** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165172 Title: can not update from kernel 7.0.0-28-generic to 7.0.0-29-generic due to broken package Status in linux package in Ubuntu: Invalid Bug description: can not update from kernal 7.0.0-28-generic to 7.0.0-29-generic due to broken package To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165172/+subscriptions
среда
[Bug 2165192] [NEW] Jammy update: v5.15.216 upstream stable release
Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ nvmet-tcp: Fix potential UAF when ddgst mismatch futex: Prevent lockup in requeue-PI during signal/ timeout wakeup macsec: don't read an unset MAC header in macsec_encrypt() KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86/mmu: Fix use-after-free on vendor module reload can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: serialize TX state transitions under so->rx_lock dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ims-pcu - fix logic error in packet reset KVM: VMX: Make vmread_error_trampoline() uncallable from C code IB/mad: Drop unmatched RMPP responses before reassembly mtd: mtdswap: remove debugfs stats file on teardown mtd: nand: mtk-ecc: stop on ECC idle timeouts btrfs: reject free space cache with more entries than pages btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp RDMA/siw: publish QP after initialization RDMA/irdma: Prevent overflows in memory contiguity checks xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert wifi: cfg80211: cancel sched scan results work on unregister wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() wifi: mac80211_hwsim: clamp virtio RX length before skb_put wifi: libertas: fix memory leak in helper_firmware_cb() wifi: p54: validate RX frame length in p54_rx_eeprom_readback() wifi: cfg80211: validate PMSR measurement type data wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: brcmfmac: initialize SDIO data work before cleanup wifi: cfg80211: bound element ID read when checking non-inheritance ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF ipv4: fib: free fib_alias with kfree_rcu() on insert error path net/iucv: take a reference on the socket found in afiucv_hs_rcv() ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts ata: sata_dwc_460ex: remove variable num_processed ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Bluetooth: qca: fix NVM tag length underflow in TLV parser smb/client: handle overlapping allocated ranges in fallocate drm/i915/gt: use correct selftest config symbol powerpc/time: Fix sparse warnings powerpc: remove the last remnants of cputime_t sched/vtime: Get rid of generic vtime_task_switch() implementation powerpc/time: Prepare to stop elapsing in dynticks-idle powerpc/vtime: Initialize starttime at boot for native accounting can: j1939: fix lockless local-destination check ksmbd: validate compound request size before reading StructureSize2 drm/i915/selftests: Fix GT PM sort comparators net/sched: act_tunnel_key: Defer dst_release to RCU callback sctp: fix auth_hmacs array size in struct sctp_cookie mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() USB: storage: add NO_ATA_1X quirk for Longmai USB Key usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: printer: fix infinite loop in printer_read() USB: gadget: snps-udc: fix device name leak on probe failure USB: gadget: fsl-udc: fix device name leak on probe failure usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: io_edgeport: cap received transmit credits USB: serial: keyspan_pda: fix data loss on receive throttling USB: serial: option: add TDTECH MT5710-CN crypto: rsa-pkcs1pad: Don't WARN on an empty digest bpf: Fix ld_{abs,ind} failure path analysis in subprogs usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() firewire: net: Fix fragmented datagram reassembly wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler wifi: ath6kl: fix OOB read from firmware IE lengths in connect event wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read wifi: carl9170: fix OOB read from off-by-two in TX status handler wifi: carl9170: fix buffer overflow in rx_stream failover path btrfs: free mapping node on duplicate reloc root insert ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status hwmon: (occ) Add sysfs entry for OCC mode hwmon: (occ) Add sysfs entries for additional extended status bits hwmon: (occ) Delay hwmon registration until user request hwmon: occ: validate poll response sensor blocks net/packet: avoid fanout hook re-registration after unregister rds: drop incoming messages that cross network namespace boundaries dpaa2-switch: put MAC endpoint device on disconnect net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call dpaa2-eth: put MAC endpoint device on disconnect nfp: Check resource mutex allocation wan: wanxl: Only reset hardware after BAR mapping wifi: mwifiex: bound uAP association event IEs to the event buffer iommu/amd: Bound the early ACPI HID map iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() wifi: mac80211: recalculate TIM when a station enters power save amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp: validate stream count in sctp_process_strreset_inreq() nexthop: initialize extack in nh_res_bucket_migrate() tipc: fix infinite loop in __tipc_nl_compat_dumpit wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() wifi: brcmfmac: fix 802.1X-SHA256 call trace warning net: bridge: vlan: fix vlan range dumps starting with pvid net: hsr: fix memory leak on slave unregistration by removing synced VLANs sctp: auth: verify auth requirement when auth_chunk is NULL vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets tipc: fix u16 MTU truncation in media and bearer MTU validation net: stmmac: add tc flower filter for EtherType matching net: stmmac: fix l3l4 filter rejecting unsupported offload requests net: stmmac: reset residual action in L3L4 filters on delete octeontx2-vf: set TC flower flag on MCAM entry allocation ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup hinic: remove unused ethtool RSS user configuration buffers net: qrtr: restrict socket creation to the initial network namespace net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule net/mlx5e: Report zero bandwidth for non-ETS traffic classes net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation raw: use more conventional iterators net: ipv6: fix dif and sdif mismatch in raw6_icmp_error bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF can: bcm: add locking when updating filter and timer values can: bcm: fix CAN frame rx/tx statistics can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: add missing device refcount for CAN filter removal can: bcm: fix stale rx/tx ops after device removal can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: track a single source interface for ANYDEV timeout/throttle ops drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() drm/radeon: fix r100_copy_blit for large BOs drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() drm/i915: Return NULL on error in active_instance drm/i915/gem: Do not leak siblings[] on proto context error drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU drm/amdgpu: Fix VFCT bus number matching with soft filter drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved drm/vmwgfx: Validate vmw_surface_metadata::array_size media: airspy: Return queued buffers on start_streaming() failure media: cec: seco: unregister adapter on IR probe failure media: cedrus: clean up media device on probe failure media: cedrus: Fix missing cleanup in error path media: cedrus: skip invalid H.264 reference list entries media: cx231xx: fix devres lifetime media: cx23885: add ioremap return check and cleanup media: meson: vdec: Fix memory leak in error path of vdec_open media: msi2500: Return queued buffers on start_streaming() failure media: pci: dm1105: Free allocated workqueue media: pwc: Drain fill_buf on start_streaming() failure media: pwc: Return queued buffers on start_streaming() failure media: radio-si476x: Unregister v4l2_device on probe failure media: rtl2832: fix use-after-free in rtl2832_remove() media: rtl2832_sdr: Return queued buffers on start_streaming() failure media: saa7134: Fix a possible memory leak in saa7134_video_init1 media: sun4i-csi: Return queued buffers on start_streaming() failure media: tegra-video: vi: fix invalid u32 return value in format lookup media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() media: vb2: use ssize_t for vb2_read/vb2_write media: vidtv: fix reference leak on failed device registration media: vimc: fix reference leak on failed device registration media: vivid: check for vb2_is_busy() when toggling caps wifi: ath6kl: fix OOB access from firmware ADDBA window size wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper wifi: wilc1000: validate assoc response length before subtracting header wifi: brcmfmac: make release_scratchbuffers idempotent staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset Bluetooth: RFCOMM: Fix session UAF in set_termios exec: fix unsigned loop counter wrap in transfer_args_to_stack() binfmt_misc: set have_execfd only once the interpreter is opened cdrom: fix stack out-of-bounds read in CDROMVOLCTRL x86/boot/compressed: Disable jump tables comedi: comedi_parport: deal with premature interrupt intel_th: fix MSC output device reference leak tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" mptcp: only set DATA_FIN when a mapping is present sctp: don't free the ASCONF's own transport in DEL-IP processing ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: bound get_version reply decode to front len libceph: Fix multiplication overflow in decode_new_up_state_weight() libceph: guard missing CRUSH type name lookup libceph: refresh auth->authorizer_buf{,_len} after authorizer update libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: remove debugfs files before client teardown binfmt_elf_fdpic: only honour the first