. Download http://cdimage.ubuntu.com/daily-live/current/natty-desktop-i386.iso (sorry, I realise this is large, at 700MB or so - if a kvm developer needs a smaller image, I should be able to prepare one). Start gdb and run 'target remote | kvm -gdb stdio -cdrom natty-desktop-i386.iso', 'c' at the prompt, and Ctrl-c in gdb as soon as kvm displays the aubergine splash screen. Then set up breakpoints as follows:

(gdb) b *0x8eeb if $al==6
Breakpoint 1 at 0x8eeb
(gdb) commands 1
Type commands for breakpoint(s) 1, one per line.
End with a line saying just "end".
>info reg al
>x/s ($es<<4)+$si
>x/xh ($ss<<4)+$sp
>end
(gdb) b *0x8de5
Breakpoint 2 at 0x8de5
(gdb) commands 2
Type commands for breakpoint(s) 2, one per line.
End with a line saying just "end".
>x/xh ($ss<<4)+$sp+40
>end

The first breakpoint is at comboot_int22 in syslinux, in the case where AL == 6, with commands that print AL, the string at ES:SI, and the return address on the stack; this corresponds to the "Open file" real-mode COMBOOT API call, which is called from cb_fopen in syslinux/com32/gfxboot/realmode_callback.asm. The second is on the IRET instruction that returns from that interrupt, with a command that prints the return address on the stack. The relevant chunk of calling code is (with 16-bit operand size):

cb_fopen:
                mov si,f_name
                push ds
                pop es
                mov ax,6
                int 22h
                xchg edx,eax
                mov al,1
                jc cb_fopen_90

After setting this up, tell gdb to continue, and quickly switch to the kvm window and press Escape to instruct the Ubuntu gfxboot theme to display the full boot menu.

You may have to try a few times to make this happen, because it's not entirely consistent, and chances are you will have to continue through a few irrelevant breakpoint traps. You may also need to use the F2 menu in gfxboot to select a different language. Sooner or later you should see:

Breakpoint 1, 0x00008eeb in ?? ()
al 0x6 6
0x110fa: "en.tr"
0x1d346: 0x0031

The return address is with CS == 0x1100, and we're in real mode, so 'set architecture i8086', and:

(gdb) disas /r 0x11031,+20
Dump of assembler code from 0x11031 to 0x11045:
   0x00011031: cd 22 int $0x22
   0x00011033: 66 92 xchg %ax,%dx
   0x00011035: b0 01 mov $0x1,%al
   0x00011037: 72 2c jb 0x11065
   0x00011039: 3b 0e cmp (%esi),%ecx
   0x0001103b: 00 00 add %al,(%eax)
   0x0001103d: 77 26 ja 0x11065
   0x0001103f: 09 c9 or %ecx,%ecx
   0x00011041: 74 22 je 0x11065
   0x00011043: 89 0e mov %ecx,(%esi)
End of assembler dump.

Note that the return address is the INT, not the instruction following the INT. This does not always happen, but when it does, other things always seem to go wrong:

(gdb) c
Continuing.

Breakpoint 3,...

Believe it or not, this appears to be a kvm bug.  It is reproducible with kvm but not with 'qemu -no-kvm'.

The problem appears to be that the return address is sometimes wrong when calling INT in real mode.  Here's how to reproduce it in GDB.  Download http://cdimage.ubuntu.com/daily-live/current/natty-desktop-i386.iso (sorry, I realise this is large, at 700MB or so - if a kvm developer needs a smaller image, I should be able to prepare one).  Start gdb and run 'target remote | kvm -gdb stdio -cdrom natty-desktop-i386.iso', 'c' at the prompt, and Ctrl-c in gdb as soon as kvm displays the aubergine splash screen.  Then set up breakpoints as follows:

(gdb) b *0x8eeb if $al==6
Breakpoint 1 at 0x8eeb
(gdb) commands 1
Type commands for breakpoint(s) 1, one per line.
End with a line saying just "end".
>info reg al
>x/s ($es<<4)+$si
>x/xh ($ss<<4)+$sp
>end
(gdb) b *0x8de5
Breakpoint 2 at 0x8de5
(gdb) commands 2
Type commands for breakpoint(s) 2, one per line.
End with a line saying just "end".
>x/xh ($ss<<4)+$sp+40
>end

The first breakpoint is at comboot_int22 in syslinux, in the case where AL == 6, with commands that print AL, the string at ES:SI, and the return address on the stack; this corresponds to the "Open file" real-mode COMBOOT API call, which is called from cb_fopen in syslinux/com32/gfxboot/realmode_callback.asm.  The second is on the IRET instruction that returns from that interrupt, with a command that prints the return address on the stack.  The relevant chunk of calling code is (with 16-bit operand size):

cb_fopen:
                mov si,f_name
                push ds
                pop es
                mov ax,6
                int 22h
                xchg edx,eax
                mov al,1
                jc cb_fopen_90

After setting this up, tell gdb to continue, and quickly switch to the kvm window and press Escape to instruct the Ubuntu gfxboot theme to display the full boot menu.

You may have to try a few times to make this happen, because it's not entirely consistent, and chances are you will have to continue through a few irrelevant breakpoint traps.  You may also need to use the F2 menu in gfxboot to select a different language.   Sooner or later you should see:

Breakpoint 1, 0x00008eeb in ?? ()
al             0x6      6
0x110fa:         "en.tr"
0x1d346:        0x0031

The return address is with CS == 0x1100, and we're in real mode, so 'set architecture i8086', and:

(gdb) disas /r 0x11031,+20
Dump of assembler code from 0x11031 to 0x11045:
   0x00011031:   cd 22  int    $0x22
   0x00011033:   66 92  xchg   %ax,%dx
   0x00011035:   b0 01  mov    $0x1,%al
   0x00011037:   72 2c  jb     0x11065
   0x00011039:   3b 0e  cmp    (%esi),%ecx
   0x0001103b:   00 00  add    %al,(%eax)
   0x0001103d:   77 26  ja     0x11065
   0x0001103f:   09 c9  or     %ecx,%ecx
   0x00011041:   74 22  je     0x11065
   0x00011043:   89 0e  mov    %ecx,(%esi)
End of assembler dump.

Note that the return address is the INT, not the instruction following the INT.  This does not always happen, but when it does, other things always seem to go wrong:

(gdb) c
Continuing.

Breakpoint 3, 0x00008de5 in ?? ()
0x1d346:        0x0031

Now we're at the IRET, which will pop three 16-bit words off the stack for EIP (zero-extended), CS, and EFLAGS.  These are supposed to be:

(gdb) x/xh ($ss<<4)+$sp
0x1d346:        0x0031
(gdb) x/xh ($ss<<4)+$sp+2
0x1d348:        0x1100
(gdb) info reg eflags
eflags         0x203206 [ PF IF #12 #13 ID ]
(gdb) x/xh ($ss<<4)+$sp+4
0x1d34a:        0x3200

That all looks right, since comboot_resume propagates the error status to the lower byte of EFLAGS on the stack, setting it to either 0 or 1.  This corresponds to a successful return.

