Monitoring Février 2018

monitoring@federez.net

8 participants
72 discussions

24 Debian package update(s) for quigon.federez.net

par root＠quigon.federez.net

apticron report [Thu, 22 Feb 2018 22:38:17 +0100] ======================================================================== apticron has detected that some packages need upgrading on: quigon.federez.net [ 160.228.155.65 ] The following packages are currently pending an upgrade: cpp-6 6.3.0-18+deb9u1 g++-6 6.3.0-18+deb9u1 gcc-6 6.3.0-18+deb9u1 gcc-6-base 6.3.0-18+deb9u1 libasan3 6.3.0-18+deb9u1 libatomic1 6.3.0-18+deb9u1 libcc1-0 6.3.0-18+deb9u1 libcilkrts5 6.3.0-18+deb9u1 libgcc1 1:6.3.0-18+deb9u1 libgcc-6-dev 6.3.0-18+deb9u1 libgfortran3 6.3.0-18+deb9u1 libgomp1 6.3.0-18+deb9u1 libitm1 6.3.0-18+deb9u1 liblsan0 6.3.0-18+deb9u1 libmpx2 6.3.0-18+deb9u1 libobjc4 6.3.0-18+deb9u1 libquadmath0 6.3.0-18+deb9u1 libstdc++6 6.3.0-18+deb9u1 libstdc++-6-dev 6.3.0-18+deb9u1 libtsan0 6.3.0-18+deb9u1 libubsan0 6.3.0-18+deb9u1 linux-image-4.9.0-6-amd64 4.9.82-1+deb9u2 linux-image-amd64 4.9+80+deb9u4 linux-libc-dev 4.9.82-1+deb9u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour linux (linux-libc-dev) --- linux (4.9.82-1+deb9u2) stretch-security; urgency=high * [x86] linux-headers: use correct version in linux-compiler-gcc-6-x86 dependency. -- Yves-Alexis Perez <corsac(a)debian.org> Wed, 21 Feb 2018 16:29:03 +0100 linux (4.9.82-1+deb9u1) stretch-security; urgency=high [ Yves-Alexis Perez ] * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.81 - [powerpc*] powerpc/64s: Add support for RFI flush of L1-D cache (CVE-2017-5754, Meltdown) - [powerpc*] powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti - [powerpc*] powerpc/64s: Allow control of RFI flush via debugfs - [x86] kaiser: fix intel_bts perf crashes - [x86] x86/pti: Make unpoison of pgd for trusted boot work for real - kaiser: allocate pgd with order 0 when pti=off - serial: core: mark port as initialized after successful IRQ change - ip6mr: fix stale iterator - net: igmp: add a missing rcu locking section - qlcnic: fix deadlock bug - tcp: release sk_frag.page in tcp_disconnect - soreuseport: fix mem leak in reuseport_add_sock() - KEYS: encrypted: fix buffer overread in valid_master_desc() - [x86] x86/retpoline: Remove the esp/rsp thunk - [x86] KVM: x86: Make indirect calls in emulator speculation safe (CVE-2017-5715, Spectre#2) - KVM: VMX: Make indirect call speculation safe - module/retpoline: Warn about missing retpoline in module - [x86] x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown - [x86] x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes - [x86] x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support - [x86] x86/entry/64: Remove the SYSCALL64 fast path - [x86] x86/asm: Move 'status' from thread_struct to thread_info - Documentation: Document array_index_nospec - [x86] x86: Implement array_index_mask_nospec - [x86] x86: Introduce barrier_nospec - [x86] x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec - [x86] x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec - [x86] x86/get_user: Use pointer masking to limit speculation - [x86] x86/syscall: Sanitize syscall table de-references under speculation - vfs, fdtable: Prevent bounds-check bypass via speculative execution (CVE-2017-5753, Spectre#1) - nl80211: Sanitize array index in parse_txq_params (CVE-2017-5753, Spectre#1) - [x86] x86/spectre: Report get_user mitigation for spectre_v1 - x86/paravirt: Remove 'noreplace-paravirt' cmdline option - x86/kvm: Update spectre-v1 mitigation (CVE-2017-5753, Spectre#1) - KVM: nVMX: mark vmcs12 pages dirty on L2 exit - KVM/x86: Add IBPB support (CVE-2017-5715, Spectre#2) - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL - [x86] x86/microcode: Do the family check first * [x86] Rewrite "Make x32 syscall support conditional on a kernel parameter" to use a static key * [x86] linux-compiler-gcc-6-x86: Add versioned dependency on gcc-6 for retpoline support * [powerpc] powerpc/64s: Simple RFI macro conversions (fix FTBFS) * Add myself to Uploaders since I did the last few uploads to Stretch. https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.82 - CIFS: zero sensitive data when freeing - posix-timer: Properly check sigevent->sigev_notify - dccp: CVE-2017-8824: use-after-free in DCCP code - media: dvb-usb-v2: lmedm04: Improve logic checking of warm start - media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner - ubi: fastmap: Erase outdated anchor PEBs during attach - ubi: block: Fix locking for idr_alloc/idr_remove - nsfs: mark dentry with DCACHE_RCUACCESS - media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic - crypto: caam - fix endless loop when DECO acquire fails - crypto: sha512-mb - initialize pending lengths correctly - KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2 - KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED - media: dvb-frontends: fix i2c access helpers for KASAN - media: ts2020: avoid integer overflows on 32 bit machines - fs/proc/kcore.c: use probe_kernel_read() instead of memcpy() - kernel/relay.c: revert "kernel/relay.c: fix potential memory leak" - pipe: actually allow root to exceed the pipe buffer limits - ACPI: sbshc: remove raw pointer from printk() message (CVE-2018-5750) - acpi, nfit: fix register dimm error handling * Remove patches included in 4.9.82 * Bump ABI to 6, remove all ignored ABI changes since ABI 5. * Remove all patches handling or reverting ABI changes. * [x86] linux-headers: Depend on updated linux-compiler-gcc-6-x86 for retpoline support. * [x86] Add versioned build-dependency on gcc-6 for retpoline support. * [rt] Update to 4.9.76-rt61 except patches refreshed locally since 4.9.76. * [rt] Add gpg key for Julia Cartwright (0x0A120DD923EEDD5F) to upstream keyring [ Ben Hutchings ] * abiupdate.py: Add support for security mirrors -- Yves-Alexis Perez <corsac(a)debian.org> Mon, 19 Feb 2018 16:10:58 +0100 linux (4.9.80-2) stretch; urgency=medium * scsi: ignore ABI change in hisi_sas. -- Yves-Alexis Perez <corsac(a)debian.org> Fri, 09 Feb 2018 13:58:52 +0100 linux (4.9.80-1) stretch; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.66 - [s390x] fix transactional execution control register handling - [s390x] runtime instrumention: fix possible memory corruption - [s390x] disassembler: add missing end marker for e7 table - [s390x] disassembler: increase show_code buffer size - ACPI / EC: Fix regression related to triggering source of EC event handling - [x86] mm: fix use-after-free of vma during userfaultfd fault - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER - vsock: use new wait API for vsock_stream_sendmsg() - sched: Make resched_cpu() unconditional - lib/mpi: call cond_resched() from mpi_powm() loop - [x86] decoder: Add new TEST instruction pattern - [arm64] Implement arch-specific pte_access_permitted() - [armhf/armmp-lpae] 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE - [armhf/armmp-lpae] 8721/1: mm: dump: check hardware RO bit for LPAE - [arm64] PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF - dm bufio: fix integer overflow when limiting maximum cache size - dm: allocate struct mapped_device with kvzalloc - [mips*] pci: Remove KERN_WARN instance inside the mt7620 driver - dm: fix race between dm_get_from_kobject() and __dm_destroy() - [mips*] Fix odd fp register warnings with MIPS64r2 - [mips*] Fix an n32 core file generation regset support regression - rt2x00usb: mark device removed when get ENOENT usb error - autofs: don't fail mount for transient error - nilfs2: fix race condition that causes file system corruption - eCryptfs: use after free in ecryptfs_release_messaging() - libceph: don't WARN() if user tries to add invalid key - bcache: check ca->alloc_thread initialized before wake up it - isofs: fix timestamps beyond 2027 - NFS: Fix typo in nomigration mount option - nfs: Fix ugly referral attributes - NFS: Avoid RCU usage in