** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.149 upstream stable release
from git://git.kernel.org/
-
+ ksmbd: free ppace array on error in parse_dacl
+ ksmbd: don't allow O_TRUNC open on read-only share
+ ksmbd: validate mech token in session setup
+ ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
+ ksmbd: only v2 leases handle the directory
+ iio: adc: ad7091r: Set alert bit in config register
+ iio: adc: ad7091r: Allow users to configure device events
+ iio: adc: ad7091r: Enable internal vref if external vref is not supplied
+ dmaengine: fix NULL pointer in channel unregistration function
+ scsi: ufs: core: Simplify power management during async scan
+ scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
+ iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
+ ext4: allow for the last group to be marked as trimmed
+ btrfs: sysfs: validate scrub_speed_max value
+ crypto: api - Disallow identical driver names
+ PM: hibernate: Enforce ordering during image compression/decompression
+ hwrng: core - Fix page fault dead lock on mmap-ed hwrng
+ crypto: s390/aes - Fix buffer overread in CTR mode
+ media: imx355: Enable runtime PM before registering async sub-device
+ rpmsg: virtio: Free driver_override when rpmsg_remove()
+ media: ov9734: Enable runtime PM before registering async sub-device
+ mips: Fix max_mapnr being uninitialized on early stages
+ bus: mhi: host: Drop chan lock before queuing buffers
+ bus: mhi: host: Add spinlock to protect WP access when queueing TREs
+ parisc/firmware: Fix F-extend for PDC addresses
+ async: Split async_schedule_node_domain()
+ async: Introduce async_schedule_dev_nocall()
+ arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
+ arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
+ arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
+ arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
+ lsm: new security_file_ioctl_compat() hook
+ scripts/get_abi: fix source path leak
+ mmc: core: Use mrq.sbc in close-ended ffu
+ mmc: mmc_spi: remove custom DMA mapped buffers
+ rtc: Adjust failure return code for cmos_set_alarm()
+ nouveau/vmm: don't set addr on the fail path to avoid warning
+ ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
+ rename(): fix the locking of subdirectories
+ ksmbd: set v2 lease version on lease upgrade
+ ksmbd: fix potential circular locking issue in smb2_set_ea()
+ ksmbd: don't increment epoch if current state and request state are same
+ ksmbd: send lease break notification on FILE_RENAME_INFORMATION
+ ksmbd: Add missing set_freezable() for freezable kthread
+ net/smc: fix illegal rmb_desc access in SMC-D connection dump
+ tcp: make sure init the accept_queue's spinlocks once
+ bnxt_en: Wait for FLR to complete during probe
+ vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
+ llc: make llc_ui_sendmsg() more robust against bonding changes
+ llc: Drop support for ETH_P_TR_802_2.
+ net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
+ tracing: Ensure visibility when inserting an element into tracing_map
+ afs: Hide silly-rename files from userspace
+ tcp: Add memory barrier to tcp_push()
+ netlink: fix potential sleeping issue in mqueue_flush_file
+ ipv6: init the accept_queue's spinlocks in inet6_create
+ net/mlx5: DR, Use the right GVMI number for drop action
+ net/mlx5: DR, Align mlx5dv_dr API vport action with FW behavior
+ net/mlx5: DR, Can't go to uplink vport on RX rule
+ net/mlx5e: fix a double-free in arfs_create_groups
+ net/mlx5e: fix a potential double-free in fs_any_create_groups
+ overflow: Allow mixed type arguments
+ netfilter: nft_limit: reject configurations that cause integer overflow
+ netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
+ netfilter: nf_tables: validate NFPROTO_* family
+ net: stmmac: Wait a bit for the reset to take effect
+ net: mvpp2: clear BM pool before initialization
+ selftests: netdevsim: fix the udp_tunnel_nic test
+ fjes: fix memleaks in fjes_hw_setup
+ net: fec: fix the unhandled context fault from smmu
+ btrfs: fix infinite directory reads
+ btrfs: set last dir index to the current last index when opening dir
+ btrfs: refresh dir last index during a rewinddir(3) call
+ btrfs: fix race between reading a directory and adding entries to it
+ btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
being deleted
+ btrfs: ref-verify: free ref cache before clearing mount opt
+ btrfs: tree-checker: fix inline ref size in error messages
+ btrfs: don't warn if discard range is not aligned to sector
+ btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
+ btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
+ rbd: don't move requests to the running list on errors
+ exec: Fix error handling in begin_new_exec()
+ wifi: iwlwifi: fix a memory corruption
+ hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
+ netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
basechain
+ firmware: arm_scmi: Check mailbox/SMT channel for consistency
+ xfs: read only mounts with fsopen mount API are busted
+ gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
+ drm: Don't unref the same fb many times by mistake due to deadlock handling
+ drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
+ drm/tidss: Fix atomic_flush check
+ drm/bridge: nxp-ptn3460: simplify some error checking
+ PM: core: Remove unnecessary (void *) conversions
+ PM: sleep: Fix possible deadlocks in core system-wide PM code
+ bus: mhi: host: Rename "struct mhi_tre" to "struct mhi_ring_element"
+ bus: mhi: host: Add alignment check for event ring read pointer
+ fs/pipe: move check to pipe_has_watch_queue()
+ pipe: wakeup wr_wait after setting max_usage
+ ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
+ ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
+ ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
+ ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
+ ARM: dts: qcom: sdx55: fix USB SS wakeup
+ media: mtk-jpeg: Fix use after free bug due to error path handling in
mtk_jpeg_dec_device_run
+ mm: use __pfn_to_section() instead of open coding it
+ mm/sparsemem: fix race in accessing memory_section->usage
+ PM / devfreq: Fix buffer overflow in trans_stat_show
+ btrfs: add definition for EXTENT_TREE_V2
+ ksmbd: fix global oob in ksmbd_nl_policy
+ cpufreq: intel_pstate: Drop redundant intel_pstate_get_hwp_cap() call
+ cpufreq: intel_pstate: Refine computation of P-state for given frequency
+ drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
+ drm/exynos: fix accidental on-stack copy of exynos_drm_plane
+ drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
+ gpio: eic-sprd: Clear interrupt after set the interrupt type
+ spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
+ mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
+ tick/sched: Preserve number of idle sleeps across CPU hotplug events
+ x86/entry/ia32: Ensure s32 is sign extended to s64
+ powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
+ arm64: irq: set the correct node for VMAP stack
+ drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
+ powerpc: Fix build error due to is_valid_bugaddr()
+ powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
+ powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
+ x86/boot: Ignore NMIs during very early boot
+ powerpc: pmd_move_must_withdraw() is only needed for
CONFIG_TRANSPARENT_HUGEPAGE
+ powerpc/lib: Validate size for vector operations
+ x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
+ perf/core: Fix narrow startup race when creating the perf nr_addr_filters
sysfs file
+ debugobjects: Stop accessing objects after releasing hash bucket lock
+ regulator: core: Only increment use_count when enable_count changes
+ audit: Send netlink ACK before setting connection in auditd_set
+ ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
+ PNP: ACPI: fix fortify warning
+ ACPI: extlog: fix NULL pointer dereference check
+ PM / devfreq: Synchronize devfreq_monitor_[start/stop]
+ ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
events
+ FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
+ UBSAN: array-index-out-of-bounds in dtSplitRoot
+ jfs: fix slab-out-of-bounds Read in dtSearch
+ jfs: fix array-index-out-of-bounds in dbAdjTree
+ jfs: fix uaf in jfs_evict_inode
+ pstore/ram: Fix crash when setting number of cpus to an odd number
+ crypto: octeontx2 - Fix cptvf driver cleanup
