Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.167 upstream stable release
from git://git.kernel.org/
drm: panel-orientation-quirks: Add quirk for OrangePi Neo
ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
ALSA: hda/conexant: Mute speakers at suspend / shutdown
i2c: Fix conditional for substituting empty ACPI functions
dma-debug: avoid deadlock between dma debug vs printk and netconsole
net: usb: qmi_wwan: add MeiG Smart SRM825L
drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
drm/amd/display: Assign linear_pitch_alignment even for VM
drm/amdgpu: fix overflowed array index read warning
drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
drm/amd/pm: fix warning using uninitialized value of max_vid_step
drm/amd/pm: fix the Out-of-bounds read warning
drm/amdgpu: fix uninitialized scalar variable warning
drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
drm/amdgpu: avoid reading vf2pf info size from FB
drm/amd/display: Check gpio_id before used as array index
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
drm/amd/display: Add array index check for hdcp ddc access
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
drm/amd/display: Check msg_id before processing transcation
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
drm/amd/amdgpu: Check tbo resource pointer
drm/amdgpu/pm: Fix uninitialized variable warning for smu10
drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
drm/amdgpu: Fix out-of-bounds write warning
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
drm/amdgpu: fix ucode out-of-bounds read warning
drm/amdgpu: fix mc_data out-of-bounds read warning
drm/amdkfd: Reconcile the definition and use of oem_id in struct
kfd_topology_device
apparmor: fix possible NULL pointer dereference
drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
drm/amdgpu: fix the waring dereferencing hive
drm/amd/pm: check specific index for aldebaran
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
drm/amd/pm: check negtive return for table entries
drm/amdgpu: update type of buf size to u32 for eeprom functions
wifi: iwlwifi: remove fw_running op
cpufreq: scmi: Avoid overflow of target_freq in fast switch
PCI: al: Check IORESOURCE_BUS existence during probe
hwspinlock: Introduce hwspin_lock_bust()
RDMA/efa: Properly handle unexpected AQ completions
ionic: fix potential irq name truncation
rcu/nocb: Remove buggy bypass lock contention mitigation
usbip: Don't submit special requests twice
usb: typec: ucsi: Fix null pointer dereference in trace
fsnotify: clear PARENT_WATCHED flags lazily
smack: tcp: ipv4, fix incorrect labeling
drm/meson: plane: Add error handling
drm/bridge: tc358767: Check if fully initialized before signalling HPD event
via IRQ
wifi: cfg80211: make hash table duplicates more survivable
block: remove the blk_flush_integrity call in blk_integrity_unregister
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
media: uvcvideo: Enforce alignment of frame and interval
drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
virtio_net: Fix napi_skb_cache_put warning
rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
ext4: reject casefold inode flag without casefold feature
udf: Limit file size to 4TB
ext4: handle redirtying in ext4_bio_write_page()
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
sch/netem: fix use after free in netem_dequeue
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
ALSA: hda/realtek: add patch for internal mic in Lenovo V145
ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
ata: libata: Fix memory leak for error path in ata_host_alloc()
irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
rtmutex: Drop rt_mutex::wait_lock before scheduling
nvme-pci: Add sleep quirk for Samsung 990 Evo
Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
Bluetooth: MGMT: Ignore keys being loaded with invalid type
mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
mmc: sdhci-of-aspeed: fix module autoloading
mmc: cqhci: Fix checking of CQHCI_HALT state
fuse: update stats for pages in dropped aux writeback list
fuse: use unsigned type for getxattr/listxattr size truncation
clk: qcom: clk-alpha-pll: Fix the pll post div mask
clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
tracing: Avoid possible softlockup in tracing_iter_reset()
ila: call nf_unregister_net_hooks() sooner
sched: sch_cake: fix bulk flow accounting logic for host fairness
nilfs2: fix missing cleanup on rollforward recovery error
nilfs2: fix state management in error path of log writing function
mptcp: pm: re-using ID of unused flushed subflows
mptcp: pm: only decrement add_addr_accepted for MPJ req
mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
mptcp: pm: fullmesh: select the right ID later
mptcp: constify a bunch of of helpers
mptcp: pm: avoid possible UaF when selecting endp
mptcp: avoid duplicated SUB_CLOSED events
mptcp: close subflow when receiving TCP+FIN
mptcp: pm: ADD_ADDR 0 is not a new address
mptcp: pm: do not remove already closed subflows
mptcp: pm: skip connecting to already established sf
mptcp: pr_debug: add missing \n at the end
mptcp: pm: send ACK on an active subflow
ALSA: hda: Add input value sanity checks to HDMI channel map controls
smack: unix sockets: fix accept()ed socket label
irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
af_unix: Remove put_pid()/put_cred() in copy_peercred().
