linux (4.15.0-201.212) bionic; urgency=medium

  * bionic/linux: 4.15.0-201.212 -proposed tracker (LP: #1997871)

  * Expose built-in trusted and revoked certificates (LP: #1996892)
    - [Packaging] Expose built-in trusted and revoked certificates

  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - s390/archrandom: prevent CPACF trng invocations in interrupt context

  * BUG: scheduling while atomic: ip/1210/0x00000200 on xenial/hwe rumford
    (LP: #1995870)
    - tg3: prevent scheduling while atomic splat

  * Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349)
    - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
    - selftests/bpf: Fix test_align verifier log patterns
    - drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
    - platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
    - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
    - ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
    - kcm: fix strp_init() order and cleanup
    - serial: fsl_lpuart: RS485 RTS polariy is inverse
    - staging: rtl8712: fix use after free bugs
    - vt: Clear selection before changing the font
    - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
    - binder: fix UAF of ref->proc caused by race condition
    - drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
    - Input: rk805-pwrkey - fix module autoloading
    - hwmon: (gpio-fan) Fix array out of bounds access
    - thunderbolt: Use the actual buffer in tb_async_error()
    - xhci: Add grace period after xHC start to prevent premature runtime suspend.
    - USB: serial: cp210x: add Decagon UCA device id
    - USB: serial: option: add support for OPPO R11 diag port
    - USB: serial: option: add Quectel EM060K modem
    - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
    - usb: dwc2: fix wrong order of phy_power_on and phy_init
    - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
    - usb-storage: Add ignore-residue quirk for NXP PN7462AU
    - s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
    - s390: fix nospec table alignments
    - USB: core: Prevent nested device-reset calls
    - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
    - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
    - net: mac802154: Fix a condition in the receive path
    - ALSA: seq: oss: Fix data-race for max_midi_devs access
    - ALSA: seq: Fix data-race at module auto-loading
    - efi: capsule-loader: Fix use-after-free in efi_capsule_write
    - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - fs: only do a memory barrier for the first set_buffer_uptodate()
    - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
    - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
    - drm/radeon: add a force flush to delay work when radeon
    - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
    - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
    - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
    - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
    - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
    - ALSA: usb-audio: Fix an out-of-bounds bug in
      __snd_usb_parse_audio_interface()
    - kprobes: Prohibit probes in gate area
    - scsi: mpt3sas: Fix use-after-free warning
    - driver core: Don't probe devices after bus_type.match() probe deferral
    - netfilter: br_netfilter: Drop dst references before setting.
    - sch_sfb: Don't assume the skb is still around after enqueueing to child
    - tipc: fix shift wrapping bug in map_get()
    - ipv6: sr: fix out-of-bounds read when setting HMAC data.
    - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
    - sch_sfb: Also store skb len before calling child enqueue
    - usb: dwc3: fix PHY disable sequence
    - USB: serial: ch341: fix lost character on LCR updates
    - USB: serial: ch341: fix disabled rx timer on older devices
    - MIPS: loongson32: ls1c: Fix hang during startup
    - SUNRPC: use _bh spinlocking on ->transport_lock
    - net: dp83822: disable false carrier interrupt
    - tcp: annotate data-race around challenge_timestamp
    - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
    - clk: core: Fix runtime PM sequence in clk_core_unprepare()
    - soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
    - i40e: Fix kernel crash during module removal
    - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
    - drm/msm/rd: Fix FIFO-full deadlock
    - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
    - tg3: Disable tg3 device on system reboot to avoid triggering AER
    - ieee802154: cc2520: add rc code in cc2520_tx()
    - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
    - tracefs: Only clobber mode/uid/gid on remount if asked
    - net: dp83822: disable rx error interrupt

  * Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
    - audit: fix potential double free on error path from fsnotify_add_inode_mark
    - parisc: Fix exception handler for fldw and fstw instructions
    - pinctrl: amd: Don't save/restore interrupt status and wake status bits
    - xfrm: fix refcount leak in __xfrm_policy_check()
    - rose: check NULL rose_loopback_neigh->loopback
    - bonding: 802.3ad: fix no transmission of LACPDUs
    - net: ipvtap - add __init/__exit annotations to module init/exit funcs
    - netfilter: ebtables: reject blobs that don't provide all entry points
    - netfilter: nft_payload: report ERANGE for too long offset and length
    - netfilter: nft_payload: do not truncate csum_offset and csum_type
    - net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
    - ratelimit: Fix data-races in ___ratelimit().
    - net: Fix a data-race around sysctl_tstamp_allow_data.
    - net: Fix a data-race around sysctl_net_busy_poll.
    - net: Fix a data-race around sysctl_net_busy_read.
    - net: Fix a data-race around netdev_budget.
    - net: Fix a data-race around netdev_budget_usecs.
    - net: Fix a data-race around sysctl_somaxconn.
    - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
    - btrfs: check if root is readonly while setting security xattr
    - loop: Check for overflow while configuring loop
    - asm-generic: sections: refactor memory_intersects
    - mm/hugetlb: fix hugetlb not supporting softdirty tracking
    - md: call __md_stop_writes in md_stop
    - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
    - arm64: map FDT as RW for early_init_dt_scan()
    - s390/mm: do not trigger write fault when vma does not allow VM_WRITE
    - x86/bugs: Add "unknown" reporting for MMIO Stale Data
    - kbuild: Fix include path in scripts/Makefile.modpost
    - Bluetooth: L2CAP: Fix build errors in some archs
    - media: pvrusb2: fix memory leak in pvr_probe
    - HID: hidraw: fix memory leak in hidraw_release()
    - fbdev: fb_pm2fb: Avoid potential divide by zero error
    - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is
      dead
    - neigh: fix possible DoS due to net iface start/stop loop
    - s390/hypfs: avoid error message under KVM
    - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
    - kprobes: don't call disarm_kprobe() for disabled kprobes
    - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
    - net: Fix data-races around netdev_tstamp_prequeue.
    - x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
    - s390: fix double free of GS and RI CBs on fork() failure
    - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
    - bpf: Fix the off-by-two error in range markings

  * CVE-2022-2663
    - netfilter: nf_conntrack_irc: Fix forged IP logic

  * CVE-2022-3061
    - video: fbdev: i740fb: Error out if 'pixclock' equals zero

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 28 Nov 2022 11:19:40 +0100

linux (4.15.0-200.211) bionic; urgency=medium

  * bionic/linux: 4.15.0-200.211 -proposed tracker (LP: #1997465)

  * CVE-2022-3239
    - media: em28xx: initialize refcount before kref_get

  * CVE-2022-3524
    - tcp/udp: Fix memory leak in ipv6_renew_options().

  * CVE-2022-3564
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

  * CVE-2022-3565
    - mISDN: fix use-after-free bugs in l1oip timer handlers

  * CVE-2022-3566
    - tcp: Fix data races around icsk->icsk_af_ops.

  * CVE-2022-3567
    - ipv6: annotate some data-races around sk->sk_prot
    - ipv6: Fix data races around sk->sk_prot.

  * CVE-2022-3594
    - r8152: Rate limit overflow messages

  * CVE-2022-3621
    - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()

  * CVE-2022-42703
    - mm/rmap.c: don't reuse anon_vma if we just want a copy
    - mm: rmap: explicitly reset vma->anon_vma in unlink_anon_vmas()
    - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 24 Nov 2022 14:47:04 -0300

linux (4.15.0-197.208) bionic; urgency=medium

  * bionic/linux: 4.15.0-197.208 -proposed tracker (LP: #1994998)

  * Memory leak while using NFQUEUE to delegate the decision on TCP packets to
    userspace processes (LP: #1991774)
    - SAUCE: netfilter: nf_queue: Fix memory leak in nf_queue_entry_get_refs

  * Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698)
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - ARM: crypto: comment out gcc warning that breaks clang builds
    - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
    - ACPI: video: Force backlight native for some TongFang devices
    - macintosh/adb: fix oob read in do_adb_query() function
    - Makefile: link with -z noexecstack --no-warn-rwx-segments
    - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
    - ALSA: bcd2000: Fix a UAF bug on the error path of probing
    - add barriers to buffer_uptodate and set_buffer_uptodate
    - HID: wacom: Don't register pad_input for touch switch
    - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
    - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
    - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
    - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
    - ALSA: hda/cirrus - support for iMac 12,1 model
    - vfs: Check the truncate maximum size in inode_newsize_ok()
    - fs: Add missing umask strip in vfs_tmpfile
    - usbnet: Fix linkwatch use-after-free on disconnect
    - parisc: Fix device names in /proc/iomem
    - drm/nouveau: fix another off-by-one in nvbios_addr
    - drm/amdgpu: Check BO's requested pinning domains against its
      preferred_domains
    - iio: light: isl29028: Fix the warning in isl29028_remove()
    - fuse: limit nsec
    - md-raid10: fix KASAN warning
    - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
    - PCI: Add defines for normal and subtractive PCI bridges
    - powerpc/fsl-pci: Fix Class Code of PCIe Root Port
    - powerpc/powernv: Avoid crashing if rng is NULL
    - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
    - USB: HCD: Fix URB giveback issue in tasklet function
    - netfilter: nf_tables: fix null deref due to zeroed list head
    - arm64: Do not forget syscall when starting a new thread.
    - arm64: fix oops in concurrently setting insn_emulation sysctls
    - ext2: Add more validity checks for inode counts
    - ARM: dts: imx6ul: add missing properties for sram
    - ARM: dts: imx6ul: fix qspi node compatible
    - ARM: OMAP2+: display: Fix refcount leak bug
    - ACPI: PM: save NVS memory for Lenovo G40-45
    - ACPI: LPSS: Fix missing check in register_device_clock()
    - PM: hibernate: defer device probing when resuming from hibernation
    - selinux: Add boundary check in put_entry()
    - ARM: findbit: fix overflowing offset
    - ARM: bcm: Fix refcount leak in bcm_kona_smc_init
    - x86/pmem: Fix platform-device leak in error path
    - ARM: dts: ast2500-evb: fix board compatible
    - soc: fsl: guts: machine variable might be unset
    - cpufreq: zynq: Fix refcount leak in zynq_get_revision
    - ARM: dts: qcom: pm8841: add required thermal-sensor-cells
    - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
    - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
    - thermal/tools/tmon: Include pthread and time headers in tmon.h
    - dm: return early from dm_pr_call() if DM device is suspended
    - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
    - drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
    - i2c: Fix a potential use after free
    - wifi: iwlegacy: 4965: fix potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - drm: bridge: adv7511: Add check for mipi_dsi_driver_register
    - media: hdpvr: fix error value returns in hdpvr_read
    - drm/vc4: dsi: Correct DSI divider calculations
    - drm/rockchip: vop: Don't crash for invalid duplicate_state()
    - drm/mediatek: dpi: Remove output format of YUV
    - drm: bridge: sii8620: fix possible off-by-one
    - media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
    - tcp: make retransmitted SKB fit into the send window
    - selftests: timers: valid-adjtimex: build fix for newer toolchains
    - selftests: timers: clocksource-switch: fix passing errors from child
    - fs: check FMODE_LSEEK to control internal pipe splicing
    - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
    - wifi: p54: Fix an error handling path in p54spi_probe()
    - wifi: p54: add missing parentheses in p54_flush()
    - can: pch_can: do not report txerr and rxerr during bus-off
    - can: rcar_can: do not report txerr and rxerr during bus-off
    - can: sja1000: do not report txerr and rxerr during bus-off
    - can: hi311x: do not report txerr and rxerr during bus-off
    - can: sun4i_can: do not report txerr and rxerr during bus-off
    - can: usb_8dev: do not report txerr and rxerr during bus-off
    - can: error: specify the values of data[5..7] of CAN error frames
    - can: pch_can: pch_can_error(): initialize errc before using it
    - Bluetooth: hci_intel: Add check for platform_driver_register
    - i2c: cadence: Support PEC for SMBus block read
    - i2c: mux-gpmux: Add of_node_put() when breaking out of loop
    - wifi: wil6210: debugfs: fix uninitialized variable use in
      `wil_write_file_wmi()`
    - wifi: libertas: Fix possible refcount leak in if_usb_probe()
    - net: rose: fix netdev reference changes
    - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
    - mtd: maps: Fix refcount leak in of_flash_probe_versatile
    - mtd: maps: Fix refcount leak in ap_flash_init
    - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
    - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
    - fpga: altera-pr-ip: fix unsigned comparison with less than zero
    - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
    - usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
    - misc: rtsx: Fix an error handling path in rtsx_pci_probe()
    - mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
    - memstick/ms_block: Fix some incorrect memory allocation
    - memstick/ms_block: Fix a memory leak
    - mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
    - scsi: smartpqi: Fix DMA direction for RAID requests
    - usb: gadget: udc: amd5536 depends on HAS_DMA
    - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
    - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
    - mmc: cavium-octeon: Add of_node_put() when breaking out of loop
    - mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
    - USB: serial: fix tty-port initialized comments
    - platform/olpc: Fix uninitialized data in debugfs write
    - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
    - RDMA/rxe: Fix error unwind in rxe_create_qp()
    - ext4: recover csum seed of tmp_inode after migrating to extents
    - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
    - ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
    - ASoC: codecs: da7210: add check for i2c_add_driver
    - ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
    - profiling: fix shift too large makes kernel panic
    - tty: n_gsm: fix non flow control frames during mux flow off
    - tty: n_gsm: fix packet re-transmission without open control channel
    - tty: n_gsm: fix race condition in gsmld_write()
    - remoteproc: qcom: wcnss: Fix handling of IRQs
    - vfio/ccw: Do not change FSM state in subchannel event
    - tty: n_gsm: fix wrong T1 retry count handling
    - tty: n_gsm: fix DM command
    - iommu/exynos: Handle failed IOMMU device registration properly
    - kfifo: fix kfifo_to_user() return type
    - mfd: t7l66xb: Drop platform disable callback
    - iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
    - s390/zcore: fix race when reading from hardware system area
    - video: fbdev: amba-clcd: Fix refcount leak bugs
    - video: fbdev: sis: fix typos in SiS_GetModeID()
    - powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and
      alias
    - powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
    - powerpc/xive: Fix refcount leak in xive_get_max_prio
    - powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
    - kprobes: Forbid probing on trampoline and BPF code areas
    - powerpc/pci: Fix PHB numbering when using opal-phbid
    - genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
    - x86/numa: Use cpumask_available instead of hardcoded NULL check
    - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
    - tools/thermal: Fix possible path truncations
    - video: fbdev: vt8623fb: Check the size of screen before memset_io()
    - video: fbdev: arkfb: Check the size of screen before memset_io()
    - video: fbdev: s3fb: Check the size of screen before memset_io()
    - scsi: zfcp: Fix missing auto port scan and thus missing target ports
    - x86/olpc: fix 'logical not is only applied to the left hand side'
    - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
    - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
    - ext4: make sure ext4_append() always allocates new block
    - ext4: fix use-after-free in ext4_xattr_set_entry
    - ext4: update s_overhead_clusters in the superblock during an on-line resize
    - ext4: fix extent status tree race in writeback error recovery path
    - ext4: correct max_inline_xattr_value_size computing
    - ext4: correct the misjudgment in ext4_iget_extra_inode
    - intel_th: pci: Add Raptor Lake-S CPU support
    - intel_th: pci: Add Raptor Lake-S PCH support
    - intel_th: pci: Add Meteor Lake-P support
    - dm raid: fix address sanitizer warning in raid_resume
    - dm raid: fix address sanitizer warning in raid_status
    - btrfs: reject log replay if there is unsupported RO compat flag
    - KVM: Add infrastructure and macro to mark VM as bugged
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
    - KVM: x86: Avoid theoretical NULL pointer dereference in
      kvm_irq_delivery_to_apic_fast()
    - tcp: fix over estimation in sk_forced_mem_schedule()
    - scsi: sg: Allow waiting for commands to complete on removed device
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    - net/9p: Initialize the iounit field during fid creation
    - net_sched: cls_route: disallow handle of 0
    - powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
    - ALSA: info: Fix llseek return value when using callback
    - rds: add missing barrier to release_refill
    - ata: libata-eh: Add missing command name
    - btrfs: fix lost error handling when looking up extended ref on log replay
    - can: ems_usb: fix clang's -Wunaligned-access warning
    - apparmor: fix quiet_denied for file rules
    - apparmor: Fix failed mount permission check error message
    - apparmor: fix aa_label_asxprint return check
    - apparmor: fix reference count leak in aa_pivotroot()
    - NFSv4: Fix races in the legacy idmapper upcall
    - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
    - SUNRPC: Reinitialise the backchannel request buffers before reuse
    - pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
    - pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
    - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
    - geneve: do not use RT_TOS for IPv6 flowlabel
    - vsock: Fix memory leak in vsock_connect()
    - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
    - tools build: Switch to new openssl API for test-libcrypto
    - xen/xenbus: fix return type in xenbus_file_read()
    - atm: idt77252: fix use-after-free bugs caused by tst_timer
    - nios2: page fault et.al. are *not* restartable syscalls...
    - nios2: don't leave NULLs in sys_call_table[]
    - nios2: traced syscall does need to check the syscall number
    - nios2: fix syscall restart checks
    - nios2: restarts apply only to the first sigframe we build...
    - nios2: add force_successful_syscall_return()
    - netfilter: nf_tables: really skip inactive sets when allocating name
    - powerpc/pci: Fix get_phb_number() locking
    - i40e: Fix to stop tx_timeout recovery if GLOBR fails
    - fec: Fix timer capture timing in `fec_ptp_enable_pps()`
    - igb: Add lock to avoid data race
    - kbuild: clear LDFLAGS in the top Makefile
    - btrfs: only write the sectors in the vertical stripe which has data stripes
    - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
    - drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
    - PCI: Add ACS quirk for Broadcom BCM5750x NICs
    - irqchip/tegra: Fix overflow implicit truncation warnings
    - usb: host: ohci-ppc-of: Fix refcount leak bug
    - clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
    - gadgetfs: ep_io - wait until IRQ finishes
    - cxl: Fix a memory leak in an error handling path
    - drivers:md:fix a potential use-after-free bug
    - ext4: avoid remove directory when directory is corrupted
    - ext4: avoid resizing to a partial cluster size
    - tty: serial: Fix refcount leak bug in ucc_uart.c
    - vfio: Clear the caps->buf to NULL after free
    - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
    - ALSA: core: Add async signal helpers
    - ALSA: timer: Use deferred fasync helper
    - smb3: check xattr value length earlier
    - powerpc/64: Init jump labels before parse_early_param()
    - video: fbdev: i740fb: Check the argument of i740_calc_vclk()
    - MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
    - meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
    - ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
    - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
    - media: tw686x: Register the irq at the end of probe
    - HID: cp2112: prevent a buffer overflow in cp2112_xfer()
    - staging: rtl8192u: Fix sleep in atomic context bug in
      dm_fsync_timer_callback
    - HID: alps: Declare U1_UNICORN_LEGACY support
    - tty: n_gsm: fix missing corner cases in gsmld_poll()
    - rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
    - gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file

  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup()
    - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
    - perf/core: Fix data race between perf_event_set_output() and
      perf_mmap_close()
    - ip: Fix a data-race around sysctl_fwmark_reflect.
    - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
    - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
    - tcp: Fix a data-race around sysctl_tcp_probe_interval.
    - i2c: cadence: Change large transfer count reset logic to be unconditional
    - net: stmmac: fix dma queue left shift overflow issue
    - igmp: Fix data-races around sysctl_igmp_llm_reports.
    - igmp: Fix a data-race around sysctl_igmp_max_memberships.
    - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
    - be2net: Fix buffer overflow in be_get_module_eeprom
    - Revert "Revert "char/random: silence a lockdep splat with printk()""
    - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
    - bpf: Make sure mac_header was set before using it
    - drm/tilcdc: Remove obsolete crtc_mode_valid() hack
    - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
    - ALSA: memalloc: Align buffer allocations in page size
    - Bluetooth: Add bt_skb_sendmsg helper
    - Bluetooth: Add bt_skb_sendmmsg helper
    - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
    - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
    - Bluetooth: Fix passing NULL to PTR_ERR
    - Bluetooth: SCO: Fix sco_send_frame returning skb->len
    - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
    - tty: drivers/tty/, stop using tty_schedule_flip()
    - tty: the rest, stop using tty_schedule_flip()
    - tty: drop tty_schedule_flip()
    - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
    - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
    - PCI: hv: Fix multi-MSI to allow more than one MSI vector
    - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
    - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
    - PCI: hv: Fix interrupt mapping for multi-MSI
    - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
    - ip: Fix data-races around sysctl_ip_nonlocal_bind.
    - tcp: Fix data-races around sysctl_tcp_mtu_probing.
    - tcp: Fix data-races around sysctl_tcp_reordering.
    - tcp: Fix data-races around some timeout sysctl knobs.
    - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
    - tcp: Fix data-races around sysctl_tcp_fastopen.
    - tcp: Fix a data-race around sysctl_tcp_early_retrans.
    - tcp: Fix data-races around sysctl_tcp_recovery.
    - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
    - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
    - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
    - tcp: Fix a data-race around sysctl_tcp_stdurg.
    - tcp: Fix a data-race around sysctl_tcp_rfc1337.
    - tcp: Fix data-races around sysctl_tcp_max_reordering.
    - ima: remove the IMA_TEMPLATE Kconfig option
    - [Config] updateconfigs for IMA_TEMPLATE
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - scsi: ufs: host: Hold reference returned by of_parse_phandle()
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - net: ping6: Fix memleak in ipv6_renew_options().
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    - tcp: Fix a data-race around sysctl_tcp_autocorking.
    - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
    - Documentation: fix sctp_wmem in ip-sysctl.rst
    - i40e: Fix interface init with MSI interrupts (no MSI-X)
    - sctp: fix sleep in atomic context bug in timer handlers
    - perf symbol: Correct address for bss symbols
    - scsi: core: Fix race between handling STS_RESOURCE and completion
    - ACPI: video: Shortening quirk list by identifying Clevo by board_name only

  * unprivileged users may trigger page cache invalidation WARN (LP: #1989144)
    - iomap: fix WARN_ON_ONCE() from unprivileged users

  * Users belonging to video group may trigger a deadlock WARN (LP: #1990690)
    - SAUCE: fbdev: remove redundant lock_fb_info

  * ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
    systems (LP: #1990985)
    - ACPI: processor_idle: Skip dummy wait if kernel is in guest
    - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
      systems

  * CVE-2022-3028
    - af_key: Do not call xfrm_probe_algs in parallel

  * CVE-2022-2978
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy

  * CVE-2022-40768
    - scsi: stex: Properly zero out the passthrough command structure

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Tue, 01 Nov 2022 17:52:05 +0100

linux (4.15.0-196.207) bionic; urgency=medium

  * bionic/linux: 4.15.0-196.207 -proposed tracker (LP: #1994992)

  * [UBUNTU 18.04] Ubuntu 18.04 kernel 4.15.0-194 crashes on IPL (LP: #1994601)
    - SAUCE: Revert "s390/archrandom: simplify back to earlier design and
      initialize earlier"

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Thu, 27 Oct 2022 13:56:02 -0700

linux (4.15.0-194.205) bionic; urgency=medium

  * bionic/linux: 4.15.0-194.205 -proposed tracker (LP: #1989935)

  * Bionic update: upstream stable patchset 2022-09-14 (LP: #1989625)
    - random: schedule mix_interrupt_randomness() less often
    - ata: libata: add qc->flags in ata_qc_complete_template tracepoint
    - dm era: commit metadata in postsuspend after worker stops
    - random: quiet urandom warning ratelimit suppression message
    - USB: serial: option: add Telit LE910Cx 0x1250 composition
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: option: add Quectel RM500K module support
    - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
    - x86/xen: Remove undefined behavior in setup_features()
    - MIPS: Remove repetitive increase irq_err_count
    - igb: Make DMA faster when CPU is active on the PCIe link
    - iio: adc: vf610: fix conversion mode sysfs node name
    - usb: chipidea: udc: check request status before setting device address
    - iio:accel:bma180: rearrange iio trigger get and register
    - iio: accel: mma8452: ignore the return value of reset operation
    - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
    - iio: trigger: sysfs: fix use-after-free on remove
    - iio: adc: axp288: Override TS pin bias current for some models
    - xtensa: xtfpga: Fix refcount leak bug in setup
    - xtensa: Fix refcount leak bug in time.c
    - powerpc: Enable execve syscall exit tracepoint
    - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
    - powerpc/powernv: wire up rng during setup_arch
    - ARM: dts: imx6qdl: correct PU regulator ramp delay
    - ARM: exynos: Fix refcount leak in exynos_map_pmu
    - ARM: Fix refcount leak in axxia_boot_secondary
    - ARM: cns3xxx: Fix refcount leak in cns3xxx_init
    - modpost: fix section mismatch check for exported init/exit sections
    - powerpc/pseries: wire up rng during setup_arch()
    - drm: remove drm_fb_helper_modinit
    - xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
    - fdt: Update CRC check for rng-seed
    - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
    - swiotlb: skip swiotlb_bounce when orig_addr is zero
    - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    - afs: Fix dynamic root getattr
    - iio:chemical:ccs811: rearrange iio trigger get and register
    - soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
    - nvdimm: Fix badblocks clear off-by-one error
    - dm raid: fix accesses beyond end of raid member array
    - dm raid: fix KASAN warning in raid5_add_disks
    - s390/archrandom: simplify back to earlier design and initialize earlier
    - SUNRPC: Fix READ_PLUS crasher
    - net: rose: fix UAF bugs caused by timer handler
    - net: usb: ax88179_178a: Fix packet receiving
    - RDMA/qedr: Fix reporting QP timeout attribute
    - usbnet: fix memory allocation in helpers
    - net: ipv6: unexport __init-annotated seg6_hmac_net_init()
    - caif_virtio: fix race between virtio_device_ready() and ndo_open()
    - netfilter: nft_dynset: restore set element counter when failing to update
    - net: bonding: fix possible NULL deref in rlb code
    - net: bonding: fix use-after-free after 802.3ad slave unbind
    - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
    - NFC: nxp-nci: Don't issue a zero length i2c_master_read()
    - xen/gntdev: Avoid blocking in unmap_grant_pages()
    - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
      fails
    - sit: use min
    - ipv6/sit: fix ipip6_tunnel_get_prl return value
    - net: Rename and export copy_skb_header
    - xen/blkfront: fix leaking data in shared pages
    - xen/netfront: fix leaking data in shared pages
    - xen/netfront: force data bouncing when backend is untrusted
    - xen/blkfront: force data bouncing when backend is untrusted
    - xen/arm: Fix race in RB-tree based P2M accounting
    - net: usb: qmi_wwan: add Telit 0x1060 composition
    - net: usb: qmi_wwan: add Telit 0x1070 composition
    - virtio-net: fix race between ndo_open() and virtio_device_ready()
    - net: tun: unlink NAPI from device on destruction
    - net: tun: stop NAPI when detaching queues
    - esp: limit skb_page_frag_refill use to a single page
    - mm/slub: add missing TID updates on slab deactivation
    - can: grcan: grcan_probe(): remove extra of_node_get()
    - can: gs_usb: gs_usb_open/close(): fix memory leak
    - usbnet: fix memory leak in error case
    - net: rose: fix UAF bug caused by rose_t0timer_expiry
    - iommu/vt-d: Fix PCI bus rescan device hot add
    - video: of_display_timing.h: include errno.h
    - powerpc/powernv: delay rng platform device creation until later in boot
    - xfs: remove incorrect ASSERT in xfs_rename
    - pinctrl: sunxi: a83t: Fix NAND function name for some pins
    - i2c: cadence: Unregister the clk notifier in error path
    - ida: don't use BUG_ON() for debugging
    - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
    - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
    - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
    - ARM: meson: Fix refcount leak in meson_smp_prepare_cpus
    - dmaengine: pl330: Fix lockdep warning about non-static key
    - ALSA: hda - Add fixup for Dell Latitidue E5430
    - ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
    - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
    - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
      pointer
    - ARM: 9213/1: Print message about disabled Spectre workarounds only once
    - ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
    - cgroup: Use separate src/dst nodes when preloading css_sets for migration
    - nilfs2: fix incorrect masking of permission flags for symlinks
    - net: dsa: bcm_sf2: force pause link settings
    - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
    - inetpeer: Fix data-races around sysctl.
    - net: Fix data-races around sysctl_mem.
    - cipso: Fix data-races around sysctl.
    - icmp: Fix data-races around sysctl.
    - ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
    - icmp: Fix a data-race around sysctl_icmp_ratelimit.
    - icmp: Fix a data-race around sysctl_icmp_ratemask.
    - ipv4: Fix data-races around sysctl_ip_dynaddr.
    - sfc: fix use after free when disabling sriov
    - seg6: fix skb checksum evaluation in SRH encapsulation/insertion
    - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
    - sfc: fix kernel panic when creating VF
    - virtio_mmio: Add missing PM calls to freeze/restore
    - virtio_mmio: Restore guest page size on resume
    - netfilter: br_netfilter: do not skip all hooks with 0 priority
    - cpufreq: pmac32-cpufreq: Fix refcount leak bug
    - platform/x86: hp-wmi: Ignore Sanitization Mode event
    - net: tipc: fix possible refcount leak in tipc_sk_create()
    - NFC: nxp-nci: don't print header length mismatch on i2c error
    - net: sfp: fix memory leak in sfp_probe()
    - ASoC: ops: Fix off by one in range control validation
    - ASoC: wm5110: Fix DRE control
    - irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
    - x86: Clear .brk area at early boot
    - signal handling: don't use BUG_ON() for debugging
    - USB: serial: ftdi_sio: add Belimo device ids
    - usb: dwc3: gadget: Fix event pending check
    - tty: serial: samsung_tty: set dma burst_size to 1
    - serial: 8250: fix return error code in serial8250_request_std_resource()
    - mm: invalidate hwpoison page cache page in fault path
    - can: m_can: m_can_tx_handler(): fix use after free of skb
    - ASoC: sgtl5000: Fix noise on shutdown/remove
    - serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle

  * Bionic update: upstream stable patchset 2022-09-12 (LP: #1989374)
    - [Config] dkms-versions -- force wireguard-dkms update
    - Revert "random: Make getrandom() ready earlier"
    - 9p: missing chunk of "fs/9p: Don't update file type when updating file
      attributes"
    - crypto: chacha20 - Fix keystream alignment for chacha20_block()
    - random: always fill buffer in get_random_bytes_wait
    - random: optimize add_interrupt_randomness
    - drivers/char/random.c: remove unused dont_count_entropy
    - random: Fix whitespace pre random-bytes work
    - random: Return nbytes filled from hw RNG
    - [Config] updateconfigs for RANDOM_TRUST_CPU, RANDOM_TRUST_BOOTLOADER
    - random: add a config option to trust the CPU's hwrng
    - random: remove preempt disabled region
    - random: Make crng state queryable
    - random: make CPU trust a boot parameter
    - drivers/char/random.c: constify poolinfo_table
    - drivers/char/random.c: remove unused stuct poolinfo::poolbits
    - drivers/char/random.c: make primary_crng static
    - random: only read from /dev/random after its pool has received 128 bits
    - random: move rand_initialize() earlier
    - random: document get_random_int() family
    - latent_entropy: avoid build error when plugin cflags are not set
    - random: fix soft lockup when trying to read from an uninitialized blocking
      pool
    - random: Support freezable kthreads in add_hwgenerator_randomness()
    - fdt: add support for rng-seed
    - random: Use wait_event_freezable() in add_hwgenerator_randomness()
    - char/random: Add a newline at the end of the file
    - Revert "hwrng: core - Freeze khwrng thread during suspend"
    - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array()
    - crypto: blake2s - generic C library implementation and selftest
    - lib/crypto: blake2s: move hmac construction into wireguard
    - lib/crypto: sha1: re-roll loops to reduce code size
    - random: Don't wake crng_init_wait when crng_init == 1
    - random: Add a urandom_read_nowait() for random APIs that don't warn
    - random: add GRND_INSECURE to return best-effort non-cryptographic bytes
    - random: ignore GRND_RANDOM in getentropy(2)
    - random: make /dev/random be almost like /dev/urandom
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - random: remove the blocking pool
    - random: delete code to pull data into pools
    - random: remove kernel.random.read_wakeup_threshold
    - random: remove unnecessary unlikely()
    - random: convert to ENTROPY_BITS for better code readability
    - random: Add and use pr_fmt()
    - random: fix typo in add_timer_randomness()
    - random: remove some dead code of poolinfo
    - random: split primary/secondary crng init paths
    - random: avoid warnings for !CONFIG_NUMA builds
    - x86: Remove arch_has_random, arch_has_random_seed
    - powerpc: Remove arch_has_random, arch_has_random_seed
    - s390: Remove arch_has_random, arch_has_random_seed
    - linux/random.h: Remove arch_has_random, arch_has_random_seed
    - linux/random.h: Use false with bool
    - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
    - powerpc: Use bool in archrandom.h
    - random: add arch_get_random_*long_early()
    - random: avoid arch_get_random_seed_long() when collecting IRQ randomness
    - random: remove dead code left over from blocking pool
    - MAINTAINERS: co-maintain random.c
    - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
    - crypto: blake2s - adjust include guard naming
    - random: document add_hwgenerator_randomness() with other input functions
    - random: remove unused irq_flags argument from add_interrupt_randomness()
    - random: use BLAKE2s instead of SHA1 in extraction
    - random: do not sign extend bytes for rotation when mixing
    - random: do not re-init if crng_reseed completes before primary init
    - random: mix bootloader randomness into pool
    - random: harmonize "crng init done" messages
    - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
    - random: initialize ChaCha20 constants with correct endianness
    - random: early initialization of ChaCha constants
    - random: avoid superfluous call to RDRAND in CRNG extraction
    - random: don't reset crng_init_cnt on urandom_read()
    - random: fix typo in comments
    - random: cleanup poolinfo abstraction
    - crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
    - random: cleanup integer types
    - random: remove incomplete last_data logic
    - random: remove unused extract_entropy() reserved argument
    - random: rather than entropy_store abstraction, use global
    - random: remove unused OUTPUT_POOL constants
    - random: de-duplicate INPUT_POOL constants
    - random: prepend remaining pool constants with POOL_
    - random: cleanup fractional entropy shift constants
    - random: access input_pool_data directly rather than through pointer
    - random: simplify arithmetic function flow in account()
    - random: continually use hwgenerator randomness
    - random: access primary_pool directly rather than through pointer
    - random: only call crng_finalize_init() for primary_crng
    - random: use computational hash for entropy extraction
    - random: simplify entropy debiting
    - random: use linear min-entropy accumulation crediting
    - random: always wake up entropy writers after extraction
    - random: make credit_entropy_bits() always safe
    - random: remove use_input_pool parameter from crng_reseed()
    - random: remove batched entropy locking
    - random: fix locking in crng_fast_load()
    - random: use RDSEED instead of RDRAND in entropy extraction
    - random: inline leaves of rand_initialize()
    - random: ensure early RDSEED goes through mixer on init
    - random: do not xor RDRAND when writing into /dev/random
    - random: absorb fast pool into input pool after fast load
    - random: use hash function for crng_slow_load()
    - random: remove outdated INT_MAX >> 6 check in urandom_read()
    - random: zero buffer after reading entropy from userspace
    - random: tie batched entropy generation to base_crng generation
    - random: remove ifdef'd out interrupt bench
    - random: remove unused tracepoints
    - random: add proper SPDX header
    - random: deobfuscate irq u32/u64 contributions
    - random: introduce drain_entropy() helper to declutter crng_reseed()
    - random: remove useless header comment
    - random: remove whitespace and reorder includes
    - random: group initialization wait functions
    - random: group entropy extraction functions
    - random: group entropy collection functions
    - random: group userspace read/write functions
    - random: group sysctl functions
    - random: rewrite header introductory comment
    - random: defer fast pool mixing to worker
    - random: do not take pool spinlock at boot
    - random: unify early init crng load accounting
    - random: check for crng_init == 0 in add_device_randomness()
    - random: pull add_hwgenerator_randomness() declaration into random.h
    - random: clear fast pool, crng, and batches in cpuhp bring up
    - random: round-robin registers as ulong, not u32
    - random: only wake up writers after zap if threshold was passed
    - random: cleanup UUID handling
    - random: unify cycles_t and jiffies usage and types
    - random: do crng pre-init loading in worker rather than irq
    - random: give sysctl_random_min_urandom_seed a more sensible value
    - random: don't let 644 read-only sysctls be written to
    - random: replace custom notifier chain with standard one
    - random: use SipHash as interrupt entropy accumulator
    - random: make consistent usage of crng_ready()
    - random: reseed more often immediately after booting
    - random: check for signal and try earlier when generating entropy
    - random: skip fast_init if hwrng provides large chunk of entropy
    - random: treat bootloader trust toggle the same way as cpu trust toggle
    - random: re-add removed comment about get_random_{u32,u64} reseeding
    - random: mix build-time latent entropy into pool at init
    - random: do not split fast init input in add_hwgenerator_randomness()
    - random: do not allow user to keep crng key around on stack
    - random: check for signal_pending() outside of need_resched() check
    - random: check for signals every PAGE_SIZE chunk of /dev/[u]random
    - random: make random_get_entropy() return an unsigned long
    - random: document crng_fast_key_erasure() destination possibility
    - random: fix sysctl documentation nits
    - init: call time_init() before rand_initialize()
    - ia64: define get_cycles macro for arch-override
    - s390: define get_cycles macro for arch-override
    - parisc: define get_cycles macro for arch-override
    - alpha: define get_cycles macro for arch-override
    - powerpc: define get_cycles macro for arch-override
    - timekeeping: Add raw clock fallback for random_get_entropy()
    - m68k: use fallback for random_get_entropy() instead of zero
    - mips: use fallback for random_get_entropy() instead of just c0 random
    - arm: use fallback for random_get_entropy() instead of zero
    - nios2: use fallback for random_get_entropy() instead of zero
    - x86/tsc: Use fallback for random_get_entropy() instead of zero
    - um: use fallback for random_get_entropy() instead of zero
    - sparc: use fallback for random_get_entropy() instead of zero
    - xtensa: use fallback for random_get_entropy() instead of zero
    - random: insist on random_get_entropy() existing in order to simplify
    - random: do not use batches when !crng_ready()
    - random: do not pretend to handle premature next security model
    - random: order timer entropy functions below interrupt functions
    - random: do not use input pool from hard IRQs
    - random: help compiler out with fast_mix() by using simpler arguments
    - siphash: use one source of truth for siphash permutations
    - random: use symbolic constants for crng_init states
    - random: avoid initializing twice in credit race
    - random: remove ratelimiting for in-kernel unseeded randomness
    - random: use proper jiffies comparison macro
    - random: handle latent entropy and command line from random_init()
    - random: credit architectural init the exact amount
    - random: use static branch for crng_ready()
    - random: remove extern from functions in header
    - random: use proper return types on get_random_{int,long}_wait()
    - random: move initialization functions out of hot pages
    - random: move randomize_page() into mm where it belongs
    - random: convert to using fops->write_iter()
    - random: wire up fops->splice_{read,write}_iter()
    - random: check for signals after page of pool writes
    - Revert "random: use static branch for crng_ready()"
    - crypto: drbg - add FIPS 140-2 CTRNG for noise source
    - crypto: drbg - always seeded with SP800-90B compliant noise source
    - crypto: drbg - prepare for more fine-grained tracking of seeding state
    - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
    - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
    - crypto: drbg - always try to free Jitter RNG instance
    - crypto: drbg - make reseeding from get_random_bytes() synchronous
    - random: avoid checking crng_ready() twice in random_init()
    - random: mark bootloader randomness code as __init
    - random: account for arch randomness in bits
    - ASoC: cs42l52: Fix TLV scales for mixer controls
    - ASoC: cs53l30: Correct number of volume levels on SX controls
    - ASoC: cs42l52: Correct TLV for Bypass Volume
    - ASoC: cs42l56: Correct typo in minimum level for SX volume controls
    - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
    - ASoC: wm8962: Fix suspend while playing music
    - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
    - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
    - scsi: ipr: Fix missing/incorrect resource cleanup in error case
    - scsi: pmcraid: Fix missing resource cleanup in error case
    - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
      failed
    - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
    - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
    - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface
      netdev[napi]_alloc_frag
    - random: credit cpu and bootloader seeds by default
    - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
    - i40e: Fix call trace in setup_tx_descriptors
    - tty: goldfish: Fix free_irq() on remove
    - misc: atmel-ssc: Fix IRQ check in ssc_probe
    - net: bgmac: Fix an erroneous kfree() in bgmac_remove()
    - arm64: ftrace: fix branch range checks
    - certs/blacklist_hashes.c: fix const confusion in certs blacklist
    - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
    - comedi: vmk80xx: fix expression for tx buffer size
    - USB: serial: option: add support for Cinterion MV31 with new baseline
    - USB: serial: io_ti: add Agilent E5805A support
    - usb: dwc2: Fix memory leak in dwc2_hcd_init
    - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
    - serial: 8250: Store to lsr_save_flags after lsr read
    - ext4: fix bug_on ext4_mb_use_inode_pa
    - ext4: make variable "count" signed
    - ext4: add reserved GDT blocks check
    - virtio-pci: Remove wrong address verification in vp_del_vqs()
    - s390/mm: use non-quiescing sske for KVM switch to keyed guest
    - usb: gadget: u_ether: fix regression in setting fixed MAC address
    - xprtrdma: fix incorrect header size calculations
    - tcp: add some entropy in __inet_hash_connect()
    - tcp: use different parts of the port_offset for index and offset
    - tcp: add small random increments to the source port
    - tcp: dynamically allocate the perturb table used by source ports
    - tcp: increase source port perturb table to 2^16
    - tcp: drop the hash_32() part from the index calculation
    - powerpc/kasan: Silence KASAN warnings in __get_wchan()
    - ASoC: es8328: Fix event generation for deemphasis control
    - ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
    - i40e: Fix adding ADQ filter to TC0
    - mlxsw: spectrum_cnt: Reorder counter pools
    - net: openvswitch: fix misuse of the cached connection on tuple changes
    - RISC-V: fix barrier() use in <vdso/processor.h>
    - powerpc/mm: Switch obsolete dssall to .long

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Fri, 16 Sep 2022 12:18:15 -0700

linux (4.15.0-193.204) bionic; urgency=medium

  * bionic/linux: 4.15.0-193.204 -proposed tracker (LP: #1987905)

  * CVE-2022-36946
    - netfilter: nf_queue: do not allow packet truncation below transport header
      offset

  * CVE-2021-33655
    - fbcon: Disallow setting font bigger than screen size
    - fbcon: Prevent that screen size is smaller than font size
    - fbmem: Check virtual screen sizes in fb_set_var()

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Fri, 26 Aug 2022 11:31:10 -0700

linux (4.15.0-192.203) bionic; urgency=medium

  * bionic/linux: 4.15.0-192.203 -proposed tracker (LP: #1983980)

  * CVE-2021-33656
    - vt: drop old FONT ioctls

  * Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782)
    - binfmt_flat: do not stop relocating GOT entries prematurely on riscv
    - USB: serial: option: add Quectel BG95 modem
    - USB: new quirk for Dell Gen 2 devices
    - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
    - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
    - btrfs: add "0x" prefix for unsupported optional features
    - btrfs: repair super block num_devices automatically
    - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
    - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
    - b43legacy: Fix assigning negative value to unsigned variable
    - b43: Fix assigning negative value to unsigned variable
    - ipw2x00: Fix potential NULL dereference in libipw_xmit()
    - ACPICA: Avoid cache flush inside virtual machines
    - ALSA: jack: Access input_dev under mutex
    - drm/amd/pm: fix double free in si_parse_power_table()
    - ath9k: fix QCA9561 PA bias level
    - media: venus: hfi: avoid null dereference in deinit
    - media: pci: cx23885: Fix the error handling in cx23885_initdev()
    - media: cx25821: Fix the warning when removing the module
    - scsi: megaraid: Fix error check return value of register_chrdev()
    - drm/amd/pm: fix the compile warning
    - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
    - ASoC: dapm: Don't fold register value changes into notifications
    - s390/preempt: disable __preempt_count_add() optimization for
      PROFILE_ALL_BRANCHES
    - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
    - ipmi:ssif: Check for NULL msg when handling events and messages
    - rtlwifi: Use pr_warn instead of WARN_ONCE
    - openrisc: start CPU timer early in boot
    - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
    - ASoC: rt5645: Fix errorenous cleanup order
    - net: phy: micrel: Allow probing without .driver_data
    - media: exynos4-is: Fix compile warning
    - rxrpc: Return an error to sendmsg if call failed
    - eth: tg3: silence the GCC 12 array-bounds warning
    - ARM: dts: ox820: align interrupt controller node name with dtschema
    - fs: jfs: fix possible NULL pointer dereference in dbFree()
    - ARM: OMAP1: clock: Fix UART rate reporting algorithm
    - fat: add ratelimit to fat*_ent_bread()
    - ARM: versatile: Add missing of_node_put in dcscb_init
    - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
    - ARM: hisi: Add missing of_node_put after of_find_compatible_node
    - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
    - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
    - powerpc/xics: fix refcount leak in icp_opal_init()
    - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
    - RDMA/hfi1: Prevent panic when SDMA is disabled
    - drm: fix EDID struct for old ARM OABI format
    - ath9k: fix ar9003_get_eepmisc
    - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
    - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
    - x86/delay: Fix the wrong asm constraint in delay_loop()
    - drm/mediatek: Fix mtk_cec_mask()
    - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
    - NFC: NULL out the dev->rfkill to prevent UAF
    - efi: Add missing prototype for efi_capsule_setup_info
    - HID: hid-led: fix maximum brightness for Dream Cheeky
    - spi: img-spfi: Fix pm_runtime_get_sync() error checking
    - ath9k_htc: fix potential out of bounds access with invalid
      rxstatus->rs_keyix
    - inotify: show inotify mask flags in proc fdinfo
    - fsnotify: fix wrong lockdep annotations
    - x86/pm: Fix false positive kmemleak report in msr_build_context()
    - drm/msm/dsi: fix error checks and return values for DSI xmit functions
    - drm/msm/hdmi: check return value after calling
      platform_get_resource_byname()
    - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
    - x86: Fix return value of __setup handlers
    - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
    - x86/mm: Cleanup the control_va_addr_alignment() __setup handler
    - drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
    - media: uvcvideo: Fix missing check to determine if element is found in list
    - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
    - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
    - media: st-delta: Fix PM disable depth imbalance in delta_probe
    - media: exynos4-is: Change clk_disable to clk_disable_unprepare
    - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
    - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
    - m68k: math-emu: Fix dependencies of math emulation support
    - sctp: read sk->sk_bound_dev_if once in sctp_rcv()
    - ASoC: wm2000: fix missing clk_disable_unprepare() on error in
      wm2000_anc_transition()
    - rxrpc: Fix listen() setting the bar too high for the prealloc rings
    - rxrpc: Don't try to resend the request if we're receiving the reply
    - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
    - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
    - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
    - ARM: dts: bcm2835-rpi-b: Fix GPIO line names
    - mfd: ipaq-micro: Fix error check return value of platform_get_irq()
    - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
    - pinctrl: mvebu: Fix irq_of_parse_and_map() return value
    - drivers/base/node.c: fix compaction sysfs file leak
    - powerpc/8xx: export 'cpm_setbrg' for modules
    - powerpc/idle: Fix return value of __setup() handler
    - powerpc/4xx/cpm: Fix return value of __setup() handler
    - tty: fix deadlock caused by calling printk() under tty_port->lock
    - Input: sparcspkr - fix refcount leak in bbc_beep_probe
    - powerpc/perf: Fix the threshold compare group constraint for power9
    - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
    - mailbox: forward the hrtimer if not queued and under a lock
    - iommu/mediatek: Add list_del in mtk_iommu_remove
    - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
    - iommu/amd: Increase timeout waiting for GA log enablement
    - perf c2c: Use stdio interface if slang is not supported
    - perf jevents: Fix event syntax error caused by ExtSel
    - wifi: mac80211: fix use-after-free in chanctx code
    - iwlwifi: mvm: fix assert 1F04 upon reconfig
    - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped
      pages
    - ext4: fix use-after-free in ext4_rename_dir_prepare
    - ext4: fix bug_on in ext4_writepages
    - ext4: verify dir block before splitting it
    - ext4: avoid cycles in directory h-tree
    - dlm: fix plock invalid read
    - dlm: fix missing lkb refcount handling
    - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
    - scsi: dc395x: Fix a missing check on list iterator
    - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
    - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
    - drm/nouveau/clk: Fix an incorrect NULL check on list iterator
    - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
    - md: fix an incorrect NULL check in does_sb_need_changing
    - md: fix an incorrect NULL check in md_reload_sb
    - RDMA/hfi1: Fix potential integer multiplication overflow errors
    - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375,
      A38x, A39x
    - irqchip: irq-xtensa-mx: fix initial IRQ affinity
    - mac80211: upgrade passive scan to active scan on DFS channels after beacon
      rx
    - um: chan_user: Fix winch_tramp() return value
    - um: Fix out-of-bounds read in LDT setup
    - iommu/msm: Fix an incorrect NULL check on list iterator
    - nodemask.h: fix compilation error with GCC12
    - hugetlb: fix huge_pmd_unshare address update
    - rtl818x: Prevent using not initialized queues
    - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
    - carl9170: tx: fix an incorrect use of list iterator
    - gma500: fix an incorrect NULL check on list iterator
    - arm64: dts: qcom: ipq8074: fix the sleep clock frequency
    - phy: qcom-qmp: fix struct clk leak on probe errors
    - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
    - dt-bindings: gpio: altera: correct interrupt-cells
    - phy: qcom-qmp: fix reset-controller leak on probe errors
    - RDMA/rxe: Generate a completion for unsupported/invalid opcode
    - MIPS: IP27: Remove incorrect `cpu_has_fpu' override
    - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
    - staging: greybus: codecs: fix type confusion of list iterator variable
    - tty: goldfish: Use tty_port_destroy() to destroy port
    - usb: usbip: fix a refcount leak in stub_probe()
    - usb: usbip: add missing device lock on tweak configuration cmd
    - USB: storage: karma: fix rio_karma_init return
    - pwm: lp3943: Fix duty calculation in case period was clamped
    - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
    - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
    - soc: rockchip: Fix refcount leak in rockchip_grf_init
    - rtc: mt6397: check return value after calling platform_get_resource()
    - serial: meson: acquire port->lock in startup()
    - serial: digicolor-usart: Don't allow CS5-6
    - serial: txx9: Don't allow CS5-6
    - serial: sh-sci: Don't allow CS5-6
    - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
    - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
    - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
    - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
    - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
    - modpost: fix removing numeric suffixes
    - jffs2: fix memory leak in jffs2_do_fill_super
    - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    - tcp: tcp_rtx_synack() can be called from process context
    - perf c2c: Fix sorting in percent_rmt_hitm_cmp()
    - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
    - tracing: Fix sleeping function called from invalid context on RT kernel
    - tracing: Avoid adding tracer option before update_tracer_options
    - i2c: cadence: Increase timeout per message if necessary
    - m68knommu: set ZERO_PAGE() to the allocated zeroed page
    - m68knommu: fix undefined reference to `_init_sp'
    - video: fbdev: pxa3xx-gcu: release the resources correctly in
      pxa3xx_gcu_probe/remove()
    - xprtrdma: treat all calls not a bcall when bc_serv is NULL
    - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
    - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
    - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
    - net: mdio: unexport __init-annotated mdio_bus_init()
    - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
    - net: ipv6: unexport __init-annotated seg6_hmac_init()
    - net: altera: Fix refcount leak in altera_tse_mdio_create
    - drm: imx: fix compiler warning with gcc-12
    - iio: dummy: iio_simple_dummy: check the return value of kstrdup()
    - lkdtm/usercopy: Expand size of "out of frame" object
    - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
    - tty: Fix a possible resource leak in icom_probe
    - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
    - USB: host: isp116x: check return value after calling platform_get_resource()
    - drivers: tty: serial: Fix deadlock in sa1100_set_termios()
    - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
    - USB: hcd-pci: Fully suspend across freeze/thaw cycle
    - usb: dwc2: gadget: don't reset gadget's driver->bus
    - misc: rtsx: set NULL intfdata when probe fails
    - extcon: Modify extcon device to be created after driver data is set
    - clocksource/drivers/sp804: Avoid error on multiple instances
    - staging: rtl8712: fix uninit-value in r871xu_drv_init()
    - serial: msm_serial: disable interrupts in __msm_console_write()
    - kernfs: Separate kernfs_pr_cont_buf and rename_lock.
    - md: protect md_unregister_thread from reentrancy
    - drm/radeon: fix a possible null pointer dereference
    - modpost: fix undefined behavior of is_arm_mapping_symbol()
    - nbd: call genl_unregister_family() first in nbd_cleanup()
    - nbd: fix race between nbd_alloc_config() and module removal
    - nbd: fix io hung while disconnecting device
    - nodemask: Fix return values to be unsigned
    - vringh: Fix loop descriptors check in the indirect cases
    - ALSA: hda/conexant - Fix loopback issue with CX20632
    - cifs: return errors during session setup during reconnects
    - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
    - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
    - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    - ixgbe: fix bcast packets Rx on VF after promisc removal
    - ixgbe: fix unexpected VLAN Rx in promisc mode on VF
    - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
    - powerpc/32: Fix overread/overwrite of thread_struct via ptrace
    - md/raid0: Ignore RAID0 layout if the second zone has only one device
    - mtd: cfi_cmdset_0002: Move and rename
      chip_check/chip_ready/chip_good_for_write
    - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
    - PCI: qcom: Fix unbalanced PHY init on probe errors
    - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
    - drm/edid: fix invalid EDID extension block filtering
    - drm/bridge: adv7511: clean up CEC adapter when probe fails
    - nl80211: show SSID for P2P_GO interfaces
    - of: overlay: do not break notify on NOTIFY_{OK|STOP}
    - x86/speculation: Add missing prototype for unpriv_ebpf_notify()
    - media: vsp1: Fix offset calculation for plane cropping
    - ext4: reject the 'commit' option on ext2 filesystems
    - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
    - NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
    - crypto: marvell/cesa - ECB does not IV
    - dax: fix cache flush on PMD-mapped pages
    - f2fs: fix dereference of stale list iterator after loop body
    - i2c: at91: use dma safe buffers
    - dmaengine: stm32-mdma: remove GISR1 register
    - md: bcache: check the return value of kzalloc() in detached_dev_do_request()
    - usb: musb: Fix missing of_node_put() in omap2430_probe
    - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
    - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
    - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
    - serial: stm32-usart: Correct CSIZE, bits, and parity
    - s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
    - nfp: only report pause frame configuration for physical device
    - af_unix: ensure POLLOUT on remote close() for connected dgram socket
    - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
    - ip_gre: test csum_start instead of transport header
    - Upstream stable to v4.14.284, v4.19.248

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Wed, 10 Aug 2022 10:11:03 -0700

linux (4.15.0-191.202) bionic; urgency=medium

  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain

  * CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0

  * CVE-2022-34918
    - netfilter: nf_tables: stricter validation of element data

  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Wed, 03 Aug 2022 22:18:18 -0300

linux (4.15.0-190.201) bionic; urgency=medium

  * bionic/linux: 4.15.0-190.201 -proposed tracker (LP: #1981321)

  * CVE-2022-1679
    - SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

  * Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879)
    - MIPS: Use address-of operator on section symbols
    - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
    - can: grcan: grcan_probe(): fix broken system id check for errata workaround
      needs
    - can: grcan: only use the NAPI poll budget for RX
    - Bluetooth: Fix the creation of hdev->name
    - mmc: rtsx: add 74 Clocks in power on flow
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
    - ALSA: pcm: Fix races among concurrent prealloc proc writes
    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
    - VFS: Fix memory leak caused by concurrently mounting fs with subtype
    - batman-adv: Don't skb_split skbuffs with frag_list
    - net: Fix features skip in for_each_netdev_feature()
    - ipv4: drop dst in multicast routing path
    - netlink: do not reset transport header in netlink_recvmsg()
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - hwmon: (ltq-cputemp) restrict it to SOC_XWAY
    - s390/ctcm: fix variable dereferenced before check
    - s390/ctcm: fix potential memory leak
    - s390/lcs: fix variable dereferenced before check
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - hwmon: (f71882fg) Fix negative temperature
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - tcp: resalt the secret every 10 seconds
    - usb: cdc-wdm: fix reading stuck on device close
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
    - drm/vmwgfx: Initialize drm_mode_fb_cmd2
    - ping: fix address binding wrt vrf
    - tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
    - net/sched: act_pedit: really ensure the skb is writable
    - um: Cleanup syscall_handler_t definition/cast, fix warning
    - Input: add bounds checking to input_set_capability()
    - Input: stmfts - fix reference leak in stmfts_input_open
    - MIPS: lantiq: check the return value of kzalloc()
    - drbd: remove usage of list iterator variable after loop
    - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
    - ALSA: wavefront: Proper check of get_user() error
    - perf: Fix sys_perf_event_open() race against self
    - drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
    - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
    - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
    - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
    - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
    - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
    - clk: at91: generated: consider range when calculating best rate
    - net/qla3xxx: Fix a test in ql_reset_work()
    - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
    - ARM: 9196/1: spectre-bhb: enable for Cortex-A15
    - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
    - igb: skip phy status check where unavailable
    - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
    - gpio: gpio-vf610: do not touch other bits when set the target bit
    - gpio: mvebu/pwm: Refuse requests with inverted polarity
    - perf bench numa: Address compiler error on s390
    - scsi: qla2xxx: Fix missed DMA unmap for aborted commands
    - mac80211: fix rx reordering with non explicit / psmp ack policy
    - ethernet: tulip: fix missing pci_disable_device() on error in
      tulip_init_one()
    - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
    - net: atlantic: verify hw_head_ lies within TX buffer ring
    - swiotlb: fix info leak with DMA_FROM_DEVICE
    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
    - net: macb: Increment rx bd head after allocating skb and buffer
    - net/sched: act_pedit: sanitize shift argument before usage
    - afs: Fix afs_getattr() to refetch file status if callback break occurred
    - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
    - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
    - tcp: change source port randomizarion at connect() time
    - secure_seq: use the 64 bits of the siphash for port offset calculation
    - ACPI: sysfs: Make sparse happy about address space in use
    - Revert "UBUNTU: SAUCE: ACPI: sysfs: copy ACPI data using io memory copying"
    - ACPI: sysfs: Fix BERT error region memory mapping
    - net: af_key: check encryption module availability consistency
    - net: ftgmac100: Disable hardware checksum on AST2600
    - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI
      controllers
    - assoc_array: Fix BUG_ON during garbage collect
    - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
    - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
    - exec: Force single empty string when argv is empty
    - netfilter: conntrack: re-fetch conntrack after insertion
    - zsmalloc: fix races between asynchronous zspage free and page migration
    - dm integrity: fix error code in dm_integrity_ctr()
    - dm crypt: make printing of the key constant-time
    - dm stats: add cond_resched when looping over entries
    - dm verity: set DM_TARGET_IMMUTABLE feature flag
    - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
    - docs: submitting-patches: Fix crossref to 'The canonical patch format'
    - NFSD: Fix possible sleep during nfsd4_release_lockowner()
    - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes

  * Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355)
    - floppy: disable FDRAWCMD by default
    - [Config] updateconfigs for BLK_DEV_FD_RAWCMD
    - hamradio: defer 6pack kfree after unregister_netdev
    - hamradio: remove needs_free_netdev to avoid UAF
    - lightnvm: disable the subsystem
    - [Config] updateconfigs for NVM, NVM_PBLK
    - usb: mtu3: fix USB 3.0 dual-role-switch from device to host
    - USB: quirks: add a Realtek card reader
    - USB: quirks: add STRING quirk for VCOM device
    - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
    - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
    - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
    - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
    - xhci: stop polling roothubs after shutdown
    - iio: dac: ad5592r: Fix the missing return value.
    - iio: dac: ad5446: Fix read_raw not returning set value
    - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
    - usb: misc: fix improper handling of refcount in uss720_probe()
    - usb: gadget: uvc: Fix crash when encoding data for usb request
    - usb: gadget: configfs: clear deactivation flag in
      configfs_composite_unbind()
    - serial: 8250: Also set sticky MCR bits in console restoration
    - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
    - hex2bin: make the function hex_to_bin constant-time
    - hex2bin: fix access beyond string end
    - USB: Fix xhci event ring dequeue pointer ERDP update issue
    - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
    - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
    - phy: samsung: exynos5250-sata: fix missing device put in probe error paths
    - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
    - ARM: dts: Fix mmc order for omap3-gta04
    - ipvs: correctly print the memory size of ip_vs_conn_tab
    - mtd: rawnand: Fix return value check of wait_for_completion_timeout
    - sctp: check asoc strreset_chunk in sctp_generate_reconf_event
    - pinctrl: pistachio: fix use of irq_of_parse_and_map()
    - ip_gre: Make o_seqno start from 0 in native mode
    - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
    - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
    - clk: sunxi: sun9i-mmc: check return value after calling
      platform_get_resource()
    - net: bcmgenet: hide status block before TX timestamping
    - bnx2x: fix napi API usage sequence
    - ASoC: wm8731: Disable the regulator when probing fails
    - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
    - cifs: destage any unwritten data to the server before calling
      copychunk_write
    - drivers: net: hippi: Fix deadlock in rr_close()
    - x86/cpu: Load microcode during restore_processor_state()
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
    - tty: n_gsm: fix malformed counter for out of frame data
    - tty: n_gsm: fix insufficient txframe size
    - tty: n_gsm: fix missing explicit ldisc flush
    - tty: n_gsm: fix wrong command retry handling
    - tty: n_gsm: fix wrong command frame length field encoding
    - tty: n_gsm: fix incorrect UA handling
    - MIPS: Fix CP0 counter erratum detection for R4k CPUs
    - parisc: Merge model and model name into one line in /proc/cpuinfo
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
    - firewire: fix potential uaf in outbound_phy_packet_callback()
    - firewire: remove check of list iterator against head past the loop body
    - firewire: core: extend card->lock in fw_core_handle_bus_reset
    - ASoC: wm8958: Fix change notifications for DSP controls
    - can: grcan: grcan_close(): fix deadlock
    - can: grcan: use ofdev->dev when allocating DMA memory
    - nfc: replace improper check device_is_registered() in netlink related
      functions
    - NFC: netlink: fix sleep in atomic bug when firmware download timeout
    - hwmon: (adt7470) Fix warning on module removal
    - ASoC: dmaengine: Restore NULL prepare_slave_config() callback
    - net: emaclite: Add error handling for of_address_to_resource()
    - smsc911x: allow using IRQ0
    - btrfs: always log symlinks in full mode
    - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
    - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
    - net: ipv6: ensure we call ipv6_mc_down() at most once
    - dm: fix mempool NULL pointer race when completing IO
    - dm: interlock pending dm_io and dm_wait_for_bios_completion
    - PCI: aardvark: Clear all MSIs at setup
    - PCI: aardvark: Fix reading MSI interrupt number
    - tcp: md5: incorrect tcp_header_len for incoming connections
    - net: hns3: add validity check for message data length
    - genirq: Synchronize interrupt thread startup
    - net: stmmac: dwmac-sun8i: add missing of_node_put() in
      sun8i_dwmac_register_mdio_mux()
    - mm: fix unexpected zeroed page mapping with zram swap

  * unprivileged tests in test_verifier from ubuntu_bpf failed with "Failed to
    load prog 'Operation not permitted'" on B-4.15 (LP: #1980648)
    - selftests/bpf: Count tests skipped by unpriv
    - selftests/bpf: Only run tests if !bpf_disabled

  * CVE-2022-1734
    - nfc: nfcmrvl: main: reorder destructive operations in
      nfcmrvl_nci_unregister_dev to avoid bugs

  * CVE-2022-1652
    - floppy: use a statically allocated error counter

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Mon, 11 Jul 2022 13:09:21 -0700

linux (4.15.0-189.200) bionic; urgency=medium

  * bionic/linux: 4.15.0-189.200 -proposed tracker (LP: #1979525)

  * linux-image-4.15.0-177-generic freezes on the welcome screen (LP: #1973167)
    - mfd: intel-lpss: Use MODULE_SOFTDEP() instead of implicit request

  * Bionic update: upstream stable patchset 2022-06-03 (LP: #1977622)
    - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
    - mm: page_alloc: fix building error on -Werror=array-compare
    - tracing: Dump stacktrace trigger to the corresponding instance
    - gfs2: assign rgrp glock before compute_bitstructs
    - ALSA: usb-audio: Clear MIDI port active flag after draining
    - tcp: fix race condition when creating child sockets from syncookies
    - tcp: Fix potential use-after-free due to double kfree()
    - dmaengine: imx-sdma: Fix error checking in sdma_event_remap
    - net/packet: fix packet_sock xmit return value checking
    - netlink: reset network and mac headers in netlink_dump()
    - ARM: vexpress/spc: Avoid negative array index when !SMP
    - platform/x86: samsung-laptop: Fix an unsigned comparison which can never be
      negative
    - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the
      constant
    - vxlan: fix error return code in vxlan_fdb_append
    - cifs: Check the IOCB_DIRECT flag, not O_DIRECT
    - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
    - drm/msm/mdp5: check the return of kzalloc()
    - net: macb: Restart tx only if queue pointer is lagging
    - stat: fix inconsistency between struct stat and struct compat_stat
    - ata: pata_marvell: Check the 'bmdma_addr' beforing reading
    - dma: at_xdmac: fix a missing check on list iterator
    - powerpc/perf: Fix power9 event alternatives
    - openvswitch: fix OOB access in reserve_sfa_size()
    - ASoC: soc-dapm: fix two incorrect uses of list iterator
    - e1000e: Fix possible overflow in LTR decoding
    - ARC: entry: fix syscall_trace_exit argument
    - ext4: fix symlink file size not match to file content
    - ext4: fix overhead calculation to account for the reserved gdt blocks
    - ext4: force overhead calculation if the s_overhead_cluster makes no sense
    - staging: ion: Prevent incorrect reference counting behavour
    - block/compat_ioctl: fix range check in BLKGETSIZE
    - ax25: add refcount in ax25_dev to avoid UAF bugs
    - ax25: fix reference count leaks of ax25_dev
    - ax25: fix UAF bugs of net_device caused by rebinding operation
    - ax25: Fix refcount leaks caused by ax25_cb_del()
    - ax25: fix UAF bug in ax25_send_control()
    - ax25: fix NPD bug in ax25_disconnect
    - ax25: Fix NULL pointer dereferences in ax25 timers
    - ax25: Fix UAF bugs in ax25 timers
    - ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
    - net/sched: cls_u32: fix possible leak in u32_init_knode()
    - drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
    - drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare

  * Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831)
    - USB: serial: pl2303: add IBM device IDs
    - USB: serial: simple: add Nokia phone driver
    - netdevice: add the case if dev is NULL
    - virtio_console: break out of buf poll on remove
    - ethernet: sun: Free the coherent when failing in probing
    - spi: Fix invalid sgs value
    - spi: Fix erroneous sgs value with min_t()
    - af_key: add __GFP_ZERO flag for compose_sadb_supported in function
      pfkey_register
    - fuse: fix pipe buffer lifetime for direct_io
    - tpm: fix reference counting for struct tpm_chip
    - block: Add a helper to validate the block size
    - virtio-blk: Use blk_validate_block_size() to validate block size
    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
    - coresight: Fix TRCCONFIGR.QE sysfs interface
    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
    - iio: inkern: apply consumer scale when no channel scale is available
    - iio: inkern: make a best effort on offset calculation
    - clk: uniphier: Fix fixed-rate initialization
    - Documentation: add link to stable release candidate tree
    - Documentation: update stable tree link
    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
    - NFSD: prevent underflow in nfssvc_decode_writeargs()
    - pinctrl: samsung: drop pin banks references on error paths
    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
    - jffs2: fix memory leak in jffs2_do_mount_fs
    - jffs2: fix memory leak in jffs2_scan_medium
    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
    - mempolicy: mbind_range() set_policy() after vma_merge()
    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
    - qed: display VF trust config
    - qed: validate and restrict untrusted VFs vlan promisc mode
    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
    - ALSA: cs4236: fix an incorrect NULL check on list iterator
    - drbd: fix potential silent data corruption
    - ACPI: properties: Consistently return -ENOENT if there are no more
      references
    - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
    - video: fbdev: sm712fb: Fix crash in smtcfb_read()
    - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
    - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
    - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
    - ARM: dts: exynos: add missing HDMI supplies on SMDK5250
    - ARM: dts: exynos: add missing HDMI supplies on SMDK5420
    - carl9170: fix missing bit-wise or operator for tx_params
    - thermal: int340x: Increase bitmap size
    - lib/raid6/test: fix multiple definition linking error
    - DEC: Limit PMAX memory probing to R3k systems
    - media: davinci: vpif: fix unbalanced runtime PM get
    - brcmfmac: firmware: Allocate space for default boardrev in nvram
    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
    - PCI: pciehp: Clear cmd_busy bit in polling mode
    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
    - crypto: mxs-dcp - Fix scatterlist processing
    - spi: tegra114: Add missing IRQ check in tegra_spi_probe
    - selftests/x86: Add validity check and allow field splitting
    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
    - hwmon: (pmbus) Add mutex to regulator ops
    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
    - PM: hibernate: fix __setup handler error handling
    - PM: suspend: fix return value of __setup handler
    - hwrng: atmel - disable trng on failure path
    - crypto: vmx - add missing dependencies
    - ACPI: APEI: fix return value of __setup handlers
    - crypto: ccp - ccp_dmaengine_unregister release dma channels
    - hwmon: (pmbus) Add Vin unit off handling
    - clocksource: acpi_pm: fix return value of __setup handler
    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
    - perf/core: Fix address filter parser for multiple filters
    - perf/x86/intel/pt: Fix address filter config for 32-bit kernel
    - media: coda: Fix missing put_device() call in coda_get_vdoa_data
    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
    - ARM: dts: qcom: ipq4019: fix sleep clock
    - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
    - media: usb: go7007: s2250-board: fix leak in probe()
    - ASoC: ti: davinci-i2s: Add check for clk_enable()
    - ALSA: spi: Add check for clk_enable()
    - arm64: dts: ns2: Fix spi-cpol and spi-cpha property
    - arm64: dts: broadcom: Fix sata nodename
    - printk: fix return value of printk.devkmsg __setup handler
    - ASoC: mxs-saif: Handle errors for clk_enable
    - ASoC: atmel_ssc_dai: Handle errors for clk_enable
    - memory: emif: Add check for setup_interrupts
    - memory: emif: check the pointer temp in get_device_details()
    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
    - media: stk1160: If start stream fails, return buffers with
      VB2_BUF_STATE_QUEUED
    - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
    - ASoC: wm8350: Handle error for wm8350_register_irq
    - ASoC: fsi: Add check for clk_enable
    - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
    - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
    - ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
    - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
      msm8916_wcd_digital_probe
    - mtd: onenand: Check for error irq
    - drm/edid: Don't clear formats if using deep color
    - ath9k_htc: fix uninit value bugs
    - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
    - ray_cs: Check ioremap return value
    - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
    - iwlwifi: Fix -EIO error code that is never returned
    - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
    - scsi: pm8001: Fix abort all task initialization
    - TOMOYO: fix __setup handlers return values
    - ext2: correct max file size computing
    - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
    - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false
      return
    - KVM: x86: Fix emulation in writing cr8
    - KVM: x86/emulator: Defer not-present segment check in
      __load_segment_descriptor()
    - i2c: xiic: Make bus names unique
    - power: supply: wm8350-power: Handle error for wm8350_register_irq
    - power: supply: wm8350-power: Add missing free in free_charger_irq
    - PCI: Reduce warnings on possible RW1C corruption
    - powerpc/sysdev: fix incorrect use to determine if list is empty
    - mfd: mc13xxx: Add check for mc13xxx_irq_request
    - vxcan: enable local echo for sent CAN frames
    - MIPS: RB532: fix return value of __setup handler
    - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
    - af_netlink: Fix shift out of bounds in group mask calculation
    - i2c: mux: demux-pinctrl: do not deactivate a master that is not active
    - tcp: ensure PMTU updates are processed during fastopen
    - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
    - mxser: fix xmit_buf leak in activate when LSR == 0xff
    - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
    - staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
    - serial: 8250_mid: Balance reference count for PCI DMA device
    - serial: 8250: Fix race condition in RTS-after-send handling
    - iio: adc: Add check for devm_request_threaded_irq
    - clk: qcom: clk-rcg2: Update the frac table for pixel clock
    - remoteproc: qcom_wcnss: Add missing of_node_put() in
      wcnss_alloc_memory_region
    - clk: loongson1: Terminate clk_div_table with sentinel element
    - clk: clps711x: Terminate clk_div_table with sentinel element
    - clk: tegra: tegra124-emc: Fix missing put_device() call in
      emc_ensure_emc_driver
    - NFS: remove unneeded check in decode_devicenotify_args()
    - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
    - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
    - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
    - tty: hvc: fix return value of __setup handler
    - kgdboc: fix return value of __setup handler
    - kgdbts: fix return value of __setup handler
    - jfs: fix divide error in dbNextAG
    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
    - xen: fix is_xen_pmu()
    - net: phy: broadcom: Fix brcm_fet_config_init()
    - qlcnic: dcb: default to returning -EOPNOTSUPP
    - net/x25: Fix null-ptr-deref caused by x25_disconnect
    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
    - lib/test: use after free in register_test_dev_kmod()
    - selinux: use correct type for context length
    - loop: use sysfs_emit() in the sysfs xxx show()
    - Fix incorrect type in assignment of ipv6 port for audit
    - irqchip/nvic: Release nvic_base upon failure
    - ACPICA: Avoid walking the ACPI Namespace if it is not there
    - ACPI/APEI: Limit printable size of BERT table data
    - PM: core: keep irq flags in device_pm_check_callbacks()
    - spi: tegra20: Use of_device_get_match_data()
    - ext4: don't BUG if someone dirty pages without asking ext4 first
    - ntfs: add sanity check on allocation size
    - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
    - video: fbdev: w100fb: Reset global state
    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
    - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
    - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
    - ARM: dts: bcm2837: Add the missing L1/L2 cache information
    - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
    - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of
      snprintf()
    - ASoC: soc-core: skip zero num_dai component in searching dai name
    - media: cx88-mpeg: clear interrupt status register before streaming video
    - ARM: tegra: tamonten: Fix I2C3 pad setting
    - ARM: mmp: Fix failure to remove sram device
    - video: fbdev: sm712fb: Fix crash in smtcfb_write()
    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
    - powerpc/lib/sstep: Fix 'sthcx' instruction
    - powerpc/lib/sstep: Fix build errors with newer binutils
    - scsi: qla2xxx: Fix warning for missing error code
    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
    - KVM: Prevent module exit until all VMs are freed
    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
    - ubifs: rename_whiteout: correct old_dir size computing
    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
    - can: mcba_usb: properly check endpoint type
    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
    - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
    - mm/mmap: return 1 from stack_guard_gap __setup() handler
    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
    - ubi: fastmap: Return error code if memory allocation fails in add_aeb()
    - ASoC: topology: Allow TLV control to be either read or write
    - ARM: dts: spear1340: Update serial node properties
    - ARM: dts: spear13xx: Update SPI dma properties
    - openvswitch: Fixed nd target mask field in the flow dump.
    - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
    - rtc: wm8350: Handle error for wm8350_register_irq
    - ARM: 9187/1: JIVE: fix return value of __setup handler
    - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
    - ptp: replace snprintf with sysfs_emit
    - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
    - scsi: mvsas: Replace snprintf() with sysfs_emit()
    - scsi: bfa: Replace snprintf() with sysfs_emit()
    - power: supply: axp20x_battery: properly report current when discharging
    - powerpc: Set crashkernel offset to mid of RMA region
    - PCI: aardvark: Fix support for MSI interrupts
    - iommu/arm-smmu-v3: fix event handling soft lockup
    - dm ioctl: prevent potential spectre v1 gadget
    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
    - net/smc: correct settings of RMB window update limit
    - macvtap: advertise link netns via netlink
    - bnxt_en: Eliminate unintended link toggle during FW reset
    - MIPS: fix fortify panic when copying asm exception handlers
    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
    - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
    - xtensa: fix DTC warning unit_address_format
    - Bluetooth: Fix use after free in hci_send_acl
    - init/main.c: return 1 from handled __setup() functions
    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
    - NFS: swap IO handling is slightly different for O_DIRECT IO
    - NFS: swap-out must always use STABLE writes.
    - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
    - virtio_console: eliminate anonymous module_init & module_exit
    - jfs: prevent NULL deref in diFree
    - parisc: Fix CPU affinity for Lasi, WAX and Dino chips
    - ipv6: add missing tx timestamping on IPPROTO_RAW
    - net: add missing SOF_TIMESTAMPING_OPT_ID support
    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
    - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
    - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
    - drm/imx: Fix memory leak in imx_pd_connector_get_modes
    - drbd: Fix five use after free bugs in get_initial_state
    - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
    - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
    - x86/pm: Save the MSR validity status at context setup
    - x86/speculation: Restore speculation related MSRs during S3 resume
    - btrfs: fix qgroup reserve overflow the qgroup limit
    - arm64: patch_text: Fixup last cpu should be master
    - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
    - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
    - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
    - mm: don't skip swap entry even if zap_details specified
    - arm64: module: remove (NOLOAD) from linker script
    - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
    - cgroup: Use open-time credentials for process migraton perm checks
    - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
    - cgroup: Use open-time cgroup namespace for process migration perm checks
    - memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
    - veth: Ensure eth header is in skb's linear part
    - gpiolib: acpi: use correct format characters
    - mlxsw: i2c: Fix initialization error flow
    - nfc: nci: add flush_workqueue to prevent uaf
    - cifs: potential buffer overflow in handling symlinks
    - drm/amd: Add USBC connector ID
    - drm/amdkfd: Check for potential null return of kmalloc_array()
    - Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
    - scsi: target: tcmu: Fix possible page UAF
    - scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
    - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
    - gpu: ipu-v3: Fix dev_dbg frequency output
    - scsi: mvsas: Add PCI ID of RocketRaid 2640
    - drivers: net: slip: fix NPD bug in sl_tx_timeout()
    - mm, page_alloc: fix build_zonerefs_node()
    - mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
    - gcc-plugins: latent_entropy: use /dev/urandom
    - ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
    - ARM: davinci: da850-evm: Avoid NULL pointer dereference
    - smp: Fix offline cpu check in flush_smp_call_function_queue()
    - i2c: pasemi: Wait for write xfers to finish
    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
    - drm/edid: check basic audio support on CEA extension block
    - ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
    - mmc: davinci_mmc: Handle error for clk_enable
    - drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
    - drm/amd/display: Fix a NULL pointer dereference in
      amdgpu_dm_connector_add_common_modes()
    - hv_balloon: rate-limit "Unhandled message" warning
    - scsi: qla2xxx: Fix incorrect reporting of task management failure
    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
    - sctp: Initialize daddr on peeled off socket
    - testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Wed, 22 Jun 2022 11:26:25 -0700

# For older changelog entries, run 'apt-get changelog linux-modules-4.15.0-201-generic-lpae'