+ crypto: stm32/crc32 - fix parsing list of devices
+ afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
+ afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
+ rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
+ jfs: fix array-index-out-of-bounds in diNewExt
+ arch: consolidate arch_irq_work_raise prototypes
+ s390/ptrace: handle setting of fpc register correctly
+ KVM: s390: fix setting of fpc register
+ SUNRPC: Fix a suspicious RCU usage warning
+ ecryptfs: Reject casefold directory inodes
+ ext4: fix inconsistent between segment fstrim and full fstrim
+ ext4: unify the type of flexbg_size to unsigned int
+ ext4: remove unnecessary check from alloc_flex_gd()
+ ext4: avoid online resizing failures due to oversized flex bg
+ wifi: rt2x00: restart beacon queue when hardware reset
+ selftests/bpf: satisfy compiler by having explicit return in btf test
+ selftests/bpf: Fix pyperf180 compilation failure with clang18
+ selftests/bpf: Fix issues in setup_classid_environment()
+ scsi: lpfc: Fix possible file string name overflow when updating firmware
+ PCI: Add no PM reset quirk for NVIDIA Spectrum devices
+ bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
+ scsi: arcmsr: Support new PCI device IDs 1883 and 1886
+ ARM: dts: imx7d: Fix coresight funnel ports
+ ARM: dts: imx7s: Fix lcdif compatible
+ ARM: dts: imx7s: Fix nand-controller #size-cells
+ wifi: ath9k: Fix potential array-index-out-of-bounds read in
ath9k_htc_txstatus()
+ bpf: Add map and need_defer parameters to .map_fd_put_ptr()
+ scsi: libfc: Don't schedule abort twice
+ scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
+ bpf: Set uattr->batch.count as zero before batched update or deletion
+ ARM: dts: rockchip: fix rk3036 hdmi ports node
+ ARM: dts: imx25/27-eukrea: Fix RTC node name
+ ARM: dts: imx: Use flash@0,0 pattern
+ ARM: dts: imx27: Fix sram node
+ ARM: dts: imx1: Fix sram node
+ ionic: pass opcode to devcmd_wait
+ block/rnbd-srv: Check for unlikely string overflow
+ ARM: dts: imx25: Fix the iim compatible string
+ ARM: dts: imx25/27: Pass timing0
+ ARM: dts: imx27-apf27dev: Fix LED name
+ ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
+ ARM: dts: imx23/28: Fix the DMA controller node name
+ net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
+ block: prevent an integer overflow in bvec_try_merge_hw_page
+ md: Whenassemble the array, consult the superblock of the freshest device
+ arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
+ arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
+ wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
+ libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
+ ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
+ wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
+ wifi: cfg80211: free beacon_ies when overridden from hidden BSS
+ Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
+ Bluetooth: L2CAP: Fix possible multiple reject send
+ bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
+ i40e: Fix VF disable behavior to block all traffic
+ octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
+ f2fs: fix to check return value of f2fs_reserve_new_block()
+ ALSA: hda: Refer to correct stream index at loops
+ ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
+ fast_dput(): handle underflows gracefully
+ RDMA/IPoIB: Fix error code return in ipoib_mcast_join
+ drm/amd/display: Fix tiled display misalignment
+ f2fs: fix write pointers on zoned device after roll forward
+ drm/drm_file: fix use of uninitialized variable
+ drm/framebuffer: Fix use of uninitialized variable
+ drm/mipi-dsi: Fix detach call without attach
+ media: stk1160: Fixed high volume of stk1160_dbg messages
+ media: rockchip: rga: fix swizzling for RGB formats
+ PCI: add INTEL_HDA_ARL to pci_ids.h
+ ALSA: hda: Intel: add HDA_ARL PCI ID support
+ ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
+ media: rkisp1: Drop IRQF_SHARED
+ f2fs: fix to tag gcing flag on page during block migration
+ drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
+ IB/ipoib: Fix mcast list locking
+ media: ddbridge: fix an error code problem in ddb_probe
+ media: i2c: imx335: Fix hblank min/max values
+ drm/msm/dpu: Ratelimit framedone timeout msgs
+ drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
+ clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
+ clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
+ watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
+ clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
+ clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
+ drm/amdgpu: Let KFD sync with VM fences
+ drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
+ ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
+ leds: trigger: panic: Don't register panic notifier if creating the trigger
failed
+ um: Fix naming clash between UML and scheduler
+ um: Don't use vfprintf() for os_info()
+ um: net: Fix return type of uml_net_start_xmit()
+ um: time-travel: fix time corruption
+ i3c: master: cdns: Update maximum prescaler value for i2c clock
+ xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
+ mfd: ti_am335x_tscadc: Fix TI SoC dependencies
+ UBUNTU: [Config] updateconfigs for MFD_TI_AM335X_TSCADC
+ mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
+ PCI: Only override AMD USB controller if required
+ PCI: switchtec: Fix stdev_release() crash after surprise hot remove
+ perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
+ usb: hub: Replace hardcoded quirk value with BIT() macro
+ selftests/sgx: Fix linker script asserts
+ tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
+ fs/kernfs/dir: obey S_ISGID
+ PCI: Fix 64GT/s effective data rate calculation
+ PCI/AER: Decode Requester ID when no error info found
+ libsubcmd: Fix memory leak in uniq()
+ drm/amdkfd: Fix lock dependency warning
+ virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region
of size 10" warnings
+ blk-mq: fix IO hang from sbitmap wakeup race
+ ceph: fix deadlock or deadcode of misusing dget()
+ drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
'get_platform_power_management_table()'
+ drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
+ drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
+ perf: Fix the nr_addr_filters fix
+ wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
+ drm: using mul_u32_u32() requires linux/math64.h
+ scsi: isci: Fix an error code problem in isci_io_request_build()
+ scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
+ selftests: net: give more time for GRO aggregation
+ ip6_tunnel: use dev_sw_netstats_rx_add()
+ ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
+ tcp: add sanity checks to rx zerocopy
+ ixgbe: Remove non-inclusive language
+ ixgbe: Refactor returning internal error codes
+ ixgbe: Refactor overtemp event handling
+ ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
+ ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
+ llc: call sock_orphan() at release time
+ bridge: mcast: fix disabled snooping after long uptime
+ netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
+ netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
+ netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
expectations
+ net: ipv4: fix a memleak in ip_setup_cork
+ af_unix: fix lockdep positive in sk_diag_dump_icons()
+ UBUNTU: SAUCE: apparmor: update unix_state_double_lock implementation
+ selftests: net: fix available tunnels detection
+ net: sysfs: Fix /sys/class/net/<iface> path
+ arm64: irq: set the correct node for shadow call stack
+ gve: Fix use-after-free vulnerability
+ HID: apple: Add support for the 2021 Magic Keyboard
+ HID: apple: Add 2021 magic keyboard FN key mapping
+ bonding: remove print in bond_verify_device_path
+ ASoC: codecs: lpass-wsa-macro: fix compander volume hack
+ dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
+ dmaengine: ti: k3-udma: Report short packet errors
+ dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
+ dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
+ phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
+ dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
+ phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
+ drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
+ net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
+ selftests: net: cut more slack for gro fwd tests.
+ selftests: net: avoid just another constant wait
+ tunnels: fix out of bounds access when building IPv6 PMTU error
+ atm: idt77252: fix a memleak in open_card_ubr0
+ octeontx2-pf: Fix a memleak otx2_sq_init
+ hwmon: (aspeed-pwm-tacho) mutex for tach reading
+ hwmon: (coretemp) Fix out-of-bounds memory access
+ hwmon: (coretemp) Fix bogus core_id to attr name mapping
+ inet: read sk->sk_family once in inet_recv_error()
+ rxrpc: Fix response to PING RESPONSE ACKs to a dead call
+ tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
+ af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
+ ppp_async: limit MRU to 64K
+ netfilter: nft_compat: reject unused compat flag
+ netfilter: nft_compat: restrict match/target protocol to u16
+ drm/amd/display: Fix multiple memory leaks reported by coverity
+ drm/amd/display: Implement bounds check for stream encoder creation in DCN301
+ netfilter: nft_ct: reject direction for ct id
+ netfilter: nft_set_pipapo: store index in scratch maps
+ netfilter: nft_set_pipapo: add helper to release pcpu scratch area
+ netfilter: nft_set_pipapo: remove scratch_aligned pointer
+ fs/ntfs3: Fix an NULL dereference bug
+ scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
+ blk-iocost: Fix an UBSAN shift-out-of-bounds warning
+ drivers: lkdtm: fix clang -Wformat warning
+ ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
+ USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
+ USB: serial: option: add Fibocom FM101-GL variant
+ USB: serial: cp210x: add ID for IMST iM871A-USB
+ usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
+ usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
+ hrtimer: Report offline hrtimer enqueue
+ Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
+ Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
+ clocksource: Skip watchdog check for large watchdog intervals
+ net: stmmac: xgmac: use #define for string constants
+ net: stmmac: xgmac: fix a typo of register name in DPP safety handling
+ btrfs: forbid creating subvol qgroups
+ btrfs: forbid deleting live subvol qgroup
+ btrfs: send: return EOPNOTSUPP on unknown flags
+ of: unittest: Fix compile in the non-dynamic case
+ wifi: iwlwifi: Fix some error codes
+ net: openvswitch: limit the number of recursions from action sets
+ spi: ppc4xx: Drop write-only variable
+ ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
+ net: sysfs: Fix /sys/class/net/<iface> path for statistics
+ MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
+ i40e: Fix waiting for queues of all VSIs to be disabled
+ scs: add CONFIG_MMU dependency for vfree_atomic()
+ tracing/trigger: Fix to return error if failed to alloc snapshot
+ mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
+ scsi: storvsc: Fix ring buffer size calculation
+ ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1
SF114-32
+ ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
+ HID: i2c-hid-of: fix NULL-deref on failed power up
+ HID: wacom: generic: Avoid reporting a serial of '0' to userspace
+ HID: wacom: Do not register input devices until after hid_hw_start
+ iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
+ usb: ucsi_acpi: Fix command completion handling
+ USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
+ usb: f_mass_storage: forbid async queue when shutdown happen
+ usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
+ media: ir_toy: fix a memleak in irtoy_tx
+ powerpc/kasan: Fix addr error caused by page alignment
+ i2c: i801: Remove i801_set_block_buffer_mode
+ i2c: i801: Fix block process call transactions
+ modpost: trim leading spaces when processing source files list
+ mptcp: fix data re-injection from stale subflow
+ scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
+ Revert "drm/amd: flush any delayed gfxoff on suspend entry"
+ firewire: core: correct documentation of fw_csr_string() kernel API
+ kbuild: Fix changing ELF file type for output of gen_btf for big endian
+ nfc: nci: free rx_data_reassembly skb on NCI device cleanup
+ net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
+ xen-netback: properly sync TX responses
+ ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
+ ASoC: codecs: wcd938x: handle deferred probe
+ binder: signal epoll threads of self-work
+ misc: fastrpc: Mark all sessions as invalid in cb_remove
+ ext4: fix double-free of blocks due to wrong extents moved_len
+ tracing: Fix wasted memory in saved_cmdlines logic
+ staging: iio: ad5933: fix type mismatch regression
+ iio: magnetometer: rm3100: add boundary check for the value read from
RM3100_REG_TMRC
+ iio: core: fix memleak in iio_device_register_sysfs
+ iio: accel: bma400: Fix a compilation problem
+ media: rc: bpf attach/detach requires write permission
+ drm/prime: Support page array >= 4GB
+ hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
+ ring-buffer: Clean ring_buffer_poll_wait() error return
+ serial: max310x: set default value when reading clock ready bit
+ serial: max310x: improve crystal stable clock detection
+ serial: max310x: fail probe if clock crystal is unstable
+ powerpc/64: Set task pt_regs->link to the LR value on scv entry
+ x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
+ x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
+ mmc: slot-gpio: Allow non-sleeping GPIO ro
+ ALSA: hda/conexant: Add quirk for SWS JS201D
+ nilfs2: fix data corruption in dsync block recovery for small block sizes
+ nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
+ crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
+ nfp: use correct macro for LengthSelect in BAR config
+ nfp: flower: prevent re-adding mac index for bonded port
+ wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
+ irqchip/irq-brcmstb-l2: Add write memory barrier before exit
+ irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
+ net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
+ s390/qeth: Fix potential loss of L3-IP@ in case of network issues
+ net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
+ ceph: prevent use-after-free in encode_cap_msg()
+ mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
+ of: property: fix typo in io-channels
+ can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
+ can: j1939: Fix UAF in j1939_sk_match_filter during
setsockopt(SO_J1939_FILTER)
+ pmdomain: core: Move the unused cleanup to a _sync initcall
+ tracing: Inform kmemleak of saved_cmdlines allocation
+ af_unix: Fix task hung while purging oob_skb in GC.
+ dma-buf: add dma_fence_timestamp helper
+ bus: moxtet: Add spi device table
+ crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
+ usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
+ usb: dwc3: ep0: Don't prepare beyond Setup stage
+ usb: dwc3: gadget: Only End Transfer for ep0 data phase
+ usb: dwc3: gadget: Delay issuing End Transfer
+ usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
+ usb: dwc3: gadget: Force sending delayed status during soft disconnect
+ usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
+ usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
+ usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
+ usb: dwc3: gadget: Handle EP0 request dequeuing properly
+ usb: dwc3: gadget: Queue PM runtime idle on disconnect event
+ serial: 8250_exar: Fill in rs485_supported
+ serial: 8250_exar: Set missing rs485_supported flag
+ fbdev/defio: Early-out if page is already enlisted
+ fbdev: Don't sort deferred-I/O pages by default
+ fbdev: defio: fix the pagelist corruption
+ fbdev: Track deferred-I/O pages in pageref struct
+ fbdev: Rename pagelist to pagereflist for deferred I/O
+ fbdev: Fix invalid page access after closing deferred I/O devices
+ fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
+ fbdev: flush deferred IO before closing
+ scripts/decode_stacktrace.sh: support old bash version
+ scripts: decode_stacktrace: demangle Rust symbols
+ scripts/decode_stacktrace.sh: optionally use LLVM utilities
+ netfilter: ipset: fix performance regression in swap operation
+ hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
+ net: prevent mss overflow in skb_segment()
+ netfilter: ipset: Missing gc cancellations fixed
+ sched/membarrier: reduce the ability to hammer on sys_membarrier
+ nilfs2: fix potential bug in end_buffer_async_write
+ nilfs2: replace WARN_ONs for invalid DAT metadata block requests
+ arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
+ PM: runtime: Have devm_pm_runtime_enable() handle
pm_runtime_dont_use_autosuspend()
+ drm/msm/dsi: Enable runtime PM
+ net: bcmgenet: Fix EEE implementation
+ fs/ntfs3: Add null pointer checks
+ smb3: Replace smb2pdu 1-element arrays with flex-arrays
+ staging: fbtft: core: set smem_len before fb_deferred_io_init call
+ usb: dwc3: gadget: Don't delay End Transfer on delayed_status
+ usb: dwc3: gadget: Execute gadget stop after halting the controller
+ media: Revert "media: rkisp1: Drop IRQF_SHARED"
+ usb: dwc3: gadget: Ignore End Transfer delay on teardown
Linux 5.15.149
- usb: dwc3: gadget: Ignore End Transfer delay on teardown
- media: Revert "media: rkisp1: Drop IRQF_SHARED"
- usb: dwc3: gadget: Execute gadget stop after halting the controller
- usb: dwc3: gadget: Don't delay End Transfer on delayed_status
- staging: fbtft: core: set smem_len before fb_deferred_io_init call
- smb3: Replace smb2pdu 1-element arrays with flex-arrays
- fs/ntfs3: Add null pointer checks
- net: bcmgenet: Fix EEE implementation
- Revert "selftests/bpf: Test tail call counting with bpf2bpf and data on stack"
- drm/msm/dsi: Enable runtime PM
- PM: runtime: Have devm_pm_runtime_enable() handle
pm_runtime_dont_use_autosuspend()
- arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
- dm: limit the number of targets and parameter size area
- nilfs2: replace WARN_ONs for invalid DAT metadata block requests
- nilfs2: fix potential bug in end_buffer_async_write
- sched/membarrier: reduce the ability to hammer on sys_membarrier
- netfilter: ipset: Missing gc cancellations fixed
- net: prevent mss overflow in skb_segment()
- hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
- netfilter: ipset: fix performance regression in swap operation
- scripts/decode_stacktrace.sh: optionally use LLVM utilities
- scripts: decode_stacktrace: demangle Rust symbols
- scripts/decode_stacktrace.sh: support old bash version
- fbdev: flush deferred IO before closing
- fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
- fbdev: Fix invalid page access after closing deferred I/O devices
- fbdev: Rename pagelist to pagereflist for deferred I/O
- fbdev: Track deferred-I/O pages in pageref struct
- fbdev: defio: fix the pagelist corruption
- fbdev: Don't sort deferred-I/O pages by default
- fbdev/defio: Early-out if page is already enlisted
- serial: 8250_exar: Set missing rs485_supported flag
- serial: 8250_exar: Fill in rs485_supported
- usb: dwc3: gadget: Queue PM runtime idle on disconnect event
- usb: dwc3: gadget: Handle EP0 request dequeuing properly
- usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
- usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
- usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
- usb: dwc3: gadget: Force sending delayed status during soft disconnect
- usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
- usb: dwc3: gadget: Delay issuing End Transfer
- usb: dwc3: gadget: Only End Transfer for ep0 data phase
- usb: dwc3: ep0: Don't prepare beyond Setup stage
- usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
- crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
- bus: moxtet: Add spi device table
- dma-buf: add dma_fence_timestamp helper
- af_unix: Fix task hung while purging oob_skb in GC.
