Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.181 upstream stable release
from git://git.kernel.org/
ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
tipc: fix memory leak in tipc_link_xmit
net: tls: explicitly disallow disconnect
net: ethtool: Don't call .cleanup_data when prepare_data fails
ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
ata: sata_sx4: Add error handling in pdc20621_i2c_read()
nvmet-fcloop: swap list_add_tail arguments
net: ppp: Add bound checking for skb data on ppp_sync_txmung
nft_set_pipapo: fix incorrect avx2 match of 5th field octet
umount: Allow superblock owners to force umount
pm: cpupower: bench: Prevent NULL dereference on malloc failure
x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when
running in a virtual machine
perf: arm_pmu: Don't disable counter in armpmu_add()
arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
xen/mcelog: Add __nonstring annotations for unterminated strings
HID: pidff: Convert infinite length from Linux API to PID standard
HID: pidff: Do not send effect envelope if it's empty
HID: pidff: Fix null pointer dereference in pidff_find_fields
ALSA: hda: intel: Fix Optimus when GPU has no sound
ASoC: fsl_audmix: register card device depends on 'dais' property
ALSA: usb-audio: Fix CME quirk for UF series keyboards
page_pool: avoid infinite loop to schedule delayed worker
jfs: Fix uninit-value access of imap allocated in the diMount() function
fs/jfs: cast inactags to s64 to prevent potential overflow
fs/jfs: Prevent integer overflow in AG size calculation
jfs: Prevent copying of nlink with value 0 from disk inode
jfs: add sanity check for agwidth in dbMount
ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
ahci: add PCI ID for Marvell 88SE9215 SATA Controller
ext4: protect ext4_release_dquot against freezing
ext4: ignore xattrs past end
scsi: st: Fix array overflow in st_setup()
wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
net: vlan: don't propagate flags on open
tracing: fix return value in __ftrace_event_enable_disable for
TRACE_REG_UNREGISTER
Bluetooth: hci_uart: fix race during initialization
drm: allow encoder mode_set even when connectors change for crtc
drm/amd/display: Update Cursor request mode to the beginning prefetch always
drm: panel-orientation-quirks: Add support for AYANEO 2S
drm: panel-orientation-quirks: Add new quirk for GPD Win 2
drm/bridge: panel: forbid initializing a panel with unknown connector type
drivers: base: devres: Allow to release group on device release
drm/amdkfd: clamp queue size to minimum
drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
fbdev: omapfb: Add 'plane' value check
ktest: Fix Test Failures Due to Missing LOG_FILE Directories
pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
pwm: rcar: Simplify multiplication/shift logic
pwm: rcar: Improve register calculation
pwm: fsl-ftm: Handle clk_get_rate() returning 0
bpf: Add endian modifiers to fix endian warnings
bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
ext4: don't treat fhandle lookup of ea_inode as FS corruption
media: i2c: adv748x: Fix test pattern selection mask
media: venus: hfi: add a check to handle OOB in sfr region
media: venus: hfi: add check to handle incorrect queue size
media: vim2m: print device name after registering device
media: siano: Fix error handling in smsdvb_module_init()
xenfs/xensyms: respect hypervisor's "next" indication
arm64: cputype: Add MIDR_CORTEX_A76AE
arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
spi: cadence-qspi: Fix probe on AM62A LP SK
mtd: rawnand: brcmnand: fix PM resume warning
media: streamzap: prevent processing IR data on URB failure
media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
media: i2c: ccs: Set the device's runtime PM status correctly in remove
media: i2c: ccs: Set the device's runtime PM status correctly in probe
media: i2c: ov7251: Set enable GPIO low in probe
media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
media: venus: hfi_parser: add check to avoid out of bound access
media: venus: hfi_parser: refactor hfi packet parsing logic
mtd: Add check for devm_kcalloc()
net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
mtd: Replace kcalloc() with devm_kcalloc()
clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
wifi: mt76: Add check for devm_kstrdup()
wifi: mac80211: fix integer overflow in hwmp_route_info_get()
ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
bus: mhi: host: Fix race between unprepare and queue_buf
ext4: fix off-by-one error in do_split
vdpa/mlx5: Fix oversized null mkey longer than 32bit
i3c: master: svc: Use readsb helper for reading MDB
i3c: Add NULL pointer check in i3c_master_queue_ibi()
jbd2: remove wrong sb->s_sequence check
mfd: ene-kb3930: Fix a potential NULL pointer dereference
locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
mptcp: fix NULL pointer in can_accept_new_subflow
mptcp: only inc MPJoinAckHMacFailure for HMAC failures
mtd: inftlcore: Add error check for inftl_read_oob()
mtd: rawnand: Add status chack in r852_ready()
arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
sparc/mm: disable preemption in lazy mmu mode
mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
sctp: detect and prevent references to a freed transport in sendmsg
thermal/drivers/rockchip: Add missing rk3328 mapping entry
crypto: ccp - Fix check for the primary ASP device
dm-integrity: set ti->error on memory allocation failure
ftrace: Add cond_resched() to ftrace_graph_set_hash()
gpio: zynq: Fix wakeup source leaks on device unbind
ntb: use 64-bit arithmetic for the MSI doorbell mask
of/irq: Fix device node refcount leakages in of_irq_count()
of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
of/irq: Fix device node refcount leakages in of_irq_init()
PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
PCI: Fix reference leak in pci_alloc_child_bus()
pinctrl: qcom: Clear latched interrupt status when changing IRQ type
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due
to Race Condition
arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
ACPI: platform-profile: Fix CFI violation when accessing sysfs files
x86/e820: Fix handling of subpage regions when calculating nosave ranges in
e820__register_nosave_regions()
Bluetooth: hci_uart: Fix another race during initialization
scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly
scsi: hisi_sas: Pass abort structure for internal abort
scsi: hisi_sas: Factor out task prep and delivery code
scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal
scsi: libsas: Delete lldd_clear_aca callback
scsi: libsas: Add struct sas_tmf_task
scsi: hisi_sas: Enable force phy when SATA disk directly connected
wifi: at76c50x: fix use after free access in at76_disconnect
wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
wifi: mac80211: Purge vif txq in ieee80211_do_stop()
wifi: wl1251: fix memory leak in wl1251_tx_work
scsi: iscsi: Fix missing scsi_host_put() in error path
md/raid10: fix missing discard IO accounting
RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
