This bug was fixed in the package linux - 5.4.0-166.183
---------------
linux (5.4.0-166.183) focal; urgency=medium
* focal/linux: 5.4.0-166.183 -proposed tracker (LP: #2038010)
* Use new annotations model (LP: #2019000)
- [Packaging] new annotations model infrastructure
- [Packaging] config-check: Handle new annotations format 4
- [Packaging] rules: Use old-kernelconfig for old configs
- [Config] sanitize annotations
- [Config] import generated configs into annotation file
- [Packaging] kernelconfig: add i386 as supported arch
- [Config] Remove all old configs files
* Packaging resync (LP: #1786013)
- [Packaging] update helper scripts
- [Packaging] update annotations scripts
* fix typo in config-checks invocation (LP: #2020413)
- [Packaging] fix typo when calling the old config-check
- [Packaging] fix typo in 4-checks.mk
* support python < 3.9 with annotations (LP: #2020531)
- [Packaging] kconfig/annotations.py: support older way of merging dicts
* CVE-2023-42756
- netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
* CVE-2023-4623
- net/sched: sch_hfsc: Ensure inner classes have fsc curve
* Focal update: v5.4.252 upstream stable release (LP: #2036240)
- ia64/cpu: Switch to arch_cpu_finalize_init()
- m68k/cpu: Switch to arch_cpu_finalize_init()
- mips/cpu: Switch to arch_cpu_finalize_init()
- sh/cpu: Switch to arch_cpu_finalize_init()
- x86/cpufeatures: Add SEV-ES CPU feature
- x86/cpu: Add VM page flush MSR availablility as a CPUID feature
- x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX]
- tools headers cpufeatures: Sync with the kernel sources
- x86/cpu, kvm: Add support for CPUID_80000021_EAX
- Linux 5.4.252
- Upstream stable to v5.4.252
* CVE-2023-42755
- net/sched: Retire rsvp classifier
- [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
* CVE-2023-42753
- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
ip_set_hash_netportnet.c
* CVE-2023-34319
- xen/netback: Fix buffer overrun triggered by unusual packet
* CVE-2023-4921
- net: sched: sch_qfq: Fix UAF in qfq_dequeue()
* CVE-2023-42752
- igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
* Avoid address overwrite in kernel_connect (LP: #2035163)
- net: Avoid address overwrite in kernel_connect
* [regression] Unable to initialize SGX enclaves with XFRM other than 3
(LP: #2034745)
- x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
* CVE-2023-4881
- netfilter: nftables: exthdr: fix 4-byte stack OOB write
* CVE-2023-4622
- af_unix: Fix null-ptr-deref in unix_stream_sendpage().
* Focal update: v5.4.251 upstream stable release (LP: #2034918)
- x86/smp: Use dedicated cache-line for mwait_play_dead()
- video: imsttfb: check for ioremap() failures
- fbdev: imsttfb: Fix use after free bug in imsttfb_probe
- HID: wacom: Use ktime_t rather than int when dealing with timestamps
- drm/i915: Initialise outparam for error return from wait_for_register
- scripts/tags.sh: Resolve gtags empty index generation
- drm/amdgpu: Validate VM ioctl flags.
- bgmac: fix *initial* chip reset to support BCM5358
- x86/resctrl: Use is_closid_match() in more places
- x86/resctrl: Only show tasks' pid in current pid namespace
- md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
- md/raid10: fix overflow of md/safe_mode_delay
- md/raid10: fix wrong setting of max_corr_read_errors
- md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
- md/raid10: fix io loss while replacement replace rdev
- irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
- irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
- tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
- clocksource/drivers/cadence-ttc: Use ttc driver as platform driver
- clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
- PM: domains: fix integer overflow issues in genpd_parse_state()
- powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
- ARM: 9303/1: kprobes: avoid missing-declaration warnings
- evm: Complete description of evm_inode_setattr()
- pstore/ram: Add check for kstrdup
- ima: Fix build warnings
- wifi: ath9k: fix AR9003 mac hardware hang check register offset
calculation
- wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
- samples/bpf: Fix buffer overflow in tcp_basertt
- spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
- wifi: mwifiex: Fix the size of a memory allocation in
mwifiex_ret_802_11_scan()
- nfc: constify several pointers to u8, char and sk_buff
- nfc: llcp: fix possible use of uninitialized variable in
nfc_llcp_send_connect()
- regulator: core: Fix more error checking for debugfs_create_dir()
- regulator: core: Streamline debugfs operations
- wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
- wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
- wifi: atmel: Fix an error handling path in atmel_probe()
- wl3501_cs: Fix a bunch of formatting issues related to function docs
- wl3501_cs: Remove unnecessary NULL check
- wl3501_cs: Fix misspelling and provide missing documentation
- net: create netdev->dev_addr assignment helpers
- wl3501_cs: use eth_hw_addr_set()
- wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
- wifi: ray_cs: Utilize strnlen() in parse_addr()
- wifi: ray_cs: Drop useless status variable in parse_addr()
- wifi: ray_cs: Fix an error handling path in ray_probe()
- wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
- wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
- watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct
config
- watchdog/perf: more properly prevent false positives with turbo modes
- kexec: fix a memory leak in crash_shrink_memory()
- memstick r592: make memstick_debug_get_tpc_name() static
- wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
- rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
- wifi: iwlwifi: pull from TXQs with softirqs disabled
- wifi: cfg80211: rewrite merging of inherited elements
- wifi: ath9k: convert msecs to jiffies where needed
- netlink: fix potential deadlock in netlink_set_err()
- netlink: do not hard code device address lenth in fdb dumps
- selftests: rtnetlink: remove netdevsim device after ipsec offload test
- gtp: Fix use-after-free in __gtp_encap_destroy().
- lib/ts_bm: reset initial match offset for every block of text
- netfilter: conntrack: dccp: copy entire header to stack buffer, not just
basic one
- netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return
value.
- ipvlan: Fix return value of ipvlan_queue_xmit()
- netlink: Add __sock_i_ino() for __netlink_diag_dump().
- radeon: avoid double free in ci_dpm_init()
- Input: drv260x - sleep between polling GO bit
- ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
- Input: adxl34x - do not hardcode interrupt trigger type
- drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
- RDMA/bnxt_re: Fix to remove an unnecessary log
- ARM: dts: gta04: Move model property out of pinctrl node
- arm64: dts: qcom: msm8916: correct camss unit address
- drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
- ARM: ep93xx: fix missing-prototype warnings
- memory: brcmstb_dpfe: fix testing array offset after use
- ASoC: es8316: Increment max value for ALC Capture Target Volume control
- ASoC: es8316: Do not set rate constraints for unsupported MCLKs
- soc/fsl/qe: fix usb.c build errors
- IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
- arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
- fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
- drm/amdkfd: Fix potential deallocation of previously deallocated memory.
- drm/radeon: fix possible division-by-zero errors
- clk: tegra: tegra124-emc: Fix potential memory leak
- ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
- clk: cdce925: check return value of kasprintf()
- clk: keystone: sci-clk: check return value of kasprintf()
- ASoC: imx-audmix: check return value of devm_kasprintf()
- scsi: qedf: Fix NULL dereference in error handling
- PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
- scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
- PCI: pciehp: Cancel bringup sequence if card is not present
- PCI: ftpci100: Release the clock resources
- PCI: Add pci_clear_master() stub for non-CONFIG_PCI
- pinctrl: cherryview: Return correct value if pin in push-pull mode
- perf dwarf-aux: Fix off-by-one in die_get_varname()
- pinctrl: at91-pio4: check return value of devm_kasprintf()
- powerpc/mm/dax: Fix the condition when checking if altmap vmemap can
cross-
boundary
- hwrng: virtio - add an internal buffer
- hwrng: virtio - don't wait on cleanup
- hwrng: virtio - don't waste entropy
- hwrng: virtio - always add a pending request
- hwrng: virtio - Fix race on data_avail and actual data
- crypto: nx - fix build warnings when DEBUG_FS is not enabled
- modpost: fix section mismatch message for R_ARM_ABS32
- modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
- crypto: marvell/cesa - Fix type mismatch warning
- modpost: fix off by one in is_executable_section()
- ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
- NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
- hwrng: st - Fix W=1 unused variable warning
- hwrng: st - keep clock enabled while hwrng is registered
- USB: serial: option: add LARA-R6 01B PIDs
- usb: dwc3: gadget: Propagate core init errors to UDC during pullup
- block: fix signed int overflow in Amiga partition support
- block: change all __u32 annotations to __be32 in affs_hardblocks.h
- w1: fix loop in w1_fini()
- sh: j2: Use ioremap() to translate device tree address into kernel memory
- media: usb: Check az6007_read() return value
- media: videodev2.h: Fix struct v4l2_input tuner index comment
- usb: dwc3: qcom: Fix potential memory leak
- extcon: Fix kernel doc of property fields to avoid warnings
- extcon: Fix kernel doc of property capability fields to avoid warnings
- usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
- usb: hide unused usbfs_notify_suspend/resume functions
- mfd: rt5033: Drop rt5033-battery sub-device
- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
- usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
- mfd: intel-lpss: Add missing check for platform_get_resource
- serial: 8250_omap: Use force_suspend and resume for system suspend
- mfd: stmfx: Fix error path in stmfx_chip_init
- KVM: s390: vsie: fix the length of APCB bitmap
- mfd: stmpe: Only disable the regulators if they are enabled
- pwm: imx-tpm: force 'real_period' to be zero in suspend
- pwm: sysfs: Do not apply state to already disabled PWMs
- rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
- sctp: fix potential deadlock on &net->sctp.addr_wq_lock
- Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
- spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
- mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
- f2fs: fix error path handling in truncate_dnode()
- powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
- net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
- tcp: annotate data races in __tcp_oow_rate_limited()
- xsk: Improve documentation for AF_XDP
- xsk: Honor SO_BINDTODEVICE on bind
- net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
- net: dsa: tag_sja1105: fix MAC DA patching from meta frames
- sh: dma: Fix DMA channel offset calculation
- i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
- i2c: xiic: Don't try to handle more interrupt events after error
- ALSA: jack: Fix mutex call in snd_jack_report()
- NFSD: add encoding of op_recall flag for write delegation
- mmc: core: disable TRIM on Kingston EMMC04G-M627
- mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
- mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is
used.
- bcache: Remove unnecessary NULL point check in node allocations
- integrity: Fix possible multiple allocation in integrity_inode_get()
- jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
- fs: avoid empty option when generating legacy mount string
- ext4: Remove ext4 locking of moved directory
- Revert "f2fs: fix potential corruption when moving a directory"
- fs: Establish locking order for unrelated directories
- fs: Lock moved directories
- btrfs: fix race when deleting quota root from the dirty cow roots list
- ARM: orion5x: fix d2net gpio initialization
- fs: no need to check source
- fanotify: disallow mount/sb marks on kernel internal pseudo fs
- block: add overflow checks for Amiga partition support
- netfilter: nf_tables: fix nat hook table deletion
- netfilter: nftables: add helper function to set the base sequence number
- netfilter: add helper function to set up the nfnetlink header and use it
- netfilter: nf_tables: use net_generic infra for transaction data
- netfilter: nf_tables: add rescheduling points during loop detection walks
- netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound
set/chain
- netfilter: nf_tables: reject unbound anonymous set before commit phase
- netfilter: nf_tables: unbind non-anonymous set if rule construction fails
- netfilter: nf_tables: fix scheduling-while-atomic splat
- netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
- tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
- block/partition: fix signedness issue for Amiga partitions
- net: lan743x: Don't sleep in atomic context
- workqueue: clean up WORK_* constant types, clarify masking
- drm/panel: Initialise panel dev and funcs through drm_panel_init()
- drm/panel: Add and fill drm_panel type field
- drm/panel: simple: Add connector_type for innolux_at043tn24
- igc: Remove delay during TX ring configuration
- igc: set TP bit in 'supported' and 'advertising' fields of
ethtool_link_ksettings
- scsi: qla2xxx: Fix error code in qla2x00_start_sp()
- net: mvneta: fix txq_map in case of txq_number==1
- ionic: improve irq numa locality
- ionic: clean irq affinity on queue deinit
- ionic: move irq request to qcq alloc
- ionic: ionic_intr_free parameter change
- ionic: remove WARN_ON to prevent panic_on_warn
- icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
- udp6: fix udp6_ehashfn() typo
- ntb: idt: Fix error handling in idt_pci_driver_init()
- NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
- ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
- NTB: ntb_transport: fix possible memory leak while device_register() fails
- NTB: ntb_tool: Add check for devm_kcalloc
- ipv6/addrconf: fix a potential refcount underflow for idev
- platform/x86: wmi: Replace UUID redefinitions by their originals
- platform/x86: wmi: Fix indentation in some cases
- platform/x86: wmi: remove unnecessary argument
- platform/x86: wmi: use guid_t and guid_equal()
- platform/x86: wmi: move variables
- platform/x86: wmi: Break possible infinite loop when parsing GUID
- erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond
EOF
- wifi: airo: avoid uninitialized warning in airo_get_rate()
- cls_flower: Add extack support for src and dst port range options
- net/sched: flower: Ensure both minimum and maximum ports are specified
- net/sched: make psched_mtu() RTNL-less safe
- pinctrl: amd: Fix mistake in handling clearing pins at startup
- pinctrl: amd: Detect internal GPIO0 debounce handling
- pinctrl: amd: Only use special debounce behavior for GPIO 0
- tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
- mtd: rawnand: meson: fix unaligned DMA buffers handling
- net: bcmgenet: Ensure MDIO unregistration has clocks enabled
- powerpc: Fail build if using recordmcount with binutils v2.37
- misc: fastrpc: Create fastrpc scalar with correct buffer count
- SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
- erofs: fix compact 4B support for 16k block size
