Kinetic update: v5.19.6 upstream stable release

Bug #1988732 reported by Andrea Righi
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Kinetic
Fix Released
Undecided
Unassigned

Bug Description

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.19.6 upstream stable release
       from git://git.kernel.org/

Linux 5.19.6
bpf: Don't use tnum_range on array range checking for poke descriptors
riscv: dts: microchip: mpfs: remove pci axi address translation property
riscv: dts: microchip: mpfs: remove bogus card-detect-delay
riscv: dts: microchip: mpfs: remove ti,fifo-depth property
riscv: dts: microchip: mpfs: fix incorrect pcie child node name
scsi: core: Fix passthrough retry counter handling
scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
scsi: ufs: core: Enable link lost interrupt
arm64/sme: Don't flush SVE register state when handling SME traps
arm64/sme: Don't flush SVE register state when allocating SME storage
arm64/signal: Flush FPSIMD register state when disabling streaming mode
arm64: fix rodata=full
perf stat: Clear evsel->reset_group for each stat run
perf/x86/intel/ds: Fix precise store latency handling
perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU
perf python: Fix build when PYTHON_CONFIG is user supplied
blk-mq: fix io hung due to missing commit_rqs
Documentation/ABI: Mention retbleed vulnerability info file for sysfs
drm/amdkfd: Fix isa version for the GC 10.3.7
x86/nospec: Fix i386 RSB stuffing
binder_alloc: add missing mmap_lock calls when using the VMA
arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76
md: call __md_stop_writes in md_stop
Revert "md-raid: destroy the bitmap after destroying the thread"
mm/hugetlb: fix hugetlb not supporting softdirty tracking
io_uring: fix issue with io_write() not always undoing sb_start_write()
Revert "zram: remove double compression logic"
riscv: dts: microchip: correct L2 cache interrupts
riscv: traps: add missing prototype
riscv: signal: fix missing prototype warning
xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
smb3: missing inode locks in punch hole
nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
ACPI: processor: Remove freq Qos request for all CPUs
shmem: update folio if shmem_replace_page() updates the page
Revert "memcg: cleanup racy sum avoidance code"
fbdev: fbcon: Properly revert changes when vc_resize() failed
s390: fix double free of GS and RI CBs on fork() failure
cifs: skip extra NULL byte in filenames
mm/mprotect: only reference swap pfn page if type match
mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
s390/mm: do not trigger write fault when vma does not allow VM_WRITE
mm/damon/dbgfs: avoid duplicate context directory creation
asm-generic: sections: refactor memory_intersects
audit: move audit_return_fixup before the filters
writeback: avoid use-after-free after removing device
loop: Check for overflow while configuring loop
x86/PAT: Have pat_enabled() properly reflect state when running on Xen
x86/nospec: Unwreck the RSB stuffing
x86/bugs: Add "unknown" reporting for MMIO Stale Data
x86/sev: Don't use cc_platform_has() for early SEV-SNP calls
x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
x86/entry: Fix entry_INT80_compat for Xen PV guests
perf/x86/lbr: Enable the branch type for the Arch LBR by default
perf/x86/intel: Fix pebs event constraints for ADL
x86/boot: Don't propagate uninitialized boot_params->cc_blob_address
btrfs: update generation of hole file extent item when merging holes
btrfs: fix possible memory leak in btrfs_get_dev_args_from_path()
btrfs: check if root is readonly while setting security xattr
btrfs: fix space cache corruption and potential double allocations
btrfs: add info when mount fails due to stale replace target
btrfs: replace: drop assert for suspended replace
btrfs: fix silent failure when deleting root reference
net: lantiq_xrx200: restore buffer if memory allocation failed
net: lantiq_xrx200: fix lock under memory pressure
net: lantiq_xrx200: confirm skb is allocated before using
net: stmmac: work around sporadic tx issue on link-up
ionic: VF initial random MAC address if no assigned mac
ionic: fix up issues with handling EAGAIN on FW cmds
ionic: clear broken state on generation change
rxrpc: Fix locking in rxrpc's sendmsg
net: ethernet: mtk_eth_soc: fix hw hash reporting for MTK_NETSYS_V2
net: ethernet: mtk_eth_soc: enable rx cksum offload for MTK_NETSYS_V2
i40e: Fix incorrect address type for IPv6 flow rules
ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