(gdb) stepi
0x00000031 in ?? ()
(gdb) disas /r ($cs<<4)+$eip,+20
Dump of assembler code from 0x11031 to 0x11045:
   0x00011031:   cd 22  int    $0x22
   0x00011033:   66 92  xchg   %ax,%dx
   0x00011035:   b0 01  mov    $0x1,%al
   0x00011037:   72 2c  jb     0x11065
   0x00011039:   3b 0e  cmp    (%esi),%ecx
   0x0001103b:   00 00  add    %al,(%eax)
   0x0001103d:   77 26  ja     0x11065
   0x0001103f:   09 c9  or     %ecx,%ecx
   0x00011041:   74 22  je     0x11065
   0x00011043:   89 0e  mov    %ecx,(%esi)
End of assembler dump.
(gdb) info reg eflags
eflags         0x203202 [ IF #12 #13 ID ]
(gdb) stepi
0x00008eeb in ?? ()

The flags are fine (qemu sets bit 0x2, since the architecture manual documents it as always 1).  But now it jumps straight back into the interrupt, executing it twice!  This is clearly wrong.

(gdb) c
Continuing.

Breakpoint 2, 0x00008de5 in ?? ()
0x1d346:        0x0033

The return address is now after the INT, as it should be.  However, since the registers were wrong for the second call:

(gdb) stepi
0x00000033 in ?? ()
(gdb)
0x00000035 in ?? ()
(gdb) info reg eflags
eflags         0x203203 [ CF IF #12 #13 ID ]

Now CF is set, which causes gfxboot to think that this API call failed, which explains the original bug.  (In earlier debugging sessions, gdb/kvm apparently silently continued past the second interrupt, so all I saw was CF mysteriously being set.)

affects:	gfxboot-theme-ubuntu (Ubuntu Natty) → qemu-kvm (Ubuntu Natty)
Changed in qemu-kvm (Ubuntu Natty):
assignee:	Colin Watson (cjwatson) → nobody

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-05:

#4

My host system is as follows:

processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 15
model name : Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz
stepping : 13
cpu MHz : 1801.000
cache size : 2048 KB
physical id : 0
siblings : 2
core id : 0
cpu cores : 2
apicid : 0
initial apicid : 0
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx lm constant_tsc arch_perfmon pebs bts aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm ida dts tpr_shadow vnmi flexpriority
bogomips : 3590.90
clflush size : 64
cache_alignment : 64
address sizes : 36 bits physical, 48 bits virtual
power management:

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 15
model name : Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz
stepping : 13
cpu MHz : 800.000
cache size : 2048 KB
physical id : 0
siblings : 2
core id : 1
cpu cores : 2
apicid : 1
initial apicid : 1
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx lm constant_tsc arch_perfmon pebs bts aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm ida dts tpr_shadow vnmi flexpriority
bogomips : 3590.97
clflush size : 64
cache_alignment : 64
address sizes : 36 bits physical, 48 bits virtual
power management:

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-05:

#5

Colin Watson wrote:
> (gdb) commands 2
> Type commands for breakpoint(s) 2, one per line.
> End with a line saying just "end".
> >x/xh ($ss<<4)+$sp+40
> >end

This should have been "x/xh ($ss<<4)+$sp". Sorry for the typo.

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-05:

#6

I've reproduced this with qemu-kvm git HEAD (df85c051d780bca0ee2462cfeb8ef6d9552a19b0).

Colin Watson (cjwatson) on 2011-04-06

summary:

- No translations in natty - inside kvm only
+ wrong return address sometimes pushed for INT in kvm (not qemu)

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-07:

#7

Hi Colin,

I'm trying right now to reproduce this myself, but I'm curious, since this only happens with kvm enabled, have you tried to reproduce this with say a maverick kernel?

Serge Hallyn (serge-hallyn) on 2011-04-07

Changed in qemu-kvm (Ubuntu Natty):
assignee:	nobody → Serge Hallyn (serge-hallyn)

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-04-07: Re: [Bug 747090] Re: wrong return address sometimes pushed for INT in kvm (not qemu)

#8

I haven't. I'm not sure I can easily take my laptop down at the moment
to try that, unfortunately ...

Revision history for this message

Dustin Kirkland  (kirkland) wrote on 2011-04-07:

#9

Subscribing Anthony...have you seen anything like this, Anthony?

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-07:

#10

Instrumenting arch/x86/kvm/emulate.c gives me:

[ 119.115925] emulate_int_real: emulating push of eip 148
[ 119.159032] emulate_int_real: emulating push of eip 40a3
[ 119.159063] emulate_int_real: emulating push of eip 40a3
[ 119.159086] emulate_int_real: emulating push of eip 148
[ 119.161142] emulate_int_real: emulating push of eip 35f7
[ 119.199433] emulate_int_real: emulating push of eip 40a3
[ 119.199464] emulate_int_real: emulating push of eip 40a3
[ 119.202484] emulate_int_real: emulating push of eip c416
[ 119.208262] emulate_int_real: emulating push of eip efc4
[ 119.257379] emulate_int_real: emulating push of eip efc4
[ 119.316397] emulate_int_real: emulating push of eip 3
[ 119.370991] emulate_int_real: emulating push of eip 7ee6
[ 119.877462] emulate_int_real: emulating push of eip c046
[ 119.879276] emulate_int_real: emulating push of eip 31
[ 120.035390] emulate_int_real: emulating push of eip c046
[ 120.073810] emulate_int_real: emulating push of eip 31
[ 123.826593] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[ 132.604929] emulate_int_real: emulating push of eip 888e
[ 132.605069] emulate_int_real: emulating push of eip 888e
[ 132.647343] emulate_int_real: emulating push of eip 6a54
[ 132.757042] emulate_int_real: emulating push of eip 6a54
[ 132.976608] emulate_int_real: emulating push of eip 6a54
[ 133.141226] emulate_int_real: emulating push of eip 6a54
[ 133.250917] emulate_int_real: emulating push of eip 6a54
[ 133.415668] emulate_int_real: emulating push of eip 6a54
[ 133.525302] emulate_int_real: emulating push of eip 6a54
[ 133.635169] emulate_int_real: emulating push of eip 6a54
[ 133.964395] emulate_int_real: emulating push of eip 6a54
[ 134.458270] emulate_int_real: emulating push of eip 6a54
[ 134.853848] emulate_int_real: emulating push of eip 6a54
[ 134.875356] emulate_int_real: emulating push of eip 31

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-07:

#11

Building a kernel with emulate_int_real removed, I assume that will start working.

I suspect the right answer will just be to increment eip, of course, i.e. something like insn_fetch(s8, 1, c->eip).

Revision history for this message

Dustin Kirkland  (kirkland) wrote on 2011-04-07:

#12

<aliguori> kirkland, yeah, that's real mode emulation
<aliguori> i'll look closer this afternoon

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-07:

#13

Quoting Dustin Kirkland (<email address hidden>):
> <aliguori> kirkland, yeah, that's real mode emulation
> <aliguori> i'll look closer this afternoon

I was wrong about the path being taken when this happens -
emulate_real_int() is not being called by emulate.c:emulate_int(), but
by x86.c:kvm_inject_realmode_interrupt().

David Planella (dpm) on 2011-04-08

Changed in ubuntu-translations:
status:	New → Triaged
importance:	Undecided → Low

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-08:

#14

0001-Remove-emulate_int_real.patch Edit (8.6 KiB, text/plain)

With this kernel patch applied, the problem appears solved for me.

I did first try my hand at a 'proper' fix, in two different ways, but failed.

The patch probably won't apply 100% cleanly, but only because two of the lines being removed have changed. Ignore that and make the patch apply.

Revision history for this message

Dustin Kirkland  (kirkland) wrote on 2011-04-08:

#15

Serge, are you working this upstream through the kvm development
mailing list, too?

Revision history for this message

Dustin Kirkland  (kirkland) wrote on 2011-04-08:

#16

Oh, and nice work on the patch, by the way :-)

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-08:

#17

Quoting Dustin Kirkland (<email address hidden>):
> Serge, are you working this upstream through the kvm development
> mailing list, too?

I've sent an email to KVM mailing list <email address hidden>
http://www.spinics.net/lists/kvm/msg52279.html
but no responses yet.

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-08:

#18

0001-Remove-emulate_int_real.patch Edit (8.6 KiB, text/plain)

A cleaned up patch which applies to uptodate linux-2.6 HEAD.

Dustin Kirkland  (kirkland) on 2011-04-11

Changed in linux (Ubuntu Natty):
status:	New → Triaged
importance:	Undecided → High
milestone:	none → ubuntu-11.04-beta-2

Jeremy Foshee (jeremyfoshee) on 2011-04-11

tags:

added: kernel-key

Revision history for this message

Dustin Kirkland  (kirkland) wrote on 2011-04-11:

#19

Marking the qemu-kvm userspace task 'invalid', as this looks to me to be exclusively in the kernel.

Marking the linux task triaged/high/B2, to make sure this is on the Kernel team's release radar. JFo: adjust accordingly, if you disagree ;-)

Changed in qemu-kvm (Ubuntu Natty):
status:	Confirmed → Invalid

Revision history for this message

Andy Whitcroft (apw) wrote on 2011-04-12:

#20

@serge -- have we heard anything further from upstream. The thread you started seems quiet. I suspect we need to debug this more before they are going to react.

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-12:

#21

Quoting Andy Whitcroft (<email address hidden>):
> @serge -- have we heard anything further from upstream. The thread you
> started seems quiet. I suspect we need to debug this more before they
> are going to react.

Yeah I'd gotten distracted during the day yesterday. When I looked more
into it last night, I think I found another solution. Namely, every
place where the code replaced by calls to kvm_inject_realmode_interrupt()
incremented the rmode.irq.rip, we need to do the same.

I can try my hand at a patch today (or leave it in your capable hands)

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-12:

#22

0001-kvm-fix-push-of-wrong-eip-when-doing-softint.patch Edit (3.2 KiB, text/plain)

No comment on this patch yet from upstream, but this patch follows upstream guidance in actually fixing the bug as opposed to undoing the bad patch altogether (as my last patch did). The kernel built with this patch works for me.

Ubuntu QA Website (ubuntuqa) on 2011-04-13

tags:

added: iso-testing

Andy Whitcroft (apw) on 2011-04-13

Changed in linux (Ubuntu Natty):
assignee:	nobody → Andy Whitcroft (apw)

Revision history for this message

Andy Whitcroft (apw) wrote on 2011-04-13:

#23

@Serge -- I have pulled down the patch (and applied Jan's changes), and applied the patch to a Natty kernel for testing. If you could just verify the kernels at the URL for me, I can get the patch out for review. Kernels are here:

http://people.canonical.com/~apw/lp747090-natty/

Thanks!

Changed in linux (Ubuntu Natty):
status:	Triaged → Incomplete

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-13:

#24

I've sent apw's updated version of the patch with no changes to the kvm mailing list. Hopefully they forward it to lkml soon.

I'm still testing, but the kernel in comment #23 is working great so far. Thanks much.

Colin Watson (cjwatson) on 2011-04-15

Changed in linux (Ubuntu Natty):
milestone:	ubuntu-11.04-beta-2 → ubuntu-11.04

Dave Walker (davewalker) on 2011-04-15

tags:

added: server-nrs

Dave Walker (davewalker) on 2011-04-15

Changed in qemu-kvm (Ubuntu Natty):
milestone:	ubuntu-11.04-beta-2 → none

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-04-15:

#25

The new kernel is working great for me for kvm. Marking the linux task from 'incomplete' to 'fix committed', as my understanding is that it is in the tree. Please correct if I'm wrong.

Changed in linux (Ubuntu Natty):
status:	Incomplete → Fix Committed

Revision history for this message

Dave Walker (davewalker) wrote on 2011-04-18:

#26

Confirmed with apw that this is fixed in ubuntu git tree, and will be Fixed in first SRU upload. Updating milestone to natty-updates to reflect this.

Changed in linux (Ubuntu Natty):
milestone:	ubuntu-11.04 → natty-updates

Dave Walker (davewalker) on 2011-04-18

tags:

added: server-nro
removed: server-nrs

Revision history for this message

Martin Pitt (pitti) wrote on 2011-05-02: Please test proposed package

#27

Accepted linux into natty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Brad Figg (brad-figg) on 2011-05-10

tags:

added: verification-needed-natty

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-05-10:

#28

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed' to 'verification-done'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-05-10:

#29

I no longer have the original natty-desktop-i386.iso, and the current one appears to have moved some of the breakpoints.

So I instead tested using this bug's dup, 771227. virsh save/restore are working with this proposed kernel. That should verify this bug, I don't know if cjwatson wants to give it another go or not.

Revision history for this message

Serge Hallyn (serge-hallyn) wrote on 2011-05-10:

#30

Also, with this kernel I do get translations when I choose 'Nederlands' as my language from the boot cd.

