Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.11 upstream stable release
from git://git.kernel.org/
Linux 5.15.11
xen/netback: don't queue unlimited number of packages
xen/netback: fix rx queue stall detection
xen/console: harden hvc_xen against event channel storms
xen/netfront: harden netfront against event channel storms
xen/blkfront: harden blkfront against event channel storms
Revert "xsk: Do not sleep in poll() when need_wakeup set"
selftests/damon: test debugfs file reads/writes with huge count
bus: ti-sysc: Fix variable set but not used warning for reinit_modules
io-wq: drop wqe lock before creating new worker
rcu: Mark accesses to rcu_state.n_force_qs
io-wq: check for wq exit after adding new worker task_work
io-wq: remove spurious bit clear on task_work addition
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
scsi: scsi_debug: Don't call kcalloc() if size arg is zero
ovl: fix warning in ovl_create_real()
fuse: annotate lock in fuse_reverse_inval_entry()
media: mxl111sf: change mutex_init() location
USB: core: Make do_proc_control() and do_proc_bulk() killable
bpf: Fix extable address check.
bpf, x64: Factor out emission of REX byte in more cases
mptcp: add missing documented NL params
xsk: Do not sleep in poll() when need_wakeup set
ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
can: m_can: pci: use custom bit timings for Elkhart Lake
can: m_can: make custom bittiming fields const
Revert "can: m_can: remove support for custom bit timing"
drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
drm/amdgpu: don't override default ECO_BITs setting
drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
powerpc/module_64: Fix livepatching for RO modules
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
perf inject: Fix segfault due to perf_data__fd() without open
perf inject: Fix segfault due to close without open
riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
cifs: sanitize multiple delimiters in prepath
timekeeping: Really make sure wall_to_monotonic isn't positive
serial: 8250_fintek: Fix garbled text for console
iocost: Fix divide-by-zero on donation from low hweight cgroup
zonefs: add MODULE_ALIAS_FS
btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
btrfs: check WRITE_ERR when trying to read an extent buffer
btrfs: fix double free of anon_dev after failure to create subvolume
btrfs: fix memory leak in __add_inode_ref()
selinux: fix sleeping function called from invalid context
USB: serial: option: add Telit FN990 compositions
USB: serial: cp210x: fix CP2105 GPIO registration
usb: gadget: u_ether: fix race in setting MAC address in setup phase
usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
usb: cdnsp: Fix issue in cdnsp_log_ep trace event
usb: cdnsp: Fix incorrect calling of cdnsp_died function
usb: cdnsp: Fix incorrect status for control request
usb: xhci: Extend support for runtime power management for AMD's Yellow carp.
usb: xhci-mtk: fix list_del warning when enable list debug
PCI/MSI: Mask MSI-X vectors only on success
PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
KVM: x86: Drop guest CPUID check for host initiated writes to
MSR_IA32_PERF_CAPABILITIES
Revert "usb: early: convert to readl_poll_timeout_atomic()"
USB: gadget: bRequestType is a bitfield, not a enum
powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
bpf: Fix extable fixup offset.
arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
afs: Fix mmap
sit: do not call ipip6_dev_free() from sit_init_net()
net: systemport: Add global locking for descriptor lifecycle
net/smc: Prevent smc_release() from long blocking
net: Fix double 0x prefix print in SKB dump
dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
sfc_ef100: potential dereference of null pointer
net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
net/packet: rx_owner_map depends on pg_vec
netdevsim: Zero-initialize memory for new map's value in function
nsim_bpf_map_alloc
ixgbe: set X550 MDIO speed before talking to PHY
ixgbe: Document how to enable NBASE-T support
igc: Fix typo in i225 LTR functions
igbvf: fix double free in `igbvf_probe`
igb: Fix removal of unicast MAC filters of VFs
soc/tegra: fuse: Fix bitwise vs. logical OR warning
mptcp: fix deadlock in __mptcp_push_pending()
mptcp: clear 'kern' flag from fallback sockets
mptcp: remove tcp ulp setsockopt support
drm/amd/pm: fix a potential gpu_metrics_table memory leak
drm/amd/display: Set exit_optimized_pwr_state for DCN31
ice: Don't put stale timestamps in the skb
ice: Use div64_u64 instead of div_u64 in adjfine
rds: memory leak in __rds_conn_create()
flow_offload: return EOPNOTSUPP for the unsupported mpls action type
net: stmmac: fix tc flower deletion for VLAN priority Rx steering
mac80211: fix lookup when adding AddBA extension element
cfg80211: Acquire wiphy mutex on regulatory work
mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
drm/i915/display: Fix an unsigned subtraction which can never be negative.
drm/ast: potential dereference of null pointer
mptcp: never allow the PM to close a listener subflow
selftest/net/forwarding: declare NETIFS p9 p10
net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
selftests/net: toeplitz: fix udp option
net/sched: sch_ets: don't remove idle classes from the round-robin list
drm: simpledrm: fix wrong unit with pixel clock
dmaengine: st_fdma: fix MODULE_ALIAS
dmaengine: idxd: fix missed completion on abort path
selftests: Fix IPv6 address bind tests
selftests: Fix raw socket bind tests with VRF
selftests: Add duplicate config only for MD5 VRF tests
net: hns3: fix race condition in debugfs
net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
selftests: icmp_redirect: pass xfail=0 to log_test()
netdevsim: don't overwrite read only ethtool parms
inet_diag: fix kernel-infoleak for UDP sockets
sch_cake: do not call cake_destroy() from cake_init()
s390/kexec_file: fix error handling when applying relocations
selftests: net: Correct ping6 expected rc from 2 to 1
Revert "drm/fb-helper: improve DRM fbdev emulation device names"
vdpa: Consider device id larger than 31
virtio/vsock: fix the transport to work with VMADDR_CID_ANY
virtio: always enter drivers/virtio/
iwlwifi: mvm: don't crash on invalid rate w/o STA
soc: imx: Register SoC device only on i.MX boards
clk: Don't parent clks until the parent is fully registered
arm64: dts: imx8mq: remove interconnect property from lcdif
ARM: socfpga: dts: fix qspi node compatible
ceph: initialize pathlen variable in reconnect_caps_cb
ceph: fix duplicate increment of opened_inodes metric
tee: amdtee: fix an IS_ERR() vs NULL bug
mac80211: track only QoS data frames for admission control
dmaengine: idxd: fix calling wq quiesce inside spinlock
dmaengine: idxd: add halt interrupt support
arm64: dts: rockchip: fix poweroff on helios64
arm64: dts: rockchip: fix audio-supply for Rock Pi 4
arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
pinctrl: amd: Fix wakeups when IRQ is shared with SCI
drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
btrfs: remove stale comment about the btrfs_show_devname
btrfs: update latest_dev when we create a sprout device
btrfs: use latest_dev in btrfs_show_devname
btrfs: convert latest_bdev type to btrfs_device and rename
audit: improve robustness of the audit queue handling
dm btree remove: fix use after free in rebalance_children()
ceph: fix up non-directory creation in SGID directories
arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
recordmcount.pl: look for jgnop instruction as well as bcrl on s390
s390/entry: fix duplicate tracking of irq nesting level
vdpa: check that offsets are within bounds
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
vduse: check that offset is within bounds in get_config()
vduse: fix memory corruption in vduse_dev_ioctl()
bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
bpf, selftests: Add test case trying to taint map value pointer
bpf: Make 32->64 bounds propagation slightly more robust
bpf: Fix signed bounds propagation after mov32
bpf, selftests: Add test case for atomic fetch on spilled pointer
bpf: Fix kernel address leakage in atomic fetch
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
mac80211: validate extended element ID is present
mac80211: send ADDBA requests using the tid/queue of the aggregation session
mac80211: mark TX-during-stop for TX in in_reconfig
mac80211: fix regression in SSN handling of addba tx
mac80211: fix rate control for retransmitted frames
KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
x86/kvm: remove unused ack_notifier callbacks
KVM: downgrade two BUG_ONs to WARN_ON_ONCE
KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
reset: tegra-bpmp: Revert Handle errors in BPMP response
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Confirmed
** Affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: Confirmed
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: Confirmed
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1956302
Title:
Jammy update: v5.15.11 upstream stable release
Status in linux package in Ubuntu:
Confirmed
Status in linux source package in Jammy:
Confirmed
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.11 upstream stable release
from git://git.kernel.org/
Linux 5.15.11
xen/netback: don't queue unlimited number of packages
xen/netback: fix rx queue stall detection
xen/console: harden hvc_xen against event channel storms
xen/netfront: harden netfront against event channel storms
xen/blkfront: harden blkfront against event channel storms
Revert "xsk: Do not sleep in poll() when need_wakeup set"
selftests/damon: test debugfs file reads/writes with huge count
bus: ti-sysc: Fix variable set but not used warning for reinit_modules
io-wq: drop wqe lock before creating new worker
rcu: Mark accesses to rcu_state.n_force_qs
io-wq: check for wq exit after adding new worker task_work
io-wq: remove spurious bit clear on task_work addition
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
scsi: scsi_debug: Don't call kcalloc() if size arg is zero
ovl: fix warning in ovl_create_real()
fuse: annotate lock in fuse_reverse_inval_entry()
media: mxl111sf: change mutex_init() location
USB: core: Make do_proc_control() and do_proc_bulk() killable
bpf: Fix extable address check.
