Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.113 upstream stable release
from git://git.kernel.org/
drm/mipi-dsi: Set the fwnode for mipi_dsi_device
ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
tick/broadcast: Make broadcast device replacement work correctly
linux/dim: Do nothing if no time delta between samples
net: stmmac: switch to use interrupt for hw crosstimestamping
net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register
net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
netfilter: nf_tables: always release netdev hooks from notifier
netfilter: conntrack: fix possible bug_on with enable_hooks=1
netlink: annotate accesses to nlk->cb_running
net: annotate sk->sk_err write from do_recvmmsg()
net: deal with most data-races in sk_wait_event()
net: add vlan_get_protocol_and_depth() helper
tcp: add annotations around sk->sk_shutdown accesses
gve: Remove the code of clearing PBA bit
net: datagram: fix data-races in datagram_poll()
af_unix: Fix a data race of sk->sk_receive_queue->qlen.
af_unix: Fix data races around sk->sk_shutdown.
drm/i915/dp: prevent potential div-by-zero
fbdev: arcfb: Fix error handling in arcfb_probe()
ext4: remove an unused variable warning with CONFIG_QUOTA=n
ext4: reflect error codes from ext4_multi_mount_protect() to its callers
ext4: fix lockdep warning when enabling MMP
ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
ext4: allow ext4_get_group_info() to fail
refscale: Move shutdown from wait_event() to wait_event_idle()
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
drm/displayid: add displayid_get_header() and check bounds better
drm/amd/display: Use DC_LOG_DC in the trasform pixel function
regmap: cache: Return error in cache sync operations for REGCACHE_NONE
arm64: dts: qcom: msm8996: Add missing DWC3 quirks
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
firmware: arm_sdei: Fix sleep from invalid context BUG
ACPI: EC: Fix oops when removing custom query handlers
remoteproc: stm32_rproc: Add mutex protection for workqueue
drm/tegra: Avoid potential 32-bit integer overflow
drm/msm/dp: Clean up handling of DP AUX interrupts
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in
acpi_db_display_objects
drm/amd: Fix an out of bounds error in BIOS parser
media: Prefer designated initializers over memset for subdev pad ops
wifi: ath: Silence memcpy run-time false positive warning
bpf: Annotate data races in bpf_local_storage
wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
ext2: Check block size validity during mount
scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
bnxt: avoid overflow in bnxt_get_nvram_directory()
net: pasemi: Fix return type of pasemi_mac_start_tx()
net: Catch invalid index in XPS mapping
scsi: target: iscsit: Free cmds before session free
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race
condition
gfs2: Fix inode height consistency check
scsi: ufs: ufs-pci: Add support for Intel Lunar Lake
ext4: set goal start correctly in ext4_mb_normalize_request
ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
f2fs: fix to drop all dirty pages during umount() if cp_error is set
f2fs: fix to check readonly condition correctly
samples/bpf: Fix fout leak in hbm's run_bpf_prog
bpf: Add preempt_count_{sub,add} into btf id deny list
wifi: iwlwifi: pcie: fix possible NULL pointer dereference
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
null_blk: Always check queue mode setting from configfs
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
wifi: ath11k: Fix SKB corruption in REO destination ring
nbd: fix incomplete validation of ioctl arg
ipvs: Update width of source for ip_vs_sync_conn_options
Bluetooth: btintel: Add LE States quirk support
Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
HID: logitech-hidpp: Don't use the USB serial for USB devices
HID: logitech-hidpp: Reconcile USB and Unifying serials
spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
HID: wacom: generic: Set battery quirk only when we see battery data
usb: typec: tcpm: fix multiple times discover svids error
serial: 8250: Reinit port->pm on port specific driver unbind
mcb-pci: Reallocate memory region to avoid memory overlapping
sched: Fix KCSAN noinstr violation
recordmcount: Fix memory leaks in the uwrite function
RDMA/core: Fix multiple -Warray-bounds warnings
iommu/arm-smmu-qcom: Limit the SMR groups to 128
fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'
fs/ntfs3: Enhance the attribute size check
fs/ntfs3: Fix NULL dereference in ni_write_inode
fs/ntfs3: Validate MFT flags before replaying logs
fs/ntfs3: Add length check in indx_get_root
fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
clk: tegra20: fix gcc-7 constant overflow warning
iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
iommu/sprd: Release dma buffer to avoid memory leak
Input: xpad - add constants for GIP interface numbers
