Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.199 upstream stable release
from git://git.kernel.org/
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
can: etas_es58x: allow partial RX URB allocation to succeed
nvmet-tcp: remove boilerplate code
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
net: update netdev_lock_{type,name}
macvlan: fix possible UAF in macvlan_forward_source()
ipv4: ip_gre: make ipgre_header() robust
vsock/test: add a final full barrier after run all tests
net/mlx5e: Restore destroying state bit after profile cleanup
selftests: drv-net: fix RPS mask handling for high CPU numbers
net/sched: sch_qfq: do not free existing class in qfq_change_class()
ASoC: tlv320adcx140: fix word length
textsearch: describe @list member in ts_ops search
mm, kfence: describe @slab parameter in __kfence_obj_info()
dmaengine: tegra-adma: Fix use-after-free
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth"
property is missing
phy: stm32-usphyc: Fix off by one in probe()
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
dmaengine: omap-dma: fix dma_pool resource leak in error paths
HID: usbhid: paper over wrong bNumDescriptor field
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon
receiving the second rts
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
phy: rockchip: inno-usb2: fix disconnection in gadget mode
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
usb: dwc3: Check for USB4 IP_NAME
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
USB: serial: option: add Telit LE910 MBIM composition
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
nvme-pci: disable secondary temp for Wodposit WPBSNM8
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
hrtimer: Fix softirq base check in update_needs_ipi()
EDAC/x38: Fix a resource leak in x38_probe1()
EDAC/i3200: Fix a resource leak in i3200_probe1()
x86/resctrl: Add missing resctrl initialization for Hygon
x86/resctrl: Fix memory bandwidth counter width for Hygon
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
dmaengine: bcm-sba-raid: fix device leak on probe
dmaengine: idxd: fix device leaks on compat bind and unbind
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
dmaengine: ti: k3-udma: fix device leak on udma lookup
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
posix-clock: introduce posix_clock_context concept
Fix memory leak in posix_clock_open()
posix-clock: Store file pointer in struct posix_clock_context
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
testptp: add option to shift clock by nanoseconds
testptp: Add support for testing ptp_clock_info .adjphase callback
selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
ptp: add testptp mask test
selftest/ptp: update ptp selftest to exercise the gettimex options
testptp: Add option to open PHC in readonly mode
net: usb: dm9601: remove broken SR9700 support
bonding: limit BOND_MODE_8023AD to Ethernet devices
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
amd-xgbe: avoid misleading per-packet error log
gue: Fix skb memleak with inner IP protocol 0.
netlink: add a proto specification for FOU
net: fou: rename the source for linking
net: fou: use policy and operation tables generated from the spec
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
l2tp: avoid one data-race in l2tp_tunnel_del_work()
ipvlan: Make the addrs_lock be per port
net/sched: Enforce that teql can only be used as root qdisc
net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
comedi: dmm32at: serialize use of paged registers
w1: fix redundant counter decrement in w1_attach_slave_device()
Revert "nfc/nci: Add the inconsistency check between the input data length and
count"
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
scsi: storvsc: Process unsupported MODE_SENSE_10
x86/kfence: avoid writing L1TF-vulnerable PTEs
staging:iio:adc:ad7280a: Register define cleanup.
iio: adc: ad7280a: handle spi_setup() errors in probe()
regmap: Fix race condition in hwspinlock irqsave routine
ALSA: usb: Increase volume range that triggers a warning
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
mISDN: annotate data-race around dev->work
ipv6: annotate data-race in ndisc_router_discovery()
usbnet: limit max_mtu based on device's hard_mtu
drm/amd/pm: Don't clear SI SMC table when setting power limit
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
bonding: provide a net pointer to __skb_flow_dissect()
octeontx2-af: Fix error handling
net/sched: act_ife: avoid possible NULL deref
x86: make page fault handling disable interrupts properly
leds: led-class: Only Add LED to leds_list when it is fully ready
of: fix reference count leak in of_alias_scan()
iio: adc: ad9467: fix ad9434 vref mask
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
wifi: ath10k: fix dma_free_coherent() pointer
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
wifi: rsi: Fix memory corruption due to not set vif driver data size
arm64: Set __nocfi on swsusp_arch_resume()
octeontx2: Fix otx2_dma_map_page() error return code
slimbus: core: fix runtime PM imbalance on report present
slimbus: core: fix device reference leak on report present
intel_th: fix device leak on output open()
uacce: fix cdev handling in the cleanup path
uacce: implement mremap in uacce_vm_ops to return -EPERM
uacce: ensure safe queue release with state management
netrom: fix double-free in nr_route_frame()
perf/x86/intel: Do not enable BTS for guests
irqchip/gic-v3-its: Avoid truncating memory addresses
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
migrate: correct lock ordering for hugetlb file folios
bpf: Do not let BPF test infra emit invalid GSO types to stack
bpf: Reject narrower access to pointer ctx fields
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
ipv6: use the right ifindex when replying to icmpv6 from localhost
rocker: fix memory leak in rocker_world_port_post_fini()
nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
ice: stop counting UDP csum mismatch as rx_errors
net/mlx5: Add HW definitions of vport debug counters
net/mlx5e: Expose rx_oversize_pkts_buffer counter
net/mlx5e: Report rx_discards_phy via rx_dropped
net/mlx5e: Account for netdev stats in ndo_get_stats64
nfc: nci: Fix race between rfkill and nci_unregister_device().