Revision history for this message

Colin Watson (cjwatson) wrote on 2011-05-17:

#31

Agreed, this is working fine now. I've confirmed that translations are working in the CD boot menu again, and I've also reproduced my gdb testing and am no longer seeing instances of wrong return addresses following INT. Thanks!

tags:

added: verification-done
removed: verification-needed-natty

Steve Conklin (sconklin) on 2011-05-17

tags:

added: verification-done-natty
removed: verification-done

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-07-13:

#32

Download full text (26.1 KiB)

This bug was fixed in the package linux - 2.6.38-10.46

---------------
linux (2.6.38-10.46) natty-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
- LP: #802464

[ Upstream Kernel Changes ]

* Revert "put stricter guards on queue dead checks"
* Revert "fix oops in scsi_run_queue()"

linux (2.6.38-10.45) natty-proposed; urgency=low

[ Upstream Kernel Changes ]

* Revert "af_unix: Only allow recv on connected seqpacket sockets."

linux (2.6.38-10.44) natty-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
- LP: #792013

[ Robert Nelson ]

  * SAUCE: omap3: beagle: detect new xM revision B
    - LP: #770679
  * SAUCE: omap3: beagle: detect new xM revision C
    - LP: #770679
  * SAUCE: omap3: beagle: if rev unknown, assume xM revision C
    - LP: #770679

[ Stefan Bader ]

* Include nls_iso8859-1 for virtual images
- LP: #732046

[ Thomas Schlichter ]

* SAUCE: vesafb: mtrr module parameter is uint, not bool
- LP: #778043

[ Tim Gardner ]

  * Revert "SAUCE: acpi battery -- move first lookup asynchronous"
    - LP: #775809
  * updateconfigs after update to v2.6.38.6

[ Upstream Kernel Changes ]

  * Revert "ALSA: hda - Fix pin-config of Gigabyte mobo"
    - LP: #780546
  * Revert "[SCSI] Retrieve the Caching mode page"
    - LP: #788691
  * Revert "USB: xhci - fix unsafe macro definitions"
  * Revert "USB: xhci - fix math in xhci_get_endpoint_interval()"
  * Revert "USB: xhci - also free streams when resetting devices"
  * ath9k_hw: fix stopping rx DMA during resets
    - LP: #775809
  * netxen: limit skb frags for non tso packet
    - LP: #775809
  * ath: add missing regdomain pair 0x5c mapping
    - LP: #775809
  * block, blk-sysfs: Fix an err return path in blk_register_queue()
    - LP: #775809
  * p54: Initialize extra_len in p54_tx_80211
    - LP: #775809
  * qlcnic: limit skb frags for non tso packet
    - LP: #775809
  * nfsd4: fix struct file leak on delegation
    - LP: #775809
  * nfsd4: Fix filp leak
    - LP: #775809
  * virtio: Decrement avail idx on buffer detach
    - LP: #775809
  * x86, gart: Set DISTLBWALKPRB bit always
    - LP: #775809
  * x86, gart: Make sure GART does not map physmem above 1TB
    - LP: #775809
  * intel-iommu: Fix use after release during device attach
    - LP: #775809
  * intel-iommu: Unlink domain from iommu
    - LP: #775809
  * intel-iommu: Fix get_domain_for_dev() error path
    - LP: #775809
  * drm/radeon/kms: pll tweaks for r7xx
    - LP: #775809
  * drm/nouveau: fix notifier memory corruption bug
    - LP: #775809
  * drm/radeon/kms: fix bad shift in atom iio table parser
    - LP: #775809
  * drm/i915/tv: Remember the detected TV type
    - LP: #775809
  * tty/n_gsm: fix bug in CRC calculation for gsm1 mode
    - LP: #775809
  * serial/imx: read cts state only after acking cts change irq
    - LP: #775809
  * ASoC: Fix output PGA enabling in wm_hubs CODECs
    - LP: #775809
  * ASoC: codecs: JZ4740: Fix OOPS
    - LP: #775809
  * ALSA: hda - Add a fix-up for Acer dmic with ALC271x codec
    - LP: #775809
  * ahci: don't enable port irq before handler is registered
    - LP: #775809
  * libata: Implement ATA_FLAG_NO_...

This bug was fixed in the package linux - 2.6.38-10.46

---------------
linux (2.6.38-10.46) natty-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
    - LP: #802464

[ Upstream Kernel Changes ]

* Revert "put stricter guards on queue dead checks"
  * Revert "fix oops in scsi_run_queue()"

linux (2.6.38-10.45) natty-proposed; urgency=low

[ Upstream Kernel Changes ]

* Revert "af_unix: Only allow recv on connected seqpacket sockets."

linux (2.6.38-10.44) natty-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
    - LP: #792013

[ Robert Nelson ]

* SAUCE: omap3: beagle: detect new xM revision B
    - LP: #770679
  * SAUCE: omap3: beagle: detect new xM revision C
    - LP: #770679
  * SAUCE: omap3: beagle: if rev unknown, assume xM revision C
    - LP: #770679

[ Stefan Bader ]

* Include nls_iso8859-1 for virtual images
    - LP: #732046

[ Thomas Schlichter ]

* SAUCE: vesafb: mtrr module parameter is uint, not bool
    - LP: #778043

[ Tim Gardner ]

* Revert "SAUCE: acpi battery -- move first lookup asynchronous"
    - LP: #775809
  * updateconfigs after update to v2.6.38.6

[ Upstream Kernel Changes ]