iommu: sun50i: clear bypass register
netfilter: nf_conncount: fix wrong variable type
udf: Avoid excessive partition lengths
media: vivid: fix wrong sizeimage value for mplane
leds: spi-byte: Call of_node_put() on error path
wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
usb: uas: set host status byte on data completion error
drm/amd/display: Check HDCP returned status
media: vivid: don't set HDMI TX controls if there are no HDMI outputs
PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
pcmcia: Use resource_size function on resource object
drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
can: bcm: Remove proc entry when dev is unregistered.
can: m_can: Release irq on error in m_can_open
igb: Fix not clearing TimeSync interrupts for 82580
platform/x86: dell-smbios: Fix error path in dell_smbios_init()
tcp_bpf: fix return value of tcp_bpf_sendmsg()
igc: Unlock on error in igc_io_resume()
ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
net: usb: don't write directly to netdev->dev_addr
usbnet: modern method to get random MAC
bareudp: Fix device stats updates.
gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
fou: Fix null-ptr-deref in GRO.
net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
net: dsa: vsc73xx: fix possible subblocks range of CAPT block
ASoC: topology: Properly initialize soc_enum values
dm init: Handle minors larger than 255
iommu/vt-d: Handle volatile descriptor status read
cgroup: Protect css->cgroup write under css_set_lock
um: line: always fill *error_out in setup_one_line()
devres: Initialize an uninitialized struct member
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
hwmon: (lm95234) Fix underflows seen when writing limit attributes
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
drm/amdgpu: Set no_hw_access when VF request full GPU fails
ext4: fix possible tid_t sequence overflows
dma-mapping: benchmark: Don't starve others when doing the test
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
fs/ntfs3: Check more cases when directory is corrupted
btrfs: replace BUG_ON with ASSERT in walk_down_proc()
btrfs: clean up our handling of refs == 0 in snapshot delete
btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
riscv: set trap vector earlier
PCI: Add missing bridge lock to pci_bus_lock()
net: dpaa: avoid on-stack arrays of NR_CPUS elements
i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()
s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
HID: amd_sfh: free driver_data after destroying hid device
Input: uinput - reject requests with unreasonable number of slots
usbnet: ipheth: race between ipheth_close and error handling
Squashfs: sanity check symbolic link size
of/irq: Prevent device address out-of-bounds read in interrupt map walk
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
ata: pata_macio: Use WARN instead of BUG
NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
cifs: Check the lease context if we actually got a lease
staging: iio: frequency: ad9834: Validate frequency parameter value
iio: buffer-dmaengine: fix releasing dma channel on error
iio: fix scale application in iio_convert_raw_to_processed_unlocked
iio: adc: ad7124: fix config comparison
iio: adc: ad7124: fix chip ID mismatch
usb: dwc3: core: update LC timer as per USB Spec V3.2
binder: fix UAF caused by offsets overwrite
nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
clocksource/drivers/timer-of: Remove percpu irq related code
uprobes: Use kzalloc to allocate xol area
perf/aux: Fix AUX buffer serialization
ksmbd: unset the binding mark of a reused connection
ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
nilfs2: replace snprintf in show functions with sysfs_emit
nilfs2: protect references to superblock parameters exposed in sysfs
workqueue: wq_watchdog_touch is always called with valid CPU
workqueue: Improve scalability of workqueue watchdog touch
ACPI: processor: Return an error if acpi_processor_get_info() fails in
processor_add()
ACPI: processor: Fix memory leaks in error paths of processor_add()
arm64: acpi: Move get_cpu_for_acpi_id() to a header
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
nvmet-tcp: fix kernel crash if commands allocation fails
ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
drm/i915/fence: Mark debug_fence_free() with __maybe_unused
gpio: rockchip: fix OF node leak in probe()
net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation
net: change maximum number of UDP segments to 128
gso: fix dodgy bit handling for GSO_UDP_L4
net: drop bad gso csum_start and offset in virtio_net_hdr
x86/mm: Fix PTI for i386 some more
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
btrfs: fix race between direct IO write and fsync when using same fd
memcg: protect concurrent access to mem_cgroup_idr
udp: fix receiving fraglist GSO packets
Linux 5.15.167
UBUNTU: Upstream stable to v5.15.167
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Koichiro Den (koichiroden)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Koichiro Den (koichiroden)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.167 upstream stable release
from git://git.kernel.org/
-
+ drm: panel-orientation-quirks: Add quirk for OrangePi Neo
+ ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
+ ALSA: hda/conexant: Mute speakers at suspend / shutdown
+ i2c: Fix conditional for substituting empty ACPI functions
+ dma-debug: avoid deadlock between dma debug vs printk and netconsole
