linux (4.19.16-1) unstable; urgency=medium

linux (4.19.16-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.14
    - ax25: fix a use-after-free in ax25_fillin_cb()
    - gro_cell: add napi_disable in gro_cells_destroy
    - ip6mr: Fix potential Spectre v1 vulnerability
    - ipv4: Fix potential Spectre v1 vulnerability
    - ipv6: explicitly initialize udp6_addr in udp_sock_create6()
    - ipv6: tunnels: fix two use-after-free
    - ip: validate header length on virtual device xmit
    - isdn: fix kernel-infoleak in capi_unlocked_ioctl
    - net/wan: fix a double free in x25_asy_open_tty()
    - packet: validate address length
    - packet: validate address length if non-zero
    - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
    - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
    - tipc: compare remote and local protocols in tipc_udp_enable()
    - tipc: fix a double free in tipc_enable_bearer()
    - tipc: fix a double kfree_skb()
    - ipv6: frags: Fix bogus skb->sk in reassembled packets
    - ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create()
      error
    - ALSA: rme9652: Fix potential Spectre v1 vulnerability
    - ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
    - ALSA: pcm: Fix potential Spectre v1 vulnerability
    - ALSA: emux: Fix potential Spectre v1 vulnerabilities
    - powerpc/fsl: Fix spectre_v2 mitigations reporting
    - usb: r8a66597: Fix a possible concurrency use-after-free bug in
      r8a66597_endpoint_disable()
    - [s390x] s390/pci: fix sleeping in atomic during hotplug
    - [x86] x86/speculation/l1tf: Drop the swap storage limit restriction when
      l1tf=off
    - [x86] x86/mm: Drop usage of __flush_tlb_all() in
      kernel_physical_mapping_init()
    - [x86] KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
    - [arm64] arm64: KVM: Make VHE Stage-2 TLB invalidation operations
      non-interruptible
    - perf pmu: Suppress potential format-truncation warning
    - perf env: Also consider env->arch == NULL as local operation
    - ext4: fix possible use after free in ext4_quota_enable
    - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
    - ext4: include terminating u32 in size of xattr entries when expanding
      inodes
    - ext4: force inode writes when nfsd calls commit_metadata()
    - ext4: check for shutdown and r/o file system in ext4_write_inode()
    - [armhf,arm64] spi: bcm2835: Fix race on DMA termination
    - [armhf,arm64] spi: bcm2835: Fix book-keeping of DMA termination
    - [armhf,arm64] spi: bcm2835: Avoid finishing transfer prematurely in IRQ
      mode
    - btrfs: dev-replace: go back to suspended state if target device is missing
    - btrfs: dev-replace: go back to suspend state if another EXCL_OP is running
    - btrfs: skip file_extent generation check for free_space_inode in
      run_delalloc_nocow
    - Btrfs: fix fsync of files with multiple hard links in new directories
    - btrfs: run delayed items before dropping the snapshot
    - Btrfs: send, fix race with transaction commits that create snapshots
    - brcmfmac: Fix out of bounds memory access during fw load
    - dax: Don't access a freed inode
    - f2fs: read page index before freeing
    - f2fs: sanity check of xattr entry size
    - media: imx274: fix stack corruption in imx274_read_reg
    - media: v4l2-tpg: array index could become negative
    - tools lib traceevent: Fix processing of dereferenced args in bprintk
      events
    - [mips*] MIPS: math-emu: Write-protect delay slot emulation pages
    - [mips*] MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
    - [mips*] MIPS: Align kernel load address to 64KB
    - [mips*] MIPS: Expand MIPS32 ASIDs to 64 bits
    - CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock
      problem
    - smb3: fix large reads on encrypted connections
    - [arm*] KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum
    - [arm*] KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring
      state
    - [arm*] KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.15
    - IB/core: Fix oops in netdev_next_upper_dev_rcu()
    - xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force
      clears the dst_entry.
    - ieee802154: hwsim: fix off-by-one in parse nested
    - netfilter: seqadj: re-load tcp header pointer after possible head
      reallocation
    - scsi: bnx2fc: Fix NULL dereference in error handling
    - [ppc64el] ibmvnic: Convert reset work item mutex to spin lock
    - [ppc64el] ibmvnic: Fix non-atomic memory allocation in IRQ context
    - [x86] x86/mm: Fix guard hole handling
    - i40e: fix mac filter delete when setting mac address
    - ixgbe: Fix race when the VF driver does a reset
    - netfilter: nat: can't use dst_hold on noref dst
    - bnx2x: Clear fip MAC when fcoe offload support is disabled
    - bnx2x: Remove configured vlans as part of unload sequence.
    - bnx2x: Send update-svid ramrod with retry/poll flags enabled
    - mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues
    - [x86] x86, hyperv: remove PCI dependency
    - [arm64] net: hns: All ports can not work when insmod hns ko after rmmod.
    - [arm64] net: hns: Fixed bug that netdev was opened twice
    - [arm64] net: hns: Clean rx fbd when ae stopped.
    - [arm64] net: hns: Avoid net reset caused by pause frames storm
    - [arm64] net: hns: Add mac pcs config when enable|disable mac
    - [arm64] net: hns: Fix ping failed when use net bridge and send multicast
    - mac80211: fix a kernel panic when TXing after TXQ teardown
    - [arm64,riscv64] net: macb: fix random memory corruption on RX with
      64-bit DMA
    - [arm64.risvv64] net: macb: fix dropped RX frames due to a race
    - lan78xx: Resolve issue with changing MAC address
    - [s390x] scsi: zfcp: fix posting too many status read buffers leading to
      adapter shutdown
    - fork: record start_time late
    - zram: fix double free backing device
    - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
    - mm, devm_memremap_pages: kill mapping "System RAM" support
    - memcg, oom: notify on oom killer invocation from the charge path
    - mt76x0: init hw capabilities
    - [amd64] media: cx23885: only reset DMA on problematic CPUs
    - ALSA: cs46xx: Potential NULL dereference in probe
    - ALSA: usb-audio: Avoid access before bLength check in
      build_audio_procunit()
    - ALSA: usb-audio: Check mixer unit descriptors more strictly
    - ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
    - ALSA: usb-audio: Always check descriptor sizes in parser code
    - Fix failure path in alloc_pid()
    - block: deactivate blk_stat timer in wbt_disable_default()
    - gfs2: Get rid of potential double-freeing in gfs2_create_inode
    - gfs2: Fix loop in gfs2_rbm_find
    - b43: Fix error in cordic routine
    - nfsd4: zero-length WRITE should succeed
    - [ppc*] powerpc/tm: Set MSR[TS] just prior to recheckpoint
    - RDMA/srpt: Fix a use-after-free in the channel release code
    - sched/fair: Fix infinite loop in update_blocked_averages() by reverting
      a9e7f6544b9c
    - [s390x] genwqe: Fix size check
    - [x86] intel_th: msu: Fix an off-by-one in attribute store
    - [armhf,arm64] drm/rockchip: psr: do not dereference encoder before it is
      null checked.
    - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16
    - Btrfs: fix deadlock when using free space tree due to block group
      creation
    - staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption
    - staging: rtl8188eu: Fix module loading from tasklet for WEP encryption
    - cpufreq: scmi: Fix frequency invariance in slow path
    - [x86] modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
    - ALSA: hda/realtek - Support Dell headset mode for New AIO platform
    - ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode
      for ALC225
    - ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
    - CIFS: Fix adjustment of credits for MTU requests
    - CIFS: Do not set credits to 1 if the server didn't grant anything
    - CIFS: Do not hide EINTR after sending network packets
    - CIFS: Fix credit computation for compounded requests
    - cifs: Fix potential OOB access of lock element array
    - usb: cdc-acm: send ZLP for Telit 3G Intel based modems
    - USB: storage: don't insert sane sense for SPC3+ when bad sense specified
    - USB: storage: add quirk for SMI SM3350
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
    - slab: alien caches must not be initialized if the allocation of the alien
      cache failed
    - mm/usercopy.c: no check page span for stack objects
    - mm, memcg: fix reclaim deadlock with writeback
    - ACPI: power: Skip duplicate power resource references in _PRx
    - ACPI / PMIC: xpower: Fix TS-pin current-source handling
    - ACPI/IORT: Fix rc_dma_get_range()
    - i2c: dev: prevent adapter retries and timeout being set as minus value
    - vfio/type1: Fix unmap overflow off-by-one
    - drm/amdgpu: Add new VegaM pci id
    - PCI: dwc: Use interrupt masking instead of disabling
    - PCI: dwc: Take lock when ACKing an interrupt
    - PCI: dwc: Move interrupt acking into the proper callback
    - drm/amd/display: Fix MST dp_blank REG_WAIT timeout
    - drm/fb_helper: Allow leaking fbdev smem_start
    - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
    - [x86] drm/i915: Unwind failure on pinning the gen7 ppgtt
    - drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume()
    - drm/amdgpu: Don't fail resume process if resuming atomic state fails
    - rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
    - ext4: make sure enough credits are reserved for dioread_nolock writes
    - ext4: fix a potential fiemap/page fault deadlock w/ inline_data
    - ext4: avoid kernel warning when writing the superblock to a dead device
    - ext4: use ext4_write_inode() when fsyncing w/o a journal
    - ext4: track writeback errors using the generic tracking infrastructure
    - ext4: fix special inode number checks in __ext4_iget()
    - mm: page_mapped: don't assume compound page is huge or THP
    - sunrpc: use-after-free in svc_process_common()
    - [armhf,arm64] KVM: Fix VMID alloc race by reverting to lock-less
    - [arm64] compat: Don't pull syscall number from regs in arm_compat_syscall
    - Btrfs: fix access to available allocation bits when starting balance
    - Btrfs: fix deadlock when enabling quotas due to concurrent snapshot
      creation
    - Btrfs: use nofs context when initializing security xattrs to avoid
      deadlock

