** CVE removed: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2010-4249
-- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/690730 Title: Maverick update to 2.6.35.10 stable upstream Status in linux package in Ubuntu: Fix Released Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from Linus' tree or in a minimally backported form of that patch. The 2.6.35.10 upstream stable patch set is now available. It should be included in the Ubuntu kernel as well. http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.10 http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.35.10.bz2 The following patches are in the 2.6.35.10 stable release: * block: Ensure physical block size is unsigned int * block: Fix race during disk initialization * block: limit vec count in bio_kmalloc() and bio_alloc_map_data() * block: take care not to overflow when calculating total iov length * block: check for proper length of iov entries in blk_rq_map_user_iov() * drm/radeon/kms: don't disable shared encoders on pre-DCE3 display blocks * jme: Fix PHY power-off error * irda: Fix parameter extraction stack overflow * irda: Fix heap memory corruption in iriap.c * cfg80211: fix BSS double-unlinking * cfg80211: fix locking * cfg80211: fix regression on processing country IEs * mac80211: fix channel assumption for association done work * mac80211: fix offchannel assumption upon association * mac80211: Fix signal strength average initialization for CQM events * mac80211: add helper for reseting the connection monitor * mac80211: reset connection idle when going offchannel * mac80211: make the beacon monitor available externally * mac80211: send last 3/5 probe requests as unicast * mac80211: disable beacon monitor while going offchannel * mac80211: use correct station flags lock * mac80211: clear txflags for ps-filtered frames * mac80211: reset probe send counter upon connection timer reset * mac80211: Fix ibss station got expired immediately * mac80211: don't sanitize invalid rates * mac80211: delete AddBA response timer * isdn/gigaset: fix bas_gigaset AT read error handling * isdn/gigaset: correct bas_gigaset rx buffer handling * isdn/gigaset: bas_gigaset locking fix * i2c-pca-platform: Change device name of request_irq * viafb: fix i2c_transfer error handling * drm/radeon/kms: register an i2c adapter name for the dp aux bus * ALSA: hda - Fix wrong SPDIF NID assignment for CA0110 * ALSA: hda - Add some workarounds for Creative IBG * ALSA: OSS mixer emulation - fix locking * ALSA: HDA: Enable internal mic on Dell E6410 and Dell E6510 * powerpc: Fix call to subpage_protection() * microblaze: Fix build with make 3.82 * NFSv4: Don't call nfs4_reclaim_complete() on receiving NFS4ERR_STALE_CLIENTID * NFSv4: Don't call nfs4_state_mark_reclaim_reboot() from error handlers * NFSv4: Fix open recovery * NFS: Don't SIGBUS if nfs_vm_page_mkwrite races with a cache invalidation * drm/radeon/kms: MC vram map needs to be >= pci aperture size * drm/radeon/kms: properly compute group_size on 6xx/7xx * drm/radeon/kms: make sure blit addr masks are 64 bit * drm/radeon/kms: fix handling of tex lookup disable in cs checker on r2xx * drm/i915: Free hardware status page on unload when physically mapped * drm/i915: diasable clock gating for the panel power sequencer * drm/i915/overlay: Ensure that the reg_bo is in the GTT prior to writing. * pcnet_cs: add new_id * SH: Add missing consts to sys_execve() declaration * reiserfs: fix inode mutex - reiserfs lock misordering * reiserfs: don't acquire lock recursively in reiserfs_acl_chmod * staging: rt2870: Add new USB ID for Belkin F6D4050 v1 * Staging: asus_oled: fix up some sysfs attribute permissions * Staging: asus_oled: fix up my fixup for some sysfs attribute permissions * ALSA: hda: Use hp-laptop quirk to enable headphones automute for Asus A52J * Staging: line6: fix up some sysfs attribute permissions * hpet: fix unwanted interrupt due to stale irq status bit * hpet: unmap unused I/O space * olpc_battery: Fix endian neutral breakage for s16 values * percpu: fix list_head init bug in __percpu_counter_init() * ipmi: proper spinlock initialization * um: remove PAGE_SIZE alignment in linker script causing kernel segfault. * um: fix global timer issue when using CONFIG_NO_HZ * numa: fix slab_node(MPOL_BIND) * hwmon: (lm85) Fix ADT7468 frequency table * oprofile: Fix the hang while taking the cpu offline * mm: fix return value of scan_lru_pages in memory unplug * mm, page-allocator: do not check the state of a non-existant buddy during free * mm: fix is_mem_section_removable() page_order BUG_ON check * agp/intel: Also add B43.1 to list of supported devices * b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd * wireless: b43: fix error path in SDIO * ssb: b43-pci-bridge: Add new vendor for BCM4318 * drivers/misc/ad525x_dpot.c: fix typo in spi write16 and write24 transfer counts * sgi-xpc: XPC fails to discover partitions with all nasids above 128 * xen: ensure that all event channels start off bound to VCPU 0 * xen: don't bother to stop other cpus on shutdown/reboot * ipc: initialize structure memory to zero for compat functions * ipc: shm: fix information leak to userland * net: NETIF_F_HW_CSUM does not imply FCoE CRC offload * drivers/char/vt_ioctl.c: fix VT_OPENQRY error value * viafb: use proper register for colour when doing fill ops * sata_via: apply magic FIFO fix to vt6420 too * eCryptfs: Clear LOOKUP_OPEN flag when creating lower file * ecryptfs: call vfs_setxattr() in ecryptfs_setxattr() * md/raid1: really fix recovery looping when single good device fails. * md: fix return value of rdev_size_change() * ALSA: hda: Use BIOS auto-parsing instead of existing model quirk for MEDION MD2 * tty: prevent DOS in the flush_to_ldisc * TTY: restore tty_ldisc_wait_idle * tty_ldisc: Fix BUG() on hangup * TTY: ldisc, fix open flag handling * usbnet: fix usb_autopm_get_interface failure(v1) * HID: Fix for problems with eGalax/DWAV multi-touch-screen * gspca - sonixj: Fix a regression of sensors hv7131r and mi0360 * hdpvr: Add missing URB_NO_TRANSFER_DMA_MAP flag * drivers/media/video/cx23885/cx23885-core.c: fix cx23885_dev_checkrevision() * KVM: Write protect memory after slot swap * KVM: x86: fix information leak to userland * KVM: Correct ordering of ldt reload wrt fs/gs reload * ASoC: Remove volatility from WM8900 POWER1 register * ASoC: wm8961 - clear WM8961_DACSLOPE bit for normal mode * ASoC: wm8961 - clear WM8961_MCLKDIV bit for freq <= 16500000 * firewire: ohci: fix buffer overflow in AR split packet handling * firewire: ohci: fix race in AR split packet handling * ALSA: hda - Fixed ALC887-VD initial error * ALSA: ac97: Apply quirk for Dell Latitude D610 binding Master and Headphone controls * ALSA: HDA: Add fixup pins for Ideapad Y550 * ALSA: hda - Added fixup for Lenovo Y550P * ALSA: hda: Add speaker pin to automute Acer Aspire 8943G * ALSA: hda: Add Samsung R720 SSID for subwoofer pin fixup * ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization * ALSA: hda - Fix ALC660-VD/ALC861-VD capture/playback mixers * ALSA: HDA: Add an extra DAC for Realtek ALC887-VD * ALSA: Fix SNDCTL_DSP_RESET ioctl for OSS emulation * ALSA: hda: Use "alienware" model quirk for another SSID * netfilter: nf_conntrack: allow nf_ct_alloc_hashtable() to get highmem pages * netfilter: NF_HOOK_COND has wrong conditional * radix-tree: fix RCU bug * latencytop: fix per task accumulator * mm/vfs: revalidate page->mapping in do_generic_file_read() * bio: take care not overflow page count when mapping/copying user data * drm/radeon/kms/atom: set sane defaults in atombios_get_encoder_mode() * drm/radeon/kms: fix typos in disabled vbios code * drm/radeon/kms: add workaround for dce3 ddc line vbios bug * drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once. * drm/radeon/kms: fix interlaced and doublescan handling * exec: make argv/envp memory visible to oom-killer * exec: copy-and-paste the fixes into compat_do_execve() paths * drm/i915/sdvo: Always add a 30ms delay to make SDVO TV detection reliable * intel-gtt: fix gtt_total_entries detection * sched: fix RCU lockdep splat from task_group() * libata: fix NULL sdev dereference race in atapi_qc_complete() * PCI: fix size checks for mmap() on /proc/bus/pci files * PCI: fix offset check for sysfs mmapped files * xHCI: fix wMaxPacketSize mask * xhci: Fix reset-device and configure-endpoint commands * xhci: Setup array of USB 2.0 and USB 3.0 ports. * xhci: Don't let the USB core disable SuperSpeed ports. * USB: gadget: AT91: fix typo in