[ubuntu/bionic-security] linux-gcp-4.15 4.15.0-1093.106 (Accepted)

Andy Whitcroft apw at canonical.com
Wed Feb 24 10:42:17 UTC 2021


linux-gcp-4.15 (4.15.0-1093.106) bionic; urgency=medium

  * bionic/linux-gcp-4.15: 4.15.0-1093.106 -proposed tracker (LP: #1913107)

  [ Ubuntu: 4.15.0-136.140 ]

  * bionic/linux: 4.15.0-136.140 -proposed tracker (LP: #1913117)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
    - update dkms package versions
  * Introduce the new NVIDIA 460-server series and update the 460 series
    (LP: #1913200)
    - [Config] dkms-versions -- drop NVIDIA 435 455 and 440-server
    - [Config] dkms-versions -- add the 460-server nvidia driver
  * switch to an autogenerated nvidia series based core via dkms-versions
    (LP: #1912803)
    - [Packaging] nvidia -- use dkms-versions to define versions built
    - [Packaging] update-version-dkms -- maintain flags fields
    - [Config] dkms-versions -- add transitional/skip information for nvidia
      packages
  * DMI entry syntax fix for Pegatron / ByteSpeed C15B (LP: #1910639)
    - Input: i8042 - unbreak Pegatron C15B
  * CVE-2020-29372
    - mm: check that mm is still valid in madvise()
  * update ENA driver, incl. new ethtool stats (LP: #1910291)
    - net: ena: change num_queues to num_io_queues for clarity and consistency
    - net: ena: ethtool: get_channels: use combined only
    - net: ena: ethtool: support set_channels callback
    - net: ena: ethtool: remove redundant non-zero check on rc
    - net/amazon: Ensure that driver version is aligned to the linux kernel
    - net: ena: ethtool: clean up minor indentation issue
    - net: ena: remove code that does nothing
    - net: ena: add unmask interrupts statistics to ethtool
    - net: ena: cosmetic: change ena_com_stats_admin stats to u64
    - net: ena: cosmetic: remove unnecessary code
    - net: ena: ethtool: convert stat_offset to 64 bit resolution
    - net: ena: ethtool: Add new device statistics
    - net: ena: Change license into format to SPDX in all files
    - net: ena: Change RSS related macros and variables names
  * CVE-2020-29374
    - gup: document and work around "COW can break either way" issue
  * Bionic update: upstream stable patchset 2021-01-12 (LP: #1911331)
    - spi: bcm2835aux: Fix use-after-free on unbind
    - spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
    - iwlwifi: pcie: limit memory read spin time
    - arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
    - iwlwifi: mvm: fix kernel panic in case of assert during CSA
    - ARC: stack unwinding: don't assume non-current task is sleeping
    - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
    - soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
    - platform/x86: acer-wmi: add automatic keyboard background light toggle key
      as KEY_LIGHTS_TOGGLE
    - Input: cm109 - do not stomp on control URB
    - Input: i8042 - add Acer laptops to the i8042 reset list
    - kbuild: avoid static_assert for genksyms
    - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
    - x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
    - PCI: qcom: Add missing reset for ipq806x
    - net: stmmac: free tx skb buffer in stmmac_resume()
    - tcp: fix cwnd-limited bug for TSO deferral where we send nothing
    - net/mlx4_en: Avoid scheduling restart task if it is already running
    - net/mlx4_en: Handle TX error CQE
    - net: stmmac: delete the eee_ctrl_timer after napi disabled
    - net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
    - net: bridge: vlan: fix error return code in __vlan_add()
    - mac80211: mesh: fix mesh_pathtbl_init() error path
    - USB: dummy-hcd: Fix uninitialized array use in init()
    - USB: add RESET_RESUME quirk for Snapscan 1212
    - ALSA: usb-audio: Fix potential out-of-bounds shift
    - ALSA: usb-audio: Fix control 'access overflow' errors from chmap
    - xhci: Give USB2 ports time to enter U3 in bus suspend
    - USB: UAS: introduce a quirk to set no_write_same
    - USB: sisusbvga: Make console support depend on BROKEN
    - [Config] updateconfigs for USB_SISUSBVGA_CON
    - ALSA: pcm: oss: Fix potential out-of-bounds shift
    - serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
    - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    - pinctrl: merrifield: Set default bias in case no particular value given
    - pinctrl: baytrail: Avoid clearing debounce value when turning it off
    - ARM: dts: sun8i: v3s: fix GIC node memory range
    - gpio: mvebu: fix potential user-after-free on probe
    - scsi: bnx2i: Requires MMU
    - can: softing: softing_netdev_open(): fix error handling
    - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
    - kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
    - drm/tegra: sor: Disable clocks on error in tegra_sor_init()
    - vxlan: Add needed_headroom for lower device