net: bridge: fix static key check
scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
dma/pool: distinguish between missing and exhausted atomic pools
ASoC: fsl: imx-card: Do not force slot width to sample width
scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
scsi: qla2xxx: edif: Fix dma_free_coherent() size
mptcp: only reset subflow errors when propagated
net: Add locking to protect skb->dev access in ip_output
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
comedi: Fix getting range information for subdevices 16 to 255
of: platform: Use default match table for /firmware
iio: adc: exynos_adc: fix OF populate on driver rebind
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
w1: w1_therm: use swap() to make code cleaner
w1: therm: Fix off-by-one buffer overflow in alarms_store
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
dmaengine: stm32: dmamux: fix device leak on route allocation
xfs: set max_agbno to allow sparse alloc of last full inode chunk
nvme-fc: rename free_ctrl callback to match name pattern
nvme-pci: do not directly handle subsys reset fallout
nvme: fix PCIe subsystem reset controller state transition
ALSA: scarlett2: Fix buffer overflow in config retrieval
mei: trace: treat reg parameter as string
ksmbd: smbd: fix dma_unmap_sg() nents
mm/pagewalk: add walk_page_range_vma()
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
fs/ntfs3: Initialize allocated memory before use
blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
espintcp: fix skb leaks
ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
NFSD: fix race between nfsd registration and exports_proc
usbnet: Fix using smp_processor_id() in preemptible code warnings
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
Bluetooth: Fix hci_suspend_sync crash
wifi: cfg80211: add a work abstraction with special semantics
wifi: mac80211: use wiphy work for sdata->work
wifi: mac80211: move TDLS work to wiphy work
HID: uclogic: Correct devm device reference for hidinput input_dev name
HID: uclogic: Add NULL check in uclogic_input_configured()
genirq/irq_sim: Initialize work context pointers properly
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
drm/amdkfd: fix a memory leak in device_queue_manager_init()
btrfs: prevent use-after-free on page private data in
btrfs_subpage_clear_uptodate()
net/sched: act_ife: convert comma to semicolon
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
drm/imx/tve: fix probe device leak
writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
mptcp: avoid dup SUB_CLOSED events after disconnect
pinctrl: meson: mark the GPIO controller as sleeping
team: Move team device type change at the end of team_port_add
wifi: cfg80211: use system_unbound_wq for wiphy work
wifi: cfg80211: fix wiphy delayed work queueing
wifi: cfg80211: cancel wiphy_work before freeing wiphy
wifi: cfg80211: fully move wiphy work to unbound workqueue
wifi: cfg80211: init wiphy_work before allocating rfkill fails
Linux 5.15.199
UBUNTU: Upstream stable to v5.15.199
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Vinicius Peixoto (vpeixoto)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Vinicius Peixoto (vpeixoto)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.199 upstream stable release
from git://git.kernel.org/
-
+ pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
+ can: etas_es58x: allow partial RX URB allocation to succeed
+ nvmet-tcp: remove boilerplate code
+ nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
+ ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
+ net: update netdev_lock_{type,name}
+ macvlan: fix possible UAF in macvlan_forward_source()
+ ipv4: ip_gre: make ipgre_header() robust
+ vsock/test: add a final full barrier after run all tests
+ net/mlx5e: Restore destroying state bit after profile cleanup
+ selftests: drv-net: fix RPS mask handling for high CPU numbers
+ net/sched: sch_qfq: do not free existing class in qfq_change_class()
+ ASoC: tlv320adcx140: fix word length
+ textsearch: describe @list member in ts_ops search
+ mm, kfence: describe @slab parameter in __kfence_obj_info()
+ dmaengine: tegra-adma: Fix use-after-free
+ dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth"
property is missing
+ phy: stm32-usphyc: Fix off by one in probe()
+ phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
+ dmaengine: omap-dma: fix dma_pool resource leak in error paths
+ HID: usbhid: paper over wrong bNumDescriptor field
+ ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
+ net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon
receiving the second rts
+ x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
+ phy: rockchip: inno-usb2: fix disconnection in gadget mode
+ phy: rockchip: inno-usb2: fix communication disruption in gadget mode
+ phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
+ usb: dwc3: Check for USB4 IP_NAME
+ USB: OHCI/UHCI: Add soft dependencies on ehci_platform
+ USB: serial: option: add Telit LE910 MBIM composition
+ USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
+ nvme-pci: disable secondary temp for Wodposit WPBSNM8
+ ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
+ hrtimer: Fix softirq base check in update_needs_ipi()
+ EDAC/x38: Fix a resource leak in x38_probe1()
+ EDAC/i3200: Fix a resource leak in i3200_probe1()
+ x86/resctrl: Add missing resctrl initialization for Hygon
+ x86/resctrl: Fix memory bandwidth counter width for Hygon
+ mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
+ drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
+ drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
+ drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
+ dmaengine: at_hdmac: fix device leak on of_dma_xlate()
+ dmaengine: bcm-sba-raid: fix device leak on probe
+ dmaengine: idxd: fix device leaks on compat bind and unbind
+ dmaengine: lpc18xx-dmamux: fix device leak on route allocation
+ dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
+ dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
+ dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
+ dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
+ dmaengine: ti: k3-udma: fix device leak on udma lookup
+ btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
+ posix-clock: introduce posix_clock_context concept
+ Fix memory leak in posix_clock_open()
+ posix-clock: Store file pointer in struct posix_clock_context
+ ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
+ testptp: add option to shift clock by nanoseconds
+ testptp: Add support for testing ptp_clock_info .adjphase callback
+ selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
+ selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
+ ptp: add testptp mask test
+ selftest/ptp: update ptp selftest to exercise the gettimex options
+ testptp: Add option to open PHC in readonly mode
+ net: usb: dm9601: remove broken SR9700 support
+ bonding: limit BOND_MODE_8023AD to Ethernet devices
+ sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
+ amd-xgbe: avoid misleading per-packet error log
+ gue: Fix skb memleak with inner IP protocol 0.
+ netlink: add a proto specification for FOU
+ net: fou: rename the source for linking
+ net: fou: use policy and operation tables generated from the spec
+ fou: Don't allow 0 for FOU_ATTR_IPPROTO.
+ l2tp: avoid one data-race in l2tp_tunnel_del_work()
+ ipvlan: Make the addrs_lock be per port
+ net/sched: Enforce that teql can only be used as root qdisc
+ net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
+ crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
+ comedi: dmm32at: serialize use of paged registers
+ w1: fix redundant counter decrement in w1_attach_slave_device()
+ Revert "nfc/nci: Add the inconsistency check between the input data length
and count"
+ Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
+ Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
+ scsi: storvsc: Process unsupported MODE_SENSE_10
+ x86/kfence: avoid writing L1TF-vulnerable PTEs
+ staging:iio:adc:ad7280a: Register define cleanup.
