Your message dated Mon, 25 Nov 2024 10:47:09 +0000
with message-id <e1tfwcx-000uvm...@fasolo.debian.org>
and subject line Bug#1062421: fixed in linux 6.1.119-1
has caused the Debian Bug report #1062421,
regarding linux-image-6.5.0-5-686-pae: [iwlegacy] kernel oops
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1062421: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1062421
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: src:linux
Version: 6.5.13-1
Severity: important
0c:00.0 Network controller: Intel Corporation PRO/Wireless 4965 AG or AGN
[Kedron] Network Connection (rev 61)
-- Package-specific info:
** Version:
Linux version 6.5.0-5-686-pae (debian-kernel@lists.debian.org) (gcc-13 (Debian
13.2.0-7) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41) #1 SMP PREEMPT_DYNAMIC
Debian 6.5.13-1 (2023-11-29)
** Command line:
BOOT_IMAGE=/boot/vmlinuz-6.5.0-5-686-pae
root=UUID=24bd6387-2e4e-4eb3-96dd-69817428d656 ro panic=15 noquiet loglevel=5
nosplash
** Tainted: W (512)
* kernel issued warning
** Kernel log:
[ 43.903258] excluding 0x3f0-0x3ff 0x4d0-0x4d7
[ 43.908023] pcmcia_socket pcmcia_socket0: cs: IO port probe 0x820-0x8ff:
[ 43.908763] clean
[ 43.918791] pcmcia_socket pcmcia_socket0: cs: IO port probe 0xc00-0xcf7:
[ 43.919335] excluding 0xc80-0xcbf
[ 43.926704] pcmcia_socket pcmcia_socket0: cs: memory probe 0x0c0000-0x0fffff:
[ 43.926723] excluding 0xc0000-0xc7fff 0xcc000-0xcffff 0xf0000-0xfffff
[ 43.929834] pcmcia_socket pcmcia_socket0: cs: memory probe
0xa0000000-0xa0ffffff:
[ 43.929869] clean
[ 43.935724] pcmcia_socket pcmcia_socket0: cs: memory probe
0x60000000-0x60ffffff:
[ 43.935755] excluding 0x60000000-0x60ffffff
[ 43.938809] pcmcia_socket pcmcia_socket0: cs: IO port probe 0xa00-0xaff:
[ 43.939652] clean
[ 44.156484] warning: `iwconfig' uses wireless extensions which will stop
working for Wi-Fi 7 hardware; use nl80211
[ 44.405062] usbcore: registered new interface driver btusb
[ 44.419090] Bluetooth: hci0: unexpected event for opcode 0x0000
[ 44.735638] input: HDA Intel Mic as
/devices/pci0000:00/0000:00:1b.0/sound/card0/input9
[ 44.736164] input: HDA Intel Headphone as
/devices/pci0000:00/0000:00:1b.0/sound/card0/input10
[ 46.527355] 8021q: 802.1Q VLAN Support v1.8
[ 47.697077] Adding 2421756k swap on /dev/sda5. Priority:-2 extents:1
across:2421756k FS
[ 49.569763] ------------[ cut here ]------------
[ 49.569771] memcpy: detected field-spanning write (size 1014) of single
field "&out_cmd->cmd.payload" at
drivers/net/wireless/intel/iwlegacy/common.c:3170 (size 320)
[ 49.569831] WARNING: CPU: 0 PID: 608 at
drivers/net/wireless/intel/iwlegacy/common.c:3170 il_enqueue_hcmd+0x34f/0x41c
[iwlegacy]
[ 49.569856] Modules linked in: 8021q garp stp mrp llc snd_hda_codec_hdmi
btusb btrtl btbcm snd_hda_codec_idt ppdev btintel snd_hda_codec_generic btmtk
dell_rbtn iwl4965 bluetooth iwlegacy dell_laptop snd_hda_intel ledtrig_audio
sha3_generic snd_intel_dspcfg mac80211 dell_smm_hwmon snd_intel_sdw_acpi
jitterentropy_rng snd_hda_codec sha512_generic pcmcia ctr libarc4 dell_wmi
snd_hda_core drbg iTCO_wdt ansi_cprng cfg80211 intel_pmc_bxt dell_smbios
snd_hwdep yenta_socket ecdh_generic sparse_keymap pcmcia_rsrc dcdbas
iTCO_vendor_support watchdog dell_wmi_descriptor rfkill snd_pcm pcmcia_core
wmi_bmof snd_timer ecc acpi_cpufreq snd at24 soundcore parport_pc button ac
parport evdev joydev sg serio_raw binfmt_misc msr ecryptfs dm_mod fuse loop
efi_pstore dax configfs nfnetlink ip_tables x_tables autofs4 drivetemp ext4
crc16 mbcache jbd2 btrfs blake2b_generic sr_mod cdrom xor raid6_pq libcrc32c
crc32c_generic uas usb_storage i915 sd_mod t10_pi crc64_rocksoft crc64
crc_t10dif i2c_algo_bit crct10dif_generic crct10dif_common
[ 49.570042] drm_buddy ata_generic drm_display_helper ata_piix