- tracing: Inform kmemleak of saved_cmdlines allocation
- pmdomain: core: Move the unused cleanup to a _sync initcall
- can: j1939: Fix UAF in j1939_sk_match_filter during
setsockopt(SO_J1939_FILTER)
- can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
- of: property: fix typo in io-channels
- mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
- ceph: prevent use-after-free in encode_cap_msg()
- net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
- s390/qeth: Fix potential loss of L3-IP@ in case of network issues
- net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
- irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
- irqchip/irq-brcmstb-l2: Add write memory barrier before exit
- wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
- nfp: flower: prevent re-adding mac index for bonded port
- nfp: use correct macro for LengthSelect in BAR config
- crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
- nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
- nilfs2: fix data corruption in dsync block recovery for small block sizes
- ALSA: hda/conexant: Add quirk for SWS JS201D
- mmc: slot-gpio: Allow non-sleeping GPIO ro
- x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
- x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
- powerpc/64: Set task pt_regs->link to the LR value on scv entry
- serial: max310x: fail probe if clock crystal is unstable
- serial: max310x: improve crystal stable clock detection
- serial: max310x: set default value when reading clock ready bit
- ring-buffer: Clean ring_buffer_poll_wait() error return
- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
- drm/prime: Support page array >= 4GB
- media: rc: bpf attach/detach requires write permission
- iio: accel: bma400: Fix a compilation problem
- iio: core: fix memleak in iio_device_register_sysfs
- iio: magnetometer: rm3100: add boundary check for the value read from
RM3100_REG_TMRC
- staging: iio: ad5933: fix type mismatch regression
- tracing: Fix wasted memory in saved_cmdlines logic
- ext4: fix double-free of blocks due to wrong extents moved_len
- misc: fastrpc: Mark all sessions as invalid in cb_remove
- binder: signal epoll threads of self-work
- ALSA: hda/cs8409: Suppress vmaster control for Dolphin models
- ASoC: codecs: wcd938x: handle deferred probe
- ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
- xen-netback: properly sync TX responses
- net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
- nfc: nci: free rx_data_reassembly skb on NCI device cleanup
- kbuild: Fix changing ELF file type for output of gen_btf for big endian
- firewire: core: correct documentation of fw_csr_string() kernel API
- lsm: fix the logic in security_inode_getsecctx()
- Revert "drm/amd: flush any delayed gfxoff on suspend entry"
- scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
- mptcp: fix data re-injection from stale subflow
- modpost: trim leading spaces when processing source files list
- i2c: i801: Fix block process call transactions
- i2c: i801: Remove i801_set_block_buffer_mode
- powerpc/kasan: Fix addr error caused by page alignment
- media: ir_toy: fix a memleak in irtoy_tx
- usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
- usb: f_mass_storage: forbid async queue when shutdown happen
- USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
- usb: ucsi_acpi: Fix command completion handling
- iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
- HID: wacom: Do not register input devices until after hid_hw_start
- HID: wacom: generic: Avoid reporting a serial of '0' to userspace
- HID: i2c-hid-of: fix NULL-deref on failed power up
- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
- ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1
SF114-32
- scsi: storvsc: Fix ring buffer size calculation
- mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
- tracing/trigger: Fix to return error if failed to alloc snapshot
- scs: add CONFIG_MMU dependency for vfree_atomic()
- i40e: Fix waiting for queues of all VSIs to be disabled
- MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
- net: sysfs: Fix /sys/class/net/<iface> path for statistics
- ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
- spi: ppc4xx: Drop write-only variable
- net: openvswitch: limit the number of recursions from action sets
- wifi: iwlwifi: Fix some error codes
- of: unittest: Fix compile in the non-dynamic case
- btrfs: send: return EOPNOTSUPP on unknown flags
- btrfs: forbid deleting live subvol qgroup
- btrfs: do not ASSERT() if the newly created subvolume already got read
- btrfs: forbid creating subvol qgroups
- netfilter: nft_set_rbtree: skip end interval element from gc
- net: stmmac: xgmac: fix a typo of register name in DPP safety handling
- net: stmmac: xgmac: use #define for string constants
- clocksource: Skip watchdog check for large watchdog intervals
- vhost: use kzalloc() instead of kmalloc() followed by memset()
- Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
- Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
- hrtimer: Report offline hrtimer enqueue
- usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
- usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
- USB: serial: cp210x: add ID for IMST iM871A-USB
- USB: serial: option: add Fibocom FM101-GL variant
- USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
- ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
- drivers: lkdtm: fix clang -Wformat warning
- blk-iocost: Fix an UBSAN shift-out-of-bounds warning
- scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
- fs/ntfs3: Fix an NULL dereference bug
- netfilter: nft_set_pipapo: remove scratch_aligned pointer
- netfilter: nft_set_pipapo: add helper to release pcpu scratch area
- netfilter: nft_set_pipapo: store index in scratch maps
- netfilter: nft_ct: reject direction for ct id
- drm/amd/display: Implement bounds check for stream encoder creation in DCN301
- drm/amd/display: Fix multiple memory leaks reported by coverity
- netfilter: nft_compat: restrict match/target protocol to u16
- netfilter: nft_compat: reject unused compat flag
- ppp_async: limit MRU to 64K
- af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
- tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
- rxrpc: Fix response to PING RESPONSE ACKs to a dead call
- inet: read sk->sk_family once in inet_recv_error()
- hwmon: (coretemp) Fix bogus core_id to attr name mapping
- hwmon: (coretemp) Fix out-of-bounds memory access
- hwmon: (aspeed-pwm-tacho) mutex for tach reading
- octeontx2-pf: Fix a memleak otx2_sq_init
- atm: idt77252: fix a memleak in open_card_ubr0
- tunnels: fix out of bounds access when building IPv6 PMTU error
- selftests: net: avoid just another constant wait
- selftests: net: cut more slack for gro fwd tests.
