This bug was fixed in the package linux - 3.5.0-43.66

---------------
linux (3.5.0-43.66) quantal; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1242895

  [ Timo Aaltonen ]

  * SAUCE: ubuntu/i915: silence unclaimed register poking debug messages
    - LP: #1138787

  [ Upstream Kernel Changes ]

  * Revert "xfs: fix _xfs_buf_find oops on blocks beyond the filesystem
    end"
    - LP: #1236041
    - CVE-2013-1819 fix backport:
  * Revert "sctp: fix call to SCTP_CMD_PROCESS_SACK in
    sctp_cmd_interpreter()"
    - LP: #1241093
  * get rid of full-hash scan on detaching vfsmounts
    - LP: #1226726
  * Smack: Fix the bug smackcipso can't set CIPSO correctly
    - LP: #1236743
  * SAUCE: (no-up) Only let characters through when there are active
    readers.
    - LP: #1208740
  * usb: xhci: define port register names and use them instead of magic
    numbers
    - LP: #1229576
  * usb: xhci: add USB2 Link power management BESL support
    - LP: #1229576
  * iwl4965: fix rfkill set state regression
    - LP: #1241093
  * ath9k_htc: Restore skb headroom when returning skb to mac80211
    - LP: #1241093
  * ALSA: opti9xx: Fix conflicting driver object name
    - LP: #1241093
  * SUNRPC: Fix memory corruption issue on 32-bit highmem systems
    - LP: #1241093
  * drm/i915: ivb: fix edp voltage swing reg val
    - LP: #1241093
  * drm/vmwgfx: Split GMR2_REMAP commands if they are to large
    - LP: #1241093
  * ALSA: ak4xx-adda: info leak in ak4xxx_capture_source_info()
    - LP: #1241093
  * Bluetooth: Add support for Foxconn/Hon Hai [0489:e04d]
    - LP: #1241093
  * [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a
    signal
    - LP: #1241093
  * xen-gnt: prevent adding duplicate gnt callbacks
    - LP: #1241093
  * usb: config->desc.bLength may not exceed amount of data returned by the
    device
    - LP: #1241093
  * USB: cdc-wdm: fix race between interrupt handler and tasklet
    - LP: #1241093
  * xhci-plat: Don't enable legacy PCI interrupts.
    - LP: #1241093
  * ASoC: wm8960: Fix PLL register writes
    - LP: #1241093
  * rculist: list_first_or_null_rcu() should use list_entry_rcu()
    - LP: #1241093
  * USB: mos7720: use GFP_ATOMIC under spinlock
    - LP: #1241093
  * USB: mos7720: fix big-endian control requests
    - LP: #1241093
  * staging: comedi: dt282x: dt282x_ai_insn_read() always fails
    - LP: #1241093
  * usb: ehci-mxc: check for pdata before dereferencing
    - LP: #1241093
  * usb: xhci: Disable runtime PM suspend for quirky controllers
    - LP: #1241093
  * USB: OHCI: Allow runtime PM without system sleep
    - LP: #1241093
  * ACPI / EC: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan
    - LP: #1241093
  * ACPI / EC: Add ASUSTEK L4R to quirk list in order to validate ECDT
    - LP: #1241093
  * USB: fix build error when CONFIG_PM_SLEEP isn't enabled
    - LP: #1241093
  * ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA
    - LP: #1241093
  * regmap: silence GCC warning
    - LP: #1241093
  * target: Fix trailing ASCII space usage in INQUIRY vendor+model
    - LP: #1241093
  * iwlwifi: dvm: don't send BT_CONFIG on devices w/o Bluetooth
    - LP: #1241093
  * Bluetooth: Add support for Mediatek Bluetooth device [0e8d:763f]
    - LP: #1241093
  * Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330]
    - LP: #1241093
  * Bluetooth: ath3k: Add support for ID 0x13d3/0x3402
    - LP: #1241093
  * Bluetooth: Add support for Atheros [0cf3:e003]
    - LP: #1241093
  * xen/events: mask events when changing their VCPU binding
    - LP: #1241093
  * tipc: fix lockdep warning during bearer initialization
    - LP: #1241093
  * htb: fix sign extension bug
    - LP: #1241093
  * net: check net.core.somaxconn sysctl values
    - LP: #1241093
  * neighbour: populate neigh_parms on alloc before calling ndo_neigh_setup
    - LP: #1241093
  * bonding: modify only neigh_parms owned by us
    - LP: #1241093
  * fib_trie: remove potential out of bound access
    - LP: #1241093
  * tcp: cubic: fix overflow error in bictcp_update()
    - LP: #1241093
  * tcp: cubic: fix bug in bictcp_acked()
    - LP: #1241093
  * macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS
    - LP: #1241093
  * ipv6: don't stop backtracking in fib6_lookup_1 if subtree does not
    match
    - LP: #1241093
  * 8139cp: Fix skb leak in rx_status_loop failure path.
    - LP: #1241093
  * tun: signedness bug in tun_get_user()
    - LP: #1241093
  * ipv6: remove max_addresses check from ipv6_create_tempaddr
    - LP: #1241093
  * ipv6: drop packets with multiple fragmentation headers
    - LP: #1241093
  * net: bridge: convert MLDv2 Query MRC into msecs_to_jiffies for
    max_delay
    - LP: #1241093
  * ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO
    - LP: #1241093
  * ipv6: Don't depend on per socket memory for neighbour discovery
    messages
    - LP: #1241093
  * net: ipv6: tcp: fix potential use after free in tcp_v6_do_rcv
    - LP: #1241093
  * ath9k: always clear ps filter bit on new assoc
    - LP: #1241093
  * libceph: unregister request in __map_request failed and nofail == false
    - LP: #1241093
  * powerpc: Handle unaligned ldbrx/stdbrx
    - LP: #1241093
  * ath9k: fix rx descriptor related race condition
    - LP: #1241093
  * ath9k: avoid accessing MRC registers on single-chain devices
    - LP: #1241093
  * brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()
    - LP: #1241093
  * mmc: tmio_mmc_dma: fix PIO fallback on SDHI
    - LP: #1241093
  * HID: validate HID report id size
    - LP: #1241093
    - CVE-2013-2888
  * of: Fix missing memory initialization on FDT unflattening
    - LP: #1241093
  * drm/edid: add quirk for Medion MD30217PG
    - LP: #1241093
  * drm/radeon: fix endian bugs in hw i2c atom routines
    - LP: #1241093
  * drm/radeon: update line buffer allocation for dce4.1/5
    - LP: #1241093
  * drm/radeon: update line buffer allocation for dce6
    - LP: #1241093
  * drm/radeon: fix LCD record parsing
    - LP: #1241093
  * drm/radeon: fix resume on some rs4xx boards (v2)
    - LP: #1241093
  * drm/radeon: fix handling of variable sized arrays for router objects
    - LP: #1241093
  * radeon kms: fix uninitialised hotplug work usage in r100_irq_process()
    - LP: #1241093
  * drm/radeon: fix init ordering for r600+
    - LP: #1241093
  * HID: input: return ENODATA if reading battery attrs fails
    - LP: #1241093
  * HID: battery: don't do DMA from stack
    - LP: #1241093
  * fuse: postpone end_page_writeback() in fuse_writepage_locked()
    - LP: #1241093
  * fuse: invalidate inode attributes on xattr modification
    - LP: #1241093
  * s5p-g2d: Fix registration failure
    - LP: #1241093
  * DocBook: upgrade media_api DocBook version to 4.2
    - LP: #1241093
  * v4l2: added missing mutex.h include to v4l2-ctrls.h
    - LP: #1241093
  * hdpvr: fix iteration over uninitialized lists in hdpvr_probe()
    - LP: #1241093
  * exynos4-is: Fix fimc-lite bayer formats
    - LP: #1241093
  * exynos4-is: Fix entity unregistration on error path
    - LP: #1241093
  * libceph: use pg_num_mask instead of pgp_num_mask for pg.seed calc
    - LP: #1241093
  * HID: pantherlord: validate output report details
    - LP: #1241093
    - CVE-2013-2892
  * HID: ntrig: validate feature report details
    - LP: #1241093
    - CVE-2013-2896
  * HID: picolcd_core: validate output report details
    - LP: #1241093
    - CVE-2013-2899
  * HID: check for NULL field when setting values
    - LP: #1241093
  * drm/i915: try not to lose backlight CBLV precision
    - LP: #1241093
  * powerpc: Default arch idle could cede processor on pseries
    - LP: #1241093
  * ocfs2: fix the end cluster offset of FIEMAP
    - LP: #1241093
  * mm/huge_memory.c: fix potential NULL pointer dereference
    - LP: #1241093
  * mm: fix aio performance regression for database caused by THP
    - LP: #1241093
  * memcg: fix multiple large threshold notifications
    - LP: #1241093
  * intel-iommu: Fix leaks in pagetable freeing
    - LP: #1241093
  * MIPS: ath79: Fix ar933x watchdog clock
    - LP: #1241093
  * ARM: PCI: versatile: Fix map_irq function to match hardware
