[Bug 2161173] [NEW] Jammy update: v5.15.210 upstream stable release

Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.210 upstream stable release from git://git.kernel.org/ Linux 5.15.210 netfilter: require Ethernet MAC header before using eth_hdr() batman-adv: tp_meter: avoid role confusion in tp_list batman-adv: tp_meter: fix race condition in send error reporting ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Bluetooth: MGMT: Fix backward compatibility with userspace media: rc: igorplugusb: fix control request setup packet batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown media: rc: ttusbir: fix inverted error logic x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function apparmor: validate default DFA states are in bounds fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter mptcp: close TOCTOU race while computing rcv_wnd arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU arm64: errata: Mitigate TLBI errata on various Arm CPUs arm64: cputype: Add C1-Premium definitions arm64: cputype: Add C1-Ultra definitions arm64: cputype: Add NVIDIA Olympus definitions selinux: enable genfscon labeling for securityfs ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 nfsd: fix heap overflow in NFSv4.0 LOCK replay cache ksmbd: Compare MACs in constant time net/ipv6: ioam6: prevent schema length wraparound in trace fill batman-adv: tp_meter: fix tp_num leak on kmalloc failure batman-adv: stop tp_meter sessions during mesh teardown blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init ipvs: skip ipv6 extension headers for csum checks mm/huge_memory: update file PMD counter before folio_put() RDMA/umem: Fix truncation for block sizes >= 4G RDMA: Move DMA block iterator logic into dedicated files RDMA/umem: fix kernel-doc warnings hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netfilter: nft_fib: fix stale stack leak via the OIFNAME register scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() serial: qcom-geni: fix UART_RX_PAR_EN bit position tty: serial: qcom-geni-serial: align #define values tty: serial: qcom-geni-serial: remove unused symbols serial: altera_jtaguart: handle uart_add_one_port() failures serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt drm/hyperv: validate resolution_count and fix WIN8 fallback drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 usb: typec: ucsi: Check if power role change actually happened before handling scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() usb: gadget: f_hid: fix device reference leak in hidg_alloc() usb: gadget: f_hid: tidy error handling in hidg_alloc usb: dwc3: xilinx: fix error handling in zynqmp init error paths tty: serial: samsung: Remove redundant port lock acquisition in rx helpers tty: serial: samsung: use u32 for register interactions serial: samsung_tty: Use port lock wrappers net: skbuff: fix missing zerocopy reference in pskb_carve helpers usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: chemical: scd30: fix division by zero in write_raw iio: chemical: scd30: Use guard(mutex) to allow early returns iio: gyro: adis16260: fix division by zero in write_raw Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() phy: tegra: xusb: Fix per-pad high-speed termination calibration phy: tegra: xusb: Disable trk clk when not in use arm64: tlb: Flush walk cache when unsharing PMD tables spi: qup: fix error pointer deref after DMA setup failure spi: qup: switch to use modern name octeontx2-pf: avoid double free of pool->stack on AQ init failure octeontx2-af: CGX: add bounds check to cgx_speed_mbps index mptcp: do not drop partial packets selftests: mptcp: drop nanoseconds width specifier mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient use less confusing names for iov_iter direction initializers ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() ipv6/addrconf: annotate data-races around devconf fields (II) ice: fix VF queue configuration with low MTU values net: hsr: defer node table free until after RCU readers Bluetooth: serialize accept_q access Bluetooth: Init sk_peer_* on bt_sock_alloc Bluetooth: Consolidate code around sk_alloc into a helper function qed: fix double free in qed_cxt_tables_alloc() qed: Use the bitmap API to simplify some functions Bluetooth: MGMT: validate Add Extended Advertising Data length Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Bluetooth: hci_qca: Convert timeout from jiffies to ms Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() smb: client: require net admin for CIFS SWN netlink genetlink: Use internal flags for multicast groups spi: lantiq-ssc: fix controller deregistration spi: st-ssc4: fix controller deregistration f2fs: fix false alarm of lockdep on cp_global_sem lock f2fs: fix incorrect file address mapping when inline inode is unwritten mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker mptcp: pm: ADD_ADDR rtx: fix potential data-race mptcp: pm: prio: skip closed subflows smb: client: Use FullSessionKey for AES-256 encryption key derivation btrfs: fix missing last_unlink_trans update when removing a directory smb: client: validate dacloffset before building DACL pointers pmdomain: core: Fix detach procedure for virtual devices in genpd tracing/probes: Limit size of event probe to 3K btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak spi: topcliff-pch: fix controller deregistration spi: topcliff-pch: Convert to platform remove callback returning void fbcon: Avoid OOB font access if console rotation fails mm/hugetlb_cma: round up per_node before logging it spi: uniphier: fix controller deregistration spi: tegra20-sflash: fix controller deregistration spi: tegra114: fix controller deregistration spi: sun6i: fix controller deregistration spi: zynq-qspi: fix controller deregistration spi: ti-qspi: fix controller deregistration spi: spi-ti-qspi: Convert to platform remove callback returning void spi: sun4i: fix controller deregistration spi: syncuacer: fix controller deregistration xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete xfrm: ah: account for ESN high bits in async callbacks net: ipv6: stop checking crypto_ahash_alignmask net: ipv4: stop checking crypto_ahash_alignmask usb: dwc3: Move GUID programming after PHY initialization wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task usb: typec: tcpm: reset internal port states on soft reset AMS smb: client: validate the whole DACL before rewriting it in cifsacl tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() crypto: caam - guard HMAC key hex dumps in hash_digest_key printk: add print_hex_dump_devel() ALSA: aloop: Fix peer runtime UAF during format-change stop ceph: only d_add() negative dentries when they are unhashed erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() can: ucan: fix devres lifetime can: ucan: fix typos in comments Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus: fix uninit-value by validating catalog record size udf: fix partition descriptor append bookkeeping mtd: spi-nor: sst: Fix write enable before AAI sequence mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration randomize_kstack: Maintain kstack_offset per task fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info net: bridge: use a stable FDB dst snapshot in RCU readers net: qrtr: ns: Limit the total number of nodes net: mctp: fix don't require received header reserved bits to be zero net: qrtr: ns: Free the node during ctrl_cmd_bye() net: qrtr: ns: Change servers radix tree to xarray net: qrtr: ns: Limit the maximum number of lookups ALSA: core: Fix potential data race at fasync handling sched: Use u64 for bandwidth ratio calculations media: rc: igorplugusb: heed coherency rules erofs: fix the out-of-bounds nameoff handling for trailing dirents ALSA: aoa: Skip devices with no codecs in i2sbus_resume() media: rc: ttusbir: respect DMA coherency rules ALSA: aoa: i2sbus: clear stale prepared state ALSA: aoa: Use guard() for mutex locks wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() thermal: core: Fix thermal zone governor cleanup issues wifi: rtw88: check for PCI upstream bridge existence rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID arm64/mm: Enable batched TLB flush in unmap_hotplug_range() net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() ksmbd: require minimum ACE size in smb_check_perm_dacl() smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb: client: require a full NFS mode SID before reading mode bits smb: server: fix max_connections off-by-one in tcp accept path smb: server: fix active_num_conn leak on transport allocation failure f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() net/tcp-md5: Fix MAC comparison to be constant-time io_uring/poll: fix signed comparison in io_poll_get_ownership() mm/damon/ops-common: call folio_test_lru() after folio_get() fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling drm/amd/display: Use krealloc_array() in dal_vector_reserve() drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs drm/amd/display: Clamp VBIOS HDMI retimer register count to array size drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock thunderbolt: Limit XDomain response copy to actual frame size thunderbolt: Clamp XDomain response data copy to allocation size thunderbolt: Bound root directory content to block size thunderbolt: Reject zero-length property entries in validator sctp: stream: fully roll back denied add-stream state sctp: diag: reject stale associations in dump_one path mmc: sdhci: add signal voltage switch in sdhci_resume_host mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC mmc: core: Fix host controller programming for fixed driver type net: rds: clear i_sends on setup unwind net: mv643xx: fix OF node refcount net: bonding: fix NULL pointer dereference in bond_do_ioctl() misc: fastrpc: fix DMA address corruption due to find_vma misuse misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context ipc/shm: serialize orphan cleanup with shm_nattch updates Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) i2c: tegra: Fix NOIRQ suspend/resume i2c: stm32f7: fix timing computation ignoring i2c-analog-filter i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() fuse: reject fuse_notify() pagecache ops on directories pidfd: refuse access to tasks that have started exiting harder IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN bnxt_en: Fix NULL pointer dereference vsock/vmci: fix sk_ack_backlog leak on failed handshake mptcp: sockopt: check timestamping ret value mptcp: fix retransmission loop when csum is enabled ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O ARM: socfpga: Fix OF node refcount leak in SMP setup RDMA/srp: bound SRP_RSP sense copy by the received length drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() ALSA: timer: Fix UAF at snd_timer_user_params() USB: serial: kl5kusb105: fix bulk-out buffer overflow USB: serial: option: add usb-id for Dell Wireless DW5826e-m USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() USB: serial: io_ti: fix heap overflow in get_manuf_info() xfrm: espintcp: do not reuse an in-progress partial send drm/i915/gem: Fix phys BO pread/pwrite with offset Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig netfilter: nft_tunnel: fix use-after-free on object destroy drm/vc4: fix krealloc() memory leak net: mvpp2: build skb from XDP-adjusted data on XDP_PASS net: mvpp2: refill RX buffers before XDP or skb use net: mvpp2: Add metadata support for xdp mode net: mvpp2: limit XDP frame size to the RX buffer net: mvpp2: sync RX data at the hardware packet offset netfilter: nft_exthdr: fix register tracking for F_PRESENT flag netfilter: nf_log: validate MAC header was set before dumping it netfilter: x_tables: avoid leaking percpu counter pointers rds: mark snapshot pages dirty in rds_info_getsockopt() ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion net: guard timestamp cmsgs to real error queue skbs sctp: fix uninit-value in __sctp_rcv_asconf_lookup() net: openvswitch: fix possible kfree_skb of ERR_PTR ipv6: sit: reload inner IPv6 header after GSO offloads net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove netlabel: validate unlabeled address and mask attribute lengths xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI arm64: tlb: Allow XZR argument to TLBI ops KVM: arm64: Remove VPIPT I-cache handling tun: free page on build_skb failure in tun_xdp_one() tap: free page on error paths in tap_get_user_xdp() nfsd: don't ignore the return code of svc_proc_register() fs/ntfs3: Return error for inconsistent extended attributes ext4: validate p_idx bounds in ext4_ext_correct_indexes time: Fix off-by-one in settimeofday() usec validation signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() sctp: purge outqueue on stale COOKIE-ECHO handling net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bluetooth: fix memory leak in error path of hci_alloc_dev() Bluetooth: bnep: reject short frames before parsing Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling Bluetooth: RFCOMM: validate skb length in MCC handlers Bluetooth: MGMT: validate advertising TLV before type checks Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() net: lan743x: permit VLAN-tagged packets up to configured MTU net: garp: fix unsigned integer underflow in garp_pdu_parse_attr pcnet32: stop holding device spin lock during napi_complete_done drm/imx: Fix three kernel-doc warnings in dcss-scaler.c 6lowpan: fix off-by-one in multicast context address compression net/sched: act_api: use RCU with deferred freeing for action lifecycle dm cache policy smq: check allocation under invalidate lock netfilter: bridge: make ebt_snat ARP rewrite writable netfilter: conntrack_irc: fix possible out-of-bounds read netfilter: synproxy: add mutex to guard hook reference counting ipvs: clear the svc scheduler ptr early on edit netfilter: xt_NFQUEUE: prefer raw_smp_processor_id tee: optee: prevent use-after-free when the client exits before the supplicant ipv6: mcast: Fix use-after-free when processing MLD queries i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Disable -Wattribute-alias for clang-23 and newer compiler-clang.h: Add __diag infrastructure for clang USB: serial: mct_u232: fix memory corruption with small endpoint bpf: Free reuseport cBPF prog after RCU grace period. usb: core: Fix SuperSpeed root hub wMaxPacketSize serial: dz: Fix bootconsole handover lockup xhci: tegra: Fix ghost USB device on dual-role port unplug USB: serial: digi_acceleport: fix memory corruption with small endpoints HID: core: Fix size_t specifier in hid_report_raw_event() HID: pass the buffer size to hid_report_raw_event HID: core: Add printk_ratelimited variants to hid_warn() etc USB: serial: cypress_m8: fix memory corruption with small endpoint serial: zs: Switch to using channel reset serial: zs: Fix bootconsole handover lockup serial: dz: Fix bootconsole message clobbering at chip reset serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma serial: zs: Fix swapped RI/DSR modem line transition counting serial: sh-sci: fix memory region release in error path drm/hyperv: validate VMBus packet size in receive callback scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() usb: gadget: f_fs: copy only received bytes on short ep0 read usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports usb: gadget: net2280: Fix double free in probe error path USB: serial: mct_u232: fix missing interrupt-in transfer sanity check USB: serial: mxuport: fix memory corruption with small endpoint USB: serial: keyspan: fix missing indat transfer sanity check USB: serial: cypress_m8: validate interrupt packet headers USB: serial: belkin_sa: validate interrupt status length USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL USB: serial: option: add MeiG SRM813Q usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize usb: usbtmc: check URB actual_length for interrupt-IN notifications usbip: vudc: Fix use after free bug in vudc_remove due to race condition usb: storage: Add quirks for PNY Elite Portable SSD USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval usb: chipidea: core: convert ci_role_switch to local variable tty: serial: pch_uart: add check for dma_alloc_coherent() comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem xfrm: esp: restore combined single-frag length gate ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks ASoC: qcom: q6asm-dai: close stream only when running netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check xfrm: ah: use skb_to_full_sk in async output callbacks xfrm: route MIGRATE notifications to caller's netns nfc: hci: fix out-of-bounds read in HCP header parsing iommu, debugobjects: avoid gcc-16.1 section mismatch warnings HID: wacom: Fix OOB write in wacom_hid_set_device_mode() ip6: vti: Use ip6_tnl.net in vti6_changelink(). xfrm: input: hold netns during deferred transport reinjection ipv6: validate extension header length before copying to cmsg ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). ipv6: exthdrs: refresh nh after handling HAO option ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() macsec: fix replay protection at XPN lower-PN wrap bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Input: elan_i2c - validate firmware size before use usb: dwc2: Fix use after free in debug code usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles usb: cdns3: gadget: fix request skipping after clearing halt USB: serial: omninet: fix memory corruption with small endpoint iio: buffer: hw-consumer: fix use-after-free in error path iio: light: cm3323: fix reg_conf not being initialized correctly iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL iio: temperature: tsys01: fix broken PROM checksum validation iio: ssp_sensors: cancel delayed work_refresh on remove iio: gyro: itg3200: fix i2c read into the wrong stack location iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw wireguard: send: append trailer after expanding head iio: dac: ad5686: fix input raw value check iio: dac: max5821: fix return value check in powerdown sync iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux parport: Fix race between port and client registration Bluetooth: HIDP: fix missing length checks in hidp_input_report() Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn ipc: limit next_id allocation to the valid ID range hpfs: fix a crash if hpfs_map_dnode_bitmap fails Bluetooth: btusb: Allow firmware re-download when version matches Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() USB: serial: safe_serial: fix memory corruption with small endpoint usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() usb: typec: altmodes/displayport: validate count before reading Status Update VDO usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO usb: typec: ucsi: ccg: reject firmware images without a ':' record header iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table RDMA/rxe: Fix double free in rxe_srq_from_init Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used drm/dp: Add eDP 1.5 bit definition drm/i915/psr: Read Intel DPCD workaround register drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work batman-adv: bla: avoid double decrement of bla.num_requests batman-adv: tt: avoid empty VLAN responses batman-adv: tt: fix TOCTOU race for reported vlans batman-adv: tp_meter: directly shut down timer on cleanup selftests: forwarding: lib: Add helpers for checksum handling batman-adv: iv: recover OGM scheduling after forward packet error batman-adv: tvlv: reject oversized TVLV packets batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface batman-adv: tvlv: abort OGM send on tvlv append failure batman-adv: v: stop OGMv2 on disabled interface sctp: fix race between sctp_wait_for_connect and peeloff gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ethtool: eeprom: add more safeties to EEPROM Netlink fallback bonding: refuse to enslave CAN devices Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() ASoC: codecs: simple-mux: Fix enum control bounds check tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() net/iucv: fix locking in .getsockopt net/smc: Do not re-initialize smc hashtables net: netlink: don't set nsid on local notifications net: netlink: fix sending unassigned nsid after assigned one tun: free page on short-frame rejection in tun_xdp_one() netfilter: ebtables: fix OOB read in compat_mtw_from_user netfilter: xt_cpu: prefer raw_smp_processor_id netfilter: synproxy: refresh tcphdr after skb_ensure_writable nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems xfrm: Check for underflow in xfrm_state_mtu nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() nfc: llcp: Fix use-after-free in llcp_sock_release() net: cpsw_new: Fix potential unregister of netdev that has not been registered yet dmaengine: idxd: Fix not releasing workqueue on .release() drm: Remove plane hsub/vsub alignment requirement for core helpers net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked net: mctp: ensure our nlmsg responses are initialised net/sched: cls_fw: fix NULL dereference of "old" filters before change() Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ** Affects: linux (Ubuntu) Importance: Undecided Status: Confirmed ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161173 Title: Jammy update: v5.15.210 upstream stable release Status in linux package in Ubuntu: Confirmed Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.210 upstream stable release from git://git.kernel.org/ Linux 5.15.210 netfilter: require Ethernet MAC header before using eth_hdr() batman-adv: tp_meter: avoid role confusion in tp_list batman-adv: tp_meter: fix race condition in send error reporting ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Bluetooth: MGMT: Fix backward compatibility with userspace media: rc: igorplugusb: fix control request setup packet batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown media: rc: ttusbir: fix inverted error logic x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function apparmor: validate default DFA states are in bounds fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter mptcp: close TOCTOU race while computing rcv_wnd arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU arm64: errata: Mitigate TLBI errata on various Arm CPUs arm64: cputype: Add C1-Premium definitions arm64: cputype: Add C1-Ultra definitions arm64: cputype: Add NVIDIA Olympus definitions selinux: enable genfscon labeling for securityfs ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 nfsd: fix heap overflow in NFSv4.0 LOCK replay cache ksmbd: Compare MACs in constant time net/ipv6: ioam6: prevent schema length wraparound in trace fill batman-adv: tp_meter: fix tp_num leak on kmalloc failure batman-adv: stop tp_meter sessions during mesh teardown blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init ipvs: skip ipv6 extension headers for csum checks mm/huge_memory: update file PMD counter before folio_put() RDMA/umem: Fix truncation for block sizes >= 4G RDMA: Move DMA block iterator logic into dedicated files RDMA/umem: fix kernel-doc warnings hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netfilter: nft_fib: fix stale stack leak via the OIFNAME register scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() serial: qcom-geni: fix UART_RX_PAR_EN bit position tty: serial: qcom-geni-serial: align #define values tty: serial: qcom-geni-serial: remove unused symbols serial: altera_jtaguart: handle uart_add_one_port() failures serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt drm/hyperv: validate resolution_count and fix WIN8 fallback drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 usb: typec: ucsi: Check if power role change actually happened before handling scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() usb: gadget: f_hid: fix device reference leak in hidg_alloc() usb: gadget: f_hid: tidy error handling in hidg_alloc usb: dwc3: xilinx: fix error handling in zynqmp init error paths tty: serial: samsung: Remove redundant port lock acquisition in rx helpers tty: serial: samsung: use u32 for register interactions serial: samsung_tty: Use port lock wrappers net: skbuff: fix missing zerocopy reference in pskb_carve helpers usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: chemical: scd30: fix division by zero in write_raw iio: chemical: scd30: Use guard(mutex) to allow early returns iio: gyro: adis16260: fix division by zero in write_raw Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() phy: tegra: xusb: Fix per-pad high-speed termination calibration phy: tegra: xusb: Disable trk clk when not in use arm64: tlb: Flush walk cache when unsharing PMD tables spi: qup: fix error pointer deref after DMA setup failure spi: qup: switch to use modern name octeontx2-pf: avoid double free of pool->stack on AQ init failure octeontx2-af: CGX: add bounds check to cgx_speed_mbps index mptcp: do not drop partial packets selftests: mptcp: drop nanoseconds width specifier mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient use less confusing names for iov_iter direction initializers ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() ipv6/addrconf: annotate data-races around devconf fields (II) ice: fix VF queue configuration with low MTU values net: hsr: defer node table free until after RCU readers Bluetooth: serialize accept_q access Bluetooth: Init sk_peer_* on bt_sock_alloc Bluetooth: Consolidate code around sk_alloc into a helper function qed: fix double free in qed_cxt_tables_alloc() qed: Use the bitmap API to simplify some functions Bluetooth: MGMT: validate Add Extended Advertising Data length Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Bluetooth: hci_qca: Convert timeout from jiffies to ms Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() smb: client: require net admin for CIFS SWN netlink genetlink: Use internal flags for multicast groups spi: lantiq-ssc: fix controller deregistration spi: st-ssc4: fix controller deregistration f2fs: fix false alarm of lockdep on cp_global_sem lock f2fs: fix incorrect file address mapping when inline inode is unwritten mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker mptcp: pm: ADD_ADDR rtx: fix potential data-race mptcp: pm: prio: skip closed subflows smb: client: Use FullSessionKey for AES-256 encryption key derivation btrfs: fix missing last_unlink_trans update when removing a directory smb: client: validate dacloffset before building DACL pointers pmdomain: core: Fix detach procedure for virtual devices in genpd tracing/probes: Limit size of event