Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.217 upstream stable release
from git://git.kernel.org/
Linux 5.15.217
ring-buffer: Use current_context for safe per-CPU buffer swap
ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
jiffies: Cast to unsigned long in secs_to_jiffies() conversion
drm/virtio: Unlock reservations on dma_resv_reserve_fences() error
drm/vmwgfx: Reserve fence slots on buffer objects in cotables
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
net/x25: fix use-after-free of the socket by its timers
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
af_packet: Don't send zero-byte data in tpacket_snd().
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
net: packet: fix wrong transport_header when sending VLAN-tagged frame
netfilter: ipset: fix list type element drift bug
netfilter: flowtable: publish GC-visible tuple last
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
netfilter: ipset: fix refcount race between list:set GC and swap
crypto: ccm - Set rfc4309 maxauthsize from child
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
net/smc: rdma write inline if qp has sufficient inline space
net: atlantic: free stranded TX buffers on ring deinit
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
openvswitch: move key and ovs_cb update out of handle_fragments
net: sched: use skb_ip_totlen and iph_totlen
openvswitch: use skb_ip_totlen in conntrack
net: add a couple of helpers for iph tot_len
mm/ptdump: always stabilise against page table freeing using init_mm
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
drm/amd/pm: fix torn gpu metrics reads
ice: wait for reset completion in ice_resume()
jiffies: Define secs_to_jiffies()
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
i2c: iproc: reset bus after timeout if START_BUSY is stuck
i2c: bcm-iproc: remove printout on handled timeouts
i2c: imx: Fix slave registration race and error handling
binfmt_misc: restore write access when removing an entry
fs: don't block write during exec on pre-content watched files
fsnotify: opt-in for permission events at file open time
ice: fix memory leak in ice_lbtest_prepare_rings()
ice: fix VF interrupts cleanup
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
scsi: scsi_debug: Rename zone type constants
scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
scsi: sd: sd_zbc: Introduce struct zoned_disk_info
scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
scsi: sd: sd_zbc: Improve source code documentation
net: pktgen: fix proc entry use-after-free
net: pktgen: fix code style (WARNING: Block comments)
igc: remove napi_synchronize() in igc_down()
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
ksmbd: reject repeated SMB2 NEGOTIATE requests
ksmbd: conn lock to serialize smb2 negotiate
mm/vmstat: fold stranded per-cpu node stats when a node comes online
ksmbd: validate minimum PDU size for transform requests
smb/server: fix minimum SMB2 PDU size
smb/server: fix minimum SMB1 PDU size
ksmbd: rename smb2_get_msg to smb_get_msg
super: fix emergency thaw deadlock on frozen block devices
ftrace: Add global mutex to serialize trace_parser access
net/sched: serialize qdisc_rtab_list against concurrent get/put
ksmbd: defer destroy_previous_session() until after NTLM authentication
libceph: fix two unsafe bare decodes in decode_lockers()
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
ceph: print cluster fsid and client global_id in all debug logs
ceph: rename _to_client() to _to_fs_client()
libceph: add doutc and *_client debug macros support
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
libceph: Amend checking to fix `make W=1` build breakage
ceph: avoid fs reclaim while using current->journal_info
sctp: avoid auth_enable sysctl UAF during netns teardown
mptcp: decrement subflows counter on failed passive join
mptcp: fix subflow accounting on close
mptcp: cleanup MPJ subflow list handling
serial: sc16is7xx: implement gpio get_direction() callback
serial: sc16is7xx: fix regression with GPIO configuration
serial: sc16is7xx: remove obsolete out_thread label
serial: sc16is7xx: Fill in rs485_supported
sc16is7xx: Properly resume TX after stop
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
serial: 8250_mid: Remove unneeded test for ->setup() presence
wifi: brcmfmac: drain bus_reset work on device removal
ALSA: seq: close a re-opened queue timer in the destructor
media: v4l2-fwnode: Fix subdev owner overwritten in
v4l2_async_register_subdev_sensor()
media: v4l: async: Set owner for async sub-devices
wifi: ath6kl: fix use-after-free in aggr_reset_state()
media: imx219: Fix maximum frame length in lines
media: i2c: imx219: Rename VTS to FRM_LENGTH
media: i2c: imx219: Correct the minimum vblanking value
media: i2c: imx219: Drop IMX219_VTS_* macros
media: marvell-cam: fix missing pci_disable_device() on remove
drm/i915/hdcp: require monotonically increasing seq_num_v
drm/i915/hdcp: check streams[] bounds before overflow
drm/i915/vrr: require valid min/max vfreq for VRR
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
drm/virtio: bound EDID block reads to the response buffer
drm/virtio: Return proper error codes instead of -1
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
drm/tegra: fbdev: Remove offset into framebuffer memory
drm/displayid: fix Tiled Display Topology ID size
drm/virtio: use uninterruptible resv lock for plane updates
dma-buf/drivers: make reserving a shared slot mandatory v4
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
octeontx2-pf: fix SQB pointer leak on init failure
net: ipa: fix SMEM state handle leaks in SMP2P init
espintcp: use sk_msg_free_partial to fix partial send
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
bootconfig: do not put quotes on cmdline items unless necessary
net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
net/sched: taprio: avoid calling child->ops->dequeue(child) twice
gpio: tegra: do not call pinctrl for GPIO direction
treewide: rename pinctrl_gpio_direction_output_new()
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
net: mana: Validate the packet length reported by the NIC
net/sched: act_ct: preserve tc_skb_cb across defragmentation
net: ixp4xx_hss: fix duplicate HDLC netdev allocation
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
net: Add helper function to parse netlink msg of ip_tunnel_encap
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
mmc: vub300: fix use-after-free on probe failure
mmc: vub300: rename probe error labels
mmc: vub300: fix use-after-free on disconnect
Input: ims-pcu - fix firmware leak in async update
firmware_loader: introduce __free() cleanup hanler