* Revert "ALSA: hda - Fix pin-config of Gigabyte mobo"
    - LP: #780546
  * Revert "[SCSI] Retrieve the Caching mode page"
    - LP: #788691
  * Revert "USB: xhci - fix unsafe macro definitions"
  * Revert "USB: xhci - fix math in xhci_get_endpoint_interval()"
  * Revert "USB: xhci - also free streams when resetting devices"
  * ath9k_hw: fix stopping rx DMA during resets
    - LP: #775809
  * netxen: limit skb frags for non tso packet
    - LP: #775809
  * ath: add missing regdomain pair 0x5c mapping
    - LP: #775809
  * block, blk-sysfs: Fix an err return path in blk_register_queue()
    - LP: #775809
  * p54: Initialize extra_len in p54_tx_80211
    - LP: #775809
  * qlcnic: limit skb frags for non tso packet
    - LP: #775809
  * nfsd4: fix struct file leak on delegation
    - LP: #775809
  * nfsd4: Fix filp leak
    - LP: #775809
  * virtio: Decrement avail idx on buffer detach
    - LP: #775809
  * x86, gart: Set DISTLBWALKPRB bit always
    - LP: #775809
  * x86, gart: Make sure GART does not map physmem above 1TB
    - LP: #775809
  * intel-iommu: Fix use after release during device attach
    - LP: #775809
  * intel-iommu: Unlink domain from iommu
    - LP: #775809
  * intel-iommu: Fix get_domain_for_dev() error path
    - LP: #775809
  * drm/radeon/kms: pll tweaks for r7xx
    - LP: #775809
  * drm/nouveau: fix notifier memory corruption bug
    - LP: #775809
  * drm/radeon/kms: fix bad shift in atom iio table parser
    - LP: #775809
  * drm/i915/tv: Remember the detected TV type
    - LP: #775809
  * tty/n_gsm: fix bug in CRC calculation for gsm1 mode
    - LP: #775809
  * serial/imx: read cts state only after acking cts change irq
    - LP: #775809
  * ASoC: Fix output PGA enabling in wm_hubs CODECs
    - LP: #775809
  * ASoC: codecs: JZ4740: Fix OOPS
    - LP: #775809
  * ALSA: hda - Add a fix-up for Acer dmic with ALC271x codec
    - LP: #775809
  * ahci: don't enable port irq before handler is registered
    - LP: #775809
  * libata: Implement ATA_FLAG_NO_DIPM and apply it to mcp65
    - LP: #775809
  * kconfig: Avoid buffer underrun in choice input
    - LP: #775809
  * UBIFS: fix master node recovery
    - LP: #775809
  * ideapad: read brightness setting on brightness key notify
    - LP: #775809
  * ACPI battery: fribble sysfs files from a resume notifier
    - LP: #775809
  * UBIFS: fix false space checking failure
    - LP: #775809
  * kvm-390: Let kernel exit SIE instruction on work
    - LP: #775809
  * pfault: fix token handling
    - LP: #775809
  * ACPI / PM: Avoid infinite recurrence while registering power resources
    - LP: #775809
  * slub: fix panic with DISCONTIGMEM
    - LP: #775809
  * set memory ranges in N_NORMAL_MEMORY when onlined
    - LP: #775809
  * FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci
    - LP: #775809
  * virtio: console: Enable call to hvc_remove() on console port remove
    - LP: #775809
  * oom: use pte pages in OOM score
    - LP: #775809
  * mm: check if PTE is already allocated during page fault
    - LP: #775809
  * mm: thp: fix /dev/zero MAP_PRIVATE and vm_flags cleanups
    - LP: #775809
  * m68k/mm: Set all online nodes in N_NORMAL_MEMORY
    - LP: #775809
  * vfs: avoid large kmalloc()s for the fdtable
    - LP: #775809
  * nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
    - LP: #775809
  * NFSv4.1: Ensure state manager thread dies on last umount
    - LP: #775809
  * um: mdd support for 64 bit atomic operations
    - LP: #775809
  * drm: select FRAMEBUFFER_CONSOLE_PRIMARY if we have FRAMEBUFFER_CONSOLE
    - LP: #775809
  * agp: fix arbitrary kernel memory writes
    - LP: #775809
  * agp: fix OOM and buffer overflow
    - LP: #775809
  * iwlwifi: do not set tx power when channel is changing
    - LP: #775809
  * iwl3945: do not deprecate software scan
    - LP: #775809
  * iwl3945: disable hw scan by default
    - LP: #775809
  * iwlegacy: fix tx_power initialization
    - LP: #775809
  * Input: xen-kbdfront - fix mouse getting stuck after save/restore
    - LP: #775809
  * Linux 2.6.38.5
    - LP: #775809
  * pmcraid: reject negative request size
    - LP: #780546
  * mpt2sas: prevent heap overflows and unchecked reads
    - LP: #780546
  * scsi_dh: fix reference counting in scsi_dh_activate error path
    - LP: #780546
  * put stricter guards on queue dead checks
    - LP: #780546
  * ALSA: HDA: Fix automute for Gateway NV79
    - LP: #761861, #780546
  * ALSA: hda - Fix Realtek's chained fixup checks
    - LP: #780546
  * i2c-parport: Fix adapter list handling
    - LP: #780546
  * workqueue: fix deadlock in worker_maybe_bind_and_lock()
    - LP: #780546
  * iwlwifi: fix skb usage after free
    - LP: #780546
  * iwlagn: fix "Received BA when not expected"
    - LP: #780546
  * atl1c: Fix work event interrupt/task races
    - LP: #780546
  * UBIFS: do not free write-buffers when in R/O mode
    - LP: #780546
  * UBIFS: seek journal heads to the latest bud in replay
    - LP: #780546
  * mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()
    - LP: #780546
  * mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish
    - LP: #780546
  * mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish
    - LP: #780546
  * drm/radeon: fix regression on atom cards with hardcoded EDID record.
    - LP: #780546
  * USB: fix regression in usbip by setting has_tt flag
    - LP: #780546
  * firewire: Fix for broken configrom updates in quick succession
    - LP: #780546
  * usbnet: add support for some Huawei modems with cdc-ether ports
    - LP: #780546
  * imon: add conditional locking in change_protocol
    - LP: #780546
  * flex_array: flex_array_prealloc takes a number of elements, not an end
    - LP: #780546
  * flex_arrays: allow zero length flex arrays
    - LP: #780546
  * ath9k: fix the return value of ath_stoprecv
    - LP: #780546
  * mac80211: fix SMPS debugfs locking
    - LP: #780546
  * af_unix: Only allow recv on connected seqpacket sockets.
    - LP: #780546
  * ARM: 6891/1: prevent heap corruption in OABI semtimedop
    - LP: #780546
  * XZ decompressor: Fix decoding of empty LZMA2 streams
    - LP: #780546
  * Open with O_CREAT flag set fails to open existing files on non writable
    directories
    - LP: #780546
  * can: Add missing socket check in can/bcm release.
    - LP: #780546
  * cx88: Fix HVR4000 IR keymap
    - LP: #780546
  * KVM: SVM: check for progress after IRET interception
    - LP: #780546
  * drm/radeon/kms: add some new pci ids
    - LP: #780546
  * can: add missing socket check in can/raw release
    - LP: #780546
  * fix oops in scsi_run_queue()
    - LP: #780546
  * VM: skip the stack guard page lookup in get_user_pages only for mlock
    - LP: #780546
  * Linux 2.6.38.6
    - LP: #780546
  * ips: use interruptible waits in ips-monitor
    - LP: #765082
  * cifs: change bleft in decode_unicode_ssetup back to signed type
    - LP: #788691
  * cifs: check for bytes_remaining going to zero in CIFS_SessSetup
    - LP: #788691
  * cifs: sanitize length checking in coalesce_t2 (try #3)
    - LP: #788691
  * cifs: refactor mid finding loop in cifs_demultiplex_thread
    - LP: #788691
  * cifs: handle errors from coalesce_t2
    - LP: #788691
  * Validate size of EFI GUID partition entries.
    - LP: #788691
  * drm/radeon/kms: add pci id to acer travelmate quirk for 5730
    - LP: #788691
  * x86, hw_breakpoints: Fix racy access to ptrace breakpoints
    - LP: #788691
  * ptrace: Prepare to fix racy accesses on task breakpoints
    - LP: #788691
  * hw_breakpoints, powerpc: Fix CONFIG_HAVE_HW_BREAKPOINT off-case in
    ptrace_set_debugreg()
    - LP: #788691
  * iwlwifi: add {ack, plpc}_check module parameters
    - LP: #788691
  * drm/radeon/kms: fix gart setup on fusion parts (v2) backport
    - LP: #788691
  * vm: fix vm_pgoff wrap in upward expansion
    - LP: #788691
  * Don't lock guardpage if the stack is growing up
    - LP: #788691
  * drm/i915/dp: Be paranoid in case we disable a DP before it is attached
    - LP: #788691
  * drm/i915/lvds: Only act on lid notify when the device is on
    - LP: #788691
  * drm/i915: Release object along create user fb error path
    - LP: #788691
  * dccp: handle invalid feature options length
    - LP: #788691
  * CIFS: Fix memory over bound bug in cifs_parse_mount_options
    - LP: #788691
  * drivers/rtc/rtc-s3c.c: fixup wake support for rtc
    - LP: #788691
  * mm: use alloc_bootmem_node_nopanic() on really needed path
    - LP: #788691
  * tmpfs: fix race between umount and swapoff
    - LP: #788691
  * ARM: zImage: make sure the stack is 64-bit aligned
    - LP: #788691
  * PM: Fix warning in pm_restrict_gfp_mask() during SNAPSHOT_S2RAM ioctl
    - LP: #788691
  * PM / Hibernate: Make snapshot_release() restore GFP mask
    - LP: #788691
  * PM / Hibernate: Fix ioctl SNAPSHOT_S2RAM
    - LP: #788691
  * net: ip_expire() must revalidate route
    - LP: #788691
  * can: fix SJA1000 dlc for RTR packets
    - LP: #788691
  * ipheth: Properly distinguish length and alignment in URBs and skbs
    - LP: #788691
  * vmxnet3: Consistently disable irqs when taking adapter->cmd_lock
    - LP: #788691
  * ehea: fix wrongly reported speed and port
    - LP: #788691
  * NET: slip, fix ldisc->open retval
    - LP: #788691
  * PCH_GbE : Fixed the issue of collision detection
    - LP: #788691
  * PCH_GbE : Fixed the issue of checksum judgment
    - LP: #788691
  * pch_gbe: support ML7223 IOH
    - LP: #788691
  * net: dev_close() should check IFF_UP
    - LP: #788691
  * slcan: fix ldisc->open retval
    - LP: #788691
  * ASoC: UDA134x: Remove POWER_OFF_ON_STANDBY define.
    - LP: #788691
  * ASoC: SSM2602: Fix 'Mic Boost2' control
    - LP: #788691
  * ne-h8300: Fix regression caused during net_device_ops conversion
    - LP: #788691
  * hydra: Fix regression caused during net_device_ops conversion
    - LP: #788691
  * ehea: Fix memory hotplug oops
    - LP: #788691
  * libertas: fix cmdpendingq locking
    - LP: #788691
  * zorro8390: Fix regression caused during net_device_ops conversion
    - LP: #788691
  * tmpfs: fix race between umount and writepage
    - LP: #788691
  * tmpfs: fix race between swapoff and writepage
    - LP: #788691
  * tmpfs: fix off-by-one in max_blocks checks
    - LP: #788691
  * tmpfs: fix spurious ENOSPC when racing with unswap
    - LP: #788691
  * libata: fix oops when LPM is used with PMP
    - LP: #788691
  * drm/radeon/kms: fix extended lvds info parsing
    - LP: #788691
  * cifs: add fallback in is_path_accessible for old servers
    - LP: #788691
  * rapidio: fix default routing initialization
    - LP: #788691
  * x86, AMD: Fix ARAT feature setting again
    - LP: #788691
  * clocksource: Install completely before selecting
    - LP: #788691
  * tick: Clear broadcast active bit when switching to oneshot
    - LP: #788691
  * x86, apic: Fix spurious error interrupts triggering on all non-boot APs
    - LP: #788691
  * Fix cx88 remote control input
    - LP: #788691
  * v4l: Release module if subdev registration fails
    - LP: #788691
  * x86: Fix UV BAU for non-consecutive nasids
    - LP: #788691
  * x86, mce, AMD: Fix leaving freed data in a list
    - LP: #788691
  * megaraid_sas: Sanity check user supplied length before passing it to
    dma_alloc_coherent()
    - LP: #788691
  * cdrom: always check_disk_change() on open
    - LP: #788691
  * vmxnet3: Fix inconsistent LRO state after initialization
    - LP: #788691
  * cifs: clean up various nits in unicode routines (try #2)
    - LP: #788691
  * cifs: fix cifsConvertToUCS() for the mapchars case
    - LP: #788691
  * iwlegacy: fix IBSS mode crashes
    - LP: #788691
  * tmpfs: fix highmem swapoff crash regression
    - LP: #788691
  * Linux 2.6.38.7
    - LP: #788691
  * rtlwifi: rtl8192ce: Fix LED initialization
    - LP: #785975

