[Bug 2172857] [NEW] Jammy update: v5.15.224 upstream stable release

[Manuel Diewald]

Public bug reported:


    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.15.224 upstream stable release
       from git://git.kernel.org/

tls: device: fix out-of-bounds write in tls_append_frag()
apparmor: fix out-of-bounds write when null terminating a label vec
device property: Add cleanup.h based fwnode_handle_put() scope based cleanup.
device property: fix infinite loop in fwnode_for_each_child_node()
nfsd: fix nfsd_file leak on inter-server COPY setup failure
ceph: bound copied dentry name length in NFS export get_name
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
ocfs2: validate dx_root extent list fields during block read
ocfs2: validate directory-index entry counts when reading metadata
nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()
nvme-tcp: fix host memory disclosure on R2T for a read command
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
usb: storage: realtek_cr: fix use-after-free on disconnect
staging: rtl8723bs: fix spacing around operators
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
ftrace: Take trace_array reference before accessing its ftrace_ops
kprobes: Protect kprobe_blacklist with RCU
nvme: add missing SRCU grace period in error path
KVM: s390: Zero initialize data structures for inject_pfault_token
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
tick/broadcast: Plug clockevents replacement race
Bluetooth: btqcomsmd: Convert to platform remove callback returning void
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
genetlink: pin family module during policy dump
io_uring/rw: end write accounting from ->ki_complete
net: bridge: use option bits for CFM/MRP frame handlers
smb: client: reject userspace cifs.idmap descriptions
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
smb: client: fix heap overflow in DACL owner/group rewrite
ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
wifi: libipw: reject TKIP frames without a full MIC
smb: client: fix potential OOB read in smb3_enum_snapshots()
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
perf tools: Fix a asan issue in parse_events_multi_pmu_add()
perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
usb: xhci: bail out of setup if the controller is inaccessible
gtp: serialize PDP context updates
KEYS: trusted: Fix TPM teardown ordering
zram: fixup read_block_state()
zram: fix out-of-bounds access in read_block_state()
nfsd: release path refs on follow_down() error
nfsd: size fh_verify server sockaddr slot by xpt_locallen
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
nfsd: fix clock domain mismatch in clients_still_reclaiming()
nfsd: gate nfs2 setacl by argp->mask
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
kernel/params.c: Use kstrtobool() instead of strtobool()
params: Do not go over the limit when getting the string length
params: Use size_add() for kmalloc()
params: Sort headers
params: Fix multi-line comment style
params: fix charp corruption on allocation failure
dmaengine: Add devm_dma_request_chan()
i2c: mxs: fix DMA channel leak on probe error
lockd: fix swapped arguments in nlmsvc_match_ip()
power: supply: rt9455: Convert to i2c's .probe_new()
power: supply: rt9455: quiesce delayed work before teardown
i2c: core: Introduce i2c_client_get_device_id helper function
power: supply: max17040: Convert to i2c's .probe_new()
power: supply: max17040: drop incorrect I2C functionality check
mmc: via-sdmmc: cancel card-detect work on remove
hwrng: stm32 - Fix runtime PM cleanup on registration failure
i3c: master: Do not treat master device as a duplicate target
i3c: master: Fix use-after-free of master->this
usb: gadget: f_mass_storage: fix null pointer dereference in 
fsg_common_set_num_buffers()
spi: bcm63xx: disable clock on resume failure
staging: sm750fb: fix mono image source stride mismatch in 
lynxfb_ops_imageblit()
ftrace: Synchronize the initialization of ftrace_ops
arm64: allow pte_offset_map() to fail
arm64: mm: Fix the lockless page-table walk in show_pte()
mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
media: rkvdec: Propagate platform_get_irq() errors
media: saa7164: fix cleanup on resource allocation failure
media: zoran: Avoid freeing a registered video_device twice
scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
f2fs: limit recovery filename logging to stored length
f2fs: fix dentry folio leak in find_in_level
ipmr: account multicast table and route memory
net/sched: act_api: release all action references on NEWACTION failure
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
smb: client: fix cifsFileInfo reference leak in deferred close
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
ALSA: virtio: reset device before deleting virtqueues
btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
watchdog: rtd119x: Use devm_clk_get_enabled() helper
watchdog: rtd119x: Avoid division by zero
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
bna: prevent IOC timer rearm during teardown
tcp: prevent collapsing skbs across boundary in rtx queue
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
net: openvswitch: conntrack: fix helper UAF due to extensions realloc
smb3: make query_on_disk_id open context consistent and move to common code
smb: client: fix create context out-of-bounds reads
net: ipconfig: Remove outdated comment and indent code block
net: ipconfig: bound DHCP option construction
pinctrl: sunxi: Refactor register/offset calculation
pinctrl: sunxi: Use devm_clk_get_enabled() helpers
pinctrl: sunxi: keep a shadow copy of the data register output latches
net: ena: Remove autopolling mode
net: ena: fix MMIO read buffer leak on probe failure
netfilter: nf_tables: set->ops->insert returns opaque set element in case of 
EEXIST
netfilter: nf_tables: skip expired catchall elements on insert and delete
smb: client: use finish_no_open() for non-regular inodes
smb: client: validate POSIX create context length
Bluetooth: mgmt: fix race in read_unconf_index_list()
Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
HID: core: remove #ifdef CONFIG_PM from hid_driver
HID: hid-alps: use default remove for hid device
HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
HID: alps: unregister DualPoint Stick input device on remove
smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
smb/client: pass cifs_open_info_data to SMB2_open()
smb: client: close handle after create-context parsing failure
smb: client: close completed creates on compound wait errors
ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
audit: fix exe mark UAF in kill_rules()
of/irq: Fix remaining refcount leaks in of_irq_init()
of/overlay: put property on deadprops only after changeset add succeeds
of/overlay: only treat a positive changeset id as registered
netfilter: nft_flow_offload: drop flowtable reference on init error path
net/packet: prevent TX_RING byte count overflow
rtc: spear: initialize IRQ state before requesting alarm IRQ
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
wifi: cfg80211: avoid double free if updating BSS fails
drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
openvswitch: add nf_ct_is_confirmed check before assigning the helper
rds_tcp: close NULL deref window in rds_tcp_set_callbacks
vxlan: use one headroom snapshot for neighbour replies
of/irq: add missing of_node_put() for interrupt parent node
vt: skip screen update for DEC alignment test on backgroup consoles
ALSA: caiaq: unregister the input device when probe fails
ALSA: line6: reject oversized playback packets
perf/core: Fix WARN in perf_sigtrap()
hsr: Remove WARN_ONCE() in hsr_addr_is_self().
scsi: qla2xxx: Initialize NVMe abort_work once at submission
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
mtd: core: clear out unregistered devices a bit more
mtd: core: Drop duplicate NULL checks around nvmem_unregister()
mtd: core: Fix refcount error in del_mtd_device()
mtd: use refcount to prevent corruption
mtd: call external _get and _put in right order
mtd: core: call _get_device() with the master MTD
nvmet: preserve device path on allocation failure
of/overlay: don't leak fragment references when changeset init fails
of/overlay: don't create "//" paths for fragments targeting the root
ASoC: wm8903: Move the DRC QR threshold to the register that holds it
wifi: ath11k: reset ar->num_stations on hardware start
wifi: cfg80211: preserve hidden-group beacon IE ownership
ASoC: codecs: rt274: Fix format setting for 44100 rate
Bluetooth: hci_core: free the HCI ID if naming fails
Bluetooth: btintel: validate DDC record lengths
net/mctp: publish the mctp_dev only after it is initialised
net/sched: cls_api: reclaim an empty proto on the error path
netfilter: ipset: do not update comments from kernel-side adds
net: systemport: Fix RUNT MIB counter register offset calculation
tipc: prevent GCM nonce reuse on peer key changes
net/sched: fq_codel: match the no-drop threshold to the packet size
net/sched: sch_codel: match the no-drop threshold to the packet size
tcp: refresh TS.Recent for accepted old ACKs
ipvs: fix missing counter decrement in lblc
ipvs: do not create invisible templates
ipvs: filter some flags received in the backup server
netfilter: nf_tables: avoid skb access on nf_stolen
net: add and use skb_get_hash_net
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
i2c: at91: release DMA channels when probe defers
perf: Fix race between perf_event_exit_task() and perf_pending_task()
PCI: Accept AtomicOps already enabled by the hypervisor
drm/radeon: Read the VRAM VBIOS signature with readb()
kgdboc: Fix tty driver reference leak in configure_kgdboc()
Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
Input: synaptics - limit T440p InterTouch quirk to LEN0036
nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
USB: cdc-acm: fix racy TIOCMIWAIT implementation
USB: serial: fix port tear down use-after-free
usb: storage: sierra_ms: reject short SWoC info transfers
usb: hub: use shorter 120ms post resume hold for SS root hubs
usb: ohci-da8xx: disable controller wakeup on cleanup
usb: ohci-s3c2410: disable controller wakeup on removal
usb: ohci-st: disable controller wakeup on removal
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
usb: gadget: aspeed-vhub: cancel wake work on device removal
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
usb: typec: tcpm: recover after failure to start the frs ams
usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
usb: typec: ucsi: Get the connector fwnode based on reg value
usb: typec: ucsi: displayport: Current CAM OOB index fixup
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
tty: amiserial: fix broken TIOCMIWAIT
tty: vcc: zero-initialize control packet in vcc_send_ctl()
tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
serial: tegra: don't clear the Tx FIFO on an Rx-only reset
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
ALSA: ua101: reject mismatched capture/playback packet sizes
Bluetooth: RFCOMM: Fix initial port reference race
Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
ipvs: bound LBLCR and LBLC cache growth
kprobes: Skip disarmed probes when checking optkprobe overlap
nvme-multipath: fix underflow in ANA log bounds checks
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
mtd: spinand: fix zero oobavail when no ECC engine is used
wifi: cw1200: fix TX padding OOB read leaking heap data to device
wifi: iwlegacy: 3945: free EEPROM data on remove
wifi: mac80211: drain PS delivery work during station teardown
wifi: mac80211: minstrel_ht: validate fixed rate index
wifi: mac80211: release mesh path quota on failed additions
wifi: mac80211: handle empty FILS association request payload
USB: serial: cp210x: add Corsair AX1500i Power Supply
USB: serial: quatech2: fix baud rate overflow
USB: serial: ssu100: fix baud rate overflow
USB: serial: fix dynamic id driver deregistration race
USB: serial: option: add support for SIMCom SIM8260C
USB: serial: option: add Quectel EG060W
USB: serial: option: add Compal EXM-G1x support
USB: serial: option: add Quectel RG660QB
USB: serial: option: add Compal EXC-T1 support
thunderbolt: Reject oversized XDomain properties responses
iio: accel: kxcjk-1013: reject duplicate event disable
iio: accel: sca3000: fix frequency divider condition check
iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
iio: gyro: adis16136: fix unprotected debugfs reads
iio: imu: adis16400: fix unprotected debugfs reads
iio: imu: adis16480: fix unprotected debugfs reads
iio: light: gp2ap020a00f: drain irq_work after free_irq
iio: proximity: isl29501: Fix return type of isl29501_register_write
iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
iio: trigger: cancel reenable_work before freeing trigger
net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones"
Input: exc3000 - properly stop timer on shutdown
arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
SUNRPC: fix gssx_dec_option_array error path bugs
SUNRPC: reject duplicate CREDS_VALUE options
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
wifi: wl12xx: Drop if with an always false condition
wifi: wlcore: Convert to platform remove callback returning void
wifi: wlcore: Fix runtime PM leak in wlcore_remove()
RDMA/hns: Fix WQ_MEM_RECLAIM warning
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
net: usb: qmi_wwan: add Quectel EG120K-EA
serial: imx: Convert to platform remove callback returning void
serial: imx: serialize imx_uart_ports[] lifetime
usb: gadget: at91_udc: Convert to platform remove callback returning void
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
usb: typec: tcpm: fix debug accessory mode detection for sink ports
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
xen/netfront: drop RX packets with a short Ethernet header
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix 
extensions
drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
soc: qcom: geni-se: Correct QUP Core ICC vote constants
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
tty: fix saved termios reset race
perf: Require kernel access for text poke events
ALSA: seq: Serialize compat port-info ioctls
arm64: errata: Factor out broken AMU const counter cap
arm64: errata: Add Cortex-A725 erratum 3821522 workaround
UBUNTU: [Config] arm64: errata: Add Cortex-A725 erratum 3821522 workaround
iio: buffer: serialize buffer teardown with mode claims
KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
fsverity: add dependency on 64K or smaller pages
drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
drm/amd/pm/si: Fix updating clock limits on AC/DC
drm/amdgpu: reset VI ASIC on MacBookPro15,1
drm/amdgpu: reset VI ASIC on MacBookPro14,3
drm/amdgpu: fix for coding style issues
drm/amdgpu: fix ACP MFD device leak on init failure
drm/amdgpu/gfx6: fix firmware leak on teardown
usb: octeon-hcd: fix the FIFO-flush timeout computation
usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
usb: ohci-spear: disable controller wakeup on removal
USB: dwc2: shut down wakeup timer before freeing HCD state
usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
tty: tty_port: restore TTY_IO_ERROR on activation failure
tty: reformat kernel-doc in tty_io.c
tty: abort break signalling on hangup
tty: serial: max3100: shut down timer before freeing port
Input: s6sy761 - fix resume ordering and restore sensing
tty: vt: fix memory leak in vc_allocate()
serial: fix TIOCMIWAIT race
drm/amd/display: Mark DCE 6.4 as not APU
wifi: mac80211: shut down RX BA session timer on teardown
wifi: mac80211: keep fallback association elements alive
thunderbolt: Fix KASAN reported use-after-free when request is canceled
USB: serial: fix ioctl hangup race
mtd: block2mtd: Fix divide error when erase_size is zero
mtd: spinand: Enable QE on all dies
wifi: mac80211: account proxy paths against the mesh path limit
USB: serial: clean up core error labels
USB: serial: fix driver deregistration order
bnxt_en: fix DMA mapping length for padded small packets
tty: introduce and use tty_port_tty_vhangup() helper
tty: port: fix tty_port_tty_vhangup() race
wifi: mac80211: keep paired old chanctx alive
wifi: mac80211: count only matching reservations in reserved switch
fs: Free any excess xarray nodes in clear_inode()
mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
wifi: mac80211: set info->band for 802.3 encap offload frames
smb: client: discard post-EOF pagecache when extending a file via zero range
iio: adc: aspeed: propagate reset deassert errors
iio: adc: max1363: sign-extend bipolar differential channel reads
HID: core: introduce hid_safe_input_report()
HID: uhid: convert to hid_safe_input_report()
crypto: drbg - Fix ineffective sanity check
ipv4: stop PMTU walk when nexthop group shrinks
ipv4: stop route notification sizing when nexthop group shrinks
ipv4: do not warn on route notification size race
ipv6: do not warn on route notification size race
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
dm ioctl: don't let data_start run past the buffer
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
wireguard: noise: reject response consumption after intermediate initiation
workqueue: Fix NULL current_pwq deref in chained work check
xen/netfront: don't leak the skb when xennet_fill_frags() fails
strparser: make sure __strp_recv isn't running before tearing down the parser
tipc: destroy topsrv workqueues before closing connections
tipc: hold a reference to nodes found by link name
Revert "wifi: libertas: reject short monitor TX frames"
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when 
!streamoute
gpio: xilinx: fix runtime PM leak on request error path
ibmveth: h_free logical LAN on open-fail after register
keys: finalize persistent keyring timeout after link attempt
KEYS: Fix add_key() race with keyring restriction
memstick: core: wait for request completion before freeing card
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
dm-crypt: reject the lmk IV mode with AEAD ciphers
dm-snap: reject the transient exception store for snapshot-merge
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: mtk-sd: Cancel request timeout work on remove
mmc: sdhci-sprd: disable runtime PM on remove
net/packet: guard the ll header push in packet_rcv_spkt()
net/smc: protect clcsock lifetime in smc_getname
net: bridge: avoid recursive multicast port cleanup
net: usb: ax88179_178a: fix rx frame length for non-last packets
nvme: fix swapped ZRASF zone state values for full and read only
openvswitch: fix soft lockup in the netlink flow dump
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
scsi: qedi: Initialize callback state before registration
Bluetooth: hci_sock: Serialize dead-device detachment
Bluetooth: RFCOMM: free the skb when the DLC has no owner
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
drm/gud: don't keep a connector without a CRTC as connector_state
drm/i915/gem: Prevent overstepping exec array boundary
drm/vc4: drain the hangcheck timer and works on V3D unbind
drm/amdgpu: make Mac FB workaround generic
fs: refuse fspick() on internal superblocks
namespace: check a submount for references right before unmounting it
dcache: don't put a mountpoint on a dentry that's being removed
namespace: refuse an automount below a mount that is in no namespace
drm/dp: don't mark the AUX backlight enabled when enabling failed
gpio: exar: initialize the ID before registering its cleanup
drm/aspeed: Balance the display clock enable on teardown
drm/vc4: Free the BO cache size list on teardown
net/sched: em_text: reject unterminated algo before autoload
cxgb4/ch_ktls: disable softirqs around tid_list erases
nvmet: use the local P2P device on metadata allocation failure
ASoC: adau1372: allow sleepy powerdown GPIOs
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
flow_dissector: avoid u16 truncation of skb->len when computing thoff
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
net/mlx5e: Order ICOSQ cc update after CQ doorbell
net: openvswitch: validate transport header presence in set_ipv6_addr
mtd: fix use-after-free in mtd release
mtd: Clean refcounting with MTD_PARTITIONED_MASTER
mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
mtd: fix double free and WARN_ON in add_mtd_device() error paths
dlm: validate length in dlm_search_rsb_tree
openvswitch: defer tunnel netdev_put to RCU release
openvswitch: vport: fix self-deadlock on release of tunnel ports
smb3: fix for slab out of bounds on mount to ksmbd
smb: client: reject short Next offsets in parse_server_interfaces()
ipv6: use RCU in ip6_xmit()
can: fix unique skb identifier regression under RPS
drm/amd/display: Don't replace a sink mode that shares the native totals
HID: hid-steam: Fix cleanup in probe()
HID: hid-steam: Make client_opened a counter
HID: steam: Fully unregister controller when hidraw is opened
HID: steam: Rearrange teardown sequence
HID: steam: Refactor registration
HID: steam: Clean up locking
tracing: Set the trace clock before registering the histogram trigger
ip6_gre: remove obsolete ERSPAN PMTU update
selinux: fix data race on AVC latest_notif
EDAC/amd64: Mask UMC chip select to the four implemented selects
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
netfilter: nf_tables: fix bidirectional offload regression
net: team: Remove unused team_mode_op, port_enabled
net: team: Rename port_disabled team mode op to port_tx_disabled
net: team: fix NULL pointer dereference in team_xmit during mode change
net: team: stop reusing skb after queue override
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
drm/vmwgfx: validate pitch coming from userspace
namespace: don't inherit MNT_UMOUNT in clone_mnt()
namespace: check the mounts before reading their parents in pivot_root()
dm: fix reading free memory in do_resume
pmdomain: rockchip: fix clock leak on domain probe failure
pmdomain: rockchip: don't ignore clock lookup errors on attach
pmdomain: rockchip: propagate subdomain add errors
optee: register TEE devices only once fully initialized
scsi: ch: Do not keep references to data transfer element devices
drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
drm/i915/gt: Unmask interrupts only when ACTIVE is true
namespace: unhash a dentry before detaching the mounts on it
namespace: don't copy an unmounted mount tree
namespace: check the target before walking it in do_mount_setattr()
fcntl: refuse F_SET_RW_HINT on an immutable inode
namespace: handle mount locking for automounts correctly
netfilter: nf_tables: fix crash when nf_trace is enabled
tty: finish kernel-doc of tty_struct members
tty: add break_wait kernel-doc
xfrm: prevent policy_hthresh.work from racing with netns teardown
xfs: log items should have a xlog pointer, not a mount
xfs: aborting inodes on shutdown may need buffer lock
xfs: fix super block buf log item UAF during force shutdown
xfs: buffer pins need to hold a buffer reference
xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
xfs: catch stale AGF/AGF metadata
xfs: rearrange code in xfs_buf_item.c
xfs: factor out stale buffer item completion
xfs: fix unmount hang with unflushable inodes stuck in the AIL
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
KVM: x86: Use active memslots for the per-vCPU MMIO cache
bpf: fix potential 32-bit overflow when accessing ARRAY map element
power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
Drivers: hv: Don't reset VMBus connection state on error/exit paths
vsock: treat TCP_CLOSING as once-established
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
ASoC: stm32: spdifrx: fix synchronization state check
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
ASoC: cs42l52: Fix the NG Type Switch bit
ASoC: pcm3168a: Fix the DAC zero flag polarity bit
ASoC: max98371: Fix the Speaker DHT Min Volume bits
ASoC: wm8978: Fix the 128x oversampling switch bits
ASoC: nau8822: Fix the 128x oversampling switch bits
netlink: remove netlink_broadcast_filtered
netlink: Reverse the patch which removed filtering
netlink: reset skb headers before unicast and multicast filtering
nios2: fix __wsum type degradation in csum_fold()
scsi: st: Save the visited block for the partition the drive is in
scsi: target: iscsi: Fix race in discovery auth updates
ocfs2/dlm: Protect the recovery list during debugfs reads
samples: pidfd: fix userprogs typo
clone: add CLONE_AUTOREAP
exit: fix lost-update race on the child_subreaper bitfields
pipe: preserve existing fasync readers on writer setup failure
netlink: avoid hashing the network namespace pointer
autofs: ignore notification errors from a replaced pipe
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for 
!VM-Entry
fsnotify: prevent mark additions during connector teardown
net/sched: fix use-after-free in __tcf_action_put()
net: rds: fix uninitialized trans dereference in CM event handler
sctp: revalidate output stream after association connect wait
tools: gpio: fix building from the top level with O=
i2c: qcom-cci: Fix HALT_ACK reset request being dropped
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
scsi: libiscsi: Validate the task named by a management response
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
tracing: Fix the shift out of bounds in the log2 histogram modifier
tracing: Fix hist trigger timestamps for buffered events
wifi: p54: validate firmware record lengths
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
dm cache: fix demotion stats in passthrough mode
dm cache: fix issue with background work locking
dm-crypt: fix a tiny race condition in crypt_dec_pending
dm-ebs: fix incorrect device offset check in ebs_ctr()
net/iucv: fix the recvmsg window update
tipc: protect node reset trace dump with node lock
sctp: validate chunk length in the inqueue parser
page_pool: keep frag_offset aligned for odd-sized requests
s390/ctcm: Prevent XID null dereference
s390/pci: Fix leak of uninitialized kernel data in SCLP report
ipv4: avoid divide by zero in fib_rebalance
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
drm/amdgpu: Fix VCE 3 ring align_mask
security/keys: fix missed RCU read section on lookup
net/sched: cls_u32: skip hash tables in u32_bind_class()
OPP: Fix race between OPP addition and lookup
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
net: bridge: mcast: don't truncate the port group walk on teardown
net/sched: cls_flower: validate mask pointer after nla_next()
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
scsi: st: Fix use-after-free race between st_remove() and st_open()
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
watch_queue: Fix note pool publication race in watch_queue_set_size()
unicode: free the map after a grace period
Input: byd - synchronize timer deletion before freeing private data
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
dm-integrity: require stable writes for internal hash modes
vsock/virtio: validate packet source for connected sockets
ipv4: udp: Create exceptions before socket matching
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
drm/i915/dmc: Harden DMC firmware payload parsing
dm-integrity: fix infinite loop on discard with large tag size
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
UBUNTU: SAUCE: Revert "md: move initialization and destruction of 'io_acct_set' 
to md.c"
md: move initialization and destruction of 'io_acct_set' to md.c
net_sched: codel: fix stale state for empty flows in fq_codel
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
tracing: Reject incomplete event filter expressions
tracing: Save the event file instead of the compatible histogram
tracing: Unregister field variable histograms when the command fails
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
keys: Avoid the owner account dereference in named keyring lookup
keys: Check the authorization payload in process keyring searches
keys: Protect the type name while describing a key
keys: make keyring indexes independent of kernel addresses
keys: Protect the read method check against type removal
KEYS: Fix key_reject_and_link() race with keyring restriction
KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
keys/trusted_keys: return immediately after TPM unseal failure
io-wq: order the exit bit against worker creation task work
signal: don't retarget shared signals in a dying thread group
Linux 5.15.224
UBUNTU: Upstream stable to v5.15.224

** Affects: linux (Ubuntu)
     Importance: Undecided
         Status: Invalid

** Affects: linux (Ubuntu Jammy)
     Importance: Medium
     Assignee: Manuel Diewald (diewald)
         Status: In Progress


** Tags: kernel-stable-tracking-bug

** Changed in: linux (Ubuntu)
       Status: New => Confirmed

** Also affects: linux (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Changed in: linux (Ubuntu)
       Status: Confirmed => Invalid

** Changed in: linux (Ubuntu Jammy)
   Importance: Undecided => Medium

** Changed in: linux (Ubuntu Jammy)
       Status: New => In Progress

** Changed in: linux (Ubuntu Jammy)
     Assignee: (unassigned) => Manuel Diewald (diewald)

** Description changed:

  
      SRU Justification
  
      Impact:
         The upstream process for stable tree updates is quite similar
         in scope to the Ubuntu SRU process, e.g., each patch has to
         demonstrably fix a bug, and each patch is vetted by upstream
         by originating either directly from a mainline/stable Linux tree or
         a minimally backported form of that patch. The following upstream
         stable patches should be included in the Ubuntu kernel:
  
         v5.15.224 upstream stable release
         from git://git.kernel.org/
  
-             
+ tls: device: fix out-of-bounds write in tls_append_frag()
+ apparmor: fix out-of-bounds write when null terminating a label vec
+ device property: Add cleanup.h based fwnode_handle_put() scope based cleanup.
+ device property: fix infinite loop in fwnode_for_each_child_node()
+ nfsd: fix nfsd_file leak on inter-server COPY setup failure
+ ceph: bound copied dentry name length in NFS export get_name
+ smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
+ HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
+ nouveau/gem: reserve the bo in the info ioctl around the vma lookup
+ ocfs2: validate dx_root extent list fields during block read
+ ocfs2: validate directory-index entry counts when reading metadata
+ nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()
+ nvme-tcp: fix host memory disclosure on R2T for a read command
+ wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
+ usb: storage: realtek_cr: fix use-after-free on disconnect
+ staging: rtl8723bs: fix spacing around operators
+ staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
+ ftrace: Take trace_array reference before accessing its ftrace_ops
+ kprobes: Protect kprobe_blacklist with RCU
+ nvme: add missing SRCU grace period in error path
+ KVM: s390: Zero initialize data structures for inject_pfault_token
+ scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
+ scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
+ scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
+ scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
+ f2fs: embed f2fs_gc_kthread in f2fs_sb_info
+ tick/broadcast: Plug clockevents replacement race
+ Bluetooth: btqcomsmd: Convert to platform remove callback returning void
+ Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
+ genetlink: pin family module during policy dump
+ io_uring/rw: end write accounting from ->ki_complete
+ net: bridge: use option bits for CFM/MRP frame handlers
+ smb: client: reject userspace cifs.idmap descriptions
+ smb: client: avoid leaking refcount in cifs_queue_oplock_break()
+ smb: client: fix heap overflow in DACL owner/group rewrite
+ ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
+ ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
+ wifi: libipw: reject TKIP frames without a full MIC
+ smb: client: fix potential OOB read in smb3_enum_snapshots()
+ smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
+ smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
+ vlan: require the MAC header to be present in __vlan_insert_inner_tag()
+ perf tools: Fix a asan issue in parse_events_multi_pmu_add()
+ perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
+ usb: xhci: bail out of setup if the controller is inaccessible
+ gtp: serialize PDP context updates
+ KEYS: trusted: Fix TPM teardown ordering
+ zram: fixup read_block_state()
+ zram: fix out-of-bounds access in read_block_state()
+ nfsd: release path refs on follow_down() error
+ nfsd: size fh_verify server sockaddr slot by xpt_locallen
+ nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
+ nfsd: fix clock domain mismatch in clients_still_reclaiming()
+ nfsd: gate nfs2 setacl by argp->mask
+ cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
+ coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
+ kernel/params.c: Use kstrtobool() instead of strtobool()
+ params: Do not go over the limit when getting the string length
+ params: Use size_add() for kmalloc()
+ params: Sort headers
+ params: Fix multi-line comment style
+ params: fix charp corruption on allocation failure
+ dmaengine: Add devm_dma_request_chan()
+ i2c: mxs: fix DMA channel leak on probe error
+ lockd: fix swapped arguments in nlmsvc_match_ip()
+ power: supply: rt9455: Convert to i2c's .probe_new()
+ power: supply: rt9455: quiesce delayed work before teardown
+ i2c: core: Introduce i2c_client_get_device_id helper function
+ power: supply: max17040: Convert to i2c's .probe_new()
+ power: supply: max17040: drop incorrect I2C functionality check
+ mmc: via-sdmmc: cancel card-detect work on remove
+ hwrng: stm32 - Fix runtime PM cleanup on registration failure
+ i3c: master: Do not treat master device as a duplicate target
+ i3c: master: Fix use-after-free of master->this
+ usb: gadget: f_mass_storage: fix null pointer dereference in 
fsg_common_set_num_buffers()
+ spi: bcm63xx: disable clock on resume failure
+ staging: sm750fb: fix mono image source stride mismatch in 
lynxfb_ops_imageblit()
+ ftrace: Synchronize the initialization of ftrace_ops
+ arm64: allow pte_offset_map() to fail
+ arm64: mm: Fix the lockless page-table walk in show_pte()
+ mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
+ media: rkvdec: Propagate platform_get_irq() errors
+ media: saa7164: fix cleanup on resource allocation failure
+ media: zoran: Avoid freeing a registered video_device twice
+ scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
+ scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
+ scsi: qla2xxx: Quiesce response IRQ before freeing request queue
+ scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
+ scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
+ f2fs: limit recovery filename logging to stored length
+ f2fs: fix dentry folio leak in find_in_level
+ ipmr: account multicast table and route memory
+ net/sched: act_api: release all action references on NEWACTION failure
+ ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
+ smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
+ smb: client: fix cifsFileInfo reference leak in deferred close
+ smb: client: avoid leaking refcount when cifs_sb_tlink() fails
+ ALSA: virtio: reset device before deleting virtqueues
+ btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
+ watchdog: rtd119x: Use devm_clk_get_enabled() helper
+ watchdog: rtd119x: Avoid division by zero
+ hwmon: (pwm-fan) Stop RPM timer before freeing tach data
+ wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
+ smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
+ bna: prevent IOC timer rearm during teardown
+ tcp: prevent collapsing skbs across boundary in rtx queue
+ drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
+ perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
+ mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
+ net: openvswitch: conntrack: fix helper UAF due to extensions realloc
+ smb3: make query_on_disk_id open context consistent and move to common code
+ smb: client: fix create context out-of-bounds reads
+ net: ipconfig: Remove outdated comment and indent code block
+ net: ipconfig: bound DHCP option construction
+ pinctrl: sunxi: Refactor register/offset calculation
+ pinctrl: sunxi: Use devm_clk_get_enabled() helpers
+ pinctrl: sunxi: keep a shadow copy of the data register output latches
+ net: ena: Remove autopolling mode
+ net: ena: fix MMIO read buffer leak on probe failure
+ netfilter: nf_tables: set->ops->insert returns opaque set element in case of 
EEXIST
+ netfilter: nf_tables: skip expired catchall elements on insert and delete
+ smb: client: use finish_no_open() for non-regular inodes
+ smb: client: validate POSIX create context length
+ Bluetooth: mgmt: fix race in read_unconf_index_list()
+ Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
+ HID: core: remove #ifdef CONFIG_PM from hid_driver
+ HID: hid-alps: use default remove for hid device
+ HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
+ HID: alps: unregister DualPoint Stick input device on remove
+ smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
+ smb/client: pass cifs_open_info_data to SMB2_open()
+ smb: client: close handle after create-context parsing failure
+ smb: client: close completed creates on compound wait errors
+ ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
+ audit: fix exe mark UAF in kill_rules()
+ of/irq: Fix remaining refcount leaks in of_irq_init()
+ of/overlay: put property on deadprops only after changeset add succeeds
+ of/overlay: only treat a positive changeset id as registered
+ netfilter: nft_flow_offload: drop flowtable reference on init error path
+ net/packet: prevent TX_RING byte count overflow
+ rtc: spear: initialize IRQ state before requesting alarm IRQ
+ sctp: check RCV_SHUTDOWN after the sendmsg connect wait
+ wifi: cfg80211: avoid double free if updating BSS fails
+ drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
+ drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
+ openvswitch: add nf_ct_is_confirmed check before assigning the helper
+ rds_tcp: close NULL deref window in rds_tcp_set_callbacks
+ vxlan: use one headroom snapshot for neighbour replies
+ of/irq: add missing of_node_put() for interrupt parent node
+ vt: skip screen update for DEC alignment test on backgroup consoles
+ ALSA: caiaq: unregister the input device when probe fails
+ ALSA: line6: reject oversized playback packets
+ perf/core: Fix WARN in perf_sigtrap()
+ hsr: Remove WARN_ONCE() in hsr_addr_is_self().
+ scsi: qla2xxx: Initialize NVMe abort_work once at submission
+ scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
+ mtd: core: clear out unregistered devices a bit more
+ mtd: core: Drop duplicate NULL checks around nvmem_unregister()
+ mtd: core: Fix refcount error in del_mtd_device()
+ mtd: use refcount to prevent corruption
+ mtd: call external _get and _put in right order
+ mtd: core: call _get_device() with the master MTD
+ nvmet: preserve device path on allocation failure
+ of/overlay: don't leak fragment references when changeset init fails
+ of/overlay: don't create "//" paths for fragments targeting the root
