** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Vinicius Peixoto (vpeixoto)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.217 upstream stable release
from git://git.kernel.org/
-
+ f2fs: fix UAF issue in f2fs_merge_page_bio()
+ media: mediatek: vcodec: Fix a resource leak related to the scp device in FW
initialization
+ fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
+ ipvs: separate destination availability state
+ selinux: require every boolean value to be defined
+ selinux: reject a class permission count below its inherited common
+ selinux: do not cancel a policy conversion that never started
+ mptcp: options: reset DSS fields in case of unexpected size
+ s390/qeth: validate user buffer length in SNMP and ARP query ioctls
+ ASoC: cs4265: sort the register default table
+ ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
+ powerpc/pseries: pci - logic bug
+ Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
+ Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
+ Input: psxpad-spi - set driver data before use
+ Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
+ Input: iforce - validate input packet lengths
+ powerpc/pseries: lparcfg - fix kbuf[] underflow
+ Input: synaptics-rmi4 - zero report size on F54 work error
+ Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
+ Input: synaptics-rmi4 - block s_input when F54 queue is busy
+ Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
+ crypto: qce - fix error path in devm_qce_register_algs
+ libceph: fix multiple unsafe decodes in decode_locker()
+ ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
+ openrisc: signal: do not restore privileged SR bits on sigreturn
+ Input: sur40 - fix input device registration ordering
+ Input: sur40 - fix V4L error path cleanup
+ libceph: Avoid using invalid osd indices from primary_temp
+ ceph: fix MDS random selection readiness predicate
+ libceph: tolerate addrvecs with multiple entries of the same type
+ mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
+ mmc: sdhci: unmap the bounce buffer before device release
+ mmc: sdhci: make tuning_err a signed int
+ drm/radeon: fix autosuspend cleanup during teardown
+ s390/vfio_ccw: Fix out of bounds check on CCW array
+ drm/amdgpu: Reject UVD message with invalid number of h265 refs
+ drm/amdgpu: validate GEM_CREATE domain combinations
+ drm/amdgpu: Reject UVD message with dimensions above 4096
+ drm/amdgpu: Implement insert_end for VCE 3
+ drm/amdgpu: Fix UVD decode image min size calculation
+ xfs: fix ilock leak on error in xfs_dq_get_next_id
+ xfs: check v5 superblock features early
+ net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
+ mm: do file ownership checks with the proper mount idmap
+ iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
+ bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
+ udmabuf: Do not create malformed scatterlists
+ dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
+ fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
+ Input: mms114 - fix touch indexing for MMS134S and MMS136
+ i2c: davinci: Unregister cpufreq notifier on probe failure
+ Input: mms114 - reject an oversized device packet size
+ ALSA: hda: conexant: Remove mic bias threshold override
+ VFS/audit: introduce kern_path_parent() for audit
+ audit: widen ino fields to u64
+ audit: use 'unsigned int' instead of 'unsigned'
+ audit: fix recursive locking deadlock in audit_dupe_exe()
+ ALSA: hda: Fix cached processing coefficient verbs
+ serial: max310x: replace bare use of 'unsigned' with 'unsigned int'
(checkpatch)
+ serial: max310x: implement gpio_chip::get_direction()
+ rxrpc: serialize kernel accept preallocation with socket teardown
+ fbcon: Rename struct fbcon_ops to struct fbcon_par
+ fbcon: Use correct type for vc_resize() return value
+ tipc: restrict socket queue dumps in enqueue tracepoints
+ mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
+ mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
+ vduse: Use fixed 4KB bounce pages for non-4KB page size
+ vduse: remove unused vaddr parameter of vduse_domain_free_coherent
+ vduse: take out allocations from vduse_dev_alloc_coherent
+ VDUSE: avoid leaking information to userspace
+ octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
+ octeontx2: Annotate mmio regions as __iomem
+ octeontx2-pf: clear stale mailbox IRQ state before request_irq()
+ octeontx2-vf: clear stale mailbox IRQ state before request_irq()
+ ASoC: mediatek: mt8183: Check runtime resume during probe
+ tcp: convert to dev_net_rcu()
+ net: dst: annotate data-races around dst->input
+ net: dst: annotate data-races around dst->output
+ net: dst: add four helpers to annotate data-races around dst->dev
+ ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
+ netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
+ ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
+ ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
+ ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
+ ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
+ ASoC: mediatek: mt8192: Check runtime resume during probe
+ netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
+ netfilter: nft_set_pipapo: move prove_locking helper around
+ netfilter: nf_conntrack_sip: remove net variable shadowing
+ netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
+ netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
+ netfilter: nft_set_pipapo: prepare walk function for on-demand clone
+ netfilter: nft_set_pipapo: merge deactivate helper into caller
+ netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
+ netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
+ netfilter: nft_set_pipapo: don't leak bad clone into future transaction
+ remoteproc: qcom: replace kstrdup with kstrndup
+ remoteproc: qcom: fix sparse warnings
+ remoteproc: qcom: pas: Adjust the phys addr wrt the mem region
+ remoteproc: qcom: Fix leak when custom dump_segments addition fails
+ lsm: use default hook return value in call_int_hook()
+ selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
+ fs/ntfs3: Make ntfs_update_mftmirr return void
+ fs/ntfs3: Undo critial modificatins to keep directory consistency
+ ntfs3: validate split-point offset in indx_insert_into_buffer
+ 9p: skip nlink update in cacheless mode to fix WARN_ON
+ net: thunderbolt: Fix frags[] overflow by bounding frame_count
+ mtd: spi-nor: Fix spi_nor_try_unlock_all()
+ mtd: spi-nor: swp: Improve locking user experience
+ dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
+ dmaengine: dw-edma: Detach the private data and chip info structures
+ dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
+ taskstats: fill_stats_for_tgid: use for_each_thread()
+ taskstats: retain dead thread stats in TGID queries
+ tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
+ ksmbd: fix integer overflow in set_file_allocation_info()
+ i2c: imx: separate atomic, dma and non-dma use case
+ i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
+ can/esd_usb2: Rename esd_usb2.c to esd_usb.c
+ UBUNTU: [Config] Set CONFIG_CAN_ESD_USB=m
+ can: esd_usb: kill anchored URBs before freeing netdevs
+ thunderbolt: Remove usage of the deprecated ida_simple_xx() API
+ thunderbolt: Update property.c function documentation
+ thunderbolt: Keep XDomain reference during the lifetime of a service
+ thunderbolt: Remove service debugfs entries during unregister
+ thunderbolt: Remove XDomain from the bus without holding tb->lock
+ thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
+ bpf,fork: wipe ->bpf_storage before bailouts that access it
+ ovl: use linked upper dentry in copy-up tmpfile
+ scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
+ dm-integrity: don't increment hash_offset twice
+ dm-verity: make error counter atomic
+ firmware_loader: introduce __free() cleanup hanler
+ Input: ims-pcu - fix firmware leak in async update
+ mmc: vub300: fix use-after-free on disconnect
+ mmc: vub300: rename probe error labels
+ mmc: vub300: fix use-after-free on probe failure
+ locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
+ net: Add helper function to parse netlink msg of ip_tunnel_encap
+ net: ipip: require CAP_NET_ADMIN in the device netns for changelink
+ net: ixp4xx_hss: fix duplicate HDLC netdev allocation
+ net/sched: act_ct: preserve tc_skb_cb across defragmentation
+ net: mana: Validate the packet length reported by the NIC
+ net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
+ octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
+ treewide: rename pinctrl_gpio_direction_output_new()
+ gpio: tegra: do not call pinctrl for GPIO direction
+ net/sched: taprio: avoid calling child->ops->dequeue(child) twice
+ net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
+ bootconfig: do not put quotes on cmdline items unless necessary
+ bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
+ bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
+ espintcp: use sk_msg_free_partial to fix partial send
+ net: ipa: fix SMEM state handle leaks in SMP2P init
+ octeontx2-pf: fix SQB pointer leak on init failure
+ fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
+ drm/dp/mst: fix buffer overflows in sideband chunk accumulation
+ usb: gadget: f_tcm: synchronize delayed set_alt with teardown
+ drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
+ drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
+ dma-buf/drivers: make reserving a shared slot mandatory v4
+ drm/virtio: use uninterruptible resv lock for plane updates
+ drm/displayid: fix Tiled Display Topology ID size
+ drm/tegra: fbdev: Remove offset into framebuffer memory
+ drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
+ drm/virtio: Return proper error codes instead of -1