probe to 3K btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak spi: topcliff-pch: fix controller deregistration spi: topcliff-pch: Convert to platform remove callback returning void fbcon: Avoid OOB font access if console rotation fails mm/hugetlb_cma: round up per_node before logging it spi: uniphier: fix controller deregistration spi: tegra20-sflash: fix controller deregistration spi: tegra114: fix controller deregistration spi: sun6i: fix controller deregistration spi: zynq-qspi: fix controller deregistration spi: ti-qspi: fix controller deregistration spi: spi-ti-qspi: Convert to platform remove callback returning void spi: sun4i: fix controller deregistration spi: syncuacer: fix controller deregistration xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete xfrm: ah: account for ESN high bits in async callbacks net: ipv6: stop checking crypto_ahash_alignmask net: ipv4: stop checking crypto_ahash_alignmask usb: dwc3: Move GUID programming after PHY initialization wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task usb: typec: tcpm: reset internal port states on soft reset AMS smb: client: validate the whole DACL before rewriting it in cifsacl tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() crypto: caam - guard HMAC key hex dumps in hash_digest_key printk: add print_hex_dump_devel() ALSA: aloop: Fix peer runtime UAF during format-change stop ceph: only d_add() negative dentries when they are unhashed erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() can: ucan: fix devres lifetime can: ucan: fix typos in comments Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus: fix uninit-value by validating catalog record size udf: fix partition descriptor append bookkeeping mtd: spi-nor: sst: Fix write enable before AAI sequence mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration randomize_kstack: Maintain kstack_offset per task fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info net: bridge: use a stable FDB dst snapshot in RCU readers net: qrtr: ns: Limit the total number of nodes net: mctp: fix don't require received header reserved bits to be zero net: qrtr: ns: Free the node during ctrl_cmd_bye() net: qrtr: ns: Change servers radix tree to xarray net: qrtr: ns: Limit the maximum number of lookups ALSA: core: Fix potential data race at fasync handling sched: Use u64 for bandwidth ratio calculations media: rc: igorplugusb: heed coherency rules erofs: fix the out-of-bounds nameoff handling for trailing dirents ALSA: aoa: Skip devices with no codecs in i2sbus_resume() media: rc: ttusbir: respect DMA coherency rules ALSA: aoa: i2sbus: clear stale prepared state ALSA: aoa: Use guard() for mutex locks wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() thermal: core: Fix thermal zone governor cleanup issues wifi: rtw88: check for PCI upstream bridge existence rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID arm64/mm: Enable batched TLB flush in unmap_hotplug_range() net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() ksmbd: require minimum ACE size in smb_check_perm_dacl() smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb: client: require a full NFS mode SID before reading mode bits smb: server: fix max_connections off-by-one in tcp accept path smb: server: fix active_num_conn leak on transport allocation failure f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() net/tcp-md5: Fix MAC comparison to be constant-time io_uring/poll: fix signed comparison in io_poll_get_ownership() mm/damon/ops-common: call folio_test_lru() after folio_get() fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling drm/amd/display: Use krealloc_array() in dal_vector_reserve() drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs drm/amd/display: Clamp VBIOS HDMI retimer register count to array size drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock thunderbolt: Limit XDomain response copy to actual frame size thunderbolt: Clamp XDomain response data copy to allocation size thunderbolt: Bound root directory content to block size thunderbolt: Reject zero-length property entries in validator sctp: stream: fully roll back denied add-stream state sctp: diag: reject stale associations in dump_one path mmc: sdhci: add signal voltage switch in sdhci_resume_host mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC mmc: core: Fix host controller programming for fixed driver type net: rds: clear i_sends on setup unwind net: mv643xx: fix OF node refcount net: bonding: fix NULL pointer dereference in bond_do_ioctl() misc: fastrpc: fix DMA address corruption due to find_vma misuse misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context ipc/shm: serialize orphan cleanup with shm_nattch updates Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) i2c: tegra: Fix NOIRQ suspend/resume i2c: stm32f7: fix timing computation ignoring i2c-analog-filter i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() fuse: reject fuse_notify() pagecache ops on directories pidfd: refuse access to tasks that have started exiting harder IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN bnxt_en: Fix NULL pointer dereference vsock/vmci: fix sk_ack_backlog leak on failed handshake mptcp: sockopt: check timestamping ret value mptcp: fix retransmission loop when csum is enabled ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O ARM: socfpga: Fix OF node refcount leak in SMP setup RDMA/srp: bound SRP_RSP sense copy by the received length drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() ALSA: timer: Fix UAF at snd_timer_user_params() USB: serial: kl5kusb105: fix bulk-out buffer overflow USB: serial: option: add usb-id for Dell Wireless DW5826e-m USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() USB: serial: io_ti: fix heap overflow in get_manuf_info() xfrm: espintcp: do not reuse an in-progress partial send drm/i915/gem: Fix phys BO pread/pwrite with offset Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig netfilter: nft_tunnel: fix use-after-free on object destroy drm/vc4: fix krealloc() memory leak net: mvpp2: build skb from XDP-adjusted data on XDP_PASS net: mvpp2: refill RX buffers before XDP or skb use net: mvpp2: Add metadata support for xdp mode net: mvpp2: limit XDP frame size to the RX buffer net: mvpp2: sync RX data at the hardware packet offset netfilter: nft_exthdr: fix register tracking for F_PRESENT flag netfilter: nf_log: validate MAC header was set before dumping it netfilter: x_tables: avoid leaking percpu counter pointers rds: mark snapshot pages dirty in rds_info_getsockopt() ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion net: guard timestamp cmsgs to real error queue skbs sctp: fix uninit-value in __sctp_rcv_asconf_lookup() net: openvswitch: fix possible kfree_skb of ERR_PTR ipv6: sit: reload inner IPv6 header after GSO offloads net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove netlabel: validate unlabeled address and mask attribute lengths xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI arm64: tlb: Allow XZR argument to TLBI ops KVM: arm64: Remove VPIPT I-cache handling tun: free page on build_skb failure in tun_xdp_one() tap: free page on error paths in tap_get_user_xdp() nfsd: don't ignore the return code of svc_proc_register() fs/ntfs3: Return error for inconsistent extended attributes ext4: validate p_idx bounds in ext4_ext_correct_indexes time: Fix off-by-one in settimeofday() usec validation signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() sctp: purge outqueue on stale COOKIE-ECHO handling net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bluetooth: fix memory leak in error path of hci_alloc_dev() Bluetooth: bnep: reject short frames before parsing Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling Bluetooth: RFCOMM: validate skb length in MCC handlers Bluetooth: MGMT: validate advertising TLV before type checks Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() net: lan743x: permit VLAN-tagged packets up to configured MTU net: garp: fix unsigned integer underflow in garp_pdu_parse_attr pcnet32: stop holding device spin lock during napi_complete_done drm/imx: Fix three kernel-doc warnings in dcss-scaler.c 6lowpan: fix off-by-one in multicast context address compression net/sched: act_api: use RCU with deferred freeing for action lifecycle dm cache policy smq: check allocation under invalidate lock netfilter: bridge: make ebt_snat ARP rewrite writable netfilter: conntrack_irc: fix possible out-of-bounds read netfilter: synproxy: add mutex to guard hook reference counting ipvs: clear the svc scheduler ptr early on edit netfilter: xt_NFQUEUE: prefer raw_smp_processor_id tee: optee: prevent use-after-free when the client exits before the supplicant ipv6: mcast: Fix use-after-free when processing MLD queries i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Disable -Wattribute-alias for clang-23 and newer compiler-clang.h: Add __diag infrastructure for clang USB: serial: mct_u232: fix memory corruption with small endpoint bpf: Free reuseport cBPF prog after RCU grace period. usb: core: Fix SuperSpeed root hub wMaxPacketSize serial: dz: Fix bootconsole handover lockup xhci: tegra: Fix ghost USB device on dual-role port unplug USB: serial: digi_acceleport: fix memory corruption with small endpoints HID: core: Fix size_t specifier in hid_report_raw_event() HID: pass the buffer size to hid_report_raw_event HID: core: Add printk_ratelimited variants to hid_warn() etc USB: serial: cypress_m8: fix memory corruption with small endpoint serial: zs: Switch to using channel reset serial: zs: Fix bootconsole handover lockup serial: dz: Fix bootconsole message clobbering at chip reset serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma serial: zs: Fix swapped RI/DSR modem line transition counting serial: sh-sci: fix memory region release in error path drm/hyperv: validate VMBus packet size in receive callback scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() usb: gadget: f_fs: copy only received bytes on short ep0 read usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports usb: gadget: net2280: Fix double free in probe error path USB: serial: mct_u232: fix missing interrupt-in transfer sanity check USB: serial: mxuport: fix memory corruption with small endpoint USB: serial: keyspan: fix missing indat transfer sanity check USB: serial: cypress_m8: validate interrupt packet headers USB: serial: belkin_sa: validate interrupt status length USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL USB: serial: option: add MeiG SRM813Q usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize usb: usbtmc: check URB