+ net: usb: qmi_wwan: add MeiG Smart SRM825L
+ drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
+ drm/amd/display: Assign linear_pitch_alignment even for VM
+ drm/amdgpu: fix overflowed array index read warning
+ drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
+ drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
+ drm/amd/pm: fix warning using uninitialized value of max_vid_step
+ drm/amd/pm: fix the Out-of-bounds read warning
+ drm/amdgpu: fix uninitialized scalar variable warning
+ drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
+ drm/amdgpu: avoid reading vf2pf info size from FB
+ drm/amd/display: Check gpio_id before used as array index
+ drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
+ drm/amd/display: Add array index check for hdcp ddc access
+ drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
+ drm/amd/display: Check msg_id before processing transcation
+ drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
+ drm/amd/amdgpu: Check tbo resource pointer
+ drm/amdgpu/pm: Fix uninitialized variable warning for smu10
+ drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
+ drm/amdgpu: Fix out-of-bounds write warning
+ drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
+ drm/amdgpu: fix ucode out-of-bounds read warning
+ drm/amdgpu: fix mc_data out-of-bounds read warning
+ drm/amdkfd: Reconcile the definition and use of oem_id in struct
kfd_topology_device
+ apparmor: fix possible NULL pointer dereference
+ drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
SOCs
+ drm/amdgpu: fix the waring dereferencing hive
+ drm/amd/pm: check specific index for aldebaran
+ drm/amdgpu: the warning dereferencing obj for nbio_v7_4
+ drm/amd/pm: check negtive return for table entries
+ drm/amdgpu: update type of buf size to u32 for eeprom functions
+ wifi: iwlwifi: remove fw_running op
+ cpufreq: scmi: Avoid overflow of target_freq in fast switch
+ PCI: al: Check IORESOURCE_BUS existence during probe
+ hwspinlock: Introduce hwspin_lock_bust()
+ RDMA/efa: Properly handle unexpected AQ completions
+ ionic: fix potential irq name truncation
+ rcu/nocb: Remove buggy bypass lock contention mitigation
+ usbip: Don't submit special requests twice
+ usb: typec: ucsi: Fix null pointer dereference in trace
+ fsnotify: clear PARENT_WATCHED flags lazily
+ smack: tcp: ipv4, fix incorrect labeling
+ drm/meson: plane: Add error handling
+ drm/bridge: tc358767: Check if fully initialized before signalling HPD event
via IRQ
+ wifi: cfg80211: make hash table duplicates more survivable
+ block: remove the blk_flush_integrity call in blk_integrity_unregister
+ drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
+ media: uvcvideo: Enforce alignment of frame and interval
+ drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
+ virtio_net: Fix napi_skb_cache_put warning
+ rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
+ ext4: reject casefold inode flag without casefold feature
+ udf: Limit file size to 4TB
+ ext4: handle redirtying in ext4_bio_write_page()
+ i2c: Use IS_REACHABLE() for substituting empty ACPI functions
+ sch/netem: fix use after free in netem_dequeue
+ ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
+ KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
+ KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
+ ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
+ ALSA: hda/realtek: add patch for internal mic in Lenovo V145
+ ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
+ ata: libata: Fix memory leak for error path in ata_host_alloc()
+ irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
+ rtmutex: Drop rt_mutex::wait_lock before scheduling
+ nvme-pci: Add sleep quirk for Samsung 990 Evo
+ Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
+ Bluetooth: MGMT: Ignore keys being loaded with invalid type
+ mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
+ mmc: sdhci-of-aspeed: fix module autoloading
+ mmc: cqhci: Fix checking of CQHCI_HALT state
+ fuse: update stats for pages in dropped aux writeback list
+ fuse: use unsigned type for getxattr/listxattr size truncation
+ clk: qcom: clk-alpha-pll: Fix the pll post div mask
+ clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
+ can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
+ tracing: Avoid possible softlockup in tracing_iter_reset()
+ ila: call nf_unregister_net_hooks() sooner
+ sched: sch_cake: fix bulk flow accounting logic for host fairness
+ nilfs2: fix missing cleanup on rollforward recovery error
+ nilfs2: fix state management in error path of log writing function
+ mptcp: pm: re-using ID of unused flushed subflows
+ mptcp: pm: only decrement add_addr_accepted for MPJ req
+ mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
+ mptcp: pm: fullmesh: select the right ID later
+ mptcp: constify a bunch of of helpers
+ mptcp: pm: avoid possible UaF when selecting endp
+ mptcp: avoid duplicated SUB_CLOSED events
+ mptcp: close subflow when receiving TCP+FIN
+ mptcp: pm: ADD_ADDR 0 is not a new address
+ mptcp: pm: do not remove already closed subflows
+ mptcp: pm: skip connecting to already established sf
+ mptcp: pr_debug: add missing \n at the end
+ mptcp: pm: send ACK on an active subflow
+ ALSA: hda: Add input value sanity checks to HDMI channel map controls
+ smack: unix sockets: fix accept()ed socket label
+ irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
+ af_unix: Remove put_pid()/put_cred() in copy_peercred().