    - vxlan: Copy needed_tailroom from lowerdev
    - scsi: mpt3sas: Increase IOCInit request timeout to 30s
    - dm table: Remove BUG_ON(in_interrupt())
    - soc/tegra: fuse: Fix index bug in get_process_id
    - USB: serial: option: add interface-number sanity check to flag handling
    - USB: gadget: f_acm: add support for SuperSpeed Plus
    - USB: gadget: f_midi: setup SuperSpeed Plus descriptors
    - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
    - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
    - usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
    - ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
    - ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on
      Exynos5410
    - ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
    - HID: i2c-hid: add Vero K147 to descriptor override
    - serial_core: Check for port state when tty is in error state
    - quota: Sanity-check quota file headers on load
    - media: msi2500: assign SPI bus number dynamically
    - crypto: af_alg - avoid undefined behavior accessing salg_name
    - md: fix a warning caused by a race between concurrent md_ioctl()s
    - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
    - drm/gma500: fix double free of gma_connector
    - soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
    - soc: mediatek: Check if power domains can be powered on at boot time
    - RDMA/bnxt_re: Set queue pair state when being queried
    - selinux: fix error initialization in inode_doinit_with_dentry()
    - RDMA/rxe: Compute PSN windows correctly
    - x86/mm/ident_map: Check for errors from ident_pud_init()
    - ARM: p2v: fix handling of LPAE translation in BE mode
    - sched/deadline: Fix sched_dl_global_validate()
    - sched: Reenable interrupts in do_sched_yield()
    - crypto: talitos - Fix return type of current_desc_hdr()
    - spi: img-spfi: fix reference leak in img_spfi_resume
    - ASoC: pcm: DRAIN support reactivation
    - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
    - arm64: dts: exynos: Correct psci compatible used on Exynos7
    - Bluetooth: Fix null pointer dereference in hci_event_packet()
    - spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
    - spi: tegra20-slink: fix reference leak in slink ops of tegra20
    - spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
    - spi: tegra114: fix reference leak in tegra spi ops
    - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
    - ASoC: wm8998: Fix PM disable depth imbalance on error
    - ASoC: arizona: Fix a wrong free in wm8997_probe
    - RDMa/mthca: Work around -Wenum-conversion warning
    - MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
    - staging: greybus: codecs: Fix reference counter leak in error handling
    - media: mtk-vcodec: add missing put_device() call in
      mtk_vcodec_release_dec_pm()
    - scsi: core: Fix VPD LUN ID designator priorities
    - media: solo6x10: fix missing snd_card_free in error handling case
    - drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
    - Input: ads7846 - fix race that causes missing releases
    - Input: ads7846 - fix integer overflow on Rt calculation
    - Input: ads7846 - fix unaligned access on 7845
    - powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
    - crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
    - soc: ti: knav_qmss: fix reference leak in knav_queue_probe
    - soc: ti: Fix reference imbalance in knav_dma_probe
    - drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
    - Input: omap4-keypad - fix runtime PM error handling
    - RDMA/cxgb4: Validate the number of CQEs
    - memstick: fix a double-free bug in memstick_check
    - ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
    - ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
    - orinoco: Move context allocation after processing the skb
    - cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
    - media: siano: fix memory leak of debugfs members in smsdvb_hotplug
    - samples: bpf: Fix lwt_len_hist reusing previous BPF map
    - mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
    - media: max2175: fix max2175_set_csm_mode() error code
    - HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
    - ARM: dts: Remove non-existent i2c1 from 98dx3236
    - power: supply: bq24190_charger: fix reference leak
    - genirq/irqdomain: Don't try to free an interrupt that has no mapping
    - PCI: iproc: Fix out-of-bound array accesses
    - ARM: dts: at91: at91sam9rl: fix ADC triggers
    - ath10k: Fix an error handling path
    - ath10k: Release some resources in an error handling path
    - NFSv4.2: condition READDIR's mask for security label based on LSM state
    - SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
    - lockd: don't use interval-based rebinding over TCP
    - NFS: switch nfsiod to be an UNBOUND workqueue.