dm-verity: make error counter atomic
dm-integrity: don't increment hash_offset twice
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
ovl: use linked upper dentry in copy-up tmpfile
bpf,fork: wipe ->bpf_storage before bailouts that access it
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
thunderbolt: Remove XDomain from the bus without holding tb->lock
thunderbolt: Remove service debugfs entries during unregister
thunderbolt: Keep XDomain reference during the lifetime of a service
thunderbolt: Update property.c function documentation
thunderbolt: Remove usage of the deprecated ida_simple_xx() API
can: esd_usb: kill anchored URBs before freeing netdevs
can/esd_usb2: Rename esd_usb2.c to esd_usb.c
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
i2c: imx: separate atomic, dma and non-dma use case
ksmbd: fix integer overflow in set_file_allocation_info()
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
smb: client: use kvzalloc() for megabyte buffer in simple fallocate
taskstats: retain dead thread stats in TGID queries
taskstats: fill_stats_for_tgid: use for_each_thread()
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
dmaengine: dw-edma: Detach the private data and chip info structures
dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
mtd: spi-nor: swp: Improve locking user experience
mtd: spi-nor: Fix spi_nor_try_unlock_all()
net: thunderbolt: Fix frags[] overflow by bounding frame_count
mtd: maps: vmu-flash: fix fault in unaligned fixup
9p: skip nlink update in cacheless mode to fix WARN_ON
ntfs3: validate split-point offset in indx_insert_into_buffer
fs/ntfs3: Undo critial modificatins to keep directory consistency
fs/ntfs3: Make ntfs_update_mftmirr return void
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
lsm: infrastructure management of the sock security
lsm: use default hook return value in call_int_hook()
remoteproc: qcom: Fix leak when custom dump_segments addition fails
remoteproc: qcom: pas: Adjust the phys addr wrt the mem region
remoteproc: qcom: fix sparse warnings
remoteproc: qcom: replace kstrdup with kstrndup
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
netfilter: nft_set_pipapo: merge deactivate helper into caller
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
netfilter: nf_conntrack_sip: remove net variable shadowing
netfilter: nft_set_pipapo: move prove_locking helper around
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
ASoC: mediatek: mt8192: Check runtime resume during probe
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
net: dst: add four helpers to annotate data-races around dst->dev
net: dst: annotate data-races around dst->output
net: dst: annotate data-races around dst->input
tcp: convert to dev_net_rcu()
ASoC: mediatek: mt8183: Check runtime resume during probe
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
octeontx2: Annotate mmio regions as __iomem
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
VDUSE: avoid leaking information to userspace
vduse: take out allocations from vduse_dev_alloc_coherent
vduse: remove unused vaddr parameter of vduse_domain_free_coherent
vduse: Use fixed 4KB bounce pages for non-4KB page size
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
tipc: restrict socket queue dumps in enqueue tracepoints
fbcon: Use correct type for vc_resize() return value
fbcon: Rename struct fbcon_ops to struct fbcon_par
rxrpc: serialize kernel accept preallocation with socket teardown
serial: max310x: implement gpio_chip::get_direction()
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
ALSA: hda: Fix cached processing coefficient verbs
audit: fix recursive locking deadlock in audit_dupe_exe()
audit: use 'unsigned int' instead of 'unsigned'
audit: widen ino fields to u64
VFS/audit: introduce kern_path_parent() for audit
ALSA: hda: conexant: Remove mic bias threshold override
Input: mms114 - reject an oversized device packet size
i2c: davinci: Unregister cpufreq notifier on probe failure
Input: mms114 - fix touch indexing for MMS134S and MMS136
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
udmabuf: Do not create malformed scatterlists
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
mm: do file ownership checks with the proper mount idmap
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
xfs: check v5 superblock features early
xfs: fix ilock leak on error in xfs_dq_get_next_id
drm/amdgpu: Fix UVD decode image min size calculation
drm/amdgpu: Implement insert_end for VCE 3
drm/amdgpu: Reject UVD message with dimensions above 4096
drm/amdgpu: validate GEM_CREATE domain combinations
drm/amdgpu: Reject UVD message with invalid number of h265 refs
s390/vfio_ccw: Fix out of bounds check on CCW array
drm/radeon: fix autosuspend cleanup during teardown
mmc: sdhci: make tuning_err a signed int
mmc: sdhci: unmap the bounce buffer before device release
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
libceph: tolerate addrvecs with multiple entries of the same type
ceph: fix MDS random selection readiness predicate
libceph: Avoid using invalid osd indices from primary_temp
Input: sur40 - fix V4L error path cleanup
Input: sur40 - fix input device registration ordering
openrisc: signal: do not restore privileged SR bits on sigreturn
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
libceph: fix multiple unsafe decodes in decode_locker()
crypto: qce - fix error path in devm_qce_register_algs
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
powerpc/pseries: lparcfg - fix kbuf[] underflow
Input: iforce - validate input packet lengths
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: psxpad-spi - set driver data before use
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
powerpc/pseries: pci - logic bug
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
ASoC: cs4265: sort the register default table
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
mptcp: options: reset DSS fields in case of unexpected size
selinux: do not cancel a policy conversion that never started
selinux: reject a class permission count below its inherited common
selinux: require every boolean value to be defined
ipvs: separate destination availability state
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW
initialization
media: mtk-vcodec: potential null pointer deference in SCP
f2fs: fix UAF issue in f2fs_merge_page_bio()
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Confirmed
** Affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168510
Title:
Jammy update: v5.15.217 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168510/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
