Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.166 upstream stable release
from git://git.kernel.org/
fuse: Initialize beyond-EOF page contents before setting uptodate
char: xillybus: Don't destroy workqueue from work item running on it
char: xillybus: Refine workqueue handling
char: xillybus: Check USB endpoints when probing device
ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
ALSA: usb-audio: Support Yamaha P-125 quirk entry
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
thunderbolt: Mark XDomain as unplugged when router is removed
s390/dasd: fix error recovery leading to data corruption on ESE devices
arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
dm resume: don't return EINVAL when signalled
dm persistent data: fix memory allocation failure
vfs: Don't evict inode under the inode lru traversing context
fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
s390/cio: rename bitmap_size() -> idset_bitmap_size()
btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
bitmap: introduce generic optimized bitmap_size()
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
selinux: fix potential counting error in avc_add_xperms_decision()
btrfs: tree-checker: add dev extent item checks
drm/amdgpu: Actually check flags for all context ops.
memcg_write_event_control(): fix a user-triggerable oops
drm/amdgpu/jpeg2: properly set atomics vmid field
s390/uv: Panic for set and remove shared access UVC errors
igc: Correct the launchtime offset
igc: remove I226 Qbv BaseTime restriction
igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
net/mlx5e: Correctly report errors for ethtool rx flows
atm: idt77252: prevent use after free in dequeue_rx()
net: axienet: Fix register defines comment description
net: dsa: vsc73xx: pass value in phy_write operation
net: dsa: vsc73xx: use read_poll_timeout instead delay loop
net: dsa: vsc73xx: check busy flag in MDIO operations
mlxbf_gige: Remove two unused function declarations
mlxbf_gige: disable RX filters until RX path initialized
mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
netfilter: allow ipv6 fragments to arrive on different devices
netfilter: flowtable: initialise extack before use
netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
net: hns3: fix wrong use of semaphore up
net: hns3: fix a deadlock problem when config TC during resetting
ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
ssb: Fix division by zero issue in ssb_calc_clock_rate
wifi: cfg80211: check wiphy mutex is held for wdev mutex
wifi: mac80211: fix BA session teardown race
wifi: cw1200: Avoid processing an invalid TIM IE
i2c: riic: avoid potential division by zero
RDMA/rtrs: Fix the problem of variable not initialized fully
s390/smp,mcck: fix early IPI handling
i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
media: radio-isa: use dev_name to fill in bus_info
staging: iio: resolver: ad2s1210: fix use before initialization
drm/amd/display: Validate hw_points_num before using it
staging: ks7010: disable bh on tx_dev_lock
binfmt_misc: cleanup on filesystem umount
media: qcom: venus: fix incorrect return value
scsi: spi: Fix sshdr use
gfs2: setattr_chown: Add missing initialization
wifi: iwlwifi: abort scan when rfkill on but device enabled
wifi: iwlwifi: fw: Fix debugfs command sending
IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
hwmon: (ltc2992) Avoid division by zero
arm64: Fix KASAN random tag seed initialization
memory: tegra: Skip SID programming if SID registers aren't set
powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
nvmet-trace: avoid dereferencing pointer too early
ext4: do not trim the group with corrupted block bitmap
afs: fix __afs_break_callback() / afs_drop_open_mmap() race
fuse: fix UAF in rcu pathwalks
quota: Remove BUG_ON from dqget()
media: pci: cx23885: check cx23885_vdev_init() return
fs: binfmt_elf_efpic: don't use missing interpreter's properties
scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
media: drivers/media/dvb-core: copy user arrays safely
net/sun3_82586: Avoid reading past buffer in debug output
drm/lima: set gp bus_stop bit before hard reset
virtiofs: forbid newlines in tags
clocksource/drivers/arm_global_timer: Guard against division by zero
netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
md: clean up invalid BUG_ON in md_ioctl
x86: Increase brk randomness entropy for 64-bit systems
memory: stm32-fmc2-ebi: check regmap_read return value
parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
powerpc/boot: Handle allocation failure in simple_realloc()
powerpc/boot: Only free if realloc() succeeds
btrfs: change BUG_ON to assertion when checking for delayed_node root
btrfs: handle invalid root reference found in may_destroy_subvol()
btrfs: send: handle unexpected data in header buffer in begin_cmd()
btrfs: change BUG_ON to assertion in tree_move_down()
btrfs: delete pointless BUG_ON check on quota root in
btrfs_qgroup_account_extent()
f2fs: fix to do sanity check in update_sit_entry
usb: gadget: fsl: Increase size of name buffer for endpoints
Bluetooth: bnep: Fix out-of-bound access
net: hns3: add checking for vf id of mailbox
nvmet-tcp: do not continue for invalid icreq
NFS: avoid infinite loop in pnfs_update_layout.
openrisc: Call setup_memory() earlier in the init sequence
s390/iucv: fix receive buffer virtual vs physical address confusion
clocksource: Make watchdog and suspend-timing multiplication overflow safe
platform/x86: lg-laptop: fix %s null argument warning
usb: dwc3: core: Skip setting event buffers for host only controllers
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
ext4: set the type of max_zeroout to unsigned int to avoid overflow
nvmet-rdma: fix possible bad dereference when freeing rsps
hrtimer: Prevent queuing of hrtimer without a function callback
gtp: pull network headers in gtp_dev_xmit()
block: use "unsigned long" for blk_validate_block_size().
