[Bug 2130466] [NEW] Jammy update: v5.15.195 upstream stable release

Public bug reported:


SRU Justification

Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:

v5.15.195 upstream stable release
from git://git.kernel.org/

iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
media: rc: fix races with imon_disconnect()
KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
udp: Fix memory accounting leak.
media: tunner: xc5000: Refactor firmware load
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
USB: serial: option: add SIMCom 8230C compositions
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
dm-integrity: limit MAX_TAG_SIZE to 255
perf subcmd: avoid crash in exclude_cmds when excludes is empty
hid: fix I2C read buffer overflow in raw_event() for mcp2221
serial: stm32: allow selecting console when the driver is module
staging: axis-fifo: fix maximum TX packet length check
staging: axis-fifo: flush RX FIFO on read errors
driver core/PM: Set power.no_callbacks along with power.no_pm
platform/x86: int3472: Check for adev == NULL
crypto: rng - Ensure set_ent is always present
minmax: add in_range() macro
net/9p: fix double req put in p9_fd_cancelled
filelock: add FL_RECLAIM to show_fl_flags() macro
selftests: arm64: Check fread return value in exec_target
coresight: trbe: Prevent overflow in PERF_IDX2OFF()
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
x86/vdso: Fix output operand size of RDPID
regmap: Remove superfluous check for !config in __regmap_init()
libbpf: Fix reuse of DEVMAP
cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
pinctrl: meson-gxl: add missing i2c_d pinmux
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
ARM: at91: pm: fix MCKx restore routine
regulator: scmi: Use int type to store negative error codes
block: use int to store blk_stack_limits() return value
PM: sleep: core: Clear power.must_resume in noirq suspend error path
pinctrl: renesas: Use int type to store negative error codes
firmware: firmware: meson-sm: fix compile-test default
arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
pwm: tiehrpwm: Fix corner case in clock divisor calculation
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
i3c: master: svc: Recycle unused IBI slot
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
bpf: Explicitly check accesses to bpf_sock_addr
smp: Fix up and expand the smp_call_function_many() kerneldoc
tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
thermal/drivers/qcom: Make LMH select QCOM_SCM
thermal/drivers/qcom/lmh: Add missing IRQ includes
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
i2c: designware: Add disabling clocks when probe fails
drm/radeon/r600_cs: clean up of dead code in r600_cs
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
scsi: myrs: Fix dma_alloc_coherent() error check
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
ALSA: lx_core: use int type to store negative error codes
drm/amdgpu: Power up UVD 3 for FW validation (v2)
wifi: mwifiex: send world regulatory domain to driver
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
tcp: fix __tcp_close() to only send RST when required
drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
usb: phy: twl6030: Fix incorrect type for ret
usb: gadget: configfs: Correctly set use_os_string at bind
misc: genwqe: Fix incorrect cmd field being reported in error
pps: fix warning in pps_register_cdev when register device fail
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
fs: ntfs3: Fix integer overflow in run_unpack()
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
netfilter: ipset: Remove unused htable_bits in macro ahash_region
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
drivers/base/node: handle error properly in register_one_node()
RDMA/cm: Rate limit destroy CM ID timeout error message
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
scsi: qla2xxx: edif: Fix incorrect sign of error code
scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
RDMA/core: Resolve MAC of next-hop device without ARP support
IB/sa: Fix sa_local_svc_timeout_ms read race
Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
wifi: ath10k: avoid unnecessary wait for service ready message
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
coresight: trbe: Return NULL pointer for allocation failures
NFSv4.1: fix backchannel max_resp_sz verification check
ipvs: Defer ip_vs_ftp unregister during netns cleanup
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
usb: vhci-hcd: Prevent suspending virtually attached devices
RDMA/siw: Always report immediate post SQ errors
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
hwrng: ks-sa - fix division by zero in ks_sa_rng_init
ocfs2: fix double free in user_cluster_connect()
drivers/base/node: fix double free in register_one_node()
nfp: fix RSS hash key size when RSS is not supported
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
net: dlink: handle copy_thresh allocation failure
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Squashfs: fix uninit-value in squashfs_get_parent
uio_hv_generic: Let userspace take care of interrupt mask
fs: udf: fix OOB read in lengthAllocDescs handling
net: nfc: nci: Add parameter validation for packet data
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
ext4: fix checks for orphan inodes
mm: hugetlb: avoid soft lockup when mprotect to large memory area
nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Input: atmel_mxt_ts - allow reset GPIO to sleep
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
pinctrl: check the return value of pinmux_ops::get_function_name()
bus: fsl-mc: Check return value of platform_get_resource()
usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
fs: always return zero on success from replace_fd()
clocksource/drivers/clps711x: Fix resource leaks in error paths
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
perf evsel: Avoid container_of on a NULL leader
libperf event: Ensure tracing data is multiple of 8 sized
clk: at91: peripheral: fix return value
perf util: Fix compression checks returning -1 as bool
rtc: x1205: Fix Xicor X1205 vendor prefix
perf session: Fix handling when buffer exceeds 2 GiB
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
cpufreq: tegra186: Set target frequency for all cpus in policy
scsi: libsas: Add sas_task_find_rq()
scsi: mvsas: Delete mvs_tag_init()
scsi: mvsas: Use sas_task_find_rq() for tagging
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
s390/cio: unregister the subchannel while purging
drm/vmwgfx: Copy DRM hash-table code into driver
drm/vmwgfx: Fix Use-after-free in validation
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
tools build: Align warning options with perf
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
drm/amdgpu: Add additional DCE6 SCL registers
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
drm/amd/display: Properly disable scaling on DCE6
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
crypto: essiv - Check ssize for decryption and in-place encryption
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
gpio: wcd934x: mark the GPIO controller as sleeping
bpf: Avoid RCU context warning when unpinning htab with internal structs
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
ACPI: debug: fix signedness issues in read/write helpers
arm64: dts: qcom: msm8916: Add missing MDSS reset
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
xen/events: Cleanup find_virq() return codes
xen/manage: Fix suspend error path
firmware: meson_sm: fix device leak at probe
media: i2c: mt9v111: fix incorrect type for ret
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
crypto: atmel - Fix dma_unmap_sg() direction
fs/ntfs3: Fix a resource leak bug in wnd_extend()
iio: dac: ad5360: use int type to store negative error codes
iio: dac: ad5421: use int type to store negative error codes
iio: frequency: adf4350: Fix prescaler usage.
init: handle bootloader identifier in kernel parameters
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
iommu/vt-d: PRS isn't usable if PDS isn't supported
KEYS: trusted_tpm1: Compare HMAC values in constant time
lib/genalloc: fix device leak in of_gen_pool_get()
openat2: don't trigger automounts with RESOLVE_NO_XDEV
parisc: don't reference obsolete termio struct for TC* constants
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
powerpc/powernv/pci: Fix underflow and leak issue
powerpc/pseries/msi: Fix potential underflow and leak issue
pwm: berlin: Fix wrong register in suspend/resume
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
sctp: Fix MAC comparison to be constant-time
sparc64: fix hugetlb for sun4u
sparc: fix error handling in scan_one_device()
mtd: rawnand: fsmc: Default to autodetect buswidth
mmc: core: SPI mode remove cmd7
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
rtc: interface: Fix long-standing race when setting alarm
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
PCI/sysfs: Ensure devices are powered for config reads
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
PCI/ERR: Fix uevent on failure to recover
PCI/AER: Fix missing uevent on recovery when a reset is requested
PCI/AER: Support errors introduced by PCIe r6.0
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
spi: cadence-quadspi: Flush posted register writes before INDAC access
spi: cadence-quadspi: Flush posted register writes before DAC access
x86/umip: Check that the instruction opcode is at least two bytes
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
ext4: verify orphan file size is not too big
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
ext4: correctly handle queries for metadata mappings
ext4: guard against EA inode refcount underflow in xattr update
ext4: free orphan info with kvfree
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
ASoC: codecs: wcd934x: Simplify with dev_err_probe
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Squashfs: add additional inode sanity checking
Squashfs: reject negative file sizes in squashfs_read_inode()
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
ksmbd: fix error code overwriting in smb2_get_info_filesystem()
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
dm: fix NULL pointer dereference in __dm_suspend()
locking: Introduce __cleanup() based infrastructure
fscontext: do not consume log entries when returning -EMSGSIZE
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
minmax: Introduce {min,max}_array()
minmax: deduplicate __unconst_integer_typeof()
minmax: fix indentation of __cmp_once() and __clamp_once()
minmax: avoid overly complicated constant expressions in VM code
minmax: add a few more MIN_T/MAX_T users
minmax: simplify and clarify min_t()/max_t() implementation
minmax: make generic MIN() and MAX() macros available everywhere
minmax: don't use max() in situations that want a C constant expression
minmax: simplify min()/max()/clamp() implementation
minmax: improve macro expansion and type checking
minmax: fix up min3() and max3() too
minmax.h: add whitespace around operators and after commas
minmax.h: update some comments
minmax.h: reduce the #define expansion of min(), max() and clamp()
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
minmax.h: move all the clamp() definitions after the min/max() ones
minmax.h: simplify the variants of clamp()
minmax.h: remove some #defines that are only expanded once
minixfs: Verify inode mode when loading from disk
pid: Add a judgment for ns null in pid_nr_ns
fs: Add 'initramfs_options' to set initramfs mount options
cramfs: Verify inode mode when loading from disk
writeback: Avoid softlockup when switching many inodes
writeback: Avoid excessively long inode switching times
media: switch from 'pci_' to 'dma_' API
media: cx18: Add missing check after DMA map
arm64: mte: Do not flag the zero page as PG_mte_tagged
media: pci/ivtv: switch from 'pci_' to 'dma_' API
media: pci: ivtv: Add missing check after DMA map
xen/events: Update virq_to_irq on migration
media: pci: ivtv: Add check for DMA map result
mm/slab: make __free(kfree) accept error pointers
mptcp: pm: in-kernel: usable client side with C-flag
selftests: mptcp: join: validate C-flag + def limit
Linux 5.15.195
UBUNTU: Upstream stable to v5.15.195

** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid

** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Bethany Jamison (bjamison)
Status: In Progress


** Tags: kernel-stable-tracking-bug

** Changed in: linux (Ubuntu)
Status: New => Confirmed

** Tags added: kernel-stable-tracking-bug

** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New

** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid

** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium

** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress

** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Bethany Jamison (bjamison)

** Description changed:


SRU Justification

Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:

v5.15.195 upstream stable release
from git://git.kernel.org/

-
+ iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
+ scsi: target: target_core_configfs: Add length check to avoid buffer overflow
+ media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
+ media: rc: fix races with imon_disconnect()
+ KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
+ udp: Fix memory accounting leak.
+ media: tunner: xc5000: Refactor firmware load
+ media: tuner: xc5000: Fix use-after-free in xc5000_release
+ media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
+ USB: serial: option: add SIMCom 8230C compositions
+ wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
+ dm-integrity: limit MAX_TAG_SIZE to 255
+ perf subcmd: avoid crash in exclude_cmds when excludes is empty
+ hid: fix I2C read buffer overflow in raw_event() for mcp2221
+ serial: stm32: allow selecting console when the driver is module
+ staging: axis-fifo: fix maximum TX packet length check
+ staging: axis-fifo: flush RX FIFO on read errors
+ driver core/PM: Set power.no_callbacks along with power.no_pm
+ platform/x86: int3472: Check for adev == NULL
+ crypto: rng - Ensure set_ent is always present
+ minmax: add in_range() macro
+ net/9p: fix double req put in p9_fd_cancelled
+ filelock: add FL_RECLAIM to show_fl_flags() macro
+ selftests: arm64: Check fread return value in exec_target
+ coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+ perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+ x86/vdso: Fix output operand size of RDPID
+ regmap: Remove superfluous check for !config in __regmap_init()
+ libbpf: Fix reuse of DEVMAP
+ cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+ ACPI: processor: idle: Fix memory leak when register cpuidle device failed
+ soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+ pinctrl: meson-gxl: add missing i2c_d pinmux
+ blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
+ ARM: at91: pm: fix MCKx restore routine
+ regulator: scmi: Use int type to store negative error codes
+ block: use int to store blk_stack_limits() return value
+ PM: sleep: core: Clear power.must_resume in noirq suspend error path
+ pinctrl: renesas: Use int type to store negative error codes
+ firmware: firmware: meson-sm: fix compile-test default
+ arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+ pwm: tiehrpwm: Fix corner case in clock divisor calculation
+ nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+ i3c: master: svc: Recycle unused IBI slot
+ selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
+ bpf: Explicitly check accesses to bpf_sock_addr
+ smp: Fix up and expand the smp_call_function_many() kerneldoc
+ tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
+ thermal/drivers/qcom: Make LMH select QCOM_SCM
+ thermal/drivers/qcom/lmh: Add missing IRQ includes
+ i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+ i2c: designware: Add disabling clocks when probe fails
+ drm/radeon/r600_cs: clean up of dead code in r600_cs
+ usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
+ scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+ scsi: myrs: Fix dma_alloc_coherent() error check
+ media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+ ALSA: lx_core: use int type to store negative error codes
+ drm/amdgpu: Power up UVD 3 for FW validation (v2)
+ wifi: mwifiex: send world regulatory domain to driver
+ PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
+ tcp: fix __tcp_close() to only send RST when required
+ drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+ usb: phy: twl6030: Fix incorrect type for ret
+ usb: gadget: configfs: Correctly set use_os_string at bind
+ misc: genwqe: Fix incorrect cmd field being reported in error
+ pps: fix warning in pps_register_cdev when register device fail
+ ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+ ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+ ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+ fs: ntfs3: Fix integer overflow in run_unpack()
+ iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+ netfilter: ipset: Remove unused htable_bits in macro ahash_region
+ watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
+ drivers/base/node: handle error properly in register_one_node()
+ RDMA/cm: Rate limit destroy CM ID timeout error message
+ wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+ ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+ scsi: qla2xxx: edif: Fix incorrect sign of error code
+ scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
+ Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
+ RDMA/core: Resolve MAC of next-hop device without ARP support
+ IB/sa: Fix sa_local_svc_timeout_ms read race
+ Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
+ wifi: ath10k: avoid unnecessary wait for service ready message
+ sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
+ sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
+ sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
+ sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+ sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+ remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+ coresight: trbe: Return NULL pointer for allocation failures
+ NFSv4.1: fix backchannel max_resp_sz verification check
+ ipvs: Defer ip_vs_ftp unregister during netns cleanup
+ scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+ usb: vhci-hcd: Prevent suspending virtually attached devices
+ RDMA/siw: Always report immediate post SQ errors
+ net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+ Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
+ hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+ ocfs2: fix double free in user_cluster_connect()
+ drivers/base/node: fix double free in register_one_node()
+ nfp: fix RSS hash key size when RSS is not supported
+ net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
+ net: dlink: handle copy_thresh allocation failure
+ Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+ Squashfs: fix uninit-value in squashfs_get_parent
+ uio_hv_generic: Let userspace take care of interrupt mask
+ fs: udf: fix OOB read in lengthAllocDescs handling
+ net: nfc: nci: Add parameter validation for packet data
+ mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
+ ext4: fix checks for orphan inodes