+ drm/virtio: bound EDID block reads to the response buffer
+ media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
+ drm/i915/vrr: require valid min/max vfreq for VRR
+ drm/i915/hdcp: check streams[] bounds before overflow
+ drm/i915/hdcp: require monotonically increasing seq_num_v
+ media: marvell-cam: fix missing pci_disable_device() on remove
+ media: i2c: imx219: Drop IMX219_VTS_* macros
+ media: i2c: imx219: Correct the minimum vblanking value
+ media: i2c: imx219: Rename VTS to FRM_LENGTH
+ media: imx219: Fix maximum frame length in lines
+ wifi: ath6kl: fix use-after-free in aggr_reset_state()
+ media: v4l: async: Set owner for async sub-devices
+ media: v4l2-fwnode: Fix subdev owner overwritten in
v4l2_async_register_subdev_sensor()
+ ALSA: seq: close a re-opened queue timer in the destructor
+ wifi: brcmfmac: drain bus_reset work on device removal
+ serial: 8250_mid: Remove unneeded test for ->setup() presence
+ serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
+ wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
+ wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
+ sc16is7xx: Properly resume TX after stop
+ serial: sc16is7xx: Fill in rs485_supported
+ serial: sc16is7xx: remove obsolete out_thread label
+ serial: sc16is7xx: fix regression with GPIO configuration
+ serial: sc16is7xx: implement gpio get_direction() callback
+ mptcp: cleanup MPJ subflow list handling
+ mptcp: fix subflow accounting on close
+ mptcp: decrement subflows counter on failed passive join
+ sctp: avoid auth_enable sysctl UAF during netns teardown
+ ceph: avoid fs reclaim while using current->journal_info
+ libceph: Amend checking to fix `make W=1` build breakage
+ libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
+ libceph: add doutc and *_client debug macros support
+ ceph: rename _to_client() to _to_fs_client()
+ ceph: print cluster fsid and client global_id in all debug logs
+ ceph: fix hanging __ceph_get_caps() with stale mds_wanted
+ libceph: fix two unsafe bare decodes in decode_lockers()
+ ksmbd: defer destroy_previous_session() until after NTLM authentication
+ net/sched: serialize qdisc_rtab_list against concurrent get/put
+ ftrace: Add global mutex to serialize trace_parser access
+ super: fix emergency thaw deadlock on frozen block devices
+ ksmbd: rename smb2_get_msg to smb_get_msg
+ smb/server: fix minimum SMB1 PDU size
+ smb/server: fix minimum SMB2 PDU size
+ ksmbd: validate minimum PDU size for transform requests
+ mm/vmstat: fold stranded per-cpu node stats when a node comes online
+ ksmbd: conn lock to serialize smb2 negotiate
+ ksmbd: reject repeated SMB2 NEGOTIATE requests
+ wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
+ igc: remove napi_synchronize() in igc_down()
+ net: pktgen: fix code style (WARNING: Block comments)
+ net: pktgen: fix proc entry use-after-free
+ scsi: sd: sd_zbc: Improve source code documentation
+ scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
+ scsi: sd: sd_zbc: Introduce struct zoned_disk_info
+ scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
+ scsi: scsi_debug: Rename zone type constants
+ scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
+ ice: fix VF interrupts cleanup
+ ice: fix memory leak in ice_lbtest_prepare_rings()
+ fsnotify: opt-in for permission events at file open time
+ fs: don't block write during exec on pre-content watched files
+ binfmt_misc: restore write access when removing an entry
+ i2c: imx: Fix slave registration race and error handling
+ i2c: bcm-iproc: remove printout on handled timeouts
+ i2c: iproc: reset bus after timeout if START_BUSY is stuck
+ can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
+ jiffies: Define secs_to_jiffies()
+ ice: wait for reset completion in ice_resume()
+ drm/amd/pm: fix torn gpu metrics reads
+ sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
+ mm/ptdump: always stabilise against page table freeing using init_mm
+ net: add a couple of helpers for iph tot_len
+ openvswitch: use skb_ip_totlen in conntrack
+ net: sched: use skb_ip_totlen and iph_totlen
+ openvswitch: move key and ovs_cb update out of handle_fragments
+ net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
+ net: atlantic: free stranded TX buffers on ring deinit
+ net/smc: rdma write inline if qp has sufficient inline space
+ net: smc: fix splice entry lifetime imbalance in smc_rx_splice
+ arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
+ crypto: ccm - Set rfc4309 maxauthsize from child
+ netfilter: ipset: fix refcount race between list:set GC and swap
+ netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
+ netfilter: flowtable: publish GC-visible tuple last
+ netfilter: ipset: fix list type element drift bug
+ net: packet: fix wrong transport_header when sending VLAN-tagged frame
+ ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
+ af_packet: Don't send zero-byte data in tpacket_snd().