nfsd: move reply cache initialization into nfsd startup
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
NFSD: Refactor nfsd_reply_cache_free_locked()
NFSD: Rename nfsd_reply_cache_alloc()
NFSD: Replace nfsd_prune_bucket()
NFSD: Refactor the duplicate reply cache shrinker
NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
NFSD: Fix frame size warning in svc_export_parse()
sunrpc: don't change ->sv_stats if it doesn't exist
nfsd: stop setting ->pg_stats for unused stats
sunrpc: pass in the sv_stats struct through svc_create_pooled
sunrpc: remove ->pg_stats from svc_program
sunrpc: use the struct net as the svc proc private
nfsd: rename NFSD_NET_* to NFSD_STATS_*
nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
nfsd: make all of the nfsd stats per-network namespace
nfsd: remove nfsd_stats, make th_cnt a global counter
nfsd: make svc_stat per-network namespace instead of global
media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
dm suspend: return -ERESTARTSYS instead of -EINTR
net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell
rings
platform/surface: aggregator: Fix warning when controller is destroyed in probe
Bluetooth: hci_core: Fix LE quote calculation
Bluetooth: SMP: Fix assumption of Central always being Initiator
tc-testing: don't access non-existent variable on exception
kcm: Serialise kcm_sendmsg() for the same socket.
netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
ip6_tunnel: Fix broken GRO
bonding: fix bond_ipsec_offload_ok return type
bonding: fix null pointer deref in bond_ipsec_offload_ok
bonding: fix xfrm real_dev null pointer dereference
bonding: fix xfrm state handling when clearing active slave
ice: fix ICE_LAST_OFFSET formula
dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
net: dsa: mv88e6xxx: read FID when handling ATU violations
net: dsa: mv88e6xxx: replace ATU violation prints with trace points
net: dsa: mv88e6xxx: Fix out-of-bound access
netem: fix return value if duplicate enqueue fails
ipv6: prevent UAF in ip6_send_skb()
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: prevent possible UAF in ip6_xmit()
netfilter: flowtable: validate vlan header
net: xilinx: axienet: Always disable promiscuous mode
net: xilinx: axienet: Fix dangling multicast addresses
drm/msm/dpu: don't play tricks with debug macros
drm/msm/dp: reset the link phy params before link training
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
mmc: mmc_test: Fix NULL dereference on allocation failure
Bluetooth: MGMT: Add error handling to pair_device()
scsi: core: Fix the return value of scsi_logical_block_count()
MIPS: Loongson64: Set timer mode in cpu-probe
HID: wacom: Defer calculation of resolution until resolution_code is known
HID: microsoft: Add rumble support to latest xbox controllers
cxgb4: add forgotten u64 ivlan cast before shift
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
mmc: dw_mmc: allow biu and ciu clocks to defer
Revert "drm/amd/display: Validate hw_points_num before using it"
hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
ALSA: timer: Relax start tick time check for slave timer elements
mm/numa: no task_numa_fault() call if PMD is changed
mm/numa: no task_numa_fault() call if PTE is changed
Input: MT - limit max slots
tools: move alignment-related macros to new <linux/align.h>
btrfs: run delayed iputs when flushing delalloc
pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
pinctrl: single: fix potential NULL dereference in pcs_get_function()
wifi: mwifiex: duplicate static structs used in driver instances
net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
mptcp: sched: check both backup in retrans
Revert "MIPS: Loongson64: reset: Prioritise firmware service"
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
ata: libata-core: Fix null pointer dereference on error
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
net:rds: Fix possible deadlock in rds_message_put
soundwire: stream: fix programming slave ports for non-continous port maps
PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro
PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros
PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro
phy: xilinx: add runtime PM support
phy: xilinx: phy-zynqmp: dynamic clock support for power-save
phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
dmaengine: dw: Add peripheral bus width verification
dmaengine: dw: Add memory bus width verification
ethtool: check device is present when getting link settings
gtp: fix a potential NULL pointer dereference
net: busy-poll: use ktime_get_ns() instead of local_clock()
nfc: pn533: Add poll mod list filling check
soc: qcom: cmd-db: Map shared memory as WC, not WB
cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
USB: serial: option: add MeiG Smart SRM825L
usb: dwc3: omap: add missing depopulate in probe error path
usb: dwc3: core: Prevent USB core invalid event buffer address access
usb: dwc3: st: fix probed platform device ref count on probe error path
usb: dwc3: st: add missing depopulate in probe error path
usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
remove_power_attributes()
usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
usb: cdnsp: fix for Link TRB with TC
phy: zynqmp: Enable reference clock correctly
igc: Fix reset adapter logics when tx mode change
igc: Fix qbv tx latency by setting gtxoffset
scsi: aacraid: Fix double-free on probe failure
apparmor: fix policy_unpack_test on big endian systems
Linux 5.15.166
UBUNTU: Upstream stable to v5.15.166
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Koichiro Den (koichiroden)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Koichiro Den (koichiroden)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.166 upstream stable release
from git://git.kernel.org/
-
+ fuse: Initialize beyond-EOF page contents before setting uptodate
+ char: xillybus: Don't destroy workqueue from work item running on it
+ char: xillybus: Refine workqueue handling
+ char: xillybus: Check USB endpoints when probing device
+ ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
+ ALSA: usb-audio: Support Yamaha P-125 quirk entry
+ xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
+ thunderbolt: Mark XDomain as unplugged when router is removed
+ s390/dasd: fix error recovery leading to data corruption on ESE devices
+ arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
NUMA_NO_NODE
+ dm resume: don't return EINVAL when signalled
+ dm persistent data: fix memory allocation failure
+ vfs: Don't evict inode under the inode lru traversing context
+ fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
+ s390/cio: rename bitmap_size() -> idset_bitmap_size()
+ btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
+ bitmap: introduce generic optimized bitmap_size()
+ fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
+ selinux: fix potential counting error in avc_add_xperms_decision()
+ btrfs: tree-checker: add dev extent item checks
+ drm/amdgpu: Actually check flags for all context ops.
