Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.216 upstream stable release
from git://git.kernel.org/
nvmet-tcp: Fix potential UAF when ddgst mismatch
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
macsec: don't read an unset MAC header in macsec_encrypt()
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
KVM: x86/mmu: Fix use-after-free on vendor module reload
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
can: isotp: serialize TX state transitions under so->rx_lock
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Input: ims-pcu - fix logic error in packet reset
KVM: VMX: Make vmread_error_trampoline() uncallable from C code
IB/mad: Drop unmatched RMPP responses before reassembly
mtd: mtdswap: remove debugfs stats file on teardown
mtd: nand: mtk-ecc: stop on ECC idle timeouts
btrfs: reject free space cache with more entries than pages
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
RDMA/hns: Fix potential integer overflow in mhop hem cleanup
RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
RDMA/siw: publish QP after initialization
RDMA/irdma: Prevent overflows in memory contiguity checks
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
wifi: cfg80211: cancel sched scan results work on unregister
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
wifi: libertas: fix memory leak in helper_firmware_cb()
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
wifi: cfg80211: validate PMSR measurement type data
wifi: cfg80211: validate PMSR FTM preamble range
wifi: cfg80211: reject unsupported PMSR FTM location requests
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi: brcmfmac: initialize SDIO data work before cleanup
wifi: cfg80211: bound element ID read when checking non-inheritance
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
ata: sata_dwc_460ex: remove variable num_processed
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
Bluetooth: qca: fix NVM tag length underflow in TLV parser
smb/client: handle overlapping allocated ranges in fallocate
drm/i915/gt: use correct selftest config symbol
powerpc/time: Fix sparse warnings
powerpc: remove the last remnants of cputime_t
sched/vtime: Get rid of generic vtime_task_switch() implementation
powerpc/time: Prepare to stop elapsing in dynticks-idle
powerpc/vtime: Initialize starttime at boot for native accounting
can: j1939: fix lockless local-destination check
ksmbd: validate compound request size before reading StructureSize2
drm/i915/selftests: Fix GT PM sort comparators
net/sched: act_tunnel_key: Defer dst_release to RCU callback
sctp: fix auth_hmacs array size in struct sctp_cookie
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
usb: gadget: printer: fix infinite loop in printer_read()
USB: gadget: snps-udc: fix device name leak on probe failure
USB: gadget: fsl-udc: fix device name leak on probe failure
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
USB: serial: ftdi_sio: add support for E+H FXA291
USB: serial: io_edgeport: cap received transmit credits
USB: serial: keyspan_pda: fix data loss on receive throttling
USB: serial: option: add TDTECH MT5710-CN
crypto: rsa-pkcs1pad: Don't WARN on an empty digest
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
firewire: net: Fix fragmented datagram reassembly
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
wifi: carl9170: fix OOB read from off-by-two in TX status handler
wifi: carl9170: fix buffer overflow in rx_stream failover path
btrfs: free mapping node on duplicate reloc root insert
ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status
hwmon: (occ) Add sysfs entry for OCC mode
hwmon: (occ) Add sysfs entries for additional extended status bits
hwmon: (occ) Delay hwmon registration until user request
hwmon: occ: validate poll response sensor blocks
net/packet: avoid fanout hook re-registration after unregister
rds: drop incoming messages that cross network namespace boundaries
dpaa2-switch: put MAC endpoint device on disconnect
net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call
dpaa2-eth: put MAC endpoint device on disconnect
nfp: Check resource mutex allocation
wan: wanxl: Only reset hardware after BAR mapping
wifi: mwifiex: bound uAP association event IEs to the event buffer
iommu/amd: Bound the early ACPI HID map
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
wifi: mac80211: recalculate TIM when a station enters power save
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
sctp: validate stream count in sctp_process_strreset_inreq()
nexthop: initialize extack in nh_res_bucket_migrate()
tipc: fix infinite loop in __tipc_nl_compat_dumpit
wifi: mt76: connac: fix possible NULL-pointer deref in
mt76_connac_mcu_uni_bss_he_tlv()
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
net: bridge: vlan: fix vlan range dumps starting with pvid
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
sctp: auth: verify auth requirement when auth_chunk is NULL
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
tipc: fix u16 MTU truncation in media and bearer MTU validation
net: stmmac: add tc flower filter for EtherType matching
net: stmmac: fix l3l4 filter rejecting unsupported offload requests
net: stmmac: reset residual action in L3L4 filters on delete
octeontx2-vf: set TC flower flag on MCAM entry allocation
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
hinic: remove unused ethtool RSS user configuration buffers
net: qrtr: restrict socket creation to the initial network namespace
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
net/mlx5e: Report zero bandwidth for non-ETS traffic classes
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
raw: use more conventional iterators
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
can: bcm: add locking when updating filter and timer values
can: bcm: fix CAN frame rx/tx statistics
can: bcm: extend bcm_tx_lock usage for data and timer updates
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
can: bcm: add missing device refcount for CAN filter removal
can: bcm: fix stale rx/tx ops after device removal
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
drm/radeon: fix r100_copy_blit for large BOs
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
drm/i915: Return NULL on error in active_instance
drm/i915/gem: Do not leak siblings[] on proto context error
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
drm/amdgpu: Fix VFCT bus number matching with soft filter
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
drm/vmwgfx: Validate vmw_surface_metadata::array_size
media: airspy: Return queued buffers on start_streaming() failure
media: cec: seco: unregister adapter on IR probe failure
media: cedrus: clean up media device on probe failure
media: cedrus: Fix missing cleanup in error path
media: cedrus: skip invalid H.264 reference list entries
media: cx231xx: fix devres lifetime
media: cx23885: add ioremap return check and cleanup
media: meson: vdec: Fix memory leak in error path of vdec_open
media: msi2500: Return queued buffers on start_streaming() failure
media: pci: dm1105: Free allocated workqueue
media: pwc: Drain fill_buf on start_streaming() failure
media: pwc: Return queued buffers on start_streaming() failure
media: radio-si476x: Unregister v4l2_device on probe failure
media: rtl2832: fix use-after-free in rtl2832_remove()
media: rtl2832_sdr: Return queued buffers on start_streaming() failure
media: saa7134: Fix a possible memory leak in saa7134_video_init1
media: sun4i-csi: Return queued buffers on start_streaming() failure
media: tegra-video: vi: fix invalid u32 return value in format lookup
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
media: vb2: use ssize_t for vb2_read/vb2_write
media: vidtv: fix reference leak on failed device registration
media: vimc: fix reference leak on failed device registration
media: vivid: check for vb2_is_busy() when toggling caps
wifi: ath6kl: fix OOB access from firmware ADDBA window size
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
wifi: wilc1000: validate assoc response length before subtracting header
wifi: brcmfmac: make release_scratchbuffers idempotent
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Bluetooth: RFCOMM: Fix session UAF in set_termios
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
binfmt_misc: set have_execfd only once the interpreter is opened
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
x86/boot/compressed: Disable jump tables
comedi: comedi_parport: deal with premature interrupt
intel_th: fix MSC output device reference leak
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
tracing: Fix resource leak on mmiotrace trace_pipe close
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
tracing/probes: Avoid temporary buffer truncation in
trace_probe_match_command_args()
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
mptcp: only set DATA_FIN when a mapping is present
sctp: don't free the ASCONF's own transport in DEL-IP processing