+ mm: hugetlb: avoid soft lockup when mprotect to large memory area
+ nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
+ Input: atmel_mxt_ts - allow reset GPIO to sleep
+ Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
+ pinctrl: check the return value of pinmux_ops::get_function_name()
+ bus: fsl-mc: Check return value of platform_get_resource()
+ usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
+ fs: always return zero on success from replace_fd()
+ clocksource/drivers/clps711x: Fix resource leaks in error paths
+ iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
+ perf evsel: Avoid container_of on a NULL leader
+ libperf event: Ensure tracing data is multiple of 8 sized
+ clk: at91: peripheral: fix return value
+ perf util: Fix compression checks returning -1 as bool
+ rtc: x1205: Fix Xicor X1205 vendor prefix
+ perf session: Fix handling when buffer exceeds 2 GiB
+ clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+ clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+ cpufreq: tegra186: Set target frequency for all cpus in policy
+ scsi: libsas: Add sas_task_find_rq()
+ scsi: mvsas: Delete mvs_tag_init()
+ scsi: mvsas: Use sas_task_find_rq() for tagging
+ scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+ net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+ s390/cio: unregister the subchannel while purging
+ drm/vmwgfx: Copy DRM hash-table code into driver
+ drm/vmwgfx: Fix Use-after-free in validation
+ net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
+ tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+ net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+ tools build: Align warning options with perf
+ mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
+ mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
+ bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+ drm/amdgpu: Add additional DCE6 SCL registers
+ drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+ drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+ drm/amd/display: Properly disable scaling on DCE6
+ bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+ crypto: essiv - Check ssize for decryption and in-place encryption
+ tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+ gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
+ gpio: wcd934x: mark the GPIO controller as sleeping
+ bpf: Avoid RCU context warning when unpinning htab with internal structs
+ ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
+ ACPI: debug: fix signedness issues in read/write helpers
+ arm64: dts: qcom: msm8916: Add missing MDSS reset
+ ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
+ xen/events: Cleanup find_virq() return codes
+ xen/manage: Fix suspend error path
+ firmware: meson_sm: fix device leak at probe
+ media: i2c: mt9v111: fix incorrect type for ret
+ drm/nouveau: fix bad ret code in nouveau_bo_move_prep
+ btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
+ bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
+ copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
+ cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
+ crypto: atmel - Fix dma_unmap_sg() direction
+ fs/ntfs3: Fix a resource leak bug in wnd_extend()
+ iio: dac: ad5360: use int type to store negative error codes
+ iio: dac: ad5421: use int type to store negative error codes
+ iio: frequency: adf4350: Fix prescaler usage.
+ init: handle bootloader identifier in kernel parameters
+ iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
+ iommu/vt-d: PRS isn't usable if PDS isn't supported
+ KEYS: trusted_tpm1: Compare HMAC values in constant time
+ lib/genalloc: fix device leak in of_gen_pool_get()
+ openat2: don't trigger automounts with RESOLVE_NO_XDEV
+ parisc: don't reference obsolete termio struct for TC* constants
+ nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
+ powerpc/powernv/pci: Fix underflow and leak issue
+ powerpc/pseries/msi: Fix potential underflow and leak issue
+ pwm: berlin: Fix wrong register in suspend/resume
+ scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
+ sctp: Fix MAC comparison to be constant-time
+ sparc64: fix hugetlb for sun4u
+ sparc: fix error handling in scan_one_device()
+ mtd: rawnand: fsmc: Default to autodetect buswidth
+ mmc: core: SPI mode remove cmd7
+ memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
+ rtc: interface: Ensure alarm irq is enabled when UIE is enabled
+ rtc: interface: Fix long-standing race when setting alarm
+ rseq/selftests: Use weak symbol reference, not definition, to link with glibc
+ PCI/sysfs: Ensure devices are powered for config reads
+ PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
+ PCI/ERR: Fix uevent on failure to recover
+ PCI/AER: Fix missing uevent on recovery when a reset is requested
+ PCI/AER: Support errors introduced by PCIe r6.0
+ PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
+ PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
+ spi: cadence-quadspi: Flush posted register writes before INDAC access
+ spi: cadence-quadspi: Flush posted register writes before DAC access
+ x86/umip: Check that the instruction opcode is at least two bytes
+ x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
+ mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
+ NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
+ nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
+ ext4: verify orphan file size is not too big
+ ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
+ ext4: correctly handle queries for metadata mappings
+ ext4: guard against EA inode refcount underflow in xattr update
+ ext4: free orphan info with kvfree
+ lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
+ KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
+ ASoC: codecs: wcd934x: Simplify with dev_err_probe
+ ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
+ Squashfs: add additional inode sanity checking
+ Squashfs: reject negative file sizes in squashfs_read_inode()
+ mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
+ mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
+ mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
+ net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
+ ksmbd: fix error code overwriting in smb2_get_info_filesystem()
+ tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
+ dm: fix NULL pointer dereference in __dm_suspend()
+ locking: Introduce __cleanup() based infrastructure
+ fscontext: do not consume log entries when returning -EMSGSIZE
+ btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
+ arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
+ minmax: Introduce {min,max}_array()
+ minmax: deduplicate __unconst_integer_typeof()
+ minmax: fix indentation of __cmp_once() and __clamp_once()
+ minmax: avoid overly complicated constant expressions in VM code
+ minmax: add a few more MIN_T/MAX_T users
+ minmax: simplify and clarify min_t()/max_t() implementation
+ minmax: make generic MIN() and MAX() macros available everywhere