+ iommu: sun50i: clear bypass register
+ netfilter: nf_conncount: fix wrong variable type
+ udf: Avoid excessive partition lengths
+ media: vivid: fix wrong sizeimage value for mplane
+ leds: spi-byte: Call of_node_put() on error path
+ wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
+ usb: uas: set host status byte on data completion error
+ drm/amd/display: Check HDCP returned status
+ media: vivid: don't set HDMI TX controls if there are no HDMI outputs
+ PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
+ media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
+ pcmcia: Use resource_size function on resource object
+ drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
+ can: bcm: Remove proc entry when dev is unregistered.
+ can: m_can: Release irq on error in m_can_open
+ igb: Fix not clearing TimeSync interrupts for 82580
+ platform/x86: dell-smbios: Fix error path in dell_smbios_init()
+ tcp_bpf: fix return value of tcp_bpf_sendmsg()
+ igc: Unlock on error in igc_io_resume()
+ ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
+ net: usb: don't write directly to netdev->dev_addr
+ usbnet: modern method to get random MAC
+ bareudp: Fix device stats updates.
+ gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
+ gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
+ fou: Fix null-ptr-deref in GRO.
+ net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
+ net: dsa: vsc73xx: fix possible subblocks range of CAPT block
+ ASoC: topology: Properly initialize soc_enum values
+ dm init: Handle minors larger than 255
+ iommu/vt-d: Handle volatile descriptor status read
+ cgroup: Protect css->cgroup write under css_set_lock
+ um: line: always fill *error_out in setup_one_line()
+ devres: Initialize an uninitialized struct member
+ pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
+ hwmon: (adc128d818) Fix underflows seen when writing limit attributes
+ hwmon: (lm95234) Fix underflows seen when writing limit attributes
+ hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
+ hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
+ libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
+ drm/amdgpu: Set no_hw_access when VF request full GPU fails
+ ext4: fix possible tid_t sequence overflows
+ dma-mapping: benchmark: Don't starve others when doing the test
+ wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
+ smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
+ fs/ntfs3: Check more cases when directory is corrupted
+ btrfs: replace BUG_ON with ASSERT in walk_down_proc()
+ btrfs: clean up our handling of refs == 0 in snapshot delete
+ btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
+ riscv: set trap vector earlier
+ PCI: Add missing bridge lock to pci_bus_lock()
+ net: dpaa: avoid on-stack arrays of NR_CPUS elements
+ i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
+ kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
+ btrfs: initialize location to fix -Wmaybe-uninitialized in
btrfs_lookup_dentry()
+ s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
+ HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
+ HID: amd_sfh: free driver_data after destroying hid device
+ Input: uinput - reject requests with unreasonable number of slots
+ usbnet: ipheth: race between ipheth_close and error handling
+ Squashfs: sanity check symbolic link size
+ of/irq: Prevent device address out-of-bounds read in interrupt map walk
+ lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
+ MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
+ ata: pata_macio: Use WARN instead of BUG
+ NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
+ cifs: Check the lease context if we actually got a lease
+ staging: iio: frequency: ad9834: Validate frequency parameter value
+ iio: buffer-dmaengine: fix releasing dma channel on error
+ iio: fix scale application in iio_convert_raw_to_processed_unlocked
+ iio: adc: ad7124: fix config comparison
+ iio: adc: ad7124: fix chip ID mismatch
+ usb: dwc3: core: update LC timer as per USB Spec V3.2
+ binder: fix UAF caused by offsets overwrite
+ nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
+ uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
+ Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
+ VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
+ clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
+ clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
+ clocksource/drivers/timer-of: Remove percpu irq related code
+ uprobes: Use kzalloc to allocate xol area
+ perf/aux: Fix AUX buffer serialization
+ ksmbd: unset the binding mark of a reused connection
+ ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
+ nilfs2: replace snprintf in show functions with sysfs_emit
+ nilfs2: protect references to superblock parameters exposed in sysfs
+ workqueue: wq_watchdog_touch is always called with valid CPU
+ workqueue: Improve scalability of workqueue watchdog touch
+ ACPI: processor: Return an error if acpi_processor_get_info() fails in
processor_add()
+ ACPI: processor: Fix memory leaks in error paths of processor_add()
+ arm64: acpi: Move get_cpu_for_acpi_id() to a header
+ arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
+ nvmet-tcp: fix kernel crash if commands allocation fails
+ ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
+ drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
+ drm/i915/fence: Mark debug_fence_free() with __maybe_unused
+ gpio: rockchip: fix OF node leak in probe()
+ net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation
+ net: change maximum number of UDP segments to 128
+ gso: fix dodgy bit handling for GSO_UDP_L4
+ net: drop bad gso csum_start and offset in virtio_net_hdr
+ x86/mm: Fix PTI for i386 some more
+ net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