    - vfio-pci: Use io_remap_pfn_range() for PCI IO memory
    - media: saa7146: fix array overflow in vidioc_s_audio()
    - clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
    - ARM: dts: at91: sama5d2: map securam as device
    - pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
    - arm64: dts: rockchip: Fix UART pull-ups on rk3328
    - memstick: r592: Fix error return in r592_probe()
    - net/mlx5: Properly convey driver version to firmware
    - ASoC: jz4740-i2s: add missed checks for clk_get()
    - dm ioctl: fix error return code in target_message
    - clocksource/drivers/arm_arch_timer: Correct fault programming of
      CNTKCTL_EL1.EVNTI
    - cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
    - cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
    - cpufreq: st: Add missing MODULE_DEVICE_TABLE
    - cpufreq: loongson1: Add missing MODULE_ALIAS
    - cpufreq: scpi: Add missing MODULE_ALIAS
    - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
    - scsi: pm80xx: Fix error return in pm8001_pci_probe()
    - seq_buf: Avoid type mismatch for seq_buf_init
    - scsi: fnic: Fix error return code in fnic_probe()
    - powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
    - powerpc/pseries/hibernation: remove redundant cacheinfo update
    - usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
    - usb: oxu210hp-hcd: Fix memory leak in oxu_create
    - speakup: fix uninitialized flush_lock
    - nfsd: Fix message level for normal termination
    - nfs_common: need lock during iterate through the list
    - x86/kprobes: Restore BTF if the single-stepping is cancelled
    - clk: tegra: Fix duplicated SE clock entry
    - extcon: max77693: Fix modalias string
    - ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
    - irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
    - watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
    - um: chan_xterm: Fix fd leak
    - nfc: s3fwrn5: Release the nfc firmware
    - powerpc/ps3: use dma_mapping_error()
    - checkpatch: fix unescaped left brace
    - net: bcmgenet: Fix a resource leak in an error handling path in the probe
      functin
    - net: allwinner: Fix some resources leak in the error handling path of the
      probe and in the remove function
    - net: korina: fix return value
    - watchdog: qcom: Avoid context switch in restart handler
    - watchdog: coh901327: add COMMON_CLK dependency
    - clk: ti: Fix memleak in ti_fapll_synth_setup
    - pwm: zx: Add missing cleanup in error path
    - pwm: lp3943: Dynamically allocate PWM chip base
    - perf record: Fix memory leak when using '--user-regs=?' to list registers
    - qlcnic: Fix error code in probe
    - clk: s2mps11: Fix a resource leak in error handling paths in the probe
      function
    - clk: sunxi-ng: Make sure divider tables have sentinel
    - cfg80211: initialize rekey_data
    - fix namespaced fscaps when !CONFIG_SECURITY
    - Input: cros_ec_keyb - send 'scancodes' in addition to key events
    - Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
    - media: gspca: Fix memory leak in probe
    - media: sunxi-cir: ensure IR is handled when it is continuous
    - media: netup_unidvb: Don't leak SPI master in probe error path
    - Input: cyapa_gen6 - fix out-of-bounds stack access
    - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
    - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources
      walks"
    - ACPI: PNP: compare the string length in the matching_id()
    - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
    - ALSA: pcm: oss: Fix a few more UBSAN fixes
    - ALSA: usb-audio: Disable sample read check if firmware doesn't give back
    - s390/smp: perform initial CPU reset also for SMT siblings
    - s390/dasd: prevent inconsistent LCU device data
    - s390/dasd: fix list corruption of pavgroup group list
    - s390/dasd: fix list corruption of lcu list
    - staging: comedi: mf6x4: Fix AI end-of-conversion detection
    - powerpc/perf: Exclude kernel samples while counting events in user space.
    - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
    - EDAC/amd64: Fix PCI component registration
    - USB: serial: mos7720: fix parallel-port state restore
    - USB: serial: keyspan_pda: fix dropped unthrottle interrupts
    - USB: serial: keyspan_pda: fix write deadlock
    - USB: serial: keyspan_pda: fix stalled writes
    - USB: serial: keyspan_pda: fix write-wakeup use-after-free
    - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
    - USB: serial: keyspan_pda: fix write unthrottling
    - ext4: fix a memory leak of ext4_free_data
    - ext4: fix deadlock with fs freezing and EA inodes
    - KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
    - ARM: dts: at91: sama5d2: fix CAN message ram offset and size
    - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
    - powerpc/xmon: Change printk() to pr_cont()
    - powerpc/powernv/memtrace: Don't leak kernel memory to user space
    - ima: Don't modify file descriptor mode on the fly
    - ceph: fix race in concurrent __ceph_remove_cap invocations
    - jffs2: Fix GC exit abnormally
    - jfs: Fix array index bounds check in dbAdjTree
    - drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
    - spi: spi-sh: Fix use-after-free on unbind
    - spi: davinci: Fix use-after-free on unbind
    - spi: pic32: Don't leak DMA channels in probe error path
    - spi: rb4xx: Don't leak SPI master in probe error path
    - spi: sc18is602: Don't leak SPI master in probe error path
    - spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
    - soc: qcom: smp2p: Safely acquire spinlock without IRQs
    - mtd: parser: cmdline: Fix parsing of part-names with colons
    - iio: buffer: Fix demux update
    - iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in
      rockchip_saradc_resume
    - iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
    - iio:pressure:mpl3115: Force alignment of buffer
    - iio:imu:bmi160: Fix too large a buffer.
    - md/cluster: fix deadlock when node is doing resync job
    - clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
    - xen-blkback: set ring->xenblkd to NULL after kthread_stop()
    - xen/xenbus: Allow watches discard events before queueing
    - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
    - xen/xenbus/xen_bus_type: Support will_handle watch callback
    - xen/xenbus: Count pending messages for each watch
    - xenbus/xenbus_backend: Disallow pending watch messages
    - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace
      labels
    - PCI: Fix pci_slot_release() NULL pointer dereference
    - Kbuild: do not emit debug info for assembly with LLVM_IAS=1
    - x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
    - powerpc: Drop -me200 addition to build flags
    - platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
    - x86/apic/vector: Fix ordering in vector assignment
    - tcp: select sane initial rcvq_space.space for big MSS
    - arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
    - block: factor out requeue handling from dispatch code
    - ixgbe: avoid premature Rx buffer reuse
    - scsi: megaraid_sas: Check user-provided offsets
    - drm/tve200: Fix handling of platform_get_irq() error
    - x86/apic: Fix x2apic enablement without interrupt remapping
    - crypto: talitos - Endianess in current_desc_hdr()
    - arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
    - media: tm6000: Fix sizeof() mismatches
    - video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
    - usb/max3421: fix return error code in max3421_probe()
    - spi: mxs: fix reference leak in mxs_spi_probe
    - crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
    - spi: fix resource leak for drivers without .remove callback
    - dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
    - power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
    - PCI: Bounds-check command-line resource alignment requests
    - PCI: Fix overflow in command-line resource alignment requests
    - arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
    - platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
    - bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
    - mac80211: don't set set TDLS STA bandwidth wider than possible
    - watchdog: Fix potential dereferencing of null pointer
    - um: tty: Fix handling of close in tty lines
    - libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
    - ARM: sunxi: Add machine match for the Allwinner V3 SoC
    - lwt: Disable BH too in run_lwt_bpf()
    - ALSA: hda: Fix regressions on clear and reconfig sysfs
    - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
    - ALSA: hda/realtek: Add quirk for MSI-GP73
    - ALSA: hda/realtek: Apply jack fixup for Quanta NL3
    - s390/dasd: fix hanging device offline processing
    - USB: serial: digi_acceleport: fix write-wakeup deadlocks
    - powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
    - ubifs: wbuf: Don't leak kernel memory to flash
    - scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
    - scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
    - pinctrl: sunxi: Always call chained_irq_{enter, exit} in
      sunxi_pinctrl_irq_handler
  * MSFT Touchpad not working on Lenovo Legion-5 15ARH05 (LP: #1887190) //
    Bionic update: upstream stable patchset 2021-01-12 (LP: #1911331)
    - pinctrl: amd: remove debounce filter setting in IRQ type setting
  * Bionic update: upstream stable patchset 2021-01-07 (LP: #1910599)
    - i2c: imx: use clk notifier for rate changes
    - i2c: imx: Fix external abort on interrupt in exit paths
    - gpio: mockup: fix resource leak in error path
    - powerpc/8xx: Always fault when _PAGE_ACCESSED is not set
    - Input: sunkbd - avoid use-after-free in teardown paths
    - mac80211: always wind down STA state
    - can: proc: can_remove_proc(): silence remove_proc_entry warning
    - KVM: x86: clflushopt should be treated as a no-op by emulation
    - ACPI: GED: fix -Wformat
    - ah6: fix error return code in ah6_input()
    - atm: nicstar: Unmap DMA on send error
    - bnxt_en: read EEPROM A2h address using page 0
    - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
    - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
    - mlxsw: core: Use variable timeout for EMAD retries
    - net: b44: fix error return code in b44_init_one()
    - net: bridge: add missing counters to ndo_get_stats64 callback
    - net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
    - net: Have netpoll bring-up DSA management interface
    - netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
    - netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
    - net/mlx4_core: Fix init_hca fields offset
    - net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
    - qlcnic: fix error return code in qlcnic_83xx_restart_hw()
    - sctp: change to hold/put transport for proto_unreach_timer
    - net/mlx5: Disable QoS when min_rates on all VFs are zero
    - net: usb: qmi_wwan: Set DTR quirk for MR400
    - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
    - net: ftgmac100: Fix crash when removing driver
    - pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
    - arm64: psci: Avoid printing in cpu_psci_cpu_die()
    - vfs: remove lockdep bogosity in __sb_start_write
    - Input: adxl34x - clean up a data type in adxl34x_probe()
    - MIPS: export has_transparent_hugepage() for modules
    - arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
    - ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
    - perf lock: Don't free "lock_seq_stat" if read_count isn't zero
    - can: af_can: prevent potential access of uninitialized member in can_rcv()
    - can: af_can: prevent potential access of uninitialized member in canfd_rcv()
    - can: dev: can_restart(): post buffer from the right context
    - can: ti_hecc: Fix memleak in ti_hecc_probe
    - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
      can_put_echo_skb()
    - can: peak_usb: fix potential integer overflow on shift of a int
    - can: m_can: m_can_handle_state_change(): fix state change
    - ASoC: qcom: lpass-platform: Fix memory leak
    - MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
    - regulator: ti-abb: Fix array out of bound read access on the first
      transition
    - xfs: revert "xfs: fix rmap key and record comparison functions"
    - libfs: fix error cast of negative value in simple_attr_write()
    - powerpc/uaccess-flush: fix missing includes in kup-radix.h
    - speakup: Do not let the line discipline be used several times
    - ALSA: ctl: fix error path at adding user-defined element set
    - ALSA: mixart: Fix mutex deadlock
    - tty: serial: imx: keep console clocks always on
    - efivarfs: fix memory leak in efivarfs_create()
    - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
    - ext4: fix bogus warning in ext4_update_dx_flag()
    - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
    - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-
      mode
    - regulator: fix memory leak with repeated set_machine_constraints()
    - regulator: avoid resolve_supply() infinite recursion
    - regulator: workaround self-referent regulators
    - xtensa: disable preemption around cache alias management calls
    - mac80211: minstrel: remove deferred sampling code
    - mac80211: minstrel: fix tx status processing corner case
    - mac80211: free sta in sta_info_insert_finish() on errors
    - s390/cpum_sf.c: fix file permission for cpum_sfb_size
    - s390/dasd: fix null pointer dereference for ERP requests
    - x86/microcode/intel: Check patch signature before saving microcode for early
      loading
    - net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
    - page_frag: Recover from memory pressure
    - qed: fix error return code in qed_iwarp_ll2_start()
    - scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
    - arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
    - arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
    - Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
    - ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet
      PHY
    - arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
    - arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
    - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
    - ALSA: usb-audio: Add delay quirk for all Logitech USB devices
    - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
    - ptrace: Set PF_SUPERPRIV when checking capability
    - seccomp: Set PF_SUPERPRIV when checking capability
    - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
    - perf event: Check ref_reloc_sym before using it
    - btrfs: fix lockdep splat when reading qgroup config on mount
    - wireless: Use linux/stddef.h instead of stddef.h
    - btrfs: adjust return values of btrfs_inode_by_name
    - arm64: pgtable: Fix pte_accessible()
    - arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect()
    - ALSA: hda/hdmi: Use single mutex unlock in error paths
    - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
    - HID: cypress: Support Varmilo Keyboards' media hotkeys
    - Input: i8042 - allow insmod to succeed on devices without an i8042
      controller
    - HID: hid-sensor-hub: Fix issue with devices with no report ID
    - dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant
    - x86/xen: don't unbind uninitialized lock_kicker_irq
    - HID: Add Logitech Dinovo Edge battery quirk
    - proc: don't allow async path resolution of /proc/self components
    - nvme: free sq/cq dbbuf pointers when dbbuf set fails
    - dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
    - scsi: libiscsi: Fix NOP race condition
    - scsi: target: iscsi: Fix cmd abort fabric stop race
    - perf/x86: fix sysfs type mismatches
    - phy: tegra: xusb: Fix dangling pointer on probe failure
    - batman-adv: set .owner to THIS_MODULE
    - scsi: ufs: Fix race between shutdown and runtime resume flow
    - bnxt_en: fix error return code in bnxt_init_one()
    - bnxt_en: fix error return code in bnxt_init_board()
    - video: hyperv_fb: Fix the cache type when mapping the VRAM
    - bnxt_en: Release PCI regions when DMA mask setup fails during probe.
    - IB/mthca: fix return value of error branch in mthca_init_cq()
    - nfc: s3fwrn5: use signed integer for parsing GPIO numbers
    - net: ena: set initial DMA width to avoid intel iommu issue
    - ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
    - ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
    - efivarfs: revert "fix memory leak in efivarfs_create()"
    - can: gs_usb: fix endianess problem with candleLight firmware
    - platform/x86: toshiba_acpi: Fix the wrong variable assignment
    - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1
    - perf probe: Fix to die_entrypc() returns error correctly
    - USB: core: Change %pK for __user pointers to %px
    - usb: gadget: f_midi: Fix memleak in f_midi_alloc
    - usb: gadget: Fix memleak in gadgetfs_fill_super
    - x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
    - x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak
    - x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak
    - USB: core: Fix regression in Hercules audio card
    - btrfs: don't access possibly stale fs_info data for printing duplicate
      device
    - KVM: x86: Fix split-irqchip vs interrupt injection window request
    - HID: add support for Sega Saturn
    - cxgb4: fix the panic caused by non smac rewrite
    - s390/qeth: fix tear down of async TX buffers
    - platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time
    - USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO
      built-in usb-audio card
    - net/af_iucv: set correct sk_protocol for child sockets
    - rose: Fix Null pointer dereference in rose_send_frame()
    - sock: set sk_err to ee_errno on dequeue from errq
    - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control
    - tun: honor IOCB_NOWAIT flag
    - usbnet: ipheth: fix connectivity with iOS 14
    - bonding: wait for sysfs kobject destruction before freeing struct slave
    - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
    - ipv4: Fix tos mask in inet_rtm_getroute()
    - ibmvnic: Ensure that SCRQ entry reads are correctly ordered
    - ibmvnic: Fix TX completion error handling
    - net/x25: prevent a couple of overflows
    - cxgb3: fix error return code in t3_sge_alloc_qset()
    - net: pasemi: fix error return code in pasemi_mac_open()
    - net/mlx5: Fix wrong address reclaim when command interface is down
    - dt-bindings: net: correct interrupt flags in examples
    - ALSA: usb-audio: US16x08: fix value count for level meters
    - Input: xpad - support Ardwiino Controllers
    - RDMA/i40iw: Address an mmap handler exploit in i40iw
    - ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
    - ibmvnic: fix call_netdevice_notifiers in do_reset
    - i40e: Fix removing driver while bare-metal VFs pass traffic
    - geneve: pull IP header before ECN decapsulation
    - pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq
      pin to output
    - pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(...,
      GPIOD_OUT_HIGH)
    - vlan: consolidate VLAN parsing code and limit max parsing depth
    - usb: gadget: f_fs: Use local copy of descriptors for userspace copy
    - USB: serial: kl5kusb105: fix memleak on open
    - USB: serial: ch341: add new Product ID for CH341A
    - USB: serial: ch341: sort device-id entries
    - USB: serial: option: add Fibocom NL668 variants
    - USB: serial: option: add support for Thales Cinterion EXS82
    - USB: serial: option: fix Quectel BG96 matching
    - tty: Fix ->pgrp locking in tiocspgrp()
    - tty: Fix ->session locking
    - ALSA: hda/realtek - Add new codec supported for ALC897
    - ALSA: hda/generic: Add option to enforce preferred_dacs pairs
    - ftrace: Fix updating FTRACE_FL_TRAMP
    - cifs: fix potential use-after-free in cifs_echo_request()
    - mm/swapfile: do not sleep with a spin lock held
    - i2c: imx: Fix reset of I2SR_IAL flag
    - i2c: imx: Check for I2SR_IAL after every byte
    - speakup: Reject setting the speakup line discipline outside of speakup
    - iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
    - spi: Introduce device-managed SPI controller allocation
    - spi: bcm-qspi: Fix use-after-free on unbind
    - spi: bcm2835: Fix use-after-free on unbind
    - spi: bcm2835: Release the DMA channel if probe fails after dma_init
    - tracing: Fix userstacktrace option for instances
    - gfs2: check for empty rgrp tree in gfs2_ri_update
    - i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
    - Input: i8042 - fix error return code in i8042_setup_aux()
    - x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
    - ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
    - x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes
      bytes
    - Revert "geneve: pull IP header before ECN decapsulation"

  [ Ubuntu: 4.15.0-135.139 ]

  * bionic/linux: 4.15.0-135.139 -proposed tracker (LP: #1912223)
  * [drm:qxl_enc_commit [qxl]] *ERROR* head number too large or missing monitors
    config: (LP: #1908219)
    - qxl: remove qxl_io_log()
    - qxl: move qxl_send_monitors_config()
    - qxl: hook monitors_config updates into crtc, not encoder.