- ext4: fix wrong unit use in ext4_mb_clear_bb
- ext4: only update i_reserved_data_blocks on successful block allocation
- jfs: jfs_dmap: Validate db_l2nbperpage while mounting
- PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
- PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
- PCI: qcom: Disable write access to read only registers for IP v2.3.3
- PCI: rockchip: Assert PCI Configuration Enable bit after probe
- PCI: rockchip: Write PCI Device ID to correct register
- PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
- PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
- PCI: rockchip: Use u32 variable to access 32-bit registers
- PCI: rockchip: Set address alignment for endpoint mode
- misc: pci_endpoint_test: Free IRQs before removing the device
- misc: pci_endpoint_test: Re-init completion for every test
- md/raid0: add discard support for the 'original' layout
- fs: dlm: return positive pid value for F_GETLK
- drm/atomic: Allow vblank-enabled + self-refresh "disable"
- drm/rockchip: vop: Leave vblank enabled in self-refresh
- serial: atmel: don't enable IRQs prematurely
- firmware: stratix10-svc: Fix a potential resource leak in
svc_create_memory_pool()
- hwrng: imx-rngc - fix the timeout for init and self check
- ceph: don't let check_caps skip sending responses for revoke msgs
- meson saradc: fix clock divider mask length
- Revert "8250: add support for ASIX devices with a FIFO bug"
- tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in
case of error
- tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk()
when
iterating clk
- tracing/histograms: Add histograms to hist_vars if they have referenced
variables
- ring-buffer: Fix deadloop issue on reading trace_pipe
- xtensa: ISS: fix call to split_if_spec
- tracing: Fix null pointer dereference in tracing_err_log_open()
- tracing/probes: Fix not to count error code to total length
- scsi: qla2xxx: Wait for io return on terminate rport
- scsi: qla2xxx: Fix potential NULL pointer dereference
- scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
- scsi: qla2xxx: Correct the index of array
- scsi: qla2xxx: Pointer may be dereferenced
- scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
- drm/atomic: Fix potential use-after-free in nonblocking commits
- perf probe: Add test for regression introduced by switch to
die_get_decl_file()
- btrfs: fix warning when putting transaction with qgroups enabled after
abort
- fuse: revalidate: don't invalidate if interrupted
- selftests: tc: set timeout to 15 minutes
- can: bcm: Fix UAF in bcm_proc_show()
- drm/client: Fix memory leak in drm_client_target_cloned
- drm/client: Fix memory leak in drm_client_modeset_probe
- ext4: correct inline offset when handling xattrs in inode body
- debugobjects: Recheck debug_objects_enabled before reporting
- nbd: Add the maximum limit of allocated index in nbd_dev_add
- md: fix data corruption for raid456 when reshape restart while grow up
- md/raid10: prevent soft lockup while flush writes
- posix-timers: Ensure timer ID search-loop limit is valid
- arm64: mm: fix VA-range sanity check
- sched/fair: Don't balance task to its current running CPU
- bpf: Address KCSAN report on bpf_lru_list
- devlink: report devlink_port_type_warn source device
- wifi: wext-core: Fix -Wstringop-overflow warning in
ioctl_standard_iw_point()
- wifi: iwlwifi: mvm: avoid baid size integer overflow
- igb: Fix igb_down hung on surprise removal
- spi: bcm63xx: fix max prepend length
- fbdev: imxfb: warn about invalid left/right margin
- pinctrl: amd: Use amd_pinconf_set() for all config options
- net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
- iavf: Fix use-after-free in free_netdev
- net:ipv6: check return value of pskb_trim()
- Revert "tcp: avoid the lookup process failing to get sk in ehash table"
- fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
- llc: Don't drop packet from non-root netns.
- netfilter: nf_tables: fix spurious set element insertion failure
- netfilter: nf_tables: can't schedule in nft_chain_validate
- tcp: annotate data-races around tp->tcp_tx_delay
- net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX
- tcp: annotate data-races around tp->linger2
- tcp: annotate data-races around rskq_defer_accept
- tcp: annotate data-races around tp->notsent_lowat
- tcp: annotate data-races around fastopenq.max_qlen
- tracing/histograms: Return an error if we fail to add histogram to
hist_vars
list
- Linux 5.4.251
* Focal update: v5.4.250 upstream stable release (LP: #2033297)
- x86/microcode/AMD: Load late on both threads too
- Linux 5.4.250
* Focal update: v5.4.249 upstream stable release (LP: #2033278)
- nilfs2: reject devices with insufficient block count
- mm: rewrite wait_on_page_bit_common() logic
- list: add "list_del_init_careful()" to go with "list_empty_careful()"
- epoll: ep_autoremove_wake_function should use list_del_init_careful
- tracing: Add tracing_reset_all_online_cpus_unlocked() function
- x86/purgatory: remove PGO flags
- tick/common: Align tick period during sched_timer setup
- media: dvbdev: Fix memleak in dvb_register_device
- media: dvbdev: fix error logic at dvb_register_device()
- media: dvb-core: Fix use-after-free due to race at dvb_register_device()
- nilfs2: fix buffer corruption due to concurrent device reads
- Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
- PCI: hv: Fix a race condition bug in hv_pci_query_relations()
- cgroup: Do not corrupt task iteration when rebinding subsystem
- mmc: meson-gx: remove redundant mmc_request_done() call from irq context
- ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN
- writeback: fix dereferencing NULL mapping->host on writeback_page_template
- nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
- cifs: Clean up DFS referral cache
- cifs: Get rid of kstrdup_const()'d paths
- cifs: Introduce helpers for finding TCP connection
- cifs: Merge is_path_valid() into get_normalized_path()
- cifs: Fix potential deadlock when updating vol in cifs_reconnect()
- x86/mm: Avoid using set_pgd() outside of real PGD pages
- ieee802154: hwsim: Fix possible memory leaks
- xfrm: Linearize the skb after offloading if needed.
- net: qca_spi: Avoid high load if QCA7000 is not available
- mmc: mtk-sd: fix deferred probing
- mmc: mvsdio: convert to devm_platform_ioremap_resource
- mmc: mvsdio: fix deferred probing
- mmc: omap: fix deferred probing
- mmc: omap_hsmmc: fix deferred probing
- mmc: sdhci-acpi: fix deferred probing
- mmc: sh_mmcif: fix deferred probing
- mmc: usdhi60rol0: fix deferred probing
- ipvs: align inner_mac_header for encapsulation
- net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
- be2net: Extend xmit workaround to BE3 chip
- netfilter: nf_tables: disallow element updates of bound anonymous sets
- netfilter: nfnetlink_osf: fix module autoload
- Revert "net: phy: dp83867: perform soft reset and retain established link"
- sch_netem: acquire qdisc lock in netem_change()
- scsi: target: iscsi: Prevent login threads from racing between each other
- HID: wacom: Add error check to wacom_parse_and_register()
- arm64: Add missing Set/Way CMO encodings
- media: cec: core: don't set last_initiator if tx in progress
- nfcsim.c: Fix error checking for debugfs_create_dir
- usb: gadget: udc: fix NULL dereference in remove()
- s390/cio: unregister device when the only path is gone
- ASoC: nau8824: Add quirk to active-high jack-detect
- ARM: dts: Fix erroneous ADS touchscreen polarities
- drm/exynos: vidi: fix a wrong error return
- drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
- drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
- x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
- i2c: imx-lpi2c: fix type char overflow issue when calculating the clock
cycle
- mm: fix VM_BUG_ON(PageTail) and BUG_ON(PageWriteback)
- mm: make wait_on_page_writeback() wait for multiple pending writebacks
- Linux 5.4.249
* allow io_uring to be disabled in runtime (LP: #2035116)
- io_uring: add a sysctl to disable io_uring system-wide
* CVE-2023-31083
- Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
* CVE-2023-4132
- media: usb: siano: Fix warning due to null work_func_t function pointer
* CVE-2023-3772
- xfrm: add NULL check in xfrm_update_ae_params
* CVE-2023-0597
- random32: add noise from network and scheduling activity
- x86/kasan: Map shadow for percpu pages on demand
- x86/mm: Randomize per-cpu entry area
- x86/mm: Recompute physical address for every page of per-CPU CEA mapping
- x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
- x86/mm: Do not shuffle CPU entry areas without KASLR
-- Roxana Nicolescu <roxana.nicole...@canonical.com> Mon, 02 Oct 2023
12:18:58 +0200
** Changed in: linux (Ubuntu Focal)
Status: Fix Committed => Fix Released
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-0597
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-31083
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-34319
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-3772
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-42752
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-42753
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-42755
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-42756
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-4622
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-4623
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-4881
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-4921
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2034918
Title:
Focal update: v5.4.251 upstream stable release
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Focal:
Fix Released
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.4.251 upstream stable release
from git://git.kernel.org/
x86/smp: Use dedicated cache-line for mwait_play_dead()
video: imsttfb: check for ioremap() failures
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
HID: wacom: Use ktime_t rather than int when dealing with timestamps
drm/i915: Initialise outparam for error return from wait_for_register
scripts/tags.sh: Resolve gtags empty index generation
drm/amdgpu: Validate VM ioctl flags.
bgmac: fix *initial* chip reset to support BCM5358
x86/resctrl: Use is_closid_match() in more places
x86/resctrl: Only show tasks' pid in current pid namespace
md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
md/raid10: fix overflow of md/safe_mode_delay
md/raid10: fix wrong setting of max_corr_read_errors
md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
md/raid10: fix io loss while replacement replace rdev
irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
clocksource/drivers/cadence-ttc: Use ttc driver as platform driver
clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
PM: domains: fix integer overflow issues in genpd_parse_state()
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
ARM: 9303/1: kprobes: avoid missing-declaration warnings
evm: Complete description of evm_inode_setattr()
pstore/ram: Add check for kstrdup
ima: Fix build warnings
wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
samples/bpf: Fix buffer overflow in tcp_basertt
spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
wifi: mwifiex: Fix the size of a memory allocation in
mwifiex_ret_802_11_scan()
nfc: constify several pointers to u8, char and sk_buff
nfc: llcp: fix possible use of uninitialized variable in
nfc_llcp_send_connect()
regulator: core: Fix more error checking for debugfs_create_dir()
regulator: core: Streamline debugfs operations
wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
wifi: atmel: Fix an error handling path in atmel_probe()
wl3501_cs: Fix a bunch of formatting issues related to function docs
wl3501_cs: Remove unnecessary NULL check
wl3501_cs: Fix misspelling and provide missing documentation
net: create netdev->dev_addr assignment helpers
wl3501_cs: use eth_hw_addr_set()
wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
wifi: ray_cs: Utilize strnlen() in parse_addr()
wifi: ray_cs: Drop useless status variable in parse_addr()
wifi: ray_cs: Fix an error handling path in ray_probe()
wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct
config
watchdog/perf: more properly prevent false positives with turbo modes
kexec: fix a memory leak in crash_shrink_memory()
memstick r592: make memstick_debug_get_tpc_name() static
wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
wifi: iwlwifi: pull from TXQs with softirqs disabled
wifi: cfg80211: rewrite merging of inherited elements
wifi: ath9k: convert msecs to jiffies where needed
netlink: fix potential deadlock in netlink_set_err()
netlink: do not hard code device address lenth in fdb dumps
selftests: rtnetlink: remove netdevsim device after ipsec offload test
gtp: Fix use-after-free in __gtp_encap_destroy().
lib/ts_bm: reset initial match offset for every block of text
netfilter: conntrack: dccp: copy entire header to stack buffer, not just
basic one
netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return
value.
ipvlan: Fix return value of ipvlan_queue_xmit()
netlink: Add __sock_i_ino() for __netlink_diag_dump().
radeon: avoid double free in ci_dpm_init()
Input: drv260x - sleep between polling GO bit
ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
Input: adxl34x - do not hardcode interrupt trigger type
drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
RDMA/bnxt_re: Fix to remove an unnecessary log
ARM: dts: gta04: Move model property out of pinctrl node
arm64: dts: qcom: msm8916: correct camss unit address
drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
ARM: ep93xx: fix missing-prototype warnings
memory: brcmstb_dpfe: fix testing array offset after use
ASoC: es8316: Increment max value for ALC Capture Target Volume control
ASoC: es8316: Do not set rate constraints for unsupported MCLKs
soc/fsl/qe: fix usb.c build errors
IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
drm/amdkfd: Fix potential deallocation of previously deallocated memory.
drm/radeon: fix possible division-by-zero errors
clk: tegra: tegra124-emc: Fix potential memory leak
ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
clk: cdce925: check return value of kasprintf()
clk: keystone: sci-clk: check return value of kasprintf()
ASoC: imx-audmix: check return value of devm_kasprintf()
scsi: qedf: Fix NULL dereference in error handling
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
PCI: pciehp: Cancel bringup sequence if card is not present
PCI: ftpci100: Release the clock resources
PCI: Add pci_clear_master() stub for non-CONFIG_PCI
pinctrl: cherryview: Return correct value if pin in push-pull mode
perf dwarf-aux: Fix off-by-one in die_get_varname()
pinctrl: at91-pio4: check return value of devm_kasprintf()
powerpc/mm/dax: Fix the condition when checking if altmap vmemap can
cross-boundary
hwrng: virtio - add an internal buffer
hwrng: virtio - don't wait on cleanup
hwrng: virtio - don't waste entropy
hwrng: virtio - always add a pending request
hwrng: virtio - Fix race on data_avail and actual data
crypto: nx - fix build warnings when DEBUG_FS is not enabled
modpost: fix section mismatch message for R_ARM_ABS32
modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
crypto: marvell/cesa - Fix type mismatch warning
modpost: fix off by one in is_executable_section()
ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
hwrng: st - Fix W=1 unused variable warning
hwrng: st - keep clock enabled while hwrng is registered
USB: serial: option: add LARA-R6 01B PIDs
usb: dwc3: gadget: Propagate core init errors to UDC during pullup
block: fix signed int overflow in Amiga partition support
block: change all __u32 annotations to __be32 in affs_hardblocks.h
w1: fix loop in w1_fini()
sh: j2: Use ioremap() to translate device tree address into kernel memory
media: usb: Check az6007_read() return value
media: videodev2.h: Fix struct v4l2_input tuner index comment
media: usb: siano: Fix warning due to null work_func_t function pointer
usb: dwc3: qcom: Fix potential memory leak
extcon: Fix kernel doc of property fields to avoid warnings
extcon: Fix kernel doc of property capability fields to avoid warnings
usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
usb: hide unused usbfs_notify_suspend/resume functions
mfd: rt5033: Drop rt5033-battery sub-device
KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
mfd: intel-lpss: Add missing check for platform_get_resource
serial: 8250_omap: Use force_suspend and resume for system suspend
mfd: stmfx: Fix error path in stmfx_chip_init
KVM: s390: vsie: fix the length of APCB bitmap
mfd: stmpe: Only disable the regulators if they are enabled
pwm: imx-tpm: force 'real_period' to be zero in suspend
pwm: sysfs: Do not apply state to already disabled PWMs
rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
sctp: fix potential deadlock on &net->sctp.addr_wq_lock
Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
f2fs: fix error path handling in truncate_dnode()
powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
tcp: annotate data races in __tcp_oow_rate_limited()
xsk: Improve documentation for AF_XDP
xsk: Honor SO_BINDTODEVICE on bind
net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
net: dsa: tag_sja1105: fix MAC DA patching from meta frames
sh: dma: Fix DMA channel offset calculation
i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
i2c: xiic: Don't try to handle more interrupt events after error
ALSA: jack: Fix mutex call in snd_jack_report()
NFSD: add encoding of op_recall flag for write delegation
mmc: core: disable TRIM on Kingston EMMC04G-M627
mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
bcache: Remove unnecessary NULL point check in node allocations
integrity: Fix possible multiple allocation in integrity_inode_get()
jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
fs: avoid empty option when generating legacy mount string
ext4: Remove ext4 locking of moved directory
Revert "f2fs: fix potential corruption when moving a directory"
fs: Establish locking order for unrelated directories
fs: Lock moved directories
btrfs: fix race when deleting quota root from the dirty cow roots list
ARM: orion5x: fix d2net gpio initialization
fs: no need to check source
fanotify: disallow mount/sb marks on kernel internal pseudo fs
block: add overflow checks for Amiga partition support
netfilter: nf_tables: fix nat hook table deletion
netfilter: nftables: add helper function to set the base sequence number
netfilter: add helper function to set up the nfnetlink header and use it
netfilter: nf_tables: use net_generic infra for transaction data
netfilter: nf_tables: add rescheduling points during loop detection walks
netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
netfilter: nf_tables: reject unbound anonymous set before commit phase
netfilter: nf_tables: unbind non-anonymous set if rule construction fails
netfilter: nf_tables: fix scheduling-while-atomic splat
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
block/partition: fix signedness issue for Amiga partitions
net: lan743x: Don't sleep in atomic context
workqueue: clean up WORK_* constant types, clarify masking
drm/panel: Initialise panel dev and funcs through drm_panel_init()
drm/panel: Add and fill drm_panel type field
drm/panel: simple: Add connector_type for innolux_at043tn24
igc: Remove delay during TX ring configuration
igc: set TP bit in 'supported' and 'advertising' fields of
ethtool_link_ksettings
scsi: qla2xxx: Fix error code in qla2x00_start_sp()
net: mvneta: fix txq_map in case of txq_number==1
ionic: improve irq numa locality
ionic: clean irq affinity on queue deinit
ionic: move irq request to qcq alloc
ionic: ionic_intr_free parameter change
ionic: remove WARN_ON to prevent panic_on_warn
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
udp6: fix udp6_ehashfn() typo
ntb: idt: Fix error handling in idt_pci_driver_init()
NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
NTB: ntb_transport: fix possible memory leak while device_register() fails
NTB: ntb_tool: Add check for devm_kcalloc
ipv6/addrconf: fix a potential refcount underflow for idev
platform/x86: wmi: Replace UUID redefinitions by their originals
platform/x86: wmi: Fix indentation in some cases
platform/x86: wmi: remove unnecessary argument
platform/x86: wmi: use guid_t and guid_equal()
platform/x86: wmi: move variables
platform/x86: wmi: Break possible infinite loop when parsing GUID
erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
wifi: airo: avoid uninitialized warning in airo_get_rate()
cls_flower: Add extack support for src and dst port range options
net/sched: flower: Ensure both minimum and maximum ports are specified
net/sched: make psched_mtu() RTNL-less safe
pinctrl: amd: Fix mistake in handling clearing pins at startup
pinctrl: amd: Detect internal GPIO0 debounce handling
pinctrl: amd: Only use special debounce behavior for GPIO 0
tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
mtd: rawnand: meson: fix unaligned DMA buffers handling
net: bcmgenet: Ensure MDIO unregistration has clocks enabled
powerpc: Fail build if using recordmcount with binutils v2.37
misc: fastrpc: Create fastrpc scalar with correct buffer count
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
erofs: fix compact 4B support for 16k block size
ext4: fix wrong unit use in ext4_mb_clear_bb
ext4: only update i_reserved_data_blocks on successful block allocation
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
PCI: qcom: Disable write access to read only registers for IP v2.3.3
PCI: rockchip: Assert PCI Configuration Enable bit after probe
PCI: rockchip: Write PCI Device ID to correct register
PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
PCI: rockchip: Use u32 variable to access 32-bit registers
PCI: rockchip: Set address alignment for endpoint mode
misc: pci_endpoint_test: Free IRQs before removing the device
misc: pci_endpoint_test: Re-init completion for every test
md/raid0: add discard support for the 'original' layout
fs: dlm: return positive pid value for F_GETLK
drm/atomic: Allow vblank-enabled + self-refresh "disable"
drm/rockchip: vop: Leave vblank enabled in self-refresh
serial: atmel: don't enable IRQs prematurely
firmware: stratix10-svc: Fix a potential resource leak in
svc_create_memory_pool()
hwrng: imx-rngc - fix the timeout for init and self check
ceph: don't let check_caps skip sending responses for revoke msgs
meson saradc: fix clock divider mask length
Revert "8250: add support for ASIX devices with a FIFO bug"
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in
case of error
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when
iterating clk
tracing/histograms: Add histograms to hist_vars if they have referenced
variables
ring-buffer: Fix deadloop issue on reading trace_pipe
xtensa: ISS: fix call to split_if_spec
tracing: Fix null pointer dereference in tracing_err_log_open()
tracing/probes: Fix not to count error code to total length
scsi: qla2xxx: Wait for io return on terminate rport
scsi: qla2xxx: Fix potential NULL pointer dereference
scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
scsi: qla2xxx: Correct the index of array
scsi: qla2xxx: Pointer may be dereferenced
scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
drm/atomic: Fix potential use-after-free in nonblocking commits
perf probe: Add test for regression introduced by switch to
die_get_decl_file()
btrfs: fix warning when putting transaction with qgroups enabled after abort
fuse: revalidate: don't invalidate if interrupted
selftests: tc: set timeout to 15 minutes
can: bcm: Fix UAF in bcm_proc_show()
drm/client: Fix memory leak in drm_client_target_cloned
drm/client: Fix memory leak in drm_client_modeset_probe
ext4: correct inline offset when handling xattrs in inode body
debugobjects: Recheck debug_objects_enabled before reporting
nbd: Add the maximum limit of allocated index in nbd_dev_add
md: fix data corruption for raid456 when reshape restart while grow up
md/raid10: prevent soft lockup while flush writes
posix-timers: Ensure timer ID search-loop limit is valid
arm64: mm: fix VA-range sanity check
sched/fair: Don't balance task to its current running CPU
bpf: Address KCSAN report on bpf_lru_list
devlink: report devlink_port_type_warn source device
wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
wifi: iwlwifi: mvm: avoid baid size integer overflow
igb: Fix igb_down hung on surprise removal
spi: bcm63xx: fix max prepend length
fbdev: imxfb: warn about invalid left/right margin
pinctrl: amd: Use amd_pinconf_set() for all config options
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
iavf: Fix use-after-free in free_netdev
net:ipv6: check return value of pskb_trim()
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
llc: Don't drop packet from non-root netns.
netfilter: nf_tables: fix spurious set element insertion failure
netfilter: nf_tables: can't schedule in nft_chain_validate
tcp: annotate data-races around tp->tcp_tx_delay
net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX
tcp: annotate data-races around tp->linger2
tcp: annotate data-races around rskq_defer_accept
tcp: annotate data-races around tp->notsent_lowat
tcp: annotate data-races around fastopenq.max_qlen
tracing/histograms: Return an error if we fail to add histogram to hist_vars
list
Linux 5.4.251
UBUNTU: Upstream stable to v5.4.251
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2034918/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