linux (2.6.38-9.43) natty-proposed; urgency=low

[ Brad Figg ]

* Release Tracking Bug
    - LP: #772096

[ Herton Ronaldo Krzesinski ]

* SAUCE: Revert "x86, hibernate: Initialize mmu_cr4_features during boot"
    - LP: #764758

[ Leann Ogasawara ]

* [Config] updateconfigs for 2.6.38.4

[ Paolo Pisati ]

* [Config] s/USB_MUSB_TUSB6010/USB_MUSB_OMAP2PLUS/ on omap3 to get musb
    - LP: #759913

[ Serge E. Hallyn ]

* SAUCE: kvm: fix push of wrong eip when doing softint
    - LP: #747090

[ Tim Gardner ]

* [Config] Add cachefiles.ko to virtual flavour
    - LP: #770430

[ Upstream Kernel Changes ]

* Revert "net/sunrpc: Use static const char arrays"
    - LP: #761134
  * Revert "x86: Cleanup highmap after brk is concluded"
    - LP: #761134
  * ALSA: hda - Fix SPDIF out regression on ALC889
    - LP: #761134
  * ALSA: Fix yet another race in disconnection
    - LP: #761134
  * ALSA: vmalloc buffers should use normal mmap
    - LP: #761134
  * perf: Better fit max unprivileged mlock pages for tools needs
    - LP: #761134
  * myri10ge: fix rmmod crash
    - LP: #761134
  * cciss: fix lost command issue
    - LP: #761134
  * ath9k: Fix kernel panic in AR2427
    - LP: #761134
  * sound/oss/opl3: validate voice and channel indexes
    - LP: #761134
  * mac80211: initialize sta->last_rx in sta_info_alloc
    - LP: #761134
  * ses: show devices for enclosures with no page 7
    - LP: #761134
  * ses: Avoid kernel panic when lun 0 is not mapped
    - LP: #761134
  * PCI/ACPI: Report ASPM support to BIOS if not disabled from command line
    - LP: #761134
  * eCryptfs: Unlock page in write_begin error path
    - LP: #761134
  * eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix
    - LP: #761134
  * crypto: aesni-intel - fixed problem with packets that are not multiple
    of 64bytes
    - LP: #761134
  * staging: usbip: bugfixes related to kthread conversion
    - LP: #761134
  * staging: usbip: bugfix add number of packets for isochronous frames
    - LP: #761134
  * staging: usbip: bugfix for isochronous packets and optimization
    - LP: #761134
  * staging: hv: use sync_bitops when interacting with the hypervisor
    - LP: #761134
  * staging: hv: Fix GARP not sent after Quick Migration
    - LP: #761134
  * xfs: register the inode cache shrinker before quotachecks
    - LP: #761134
  * amd64_edac: Fix potential memleak
    - LP: #761134
  * watchdog: s3c2410_wdt.c: Convert release_resource to
    release_region/release_mem_region
    - LP: #761134
  * watchdog: Convert release_resource to release_region/release_mem_region
    - LP: #761134
  * irda: validate peer name and attribute lengths
    - LP: #761134
  * irda: prevent heap corruption on invalid nickname
    - LP: #761134
  * powerpc: Fix accounting of softirq time when idle
    - LP: #761134
  * nilfs2: fix data loss in mmap page write for hole blocks
    - LP: #761134
  * ASoC: Explicitly say registerless widgets have no register
    - LP: #761134
  * ASoC: imx: set watermarks for mx2-dma
    - LP: #761134
  * ASoC: imx: fix burstsize for DMA
    - LP: #761134
  * ASoC: Fix CODEC device name for Corgi
    - LP: #761134
  * ALSA: ens1371: fix Creative Ectiva support
    - LP: #761134
  * ALSA: hda - HDMI: Fix MCP7x audio infoframe checksums
    - LP: #761134
  * ALSA: HDA: Fix single internal mic on ALC275 (Sony Vaio VPCSB1C5E)
    - LP: #752792, #761134
  * net: fix ethtool->set_flags not intended -EINVAL return value
    - LP: #761134
  * drm/radeon/kms: add some new ontario pci ids
    - LP: #761134
  * drm/radeon/kms: add some sanity checks to obj info record parsingi (v2)
    - LP: #761134
  * inotify: fix double free/corruption of stuct user
    - LP: #761134
  * HID: hid-magicmouse: Increase evdev buffer size
    - LP: #761134
  * perf: Fix task_struct reference leak
    - LP: #761134
  * perf: Rebase max unprivileged mlock threshold on top of page size
    - LP: #761134
  * ROSE: prevent heap corruption with bad facilities
    - LP: #761134
  * Btrfs: Fix uninitialized root flags for subvolumes
    - LP: #761134
  * x86, mtrr, pat: Fix one cpu getting out of sync during resume
    - LP: #761134
  * Input: synaptics - fix crash in synaptics_module_init()
    - LP: #761134
  * ath9k: fix a chip wakeup related crash in ath9k_start
    - LP: #761134
  * mac80211: fix a crash in minstrel_ht in HT mode with no supported MCS
    rates
    - LP: #761134
  * staging: IIO: IMU: ADIS16400: Fix up SPI messages cs_change behavior
    - LP: #761134
  * staging: IIO: IMU: ADIS16400: Add delay after self test
    - LP: #761134
  * staging: IIO: IMU: ADIS16400: Fix addresses of GYRO and ACCEL
    calibration offset
    - LP: #761134
  * staging: IIO: IMU: ADIS16400: Make sure only enabled scan_elements are
    pushed into the ring
    - LP: #761134
  * UBIFS: do not read flash unnecessarily
    - LP: #761134
  * UBIFS: fix oops on error path in read_pnode
    - LP: #761134
  * UBIFS: fix debugging failure in dbg_check_space_info
    - LP: #761134
  * quota: Don't write quota info in dquot_commit()
    - LP: #761134
  * mm: avoid wrapping vm_pgoff in mremap()
    - LP: #761134
  * iwlwifi: accept EEPROM version 0x423 for iwl6000
    - LP: #761134
  * p54usb: IDs for two new devices
    - LP: #761134
  * rt2x00: Fix radio off hang issue for PCIE interface
    - LP: #662288, #761134
  * rt2x00: fix cancelling uninitialized work
    - LP: #761134
  * wl12xx: fix potential buffer overflow in testmode nvs push
    - LP: #761134
  * media/radio/wl1273: fix build errors
    - LP: #761134
  * b43: allocate receive buffers big enough for max frame len + offset
    - LP: #761134
  * Bluetooth: sco: fix information leak to userspace
    - LP: #761134
  * bridge: netfilter: fix information leak
    - LP: #761134
  * Bluetooth: bnep: fix buffer overflow
    - LP: #761134
  * Bluetooth: add support for Apple MacBook Pro 8,2
    - LP: #761134
  * Treat writes as new when holes span across page boundaries
    - LP: #761134
  * char/tpm: Fix unitialized usage of data buffer
    - LP: #761134
  * netfilter: ip_tables: fix infoleak to userspace
    - LP: #761134
  * netfilter: xtables: fix reentrancy
    - LP: #761134
  * netfilter: arp_tables: fix infoleak to userspace
    - LP: #761134
  * netfilter: ipt_CLUSTERIP: fix buffer overflow
    - LP: #761134
  * ipv6: netfilter: ip6_tables: fix infoleak to userspace
    - LP: #761134
  * scsi_transport_iscsi: make priv_sess file writeable only by root
    - LP: #761134
  * mfd: ab8500: world-writable debugfs register-* files
    - LP: #761134
  * mfd: ab3500: world-writable debugfs register-* files
    - LP: #761134
  * mfd: ab3100: world-writable debugfs *_priv files
    - LP: #761134
  * drivers/rtc/rtc-ds1511.c: world-writable sysfs nvram file
    - LP: #761134
  * drivers/misc/ep93xx_pwm.c: world-writable sysfs files
