Public bug reported: SRU Justification
Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.104 upstream stable release from git://git.kernel.org/ xfrm: Allow transport-mode states with AF_UNSPEC selector drm/panfrost: Don't sync rpm suspension after mmu flushing cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Fix a procfs host directory removal regression tcp: tcp_make_synack() can be called from process context nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode vdpa_sim: not reset state in vdpasim_queue_ready vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready PCI: s390: Fix use-after-free of PCI resources with per-function hotplug drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area drm/i915/display: clean up comments drm/i915/psr: Use calculated io and fast wake lines net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: dsa: mt7530: remove now incorrect comment regarding port 5 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used loop: Fix use-after-free issues net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL ice: xsk: disable txq irq before flushing hw net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ravb: avoid PHY being resumed when interface is not up sh_eth: avoid PHY being resumed when interface is not up ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net/iucv: Fix size of interrupt data qed/qed_mng_tlv: correctly zero out ->min instead of ->hour ethernet: sun: add check for the mdesc_grab() bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table kconfig: Update config changed flag before calling callback hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command jffs2: correct logic when creating a hole in jffs2_write_begin ext4: fail ext4_iget if special inode unallocated ext4: update s_journal_inum if it changes after journal replay ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access net/9p: fix bug in client create for .L sh: intc: Avoid spurious sizeof-pointer-div warning drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type serial: 8250_fsl: fix handle_irq locking firmware: xilinx: don't make a sleepable memory allocation from an atomic context s390/ipl: add missing intersection check to ipl_report handling interconnect: fix mem leak when freeing nodes interconnect: exynos: fix node leak in probe PM QoS error path tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro Revert "riscv: mm: notify remote harts about mmu cache updates" riscv: asid: Fixup stale TLB entry cause application crash drm/shmem-helper: Remove another errant put in error path drm/sun4i: fix missing component unbind on bind errors drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume mptcp: fix possible deadlock in subflow_error_report mptcp: add ro_after_init for tcp{,v6}_prot_override mptcp: avoid setting TCP_CLOSE state twice mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() ftrace: Fix invalid address access in lookup_rec() when index is 0 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks trace/hwlat: Do not wipe the contents of per-cpu thread data net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit cpuidle: psci: Iterate backwards over list in psci_pd_remove() x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915/active: Fix misuse of non-idle barriers as fence trackers io_uring: avoid null-ptr-deref in io_arm_poll_handler PCI: Unify delay handling for reset and resume PCI/DPC: Await readiness of secondary bus after reset HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own perf: Fix check before add_event_to_groups() in perf_group_detach() Linux 5.15.104 UBUNTU: Upstream stable to v5.15.104 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Jammy) Importance: Medium Assignee: Kamal Mostafa (kamalmostafa) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Tags added: kernel-stable-tracking-bug ** Also affects: linux (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Jammy) Status: New => In Progress ** Changed in: linux (Ubuntu Jammy) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Jammy) Assignee: (unassigned) => Kamal Mostafa (kamalmostafa) ** Description changed: + SRU Justification - SRU Justification + Impact: + The upstream process for stable tree updates is quite similar + in scope to the Ubuntu SRU process, e.g., each patch has to + demonstrably fix a bug, and each patch is vetted by upstream + by originating either directly from a mainline/stable Linux tree or + a minimally backported form of that patch. The following upstream + stable patches should be included in the Ubuntu kernel: - Impact: - The upstream process for stable tree updates is quite similar - in scope to the Ubuntu SRU process, e.g., each patch has to - demonstrably fix a bug, and each patch is vetted by upstream - by originating either directly from a mainline/stable Linux tree or - a minimally backported form of that patch. The following upstream - stable patches should be included in the Ubuntu kernel: + v5.15.104 upstream stable release + from git://git.kernel.org/ - v5.15.104 upstream stable release - from git://git.kernel.org/ + xfrm: Allow transport-mode states with AF_UNSPEC selector + drm/panfrost: Don't sync rpm suspension after mmu flushing + cifs: Move the in_send statistic to __smb_send_rqst() + drm/meson: fix 1px pink line on GXM when scaling video overlay + clk: HI655X: select REGMAP instead of depending on it + docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate + scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() + ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() + netfilter: nft_nat: correct length for loading protocol registers + netfilter: nft_masq: correct length for loading protocol registers + netfilter: nft_redir: correct length for loading protocol registers + netfilter: nft_redir: correct value of inet type `.maxattrs` + scsi: core: Fix a procfs host directory removal regression + tcp: tcp_make_synack() can be called from process context + nfc: pn533: initialize struct pn533_out_arg properly + ipvlan: Make skb->skb_iif track skb->dev for l3s mode + i40e: Fix kernel crash during reboot when adapter is in recovery mode + vdpa_sim: not reset state in vdpasim_queue_ready + vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready + PCI: s390: Fix use-after-free of PCI resources with per-function hotplug + drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled + drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area + drm/i915/display: clean up comments + drm/i915/psr: Use calculated io and fast wake lines + net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() + qed/qed_dev: guard against a possible division by zero + net: dsa: mt7530: remove now incorrect comment regarding port 5 + net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used + loop: Fix use-after-free issues + net: tunnels: annotate lockless accesses to dev->needed_headroom + net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails + nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition + net/smc: fix deadlock triggered by cancel_delayed_work_syn() + net: usb: smsc75xx: Limit packet length to skb->len + drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc + block: null_blk: Fix handling of fake timeout request + nvme: fix handling single range discard request + nvmet: avoid potential UAF in nvmet_req_complete() + block: sunvdc: add check for mdesc_grab() returning NULL + ice: xsk: disable txq irq before flushing hw + net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 + ravb: avoid PHY being resumed when interface is not up + sh_eth: avoid PHY being resumed when interface is not up + ipv4: Fix incorrect table ID in IOCTL path + net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull + net/iucv: Fix size of interrupt data + qed/qed_mng_tlv: correctly zero out ->min instead of ->hour + ethernet: sun: add check for the mdesc_grab() + bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change + bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails + hwmon: (adt7475) Display smoothing attributes in correct order + hwmon: (adt7475) Fix masking of hysteresis registers + hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition + hwmon: (ina3221) return prober error code + hwmon: (ucd90320) Add minimum delay between bus accesses + hwmon: tmp512: drop of_match_ptr for ID table + kconfig: Update config changed flag before calling callback + hwmon: (adm1266) Set `can_sleep` flag for GPIO chip + hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip + media: m5mols: fix off-by-one loop termination error + mmc: atmel-mci: fix race between stop command and start of next command + jffs2: correct logic when creating a hole in jffs2_write_begin + ext4: fail ext4_iget if special inode unallocated + ext4: update s_journal_inum if it changes after journal replay + ext4: fix task hung in ext4_xattr_delete_inode + drm/amdkfd: Fix an illegal memory access + net/9p: fix bug in client create for .L + sh: intc: Avoid spurious sizeof-pointer-div warning + drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes + ext4: fix possible double unlock when moving a directory + tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted + serial: 8250_em: Fix UART port type + serial: 8250_fsl: fix handle_irq locking + firmware: xilinx: don't make a sleepable memory allocation from an atomic context + s390/ipl: add missing intersection check to ipl_report handling + interconnect: fix mem leak when freeing nodes + interconnect: exynos: fix node leak in probe PM QoS error path + tracing: Make splice_read available again + tracing: Check field value in hist_field_name() + tracing: Make tracepoint lockdep check actually test something + cifs: Fix smb2_set_path_size() + ALSA: hda: intel-dsp-config: add MTL PCI id + ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro + Revert "riscv: mm: notify remote harts about mmu cache updates" + riscv: asid: Fixup stale TLB entry cause application crash + drm/shmem-helper: Remove another errant put in error path + drm/sun4i: fix missing component unbind on bind errors + drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume + mptcp: fix possible deadlock in subflow_error_report + mptcp: add ro_after_init for tcp{,v6}_prot_override + mptcp: avoid setting TCP_CLOSE state twice + mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() + ftrace: Fix invalid address access in lookup_rec() when index is 0 + nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 + mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage + mmc: sdhci_am654: lower power-on failed message severity + fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks + trace/hwlat: Do not wipe the contents of per-cpu thread data + net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit + cpuidle: psci: Iterate backwards over list in psci_pd_remove() + x86/mce: Make sure logged MCEs are processed after sysfs update + x86/mm: Fix use of uninitialized buffer in sme_enable() + x86/resctrl: Clear staged_config[] before and after it is used + drm/i915: Don't use stolen memory for ring buffers with LLC + drm/i915/active: Fix misuse of non-idle barriers as fence trackers + io_uring: avoid null-ptr-deref in io_arm_poll_handler + PCI: Unify delay handling for reset and resume + PCI/DPC: Await readiness of secondary bus after reset + HID: core: Provide new max_buffer_size attribute to over-ride the default + HID: uhid: Over-ride the default maximum data buffer value with our own + perf: Fix check before add_event_to_groups() in perf_group_detach() + Linux 5.15.104 + UBUNTU: Upstream stable to v5.15.104 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2023225 Title: Jammy update: v5.15.104 upstream stable release Status in linux package in Ubuntu: Invalid Status in linux source package in Jammy: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.104 upstream stable release from git://git.kernel.org/ xfrm: Allow transport-mode states with AF_UNSPEC selector drm/panfrost: Don't sync rpm suspension after mmu flushing cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Fix a procfs host directory removal regression tcp: tcp_make_synack() can be called from process context nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode vdpa_sim: not reset state in vdpasim_queue_ready vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready PCI: s390: Fix use-after-free of PCI resources with per-function hotplug drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area drm/i915/display: clean up comments drm/i915/psr: Use calculated io and fast wake lines net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: dsa: mt7530: remove now incorrect comment regarding port 5 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used loop: Fix use-after-free issues net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL ice: xsk: disable txq irq before flushing hw net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ravb: avoid PHY being resumed when interface is not up sh_eth: avoid PHY being resumed when interface is not up ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net/iucv: Fix size of interrupt data qed/qed_mng_tlv: correctly zero out ->min instead of ->hour ethernet: sun: add check for the mdesc_grab() bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table kconfig: Update config changed flag before calling callback hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command jffs2: correct logic when creating a hole in jffs2_write_begin ext4: fail ext4_iget if special inode unallocated ext4: update s_journal_inum if it changes after journal replay ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access net/9p: fix bug in client create for .L sh: intc: Avoid spurious sizeof-pointer-div warning drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type serial: 8250_fsl: fix handle_irq locking firmware: xilinx: don't make a sleepable memory allocation from an atomic context s390/ipl: add missing intersection check to ipl_report handling interconnect: fix mem leak when freeing nodes interconnect: exynos: fix node leak in probe PM QoS error path tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro Revert "riscv: mm: notify remote harts about mmu cache updates" riscv: asid: Fixup stale TLB entry cause application crash drm/shmem-helper: Remove another errant put in error path drm/sun4i: fix missing component unbind on bind errors drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume mptcp: fix possible deadlock in subflow_error_report mptcp: add ro_after_init for tcp{,v6}_prot_override mptcp: avoid setting TCP_CLOSE state twice mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() ftrace: Fix invalid address access in lookup_rec() when index is 0 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks trace/hwlat: Do not wipe the contents of per-cpu thread data net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit cpuidle: psci: Iterate backwards over list in psci_pd_remove() x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915/active: Fix misuse of non-idle barriers as fence trackers io_uring: avoid null-ptr-deref in io_arm_poll_handler PCI: Unify delay handling for reset and resume PCI/DPC: Await readiness of secondary bus after reset HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own perf: Fix check before add_event_to_groups() in perf_group_detach() Linux 5.15.104 UBUNTU: Upstream stable to v5.15.104 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2023225/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp