This bug was fixed in the package linux-oem-5.14 - 5.14.0-1027.30

---------------
linux-oem-5.14 (5.14.0-1027.30) focal; urgency=medium

  * CVE-2022-0001
    - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
    - SAUCE: x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - SAUCE: x86/speculation: Add eIBRS + Retpoline options
    - SAUCE: Documentation/hw-vuln: Update spectre doc

linux-oem-5.14 (5.14.0-1025.27) focal; urgency=medium

  * focal/linux-oem-5.14: 5.14.0-1025.27 -proposed tracker (LP:
#1961265)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2022.02.21)
    - [Config] Update config to match upstream stable release

  * Disable iwlwifi UHB (ultra high band) channels if we don't support wifi 6e
    currently (LP: #1961971)
    - SAUCE: iwlwifi: disable 6-7 GHz channels

  * Fix With 20.04d kernel and WX3200, unit freezes on resume (LP: #1961855)
    - SAUCE: drm/amd: Check if ASPM is enabled from PCIe subsystem

  * CVE-2022-25636
    - netfilter: nf_tables_offload: incorrect flow offload action array size

  * Focal update: upstream stable patchset 2022-02-22 (LP: #1961793)
    - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
    - selftests: mptcp: fix ipv6 routing setup
    - net: ipa: use a bitmap for endpoint replenish_enabled
    - net: ipa: prevent concurrent replenish
    - drm/vc4: hdmi: Make sure the device is powered with CEC
    - net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic
    - net/mlx5: Bridge, take rtnl lock in init error handler
    - net/mlx5: Bridge, ensure dev_name is null-terminated
    - net/mlx5e: Fix handling of wrong devices during bond netevent
    - net/mlx5: Use del_timer_sync in fw reset flow of halting poll
    - net/mlx5e: Fix module EEPROM query
    - net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE
    - net/mlx5e: Don't treat small ceil values as unlimited in HTB offload
    - net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion
    - net/mlx5: E-Switch, Fix uninitialized variable modact
    - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
    - i40e: Fix reset bw limit when DCB enabled with 1 TC
    - i40e: Fix reset path while removing the driver
    - net: amd-xgbe: ensure to reset the tx_timer_active flag
    - net: amd-xgbe: Fix skb data length underflow
    - fanotify: Fix stale file descriptor in copy_event_to_user()
    - net: sched: fix use-after-free in tc_new_tfilter()
    - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
    - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
    - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
    - tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
    - Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
    - Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" again
    - drm/i915: Disable DSB usage for now
    - selinux: fix double free of cond_list on error paths
    - audit: improve audit queue handling when "audit=1" on cmdline
    - ipc/sem: do not sleep with a spin lock held
    - spi: stm32-qspi: Update spi registering
    - ASoC: hdmi-codec: Fix OOB memory accesses
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
    - ALSA: usb-audio: Correct quirk for VF0770
    - ALSA: hda: Fix UAF of leds class devs at unbinding
    - ALSA: hda: realtek: Fix race at concurrent COEF updates
    - ALSA: hda/realtek: Add quirk for ASUS GU603
    - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220
      quirks
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer
      chipset)
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after
      reboot from Windows
    - btrfs: don't start transaction for scrub if the fs is mounted read-only
    - btrfs: fix deadlock between quota disable and qgroup rescan worker
    - btrfs: fix use-after-free after failure to create a snapshot
    - Revert "fs/9p: search open fids first"
    - drm/nouveau: fix off by one in BIOS boundary checking
    - drm/amd/pm: correct the MGpuFanBoost support for Beige Goby
    - drm/amd/display: watermark latencies is not enough on DCN31
    - drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple 
Retina
      panels
    - nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts()
    - mm/debug_vm_pgtable: remove pte entry from the page table
    - mm/pgtable: define pte_index so that preprocessor could recognize it
    - mm/kmemleak: avoid scanning potential huge holes
    - block: bio-integrity: Advance seed correctly for larger interval sizes
    - dma-buf: heaps: Fix potential spectre v1 gadget
    - IB/hfi1: Fix AIP early init panic
    - Revert "fbcon: Disable accelerated scrolling"
    - fbcon: Add option to enable legacy hardware acceleration
    - mptcp: fix msk traversal in mptcp_nl_cmd_set_flags()
    - Revert "ASoC: mediatek: Check for error clk pointer"
    - KVM: arm64: Avoid consuming a stale esr value when SError occur
    - KVM: arm64: Stop handle_exit() from handling HVC twice when an SError 
occurs
    - RDMA/cma: Use correct address when leaving multicast group
    - RDMA/ucma: Protect mc during concurrent multicast leaves
    - IB/rdmavt: Validate remote_addr during loopback atomic tests
    - RDMA/siw: Fix broken RDMA Read Fence/Resume logic.
    - RDMA/mlx4: Don't continue event handler after memory allocation failure
    - ALSA: usb-audio: initialize variables that could ignore errors
    - ALSA: hda: Skip codec shutdown in case the codec is not registered
    - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
    - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
    - spi: bcm-qspi: check for valid cs before applying chip select
    - spi: mediatek: Avoid NULL pointer crash in interrupt
    - spi: meson-spicc: add IRQ check in meson_spicc_probe
    - spi: uniphier: fix reference count leak in uniphier_spi_probe()
    - IB/hfi1: Fix tstats alloc and dealloc
    - IB/cm: Release previously acquired reference counter in the cm_id_priv
    - net: ieee802154: hwsim: Ensure proper channel selection at probe time
    - net: ieee802154: mcr20a: Fix lifs/sifs periods
    - net: ieee802154: ca8210: Stop leaking skb's
    - netfilter: nft_reject_bridge: Fix for missing reply from prerouting
    - net: ieee802154: Return meaningful error codes from the netlink helpers
    - net/smc: Forward wakeup to smc socket waitqueue after fallback
    - net: stmmac: dwmac-visconti: No change to ETHER_CLOCK_SEL for unexpected
      speed request.
    - net: stmmac: properly handle with runtime pm in stmmac_dvr_remove()
    - net: macsec: Fix offload support for NETDEV_UNREGISTER event
    - net: macsec: Verify that send_sci is on when setting Tx sci explicitly
    - net: stmmac: dump gmac4 DMA registers correctly
    - net: stmmac: ensure PTP time register reads are consistent
    - drm/kmb: Fix for build errors with Warray-bounds
    - drm/i915/overlay: Prevent divide by zero bugs in scaling
    - drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled
    - ASoC: fsl: Add missing error handling in pcm030_fabric_probe
    - ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period 
bytes
    - ASoC: simple-card: fix probe failure on platform component
    - ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name
    - ASoC: max9759: fix underflow in speaker_gain_control_put()
    - ASoC: codecs: wcd938x: fix incorrect used of portid
    - ASoC: codecs: lpass-rx-macro: fix sidetone register offsets
    - ASoC: codecs: wcd938x: fix return value of mixer put function
    - pinctrl: sunxi: Fix H616 I2S3 pin data
    - pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured 
line
    - pinctrl: intel: fix unexpected interrupt
    - pinctrl: bcm2835: Fix a few error paths
    - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
    - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
    - gve: fix the wrong AdminQ buffer queue index check
    - bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
    - selftests/exec: Remove pipe from TEST_GEN_FILES
    - selftests: futex: Use variable MAKE instead of make
    - tools/resolve_btfids: Do not print any commands when building silently
    - rtc: cmos: Evaluate century appropriate
    - kvm: add guest_state_{enter,exit}_irqoff()
    - kvm/arm64: rework guest entry logic
    - perf: Copy perf_event_attr::sig_data on modification
    - perf stat: Fix display of grouped aliased events
    - perf/x86/intel/pt: Fix crash with stop filters in single-range mode
    - x86/perf: Default set FREEZE_ON_SMI for all
    - EDAC/altera: Fix deferred probing
    - EDAC/xgene: Fix deferred probing
    - ext4: prevent used blocks from being allocated during fast commit replay
    - ext4: modify the logic of ext4_mb_new_blocks_simple
    - ext4: fix error handling in ext4_restore_inline_data()
    - ext4: fix error handling in ext4_fc_record_modified_inode()
    - ext4: fix incorrect type issue during replay_del_range
    - net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY
    - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
    - tools include UAPI: Sync sound/asound.h copy with the kernel sources
    - gpio: idt3243x: Fix an ignored error return from platform_get_irq()
    - gpio: mpc8xxx: Fix an ignored error return from platform_get_irq()
    - selftests: nft_concat_range: add test for reload with no element add/del
    - selftests: netfilter: check stateless nat udp checksum fixup
    - moxart: fix potential use-after-free on remove path
    - arm64: Add Cortex-A510 CPU part definition
    - KVM: s390: Return error on SIDA memop on normal guest
    - crypto: api - Move cryptomgr soft dependency into algapi
    - integrity: check the return value of audit_log_start()
    - ima: fix reference leak in asymmetric_verify()
    - ima: Remove ima_policy file before directory
    - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
    - ima: Do not print policy rule with inactive LSM labels
    - mmc: sdhci-of-esdhc: Check for error num after setting mask
    - mmc: core: Wait for command setting 'Power Off Notification' bit to 
complete
    - can: isotp: fix potential CAN frame reception race in isotp_rcv()
    - can: isotp: fix error path in isotp_sendmsg() to unlock wait queue
    - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible 
PHYs
    - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs
    - NFS: Fix initialisation of nfs_client cl_flags field
    - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
    - NFSD: Fix ia_size underflow
    - NFSD: Clamp WRITE offsets
    - NFSD: Fix offset type in I/O trace points
    - NFSD: Fix the behavior of READ near OFFSET_MAX
    - thermal/drivers/int340x: Improve the tcc offset saving for suspend/resume
    - thermal/drivers/int340x: processor_thermal: Suppot 64 bit RFIM responses
    - thermal: int340x: Limit Kconfig to 64-bit
    - thermal/drivers/int340x: Fix RFIM mailbox write commands
    - tracing: Propagate is_signed to expression
    - NFS: change nfs_access_get_cached to only report the mask
    - NFSv4 only print the label when its queried
    - nfs: nfs4clinet: check the return value of kstrdup()
    - NFSv4.1: Fix uninitialised variable in devicenotify
    - NFSv4 remove zero number of fs_locations entries error check
    - NFSv4 store server support for fs_location attribute
    - NFSv4.1 query for fs_location attr on a new file system
    - NFSv4 expose nfs_parse_server_name function
    - NFSv4 handle port presence in fs_location server string
    - SUNRPC allow for unspecified transport time in rpc_clnt_add_xprt
    - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change
    - sunrpc: Fix potential race conditions in rpc_sysfs_xprt_state_change()
    - irqchip/realtek-rtl: Service all pending interrupts
    - perf/x86/rapl: fix AMD event handling
    - x86/perf: Avoid warning for Arch LBR without XSAVE
    - sched: Avoid double preemption in __cond_resched_*lock*()
    - drm/vc4: Fix deadlock on DSI device attach error
    - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer
    - net: sched: Clarify error message when qdisc kind is unknown
    - powerpc/fixmap: Fix VM debug warning on unmap