phy: st: miphy28lp: use _poll_timeout functions for waits
soundwire: qcom: gracefully handle too many ports in DT
mfd: dln2: Fix memory leak in dln2_probe()
parisc: Replace regular spinlock with spin_trylock on panic path
platform/x86: hp-wmi: Support touchpad on/off
UBUNTU: [Config] updateconfigs for X86_PLATFORM_DRIVERS_HP
platform/x86: Move existing HP drivers to a new hp subdir
platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct
xfrm: don't check the default policy if the policy allows the packet
Revert "Fix XFRM-I support for nested ESP tunnels"
drm/msm/dp: unregister audio driver during unbind
drm/msm/dpu: Add INTF_5 interrupts
drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header
drm/msm/dpu: Remove duplicate register defines from INTF
dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and
qcom, sync-dual-dsi
ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
cpupower: Make TSC read per CPU for Mperf monitor
af_key: Reject optional tunnel/BEET mode templates in outbound policies
selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test
selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test
net: fec: Better handle pm_runtime_get() failing in .remove()
net: phy: dp83867: add w/a for packet errors seen with short cables
ALSA: firewire-digi00x: prevent potential use after free
ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
vsock: avoid to close connected socket after the timeout
tcp: fix possible sk_priority leak in tcp_v4_send_reset()
serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
serial: 8250_bcm7271: balance clk_enable calls
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
erspan: get the proto with the md version for collect_md
net: hns3: fix output information incomplete for dumping tx queue info with
debugfs
net: hns3: fix sending pfc frames after reset issue
net: hns3: fix reset delay time to avoid configuration timeout
media: netup_unidvb: fix use-after-free at del_timer()
SUNRPC: double free xprt_ctxt while still in use
tracing: Introduce helpers to safely handle dynamic-sized sockaddrs
SUNRPC: Clean up svc_deferred_class trace events
SUNRPC: Remove dead code in svc_tcp_release_rqst()
SUNRPC: Remove svc_rqst::rq_xprt_hlen
SUNRPC: always free ctxt when freeing deferred request
SUNRPC: Fix trace_svc_register() call site
drm/exynos: fix g2d_open/close helper function definitions
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
virtio-net: Maintain reverse cleanup order
virtio_net: Fix error unwinding of XDP initialization
tipc: add tipc_bearer_min_mtu to calculate min mtu
tipc: do not update mtu if msg_max is too small in mtu negotiation
tipc: check the bearer min mtu properly when setting it by netlink
s390/cio: include subchannels without devices also for evaluation
net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
net: bcmgenet: Restore phy_stop() depending upon suspend/close
wifi: mac80211: fix min center freq offset tracing
wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
wifi: iwlwifi: mvm: don't trust firmware n_channels
scsi: storvsc: Don't pass unused PFNs to Hyper-V host
cassini: Fix a memory leak in the error handling path of cas_init_one()
net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
igb: fix bit_shift to be in [1..8] range
vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
netfilter: nf_tables: fix nft_trans type confusion
netfilter: nft_set_rbtree: fix null deref on element insertion
bridge: always declare tunnel functions
ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
USB: usbtmc: Fix direction for 0-length ioctl control messages
usb-storage: fix deadlock when a scsi command timeouts more than once
USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
usb: dwc3: debugfs: Resume dwc3 before accessing registers
usb: gadget: u_ether: Fix host MAC address case
usb: typec: altmodes/displayport: fix pin_assignment_show
xhci-pci: Only run d3cold avoidance quirk for s2idle
xhci: Fix incorrect tracking of free space on transfer rings
ALSA: hda: Fix Oops by 9.1 surround channel names
ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
ALSA: hda/realtek: Add quirk for Clevo L140AU
ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
can: kvaser_pciefd: Call request_irq() before enabling interrupts
can: kvaser_pciefd: Empty SRB buffer in probe
can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
can: kvaser_pciefd: Disable interrupts in probe error path
SMB3: Close all deferred handles of inode in case of handle lease break
SMB3: drop reference to cfile before sending oplock break
ksmbd: smb2: Allow messages padded to 8byte boundary
ksmbd: allocate one more byte for implied bcc[0]
ksmbd: fix wrong UserName check in session_user
ksmbd: fix global-out-of-bounds in smb2_find_context_vals
statfs: enforce statfs[64] structure initialization
serial: Add support for Advantech PCI-1611U card
serial: 8250_exar: Add support for USR298x PCI Modems