drm_kms_helper cec rc_core libata sdhci_pci ttm uhci_hcd ehci_pci ehci_hcd
cqhci firewire_ohci scsi_mod drm tg3 firewire_core coretemp sdhci i2c_i801
usbcore psmouse libphy mmc_core lpc_ich i2c_smbus crc_itu_t scsi_common
usb_common battery video wmi
[ 49.570105] CPU: 0 PID: 608 Comm: wpa_supplicant Not tainted 6.5.0-5-686-pae
#1 Debian 6.5.13-1
[ 49.570112] Hardware name: Dell Inc. Latitude D430
/000007, BIOS A01 06/20/2007
[ 49.570115] EIP: il_enqueue_hcmd+0x34f/0x41c [iwlegacy]
[ 49.570129] Code: f8 00 0f 85 62 fe ff ff 89 45 d0 c6 05 6a a1 f0 f8 01 68
40 01 00 00 68 08 ec f0 f8 51 89 4d d4 68 5c ec f0 f8 e8 51 5c 17 dc <0f> 0b 8b
45 d0 8b 4d d4 83 c4 10 e9 30 fe ff ff 90 8b 7d f0 ba 28
[ 49.570135] EAX: 00000099 EBX: c4016cf0 ECX: f5bdbf44 EDX: f5bdbf40
[ 49.570139] ESI: c44b4f00 EDI: c13c1a88 EBP: c13c1a28 ESP: c13c19e8
[ 49.570144] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010082
[ 49.570149] CR0: 80050033 CR2: b7ee89a0 CR3: 0475c000 CR4: 000006f0
[ 49.570155] Call Trace:
[ 49.570161] ? show_regs+0x4f/0x58
[ 49.570173] ? il_enqueue_hcmd+0x34f/0x41c [iwlegacy]
[ 49.570185] ? __warn+0x74/0x128
[ 49.570192] ? il_enqueue_hcmd+0x34f/0x41c [iwlegacy]
[ 49.570204] ? report_bug+0x170/0x194
[ 49.570213] ? exc_overflow+0x38/0x38
[ 49.570221] ? handle_bug+0x2d/0x58
[ 49.570228] ? exc_invalid_op+0x18/0x54
[ 49.570234] ? handle_exception+0x133/0x133
[ 49.570242] ? exc_overflow+0x38/0x38
[ 49.570249] ? il_enqueue_hcmd+0x34f/0x41c [iwlegacy]
[ 49.570262] ? exc_overflow+0x38/0x38
[ 49.570268] ? il_enqueue_hcmd+0x34f/0x41c [iwlegacy]
[ 49.570282] ? kmem_cache_alloc_node+0x172/0x478
[ 49.570291] il_send_cmd_sync+0x43/0x330 [iwlegacy]
[ 49.570304] ? il_fill_probe_req+0x7c/0xb0 [iwlegacy]
[ 49.570318] il4965_request_scan+0x466/0x690 [iwl4965]
[ 49.570333] ? try_to_grab_pending+0x75/0x154
[ 49.570341] ? il4965_hwrate_to_mac80211_idx+0x74/0x74 [iwl4965]
[ 49.570355] il_mac_hw_scan+0x115/0x178 [iwlegacy]
[ 49.570368] ? il_set_tx_power+0x158/0x158 [iwlegacy]
[ 49.570381] drv_hw_scan+0x9a/0x14c [mac80211]
[ 49.570471] __ieee80211_start_scan+0x20a/0x688 [mac80211]
[ 49.570543] ? sock_fasync+0x70/0x70
[ 49.570552] ieee80211_request_scan+0x27/0x40 [mac80211]
[ 49.570592] ieee80211_scan+0x53/0xbc [mac80211]
[ 49.570592] rdev_scan+0x26/0xbc [cfg80211]
[ 49.570592] cfg80211_scan+0xee/0x114 [cfg80211]
[ 49.570592] nl80211_trigger_scan+0x394/0x6fc [cfg80211]
[ 49.570592] genl_rcv_msg+0x296/0x498
[ 49.570592] ? __cfg80211_rdev_from_attrs+0x1bc/0x1bc [cfg80211]
[ 49.570592] ? nl80211_send_scan_start+0x94/0x94 [cfg80211]
[ 49.570592] ? nl80211_add_commands_unsplit+0x71c/0x71c [cfg80211]
[ 49.570592] ? genl_family_rcv_msg_attrs_parse.isra.0+0xdc/0xdc
[ 49.570592] netlink_rcv_skb+0x46/0xdc
[ 49.570592] genl_rcv+0x21/0x30
[ 49.570592] netlink_unicast+0x187/0x2e4
[ 49.570592] netlink_sendmsg+0x28f/0x490
[ 49.570592] ? netlink_unicast+0x2e4/0x2e4
[ 49.570592] ____sys_sendmsg+0x305/0x320
[ 49.570592] ___sys_sendmsg+0x8d/0xb8
[ 49.570592] __sys_sendmsg+0x58/0x9c
[ 49.570592] __ia32_sys_socketcall+0x316/0x33c
[ 49.570592] __do_fast_syscall_32+0x68/0xb0
[ 49.570592] ? exit_to_user_mode_prepare+0x32/0x168
[ 49.570592] ? irqentry_exit_to_user_mode+0x16/0x18
[ 49.570592] do_fast_syscall_32+0x29/0x60
[ 49.570592] do_SYSENTER_32+0x15/0x18
[ 49.570592] entry_SYSENTER_32+0x98/0xf1
[ 49.570592] EIP: 0xb7f1e579
[ 49.570592] Code: c4 01 10 03 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4
01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59
c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
[ 49.570592] EAX: ffffffda EBX: 00000010 ECX: bfd3eb60 EDX: 00000000
[ 49.570592] ESI: b761dff4 EDI: 01be3390 EBP: 01be3310 ESP: bfd3eb50
[ 49.570592] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000282
[ 49.570592] ---[ end trace 0000000000000000 ]---
** Model information
** Loaded modules:
qrtr
ccm
uinput
8021q
garp
stp
mrp
llc
snd_hda_codec_hdmi
btusb
btrtl
btbcm
snd_hda_codec_idt
ppdev
btintel
snd_hda_codec_generic
btmtk
dell_rbtn
iwl4965
bluetooth
iwlegacy
dell_laptop
snd_hda_intel
ledtrig_audio
sha3_generic
snd_intel_dspcfg
mac80211
dell_smm_hwmon
snd_intel_sdw_acpi
jitterentropy_rng
snd_hda_codec
sha512_generic
pcmcia
ctr
libarc4
dell_wmi
snd_hda_core
drbg
iTCO_wdt
ansi_cprng
cfg80211
intel_pmc_bxt
dell_smbios
snd_hwdep
yenta_socket
ecdh_generic
sparse_keymap
pcmcia_rsrc
dcdbas
iTCO_vendor_support
watchdog
dell_wmi_descriptor
rfkill
snd_pcm
pcmcia_core
wmi_bmof
snd_timer
ecc
acpi_cpufreq
snd
at24
soundcore
parport_pc
button
ac
parport
evdev
joydev
sg
serio_raw
binfmt_misc
msr
ecryptfs
dm_mod
fuse
loop
efi_pstore
dax
configfs
nfnetlink
ip_tables
x_tables
autofs4
drivetemp
ext4
crc16
mbcache
jbd2
btrfs
blake2b_generic
sr_mod
cdrom
xor
raid6_pq
libcrc32c
crc32c_generic
uas
usb_storage
i915
sd_mod
t10_pi
crc64_rocksoft
crc64
crc_t10dif
i2c_algo_bit
crct10dif_generic
crct10dif_common
drm_buddy
ata_generic
drm_display_helper
ata_piix
drm_kms_helper
cec
rc_core
libata
sdhci_pci
ttm
uhci_hcd
ehci_pci
ehci_hcd
cqhci
firewire_ohci
scsi_mod
drm
tg3
firewire_core
coretemp
sdhci
i2c_i801
usbcore
psmouse
libphy
mmc_core
lpc_ich
i2c_smbus
crc_itu_t
scsi_common
usb_common
battery
video
wmi
-- System Information:
Debian Release: trixie/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 6.5.0-5-686-pae (SMP w/1 CPU thread; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8), LANGUAGE=fi:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages linux-image-6.5.0-5-686-pae depends on:
ii initramfs-tools [linux-initramfs-tool] 0.142
ii kmod 31-1
ii linux-base 4.9
Versions of packages linux-image-6.5.0-5-686-pae recommends:
ii apparmor 3.0.12-1+b2
ii firmware-linux-free 20200122-2
Versions of packages linux-image-6.5.0-5-686-pae suggests:
pn debian-kernel-handbook <none>
ii grub-pc 2.12-1
pn linux-doc-6.5 <none>
Versions of packages linux-image-6.5.0-5-686-pae is related to:
ii firmware-amd-graphics 20230625-2
pn firmware-atheros <none>
pn firmware-bnx2 <none>
pn firmware-bnx2x <none>
pn firmware-brcm80211 <none>
pn firmware-cavium <none>
pn firmware-intel-sound <none>
pn firmware-intelwimax <none>
pn firmware-ipw2x00 <none>
pn firmware-ivtv <none>
ii firmware-iwlwifi 20230625-2
pn firmware-libertas <none>
ii firmware-linux-nonfree 20230625-2
ii firmware-misc-nonfree 20230625-2
pn firmware-myricom <none>
pn firmware-netxen <none>
pn firmware-qlogic <none>
ii firmware-realtek 20230625-2
pn firmware-samsung <none>
pn firmware-siano <none>
pn firmware-ti-connectivity <none>
pn xen-hypervisor <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 6.1.119-1
Done: Salvatore Bonaccorso <car...@debian.org>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1062...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <car...@debian.org> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 22 Nov 2024 23:27:23 +0100
Source: linux
Architecture: source
Version: 6.1.119-1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <car...@debian.org>
Closes: 1062421 1085762 1086447 1087602
Changes:
linux (6.1.119-1) bookworm-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.116
- cpufreq: Generalize of_perf_domain_get_sharing_cpumask phandle format
- cpufreq: Avoid a bad reference count on CPU node (CVE-2024-50012)
- mm: remove kern_addr_valid() completely
- fs/proc/kcore: avoid bounce buffer for ktext data
- fs/proc/kcore: convert read_kcore() to read_kcore_iter()
- fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions
- fs/proc/kcore.c: allow translation of physical memory addresses
- cgroup: Fix potential overflow issue when checking max_depth
- wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
(Closes: #1062421)
- mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
- wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
- wifi: ath11k: Fix invalid ring usage in full monitor mode
- wifi: brcm80211: BRCM_TRACING should depend on TRACING
- RDMA/cxgb4: Dump vendor specific QP details
- RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
- RDMA/bnxt_re: synchronize the qp-handle table array
- wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
- wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
(CVE-2024-53059)
- [armel,armhf] ASoC: cs42l51: Fix some error handling paths in
cs42l51_probe()
- macsec: Fix use-after-free while sending the offloading packet
(CVE-2024-50261)
- net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
(CVE-2024-53058)
- ipv4: ip_tunnel: Fix suspicious RCU usage warning in
ip_tunnel_init_flow()
(CVE-2024-53042)
- gtp: allow -1 to be specified as file description from userspace
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057)
- netdevsim: Add trailing zero to terminate the string in
nsim_nexthop_bucket_activity_write() (CVE-2024-50259)
- bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262)
- netfilter: Fix use-after-free in get_info() (CVE-2024-50257)
- netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
(CVE-2024-50256)
- Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
(CVE-2024-50255)
- net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
- netfilter: nft_payload: sanitize offset and length before calling
skb_checksum() (CVE-2024-50251)
- iomap: convert iomap_unshare_iter to use large folios
- iomap: improve shared block detection in iomap_unshare_iter
- iomap: don't bother unsharing delalloc extents
- iomap: share iomap_unshare_iter predicate code with fsdax
- fsdax: remove zeroing code from dax_unshare_iter
- fsdax: dax_unshare_iter needs to copy entire blocks (CVE-2024-50250)
- iomap: turn iomap_want_unshare_iter into an inline function
- compiler-gcc: be consistent with underscores use for `no_sanitize`
- compiler-gcc: remove attribute support check for
`__no_sanitize_address__`
- afs: Automatically generate trace tag enums
- afs: Fix missing subdir edit when renamed between parent dirs
- ACPI: CPPC: Make rmw_lock a raw_spin_lock (CVE-2024-50249)
- fs/ntfs3: Check if more than chunk-size bytes are written
(CVE-2024-50247)
- fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
- fs/ntfs3: Stale inode instead of bad
- fs/ntfs3: Fix possible deadlock in mi_read (CVE-2024-50245)
- fs/ntfs3: Additional check in ni_clear() (CVE-2024-50244)
- scsi: scsi_transport_fc: Allow setting rport state to current state
- net: amd: mvme147: Fix probe banner message
- NFS: remove revoked delegation from server's delegation list
- misc: sgi-gru: Don't disable preemption in GRU driver
- usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
- usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
- usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
- USB: gadget: dummy-hcd: Fix "task hung" problem
- ALSA: usb-audio: Add quirks for Dell WD19 dock
- usbip: tools: Fix detach_port() invalid port error path
- usb: phy: Fix API devm_usb_put_phy() can not release the phy
- usb: typec: fix unreleased fwnode_handle in
typec_port_register_altmodes()
- xhci: Fix Link TRB DMA in command ring stopped completion event
- xhci: Use pm_runtime_get to prevent RPM on unsupported systems
- Revert "driver core: Fix uevent_show() vs driver detach race"
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
(CVE-2024-50237)
- wifi: ath10k: Fix memory leak in management tx (CVE-2024-50236)
- wifi: cfg80211: clear wdev->cqm_config pointer on free (CVE-2024-50235)
- wifi: iwlegacy: Clear stale interrupts before resuming device
(CVE-2024-50234)
- iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
(CVE-2024-50232)
- iio: light: veml6030: fix microlux value calculation
- nilfs2: fix potential deadlock with newly created symlinks
(CVE-2024-50229)
- block: fix sanity checks in blk_rq_map_user_bvec
- cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
(CVE-2024-53054)
- ALSA: hda/realtek: Limit internal Mic boost on Dell platform
- cxl/acpi: Move rescan to the workqueue
- cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
- mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE
- mm/page_alloc: treat RT tasks similar to __GFP_HIGH
- mm/page_alloc: explicitly record high-order atomic allocations in
alloc_flags
- mm/page_alloc: explicitly define what alloc flags deplete min reserves
- mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations
accesses reserves
- mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
- ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (CVE-2024-50218)
- mctp i2c: handle NULL header address (CVE-2024-53043)
- ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
- nvmet-auth: assign dh_key to NULL after kfree_sensitive (CVE-2024-50215)
- io_uring: rename kiocb_end_write() local helper
- fs: create kiocb_{start,end}_write() helpers
- io_uring: use kiocb_{start,end}_write() helpers
- io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
(CVE-2024-53052)
- mm: migrate: try again if THP split is failed due to page refcnt
- migrate: convert unmap_and_move() to use folios
- migrate: convert migrate_pages() to use folios
- mm/migrate.c: stop using 0 as NULL pointer
- migrate_pages: organize stats with struct migrate_pages_stats
- migrate_pages: separate hugetlb folios migration
- migrate_pages: restrict number of pages to migrate in batch
- migrate_pages: split unmap_and_move() to _unmap() and _move()
- vmscan,migrate: fix page count imbalance on node stats when demoting
pages
- io_uring: always lock __io_cqring_overflow_flush (Closes: #1087602)
- [x86] bugs: Use code segment selector for VERW operand (CVE-2024-50072)
- wifi: mac80211: fix NULL dereference at band check in starting tx ba
session (CVE-2024-43911)
- nilfs2: fix kernel bug due to missing clearing of checked flag
(CVE-2024-50230)
- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055)
- mm: shmem: fix data-race in shmem_getattr() (CVE-2024-50228)
- mtd: spi-nor: winbond: fix w25q128 regression
- drm/amd/display: Add null checks for 'stream' and 'plane' before
dereferencing (CVE-2024-43904)
- drm/amd/display: Skip on writeback when it's not applicable
(CVE-2024-36914)
- vt: prevent kernel-infoleak in con_font_get()
- mm: avoid gcc complaint about pointer casting
- migrate_pages_batch: fix statistics for longterm pin retry
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.117
- [arm64] dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610
- [arm64] dts: rockchip: Fix rt5651 compatible value on
rk3399-sapphire-excavator
- [arm64] dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
- [arm64] dts: rockchip: Fix wakeup prop names on PineNote BT node
- [arm64] dts: rockchip: Fix bluetooth properties on Rock960 boards
- [arm64] dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
- [arm64] dts: rockchip: Fix LED triggers on rk3308-roc-cc
- [arm64] dts: imx8qm: Fix VPU core alias name
- [arm64] dts: imx8qxp: Add VPU subsystem file
- [arm64] dts: imx8-ss-vpu: Fix imx8qm VPU IRQs
- [arm64] dts: imx8mp: correct sdhc ipg clk
- [armhf] ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
- HID: core: zero-initialize the report buffer (CVE-2024-50302)
- [x86] platform/x86/amd/pmc: Detect when STB is not available
(CVE-2024-53072)
- sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()
- NFSv3: only use NFS timeout for MOUNT when protocols are compatible
- NFSv3: handle out-of-order write replies.