+ net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
+ net/x25: fix use-after-free of the socket by its timers
+ binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
+ udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
+ drm/vmwgfx: Reserve fence slots on buffer objects in cotables
+ drm/virtio: Unlock reservations on dma_resv_reserve_fences() error
+ jiffies: Cast to unsigned long in secs_to_jiffies() conversion
+ ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
+ ring-buffer: Use current_context for safe per-CPU buffer swap
Linux 5.15.217
- ring-buffer: Use current_context for safe per-CPU buffer swap
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion
- drm/virtio: Unlock reservations on dma_resv_reserve_fences() error
- drm/vmwgfx: Reserve fence slots on buffer objects in cotables
- udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
- net/x25: fix use-after-free of the socket by its timers
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- af_packet: Don't send zero-byte data in tpacket_snd().
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- netfilter: ipset: fix list type element drift bug
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- netfilter: ipset: fix refcount race between list:set GC and swap
- crypto: ccm - Set rfc4309 maxauthsize from child
- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- net/smc: rdma write inline if qp has sufficient inline space
- net: atlantic: free stranded TX buffers on ring deinit
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- openvswitch: move key and ovs_cb update out of handle_fragments
- net: sched: use skb_ip_totlen and iph_totlen
- openvswitch: use skb_ip_totlen in conntrack
- net: add a couple of helpers for iph tot_len
- mm/ptdump: always stabilise against page table freeing using init_mm
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- drm/amd/pm: fix torn gpu metrics reads
- ice: wait for reset completion in ice_resume()
- jiffies: Define secs_to_jiffies()
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
- i2c: iproc: reset bus after timeout if START_BUSY is stuck
- i2c: bcm-iproc: remove printout on handled timeouts
- i2c: imx: Fix slave registration race and error handling
- binfmt_misc: restore write access when removing an entry
- fs: don't block write during exec on pre-content watched files
- fsnotify: opt-in for permission events at file open time
- ice: fix memory leak in ice_lbtest_prepare_rings()
- ice: fix VF interrupts cleanup
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
- scsi: scsi_debug: Rename zone type constants
- scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
- scsi: sd: sd_zbc: Introduce struct zoned_disk_info
- scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
- scsi: sd: sd_zbc: Improve source code documentation
- net: pktgen: fix proc entry use-after-free
- net: pktgen: fix code style (WARNING: Block comments)
- igc: remove napi_synchronize() in igc_down()
- wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
- ksmbd: reject repeated SMB2 NEGOTIATE requests
- ksmbd: conn lock to serialize smb2 negotiate
- mm/vmstat: fold stranded per-cpu node stats when a node comes online
- ksmbd: validate minimum PDU size for transform requests
- smb/server: fix minimum SMB2 PDU size
- smb/server: fix minimum SMB1 PDU size
- ksmbd: rename smb2_get_msg to smb_get_msg
- super: fix emergency thaw deadlock on frozen block devices
- ftrace: Add global mutex to serialize trace_parser access
- net/sched: serialize qdisc_rtab_list against concurrent get/put
- ksmbd: defer destroy_previous_session() until after NTLM authentication
- libceph: fix two unsafe bare decodes in decode_lockers()
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted
- ceph: print cluster fsid and client global_id in all debug logs
- ceph: rename _to_client() to _to_fs_client()
- libceph: add doutc and *_client debug macros support
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
- libceph: Amend checking to fix `make W=1` build breakage
- ceph: avoid fs reclaim while using current->journal_info
- sctp: avoid auth_enable sysctl UAF during netns teardown
- mptcp: decrement subflows counter on failed passive join
- mptcp: fix subflow accounting on close
- mptcp: cleanup MPJ subflow list handling
- serial: sc16is7xx: implement gpio get_direction() callback
- serial: sc16is7xx: fix regression with GPIO configuration
- serial: sc16is7xx: remove obsolete out_thread label
- serial: sc16is7xx: Fill in rs485_supported
- sc16is7xx: Properly resume TX after stop
- wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
- wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
- serial: 8250_mid: Remove unneeded test for ->setup() presence
- wifi: brcmfmac: drain bus_reset work on device removal
- ALSA: seq: close a re-opened queue timer in the destructor
- media: v4l2-fwnode: Fix subdev owner overwritten in
v4l2_async_register_subdev_sensor()
- media: v4l: async: Set owner for async sub-devices
- wifi: ath6kl: fix use-after-free in aggr_reset_state()
- media: imx219: Fix maximum frame length in lines
- media: i2c: imx219: Rename VTS to FRM_LENGTH
- media: i2c: imx219: Correct the minimum vblanking value
- media: i2c: imx219: Drop IMX219_VTS_* macros
- media: marvell-cam: fix missing pci_disable_device() on remove
- drm/i915/hdcp: require monotonically increasing seq_num_v
- drm/i915/hdcp: check streams[] bounds before overflow
- drm/i915/vrr: require valid min/max vfreq for VRR
- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
- drm/virtio: bound EDID block reads to the response buffer
- drm/virtio: Return proper error codes instead of -1
- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
- drm/tegra: fbdev: Remove offset into framebuffer memory
- drm/displayid: fix Tiled Display Topology ID size
- drm/virtio: use uninterruptible resv lock for plane updates
- dma-buf/drivers: make reserving a shared slot mandatory v4
- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
- usb: gadget: f_tcm: synchronize delayed set_alt with teardown
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation
- fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
- octeontx2-pf: fix SQB pointer leak on init failure
- net: ipa: fix SMEM state handle leaks in SMP2P init
- espintcp: use sk_msg_free_partial to fix partial send
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
- bootconfig: do not put quotes on cmdline items unless necessary
- net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
- net/sched: taprio: avoid calling child->ops->dequeue(child) twice
- gpio: tegra: do not call pinctrl for GPIO direction
- treewide: rename pinctrl_gpio_direction_output_new()
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
- net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
- net: mana: Validate the packet length reported by the NIC
- net/sched: act_ct: preserve tc_skb_cb across defragmentation
- net: ixp4xx_hss: fix duplicate HDLC netdev allocation
- net: ipip: require CAP_NET_ADMIN in the device netns for changelink
- net: Add helper function to parse netlink msg of ip_tunnel_encap
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
- mmc: vub300: fix use-after-free on probe failure
- mmc: vub300: rename probe error labels
- mmc: vub300: fix use-after-free on disconnect
- Input: ims-pcu - fix firmware leak in async update
- firmware_loader: introduce __free() cleanup hanler
- dm-verity: make error counter atomic
- dm-integrity: don't increment hash_offset twice
- scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
- ovl: use linked upper dentry in copy-up tmpfile
- bpf,fork: wipe ->bpf_storage before bailouts that access it
- thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
- thunderbolt: Remove XDomain from the bus without holding tb->lock
- thunderbolt: Remove service debugfs entries during unregister
- thunderbolt: Keep XDomain reference during the lifetime of a service
- thunderbolt: Update property.c function documentation
- thunderbolt: Remove usage of the deprecated ida_simple_xx() API
- can: esd_usb: kill anchored URBs before freeing netdevs
- can/esd_usb2: Rename esd_usb2.c to esd_usb.c
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
- i2c: imx: separate atomic, dma and non-dma use case
- ksmbd: fix integer overflow in set_file_allocation_info()
- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
- smb: client: use kvzalloc() for megabyte buffer in simple fallocate
- taskstats: retain dead thread stats in TGID queries
- taskstats: fill_stats_for_tgid: use for_each_thread()
- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
- dmaengine: dw-edma: Detach the private data and chip info structures
- dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
- mtd: spi-nor: swp: Improve locking user experience
- mtd: spi-nor: Fix spi_nor_try_unlock_all()
- net: thunderbolt: Fix frags[] overflow by bounding frame_count
- mtd: maps: vmu-flash: fix fault in unaligned fixup
- 9p: skip nlink update in cacheless mode to fix WARN_ON
- ntfs3: validate split-point offset in indx_insert_into_buffer
- fs/ntfs3: Undo critial modificatins to keep directory consistency
- fs/ntfs3: Make ntfs_update_mftmirr return void
- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
- lsm: infrastructure management of the sock security
- lsm: use default hook return value in call_int_hook()
- remoteproc: qcom: Fix leak when custom dump_segments addition fails
- remoteproc: qcom: pas: Adjust the phys addr wrt the mem region
- remoteproc: qcom: fix sparse warnings
- remoteproc: qcom: replace kstrdup with kstrndup
- netfilter: nft_set_pipapo: don't leak bad clone into future transaction
- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
- netfilter: nft_set_pipapo: merge deactivate helper into caller
- netfilter: nft_set_pipapo: prepare walk function for on-demand clone
- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
- netfilter: nf_conntrack_sip: remove net variable shadowing
- netfilter: nft_set_pipapo: move prove_locking helper around
- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
- ASoC: mediatek: mt8192: Check runtime resume during probe
- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
- ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
- ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
- ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
- net: dst: add four helpers to annotate data-races around dst->dev
- net: dst: annotate data-races around dst->output
- net: dst: annotate data-races around dst->input
- tcp: convert to dev_net_rcu()
- ASoC: mediatek: mt8183: Check runtime resume during probe
- octeontx2-vf: clear stale mailbox IRQ state before request_irq()
- octeontx2-pf: clear stale mailbox IRQ state before request_irq()
- octeontx2: Annotate mmio regions as __iomem
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
- VDUSE: avoid leaking information to userspace
- vduse: take out allocations from vduse_dev_alloc_coherent
- vduse: remove unused vaddr parameter of vduse_domain_free_coherent
- vduse: Use fixed 4KB bounce pages for non-4KB page size
- mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
- mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
- tipc: restrict socket queue dumps in enqueue tracepoints
- fbcon: Use correct type for vc_resize() return value
- fbcon: Rename struct fbcon_ops to struct fbcon_par
- rxrpc: serialize kernel accept preallocation with socket teardown
- serial: max310x: implement gpio_chip::get_direction()
- serial: max310x: replace bare use of 'unsigned' with 'unsigned int'
(checkpatch)
- ALSA: hda: Fix cached processing coefficient verbs
- audit: fix recursive locking deadlock in audit_dupe_exe()
- audit: use 'unsigned int' instead of 'unsigned'
- audit: widen ino fields to u64
- VFS/audit: introduce kern_path_parent() for audit
- ALSA: hda: conexant: Remove mic bias threshold override
- Input: mms114 - reject an oversized device packet size
- i2c: davinci: Unregister cpufreq notifier on probe failure
- Input: mms114 - fix touch indexing for MMS134S and MMS136
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
- dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
- udmabuf: Do not create malformed scatterlists
- bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
- mm: do file ownership checks with the proper mount idmap
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
- xfs: check v5 superblock features early
- xfs: fix ilock leak on error in xfs_dq_get_next_id
- drm/amdgpu: Fix UVD decode image min size calculation
- drm/amdgpu: Implement insert_end for VCE 3
- drm/amdgpu: Reject UVD message with dimensions above 4096
- drm/amdgpu: validate GEM_CREATE domain combinations
- drm/amdgpu: Reject UVD message with invalid number of h265 refs
- s390/vfio_ccw: Fix out of bounds check on CCW array
- drm/radeon: fix autosuspend cleanup during teardown
- mmc: sdhci: make tuning_err a signed int
- mmc: sdhci: unmap the bounce buffer before device release
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
- libceph: tolerate addrvecs with multiple entries of the same type
- ceph: fix MDS random selection readiness predicate
- libceph: Avoid using invalid osd indices from primary_temp
- Input: sur40 - fix V4L error path cleanup
- Input: sur40 - fix input device registration ordering
- openrisc: signal: do not restore privileged SR bits on sigreturn
- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
- libceph: fix multiple unsafe decodes in decode_locker()
- crypto: qce - fix error path in devm_qce_register_algs
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
- Input: synaptics-rmi4 - block s_input when F54 queue is busy
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
- Input: synaptics-rmi4 - zero report size on F54 work error
- powerpc/pseries: lparcfg - fix kbuf[] underflow
- Input: iforce - validate input packet lengths
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
- Input: psxpad-spi - set driver data before use
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
- powerpc/pseries: pci - logic bug
- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
- ASoC: cs4265: sort the register default table
- s390/qeth: validate user buffer length in SNMP and ARP query ioctls
- mptcp: options: reset DSS fields in case of unexpected size
- selinux: do not cancel a policy conversion that never started
- selinux: reject a class permission count below its inherited common
- selinux: require every boolean value to be defined
- ipvs: separate destination availability state
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW
initialization
- media: mtk-vcodec: potential null pointer deference in SCP
- f2fs: fix UAF issue in f2fs_merge_page_bio()
+ UBUNTU: Upstream stable to v5.15.217
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168510
Title:
Jammy update: v5.15.217 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168510/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