    - LP: #761134
  * drivers/leds/leds-lp5523.c: world-writable engine* sysfs files
    - LP: #761134
  * drivers/leds/leds-lp5521.c: world-writable sysfs engine* files
    - LP: #761134
  * econet: 4 byte infoleak to the network
    - LP: #761134
  * netfilter: h323: bug in parsing of ASN1 SEQOF field
    - LP: #761134
  * sound/oss: remove offset from load_patch callbacks
    - LP: #761134
  * drivers/media/video/tlg2300/pd-video.c: Remove second mutex_unlock in
    pd_vidioc_s_fmt
    - LP: #761134
  * acer-wmi: does not set persistence state by rfkill_init_sw_state
    - LP: #761134
  * Squashfs: Use vmalloc rather than kmalloc for zlib workspace
    - LP: #761134
  * Squashfs: handle corruption of directory structure
    - LP: #761134
  * atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
    - LP: #761134
  * atm/solos-pci: Don't flap VCs when carrier state changes
    - LP: #761134
  * ext4: fix a double free in ext4_register_li_request
    - LP: #761134
  * ext4: fix credits computing for indirect mapped files
    - LP: #761134
  * nfsd: fix auth_domain reference leak on nlm operations
    - LP: #761134
  * nfsd4: fix oops on lock failure
    - LP: #761134
  * Linux 2.6.38.3
    - LP: #761134
  * vm: fix vm_pgoff wrap in stack expansion
    - LP: #769042
  * drm/radeon/kms: pll tweaks for rv6xx
    - LP: #769042
  * drm/radeon/kms: fix suspend on rv530 asics
    - LP: #769042
  * cifs: always do is_path_accessible check in cifs_mount
    - LP: #769042
  * cifs: check for private_data before trying to put it
    - LP: #769042
  * cifs: set ra_pages in backing_dev_info
    - LP: #769042
  * cifs: wrap received signature check in srv_mutex
    - LP: #769042
  * video: sn9c102: world-wirtable sysfs files
    - LP: #769042
  * UBIFS: restrict world-writable debugfs files
    - LP: #769042
  * ALSA: hda - Fix pin-config of Gigabyte mobo
    - LP: #769042
  * NET: cdc-phonet, handle empty phonet header
    - LP: #769042
  * x86: Fix a bogus unwind annotation in lib/semaphore_32.S
    - LP: #769042
  * tioca: Fix assignment from incompatible pointer warnings
    - LP: #769042
  * mca.c: Fix cast from integer to pointer warning
    - LP: #769042
  * vm: fix mlock() on stack guard page
    - LP: #769042
  * UBIFS: fix assertion warnings
    - LP: #769042
  * perf: Fix task context scheduling
    - LP: #769042
  * bridge: Fix possibly wrong MLD queries' ethernet source address
    - LP: #769042
  * fib: add rtnl locking in ip_fib_net_exit
    - LP: #769042
  * gianfar: Fall back to software tcp/udp checksum on older controllers
    - LP: #769042
  * l2tp: fix possible oops on l2tp_eth module unload
    - LP: #769042
  * net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
    - LP: #769042
  * net_sched: fix ip_tos2prio
    - LP: #769042
  * pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev
    - LP: #769042
  * sctp: Pass __GFP_NOWARN to hash table allocation attempts.
    - LP: #769042
  * tcp: avoid cwnd moderation in undo
    - LP: #769042
  * xfrm: Refcount destination entry on xfrm_lookup
    - LP: #769042
  * vlan: should take into account needed_headroom
    - LP: #769042
  * bridge: Reset IPCB when entering IP stack on NF_FORWARD
    - LP: #769042
  * sparc: Fix .size directive for do_int_load
    - LP: #769042
  * sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault().
    - LP: #769042
  * sparc32: Pass task_struct to schedule_tail() in ret_from_fork
    - LP: #769042
  * sparc64: Fix build errors with gcc-4.6.0
    - LP: #769042
  * futex: Set FLAGS_HAS_TIMEOUT during futex_wait restart setup
    - LP: #769042
  * kstrto*: converting strings to integers done (hopefully) right
    - LP: #769042
  * mm/thp: use conventional format for boolean attributes
    - LP: #769042
  * ramfs: fix memleak on no-mmu arch
    - LP: #769042
  * oom-kill: remove boost_dying_task_prio()
    - LP: #769042
  * MAINTAINERS: update STABLE BRANCH info
    - LP: #769042
  * UBIFS: fix oops when R/O file-system is fsync'ed
    - LP: #769042
  * x86, AMD: Set ARAT feature on AMD processors
    - LP: #769042
  * x86, amd: Disable GartTlbWlkErr when BIOS forgets it
    - LP: #769042
  * vfs: Fix absolute RCU path walk failures due to uninitialized seq
    number
    - LP: #769042
  * ARM: 6864/1: hw_breakpoint: clear DBGVCR out of reset
    - LP: #769042
  * i2c-algo-bit: Call pre/post_xfer for bit_test
    - LP: #769042
  * RTC: add missing "return 0" in new alarm func for rtc-bfin.c
    - LP: #769042
  * sched: Fix erroneous all_pinned logic
    - LP: #769042
  * vmscan: all_unreclaimable() use zone->all_unreclaimable as a name
    - LP: #769042
  * brk: COMPAT_BRK: fix detection of randomized brk
    - LP: #769042
  * usb: musb: temporarily make it bool
    - LP: #769042
  * USB: ftdi_sio: Added IDs for CTI USB Serial Devices
    - LP: #769042
  * USB: ftdi_sio: add PID for OCT DK201 docking station
    - LP: #769042
  * USB: ftdi_sio: add ids for Hameg HO720 and HO730
    - LP: #769042
  * USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem.
    - LP: #769042
  * next_pidmap: fix overflow condition
    - LP: #769042
  * proc: do proper range check on readdir offset
    - LP: #769042
  * powerpc: Fix oops if scan_dispatch_log is called too early
    - LP: #769042
  * powerpc/perf_event: Skip updating kernel counters if register value
    shrinks
    - LP: #769042
  * usb: Fix qcserial memory leak on rmmod
    - LP: #769042
  * usb: qcserial avoid pointing to freed memory
    - LP: #769042
  * usb: qcserial add missing errorpath kfrees
    - LP: #769042
  * USB: EHCI: unlink unused QHs when the controller is stopped
    - LP: #769042
  * USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices
    - LP: #769042
  * USB: xhci - fix unsafe macro definitions
    - LP: #769042
  * USB: xhci - fix math in xhci_get_endpoint_interval()
    - LP: #769042
  * USB: xhci - also free streams when resetting devices
    - LP: #769042
  * USB: Fix unplug of device with active streams
    - LP: #769042
  * radeon: Fix KMS CP writeback on big endian machines.
    - LP: #769042
  * Bluetooth: Fix HCI_RESET command synchronization
    - LP: #700292, #769042
  * perf tool: Fix gcc 4.6.0 issues
    - LP: #769042
  * bridge: reset IPCB in br_parse_ip_options
    - LP: #769042
  * ip: ip_options_compile() resilient to NULL skb route
    - LP: #769042
  * Linux 2.6.38.4
    - LP: #769042
  * (pre stable) ath9k_hw: partially revert "fix dma descriptor rx error
    bit parsing"
    - LP: #735171
  * fs/partitions/ldm.c: fix oops caused by corrupted partition table,
    CVE-2011-1017
    - LP: #771382
    - CVE-2011-1017
  * (pre-stable) drm/i915: Sanitize the output registers after resume
    - LP: #745304
 -- Steve Conklin <sconklin@canonical.com>   Tue, 28 Jun 2011 12:36:29 +0100