- nfs: avoid i_lock contention in nfs_clear_invalid_mapping
- security/keys: fix slab-out-of-bounds in key_task_permission
(CVE-2024-50301)
- [arm64] net: enetc: set MAC address to the VF net_device
- sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299)
- can: c_can: fix {rx,tx}_errors statistics
- ice: change q_index variable type to s16 to store -1 value
- i40e: fix race condition by adding filter's intermediate sync state
(CVE-2024-53088)
- [arm64] net: hns3: fix kernel crash when uninstalling driver
(CVE-2024-50296)
- net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
- net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case
- virtio_net: Add hash_key_length check (CVE-2024-53082)
- Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
- media: stb0899_algo: initialize cfr before using it
- media: dvbdev: prevent the risk of out of memory access (CVE-2024-53063)
- media: dvb_frontend: don't play tricks with underflow values
- media: adv7604: prevent underflow condition when reporting colorspace
- scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
- ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
- [armhf] ASoC: stm32: spdifrx: fix dma channel release in
stm32_spdifrx_remove
- media: ar0521: don't overflow when checking PLL values (CVE-2024-53081)
- media: s5p-jpeg: prevent buffer overflows (CVE-2024-53061)
- media: cx24116: prevent overflows on SNR calculus (CVE-2024-50290)
- media: pulse8-cec: fix data timestamp at pulse8_setup()
- media: v4l2-tpg: prevent the risk of a division by zero (CVE-2024-50287)
- media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
- can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation
- can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when
switching CAN modes
- ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
(CVE-2024-50286)
- ksmbd: Fix the missing xa_store error check (CVE-2024-50284)
- ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp (CVE-2024-50283)
- pwm: imx-tpm: Use correct MODULO value for EPWM mode
- drm/amdgpu: Adjust debugfs eviction and IB access permissions
- drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
(CVE-2024-50282)
- drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
(CVE-2024-53060)
- thermal/drivers/qcom/lmh: Remove false lockdep backtrace
- dm cache: correct the number of origin blocks to match the target length
- dm cache: fix flushing uninitialized delayed_work on cache_ctr error
(CVE-2024-50280)
- dm cache: fix out-of-bounds access to the dirty bitset when resizing
(CVE-2024-50279)
- dm cache: optimize dirty bit checking with find_next_bit when resizing
- dm cache: fix potential out-of-bounds access on the first resume
(CVE-2024-50278)
- dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
overflow
- ALSA: usb-audio: Add quirk for HP 320 FHD Webcam
- ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
- posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone
- nfs: Fix KMSAN warning in decode_getfattr_attrs() (CVE-2024-53066)
- net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc()
- net: vertexcom: mse102x: Fix possible double free of TX skb
(CVE-2024-50276)
- mptcp: use sock_kfree_s instead of kfree
- btrfs: reinitialize delayed ref list after deleting it from the list
(CVE-2024-50273)
- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
(CVE-2024-38540)
- Revert "wifi: mac80211: fix RCU list iterations"
- net: do not delay dst_entries_add() in dst_release() (CVE-2024-50036)
- media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
uvc_parse_format
- filemap: Fix bounds checking in filemap_read() (CVE-2024-50272)
- fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
- signal: restore the override_rlimit logic (CVE-2024-50271)
- usb: musb: sunxi: Fix accessing an released usb phy (CVE-2024-50269)
- usb: dwc3: fix fault at system suspend if device was already runtime
suspended
- usb: typec: fix potential out of bounds in
ucsi_ccg_update_set_new_cam_cmd()
- USB: serial: io_edgeport: fix use after free in debug printk
(CVE-2024-50267)
- USB: serial: qcserial: add support for Sierra Wireless EM86xx
- USB: serial: option: add Fibocom FG132 0x0112 composition
- USB: serial: option: add Quectel RG650V
- irqchip/gic-v3: Force propagation of the active state with a read-back
- ocfs2: remove entry once instead of null-ptr-dereference in
ocfs2_xa_remove()
- ucounts: fix counter leak in inc_rlimit_get_ucounts()
- [x86] ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022
- net: sched: use RCU read-side critical section in taprio_dump()
(CVE-2024-50126)
- hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
- vsock/virtio: Initialization of the dangling pointer occurring in
vsk->trans
- media: amphion: Fix VPU core alias name
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.118
- Revert "Bluetooth: fix use-after-free in accessing skb after sending it"
- Revert "Bluetooth: hci_sync: Fix overwriting request callback"
- Revert "Bluetooth: af_bluetooth: Fix deadlock"
- Revert "Bluetooth: hci_core: Fix possible buffer overflow"
- Revert "Bluetooth: hci_conn: Consolidate code for aborting connections"
(Closes: #1086447)
- 9p: Avoid creating multiple slab caches with the same name
- nvme: tcp: avoid race between queue_lock lock and destroy
- block: Fix elevator_get_default() checking for NULL q->tag_set
- HID: multitouch: Add support for B2402FVA track point
- HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
- nvme: disable CC.CRIME (NVME_CC_CRIME)
- bpf: use kvzmalloc to allocate BPF verifier environment
- crypto: api - Fix liveliness check in crypto_alg_tested
- [arm*] crypto: marvell/cesa - Disable hash algorithms
- sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
- drm/vmwgfx: Limit display layout ioctl array size to
VMWGFX_NUM_DISPLAY_UNITS
- nvme-multipath: defer partition scanning (CVE-2024-53093)
- [powerpc*] powernv: Free name on error in opal_event_init()
- nvme: make keep-alive synchronous operation
- bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6
- fs: Fix uninitialized value issue in from_kuid and from_kgid
- HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa touchpad
- HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard
- net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
- md/raid10: improve code of mrdev in raid10_sync_request
- io_uring: fix possible deadlock in io_register_iowq_max_workers()
(CVE-2024-41080)
- uprobes: encapsulate preparation of uprobe args buffer
- uprobe: avoid out-of-bounds memory access of fetching args
(CVE-2024-50067)
- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
(CVE-2024-49991)
- ext4: fix timer use-after-free on failed mount (CVE-2024-49960)
- Bluetooth: L2CAP: Fix uaf in l2cap_connect (CVE-2024-49950)
- mm: krealloc: Fix MTE false alarm in __do_krealloc
- [x86] platform/x86: x86-android-tablets: Fix use after free on
platform_device_register() errors (CVE-2024-49986)
- fs/ntfs3: Fix general protection fault in run_is_mapped_full
(CVE-2024-50243)
- 9p: fix slab cache name creation for real
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.119
- netlink: terminate outstanding dump on socket close
- [arm64,armhf] drm/rockchip: vop: Fix a dereferenced before check warning
- mptcp: error out earlier on disconnect
- net/mlx5: fs, lock FTE when checking if active
- net/mlx5e: kTLS, Fix incorrect page refcounting
- net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
- virtio/vsock: Fix accept_queue memory leak
- Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
- Bluetooth: hci_core: Fix calling mgmt_device_connected
- net/sched: cls_u32: replace int refcounts with proper refcounts
- net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for
hnodes.
- bonding: add ns target multicast address to slave device
- [armel,armhf] 9419/1: mm: Fix kernel memory mapping for xip kernels
- [x86] mm: Fix a kdump kernel failure on SME system when
CONFIG_IMA_KEXEC=y
- mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
- ocfs2: uncache inode which has failed entering the group
- vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
- ima: fix buffer overrun in ima_eventdigest_init_common
- [x86] KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID
disabled
- [x86] KVM: x86: Unconditionally set irr_pending when updating APICv state
- [x86] KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind
CONFIG_BROKEN
- nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
- ALSA: hda/realtek - Fixed Clevo platform headset Mic issue
- ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10
- ocfs2: fix UBSAN warning in ocfs2_verify_volume()
- nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
- Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
- mmc: sunxi-mmc: Fix A100 compatible description
- drm/bridge: tc358768: Fix DSI command tx
- drm/amd: Fix initialization mistake for NBIO 7.7.0
- staging: vchiq_arm: Get the rid off struct vchiq_2835_state
- staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation
- fs/ntfs3: Additional check in ntfs_file_release (CVE-2024-50242)
- Bluetooth: ISO: Fix not validating setsockopt user input (CVE-2024-35964)
- lib/buildid: Fix build ID parsing logic
- cxl/pci: fix error code in __cxl_hdm_decode_init()
- media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
- NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
- NFSD: Async COPY result needs to return a write verifier
- NFSD: Limit the number of concurrent async COPY operations
(CVE-2024-49974)
- NFSD: Initialize struct nfsd4_copy earlier
- NFSD: Never decrement pending_async_copies on error
- mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
- mptcp: define more local variables sk
- mptcp: add userspace_pm_lookup_addr_by_id helper
- mptcp: update local address flags when setting it
- mptcp: hold pm lock when deleting entry
- mptcp: drop lookup_by_id in lookup_addr
- mptcp: pm: use _rcu variant under rcu_read_lock
- ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
(CVE-2024-26954)
- ksmbd: fix potencial out-of-bounds when buffer offset is invalid
(CVE-2024-26952)
- net: add copy_safe_from_sockptr() helper
- nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
- fs/9p: fix uninitialized values during inode evict (CVE-2024-36923)
- ipvs: properly dereference pe in ip_vs_add_service (CVE-2024-42322)
- net/sched: taprio: extend minimum interval restriction to entire cycle
too
(CVE-2024-36244)
- net: fec: remove .ndo_poll_controller to avoid deadlocks (CVE-2024-38553)
- mm: revert "mm: shmem: fix data-race in shmem_getattr()"
- mm: avoid unsafe VMA hook invocation when error arises on mmap hook
- mm: unconditionally close VMAs on error
- mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
- mm: resolve faulty mmap_region() error path behaviour
- drm/amd: check num of link levels when update pcie param (CVE-2023-52812)
- char: xillybus: Prevent use-after-free due to race condition
(CVE-2022-45888)
- null_blk: Remove usage of the deprecated ida_simple_xx() API
- null_blk: fix null-ptr-dereference while configuring 'power' and
'submit_queues' (CVE-2024-36478)
- null_blk: Fix return value of nullb_device_power_store()
- parisc: fix a possible DMA corruption (CVE-2024-44949)
- char: xillybus: Fix trivial bug with mutex
- net: Make copy_safe_from_sockptr() match documentation
.