+ ASoC: wm8903: Move the DRC QR threshold to the register that holds it
+ wifi: ath11k: reset ar->num_stations on hardware start
+ wifi: cfg80211: preserve hidden-group beacon IE ownership
+ ASoC: codecs: rt274: Fix format setting for 44100 rate
+ Bluetooth: hci_core: free the HCI ID if naming fails
+ Bluetooth: btintel: validate DDC record lengths
+ net/mctp: publish the mctp_dev only after it is initialised
+ net/sched: cls_api: reclaim an empty proto on the error path
+ netfilter: ipset: do not update comments from kernel-side adds
+ net: systemport: Fix RUNT MIB counter register offset calculation
+ tipc: prevent GCM nonce reuse on peer key changes
+ net/sched: fq_codel: match the no-drop threshold to the packet size
+ net/sched: sch_codel: match the no-drop threshold to the packet size
+ tcp: refresh TS.Recent for accepted old ACKs
+ ipvs: fix missing counter decrement in lblc
+ ipvs: do not create invisible templates
+ ipvs: filter some flags received in the backup server
+ netfilter: nf_tables: avoid skb access on nf_stolen
+ net: add and use skb_get_hash_net
+ ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
+ i2c: at91: release DMA channels when probe defers
+ perf: Fix race between perf_event_exit_task() and perf_pending_task()
+ PCI: Accept AtomicOps already enabled by the hypervisor
+ drm/radeon: Read the VRAM VBIOS signature with readb()
+ kgdboc: Fix tty driver reference leak in configure_kgdboc()
+ Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
+ Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
+ Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
+ Input: synaptics - limit T440p InterTouch quirk to LEN0036
+ nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
+ USB: cdc-acm: fix racy TIOCMIWAIT implementation
+ USB: serial: fix port tear down use-after-free
+ usb: storage: sierra_ms: reject short SWoC info transfers
+ usb: hub: use shorter 120ms post resume hold for SS root hubs
+ usb: ohci-da8xx: disable controller wakeup on cleanup
+ usb: ohci-s3c2410: disable controller wakeup on removal
+ usb: ohci-st: disable controller wakeup on removal
+ usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
+ usb: gadget: aspeed-vhub: cancel wake work on device removal
+ USB: gadget: dummy-hcd: Fix wait for outstanding request completions
+ usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
+ usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
+ usb: typec: tcpm: recover after failure to start the frs ams
+ usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
+ usb: typec: ucsi: Get the connector fwnode based on reg value
+ usb: typec: ucsi: displayport: Current CAM OOB index fixup
+ usb: cdns3: fix use-after-free in cdns3_gadget_exit()
+ usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
+ tty: amiserial: fix broken TIOCMIWAIT
+ tty: vcc: zero-initialize control packet in vcc_send_ctl()
+ tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
+ tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
+ serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
+ serial: tegra: don't clear the Tx FIFO on an Rx-only reset
+ serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
+ ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
+ ALSA: ua101: reject mismatched capture/playback packet sizes
+ Bluetooth: RFCOMM: Fix initial port reference race
+ Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
+ Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
+ Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
+ ipvs: bound LBLCR and LBLC cache growth
+ kprobes: Skip disarmed probes when checking optkprobe overlap
+ nvme-multipath: fix underflow in ANA log bounds checks
+ mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
+ mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
+ mtd: spinand: fix zero oobavail when no ECC engine is used
+ wifi: cw1200: fix TX padding OOB read leaking heap data to device
+ wifi: iwlegacy: 3945: free EEPROM data on remove
+ wifi: mac80211: drain PS delivery work during station teardown
+ wifi: mac80211: minstrel_ht: validate fixed rate index
+ wifi: mac80211: release mesh path quota on failed additions
+ wifi: mac80211: handle empty FILS association request payload
+ USB: serial: cp210x: add Corsair AX1500i Power Supply
+ USB: serial: quatech2: fix baud rate overflow
+ USB: serial: ssu100: fix baud rate overflow
+ USB: serial: fix dynamic id driver deregistration race
+ USB: serial: option: add support for SIMCom SIM8260C
+ USB: serial: option: add Quectel EG060W
+ USB: serial: option: add Compal EXM-G1x support
+ USB: serial: option: add Quectel RG660QB
+ USB: serial: option: add Compal EXC-T1 support
+ thunderbolt: Reject oversized XDomain properties responses
+ iio: accel: kxcjk-1013: reject duplicate event disable
+ iio: accel: sca3000: fix frequency divider condition check
+ iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
+ iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
+ iio: gyro: adis16136: fix unprotected debugfs reads
+ iio: imu: adis16400: fix unprotected debugfs reads
+ iio: imu: adis16480: fix unprotected debugfs reads
+ iio: light: gp2ap020a00f: drain irq_work after free_irq
+ iio: proximity: isl29501: Fix return type of isl29501_register_write
+ iio: proximity: pulsedlight: fix iio_device left registered on PM setup 
failure
+ iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
+ iio: trigger: cancel reenable_work before freeing trigger
+ net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
+ Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones"
+ Input: exc3000 - properly stop timer on shutdown
+ arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
+ drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
+ SUNRPC: fix gssx_dec_option_array error path bugs
+ SUNRPC: reject duplicate CREDS_VALUE options
+ vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
+ mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
+ smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
+ wifi: wl12xx: Drop if with an always false condition
+ wifi: wlcore: Convert to platform remove callback returning void
+ wifi: wlcore: Fix runtime PM leak in wlcore_remove()
+ RDMA/hns: Fix WQ_MEM_RECLAIM warning
+ vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
+ wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
+ net: usb: qmi_wwan: add Quectel EG120K-EA
+ serial: imx: Convert to platform remove callback returning void
+ serial: imx: serialize imx_uart_ports[] lifetime
+ usb: gadget: at91_udc: Convert to platform remove callback returning void
+ usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
+ usb: typec: tcpm: fix debug accessory mode detection for sink ports
+ usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
+ xen/netfront: drop RX packets with a short Ethernet header
+ smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix 
extensions
+ drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
+ soc: qcom: geni-se: Correct QUP Core ICC vote constants
+ usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
+ tty: fix saved termios reset race
+ perf: Require kernel access for text poke events
+ ALSA: seq: Serialize compat port-info ioctls
+ arm64: errata: Factor out broken AMU const counter cap
+ arm64: errata: Add Cortex-A725 erratum 3821522 workaround
+ UBUNTU: [Config] arm64: errata: Add Cortex-A725 erratum 3821522 workaround
+ iio: buffer: serialize buffer teardown with mode claims
+ KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
+ fsverity: add dependency on 64K or smaller pages
+ drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
+ drm/amd/pm/si: Fix updating clock limits on AC/DC
+ drm/amdgpu: reset VI ASIC on MacBookPro15,1
+ drm/amdgpu: reset VI ASIC on MacBookPro14,3
+ drm/amdgpu: fix for coding style issues
+ drm/amdgpu: fix ACP MFD device leak on init failure
+ drm/amdgpu/gfx6: fix firmware leak on teardown
+ usb: octeon-hcd: fix the FIFO-flush timeout computation
+ usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
+ usb: ohci-spear: disable controller wakeup on removal
+ USB: dwc2: shut down wakeup timer before freeing HCD state
+ usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
+ tty: tty_port: restore TTY_IO_ERROR on activation failure
+ tty: reformat kernel-doc in tty_io.c
+ tty: abort break signalling on hangup
+ tty: serial: max3100: shut down timer before freeing port
+ Input: s6sy761 - fix resume ordering and restore sensing
+ tty: vt: fix memory leak in vc_allocate()
+ serial: fix TIOCMIWAIT race
+ drm/amd/display: Mark DCE 6.4 as not APU
+ wifi: mac80211: shut down RX BA session timer on teardown
+ wifi: mac80211: keep fallback association elements alive
+ thunderbolt: Fix KASAN reported use-after-free when request is canceled
+ USB: serial: fix ioctl hangup race
+ mtd: block2mtd: Fix divide error when erase_size is zero
+ mtd: spinand: Enable QE on all dies
+ wifi: mac80211: account proxy paths against the mesh path limit
+ USB: serial: clean up core error labels
+ USB: serial: fix driver deregistration order
+ bnxt_en: fix DMA mapping length for padded small packets
+ tty: introduce and use tty_port_tty_vhangup() helper
+ tty: port: fix tty_port_tty_vhangup() race
+ wifi: mac80211: keep paired old chanctx alive
+ wifi: mac80211: count only matching reservations in reserved switch
+ fs: Free any excess xarray nodes in clear_inode()
+ mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
+ KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
+ wifi: mac80211: set info->band for 802.3 encap offload frames
+ smb: client: discard post-EOF pagecache when extending a file via zero range
+ iio: adc: aspeed: propagate reset deassert errors
+ iio: adc: max1363: sign-extend bipolar differential channel reads
+ HID: core: introduce hid_safe_input_report()
+ HID: uhid: convert to hid_safe_input_report()
+ crypto: drbg - Fix ineffective sanity check
+ ipv4: stop PMTU walk when nexthop group shrinks
+ ipv4: stop route notification sizing when nexthop group shrinks
+ ipv4: do not warn on route notification size race
+ ipv6: do not warn on route notification size race
+ btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
+ dm ioctl: don't let data_start run past the buffer
+ wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
+ wireguard: noise: reject response consumption after intermediate initiation
+ workqueue: Fix NULL current_pwq deref in chained work check
+ xen/netfront: don't leak the skb when xennet_fill_frags() fails
+ strparser: make sure __strp_recv isn't running before tearing down the parser
+ tipc: destroy topsrv workqueues before closing connections
+ tipc: hold a reference to nodes found by link name
+ Revert "wifi: libertas: reject short monitor TX frames"
+ selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
+ sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when 
!streamoute
+ gpio: xilinx: fix runtime PM leak on request error path
+ ibmveth: h_free logical LAN on open-fail after register
+ keys: finalize persistent keyring timeout after link attempt
+ KEYS: Fix add_key() race with keyring restriction
+ memstick: core: wait for request completion before freeing card
+ memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
+ dm-crypt: reject the lmk IV mode with AEAD ciphers
+ dm-snap: reject the transient exception store for snapshot-merge
+ mmc: cavium-octeon: destroy slot platform devices on remove
+ mmc: cavium-thunderx: destroy slot platform devices on remove
+ mmc: mtk-sd: Cancel request timeout work on remove
+ mmc: sdhci-sprd: disable runtime PM on remove
+ net/packet: guard the ll header push in packet_rcv_spkt()
+ net/smc: protect clcsock lifetime in smc_getname
+ net: bridge: avoid recursive multicast port cleanup
+ net: usb: ax88179_178a: fix rx frame length for non-last packets
+ nvme: fix swapped ZRASF zone state values for full and read only
+ openvswitch: fix soft lockup in the netlink flow dump
+ regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
+ scsi: qedi: Initialize callback state before registration
+ Bluetooth: hci_sock: Serialize dead-device detachment
+ Bluetooth: RFCOMM: free the skb when the DLC has no owner
+ Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
+ drm/gud: don't keep a connector without a CRTC as connector_state
+ drm/i915/gem: Prevent overstepping exec array boundary
+ drm/vc4: drain the hangcheck timer and works on V3D unbind
+ drm/amdgpu: make Mac FB workaround generic
+ fs: refuse fspick() on internal superblocks
+ namespace: check a submount for references right before unmounting it
+ dcache: don't put a mountpoint on a dentry that's being removed
+ namespace: refuse an automount below a mount that is in no namespace
+ drm/dp: don't mark the AUX backlight enabled when enabling failed
+ gpio: exar: initialize the ID before registering its cleanup
+ drm/aspeed: Balance the display clock enable on teardown
+ drm/vc4: Free the BO cache size list on teardown
+ net/sched: em_text: reject unterminated algo before autoload
+ cxgb4/ch_ktls: disable softirqs around tid_list erases
+ nvmet: use the local P2P device on metadata allocation failure
+ ASoC: adau1372: allow sleepy powerdown GPIOs
+ ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
+ ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
+ flow_dissector: avoid u16 truncation of skb->len when computing thoff
+ flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
+ net/mlx5e: Order ICOSQ cc update after CQ doorbell
+ net: openvswitch: validate transport header presence in set_ipv6_addr
+ mtd: fix use-after-free in mtd release
+ mtd: Clean refcounting with MTD_PARTITIONED_MASTER
+ mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
+ mtd: fix double free and WARN_ON in add_mtd_device() error paths
+ dlm: validate length in dlm_search_rsb_tree
+ openvswitch: defer tunnel netdev_put to RCU release
+ openvswitch: vport: fix self-deadlock on release of tunnel ports
+ smb3: fix for slab out of bounds on mount to ksmbd
+ smb: client: reject short Next offsets in parse_server_interfaces()
+ ipv6: use RCU in ip6_xmit()
+ can: fix unique skb identifier regression under RPS
+ drm/amd/display: Don't replace a sink mode that shares the native totals
+ HID: hid-steam: Fix cleanup in probe()
+ HID: hid-steam: Make client_opened a counter
+ HID: steam: Fully unregister controller when hidraw is opened
+ HID: steam: Rearrange teardown sequence
+ HID: steam: Refactor registration
+ HID: steam: Clean up locking
+ tracing: Set the trace clock before registering the histogram trigger
+ ip6_gre: remove obsolete ERSPAN PMTU update
+ selinux: fix data race on AVC latest_notif
+ EDAC/amd64: Mask UMC chip select to the four implemented selects
+ mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
+ mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
+ netfilter: nf_tables: fix bidirectional offload regression
+ net: team: Remove unused team_mode_op, port_enabled
+ net: team: Rename port_disabled team mode op to port_tx_disabled
+ net: team: fix NULL pointer dereference in team_xmit during mode change
+ net: team: stop reusing skb after queue override
+ Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
+ drm/vmwgfx: validate pitch coming from userspace
+ namespace: don't inherit MNT_UMOUNT in clone_mnt()
+ namespace: check the mounts before reading their parents in pivot_root()
+ dm: fix reading free memory in do_resume
+ pmdomain: rockchip: fix clock leak on domain probe failure
+ pmdomain: rockchip: don't ignore clock lookup errors on attach
+ pmdomain: rockchip: propagate subdomain add errors
+ optee: register TEE devices only once fully initialized
+ scsi: ch: Do not keep references to data transfer element devices
+ drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
+ drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
+ drm/i915/gt: Unmask interrupts only when ACTIVE is true
+ namespace: unhash a dentry before detaching the mounts on it
+ namespace: don't copy an unmounted mount tree
+ namespace: check the target before walking it in do_mount_setattr()
+ fcntl: refuse F_SET_RW_HINT on an immutable inode
+ namespace: handle mount locking for automounts correctly
+ netfilter: nf_tables: fix crash when nf_trace is enabled
+ tty: finish kernel-doc of tty_struct members
+ tty: add break_wait kernel-doc
+ xfrm: prevent policy_hthresh.work from racing with netns teardown
+ xfs: log items should have a xlog pointer, not a mount
+ xfs: aborting inodes on shutdown may need buffer lock
+ xfs: fix super block buf log item UAF during force shutdown
+ xfs: buffer pins need to hold a buffer reference
+ xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
+ xfs: catch stale AGF/AGF metadata
+ xfs: rearrange code in xfs_buf_item.c
+ xfs: factor out stale buffer item completion
+ xfs: fix unmount hang with unflushable inodes stuck in the AIL
+ ksmbd: fix heap out-of-bounds write in krb5_authenticate()
+ KVM: x86: Use active memslots for the per-vCPU MMIO cache
+ bpf: fix potential 32-bit overflow when accessing ARRAY map element
+ power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
+ Drivers: hv: Don't reset VMBus connection state on error/exit paths
+ vsock: treat TCP_CLOSING as once-established
+ net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
+ ASoC: stm32: spdifrx: fix synchronization state check
+ ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
+ ASoC: cs42l52: Fix the NG Type Switch bit
+ ASoC: pcm3168a: Fix the DAC zero flag polarity bit
+ ASoC: max98371: Fix the Speaker DHT Min Volume bits
+ ASoC: wm8978: Fix the 128x oversampling switch bits
+ ASoC: nau8822: Fix the 128x oversampling switch bits
+ netlink: remove netlink_broadcast_filtered
+ netlink: Reverse the patch which removed filtering
+ netlink: reset skb headers before unicast and multicast filtering
+ nios2: fix __wsum type degradation in csum_fold()
+ scsi: st: Save the visited block for the partition the drive is in
+ scsi: target: iscsi: Fix race in discovery auth updates
+ ocfs2/dlm: Protect the recovery list during debugfs reads
+ samples: pidfd: fix userprogs typo
+ clone: add CLONE_AUTOREAP
+ exit: fix lost-update race on the child_subreaper bitfields
+ pipe: preserve existing fasync readers on writer setup failure
+ netlink: avoid hashing the network namespace pointer
+ autofs: ignore notification errors from a replaced pipe
+ KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for 
!VM-Entry
+ fsnotify: prevent mark additions during connector teardown
+ net/sched: fix use-after-free in __tcf_action_put()
+ net: rds: fix uninitialized trans dereference in CM event handler
+ sctp: revalidate output stream after association connect wait
+ tools: gpio: fix building from the top level with O=
+ i2c: qcom-cci: Fix HALT_ACK reset request being dropped
+ scsi: libiscsi: Reject a negative task index from parse_pdu_itt
+ scsi: libiscsi: Validate the ITT reflected in a Reject PDU
+ scsi: libiscsi: Validate the task named by a management response
+ drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
+ drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
+ tracing: Fix the shift out of bounds in the log2 histogram modifier
+ tracing: Fix hist trigger timestamps for buffered events
+ wifi: p54: validate firmware record lengths
+ tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
+ cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
+ dm cache: fix demotion stats in passthrough mode
+ dm cache: fix issue with background work locking
+ dm-crypt: fix a tiny race condition in crypt_dec_pending
+ dm-ebs: fix incorrect device offset check in ebs_ctr()
+ net/iucv: fix the recvmsg window update
+ tipc: protect node reset trace dump with node lock
+ sctp: validate chunk length in the inqueue parser
+ page_pool: keep frag_offset aligned for odd-sized requests
+ s390/ctcm: Prevent XID null dereference
+ s390/pci: Fix leak of uninitialized kernel data in SCLP report
+ ipv4: avoid divide by zero in fib_rebalance
+ mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
+ drm/amdgpu: Fix VCE 3 ring align_mask
+ security/keys: fix missed RCU read section on lookup
+ net/sched: cls_u32: skip hash tables in u32_bind_class()
+ OPP: Fix race between OPP addition and lookup
+ KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
+ net: bridge: mcast: don't truncate the port group walk on teardown
+ net/sched: cls_flower: validate mask pointer after nla_next()
+ tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace 
fields
+ scsi: st: Fix use-after-free race between st_remove() and st_open()
+ KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
+ hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
+ watch_queue: Fix note pool publication race in watch_queue_set_size()
+ unicode: free the map after a grace period
+ Input: byd - synchronize timer deletion before freeing private data
+ mm/huge_memory: transfer the pmd dirty bit to the folio on zap
+ dm-integrity: require stable writes for internal hash modes
+ vsock/virtio: validate packet source for connected sockets
+ ipv4: udp: Create exceptions before socket matching
+ i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
+ futex: Fix mm reuse handling for FUT_OFF_MMSHARED
+ drm/i915/dmc: Harden DMC firmware payload parsing
+ dm-integrity: fix infinite loop on discard with large tag size
+ cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
+ xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
+ ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
+ ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
+ ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