PT_INTERP iommu/vt-d: Disallow SVA if page walk is not coherent phonet: pep: fix use-after-free in pep_get_sb() vxlan: require CAP_NET_ADMIN in the device netns for changelink net: slip: serialize receive against buffer reallocation geneve: require CAP_NET_ADMIN in the device netns for changelink net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() net/iucv: fix use-after-free of a severed iucv_path net/x25: fix use-after-free in x25_kill_by_neigh() net: hip04: fix RX buffer leak on build_skb failure proc: Fix broken error paths for namespace links rbd: Reset positive result codes to zero in object map update path ice: use READ_ONCE() to access cached PHC time ila: reload IPv6 header after pskb_may_pull in checksum adjust mac802154: llsec: reject frames shorter than the authentication tag pppoe: reload header pointer after dev_hard_header() tipc: clear sock->sk on the failed-insert path in tipc_sk_create() drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx8: drop unecessary BUG_ON() drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() drm/amdgpu: fix division by zero with invalid uvd dimensions drm/amdgpu: invoke pm_genpd_remove() before freeing genpd tipc: fix use-after-free of the discoverer in tipc_disc_rcv() wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses openvswitch: fix GSO userspace truncation underflow raw: remove unused variables from raw6_icmp_error() raw: fix a typo in raw_icmp_error() net: mpls: initialize rtm_tos in mpls_getroute() media: uvcvideo: Implement dual stream quirk to fix loss of usb packets media: uvcvideo: Fix sequence number when no EOF gve: fix Rx queue stall on alloc failure HID: logitech-dj: Standardise hid_report_enum variable nomenclature HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report net: qrtr: ns: Limit the maximum server registration per node net: qrtr: ns: Raise node count limit to 512 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup phy: zynqmp: Allow variation in refclk rate phy-zynqmp: Postpone getting clock rate until actually needed phy: zynqmp: fix clock error handling in xpsgtr_phy_init() phy: zynqmp: fix runtime PM leak on probe allocation failure netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() drm/mediatek: Check CRTC state before freeing keys: fix out-of-bounds read in keyring_get_key_chunk() keys: make keyring key-chunk byte order agree with keyring_diff_objects() assoc_array: trim the final shortcut word using the current chunk end netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nft_payload: fix mask build for partial field offload rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer smb: client: fix buffer leaks in SMB1 read and write hwmon: (nct6775-core) Prevent access to unsupported weight registers net: bridge: mrp: fix Option TLV length in MRP_Test frames forcedeth: fix UAF of txrx_stats in nv_remove hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Fix PWM auto temp state array and bounds check powerpc/boot: Fix simpleboot CPU node lookup check powerpc/boot: Fix treeboot-currituck CPU node lookup check powerpc/boot: Fix treeboot-akebono CPU node lookup check wifi: mac80211: validate individual TWT params before driver setup hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp net: phylink: put link_gpio if phylink_create fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req net: sxgbe: free TX rings on RX allocation failure net: sxgbe: check descriptor ring allocation failures can: isotp: check register_netdevice_notifier() error in module init tracing/mmiotrace: Reset dropped_count in mmio_reset_data() octeontx2-pf: Set correct sequence for carrier off and tx queue stop qede: sync udp_tunnel ports outside qede_lock in the recovery path rhashtable: clear stale iter->p on table restart pinctrl: devicetree: don't free uninitialized dev_name on error path pinctrl: bm1880: add missing select GENERIC_PINCONF mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/hugetlb: fix list corruption in allocate_file_region_entries() sctp: validate Adaptation Indication parameter length audit: fix potential integer overflow in audit_log_n_string() audit: fix potential use-after-free in audit_del_rule() Bluetooth: HIDP: reject frames without a transaction header Bluetooth: HIDP: validate numbered report payloads bpf: lwt: Fix dst reference leak on reroute failure ALSA: 6fire: Fix UAF at error handling during probe ALSA: lx6464es: fix period byte count for 16-bit streams ALSA: pcm: wake linked drain waiters on unlink ASoC: tas2562: fix DVC coefficient write order ASoC: tas2562: fix broken entries in the volume lookup table ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: Clamp frame size in implicit-feedback mode dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ e1000: fix memory leak in e1000_probe() igbvf: Fix leak in TX DMA error cleanup ipvs: do not propagate one-packet flag to synced conns net/smc: fix socket use-after-free during link group termination netfilter: ipset: do not update comments from kernel-side hash adds tipc: avoid use-after-free in poll trace queue dumps wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames binfmt_misc: reject a flag character as the field delimiter mm/page_reporting: use system_freezable_wq to fix UAF during suspend net: bridge: stop fast-leave after deleting a port group net: ipv6: clear suppressed fib6 rule result powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() um: vector: fix use-after-free in vector_mmsg_rx() vxlan: re-fetch eth header after route_shortcircuit() vxlan: unclone skb head before modifying eth header in route_shortcircuit() vxlan: use neigh_ha_snapshot() in route_shortcircuit() vxlan: use pskb_network_may_pull() in route_shortcircuit() tracing: Check return value of __register_event() in trace_module_add_events() tracing/filters: Fix false positive match in regex_match_full() selftests/clone3: fix wild pointer access of getline due to missing init sctp: reject stale cookies with mismatched verification tags sctp: prevent peer transport count overflow hwmon: (npcm750-pwm-fan): stop fan timer on device detach i2c: amd-mp2: Unregister callback on adapter add failure cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() s390/qeth: Check CAP_NET_ADMIN for private ioctls s390/dasd: Fix potential NULL pointer dereference s390/zcrypt: Validate length for CCA AES cipher key requests s390/zcrypt: Validate length for CCA ECC private key requests phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask phy: zynqmp: use read-modify-write for SERDES scrambler bypass phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB net: openvswitch: fix potential UAF on meter attach failure net: openvswitch: fix skb leak on flow key update failure during ct i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: imx: Cancel hrtimer before clearing slave pointer can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured can: ems_usb: validate CPC message lengths can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents can: softing: fw_parse(): validate firmware record spans can: peak_usb: add bounds check for USB channel index can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error can: peak_usb: validate uCAN receive record lengths drm/vc4: Zero the tile state data array before each BIN job drm/amdgpu: restore UMD profile pstate after runtime resume drm/amdgpu: cap GTT size to physical RAM on APUs drm/vmwgfx: validate DRAW_PRIMITIVES header size before division drm/vmwgfx: bound DMA command body size against suffix pointer HID: logitech-dj: Fix maxfield check in DJ short report validation mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios net: openvswitch: fix skb leak on flow key update failure during recirculation firmware: stratix10-svc: fix memory leaks and list corruption bugs gpio: pch: use raw_spinlock_t for the register lock mount: honour SB_NOUSER in the new mount API s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call ARM: npcm: Fix OF node refcount leaks in SMP setup bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bpf: Preserve pointer state for commuted arithmetic net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() net/sched: cls_route: fix fastmap use-after-free on filter net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete net/mlx5: fw_tracer, return NULL on create error counter: microchip-tcb-capture: Fix DT channel validation vhost/vdpa: reject overflowing PA map page counts on 32-bit udp: fix potential use-after-free in tunnel segmentation net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter net/openvswitch: check Ethernet header length in key_extract() selftests/ftrace: Add test case for GRP/ only input selftests/ftrace: refactor eprobes test to fix argument checks bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips bnxt_en: Disable EOP for TPA on all chips to prevent data corruption bnxt_en: Fix PTP PPS setting bug sctp: fix addip_serial increment on ASCONF_ACK allocation failure tcp: fix TFO max_qlen accounting across reuseport migration net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length net: prestera: validate firmware header length net: remove WARN_ON_ONCE() from sk_mc_loop() net/smc: fix TOCTOU race between smc_listen_out() and listener close net: qrtr: ns: Raise lookup limit to 128 net: thunderbolt: Tear down DMA paths before stopping the rings ata: pata_sl82c105: fix bridge revision use-after-free sctp: clear control chunk transport if it is being removed tls: don't abort the connection on signal-interrupted sends hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Input: evdev - sanitize event type index when fetching event masks ALSA: usb-audio: fix OOB write on Type II inbound URBs usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() thunderbolt: icm: Preserve USB4 proxy data-valid bit usb: cdnsp: fix incorrect endian conversions for APB timeout register usb: gadget: f_ncm: Use unsigned int for ndp_index ima: fix out-of-bounds read in xattr_verify() ipvs: add totalconns for dest ipvs: properly update the overload flag on dest edit ipvs: clear IPv4 options after rebasing tunnel ICMP errors net/packet: reset the MAC header on the packet-socket transmit path net: openvswitch: reallocate update replies for mismatched IDs net: octeontx2-pf: Fix UB in shift operation net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header netfilter: ebt_nflog: pin the NFLOG backend net: bridge: mrp: fix uninitialised bytes on the wire vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Input: evdev - fix information leak in evdev_pass_values() Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev futex: Prevent robust futex exit race some more pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP RDMA/rxe: Fix a use-after-free problem in rxe_mmap fscrypt: Replace mk_users keyring with simple list ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops ipv4: fix use-after-free in fib_nhc_update_mtu() serial: 8250_dma: Clear stale RX state on shutdown staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: validate monitor transmit frame lengths misc: fastrpc: fix channel ctx ref leak when session alloc fails misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free ALSA: usx2y: bound the hwdep mmap fault offset tracing: Fix race between update_event_fields and, event_define_fields fbdev: bitblit: bound-check glyph index in bit_cursor() ipv6: prevent in6_dev_get() from resurrecting inet6_dev netfilter: bridge: release template ct on non-IP path net: atlantic: free RX pages of consumed but not refilled buffers net/sched: act_gact, act_police: range check the fallback control action xdp: reject clones that overrun skb_shared_info tailroom vxlan: do not arm the ageing timer on a device that is down vsock/virtio: read virtqueues under worker locks vsock/virtio: avoid refilling the RX queue after teardown vhost: reset the vring metadata cache on vring reconfiguration tipc: read le->link under the node lock in tipc_node_link_down() Revert "thermal/drivers/hwmon: Cleanup coding style a bit" ipv6: fix Route Information option length validation ip6_tunnel: clear skb2->cb[] in ip6ip6_err() bpf, sockmap: Fix sk_redir use-after-free in send verdict scsi: scsi_debug: Negate wrapped memcmp() result sctp: keep chunk->transport in step with the list it is queued on sctp: fix use-after-free of cached ASCONF chunk sctp: clear new_transport when removing a peer thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 UBUNTU: Upstream stable to v5.15.216 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Jammy) Importance: Medium Assignee: Vinicius Peixoto (vpeixoto) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Also affects: linux (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Jammy) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Jammy) Status: New => In Progress ** Changed in: linux (Ubuntu Jammy) Assignee: (unassigned) => Vinicius Peixoto (vpeixoto) ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ - + nvmet-tcp: Fix potential UAF when ddgst mismatch + futex: Prevent lockup in requeue-PI during signal/ timeout wakeup + macsec: don't read an unset MAC header in macsec_encrypt() + KVM: nVMX: Hide shadow VMCS right after VMCLEAR + KVM: x86/mmu: Fix use-after-free on vendor module reload + can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER + can: isotp: serialize TX state transitions under so->rx_lock + dmaengine: sh: rz-dmac: Move interrupt request after everything is set up + Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() + Input: ims-pcu - fix logic error in packet reset + KVM: VMX: Make vmread_error_trampoline() uncallable from C code + IB/mad: Drop unmatched RMPP responses before reassembly + mtd: mtdswap: remove debugfs stats file on teardown + mtd: nand: mtk-ecc: stop on ECC idle timeouts + btrfs: reject free space cache with more entries than pages + btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() + firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() + RDMA/hns: Fix potential integer overflow in mhop hem cleanup + RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp + RDMA/siw: publish QP after initialization + RDMA/irdma: Prevent overflows in memory contiguity checks + xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert + wifi: cfg80211: cancel sched scan results work on unregister + wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() + wifi: mac80211_hwsim: clamp virtio RX length before skb_put + wifi: libertas: fix memory leak in helper_firmware_cb() + wifi: p54: validate RX frame length in p54_rx_eeprom_readback() + wifi: cfg80211: validate PMSR measurement type data + wifi: cfg80211: validate PMSR FTM preamble range + wifi: cfg80211: reject unsupported PMSR FTM location requests + wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock + wifi: brcmfmac: initialize SDIO data work before cleanup + wifi: cfg80211: bound element ID read when checking non-inheritance + ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop + ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup + firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context + ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF + ipv4: fib: free fib_alias with kfree_rcu() on insert error path + net/iucv: take a reference on the socket found in afiucv_hs_rcv() + ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered + ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts + ata: sata_dwc_460ex: remove variable num_processed + ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning + ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC + Bluetooth: qca: fix NVM tag length underflow in TLV parser + smb/client: handle overlapping allocated ranges in fallocate + drm/i915/gt: use correct selftest config symbol + powerpc/time: Fix sparse warnings + powerpc: remove the last remnants of cputime_t + sched/vtime: Get rid of generic vtime_task_switch() implementation + powerpc/time: Prepare to stop elapsing in dynticks-idle + powerpc/vtime: Initialize starttime at boot for native accounting + can: j1939: fix lockless local-destination check + ksmbd: validate compound request size before reading StructureSize2 + drm/i915/selftests: Fix GT PM sort comparators + net/sched: act_tunnel_key: Defer dst_release to RCU callback + sctp: fix auth_hmacs array size in struct sctp_cookie + mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n + wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() + USB: storage: add NO_ATA_1X quirk for Longmai USB Key + usb: chipidea: fix usage_count leak when autosuspend_delay is negative + usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback + usb: gadget: f_midi: cancel pending IN work before freeing the midi object + usb: gadget: printer: fix infinite loop in printer_read() + USB: gadget: snps-udc: fix device name leak on probe failure + USB: gadget: fsl-udc: fix device name leak on probe failure + usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() + usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown + usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer + USB: serial: ftdi_sio: add support for E+H FXA291 + USB: serial: io_edgeport: cap received transmit credits + USB: serial: keyspan_pda: fix data loss on receive throttling + USB: serial: option: add TDTECH MT5710-CN + crypto: rsa-pkcs1pad: Don't WARN on an empty digest + bpf: Fix ld_{abs,ind} failure path analysis in subprogs + usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits + wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request + hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop + hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop + watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() + wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() + firewire: net: Fix fragmented datagram reassembly + wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler + wifi: ath6kl: fix OOB read from firmware IE lengths in connect event + wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read + wifi: carl9170: fix OOB read from off-by-two in TX status handler + wifi: carl9170: fix buffer overflow in rx_stream failover path + btrfs: free mapping node on duplicate reloc root insert + ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint + ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI + usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect + hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status + hwmon: (occ) Add sysfs entry for OCC mode + hwmon: (occ) Add sysfs entries for additional extended status bits + hwmon: (occ) Delay hwmon registration until user request + hwmon: occ: validate poll response sensor blocks + net/packet: avoid fanout hook re-registration after unregister + rds: drop incoming messages that cross network namespace boundaries + dpaa2-switch: put MAC endpoint device on disconnect + net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call + dpaa2-eth: put MAC endpoint device on disconnect + nfp: Check resource mutex allocation + wan: wanxl: Only reset hardware after BAR mapping + wifi: mwifiex: bound uAP association event IEs to the event buffer + iommu/amd: Bound the early ACPI HID map + iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() + wifi: mac80211: recalculate TIM when a station enters power save + amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN + sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid + sctp: validate stream count in sctp_process_strreset_inreq() + nexthop: initialize extack in nh_res_bucket_migrate() + tipc: fix infinite loop in __tipc_nl_compat_dumpit + wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() + wifi: brcmfmac: fix 802.1X-SHA256 call trace warning + net: bridge: vlan: fix vlan range dumps starting with pvid + net: hsr: fix memory leak on slave unregistration by removing synced VLANs + sctp: auth: verify auth requirement when auth_chunk is NULL + vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets + tipc: fix u16 MTU truncation in media and bearer MTU validation + net: stmmac: add tc flower filter for EtherType matching + net: stmmac: fix l3l4 filter rejecting unsupported offload requests + net: stmmac: reset residual action in L3L4 filters on delete + octeontx2-vf: set TC flower flag on MCAM entry allocation + ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup + hinic: remove unused ethtool RSS user configuration buffers + net: qrtr: restrict socket creation to the initial network namespace + net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule + net/mlx5e: Report zero bandwidth for non-ETS traffic classes + net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation + raw: use more conventional iterators + net: ipv6: fix dif and sdif mismatch in raw6_icmp_error + bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() + can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF + can: bcm: add locking when updating filter and timer values + can: bcm: fix CAN frame rx/tx statistics + can: bcm: extend bcm_tx_lock usage for data and timer updates + can: bcm: validate frame length in bcm_rx_setup() for RTR replies + can: bcm: add missing device refcount for CAN filter removal + can: bcm: fix stale rx/tx ops after device removal + can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() + can: bcm: track a single source interface for ANYDEV timeout/throttle ops + drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() + drm/radeon: fix r100_copy_blit for large BOs + drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() + drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() + drm/i915: Return NULL on error in active_instance + drm/i915/gem: Do not leak siblings[] on proto context error + drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + drm/amdgpu: Fix VFCT bus number matching with soft filter + drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) + drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved + drm/vmwgfx: Validate vmw_surface_metadata::array_size + media: airspy: Return queued buffers on start_streaming() failure + media: cec: seco: unregister adapter on IR probe failure + media: cedrus: clean up media device on probe failure + media: cedrus: Fix missing cleanup in error path + media: cedrus: skip invalid H.264 reference list entries + media: cx231xx: fix devres lifetime + media: cx23885: add ioremap return check and cleanup + media: meson: vdec: Fix memory leak in error path of vdec_open + media: msi2500: Return queued buffers on start_streaming() failure + media: pci: dm1105: Free allocated workqueue + media: pwc: Drain fill_buf on start_streaming() failure + media: pwc: Return queued buffers on start_streaming() failure + media: radio-si476x: Unregister v4l2_device on probe failure + media: rtl2832: fix use-after-free in rtl2832_remove() + media: rtl2832_sdr: Return queued buffers on start_streaming() failure + media: saa7134: Fix a possible memory leak in saa7134_video_init1 + media: sun4i-csi: Return queued buffers on start_streaming() failure + media: tegra-video: vi: fix invalid u32 return value in format lookup + media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() + media: vb2: use ssize_t for vb2_read/vb2_write + media: vidtv: fix reference leak on failed device registration + media: vimc: fix reference leak on failed device registration + media: vivid: check for vb2_is_busy() when toggling caps + wifi: ath6kl: fix OOB access from firmware ADDBA window size + wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper + wifi: wilc1000: validate assoc response length before subtracting header + wifi: brcmfmac: make release_scratchbuffers idempotent + staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() + staging: rtl8723bs: fix inverted HT40 secondary channel offset + Bluetooth: RFCOMM: Fix session UAF in set_termios + exec: fix unsigned loop counter wrap in transfer_args_to_stack() + binfmt_misc: set have_execfd only once the interpreter is opened + cdrom: fix stack out-of-bounds read in CDROMVOLCTRL + x86/boot/compressed: Disable jump tables + comedi: comedi_parport: deal with premature interrupt + intel_th: fix MSC output device reference leak + tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev + tracing: Fix resource leak on mmiotrace trace_pipe close + tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() + tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() + tracing/probes: Fix potential underflow in LEN_OR_ZERO macro + tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() + arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates + Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" + mptcp: only set DATA_FIN when a mapping is present + sctp: don't free the ASCONF's own transport in DEL-IP processing + ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() + libceph: bound get_version reply decode to front len + libceph: Fix multiplication overflow in decode_new_up_state_weight() + libceph: guard missing CRUSH type name lookup + libceph: refresh auth->authorizer_buf{,_len} after authorizer update + libceph: Reject monmaps advertising zero monitors + libceph: reject zero bucket types in crush_decode + libceph: remove debugfs files before client teardown + binfmt_elf_fdpic: only honour the first PT_INTERP + iommu/vt-d: Disallow SVA if page walk is not coherent + phonet: pep: fix use-after-free in pep_get_sb() + vxlan: require CAP_NET_ADMIN in the device netns for changelink + net: slip: serialize receive against buffer reallocation + geneve: require CAP_NET_ADMIN in the device netns for changelink + net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() + net/iucv: fix use-after-free of a severed iucv_path + net/x25: fix use-after-free in x25_kill_by_neigh() + net: hip04: fix RX buffer leak on build_skb failure + proc: Fix broken error paths for namespace links + rbd: Reset positive result codes to zero in object map update path + ice: use READ_ONCE() to access cached PHC time + ila: reload IPv6 header after pskb_may_pull in checksum adjust + mac802154: llsec: reject frames shorter than the authentication tag + pppoe: reload header pointer after dev_hard_header() + tipc: clear sock->sk on the failed-insert path in tipc_sk_create() + drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() + drm/amdgpu/gfx8: drop unecessary BUG_ON() + drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() + drm/amdgpu: fix division by zero with invalid uvd dimensions + drm/amdgpu: invoke pm_genpd_remove() before freeing genpd + tipc: fix use-after-free of the discoverer in tipc_disc_rcv() + wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses + openvswitch: fix GSO userspace truncation underflow + raw: remove unused variables from raw6_icmp_error() + raw: fix a typo in raw_icmp_error() + net: mpls: initialize rtm_tos in mpls_getroute() + media: uvcvideo: Implement dual stream quirk to fix loss of usb packets + media: uvcvideo: Fix sequence number when no EOF + gve: fix Rx queue stall on alloc failure + HID: logitech-dj: Standardise hid_report_enum variable nomenclature + HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write + HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report + net: qrtr: ns: Limit the maximum server registration per node + net: qrtr: ns: Raise node count limit to 512 + dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA + ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup + ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup + phy: zynqmp: Allow variation in refclk rate + phy-zynqmp: Postpone getting clock rate until actually needed + phy: zynqmp: fix clock error handling in xpsgtr_phy_init() + phy: zynqmp: fix runtime PM leak on probe allocation failure + netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() + drm/mediatek: Check CRTC state before freeing + keys: fix out-of-bounds read in keyring_get_key_chunk() + keys: make keyring key-chunk byte order agree with keyring_diff_objects() + assoc_array: trim the final shortcut word using the current chunk end + netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH + netfilter: nft_payload: fix mask build for partial field offload + rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled + rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() + scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer + scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer + smb: client: fix buffer leaks in SMB1 read and write + hwmon: (nct6775-core) Prevent access to unsupported weight registers + net: bridge: mrp: fix Option TLV length in MRP_Test frames + forcedeth: fix UAF of txrx_stats in nv_remove + hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors + hwmon: (adt7470) Fix cache updated before hardware write on I2C error + hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread + hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() + hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks + hwmon: (adt7470) Use cached PWM frequency value + hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read + hwmon: (adt7470) Fix PWM auto temp state array and bounds check + powerpc/boot: Fix simpleboot CPU node lookup check + powerpc/boot: Fix treeboot-currituck CPU node lookup check + powerpc/boot: Fix treeboot-akebono CPU node lookup check + wifi: mac80211: validate individual TWT params before driver setup + hwmon: (pmbus) Fix return value from pmbus_update_byte_data() + Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp + net: phylink: put link_gpio if phylink_create fails + scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req + net: sxgbe: free TX rings on RX allocation failure + net: sxgbe: check descriptor ring allocation failures + can: isotp: check register_netdevice_notifier() error in module init + tracing/mmiotrace: Reset dropped_count in mmio_reset_data() + octeontx2-pf: Set correct sequence for carrier off and tx queue stop + qede: sync udp_tunnel ports outside qede_lock in the recovery path + rhashtable: clear stale iter->p on table restart + pinctrl: devicetree: don't free uninitialized dev_name on error path + pinctrl: bm1880: add missing select GENERIC_PINCONF + mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() + mm/hugetlb: fix list corruption in allocate_file_region_entries() + sctp: validate Adaptation Indication parameter length + audit: fix potential integer overflow in audit_log_n_string() + audit: fix potential use-after-free in audit_del_rule() + Bluetooth: HIDP: reject frames without a transaction header + Bluetooth: HIDP: validate numbered report payloads + bpf: lwt: Fix dst reference leak on reroute failure + ALSA: 6fire: Fix UAF at error handling during probe + ALSA: lx6464es: fix period byte count for 16-bit streams + ALSA: pcm: wake linked drain waiters on unlink + ASoC: tas2562: fix DVC coefficient write order + ASoC: tas2562: fix broken entries in the volume lookup table + ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() + ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set + ALSA: usb-audio: Clamp frame size in implicit-feedback mode + dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ + e1000: fix memory leak in e1000_probe() + igbvf: Fix leak in TX DMA error cleanup + ipvs: do not propagate one-packet flag to synced conns + net/smc: fix socket use-after-free during link group termination + netfilter: ipset: do not update comments from kernel-side hash adds + tipc: avoid use-after-free in poll trace queue dumps + wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames + binfmt_misc: reject a flag character as the field delimiter + mm/page_reporting: use system_freezable_wq to fix UAF during suspend + net: bridge: stop fast-leave after deleting a port group + net: ipv6: clear suppressed fib6 rule result + powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() + um: vector: fix use-after-free in vector_mmsg_rx() + vxlan: re-fetch eth header after route_shortcircuit() + vxlan: unclone skb head before modifying eth header in route_shortcircuit() + vxlan: use neigh_ha_snapshot() in route_shortcircuit() + vxlan: use pskb_network_may_pull() in route_shortcircuit() + tracing: Check return value of __register_event() in trace_module_add_events() + tracing/filters: Fix false positive match in regex_match_full() + selftests/clone3: fix wild pointer access of getline due to missing init + sctp: reject stale cookies with mismatched verification tags + sctp: prevent peer transport count overflow + hwmon: (npcm750-pwm-fan): stop fan timer on device detach + i2c: amd-mp2: Unregister callback on adapter add failure + cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() + s390/qeth: Check CAP_NET_ADMIN for private ioctls + s390/dasd: Fix potential NULL pointer dereference + s390/zcrypt: Validate length for CCA AES cipher key requests + s390/zcrypt: Validate length for CCA ECC private key requests + phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask + phy: zynqmp: use read-modify-write for SERDES scrambler bypass + phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB + net: openvswitch: fix potential UAF on meter attach failure + net: openvswitch: fix skb leak on flow key update failure during ct + i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock + i2c: imx: Cancel hrtimer before clearing slave pointer + can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured + can: ems_usb: validate CPC message lengths + can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure + can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer + can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() + can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents + can: softing: fw_parse(): validate firmware record spans + can: peak_usb: add bounds check for USB channel index + can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error + can: peak_usb: validate uCAN receive record lengths + drm/vc4: Zero the tile state data array before each BIN job + drm/amdgpu: restore UMD profile pstate after runtime resume + drm/amdgpu: cap GTT size to physical RAM on APUs + drm/vmwgfx: validate DRAW_PRIMITIVES header size before division + drm/vmwgfx: bound DMA command body size against suffix pointer + HID: logitech-dj: Fix maxfield check in DJ short report validation + mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios + net: openvswitch: fix skb leak on flow key update failure during recirculation + firmware: stratix10-svc: fix memory leaks and list corruption bugs + gpio: pch: use raw_spinlock_t for the register lock + mount: honour SB_NOUSER in the new mount API + s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() + nfs4: take a reference on the nfs_client when running FREE_STATEID + NFS: Pin the 'struct nfs_server' during a FREE_STATEID call + ARM: npcm: Fix OF node refcount leaks in SMP setup + bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor + bpf: Preserve pointer state for commuted arithmetic + net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() + net/sched: cls_route: fix fastmap use-after-free on filter + net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete + net/mlx5: fw_tracer, return NULL on create error + counter: microchip-tcb-capture: Fix DT channel validation + vhost/vdpa: reject overflowing PA map page counts on 32-bit + udp: fix potential use-after-free in tunnel segmentation + net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter + net/openvswitch: check Ethernet header length in key_extract() + selftests/ftrace: Add test case for GRP/ only input + selftests/ftrace: refactor eprobes test to fix argument checks + bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips + bnxt_en: Disable EOP for TPA on all chips to prevent data corruption + bnxt_en: Fix PTP PPS setting bug + sctp: fix addip_serial increment on ASCONF_ACK allocation failure + tcp: fix TFO max_qlen accounting across reuseport migration + net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length + net: prestera: validate firmware header length + net: remove WARN_ON_ONCE() from sk_mc_loop() + net/smc: fix TOCTOU race between smc_listen_out() and listener close + net: qrtr: ns: Raise lookup limit to 128 + net: thunderbolt: Tear down DMA paths before stopping the rings + ata: pata_sl82c105: fix bridge revision use-after-free + sctp: clear control chunk transport if it is being removed + tls: don't abort the connection on signal-interrupted sends + hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination + spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + Input: evdev - sanitize event type index when fetching event masks + ALSA: usb-audio: fix OOB write on Type II inbound URBs + usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() + thunderbolt: icm: Preserve USB4 proxy data-valid bit + usb: cdnsp: fix incorrect endian conversions for APB timeout register + usb: gadget: f_ncm: Use unsigned int for ndp_index + ima: fix out-of-bounds read in xattr_verify() + ipvs: add totalconns for dest + ipvs: properly update the overload flag on dest edit + ipvs: clear IPv4 options after rebasing tunnel ICMP errors + net/packet: reset the MAC header on the packet-socket transmit path + net: openvswitch: reallocate update replies for mismatched IDs + net: octeontx2-pf: Fix UB in shift operation + net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header + netfilter: ebt_nflog: pin the NFLOG backend + net: bridge: mrp: fix uninitialised bytes on the wire + vt: add permission check for KDSKBMETA ioctl + vt: stabilize tty reference in kbd_keycode with tty_port_tty_get + Input: evdev - fix information leak in evdev_pass_values() + Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref + Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + futex: Prevent robust futex exit race some more + pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP + RDMA/rxe: Fix a use-after-free problem in rxe_mmap + fscrypt: Replace mk_users keyring with simple list + ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops + ipv4: fix use-after-free in fib_nhc_update_mtu() + serial: 8250_dma: Clear stale RX state on shutdown + staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() + staging: rtl8723bs: fix OOB read in WMM_param_handler() + staging: rtl8723bs: fix missing shared-key auth challenge length check + staging: rtl8723bs: validate monitor transmit frame lengths + misc: fastrpc: fix channel ctx ref leak when session alloc fails + misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free + ALSA: usx2y: bound the hwdep mmap fault offset + tracing: Fix race between update_event_fields and, event_define_fields + fbdev: bitblit: bound-check glyph index in bit_cursor() + ipv6: prevent in6_dev_get() from resurrecting inet6_dev + netfilter: bridge: release template ct on non-IP path + net: atlantic: free RX pages of consumed but not refilled buffers + net/sched: act_gact, act_police: range check the fallback control action + xdp: reject clones that overrun skb_shared_info tailroom + vxlan: do not arm the ageing timer on a device that is down + vsock/virtio: read virtqueues under worker locks + vsock/virtio: avoid refilling the RX queue after teardown + vhost: reset the vring metadata cache on vring reconfiguration + tipc: read le->link under the node lock in tipc_node_link_down() + Revert "thermal/drivers/hwmon: Cleanup coding style a bit" + ipv6: fix Route Information option length validation + ip6_tunnel: clear skb2->cb[] in ip6ip6_err() + bpf, sockmap: Fix sk_redir use-after-free in send verdict + scsi: scsi_debug: Negate wrapped memcmp() result + sctp: keep chunk->transport in step with the list it is queued on + sctp: fix use-after-free of cached ASCONF chunk + sctp: clear new_transport when removing a peer + thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - sctp: clear new_transport when removing a peer - sctp: fix use-after-free of cached ASCONF chunk - sctp: keep chunk->transport in step with the list it is queued on - scsi: scsi_debug: Negate wrapped memcmp() result - bpf, sockmap: Fix sk_redir use-after-free in send verdict - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - ipv6: fix Route Information option length validation - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - tipc: read le->link under the node lock in tipc_node_link_down() - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - vsock/virtio: read virtqueues under worker locks - vxlan: do not arm the ageing timer on a device that is down - xdp: reject clones that overrun skb_shared_info tailroom - net/sched: act_gact, act_police: range check the fallback control action - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - fbdev: bitblit: bound-check glyph index in bit_cursor() - tracing: Fix race between update_event_fields and, event_define_fields - ALSA: usx2y: bound the hwdep mmap fault offset - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - ipv4: fix use-after-free in fib_nhc_update_mtu() - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - fscrypt: Replace mk_users keyring with simple list - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - futex: Prevent robust futex exit race some more - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Input: evdev - fix information leak in evdev_pass_values() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: bridge: mrp: fix uninitialised bytes on the wire - netfilter: ebt_nflog: pin the NFLOG backend - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - net: octeontx2-pf: Fix UB in shift operation - net: openvswitch: reallocate update replies for mismatched IDs - net/packet: reset the MAC header on the packet-socket transmit path - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - Input: evdev - sanitize event type index when fetching event masks - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - sctp: clear control chunk transport if it is being removed - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net: qrtr: ns: Raise lookup limit to 128 - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - tcp: fix TFO max_qlen accounting across reuseport migration - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - selftests/ftrace: Add test case for GRP/ only input - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - udp: fix potential use-after-free in tunnel segmentation - vhost/vdpa: reject overflowing PA map page counts on 32-bit - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - bpf: Preserve pointer state for commuted arithmetic - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - ARM: npcm: Fix OF node refcount leaks in SMP setup - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - nfs4: take a reference on the nfs_client when running FREE_STATEID - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - mount: honour SB_NOUSER in the new mount API - gpio: pch: use raw_spinlock_t for the register lock - firmware: stratix10-svc: fix memory leaks and list corruption bugs - net: openvswitch: fix skb leak on flow key update failure during recirculation - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - HID: logitech-dj: Fix maxfield check in DJ short report validation - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/vc4: Zero the tile state data array before each BIN job - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - selftests/clone3: fix wild pointer access of getline due to missing init - tracing/filters: Fix false positive match in regex_match_full() - tracing: Check return value of __register_event() in trace_module_add_events() - vxlan: use pskb_network_may_pull() in route_shortcircuit() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - net: ipv6: clear suppressed fib6 rule result - net: bridge: stop fast-leave after deleting a port group - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - igbvf: Fix leak in TX DMA error cleanup - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - pinctrl: devicetree: don't free uninitialized dev_name on error path - rhashtable: clear stale iter->p on table restart - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - net: phylink: put link_gpio if phylink_create fails - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - smb: client: fix buffer leaks in SMB1 read and write - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - phy: zynqmp: Allow variation in refclk rate - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - tls: separate no-async decryption request handling from async - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: ns: Limit the maximum server registration per node - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets - net: mpls: initialize rtm_tos in mpls_getroute() - raw: fix a typo in raw_icmp_error() - raw: remove unused variables from raw6_icmp_error() - openvswitch: fix GSO userspace truncation underflow - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mac802154: llsec: reject frames shorter than the authentication tag - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - rbd: Reset positive result codes to zero in object map update path - proc: Fix broken error paths for namespace links - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: reject zero bucket types in crush_decode - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - binfmt_misc: set have_execfd only once the interpreter is opened - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - media: vivid: check for vb2_is_busy() when toggling caps - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - raw: use more conventional iterators - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - hinic: remove unused ethtool RSS user configuration buffers - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: add tc flower filter for EtherType matching - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - sctp: validate stream count in sctp_process_strreset_inreq() - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - dpaa2-eth: put MAC endpoint device on disconnect - net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - net/packet: avoid fanout hook re-registration after unregister - hwmon: occ: validate poll response sensor blocks - hwmon: (occ) Delay hwmon registration until user request - hwmon: (occ) Add sysfs entries for additional extended status bits - hwmon: (occ) Add sysfs entry for OCC mode - hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint - btrfs: free mapping node on duplicate reloc root insert - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - firewire: net: Fix fragmented datagram reassembly - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: io_edgeport: cap received transmit credits - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - sctp: fix auth_hmacs array size in struct sctp_cookie - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - can: j1939: fix lockless local-destination check - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - powerpc: remove the last remnants of cputime_t - powerpc/time: Fix sparse warnings - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: remove variable num_processed - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - KVM: VMX: Make vmread_error_trampoline() uncallable from C code - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - macsec: don't read an unset MAC header in macsec_encrypt() - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - nvmet-tcp: Fix potential UAF when ddgst mismatch + UBUNTU: Upstream stable to v5.15.216 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165192 Title: Jammy update: v5.15.216 upstream stable release Status in linux package in Ubuntu: Invalid Status in linux source package in Jammy: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ nvmet-tcp: Fix potential UAF when ddgst mismatch futex: Prevent lockup in requeue-PI during signal/ timeout wakeup macsec: don't read an unset MAC header in macsec_encrypt() KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86/mmu: Fix use-after-free on vendor module reload can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: serialize TX state transitions under so->rx_lock dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ims-pcu - fix logic error in packet reset KVM: VMX: Make vmread_error_trampoline() uncallable from C code IB/mad: Drop unmatched RMPP responses before reassembly mtd: mtdswap: remove debugfs stats file on teardown mtd: nand: mtk-ecc: stop on ECC idle timeouts btrfs: reject free space cache with more entries than pages btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp RDMA/siw: publish QP after initialization RDMA/irdma: Prevent overflows in memory contiguity checks xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert wifi: cfg80211: cancel sched scan results work on unregister wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() wifi: mac80211_hwsim: clamp virtio RX length before skb_put wifi: libertas: fix memory leak in helper_firmware_cb() wifi: p54: validate RX frame length in p54_rx_eeprom_readback() wifi: cfg80211: validate PMSR measurement type data wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: brcmfmac: initialize SDIO data work before cleanup wifi: cfg80211: bound element ID read when checking non-inheritance ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF ipv4: fib: free fib_alias with kfree_rcu() on insert error path net/iucv: take a reference on the socket found in afiucv_hs_rcv() ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts ata: sata_dwc_460ex: remove variable num_processed ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Bluetooth: qca: fix NVM tag length underflow in TLV parser smb/client: handle overlapping allocated ranges in fallocate drm/i915/gt: use correct selftest config symbol powerpc/time: Fix sparse warnings powerpc: remove the last remnants of cputime_t sched/vtime: Get rid of generic vtime_task_switch() implementation powerpc/time: Prepare to stop elapsing in dynticks-idle powerpc/vtime: Initialize starttime at boot for native accounting can: j1939: fix lockless local-destination check ksmbd: validate compound request size before reading StructureSize2 drm/i915/selftests: Fix GT PM sort comparators net/sched: act_tunnel_key: Defer dst_release to RCU callback sctp: fix auth_hmacs array size in struct sctp_cookie mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() USB: storage: add NO_ATA_1X quirk for Longmai USB Key usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: printer: fix infinite loop in printer_read() USB: gadget: snps-udc: fix device name leak on probe failure USB: gadget: fsl-udc: fix device name leak on probe failure usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: io_edgeport: cap received transmit credits USB: serial: keyspan_pda: fix data loss on receive throttling USB: serial: option: add TDTECH MT5710-CN crypto: rsa-pkcs1pad: Don't WARN on an empty digest bpf: Fix ld_{abs,ind} failure path analysis in subprogs usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() firewire: net: Fix fragmented datagram reassembly wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler wifi: ath6kl: fix OOB read from firmware IE lengths in connect event wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read wifi: carl9170: fix OOB read from off-by-two in TX status handler wifi: carl9170: fix buffer overflow in rx_stream failover path btrfs: free mapping node on duplicate reloc root insert ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status hwmon: (occ) Add sysfs entry for OCC mode hwmon: (occ) Add sysfs entries for additional extended status bits hwmon: (occ) Delay hwmon registration until user request hwmon: occ: validate poll response sensor blocks net/packet: avoid fanout hook re-registration after unregister rds: drop incoming messages that cross network namespace boundaries dpaa2-switch: put MAC endpoint device on disconnect net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call dpaa2-eth: put MAC endpoint device on disconnect nfp: Check resource mutex allocation wan: wanxl: Only reset hardware after BAR mapping wifi: mwifiex: bound uAP association event IEs to the event buffer iommu/amd: Bound the early ACPI HID map iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() wifi: mac80211: recalculate TIM when a station enters power save amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp: validate stream count in sctp_process_strreset_inreq() nexthop: initialize extack in nh_res_bucket_migrate() tipc: fix infinite loop in __tipc_nl_compat_dumpit wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() wifi: brcmfmac: fix 802.1X-SHA256 call trace warning net: bridge: vlan: fix vlan range dumps starting with pvid net: hsr: fix memory leak on slave unregistration by removing synced VLANs sctp: auth: verify auth requirement when auth_chunk is NULL vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets tipc: fix u16 MTU truncation in media and bearer MTU validation net: stmmac: add tc flower filter for EtherType matching net: stmmac: fix l3l4 filter rejecting unsupported offload requests net: stmmac: reset residual action in L3L4 filters on delete octeontx2-vf: set TC flower flag on MCAM entry allocation ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup hinic: remove unused ethtool RSS user configuration buffers net: qrtr: restrict socket creation to the initial network namespace net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule net/mlx5e: Report zero bandwidth for non-ETS traffic classes net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation raw: use more conventional iterators net: ipv6: fix dif and sdif mismatch in raw6_icmp_error bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF can: bcm: add locking when updating filter and timer values can: bcm: fix CAN frame rx/tx statistics can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: add missing device refcount for CAN filter removal can: bcm: fix stale rx/tx ops after device removal can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: track a single source interface for ANYDEV timeout/throttle ops drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() drm/radeon: fix r100_copy_blit for large BOs drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() drm/i915: Return NULL on error in active_instance drm/i915/gem: Do not leak siblings[] on proto context error drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU drm/amdgpu: Fix VFCT bus number matching with soft filter drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved drm/vmwgfx: Validate vmw_surface_metadata::array_size media: airspy: Return queued buffers on start_streaming() failure media: cec: seco: unregister adapter on IR probe failure media: cedrus: clean up media device on probe failure media: cedrus: Fix missing cleanup in error path media: cedrus: skip invalid H.264 reference list entries media: cx231xx: fix devres lifetime media: cx23885: add ioremap return check and cleanup media: meson: vdec: Fix memory leak in error path of vdec_open media: msi2500: Return queued buffers on start_streaming() failure media: pci: dm1105: Free allocated workqueue media: pwc: Drain fill_buf on start_streaming() failure media: pwc: Return queued buffers on start_streaming() failure media: radio-si476x: Unregister v4l2_device on probe failure media: rtl2832: fix use-after-free in rtl2832_remove() media: rtl2832_sdr: Return queued buffers on start_streaming() failure media: saa7134: Fix a possible memory leak in saa7134_video_init1 media: sun4i-csi: Return queued buffers on start_streaming() failure media: tegra-video: vi: fix invalid u32 return value in format lookup media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() media: vb2: use ssize_t for vb2_read/vb2_write media: vidtv: fix reference leak on failed device registration media: vimc: fix reference leak on failed device registration media: vivid: check for vb2_is_busy() when toggling caps wifi: ath6kl: fix OOB access from firmware ADDBA window size wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper wifi: wilc1000: validate assoc response length before subtracting header wifi: brcmfmac: make release_scratchbuffers idempotent staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset Bluetooth: RFCOMM: Fix session UAF in set_termios exec: fix unsigned loop counter wrap in transfer_args_to_stack() binfmt_misc: set have_execfd only once the interpreter is opened cdrom: fix stack out-of-bounds read in CDROMVOLCTRL x86/boot/compressed: Disable jump tables comedi: comedi_parport: deal with premature interrupt intel_th: fix MSC output device reference leak tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" mptcp: only set DATA_FIN when a mapping is present sctp: don't free the ASCONF's own transport in DEL-IP processing ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: bound get_version reply decode to front len libceph: Fix multiplication overflow in decode_new_up_state_weight() libceph: guard missing CRUSH type name lookup libceph: refresh auth->authorizer_buf{,_len} after authorizer update libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: remove debugfs files before client teardown binfmt_elf_fdpic: only honour the first PT_INTERP iommu/vt-d: Disallow SVA if page walk is not coherent phonet: pep: fix use-after-free in pep_get_sb() vxlan: require CAP_NET_ADMIN in the device netns for changelink net: slip: serialize receive against buffer reallocation geneve: require CAP_NET_ADMIN in the device netns for changelink net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() net/iucv: fix use-after-free of a severed iucv_path net/x25: fix use-after-free in x25_kill_by_neigh() net: hip04: fix RX buffer leak on build_skb failure proc: Fix broken error paths for namespace links rbd: Reset positive result codes to zero in object map update path ice: use READ_ONCE() to access cached PHC time ila: reload IPv6 header after pskb_may_pull in checksum adjust mac802154: llsec: reject frames shorter than the authentication tag pppoe: reload header pointer after dev_hard_header() tipc: clear sock->sk on the failed-insert path in tipc_sk_create() drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx8: drop unecessary BUG_ON() drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() drm/amdgpu: fix division by zero with invalid uvd dimensions drm/amdgpu: invoke pm_genpd_remove() before freeing genpd tipc: fix use-after-free of the discoverer in tipc_disc_rcv() wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses openvswitch: fix GSO userspace truncation underflow raw: remove unused variables from raw6_icmp_error() raw: fix a typo in raw_icmp_error() net: mpls: initialize rtm_tos in mpls_getroute() media: uvcvideo: Implement dual stream quirk to fix loss of usb packets media: uvcvideo: Fix sequence number when no EOF gve: fix Rx queue stall on alloc failure HID: logitech-dj: Standardise hid_report_enum variable nomenclature HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report net: qrtr: ns: Limit the maximum server registration per node net: qrtr: ns: Raise node count limit to 512 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup phy: zynqmp: Allow variation in refclk rate phy-zynqmp: Postpone getting clock rate until actually needed phy: zynqmp: fix clock error handling in xpsgtr_phy_init() phy: zynqmp: fix runtime PM leak on probe allocation failure netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() drm/mediatek: Check CRTC state before freeing keys: fix out-of-bounds read in keyring_get_key_chunk() keys: make keyring key-chunk byte order agree with keyring_diff_objects() assoc_array: trim the final shortcut word using the current chunk end netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nft_payload: fix mask build for partial field offload rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer smb: client: fix buffer leaks in SMB1 read and write hwmon: (nct6775-core) Prevent access to unsupported weight registers net: bridge: mrp: fix Option TLV length in MRP_Test frames forcedeth: fix UAF of txrx_stats in nv_remove hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Fix PWM auto temp state array and bounds check powerpc/boot: Fix simpleboot CPU node lookup check powerpc/boot: Fix treeboot-currituck CPU node lookup check powerpc/boot: Fix treeboot-akebono CPU node lookup check wifi: mac80211: validate individual TWT params before driver setup hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp net: phylink: put link_gpio if phylink_create fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req net: sxgbe: free TX rings on RX allocation failure net: sxgbe: check descriptor ring allocation failures can: isotp: check register_netdevice_notifier() error in module init tracing/mmiotrace: Reset dropped_count in mmio_reset_data() octeontx2-pf: Set correct sequence for carrier off and tx queue stop qede: sync udp_tunnel ports outside qede_lock in the recovery path rhashtable: clear stale iter->p on table restart pinctrl: devicetree: don't free uninitialized dev_name on error path pinctrl: bm1880: add missing select GENERIC_PINCONF mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/hugetlb: fix list corruption in allocate_file_region_entries() sctp: validate Adaptation Indication parameter length audit: fix potential integer overflow in audit_log_n_string() audit: fix potential use-after-free in audit_del_rule() Bluetooth: HIDP: reject frames without a transaction header Bluetooth: HIDP: validate numbered report payloads bpf: lwt: Fix dst reference leak on reroute failure ALSA: 6fire: Fix UAF at error handling during probe ALSA: lx6464es: fix period byte count for 16-bit streams ALSA: pcm: wake linked drain waiters on unlink ASoC: tas2562: fix DVC coefficient write order ASoC: tas2562: fix broken entries in the volume lookup table ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: Clamp frame size in implicit-feedback mode dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ e1000: fix memory leak in e1000_probe() igbvf: Fix leak in TX DMA error cleanup ipvs: do not propagate one-packet flag to synced conns net/smc: fix socket use-after-free during link group termination netfilter: ipset: do not update comments from kernel-side hash adds tipc: avoid use-after-free in poll trace queue dumps wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames binfmt_misc: reject a flag character as the field delimiter mm/page_reporting: use system_freezable_wq to fix UAF during suspend net: bridge: stop fast-leave after deleting a port group net: ipv6: clear suppressed fib6 rule result powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() um: vector: fix use-after-free in vector_mmsg_rx() vxlan: re-fetch eth header after route_shortcircuit() vxlan: unclone skb head before modifying eth header in route_shortcircuit() vxlan: use neigh_ha_snapshot() in route_shortcircuit() vxlan: use pskb_network_may_pull() in route_shortcircuit() tracing: Check return value of __register_event() in trace_module_add_events() tracing/filters: Fix false positive match in regex_match_full() selftests/clone3: fix wild pointer access of getline due to missing init sctp: reject stale cookies with mismatched verification tags sctp: prevent peer transport count overflow hwmon: (npcm750-pwm-fan): stop fan timer on device detach i2c: amd-mp2: Unregister callback on adapter add failure cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() s390/qeth: Check CAP_NET_ADMIN for private ioctls s390/dasd: Fix potential NULL pointer dereference s390/zcrypt: Validate length for CCA AES cipher key requests s390/zcrypt: Validate length for CCA ECC private key requests phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask phy: zynqmp: use read-modify-write for SERDES scrambler bypass phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB net: openvswitch: fix potential UAF on meter attach failure net: openvswitch: fix skb leak on flow key update failure during ct i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: imx: Cancel hrtimer before clearing slave pointer can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured can: ems_usb: validate CPC message lengths can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents can: softing: fw_parse(): validate firmware record spans can: peak_usb: add bounds check for USB channel index can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error can: peak_usb: validate uCAN receive record lengths drm/vc4: Zero the tile state data array before each BIN job drm/amdgpu: restore UMD profile pstate after runtime resume drm/amdgpu: cap GTT size to physical RAM on APUs drm/vmwgfx: validate DRAW_PRIMITIVES header size before division drm/vmwgfx: bound DMA command body size against suffix pointer HID: logitech-dj: Fix maxfield check in DJ short report validation mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios net: openvswitch: fix skb leak on flow key update failure during recirculation firmware: stratix10-svc: fix memory leaks and list corruption bugs gpio: pch: use raw_spinlock_t for the register lock mount: honour SB_NOUSER in the new mount API s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call ARM: npcm: Fix OF node refcount leaks in SMP setup bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bpf: Preserve pointer state for commuted arithmetic net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() net/sched: cls_route: fix fastmap use-after-free on filter net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete net/mlx5: fw_tracer, return NULL on create error counter: microchip-tcb-capture: Fix DT channel validation vhost/vdpa: reject overflowing PA map page counts on 32-bit udp: fix potential use-after-free in tunnel segmentation net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter net/openvswitch: check Ethernet header length in key_extract() selftests/ftrace: Add test case for GRP/ only input selftests/ftrace: refactor eprobes test to fix argument checks bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips bnxt_en: Disable EOP for TPA on all chips to prevent data corruption bnxt_en: Fix PTP PPS setting bug sctp: fix addip_serial increment on ASCONF_ACK allocation failure tcp: fix TFO max_qlen accounting across reuseport migration net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length net: prestera: validate firmware header length net: remove WARN_ON_ONCE() from sk_mc_loop() net/smc: fix TOCTOU race between smc_listen_out() and listener close net: qrtr: ns: Raise lookup limit to 128 net: thunderbolt: Tear down DMA paths before stopping the rings ata: pata_sl82c105: fix bridge revision use-after-free sctp: clear control chunk transport if it is being removed tls: don't abort the connection on signal-interrupted sends hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Input: evdev - sanitize event type index when fetching event masks ALSA: usb-audio: fix OOB write on Type II inbound URBs usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() thunderbolt: icm: Preserve USB4 proxy data-valid bit usb: cdnsp: fix incorrect endian conversions for APB timeout register usb: gadget: f_ncm: Use unsigned int for ndp_index ima: fix out-of-bounds read in xattr_verify() ipvs: add totalconns for dest ipvs: properly update the overload flag on dest edit ipvs: clear IPv4 options after rebasing tunnel ICMP errors net/packet: reset the MAC header on the packet-socket transmit path net: openvswitch: reallocate update replies for mismatched IDs net: octeontx2-pf: Fix UB in shift operation net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header netfilter: ebt_nflog: pin the NFLOG backend net: bridge: mrp: fix uninitialised bytes on the wire vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Input: evdev - fix information leak in evdev_pass_values() Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev futex: Prevent robust futex exit race some more pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP RDMA/rxe: Fix a use-after-free problem in rxe_mmap fscrypt: Replace mk_users keyring with simple list ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops ipv4: fix use-after-free in fib_nhc_update_mtu() serial: 8250_dma: Clear stale RX state on shutdown staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: validate monitor transmit frame lengths misc: fastrpc: fix channel ctx ref leak when session alloc fails misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free ALSA: usx2y: bound the hwdep mmap fault offset tracing: Fix race between update_event_fields and, event_define_fields fbdev: bitblit: bound-check glyph index in bit_cursor() ipv6: prevent in6_dev_get() from resurrecting inet6_dev netfilter: bridge: release template ct on non-IP path net: atlantic: free RX pages of consumed but not refilled buffers net/sched: act_gact, act_police: range check the fallback control action xdp: reject clones that overrun skb_shared_info tailroom vxlan: do not arm the ageing timer on a device that is down vsock/virtio: read virtqueues under worker locks vsock/virtio: avoid refilling the RX queue after teardown vhost: reset the vring metadata cache on vring reconfiguration tipc: read le->link under the node lock in tipc_node_link_down() Revert "thermal/drivers/hwmon: Cleanup coding style a bit" ipv6: fix Route Information option length validation ip6_tunnel: clear skb2->cb[] in ip6ip6_err() bpf, sockmap: Fix sk_redir use-after-free in send verdict scsi: scsi_debug: Negate wrapped memcmp() result sctp: keep chunk->transport in step with the list it is queued on sctp: fix use-after-free of cached ASCONF chunk sctp: clear new_transport when removing a peer thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 UBUNTU: Upstream stable to v5.15.216 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165192/+subscriptions
Подписаться на:
Сообщения (Atom)