tracepoints - nfsd: deal with revoked delegations appropriately - rtlwifi: rtl8192ee: Fix memory leak when loading firmware - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time - ata: fixes kernel crash while tracing ata_eh_link_autopsy event - ext4: fix interaction between i_size, fallocate, and delalloc after a crash - ALSA: pcm: update tstamp only if audio_tstamp changed - ALSA: usb-audio: Add sanity checks to FE parser - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU - ALSA: usb-audio: Add sanity checks in v2 clock parsers - ALSA: timer: Remove kernel warning at compat ioctl error paths - ALSA: hda: Fix too short HDMI/DP chmap reporting - ALSA: hda/realtek - Fix ALC700 family no sound issue - fix a page leak in vhost_scsi_iov_to_sgl() error recovery - fs/9p: Compare qid.path in v9fs_test_inode - iscsi-target: Fix non-immediate TMR reference leak - target: Fix QUEUE_FULL + SCSI task attribute handling - [armhf] mtd: nand: omap2: Fix subpage write - mtd: nand: Fix writing mtdoops to nand flash. - mtd: nand: mtk: fix infinite ECC decode IRQ issue - p54: don't unregister leds when they are not initialized - block: Fix a race between blk_cleanup_queue() and timeout handling - [armhf,arm64] irqchip/gic-v3: Fix ppi-partitions lookup - lockd: double unregister of inetaddr notifiers - [x86] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state - [x86] KVM: SVM: obey guest PAT - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status - [armhf] clk: ti: dra7-atl-clock: fix child-node lookups - libnvdimm, pfn: make 'resource' attribute only readable by root - libnvdimm, namespace: fix label initialization to use valid seq numbers - libnvdimm, namespace: make 'resource' attribute only readable by root - IB/srpt: Do not accept invalid initiator port names - IB/srp: Avoid that a cable pull can trigger a kernel crash - NFC: fix device-allocation error return - fm10k,i40e,i40evf,igb,igbvf,ixgbe,ixgbevf: Use smp_rmb rather than read_barrier_depends - [powerpc*] signal: Properly handle return value from uprobe_deny_signal() - media: Don't do DMA on stack for firmware upload in the AS102 driver - media: rc: check for integer overflow - media: v4l2-ctrl: Fix flags field on Control events - sched/rt: Simplify the IPI based RT balancing logic - fscrypt: lock mutex before checking for bounce page pool - net/9p: Switch to wait_event_killable() - PM / OPP: Add missing of_node_put(np) - [x86] Revert "drm/i915: Do not rely on wm preservation for ILK watermarks" closes: #884001 - e1000e: Fix error path in link detection - e1000e: Fix return value test - e1000e: Separate signaling for link check/link up - e1000e: Avoid receiver overrun interrupt bursts - RDS: make message size limit compliant with spec - RDS: RDMA: return appropriate error on rdma map failures - RDS: RDMA: fix the ib_map_mr_sg_zbva() argument - PCI: Apply _HPX settings only to relevant devices - [armhf] clk: sunxi-ng: A31: Fix spdif clock register - [armhf] clk: sunxi-ng: fix PLL_CPUX adjusting on A33 - fscrypt: use ENOKEY when file cannot be created w/o key - fscrypt: use ENOTDIR when setting encryption policy on nondirectory - net: Allow IP_MULTICAST_IF to set index to L3 slave - net: 3com: typhoon: typhoon_init_one: fix incorrect return values - rt2800: set minimum MPDU and PSDU lengths to sane values - adm80211: return an error if adm8211_alloc_rings() fails - mwifiex: sdio: fix use after free issue for save_adapter - ath10k: fix incorrect txpower set by P2P_DEVICE interface - ath10k: ignore configuring the incorrect board_id - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() - bnxt_en: Set default completion ring for async events. - ath10k: set CTS protection VDEV param only if VDEV is up - ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE - drm: Apply range restriction after color adjustment when allocation - [arm64] clk: qcom: ipq4019: Add all the frequencies for apss cpu - mac80211: Remove invalid flag operations in mesh TSF synchronization - mac80211: Suppress NEW_PEER_CANDIDATE event if no room - adm80211: add checks for dma mapping errors - iio: light: fix improper return value - netfilter: nft_queue: use raw_smp_processor_id() - netfilter: nf_tables: fix oob access - [armel,armhf] crypto: marvell - Copy IVDIG before launching partial DMA ahash requests - btrfs: return the actual error value from from btrfs_uuid_tree_iterate - [s390x] kbuild: enable modversions for symbols exported from asm - cec: when canceling a message, don't overwrite old status info - cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2 - cec: update log_addr[] before finishing configuration - nvmet: fix KATO offset in Set Features - xen: xenbus driver must not accept invalid transaction ids https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.67 - [armhf] dts: LogicPD Torpedo: Fix camera pin mux - [armhf] dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio - mm/cma: fix alloc_contig_range ret code/potential leak - mm, hugetlbfs: introduce ->split() to vm_operations_struct - mm/madvise.c: fix madvise() infinite loop under special circumstances - btrfs: clear space cache inode generation always - nfsd: Fix stateid races between OPEN and CLOSE - nfsd: Fix another OPEN stateid race - nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat - [armhf] mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot - [armhf] OMAP2+: Fix WL1283 Bluetooth Baud Rate - [x86] KVM: pvclock: Handle first-time write to pvclock-page contains random junk - [x86] KVM: Exit to user-mode on #UD intercept when emulator requires - [x86] KVM: inject exceptions produced by x86_decode_insn - [x86] KVM: lapic: Split out x2apic ldr calculation - [x86] KVM: lapic: Fixup LDR on load in x2apic - mmc: core: Do not leave the block driver in a suspended state - mmc: core: prepend 0x to OCR entry in sysfs - eeprom: at24: fix reading from 24MAC402/24MAC602 - eeprom: at24: correctly set the size for at24mac402 - eeprom: at24: check at24_read/write arguments - [x86,alpha] i2c: i801: Fix Failed to allocate irq -2147483648 error - hwmon: (jc42) optionally try to disable the SMBUS timeout - nvme-pci: add quirk for delay before CHK RDY for WDC SN200 - Revert "drm/radeon: dont switch vt on suspend" - drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs() - drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories() - drm/radeon: fix atombios on big endian - [armhf,arm64] drm/panel: simple: Add missing panel_simple_unprepare() calls - [arm64] drm/hisilicon: Ensure LDI regs are properly configured. - drm/ttm: once more fix ttm_buffer_object_transfer - drm/amd/pp: fix typecast error in powerplay. - NFS: revalidate "." etc correctly on "open". - [x86] drm/i915: Don't try indexed reads to alternate slave addresses - [x86] drm/i915: Prevent zero length "index" write https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.68 - bcache: only permit to recovery read error when cache device is clean - bcache: recover data from backing when data is clean - Revert "crypto: caam - get rid of tasklet" - mm, oom_reaper: gather each vma to prevent leaking TLB entry - uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices - usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub - [s390x] runtime instrumentation: simplify task exit handling - ima: fix hash algorithm initialization - [s390x] pci: do not require AIS facility - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() - staging: rtl8188eu: avoid a null dereference on pmlmepriv - [arm64] mmc: sdhci-msm: fix issue with power irq - serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X - [x86] entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() - [x86] EDAC, sb_edac: Fix missing break in switch - [armel,armhf] sysrq : fix Show Regs call trace on ARM - usbip: tools: Install all headers needed for libusbip development - [x86] kprobes: Disable preemption in ftrace-based jprobes - iio: adc: ti-ads1015: add 10% to conversion wait time - dax: Avoid page invalidation races and unnecessary radix tree traversals - net/mlx4_en: Fix type mismatch for 32-bit systems - l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups - usb: gadget: f_fs: Fix ExtCompat descriptor validation - libcxgb: fix error check for ip6_route_output() - [armhf] OMAP2+: Fix WL1283 Bluetooth Baud Rate - vti6: fix device register to report IFLA_INFO_KIND - be2net: fix accesses to unicast list - be2net: fix unicast list filling - net/appletalk: Fix kernel memory disclosure - libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount - mm: fix remote numa hits statistics - mac80211: calculate min channel width correctly - nfs: Don't take a reference on fl->fl_file for LOCK operation - [armhf,arm64] KVM: Fix occasional warning from the timer work function - mac80211: prevent skb/txq mismatch - NFSv4: Fix client recovery when server reboots multiple times - [x86] perf/intel: Account interrupts for PEBS errors - [powerpc*] mm: Fix memory hotplug BUG() on radix - qla2xxx: Fix wrong IOCB type assumption - drm/amdgpu: fix bug set incorrect value to vce register - net: sctp: fix array overrun read on sctp_timer_tbl - [x86] fpu: Set the xcomp_bv when we fake up a XSAVES area - drm/amdgpu: fix unload driver issue for virtual display - mac80211: don't try to sleep in rate_control_rate_init() - RDMA/qedr: Return success when not changing QP state - RDMA/qedr: Fix RDMA CM loopback - tipc: fix nametbl_lock soft lockup at module exit - tipc: fix cleanup at module unload - [armhf] dmaengine: pl330: fix double lock - tcp: correct memory barrier usage in tcp_check_space() - nvmet: cancel fatal error and flush async work before free controller - gtp: clear DF bit on GTP packet tx - gtp: fix cross netns recv on gtp socket - net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause - [arm64] net: thunderx: avoid dereferencing xcv when NULL - be2net: fix initial MAC setting - [powerpc*] vfio/spapr: Fix missing mutex unlock when creating a window - mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers - xen-netfront: Improve error handling during initialization - cec: initiator should be the same as the destination for, poll - xen-netback: vif counters from int/long to u64 - net: fec: fix multicast filtering hardware setup - dma-buf/dma-fence: Extract __dma_fence_is_later() - dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound - dma-buf/sw-sync: Prevent user overflow on timeline advance - dma-buf/sw-sync: sync_pt is private and of fixed size - dma-buf/sw-sync: Fix locking around sync_timeline lists - dma-buf/sw-sync: Use an rbtree to sort fences in the timeline - dma-buf/sw_sync: move timeline_fence_ops around - dma-buf/sw_sync: clean up list before signaling the fence - dma-fence: Clear fence->status during dma_fence_init() - dma-fence: Wrap querying the fence->status - dma-fence: Introduce drm_fence_set_error() helper - dma-buf/sw_sync: force signal all unsignaled fences on dying timeline - dma-buf/sync_file: hold reference to fence when creating sync_file - usb: hub: Cycle HUB power when initialization fails - usb: xhci: fix panic in xhci_free_virt_devices_depth_first - USB: core: Add type-specific length check of BOS descriptors - USB: Increase usbfs transfer limit - USB: devio: Prevent integer overflow in proc_do_submiturb() - USB: usbfs: Filter flags passed in from user space - usb: host: fix incorrect updating of offset - xen-netfront: avoid crashing on resume after a failure in talk_to_netback() https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.69 - can: kvaser_usb: free buf in error paths - can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() - can: kvaser_usb: ratelimit errors if incomplete messages are received - can: kvaser_usb: cancel urb on -EPIPE and -EPROTO - can: ems_usb: cancel urb on -EPIPE and -EPROTO - can: esd_usb2: cancel urb on -EPIPE and -EPROTO - can: usb_8dev: cancel urb on -EPIPE and -EPROTO - virtio: release virtio index when fail to device_register - [x86] hv: kvp: Avoid reading past allocated blocks from KVP file - isa: Prevent NULL dereference in isa_bus driver callbacks - scsi: dma-mapping: always provide dma_get_cache_alignment - scsi: use dma_get_cache_alignment() as minimum DMA alignment - scsi: libsas: align sata_device's rps_resp on a cacheline - efi: Move some sysfs files to be read-only by root - efi/esrt: Use memunmap() instead of kfree() to free the remapping - ASN.1: fix out-of-bounds read when parsing indefinite length item - ASN.1: check for error from ASN1_OP_END__ACT actions - X.509: reject invalid BIT STRING for subjectPublicKey - X.509: fix comparisons of ->pkey_algo - [x86] PCI: Make broadcom_postcore_init() check acpi_disabled - [x86] KVM: fix APIC page invalidation - btrfs: fix missing error return in btrfs_drop_snapshot - ALSA: pcm: prevent UAF in snd_pcm_info - ALSA: seq: Remove spurious WARN_ON() at timer check - ALSA: usb-audio: Fix out-of-bound error - ALSA: usb-audio: Add check return value for usb_string() - [x86] iommu/vt-d: Fix scatterlist offset handling - smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place - [s390x] fix compat system call table - [s390x] KVM: Fix skey emulation permission check - [powerpc*] 64s: Initialize ISAv3 MMU registers before setting partition table - brcmfmac: change driver unbind order of the sdio function devices - media: dvb: i2c transfers over usb cannot be done from stack - [armhf,arm64] KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one - [armhf,arm64] KVM: Fix broken GICH_ELRSR big endian conversion - [armhf,arm64] KVM: vgic-irqfd: Fix MSI entry allocation - [armhf,arm64] KVM: vgic-its: Check result of allocation before use - [arm64] fpsimd: Prevent registers leaking from dead tasks - [armhf] bus: arm-cci: Fix use of smp_processor_id() in preemptible context - usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT - [armel,armhf] BUG if jumping to usermode address in kernel mode - [armel,armhf] avoid faulting on qemu - thp: reduce indentation level in change_huge_pmd() - thp: fix MADV_DONTNEED vs. numa balancing race - mm: drop unused pmdp_huge_get_and_clear_notify() - [armel,armhf] 8657/1: uaccess: consistently check object sizes - vti6: Don't report path MTU below IPV6_MIN_MTU. - [armhf] OMAP2+: gpmc-onenand: propagate error on initialization failure - [x86] platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register - sched/fair: Make select_idle_cpu() more aggressive - [x86] hpet: Prevent might sleep splat on resume - [powerpc*] 64: Invalidate process table caching after setting process table - lirc: fix dead lock between open and wakeup_filter - module: set __jump_table alignment to 8 - [powerpc*] 64: Fix checksum folding in csum_add() - [armhf] OMAP2+: Fix device node reference counts - [armhf] OMAP2+: Release device node after it is no longer needed. - usb: gadget: configs: plug memory leak - USB: gadgetfs: Fix a potential memory leak in 'dev_config()' - [armhf,arm64] usb: dwc3: gadget: Fix system suspend/resume on TI platforms - usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver - [x86] kvm: nVMX: VMCLEAR should not cause the vCPU to shut down - libata: drop WARN from protocol error in ata_sff_qc_issue() - workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq - scsi: qla2xxx: Fix ql_dump_buffer - scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters - [armhf] irqchip/crossbar: Fix incorrect type of register size - [x86] KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset - [armhf,arm64] KVM: Survive unknown traps from guests - [armhf,arm64] KVM: VGIC: Fix command handling while ITS being disabled - bnx2x: prevent crash when accessing PTP with interface down - bnx2x: fix possible overrun of VFPF multicast addresses array - bnx2x: fix detection of VLAN filtering feature for VF - bnx2x: do not rollback VF MAC/VLAN filters we did not configure - rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races - [powerpc*] ibmvnic: Fix overflowing firmware/hardware TX queue - [powerpc*] ibmvnic: Allocate number of rx/tx buffers agreed on by firmware - ipv6: reorder icmpv6_init() and ip6_mr_init() - blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue() - zram: set physical queue limits to avoid array out of bounds accesses - netfilter: don't track fragmented packets - [powerpc*] axonram: Fix gendisk handling - drm/amd/amdgpu: fix console deadlock if late init failed - [powerpc*] powernv/ioda2: Gracefully fail if too many TCE levels requested - [x86] EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro - [x86] EDAC, i5000, i5400: Fix definition of NRECMEMB register - kbuild: pkg: use --transform option to prefix paths in tar - coccinelle: fix parallel build with CHECK=scripts/coccicheck - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() - gre6: use log_ecn_error module parameter in ip6_tnl_rcv() - route: also update fnhe_genid when updating a route cache - route: update fnhe_expires for redirect when the fnhe exists - NFS: Fix a typo in nfs_rename() - sunrpc: Fix rpc_task_begin trace point - xfs: fix forgotten rcu read unlock when skipping inode reclaim - block: wake up all tasks blocked in get_request() - zsmalloc: calling zs_map_object() from irq is a bug - sctp: do not free asoc when it is already dead in sctp_sendmsg - sctp: use the right sk after waking up from wait_buf sleep - bpf: fix lockdep splat - atm: horizon: Fix irq release error - xfrm: Copy policy family in clone_policy - IB/mlx4: Increase maximal message size under UD QP - IB/mlx5: Assign send CQ and recv CQ of UMR QP - afs: Connect up the CB.ProbeUuid https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.70 - [s390x] qeth: fix early exit from error path - tipc: fix memory leak in tipc_accept_from_sock() - rds: Fix NULL pointer dereference in __rds_rdma_map - sit: update frag_off info - packet: fix crash in fanout_demux_rollover() - net/packet: fix a race in packet_bind() and packet_notifier() - usbnet: fix alignment for frames with no ethernet header - stmmac: reset last TSO segment size after device open - tcp/dccp: block bh before arming time_wait timer - [s390x] qeth: build max size GSO skbs on L2 devices - [s390x] qeth: fix GSO throughput regression - [s390x] qeth: fix thinko in IPv4 multicast address tracking - tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() - Fix handling of verdicts after NF_QUEUE - ipmi: Stop timers before cleaning up the module - [s390x] always save and restore all registers on context switch - usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping - fix kcm_clone() - [armhf,arm64] KVM: vgic-its: Preserve the revious read from the pending table - [powerpc*] 64: Fix checksum folding in csum_tcpudp_nofold and ip_fast_csum_nofold - kbuild: do not call cc-option before KBUILD_CFLAGS initialization - ipvlan: fix ipv6 outbound device - audit: ensure that 'audit=1' actually enables audit for PID 1 - md: free unused memory after bitmap resize - RDMA/cxgb4: Annotate r2 and stag as __be32 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.71 - mfd: fsl-imx25: Clean up irq settings during removal - crypto: rsa - fix buffer overread when stripping leading zeroes - autofs: fix careless error in recent commit - tracing: Allocate mask_str buffer dynamically - USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID - usbip: fix stub_rx: get_pipe() to validate endpoint number (CVE-2017-16912) - usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input (CVE-2017-16913) - usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer (CVE-2017-16914) - ceph: drop negative child dentries before try pruning inode's alias - usb: xhci: fix TDS for MTK xHCI1.1 - xhci: Don't add a virt_dev to the devs array before it's fully allocated - nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests - sched/rt: Do not pull from current CPU if only one CPU to pull - eeprom: at24: change nvmem stride to 1 - dmaengine: dmatest: move callback wait queue to thread context - ext4: fix fdatasync(2) after fallocate(2) operation - ext4: fix crash when a directory's i_size is too small - mac80211: Fix addition of mesh configuration element - [x86] KVM: nVMX: do not warn when MSR bitmap address is not backed - md-cluster: free md_cluster_info if node leave cluster - userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE - userfaultfd: selftest: vm: allow to build in vm/ directory - net: initialize msg.msg_flags in recvfrom - bnxt_en: Ignore 0 value in autoneg supported speed from firmware. - net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values - net: bcmgenet: correct MIB access of UniMAC RUNT counters - net: bcmgenet: reserved phy revisions must be checked first - net: bcmgenet: power down internal phy if open or resume fails - net: bcmgenet: synchronize irq0 status between the isr and task - net: bcmgenet: Power up the internal PHY before probing the MII - rxrpc: Wake up the transmitter if Rx window size increases on the peer - net/mlx5: Fix create autogroup prev initializer - net/mlx5: Don't save PCI state when PCI error is detected - drm/amdgpu: fix parser init error path to avoid crash in parser fini - NFSD: fix nfsd_minorversion(.., NFSD_AVAIL) - NFSD: fix nfsd_reset_versions for NFSv4. - [armhf] drm/omap: fix dmabuf mmap for dma_alloc'ed buffers - netfilter: bridge: honor frag_max_size when refragmenting - blk-mq: Fix tagset reinit in the presence of cpu hot-unplug - writeback: fix memory leak in wb_queue_work() - net: wimax/i2400m: fix NULL-deref at probe - dmaengine: Fix array index out of bounds warning in __get_unmap_pool() - irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN - net: Resend IGMP memberships upon peer notification. - qed: Align CIDs according to DORQ requirement - qed: Fix mapping leak on LL2 rx flow - qed: Fix interrupt flags on Rx LL2 - scsi: hpsa: update check for logical volume status - scsi: hpsa: limit outstanding rescans - scsi: hpsa: do not timeout reset operations - fjes: Fix wrong netdevice feature flags - drm/radeon/si: add dpm quirk for Oland - [x86] Drivers: hv: util: move waiting for release to hv_utils_transport itself - iwlwifi: mvm: cleanup pending frames in DQA mode - sched/deadline: Add missing update_rq_clock() in dl_task_timer() - sched/deadline: Make sure the replenishment timer fires in the next period - sched/deadline: Throttle a constrained deadline task activated after the deadline - sched/deadline: Use deadline instead of period when calculating overflow - drm/radeon: reinstate oland workaround for sclk - afs: Fix missing put_page() - afs: Populate group ID from vnode status - afs: Adjust mode bits processing - afs: Deal with an empty callback array - afs: Flush outstanding writes when an fd is closed - afs: Migrate vlocation fields to 64-bit - afs: Prevent callback expiry timer overflow - afs: Fix the maths in afs_fs_store_data() - afs: Invalid op ID should abort with RXGEN_OPCODE - afs: Better abort and net error handling - afs: Populate and use client modification time - afs: Fix page leak in afs_write_begin() - afs: Fix afs_kill_pages() - afs: Fix abort on signal while waiting for call completion - nvme-loop: fix a possible use-after-free when destroying the admin queue - nvmet: confirm sq percpu has scheduled and switched to atomic - nvmet-rdma: Fix a possible uninitialized variable dereference - net/mlx4_core: Avoid delays during VF driver device shutdown - net: mpls: Fix nexthop alive tracking on down events - rxrpc: Ignore BUSY packets on old calls - tty: don't panic on OOM in tty_set_ldisc() - tty: fix data race in tty_ldisc_ref_wait() - perf symbols: Fix symbols__fixup_end heuristic for corner cases - efi/esrt: Cleanup bad memory map log messages - NFSv4.1 respect server's max size in CREATE_SESSION - btrfs: add missing memset while reading compressed inline extents - target: Use system workqueue for ALUA transitions - target: fix ALUA transition timeout handling - target: fix race during implicit transition work flushes - [x86] Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting" - HID: cp2112: fix broken gpio_direction_input callback - sfc: don't warn on successful change of MAC - video: udlfb: Fix read EDID timeout - rtc: pcf8563: fix output clock rate - [x86] ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case - [armhf] dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type - PCI/PME: Handle invalid data when reading Root Status - powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo - PCI: Do not allocate more buses than available in parent - netfilter: ipvs: Fix inappropriate output of procfs - [powerpc*] opal: Fix EBUSY bug in acquiring tokens - [powerpc*] ipic: Fix status get and status clear - [x86] platform: intel_punit_ipc: Fix resource ioremap warning - target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd() - iscsi-target: fix memory leak in lio_target_tiqn_addtpg() - target:fix condition return in core_pr_dump_initiator_port() - target/file: Do not return error for UNMAP if length is zero - badblocks: fix wrong return value in badblocks_set if badblocks are disabled - [x86] iommu/amd: Limit the IOVA page range to the specified addresses - xfs: truncate pagecache before writeback in xfs_setattr_size() - crypto: tcrypt - fix buffer lengths in test_aead_speed() - mm: Handle 0 flags in _calc_vm_trans() macro - [armhf] clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU - [arm64] clk: hi6220: mark clock cs_atb_syspll as critical - [armhf,arm64] clk: tegra: Fix cclk_lp divisor register - ppp: Destroy the mutex when cleanup - thermal/drivers/step_wise: Fix temperature regulation misbehavior - scsi: scsi_debug: write_same: fix error report - GFS2: Take inode off order_write list when setting jdata flag - bcache: explicitly destroy mutex while exiting - bcache: fix wrong cache_misses statistics - Ib/hfi1: Return actual operational VLs in port info query - [x86] platform: hp_accel: Add quirk for HP ProBook 440 G4 - nvme: use kref_get_unless_zero in nvme_find_get_ns - l2tp: cleanup l2tp_tunnel_delete calls - xfs: fix log block underflow during recovery cycle verification - xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real - RDMA/cxgb4: Declare stag as __be32 - PCI: Detach driver before procfs & sysfs teardown on device remove - scsi: hpsa: cleanup sas_phy structures in sysfs when unloading - scsi: hpsa: destroy sas transport properties before scsi_host - [powerpc*] perf/hv-24x7: Fix incorrect comparison in memord - tty fix oops when rmmod 8250 - raid5: Set R5_Expanded on parity devices as well as data. - scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry - IB/core: Fix calculation of maximum RoCE MTU - vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend - rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd - rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd - scsi: sd: change manage_start_stop to bool in sysfs interface - scsi: sd: change allow_restart to bool in sysfs interface - scsi: bfa: integer overflow in debugfs - udf: Avoid overflow when session starts at large offset - macvlan: Only deliver one copy of the frame to the macvlan interface - RDMA/cma: Avoid triggering undefined behavior - IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop - icmp: don't fail on fragment reassembly time exceeded - ath9k: fix tx99 potential info leak https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.72 - cxl: Check if vphb exists before iterating over AFU devices - [arm64] Initialise high_memory global variable earlier - kvm: fix usage of uninit spinlock in avic_vm_destroy() - [armhf] kprobes: Fix the return address of multiple kretprobes - [armhf] kprobes: Align stack to 8-bytes in test code - nvme-loop: handle cpu unplug when re-establishing the controller - cpuidle: Validate cpu_dev in cpuidle_add_sysfs() - r8152: fix the list rx_done may be used without initialization - crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex - vsock: track pkt owner vsock - vhost-vsock: add pkt cancel capability - vsock: cancel packets when failing to connect - sch_dsmark: fix invalid skb_cow() usage - bna: integer overflow bug in debugfs - sctp: out_qlen should be updated when pruning unsent queue - usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed - usb: gadget: udc: remove pointer dereference after free - netfilter: nfnl_cthelper: fix runtime expectation policy updates - netfilter: nfnl_cthelper: Fix memory leak - [armhf] iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5 - r8152: fix the rx early size of RTL8153 - tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe - inet: frag: release spinlock before calling icmp_send() - scsi: lpfc: Fix PT2PT PRLI reject - [x86] kvm: vmx: Flush TLB when the APIC-access address changes - [x86] KVM: correct async page present tracepoint - [x86] KVM: VMX: Fix enable VPID conditions - [armhf] dts: ti: fix PCI bus dtc warnings - [x86] hwmon: (asus_atk0110) fix uninitialized data access - HID: xinmo: fix for out of range for THT 2P arcade controller. - ASoC: STI: Fix reader substream pointer set - r8152: prevent the driver from transmitting packets with carrier off - [s390x] qeth: size calculation outbound buffers - [s390x] qeth: no ETH header for outbound AF_IUCV - bna: avoid writing uninitialized data into hw registers - i40iw: Receive netdev events post INET_NOTIFIER state - IB/core: Protect against self-requeue of a cq work item - infiniband: Fix alignment of mmap cookies to support VIPT caching - nbd: set queue timeout properly - net: Do not allow negative values for busy_read and busy_poll sysctl interfaces - IB/rxe: double free on error - IB/rxe: increment msn only when completing a request - i40e: Do not enable NAPI on q_vectors that have no rings - RDMA/iser: Fix possible mr leak on device removal event - irda: vlsi_ir: fix check for DMA mapping errors - netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register - [armhf] dts: am335x-evmsk: adjust mmc2 param to allow suspend - cpufreq: Fix creation of symbolic links to policy directories - net: ipconfig: fix ic_close_devs() use-after-free - [x86] KVM: pci-assign: do not map smm memory slot pages in vt-d page tables - virtio-balloon: use actual number of stats for stats queue buffers - virtio_balloon: prevent uninitialized variable use - isdn: kcapi: avoid uninitialized data - xhci: plat: Register shutdown for xhci_plat - netfilter: nfnetlink_queue: fix secctx memory leak - Btrfs: fix an integer overflow check - [armel,armhf] dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory - [powerpc*] cpuidle: powernv: Pass correct drv->cpumask for registration - bnxt_en: Fix NULL pointer dereference in reopen failure path - [armhf,arm64] backlight: pwm_bl: Fix overflow condition - [armhf,arm64] rtc: pl031: make interrupt optional - kvm, mm: account kvm related kmem slabs to kmemcg - net: phy: at803x: Change error to EINVAL for invalid MAC - PCI: Avoid bus reset if bridge itself is broken - scsi: cxgb4i: fix Tx skb leak - scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive - PCI: Create SR-IOV virtfn/physfn links before attaching driver - PM / OPP: Move error message to debug level - igb: check memory allocation failure - ixgbe: fix use of uninitialized padding - IB/rxe: check for allocation failure on elem - PCI/AER: Report non-fatal errors only to the affected endpoint - tracing: Exclude 'generic fields' from histograms - fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw - scsi: lpfc: Fix secure firmware updates - scsi: lpfc: PLOGI failures during NPIV testing - vfio/pci: Virtualize Maximum Payload Size - fm10k: ensure we process SM mbx when processing VF mbx - net: ipv6: send NS for DAD when link operationally up - [armhf] clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision - tcp: fix under-evaluated ssthresh in TCP Vegas - rtc: set the alarm to the next expiring timer - cpuidle: fix broadcast control when broadcast can not be entered - [arm64] thermal: hisilicon: Handle return value of clk_prepare_enable - [arm64] thermal/drivers/hisi: Fix missing interrupt enablement - [arm64] thermal/drivers/hisi: Fix kernel panic on alarm interrupt - [arm64] thermal/drivers/hisi: Simplify the temperature/step computation - [arm64] thermal/drivers/hisi: Fix multiple alarm interrupts firing - [mips*] math-emu: Fix final emulation phase for certain instructions - [x86] platform: asus-wireless: send an EV_SYN/SYN_REPORT between state changes https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.73 - ACPI: APEI / ERST: Fix missing error handling in erst_reader() - ALSA: rawmidi: Avoid racy info ioctl via ctl device - spi: xilinx: Detect stall with Unknown commands - [x86] KVM: X86: Fix load RFLAGS w/o the fixed bit - [x86] kvm: x86: fix RSM when PCID is non-zero - [armhf] clk: sunxi: sun9i-mmc: Implement reset callback for reset controls - [powerpc*] powerpc/perf: Dereference BHRB entries safely - bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.74 - tracing: Remove extra zeroing out of the ring buffer page - tracing: Fix possible double free on failure of allocating trace buffer - tracing: Fix crash when it fails to alloc ring buffer - ring-buffer: Mask out the info bits when returning buffer page length - ASoC: wm_adsp: Fix validation of firmware and coeff lengths - [x86] x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() - [x86] x86/mm: Remove flush_tlb() and flush_tlb_current_task() - [x86] x86/mm: Make flush_tlb_mm_range() more predictable - [x86] x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range() - [x86] x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code - [x86] x86/mm: Disable PCID on 32-bit kernels - [x86] x86/mm: Add the 'nopcid' boot option to turn off PCID - [x86] x86/mm: Enable CR4.PCIDE on supported systems - [amd64] x86/mm/64: Fix reboot interaction with CR4.PCIDE - kbuild: add '-fno-stack-check' to kernel build options - ipv4: igmp: guard against silly MTU values - ipv6: mcast: better catch silly mtu values - ptr_ring: add barriers - RDS: Check cmsg_len before dereferencing CMSG_DATA - tg3: Fix rx hang on MTU change with 5717/5719 - net: ipv4: fix for a race condition in raw_sendmsg - ipv4: Fix use-after-free when flushing FIB tables - net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks - net: Fix double free and memory corruption in get_net_ns_by_id() (CVE-2017-15129) - net/mlx5e: Fix possible deadlock of VXLAN lock - net/mlx5e: Prevent possible races in VXLAN control flow - usbip: fix usbip bind writing random string after command in match_busid - usbip: prevent leaking socket pointer address in messages - usbip: stub: stop printing kernel pointer addresses in messages - usbip: vhci: stop printing kernel pointer addresses in messages - USB: Fix off by one in type-specific length check of BOS SSP capability - nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick() - [x86] x86/smpboot: Remove stale TLB flush invocations - n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.75 - [x86] x86/boot: Add early cmdline parsing for options with arguments - [amd64] KAISER: Kernel Address Isolation - [amd64] kaiser: merged update - [amd64] kaiser: do not set _PAGE_NX on pgd_none - [amd64] kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE - [amd64] kaiser: fix build and FIXME in alloc_ldt_struct() - [amd64] kaiser: KAISER depends on SMP - [amd64] kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER - [amd64] kaiser: fix perf crashes - [amd64] kaiser: ENOMEM if kaiser_pagetable_walk() NULL - [amd64] kaiser: tidied up asm/kaiser.h somewhat - [amd64] kaiser: tidied up kaiser_add/remove_mapping slightly - [amd64] kaiser: align addition to x86/mm/Makefile - [amd64] kaiser: cleanups while trying for gold link - [amd64] kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET - [amd64] kaiser: delete KAISER_REAL_SWITCH option - [amd64] kaiser: vmstat show NR_KAISERTABLE as nr_overhead - [amd64] kaiser: enhanced by kernel and user PCIDs - [amd64] kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user - [amd64] kaiser: PCID 0 for kernel and 128 for user - [amd64] kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user - [amd64] kaiser: paranoid_entry pass cr3 need to paranoid_exit - [amd64] kaiser: kaiser_remove_mapping() move along the pgd - [amd64] kaiser: fix unlikely error in alloc_ldt_struct() - [amd64] kaiser: add "nokaiser" boot option, using ALTERNATIVE - [amd64] x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling - [amd64] x86/kaiser: Check boottime cmdline params - [amd64] kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush - [amd64] kaiser: drop is_atomic arg to kaiser_pagetable_walk() - [amd64] kaiser: asm/tlbflush.h handle noPGE at lower level - [amd64] kaiser: kaiser_flush_tlb_on_return_to_user() check PCID - [amd64] x86/paravirt: Dont patch flush_tlb_single - [amd64] x86/kaiser: Reenable PARAVIRT - [amd64] kaiser: disabled on Xen PV - [amd64] x86/kaiser: Move feature detection up - [amd64] KPTI: Rename to PAGE_TABLE_ISOLATION - [amd64] KPTI: Report when enabled - [amd64] kaiser: Set _PAGE_NX only if supported https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.76 - crypto: n2 - cure use after free - crypto: chacha20poly1305 - validate the digest size - crypto: pcrypt - fix freeing pcrypt instances (CVE-2017-18075) - nbd: fix use-after-free of rq/bio in the xmit path - [arm] iommu/arm-smmu-v3: Don't free page table ops twice - [arm] iommu/arm-smmu-v3: Cope with duplicated Stream IDs - [x86] x86/microcode/AMD: Add support for fam17h microcode loading - [hppa] parisc: Fix alignment of pa_tlb_lock in assembly on 32-bit SMP kernel - [x86] Map the vsyscall page with _PAGE_USER https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.77 - mac80211: Add RX flag to indicate ICV stripped - ath10k: rebuild crypto header in rx data frames - [x86] KVM: Fix stack-out-of-bounds read in write_mmio - [mips] MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA - [x86] kvm: vmx: Scrub hardware GPRs at VM-exit (mitigates Spectre / CVE-2017-5715 and CVE-2017-5753) - ALSA: pcm: Remove incorrect snd_BUG_ON() usages - RDS: Heap OOB write in rds_message_alloc_sgs() (CVE-2018-5332) - RDS: null pointer dereference in rds_atomic_free_op (CVE-2018-5333) - ipv6: fix possible mem leaks in ipv6_make_skb() - mlxsw: spectrum_router: Fix NULL pointer deref - crypto: algapi - fix NULL dereference in crypto_remove_spawns() - [x86] x86/microcode/intel: Extend BDW late-loading with a revision check - [x86] KVM: x86: Add memory barrier on vmcs field lookup (mitigates Spectre#2 / CVE-2017-5715) - [x86] kaiser: Set _PAGE_NX only if supported - bpf: prevent out-of-bounds speculation (mitigates Spectre#1 / CVE-2017-5753) - bpf, array: fix overflow in max_entries and undefined behavior in index_mask - USB: fix usbmon BUG trigger - usbip: remove kernel addresses from usb device and urb debug msgs - usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input - usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer - Bluetooth: Prevent stack info leak from the EFS element.(CVE-2017-1000410) - [x86] x86/retpoline: Add initial retpoline support (mitigates Spectre#2 / CVE-2017-5715) - [x86] x86/spectre: Add boot time option to select Spectre v2 mitigation - [x86] x86/retpoline/crypto: Convert crypto assembler indirect jumps - [x86] x86/retpoline/entry: Convert entry assembler indirect jumps - [x86] x86/retpoline/ftrace: Convert ftrace assembler indirect jumps - [x86] x86/retpoline/hyperv: Convert assembler indirect jumps - [x86] x86/retpoline/xen: Convert Xen hypercall indirect jumps - [x86] x86/retpoline/checksum32: Convert assembler indirect jumps - [x86] x86/retpoline/irq32: Convert assembler indirect jumps - [x86] x86/retpoline: Fill return stack buffer on vmexit - [x86] x86/pti/efi: broken conversion from efi to kernel page table https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.78 - futex: Prevent overflow by strengthen input validation - ALSA: seq: Make ioctls race-free - af_key: fix buffer overread in verify_address_len() - af_key: fix buffer overread in parse_exthdrs() - iser-target: Fix possible use-after-free in connection establishment error - [x86] x86/retpoline: Fill RSB on context switch for affected CPUs - [x86] x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros - module: Add retpoline tag to VERMAGIC - [x86] x86/mm/pkeys: Fix fill_sig_info_pkey - [x86] x86/tsc: Fix erroneous TSC rate on Skylake Xeon - pipe: avoid round_pipe_size() nr_pages overflow on 32-bit - [x86] x86/apic/vector: Fix off by one in error path - Input: ALPS - fix multi-touch decoding on SS4 plus touchpads - Input: 88pm860x-ts - fix child-node lookup - Input: twl6040-vibra - fix child-node lookup - Input: twl4030-vibra - fix sibling-node lookup - proc: fix coredump vs read /proc/*/stat race - libata: apply MAX_SEC_1024 to all LITEON EP1 series devices - workqueue: avoid hard lockups in show_workqueue_state() - dm btree: fix serious bug in btree_split_beneath() - dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 - [arm64] arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls - [x86] x86/cpu, x86/pti: Do not enable PTI on AMD processors - usbip: fix warning in vhci_hcd_probe/lockdep_init_map - [x86] x86/mce: Make machine check speculation protected - [x86] retpoline: Introduce start/end markers of indirect thunk - [x86] x86/retpoline: Optimize inline assembler for vmexit_fill_RSB https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.79 - [i386] x86/asm/32: Make sync_core() handle missing CPUID on all 32-bit kernels - usbip: prevent vhci_hcd driver from leaking a socket pointer address (CVE-2017-16911) - usbip: Fix potential format overflow in userspace tools - [arm*] KVM: arm/arm64: Check pagesize when allocating a hugepage at Stage 2 - [amd64] Prevent timer value 0 for MWAITX - drivers: base: cacheinfo: fix boot error message when acpi is enabled - mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack - ACPICA: Namespace: fix operand cache leak - netfilter: nfnetlink_cthelper: Add missing permission checks - netfilter: xt_osf: Add missing permission checks - fs/fcntl: f_setown, avoid undefined behaviour - Revert "module: Add retpoline tag to VERMAGIC" - orangefs: fix deadlock; do not write i_size in read_iter - um: link vmlinux with -no-pie - vsyscall: Fix permissions for emulate mode with KAISER/PTI - ipv6: fix udpv6 sendmsg crash caused by too small MTU - ipv6: ip6_make_skb() needs to clear cork.base.dst - net: igmp: fix source address check for IGMPv3 reports - net: qdisc_pkt_len_init() should be more robust - net: tcp: close sock if net namespace is exiting - pppoe: take ->needed_headroom of lower device into account on xmit - r8169: fix memory corruption on retrieval of hardware statistics. - sctp: do not allow the v4 socket to bind a v4mapped v6 address - sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf - flow_dissector: properly cap thoff field - perf/x86/amd/power: Do not load AMD power module on !AMD platforms - x86/microcode/intel: Extend BDW late-loading further with LLC size check - bpf: fix bpf_tail_call() x64 JIT - bpf: avoid false sharing of map refcount with max_entries - bpf: fix divides by zero - bpf: fix 32-bit divide by zero - nfsd: auth: Fix gid sorting when rootsquash enabled https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.80 - loop: fix concurrent lo_open/lo_release (CVE-2018-5344) - gpio: Fix kernel stack leak to userspace - crypto: aesni - handle zero length dst buffer - crypto: sha3-generic - fixes for alignment and big endian operation - HID: wacom: EKR: ensure devres groups at higher indexes are released - igb: Free IRQs when device is hotplugged - drm/vc4: Account for interrupts in flight - [x86] KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure - [x86] KVM: x86: Don't re-execute instruction when not passing CR2 value - [x86] KVM: X86: Fix operand/address-size during instruction decoding - [x86] KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race - [x86] KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered - ACPI / bus: Leave modalias empty for devices which are not present - [x86] KVM: x86: ioapic: Preserve read-only values in the redirection table - btrfs: fix deadlock when writing out space cache - [x86] KVM: X86: Fix softlockup when get the current kvmclock - KVM: VMX: Fix rflags cache during vCPU reset - xfs: always free inline data before resetting inode fork during ifree - kmemleak: add scheduling point to kmemleak_scan() - scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path - scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg - usb: gadget: don't dereference g until after it has been null checked - tty: fix data race between tty_init_dev and flush of buf - USB: serial: io_edgeport: fix possible sleep-in-atomic - usbip: prevent bind loops on devices attached to vhci_hcd [ Ben Hutchings ] * [rt] Update to 4.9.68-rt60: - Revert "memcontrol: Prevent scheduling while atomic in cgroup code" - Revert "fs: jbd2: pull your plug when waiting for space" - rtmutex: Fix lock stealing logic - cpu_pm: replace raw_notifier to atomic_notifier - PM / CPU: replace raw_notifier with atomic_notifier (fixup) - kernel/hrtimer: migrate deferred timer on CPU down - net: take the tcp_sk_lock lock with BH disabled - kernel/hrtimer: don't wakeup a process while holding the hrtimer base lock - kernel/hrtimer/hotplug: don't wake ktimersoftd while holding the hrtimer base lock - Bluetooth: avoid recursive locking in hci_send_to_channel() - iommu/amd: Use raw_cpu_ptr() instead of get_cpu_ptr() for ->flush_queue - rt/locking: allow recursive local_trylock() - locking/rtmutex: don't drop the wait_lock twice - net: use trylock in icmp_sk * e1000e: Fix e1000_check_for_copper_link_ich8lan return value. (see bug #885348) * [s390x] Un-revert upstream change moving exports to assembly sources [ Yves-Alexis Perez ] * mm, hugetlbfs: Avoid ABI change in 4.9.67. * dma-fence: Avoid ABI change in 4.9.68. * lib/genalloc: Avoid ABI change in 4.9.69. * Ignore ABI changes in inet_diag, SCTP, vsock, NVME, MD and libsas drivers, prevent FTBFS. * debian/patches: drop patches included upstream: - bugfix/all/e1000e-fix-e1000_check_for_copper_link_ich8lan-return-value.patch - bugfix/all/kvm-fix-stack-out-of-bounds-read-in-write_mmio.patch - bugfix/all/bluetooth-prevent-stack-info-leak-from-the-efs-element.patch - bugfix/all/mm-mmap.c-do-not-blow-on-prot_none-map_fixed-holes-i.patch - bugfix/all/netfilter-nfnetlink_cthelper-add-missing-permission-.patch - bugfix/all/netfilter-xt_osf-add-missing-permission-checks.patch - bugfix/all/nfsd-auth-Fix-gid-sorting-when-rootsquash-enabled.patch * bpf: avoid ABI changes in 4.9.77 and 4.9.79. * Ignore ABI change for cpu_tlbstate (symbol not exported _GPL anymore) * sched/rt: Avoid ABI change in 4.9.66. * Ignore ABI change for tcp_cong_avoid_ai and tcp_slow_start. * RT patchset: - fix context against 4.9.78 (164, 165, 229, 230) - refresh for fuzz (228) * mm: Avoid ABI change in 4.9.79. * usbip: ignore ABI change in 4.9.79. * cpupower: check for CPU existence has been fixed upstream, although a bit differently than the included patch. [ Salvatore Bonaccorso ] * nfsd: auth: Fix gid sorting when rootsquash enabled (CVE-2018-1000028) -- Yves-Alexis Perez <corsac(a)debian.org> Sun, 04 Feb 2018 21:11:44 +0100 --- Modifications pour linux-latest (linux-image-amd64) --- linux-latest (80+deb9u4) stretch-security; urgency=high * Update to 4.9.0-6 -- Yves-Alexis Perez <corsac(a)debian.org> Thu, 22 Feb 2018 08:32:44 +0100 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on quigon.federez.net -- apticron