serial: qcom-geni: fix enabling deactivated interrupt
thunderbolt: Clear registers properly when auto clear isn't in use
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
ceph: force updating the msg pointer in non-split case
powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device
tpm/tpm_tis: Disable interrupts for more Lenovo devices
powerpc/64s/radix: Fix soft dirty tracking
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
s390/qdio: fix do_sqbs() inline assembly constraint
HID: wacom: Force pen out of prox if no events have been received in a while
HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
HID: wacom: add three styli to wacom_intuos_get_tool_type
Linux 5.15.113
UBUNTU: Upstream stable to v5.15.113
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Kamal Mostafa (kamalmostafa)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Description changed:
+ SRU Justification
- SRU Justification
+ Impact:
+ The upstream process for stable tree updates is quite similar
+ in scope to the Ubuntu SRU process, e.g., each patch has to
+ demonstrably fix a bug, and each patch is vetted by upstream
+ by originating either directly from a mainline/stable Linux tree or
+ a minimally backported form of that patch. The following upstream
+ stable patches should be included in the Ubuntu kernel:
- Impact:
- The upstream process for stable tree updates is quite similar
- in scope to the Ubuntu SRU process, e.g., each patch has to
- demonstrably fix a bug, and each patch is vetted by upstream
- by originating either directly from a mainline/stable Linux tree or
- a minimally backported form of that patch. The following upstream
- stable patches should be included in the Ubuntu kernel:
+ v5.15.113 upstream stable release
+ from git://git.kernel.org/
- v5.15.113 upstream stable release
- from git://git.kernel.org/
+ drm/mipi-dsi: Set the fwnode for mipi_dsi_device
+ ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
+ net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
+ scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
+ tick/broadcast: Make broadcast device replacement work correctly
+ linux/dim: Do nothing if no time delta between samples
+ net: stmmac: switch to use interrupt for hw crosstimestamping
+ net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register
+ net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
+ netfilter: nf_tables: always release netdev hooks from notifier
+ netfilter: conntrack: fix possible bug_on with enable_hooks=1
+ netlink: annotate accesses to nlk->cb_running
+ net: annotate sk->sk_err write from do_recvmmsg()
+ net: deal with most data-races in sk_wait_event()
+ net: add vlan_get_protocol_and_depth() helper
+ tcp: add annotations around sk->sk_shutdown accesses
+ gve: Remove the code of clearing PBA bit
+ net: datagram: fix data-races in datagram_poll()
+ af_unix: Fix a data race of sk->sk_receive_queue->qlen.
+ af_unix: Fix data races around sk->sk_shutdown.
+ drm/i915/dp: prevent potential div-by-zero
+ fbdev: arcfb: Fix error handling in arcfb_probe()
+ ext4: remove an unused variable warning with CONFIG_QUOTA=n
+ ext4: reflect error codes from ext4_multi_mount_protect() to its callers
+ ext4: fix lockdep warning when enabling MMP
+ ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
+ ext4: allow ext4_get_group_info() to fail
+ refscale: Move shutdown from wait_event() to wait_event_idle()
+ rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
+ fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
+ drm/displayid: add displayid_get_header() and check bounds better
+ drm/amd/display: Use DC_LOG_DC in the trasform pixel function
+ regmap: cache: Return error in cache sync operations for REGCACHE_NONE
+ arm64: dts: qcom: msm8996: Add missing DWC3 quirks
+ media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and
buffer_finish()
+ media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
+ firmware: arm_sdei: Fix sleep from invalid context BUG
+ ACPI: EC: Fix oops when removing custom query handlers
+ remoteproc: stm32_rproc: Add mutex protection for workqueue
+ drm/tegra: Avoid potential 32-bit integer overflow
+ drm/msm/dp: Clean up handling of DP AUX interrupts
+ ACPICA: Avoid undefined behavior: applying zero offset to null pointer
+ ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in
acpi_db_display_objects
+ drm/amd: Fix an out of bounds error in BIOS parser
+ media: Prefer designated initializers over memset for subdev pad ops
+ wifi: ath: Silence memcpy run-time false positive warning
+ bpf: Annotate data races in bpf_local_storage
+ wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
+ ext2: Check block size validity during mount
+ scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
+ bnxt: avoid overflow in bnxt_get_nvram_directory()
+ net: pasemi: Fix return type of pasemi_mac_start_tx()
+ net: Catch invalid index in XPS mapping