actual_length for interrupt-IN notifications usbip: vudc: Fix use after free bug in vudc_remove due to race condition usb: storage: Add quirks for PNY Elite Portable SSD USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval usb: chipidea: core: convert ci_role_switch to local variable tty: serial: pch_uart: add check for dma_alloc_coherent() comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem xfrm: esp: restore combined single-frag length gate ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks ASoC: qcom: q6asm-dai: close stream only when running netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check xfrm: ah: use skb_to_full_sk in async output callbacks xfrm: route MIGRATE notifications to caller's netns nfc: hci: fix out-of-bounds read in HCP header parsing iommu, debugobjects: avoid gcc-16.1 section mismatch warnings HID: wacom: Fix OOB write in wacom_hid_set_device_mode() ip6: vti: Use ip6_tnl.net in vti6_changelink(). xfrm: input: hold netns during deferred transport reinjection ipv6: validate extension header length before copying to cmsg ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). ipv6: exthdrs: refresh nh after handling HAO option ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() macsec: fix replay protection at XPN lower-PN wrap bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Input: elan_i2c - validate firmware size before use usb: dwc2: Fix use after free in debug code usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles usb: cdns3: gadget: fix request skipping after clearing halt USB: serial: omninet: fix memory corruption with small endpoint iio: buffer: hw-consumer: fix use-after-free in error path iio: light: cm3323: fix reg_conf not being initialized correctly iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL iio: temperature: tsys01: fix broken PROM checksum validation iio: ssp_sensors: cancel delayed work_refresh on remove iio: gyro: itg3200: fix i2c read into the wrong stack location iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw wireguard: send: append trailer after expanding head iio: dac: ad5686: fix input raw value check iio: dac: max5821: fix return value check in powerdown sync iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux parport: Fix race between port and client registration Bluetooth: HIDP: fix missing length checks in hidp_input_report() Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn ipc: limit next_id allocation to the valid ID range hpfs: fix a crash if hpfs_map_dnode_bitmap fails Bluetooth: btusb: Allow firmware re-download when version matches Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() USB: serial: safe_serial: fix memory corruption with small endpoint usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() usb: typec: altmodes/displayport: validate count before reading Status Update VDO usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO usb: typec: ucsi: ccg: reject firmware images without a ':' record header iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table RDMA/rxe: Fix double free in rxe_srq_from_init Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used drm/dp: Add eDP 1.5 bit definition drm/i915/psr: Read Intel DPCD workaround register drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work batman-adv: bla: avoid double decrement of bla.num_requests batman-adv: tt: avoid empty VLAN responses batman-adv: tt: fix TOCTOU race for reported vlans batman-adv: tp_meter: directly shut down timer on cleanup selftests: forwarding: lib: Add helpers for checksum handling batman-adv: iv: recover OGM scheduling after forward packet error batman-adv: tvlv: reject oversized TVLV packets batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface batman-adv: tvlv: abort OGM send on tvlv append failure batman-adv: v: stop OGMv2 on disabled interface sctp: fix race between sctp_wait_for_connect and peeloff gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ethtool: eeprom: add more safeties to EEPROM Netlink fallback bonding: refuse to enslave CAN devices Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() ASoC: codecs: simple-mux: Fix enum control bounds check tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() net/iucv: fix locking in .getsockopt net/smc: Do not re-initialize smc hashtables net: netlink: don't set nsid on local notifications net: netlink: fix sending unassigned nsid after assigned one tun: free page on short-frame rejection in tun_xdp_one() netfilter: ebtables: fix OOB read in compat_mtw_from_user netfilter: xt_cpu: prefer raw_smp_processor_id netfilter: synproxy: refresh tcphdr after skb_ensure_writable nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems xfrm: Check for underflow in xfrm_state_mtu nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() nfc: llcp: Fix use-after-free in llcp_sock_release() net: cpsw_new: Fix potential unregister of netdev that has not been registered yet dmaengine: idxd: Fix not releasing workqueue on .release() drm: Remove plane hsub/vsub alignment requirement for core helpers net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked net: mctp: ensure our nlmsg responses are initialised net/sched: cls_fw: fix NULL dereference of "old" filters before change() Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161173/+subscriptions