+ memcg_write_event_control(): fix a user-triggerable oops
+ drm/amdgpu/jpeg2: properly set atomics vmid field
+ s390/uv: Panic for set and remove shared access UVC errors
+ igc: Correct the launchtime offset
+ igc: remove I226 Qbv BaseTime restriction
+ igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
+ net/mlx5e: Correctly report errors for ethtool rx flows
+ atm: idt77252: prevent use after free in dequeue_rx()
+ net: axienet: Fix register defines comment description
+ net: dsa: vsc73xx: pass value in phy_write operation
+ net: dsa: vsc73xx: use read_poll_timeout instead delay loop
+ net: dsa: vsc73xx: check busy flag in MDIO operations
+ mlxbf_gige: Remove two unused function declarations
+ mlxbf_gige: disable RX filters until RX path initialized
+ mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
+ netfilter: allow ipv6 fragments to arrive on different devices
+ netfilter: flowtable: initialise extack before use
+ netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
+ net: hns3: fix wrong use of semaphore up
+ net: hns3: fix a deadlock problem when config TC during resetting
+ ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
+ ssb: Fix division by zero issue in ssb_calc_clock_rate
+ wifi: cfg80211: check wiphy mutex is held for wdev mutex
+ wifi: mac80211: fix BA session teardown race
+ wifi: cw1200: Avoid processing an invalid TIM IE
+ i2c: riic: avoid potential division by zero
+ RDMA/rtrs: Fix the problem of variable not initialized fully
+ s390/smp,mcck: fix early IPI handling
+ i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
+ i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
+ media: radio-isa: use dev_name to fill in bus_info
+ staging: iio: resolver: ad2s1210: fix use before initialization
+ drm/amd/display: Validate hw_points_num before using it
+ staging: ks7010: disable bh on tx_dev_lock
+ binfmt_misc: cleanup on filesystem umount
+ media: qcom: venus: fix incorrect return value
+ scsi: spi: Fix sshdr use
+ gfs2: setattr_chown: Add missing initialization
+ wifi: iwlwifi: abort scan when rfkill on but device enabled
+ wifi: iwlwifi: fw: Fix debugfs command sending
+ IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
+ hwmon: (ltc2992) Avoid division by zero
+ arm64: Fix KASAN random tag seed initialization
+ memory: tegra: Skip SID programming if SID registers aren't set
+ powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
+ nvmet-trace: avoid dereferencing pointer too early
+ ext4: do not trim the group with corrupted block bitmap
+ afs: fix __afs_break_callback() / afs_drop_open_mmap() race
+ fuse: fix UAF in rcu pathwalks
+ quota: Remove BUG_ON from dqget()
+ media: pci: cx23885: check cx23885_vdev_init() return
+ fs: binfmt_elf_efpic: don't use missing interpreter's properties
+ scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
+ media: drivers/media/dvb-core: copy user arrays safely
+ net/sun3_82586: Avoid reading past buffer in debug output
+ drm/lima: set gp bus_stop bit before hard reset
+ virtiofs: forbid newlines in tags
+ clocksource/drivers/arm_global_timer: Guard against division by zero
+ netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
+ md: clean up invalid BUG_ON in md_ioctl
+ x86: Increase brk randomness entropy for 64-bit systems
+ memory: stm32-fmc2-ebi: check regmap_read return value
+ parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
+ powerpc/boot: Handle allocation failure in simple_realloc()
+ powerpc/boot: Only free if realloc() succeeds
+ btrfs: change BUG_ON to assertion when checking for delayed_node root
+ btrfs: handle invalid root reference found in may_destroy_subvol()
+ btrfs: send: handle unexpected data in header buffer in begin_cmd()
+ btrfs: change BUG_ON to assertion in tree_move_down()
+ btrfs: delete pointless BUG_ON check on quota root in
btrfs_qgroup_account_extent()
+ f2fs: fix to do sanity check in update_sit_entry
+ usb: gadget: fsl: Increase size of name buffer for endpoints
+ Bluetooth: bnep: Fix out-of-bound access
+ net: hns3: add checking for vf id of mailbox
+ nvmet-tcp: do not continue for invalid icreq
+ NFS: avoid infinite loop in pnfs_update_layout.
+ openrisc: Call setup_memory() earlier in the init sequence
+ s390/iucv: fix receive buffer virtual vs physical address confusion
+ clocksource: Make watchdog and suspend-timing multiplication overflow safe
+ platform/x86: lg-laptop: fix %s null argument warning
+ usb: dwc3: core: Skip setting event buffers for host only controllers
+ irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
+ ext4: set the type of max_zeroout to unsigned int to avoid overflow
+ nvmet-rdma: fix possible bad dereference when freeing rsps
+ hrtimer: Prevent queuing of hrtimer without a function callback
+ gtp: pull network headers in gtp_dev_xmit()
+ block: use "unsigned long" for blk_validate_block_size().