    - scsi: target: iscsi: Make sure the np under each tpg is unique
    - scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup()
    - scsi: qedf: Add stag_work to all the vports
    - scsi: qedf: Fix refcount issue when LOGO is received during TMF
    - scsi: qedf: Change context reset messages to ratelimited
    - scsi: pm8001: Fix bogus FW crash for maxcpus=1
    - scsi: ufs: Use generic error code in ufshcd_set_dev_pwr_mode()
    - scsi: ufs: Treat link loss as fatal error
    - scsi: myrs: Fix crash in error case
    - net: stmmac: reduce unnecessary wakeups from eee sw timer
    - PM: hibernate: Remove register_nosave_region_late()
    - drm/amd/display: Correct MPC split policy for DCN301
    - usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
    - perf: Always wake the parent event
    - nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs
    - MIPS: Fix build error due to PTR used in more places
    - net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout()
    - KVM: eventfd: Fix false positive RCU usage warning
    - KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER
    - KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS
    - KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode
    - KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow
    - KVM: x86: Report deprecated x87 features in supported CPUID
    - riscv: fix build with binutils 2.38
    - riscv: cpu-hotplug: clear cpu from numa map when teardown
    - riscv: eliminate unreliable __builtin_frame_address(1)
    - gfs2: Fix gfs2_release for non-writers regression
    - ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
    - ARM: dts: Fix boot regression on Skomer
    - ARM: socfpga: fix missing RESET_CONTROLLER
    - nvme-tcp: fix bogus request completion when failing to send AER
    - ACPI/IORT: Check node revision for PMCG resources
    - PM: s2idle: ACPI: Fix wakeup interrupts handling
    - drm/amdgpu/display: change pipe policy for DCN 2.0
    - drm/rockchip: vop: Correct RK3399 VOP register fields
    - drm/i915: Allow !join_mbus cases for adlp+ dbuf configuration
    - drm/i915: Populate pipe dbuf slices more accurately during readout
    - ARM: dts: Fix timer regression for beagleboard revision c
    - ARM: dts: meson: Fix the UART compatible strings
    - ARM: dts: meson8: Fix the UART device-tree schema validation
    - ARM: dts: meson8b: Fix the UART device-tree schema validation
    - phy: broadcom: Kconfig: Fix PHY_BRCM_USB config option
    - staging: fbtft: Fix error path in fbtft_driver_module_init()
    - ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
    - phy: xilinx: zynqmp: Fix bus width setting for SGMII
    - phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()
    - ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo
    - usb: f_fs: Fix use-after-free for epfile
    - phy: dphy: Correct clk_pre parameter
    - gpio: aggregator: Fix calling into sleeping GPIO controllers
    - NFS: Don't overfill uncached readdir pages
    - NFS: Don't skip directory entries when doing uncached readdir
    - drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd.
    - misc: fastrpc: avoid double fput() on failed usercopy
    - net: sparx5: Fix get_stat64 crash in tcpdump
    - netfilter: ctnetlink: disable helper autoassign
    - arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133'
    - arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io
      regulator
    - arm64: dts: meson-sm1-bananapi-m5: fix wrong GPIO domain for GPIOE_2
    - arm64: dts: meson-sm1-odroid: fix boot loop after reboot
    - ixgbevf: Require large buffers for build_skb on 82599VF
    - drm/panel: simple: Assign data from panel_dpi_probe() correctly
    - ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE
    - gpiolib: Never return internal error codes to user space
    - gpio: sifive: use the correct register to read output values
    - fbcon: Avoid 'cap' set but not used warning
    - bonding: pair enable_port with slave_arr_updates
    - net: dsa: mv88e6xxx: don't use devres for mdiobus
    - net: dsa: ar9331: register the mdiobus under devres
    - net: dsa: bcm_sf2: don't use devres for mdiobus
    - net: dsa: felix: don't use devres for mdiobus
    - net: dsa: mt7530: fix kernel bug in mdiobus_free() when unbinding
    - net: dsa: lantiq_gswip: don't use devres for mdiobus
    - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure 
path
    - nfp: flower: fix ida_idx not being released
    - net: do not keep the dst cache when uncloning an skb dst and its metadata
    - net: fix a memleak when uncloning an skb dst and its metadata
    - veth: fix races around rq->rx_notify_masked
    - net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE
    - tipc: rate limit warning for received illegal binding update
    - net: amd-xgbe: disable interrupts during pci removal
    - drm/amd/pm: fix hwmon node of power1_label create issue
    - mptcp: netlink: process IPv6 addrs in creating listening sockets
    - dpaa2-eth: unregister the netdev before disconnecting from the PHY
    - ice: fix an error code in ice_cfg_phy_fec()
    - ice: fix IPIP and SIT TSO offload
    - ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
    - ice: Avoid RTNL lock when re-creating auxiliary device
    - net: mscc: ocelot: fix mutex lock error during ethtool stats read
    - net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister
    - vt_ioctl: fix array_index_nospec in vt_setactivate
    - vt_ioctl: add array_index_nospec to VT_ACTIVATE
    - n_tty: wake up poll(POLLRDNORM) on receiving data
    - eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
    - usb: dwc2: drd: fix soft connect when gadget is unconfigured
    - Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured"
    - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
    - usb: ulpi: Move of_node_put to ulpi_dev_release
    - usb: ulpi: Call of_node_put correctly
    - usb: dwc3: gadget: Prevent core from processing stale TRBs
    - usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition
    - USB: gadget: validate interface OS descriptor requests
    - usb: gadget: rndis: check size of RNDIS_MSG_SET command
    - usb: gadget: f_uac2: Define specific wTerminalType
    - usb: raw-gadget: fix handling of dual-direction-capable endpoints
    - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
    - USB: serial: option: add ZTE MF286D modem
    - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
    - USB: serial: cp210x: add NCR Retail IO box id
    - USB: serial: cp210x: add CPI Bulk Coin Recycler id
    - speakup-dectlk: Restore pitch setting
    - phy: ti: Fix missing sentinel for clk_div_table
    - iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
    - mm: memcg: synchronize objcg lists with a dedicated spinlock
    - seccomp: Invalidate seccomp mode to catch death failures
    - s390/cio: verify the driver availability for path_event call
    - x86/sgx: Silence softlockup detection when releasing large enclaves
    - Makefile.extrawarn: Move -Wunaligned-access to W=1
    - scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
    - scsi: lpfc: Reduce log messages seen after firmware download
    - MIPS: octeon: Fix missed PTR->PTR_WD conversion
    - arm64: dts: imx8mq: fix lcdif port node
    - perf: Fix list corruption in perf_cgroup_switch()
    - iommu: Fix potential use-after-free during probe
    - drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
    - fs/proc: task_mmu.c: don't read mapcount for migration entry
    - btrfs: zoned: cache reported zone during mount
    - scsi: lpfc: Fix mailbox command failure during driver initialization
    - HID:Add support for UGTABLET WP5540
    - Revert "svm: Add warning message for AVIC IPI invalid target"
    - parisc: Show error if wrong 32/64-bit compiler is being used
    - serial: parisc: GSC: fix build when IOSAPIC is not set
    - parisc: Drop __init from map_pages declaration
    - parisc: Fix data TLB miss in sba_unmap_sg
    - parisc: Fix sglist access in ccio-dma.c
    - mmc: block: fix read single on recovery logic
    - mm: don't try to NUMA-migrate COW pages that have other uses
    - PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA
      topology
    - parisc: Add ioread64_lo_hi() and iowrite64_lo_hi()
    - btrfs: send: in case of IO error log it
    - platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1
    - kunit: tool: Import missing importlib.abc
    - selftests: rtc: Increase test timeout so that all tests run
    - kselftest: signal all child processes
    - net: ieee802154: at86rf230: Stop leaking skb's
    - selftests/zram: Skip max_comp_streams interface on newer kernel
    - selftests/zram01.sh: Fix compression ratio calculation
    - selftests/zram: Adapt the situation that /dev/zram0 is being used
    - selftests: openat2: Print also errno in failure messages
    - selftests: openat2: Add missing dependency in Makefile
    - selftests: openat2: Skip testcases that fail with EOPNOTSUPP
    - selftests: skip mincore.check_file_mmap when fs lacks needed support
    - ax25: improve the incomplete fix to avoid UAF and NPD bugs
    - pinctrl: bcm63xx: fix unmet dependency on REGMAP for GPIO_REGMAP
    - vfs: make freeze_super abort when sync_filesystem returns error
    - quota: make dquot_quota_sync return errors from ->sync_fs
    - scsi: pm80xx: Fix double completion for SATA devices
    - kselftest: Fix vdso_test_abi return status
    - scsi: core: Reallocate device's budget map on queue depth change
    - scsi: pm8001: Fix use-after-free for aborted TMF sas_task
    - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
    - drm/amd: Warn users about potential s0ix problems
    - nvme: fix a possible use-after-free in controller reset during load
    - nvme-tcp: fix possible use-after-free in transport error_recovery work
    - nvme-rdma: fix possible use-after-free in transport error_recovery work
    - net: sparx5: do not refer to skb after passing it on
    - drm/amdgpu: Rename amdgpu_acpi_is_s0ix_supported
    - drm/amd: add support to check whether the system is set to s3
    - drm/amd: Only run s3 or s0ix if system is configured properly
    - drm/amdgpu: fix logic inversion in check
    - x86/Xen: streamline (and fix) PV CPU enumeration
    - Revert "module, async: async_synchronize_full() on module init iff async 
is
      used"
    - gcc-plugins/stackleak: Use noinstr in favor of notrace
    - random: wake up /dev/random writers after zap
    - KVM: x86/xen: Fix runstate updates to be atomic when preempting vCPU
    - KVM: x86: SVM: don't passthrough SMAP/SMEP/PKE bits in !NPT && !gCR0.PG 
case
    - KVM: x86: nSVM: fix potential NULL derefernce on nested migration
    - KVM: x86: nSVM: mark vmcb01 as dirty when restoring SMM saved state
    - iwlwifi: fix use-after-free
    - drm/radeon: Fix backlight control on iMac 12,1
    - drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
    - drm/amd/pm: correct the sequence of sending gpu reset msg
    - drm/amdgpu: skipping SDMA hw_init and hw_fini for S0ix.
    - drm/i915/opregion: check port number bounds for SWSCI display power state
    - drm/i915: Fix dbuf slice config lookup
    - drm/i915: Fix mbus join config lookup
    - vsock: remove vsock from connected table when connect is interrupted by a
      signal
    - drm/cma-helper: Set VM_DONTEXPAND for mmap
    - drm/i915/gvt: Make DRM_I915_GVT depend on X86
    - iwlwifi: pcie: fix locking when "HW not ready"
    - iwlwifi: pcie: gen2: fix locking when "HW not ready"
    - selftests: netfilter: fix exit value for nft_concat_range
    - netfilter: nft_synproxy: unregister hooks on init error path
    - selftests: netfilter: disable rp_filter on router
    - ipv4: fix data races in fib_alias_hw_flags_set
    - ipv6: fix data-race in fib6_info_hw_flags_set / fib6_purge_rt
    - ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
    - ipv6: per-netns exclusive flowlabel checks
    - Revert "net: ethernet: bgmac: Use devm_platform_ioremap_resource_byname"
    - mac80211: mlme: check for null after calling kmemdup
    - cfg80211: fix race in netlink owner interface destruction
    - net: dsa: lan9303: fix reset on probe
    - net: dsa: lantiq_gswip: fix use after free in gswip_remove()
    - net: dsa: lan9303: add VLAN IDs to master device
    - net: ieee802154: ca8210: Fix lifs/sifs periods
    - ping: fix the dif and sdif check in ping_lookup
    - bonding: force carrier update when releasing slave
    - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
    - net_sched: add __rcu annotation to netdev->qdisc
    - bonding: fix data-races around agg_select_timer
    - libsubcmd: Fix use-after-free for realloc(..., 0)
    - net/smc: Avoid overwriting the copies of clcsock callback functions
    - net: phy: mediatek: remove PHY mode check on MT7531
    - atl1c: fix tx timeout after link flap on Mikrotik 10/25G NIC
    - tipc: fix wrong publisher node address in link publications
    - dpaa2-eth: Initialize mutex used in one step timestamping path
    - net: bridge: multicast: notify switchdev driver whenever MC processing 
gets
      disabled
    - perf bpf: Defer freeing string after possible strlen() on it
    - selftests/exec: Add non-regular to TEST_GEN_PROGS
    - arm64: Correct wrong label in macro __init_el2_gicv3
    - ALSA: usb-audio: revert to IMPLICIT_FB_FIXED_DEV for M-Audio FastTrack 
Ultra
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
    - ALSA: hda/realtek: Fix deadlock by COEF mutex
    - ALSA: hda: Fix regression on forced probe mask option
    - ALSA: hda: Fix missing codec probe on Shenker Dock 15
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_sx()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_xr_sx()
    - cifs: fix set of group SID via NTSD xattrs
    - powerpc/603: Fix boot failure with DEBUG_PAGEALLOC and KFENCE
    - powerpc/lib/sstep: fix 'ptesync' build error
    - mtd: rawnand: gpmi: don't leak PM reference in error path
    - smb3: fix snapshot mount option
    - tipc: fix wrong notification node addresses
    - scsi: ufs: Remove dead code
    - scsi: ufs: Fix a deadlock in the error handler
    - ASoC: tas2770: Insert post reset delay
    - ASoC: qcom: Actually clear DMA interrupt register for HDMI
    - block/wbt: fix negative inflight counter when remove scsi device
    - NFS: Remove an incorrect revalidation in nfs4_update_changeattr_locked()
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks
    - NFS: Do not report writeback errors in nfs_getattr()
    - tty: n_tty: do not look ahead for EOL character past the end of the buffer
    - block: fix surprise removal for drivers calling blk_set_queue_dying
    - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
    - mtd: parsers: qcom: Fix kernel panic on skipped partition
    - mtd: parsers: qcom: Fix missing free for pparts in cleanup
    - mtd: phram: Prevent divide by zero bug in phram_setup()
    - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
    - mtd: rawnand: ingenic: Fix missing put_device in ingenic_ecc_get
    - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
    - KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
    - KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf 
event
    - KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
    - ARM: OMAP2+: hwmod: Add of_node_put() before break
    - ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of
    - phy: usb: Leave some clocks running during suspend
    - staging: vc04_services: Fix RCU dereference check
    - irqchip/sifive-plic: Add missing thead,c900-plic match string
    - x86/bug: Merge annotate_reachable() into _BUG_FLAGS() asm
    - netfilter: conntrack: don't refresh sctp entries in closed state
    - arm64: dts: meson-gx: add ATF BL32 reserved-memory region
    - arm64: dts: meson-g12: add ATF BL32 reserved-memory region
    - arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610
    - pidfd: fix test failure due to stack overflow on some arches
    - selftests: fixup build warnings in pidfd / clone3 tests
    - mm: io_uring: allow oom-killer from io_uring_setup
    - kconfig: let 'shell' return enough output for deep path names
    - ata: libata-core: Disable TRIM on M88V29
    - soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
    - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
    - drm/rockchip: dw_hdmi: Do not leave clock enabled in error case
    - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
    - drm/amd/display: Cap pflip irqs per max otg number
    - drm/amd/display: fix yellow carp wm clamping
    - net: usb: qmi_wwan: Add support for Dell DW5829e
    - net: macb: Align the dma and coherent dma masks
    - kconfig: fix failing to generate auto.conf
    - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
    - EDAC: Fix calculation of returned address and next offset in
      edac_align_ptr()
    - ucounts: Handle wrapping in is_ucounts_overlimit
    - ucounts: In set_cred_ucounts assume new->ucounts is non-NULL
    - ucounts: Base set_cred_ucounts changes on the real user
    - ucounts: Enforce RLIMIT_NPROC not RLIMIT_NPROC+1
    - lib/iov_iter: initialize "flags" in new pipe_buffer
    - ucounts: Move RLIMIT_NPROC handling after set_user
    - net: sched: limit TC_ACT_REPEAT loops
    - dmaengine: sh: rcar-dmac: Check for error num after setting mask
    - dmaengine: stm32-dmamux: Fix PM disable depth imbalance in
      stm32_dmamux_probe
    - dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
    - tests: fix idmapped mount_setattr test
    - i2c: qcom-cci: don't delete an unregistered adapter
    - i2c: qcom-cci: don't put a device tree node before i2c_add_adapter()
    - copy_process(): Move fd_install() out of sighand->siglock critical section
    - scsi: qedi: Fix ABBA deadlock in qedi_process_tmf_resp() and
      qedi_process_cmd_cleanup_resp()
    - ice: enable parsing IPSEC SPI headers for RSS
    - i2c: brcmstb: fix support for DSL and CM variants
    - lockdep: Correct lock_classes index mapping