[ Salvatore Bonaccorso ]
* Bump ABI to 28
* [x86] Revert "x86: Increase brk randomness entropy for 64-bit systems"
(Closes: #1085762)
Checksums-Sha1:
e215a34b3972cbccd6b19af51fd7ae55d6e194a7 290930 linux_6.1.119-1.dsc
637745720659db870da3f9934375be1563e2e3f2 137707144 linux_6.1.119.orig.tar.xz
b536d58f0bebd603fc256f7cd91f3eb912fde92c 1696788 linux_6.1.119-1.debian.tar.xz
d2fe19e4ed37de381a7976fbb7f389d9de33de46 7602 linux_6.1.119-1_source.buildinfo
Checksums-Sha256:
c13e92aa9821c3f3300c5524f35f2e0da7def1313803547a6c7d41c150fb1714 290930
linux_6.1.119-1.dsc
59e74f3e07779dc13de2ddf10ee6652d373373248caa0517ba7871846985c847 137707144
linux_6.1.119.orig.tar.xz
6f99efa9463c35b875fc7138f1acb72186e283d49cbad5f59c62d35808fb5ae2 1696788
linux_6.1.119-1.debian.tar.xz
ccb1fd576bc940f968c0e9d27b13c6ae9b25874cb6fec8ec96fbd006755d3c7e 7602
linux_6.1.119-1_source.buildinfo
Files:
344b09c723f1ac7510bff98f4760a2b0 290930 kernel optional linux_6.1.119-1.dsc
883ee8e4156ed707dbb835a490cfe546 137707144 kernel optional
linux_6.1.119.orig.tar.xz
879af74209a93e1cdafa2dfc3e4cf36d 1696788 kernel optional
linux_6.1.119-1.debian.tar.xz
6c3faf1a1f5310eea4d446efcef730ef 7602 kernel optional
linux_6.1.119-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmdBBxBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ER7QP/REiQVkOwhywQkCVAx5PlTqcBkRRwsi9
/5RH6q4azq7h6eYsiCOSCVf5lq00XmcH9ME2sHls66sN4FY0AxBLHmgzYf1ccGR3
/CCRK2AVrVZsZtPISZf8kPNCNcGAmyNcS1yLX+6UzaYx/6ajb+AeTG/xhcfPNa0v
FZhzBqeawkEt/KYmsSExKnygovqpkffzsAaf4QE3uUYo84vlybxBFLNmwkzcSIeZ
a/n/KFcLT6E2Z0GYJdpp5mLzkKFpPu7bzq2Tm0/o2ruL7Qgu4ElpSnr4XR+xM55i
Mq9ELem3P1dQzAEmFEgCeGvv7Na4lam3GsCWWN8MNcMgrmzSixxwdDThPw9Km1bX
s+aq044FoubG77W1h4S7OFzViO+Vv6nGbCcaH507Z9BDfOBXGvOck9Zq9ZXsPPCF
CQIj958dYWsPzDu03LQnn7TqIL3Kos4oWVvI48GbBu4x4CSxmcTqY6l1OTbjtJxz
N2DqzhvFvrddHR5WTnWU+znnuHyQFysAi3q1i+nNDwNcQLbNrAWzg7smhe/frXjV
hBSjgpOV6VR9mVh8ISiycAUJdL/VnzroOH2KtSgXw/x5ydBv9bQHu5dOwrz6KsBw
MkREe2uRbLdnPUP73PKWuk/4N6Gk6rGAihLJyRe+HbbNAUVfpMBdXe3ktyOPiibm
nSKuwJCDfrKR
=sj+m
-----END PGP SIGNATURE-----
pgpCqXsxp2jAT.pgp
Description: PGP signature
--- End Message ---