+ nfsd: move reply cache initialization into nfsd startup
+ nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
+ NFSD: Refactor nfsd_reply_cache_free_locked()
+ NFSD: Rename nfsd_reply_cache_alloc()
+ NFSD: Replace nfsd_prune_bucket()
+ NFSD: Refactor the duplicate reply cache shrinker
+ NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
+ NFSD: Fix frame size warning in svc_export_parse()
+ sunrpc: don't change ->sv_stats if it doesn't exist
+ nfsd: stop setting ->pg_stats for unused stats
+ sunrpc: pass in the sv_stats struct through svc_create_pooled
+ sunrpc: remove ->pg_stats from svc_program
+ sunrpc: use the struct net as the svc proc private
+ nfsd: rename NFSD_NET_* to NFSD_STATS_*
+ nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
+ nfsd: make all of the nfsd stats per-network namespace
+ nfsd: remove nfsd_stats, make th_cnt a global counter
+ nfsd: make svc_stat per-network namespace instead of global
+ media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
+ dm suspend: return -ERESTARTSYS instead of -EINTR
+ net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell
rings
+ platform/surface: aggregator: Fix warning when controller is destroyed in
probe
+ Bluetooth: hci_core: Fix LE quote calculation
+ Bluetooth: SMP: Fix assumption of Central always being Initiator
+ tc-testing: don't access non-existent variable on exception
+ kcm: Serialise kcm_sendmsg() for the same socket.
+ netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
+ netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
+ ip6_tunnel: Fix broken GRO
+ bonding: fix bond_ipsec_offload_ok return type
+ bonding: fix null pointer deref in bond_ipsec_offload_ok
+ bonding: fix xfrm real_dev null pointer dereference
+ bonding: fix xfrm state handling when clearing active slave
+ ice: fix ICE_LAST_OFFSET formula
+ dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
+ net: dsa: mv88e6xxx: read FID when handling ATU violations
+ net: dsa: mv88e6xxx: replace ATU violation prints with trace points
+ net: dsa: mv88e6xxx: Fix out-of-bound access
+ netem: fix return value if duplicate enqueue fails
+ ipv6: prevent UAF in ip6_send_skb()
+ ipv6: fix possible UAF in ip6_finish_output2()
+ ipv6: prevent possible UAF in ip6_xmit()
+ netfilter: flowtable: validate vlan header
+ net: xilinx: axienet: Always disable promiscuous mode
+ net: xilinx: axienet: Fix dangling multicast addresses
+ drm/msm/dpu: don't play tricks with debug macros
+ drm/msm/dp: reset the link phy params before link training
+ drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
+ mmc: mmc_test: Fix NULL dereference on allocation failure
+ Bluetooth: MGMT: Add error handling to pair_device()
+ scsi: core: Fix the return value of scsi_logical_block_count()
+ MIPS: Loongson64: Set timer mode in cpu-probe
+ HID: wacom: Defer calculation of resolution until resolution_code is known
+ HID: microsoft: Add rumble support to latest xbox controllers
+ cxgb4: add forgotten u64 ivlan cast before shift
+ KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
+ mmc: dw_mmc: allow biu and ciu clocks to defer
+ Revert "drm/amd/display: Validate hw_points_num before using it"
+ hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
+ ALSA: timer: Relax start tick time check for slave timer elements
+ mm/numa: no task_numa_fault() call if PMD is changed
+ mm/numa: no task_numa_fault() call if PTE is changed
+ Input: MT - limit max slots
+ tools: move alignment-related macros to new <linux/align.h>
+ btrfs: run delayed iputs when flushing delalloc
+ pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
+ pinctrl: single: fix potential NULL dereference in pcs_get_function()
+ wifi: mwifiex: duplicate static structs used in driver instances
+ net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
+ mptcp: sched: check both backup in retrans
+ Revert "MIPS: Loongson64: reset: Prioritise firmware service"
+ drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
+ ata: libata-core: Fix null pointer dereference on error
+ cgroup/cpuset: Prevent UAF in proc_cpuset_show()
+ net:rds: Fix possible deadlock in rds_message_put
+ soundwire: stream: fix programming slave ports for non-continous port maps
+ PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro
+ PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros
+ PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro
+ phy: xilinx: add runtime PM support
+ phy: xilinx: phy-zynqmp: dynamic clock support for power-save
+ phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
+ dmaengine: dw: Add peripheral bus width verification
+ dmaengine: dw: Add memory bus width verification
+ ethtool: check device is present when getting link settings
+ gtp: fix a potential NULL pointer dereference
+ net: busy-poll: use ktime_get_ns() instead of local_clock()
+ nfc: pn533: Add poll mod list filling check
+ soc: qcom: cmd-db: Map shared memory as WC, not WB
+ cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
+ USB: serial: option: add MeiG Smart SRM825L
+ usb: dwc3: omap: add missing depopulate in probe error path
+ usb: dwc3: core: Prevent USB core invalid event buffer address access
+ usb: dwc3: st: fix probed platform device ref count on probe error path
+ usb: dwc3: st: add missing depopulate in probe error path
+ usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
remove_power_attributes()
+ usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
+ usb: cdnsp: fix for Link TRB with TC
+ phy: zynqmp: Enable reference clock correctly
+ igc: Fix reset adapter logics when tx mode change
+ igc: Fix qbv tx latency by setting gtxoffset
+ scsi: aacraid: Fix double-free on probe failure
+ apparmor: fix policy_unpack_test on big endian systems
Linux 5.15.166
- apparmor: fix policy_unpack_test on big endian systems