+ UBUNTU: SAUCE: Revert "md: move initialization and destruction of 
'io_acct_set' to md.c"
+ md: move initialization and destruction of 'io_acct_set' to md.c
+ net_sched: codel: fix stale state for empty flows in fq_codel
+ Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
+ Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
+ tracing: Reject incomplete event filter expressions
+ tracing: Save the event file instead of the compatible histogram
+ tracing: Unregister field variable histograms when the command fails
+ tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
+ keys: Avoid the owner account dereference in named keyring lookup
+ keys: Check the authorization payload in process keyring searches
+ keys: Protect the type name while describing a key
+ keys: make keyring indexes independent of kernel addresses
+ keys: Protect the read method check against type removal
+ KEYS: Fix key_reject_and_link() race with keyring restriction
+ KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
+ keys/trusted_keys: return immediately after TPM unseal failure
+ io-wq: order the exit bit against worker creation task work
+ signal: don't retarget shared signals in a dying thread group
  Linux 5.15.224
- signal: don't retarget shared signals in a dying thread group
- io-wq: order the exit bit against worker creation task work
- keys/trusted_keys: return immediately after TPM unseal failure
- KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
- KEYS: Fix key_reject_and_link() race with keyring restriction
- keys: Protect the read method check against type removal
- keys: make keyring indexes independent of kernel addresses
- keys: Protect the type name while describing a key
- keys: Check the authorization payload in process keyring searches
- keys: Avoid the owner account dereference in named keyring lookup
- tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
- tracing: Unregister field variable histograms when the command fails
- tracing: Save the event file instead of the compatible histogram
- tracing: Reject incomplete event filter expressions
- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
- Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
- net_sched: codel: fix stale state for empty flows in fq_codel
- md: move initialization and destruction of 'io_acct_set' to md.c
- netfilter: nf_tables: unconditionally bump set->nelems before insertion
- netfilter: nf_tables: always increment set element count
- net: bonding: fix use-after-free in bond_xmit_broadcast()
- ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
- ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
- ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
- xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
- cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
- dm-integrity: fix infinite loop on discard with large tag size
- drm/i915/dmc: Harden DMC firmware payload parsing
- futex: Fix mm reuse handling for FUT_OFF_MMSHARED
- i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
- ipv4: udp: Create exceptions before socket matching
- vsock/virtio: validate packet source for connected sockets
- dm-integrity: require stable writes for internal hash modes
- netfilter: nf_tables: always walk all pending catchall elements
- bridge: mcast: Fix use-after-free during router port configuration
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap
- Input: byd - synchronize timer deletion before freeing private data
- unicode: free the map after a grace period
- watch_queue: Fix note pool publication race in watch_queue_set_size()
- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
- scsi: st: Fix use-after-free race between st_remove() and st_open()
- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace 
fields
- net/sched: cls_flower: validate mask pointer after nla_next()
- net: bridge: mcast: don't truncate the port group walk on teardown
- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
- OPP: Fix race between OPP addition and lookup
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- security/keys: fix missed RCU read section on lookup
- drm/amdgpu: Fix VCE 3 ring align_mask
- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
- ipv4: avoid divide by zero in fib_rebalance
- s390/pci: Fix leak of uninitialized kernel data in SCLP report
- s390/ctcm: Prevent XID null dereference
- page_pool: keep frag_offset aligned for odd-sized requests
- sctp: validate chunk length in the inqueue parser
- tipc: protect node reset trace dump with node lock
- net/iucv: fix the recvmsg window update
- dm-ebs: fix incorrect device offset check in ebs_ctr()
- dm-crypt: fix a tiny race condition in crypt_dec_pending
- dm cache: fix issue with background work locking
- dm cache: fix demotion stats in passthrough mode
- cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
- tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
- wifi: p54: validate firmware record lengths
- tracing: Fix hist trigger timestamps for buffered events
- tracing: Fix the shift out of bounds in the log2 histogram modifier
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
- drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
- scsi: libiscsi: Validate the task named by a management response
- scsi: libiscsi: Validate the ITT reflected in a Reject PDU
- scsi: libiscsi: Reject a negative task index from parse_pdu_itt
- i2c: qcom-cci: Fix HALT_ACK reset request being dropped
- tools: gpio: fix building from the top level with O=
- sctp: revalidate output stream after association connect wait
- net: rds: fix uninitialized trans dereference in CM event handler
- net/sched: fix use-after-free in __tcf_action_put()
- fsnotify: prevent mark additions during connector teardown
- KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for 
!VM-Entry
- autofs: ignore notification errors from a replaced pipe
- netlink: avoid hashing the network namespace pointer
- pipe: preserve existing fasync readers on writer setup failure
- exit: fix lost-update race on the child_subreaper bitfields
- clone: add CLONE_AUTOREAP
- samples: pidfd: fix userprogs typo
- ocfs2/dlm: Protect the recovery list during debugfs reads
- scsi: target: iscsi: Fix race in discovery auth updates
- scsi: st: Save the visited block for the partition the drive is in
- nios2: fix __wsum type degradation in csum_fold()
- netlink: reset skb headers before unicast and multicast filtering
- netlink: Reverse the patch which removed filtering
- netlink: remove netlink_broadcast_filtered
- ASoC: nau8822: Fix the 128x oversampling switch bits
- ASoC: wm8978: Fix the 128x oversampling switch bits
- ASoC: max98371: Fix the Speaker DHT Min Volume bits
- ASoC: pcm3168a: Fix the DAC zero flag polarity bit
- ASoC: cs42l52: Fix the NG Type Switch bit
- ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
- ASoC: stm32: spdifrx: fix synchronization state check
- net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
- vsock: treat TCP_CLOSING as once-established
- Drivers: hv: Don't reset VMBus connection state on error/exit paths
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
- bpf: fix potential 32-bit overflow when accessing ARRAY map element
- KVM: x86: Use active memslots for the per-vCPU MMIO cache
- ksmbd: fix heap out-of-bounds write in krb5_authenticate()
- xfs: fix unmount hang with unflushable inodes stuck in the AIL
- xfs: factor out stale buffer item completion
- xfs: rearrange code in xfs_buf_item.c
- xfs: catch stale AGF/AGF metadata
- xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
- xfs: buffer pins need to hold a buffer reference
- xfs: fix super block buf log item UAF during force shutdown
- xfs: aborting inodes on shutdown may need buffer lock
- xfs: log items should have a xlog pointer, not a mount
- xfrm: prevent policy_hthresh.work from racing with netns teardown
- tty: add break_wait kernel-doc
- tty: finish kernel-doc of tty_struct members
- netfilter: nf_tables: fix crash when nf_trace is enabled
- namespace: handle mount locking for automounts correctly
- fcntl: refuse F_SET_RW_HINT on an immutable inode
- namespace: check the target before walking it in do_mount_setattr()
- namespace: don't copy an unmounted mount tree
- namespace: unhash a dentry before detaching the mounts on it
- drm/i915/gt: Unmask interrupts only when ACTIVE is true
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
- scsi: ch: Do not keep references to data transfer element devices
- optee: register TEE devices only once fully initialized
- pmdomain: rockchip: propagate subdomain add errors
- pmdomain: rockchip: don't ignore clock lookup errors on attach
- pmdomain: rockchip: fix clock leak on domain probe failure
- dm: fix reading free memory in do_resume
- namespace: check the mounts before reading their parents in pivot_root()
- namespace: don't inherit MNT_UMOUNT in clone_mnt()
- drm/vmwgfx: validate pitch coming from userspace
- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- net: team: stop reusing skb after queue override
- net: team: fix NULL pointer dereference in team_xmit during mode change
- net: team: Rename port_disabled team mode op to port_tx_disabled
- net: team: Remove unused team_mode_op, port_enabled
- netfilter: nf_tables: fix bidirectional offload regression
- mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
- mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
- EDAC/amd64: Mask UMC chip select to the four implemented selects
- selinux: fix data race on AVC latest_notif
- ip6_gre: remove obsolete ERSPAN PMTU update
- tracing: Set the trace clock before registering the histogram trigger
- HID: steam: Clean up locking
- HID: steam: Refactor registration
- HID: steam: Rearrange teardown sequence
- HID: steam: Fully unregister controller when hidraw is opened
- HID: hid-steam: Make client_opened a counter
- HID: hid-steam: Fix cleanup in probe()
- drm/amd/display: Don't replace a sink mode that shares the native totals
- can: fix unique skb identifier regression under RPS
- ipv6: use RCU in ip6_xmit()
- smb: client: reject short Next offsets in parse_server_interfaces()
- smb3: fix for slab out of bounds on mount to ksmbd
- cifs: fix underflow in parse_server_interfaces()
- netfilter: nf_tables: release flowtable after rcu grace period on error
- openvswitch: vport: fix self-deadlock on release of tunnel ports
- openvswitch: defer tunnel netdev_put to RCU release
- dlm: validate length in dlm_search_rsb_tree
- mtd: fix double free and WARN_ON in add_mtd_device() error paths
- mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
- mtd: Clean refcounting with MTD_PARTITIONED_MASTER
- mtd: fix use-after-free in mtd release
- net: openvswitch: validate transport header presence in set_ipv6_addr
- net/mlx5e: Order ICOSQ cc update after CQ doorbell
- flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
