Jammy update: v5.15.58 upstream stable release

Bug #1988479 reported by Kamal Mostafa
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Fix Released
Medium
Kamal Mostafa

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.15.58 upstream stable release
       from git://git.kernel.org/

pinctrl: stm32: fix optional IRQ support to gpios
riscv: add as-options for modules with assembly compontents
mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication
lockdown: Fix kexec lockdown bypass with ima policy
drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
bus: mhi: host: pci_generic: add Telit FN980 v1 hardware revision
bus: mhi: host: pci_generic: add Telit FN990
Revert "selftest/vm: verify remap destination address in mremap_test"
Revert "selftest/vm: verify mmap addr in mremap_test"
PCI: hv: Fix multi-MSI to allow more than one MSI vector
PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
PCI: hv: Fix interrupt mapping for multi-MSI
serial: mvebu-uart: correctly report configured baudrate value
batman-adv: Use netif_rx_any_context() any.
xfs: fix maxlevels comparisons in the btree staging code
xfs: fold perag loop iteration logic into helper function
xfs: rename the next_agno perag iteration variable
xfs: terminate perag iteration reliably on agcount
xfs: fix perag reference leak on iteration race with growfs
xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list()
r8152: fix a WOL issue
ip: Fix data-races around sysctl_ip_default_ttl.
xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
RDMA/irdma: Do not advertise 1GB page size for x722
RDMA/irdma: Fix sleep from invalid context BUG
pinctrl: ralink: rename MT7628(an) functions to MT76X8
pinctrl: ralink: rename pinctrl-rt2880 to pinctrl-ralink
pinctrl: ralink: Check for null return of devm_kcalloc
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
ipv4/tcp: do not use per netns ctl sockets
net: tun: split run_ebpf_filter() and pskb_trim() into different "if statement"
mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30%
sysctl: move some boundary constants from sysctl.c to sysctl_vals
tcp: Fix data-races around sysctl_tcp_ecn.
drm/amd/display: Add option to defer works of hpd_rx_irq
drm/amd/display: Fork thread to offload work of hpd_rx_irq
drm/amdgpu/display: add quirk handling for stutter mode
drm/amd/display: Ignore First MST Sideband Message Return Error
scsi: megaraid: Clear READ queue map's nr_queues
scsi: ufs: core: Drop loglevel of WriteBoost message
nvme: check for duplicate identifiers earlier
nvme: fix block device naming collision
igc: Reinstate IGC_REMOVED logic and implement it properly
ip: Fix data-races around sysctl_ip_no_pmtu_disc.
ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
ip: Fix data-races around sysctl_ip_fwd_update_priority.
ip: Fix data-races around sysctl_ip_nonlocal_bind.
ip: Fix a data-race around sysctl_ip_autobind_reuse.
ip: Fix a data-race around sysctl_fwmark_reflect.
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
tcp: Fix data-races around sysctl_tcp_mtu_probing.
tcp: Fix data-races around sysctl_tcp_base_mss.
tcp: Fix data-races around sysctl_tcp_min_snd_mss.
tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.
tcp: Fix a data-race around sysctl_tcp_probe_threshold.
tcp: Fix a data-race around sysctl_tcp_probe_interval.
net: stmmac: fix pm runtime issue in stmmac_dvr_remove()
net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow
mtd: rawnand: gpmi: validate controller clock rate
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
net: dsa: microchip: ksz_common: Fix refcount leak bug
net: skb: introduce kfree_skb_reason()
net: skb: use kfree_skb_reason() in tcp_v4_rcv()
net: skb: use kfree_skb_reason() in __udp4_lib_rcv()
net: socket: rename SKB_DROP_REASON_SOCKET_FILTER
net: skb_drop_reason: add document for drop reasons
net: netfilter: use kfree_drop_reason() for NF_DROP
net: ipv4: use kfree_skb_reason() in ip_rcv_core()
net: ipv4: use kfree_skb_reason() in ip_rcv_finish_core()
i2c: mlxcpld: Fix register setting for 400KHz frequency
i2c: cadence: Change large transfer count reset logic to be unconditional
perf tests: Fix Convert perf time to TSC test for hybrid
net: stmmac: fix dma queue left shift overflow issue
net/tls: Fix race in TLS device down flow
igmp: Fix data-races around sysctl_igmp_llm_reports.
igmp: Fix a data-race around sysctl_igmp_max_memberships.
igmp: Fix data-races around sysctl_igmp_max_msf.
tcp: Fix data-races around keepalive sysctl knobs.
tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries.
tcp: Fix data-races around sysctl_tcp_syncookies.
tcp: Fix data-races around sysctl_tcp_migrate_req.
tcp: Fix data-races around sysctl_tcp_reordering.
tcp: Fix data-races around some timeout sysctl knobs.
tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
tcp: Fix a data-race around sysctl_tcp_tw_reuse.
tcp: Fix data-races around sysctl_max_syn_backlog.
tcp: Fix data-races around sysctl_tcp_fastopen.
tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.
iavf: Fix handling of dummy receive descriptors
pinctrl: armada-37xx: Use temporary variable for struct device
pinctrl: armada-37xx: Make use of the devm_platform_ioremap_resource()
pinctrl: armada-37xx: Convert to use dev_err_probe()
pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context
i40e: Fix erroneous adapter reinitialization during recovery process
ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
net: stmmac: remove redunctant disable xPCS EEE call
gpio: pca953x: only use single read/write for No AI mode
gpio: pca953x: use the correct range when do regmap sync
gpio: pca953x: use the correct register address when regcache sync during init
be2net: Fix buffer overflow in be_get_module_eeprom
net: dsa: sja1105: silent spi_device_id warnings
net: dsa: vitesse-vsc73xx: silent spi_device_id warnings
drm/imx/dcss: Add missing of_node_put() in fail path
ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.
ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
ip: Fix data-races around sysctl_ip_prot_sock.
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
tcp: Fix data-races around sysctl knobs related to SYN option.
tcp: Fix a data-race around sysctl_tcp_early_retrans.
tcp: Fix data-races around sysctl_tcp_recovery.
tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
tcp: Fix a data-race around sysctl_tcp_stdurg.
tcp: Fix a data-race around sysctl_tcp_rfc1337.
tcp: Fix a data-race around sysctl_tcp_abort_on_overflow.
tcp: Fix data-races around sysctl_tcp_max_reordering.
gpio: gpio-xilinx: Fix integer overflow
KVM: selftests: Fix target thread to be migrated in rseq_test
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
KVM: Don't null dereference ops->destroy
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
bpf: Make sure mac_header was set before using it
sched/deadline: Fix BUG_ON condition for deboosted tasks
x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
dlm: fix pending remove if msg allocation fails
x86/uaccess: Implement macros for CMPXCHG on user addresses
bitfield.h: Fix "type of reg too small for mask" test
x86/entry_32: Remove .fixup usage
x86/extable: Extend extable functionality
x86/msr: Remove .fixup usage
x86/futex: Remove .fixup usage
KVM: x86: Use __try_cmpxchg_user() to emulate atomic accesses
xhci: dbc: refactor xhci_dbc_init()
xhci: dbc: create and remove dbc structure in dbgtty driver.
xhci: dbc: Rename xhci_dbc_init and xhci_dbc_exit
xhci: Set HCD flag to defer primary roothub registration
mt76: fix use-after-free by removing a non-RCU wcid pointer
iwlwifi: fw: uefi: add missing include guards
crypto: qat - set to zero DH parameters before free
crypto: qat - use pre-allocated buffers in datapath
crypto: qat - refactor submission logic
crypto: qat - add backlog mechanism
crypto: qat - fix memory leak in RSA
crypto: qat - remove dma_free_coherent() for RSA
crypto: qat - remove dma_free_coherent() for DH
crypto: qat - add param check for RSA
crypto: qat - add param check for DH
crypto: qat - re-enable registration of algorithms
exfat: fix referencing wrong parent directory information after renaming
tracing: Have event format check not flag %p* on __get_dynamic_array()
tracing: Place trace_pid_list logic into abstract functions
tracing: Fix return value of trace_pid_write()
um: virtio_uml: Allow probing from devicetree
um: virtio_uml: Fix broken device handling in time-travel
Bluetooth: Add bt_skb_sendmsg helper
Bluetooth: Add bt_skb_sendmmsg helper
Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
Bluetooth: Fix passing NULL to PTR_ERR
Bluetooth: SCO: Fix sco_send_frame returning skb->len
Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
exfat: use updated exfat_chain directly during renaming
x86/amd: Use IBPB for firmware calls
x86/alternative: Report missing return thunk details
watchqueue: make sure to serialize 'wqueue->defunct' properly
tty: drivers/tty/, stop using tty_schedule_flip()
tty: the rest, stop using tty_schedule_flip()
tty: drop tty_schedule_flip()
tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
watch-queue: remove spurious double semicolon
drm/amd/display: invalid parameter check in dmub_hpd_callback
x86/extable: Prefer local labels in .set directives
KVM: x86: fix typo in __try_cmpxchg_user causing non-atomicness
x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
x86/entry_32: Fix segment exceptions
Linux 5.15.58
UBUNTU: Upstream stable to v5.15.58

CVE References

Changed in linux (Ubuntu):
status: New → Confirmed
tags: added: kernel-stable-tracking-bug
Changed in linux (Ubuntu):
status: Confirmed → Invalid
Changed in linux (Ubuntu Jammy):
status: New → In Progress
importance: Undecided → Medium
assignee: nobody → Kamal Mostafa (kamalmostafa)
description: updated
Stefan Bader (smb)
Changed in linux (Ubuntu Jammy):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (42.9 KiB)

This bug was fixed in the package linux - 5.15.0-50.56

---------------
linux (5.15.0-50.56) jammy; urgency=medium

  * jammy/linux: 5.15.0-50.56 -proposed tracker (LP: #1990148)

  * CVE-2022-3176
    - io_uring: refactor poll update
    - io_uring: move common poll bits
    - io_uring: kill poll linking optimisation
    - io_uring: inline io_poll_complete
    - io_uring: correct fill events helpers types
    - io_uring: clean cqe filling functions
    - io_uring: poll rework
    - io_uring: remove poll entry from list when canceling all
    - io_uring: bump poll refs to full 31-bits
    - io_uring: fail links when poll fails
    - io_uring: fix wrong arm_poll error handling
    - io_uring: fix UAF due to missing POLLFREE handling

  * ip/nexthop: fix default address selection for connected nexthop
    (LP: #1988809)
    - selftests/net: test nexthop without gw

  * ip/nexthop: fix default address selection for connected nexthop
    (LP: #1988809) // icmp_redirect.sh in ubuntu_kernel_selftests failed on
    Jammy 5.15.0-49.55 (LP: #1990124)
    - ip: fix triggering of 'icmp redirect'

linux (5.15.0-49.55) jammy; urgency=medium

  * jammy/linux: 5.15.0-49.55 -proposed tracker (LP: #1989785)

  * amdgpu module crash after 5.15 kernel update (LP: #1981883)
    - drm/amdgpu: fix check in fbdev init

  * scsi: hisi_sas: Increase debugfs_dump_index after dump is  completed
    (LP: #1982070)
    - scsi: hisi_sas: Increase debugfs_dump_index after dump is completed

  * [UBUNTU 22.04] s390/qeth: cache link_info for ethtool (LP: #1984103)
    - s390/qeth: cache link_info for ethtool

  * WARN in trace_event_dyn_put_ref (LP: #1987232)
    - tracing/perf: Fix double put of trace event when init fails

  * Jammy update: v5.15.60 upstream stable release (LP: #1989221)
    - x86/speculation: Make all RETbleed mitigations 64-bit only
    - selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
    - selftests/bpf: Check dst_port only on the client socket
    - block: fix default IO priority handling again
    - tools/vm/slabinfo: Handle files in debugfs
    - ACPI: video: Force backlight native for some TongFang devices
    - ACPI: video: Shortening quirk list by identifying Clevo by board_name only
    - ACPI: APEI: Better fix to avoid spamming the console with old error logs
    - crypto: arm64/poly1305 - fix a read out-of-bound
    - KVM: x86: do not report a vCPU as preempted outside instruction boundaries
    - KVM: x86: do not set st->preempted when going back to user space
    - KVM: selftests: Make hyperv_clock selftest more stable
    - tools/kvm_stat: fix display of error when multiple processes are found
    - selftests: KVM: Handle compiler optimizations in ucall
    - KVM: x86/svm: add __GFP_ACCOUNT to __sev_dbg_{en,de}crypt_user()
    - arm64: set UXN on swapper page tables
    - btrfs: zoned: prevent allocation from previous data relocation BG
    - btrfs: zoned: fix critical section of relocation inode writeback
    - Bluetooth: hci_bcm: Add BCM4349B1 variant
    - Bluetooth: hci_bcm: Add DT compatible for CYW55572
    - dt-bindings: bluetooth: broadcom: Add BCM4349B1 DT binding
    - Bluetooth: btusb: Add support of IMC Netw...

Changed in linux (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-bluefield/5.15.0-1010.12 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-jammy
tags: removed: verification-needed-jammy
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.