+ btrfs: fix race between direct IO write and fsync when using same fd
+ memcg: protect concurrent access to mem_cgroup_idr
+ udp: fix receiving fraglist GSO packets
Linux 5.15.167
- udp: fix receiving fraglist GSO packets
- memcg: protect concurrent access to mem_cgroup_idr
- btrfs: fix race between direct IO write and fsync when using same fd
- net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
- x86/mm: Fix PTI for i386 some more
- net: drop bad gso csum_start and offset in virtio_net_hdr
- gso: fix dodgy bit handling for GSO_UDP_L4
- net: change maximum number of UDP segments to 128
- net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation
- gpio: rockchip: fix OF node leak in probe()
- drm/i915/fence: Mark debug_fence_free() with __maybe_unused
- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
- nvmet-tcp: fix kernel crash if commands allocation fails
- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
- arm64: acpi: Move get_cpu_for_acpi_id() to a header
- ACPI: processor: Fix memory leaks in error paths of processor_add()
- ACPI: processor: Return an error if acpi_processor_get_info() fails in
processor_add()
- workqueue: Improve scalability of workqueue watchdog touch
- workqueue: wq_watchdog_touch is always called with valid CPU
- nilfs2: protect references to superblock parameters exposed in sysfs
- nilfs2: replace snprintf in show functions with sysfs_emit
- ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
- ksmbd: unset the binding mark of a reused connection
- perf/aux: Fix AUX buffer serialization
- uprobes: Use kzalloc to allocate xol area
- clocksource/drivers/timer-of: Remove percpu irq related code
- clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
- clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
- VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
- nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
- binder: fix UAF caused by offsets overwrite
- usb: dwc3: core: update LC timer as per USB Spec V3.2
- iio: adc: ad7124: fix chip ID mismatch
- iio: adc: ad7124: fix config comparison
- iio: fix scale application in iio_convert_raw_to_processed_unlocked
- iio: buffer-dmaengine: fix releasing dma channel on error
- staging: iio: frequency: ad9834: Validate frequency parameter value
- cifs: Check the lease context if we actually got a lease
- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
- ata: pata_macio: Use WARN instead of BUG
- MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
- lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
- of/irq: Prevent device address out-of-bounds read in interrupt map walk
- Squashfs: sanity check symbolic link size
- usbnet: ipheth: race between ipheth_close and error handling
- Input: uinput - reject requests with unreasonable number of slots
- HID: amd_sfh: free driver_data after destroying hid device
- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
- s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
- btrfs: initialize location to fix -Wmaybe-uninitialized in
btrfs_lookup_dentry()
- kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
- net: dpaa: avoid on-stack arrays of NR_CPUS elements
- PCI: Add missing bridge lock to pci_bus_lock()
- riscv: set trap vector earlier
- btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
- btrfs: clean up our handling of refs == 0 in snapshot delete
- btrfs: replace BUG_ON with ASSERT in walk_down_proc()
- fs/ntfs3: Check more cases when directory is corrupted
- smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
- dma-mapping: benchmark: Don't starve others when doing the test
- ext4: fix possible tid_t sequence overflows
- drm/amdgpu: Set no_hw_access when VF request full GPU fails
- libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
- hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
- hwmon: (lm95234) Fix underflows seen when writing limit attributes
- hwmon: (adc128d818) Fix underflows seen when writing limit attributes
- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
- devres: Initialize an uninitialized struct member
- um: line: always fill *error_out in setup_one_line()
- cgroup: Protect css->cgroup write under css_set_lock
- iommu/vt-d: Handle volatile descriptor status read
- dm init: Handle minors larger than 255
- ASoC: topology: Properly initialize soc_enum values
- net: dsa: vsc73xx: fix possible subblocks range of CAPT block
- net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
- fou: Fix null-ptr-deref in GRO.
- gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
- gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
- bareudp: Fix device stats updates.
- usbnet: modern method to get random MAC
- net: usb: don't write directly to netdev->dev_addr
- ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
- igc: Unlock on error in igc_io_resume()
- tcp_bpf: fix return value of tcp_bpf_sendmsg()
- platform/x86: dell-smbios: Fix error path in dell_smbios_init()
- igb: Fix not clearing TimeSync interrupts for 82580
- can: m_can: Release irq on error in m_can_open
- can: bcm: Remove proc entry when dev is unregistered.
- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
- pcmcia: Use resource_size function on resource object
- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
- media: vivid: don't set HDMI TX controls if there are no HDMI outputs
- drm/amd/display: Check HDCP returned status
- usb: uas: set host status byte on data completion error
- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
- leds: spi-byte: Call of_node_put() on error path
- media: vivid: fix wrong sizeimage value for mplane
- udf: Avoid excessive partition lengths
- netfilter: nf_conncount: fix wrong variable type
- iommu: sun50i: clear bypass register
- af_unix: Remove put_pid()/put_cred() in copy_peercred().
- irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
- smack: unix sockets: fix accept()ed socket label
- ALSA: hda: Add input value sanity checks to HDMI channel map controls
- mptcp: pm: send ACK on an active subflow
- mptcp: pr_debug: add missing \n at the end
- mptcp: pm: skip connecting to already established sf
- mptcp: pm: do not remove already closed subflows
- mptcp: pm: ADD_ADDR 0 is not a new address
- mptcp: close subflow when receiving TCP+FIN
- mptcp: avoid duplicated SUB_CLOSED events
- mptcp: pm: avoid possible UaF when selecting endp
- mptcp: constify a bunch of of helpers
- mptcp: pm: fullmesh: select the right ID later
- mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
- mptcp: pm: only decrement add_addr_accepted for MPJ req
- mptcp: pm: re-using ID of unused flushed subflows
- nilfs2: fix state management in error path of log writing function
- nilfs2: fix missing cleanup on rollforward recovery error
- sched: sch_cake: fix bulk flow accounting logic for host fairness
- ila: call nf_unregister_net_hooks() sooner
- tracing: Avoid possible softlockup in tracing_iter_reset()
- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
- clk: qcom: clk-alpha-pll: Fix the pll post div mask
- fuse: use unsigned type for getxattr/listxattr size truncation
- fuse: update stats for pages in dropped aux writeback list
- mmc: cqhci: Fix checking of CQHCI_HALT state
- mmc: sdhci-of-aspeed: fix module autoloading
- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
- Bluetooth: MGMT: Ignore keys being loaded with invalid type
- Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
- nvme-pci: Add sleep quirk for Samsung 990 Evo
- rtmutex: Drop rt_mutex::wait_lock before scheduling
- irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
- ata: libata: Fix memory leak for error path in ata_host_alloc()
- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
- ALSA: hda/realtek: add patch for internal mic in Lenovo V145
- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
- KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
- KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
- sch/netem: fix use after free in netem_dequeue
- i2c: Use IS_REACHABLE() for substituting empty ACPI functions
- ext4: handle redirtying in ext4_bio_write_page()
- udf: Limit file size to 4TB
- ext4: reject casefold inode flag without casefold feature
- rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
- virtio_net: Fix napi_skb_cache_put warning
- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
- media: uvcvideo: Enforce alignment of frame and interval
- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
- block: remove the blk_flush_integrity call in blk_integrity_unregister
- wifi: cfg80211: make hash table duplicates more survivable
- drm/bridge: tc358767: Check if fully initialized before signalling HPD event
via IRQ
- drm/meson: plane: Add error handling
- smack: tcp: ipv4, fix incorrect labeling
- fsnotify: clear PARENT_WATCHED flags lazily
- usb: typec: ucsi: Fix null pointer dereference in trace
- usbip: Don't submit special requests twice
- rcu/nocb: Remove buggy bypass lock contention mitigation
- ionic: fix potential irq name truncation
- RDMA/efa: Properly handle unexpected AQ completions
- hwspinlock: Introduce hwspin_lock_bust()
- PCI: al: Check IORESOURCE_BUS existence during probe
- cpufreq: scmi: Avoid overflow of target_freq in fast switch
- wifi: iwlwifi: remove fw_running op
- drm/amdgpu: update type of buf size to u32 for eeprom functions
- drm/amd/pm: check negtive return for table entries
- drm/amdgpu: the warning dereferencing obj for nbio_v7_4
- drm/amd/pm: check specific index for aldebaran
- drm/amdgpu: fix the waring dereferencing hive
- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
SOCs
- apparmor: fix possible NULL pointer dereference
- drm/amdkfd: Reconcile the definition and use of oem_id in struct
kfd_topology_device
- drm/amdgpu: fix mc_data out-of-bounds read warning
- drm/amdgpu: fix ucode out-of-bounds read warning
- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
- drm/amdgpu: Fix out-of-bounds write warning
- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
- drm/amdgpu/pm: Fix uninitialized variable warning for smu10
- drm/amd/amdgpu: Check tbo resource pointer
- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
- drm/amd/display: Check msg_id before processing transcation
- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
- drm/amd/display: Add array index check for hdcp ddc access
- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
- drm/amd/display: Check gpio_id before used as array index
- drm/amdgpu: avoid reading vf2pf info size from FB
- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
- drm/amdgpu: fix uninitialized scalar variable warning
- drm/amd/pm: fix the Out-of-bounds read warning
- drm/amd/pm: fix warning using uninitialized value of max_vid_step
- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
- drm/amdgpu: fix overflowed array index read warning
- drm/amd/display: Assign linear_pitch_alignment even for VM
- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
- net: usb: qmi_wwan: add MeiG Smart SRM825L
- dma-debug: avoid deadlock between dma debug vs printk and netconsole
- i2c: Fix conditional for substituting empty ACPI functions
- ALSA: hda/conexant: Mute speakers at suspend / shutdown
- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
- drm: panel-orientation-quirks: Add quirk for OrangePi Neo
+ UBUNTU: Upstream stable to v5.15.167