  * Lower the volume of expected s0i3 WARN_ON  (LP: #1961119)
    - display/amd: decrease message verbosity about watermarks table failure

  * Reinstate ACPI S5 for reboot (LP: #1951055)
    - SAUCE: PM: ACPI: reboot: Reinstate S5 for reboot

  * Not able to enter s2idle state on AMD platforms (LP: #1961121)
    - HID: amd_sfh: Add command response to check command status
    - HID: amd_sfh: Add support for PM suspend and resume
    - HID: amd_sfh: Handle amd_sfh work buffer in PM ops
    - HID: amd_sfh: Correct the structure field name
    - HID: amd_sfh: Disable the interrupt for all command
    - HID: amd_sfh: Add functionality to clear interrupts
    - HID: amd_sfh: Add interrupt handler to process interrupts

  * Miscellaneous upstream changes
    - HID: amd_sfh: Increase sensor command timeout
    - HID: amd_sfh: Add illuminance mask to limit ALS max value

 -- Thadeu Lima de Souza Cascardo <casca...@canonical.com>  Mon, 07 Mar
2022 11:07:55 -0300

** Changed in: linux-oem-5.14 (Ubuntu Focal)
       Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-0001

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-25636

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-oem-5.14 in Ubuntu.
https://bugs.launchpad.net/bugs/1961119

Title:
  Lower the volume of expected s0i3 WARN_ON

Status in HWE Next:
  Fix Committed
Status in linux-oem-5.14 package in Ubuntu:
  Invalid
Status in linux-oem-5.14 source package in Focal:
  Fix Released

Bug description:
  [Impact]

  AMD has a known BIOS bug right now that leads to the following WARN
  traceback during s0i3 resume (see below).

  This doesn't have (measurable) functional impact to the system or GPU,
  but it is an ugly message to have in place and makes it look like a
  potentially major problem.

  AMD is working on fixing this in BIOS, but it may not be ready by the
  time the first platforms launch.

  [Fix]

  Print a shorter message warning instead: "Watermarks table not configured 
properly by SMU".
    
  The fixed was cherry-picked from mainline kernel v5.17-rc4.

  [Test]

  This is requested by AMD, and tested and verified on the AMD CRB.

  [Where problems could occur]

  Low. This only changes the behavors of message printing There are no
  functional changes.