atmel_usba_udc driver * usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time * USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial * USB: option: fix when the driver is loaded incorrectly for some Huawei devices. * usb: misc: sisusbvga: fix information leak to userland * usb: misc: iowarrior: fix information leak to userland * usb: core: fix information leak to userland * Staging: rt2870: Add USB ID for Buffalo Airstation WLI-UC-GN * USB: EHCI: fix obscure race in ehci_endpoint_disable * USB: storage: sierra_ms: fix sysfs file attribute * USB: atm: ueagle-atm: fix up some permissions on the sysfs files * USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions * USB: misc: usbled: fix up some sysfs attribute permissions * USB: misc: trancevibrator: fix up a sysfs attribute permission * USB: misc: usbsevseg: fix up some sysfs attribute permissions * USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable * USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added * USB: fix autosuspend bug in usb-serial * e1000: fix screaming IRQ * ACPI battery: support percentage battery remaining capacity * acpi-cpufreq: fix a memleak when unloading driver * ACPI: debugfs custom_method open to non-root * PNPACPI: cope with invalid device IDs * saa7134: Fix autodetect for Behold A7 and H7 TV cards * fuse: fix attributes after open(O_TRUNC) * cs5535-gpio: apply CS5536 errata workaround for GPIOs * do_exit(): make sure that we run with get_fs() == USER_DS * cifs: fix another memleak, in cifs_root_iget * uml: disable winch irq before freeing handler data * backlight: grab ops_lock before testing bd->ops * nommu: yield CPU while disposing VM * x86: Ignore trap bits on single step exceptions * mmc: fix rmmod race for hosts using card-detection polling * DECnet: don't leak uninitialized stack byte * perf_events: Fix perf_counter_mmap() hook in mprotect() * ARM: 6464/2: fix spinlock recursion in adjust_pte() * ARM: 6489/1: thumb2: fix incorrect optimisation in usracc * ARM: 6482/2: Fix find_next_zero_bit and related assembly * leds: fix bug with reading NAS SS4200 dmi code * Staging: udlfb: fix up some sysfs attribute permissions * Staging: iio: adis16220: fix up some sysfs attribute permissions * Staging: iio: adis16220: fix up my fixup for some sysfs attribute permissions * Staging: samsung-laptop: fix up some sysfs attribute permissions * Staging: samsung-laptop: fix up my fixup for some sysfs attribute permissions * Staging: frontier: fix up some sysfs attribute permissions * staging: rtl8187se: Change panic to warn when RF switch turned off * Staging: batman-adv: ensure that eth_type_trans gets linear memory * perf: Fix inherit vs. context rotation bug * ARM: 6456/1: Fix for building DEBUG with sa11xx_base.c as a module. * PM / Hibernate: Fix memory corruption related to swap * wmi: use memcmp instead of strncmp to compare GUIDs * nohz/s390: fix arch_needs_cpu() return value on offline cpus * genirq: Fix incorrect proc spurious output * net: Truncate recvfrom and sendto length to INT_MAX. * net: Limit socket I/O iovec total length to INT_MAX. * Input: i8042 - add Sony VAIO VPCZ122GX to nomux list * omap: dma: Fix buffering disable bit setting for omap24xx * OMAP3: DMA: Errata i541: sDMA FIFO draining does not finish * memory corruption in X.25 facilities parsing * net: optimize Berkeley Packet Filter (BPF) processing * filter: make sure filters dont read uninitialized memory * can-bcm: fix minor heap overflow * x25: Prevent crashing when parsing bad X.25 facilities * crypto: padlock - Fix AES-CBC handling on odd-block-sized input * econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849 * econet: fix CVE-2010-3850 * econet: fix CVE-2010-3848 * rds: Integer overflow in RDS cmsg handling * cfg80211: fix extension channel checks to initiate communication * r8169: fix rx checksum offload * r8169: (re)init phy on resume * r8169: fix checksum broken * nmi: fix clock comparator revalidation * Rename 'pipe_info()' to 'get_pipe_info()' * Export 'get_pipe_info()' to other users * Un-inline get_pipe_info() helper function * Fix pktcdvd ioctl dev_minor range check * Release 2.6.35.10 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/690730/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