RDMA/hns: Fix wrong maximum DMA segment size
RDMA/core: Silence oversized kvmalloc() warning
Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
Bluetooth: btrtl: Prevent potential NULL dereference
Bluetooth: l2cap: Check encryption key size on incoming connection
Revert "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
igc: fix PTM cycle trigger logic
igc: move ktime snapshot into PTM retry loop
igc: handle the IGC_PTP_ENABLED flag correctly
igc: cleanup PTP module if probe fails
net: mctp: Set SOCK_RCU_FREE
net: openvswitch: fix nested key length validation in the set() action
cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
net: b53: enable BPDU reception for management port
net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never
registered
net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
riscv: Properly export reserved regions in /proc/iomem
riscv: KGDB: Do not inline arch_kgdb_breakpoint()
riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
writeback: fix false warning in inode_to_wb()
Revert "PCI: Avoid reset when disabled via sysfs"
ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
asus-laptop: Fix an uninitialized variable
nfs: move nfs_fhandle_hash to common include file
nfs: add missing selections of CONFIG_CRC32
nfsd: decrease sc_count directly if fail to queue dl_recall
btrfs: correctly escape subvol in btrfs_show_options()
crypto: caam/qi - Fix drv_ctx refcount bug
Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to
hfs_bnode_read_key"
hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
i2c: cros-ec-tunnel: defer probe if parent EC is not present
isofs: Prevent the use of too small fid
loop: properly send KOBJ_CHANGED uevent for disk device
loop: LOOP_SET_FD: send uevents for partitions
mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
riscv: Avoid fortify warning in syscall_get_arguments()
tracing: Fix filter string testing
virtiofs: add filesystem context source name check
perf/x86/intel: Allow to update user space GPRs from PEBS records
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
drm/repaper: fix integer overflows in repeat functions
drm/amd/pm: Prevent division by zero
drm/amd/pm/powerplay: Prevent division by zero
drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
drm/amdgpu/dma_buf: fix page_link check
drm/nouveau: prime: fix ttm_bo_delayed_delete oops
drm/sti: remove duplicate object names
KVM: arm64: Get rid of host SVE tracking/saving
KVM: arm64: Always start with clearing SVE flag on load
KVM: arm64: Discard any SVE state when entering KVM guests
arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE
arm64/fpsimd: Have KVM explicitly say which FP registers to save
arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM
KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
KVM: arm64: Remove host FPSIMD saving for non-protected KVM
KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
KVM: arm64: Calculate cptr_el2 traps on activating traps
KVM: arm64: Eagerly switch ZCR_EL{1,2}
cpufreq: Reference count policy in cpufreq_update_limits()
kbuild: Add '-fno-builtin-wcslen'
mptcp: sockopt: fix getting IPV6_V6ONLY
misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq
error
misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
ipv6: release nexthop on device removal
net: fix crash when config small gso_max_size/gso_ipv4_max_size
filemap: Fix bounds checking in filemap_read()
phonet/pep: fix racy skb_queue_empty() use
bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
x86/pvh: Call C code via the kernel virtual mapping
powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
landlock: Add the errata interface
nvmet-fc: Remove unused functions
smb: client: fix potential UAF in cifs_dump_full_key()
Revert "smb: client: fix use-after-free bug in cifs_debug_data_proc_show()"
smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
cifs: Fix UAF in cifs_demultiplex_thread()
smb: client: fix UAF in async decryption
smb: client: fix NULL ptr deref in crypto_aead_setkey()
smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
smb: client: fix potential deadlock when releasing mids
smb: client: fix potential UAF in cifs_stats_proc_show()
sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
bpf: avoid holding freeze_mutex during mmap operation
blk-cgroup: support to track if policy is online
blk-iocost: do not WARN if iocg was already offlined
ext4: fix timer use-after-free on failed mount
ipvs: properly dereference pe in ip_vs_add_service
net: openvswitch: fix race on port output
openvswitch: fix lockup on tx to unregistering netdev with carrier
scsi: ufs: bsg: Set bsg_queue to NULL after removal
MIPS: dec: Declare which_prom() as static
MIPS: cevt-ds1287: Add missing ds1287.h include
MIPS: ds1287: Match ds1287_set_base_clock() function types
dm cache: fix flushing uninitialized delayed_work on cache_ctr error
drm/i915/gt: Cleanup partial engine discovery failures
fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
mm: fix apply_to_existing_page_range()
pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
Bluetooth: SCO: Fix UAF on sco_sock_timeout
module: sign with sha512 instead of sha1 by default
media: streamzap: remove unnecessary ir_raw_event_reset and handle
media: streamzap: no need for usb pid/vid in device name
media: streamzap: less chatter
media: streamzap: remove unused struct members
media: streamzap: fix race between device disconnection and urb callback
auxdisplay: hd44780: Convert to platform remove callback returning void
auxdisplay: hd44780: Fix an API misuse in hd44780.c
net: dsa: mv88e6xxx: fix VTU methods for 6320 family
soc: samsung: exynos-chipid: avoid soc_device_to_device()
soc: samsung: exynos-chipid: Pass revision reg offsets
soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return
value check
iio: adc: ad7768-1: Fix conversion result sign
backlight: led_bl: Convert to platform remove callback returning void
backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
cifs: print TIDs as hex
cifs: avoid NULL pointer dereference in dbg call
cifs: fix integer overflow in match_server()
gpio: tegra186: Force one interrupt per bank
gpio: tegra186: fix resource handling in ACPI probe path
Revert "PCI: Coalesce host bridge contiguous apertures"
PCI: Coalesce host bridge contiguous apertures
PCI: Assign PCI domain IDs by ida_alloc()
PCI: Fix reference leak in pci_register_host_bridge()
ksmbd: Prevent integer overflow in calculation of deadtime
selftests/mm: generate a temporary mountpoint for cgroup filesystem
kmsan: disable strscpy() optimization under KMSAN
string: Add load_unaligned_zeropad() code path to sized_strscpy()
drm/msm/a6xx: Improve gpu recovery sequence
drm/msm/a6xx: Handle GMU prepare-slumber hfi failure
drm/msm/a6xx: Avoid gx gbit halt during rpm suspend
drm/msm/a6xx: Fix stale rpmh votes from GPU
dma/contiguous: avoid warning about unused size_bytes
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
cpufreq: cppc: Fix invalid return value in .get() callback
net: phy: leds: fix memory leak
tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