- net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
- drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
- phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
- dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
- phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
- dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
- dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
- dmaengine: ti: k3-udma: Report short packet errors
- dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
- ASoC: codecs: lpass-wsa-macro: fix compander volume hack
- bonding: remove print in bond_verify_device_path
- HID: apple: Add 2021 magic keyboard FN key mapping
- HID: apple: Add support for the 2021 Magic Keyboard
- gve: Fix use-after-free vulnerability
- arm64: irq: set the correct node for shadow call stack
- net: sysfs: Fix /sys/class/net/<iface> path
- selftests: net: fix available tunnels detection
- af_unix: fix lockdep positive in sk_diag_dump_icons()
- net: ipv4: fix a memleak in ip_setup_cork
- netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
expectations
- netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
- netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
- bridge: mcast: fix disabled snooping after long uptime
- llc: call sock_orphan() at release time
- ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
- ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
- ixgbe: Refactor overtemp event handling
- ixgbe: Refactor returning internal error codes
- ixgbe: Remove non-inclusive language
- tcp: add sanity checks to rx zerocopy
- ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
- ip6_tunnel: use dev_sw_netstats_rx_add()
- selftests: net: give more time for GRO aggregation
- scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
- scsi: isci: Fix an error code problem in isci_io_request_build()
- drm: using mul_u32_u32() requires linux/math64.h
- wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
- perf: Fix the nr_addr_filters fix
- drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
- drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
- drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
'get_platform_power_management_table()'
- ceph: fix deadlock or deadcode of misusing dget()
- blk-mq: fix IO hang from sbitmap wakeup race
- virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region
of size 10" warnings
- drm/amdkfd: Fix lock dependency warning
- libsubcmd: Fix memory leak in uniq()
- PCI/AER: Decode Requester ID when no error info found
- PCI: Fix 64GT/s effective data rate calculation
- fs/kernfs/dir: obey S_ISGID
- tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
- selftests/sgx: Fix linker script asserts
- usb: hub: Replace hardcoded quirk value with BIT() macro
- perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
- PCI: switchtec: Fix stdev_release() crash after surprise hot remove
- PCI: Only override AMD USB controller if required
- mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
- mfd: ti_am335x_tscadc: Fix TI SoC dependencies
- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
- i3c: master: cdns: Update maximum prescaler value for i2c clock
- um: time-travel: fix time corruption
- um: net: Fix return type of uml_net_start_xmit()
- um: Don't use vfprintf() for os_info()
- um: Fix naming clash between UML and scheduler
- leds: trigger: panic: Don't register panic notifier if creating the trigger
failed
- ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
- drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
- drm/amdgpu: Let KFD sync with VM fences
- clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
- clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
- watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
- clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
- clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
- drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
- drm/msm/dpu: Ratelimit framedone timeout msgs
- media: i2c: imx335: Fix hblank min/max values
- media: ddbridge: fix an error code problem in ddb_probe
- IB/ipoib: Fix mcast list locking
- drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
- f2fs: fix to tag gcing flag on page during block migration
- media: rkisp1: Drop IRQF_SHARED
- ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
- ALSA: hda: Intel: add HDA_ARL PCI ID support
- PCI: add INTEL_HDA_ARL to pci_ids.h
- media: rockchip: rga: fix swizzling for RGB formats
- media: stk1160: Fixed high volume of stk1160_dbg messages
- drm/mipi-dsi: Fix detach call without attach
- drm/framebuffer: Fix use of uninitialized variable
- drm/drm_file: fix use of uninitialized variable
- f2fs: fix write pointers on zoned device after roll forward
- drm/amd/display: Fix tiled display misalignment
- RDMA/IPoIB: Fix error code return in ipoib_mcast_join
- fast_dput(): handle underflows gracefully
- ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
- ALSA: hda: Refer to correct stream index at loops
- f2fs: fix to check return value of f2fs_reserve_new_block()
- octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
- i40e: Fix VF disable behavior to block all traffic
- bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
- Bluetooth: L2CAP: Fix possible multiple reject send
- Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
- wifi: cfg80211: free beacon_ies when overridden from hidden BSS
- wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
- ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
- libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
- wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
- arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
- arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
- md: Whenassemble the array, consult the superblock of the freshest device
- block: prevent an integer overflow in bvec_try_merge_hw_page
- net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
- ARM: dts: imx23/28: Fix the DMA controller node name
- ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
- ARM: dts: imx27-apf27dev: Fix LED name
- ARM: dts: imx25/27: Pass timing0
- ARM: dts: imx25: Fix the iim compatible string
- block/rnbd-srv: Check for unlikely string overflow
- ionic: pass opcode to devcmd_wait
- ARM: dts: imx1: Fix sram node
- ARM: dts: imx27: Fix sram node
- ARM: dts: imx: Use flash@0,0 pattern
- ARM: dts: imx25/27-eukrea: Fix RTC node name
- ARM: dts: rockchip: fix rk3036 hdmi ports node
- bpf: Set uattr->batch.count as zero before batched update or deletion
- scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
- scsi: libfc: Don't schedule abort twice
- bpf: Add map and need_defer parameters to .map_fd_put_ptr()
- wifi: ath9k: Fix potential array-index-out-of-bounds read in
ath9k_htc_txstatus()
- ARM: dts: imx7s: Fix nand-controller #size-cells
- ARM: dts: imx7s: Fix lcdif compatible
- ARM: dts: imx7d: Fix coresight funnel ports
- scsi: arcmsr: Support new PCI device IDs 1883 and 1886
- bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
- PCI: Add no PM reset quirk for NVIDIA Spectrum devices
- scsi: lpfc: Fix possible file string name overflow when updating firmware
- selftests/bpf: Fix issues in setup_classid_environment()
- selftests/bpf: Fix pyperf180 compilation failure with clang18
- selftests/bpf: satisfy compiler by having explicit return in btf test
- wifi: rt2x00: restart beacon queue when hardware reset
- ext4: avoid online resizing failures due to oversized flex bg
- ext4: remove unnecessary check from alloc_flex_gd()
- ext4: unify the type of flexbg_size to unsigned int
- ext4: fix inconsistent between segment fstrim and full fstrim
- ecryptfs: Reject casefold directory inodes
- SUNRPC: Fix a suspicious RCU usage warning
- KVM: s390: fix setting of fpc register
- s390/ptrace: handle setting of fpc register correctly
- arch: consolidate arch_irq_work_raise prototypes
- jfs: fix array-index-out-of-bounds in diNewExt
- rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
- afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
- afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
- crypto: stm32/crc32 - fix parsing list of devices
- crypto: octeontx2 - Fix cptvf driver cleanup
- pstore/ram: Fix crash when setting number of cpus to an odd number
- jfs: fix uaf in jfs_evict_inode
- jfs: fix array-index-out-of-bounds in dbAdjTree
- jfs: fix slab-out-of-bounds Read in dtSearch
- UBSAN: array-index-out-of-bounds in dtSplitRoot
- FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
- ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
events
- PM / devfreq: Synchronize devfreq_monitor_[start/stop]
- ACPI: extlog: fix NULL pointer dereference check
- PNP: ACPI: fix fortify warning
- ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
- audit: Send netlink ACK before setting connection in auditd_set
- regulator: core: Only increment use_count when enable_count changes
- debugobjects: Stop accessing objects after releasing hash bucket lock
- perf/core: Fix narrow startup race when creating the perf nr_addr_filters
sysfs file
- x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
- powerpc/lib: Validate size for vector operations
- powerpc: pmd_move_must_withdraw() is only needed for
CONFIG_TRANSPARENT_HUGEPAGE
- x86/boot: Ignore NMIs during very early boot
- powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
- powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
- powerpc: Fix build error due to is_valid_bugaddr()
- drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
- arm64: irq: set the correct node for VMAP stack
- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
- x86/entry/ia32: Ensure s32 is sign extended to s64
- tick/sched: Preserve number of idle sleeps across CPU hotplug events
- mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
- spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
- block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
- gpio: eic-sprd: Clear interrupt after set the interrupt type
- drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
- drm/exynos: fix accidental on-stack copy of exynos_drm_plane
- drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
- cpufreq: intel_pstate: Refine computation of P-state for given frequency
- cpufreq: intel_pstate: Drop redundant intel_pstate_get_hwp_cap() call
- ksmbd: fix global oob in ksmbd_nl_policy
- btrfs: add definition for EXTENT_TREE_V2
- PM / devfreq: Fix buffer overflow in trans_stat_show
- mm/sparsemem: fix race in accessing memory_section->usage
- mm: use __pfn_to_section() instead of open coding it
- media: mtk-jpeg: Fix use after free bug due to error path handling in
mtk_jpeg_dec_device_run
- ARM: dts: qcom: sdx55: fix USB SS wakeup
- ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
- ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
- ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
- ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
- pipe: wakeup wr_wait after setting max_usage
- fs/pipe: move check to pipe_has_watch_queue()
- bus: mhi: host: Add alignment check for event ring read pointer
- bus: mhi: host: Rename "struct mhi_tre" to "struct mhi_ring_element"
- PM: sleep: Fix possible deadlocks in core system-wide PM code
- PM: core: Remove unnecessary (void *) conversions
- drm/bridge: nxp-ptn3460: simplify some error checking
- drm/tidss: Fix atomic_flush check
- drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
- drm: Don't unref the same fb many times by mistake due to deadlock handling
- gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
- xfs: read only mounts with fsopen mount API are busted
- firmware: arm_scmi: Check mailbox/SMT channel for consistency
- netfilter: nf_tables: reject QUEUE/DROP verdict parameters
- netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
basechain
- hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
- wifi: iwlwifi: fix a memory corruption
- exec: Fix error handling in begin_new_exec()
- rbd: don't move requests to the running list on errors
- btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
- btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
- btrfs: don't warn if discard range is not aligned to sector
- btrfs: tree-checker: fix inline ref size in error messages
- btrfs: ref-verify: free ref cache before clearing mount opt
- btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
being deleted
- btrfs: fix race between reading a directory and adding entries to it
- btrfs: refresh dir last index during a rewinddir(3) call
- btrfs: set last dir index to the current last index when opening dir
- btrfs: fix infinite directory reads
- net: fec: fix the unhandled context fault from smmu
- fjes: fix memleaks in fjes_hw_setup
- selftests: netdevsim: fix the udp_tunnel_nic test
- net: mvpp2: clear BM pool before initialization
- net: stmmac: Wait a bit for the reset to take effect
- netfilter: nf_tables: validate NFPROTO_* family
- netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
- netfilter: nft_limit: reject configurations that cause integer overflow
- overflow: Allow mixed type arguments
- net/mlx5e: fix a potential double-free in fs_any_create_groups
- net/mlx5e: fix a double-free in arfs_create_groups
- net/mlx5: DR, Can't go to uplink vport on RX rule
- net/mlx5: DR, Align mlx5dv_dr API vport action with FW behavior
- net/mlx5: DR, Replace local WIRE_PORT macro with the existing
MLX5_VPORT_UPLINK
- net/mlx5: DR, Use the right GVMI number for drop action
- ipv6: init the accept_queue's spinlocks in inet6_create
- netlink: fix potential sleeping issue in mqueue_flush_file
- tcp: Add memory barrier to tcp_push()
- afs: Hide silly-rename files from userspace
- tracing: Ensure visibility when inserting an element into tracing_map
- net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
- llc: Drop support for ETH_P_TR_802_2.