- scsi: aacraid: Fix double-free on probe failure
- igc: Fix qbv tx latency by setting gtxoffset
- igc: Fix reset adapter logics when tx mode change
- phy: zynqmp: Enable reference clock correctly
- usb: cdnsp: fix for Link TRB with TC
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
remove_power_attributes()
- usb: dwc3: st: add missing depopulate in probe error path
- usb: dwc3: st: fix probed platform device ref count on probe error path
- usb: dwc3: core: Prevent USB core invalid event buffer address access
- usb: dwc3: omap: add missing depopulate in probe error path
- USB: serial: option: add MeiG Smart SRM825L
- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
- soc: qcom: cmd-db: Map shared memory as WC, not WB
- nfc: pn533: Add poll mod list filling check
- net: busy-poll: use ktime_get_ns() instead of local_clock()
- gtp: fix a potential NULL pointer dereference
- ethtool: check device is present when getting link settings
- dmaengine: dw: Add memory bus width verification
- dmaengine: dw: Add peripheral bus width verification
- phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
- phy: xilinx: phy-zynqmp: dynamic clock support for power-save
- phy: xilinx: add runtime PM support
- PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro
- PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros
- PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro
- soundwire: stream: fix programming slave ports for non-continous port maps
- net:rds: Fix possible deadlock in rds_message_put
- cgroup/cpuset: Prevent UAF in proc_cpuset_show()
- ata: libata-core: Fix null pointer dereference on error
- drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
- Revert "MIPS: Loongson64: reset: Prioritise firmware service"
- mptcp: sched: check both backup in retrans
- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
- wifi: mwifiex: duplicate static structs used in driver instances
- pinctrl: single: fix potential NULL dereference in pcs_get_function()
- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
- btrfs: run delayed iputs when flushing delalloc
- drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
- tools: move alignment-related macros to new <linux/align.h>
- Input: MT - limit max slots
- Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
- mm/numa: no task_numa_fault() call if PTE is changed
- mm/numa: no task_numa_fault() call if PMD is changed
- ALSA: timer: Relax start tick time check for slave timer elements
- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
- Revert "drm/amd/display: Validate hw_points_num before using it"
- mmc: dw_mmc: allow biu and ciu clocks to defer
- KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
- cxgb4: add forgotten u64 ivlan cast before shift
- HID: microsoft: Add rumble support to latest xbox controllers
- HID: wacom: Defer calculation of resolution until resolution_code is known
- MIPS: Loongson64: Set timer mode in cpu-probe
- scsi: core: Fix the return value of scsi_logical_block_count()
- Bluetooth: MGMT: Add error handling to pair_device()
- mmc: mmc_test: Fix NULL dereference on allocation failure
- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
- drm/msm/dp: reset the link phy params before link training
- drm/msm/dpu: don't play tricks with debug macros
- net: xilinx: axienet: Fix dangling multicast addresses
- net: xilinx: axienet: Always disable promiscuous mode
- netfilter: flowtable: validate vlan header
- ipv6: prevent possible UAF in ip6_xmit()
- ipv6: fix possible UAF in ip6_finish_output2()
- ipv6: prevent UAF in ip6_send_skb()
- netem: fix return value if duplicate enqueue fails
- net: dsa: mv88e6xxx: Fix out-of-bound access
- net: dsa: mv88e6xxx: replace ATU violation prints with trace points
- net: dsa: mv88e6xxx: read FID when handling ATU violations
- dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
- ice: fix ICE_LAST_OFFSET formula
- bonding: fix xfrm state handling when clearing active slave
- bonding: fix xfrm real_dev null pointer dereference
- bonding: fix null pointer deref in bond_ipsec_offload_ok
- bonding: fix bond_ipsec_offload_ok return type
- ip6_tunnel: Fix broken GRO
- netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
- netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
- kcm: Serialise kcm_sendmsg() for the same socket.
- tc-testing: don't access non-existent variable on exception
- Bluetooth: SMP: Fix assumption of Central always being Initiator
- Bluetooth: hci_core: Fix LE quote calculation
- platform/surface: aggregator: Fix warning when controller is destroyed in
probe
- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell
rings
- dm suspend: return -ERESTARTSYS instead of -EINTR
- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
- nfsd: make svc_stat per-network namespace instead of global
- nfsd: remove nfsd_stats, make th_cnt a global counter
- nfsd: make all of the nfsd stats per-network namespace
- nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
- nfsd: rename NFSD_NET_* to NFSD_STATS_*
- sunrpc: use the struct net as the svc proc private
- sunrpc: remove ->pg_stats from svc_program
- sunrpc: pass in the sv_stats struct through svc_create_pooled
- nfsd: stop setting ->pg_stats for unused stats
- sunrpc: don't change ->sv_stats if it doesn't exist
- NFSD: Fix frame size warning in svc_export_parse()
- NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
- NFSD: Refactor the duplicate reply cache shrinker
- NFSD: Replace nfsd_prune_bucket()
- NFSD: Rename nfsd_reply_cache_alloc()
- NFSD: Refactor nfsd_reply_cache_free_locked()
- nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
- nfsd: move reply cache initialization into nfsd startup
- block: use "unsigned long" for blk_validate_block_size().