    - LP: #1241093
  * ARM: PCI: versatile: Fix SMAP register offsets
    - LP: #1241093
  * crypto: api - Fix race condition in larval lookup
    - LP: #1241093
  * cifs: ensure that srv_mutex is held when dealing with ssocket pointer
    - LP: #1241093
  * ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist
    - LP: #1241093
  * ASoC: mc13783: add spi errata fix
    - LP: #1241093
  * [SCSI] sd: Fix potential out-of-bounds access
    - LP: #1241093
  * Linux 3.5.7.22
    - LP: #1241093
  * drm/radeon/atom: workaround vbios bug in transmitter table on rs880
    (v2)
    - LP: #1241093
  * drm/ast: fix the ast open key function
    - LP: #1241093
  * sched/fair: Fix small race where child->se.parent,cfs_rq might point to
    invalid ones
    - LP: #1241093
  * HID: provide a helper for validating hid reports
    - LP: #1241093
  * HID: zeroplus: validate output report details
    - LP: #1241093
    - CVE-2013-2889
  * HID: LG: validate HID output report details
    - LP: #1241093
    - CVE-2013-2893
  * HID: add usage_index in struct hid_usage.
    - LP: #1241093
  * HID: validate feature and input report details
    - LP: #1241093
    - CVE-2013-2897
  * HID: logitech-dj: validate output report details
    - LP: #1241093
    - CVE-2013-2895
  * HID: multitouch: validate indexes details
    - LP: #1241093
    - CVE-2013-2897
  * drm/radeon: fix panel scaling with eDP and LVDS bridges
    - LP: #1241093
  * net: usb: cdc_ether: Use wwan interface for Telit modules
    - LP: #1241093
  * usb: gadget: fix a bug and a WARN_ON in dummy-hcd
    - LP: #1241093
  * drm/ttm: fix the tt_populated check in ttm_tt_destroy()
    - LP: #1241093
  * sfc: Fix efx_rx_buf_offset() for recycled pages
    - LP: #1241093
  * perf: Clarify perf_cpu_context::active_pmu usage by renaming it to
    ::unique_pmu
    - LP: #1241093
  * perf: Fix perf_cgroup_switch for sw-events
    - LP: #1241093
  * cfq: explicitly use 64bit divide operation for 64bit arguments
    - LP: #1241093
  * perf tools: Handle JITed code in shared memory
    - LP: #1241093
  * HID: Fix Speedlink VAD Cezanne support for some devices
    - LP: #1241093
  * HID: usbhid: quirk for N-Trig DuoSense Touch Screen
    - LP: #1241093
  * workqueue: cond_resched() after processing each work item
    - LP: #1241093
  * cgroup: fail if monitored file and event_control are in different
    cgroup
    - LP: #1241093
  * tg3: Don't turn off led on 5719 serdes port 0
    - LP: #1241093
  * tg3: Expand led off fix to include 5720
    - LP: #1241093
  * mm, memcg: give exiting processes access to memory reserves
    - LP: #1241093
  * video: mxsfb: Add missing break
    - LP: #1241093
  * xhci: Fix race between ep halt and URB cancellation
    - LP: #1241093
  * serial: pch_uart: fix tty-kref leak in rx-error path
    - LP: #1241093
  * serial: pch_uart: fix tty-kref leak in dma-rx path
    - LP: #1241093
  * x86, efi: Don't map Boot Services on i386
    - LP: #1241093
  * ALSA: compress: Fix compress device unregister.
    - LP: #1241093
  * dm snapshot: workaround for a false positive lockdep warning
    - LP: #1241093
  * dm-snapshot: fix performance degradation due to small hash size
    - LP: #1241093
  * x86/reboot: Add quirk to make Dell C6100 use reboot=pci automatically
    - LP: #1241093
  * drm/radeon: disable tests/benchmarks if accel is disabled
    - LP: #1241093
  * xhci: Fix oops happening after address device timeout
    - LP: #1241093
  * xhci: Ensure a command structure points to the correct trb on the
    command ring
    - LP: #1241093
  * drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
    - LP: #1241093
  * staging: vt6656: [BUG] main_usb.c oops on device_close move flag
    earlier.
    - LP: #1241093
  * USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
    - LP: #1241093
  * usb/core/devio.c: Don't reject control message to endpoint with wrong
    direction bit
    - LP: #1241093
  * hwmon: (applesmc) Check key count before proceeding
    - LP: #1241093
  * USB: Fix breakage in ffs_fs_mount()
    - LP: #1241093
  * usb: dwc3: pci: add support for BayTrail
    - LP: #1241093
  * caif: Add missing braces to multiline if in cfctrl_linkup_request
    - LP: #1241093
  * net: sctp: fix smatch warning in sctp_send_asconf_del_ip
    - LP: #1241093
  * net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
    - LP: #1241093
  * resubmit bridge: fix message_age_timer calculation
    - LP: #1241093
  * bridge: Clamp forward_delay when enabling STP
    - LP: #1241093
  * ip: use ip_hdr() in __ip_make_skb() to retrieve IP header
    - LP: #1241093
  * ip: generate unique IP identificator if local fragmentation is allowed
    - LP: #1241093
  * netpoll: fix NULL pointer dereference in netpoll_cleanup
    - LP: #1241093
  * ipv6: udp packets following an UFO enqueued packet need also be handled
    by UFO
    - LP: #1241093
  * via-rhine: fix VLAN priority field (PCP, IEEE 802.1p)
    - LP: #1241093
  * net: flow_dissector: fix thoff for IPPROTO_AH
    - LP: #1241093
  * bonding: Fix broken promiscuity reference counting issue
    - LP: #1241093
  * ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put
    - LP: #1241093
  * ipv6 mcast: use in6_dev_put in timer handlers instead of __in6_dev_put
    - LP: #1241093
  * dm9601: fix IFF_ALLMULTI handling
    - LP: #1241093
  * ll_temac: Reset dma descriptors indexes on ndo_open
    - LP: #1241093
  * gianfar: Change default HW Tx queue scheduling mode
    - LP: #1241093
  * fanotify: dont merge permission events
    - LP: #1241093
  * sparc32: Fix exit flag passed from traced sys_sigreturn
    - LP: #1241093
  * sparc64: Fix not SRA'ed %o5 in 32-bit traced syscall
    - LP: #1241093
  * esp_scsi: Fix tag state corruption when autosensing.
    - LP: #1241093
  * sparc64: Fix ITLB handler of null page
    - LP: #1241093
  * sparc64: Remove RWSEM export leftovers
    - LP: #1241093
  * sparc64: Fix off by one in trampoline TLB mapping installation loop.
    - LP: #1241093
  * ASoC: max98095: a couple array underflows
    - LP: #1241093
  * ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
    - LP: #1241093
  * Bluetooth: Add a new PID/VID 0cf3/e005 for AR3012.
    - LP: #1241093
  * Bluetooth: Fix security level for peripheral role
    - LP: #1241093
  * Bluetooth: Fix encryption key size for peripheral role
    - LP: #1241093
  * Bluetooth: Add support for BCM20702A0 [0b05, 17cb]
    - LP: #1241093
  * rtlwifi: Align private space in rtl_priv struct
    - LP: #1241093
  * p54usb: add USB ID for Corega WLUSB2GTST USB adapter
    - LP: #1241093
  * mwifiex: fix hang issue for USB chipsets
    - LP: #1241093
  * mwifiex: fix NULL pointer dereference in usb suspend handler
    - LP: #1241093
  * USB: serial: option: Ignore card reader interface on Huawei E1750
    - LP: #1241093
  * ib_srpt: Destroy cm_id before destroying QP.
    - LP: #1241093
  * powerpc: Fix parameter clobber in csum_partial_copy_generic()
    - LP: #1241093
  * powerpc/sysfs: Disable writing to PURR in guest mode
    - LP: #1241093
  * powerpc/iommu: Use GFP_KERNEL instead of GFP_ATOMIC in
    iommu_init_table()
    - LP: #1241093
  * powerpc/vio: Fix modalias_show return values
    - LP: #1241093
  * ib_srpt: always set response for task management
    - LP: #1241093
  * staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice
    - LP: #1241093
  * mwifiex: fix memory corruption when unsetting multicast list
    - LP: #1241093
  * ext4: avoid hang when mounting non-journal filesystems with orphan list
    - LP: #1241093
  * dmaengine: imx-dma: fix slow path issue in prep_dma_cyclic
    - LP: #1241093
  * dmaengine: imx-dma: fix lockdep issue between irqhandler and tasklet
    - LP: #1241093
  * dma: fix comments
    - LP: #1241093
  * dmaengine: imx-dma: fix callback path in tasklet
    - LP: #1241093
  * Linux 3.5.7.23
    - LP: #1241093
  * [PATCH 01/35] drm/i915: Revert hdmi HDP pin checks
    - LP: #1138700
  * [PATCH 02/35] drm/i915: add HAS_DDI check
    - LP: #1240639
  * [PATCH 03/35] drm/i915: don't intel_crt_init on any ULT machines
    - LP: #1240639
  * [PATCH 04/35] drm/i915: no lvds quirk for hp t5740
    - LP: #1240639
  * [PATCH 05/35] drm/i915/sdvo: Use &intel_sdvo->ddc instead of
    intel_sdvo->i2c for DDC.