  * Touchpad not detected on ByteSpeed C15B laptop (LP: #1906128)
    - Input: i8042 - add ByteSpeed touchpad to noloop table
  * vmx_nm_test in ubuntu_kvm_unit_tests interrupted on X-oracle-4.15 /
    B-oracle-4.15 / X-KVM / B-KVM (LP: #1872401)
    - KVM: nVMX: Always reflect #NM VM-exits to L1
  * stack trace in kernel (LP: #1903596)
    - net: napi: remove useless stack trace
  * CVE-2020-27777
    - [Config]: Set CONFIG_PPC_RTAS_FILTER
  * Bionic update: upstream stable patchset 2020-12-04 (LP: #1906875)
    - regulator: defer probe when trying to get voltage from unresolved supply
    - ring-buffer: Fix recursion protection transitions between interrupt context
    - time: Prevent undefined behaviour in timespec64_to_ns()
    - nbd: don't update block size after device is started
    - btrfs: sysfs: init devices outside of the chunk_mutex
    - btrfs: reschedule when cloning lots of extents
    - genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
    - hv_balloon: disable warning when floor reached
    - net: xfrm: fix a race condition during allocing spi
    - perf tools: Add missing swap for ino_generation
    - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
    - can: rx-offload: don't call kfree_skb() from IRQ context
    - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ
      context
    - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR
      frames
    - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
    - can: peak_usb: add range checking in decode operations
    - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
    - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is
      on
    - xfs: flush new eof page on truncate to avoid post-eof corruption
    - Btrfs: fix missing error return if writeback for extent buffer never started
    - ath9k_htc: Use appropriate rs_datalen type
    - usb: gadget: goku_udc: fix potential crashes in probe
    - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    - gfs2: Add missing truncate_inode_pages_final for sd_aspace
    - gfs2: check for live vs. read-only file system in gfs2_fitrim
    - scsi: hpsa: Fix memory leak in hpsa_init_one()
    - drm/amdgpu: perform srbm soft reset always on SDMA resume
    - mac80211: fix use of skb payload instead of header
    - cfg80211: regulatory: Fix inconsistent format argument
    - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
    - iommu/amd: Increase interrupt remapping table limit to 512 entries
    - pinctrl: intel: Set default bias in case no particular value given
    - ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
    - pinctrl: aspeed: Fix GPI only function problem.
    - nbd: fix a block_device refcount leak in nbd_release
    - xfs: fix flags argument to rmap lookup when converting shared file rmaps
    - xfs: fix rmap key and record comparison functions
    - xfs: fix a missing unlock on error in xfs_fs_map_blocks
    - of/address: Fix of_node memory leak in of_dma_is_coherent
    - cosa: Add missing kfree in error path of cosa_write
    - perf: Fix get_recursion_context()
    - ext4: correctly report "not supported" for {usr,grp}jquota when
      !CONFIG_QUOTA
    - ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
    - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
    - uio: Fix use-after-free in uio_unregister_device()
    - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
    - mei: protect mei_cl_mtu from null dereference
    - futex: Don't enable IRQs unconditionally in put_pi_state()
    - ocfs2: initialize ip_next_orphan
    - selinux: Fix error return code in sel_ib_pkey_sid_slow()
    - don't dump the threads that had been already exiting when zapped.
    - drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
    - pinctrl: amd: use higher precision for 512 RtcClk
    - pinctrl: amd: fix incorrect way to disable debounce filter
    - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
    - IPv6: Set SIT tunnel hard_header_len to zero
    - net/af_iucv: fix null pointer dereference on shutdown
    - net/x25: Fix null-ptr-deref in x25_connect
    - vrf: Fix fast path output packet handling with async Netfilter rules
    - r8169: fix potential skb double free in an error path
    - net: Update window_clamp if SOCK_RCVBUF is set
    - random32: make prandom_u32() output unpredictable
    - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-
      on STIBP
    - perf/core: Fix bad use of igrab()
    - perf/core: Fix crash when using HW tracing kernel filters
    - perf/core: Fix a memory leak in perf_event_parse_addr_filter()
    - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
    - reboot: fix overflow parsing reboot cpu number
    - Convert trailing spaces and periods in path components
    - xfs: fix scrub flagging rtinherit even if there is no rt device
    - drm/amd/pm: perform SMC reset on suspend/hibernation
    - drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
    - s390/smp: move rcu_cpu_starting() earlier
    - tpm_tis: Disable interrupts on ThinkPad T490s
    - tick/common: Touch watchdog in tick_unfreeze() on all CPUs
    - mfd: sprd: Add wakeup capability for PMIC IRQ
    - btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
    - thunderbolt: Fix memory leak if ida_simple_get() fails in
      enumerate_services()
    - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
    - mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove

  [ Ubuntu: 4.15.0-134.138 ]

  * Packaging resync (LP: #1786013)
    - update dkms package versions

Date: 2021-02-03 04:47:09.585215+00:00
Changed-By: Khaled El Mously <khalid.elmously at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1093.106
-------------- next part --------------
Sorry, changesfile not available.


More information about the Bionic-changes mailing list