  ------- WARN_ON messages -------

  ------------[ cut here ]------------
  WARNING: CPU: 8 PID: 60399 at 
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn31/dcn31_smu.c:123 
dcn31_smu_send_msg_with_param+0xec/0x130 [amdgpu]
  Modules linked in: btrfs blake2b_generic xor zstd_compress raid6_pq ufs qnx4 
hfsplus hfs minix ntfs msdos jfs xfs libcrc32c cpuid michael_mic 
hid_logitech_hidpp snd_usb_audio snd_usbmidi_lib hid_logitech_dj usbhid 
cdc_ether usbnet r8152 mii qrtr_mhi joydev intel_rapl_msr intel_rapl_common 
bnep snd_soc_dmic snd_acp6x_pdm_dma snd_soc_acp6x_mach snd_soc_core 
snd_compress ac97_bus snd_pcm_dmaengine edac_mce_amd amdgpu 
snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi 
nls_iso8859_1 kvm_amd kvm snd_hda_intel qrtr snd_intel_dspcfg ns 
snd_intel_sdw_acpi snd_hda_codec ath11k_pci crct10dif_pclmul input_leds 
snd_pci_acp6x ghash_clmulni_intel ath11k snd_hda_core snd_hwdep qmi_helpers 
aesni_intel snd_pcm uvcvideo crypto_simd videobuf2_vmalloc videobuf2_memops 
videobuf2_v4l2 iommu_v2 cryptd platform_profile btusb snd_seq_midi gpu_sched 
rapl mac80211 serio_raw snd_seq_midi_event videobuf2_common sparse_keymap 
drm_ttm_helper btrtl snd_rawmidi btbcm videodev
   btintel ttm efi_pstore wmi_bmof hid_multitouch mc bluetooth snd_seq 
drm_kms_helper snd_seq_device ecdh_generic cfg80211 ecc snd_timer cec rc_core 
i2c_algo_bit snd fb_sys_fops syscopyarea sysfillrect mhi sysimgblt libarc4 
soundcore snd_rn_pci_acp3x snd_pci_acp3x ccp ucsi_acpi typec_ucsi amd_pmc 
wireless_hotkey mac_hid typec acpi_tad sch_fq_codel msr parport_pc ppdev lp 
parport drm ip_tables x_tables autofs4 hid_generic crc32_pclmul thunderbolt 
nvme i2c_piix4 xhci_pci xhci_pci_renesas nvme_core iosm wmi i2c_hid_acpi video 
i2c_hid hid
  Workqueue: events_unbound async_run_entry_fn
  RIP: 0010:dcn31_smu_send_msg_with_param+0xec/0x130 [amdgpu]
  Code: 00 e8 38 60 fc ff 48 8b 3b 4c 89 ea be 9b 62 01 00 e8 c8 60 fc ff 85 c0 
75 40 bf c6 a7 00 00 e8 aa da 0c c6 41 83 ec 01 75 dc <0f> 0b 48 8b 3b b9 80 84 
1e 00 44 89 fa 44 89 f6 e8 af 9c fc ff 48
  RSP: 0018:ffffb76d03167bc8 EFLAGS: 00010202
  RAX: 00000000000000ff RBX: ffff9dc54f492800 RCX: 0000000000000008
  RDX: 0000000000000000 RSI: 000000000001629b RDI: ffff9dc548bc0000
  RBP: ffffb76d03167bf8 R08: 0000000000000009 R09: 0000000000000320
  R10: 0000000000000191 R11: 0000000004451a00 R12: 0000000000030b48
  R13: ffffffffc1717d90 R14: 0000000000000011 R15: 0000000000000001
  FS: 0000000000000000(0000) GS:ffff9dcc7e800000(0000) knlGS:0000000000000000
  CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000055f79ba89f68 CR3: 0000000526810000 CR4: 0000000000750ee0
  PKRU: 55555554
  Call Trace:
   <TASK>
   dcn31_smu_transfer_wm_table_dram_2_smu+0x23/0x30 [amdgpu]
   dcn31_notify_wm_ranges+0x145/0x180 [amdgpu]
   dcn31_init_hw+0x465/0x8e0 [amdgpu]
   dc_set_power_state+0x113/0x160 [amdgpu]
   dm_resume+0x2b5/0x610 [amdgpu]
   amdgpu_device_ip_resume_phase2+0x58/0xc0 [amdgpu]
   amdgpu_device_resume+0xd9/0x210 [amdgpu]
   amdgpu_pmops_resume+0x1d/0x40 [amdgpu]
   pci_pm_resume+0x5b/0x90
   ? pci_pm_thaw+0x80/0x80
   dpm_run_callback+0x52/0x160
   device_resume+0xdd/0x1e0
   async_resume+0x1f/0x60
   async_run_entry_fn+0x33/0x120
   process_one_work+0x236/0x420
   worker_thread+0x34/0x410
   ? process_one_work+0x420/0x420
   kthread+0x12f/0x150
   ? set_kthread_struct+0x40/0x40
   ret_from_fork+0x22/0x30
   </TASK>
  ---[ end trace 71d329758d0428b2 ]---
  ------------[ cut here ]------------
  WARNING: CPU: 8 PID: 60399 at 
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn31/dcn31_smu.c:105 
dcn31_smu_send_msg_with_param+0x56/0x130 [amdgpu]