- llc: make llc_ui_sendmsg() more robust against bonding changes
- vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
- bnxt_en: Wait for FLR to complete during probe
- tcp: make sure init the accept_queue's spinlocks once
- net/smc: fix illegal rmb_desc access in SMC-D connection dump
- ksmbd: Add missing set_freezable() for freezable kthread
- ksmbd: send lease break notification on FILE_RENAME_INFORMATION
- ksmbd: don't increment epoch if current state and request state are same
- ksmbd: fix potential circular locking issue in smb2_set_ea()
- ksmbd: set v2 lease version on lease upgrade
- rename(): fix the locking of subdirectories
- ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
- nouveau/vmm: don't set addr on the fail path to avoid warning
- rtc: Adjust failure return code for cmos_set_alarm()
- mmc: mmc_spi: remove custom DMA mapped buffers
- mmc: core: Use mrq.sbc in close-ended ffu
- scripts/get_abi: fix source path leak
- lsm: new security_file_ioctl_compat() hook
- arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
- arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
- arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
- arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
- async: Introduce async_schedule_dev_nocall()
- async: Split async_schedule_node_domain()
- parisc/firmware: Fix F-extend for PDC addresses
- bus: mhi: host: Add spinlock to protect WP access when queueing TREs
- bus: mhi: host: Drop chan lock before queuing buffers
- mips: Fix max_mapnr being uninitialized on early stages
- media: ov9734: Enable runtime PM before registering async sub-device
- rpmsg: virtio: Free driver_override when rpmsg_remove()
- media: imx355: Enable runtime PM before registering async sub-device
- crypto: s390/aes - Fix buffer overread in CTR mode
- hwrng: core - Fix page fault dead lock on mmap-ed hwrng
- PM: hibernate: Enforce ordering during image compression/decompression
- crypto: api - Disallow identical driver names
- btrfs: sysfs: validate scrub_speed_max value
- ext4: allow for the last group to be marked as trimmed
- iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
- scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
- scsi: ufs: core: Simplify power management during async scan
- dmaengine: fix NULL pointer in channel unregistration function
- iio: adc: ad7091r: Enable internal vref if external vref is not supplied
- iio: adc: ad7091r: Allow users to configure device events
- iio: adc: ad7091r: Set alert bit in config register
- ksmbd: only v2 leases handle the directory
- ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
- ksmbd: validate mech token in session setup
- ksmbd: don't allow O_TRUNC open on read-only share
- ksmbd: free ppace array on error in parse_dacl
+ UBUNTU: Upstream stable to v5.15.149
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2059014
Title:
Jammy update: v5.15.149 upstream stable release
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Jammy:
In Progress
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.149 upstream stable release
from git://git.kernel.org/
ksmbd: free ppace array on error in parse_dacl
ksmbd: don't allow O_TRUNC open on read-only share
ksmbd: validate mech token in session setup
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
ksmbd: only v2 leases handle the directory
iio: adc: ad7091r: Set alert bit in config register
iio: adc: ad7091r: Allow users to configure device events
iio: adc: ad7091r: Enable internal vref if external vref is not supplied
dmaengine: fix NULL pointer in channel unregistration function
scsi: ufs: core: Simplify power management during async scan
scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
ext4: allow for the last group to be marked as trimmed
btrfs: sysfs: validate scrub_speed_max value
crypto: api - Disallow identical driver names
PM: hibernate: Enforce ordering during image compression/decompression
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
crypto: s390/aes - Fix buffer overread in CTR mode
media: imx355: Enable runtime PM before registering async sub-device
rpmsg: virtio: Free driver_override when rpmsg_remove()
media: ov9734: Enable runtime PM before registering async sub-device
mips: Fix max_mapnr being uninitialized on early stages
bus: mhi: host: Drop chan lock before queuing buffers
bus: mhi: host: Add spinlock to protect WP access when queueing TREs
parisc/firmware: Fix F-extend for PDC addresses
async: Split async_schedule_node_domain()
async: Introduce async_schedule_dev_nocall()
arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
lsm: new security_file_ioctl_compat() hook
scripts/get_abi: fix source path leak
mmc: core: Use mrq.sbc in close-ended ffu
mmc: mmc_spi: remove custom DMA mapped buffers
rtc: Adjust failure return code for cmos_set_alarm()
nouveau/vmm: don't set addr on the fail path to avoid warning
ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
rename(): fix the locking of subdirectories
ksmbd: set v2 lease version on lease upgrade
ksmbd: fix potential circular locking issue in smb2_set_ea()
ksmbd: don't increment epoch if current state and request state are same
ksmbd: send lease break notification on FILE_RENAME_INFORMATION
ksmbd: Add missing set_freezable() for freezable kthread
net/smc: fix illegal rmb_desc access in SMC-D connection dump
tcp: make sure init the accept_queue's spinlocks once
bnxt_en: Wait for FLR to complete during probe
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
llc: make llc_ui_sendmsg() more robust against bonding changes
llc: Drop support for ETH_P_TR_802_2.
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
tracing: Ensure visibility when inserting an element into tracing_map
afs: Hide silly-rename files from userspace
tcp: Add memory barrier to tcp_push()
netlink: fix potential sleeping issue in mqueue_flush_file
ipv6: init the accept_queue's spinlocks in inet6_create
net/mlx5: DR, Use the right GVMI number for drop action
net/mlx5: DR, Align mlx5dv_dr API vport action with FW behavior
net/mlx5: DR, Can't go to uplink vport on RX rule
net/mlx5e: fix a double-free in arfs_create_groups
net/mlx5e: fix a potential double-free in fs_any_create_groups
overflow: Allow mixed type arguments
netfilter: nft_limit: reject configurations that cause integer overflow
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
netfilter: nf_tables: validate NFPROTO_* family
net: stmmac: Wait a bit for the reset to take effect
net: mvpp2: clear BM pool before initialization
selftests: netdevsim: fix the udp_tunnel_nic test
fjes: fix memleaks in fjes_hw_setup
net: fec: fix the unhandled context fault from smmu
btrfs: fix infinite directory reads
btrfs: set last dir index to the current last index when opening dir
btrfs: refresh dir last index during a rewinddir(3) call
btrfs: fix race between reading a directory and adding entries to it
btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
being deleted
btrfs: ref-verify: free ref cache before clearing mount opt
btrfs: tree-checker: fix inline ref size in error messages
btrfs: don't warn if discard range is not aligned to sector
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
rbd: don't move requests to the running list on errors
exec: Fix error handling in begin_new_exec()
wifi: iwlwifi: fix a memory corruption
hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
basechain
firmware: arm_scmi: Check mailbox/SMT channel for consistency
xfs: read only mounts with fsopen mount API are busted
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
drm: Don't unref the same fb many times by mistake due to deadlock handling
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
drm/tidss: Fix atomic_flush check
drm/bridge: nxp-ptn3460: simplify some error checking
PM: core: Remove unnecessary (void *) conversions
PM: sleep: Fix possible deadlocks in core system-wide PM code
bus: mhi: host: Rename "struct mhi_tre" to "struct mhi_ring_element"
bus: mhi: host: Add alignment check for event ring read pointer
fs/pipe: move check to pipe_has_watch_queue()
pipe: wakeup wr_wait after setting max_usage
ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
ARM: dts: qcom: sdx55: fix USB SS wakeup
media: mtk-jpeg: Fix use after free bug due to error path handling in
mtk_jpeg_dec_device_run
mm: use __pfn_to_section() instead of open coding it
mm/sparsemem: fix race in accessing memory_section->usage
PM / devfreq: Fix buffer overflow in trans_stat_show
btrfs: add definition for EXTENT_TREE_V2
ksmbd: fix global oob in ksmbd_nl_policy
cpufreq: intel_pstate: Drop redundant intel_pstate_get_hwp_cap() call
cpufreq: intel_pstate: Refine computation of P-state for given frequency
drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
drm/exynos: fix accidental on-stack copy of exynos_drm_plane
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
gpio: eic-sprd: Clear interrupt after set the interrupt type
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
tick/sched: Preserve number of idle sleeps across CPU hotplug events
x86/entry/ia32: Ensure s32 is sign extended to s64
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
arm64: irq: set the correct node for VMAP stack
drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
powerpc: Fix build error due to is_valid_bugaddr()
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
x86/boot: Ignore NMIs during very early boot
powerpc: pmd_move_must_withdraw() is only needed for
CONFIG_TRANSPARENT_HUGEPAGE
powerpc/lib: Validate size for vector operations
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
perf/core: Fix narrow startup race when creating the perf nr_addr_filters
sysfs file
debugobjects: Stop accessing objects after releasing hash bucket lock
regulator: core: Only increment use_count when enable_count changes
audit: Send netlink ACK before setting connection in auditd_set
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
PNP: ACPI: fix fortify warning
ACPI: extlog: fix NULL pointer dereference check
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
events
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
UBSAN: array-index-out-of-bounds in dtSplitRoot
jfs: fix slab-out-of-bounds Read in dtSearch
jfs: fix array-index-out-of-bounds in dbAdjTree
jfs: fix uaf in jfs_evict_inode
pstore/ram: Fix crash when setting number of cpus to an odd number
crypto: octeontx2 - Fix cptvf driver cleanup
crypto: stm32/crc32 - fix parsing list of devices
afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
jfs: fix array-index-out-of-bounds in diNewExt
arch: consolidate arch_irq_work_raise prototypes
s390/ptrace: handle setting of fpc register correctly
KVM: s390: fix setting of fpc register
SUNRPC: Fix a suspicious RCU usage warning
ecryptfs: Reject casefold directory inodes
ext4: fix inconsistent between segment fstrim and full fstrim
ext4: unify the type of flexbg_size to unsigned int
ext4: remove unnecessary check from alloc_flex_gd()
ext4: avoid online resizing failures due to oversized flex bg
wifi: rt2x00: restart beacon queue when hardware reset
selftests/bpf: satisfy compiler by having explicit return in btf test
selftests/bpf: Fix pyperf180 compilation failure with clang18
selftests/bpf: Fix issues in setup_classid_environment()
scsi: lpfc: Fix possible file string name overflow when updating firmware
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
scsi: arcmsr: Support new PCI device IDs 1883 and 1886
ARM: dts: imx7d: Fix coresight funnel ports
ARM: dts: imx7s: Fix lcdif compatible
ARM: dts: imx7s: Fix nand-controller #size-cells
wifi: ath9k: Fix potential array-index-out-of-bounds read in
ath9k_htc_txstatus()
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
scsi: libfc: Don't schedule abort twice
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
bpf: Set uattr->batch.count as zero before batched update or deletion
ARM: dts: rockchip: fix rk3036 hdmi ports node
ARM: dts: imx25/27-eukrea: Fix RTC node name
ARM: dts: imx: Use flash@0,0 pattern
ARM: dts: imx27: Fix sram node
ARM: dts: imx1: Fix sram node
ionic: pass opcode to devcmd_wait
block/rnbd-srv: Check for unlikely string overflow
ARM: dts: imx25: Fix the iim compatible string
ARM: dts: imx25/27: Pass timing0
ARM: dts: imx27-apf27dev: Fix LED name
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
ARM: dts: imx23/28: Fix the DMA controller node name
net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
block: prevent an integer overflow in bvec_try_merge_hw_page
md: Whenassemble the array, consult the superblock of the freshest device
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
Bluetooth: L2CAP: Fix possible multiple reject send
bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
i40e: Fix VF disable behavior to block all traffic
octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
f2fs: fix to check return value of f2fs_reserve_new_block()
ALSA: hda: Refer to correct stream index at loops
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
fast_dput(): handle underflows gracefully
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
drm/amd/display: Fix tiled display misalignment
f2fs: fix write pointers on zoned device after roll forward
drm/drm_file: fix use of uninitialized variable
drm/framebuffer: Fix use of uninitialized variable
drm/mipi-dsi: Fix detach call without attach
media: stk1160: Fixed high volume of stk1160_dbg messages
media: rockchip: rga: fix swizzling for RGB formats
PCI: add INTEL_HDA_ARL to pci_ids.h
ALSA: hda: Intel: add HDA_ARL PCI ID support
ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
media: rkisp1: Drop IRQF_SHARED
f2fs: fix to tag gcing flag on page during block migration
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
IB/ipoib: Fix mcast list locking
media: ddbridge: fix an error code problem in ddb_probe
media: i2c: imx335: Fix hblank min/max values
drm/msm/dpu: Ratelimit framedone timeout msgs
drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
drm/amdgpu: Let KFD sync with VM fences
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
leds: trigger: panic: Don't register panic notifier if creating the trigger
failed
um: Fix naming clash between UML and scheduler
um: Don't use vfprintf() for os_info()
um: net: Fix return type of uml_net_start_xmit()
um: time-travel: fix time corruption
i3c: master: cdns: Update maximum prescaler value for i2c clock
xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
UBUNTU: [Config] updateconfigs for MFD_TI_AM335X_TSCADC
mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
PCI: Only override AMD USB controller if required
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
usb: hub: Replace hardcoded quirk value with BIT() macro
selftests/sgx: Fix linker script asserts
tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
fs/kernfs/dir: obey S_ISGID
PCI: Fix 64GT/s effective data rate calculation
PCI/AER: Decode Requester ID when no error info found
libsubcmd: Fix memory leak in uniq()
drm/amdkfd: Fix lock dependency warning
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region
of size 10" warnings
blk-mq: fix IO hang from sbitmap wakeup race
ceph: fix deadlock or deadcode of misusing dget()
drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
'get_platform_power_management_table()'
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
perf: Fix the nr_addr_filters fix
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
drm: using mul_u32_u32() requires linux/math64.h
scsi: isci: Fix an error code problem in isci_io_request_build()
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
selftests: net: give more time for GRO aggregation
ip6_tunnel: use dev_sw_netstats_rx_add()
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
tcp: add sanity checks to rx zerocopy
ixgbe: Remove non-inclusive language
ixgbe: Refactor returning internal error codes
ixgbe: Refactor overtemp event handling
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
llc: call sock_orphan() at release time
bridge: mcast: fix disabled snooping after long uptime
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
expectations
net: ipv4: fix a memleak in ip_setup_cork
af_unix: fix lockdep positive in sk_diag_dump_icons()
UBUNTU: SAUCE: apparmor: update unix_state_double_lock implementation
selftests: net: fix available tunnels detection
net: sysfs: Fix /sys/class/net/<iface> path
arm64: irq: set the correct node for shadow call stack
gve: Fix use-after-free vulnerability
HID: apple: Add support for the 2021 Magic Keyboard
HID: apple: Add 2021 magic keyboard FN key mapping
bonding: remove print in bond_verify_device_path
ASoC: codecs: lpass-wsa-macro: fix compander volume hack
dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
dmaengine: ti: k3-udma: Report short packet errors
dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
selftests: net: cut more slack for gro fwd tests.