net_sched: hfsc: Fix a UAF vulnerability in class handling
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
virtio_console: fix missing byte order handling for cols and rows
net: selftests: initialize TCP header and skb payload with zero
drm/amd/display: Fix gpu reset in multidisplay config
KVM: SVM: Allocate IR data using atomic allocation
mcb: fix a double free bug in chameleon_parse_gdd()
USB: storage: quirk for ADATA Portable HDD CH94
mei: me: add panther lake H DID
KVM: x86: Reset IRTE to host control if *new* route isn't postable
serial: sifive: lock port in startup()/shutdown() callbacks
USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
USB: serial: option: add Sierra Wireless EM9291
USB: serial: simple: add OWON HDS200 series oscilloscope support
usb: cdns3: Fix deadlock when using NCM gadget
usb: chipidea: ci_hdrc_imx: fix usbmisc handling
usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
usb: dwc3: gadget: check that event count does not exceed event buffer length
usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
USB: VLI disk crashes if LPM is used
USB: wdm: handle IO errors in wdm_wwan_port_start
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
USB: wdm: add annotation
MIPS: cm: Detect CM quirks from device tree
crypto: null - Use spin lock instead of mutex
clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
parisc: PDT: Fix missing prototype warning
s390/sclp: Add check for get_zeroed_page()
s390/tty: Fix a potential memory leak bug
usb: host: max3421-hcd: Add missing spi_device_id table
fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
dmaengine: dmatest: Fix dmatest waiting less when interrupted
usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
wcd934x_slim_irq_handler()
qibfs: fix _another_ leak
ntb: reduce stack usage in idt_scan_mws
sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
KVM: s390: Don't use %pK through tracepoints
udmabuf: fix a buf size overflow issue during udmabuf creation
selftests: ublk: fix test_stripe_04
xen: Change xen-acpi-processor dom0 dependency
nvme: requeue namespace scan on missed AENs
ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
nvme: re-read ANA log page after ns scan completes
objtool: Stop UNRET validation on UD2
selftests/mincore: Allow read-ahead pages to reach the end of the file
x86/bugs: Use SBPB in write_ibpb() if applicable
x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
x86/bugs: Don't fill RSB on context switch with eIBRS
nvmet-fc: take tgtport reference only once
nvmet-fc: put ref when assoc->del_work is already scheduled
ext4: make block validity check resistent to sb bh corruption
scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
scsi: pm80xx: Set phy_attached to zero when device is gone
loop: aio inherit the ioprio of original request
ubsan: Fix panic from test_ubsan_out_of_bounds
md/raid1: Add check for missing source disk in process_checks()
jfs: define xtree root and page independently
comedi: jr3_pci: Fix synchronous deletion of timer
crypto: atmel-sha204a - Set hwrng quality to lowest possible
net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
net: dsa: mv88e6xxx: enable PVT for 6321 switch
net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
drm/amd/display: fix double free issue during amdgpu module unload
xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
MIPS: cm: Fix warning if MIPS_CM is disabled
nvme: fixup scan failure for non-ANA multipath controllers
PCI: Fix use-after-free in pci_bus_release_domain_nr()
PCI: Fix dropping valid root bus resources with .end = zero
PCI: Release resource invalidated by coalescing
Linux 5.15.181
UBUNTU: Upstream stable to v5.15.181
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.181 upstream stable release
from git://git.kernel.org/
-
+ ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
+ tipc: fix memory leak in tipc_link_xmit
+ net: tls: explicitly disallow disconnect
+ net: ethtool: Don't call .cleanup_data when prepare_data fails
+ ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
+ ata: sata_sx4: Add error handling in pdc20621_i2c_read()
+ nvmet-fcloop: swap list_add_tail arguments
+ net: ppp: Add bound checking for skb data on ppp_sync_txmung
+ nft_set_pipapo: fix incorrect avx2 match of 5th field octet
+ umount: Allow superblock owners to force umount
+ pm: cpupower: bench: Prevent NULL dereference on malloc failure
+ x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when
running in a virtual machine
+ perf: arm_pmu: Don't disable counter in armpmu_add()
+ arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
+ xen/mcelog: Add __nonstring annotations for unterminated strings
+ HID: pidff: Convert infinite length from Linux API to PID standard
+ HID: pidff: Do not send effect envelope if it's empty
+ HID: pidff: Fix null pointer dereference in pidff_find_fields
+ ALSA: hda: intel: Fix Optimus when GPU has no sound
+ ASoC: fsl_audmix: register card device depends on 'dais' property
+ ALSA: usb-audio: Fix CME quirk for UF series keyboards
+ page_pool: avoid infinite loop to schedule delayed worker
+ jfs: Fix uninit-value access of imap allocated in the diMount() function
+ fs/jfs: cast inactags to s64 to prevent potential overflow
+ fs/jfs: Prevent integer overflow in AG size calculation
+ jfs: Prevent copying of nlink with value 0 from disk inode
+ jfs: add sanity check for agwidth in dbMount
+ ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
+ f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
+ ahci: add PCI ID for Marvell 88SE9215 SATA Controller
+ ext4: protect ext4_release_dquot against freezing
+ ext4: ignore xattrs past end
+ scsi: st: Fix array overflow in st_setup()
+ wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
+ net: vlan: don't propagate flags on open
+ tracing: fix return value in __ftrace_event_enable_disable for
TRACE_REG_UNREGISTER
+ Bluetooth: hci_uart: fix race during initialization
+ drm: allow encoder mode_set even when connectors change for crtc
+ drm/amd/display: Update Cursor request mode to the beginning prefetch always
+ drm: panel-orientation-quirks: Add support for AYANEO 2S
+ drm: panel-orientation-quirks: Add new quirk for GPD Win 2
+ drm/bridge: panel: forbid initializing a panel with unknown connector type
+ drivers: base: devres: Allow to release group on device release
+ drm/amdkfd: clamp queue size to minimum
+ drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
+ drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
+ PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
+ fbdev: omapfb: Add 'plane' value check
+ ktest: Fix Test Failures Due to Missing LOG_FILE Directories
+ pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
+ pwm: rcar: Simplify multiplication/shift logic
+ pwm: rcar: Improve register calculation
+ pwm: fsl-ftm: Handle clk_get_rate() returning 0
+ bpf: Add endian modifiers to fix endian warnings
+ bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
+ ext4: don't treat fhandle lookup of ea_inode as FS corruption
+ media: i2c: adv748x: Fix test pattern selection mask
+ media: venus: hfi: add a check to handle OOB in sfr region
+ media: venus: hfi: add check to handle incorrect queue size
+ media: vim2m: print device name after registering device
+ media: siano: Fix error handling in smsdvb_module_init()
+ xenfs/xensyms: respect hypervisor's "next" indication
+ arm64: cputype: Add MIDR_CORTEX_A76AE
+ arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
+ arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
+ arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
+ spi: cadence-qspi: Fix probe on AM62A LP SK
+ mtd: rawnand: brcmnand: fix PM resume warning
+ media: streamzap: prevent processing IR data on URB failure
+ media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
+ media: i2c: ccs: Set the device's runtime PM status correctly in remove
+ media: i2c: ccs: Set the device's runtime PM status correctly in probe
+ media: i2c: ov7251: Set enable GPIO low in probe
+ media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
+ media: venus: hfi_parser: add check to avoid out of bound access
+ media: venus: hfi_parser: refactor hfi packet parsing logic
+ mtd: Add check for devm_kcalloc()
+ net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
+ mtd: Replace kcalloc() with devm_kcalloc()
+ clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
+ wifi: mt76: Add check for devm_kstrdup()
+ wifi: mac80211: fix integer overflow in hwmp_route_info_get()
+ ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
+ bus: mhi: host: Fix race between unprepare and queue_buf
+ ext4: fix off-by-one error in do_split
+ vdpa/mlx5: Fix oversized null mkey longer than 32bit
+ i3c: master: svc: Use readsb helper for reading MDB
+ i3c: Add NULL pointer check in i3c_master_queue_ibi()
+ jbd2: remove wrong sb->s_sequence check
+ mfd: ene-kb3930: Fix a potential NULL pointer dereference
+ locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
+ lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
+ mptcp: fix NULL pointer in can_accept_new_subflow
+ mptcp: only inc MPJoinAckHMacFailure for HMAC failures
+ mtd: inftlcore: Add error check for inftl_read_oob()
+ mtd: rawnand: Add status chack in r852_ready()
+ arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
+ sparc/mm: disable preemption in lazy mmu mode
+ mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
+ mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
+ sctp: detect and prevent references to a freed transport in sendmsg
+ thermal/drivers/rockchip: Add missing rk3328 mapping entry
+ crypto: ccp - Fix check for the primary ASP device
+ dm-integrity: set ti->error on memory allocation failure
+ ftrace: Add cond_resched() to ftrace_graph_set_hash()
+ gpio: zynq: Fix wakeup source leaks on device unbind
+ ntb: use 64-bit arithmetic for the MSI doorbell mask
+ of/irq: Fix device node refcount leakages in of_irq_count()
+ of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
+ of/irq: Fix device node refcount leakages in of_irq_init()
+ PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
+ PCI: Fix reference leak in pci_alloc_child_bus()
+ pinctrl: qcom: Clear latched interrupt status when changing IRQ type
+ HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver
Due to Race Condition
+ arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
+ ACPI: platform-profile: Fix CFI violation when accessing sysfs files
+ x86/e820: Fix handling of subpage regions when calculating nosave ranges in
e820__register_nosave_regions()
+ Bluetooth: hci_uart: Fix another race during initialization
+ scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly
+ scsi: hisi_sas: Pass abort structure for internal abort
+ scsi: hisi_sas: Factor out task prep and delivery code
+ scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal
+ scsi: libsas: Delete lldd_clear_aca callback
+ scsi: libsas: Add struct sas_tmf_task
+ scsi: hisi_sas: Enable force phy when SATA disk directly connected
+ wifi: at76c50x: fix use after free access in at76_disconnect
+ wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
+ wifi: mac80211: Purge vif txq in ieee80211_do_stop()
+ wifi: wl1251: fix memory leak in wl1251_tx_work
+ scsi: iscsi: Fix missing scsi_host_put() in error path
+ md/raid10: fix missing discard IO accounting
+ RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
+ RDMA/hns: Fix wrong maximum DMA segment size
+ RDMA/core: Silence oversized kvmalloc() warning
+ Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
+ Bluetooth: btrtl: Prevent potential NULL dereference
+ Bluetooth: l2cap: Check encryption key size on incoming connection
+ Revert "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
+ igc: fix PTM cycle trigger logic
+ igc: move ktime snapshot into PTM retry loop
+ igc: handle the IGC_PTP_ENABLED flag correctly
+ igc: cleanup PTP module if probe fails
+ net: mctp: Set SOCK_RCU_FREE
+ net: openvswitch: fix nested key length validation in the set() action
+ cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
+ net: b53: enable BPDU reception for management port
+ net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never
registered
+ net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
+ riscv: Properly export reserved regions in /proc/iomem
+ riscv: KGDB: Do not inline arch_kgdb_breakpoint()
+ riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
+ cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
+ writeback: fix false warning in inode_to_wb()
+ Revert "PCI: Avoid reset when disabled via sysfs"
+ ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
+ ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
+ asus-laptop: Fix an uninitialized variable
+ nfs: move nfs_fhandle_hash to common include file
+ nfs: add missing selections of CONFIG_CRC32
+ nfsd: decrease sc_count directly if fail to queue dl_recall
+ btrfs: correctly escape subvol in btrfs_show_options()
+ crypto: caam/qi - Fix drv_ctx refcount bug
+ Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to
hfs_bnode_read_key"
+ hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
+ i2c: cros-ec-tunnel: defer probe if parent EC is not present
+ isofs: Prevent the use of too small fid
+ loop: properly send KOBJ_CHANGED uevent for disk device
+ loop: LOOP_SET_FD: send uevents for partitions
+ mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
+ riscv: Avoid fortify warning in syscall_get_arguments()
+ tracing: Fix filter string testing
+ virtiofs: add filesystem context source name check
+ perf/x86/intel: Allow to update user space GPRs from PEBS records
+ perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
+ perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
+ perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
+ drm/repaper: fix integer overflows in repeat functions
+ drm/amd/pm: Prevent division by zero
+ drm/amd/pm/powerplay: Prevent division by zero
+ drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
+ drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
+ drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