  Modules linked in: btrfs blake2b_generic xor zstd_compress raid6_pq ufs qnx4 
hfsplus hfs minix ntfs msdos jfs xfs libcrc32c cpuid michael_mic 
hid_logitech_hidpp snd_usb_audio snd_usbmidi_lib hid_logitech_dj usbhid 
cdc_ether usbnet r8152 mii qrtr_mhi joydev intel_rapl_msr intel_rapl_common 
bnep snd_soc_dmic snd_acp6x_pdm_dma snd_soc_acp6x_mach snd_soc_core 
snd_compress ac97_bus snd_pcm_dmaengine edac_mce_amd amdgpu 
snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi 
nls_iso8859_1 kvm_amd kvm snd_hda_intel qrtr snd_intel_dspcfg ns 
snd_intel_sdw_acpi snd_hda_codec ath11k_pci crct10dif_pclmul input_leds 
snd_pci_acp6x ghash_clmulni_intel ath11k snd_hda_core snd_hwdep qmi_helpers 
aesni_intel snd_pcm uvcvideo crypto_simd videobuf2_vmalloc videobuf2_memops 
videobuf2_v4l2 iommu_v2 cryptd platform_profile btusb snd_seq_midi gpu_sched 
rapl mac80211 serio_raw snd_seq_midi_event videobuf2_common sparse_keymap 
drm_ttm_helper btrtl snd_rawmidi btbcm videodev
   btintel ttm efi_pstore wmi_bmof hid_multitouch mc bluetooth snd_seq 
drm_kms_helper snd_seq_device ecdh_generic cfg80211 ecc snd_timer cec rc_core 
i2c_algo_bit snd fb_sys_fops syscopyarea sysfillrect mhi sysimgblt libarc4 
soundcore snd_rn_pci_acp3x snd_pci_acp3x ccp ucsi_acpi typec_ucsi amd_pmc 
wireless_hotkey mac_hid typec acpi_tad sch_fq_codel msr parport_pc ppdev lp 
parport drm ip_tables x_tables autofs4 hid_generic crc32_pclmul thunderbolt 
nvme i2c_piix4 xhci_pci xhci_pci_renesas nvme_core iosm wmi i2c_hid_acpi video 
i2c_hid hid
  Workqueue: events_unbound async_run_entry_fn
  RIP: 0010:dcn31_smu_send_msg_with_param+0x56/0x130 [amdgpu]
  Code: 48 8b 3b 4c 89 ea be 9b 62 01 00 e8 64 61 fc ff 85 c0 75 32 bf c6 a7 00 
00 89 45 d4 e8 43 db 0c c6 41 83 ec 01 8b 45 d4 75 d6 <0f> 0b 85 c0 ba ff ff ff 
ff 75 16 48 83 c4 08 89 d0 5b 41 5c 41 5d
  RSP: 0018:ffffb76d03167b80 EFLAGS: 00010202
  RAX: 00000000000000ff RBX: ffff9dc54f492800 RCX: ffff9dc54dec03b0
  RDX: 0000000000000000 RSI: 000000000001629b RDI: ffff9dc548bc0000
  RBP: ffffb76d03167bb0 R08: ffffffffc1614a90 R09: ffffb76d03167bc8
  R10: 0000000000000000 R11: ffffffff88875560 R12: 0000000000030d41
  R13: ffffffffc1717d90 R14: 0000000000000012 R15: 0000000000000000
  FS: 0000000000000000(0000) GS:ffff9dcc7e800000(0000) knlGS:0000000000000000
  CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000055f79ba89f68 CR3: 0000000526810000 CR4: 0000000000750ee0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? amdgpu_cgs_write_register+0x14/0x20 [amdgpu]
   dcn31_smu_set_display_idle_optimization+0x2f/0x40 [amdgpu]
   dcn31_update_clocks+0x2f5/0x340 [amdgpu]
   ? amdgpu_device_rreg+0x17/0x20 [amdgpu]
   ? amdgpu_cgs_read_register+0x14/0x20 [amdgpu]
   ? dm_read_reg_func+0x2f/0x90 [amdgpu]
   dcn21_exit_optimized_pwr_state+0x1e/0x20 [amdgpu]
   clk_mgr_exit_optimized_pwr_state+0x91/0x120 [amdgpu]
   dc_link_detect+0x73/0xc0 [amdgpu]
   dm_resume+0x34c/0x610 [amdgpu]
   amdgpu_device_ip_resume_phase2+0x58/0xc0 [amdgpu]
   amdgpu_device_resume+0xd9/0x210 [amdgpu]
   amdgpu_pmops_resume+0x1d/0x40 [amdgpu]
   pci_pm_resume+0x5b/0x90
   ? pci_pm_thaw+0x80/0x80
   dpm_run_callback+0x52/0x160
   device_resume+0xdd/0x1e0
   async_resume+0x1f/0x60
   async_run_entry_fn+0x33/0x120
   process_one_work+0x236/0x420
   worker_thread+0x34/0x410
   ? process_one_work+0x420/0x420
   kthread+0x12f/0x150
   ? set_kthread_struct+0x40/0x40
   ret_from_fork+0x22/0x30
   </TASK>
  ---[ end trace 71d329758d0428b3 ]---

To manage notifications about this bug go to:
https://bugs.launchpad.net/hwe-next/+bug/1961119/+subscriptions


-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to     : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to