selftests: net: avoid just another constant wait
tunnels: fix out of bounds access when building IPv6 PMTU error
atm: idt77252: fix a memleak in open_card_ubr0
octeontx2-pf: Fix a memleak otx2_sq_init
hwmon: (aspeed-pwm-tacho) mutex for tach reading
hwmon: (coretemp) Fix out-of-bounds memory access
hwmon: (coretemp) Fix bogus core_id to attr name mapping
inet: read sk->sk_family once in inet_recv_error()
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
ppp_async: limit MRU to 64K
netfilter: nft_compat: reject unused compat flag
netfilter: nft_compat: restrict match/target protocol to u16
drm/amd/display: Fix multiple memory leaks reported by coverity
drm/amd/display: Implement bounds check for stream encoder creation in DCN301
netfilter: nft_ct: reject direction for ct id
netfilter: nft_set_pipapo: store index in scratch maps
netfilter: nft_set_pipapo: add helper to release pcpu scratch area
netfilter: nft_set_pipapo: remove scratch_aligned pointer
fs/ntfs3: Fix an NULL dereference bug
scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
blk-iocost: Fix an UBSAN shift-out-of-bounds warning
drivers: lkdtm: fix clang -Wformat warning
ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
USB: serial: option: add Fibocom FM101-GL variant
USB: serial: cp210x: add ID for IMST iM871A-USB
usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
hrtimer: Report offline hrtimer enqueue
Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
clocksource: Skip watchdog check for large watchdog intervals
net: stmmac: xgmac: use #define for string constants
net: stmmac: xgmac: fix a typo of register name in DPP safety handling
btrfs: forbid creating subvol qgroups
btrfs: forbid deleting live subvol qgroup
btrfs: send: return EOPNOTSUPP on unknown flags
of: unittest: Fix compile in the non-dynamic case
wifi: iwlwifi: Fix some error codes
net: openvswitch: limit the number of recursions from action sets
spi: ppc4xx: Drop write-only variable
ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
net: sysfs: Fix /sys/class/net/<iface> path for statistics
MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
i40e: Fix waiting for queues of all VSIs to be disabled
scs: add CONFIG_MMU dependency for vfree_atomic()
tracing/trigger: Fix to return error if failed to alloc snapshot
mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
scsi: storvsc: Fix ring buffer size calculation
ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1
SF114-32
ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
HID: i2c-hid-of: fix NULL-deref on failed power up
HID: wacom: generic: Avoid reporting a serial of '0' to userspace
HID: wacom: Do not register input devices until after hid_hw_start
iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
usb: ucsi_acpi: Fix command completion handling
USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
usb: f_mass_storage: forbid async queue when shutdown happen
usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
media: ir_toy: fix a memleak in irtoy_tx
powerpc/kasan: Fix addr error caused by page alignment
i2c: i801: Remove i801_set_block_buffer_mode
i2c: i801: Fix block process call transactions
modpost: trim leading spaces when processing source files list
mptcp: fix data re-injection from stale subflow
scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
Revert "drm/amd: flush any delayed gfxoff on suspend entry"
firewire: core: correct documentation of fw_csr_string() kernel API
kbuild: Fix changing ELF file type for output of gen_btf for big endian
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
xen-netback: properly sync TX responses
ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
ASoC: codecs: wcd938x: handle deferred probe
binder: signal epoll threads of self-work
misc: fastrpc: Mark all sessions as invalid in cb_remove
ext4: fix double-free of blocks due to wrong extents moved_len
tracing: Fix wasted memory in saved_cmdlines logic
staging: iio: ad5933: fix type mismatch regression
iio: magnetometer: rm3100: add boundary check for the value read from
RM3100_REG_TMRC
iio: core: fix memleak in iio_device_register_sysfs
iio: accel: bma400: Fix a compilation problem
media: rc: bpf attach/detach requires write permission
drm/prime: Support page array >= 4GB
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
ring-buffer: Clean ring_buffer_poll_wait() error return
serial: max310x: set default value when reading clock ready bit
serial: max310x: improve crystal stable clock detection
serial: max310x: fail probe if clock crystal is unstable
powerpc/64: Set task pt_regs->link to the LR value on scv entry
x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
mmc: slot-gpio: Allow non-sleeping GPIO ro
ALSA: hda/conexant: Add quirk for SWS JS201D
nilfs2: fix data corruption in dsync block recovery for small block sizes
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
nfp: use correct macro for LengthSelect in BAR config
nfp: flower: prevent re-adding mac index for bonded port
wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
irqchip/irq-brcmstb-l2: Add write memory barrier before exit
irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
ceph: prevent use-after-free in encode_cap_msg()
mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
of: property: fix typo in io-channels
can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
can: j1939: Fix UAF in j1939_sk_match_filter during
setsockopt(SO_J1939_FILTER)
pmdomain: core: Move the unused cleanup to a _sync initcall
tracing: Inform kmemleak of saved_cmdlines allocation
af_unix: Fix task hung while purging oob_skb in GC.
dma-buf: add dma_fence_timestamp helper
bus: moxtet: Add spi device table
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
usb: dwc3: ep0: Don't prepare beyond Setup stage
usb: dwc3: gadget: Only End Transfer for ep0 data phase
usb: dwc3: gadget: Delay issuing End Transfer
usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
usb: dwc3: gadget: Force sending delayed status during soft disconnect
usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
usb: dwc3: gadget: Handle EP0 request dequeuing properly
usb: dwc3: gadget: Queue PM runtime idle on disconnect event
serial: 8250_exar: Fill in rs485_supported
serial: 8250_exar: Set missing rs485_supported flag
fbdev/defio: Early-out if page is already enlisted
fbdev: Don't sort deferred-I/O pages by default
fbdev: defio: fix the pagelist corruption
fbdev: Track deferred-I/O pages in pageref struct
fbdev: Rename pagelist to pagereflist for deferred I/O
fbdev: Fix invalid page access after closing deferred I/O devices
fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
fbdev: flush deferred IO before closing
scripts/decode_stacktrace.sh: support old bash version
scripts: decode_stacktrace: demangle Rust symbols
scripts/decode_stacktrace.sh: optionally use LLVM utilities
netfilter: ipset: fix performance regression in swap operation
hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
net: prevent mss overflow in skb_segment()
netfilter: ipset: Missing gc cancellations fixed
sched/membarrier: reduce the ability to hammer on sys_membarrier
nilfs2: fix potential bug in end_buffer_async_write
nilfs2: replace WARN_ONs for invalid DAT metadata block requests
arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
PM: runtime: Have devm_pm_runtime_enable() handle
pm_runtime_dont_use_autosuspend()
drm/msm/dsi: Enable runtime PM
net: bcmgenet: Fix EEE implementation
fs/ntfs3: Add null pointer checks
smb3: Replace smb2pdu 1-element arrays with flex-arrays
staging: fbtft: core: set smem_len before fb_deferred_io_init call
usb: dwc3: gadget: Don't delay End Transfer on delayed_status
usb: dwc3: gadget: Execute gadget stop after halting the controller
media: Revert "media: rkisp1: Drop IRQF_SHARED"
usb: dwc3: gadget: Ignore End Transfer delay on teardown
Linux 5.15.149
UBUNTU: Upstream stable to v5.15.149
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2059014/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