+ drm/amdgpu/dma_buf: fix page_link check
+ drm/nouveau: prime: fix ttm_bo_delayed_delete oops
+ drm/sti: remove duplicate object names
+ KVM: arm64: Get rid of host SVE tracking/saving
+ KVM: arm64: Always start with clearing SVE flag on load
+ KVM: arm64: Discard any SVE state when entering KVM guests
+ arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE
+ arm64/fpsimd: Have KVM explicitly say which FP registers to save
+ arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM
+ KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
+ KVM: arm64: Remove host FPSIMD saving for non-protected KVM
+ KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
+ KVM: arm64: Calculate cptr_el2 traps on activating traps
+ KVM: arm64: Eagerly switch ZCR_EL{1,2}
+ cpufreq: Reference count policy in cpufreq_update_limits()
+ kbuild: Add '-fno-builtin-wcslen'
+ mptcp: sockopt: fix getting IPV6_V6ONLY
+ misc: pci_endpoint_test: Avoid issue of interrupts remaining after
request_irq error
+ misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
+ misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
+ ipv6: release nexthop on device removal
+ net: fix crash when config small gso_max_size/gso_ipv4_max_size
+ filemap: Fix bounds checking in filemap_read()
+ phonet/pep: fix racy skb_queue_empty() use
+ bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
+ x86/pvh: Call C code via the kernel virtual mapping
+ powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
+ drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
max_links
+ landlock: Add the errata interface
+ nvmet-fc: Remove unused functions
+ smb: client: fix potential UAF in cifs_dump_full_key()
+ Revert "smb: client: fix use-after-free bug in cifs_debug_data_proc_show()"
+ smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
+ cifs: Fix UAF in cifs_demultiplex_thread()
+ smb: client: fix UAF in async decryption
+ smb: client: fix NULL ptr deref in crypto_aead_setkey()
+ smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
+ smb: client: fix potential deadlock when releasing mids
+ smb: client: fix potential UAF in cifs_stats_proc_show()
+ sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
+ bpf: avoid holding freeze_mutex during mmap operation
+ blk-cgroup: support to track if policy is online
+ blk-iocost: do not WARN if iocg was already offlined
+ ext4: fix timer use-after-free on failed mount
+ ipvs: properly dereference pe in ip_vs_add_service
+ net: openvswitch: fix race on port output
+ openvswitch: fix lockup on tx to unregistering netdev with carrier
+ scsi: ufs: bsg: Set bsg_queue to NULL after removal
+ MIPS: dec: Declare which_prom() as static
+ MIPS: cevt-ds1287: Add missing ds1287.h include
+ MIPS: ds1287: Match ds1287_set_base_clock() function types
+ dm cache: fix flushing uninitialized delayed_work on cache_ctr error
+ drm/i915/gt: Cleanup partial engine discovery failures
+ fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children
stats
+ mm: fix apply_to_existing_page_range()
+ pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
+ scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and
PLOGI
+ Bluetooth: SCO: Fix UAF on sco_sock_timeout
+ module: sign with sha512 instead of sha1 by default
+ media: streamzap: remove unnecessary ir_raw_event_reset and handle
+ media: streamzap: no need for usb pid/vid in device name
+ media: streamzap: less chatter
+ media: streamzap: remove unused struct members
+ media: streamzap: fix race between device disconnection and urb callback
+ auxdisplay: hd44780: Convert to platform remove callback returning void
+ auxdisplay: hd44780: Fix an API misuse in hd44780.c
+ net: dsa: mv88e6xxx: fix VTU methods for 6320 family
+ soc: samsung: exynos-chipid: avoid soc_device_to_device()
+ soc: samsung: exynos-chipid: Pass revision reg offsets
+ soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
+ iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
return value check
+ iio: adc: ad7768-1: Fix conversion result sign
+ backlight: led_bl: Convert to platform remove callback returning void
+ backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
+ cifs: print TIDs as hex
+ cifs: avoid NULL pointer dereference in dbg call
+ cifs: fix integer overflow in match_server()
+ gpio: tegra186: Force one interrupt per bank
+ gpio: tegra186: fix resource handling in ACPI probe path
+ Revert "PCI: Coalesce host bridge contiguous apertures"
+ PCI: Coalesce host bridge contiguous apertures
+ PCI: Assign PCI domain IDs by ida_alloc()
+ PCI: Fix reference leak in pci_register_host_bridge()
+ ksmbd: Prevent integer overflow in calculation of deadtime
+ selftests/mm: generate a temporary mountpoint for cgroup filesystem
+ kmsan: disable strscpy() optimization under KMSAN
+ string: Add load_unaligned_zeropad() code path to sized_strscpy()
+ drm/msm/a6xx: Improve gpu recovery sequence
+ drm/msm/a6xx: Handle GMU prepare-slumber hfi failure
+ drm/msm/a6xx: Avoid gx gbit halt during rpm suspend
+ drm/msm/a6xx: Fix stale rpmh votes from GPU
+ dma/contiguous: avoid warning about unused size_bytes
+ cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
+ cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
+ cpufreq: cppc: Fix invalid return value in .get() callback
+ net: phy: leds: fix memory leak
+ tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
+ net_sched: hfsc: Fix a UAF vulnerability in class handling
+ net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
+ iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
+ virtio_console: fix missing byte order handling for cols and rows
+ net: selftests: initialize TCP header and skb payload with zero
+ drm/amd/display: Fix gpu reset in multidisplay config
+ KVM: SVM: Allocate IR data using atomic allocation
+ mcb: fix a double free bug in chameleon_parse_gdd()
+ USB: storage: quirk for ADATA Portable HDD CH94
+ mei: me: add panther lake H DID
+ KVM: x86: Reset IRTE to host control if *new* route isn't postable
+ serial: sifive: lock port in startup()/shutdown() callbacks
+ USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
+ USB: serial: option: add Sierra Wireless EM9291
+ USB: serial: simple: add OWON HDS200 series oscilloscope support
+ usb: cdns3: Fix deadlock when using NCM gadget
+ usb: chipidea: ci_hdrc_imx: fix usbmisc handling
+ usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
+ usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
+ USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
+ usb: dwc3: gadget: check that event count does not exceed event buffer length
+ usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
+ usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
+ USB: VLI disk crashes if LPM is used
+ USB: wdm: handle IO errors in wdm_wwan_port_start
+ USB: wdm: close race between wdm_open and wdm_wwan_port_stop
+ USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
+ USB: wdm: add annotation
+ MIPS: cm: Detect CM quirks from device tree
+ crypto: null - Use spin lock instead of mutex
+ clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