- gtp: pull network headers in gtp_dev_xmit()
- hrtimer: Prevent queuing of hrtimer without a function callback
- nvmet-rdma: fix possible bad dereference when freeing rsps
- ext4: set the type of max_zeroout to unsigned int to avoid overflow
- irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
- usb: dwc3: core: Skip setting event buffers for host only controllers
- platform/x86: lg-laptop: fix %s null argument warning
- clocksource: Make watchdog and suspend-timing multiplication overflow safe
- s390/iucv: fix receive buffer virtual vs physical address confusion
- openrisc: Call setup_memory() earlier in the init sequence
- NFS: avoid infinite loop in pnfs_update_layout.
- nvmet-tcp: do not continue for invalid icreq
- net: hns3: add checking for vf id of mailbox
- Bluetooth: bnep: Fix out-of-bound access
- usb: gadget: fsl: Increase size of name buffer for endpoints
- f2fs: fix to do sanity check in update_sit_entry
- btrfs: delete pointless BUG_ON check on quota root in
btrfs_qgroup_account_extent()
- btrfs: change BUG_ON to assertion in tree_move_down()
- btrfs: send: handle unexpected data in header buffer in begin_cmd()
- btrfs: handle invalid root reference found in may_destroy_subvol()
- btrfs: change BUG_ON to assertion when checking for delayed_node root
- powerpc/boot: Only free if realloc() succeeds
- powerpc/boot: Handle allocation failure in simple_realloc()
- parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
- memory: stm32-fmc2-ebi: check regmap_read return value
- x86: Increase brk randomness entropy for 64-bit systems
- md: clean up invalid BUG_ON in md_ioctl
- netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
- clocksource/drivers/arm_global_timer: Guard against division by zero
- virtiofs: forbid newlines in tags
- drm/lima: set gp bus_stop bit before hard reset
- net/sun3_82586: Avoid reading past buffer in debug output
- media: drivers/media/dvb-core: copy user arrays safely
- scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
- fs: binfmt_elf_efpic: don't use missing interpreter's properties
- media: pci: cx23885: check cx23885_vdev_init() return
- quota: Remove BUG_ON from dqget()
- fuse: fix UAF in rcu pathwalks
- afs: fix __afs_break_callback() / afs_drop_open_mmap() race
- ext4: do not trim the group with corrupted block bitmap
- nvmet-trace: avoid dereferencing pointer too early
- powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
- memory: tegra: Skip SID programming if SID registers aren't set
- arm64: Fix KASAN random tag seed initialization
- hwmon: (ltc2992) Avoid division by zero
- IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
- wifi: iwlwifi: fw: Fix debugfs command sending
- wifi: iwlwifi: abort scan when rfkill on but device enabled
- gfs2: setattr_chown: Add missing initialization
- scsi: spi: Fix sshdr use
- media: qcom: venus: fix incorrect return value
- binfmt_misc: cleanup on filesystem umount
- staging: ks7010: disable bh on tx_dev_lock
- drm/amd/display: Validate hw_points_num before using it
- staging: iio: resolver: ad2s1210: fix use before initialization
- media: radio-isa: use dev_name to fill in bus_info
- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
- s390/smp,mcck: fix early IPI handling
- RDMA/rtrs: Fix the problem of variable not initialized fully
- i2c: riic: avoid potential division by zero
- wifi: cw1200: Avoid processing an invalid TIM IE
- wifi: mac80211: fix BA session teardown race
- wifi: cfg80211: check wiphy mutex is held for wdev mutex
- ssb: Fix division by zero issue in ssb_calc_clock_rate
- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
- net: hns3: fix a deadlock problem when config TC during resetting
- net: hns3: fix wrong use of semaphore up
- netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
- netfilter: flowtable: initialise extack before use
- netfilter: allow ipv6 fragments to arrive on different devices
- mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
- mlxbf_gige: disable RX filters until RX path initialized
- mlxbf_gige: Remove two unused function declarations
- net: dsa: vsc73xx: check busy flag in MDIO operations
- net: dsa: vsc73xx: use read_poll_timeout instead delay loop
- net: dsa: vsc73xx: pass value in phy_write operation
- net: axienet: Fix register defines comment description
- atm: idt77252: prevent use after free in dequeue_rx()
- net/mlx5e: Correctly report errors for ethtool rx flows
- igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
- igc: remove I226 Qbv BaseTime restriction
- igc: Correct the launchtime offset
- s390/uv: Panic for set and remove shared access UVC errors
- drm/amdgpu/jpeg2: properly set atomics vmid field
- memcg_write_event_control(): fix a user-triggerable oops
- drm/amdgpu: Actually check flags for all context ops.
- btrfs: tree-checker: add dev extent item checks
- selinux: fix potential counting error in avc_add_xperms_decision()
- fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
- bitmap: introduce generic optimized bitmap_size()
- btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
- s390/cio: rename bitmap_size() -> idset_bitmap_size()
- fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
- vfs: Don't evict inode under the inode lru traversing context
- dm persistent data: fix memory allocation failure
- dm resume: don't return EINVAL when signalled
- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
NUMA_NO_NODE
- s390/dasd: fix error recovery leading to data corruption on ESE devices
- thunderbolt: Mark XDomain as unplugged when router is removed
- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
- ALSA: usb-audio: Support Yamaha P-125 quirk entry
- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
- char: xillybus: Check USB endpoints when probing device
- char: xillybus: Refine workqueue handling
- char: xillybus: Don't destroy workqueue from work item running on it
- fuse: Initialize beyond-EOF page contents before setting uptodate
+ UBUNTU: Upstream stable to v5.15.166
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2080594
Title:
Jammy update: v5.15.166 upstream stable release
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Jammy:
In Progress
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.166 upstream stable release
from git://git.kernel.org/
fuse: Initialize beyond-EOF page contents before setting uptodate
char: xillybus: Don't destroy workqueue from work item running on it
char: xillybus: Refine workqueue handling
char: xillybus: Check USB endpoints when probing device
ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
ALSA: usb-audio: Support Yamaha P-125 quirk entry
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
thunderbolt: Mark XDomain as unplugged when router is removed
s390/dasd: fix error recovery leading to data corruption on ESE devices
arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
NUMA_NO_NODE
dm resume: don't return EINVAL when signalled
dm persistent data: fix memory allocation failure
vfs: Don't evict inode under the inode lru traversing context
fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
s390/cio: rename bitmap_size() -> idset_bitmap_size()
btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
bitmap: introduce generic optimized bitmap_size()
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
selinux: fix potential counting error in avc_add_xperms_decision()
btrfs: tree-checker: add dev extent item checks
drm/amdgpu: Actually check flags for all context ops.
memcg_write_event_control(): fix a user-triggerable oops
drm/amdgpu/jpeg2: properly set atomics vmid field
s390/uv: Panic for set and remove shared access UVC errors
igc: Correct the launchtime offset
igc: remove I226 Qbv BaseTime restriction
igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
net/mlx5e: Correctly report errors for ethtool rx flows
atm: idt77252: prevent use after free in dequeue_rx()
net: axienet: Fix register defines comment description
net: dsa: vsc73xx: pass value in phy_write operation
net: dsa: vsc73xx: use read_poll_timeout instead delay loop
net: dsa: vsc73xx: check busy flag in MDIO operations
mlxbf_gige: Remove two unused function declarations
mlxbf_gige: disable RX filters until RX path initialized
mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
netfilter: allow ipv6 fragments to arrive on different devices
netfilter: flowtable: initialise extack before use
netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
net: hns3: fix wrong use of semaphore up
net: hns3: fix a deadlock problem when config TC during resetting
ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
ssb: Fix division by zero issue in ssb_calc_clock_rate
wifi: cfg80211: check wiphy mutex is held for wdev mutex
wifi: mac80211: fix BA session teardown race
wifi: cw1200: Avoid processing an invalid TIM IE
i2c: riic: avoid potential division by zero
RDMA/rtrs: Fix the problem of variable not initialized fully
s390/smp,mcck: fix early IPI handling
i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
media: radio-isa: use dev_name to fill in bus_info
staging: iio: resolver: ad2s1210: fix use before initialization
drm/amd/display: Validate hw_points_num before using it
staging: ks7010: disable bh on tx_dev_lock
binfmt_misc: cleanup on filesystem umount
media: qcom: venus: fix incorrect return value
scsi: spi: Fix sshdr use
gfs2: setattr_chown: Add missing initialization
wifi: iwlwifi: abort scan when rfkill on but device enabled
wifi: iwlwifi: fw: Fix debugfs command sending
IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
hwmon: (ltc2992) Avoid division by zero
arm64: Fix KASAN random tag seed initialization
memory: tegra: Skip SID programming if SID registers aren't set
powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
nvmet-trace: avoid dereferencing pointer too early
ext4: do not trim the group with corrupted block bitmap
afs: fix __afs_break_callback() / afs_drop_open_mmap() race
fuse: fix UAF in rcu pathwalks
quota: Remove BUG_ON from dqget()
media: pci: cx23885: check cx23885_vdev_init() return
fs: binfmt_elf_efpic: don't use missing interpreter's properties
scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
media: drivers/media/dvb-core: copy user arrays safely
net/sun3_82586: Avoid reading past buffer in debug output
drm/lima: set gp bus_stop bit before hard reset
virtiofs: forbid newlines in tags
clocksource/drivers/arm_global_timer: Guard against division by zero
netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
md: clean up invalid BUG_ON in md_ioctl
x86: Increase brk randomness entropy for 64-bit systems
memory: stm32-fmc2-ebi: check regmap_read return value
parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
powerpc/boot: Handle allocation failure in simple_realloc()
powerpc/boot: Only free if realloc() succeeds
btrfs: change BUG_ON to assertion when checking for delayed_node root
btrfs: handle invalid root reference found in may_destroy_subvol()
btrfs: send: handle unexpected data in header buffer in begin_cmd()
btrfs: change BUG_ON to assertion in tree_move_down()
btrfs: delete pointless BUG_ON check on quota root in
btrfs_qgroup_account_extent()
f2fs: fix to do sanity check in update_sit_entry
usb: gadget: fsl: Increase size of name buffer for endpoints
Bluetooth: bnep: Fix out-of-bound access
net: hns3: add checking for vf id of mailbox
nvmet-tcp: do not continue for invalid icreq
NFS: avoid infinite loop in pnfs_update_layout.