bpf, x64: Factor out emission of REX byte in more cases
mptcp: add missing documented NL params
xsk: Do not sleep in poll() when need_wakeup set
ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
can: m_can: pci: use custom bit timings for Elkhart Lake
can: m_can: make custom bittiming fields const
Revert "can: m_can: remove support for custom bit timing"
drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
drm/amdgpu: don't override default ECO_BITs setting
drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
powerpc/module_64: Fix livepatching for RO modules
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
perf inject: Fix segfault due to perf_data__fd() without open
perf inject: Fix segfault due to close without open
riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
cifs: sanitize multiple delimiters in prepath
timekeeping: Really make sure wall_to_monotonic isn't positive
serial: 8250_fintek: Fix garbled text for console
iocost: Fix divide-by-zero on donation from low hweight cgroup
zonefs: add MODULE_ALIAS_FS
btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
btrfs: check WRITE_ERR when trying to read an extent buffer
btrfs: fix double free of anon_dev after failure to create subvolume
btrfs: fix memory leak in __add_inode_ref()
selinux: fix sleeping function called from invalid context
USB: serial: option: add Telit FN990 compositions
USB: serial: cp210x: fix CP2105 GPIO registration
usb: gadget: u_ether: fix race in setting MAC address in setup phase
usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
usb: cdnsp: Fix issue in cdnsp_log_ep trace event
usb: cdnsp: Fix incorrect calling of cdnsp_died function
usb: cdnsp: Fix incorrect status for control request
usb: xhci: Extend support for runtime power management for AMD's Yellow carp.
usb: xhci-mtk: fix list_del warning when enable list debug
PCI/MSI: Mask MSI-X vectors only on success
PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
KVM: x86: Drop guest CPUID check for host initiated writes to
MSR_IA32_PERF_CAPABILITIES
Revert "usb: early: convert to readl_poll_timeout_atomic()"
USB: gadget: bRequestType is a bitfield, not a enum
powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
bpf: Fix extable fixup offset.
arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
afs: Fix mmap
sit: do not call ipip6_dev_free() from sit_init_net()
net: systemport: Add global locking for descriptor lifecycle
net/smc: Prevent smc_release() from long blocking
net: Fix double 0x prefix print in SKB dump
dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
sfc_ef100: potential dereference of null pointer
net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
net/packet: rx_owner_map depends on pg_vec
netdevsim: Zero-initialize memory for new map's value in function
nsim_bpf_map_alloc
ixgbe: set X550 MDIO speed before talking to PHY
ixgbe: Document how to enable NBASE-T support
igc: Fix typo in i225 LTR functions
igbvf: fix double free in `igbvf_probe`
igb: Fix removal of unicast MAC filters of VFs
soc/tegra: fuse: Fix bitwise vs. logical OR warning
mptcp: fix deadlock in __mptcp_push_pending()
mptcp: clear 'kern' flag from fallback sockets
mptcp: remove tcp ulp setsockopt support
drm/amd/pm: fix a potential gpu_metrics_table memory leak
drm/amd/display: Set exit_optimized_pwr_state for DCN31
ice: Don't put stale timestamps in the skb
ice: Use div64_u64 instead of div_u64 in adjfine
rds: memory leak in __rds_conn_create()
flow_offload: return EOPNOTSUPP for the unsupported mpls action type
net: stmmac: fix tc flower deletion for VLAN priority Rx steering
mac80211: fix lookup when adding AddBA extension element
cfg80211: Acquire wiphy mutex on regulatory work
mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
drm/i915/display: Fix an unsigned subtraction which can never be negative.
drm/ast: potential dereference of null pointer
mptcp: never allow the PM to close a listener subflow
selftest/net/forwarding: declare NETIFS p9 p10
net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
selftests/net: toeplitz: fix udp option
net/sched: sch_ets: don't remove idle classes from the round-robin list
drm: simpledrm: fix wrong unit with pixel clock
dmaengine: st_fdma: fix MODULE_ALIAS
dmaengine: idxd: fix missed completion on abort path
selftests: Fix IPv6 address bind tests
selftests: Fix raw socket bind tests with VRF
selftests: Add duplicate config only for MD5 VRF tests
net: hns3: fix race condition in debugfs
net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
selftests: icmp_redirect: pass xfail=0 to log_test()
netdevsim: don't overwrite read only ethtool parms
inet_diag: fix kernel-infoleak for UDP sockets
sch_cake: do not call cake_destroy() from cake_init()
s390/kexec_file: fix error handling when applying relocations
selftests: net: Correct ping6 expected rc from 2 to 1
Revert "drm/fb-helper: improve DRM fbdev emulation device names"
vdpa: Consider device id larger than 31
virtio/vsock: fix the transport to work with VMADDR_CID_ANY
virtio: always enter drivers/virtio/
iwlwifi: mvm: don't crash on invalid rate w/o STA
soc: imx: Register SoC device only on i.MX boards
clk: Don't parent clks until the parent is fully registered
arm64: dts: imx8mq: remove interconnect property from lcdif
ARM: socfpga: dts: fix qspi node compatible
ceph: initialize pathlen variable in reconnect_caps_cb
ceph: fix duplicate increment of opened_inodes metric
tee: amdtee: fix an IS_ERR() vs NULL bug
mac80211: track only QoS data frames for admission control
dmaengine: idxd: fix calling wq quiesce inside spinlock
dmaengine: idxd: add halt interrupt support
arm64: dts: rockchip: fix poweroff on helios64
arm64: dts: rockchip: fix audio-supply for Rock Pi 4
arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
pinctrl: amd: Fix wakeups when IRQ is shared with SCI
drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
btrfs: remove stale comment about the btrfs_show_devname
btrfs: update latest_dev when we create a sprout device
btrfs: use latest_dev in btrfs_show_devname
btrfs: convert latest_bdev type to btrfs_device and rename
audit: improve robustness of the audit queue handling
dm btree remove: fix use after free in rebalance_children()
ceph: fix up non-directory creation in SGID directories
arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
recordmcount.pl: look for jgnop instruction as well as bcrl on s390
s390/entry: fix duplicate tracking of irq nesting level
vdpa: check that offsets are within bounds
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
vduse: check that offset is within bounds in get_config()
vduse: fix memory corruption in vduse_dev_ioctl()
bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
bpf, selftests: Add test case trying to taint map value pointer
bpf: Make 32->64 bounds propagation slightly more robust
bpf: Fix signed bounds propagation after mov32
bpf, selftests: Add test case for atomic fetch on spilled pointer
bpf: Fix kernel address leakage in atomic fetch
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
mac80211: validate extended element ID is present
mac80211: send ADDBA requests using the tid/queue of the aggregation session
mac80211: mark TX-during-stop for TX in in_reconfig
mac80211: fix regression in SSN handling of addba tx
mac80211: fix rate control for retransmitted frames
KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
x86/kvm: remove unused ack_notifier callbacks
KVM: downgrade two BUG_ONs to WARN_ON_ONCE
KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
reset: tegra-bpmp: Revert Handle errors in BPMP response
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1956302/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