+ scsi: target: iscsit: Free cmds before session free
+ lib: cpu_rmap: Avoid use after free on rmap->obj array entries
+ scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race
condition
+ gfs2: Fix inode height consistency check
+ scsi: ufs: ufs-pci: Add support for Intel Lunar Lake
+ ext4: set goal start correctly in ext4_mb_normalize_request
+ ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
+ f2fs: fix to drop all dirty pages during umount() if cp_error is set
+ f2fs: fix to check readonly condition correctly
+ samples/bpf: Fix fout leak in hbm's run_bpf_prog
+ bpf: Add preempt_count_{sub,add} into btf id deny list
+ wifi: iwlwifi: pcie: fix possible NULL pointer dereference
+ wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
+ null_blk: Always check queue mode setting from configfs
+ wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
+ wifi: ath11k: Fix SKB corruption in REO destination ring
+ nbd: fix incomplete validation of ioctl arg
+ ipvs: Update width of source for ip_vs_sync_conn_options
+ Bluetooth: btintel: Add LE States quirk support
+ Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
+ Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
+ HID: logitech-hidpp: Don't use the USB serial for USB devices
+ HID: logitech-hidpp: Reconcile USB and Unifying serials
+ spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
+ HID: wacom: generic: Set battery quirk only when we see battery data
+ usb: typec: tcpm: fix multiple times discover svids error
+ serial: 8250: Reinit port->pm on port specific driver unbind
+ mcb-pci: Reallocate memory region to avoid memory overlapping
+ sched: Fix KCSAN noinstr violation
+ recordmcount: Fix memory leaks in the uwrite function
+ RDMA/core: Fix multiple -Warray-bounds warnings
+ iommu/arm-smmu-qcom: Limit the SMR groups to 128
+ fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'
+ fs/ntfs3: Enhance the attribute size check
+ fs/ntfs3: Fix NULL dereference in ni_write_inode
+ fs/ntfs3: Validate MFT flags before replaying logs
+ fs/ntfs3: Add length check in indx_get_root
+ fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
+ clk: tegra20: fix gcc-7 constant overflow warning
+ iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
+ iommu/sprd: Release dma buffer to avoid memory leak
+ Input: xpad - add constants for GIP interface numbers
+ phy: st: miphy28lp: use _poll_timeout functions for waits
+ soundwire: qcom: gracefully handle too many ports in DT
+ mfd: dln2: Fix memory leak in dln2_probe()
+ parisc: Replace regular spinlock with spin_trylock on panic path
+ platform/x86: hp-wmi: Support touchpad on/off
+ UBUNTU: [Config] updateconfigs for X86_PLATFORM_DRIVERS_HP
+ platform/x86: Move existing HP drivers to a new hp subdir
+ platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct
+ xfrm: don't check the default policy if the policy allows the packet
+ Revert "Fix XFRM-I support for nested ESP tunnels"
+ drm/msm/dp: unregister audio driver during unbind
+ drm/msm/dpu: Add INTF_5 interrupts
+ drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header
+ drm/msm/dpu: Remove duplicate register defines from INTF
+ dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and
qcom, sync-dual-dsi
+ ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
+ cpupower: Make TSC read per CPU for Mperf monitor
+ af_key: Reject optional tunnel/BEET mode templates in outbound policies
+ selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test
+ selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test
+ net: fec: Better handle pm_runtime_get() failing in .remove()
+ net: phy: dp83867: add w/a for packet errors seen with short cables
+ ALSA: firewire-digi00x: prevent potential use after free
+ ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
+ vsock: avoid to close connected socket after the timeout
+ tcp: fix possible sk_priority leak in tcp_v4_send_reset()
+ serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
+ serial: 8250_bcm7271: balance clk_enable calls
+ serial: 8250_bcm7271: fix leak in `brcmuart_probe`
+ erspan: get the proto with the md version for collect_md
+ net: hns3: fix output information incomplete for dumping tx queue info with
debugfs
+ net: hns3: fix sending pfc frames after reset issue
+ net: hns3: fix reset delay time to avoid configuration timeout
+ media: netup_unidvb: fix use-after-free at del_timer()
+ SUNRPC: double free xprt_ctxt while still in use
+ tracing: Introduce helpers to safely handle dynamic-sized sockaddrs
+ SUNRPC: Clean up svc_deferred_class trace events
+ SUNRPC: Remove dead code in svc_tcp_release_rqst()
+ SUNRPC: Remove svc_rqst::rq_xprt_hlen
+ SUNRPC: always free ctxt when freeing deferred request
+ SUNRPC: Fix trace_svc_register() call site
+ drm/exynos: fix g2d_open/close helper function definitions
+ net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
+ virtio-net: Maintain reverse cleanup order
+ virtio_net: Fix error unwinding of XDP initialization
+ tipc: add tipc_bearer_min_mtu to calculate min mtu
+ tipc: do not update mtu if msg_max is too small in mtu negotiation
+ tipc: check the bearer min mtu properly when setting it by netlink
+ s390/cio: include subchannels without devices also for evaluation
+ net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
+ net: bcmgenet: Restore phy_stop() depending upon suspend/close
+ wifi: mac80211: fix min center freq offset tracing
+ wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
+ wifi: iwlwifi: mvm: don't trust firmware n_channels
+ scsi: storvsc: Don't pass unused PFNs to Hyper-V host
+ cassini: Fix a memory leak in the error handling path of cas_init_one()
+ net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
+ igb: fix bit_shift to be in [1..8] range
+ vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
+ netfilter: nf_tables: fix nft_trans type confusion
+ netfilter: nft_set_rbtree: fix null deref on element insertion
+ bridge: always declare tunnel functions
+ ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
+ USB: usbtmc: Fix direction for 0-length ioctl control messages
+ usb-storage: fix deadlock when a scsi command timeouts more than once
+ USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
+ usb: dwc3: debugfs: Resume dwc3 before accessing registers
+ usb: gadget: u_ether: Fix host MAC address case
+ usb: typec: altmodes/displayport: fix pin_assignment_show
+ xhci-pci: Only run d3cold avoidance quirk for s2idle
+ xhci: Fix incorrect tracking of free space on transfer rings
+ ALSA: hda: Fix Oops by 9.1 surround channel names
+ ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
+ ALSA: hda/realtek: Add quirk for Clevo L140AU
+ ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
+ ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
+ can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
+ can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
+ can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
+ can: kvaser_pciefd: Call request_irq() before enabling interrupts
+ can: kvaser_pciefd: Empty SRB buffer in probe
+ can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
+ can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
+ can: kvaser_pciefd: Disable interrupts in probe error path
+ SMB3: Close all deferred handles of inode in case of handle lease break
+ SMB3: drop reference to cfile before sending oplock break
+ ksmbd: smb2: Allow messages padded to 8byte boundary
+ ksmbd: allocate one more byte for implied bcc[0]
+ ksmbd: fix wrong UserName check in session_user
+ ksmbd: fix global-out-of-bounds in smb2_find_context_vals
+ statfs: enforce statfs[64] structure initialization
+ serial: Add support for Advantech PCI-1611U card
+ serial: 8250_exar: Add support for USR298x PCI Modems
+ serial: qcom-geni: fix enabling deactivated interrupt
+ thunderbolt: Clear registers properly when auto clear isn't in use
+ vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
+ ceph: force updating the msg pointer in non-split case
+ powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device
+ tpm/tpm_tis: Disable interrupts for more Lenovo devices
+ powerpc/64s/radix: Fix soft dirty tracking
+ nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
+ s390/qdio: fix do_sqbs() inline assembly constraint
+ HID: wacom: Force pen out of prox if no events have been received in a while
+ HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
+ HID: wacom: add three styli to wacom_intuos_get_tool_type
+ Linux 5.15.113
+ UBUNTU: Upstream stable to v5.15.113
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Kamal Mostafa (kamalmostafa)
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2028408
Title:
Jammy update: v5.15.113 upstream stable release
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Jammy:
In Progress
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.113 upstream stable release
from git://git.kernel.org/
drm/mipi-dsi: Set the fwnode for mipi_dsi_device
ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
tick/broadcast: Make broadcast device replacement work correctly
linux/dim: Do nothing if no time delta between samples
net: stmmac: switch to use interrupt for hw crosstimestamping
net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register
net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
netfilter: nf_tables: always release netdev hooks from notifier
netfilter: conntrack: fix possible bug_on with enable_hooks=1
netlink: annotate accesses to nlk->cb_running
net: annotate sk->sk_err write from do_recvmmsg()
net: deal with most data-races in sk_wait_event()
net: add vlan_get_protocol_and_depth() helper
tcp: add annotations around sk->sk_shutdown accesses
gve: Remove the code of clearing PBA bit
net: datagram: fix data-races in datagram_poll()
af_unix: Fix a data race of sk->sk_receive_queue->qlen.
af_unix: Fix data races around sk->sk_shutdown.
drm/i915/dp: prevent potential div-by-zero
fbdev: arcfb: Fix error handling in arcfb_probe()
ext4: remove an unused variable warning with CONFIG_QUOTA=n
ext4: reflect error codes from ext4_multi_mount_protect() to its callers
ext4: fix lockdep warning when enabling MMP
ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
ext4: allow ext4_get_group_info() to fail
refscale: Move shutdown from wait_event() to wait_event_idle()
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
drm/displayid: add displayid_get_header() and check bounds better
drm/amd/display: Use DC_LOG_DC in the trasform pixel function
regmap: cache: Return error in cache sync operations for REGCACHE_NONE
arm64: dts: qcom: msm8996: Add missing DWC3 quirks
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and
buffer_finish()
media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
firmware: arm_sdei: Fix sleep from invalid context BUG
ACPI: EC: Fix oops when removing custom query handlers
remoteproc: stm32_rproc: Add mutex protection for workqueue
drm/tegra: Avoid potential 32-bit integer overflow
drm/msm/dp: Clean up handling of DP AUX interrupts
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in
acpi_db_display_objects
drm/amd: Fix an out of bounds error in BIOS parser
media: Prefer designated initializers over memset for subdev pad ops
wifi: ath: Silence memcpy run-time false positive warning
bpf: Annotate data races in bpf_local_storage
wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
ext2: Check block size validity during mount
scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
bnxt: avoid overflow in bnxt_get_nvram_directory()
net: pasemi: Fix return type of pasemi_mac_start_tx()
net: Catch invalid index in XPS mapping
scsi: target: iscsit: Free cmds before session free
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race
condition
gfs2: Fix inode height consistency check
scsi: ufs: ufs-pci: Add support for Intel Lunar Lake
ext4: set goal start correctly in ext4_mb_normalize_request
ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
f2fs: fix to drop all dirty pages during umount() if cp_error is set
f2fs: fix to check readonly condition correctly
samples/bpf: Fix fout leak in hbm's run_bpf_prog
bpf: Add preempt_count_{sub,add} into btf id deny list
wifi: iwlwifi: pcie: fix possible NULL pointer dereference
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
null_blk: Always check queue mode setting from configfs
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
wifi: ath11k: Fix SKB corruption in REO destination ring
nbd: fix incomplete validation of ioctl arg
ipvs: Update width of source for ip_vs_sync_conn_options
Bluetooth: btintel: Add LE States quirk support
Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
HID: logitech-hidpp: Don't use the USB serial for USB devices
HID: logitech-hidpp: Reconcile USB and Unifying serials
spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
HID: wacom: generic: Set battery quirk only when we see battery data
usb: typec: tcpm: fix multiple times discover svids error
serial: 8250: Reinit port->pm on port specific driver unbind
mcb-pci: Reallocate memory region to avoid memory overlapping
sched: Fix KCSAN noinstr violation
recordmcount: Fix memory leaks in the uwrite function
RDMA/core: Fix multiple -Warray-bounds warnings
iommu/arm-smmu-qcom: Limit the SMR groups to 128
fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'
fs/ntfs3: Enhance the attribute size check
fs/ntfs3: Fix NULL dereference in ni_write_inode
fs/ntfs3: Validate MFT flags before replaying logs
fs/ntfs3: Add length check in indx_get_root
fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
clk: tegra20: fix gcc-7 constant overflow warning
iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
iommu/sprd: Release dma buffer to avoid memory leak
Input: xpad - add constants for GIP interface numbers
phy: st: miphy28lp: use _poll_timeout functions for waits
soundwire: qcom: gracefully handle too many ports in DT
mfd: dln2: Fix memory leak in dln2_probe()
parisc: Replace regular spinlock with spin_trylock on panic path
platform/x86: hp-wmi: Support touchpad on/off
UBUNTU: [Config] updateconfigs for X86_PLATFORM_DRIVERS_HP
platform/x86: Move existing HP drivers to a new hp subdir
platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct
xfrm: don't check the default policy if the policy allows the packet
Revert "Fix XFRM-I support for nested ESP tunnels"
drm/msm/dp: unregister audio driver during unbind
drm/msm/dpu: Add INTF_5 interrupts
drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header
drm/msm/dpu: Remove duplicate register defines from INTF
dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and
qcom, sync-dual-dsi
ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
cpupower: Make TSC read per CPU for Mperf monitor