openrisc: Call setup_memory() earlier in the init sequence
s390/iucv: fix receive buffer virtual vs physical address confusion
clocksource: Make watchdog and suspend-timing multiplication overflow safe
platform/x86: lg-laptop: fix %s null argument warning
usb: dwc3: core: Skip setting event buffers for host only controllers
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
ext4: set the type of max_zeroout to unsigned int to avoid overflow
nvmet-rdma: fix possible bad dereference when freeing rsps
hrtimer: Prevent queuing of hrtimer without a function callback
gtp: pull network headers in gtp_dev_xmit()
block: use "unsigned long" for blk_validate_block_size().
nfsd: move reply cache initialization into nfsd startup
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
NFSD: Refactor nfsd_reply_cache_free_locked()
NFSD: Rename nfsd_reply_cache_alloc()
NFSD: Replace nfsd_prune_bucket()
NFSD: Refactor the duplicate reply cache shrinker
NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
NFSD: Fix frame size warning in svc_export_parse()
sunrpc: don't change ->sv_stats if it doesn't exist
nfsd: stop setting ->pg_stats for unused stats
sunrpc: pass in the sv_stats struct through svc_create_pooled
sunrpc: remove ->pg_stats from svc_program
sunrpc: use the struct net as the svc proc private
nfsd: rename NFSD_NET_* to NFSD_STATS_*
nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
nfsd: make all of the nfsd stats per-network namespace
nfsd: remove nfsd_stats, make th_cnt a global counter
nfsd: make svc_stat per-network namespace instead of global
media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
dm suspend: return -ERESTARTSYS instead of -EINTR
net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell
rings
platform/surface: aggregator: Fix warning when controller is destroyed in
probe
Bluetooth: hci_core: Fix LE quote calculation
Bluetooth: SMP: Fix assumption of Central always being Initiator
tc-testing: don't access non-existent variable on exception
kcm: Serialise kcm_sendmsg() for the same socket.
netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
ip6_tunnel: Fix broken GRO
bonding: fix bond_ipsec_offload_ok return type
bonding: fix null pointer deref in bond_ipsec_offload_ok
bonding: fix xfrm real_dev null pointer dereference
bonding: fix xfrm state handling when clearing active slave
ice: fix ICE_LAST_OFFSET formula
dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
net: dsa: mv88e6xxx: read FID when handling ATU violations
net: dsa: mv88e6xxx: replace ATU violation prints with trace points
net: dsa: mv88e6xxx: Fix out-of-bound access
netem: fix return value if duplicate enqueue fails
ipv6: prevent UAF in ip6_send_skb()
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: prevent possible UAF in ip6_xmit()
netfilter: flowtable: validate vlan header
net: xilinx: axienet: Always disable promiscuous mode
net: xilinx: axienet: Fix dangling multicast addresses
drm/msm/dpu: don't play tricks with debug macros
drm/msm/dp: reset the link phy params before link training
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
mmc: mmc_test: Fix NULL dereference on allocation failure
Bluetooth: MGMT: Add error handling to pair_device()
scsi: core: Fix the return value of scsi_logical_block_count()
MIPS: Loongson64: Set timer mode in cpu-probe
HID: wacom: Defer calculation of resolution until resolution_code is known
HID: microsoft: Add rumble support to latest xbox controllers
cxgb4: add forgotten u64 ivlan cast before shift
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
mmc: dw_mmc: allow biu and ciu clocks to defer
Revert "drm/amd/display: Validate hw_points_num before using it"
hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
ALSA: timer: Relax start tick time check for slave timer elements
mm/numa: no task_numa_fault() call if PMD is changed
mm/numa: no task_numa_fault() call if PTE is changed
Input: MT - limit max slots
tools: move alignment-related macros to new <linux/align.h>
btrfs: run delayed iputs when flushing delalloc
pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
pinctrl: single: fix potential NULL dereference in pcs_get_function()
wifi: mwifiex: duplicate static structs used in driver instances
net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
mptcp: sched: check both backup in retrans
Revert "MIPS: Loongson64: reset: Prioritise firmware service"
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
ata: libata-core: Fix null pointer dereference on error
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
net:rds: Fix possible deadlock in rds_message_put
soundwire: stream: fix programming slave ports for non-continous port maps
PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro
PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros
PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro
phy: xilinx: add runtime PM support
phy: xilinx: phy-zynqmp: dynamic clock support for power-save
phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
dmaengine: dw: Add peripheral bus width verification
dmaengine: dw: Add memory bus width verification
ethtool: check device is present when getting link settings
gtp: fix a potential NULL pointer dereference
net: busy-poll: use ktime_get_ns() instead of local_clock()
nfc: pn533: Add poll mod list filling check
soc: qcom: cmd-db: Map shared memory as WC, not WB
cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
USB: serial: option: add MeiG Smart SRM825L
usb: dwc3: omap: add missing depopulate in probe error path
usb: dwc3: core: Prevent USB core invalid event buffer address access
usb: dwc3: st: fix probed platform device ref count on probe error path
usb: dwc3: st: add missing depopulate in probe error path
usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
remove_power_attributes()
usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
usb: cdnsp: fix for Link TRB with TC
phy: zynqmp: Enable reference clock correctly
igc: Fix reset adapter logics when tx mode change
igc: Fix qbv tx latency by setting gtxoffset
scsi: aacraid: Fix double-free on probe failure
apparmor: fix policy_unpack_test on big endian systems
Linux 5.15.166
UBUNTU: Upstream stable to v5.15.166
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2080594/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