+ parisc: PDT: Fix missing prototype warning
+ s390/sclp: Add check for get_zeroed_page()
+ s390/tty: Fix a potential memory leak bug
+ usb: host: max3421-hcd: Add missing spi_device_id table
+ fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
+ usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
+ sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
+ dmaengine: dmatest: Fix dmatest waiting less when interrupted
+ usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
+ usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
+ objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
wcd934x_slim_irq_handler()
+ qibfs: fix _another_ leak
+ ntb: reduce stack usage in idt_scan_mws
+ sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
+ KVM: s390: Don't use %pK through tracepoints
+ udmabuf: fix a buf size overflow issue during udmabuf creation
+ selftests: ublk: fix test_stripe_04
+ xen: Change xen-acpi-processor dom0 dependency
+ nvme: requeue namespace scan on missed AENs
+ ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
+ nvme: re-read ANA log page after ns scan completes
+ objtool: Stop UNRET validation on UD2
+ selftests/mincore: Allow read-ahead pages to reach the end of the file
+ x86/bugs: Use SBPB in write_ibpb() if applicable
+ x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
+ x86/bugs: Don't fill RSB on context switch with eIBRS
+ nvmet-fc: take tgtport reference only once
+ nvmet-fc: put ref when assoc->del_work is already scheduled
+ ext4: make block validity check resistent to sb bh corruption
+ scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
+ scsi: pm80xx: Set phy_attached to zero when device is gone
+ loop: aio inherit the ioprio of original request
+ ubsan: Fix panic from test_ubsan_out_of_bounds
+ md/raid1: Add check for missing source disk in process_checks()
+ jfs: define xtree root and page independently
+ comedi: jr3_pci: Fix synchronous deletion of timer
+ crypto: atmel-sha204a - Set hwrng quality to lowest possible
+ net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
+ net: dsa: mv88e6xxx: enable PVT for 6321 switch
+ net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
+ drm/amd/display: fix double free issue during amdgpu module unload
+ xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
+ MIPS: cm: Fix warning if MIPS_CM is disabled
+ nvme: fixup scan failure for non-ANA multipath controllers
+ PCI: Fix use-after-free in pci_bus_release_domain_nr()
+ PCI: Fix dropping valid root bus resources with .end = zero
+ PCI: Release resource invalidated by coalescing
Linux 5.15.181
- PCI: Release resource invalidated by coalescing
- PCI: Fix dropping valid root bus resources with .end = zero
- PCI: Fix use-after-free in pci_bus_release_domain_nr()
- nvme: fixup scan failure for non-ANA multipath controllers
- MIPS: cm: Fix warning if MIPS_CM is disabled
- xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
- drm/amd/display: fix double free issue during amdgpu module unload
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
- net: dsa: mv88e6xxx: enable PVT for 6321 switch
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
- crypto: atmel-sha204a - Set hwrng quality to lowest possible
- comedi: jr3_pci: Fix synchronous deletion of timer
- jfs: define xtree root and page independently
- md/raid1: Add check for missing source disk in process_checks()
- ubsan: Fix panic from test_ubsan_out_of_bounds
- loop: aio inherit the ioprio of original request
- scsi: pm80xx: Set phy_attached to zero when device is gone
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
- ext4: make block validity check resistent to sb bh corruption
- nvmet-fc: put ref when assoc->del_work is already scheduled
- nvmet-fc: take tgtport reference only once
- x86/bugs: Don't fill RSB on context switch with eIBRS
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
- x86/bugs: Use SBPB in write_ibpb() if applicable
- selftests/mincore: Allow read-ahead pages to reach the end of the file
- objtool: Stop UNRET validation on UD2
- nvme: re-read ANA log page after ns scan completes
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
- nvme: requeue namespace scan on missed AENs
- xen: Change xen-acpi-processor dom0 dependency
- selftests: ublk: fix test_stripe_04
- udmabuf: fix a buf size overflow issue during udmabuf creation
- KVM: s390: Don't use %pK through tracepoints
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
- ntb: reduce stack usage in idt_scan_mws
- qibfs: fix _another_ leak
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
wcd934x_slim_irq_handler()
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
- dmaengine: dmatest: Fix dmatest waiting less when interrupted
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
- usb: host: max3421-hcd: Add missing spi_device_id table
- s390/tty: Fix a potential memory leak bug
- s390/sclp: Add check for get_zeroed_page()
- parisc: PDT: Fix missing prototype warning
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
- crypto: null - Use spin lock instead of mutex
- MIPS: cm: Detect CM quirks from device tree
- USB: wdm: add annotation
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop
- USB: wdm: handle IO errors in wdm_wwan_port_start
- USB: VLI disk crashes if LPM is used
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
- usb: dwc3: gadget: check that event count does not exceed event buffer length
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling
- usb: cdns3: Fix deadlock when using NCM gadget
- USB: serial: simple: add OWON HDS200 series oscilloscope support
- USB: serial: option: add Sierra Wireless EM9291
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
- serial: sifive: lock port in startup()/shutdown() callbacks
- KVM: x86: Reset IRTE to host control if *new* route isn't postable
- mei: me: add panther lake H DID
- USB: storage: quirk for ADATA Portable HDD CH94
- mcb: fix a double free bug in chameleon_parse_gdd()
- KVM: SVM: Allocate IR data using atomic allocation
- drm/amd/display: Fix gpu reset in multidisplay config
- net: selftests: initialize TCP header and skb payload with zero
- virtio_console: fix missing byte order handling for cols and rows
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
- net_sched: hfsc: Fix a UAF vulnerability in class handling
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
- net: phy: leds: fix memory leak
- cpufreq: cppc: Fix invalid return value in .get() callback
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
- dma/contiguous: avoid warning about unused size_bytes
- drm/msm/a6xx: Fix stale rpmh votes from GPU
- drm/msm/a6xx: Avoid gx gbit halt during rpm suspend
- drm/msm/a6xx: Handle GMU prepare-slumber hfi failure
- drm/msm/a6xx: Improve gpu recovery sequence
- string: Add load_unaligned_zeropad() code path to sized_strscpy()
- kmsan: disable strscpy() optimization under KMSAN
- selftests/mm: generate a temporary mountpoint for cgroup filesystem
- ksmbd: Prevent integer overflow in calculation of deadtime
- PCI: Fix reference leak in pci_register_host_bridge()