+ minmax: don't use max() in situations that want a C constant expression
+ minmax: simplify min()/max()/clamp() implementation
+ minmax: improve macro expansion and type checking
+ minmax: fix up min3() and max3() too
+ minmax.h: add whitespace around operators and after commas
+ minmax.h: update some comments
+ minmax.h: reduce the #define expansion of min(), max() and clamp()
+ minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
+ minmax.h: move all the clamp() definitions after the min/max() ones
+ minmax.h: simplify the variants of clamp()
+ minmax.h: remove some #defines that are only expanded once
+ minixfs: Verify inode mode when loading from disk
+ pid: Add a judgment for ns null in pid_nr_ns
+ fs: Add 'initramfs_options' to set initramfs mount options
+ cramfs: Verify inode mode when loading from disk
+ writeback: Avoid softlockup when switching many inodes
+ writeback: Avoid excessively long inode switching times
+ media: switch from 'pci_' to 'dma_' API
+ media: cx18: Add missing check after DMA map
+ arm64: mte: Do not flag the zero page as PG_mte_tagged
+ media: pci/ivtv: switch from 'pci_' to 'dma_' API
+ media: pci: ivtv: Add missing check after DMA map
+ xen/events: Update virq_to_irq on migration
+ media: pci: ivtv: Add check for DMA map result
+ mm/slab: make __free(kfree) accept error pointers
+ mptcp: pm: in-kernel: usable client side with C-flag
+ selftests: mptcp: join: validate C-flag + def limit
Linux 5.15.195
- selftests: mptcp: join: validate C-flag + def limit
- mptcp: pm: in-kernel: usable client side with C-flag
- mm/slab: make __free(kfree) accept error pointers
- media: pci: ivtv: Add check for DMA map result
- xen/events: Update virq_to_irq on migration
- media: pci: ivtv: Add missing check after DMA map
- media: pci/ivtv: switch from 'pci_' to 'dma_' API
- arm64: mte: Do not flag the zero page as PG_mte_tagged
- media: cx18: Add missing check after DMA map
- media: switch from 'pci_' to 'dma_' API
- writeback: Avoid excessively long inode switching times
- writeback: Avoid softlockup when switching many inodes
- cramfs: Verify inode mode when loading from disk
- fs: Add 'initramfs_options' to set initramfs mount options
- pid: Add a judgment for ns null in pid_nr_ns
- minixfs: Verify inode mode when loading from disk
- minmax.h: remove some #defines that are only expanded once
- minmax.h: simplify the variants of clamp()
- minmax.h: move all the clamp() definitions after the min/max() ones
- minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
- minmax.h: reduce the #define expansion of min(), max() and clamp()
- minmax.h: update some comments
- minmax.h: add whitespace around operators and after commas
- minmax: fix up min3() and max3() too
- minmax: improve macro expansion and type checking
- minmax: simplify min()/max()/clamp() implementation
- minmax: don't use max() in situations that want a C constant expression
- minmax: make generic MIN() and MAX() macros available everywhere
- minmax: simplify and clarify min_t()/max_t() implementation
- minmax: add a few more MIN_T/MAX_T users
- minmax: avoid overly complicated constant expressions in VM code
- minmax: fix indentation of __cmp_once() and __clamp_once()
- minmax: deduplicate __unconst_integer_typeof()
- minmax: Introduce {min,max}_array()
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
- fscontext: do not consume log entries when returning -EMSGSIZE
- locking: Introduce __cleanup() based infrastructure
- dm: fix NULL pointer dereference in __dm_suspend()
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
- ksmbd: fix error code overwriting in smb2_get_info_filesystem()
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
- media: mc: Clear minor number before put device
- Squashfs: reject negative file sizes in squashfs_read_inode()
- Squashfs: add additional inode sanity checking
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
- ASoC: codecs: wcd934x: Simplify with dev_err_probe
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
- ext4: free orphan info with kvfree
- ext4: guard against EA inode refcount underflow in xattr update
- ext4: correctly handle queries for metadata mappings
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
- ext4: verify orphan file size is not too big
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
- x86/umip: Check that the instruction opcode is at least two bytes
- spi: cadence-quadspi: Flush posted register writes before DAC access
- spi: cadence-quadspi: Flush posted register writes before INDAC access
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
- PCI/AER: Support errors introduced by PCIe r6.0
- PCI/AER: Fix missing uevent on recovery when a reset is requested
- PCI/ERR: Fix uevent on failure to recover
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
- PCI/sysfs: Ensure devices are powered for config reads
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc
- rtc: interface: Fix long-standing race when setting alarm
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
- mmc: core: SPI mode remove cmd7
- mtd: rawnand: fsmc: Default to autodetect buswidth
- sparc: fix error handling in scan_one_device()
- sparc64: fix hugetlb for sun4u
- sctp: Fix MAC comparison to be constant-time
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
- pwm: berlin: Fix wrong register in suspend/resume
- powerpc/pseries/msi: Fix potential underflow and leak issue
- powerpc/powernv/pci: Fix underflow and leak issue
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
- parisc: don't reference obsolete termio struct for TC* constants
- openat2: don't trigger automounts with RESOLVE_NO_XDEV
- lib/genalloc: fix device leak in of_gen_pool_get()
- KEYS: trusted_tpm1: Compare HMAC values in constant time
- iommu/vt-d: PRS isn't usable if PDS isn't supported
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
- init: handle bootloader identifier in kernel parameters
- iio: frequency: adf4350: Fix prescaler usage.
- iio: dac: ad5421: use int type to store negative error codes
- iio: dac: ad5360: use int type to store negative error codes
- fs/ntfs3: Fix a resource leak bug in wnd_extend()
- crypto: atmel - Fix dma_unmap_sg() direction
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
- copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep
- media: i2c: mt9v111: fix incorrect type for ret
- firmware: meson_sm: fix device leak at probe
- xen/manage: Fix suspend error path
- xen/events: Cleanup find_virq() return codes
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
- arm64: dts: qcom: msm8916: Add missing MDSS reset
- ACPI: debug: fix signedness issues in read/write helpers
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
- bpf: Avoid RCU context warning when unpinning htab with internal structs
- gpio: wcd934x: mark the GPIO controller as sleeping
- gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
- crypto: essiv - Check ssize for decryption and in-place encryption
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
- drm/amd/display: Properly disable scaling on DCE6
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
- drm/amdgpu: Add additional DCE6 SCL registers
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
- tools build: Align warning options with perf
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
- drm/vmwgfx: Fix Use-after-free in validation
- drm/vmwgfx: Copy DRM hash-table code into driver
- s390/cio: unregister the subchannel while purging
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
- scsi: mvsas: Use sas_task_find_rq() for tagging
- scsi: mvsas: Delete mvs_tag_init()
- scsi: libsas: Add sas_task_find_rq()
- cpufreq: tegra186: Set target frequency for all cpus in policy
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
- perf test: Don't leak workload gopipe in PERF_RECORD_*
- perf session: Fix handling when buffer exceeds 2 GiB
- rtc: x1205: Fix Xicor X1205 vendor prefix
- perf util: Fix compression checks returning -1 as bool
- clk: at91: peripheral: fix return value
- libperf event: Ensure tracing data is multiple of 8 sized
- perf evsel: Avoid container_of on a NULL leader
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
- clocksource/drivers/clps711x: Fix resource leaks in error paths
- fs: always return zero on success from replace_fd()
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
- bus: fsl-mc: Check return value of platform_get_resource()
- pinctrl: check the return value of pinmux_ops::get_function_name()
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
- Input: atmel_mxt_ts - allow reset GPIO to sleep
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
- mm: hugetlb: avoid soft lockup when mprotect to large memory area
- ext4: fix checks for orphan inodes
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
- net: nfc: nci: Add parameter validation for packet data
- fs: udf: fix OOB read in lengthAllocDescs handling
- uio_hv_generic: Let userspace take care of interrupt mask
- Squashfs: fix uninit-value in squashfs_get_parent
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
- net: dlink: handle copy_thresh allocation failure
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
- nfp: fix RSS hash key size when RSS is not supported
- drivers/base/node: fix double free in register_one_node()
- ocfs2: fix double free in user_cluster_connect()
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
- RDMA/siw: Always report immediate post SQ errors
- usb: vhci-hcd: Prevent suspending virtually attached devices
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
- ipvs: Defer ip_vs_ftp unregister during netns cleanup
- NFSv4.1: fix backchannel max_resp_sz verification check
- coresight: trbe: Return NULL pointer for allocation failures
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
- wifi: ath10k: avoid unnecessary wait for service ready message
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
- IB/sa: Fix sa_local_svc_timeout_ms read race
- RDMA/core: Resolve MAC of next-hop device without ARP support
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
- scsi: qla2xxx: edif: Fix incorrect sign of error code
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
- wifi: mt76: fix potential memory leak in mt76_wmac_probe()
- RDMA/cm: Rate limit destroy CM ID timeout error message
- drivers/base/node: handle error properly in register_one_node()
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
- netfilter: ipset: Remove unused htable_bits in macro ahash_region
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
- fs: ntfs3: Fix integer overflow in run_unpack()
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
- pps: fix warning in pps_register_cdev when register device fail
- misc: genwqe: Fix incorrect cmd field being reported in error
- usb: gadget: configfs: Correctly set use_os_string at bind
- usb: phy: twl6030: Fix incorrect type for ret
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
- tcp: fix __tcp_close() to only send RST when required
- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
- wifi: mwifiex: send world regulatory domain to driver
- drm/amdgpu: Power up UVD 3 for FW validation (v2)
- ALSA: lx_core: use int type to store negative error codes
- media: rj54n1cb0c: Fix memleak in rj54n1_probe()
- scsi: myrs: Fix dma_alloc_coherent() error check
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
- drm/radeon/r600_cs: clean up of dead code in r600_cs
- i2c: designware: Add disabling clocks when probe fails
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
- thermal/drivers/qcom/lmh: Add missing IRQ includes
- thermal/drivers/qcom: Make LMH select QCOM_SCM
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
- smp: Fix up and expand the smp_call_function_many() kerneldoc
- bpf: Explicitly check accesses to bpf_sock_addr
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
- i3c: master: svc: Recycle unused IBI slot
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
- pwm: tiehrpwm: Fix corner case in clock divisor calculation
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
- firmware: firmware: meson-sm: fix compile-test default
- pinctrl: renesas: Use int type to store negative error codes
- PM: sleep: core: Clear power.must_resume in noirq suspend error path
- block: use int to store blk_stack_limits() return value
- regulator: scmi: Use int type to store negative error codes
- ARM: at91: pm: fix MCKx restore routine
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
- pinctrl: meson-gxl: add missing i2c_d pinmux
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
- libbpf: Fix reuse of DEVMAP
- regmap: Remove superfluous check for !config in __regmap_init()
- x86/vdso: Fix output operand size of RDPID
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
- coresight: trbe: Prevent overflow in PERF_IDX2OFF()
- selftests: arm64: Check fread return value in exec_target
- filelock: add FL_RECLAIM to show_fl_flags() macro
- net/9p: fix double req put in p9_fd_cancelled
- minmax: add in_range() macro
- crypto: rng - Ensure set_ent is always present
- platform/x86: int3472: Check for adev == NULL
- driver core/PM: Set power.no_callbacks along with power.no_pm
- staging: axis-fifo: flush RX FIFO on read errors
- staging: axis-fifo: fix maximum TX packet length check
- serial: stm32: allow selecting console when the driver is module
- hid: fix I2C read buffer overflow in raw_event() for mcp2221
- perf subcmd: avoid crash in exclude_cmds when excludes is empty
- dm-integrity: limit MAX_TAG_SIZE to 255
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
- USB: serial: option: add SIMCom 8230C compositions
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
- media: tuner: xc5000: Fix use-after-free in xc5000_release
- media: tunner: xc5000: Refactor firmware load
- udp: Fix memory accounting leak.
- KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
- media: rc: fix races with imon_disconnect()
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow
- iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
+ UBUNTU: Upstream stable to v5.15.195

--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/2130466

Title:
Jammy update: v5.15.195 upstream stable release

Status in linux package in Ubuntu:
Invalid
Status in linux source package in Jammy:
In Progress

Bug description:

SRU Justification

Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:

v5.15.195 upstream stable release
from git://git.kernel.org/

iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
media: rc: fix races with imon_disconnect()
KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
udp: Fix memory accounting leak.
media: tunner: xc5000: Refactor firmware load
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
USB: serial: option: add SIMCom 8230C compositions
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
dm-integrity: limit MAX_TAG_SIZE to 255
perf subcmd: avoid crash in exclude_cmds when excludes is empty
hid: fix I2C read buffer overflow in raw_event() for mcp2221
serial: stm32: allow selecting console when the driver is module
staging: axis-fifo: fix maximum TX packet length check
staging: axis-fifo: flush RX FIFO on read errors
driver core/PM: Set power.no_callbacks along with power.no_pm
platform/x86: int3472: Check for adev == NULL
crypto: rng - Ensure set_ent is always present
minmax: add in_range() macro
net/9p: fix double req put in p9_fd_cancelled
filelock: add FL_RECLAIM to show_fl_flags() macro
selftests: arm64: Check fread return value in exec_target
coresight: trbe: Prevent overflow in PERF_IDX2OFF()
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
x86/vdso: Fix output operand size of RDPID
regmap: Remove superfluous check for !config in __regmap_init()
libbpf: Fix reuse of DEVMAP
cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
pinctrl: meson-gxl: add missing i2c_d pinmux
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
ARM: at91: pm: fix MCKx restore routine
regulator: scmi: Use int type to store negative error codes
block: use int to store blk_stack_limits() return value
PM: sleep: core: Clear power.must_resume in noirq suspend error path
pinctrl: renesas: Use int type to store negative error codes
firmware: firmware: meson-sm: fix compile-test default
arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
pwm: tiehrpwm: Fix corner case in clock divisor calculation
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
i3c: master: svc: Recycle unused IBI slot
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
bpf: Explicitly check accesses to bpf_sock_addr
smp: Fix up and expand the smp_call_function_many() kerneldoc
tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
thermal/drivers/qcom: Make LMH select QCOM_SCM
thermal/drivers/qcom/lmh: Add missing IRQ includes
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
i2c: designware: Add disabling clocks when probe fails
drm/radeon/r600_cs: clean up of dead code in r600_cs
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
scsi: myrs: Fix dma_alloc_coherent() error check
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
ALSA: lx_core: use int type to store negative error codes
drm/amdgpu: Power up UVD 3 for FW validation (v2)
wifi: mwifiex: send world regulatory domain to driver
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
tcp: fix __tcp_close() to only send RST when required
drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
usb: phy: twl6030: Fix incorrect type for ret
usb: gadget: configfs: Correctly set use_os_string at bind
misc: genwqe: Fix incorrect cmd field being reported in error
pps: fix warning in pps_register_cdev when register device fail
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
fs: ntfs3: Fix integer overflow in run_unpack()
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
netfilter: ipset: Remove unused htable_bits in macro ahash_region
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
drivers/base/node: handle error properly in register_one_node()
RDMA/cm: Rate limit destroy CM ID timeout error message
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
scsi: qla2xxx: edif: Fix incorrect sign of error code
scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
RDMA/core: Resolve MAC of next-hop device without ARP support
IB/sa: Fix sa_local_svc_timeout_ms read race
Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
wifi: ath10k: avoid unnecessary wait for service ready message
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
coresight: trbe: Return NULL pointer for allocation failures
NFSv4.1: fix backchannel max_resp_sz verification check
ipvs: Defer ip_vs_ftp unregister during netns cleanup
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
usb: vhci-hcd: Prevent suspending virtually attached devices
RDMA/siw: Always report immediate post SQ errors
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
hwrng: ks-sa - fix division by zero in ks_sa_rng_init
ocfs2: fix double free in user_cluster_connect()
drivers/base/node: fix double free in register_one_node()
nfp: fix RSS hash key size when RSS is not supported
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
net: dlink: handle copy_thresh allocation failure
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Squashfs: fix uninit-value in squashfs_get_parent
uio_hv_generic: Let userspace take care of interrupt mask
fs: udf: fix OOB read in lengthAllocDescs handling
net: nfc: nci: Add parameter validation for packet data
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
ext4: fix checks for orphan inodes
mm: hugetlb: avoid soft lockup when mprotect to large memory area
nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Input: atmel_mxt_ts - allow reset GPIO to sleep
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
pinctrl: check the return value of pinmux_ops::get_function_name()
bus: fsl-mc: Check return value of platform_get_resource()
usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
fs: always return zero on success from replace_fd()
clocksource/drivers/clps711x: Fix resource leaks in error paths
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
perf evsel: Avoid container_of on a NULL leader
libperf event: Ensure tracing data is multiple of 8 sized
clk: at91: peripheral: fix return value
perf util: Fix compression checks returning -1 as bool
rtc: x1205: Fix Xicor X1205 vendor prefix
perf session: Fix handling when buffer exceeds 2 GiB
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
cpufreq: tegra186: Set target frequency for all cpus in policy
scsi: libsas: Add sas_task_find_rq()
scsi: mvsas: Delete mvs_tag_init()
scsi: mvsas: Use sas_task_find_rq() for tagging
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
s390/cio: unregister the subchannel while purging
drm/vmwgfx: Copy DRM hash-table code into driver
drm/vmwgfx: Fix Use-after-free in validation
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
tools build: Align warning options with perf
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
drm/amdgpu: Add additional DCE6 SCL registers
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
drm/amd/display: Properly disable scaling on DCE6
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
crypto: essiv - Check ssize for decryption and in-place encryption
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
gpio: wcd934x: mark the GPIO controller as sleeping
bpf: Avoid RCU context warning when unpinning htab with internal structs
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
ACPI: debug: fix signedness issues in read/write helpers
arm64: dts: qcom: msm8916: Add missing MDSS reset
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
xen/events: Cleanup find_virq() return codes
xen/manage: Fix suspend error path
firmware: meson_sm: fix device leak at probe
media: i2c: mt9v111: fix incorrect type for ret
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
crypto: atmel - Fix dma_unmap_sg() direction
fs/ntfs3: Fix a resource leak bug in wnd_extend()
iio: dac: ad5360: use int type to store negative error codes
iio: dac: ad5421: use int type to store negative error codes
iio: frequency: adf4350: Fix prescaler usage.
init: handle bootloader identifier in kernel parameters
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
iommu/vt-d: PRS isn't usable if PDS isn't supported
KEYS: trusted_tpm1: Compare HMAC values in constant time
lib/genalloc: fix device leak in of_gen_pool_get()
openat2: don't trigger automounts with RESOLVE_NO_XDEV
parisc: don't reference obsolete termio struct for TC* constants
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
powerpc/powernv/pci: Fix underflow and leak issue
powerpc/pseries/msi: Fix potential underflow and leak issue
pwm: berlin: Fix wrong register in suspend/resume
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
sctp: Fix MAC comparison to be constant-time
sparc64: fix hugetlb for sun4u
sparc: fix error handling in scan_one_device()
mtd: rawnand: fsmc: Default to autodetect buswidth
mmc: core: SPI mode remove cmd7
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
rtc: interface: Fix long-standing race when setting alarm
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
PCI/sysfs: Ensure devices are powered for config reads
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
PCI/ERR: Fix uevent on failure to recover
PCI/AER: Fix missing uevent on recovery when a reset is requested
PCI/AER: Support errors introduced by PCIe r6.0
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
spi: cadence-quadspi: Flush posted register writes before INDAC access
spi: cadence-quadspi: Flush posted register writes before DAC access
x86/umip: Check that the instruction opcode is at least two bytes
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
ext4: verify orphan file size is not too big
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
ext4: correctly handle queries for metadata mappings
ext4: guard against EA inode refcount underflow in xattr update
ext4: free orphan info with kvfree
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
ASoC: codecs: wcd934x: Simplify with dev_err_probe
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Squashfs: add additional inode sanity checking
Squashfs: reject negative file sizes in squashfs_read_inode()
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
ksmbd: fix error code overwriting in smb2_get_info_filesystem()
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
dm: fix NULL pointer dereference in __dm_suspend()
locking: Introduce __cleanup() based infrastructure
fscontext: do not consume log entries when returning -EMSGSIZE
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
minmax: Introduce {min,max}_array()
minmax: deduplicate __unconst_integer_typeof()
minmax: fix indentation of __cmp_once() and __clamp_once()
minmax: avoid overly complicated constant expressions in VM code
minmax: add a few more MIN_T/MAX_T users
minmax: simplify and clarify min_t()/max_t() implementation
minmax: make generic MIN() and MAX() macros available everywhere
minmax: don't use max() in situations that want a C constant expression
minmax: simplify min()/max()/clamp() implementation
minmax: improve macro expansion and type checking
minmax: fix up min3() and max3() too
minmax.h: add whitespace around operators and after commas
minmax.h: update some comments
minmax.h: reduce the #define expansion of min(), max() and clamp()
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
minmax.h: move all the clamp() definitions after the min/max() ones
minmax.h: simplify the variants of clamp()
minmax.h: remove some #defines that are only expanded once
minixfs: Verify inode mode when loading from disk
pid: Add a judgment for ns null in pid_nr_ns
fs: Add 'initramfs_options' to set initramfs mount options
cramfs: Verify inode mode when loading from disk
writeback: Avoid softlockup when switching many inodes
writeback: Avoid excessively long inode switching times
media: switch from 'pci_' to 'dma_' API
media: cx18: Add missing check after DMA map
arm64: mte: Do not flag the zero page as PG_mte_tagged
media: pci/ivtv: switch from 'pci_' to 'dma_' API
media: pci: ivtv: Add missing check after DMA map
xen/events: Update virq_to_irq on migration
media: pci: ivtv: Add check for DMA map result
mm/slab: make __free(kfree) accept error pointers
mptcp: pm: in-kernel: usable client side with C-flag
selftests: mptcp: join: validate C-flag + def limit
Linux 5.15.195
UBUNTU: Upstream stable to v5.15.195

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2130466/+subscriptions