  [ John Paul Adrian Glaubitz ]
  * [m68k] Add patch to build with -ffreestanding to fix FTBFS

  [ Ben Hutchings ]
  * [ia64,m68k] libbpf: Really don't build on architectures without perf events
  * Use dh_listpackages to determine which packages to build
  * Add pkg.linux.nokernel build profile that excludes kernel image and header
    packages

  [ Yves-Alexis Perez ]
  * Bump ABI to 2 because of changes in struct sock_common from 60f05dddf1eb
  * [rt] Update to 4.19.15-rt12
    - rtmutex/rwlock: preserve state like a sleeping lock

  [ Salvatore Bonaccorso ]
  * ipv6: Consider sk_bound_dev_if when binding a socket to an address
    (Closes: #918103)
  * posix-cpu-timers: Unbreak timer rearming (Closes: #919019, #919049)

  [ Michal Simek ]
  * [arm64] Enable Xilinx ZynqMP SoC and drivers

  [ YunQiang Su ]
  * [mipsel, mips64el] Enable DRM_AST and FB_SM750 for loongson-3
    install ast and sm750fb to loongson-3's fb-modules

  [ Romain Perier ]
  * [rt] Update to 4.19.13-rt10

  [ Luigi Baldoni ]
  * [x86] Enable LEDS_APU to support leds on PC Engines
    APU SBC series

[dgit import unpatched linux 4.19.16-1]