7 années, 2 mois

BANNED contents (.exe, .exe-ms, lkc Inv Docs293892888 SKMBT 022 FEB.pdf.exe) in mail FROM [122.128.109.39]:40514 <anupam@shubhalakshmi.com>

par Content-filter＠quigon.federez.net

No viruses were found. Banned name: .exe,.exe-ms,lkc Inv Docs293892888 SKMBT 022 FEB.pdf.exe Content type: Banned Internal reference code for the message is 18333-01/ecY8kE6QoFOy First upstream SMTP client IP address: [122.128.109.39] According to a 'Received:' trace, the message apparently originated at: [122.128.109.39], mars.lookeasy.net unknown [122.128.109.39] Return-Path: <anupam(a)shubhalakshmi.com> From: Anupam Agarwal <anupam(a)shubhalakshmi.com> Message-ID: <d387c1d52160c2c8ef53cf54f93a3530(a)shubhalakshmi.com> Subject: AW: RV: TE-50-2017-18(DOCS) INV#..... The message has been quarantined as: e/banned-ecY8kE6QoFOy The message WAS NOT relayed to: <admin(a)federez.net>: 554 5.7.0 Bounce, id=18333-01 - BANNED: .exe,.exe-ms,lkc Inv Docs293892888 SKMBT 022 FEB.pdf.exe

7 années, 2 mois

Cron <root@quigon> /root/scripts/renew_letsencrypt_certificates.sh 1>/dev/null

par root＠quigon.rez-gif.supelec.fr

Failed authorization procedure. wiki-backup.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://wiki-backup.federez.net/.well-known/acme-challenge/xPCmiGzW83gZz1mng…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p", ldap-ro.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://ldap-ro.federez.net/.well-known/acme-challenge/dTP08lMzfKovFYGxQQcP-…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p"

7 années, 2 mois

Cron <root@quigon> /root/scripts/renew_letsencrypt_certificates.sh 1>/dev/null

par root＠quigon.rez-gif.supelec.fr

Failed authorization procedure. wiki-backup.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://wiki-backup.federez.net/.well-known/acme-challenge/kNdjVtGENEkPb6c6T…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p", ldap-ro.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://ldap-ro.federez.net/.well-known/acme-challenge/Ntr4c7_fVvQYfMdPJTO4Y…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p"

7 années, 2 mois

*** SECURITY information for dodecagon.federez.net ***

par chirac＠federez.net

dodecagon.federez.net : Feb 21 03:41:41 : chirac : 1 incorrect password attempt ; TTY=pts/0 ; PWD=/home/chirac ; USER=root ; COMMAND=/bin/su

7 années, 2 mois

Cron <root@dodecagon> /root/scripts/renew_letsencrypt_certificates.sh 1>/dev/null

par root＠federez.net

ssh: connect to host dragon.federez.net port 22: Connection timed out lost connection ssh: connect to host dragon.federez.net port 22: Connection timed out lost connection Impossible de transférer le certificat federez.net vers dragon.federez.net

7 années, 2 mois

Cron <root@dodecagon> obnam --config /etc/obnam/to_kdell.profile backup 1>/dev/null

par root＠federez.net

ssh: connect to host kdell.federez.net port 22: Connection timed out Traceback (most recent call last): File "/usr/lib/python2.7/dist-packages/cliapp/app.py", line 189, in _run self.process_args(args) File "/usr/lib/python2.7/dist-packages/obnamlib/app.py", line 222, in process_args cliapp.Application.process_args(self, args) File "/usr/lib/python2.7/dist-packages/cliapp/app.py", line 589, in process_args method(args[1:]) File "/usr/lib/python2.7/dist-packages/obnamlib/plugins/backup_plugin.py", line 162, in backup self.start_backup() File "/usr/lib/python2.7/dist-packages/obnamlib/plugins/backup_plugin.py", line 199, in start_backup self.repo = self.open_repository() File "/usr/lib/python2.7/dist-packages/obnamlib/plugins/backup_plugin.py", line 224, in open_repository return self.app.get_repository_object(create=True) File "/usr/lib/python2.7/dist-packages/obnamlib/app.py", line 258, in get_repository_object repofs.connect() File "/usr/lib/python2.7/dist-packages/obnamlib/plugins/sftp_plugin.py", line 195, in connect if not try_openssh or not self._connect_openssh(): File "/usr/lib/python2.7/dist-packages/obnamlib/plugins/sftp_plugin.py", line 239, in _connect_openssh self.sftp = paramiko.SFTPClient(SSHChannelAdapter(proc)) File "/usr/lib/python2.7/dist-packages/paramiko/sftp_client.py", line 101, in __init__ raise SSHException('EOF during negotiation') SSHException: EOF during negotiation

7 années, 2 mois

Undelivered Mail Returned to Sender

par MAILER-DAEMON＠nonagon.crans.org

This is the mail system at host nonagon.crans.org. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <monitoring(a)federez.net> (expanded from <root>): host smtp.crans.org[2a06:e042:100:4:200:9ff:fe04:1901] said: 550 5.1.0 <root(a)nonagon.crans.org>: Sender address rejected: User unknown in relay recipient table (in reply to RCPT TO command)

7 années, 2 mois

Cron <root@quigon> /root/scripts/renew_letsencrypt_certificates.sh 1>/dev/null

par root＠quigon.rez-gif.supelec.fr

Failed authorization procedure. ldap-ro.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://ldap-ro.federez.net/.well-known/acme-challenge/iIA58Ep_b11YkYaHoRYzc…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p", wiki-backup.federez.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://wiki-backup.federez.net/.well-known/acme-challenge/4ecl7HeDz9tshaK04…: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p"

7 années, 2 mois

Cron <root@quigon> if test -x /usr/sbin/apticron; then /usr/sbin/apticron --cron; else true; fi

par root＠quigon.rez-gif.supelec.fr

E: Impossible d'obtenir le verrou /var/lib/dpkg/lock - open (11: Ressource temporairement non disponible) E: Impossible de verrouiller le répertoire d'administration (/var/lib/dpkg/). Il est possible qu'un autre processus l'utilise.

7 années, 2 mois

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Monitoring Février 2018