net: Fix a data-race around sysctl_somaxconn.
net: Fix a data-race around netdev_unregister_timeout_secs.
net: Fix a data-race around gro_normal_batch.
net: Fix data-races around sysctl_devconf_inherit_init_net.
net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
net: Fix a data-race around netdev_budget_usecs.
net: Fix data-races around sysctl_max_skb_frags.
net: Fix a data-race around netdev_budget.
net: Fix a data-race around sysctl_net_busy_read.
net: Fix a data-race around sysctl_net_busy_poll.
net: Fix a data-race around sysctl_tstamp_allow_data.
net: Fix data-races around sysctl_optmem_max.
ratelimit: Fix data-races in ___ratelimit().
net: Fix data-races around netdev_tstamp_prequeue.
net: Fix data-races around netdev_max_backlog.
net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
net: Fix data-races around sysctl_[rw]mem_(max|default).
netfilter: flowtable: fix stuck flows on cleanup due to pending work
netfilter: flowtable: add function to invoke garbage collection immediately
netfilter: nf_tables: disallow binding to already bound chain
netfilter: nft_tunnel: restrict it to netdev family
netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
netfilter: nf_tables: do not leave chain stats enabled on error
netfilter: nft_payload: do not truncate csum_offset and csum_type
netfilter: nft_payload: report ERANGE for too long offset and length
netfilter: nf_tables: make table handle allocation per-netns friendly
netfilter: nf_tables: disallow updates of implicit chain
bnxt_en: fix LRO/GRO_HW features in ndo_fix_features callback
bnxt_en: fix NQ resource accounting during vf creation on 57500 chips
bnxt_en: set missing reload flag in devlink features
bnxt_en: Use PAGE_SIZE to init buffer when multi buffer XDP is not in use
netfilter: nft_tproxy: restrict to prerouting hook
netfilter: ebtables: reject blobs that don't provide all entry points
net: ipvtap - add __init/__exit annotations to module init/exit funcs
bonding: 802.3ad: fix no transmission of LACPDUs
net: moxa: get rid of asymmetry in DMA mapping/unmapping
net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume()
net: ipa: don't assume SMEM is page-aligned
net: dsa: microchip: keep compatibility with device tree blobs with no phy-mode
net: dsa: microchip: update the ksz_phylink_get_caps
net: dsa: microchip: move the port mirror to ksz_common
net: dsa: microchip: move vlan functionality to ksz_common
net: dsa: microchip: move tag_protocol to ksz_common
net: dsa: microchip: move switch chip_id detection to ksz_common
net: dsa: microchip: ksz9477: cleanup the ksz9477_switch_detect
net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off
net/mlx5e: Fix wrong application of the LRO state
net/mlx5: Avoid false positive lockdep warning by adding lock_class_key
net/mlx5: Fix cmd error logging for manage pages cmd
net/mlx5: Disable irq when locking lag_lock
net/mlx5: Eswitch, Fix forwarding decision to uplink
net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY
net/mlx5e: Properly disable vlan strip on non-UL reps
ice: xsk: use Rx ring's XDP ring when picking NAPI context
ice: xsk: prohibit usage of non-balanced queue id
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
r8152: fix the RX FIFO settings when suspending
r8152: fix the units of some registers for RTL8156A
rose: check NULL rose_loopback_neigh->loopback
ntfs: fix acl handling
mm/smaps: don't access young/dirty bit if pte unpresent
SUNRPC: RPC level errors should set task->tk_rpc_status
NFSv4.2 fix problems with __nfs42_ssc_open
Revert "net: macsec: update SCI upon MAC address change."
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
xfrm: policy: fix metadata dst->dev xmit null pointer dereference
af_key: Do not call xfrm_probe_algs in parallel
xfrm: clone missing x->lastused in xfrm_do_migrate
Revert "xfrm: update SA curlft.use_time"
xfrm: fix refcount leak in __xfrm_policy_check()
mt76: mt7921: fix command timeout in AP stop period
mm/hugetlb: support write-faults in shared mappings
mm/uffd: reset write protection when unregister with wp-mode
kprobes: don't call disarm_kprobe() for disabled kprobes
kernel/sys_ni: add compat entry for fadvise64_64
parisc: Fix exception handler for fldw and fstw instructions
parisc: Make CONFIG_64BIT available for ARCH=parisc64 only
cgroup: Fix race condition at rebind_subsystems()
audit: fix potential double free on error path from fsnotify_add_inode_mark
NFS: Fix another fsync() issue after a server reboot
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW

CVE References

Andrea Righi (arighi)
Changed in linux (Ubuntu):
status: New → Confirmed
tags: added: kernel-stable-tracking-bug
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (18.6 KiB)

This bug was fixed in the package linux - 5.19.0-18.18

---------------
linux (5.19.0-18.18) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-18.18 -proposed tracker (LP: #1990366)

  * 5.19.0-17.17: kernel NULL pointer dereference, address: 0000000000000084
    (LP: #1990236)
    - Revert "UBUNTU: SAUCE: apparmor: Fix regression in stacking due to label
      flags"
    - Revert "UBUNTU: [Config] disable SECURITY_APPARMOR_RESTRICT_USERNS"
    - Revert "UBUNTU: SAUCE: Revert "hwrng: virtio - add an internal buffer""
    - Revert "UBUNTU: SAUCE: Revert "hwrng: virtio - don't wait on cleanup""
    - Revert "UBUNTU: SAUCE: Revert "hwrng: virtio - don't waste entropy""
    - Revert "UBUNTU: SAUCE: Revert "hwrng: virtio - always add a pending
      request""
    - Revert "UBUNTU: SAUCE: Revert "hwrng: virtio - unregister device before
      reset""
    - Revert "UBUNTU: SAUCE: Revert "virtio-rng: make device ready before making
      request""
    - Revert "UBUNTU: [Config] update configs after apply new apparmor patch set"
    - Revert "UBUNTU: SAUCE: apparmor: add user namespace creation mediation"
    - Revert "UBUNTU: SAUCE: selinux: Implement userns_create hook"
    - Revert "UBUNTU: SAUCE: bpf-lsm: Make bpf_lsm_userns_create() sleepable"
    - Revert "UBUNTU: SAUCE: security, lsm: Introduce security_create_user_ns()"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: AppArmor: Remove the exclusive
      flag"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Add /proc attr entry for full
      LSM context"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Removed scaffolding function
      lsmcontext_init"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: netlabel: Use a struct lsmblob in
      audit data"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: Audit: Add record for multiple
      object contexts"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: audit: multiple subject lsm values
      for netlabel"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: Audit: Add record for multiple task
      security contexts"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: Audit: Allow multiple records in an
      audit_buffer"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Add a function to report
      multiple LSMs"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: Audit: Create audit_stamp
      structure"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: Audit: Keep multiple LSM data in
      audit_names"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: security_secid_to_secctx
      module selection"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: binder: Pass LSM identifier for
      confirmation"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: NET: Store LSM netlabel data in a
      lsmblob"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: security_secid_to_secctx in
      netlink netfilter"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Use lsmcontext in
      security_dentry_init_security"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Use lsmcontext in
      security_inode_getsecctx"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM: Use lsmcontext in
      security_secid_to_secctx"
    - Revert "UBUNTU: SAUCE: lsm stacking v37: LSM:...

Changed in linux (Ubuntu Kinetic):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.