+ iio: adc: ad7280a: handle spi_setup() errors in probe()
+ regmap: Fix race condition in hwspinlock irqsave routine
+ ALSA: usb: Increase volume range that triggers a warning
+ net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
+ net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
+ mISDN: annotate data-race around dev->work
+ ipv6: annotate data-race in ndisc_router_discovery()
+ usbnet: limit max_mtu based on device's hard_mtu
+ drm/amd/pm: Don't clear SI SMC table when setting power limit
+ drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
+ be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
+ bonding: provide a net pointer to __skb_flow_dissect()
+ octeontx2-af: Fix error handling
+ net/sched: act_ife: avoid possible NULL deref
+ x86: make page fault handling disable interrupts properly
+ leds: led-class: Only Add LED to leds_list when it is fully ready
+ of: fix reference count leak in of_alias_scan()
+ iio: adc: ad9467: fix ad9434 vref mask
+ iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
+ iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
+ ALSA: ctxfi: Fix potential OOB access in audio mixer handling
+ ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
+ mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
+ wifi: ath10k: fix dma_free_coherent() pointer
+ wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
+ wifi: rsi: Fix memory corruption due to not set vif driver data size
+ arm64: Set __nocfi on swsusp_arch_resume()
+ octeontx2: Fix otx2_dma_map_page() error return code
+ slimbus: core: fix runtime PM imbalance on report present
+ slimbus: core: fix device reference leak on report present
+ intel_th: fix device leak on output open()
+ uacce: fix cdev handling in the cleanup path
+ uacce: implement mremap in uacce_vm_ops to return -EPERM
+ uacce: ensure safe queue release with state management
+ netrom: fix double-free in nr_route_frame()
+ perf/x86/intel: Do not enable BTS for guests
+ irqchip/gic-v3-its: Avoid truncating memory addresses
+ can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
+ can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
+ can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
+ can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
+ migrate: correct lock ordering for hugetlb file folios
+ bpf: Do not let BPF test infra emit invalid GSO types to stack
+ bpf: Reject narrower access to pointer ctx fields
+ Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
+ net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
+ net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
+ ipv6: use the right ifindex when replying to icmpv6 from localhost
+ rocker: fix memory leak in rocker_world_port_post_fini()
+ nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
+ ice: stop counting UDP csum mismatch as rx_errors
+ net/mlx5: Add HW definitions of vport debug counters
+ net/mlx5e: Expose rx_oversize_pkts_buffer counter
+ net/mlx5e: Report rx_discards_phy via rx_dropped
+ net/mlx5e: Account for netdev stats in ndo_get_stats64
+ nfc: nci: Fix race between rfkill and nci_unregister_device().
+ net: bridge: fix static key check
+ scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
+ gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
+ dma/pool: distinguish between missing and exhausted atomic pools
+ ASoC: fsl: imx-card: Do not force slot width to sample width
+ scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
+ scsi: qla2xxx: edif: Fix dma_free_coherent() size
+ mptcp: only reset subflow errors when propagated
+ net: Add locking to protect skb->dev access in ip_output
+ tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
+ comedi: Fix getting range information for subdevices 16 to 255
+ of: platform: Use default match table for /firmware
+ iio: adc: exynos_adc: fix OF populate on driver rebind
+ scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
+ arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
+ w1: w1_therm: use swap() to make code cleaner
+ w1: therm: Fix off-by-one buffer overflow in alarms_store
+ dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
+ dmaengine: stm32: dmamux: fix device leak on route allocation
+ xfs: set max_agbno to allow sparse alloc of last full inode chunk
+ nvme-fc: rename free_ctrl callback to match name pattern
+ nvme-pci: do not directly handle subsys reset fallout
+ nvme: fix PCIe subsystem reset controller state transition
+ ALSA: scarlett2: Fix buffer overflow in config retrieval
+ mei: trace: treat reg parameter as string
+ ksmbd: smbd: fix dma_unmap_sg() nents
+ mm/pagewalk: add walk_page_range_vma()
+ ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
+ drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
+ ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
+ fs/ntfs3: Initialize allocated memory before use
+ blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
+ espintcp: fix skb leaks
+ ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
+ NFSD: fix race between nfsd registration and exports_proc
+ usbnet: Fix using smp_processor_id() in preemptible code warnings
+ net: stmmac: make sure that ptp_rate is not 0 before configuring EST
+ Bluetooth: Fix hci_suspend_sync crash
+ wifi: cfg80211: add a work abstraction with special semantics
+ wifi: mac80211: use wiphy work for sdata->work
+ wifi: mac80211: move TDLS work to wiphy work
+ HID: uclogic: Correct devm device reference for hidinput input_dev name
+ HID: uclogic: Add NULL check in uclogic_input_configured()
+ genirq/irq_sim: Initialize work context pointers properly
+ can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
+ drm/amdkfd: fix a memory leak in device_queue_manager_init()
+ btrfs: prevent use-after-free on page private data in
btrfs_subpage_clear_uptodate()
+ net/sched: act_ife: convert comma to semicolon
+ pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
+ drm/imx/tve: fix probe device leak
+ writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
+ mptcp: avoid dup SUB_CLOSED events after disconnect