Changed in linux (Ubuntu Natty):
status:	Fix Committed → Fix Released

Gabor Kelemen (kelemeng) on 2011-08-19

Changed in ubuntu-translations:
status:	Triaged → Fix Released

Revision history for this message

Leann Ogasawara (leannogasawara) wrote on 2011-08-23:

#33

Marking actively developed linux task from Fix Committed to Fix Released as this patch has been applied and uploaded for Oneiric:

ubuntu-oneiric$ git describe --contains 71f9833bb1cba9939245f3e57388d87d69f8f399
v3.0-rc1~350^2~68

Changed in linux (Ubuntu):
milestone:	natty-updates → none
status:	Fix Committed → Fix Released

Ubuntu
qemu-kvm package

wrong return address sometimes pushed for INT in kvm (not qemu)

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Remote bug watches

	Status	Importance	Assigned to	Milestone
Ubuntu Translations	Fix Released	Low	Unassigned
linux (Ubuntu)	Fix Released	High	Andy Whitcroft
Natty	Fix Released	High	Andy Whitcroft	Ubuntu natty-updates
qemu-kvm (Ubuntu)	Invalid	High	Serge Hallyn
Natty	Invalid	High	Serge Hallyn

Ubuntuqemu-kvm package

wrong return address sometimes pushed for INT in kvm (not qemu)

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Remote bug watches

Ubuntu
qemu-kvm package