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2081279
Title:
Jammy update: v5.15.167 upstream stable release
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Jammy:
In Progress
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.167 upstream stable release
from git://git.kernel.org/
drm: panel-orientation-quirks: Add quirk for OrangePi Neo
ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
ALSA: hda/conexant: Mute speakers at suspend / shutdown
i2c: Fix conditional for substituting empty ACPI functions
dma-debug: avoid deadlock between dma debug vs printk and netconsole
net: usb: qmi_wwan: add MeiG Smart SRM825L
drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
drm/amd/display: Assign linear_pitch_alignment even for VM
drm/amdgpu: fix overflowed array index read warning
drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
drm/amd/pm: fix warning using uninitialized value of max_vid_step
drm/amd/pm: fix the Out-of-bounds read warning
drm/amdgpu: fix uninitialized scalar variable warning
drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
drm/amdgpu: avoid reading vf2pf info size from FB
drm/amd/display: Check gpio_id before used as array index
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
drm/amd/display: Add array index check for hdcp ddc access
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
drm/amd/display: Check msg_id before processing transcation
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
drm/amd/amdgpu: Check tbo resource pointer
drm/amdgpu/pm: Fix uninitialized variable warning for smu10
drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
drm/amdgpu: Fix out-of-bounds write warning
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
drm/amdgpu: fix ucode out-of-bounds read warning
drm/amdgpu: fix mc_data out-of-bounds read warning
drm/amdkfd: Reconcile the definition and use of oem_id in struct
kfd_topology_device
apparmor: fix possible NULL pointer dereference
drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
SOCs
drm/amdgpu: fix the waring dereferencing hive
drm/amd/pm: check specific index for aldebaran
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
drm/amd/pm: check negtive return for table entries
drm/amdgpu: update type of buf size to u32 for eeprom functions
wifi: iwlwifi: remove fw_running op
cpufreq: scmi: Avoid overflow of target_freq in fast switch
PCI: al: Check IORESOURCE_BUS existence during probe
hwspinlock: Introduce hwspin_lock_bust()
RDMA/efa: Properly handle unexpected AQ completions
ionic: fix potential irq name truncation
rcu/nocb: Remove buggy bypass lock contention mitigation
usbip: Don't submit special requests twice
usb: typec: ucsi: Fix null pointer dereference in trace
fsnotify: clear PARENT_WATCHED flags lazily
smack: tcp: ipv4, fix incorrect labeling
drm/meson: plane: Add error handling
drm/bridge: tc358767: Check if fully initialized before signalling HPD event
via IRQ
wifi: cfg80211: make hash table duplicates more survivable
block: remove the blk_flush_integrity call in blk_integrity_unregister
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
media: uvcvideo: Enforce alignment of frame and interval
drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
virtio_net: Fix napi_skb_cache_put warning
rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
ext4: reject casefold inode flag without casefold feature
udf: Limit file size to 4TB
ext4: handle redirtying in ext4_bio_write_page()
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
sch/netem: fix use after free in netem_dequeue
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
ALSA: hda/realtek: add patch for internal mic in Lenovo V145
ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
ata: libata: Fix memory leak for error path in ata_host_alloc()
irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
rtmutex: Drop rt_mutex::wait_lock before scheduling
nvme-pci: Add sleep quirk for Samsung 990 Evo
Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
Bluetooth: MGMT: Ignore keys being loaded with invalid type
mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
mmc: sdhci-of-aspeed: fix module autoloading
mmc: cqhci: Fix checking of CQHCI_HALT state
fuse: update stats for pages in dropped aux writeback list
fuse: use unsigned type for getxattr/listxattr size truncation
clk: qcom: clk-alpha-pll: Fix the pll post div mask
clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
tracing: Avoid possible softlockup in tracing_iter_reset()
ila: call nf_unregister_net_hooks() sooner
sched: sch_cake: fix bulk flow accounting logic for host fairness
nilfs2: fix missing cleanup on rollforward recovery error
nilfs2: fix state management in error path of log writing function
mptcp: pm: re-using ID of unused flushed subflows
mptcp: pm: only decrement add_addr_accepted for MPJ req
mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
mptcp: pm: fullmesh: select the right ID later
mptcp: constify a bunch of of helpers
mptcp: pm: avoid possible UaF when selecting endp
mptcp: avoid duplicated SUB_CLOSED events
mptcp: close subflow when receiving TCP+FIN
mptcp: pm: ADD_ADDR 0 is not a new address
mptcp: pm: do not remove already closed subflows
mptcp: pm: skip connecting to already established sf
mptcp: pr_debug: add missing \n at the end
mptcp: pm: send ACK on an active subflow
ALSA: hda: Add input value sanity checks to HDMI channel map controls
smack: unix sockets: fix accept()ed socket label
irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
af_unix: Remove put_pid()/put_cred() in copy_peercred().
iommu: sun50i: clear bypass register
netfilter: nf_conncount: fix wrong variable type
udf: Avoid excessive partition lengths
media: vivid: fix wrong sizeimage value for mplane
leds: spi-byte: Call of_node_put() on error path
wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
usb: uas: set host status byte on data completion error
drm/amd/display: Check HDCP returned status
media: vivid: don't set HDMI TX controls if there are no HDMI outputs
PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
pcmcia: Use resource_size function on resource object
drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
can: bcm: Remove proc entry when dev is unregistered.
can: m_can: Release irq on error in m_can_open
igb: Fix not clearing TimeSync interrupts for 82580
platform/x86: dell-smbios: Fix error path in dell_smbios_init()
tcp_bpf: fix return value of tcp_bpf_sendmsg()
igc: Unlock on error in igc_io_resume()
ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
net: usb: don't write directly to netdev->dev_addr
usbnet: modern method to get random MAC
bareudp: Fix device stats updates.
gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
fou: Fix null-ptr-deref in GRO.
net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
net: dsa: vsc73xx: fix possible subblocks range of CAPT block
ASoC: topology: Properly initialize soc_enum values
dm init: Handle minors larger than 255
iommu/vt-d: Handle volatile descriptor status read
cgroup: Protect css->cgroup write under css_set_lock
um: line: always fill *error_out in setup_one_line()
devres: Initialize an uninitialized struct member
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
hwmon: (lm95234) Fix underflows seen when writing limit attributes
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
drm/amdgpu: Set no_hw_access when VF request full GPU fails
ext4: fix possible tid_t sequence overflows
dma-mapping: benchmark: Don't starve others when doing the test
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
fs/ntfs3: Check more cases when directory is corrupted
btrfs: replace BUG_ON with ASSERT in walk_down_proc()
btrfs: clean up our handling of refs == 0 in snapshot delete
btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
riscv: set trap vector earlier
PCI: Add missing bridge lock to pci_bus_lock()
net: dpaa: avoid on-stack arrays of NR_CPUS elements
i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
btrfs: initialize location to fix -Wmaybe-uninitialized in
btrfs_lookup_dentry()
s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
HID: amd_sfh: free driver_data after destroying hid device
Input: uinput - reject requests with unreasonable number of slots
usbnet: ipheth: race between ipheth_close and error handling
Squashfs: sanity check symbolic link size
of/irq: Prevent device address out-of-bounds read in interrupt map walk
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
ata: pata_macio: Use WARN instead of BUG
NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
cifs: Check the lease context if we actually got a lease
staging: iio: frequency: ad9834: Validate frequency parameter value
iio: buffer-dmaengine: fix releasing dma channel on error
iio: fix scale application in iio_convert_raw_to_processed_unlocked
iio: adc: ad7124: fix config comparison
iio: adc: ad7124: fix chip ID mismatch
usb: dwc3: core: update LC timer as per USB Spec V3.2
binder: fix UAF caused by offsets overwrite
nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
clocksource/drivers/timer-of: Remove percpu irq related code
uprobes: Use kzalloc to allocate xol area
perf/aux: Fix AUX buffer serialization
ksmbd: unset the binding mark of a reused connection
ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
nilfs2: replace snprintf in show functions with sysfs_emit
nilfs2: protect references to superblock parameters exposed in sysfs
workqueue: wq_watchdog_touch is always called with valid CPU
workqueue: Improve scalability of workqueue watchdog touch
ACPI: processor: Return an error if acpi_processor_get_info() fails in
processor_add()
ACPI: processor: Fix memory leaks in error paths of processor_add()
arm64: acpi: Move get_cpu_for_acpi_id() to a header
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
nvmet-tcp: fix kernel crash if commands allocation fails
ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
drm/i915/fence: Mark debug_fence_free() with __maybe_unused
gpio: rockchip: fix OF node leak in probe()
net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation
net: change maximum number of UDP segments to 128
gso: fix dodgy bit handling for GSO_UDP_L4
net: drop bad gso csum_start and offset in virtio_net_hdr
x86/mm: Fix PTI for i386 some more
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
btrfs: fix race between direct IO write and fsync when using same fd
memcg: protect concurrent access to mem_cgroup_idr
udp: fix receiving fraglist GSO packets
Linux 5.15.167
UBUNTU: Upstream stable to v5.15.167
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2081279/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