- flow_dissector: avoid u16 truncation of skb->len when computing thoff
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
- ASoC: adau1372: allow sleepy powerdown GPIOs
- nvmet: use the local P2P device on metadata allocation failure
- cxgb4/ch_ktls: disable softirqs around tid_list erases
- net/sched: em_text: reject unterminated algo before autoload
- drm/vc4: Free the BO cache size list on teardown
- drm/aspeed: Balance the display clock enable on teardown
- gpio: exar: initialize the ID before registering its cleanup
- drm/dp: don't mark the AUX backlight enabled when enabling failed
- namespace: refuse an automount below a mount that is in no namespace
- dcache: don't put a mountpoint on a dentry that's being removed
- namespace: check a submount for references right before unmounting it
- fs: refuse fspick() on internal superblocks
- drm/amdgpu: make Mac FB workaround generic
- drm/vc4: drain the hangcheck timer and works on V3D unbind
- drm/i915/gem: Prevent overstepping exec array boundary
- drm/gud: don't keep a connector without a CRTC as connector_state
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- Bluetooth: RFCOMM: free the skb when the DLC has no owner
- Bluetooth: hci_sock: Serialize dead-device detachment
- scsi: qedi: Initialize callback state before registration
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
- openvswitch: fix soft lockup in the netlink flow dump
- nvme: fix swapped ZRASF zone state values for full and read only
- net: usb: ax88179_178a: fix rx frame length for non-last packets
- net: bridge: avoid recursive multicast port cleanup
- net/smc: protect clcsock lifetime in smc_getname
- net/packet: guard the ll header push in packet_rcv_spkt()
- mmc: sdhci-sprd: disable runtime PM on remove
- mmc: mtk-sd: Cancel request timeout work on remove
- mmc: cavium-thunderx: destroy slot platform devices on remove
- mmc: cavium-octeon: destroy slot platform devices on remove
- dm-snap: reject the transient exception store for snapshot-merge
- dm-crypt: reject the lmk IV mode with AEAD ciphers
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
- memstick: core: wait for request completion before freeing card
- KEYS: Fix add_key() race with keyring restriction
- keys: finalize persistent keyring timeout after link attempt
- ibmveth: h_free logical LAN on open-fail after register
- gpio: xilinx: fix runtime PM leak on request error path
- sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when 
!streamoute
- selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
- Revert "wifi: libertas: reject short monitor TX frames"
- tipc: hold a reference to nodes found by link name
- tipc: destroy topsrv workqueues before closing connections
- strparser: make sure __strp_recv isn't running before tearing down the parser
- xen/netfront: don't leak the skb when xennet_fill_frags() fails
- workqueue: Fix NULL current_pwq deref in chained work check
- wireguard: noise: reject response consumption after intermediate initiation
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
- dm ioctl: don't let data_start run past the buffer
- btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
- ipv6: do not warn on route notification size race
- ipv4: do not warn on route notification size race
- ipv4: stop route notification sizing when nexthop group shrinks
- ipv4: stop PMTU walk when nexthop group shrinks
- crypto: drbg - Fix ineffective sanity check
- HID: uhid: convert to hid_safe_input_report()
- HID: core: introduce hid_safe_input_report()
- iio: adc: max1363: sign-extend bipolar differential channel reads
- iio: adc: aspeed: propagate reset deassert errors
- smb: client: discard post-EOF pagecache when extending a file via zero range
- wifi: mac80211: set info->band for 802.3 encap offload frames
- KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
- mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
- fs: Free any excess xarray nodes in clear_inode()
- wifi: mac80211: count only matching reservations in reserved switch
- wifi: mac80211: keep paired old chanctx alive
- tty: port: fix tty_port_tty_vhangup() race
- tty: introduce and use tty_port_tty_vhangup() helper
- bnxt_en: fix DMA mapping length for padded small packets
- USB: serial: fix driver deregistration order
- USB: serial: clean up core error labels
- wifi: mac80211: account proxy paths against the mesh path limit
- mtd: spinand: Enable QE on all dies
- mtd: block2mtd: Fix divide error when erase_size is zero
- USB: serial: fix ioctl hangup race
- thunderbolt: Fix KASAN reported use-after-free when request is canceled
- wifi: mac80211: keep fallback association elements alive
- wifi: mac80211: shut down RX BA session timer on teardown
- drm/amd/display: Mark DCE 6.4 as not APU
- serial: fix TIOCMIWAIT race
- tty: vt: fix memory leak in vc_allocate()
- Input: s6sy761 - fix resume ordering and restore sensing
- tty: serial: max3100: shut down timer before freeing port
- tty: abort break signalling on hangup
- tty: reformat kernel-doc in tty_io.c
- tty: tty_port: restore TTY_IO_ERROR on activation failure
- usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
- USB: dwc2: shut down wakeup timer before freeing HCD state
- usb: ohci-spear: disable controller wakeup on removal
- usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
- usb: octeon-hcd: fix the FIFO-flush timeout computation
- drm/amdgpu/gfx6: fix firmware leak on teardown
- drm/amdgpu: fix ACP MFD device leak on init failure
- drm/amdgpu: fix for coding style issues
- drm/amdgpu: reset VI ASIC on MacBookPro14,3
- drm/amdgpu: reset VI ASIC on MacBookPro15,1
- drm/amd/pm/si: Fix updating clock limits on AC/DC
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
- fsverity: add dependency on 64K or smaller pages
- KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
- iio: buffer: serialize buffer teardown with mode claims
- arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- arm64: errata: Factor out broken AMU const counter cap
- ALSA: seq: Serialize compat port-info ioctls
- perf: Require kernel access for text poke events
- tty: fix saved termios reset race
- usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- soc: qcom: geni-se: Correct QUP Core ICC vote constants
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix 
extensions
- xen/netfront: drop RX packets with a short Ethernet header
- usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
- usb: typec: tcpm: fix debug accessory mode detection for sink ports
- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
- usb: gadget: at91_udc: Convert to platform remove callback returning void
- serial: imx: serialize imx_uart_ports[] lifetime
- serial: imx: Convert to platform remove callback returning void
- net: usb: qmi_wwan: add Quectel EG120K-EA
- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
- vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
- RDMA/hns: Fix WQ_MEM_RECLAIM warning
- wifi: wlcore: Fix runtime PM leak in wlcore_remove()
- wifi: wlcore: Convert to platform remove callback returning void
- wifi: wl12xx: Drop if with an always false condition
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
- mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
- SUNRPC: reject duplicate CREDS_VALUE options
- SUNRPC: fix gssx_dec_option_array error path bugs
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
- arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
- Input: exc3000 - properly stop timer on shutdown
- Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones"
- net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
- iio: trigger: cancel reenable_work before freeing trigger
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup 
failure
- iio: proximity: isl29501: Fix return type of isl29501_register_write
- iio: light: gp2ap020a00f: drain irq_work after free_irq
- iio: imu: adis16480: fix unprotected debugfs reads
- iio: imu: adis16400: fix unprotected debugfs reads
- iio: gyro: adis16136: fix unprotected debugfs reads
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
- iio: accel: sca3000: fix frequency divider condition check
- iio: accel: kxcjk-1013: reject duplicate event disable
- thunderbolt: Reject oversized XDomain properties responses
- USB: serial: option: add Compal EXC-T1 support
- USB: serial: option: add Quectel RG660QB
- USB: serial: option: add Compal EXM-G1x support
- USB: serial: option: add Quectel EG060W
- USB: serial: option: add support for SIMCom SIM8260C
- USB: serial: fix dynamic id driver deregistration race
- USB: serial: ssu100: fix baud rate overflow
- USB: serial: quatech2: fix baud rate overflow
- USB: serial: cp210x: add Corsair AX1500i Power Supply
- wifi: mac80211: handle empty FILS association request payload
- wifi: mac80211: release mesh path quota on failed additions
- wifi: mac80211: minstrel_ht: validate fixed rate index
- wifi: mac80211: drain PS delivery work during station teardown
- wifi: iwlegacy: 3945: free EEPROM data on remove
- wifi: cw1200: fix TX padding OOB read leaking heap data to device
- mtd: spinand: fix zero oobavail when no ECC engine is used
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
- nvme-multipath: fix underflow in ANA log bounds checks
- kprobes: Skip disarmed probes when checking optkprobe overlap
- ipvs: bound LBLCR and LBLC cache growth
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
- Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
- Bluetooth: RFCOMM: Fix initial port reference race
- ALSA: ua101: reject mismatched capture/playback packet sizes
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
- tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
- tty: vcc: zero-initialize control packet in vcc_send_ctl()
- tty: amiserial: fix broken TIOCMIWAIT
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
- usb: cdns3: fix use-after-free in cdns3_gadget_exit()
- usb: typec: ucsi: displayport: Current CAM OOB index fixup
- usb: typec: ucsi: Get the connector fwnode based on reg value
- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
- usb: typec: tcpm: recover after failure to start the frs ams
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions
- usb: gadget: aspeed-vhub: cancel wake work on device removal
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
- usb: ohci-st: disable controller wakeup on removal
- usb: ohci-s3c2410: disable controller wakeup on removal
- usb: ohci-da8xx: disable controller wakeup on cleanup
- usb: hub: use shorter 120ms post resume hold for SS root hubs
- usb: storage: sierra_ms: reject short SWoC info transfers
- USB: serial: fix port tear down use-after-free
- USB: cdc-acm: fix racy TIOCMIWAIT implementation
- nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