    - LP: #1240639
  * [PATCH 06/35] drm/i915: prefer VBT modes for SVDO-LVDS over EDID
    - LP: #1240639
  * [PATCH 07/35] drm/i915: Fix context sizes on HSW
    - LP: #1240639
  * [PATCH 08/35] drm/i915: Only clear write-domains after a successful
    wait-seqno
    - LP: #1240639
  * [PATCH 09/35] drm/i915: Correct obj->mm_list link to
    dev_priv->dev_priv->mm.inactive_list
    - LP: #1240639
  * [PATCH 10/35] drm/i915: fix up ring cleanup for the i830/i845 CS tlb
    w/a
    - LP: #1240639
  * [PATCH 11/35] Partially revert "drm/i915: unconditionally use mt
    forcewake on hsw/ivb"
    - LP: #1240639
  * [PATCH 12/35] drm/i915: Fix write-read race with multiple rings
    - LP: #1240639
  * [PATCH 13/35] drm/i915: merge {i965, sandybridge}_write_fence_reg()
    - LP: #1240639
  * [PATCH 14/35] drm/i915: Fix incoherence with fence updates on
    Sandybridge+
    - LP: #1240639
  * [PATCH 15/35] Revert "drm/i915: Workaround incoherence between fences
    and LLC across multiple CPUs"
    - LP: #1240639
  * [PATCH 16/35] drm/i915: rename sdvox_reg to hdmi_reg on HDMI context
    - LP: #1240639
  * [PATCH 17/35] drm/i915: don't setup hdmi for port D edp in ddi_init
    - LP: #1240639
  * [PATCH 18/35] drm/i915: Preserve the DDI_A_4_LANES bit from the bios
    - LP: #1240639
  * [PATCH 19/35] drm/i915: fix long-standing SNB regression in power
    consumption after resume v2
    - LP: #1240639
  * [PATCH 20/35] drm/i915: inverted brightness quirk for Acer Aspire 4736Z
    - LP: #1240639
  * [PATCH 21/35] drm/i915: quirk no PCH_PWM_ENABLE for Dell XPS13
    backlight
    - LP: #1162026, #1163720, #1240639
  * [PATCH 22/35] drm/i915: Serialize almost all register access
    - LP: #1240639
  * [PATCH 23/35] drm/i915: fix up gt init sequence fallout
    - LP: #1240639
  * [PATCH 24/35] drm/i915: initialize gt_lock early with other spin locks
    - LP: #1240639
  * [PATCH 25/35] drm/i915: fix missed hunk after GT access breakage
    - LP: #1240639
  * [PATCH 26/35] drm/i915: do not disable backlight on vgaswitcheroo
    switch off
    - LP: #1240639
  * [PATCH 27/35] drm/i915: Move num_pipes to intel info
    - LP: #1240639
  * [PATCH 28/35] drm/i915: Don't deref pipe->cpu_transcoder in the
    hangcheck code
    - LP: #1240639
  * [PATCH 29/35] drm/i915: Invalidate TLBs for the rings after a reset
    - LP: #1240639
  * [PATCH 30/35] drm/i915: ivb: fix edp voltage swing reg val
    - LP: #1240639
  * [PATCH 31/35] drm/i915: try not to lose backlight CBLV precision
    - LP: #1240639
  * [PATCH 32/35] drm/i915: do not update cursor in crtc mode set
    - LP: #1240639
  * [PATCH 33/35] drm/i915: Don't enable the cursor on a disable pipe
    - LP: #1240639
  * [PATCH 34/35] drm/i915/dp: increase i2c-over-aux retry interval on AUX
    DEFER
    - LP: #1240639
  * [PATCH 35/35] drm/i915: hsw: fix link training for eDP on port-A
    - LP: #1138700
  * USB: handle LPM errors during device suspend correctly
    - LP: #1241093
 -- Brad Figg <email address hidden>   Thu, 17 Oct 2013 10:49:22 -0700