af_key: Reject optional tunnel/BEET mode templates in outbound policies
selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test
selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test
net: fec: Better handle pm_runtime_get() failing in .remove()
net: phy: dp83867: add w/a for packet errors seen with short cables
ALSA: firewire-digi00x: prevent potential use after free
ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
vsock: avoid to close connected socket after the timeout
tcp: fix possible sk_priority leak in tcp_v4_send_reset()
serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
serial: 8250_bcm7271: balance clk_enable calls
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
erspan: get the proto with the md version for collect_md
net: hns3: fix output information incomplete for dumping tx queue info with
debugfs
net: hns3: fix sending pfc frames after reset issue
net: hns3: fix reset delay time to avoid configuration timeout
media: netup_unidvb: fix use-after-free at del_timer()
SUNRPC: double free xprt_ctxt while still in use
tracing: Introduce helpers to safely handle dynamic-sized sockaddrs
SUNRPC: Clean up svc_deferred_class trace events
SUNRPC: Remove dead code in svc_tcp_release_rqst()
SUNRPC: Remove svc_rqst::rq_xprt_hlen
SUNRPC: always free ctxt when freeing deferred request
SUNRPC: Fix trace_svc_register() call site
drm/exynos: fix g2d_open/close helper function definitions
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
virtio-net: Maintain reverse cleanup order
virtio_net: Fix error unwinding of XDP initialization
tipc: add tipc_bearer_min_mtu to calculate min mtu
tipc: do not update mtu if msg_max is too small in mtu negotiation
tipc: check the bearer min mtu properly when setting it by netlink
s390/cio: include subchannels without devices also for evaluation
net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
net: bcmgenet: Restore phy_stop() depending upon suspend/close
wifi: mac80211: fix min center freq offset tracing
wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
wifi: iwlwifi: mvm: don't trust firmware n_channels
scsi: storvsc: Don't pass unused PFNs to Hyper-V host
cassini: Fix a memory leak in the error handling path of cas_init_one()
net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
igb: fix bit_shift to be in [1..8] range
vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
netfilter: nf_tables: fix nft_trans type confusion
netfilter: nft_set_rbtree: fix null deref on element insertion
bridge: always declare tunnel functions
ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
USB: usbtmc: Fix direction for 0-length ioctl control messages
usb-storage: fix deadlock when a scsi command timeouts more than once
USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
usb: dwc3: debugfs: Resume dwc3 before accessing registers
usb: gadget: u_ether: Fix host MAC address case
usb: typec: altmodes/displayport: fix pin_assignment_show
xhci-pci: Only run d3cold avoidance quirk for s2idle
xhci: Fix incorrect tracking of free space on transfer rings
ALSA: hda: Fix Oops by 9.1 surround channel names
ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
ALSA: hda/realtek: Add quirk for Clevo L140AU
ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
can: kvaser_pciefd: Call request_irq() before enabling interrupts
can: kvaser_pciefd: Empty SRB buffer in probe
can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
can: kvaser_pciefd: Disable interrupts in probe error path
SMB3: Close all deferred handles of inode in case of handle lease break
SMB3: drop reference to cfile before sending oplock break
ksmbd: smb2: Allow messages padded to 8byte boundary
ksmbd: allocate one more byte for implied bcc[0]
ksmbd: fix wrong UserName check in session_user
ksmbd: fix global-out-of-bounds in smb2_find_context_vals
statfs: enforce statfs[64] structure initialization
serial: Add support for Advantech PCI-1611U card
serial: 8250_exar: Add support for USR298x PCI Modems
serial: qcom-geni: fix enabling deactivated interrupt
thunderbolt: Clear registers properly when auto clear isn't in use
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
ceph: force updating the msg pointer in non-split case
powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device
tpm/tpm_tis: Disable interrupts for more Lenovo devices
powerpc/64s/radix: Fix soft dirty tracking
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
s390/qdio: fix do_sqbs() inline assembly constraint
HID: wacom: Force pen out of prox if no events have been received in a while
HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
HID: wacom: add three styli to wacom_intuos_get_tool_type
Linux 5.15.113
UBUNTU: Upstream stable to v5.15.113
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2028408/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