+ pinctrl: meson: mark the GPIO controller as sleeping
+ team: Move team device type change at the end of team_port_add
+ wifi: cfg80211: use system_unbound_wq for wiphy work
+ wifi: cfg80211: fix wiphy delayed work queueing
+ wifi: cfg80211: cancel wiphy_work before freeing wiphy
+ wifi: cfg80211: fully move wiphy work to unbound workqueue
+ wifi: cfg80211: init wiphy_work before allocating rfkill fails
Linux 5.15.199
- wifi: cfg80211: init wiphy_work before allocating rfkill fails
- wifi: cfg80211: fully move wiphy work to unbound workqueue
- wifi: cfg80211: cancel wiphy_work before freeing wiphy
- wifi: cfg80211: fix wiphy delayed work queueing
- wifi: cfg80211: use system_unbound_wq for wiphy work
- team: Move team device type change at the end of team_port_add
- pinctrl: meson: mark the GPIO controller as sleeping
- mptcp: avoid dup SUB_CLOSED events after disconnect
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
- drm/imx/tve: fix probe device leak
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
- net/sched: act_ife: convert comma to semicolon
- btrfs: prevent use-after-free on page private data in
btrfs_subpage_clear_uptodate()
- drm/amdkfd: fix a memory leak in device_queue_manager_init()
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
- genirq/irq_sim: Initialize work context pointers properly
- HID: uclogic: Add NULL check in uclogic_input_configured()
- HID: uclogic: Correct devm device reference for hidinput input_dev name
- wifi: mac80211: move TDLS work to wiphy work
- wifi: mac80211: use wiphy work for sdata->work
- wifi: cfg80211: add a work abstraction with special semantics
- Bluetooth: Fix hci_suspend_sync crash
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST
- usbnet: Fix using smp_processor_id() in preemptible code warnings
- NFSD: fix race between nfsd registration and exports_proc
- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
- espintcp: fix skb leaks
- blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
- fs/ntfs3: Initialize allocated memory before use
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
- drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
- mm/pagewalk: add walk_page_range_vma()
- ksmbd: smbd: fix dma_unmap_sg() nents
- mei: trace: treat reg parameter as string
- ALSA: scarlett2: Fix buffer overflow in config retrieval
- nvme: fix PCIe subsystem reset controller state transition
- nvme-pci: do not directly handle subsys reset fallout
- nvme-fc: rename free_ctrl callback to match name pattern
- xfs: set max_agbno to allow sparse alloc of last full inode chunk
- dmaengine: stm32: dmamux: fix device leak on route allocation
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
- w1: therm: Fix off-by-one buffer overflow in alarms_store
- w1: w1_therm: use swap() to make code cleaner
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
- iio: adc: exynos_adc: fix OF populate on driver rebind
- of: platform: Use default match table for /firmware
- comedi: Fix getting range information for subdevices 16 to 255
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
- net: Add locking to protect skb->dev access in ip_output
- mptcp: only reset subflow errors when propagated
- scsi: qla2xxx: edif: Fix dma_free_coherent() size
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
- ASoC: fsl: imx-card: Do not force slot width to sample width
- dma/pool: distinguish between missing and exhausted atomic pools
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
- net: bridge: fix static key check
- nfc: nci: Fix race between rfkill and nci_unregister_device().
- net/mlx5e: Account for netdev stats in ndo_get_stats64
- net/mlx5e: Report rx_discards_phy via rx_dropped
- net/mlx5e: Expose rx_oversize_pkts_buffer counter
- net/mlx5: Add HW definitions of vport debug counters
- ice: stop counting UDP csum mismatch as rx_errors
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
- rocker: fix memory leak in rocker_world_port_post_fini()
- ipv6: use the right ifindex when replying to icmpv6 from localhost
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
- bpf: Reject narrower access to pointer ctx fields
- bpf: Do not let BPF test infra emit invalid GSO types to stack
- migrate: correct lock ordering for hugetlb file folios
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
- irqchip/gic-v3-its: Avoid truncating memory addresses
- perf/x86/intel: Do not enable BTS for guests
- netrom: fix double-free in nr_route_frame()
- uacce: ensure safe queue release with state management
- uacce: implement mremap in uacce_vm_ops to return -EPERM
- uacce: fix cdev handling in the cleanup path
- intel_th: fix device leak on output open()
- slimbus: core: fix device reference leak on report present
- slimbus: core: fix runtime PM imbalance on report present
- octeontx2: Fix otx2_dma_map_page() error return code
- arm64: Set __nocfi on swsusp_arch_resume()
- wifi: rsi: Fix memory corruption due to not set vif driver data size
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
- wifi: ath10k: fix dma_free_coherent() pointer
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
- iio: adc: ad9467: fix ad9434 vref mask
- of: fix reference count leak in of_alias_scan()
- leds: led-class: Only Add LED to leds_list when it is fully ready
- x86: make page fault handling disable interrupts properly
- net/sched: act_ife: avoid possible NULL deref
- octeontx2-af: Fix error handling
- bonding: provide a net pointer to __skb_flow_dissect()
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
- drm/amd/pm: Don't clear SI SMC table when setting power limit
- usbnet: limit max_mtu based on device's hard_mtu
- ipv6: annotate data-race in ndisc_router_discovery()
- mISDN: annotate data-race around dev->work
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
- ALSA: usb: Increase volume range that triggers a warning
- regmap: Fix race condition in hwspinlock irqsave routine
- iio: adc: ad7280a: handle spi_setup() errors in probe()
- staging:iio:adc:ad7280a: Register define cleanup.
- x86/kfence: avoid writing L1TF-vulnerable PTEs
- scsi: storvsc: Process unsupported MODE_SENSE_10
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
- Revert "nfc/nci: Add the inconsistency check between the input data length
and count"
- w1: fix redundant counter decrement in w1_attach_slave_device()
- comedi: dmm32at: serialize use of paged registers
- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
- net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
- net/sched: Enforce that teql can only be used as root qdisc
- ipvlan: Make the addrs_lock be per port
- l2tp: avoid one data-race in l2tp_tunnel_del_work()
- fou: Don't allow 0 for FOU_ATTR_IPPROTO.
- net: fou: use policy and operation tables generated from the spec
- net: fou: rename the source for linking
- netlink: add a proto specification for FOU
- gue: Fix skb memleak with inner IP protocol 0.
- amd-xgbe: avoid misleading per-packet error log
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
- bonding: limit BOND_MODE_8023AD to Ethernet devices
- net: usb: dm9601: remove broken SR9700 support
- testptp: Add option to open PHC in readonly mode
- selftest/ptp: update ptp selftest to exercise the gettimex options
- ptp: add testptp mask test
- selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
- selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
- testptp: Add support for testing ptp_clock_info .adjphase callback
- testptp: add option to shift clock by nanoseconds
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
- posix-clock: Store file pointer in struct posix_clock_context
- Fix memory leak in posix_clock_open()
- posix-clock: introduce posix_clock_context concept
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
- dmaengine: ti: k3-udma: fix device leak on udma lookup
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation
- dmaengine: idxd: fix device leaks on compat bind and unbind
- dmaengine: bcm-sba-raid: fix device leak on probe
- dmaengine: at_hdmac: fix device leak on of_dma_xlate()
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
- x86/resctrl: Fix memory bandwidth counter width for Hygon
- x86/resctrl: Add missing resctrl initialization for Hygon
- EDAC/i3200: Fix a resource leak in i3200_probe1()
- EDAC/x38: Fix a resource leak in x38_probe1()
- hrtimer: Fix softirq base check in update_needs_ipi()
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
- nvme-pci: disable secondary temp for Wodposit WPBSNM8
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
- USB: serial: option: add Telit LE910 MBIM composition
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform
- usb: dwc3: Check for USB4 IP_NAME
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode
- phy: rockchip: inno-usb2: fix disconnection in gadget mode
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon
receiving the second rts
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
- HID: usbhid: paper over wrong bNumDescriptor field
- dmaengine: omap-dma: fix dma_pool resource leak in error paths
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
- phy: stm32-usphyc: Fix off by one in probe()
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth"
property is missing
- dmaengine: tegra-adma: Fix use-after-free
- mm, kfence: describe @slab parameter in __kfence_obj_info()
- textsearch: describe @list member in ts_ops search
- ASoC: tlv320adcx140: fix word length
- net/sched: sch_qfq: do not free existing class in qfq_change_class()
- selftests: drv-net: fix RPS mask handling for high CPU numbers
- net/mlx5e: Restore destroying state bit after profile cleanup
- vsock/test: add a final full barrier after run all tests
- ipv4: ip_gre: make ipgre_header() robust
- macvlan: fix possible UAF in macvlan_forward_source()
- net: update netdev_lock_{type,name}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
- nvmet-tcp: remove boilerplate code
- can: etas_es58x: allow partial RX URB allocation to succeed
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
+ UBUNTU: Upstream stable to v5.15.199
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2143304
Title:
Jammy update: v5.15.199 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2143304/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