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
libceph: bound get_version reply decode to front len
libceph: Fix multiplication overflow in decode_new_up_state_weight()
libceph: guard missing CRUSH type name lookup
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
libceph: Reject monmaps advertising zero monitors
libceph: reject zero bucket types in crush_decode
libceph: remove debugfs files before client teardown
binfmt_elf_fdpic: only honour the first PT_INTERP
iommu/vt-d: Disallow SVA if page walk is not coherent
phonet: pep: fix use-after-free in pep_get_sb()
vxlan: require CAP_NET_ADMIN in the device netns for changelink
net: slip: serialize receive against buffer reallocation
geneve: require CAP_NET_ADMIN in the device netns for changelink
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
net/iucv: fix use-after-free of a severed iucv_path
net/x25: fix use-after-free in x25_kill_by_neigh()
net: hip04: fix RX buffer leak on build_skb failure
proc: Fix broken error paths for namespace links
rbd: Reset positive result codes to zero in object map update path
ice: use READ_ONCE() to access cached PHC time
ila: reload IPv6 header after pskb_may_pull in checksum adjust
mac802154: llsec: reject frames shorter than the authentication tag
pppoe: reload header pointer after dev_hard_header()
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx8: drop unecessary BUG_ON()
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
drm/amdgpu: fix division by zero with invalid uvd dimensions
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
openvswitch: fix GSO userspace truncation underflow
raw: remove unused variables from raw6_icmp_error()
raw: fix a typo in raw_icmp_error()
net: mpls: initialize rtm_tos in mpls_getroute()
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
media: uvcvideo: Fix sequence number when no EOF
gve: fix Rx queue stall on alloc failure
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
net: qrtr: ns: Limit the maximum server registration per node
net: qrtr: ns: Raise node count limit to 512
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
phy: zynqmp: Allow variation in refclk rate
phy-zynqmp: Postpone getting clock rate until actually needed
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: zynqmp: fix runtime PM leak on probe allocation failure
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
drm/mediatek: Check CRTC state before freeing
keys: fix out-of-bounds read in keyring_get_key_chunk()
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
assoc_array: trim the final shortcut word using the current chunk end
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
netfilter: nft_payload: fix mask build for partial field offload
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
smb: client: fix buffer leaks in SMB1 read and write
hwmon: (nct6775-core) Prevent access to unsupported weight registers
net: bridge: mrp: fix Option TLV length in MRP_Test frames
forcedeth: fix UAF of txrx_stats in nv_remove
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
powerpc/boot: Fix simpleboot CPU node lookup check
powerpc/boot: Fix treeboot-currituck CPU node lookup check
powerpc/boot: Fix treeboot-akebono CPU node lookup check
wifi: mac80211: validate individual TWT params before driver setup
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
net: phylink: put link_gpio if phylink_create fails
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
net: sxgbe: free TX rings on RX allocation failure
net: sxgbe: check descriptor ring allocation failures
can: isotp: check register_netdevice_notifier() error in module init
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
qede: sync udp_tunnel ports outside qede_lock in the recovery path
rhashtable: clear stale iter->p on table restart
pinctrl: devicetree: don't free uninitialized dev_name on error path
pinctrl: bm1880: add missing select GENERIC_PINCONF
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
mm/hugetlb: fix list corruption in allocate_file_region_entries()
sctp: validate Adaptation Indication parameter length
audit: fix potential integer overflow in audit_log_n_string()
audit: fix potential use-after-free in audit_del_rule()
Bluetooth: HIDP: reject frames without a transaction header
Bluetooth: HIDP: validate numbered report payloads
bpf: lwt: Fix dst reference leak on reroute failure
ALSA: 6fire: Fix UAF at error handling during probe
ALSA: lx6464es: fix period byte count for 16-bit streams
ALSA: pcm: wake linked drain waiters on unlink
ASoC: tas2562: fix DVC coefficient write order
ASoC: tas2562: fix broken entries in the volume lookup table
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
e1000: fix memory leak in e1000_probe()
igbvf: Fix leak in TX DMA error cleanup
ipvs: do not propagate one-packet flag to synced conns
net/smc: fix socket use-after-free during link group termination
netfilter: ipset: do not update comments from kernel-side hash adds
tipc: avoid use-after-free in poll trace queue dumps
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
binfmt_misc: reject a flag character as the field delimiter
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
net: bridge: stop fast-leave after deleting a port group
net: ipv6: clear suppressed fib6 rule result
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
um: vector: fix use-after-free in vector_mmsg_rx()
vxlan: re-fetch eth header after route_shortcircuit()
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
vxlan: use pskb_network_may_pull() in route_shortcircuit()
tracing: Check return value of __register_event() in trace_module_add_events()
tracing/filters: Fix false positive match in regex_match_full()
selftests/clone3: fix wild pointer access of getline due to missing init
sctp: reject stale cookies with mismatched verification tags
sctp: prevent peer transport count overflow
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
i2c: amd-mp2: Unregister callback on adapter add failure
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
s390/qeth: Check CAP_NET_ADMIN for private ioctls
s390/dasd: Fix potential NULL pointer dereference
s390/zcrypt: Validate length for CCA AES cipher key requests
s390/zcrypt: Validate length for CCA ECC private key requests
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
net: openvswitch: fix potential UAF on meter attach failure
net: openvswitch: fix skb leak on flow key update failure during ct
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
i2c: imx: Cancel hrtimer before clearing slave pointer
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
can: ems_usb: validate CPC message lengths
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit
failure
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
can: softing: fw_parse(): validate firmware record spans
can: peak_usb: add bounds check for USB channel index
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
can: peak_usb: validate uCAN receive record lengths
drm/vc4: Zero the tile state data array before each BIN job
drm/amdgpu: restore UMD profile pstate after runtime resume
drm/amdgpu: cap GTT size to physical RAM on APUs
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
drm/vmwgfx: bound DMA command body size against suffix pointer
HID: logitech-dj: Fix maxfield check in DJ short report validation
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
net: openvswitch: fix skb leak on flow key update failure during recirculation
firmware: stratix10-svc: fix memory leaks and list corruption bugs
gpio: pch: use raw_spinlock_t for the register lock
mount: honour SB_NOUSER in the new mount API
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
nfs4: take a reference on the nfs_client when running FREE_STATEID
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
ARM: npcm: Fix OF node refcount leaks in SMP setup
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
bpf: Preserve pointer state for commuted arithmetic
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
net/sched: cls_route: fix fastmap use-after-free on filter
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
net/mlx5: fw_tracer, return NULL on create error
counter: microchip-tcb-capture: Fix DT channel validation
vhost/vdpa: reject overflowing PA map page counts on 32-bit
udp: fix potential use-after-free in tunnel segmentation
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
net/openvswitch: check Ethernet header length in key_extract()
selftests/ftrace: Add test case for GRP/ only input
selftests/ftrace: refactor eprobes test to fix argument checks
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
bnxt_en: Fix PTP PPS setting bug
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
tcp: fix TFO max_qlen accounting across reuseport migration
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
net: prestera: validate firmware header length
net: remove WARN_ON_ONCE() from sk_mc_loop()
net/smc: fix TOCTOU race between smc_listen_out() and listener close
net: qrtr: ns: Raise lookup limit to 128
net: thunderbolt: Tear down DMA paths before stopping the rings
ata: pata_sl82c105: fix bridge revision use-after-free
sctp: clear control chunk transport if it is being removed
tls: don't abort the connection on signal-interrupted sends
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Input: evdev - sanitize event type index when fetching event masks
ALSA: usb-audio: fix OOB write on Type II inbound URBs
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
thunderbolt: icm: Preserve USB4 proxy data-valid bit
usb: cdnsp: fix incorrect endian conversions for APB timeout register
usb: gadget: f_ncm: Use unsigned int for ndp_index
ima: fix out-of-bounds read in xattr_verify()
ipvs: add totalconns for dest
ipvs: properly update the overload flag on dest edit
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
net/packet: reset the MAC header on the packet-socket transmit path
net: openvswitch: reallocate update replies for mismatched IDs
net: octeontx2-pf: Fix UB in shift operation
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
netfilter: ebt_nflog: pin the NFLOG backend
net: bridge: mrp: fix uninitialised bytes on the wire
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Input: evdev - fix information leak in evdev_pass_values()
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
futex: Prevent robust futex exit race some more
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
fscrypt: Replace mk_users keyring with simple list
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
ipv4: fix use-after-free in fib_nhc_update_mtu()
serial: 8250_dma: Clear stale RX state on shutdown
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: validate monitor transmit frame lengths
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
ALSA: usx2y: bound the hwdep mmap fault offset
tracing: Fix race between update_event_fields and, event_define_fields
fbdev: bitblit: bound-check glyph index in bit_cursor()
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
netfilter: bridge: release template ct on non-IP path
net: atlantic: free RX pages of consumed but not refilled buffers
net/sched: act_gact, act_police: range check the fallback control action
xdp: reject clones that overrun skb_shared_info tailroom
vxlan: do not arm the ageing timer on a device that is down
vsock/virtio: read virtqueues under worker locks
vsock/virtio: avoid refilling the RX queue after teardown
vhost: reset the vring metadata cache on vring reconfiguration
tipc: read le->link under the node lock in tipc_node_link_down()
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
ipv6: fix Route Information option length validation
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
bpf, sockmap: Fix sk_redir use-after-free in send verdict
scsi: scsi_debug: Negate wrapped memcmp() result
sctp: keep chunk->transport in step with the list it is queued on
sctp: fix use-after-free of cached ASCONF chunk
sctp: clear new_transport when removing a peer
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Linux 5.15.216
UBUNTU: Upstream stable to v5.15.216
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Vinicius Peixoto (vpeixoto)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Vinicius Peixoto (vpeixoto)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.216 upstream stable release
from git://git.kernel.org/
-
+ nvmet-tcp: Fix potential UAF when ddgst mismatch
+ futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
+ macsec: don't read an unset MAC header in macsec_encrypt()
+ KVM: nVMX: Hide shadow VMCS right after VMCLEAR
+ KVM: x86/mmu: Fix use-after-free on vendor module reload
+ can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
+ can: isotp: serialize TX state transitions under so->rx_lock
+ dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
+ Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
+ Input: ims-pcu - fix logic error in packet reset
+ KVM: VMX: Make vmread_error_trampoline() uncallable from C code
+ IB/mad: Drop unmatched RMPP responses before reassembly
+ mtd: mtdswap: remove debugfs stats file on teardown
+ mtd: nand: mtk-ecc: stop on ECC idle timeouts
+ btrfs: reject free space cache with more entries than pages
+ btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
+ firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
+ RDMA/hns: Fix potential integer overflow in mhop hem cleanup
+ RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
+ RDMA/siw: publish QP after initialization
+ RDMA/irdma: Prevent overflows in memory contiguity checks
+ xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
+ wifi: cfg80211: cancel sched scan results work on unregister
+ wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
+ wifi: mac80211_hwsim: clamp virtio RX length before skb_put
+ wifi: libertas: fix memory leak in helper_firmware_cb()
+ wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
+ wifi: cfg80211: validate PMSR measurement type data
+ wifi: cfg80211: validate PMSR FTM preamble range
+ wifi: cfg80211: reject unsupported PMSR FTM location requests
+ wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
+ wifi: brcmfmac: initialize SDIO data work before cleanup
+ wifi: cfg80211: bound element ID read when checking non-inheritance
+ ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
+ ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
+ firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
+ ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
+ ipv4: fib: free fib_alias with kfree_rcu() on insert error path
+ net/iucv: take a reference on the socket found in afiucv_hs_rcv()
+ ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
registered
+ ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
+ ata: sata_dwc_460ex: remove variable num_processed
+ ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
+ ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
+ Bluetooth: qca: fix NVM tag length underflow in TLV parser
+ smb/client: handle overlapping allocated ranges in fallocate
+ drm/i915/gt: use correct selftest config symbol
+ powerpc/time: Fix sparse warnings
+ powerpc: remove the last remnants of cputime_t
+ sched/vtime: Get rid of generic vtime_task_switch() implementation
+ powerpc/time: Prepare to stop elapsing in dynticks-idle
+ powerpc/vtime: Initialize starttime at boot for native accounting
+ can: j1939: fix lockless local-destination check
+ ksmbd: validate compound request size before reading StructureSize2
+ drm/i915/selftests: Fix GT PM sort comparators
+ net/sched: act_tunnel_key: Defer dst_release to RCU callback
+ sctp: fix auth_hmacs array size in struct sctp_cookie
+ mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
+ wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
+ USB: storage: add NO_ATA_1X quirk for Longmai USB Key
+ usb: chipidea: fix usage_count leak when autosuspend_delay is negative
+ usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
+ usb: gadget: f_midi: cancel pending IN work before freeing the midi object
+ usb: gadget: printer: fix infinite loop in printer_read()
+ USB: gadget: snps-udc: fix device name leak on probe failure
+ USB: gadget: fsl-udc: fix device name leak on probe failure
+ usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
+ usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
+ usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
+ USB: serial: ftdi_sio: add support for E+H FXA291
+ USB: serial: io_edgeport: cap received transmit credits
+ USB: serial: keyspan_pda: fix data loss on receive throttling
+ USB: serial: option: add TDTECH MT5710-CN
+ crypto: rsa-pkcs1pad: Don't WARN on an empty digest
+ bpf: Fix ld_{abs,ind} failure path analysis in subprogs
+ usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
+ wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
request
+ hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
+ hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
+ watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
+ wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
+ firewire: net: Fix fragmented datagram reassembly
+ wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
+ wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
+ wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
+ wifi: carl9170: fix OOB read from off-by-two in TX status handler
+ wifi: carl9170: fix buffer overflow in rx_stream failover path
+ btrfs: free mapping node on duplicate reloc root insert
+ ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint
+ ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
+ usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
+ hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status
+ hwmon: (occ) Add sysfs entry for OCC mode
+ hwmon: (occ) Add sysfs entries for additional extended status bits
+ hwmon: (occ) Delay hwmon registration until user request
+ hwmon: occ: validate poll response sensor blocks
+ net/packet: avoid fanout hook re-registration after unregister
+ rds: drop incoming messages that cross network namespace boundaries
+ dpaa2-switch: put MAC endpoint device on disconnect
+ net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call
+ dpaa2-eth: put MAC endpoint device on disconnect
+ nfp: Check resource mutex allocation
+ wan: wanxl: Only reset hardware after BAR mapping
+ wifi: mwifiex: bound uAP association event IEs to the event buffer
+ iommu/amd: Bound the early ACPI HID map
+ iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
+ wifi: mac80211: recalculate TIM when a station enters power save
+ amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
+ sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
+ sctp: validate stream count in sctp_process_strreset_inreq()
+ nexthop: initialize extack in nh_res_bucket_migrate()
+ tipc: fix infinite loop in __tipc_nl_compat_dumpit
+ wifi: mt76: connac: fix possible NULL-pointer deref in
mt76_connac_mcu_uni_bss_he_tlv()
+ wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
+ net: bridge: vlan: fix vlan range dumps starting with pvid
+ net: hsr: fix memory leak on slave unregistration by removing synced VLANs
+ sctp: auth: verify auth requirement when auth_chunk is NULL
+ vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
+ tipc: fix u16 MTU truncation in media and bearer MTU validation
+ net: stmmac: add tc flower filter for EtherType matching
+ net: stmmac: fix l3l4 filter rejecting unsupported offload requests
+ net: stmmac: reset residual action in L3L4 filters on delete
+ octeontx2-vf: set TC flower flag on MCAM entry allocation
+ ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
+ hinic: remove unused ethtool RSS user configuration buffers
+ net: qrtr: restrict socket creation to the initial network namespace
+ net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
+ net/mlx5e: Report zero bandwidth for non-ETS traffic classes
+ net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
+ raw: use more conventional iterators
+ net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
+ bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
+ can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
+ can: bcm: add locking when updating filter and timer values
+ can: bcm: fix CAN frame rx/tx statistics
+ can: bcm: extend bcm_tx_lock usage for data and timer updates
+ can: bcm: validate frame length in bcm_rx_setup() for RTR replies
+ can: bcm: add missing device refcount for CAN filter removal
+ can: bcm: fix stale rx/tx ops after device removal
+ can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
+ can: bcm: track a single source interface for ANYDEV timeout/throttle ops
+ drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
+ drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
+ drm/radeon: fix r100_copy_blit for large BOs
+ drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
+ drm/i915: Return NULL on error in active_instance
+ drm/i915/gem: Do not leak siblings[] on proto context error
+ drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+ drm/amdgpu: Fix VFCT bus number matching with soft filter
+ drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
+ drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
+ drm/vmwgfx: Validate vmw_surface_metadata::array_size
+ media: airspy: Return queued buffers on start_streaming() failure
+ media: cec: seco: unregister adapter on IR probe failure
+ media: cedrus: clean up media device on probe failure
+ media: cedrus: Fix missing cleanup in error path
+ media: cedrus: skip invalid H.264 reference list entries
+ media: cx231xx: fix devres lifetime
+ media: cx23885: add ioremap return check and cleanup
+ media: meson: vdec: Fix memory leak in error path of vdec_open
+ media: msi2500: Return queued buffers on start_streaming() failure
+ media: pci: dm1105: Free allocated workqueue
+ media: pwc: Drain fill_buf on start_streaming() failure
+ media: pwc: Return queued buffers on start_streaming() failure
+ media: radio-si476x: Unregister v4l2_device on probe failure
+ media: rtl2832: fix use-after-free in rtl2832_remove()
+ media: rtl2832_sdr: Return queued buffers on start_streaming() failure
+ media: saa7134: Fix a possible memory leak in saa7134_video_init1
+ media: sun4i-csi: Return queued buffers on start_streaming() failure
+ media: tegra-video: vi: fix invalid u32 return value in format lookup
+ media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
+ media: vb2: use ssize_t for vb2_read/vb2_write
+ media: vidtv: fix reference leak on failed device registration
+ media: vimc: fix reference leak on failed device registration
+ media: vivid: check for vb2_is_busy() when toggling caps
+ wifi: ath6kl: fix OOB access from firmware ADDBA window size
+ wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
+ wifi: wilc1000: validate assoc response length before subtracting header
+ wifi: brcmfmac: make release_scratchbuffers idempotent
+ staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
+ staging: rtl8723bs: fix inverted HT40 secondary channel offset
+ Bluetooth: RFCOMM: Fix session UAF in set_termios
+ exec: fix unsigned loop counter wrap in transfer_args_to_stack()
+ binfmt_misc: set have_execfd only once the interpreter is opened
+ cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
+ x86/boot/compressed: Disable jump tables
+ comedi: comedi_parport: deal with premature interrupt
+ intel_th: fix MSC output device reference leak
+ tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
+ tracing: Fix resource leak on mmiotrace trace_pipe close
+ tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
+ tracing/probes: Avoid temporary buffer truncation in
trace_probe_match_command_args()
+ tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
+ tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
+ arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
+ Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
+ mptcp: only set DATA_FIN when a mapping is present
+ sctp: don't free the ASCONF's own transport in DEL-IP processing
+ ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
+ libceph: bound get_version reply decode to front len
+ libceph: Fix multiplication overflow in decode_new_up_state_weight()
+ libceph: guard missing CRUSH type name lookup
+ libceph: refresh auth->authorizer_buf{,_len} after authorizer update
+ libceph: Reject monmaps advertising zero monitors
+ libceph: reject zero bucket types in crush_decode
+ libceph: remove debugfs files before client teardown
+ binfmt_elf_fdpic: only honour the first PT_INTERP
+ iommu/vt-d: Disallow SVA if page walk is not coherent
+ phonet: pep: fix use-after-free in pep_get_sb()
+ vxlan: require CAP_NET_ADMIN in the device netns for changelink
+ net: slip: serialize receive against buffer reallocation
+ geneve: require CAP_NET_ADMIN in the device netns for changelink
+ net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
+ net/iucv: fix use-after-free of a severed iucv_path
+ net/x25: fix use-after-free in x25_kill_by_neigh()
+ net: hip04: fix RX buffer leak on build_skb failure
+ proc: Fix broken error paths for namespace links
+ rbd: Reset positive result codes to zero in object map update path
+ ice: use READ_ONCE() to access cached PHC time
+ ila: reload IPv6 header after pskb_may_pull in checksum adjust
+ mac802154: llsec: reject frames shorter than the authentication tag
+ pppoe: reload header pointer after dev_hard_header()
+ tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
+ drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/gfx8: drop unecessary BUG_ON()
+ drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
+ drm/amdgpu: fix division by zero with invalid uvd dimensions
+ drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
+ tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
+ wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
+ openvswitch: fix GSO userspace truncation underflow
+ raw: remove unused variables from raw6_icmp_error()
+ raw: fix a typo in raw_icmp_error()
+ net: mpls: initialize rtm_tos in mpls_getroute()
+ media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
+ media: uvcvideo: Fix sequence number when no EOF
+ gve: fix Rx queue stall on alloc failure
+ HID: logitech-dj: Standardise hid_report_enum variable nomenclature
+ HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
+ HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
+ net: qrtr: ns: Limit the maximum server registration per node
+ net: qrtr: ns: Raise node count limit to 512
+ dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
+ ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
+ ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
+ phy: zynqmp: Allow variation in refclk rate
+ phy-zynqmp: Postpone getting clock rate until actually needed
+ phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
+ phy: zynqmp: fix runtime PM leak on probe allocation failure
+ netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
+ drm/mediatek: Check CRTC state before freeing
+ keys: fix out-of-bounds read in keyring_get_key_chunk()
+ keys: make keyring key-chunk byte order agree with keyring_diff_objects()
+ assoc_array: trim the final shortcut word using the current chunk end
+ netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
+ netfilter: nft_payload: fix mask build for partial field offload
+ rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
+ rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
+ scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
+ scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
+ smb: client: fix buffer leaks in SMB1 read and write
+ hwmon: (nct6775-core) Prevent access to unsupported weight registers
+ net: bridge: mrp: fix Option TLV length in MRP_Test frames
+ forcedeth: fix UAF of txrx_stats in nv_remove
+ hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
+ hwmon: (adt7470) Fix cache updated before hardware write on I2C error
+ hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
+ hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
+ hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
+ hwmon: (adt7470) Use cached PWM frequency value
+ hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
+ hwmon: (adt7470) Fix PWM auto temp state array and bounds check
+ powerpc/boot: Fix simpleboot CPU node lookup check
+ powerpc/boot: Fix treeboot-currituck CPU node lookup check
+ powerpc/boot: Fix treeboot-akebono CPU node lookup check
+ wifi: mac80211: validate individual TWT params before driver setup
+ hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
+ Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
+ net: phylink: put link_gpio if phylink_create fails
+ scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
+ net: sxgbe: free TX rings on RX allocation failure
+ net: sxgbe: check descriptor ring allocation failures
+ can: isotp: check register_netdevice_notifier() error in module init
+ tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
+ octeontx2-pf: Set correct sequence for carrier off and tx queue stop
+ qede: sync udp_tunnel ports outside qede_lock in the recovery path
+ rhashtable: clear stale iter->p on table restart
+ pinctrl: devicetree: don't free uninitialized dev_name on error path
+ pinctrl: bm1880: add missing select GENERIC_PINCONF
+ mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
+ mm/hugetlb: fix list corruption in allocate_file_region_entries()
+ sctp: validate Adaptation Indication parameter length
+ audit: fix potential integer overflow in audit_log_n_string()
+ audit: fix potential use-after-free in audit_del_rule()
+ Bluetooth: HIDP: reject frames without a transaction header
+ Bluetooth: HIDP: validate numbered report payloads
+ bpf: lwt: Fix dst reference leak on reroute failure
+ ALSA: 6fire: Fix UAF at error handling during probe
+ ALSA: lx6464es: fix period byte count for 16-bit streams
+ ALSA: pcm: wake linked drain waiters on unlink
+ ASoC: tas2562: fix DVC coefficient write order
+ ASoC: tas2562: fix broken entries in the volume lookup table
+ ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
+ ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
+ ALSA: usb-audio: Clamp frame size in implicit-feedback mode
+ dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
+ e1000: fix memory leak in e1000_probe()
+ igbvf: Fix leak in TX DMA error cleanup
+ ipvs: do not propagate one-packet flag to synced conns
+ net/smc: fix socket use-after-free during link group termination
+ netfilter: ipset: do not update comments from kernel-side hash adds
+ tipc: avoid use-after-free in poll trace queue dumps
+ wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
+ binfmt_misc: reject a flag character as the field delimiter
+ mm/page_reporting: use system_freezable_wq to fix UAF during suspend
+ net: bridge: stop fast-leave after deleting a port group
+ net: ipv6: clear suppressed fib6 rule result
+ powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
+ um: vector: fix use-after-free in vector_mmsg_rx()
+ vxlan: re-fetch eth header after route_shortcircuit()
+ vxlan: unclone skb head before modifying eth header in route_shortcircuit()
+ vxlan: use neigh_ha_snapshot() in route_shortcircuit()
+ vxlan: use pskb_network_may_pull() in route_shortcircuit()
+ tracing: Check return value of __register_event() in trace_module_add_events()
+ tracing/filters: Fix false positive match in regex_match_full()
+ selftests/clone3: fix wild pointer access of getline due to missing init
+ sctp: reject stale cookies with mismatched verification tags
+ sctp: prevent peer transport count overflow
+ hwmon: (npcm750-pwm-fan): stop fan timer on device detach
+ i2c: amd-mp2: Unregister callback on adapter add failure
+ cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
+ s390/qeth: Check CAP_NET_ADMIN for private ioctls
+ s390/dasd: Fix potential NULL pointer dereference
+ s390/zcrypt: Validate length for CCA AES cipher key requests
+ s390/zcrypt: Validate length for CCA ECC private key requests
+ phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
+ phy: zynqmp: use read-modify-write for SERDES scrambler bypass
+ phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
+ net: openvswitch: fix potential UAF on meter attach failure
+ net: openvswitch: fix skb leak on flow key update failure during ct
+ i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
deadlock
+ i2c: imx: Cancel hrtimer before clearing slave pointer
+ can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
+ can: ems_usb: validate CPC message lengths
+ can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
resubmit failure
+ can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
+ can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
+ can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
+ can: softing: fw_parse(): validate firmware record spans
+ can: peak_usb: add bounds check for USB channel index
+ can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
+ can: peak_usb: validate uCAN receive record lengths
+ drm/vc4: Zero the tile state data array before each BIN job
+ drm/amdgpu: restore UMD profile pstate after runtime resume
+ drm/amdgpu: cap GTT size to physical RAM on APUs
+ drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
+ drm/vmwgfx: bound DMA command body size against suffix pointer
+ HID: logitech-dj: Fix maxfield check in DJ short report validation
+ mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
+ net: openvswitch: fix skb leak on flow key update failure during recirculation
+ firmware: stratix10-svc: fix memory leaks and list corruption bugs
+ gpio: pch: use raw_spinlock_t for the register lock
+ mount: honour SB_NOUSER in the new mount API
+ s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
+ nfs4: take a reference on the nfs_client when running FREE_STATEID
+ NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
+ ARM: npcm: Fix OF node refcount leaks in SMP setup
+ bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
+ bpf: Preserve pointer state for commuted arithmetic
+ net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
+ net/sched: cls_route: fix fastmap use-after-free on filter
+ net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
+ net/mlx5: fw_tracer, return NULL on create error
+ counter: microchip-tcb-capture: Fix DT channel validation
+ vhost/vdpa: reject overflowing PA map page counts on 32-bit
+ udp: fix potential use-after-free in tunnel segmentation
+ net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
+ net/openvswitch: check Ethernet header length in key_extract()
+ selftests/ftrace: Add test case for GRP/ only input
+ selftests/ftrace: refactor eprobes test to fix argument checks
+ bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
+ bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
+ bnxt_en: Fix PTP PPS setting bug
+ sctp: fix addip_serial increment on ASCONF_ACK allocation failure
+ tcp: fix TFO max_qlen accounting across reuseport migration
+ net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
+ net: prestera: validate firmware header length
+ net: remove WARN_ON_ONCE() from sk_mc_loop()
+ net/smc: fix TOCTOU race between smc_listen_out() and listener close
+ net: qrtr: ns: Raise lookup limit to 128
+ net: thunderbolt: Tear down DMA paths before stopping the rings
+ ata: pata_sl82c105: fix bridge revision use-after-free
+ sctp: clear control chunk transport if it is being removed
+ tls: don't abort the connection on signal-interrupted sends
+ hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
+ spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+ Input: evdev - sanitize event type index when fetching event masks
+ ALSA: usb-audio: fix OOB write on Type II inbound URBs
+ usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
+ thunderbolt: icm: Preserve USB4 proxy data-valid bit
+ usb: cdnsp: fix incorrect endian conversions for APB timeout register
+ usb: gadget: f_ncm: Use unsigned int for ndp_index
+ ima: fix out-of-bounds read in xattr_verify()
+ ipvs: add totalconns for dest
+ ipvs: properly update the overload flag on dest edit
+ ipvs: clear IPv4 options after rebasing tunnel ICMP errors
+ net/packet: reset the MAC header on the packet-socket transmit path
+ net: openvswitch: reallocate update replies for mismatched IDs
+ net: octeontx2-pf: Fix UB in shift operation
+ net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
+ netfilter: ebt_nflog: pin the NFLOG backend
+ net: bridge: mrp: fix uninitialised bytes on the wire
+ vt: add permission check for KDSKBMETA ioctl
+ vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
+ Input: evdev - fix information leak in evdev_pass_values()
+ Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
+ Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
+ futex: Prevent robust futex exit race some more
+ pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
+ RDMA/rxe: Fix a use-after-free problem in rxe_mmap
+ fscrypt: Replace mk_users keyring with simple list
+ ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
+ ipv4: fix use-after-free in fib_nhc_update_mtu()
+ serial: 8250_dma: Clear stale RX state on shutdown
+ staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
+ staging: rtl8723bs: fix OOB read in WMM_param_handler()
+ staging: rtl8723bs: fix missing shared-key auth challenge length check
+ staging: rtl8723bs: validate monitor transmit frame lengths
+ misc: fastrpc: fix channel ctx ref leak when session alloc fails
+ misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
+ ALSA: usx2y: bound the hwdep mmap fault offset
+ tracing: Fix race between update_event_fields and, event_define_fields
+ fbdev: bitblit: bound-check glyph index in bit_cursor()
+ ipv6: prevent in6_dev_get() from resurrecting inet6_dev
+ netfilter: bridge: release template ct on non-IP path
+ net: atlantic: free RX pages of consumed but not refilled buffers
+ net/sched: act_gact, act_police: range check the fallback control action
+ xdp: reject clones that overrun skb_shared_info tailroom
+ vxlan: do not arm the ageing timer on a device that is down
+ vsock/virtio: read virtqueues under worker locks
+ vsock/virtio: avoid refilling the RX queue after teardown
+ vhost: reset the vring metadata cache on vring reconfiguration
+ tipc: read le->link under the node lock in tipc_node_link_down()
+ Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
+ ipv6: fix Route Information option length validation
+ ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
+ bpf, sockmap: Fix sk_redir use-after-free in send verdict
+ scsi: scsi_debug: Negate wrapped memcmp() result
+ sctp: keep chunk->transport in step with the list it is queued on
+ sctp: fix use-after-free of cached ASCONF chunk
+ sctp: clear new_transport when removing a peer
+ thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Linux 5.15.216
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- tipc: read le->link under the node lock in tipc_node_link_down()
- vhost: reset the vring metadata cache on vring reconfiguration
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: read virtqueues under worker locks
- vxlan: do not arm the ageing timer on a device that is down
- xdp: reject clones that overrun skb_shared_info tailroom
- net/sched: act_gact, act_police: range check the fallback control action
- net: atlantic: free RX pages of consumed but not refilled buffers
- netfilter: bridge: release template ct on non-IP path
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- tracing: Fix race between update_event_fields and, event_define_fields
- ALSA: usx2y: bound the hwdep mmap fault offset
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- staging: rtl8723bs: validate monitor transmit frame lengths
- staging: rtl8723bs: fix missing shared-key auth challenge length check
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- serial: 8250_dma: Clear stale RX state on shutdown
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- fscrypt: Replace mk_users keyring with simple list
- RDMA/rxe: Fix a use-after-free problem in rxe_mmap
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
- futex: Prevent robust futex exit race some more
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
- Input: evdev - fix information leak in evdev_pass_values()
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- vt: add permission check for KDSKBMETA ioctl
- net: bridge: mrp: fix uninitialised bytes on the wire
- netfilter: ebt_nflog: pin the NFLOG backend
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- net: octeontx2-pf: Fix UB in shift operation
- net: openvswitch: reallocate update replies for mismatched IDs
- net/packet: reset the MAC header on the packet-socket transmit path
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- ipvs: properly update the overload flag on dest edit
- ipvs: add totalconns for dest
- ima: fix out-of-bounds read in xattr_verify()
- usb: gadget: f_ncm: Use unsigned int for ndp_index
- usb: cdnsp: fix incorrect endian conversions for APB timeout register
- thunderbolt: icm: Preserve USB4 proxy data-valid bit
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- ALSA: usb-audio: fix OOB write on Type II inbound URBs
- Input: evdev - sanitize event type index when fetching event masks
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
- tls: don't abort the connection on signal-interrupted sends
- sctp: clear control chunk transport if it is being removed
- ata: pata_sl82c105: fix bridge revision use-after-free
- net: thunderbolt: Tear down DMA paths before stopping the rings
- net: qrtr: ns: Raise lookup limit to 128
- net/smc: fix TOCTOU race between smc_listen_out() and listener close
- net: remove WARN_ON_ONCE() from sk_mc_loop()
- net: prestera: validate firmware header length
- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
- tcp: fix TFO max_qlen accounting across reuseport migration
- sctp: fix addip_serial increment on ASCONF_ACK allocation failure
- bnxt_en: Fix PTP PPS setting bug
- bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
- selftests/ftrace: refactor eprobes test to fix argument checks
- selftests/ftrace: Add test case for GRP/ only input
- net/openvswitch: check Ethernet header length in key_extract()
- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
- udp: fix potential use-after-free in tunnel segmentation
- vhost/vdpa: reject overflowing PA map page counts on 32-bit
- counter: microchip-tcb-capture: Fix DT channel validation
- net/mlx5: fw_tracer, return NULL on create error
- net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
- net/sched: cls_route: fix fastmap use-after-free on filter
- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
- bpf: Preserve pointer state for commuted arithmetic
- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- ARM: npcm: Fix OF node refcount leaks in SMP setup
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- nfs4: take a reference on the nfs_client when running FREE_STATEID
- s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
- mount: honour SB_NOUSER in the new mount API
- gpio: pch: use raw_spinlock_t for the register lock
- firmware: stratix10-svc: fix memory leaks and list corruption bugs
- net: openvswitch: fix skb leak on flow key update failure during recirculation
- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
- HID: logitech-dj: Fix maxfield check in DJ short report validation
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/amdgpu: cap GTT size to physical RAM on APUs
- drm/amdgpu: restore UMD profile pstate after runtime resume
- drm/vc4: Zero the tile state data array before each BIN job
- can: peak_usb: validate uCAN receive record lengths
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
- can: peak_usb: add bounds check for USB channel index
- can: softing: fw_parse(): validate firmware record spans
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
resubmit failure
- can: ems_usb: validate CPC message lengths
- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
- i2c: imx: Cancel hrtimer before clearing slave pointer
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
deadlock
- net: openvswitch: fix skb leak on flow key update failure during ct
- net: openvswitch: fix potential UAF on meter attach failure
- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
- phy: zynqmp: use read-modify-write for SERDES scrambler bypass
- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
- s390/zcrypt: Validate length for CCA ECC private key requests
- s390/zcrypt: Validate length for CCA AES cipher key requests
- s390/dasd: Fix potential NULL pointer dereference
- s390/qeth: Check CAP_NET_ADMIN for private ioctls
- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
- i2c: amd-mp2: Unregister callback on adapter add failure
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach
- sctp: prevent peer transport count overflow
- sctp: reject stale cookies with mismatched verification tags
- selftests/clone3: fix wild pointer access of getline due to missing init
- tracing/filters: Fix false positive match in regex_match_full()
- tracing: Check return value of __register_event() in trace_module_add_events()
- vxlan: use pskb_network_may_pull() in route_shortcircuit()
- vxlan: use neigh_ha_snapshot() in route_shortcircuit()
- vxlan: unclone skb head before modifying eth header in route_shortcircuit()
- vxlan: re-fetch eth header after route_shortcircuit()
- um: vector: fix use-after-free in vector_mmsg_rx()
- powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
- net: ipv6: clear suppressed fib6 rule result
- net: bridge: stop fast-leave after deleting a port group
- mm/page_reporting: use system_freezable_wq to fix UAF during suspend
- binfmt_misc: reject a flag character as the field delimiter
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
- tipc: avoid use-after-free in poll trace queue dumps
- netfilter: ipset: do not update comments from kernel-side hash adds
- net/smc: fix socket use-after-free during link group termination
- ipvs: do not propagate one-packet flag to synced conns
- igbvf: Fix leak in TX DMA error cleanup
- e1000: fix memory leak in e1000_probe()
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
- ASoC: tas2562: fix broken entries in the volume lookup table
- ASoC: tas2562: fix DVC coefficient write order
- ALSA: pcm: wake linked drain waiters on unlink
- ALSA: lx6464es: fix period byte count for 16-bit streams
- ALSA: 6fire: Fix UAF at error handling during probe
- bpf: lwt: Fix dst reference leak on reroute failure
- Bluetooth: HIDP: validate numbered report payloads
- Bluetooth: HIDP: reject frames without a transaction header
- audit: fix potential use-after-free in audit_del_rule()
- audit: fix potential integer overflow in audit_log_n_string()
- sctp: validate Adaptation Indication parameter length
- mm/hugetlb: fix list corruption in allocate_file_region_entries()
- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
- pinctrl: bm1880: add missing select GENERIC_PINCONF
- pinctrl: devicetree: don't free uninitialized dev_name on error path
- rhashtable: clear stale iter->p on table restart
- qede: sync udp_tunnel ports outside qede_lock in the recovery path
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop
- tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
- can: isotp: check register_netdevice_notifier() error in module init
- net: sxgbe: check descriptor ring allocation failures
- net: sxgbe: free TX rings on RX allocation failure
- scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
- net: phylink: put link_gpio if phylink_create fails
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
- wifi: mac80211: validate individual TWT params before driver setup
- powerpc/boot: Fix treeboot-akebono CPU node lookup check
- powerpc/boot: Fix treeboot-currituck CPU node lookup check
- powerpc/boot: Fix simpleboot CPU node lookup check
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check
- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
- hwmon: (adt7470) Use cached PWM frequency value
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
- hwmon: (adt7470) Fix cache updated before hardware write on I2C error
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
- forcedeth: fix UAF of txrx_stats in nv_remove
- net: bridge: mrp: fix Option TLV length in MRP_Test frames
- hwmon: (nct6775-core) Prevent access to unsupported weight registers
- smb: client: fix buffer leaks in SMB1 read and write
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
- rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
- rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
- netfilter: nft_payload: fix mask build for partial field offload
- netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
- assoc_array: trim the final shortcut word using the current chunk end
- keys: make keyring key-chunk byte order agree with keyring_diff_objects()
- keys: fix out-of-bounds read in keyring_get_key_chunk()
- drm/mediatek: Check CRTC state before freeing
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
- phy: zynqmp: fix runtime PM leak on probe allocation failure
- phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
- phy-zynqmp: Postpone getting clock rate until actually needed
- phy: zynqmp: Allow variation in refclk rate
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
- tls: separate no-async decryption request handling from async
- net: qrtr: ns: Raise node count limit to 512
- net: qrtr: ns: Limit the maximum server registration per node
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature
- gve: fix Rx queue stall on alloc failure
- media: uvcvideo: Fix sequence number when no EOF
- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
- net: mpls: initialize rtm_tos in mpls_getroute()
- raw: fix a typo in raw_icmp_error()
- raw: remove unused variables from raw6_icmp_error()
- openvswitch: fix GSO userspace truncation underflow
- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
- tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- drm/amdgpu: fix division by zero with invalid uvd dimensions
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx8: drop unecessary BUG_ON()
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
- pppoe: reload header pointer after dev_hard_header()
- mac802154: llsec: reject frames shorter than the authentication tag
- ila: reload IPv6 header after pskb_may_pull in checksum adjust
- ice: use READ_ONCE() to access cached PHC time
- rbd: Reset positive result codes to zero in object map update path
- proc: Fix broken error paths for namespace links
- net: hip04: fix RX buffer leak on build_skb failure
- net/x25: fix use-after-free in x25_kill_by_neigh()
- net/iucv: fix use-after-free of a severed iucv_path
- net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
- geneve: require CAP_NET_ADMIN in the device netns for changelink
- net: slip: serialize receive against buffer reallocation
- vxlan: require CAP_NET_ADMIN in the device netns for changelink
- phonet: pep: fix use-after-free in pep_get_sb()
- iommu/vt-d: Disallow SVA if page walk is not coherent
- binfmt_elf_fdpic: only honour the first PT_INTERP
- libceph: remove debugfs files before client teardown
- libceph: reject zero bucket types in crush_decode
- libceph: Reject monmaps advertising zero monitors
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update
- libceph: guard missing CRUSH type name lookup
- libceph: Fix multiplication overflow in decode_new_up_state_weight()
- libceph: bound get_version reply decode to front len
- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
- sctp: don't free the ASCONF's own transport in DEL-IP processing
- mptcp: only set DATA_FIN when a mapping is present
- Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
- arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
- tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
- tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
- tracing/probes: Avoid temporary buffer truncation in
trace_probe_match_command_args()
- tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
- tracing: Fix resource leak on mmiotrace trace_pipe close
- tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
- intel_th: fix MSC output device reference leak
- comedi: comedi_parport: deal with premature interrupt
- x86/boot/compressed: Disable jump tables
- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
- binfmt_misc: set have_execfd only once the interpreter is opened
- exec: fix unsigned loop counter wrap in transfer_args_to_stack()
- Bluetooth: RFCOMM: Fix session UAF in set_termios
- staging: rtl8723bs: fix inverted HT40 secondary channel offset
- staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
- wifi: brcmfmac: make release_scratchbuffers idempotent
- wifi: wilc1000: validate assoc response length before subtracting header
- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
- wifi: ath6kl: fix OOB access from firmware ADDBA window size
- media: vivid: check for vb2_is_busy() when toggling caps
- media: vimc: fix reference leak on failed device registration
- media: vidtv: fix reference leak on failed device registration
- media: vb2: use ssize_t for vb2_read/vb2_write
- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
- media: tegra-video: vi: fix invalid u32 return value in format lookup
- media: sun4i-csi: Return queued buffers on start_streaming() failure
- media: saa7134: Fix a possible memory leak in saa7134_video_init1
- media: rtl2832_sdr: Return queued buffers on start_streaming() failure
- media: rtl2832: fix use-after-free in rtl2832_remove()
- media: radio-si476x: Unregister v4l2_device on probe failure
- media: pwc: Return queued buffers on start_streaming() failure
- media: pwc: Drain fill_buf on start_streaming() failure
- media: pci: dm1105: Free allocated workqueue
- media: msi2500: Return queued buffers on start_streaming() failure
- media: meson: vdec: Fix memory leak in error path of vdec_open
- media: cx23885: add ioremap return check and cleanup
- media: cx231xx: fix devres lifetime
- media: cedrus: skip invalid H.264 reference list entries
- media: cedrus: Fix missing cleanup in error path
- media: cedrus: clean up media device on probe failure
- media: cec: seco: unregister adapter on IR probe failure
- media: airspy: Return queued buffers on start_streaming() failure
- drm/vmwgfx: Validate vmw_surface_metadata::array_size
- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
- drm/amdgpu: Fix VFCT bus number matching with soft filter
- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
- drm/i915/gem: Do not leak siblings[] on proto context error
- drm/i915: Return NULL on error in active_instance
- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
- drm/radeon: fix r100_copy_blit for large BOs
- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
- can: bcm: track a single source interface for ANYDEV timeout/throttle ops
- can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
- can: bcm: fix stale rx/tx ops after device removal
- can: bcm: add missing device refcount for CAN filter removal
- can: bcm: validate frame length in bcm_rx_setup() for RTR replies
- can: bcm: extend bcm_tx_lock usage for data and timer updates
- can: bcm: fix CAN frame rx/tx statistics
- can: bcm: add locking when updating filter and timer values
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
- bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
- net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
- raw: use more conventional iterators
- net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
- net/mlx5e: Report zero bandwidth for non-ETS traffic classes
- net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
- net: qrtr: restrict socket creation to the initial network namespace
- hinic: remove unused ethtool RSS user configuration buffers
- ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
- octeontx2-vf: set TC flower flag on MCAM entry allocation
- net: stmmac: reset residual action in L3L4 filters on delete
- net: stmmac: fix l3l4 filter rejecting unsupported offload requests
- net: stmmac: add tc flower filter for EtherType matching
- tipc: fix u16 MTU truncation in media and bearer MTU validation
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
- sctp: auth: verify auth requirement when auth_chunk is NULL
- net: hsr: fix memory leak on slave unregistration by removing synced VLANs
- net: bridge: vlan: fix vlan range dumps starting with pvid
- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
- wifi: mt76: connac: fix possible NULL-pointer deref in
mt76_connac_mcu_uni_bss_he_tlv()
- tipc: fix infinite loop in __tipc_nl_compat_dumpit
- nexthop: initialize extack in nh_res_bucket_migrate()
- sctp: validate stream count in sctp_process_strreset_inreq()
- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
- amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
- wifi: mac80211: recalculate TIM when a station enters power save
- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
- iommu/amd: Bound the early ACPI HID map
- wifi: mwifiex: bound uAP association event IEs to the event buffer
- wan: wanxl: Only reset hardware after BAR mapping
- nfp: Check resource mutex allocation
- dpaa2-eth: put MAC endpoint device on disconnect
- net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call
- dpaa2-switch: put MAC endpoint device on disconnect
- rds: drop incoming messages that cross network namespace boundaries
- net/packet: avoid fanout hook re-registration after unregister
- hwmon: occ: validate poll response sensor blocks
- hwmon: (occ) Delay hwmon registration until user request
- hwmon: (occ) Add sysfs entries for additional extended status bits
- hwmon: (occ) Add sysfs entry for OCC mode
- hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status
- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
- ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint
- btrfs: free mapping node on duplicate reloc root insert
- wifi: carl9170: fix buffer overflow in rx_stream failover path
- wifi: carl9170: fix OOB read from off-by-two in TX status handler
- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
- firewire: net: Fix fragmented datagram reassembly
- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
request
- usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
- bpf: Fix ld_{abs,ind} failure path analysis in subprogs
- Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
- crypto: rsa-pkcs1pad: Don't WARN on an empty digest
- USB: serial: option: add TDTECH MT5710-CN
- USB: serial: keyspan_pda: fix data loss on receive throttling
- USB: serial: io_edgeport: cap received transmit credits
- USB: serial: ftdi_sio: add support for E+H FXA291
- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
- USB: gadget: fsl-udc: fix device name leak on probe failure
- USB: gadget: snps-udc: fix device name leak on probe failure
- usb: gadget: printer: fix infinite loop in printer_read()
- usb: gadget: f_midi: cancel pending IN work before freeing the midi object
- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key
- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
- mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
- sctp: fix auth_hmacs array size in struct sctp_cookie
- net/sched: act_tunnel_key: Defer dst_release to RCU callback
- drm/i915/selftests: Fix GT PM sort comparators
- ksmbd: validate compound request size before reading StructureSize2
- can: j1939: fix lockless local-destination check
- powerpc/vtime: Initialize starttime at boot for native accounting
- powerpc/time: Prepare to stop elapsing in dynticks-idle
- sched/vtime: Get rid of generic vtime_task_switch() implementation
- powerpc: remove the last remnants of cputime_t
- powerpc/time: Fix sparse warnings
- drm/i915/gt: use correct selftest config symbol
- smb/client: handle overlapping allocated ranges in fallocate
- Bluetooth: qca: fix NVM tag length underflow in TLV parser
- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
- ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
- ata: sata_dwc_460ex: remove variable num_processed
- ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
- ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
registered
- net/iucv: take a reference on the socket found in afiucv_hs_rcv()
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
- wifi: cfg80211: bound element ID read when checking non-inheritance
- wifi: brcmfmac: initialize SDIO data work before cleanup
- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
- wifi: cfg80211: reject unsupported PMSR FTM location requests
- wifi: cfg80211: validate PMSR FTM preamble range
- wifi: cfg80211: validate PMSR measurement type data
- wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
- wifi: libertas: fix memory leak in helper_firmware_cb()
- wifi: mac80211_hwsim: clamp virtio RX length before skb_put
- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
- wifi: cfg80211: cancel sched scan results work on unregister
- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
- RDMA/irdma: Prevent overflows in memory contiguity checks
- RDMA/siw: publish QP after initialization
- RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
- RDMA/hns: Fix potential integer overflow in mhop hem cleanup
- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
- btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
- btrfs: reject free space cache with more entries than pages
- mtd: nand: mtk-ecc: stop on ECC idle timeouts
- mtd: mtdswap: remove debugfs stats file on teardown
- IB/mad: Drop unmatched RMPP responses before reassembly
- KVM: VMX: Make vmread_error_trampoline() uncallable from C code
- Input: ims-pcu - fix logic error in packet reset
- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
- dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
- can: isotp: serialize TX state transitions under so->rx_lock
- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
- KVM: x86/mmu: Fix use-after-free on vendor module reload
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR
- macsec: don't read an unset MAC header in macsec_encrypt()
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
- nvmet-tcp: Fix potential UAF when ddgst mismatch
+ UBUNTU: Upstream stable to v5.15.216
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165192
Title:
Jammy update: v5.15.216 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165192/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