- PCI: Assign PCI domain IDs by ida_alloc()
- PCI: Coalesce host bridge contiguous apertures
- gpio: tegra186: fix resource handling in ACPI probe path
- gpio: tegra186: Force one interrupt per bank
- cifs: fix integer overflow in match_server()
- cifs: avoid NULL pointer dereference in dbg call
- cifs: print TIDs as hex
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
- backlight: led_bl: Convert to platform remove callback returning void
- iio: adc: ad7768-1: Fix conversion result sign
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
return value check
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
- soc: samsung: exynos-chipid: Pass revision reg offsets
- soc: samsung: exynos-chipid: avoid soc_device_to_device()
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family
- auxdisplay: hd44780: Fix an API misuse in hd44780.c
- auxdisplay: hd44780: Convert to platform remove callback returning void
- media: streamzap: fix race between device disconnection and urb callback
- media: streamzap: remove unused struct members
- media: streamzap: less chatter
- media: streamzap: no need for usb pid/vid in device name
- media: streamzap: remove unnecessary ir_raw_event_reset and handle
- module: sign with sha512 instead of sha1 by default
- Bluetooth: SCO: Fix UAF on sco_sock_timeout
- f2fs: Add inline to f2fs_build_fault_attr() stub
- scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and
PLOGI
- pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
- f2fs: check validation of fault attrs in f2fs_build_fault_attr()
- mm: fix apply_to_existing_page_range()
- fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children
stats
- drm/i915/gt: Cleanup partial engine discovery failures
- dm cache: fix flushing uninitialized delayed_work on cache_ctr error
- jfs: Fix shift-out-of-bounds in dbDiscardAG
- MIPS: ds1287: Match ds1287_set_base_clock() function types
- MIPS: cevt-ds1287: Add missing ds1287.h include
- MIPS: dec: Declare which_prom() as static
- net: defer final 'struct net' free in netns dismantle
- scsi: ufs: bsg: Set bsg_queue to NULL after removal
- scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
- openvswitch: fix lockup on tx to unregistering netdev with carrier
- net: openvswitch: fix race on port output
- ipvs: properly dereference pe in ip_vs_add_service
- ext4: fix timer use-after-free on failed mount
- blk-iocost: do not WARN if iocg was already offlined
- blk-cgroup: support to track if policy is online
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
- bpf: avoid holding freeze_mutex during mmap operation
- sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
- smb: client: fix potential UAF in cifs_stats_proc_show()
- smb: client: fix potential deadlock when releasing mids
- smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
- smb: client: fix NULL ptr deref in crypto_aead_setkey()
- smb: client: fix UAF in async decryption
- cifs: Fix UAF in cifs_demultiplex_thread()
- smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
- net: make sock_inuse_add() available
- ksmbd: fix potencial out-of-bounds when buffer offset is invalid
- smb: client: fix potential UAF in cifs_dump_full_key()
- nvmet-fc: Remove unused functions
- landlock: Add the errata interface
- drm/amdgpu: fix usage slab after free
- drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing
- drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
- drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
max_links
- wifi: ath10k: avoid NULL pointer error during sdio remove
- phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
- powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
- x86/pvh: Call C code via the kernel virtual mapping
- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
- phonet/pep: fix racy skb_queue_empty() use
- filemap: Fix bounds checking in filemap_read()
- net: fix crash when config small gso_max_size/gso_ipv4_max_size
- ipv6: release nexthop on device removal
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after
request_irq error
- mptcp: sockopt: fix getting IPV6_V6ONLY
- kbuild: Add '-fno-builtin-wcslen'
- cpufreq: Reference count policy in cpufreq_update_limits()
- KVM: arm64: Eagerly switch ZCR_EL{1,2}
- KVM: arm64: Calculate cptr_el2 traps on activating traps
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
- arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM
- arm64/fpsimd: Have KVM explicitly say which FP registers to save
- arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE
- KVM: arm64: Discard any SVE state when entering KVM guests
- KVM: arm64: Always start with clearing SVE flag on load
- KVM: arm64: Get rid of host SVE tracking/saving
- drm/sti: remove duplicate object names
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops
- drm/amdgpu/dma_buf: fix page_link check
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
- drm/amd/pm/powerplay: Prevent division by zero
- drm/amd/pm: Prevent division by zero
- drm/repaper: fix integer overflows in repeat functions
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
- perf/x86/intel: Allow to update user space GPRs from PEBS records
- virtiofs: add filesystem context source name check
- tracing: Fix filter string testing
- riscv: Avoid fortify warning in syscall_get_arguments()
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
- loop: LOOP_SET_FD: send uevents for partitions
- loop: properly send KOBJ_CHANGED uevent for disk device
- isofs: Prevent the use of too small fid
- i2c: cros-ec-tunnel: defer probe if parent EC is not present
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
- crypto: caam/qi - Fix drv_ctx refcount bug
- btrfs: correctly escape subvol in btrfs_show_options()
- nfsd: decrease sc_count directly if fail to queue dl_recall
- nfs: add missing selections of CONFIG_CRC32
- nfs: move nfs_fhandle_hash to common include file
- asus-laptop: Fix an uninitialized variable
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
- Revert "PCI: Avoid reset when disabled via sysfs"
- writeback: fix false warning in inode_to_wb()
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
- riscv: KGDB: Do not inline arch_kgdb_breakpoint()
- riscv: Properly export reserved regions in /proc/iomem
- net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never
registered
- net: b53: enable BPDU reception for management port
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
- net: openvswitch: fix nested key length validation in the set() action
- net: mctp: Set SOCK_RCU_FREE
- igc: cleanup PTP module if probe fails
- igc: handle the IGC_PTP_ENABLED flag correctly
- igc: move ktime snapshot into PTM retry loop
- igc: fix PTM cycle trigger logic
- Revert "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
- Bluetooth: l2cap: Check encryption key size on incoming connection
- Bluetooth: btrtl: Prevent potential NULL dereference
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
- RDMA/core: Silence oversized kvmalloc() warning
- RDMA/hns: Fix wrong maximum DMA segment size
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
- md/raid10: fix missing discard IO accounting
- scsi: iscsi: Fix missing scsi_host_put() in error path
- wifi: wl1251: fix memory leak in wl1251_tx_work
- wifi: mac80211: Purge vif txq in ieee80211_do_stop()
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
- wifi: at76c50x: fix use after free access in at76_disconnect
- scsi: hisi_sas: Enable force phy when SATA disk directly connected
- scsi: libsas: Add struct sas_tmf_task
- scsi: libsas: Delete lldd_clear_aca callback
- scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal
- scsi: hisi_sas: Factor out task prep and delivery code
- scsi: hisi_sas: Pass abort structure for internal abort
- scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly
- Bluetooth: hci_uart: Fix another race during initialization
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in
e820__register_nosave_regions()
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver
Due to Race Condition
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type
- PCI: Fix reference leak in pci_alloc_child_bus()
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
- of/irq: Fix device node refcount leakages in of_irq_init()
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
- of/irq: Fix device node refcount leakages in of_irq_count()
- ntb: use 64-bit arithmetic for the MSI doorbell mask
- gpio: zynq: Fix wakeup source leaks on device unbind
- ftrace: Add cond_resched() to ftrace_graph_set_hash()
- dm-integrity: set ti->error on memory allocation failure
- crypto: ccp - Fix check for the primary ASP device
- thermal/drivers/rockchip: Add missing rk3328 mapping entry
- sctp: detect and prevent references to a freed transport in sendmsg
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
- sparc/mm: disable preemption in lazy mmu mode
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
- mtd: rawnand: Add status chack in r852_ready()
- mtd: inftlcore: Add error check for inftl_read_oob()
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures
- mptcp: fix NULL pointer in can_accept_new_subflow
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
- mfd: ene-kb3930: Fix a potential NULL pointer dereference
- jbd2: remove wrong sb->s_sequence check
- i3c: Add NULL pointer check in i3c_master_queue_ibi()
- i3c: master: svc: Use readsb helper for reading MDB
- vdpa/mlx5: Fix oversized null mkey longer than 32bit
- ext4: fix off-by-one error in do_split
- bus: mhi: host: Fix race between unprepare and queue_buf
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
- wifi: mac80211: fix integer overflow in hwmp_route_info_get()
- wifi: mt76: Add check for devm_kstrdup()
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
- mtd: Replace kcalloc() with devm_kcalloc()
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
- mtd: Add check for devm_kcalloc()
- media: venus: hfi_parser: refactor hfi packet parsing logic
- media: venus: hfi_parser: add check to avoid out of bound access
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
- media: i2c: ov7251: Set enable GPIO low in probe
- media: i2c: ccs: Set the device's runtime PM status correctly in probe
- media: i2c: ccs: Set the device's runtime PM status correctly in remove
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
- media: streamzap: prevent processing IR data on URB failure
- mtd: rawnand: brcmnand: fix PM resume warning
- spi: cadence-qspi: Fix probe on AM62A LP SK
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
- arm64: cputype: Add MIDR_CORTEX_A76AE
- xenfs/xensyms: respect hypervisor's "next" indication
- media: siano: Fix error handling in smsdvb_module_init()
- media: vim2m: print device name after registering device
- media: venus: hfi: add check to handle incorrect queue size
- media: venus: hfi: add a check to handle OOB in sfr region
- media: i2c: adv748x: Fix test pattern selection mask
- ext4: don't treat fhandle lookup of ea_inode as FS corruption
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
- bpf: Add endian modifiers to fix endian warnings
- pwm: fsl-ftm: Handle clk_get_rate() returning 0
- pwm: rcar: Improve register calculation
- pwm: rcar: Simplify multiplication/shift logic
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories
- fbdev: omapfb: Add 'plane' value check
- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
- drm/amdkfd: clamp queue size to minimum
- drivers: base: devres: Allow to release group on device release
- drm/bridge: panel: forbid initializing a panel with unknown connector type
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2
- drm: panel-orientation-quirks: Add support for AYANEO 2S
- drm/amd/display: Update Cursor request mode to the beginning prefetch always
- drm: allow encoder mode_set even when connectors change for crtc
- Bluetooth: hci_uart: fix race during initialization
- tracing: fix return value in __ftrace_event_enable_disable for
TRACE_REG_UNREGISTER
- net: vlan: don't propagate flags on open
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
- scsi: st: Fix array overflow in st_setup()
- ext4: ignore xattrs past end
- ext4: protect ext4_release_dquot against freezing
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
- jfs: add sanity check for agwidth in dbMount
- jfs: Prevent copying of nlink with value 0 from disk inode
- fs/jfs: Prevent integer overflow in AG size calculation
- fs/jfs: cast inactags to s64 to prevent potential overflow
- jfs: Fix uninit-value access of imap allocated in the diMount() function
- page_pool: avoid infinite loop to schedule delayed worker
- ALSA: usb-audio: Fix CME quirk for UF series keyboards
- ASoC: fsl_audmix: register card device depends on 'dais' property
- ALSA: hda: intel: Fix Optimus when GPU has no sound
- HID: pidff: Fix null pointer dereference in pidff_find_fields
- HID: pidff: Do not send effect envelope if it's empty
- HID: pidff: Convert infinite length from Linux API to PID standard
- xen/mcelog: Add __nonstring annotations for unterminated strings
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
- perf: arm_pmu: Don't disable counter in armpmu_add()
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when
running in a virtual machine
- pm: cpupower: bench: Prevent NULL dereference on malloc failure
- umount: Allow superblock owners to force umount
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet
- net: ppp: Add bound checking for skb data on ppp_sync_txmung
- nvmet-fcloop: swap list_add_tail arguments
- ata: sata_sx4: Add error handling in pdc20621_i2c_read()
- ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
- net: ethtool: Don't call .cleanup_data when prepare_data fails
- net: tls: explicitly disallow disconnect
- tipc: fix memory leak in tipc_link_xmit
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
+ UBUNTU: Upstream stable to v5.15.181
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2111606
Title:
Jammy update: v5.15.181 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2111606/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