- Input: synaptics - limit T440p InterTouch quirk to LEN0036
- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
- kgdboc: Fix tty driver reference leak in configure_kgdboc()
- drm/radeon: Read the VRAM VBIOS signature with readb()
- PCI: Accept AtomicOps already enabled by the hypervisor
- perf: Fix race between perf_event_exit_task() and perf_pending_task()
- i2c: at91: release DMA channels when probe defers
- ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
- net: add and use skb_get_hash_net
- netfilter: nf_tables: avoid skb access on nf_stolen
- ipvs: filter some flags received in the backup server
- ipvs: do not create invisible templates
- ipvs: fix missing counter decrement in lblc
- tcp: refresh TS.Recent for accepted old ACKs
- net/sched: sch_codel: match the no-drop threshold to the packet size
- net/sched: fq_codel: match the no-drop threshold to the packet size
- tipc: prevent GCM nonce reuse on peer key changes
- net: systemport: Fix RUNT MIB counter register offset calculation
- netfilter: ipset: do not update comments from kernel-side adds
- net/sched: cls_api: reclaim an empty proto on the error path
- net/mctp: publish the mctp_dev only after it is initialised
- mctp: Add refcounts to mctp_dev
- Bluetooth: btintel: validate DDC record lengths
- Bluetooth: hci_core: free the HCI ID if naming fails
- ASoC: codecs: rt274: Fix format setting for 44100 rate
- wifi: cfg80211: preserve hidden-group beacon IE ownership
- wifi: ath11k: reset ar->num_stations on hardware start
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it
- of/overlay: don't create "//" paths for fragments targeting the root
- of/overlay: don't leak fragment references when changeset init fails
- nvmet: preserve device path on allocation failure
- mtd: core: call _get_device() with the master MTD
- mtd: call external _get and _put in right order
- mtd: use refcount to prevent corruption
- mtd: core: Fix refcount error in del_mtd_device()
- mtd: core: Drop duplicate NULL checks around nvmem_unregister()
- mtd: core: clear out unregistered devices a bit more
- scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
- scsi: qla2xxx: Initialize NVMe abort_work once at submission
- hsr: Remove WARN_ONCE() in hsr_addr_is_self().
- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
- perf/core: Fix WARN in perf_sigtrap()
- ALSA: line6: reject oversized playback packets
- ALSA: caiaq: unregister the input device when probe fails
- vt: skip screen update for DEC alignment test on backgroup consoles
- of/irq: add missing of_node_put() for interrupt parent node
- vxlan: use one headroom snapshot for neighbour replies
- rds_tcp: close NULL deref window in rds_tcp_set_callbacks
- openvswitch: add nf_ct_is_confirmed check before assigning the helper
- drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
- drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
- wifi: cfg80211: avoid double free if updating BSS fails
- sctp: check RCV_SHUTDOWN after the sendmsg connect wait
- rtc: spear: initialize IRQ state before requesting alarm IRQ
- net/packet: prevent TX_RING byte count overflow
- netfilter: nft_flow_offload: drop flowtable reference on init error path
- of/overlay: only treat a positive changeset id as registered
- of/overlay: put property on deadprops only after changeset add succeeds
- of/irq: Fix remaining refcount leaks in of_irq_init()
- audit: fix exe mark UAF in kill_rules()
- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
- smb: client: close completed creates on compound wait errors
- smb: client: close handle after create-context parsing failure
- smb/client: pass cifs_open_info_data to SMB2_open()
- smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
- HID: alps: unregister DualPoint Stick input device on remove
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
- HID: hid-alps: use default remove for hid device
- HID: core: remove #ifdef CONFIG_PM from hid_driver
- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
- Bluetooth: mgmt: fix race in read_unconf_index_list()
- smb: client: validate POSIX create context length
- smb: client: use finish_no_open() for non-regular inodes
- netfilter: nf_tables: skip expired catchall elements on insert and delete
- netfilter: nf_tables: set->ops->insert returns opaque set element in case of 
EEXIST
- net: ena: fix MMIO read buffer leak on probe failure
- net: ena: Remove autopolling mode
- pinctrl: sunxi: keep a shadow copy of the data register output latches
- pinctrl: sunxi: Use devm_clk_get_enabled() helpers
- pinctrl: sunxi: Refactor register/offset calculation
- net: ipconfig: bound DHCP option construction
- net: ipconfig: Remove outdated comment and indent code block
- smb: client: fix create context out-of-bounds reads
- smb3: make query_on_disk_id open context consistent and move to common code
- net: openvswitch: conntrack: fix helper UAF due to extensions realloc
- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
- perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
- tcp: prevent collapsing skbs across boundary in rtx queue
- bna: prevent IOC timer rearm during teardown
- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
- hwmon: (pwm-fan) Stop RPM timer before freeing tach data
- watchdog: rtd119x: Avoid division by zero
- watchdog: rtd119x: Use devm_clk_get_enabled() helper
- btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
- ALSA: virtio: reset device before deleting virtqueues
- smb: client: avoid leaking refcount when cifs_sb_tlink() fails
- smb: client: fix cifsFileInfo reference leak in deferred close
- smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
- ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
- net/sched: act_api: release all action references on NEWACTION failure
- ipmr: account multicast table and route memory
- f2fs: fix dentry folio leak in find_in_level
- f2fs: limit recovery filename logging to stored length
- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
- scsi: qla2xxx: Quiesce response IRQ before freeing request queue
- scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
- media: zoran: Avoid freeing a registered video_device twice
- media: saa7164: fix cleanup on resource allocation failure
- media: rkvdec: Propagate platform_get_irq() errors
- mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
- arm64: mm: Fix the lockless page-table walk in show_pte()
- arm64: allow pte_offset_map() to fail
- ftrace: Synchronize the initialization of ftrace_ops
- staging: sm750fb: fix mono image source stride mismatch in 
lynxfb_ops_imageblit()
- spi: bcm63xx: disable clock on resume failure
- usb: gadget: f_mass_storage: fix null pointer dereference in 
fsg_common_set_num_buffers()
- i3c: master: Fix use-after-free of master->this
- i3c: master: Do not treat master device as a duplicate target
- hwrng: stm32 - Fix runtime PM cleanup on registration failure
- mmc: via-sdmmc: cancel card-detect work on remove
- power: supply: max17040: drop incorrect I2C functionality check
- power: supply: max17040: Convert to i2c's .probe_new()
- i2c: core: Introduce i2c_client_get_device_id helper function
- power: supply: rt9455: quiesce delayed work before teardown
- power: supply: rt9455: Convert to i2c's .probe_new()
- lockd: fix swapped arguments in nlmsvc_match_ip()
- i2c: mxs: fix DMA channel leak on probe error
- dmaengine: Add devm_dma_request_chan()
- params: fix charp corruption on allocation failure
- params: Fix multi-line comment style
- params: Sort headers
- params: Use size_add() for kmalloc()
- params: Do not go over the limit when getting the string length
- kernel/params.c: Use kstrtobool() instead of strtobool()
- coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
- cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
- nfsd: gate nfs2 setacl by argp->mask
- nfsd: fix clock domain mismatch in clients_still_reclaiming()
- nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
- nfsd: size fh_verify server sockaddr slot by xpt_locallen
- nfsd: release path refs on follow_down() error
- zram: fix out-of-bounds access in read_block_state()
- zram: fixup read_block_state()
- KEYS: trusted: Fix TPM teardown ordering
- gtp: serialize PDP context updates
- usb: xhci: bail out of setup if the controller is inaccessible
- perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
- perf tools: Fix a asan issue in parse_events_multi_pmu_add()
- vlan: require the MAC header to be present in __vlan_insert_inner_tag()
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- smb: client: fix potential OOB read in smb3_enum_snapshots()
- wifi: libipw: reject TKIP frames without a full MIC
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
- smb: client: fix heap overflow in DACL owner/group rewrite
- smb: client: avoid leaking refcount in cifs_queue_oplock_break()
- smb: client: reject userspace cifs.idmap descriptions
- net: bridge: use option bits for CFM/MRP frame handlers
- io_uring/rw: end write accounting from ->ki_complete
- genetlink: pin family module during policy dump
- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
- Bluetooth: btqcomsmd: Convert to platform remove callback returning void
- tick/broadcast: Plug clockevents replacement race
- f2fs: embed f2fs_gc_kthread in f2fs_sb_info
- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
- KVM: s390: Zero initialize data structures for inject_pfault_token
- nvme: add missing SRCU grace period in error path
- kprobes: Protect kprobe_blacklist with RCU
- ftrace: Take trace_array reference before accessing its ftrace_ops
- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
- staging: rtl8723bs: fix spacing around operators
- usb: storage: realtek_cr: fix use-after-free on disconnect
- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
- nvme-tcp: fix host memory disclosure on R2T for a read command
- nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()
- ocfs2: validate directory-index entry counts when reading metadata
- ocfs2: validate dx_root extent list fields during block read
- nouveau/gem: reserve the bo in the info ioctl around the vma lookup
- HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
- ceph: bound copied dentry name length in NFS export get_name
- nfsd: fix nfsd_file leak on inter-server COPY setup failure
- device property: fix infinite loop in fwnode_for_each_child_node()
- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup.
- apparmor: fix out-of-bounds write when null terminating a label vec
- tls: device: fix out-of-bounds write in tls_append_frag()
+ UBUNTU: Upstream stable to v5.15.224

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172857

Title:
  Jammy update: v5.15.224 upstream stable release

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172857/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs