linux-azure-4.15 (4.15.0-1149.164) bionic; urgency=medium

  [ Ubuntu: 4.15.0-191.202 ]

  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0
  * CVE-2022-34918
    - netfilter: nf_tables: stricter validation of element data
  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 04 Aug 2022 19:11:41 +0200

linux-azure-4.15 (4.15.0-1148.163) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1148.163 -proposed tracker (LP: #1983495)

  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Wed, 03 Aug 2022 15:03:09 -0300

linux-azure-4.15 (4.15.0-1147.162) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1147.162 -proposed tracker (LP: #1981301)

  * Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355)
    - [Config] updateconfigs for NVM, NVM_PBLK

  [ Ubuntu: 4.15.0-190.201 ]

  * bionic/linux: 4.15.0-190.201 -proposed tracker (LP: #1981321)
  * CVE-2022-1679
    - SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
  * Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879)
    - MIPS: Use address-of operator on section symbols
    - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
    - can: grcan: grcan_probe(): fix broken system id check for errata workaround
      needs
    - can: grcan: only use the NAPI poll budget for RX
    - Bluetooth: Fix the creation of hdev->name
    - mmc: rtsx: add 74 Clocks in power on flow
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
    - ALSA: pcm: Fix races among concurrent prealloc proc writes
    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
    - VFS: Fix memory leak caused by concurrently mounting fs with subtype
    - batman-adv: Don't skb_split skbuffs with frag_list
    - net: Fix features skip in for_each_netdev_feature()
    - ipv4: drop dst in multicast routing path
    - netlink: do not reset transport header in netlink_recvmsg()
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - hwmon: (ltq-cputemp) restrict it to SOC_XWAY
    - s390/ctcm: fix variable dereferenced before check
    - s390/ctcm: fix potential memory leak
    - s390/lcs: fix variable dereferenced before check
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - hwmon: (f71882fg) Fix negative temperature
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - tcp: resalt the secret every 10 seconds
    - usb: cdc-wdm: fix reading stuck on device close
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
    - drm/vmwgfx: Initialize drm_mode_fb_cmd2
    - ping: fix address binding wrt vrf
    - tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
    - net/sched: act_pedit: really ensure the skb is writable
    - um: Cleanup syscall_handler_t definition/cast, fix warning
    - Input: add bounds checking to input_set_capability()
    - Input: stmfts - fix reference leak in stmfts_input_open
    - MIPS: lantiq: check the return value of kzalloc()
    - drbd: remove usage of list iterator variable after loop
    - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
    - ALSA: wavefront: Proper check of get_user() error
    - perf: Fix sys_perf_event_open() race against self
    - drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
    - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
    - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
    - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
    - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
    - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
    - clk: at91: generated: consider range when calculating best rate
    - net/qla3xxx: Fix a test in ql_reset_work()
    - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
    - ARM: 9196/1: spectre-bhb: enable for Cortex-A15
    - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
    - igb: skip phy status check where unavailable
    - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
    - gpio: gpio-vf610: do not touch other bits when set the target bit
    - gpio: mvebu/pwm: Refuse requests with inverted polarity
    - perf bench numa: Address compiler error on s390
    - scsi: qla2xxx: Fix missed DMA unmap for aborted commands
    - mac80211: fix rx reordering with non explicit / psmp ack policy
    - ethernet: tulip: fix missing pci_disable_device() on error in
      tulip_init_one()
    - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
    - net: atlantic: verify hw_head_ lies within TX buffer ring
    - swiotlb: fix info leak with DMA_FROM_DEVICE
    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
    - net: macb: Increment rx bd head after allocating skb and buffer
    - net/sched: act_pedit: sanitize shift argument before usage
    - afs: Fix afs_getattr() to refetch file status if callback break occurred
    - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
    - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
    - tcp: change source port randomizarion at connect() time
    - secure_seq: use the 64 bits of the siphash for port offset calculation
    - ACPI: sysfs: Make sparse happy about address space in use
    - Revert "UBUNTU: SAUCE: ACPI: sysfs: copy ACPI data using io memory copying"
    - ACPI: sysfs: Fix BERT error region memory mapping
    - net: af_key: check encryption module availability consistency
    - net: ftgmac100: Disable hardware checksum on AST2600
    - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI
      controllers
    - assoc_array: Fix BUG_ON during garbage collect
    - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
    - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
    - exec: Force single empty string when argv is empty
    - netfilter: conntrack: re-fetch conntrack after insertion
    - zsmalloc: fix races between asynchronous zspage free and page migration
    - dm integrity: fix error code in dm_integrity_ctr()
    - dm crypt: make printing of the key constant-time
    - dm stats: add cond_resched when looping over entries
    - dm verity: set DM_TARGET_IMMUTABLE feature flag
    - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
    - docs: submitting-patches: Fix crossref to 'The canonical patch format'
    - NFSD: Fix possible sleep during nfsd4_release_lockowner()
    - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
  * Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355)
    - floppy: disable FDRAWCMD by default
    - [Config] updateconfigs for BLK_DEV_FD_RAWCMD
    - hamradio: defer 6pack kfree after unregister_netdev
    - hamradio: remove needs_free_netdev to avoid UAF
    - lightnvm: disable the subsystem
    - [Config] updateconfigs for NVM, NVM_PBLK
    - usb: mtu3: fix USB 3.0 dual-role-switch from device to host
    - USB: quirks: add a Realtek card reader
    - USB: quirks: add STRING quirk for VCOM device
    - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
    - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
    - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
    - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
    - xhci: stop polling roothubs after shutdown
    - iio: dac: ad5592r: Fix the missing return value.
    - iio: dac: ad5446: Fix read_raw not returning set value
    - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
    - usb: misc: fix improper handling of refcount in uss720_probe()
    - usb: gadget: uvc: Fix crash when encoding data for usb request
    - usb: gadget: configfs: clear deactivation flag in
      configfs_composite_unbind()
    - serial: 8250: Also set sticky MCR bits in console restoration
    - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
    - hex2bin: make the function hex_to_bin constant-time
    - hex2bin: fix access beyond string end
    - USB: Fix xhci event ring dequeue pointer ERDP update issue
    - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
    - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
    - phy: samsung: exynos5250-sata: fix missing device put in probe error paths
    - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
    - ARM: dts: Fix mmc order for omap3-gta04
    - ipvs: correctly print the memory size of ip_vs_conn_tab
    - mtd: rawnand: Fix return value check of wait_for_completion_timeout
    - sctp: check asoc strreset_chunk in sctp_generate_reconf_event
    - pinctrl: pistachio: fix use of irq_of_parse_and_map()
    - ip_gre: Make o_seqno start from 0 in native mode
    - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
    - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
    - clk: sunxi: sun9i-mmc: check return value after calling
      platform_get_resource()
    - net: bcmgenet: hide status block before TX timestamping
    - bnx2x: fix napi API usage sequence
    - ASoC: wm8731: Disable the regulator when probing fails
    - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
    - cifs: destage any unwritten data to the server before calling
      copychunk_write
    - drivers: net: hippi: Fix deadlock in rr_close()
    - x86/cpu: Load microcode during restore_processor_state()
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
    - tty: n_gsm: fix malformed counter for out of frame data
    - tty: n_gsm: fix insufficient txframe size
    - tty: n_gsm: fix missing explicit ldisc flush
    - tty: n_gsm: fix wrong command retry handling
    - tty: n_gsm: fix wrong command frame length field encoding
    - tty: n_gsm: fix incorrect UA handling
    - MIPS: Fix CP0 counter erratum detection for R4k CPUs
    - parisc: Merge model and model name into one line in /proc/cpuinfo
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
    - firewire: fix potential uaf in outbound_phy_packet_callback()
    - firewire: remove check of list iterator against head past the loop body
    - firewire: core: extend card->lock in fw_core_handle_bus_reset
    - ASoC: wm8958: Fix change notifications for DSP controls
    - can: grcan: grcan_close(): fix deadlock
    - can: grcan: use ofdev->dev when allocating DMA memory
    - nfc: replace improper check device_is_registered() in netlink related
      functions
    - NFC: netlink: fix sleep in atomic bug when firmware download timeout
    - hwmon: (adt7470) Fix warning on module removal
    - ASoC: dmaengine: Restore NULL prepare_slave_config() callback
    - net: emaclite: Add error handling for of_address_to_resource()
    - smsc911x: allow using IRQ0
    - btrfs: always log symlinks in full mode
    - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
    - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
    - net: ipv6: ensure we call ipv6_mc_down() at most once
    - dm: fix mempool NULL pointer race when completing IO
    - dm: interlock pending dm_io and dm_wait_for_bios_completion
    - PCI: aardvark: Clear all MSIs at setup
    - PCI: aardvark: Fix reading MSI interrupt number
    - tcp: md5: incorrect tcp_header_len for incoming connections
    - net: hns3: add validity check for message data length
    - genirq: Synchronize interrupt thread startup
    - net: stmmac: dwmac-sun8i: add missing of_node_put() in
      sun8i_dwmac_register_mdio_mux()
    - mm: fix unexpected zeroed page mapping with zram swap
  * unprivileged tests in test_verifier from ubuntu_bpf failed with "Failed to
    load prog 'Operation not permitted'" on B-4.15 (LP: #1980648)
    - selftests/bpf: Count tests skipped by unpriv
    - selftests/bpf: Only run tests if !bpf_disabled
  * CVE-2022-1734
    - nfc: nfcmrvl: main: reorder destructive operations in
      nfcmrvl_nci_unregister_dev to avoid bugs
  * CVE-2022-1652
    - floppy: use a statically allocated error counter

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Wed, 27 Jul 2022 14:25:06 -0300

linux-azure-4.15 (4.15.0-1146.161) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1146.161 -proposed tracker (LP: #1979504)

  [ Ubuntu: 4.15.0-189.200 ]

  * bionic/linux: 4.15.0-189.200 -proposed tracker (LP: #1979525)
  * linux-image-4.15.0-177-generic freezes on the welcome screen (LP: #1973167)
    - mfd: intel-lpss: Use MODULE_SOFTDEP() instead of implicit request
  * Bionic update: upstream stable patchset 2022-06-03 (LP: #1977622)
    - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
    - mm: page_alloc: fix building error on -Werror=array-compare
    - tracing: Dump stacktrace trigger to the corresponding instance
    - gfs2: assign rgrp glock before compute_bitstructs
    - ALSA: usb-audio: Clear MIDI port active flag after draining
    - tcp: fix race condition when creating child sockets from syncookies
    - tcp: Fix potential use-after-free due to double kfree()
    - dmaengine: imx-sdma: Fix error checking in sdma_event_remap
    - net/packet: fix packet_sock xmit return value checking
    - netlink: reset network and mac headers in netlink_dump()
    - ARM: vexpress/spc: Avoid negative array index when !SMP
    - platform/x86: samsung-laptop: Fix an unsigned comparison which can never be
      negative
    - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the
      constant
    - vxlan: fix error return code in vxlan_fdb_append
    - cifs: Check the IOCB_DIRECT flag, not O_DIRECT
    - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
    - drm/msm/mdp5: check the return of kzalloc()
    - net: macb: Restart tx only if queue pointer is lagging
    - stat: fix inconsistency between struct stat and struct compat_stat
    - ata: pata_marvell: Check the 'bmdma_addr' beforing reading
    - dma: at_xdmac: fix a missing check on list iterator
    - powerpc/perf: Fix power9 event alternatives
    - openvswitch: fix OOB access in reserve_sfa_size()
    - ASoC: soc-dapm: fix two incorrect uses of list iterator
    - e1000e: Fix possible overflow in LTR decoding
    - ARC: entry: fix syscall_trace_exit argument
    - ext4: fix symlink file size not match to file content
    - ext4: fix overhead calculation to account for the reserved gdt blocks
    - ext4: force overhead calculation if the s_overhead_cluster makes no sense
    - staging: ion: Prevent incorrect reference counting behavour
    - block/compat_ioctl: fix range check in BLKGETSIZE
    - ax25: add refcount in ax25_dev to avoid UAF bugs
    - ax25: fix reference count leaks of ax25_dev
    - ax25: fix UAF bugs of net_device caused by rebinding operation
    - ax25: Fix refcount leaks caused by ax25_cb_del()
    - ax25: fix UAF bug in ax25_send_control()
    - ax25: fix NPD bug in ax25_disconnect
    - ax25: Fix NULL pointer dereferences in ax25 timers
    - ax25: Fix UAF bugs in ax25 timers
    - ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
    - net/sched: cls_u32: fix possible leak in u32_init_knode()
    - drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
    - drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
  * Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831)
    - USB: serial: pl2303: add IBM device IDs
    - USB: serial: simple: add Nokia phone driver
    - netdevice: add the case if dev is NULL
    - virtio_console: break out of buf poll on remove
    - ethernet: sun: Free the coherent when failing in probing
    - spi: Fix invalid sgs value
    - spi: Fix erroneous sgs value with min_t()
    - af_key: add __GFP_ZERO flag for compose_sadb_supported in function
      pfkey_register
    - fuse: fix pipe buffer lifetime for direct_io
    - tpm: fix reference counting for struct tpm_chip
    - block: Add a helper to validate the block size
    - virtio-blk: Use blk_validate_block_size() to validate block size
    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
    - coresight: Fix TRCCONFIGR.QE sysfs interface
    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
    - iio: inkern: apply consumer scale when no channel scale is available
    - iio: inkern: make a best effort on offset calculation
    - clk: uniphier: Fix fixed-rate initialization
    - Documentation: add link to stable release candidate tree
    - Documentation: update stable tree link
    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
    - NFSD: prevent underflow in nfssvc_decode_writeargs()
    - pinctrl: samsung: drop pin banks references on error paths
    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
    - jffs2: fix memory leak in jffs2_do_mount_fs
    - jffs2: fix memory leak in jffs2_scan_medium
    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
    - mempolicy: mbind_range() set_policy() after vma_merge()
    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
    - qed: display VF trust config
    - qed: validate and restrict untrusted VFs vlan promisc mode
    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
    - ALSA: cs4236: fix an incorrect NULL check on list iterator
    - drbd: fix potential silent data corruption
    - ACPI: properties: Consistently return -ENOENT if there are no more
      references
    - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
    - video: fbdev: sm712fb: Fix crash in smtcfb_read()
    - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
    - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
    - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
    - ARM: dts: exynos: add missing HDMI supplies on SMDK5250
    - ARM: dts: exynos: add missing HDMI supplies on SMDK5420
    - carl9170: fix missing bit-wise or operator for tx_params
    - thermal: int340x: Increase bitmap size
    - lib/raid6/test: fix multiple definition linking error
    - DEC: Limit PMAX memory probing to R3k systems
    - media: davinci: vpif: fix unbalanced runtime PM get
    - brcmfmac: firmware: Allocate space for default boardrev in nvram
    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
    - PCI: pciehp: Clear cmd_busy bit in polling mode
    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
    - crypto: mxs-dcp - Fix scatterlist processing
    - spi: tegra114: Add missing IRQ check in tegra_spi_probe
    - selftests/x86: Add validity check and allow field splitting
    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
    - hwmon: (pmbus) Add mutex to regulator ops
    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
    - PM: hibernate: fix __setup handler error handling
    - PM: suspend: fix return value of __setup handler
    - hwrng: atmel - disable trng on failure path
    - crypto: vmx - add missing dependencies
    - ACPI: APEI: fix return value of __setup handlers
    - crypto: ccp - ccp_dmaengine_unregister release dma channels
    - hwmon: (pmbus) Add Vin unit off handling
    - clocksource: acpi_pm: fix return value of __setup handler
    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
    - perf/core: Fix address filter parser for multiple filters
    - perf/x86/intel/pt: Fix address filter config for 32-bit kernel
    - media: coda: Fix missing put_device() call in coda_get_vdoa_data
    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
    - ARM: dts: qcom: ipq4019: fix sleep clock
    - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
    - media: usb: go7007: s2250-board: fix leak in probe()
    - ASoC: ti: davinci-i2s: Add check for clk_enable()
    - ALSA: spi: Add check for clk_enable()
    - arm64: dts: ns2: Fix spi-cpol and spi-cpha property
    - arm64: dts: broadcom: Fix sata nodename
    - printk: fix return value of printk.devkmsg __setup handler
    - ASoC: mxs-saif: Handle errors for clk_enable
    - ASoC: atmel_ssc_dai: Handle errors for clk_enable
    - memory: emif: Add check for setup_interrupts
    - memory: emif: check the pointer temp in get_device_details()
    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
    - media: stk1160: If start stream fails, return buffers with
      VB2_BUF_STATE_QUEUED
    - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
    - ASoC: wm8350: Handle error for wm8350_register_irq
    - ASoC: fsi: Add check for clk_enable
    - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
    - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
    - ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
    - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
      msm8916_wcd_digital_probe
    - mtd: onenand: Check for error irq
    - drm/edid: Don't clear formats if using deep color
    - ath9k_htc: fix uninit value bugs
    - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
    - ray_cs: Check ioremap return value
    - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
    - iwlwifi: Fix -EIO error code that is never returned
    - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
    - scsi: pm8001: Fix abort all task initialization
    - TOMOYO: fix __setup handlers return values
    - ext2: correct max file size computing
    - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
    - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false
      return
    - KVM: x86: Fix emulation in writing cr8
    - KVM: x86/emulator: Defer not-present segment check in
      __load_segment_descriptor()
    - i2c: xiic: Make bus names unique
    - power: supply: wm8350-power: Handle error for wm8350_register_irq
    - power: supply: wm8350-power: Add missing free in free_charger_irq
    - PCI: Reduce warnings on possible RW1C corruption
    - powerpc/sysdev: fix incorrect use to determine if list is empty
    - mfd: mc13xxx: Add check for mc13xxx_irq_request
    - vxcan: enable local echo for sent CAN frames
    - MIPS: RB532: fix return value of __setup handler
    - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
    - af_netlink: Fix shift out of bounds in group mask calculation
    - i2c: mux: demux-pinctrl: do not deactivate a master that is not active
    - tcp: ensure PMTU updates are processed during fastopen
    - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
    - mxser: fix xmit_buf leak in activate when LSR == 0xff
    - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
    - staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
    - serial: 8250_mid: Balance reference count for PCI DMA device
    - serial: 8250: Fix race condition in RTS-after-send handling
    - iio: adc: Add check for devm_request_threaded_irq
    - clk: qcom: clk-rcg2: Update the frac table for pixel clock
    - remoteproc: qcom_wcnss: Add missing of_node_put() in
      wcnss_alloc_memory_region
    - clk: loongson1: Terminate clk_div_table with sentinel element
    - clk: clps711x: Terminate clk_div_table with sentinel element
    - clk: tegra: tegra124-emc: Fix missing put_device() call in
      emc_ensure_emc_driver
    - NFS: remove unneeded check in decode_devicenotify_args()
    - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
    - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
    - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
    - tty: hvc: fix return value of __setup handler
    - kgdboc: fix return value of __setup handler
    - kgdbts: fix return value of __setup handler
    - jfs: fix divide error in dbNextAG
    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
    - xen: fix is_xen_pmu()
    - net: phy: broadcom: Fix brcm_fet_config_init()
    - qlcnic: dcb: default to returning -EOPNOTSUPP
    - net/x25: Fix null-ptr-deref caused by x25_disconnect
    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
    - lib/test: use after free in register_test_dev_kmod()
    - selinux: use correct type for context length
    - loop: use sysfs_emit() in the sysfs xxx show()
    - Fix incorrect type in assignment of ipv6 port for audit
    - irqchip/nvic: Release nvic_base upon failure
    - ACPICA: Avoid walking the ACPI Namespace if it is not there
    - ACPI/APEI: Limit printable size of BERT table data
    - PM: core: keep irq flags in device_pm_check_callbacks()
    - spi: tegra20: Use of_device_get_match_data()
    - ext4: don't BUG if someone dirty pages without asking ext4 first
    - ntfs: add sanity check on allocation size
    - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
    - video: fbdev: w100fb: Reset global state
    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
    - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
    - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
    - ARM: dts: bcm2837: Add the missing L1/L2 cache information
    - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
    - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of
      snprintf()
    - ASoC: soc-core: skip zero num_dai component in searching dai name
    - media: cx88-mpeg: clear interrupt status register before streaming video
    - ARM: tegra: tamonten: Fix I2C3 pad setting
    - ARM: mmp: Fix failure to remove sram device
    - video: fbdev: sm712fb: Fix crash in smtcfb_write()
    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
    - powerpc/lib/sstep: Fix 'sthcx' instruction
    - powerpc/lib/sstep: Fix build errors with newer binutils
    - scsi: qla2xxx: Fix warning for missing error code
    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
    - KVM: Prevent module exit until all VMs are freed
    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
    - ubifs: rename_whiteout: correct old_dir size computing
    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
    - can: mcba_usb: properly check endpoint type
    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
    - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
    - mm/mmap: return 1 from stack_guard_gap __setup() handler
    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
    - ubi: fastmap: Return error code if memory allocation fails in add_aeb()
    - ASoC: topology: Allow TLV control to be either read or write
    - ARM: dts: spear1340: Update serial node properties
    - ARM: dts: spear13xx: Update SPI dma properties
    - openvswitch: Fixed nd target mask field in the flow dump.
    - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
    - rtc: wm8350: Handle error for wm8350_register_irq
    - ARM: 9187/1: JIVE: fix return value of __setup handler
    - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
    - ptp: replace snprintf with sysfs_emit
    - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
    - scsi: mvsas: Replace snprintf() with sysfs_emit()
    - scsi: bfa: Replace snprintf() with sysfs_emit()
    - power: supply: axp20x_battery: properly report current when discharging
    - powerpc: Set crashkernel offset to mid of RMA region
    - PCI: aardvark: Fix support for MSI interrupts
    - iommu/arm-smmu-v3: fix event handling soft lockup
    - dm ioctl: prevent potential spectre v1 gadget
    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
    - net/smc: correct settings of RMB window update limit
    - macvtap: advertise link netns via netlink
    - bnxt_en: Eliminate unintended link toggle during FW reset
    - MIPS: fix fortify panic when copying asm exception handlers
    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
    - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
    - xtensa: fix DTC warning unit_address_format
    - Bluetooth: Fix use after free in hci_send_acl
    - init/main.c: return 1 from handled __setup() functions
    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
    - NFS: swap IO handling is slightly different for O_DIRECT IO
    - NFS: swap-out must always use STABLE writes.
    - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
    - virtio_console: eliminate anonymous module_init & module_exit
    - jfs: prevent NULL deref in diFree
    - parisc: Fix CPU affinity for Lasi, WAX and Dino chips
    - ipv6: add missing tx timestamping on IPPROTO_RAW
    - net: add missing SOF_TIMESTAMPING_OPT_ID support
    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
    - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
    - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
    - drm/imx: Fix memory leak in imx_pd_connector_get_modes
    - drbd: Fix five use after free bugs in get_initial_state
    - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
    - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
    - x86/pm: Save the MSR validity status at context setup
    - x86/speculation: Restore speculation related MSRs during S3 resume
    - btrfs: fix qgroup reserve overflow the qgroup limit
    - arm64: patch_text: Fixup last cpu should be master
    - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
    - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
    - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
    - mm: don't skip swap entry even if zap_details specified
    - arm64: module: remove (NOLOAD) from linker script
    - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
    - cgroup: Use open-time credentials for process migraton perm checks
    - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
    - cgroup: Use open-time cgroup namespace for process migration perm checks
    - memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
    - veth: Ensure eth header is in skb's linear part
    - gpiolib: acpi: use correct format characters
    - mlxsw: i2c: Fix initialization error flow
    - nfc: nci: add flush_workqueue to prevent uaf
    - cifs: potential buffer overflow in handling symlinks
    - drm/amd: Add USBC connector ID
    - drm/amdkfd: Check for potential null return of kmalloc_array()
    - Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
    - scsi: target: tcmu: Fix possible page UAF
    - scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
    - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
    - gpu: ipu-v3: Fix dev_dbg frequency output
    - scsi: mvsas: Add PCI ID of RocketRaid 2640
    - drivers: net: slip: fix NPD bug in sl_tx_timeout()
    - mm, page_alloc: fix build_zonerefs_node()
    - mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
    - gcc-plugins: latent_entropy: use /dev/urandom
    - ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
    - ARM: davinci: da850-evm: Avoid NULL pointer dereference
    - smp: Fix offline cpu check in flush_smp_call_function_queue()
    - i2c: pasemi: Wait for write xfers to finish
    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
    - drm/edid: check basic audio support on CEA extension block
    - ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
    - mmc: davinci_mmc: Handle error for clk_enable
    - drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
    - drm/amd/display: Fix a NULL pointer dereference in
      amdgpu_dm_connector_add_common_modes()
    - hv_balloon: rate-limit "Unhandled message" warning
    - scsi: qla2xxx: Fix incorrect reporting of task management failure
    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
    - sctp: Initialize daddr on peeled off socket
    - testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set

  [ Ubuntu: 4.15.0-188.199 ]

  * bionic/linux: 4.15.0-188.199 -proposed tracker (LP: #1978697)
  * CVE-2022-28388
    - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
      path

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 05 Jul 2022 10:13:34 -0300

linux-azure-4.15 (4.15.0-1145.160) bionic; urgency=medium

  [ Ubuntu: 4.15.0-187.198 ]

  * CVE-2022-21123 // CVE-2022-21125 // CVE-2022-21166
    - x86/cpu: Add Elkhart Lake to Intel family
    - cpu/speculation: Add prototype for cpu_show_srbds()
    - x86/cpu: Add Jasper Lake to Intel family
    - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel
      CPU family
    - x86/cpu: Add another Alder Lake CPU to the Intel family
    - Documentation: Add documentation for Processor MMIO Stale Data
    - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
    - x86/speculation: Add a common function for MD_CLEAR mitigation update
    - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
    - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
    - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
    - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
    - x86/speculation/srbds: Update SRBDS mitigation selection
    - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
    - KVM: x86/speculation: Disable Fill buffer clear within guests
    - x86/speculation/mmio: Print SMT warning

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 13 Jun 2022 17:21:52 -0300

linux-azure-4.15 (4.15.0-1142.156) bionic; urgency=medium

  [ Ubuntu: 4.15.0-184.194 ]

  * CVE-2022-1966
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 03 Jun 2022 07:58:25 -0300

linux-azure-4.15 (4.15.0-1140.153) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1140.153 -proposed tracker (LP: #1974406)

  [ Ubuntu: 4.15.0-182.191 ]

  * CVE-2022-21499
    - SAUCE: debug: Lock down kgdb

  [ Ubuntu: 4.15.0-181.190 ]

  * bionic/linux: 4.15.0-181.190 -proposed tracker (LP: #1974426)
  * Bionic update: upstream stable patchset 2022-05-06 (LP: #1972006)
    - [Config] updateconfigs for ARM64_ERRATUM_1188873
    - arm64: arch_timer: Add workaround for ARM erratum 1188873
    - arm64: arch_timer: avoid unused function warning
    - arm64: Add silicon-errata.txt entry for ARM erratum 1188873
    - arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT
    - arm64: Add part number for Neoverse N1
    - arm64: Add part number for Arm Cortex-A77
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
    - arm64: Add Cortex-X2 CPU part definition
    - arm64: entry.S: Add ventry overflow sanity checks
    - arm64: entry: Make the trampoline cleanup optional
    - arm64: entry: Free up another register on kpti's tramp_exit path
    - arm64: entry: Move the trampoline data page before the text page
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors
    - arm64: entry: Move trampoline macros out of ifdef'd section
    - arm64: entry: Make the kpti trampoline's kpti sequence optional
    - Revert "arm64: mmu: add the entry trampolines start/end section markers into
      sections.h"
    - arm64: entry: Allow the trampoline text to occupy multiple pages
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
    - [Config] updateconfigs for MITIGATE_SPECTRE_BRANCH_HISTORY
    - arm64: entry: Add vectors that have the bhb mitigation sequences
    - arm64: entry: Add macro for reading symbol addresses from the trampoline
    - arm64: Add percpu vectors for EL1
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
    - KVM: arm64: Add templates for BHB mitigation sequences
    - arm64: Mitigate spectre style branch history side channels
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
    - arm64: add ID_AA64ISAR2_EL1 sys register
    - arm64: Use the clearbhb instruction in mitigations
  * issuing invalid ioctl to /dev/vsock may spam dmesg (LP: #1971480)
    - vsock: remove ratelimit unknown ioctl message
  * ubuntu_ltp_controllers:cpuset_sched_domains: tests 3,9,11,17,19,25 report
    incorrect sched domain for cpu#32 (LP: #1951289)
    - sched/topology: Make sched_init_numa() use a set for the deduplicating sort
    - sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
    - ia64: ensure proper NUMA distance and possible map initialization
  * CVE-2022-1419
    - drm/vgem: Reclassify buffer creation debug message
    - drm/vgem: Close use-after-free race in vgem_gem_create
  * CVE-2022-28390
    - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  * Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479)
    - net: qlogic: check the return value of dma_alloc_coherent() in
      qed_vf_hw_prepare()
    - qed: return status of qed_iov_get_link
    - ethernet: Fix error handling in xemaclite_of_probe
    - net: ethernet: ti: cpts: Handle error for clk_enable
    - net: ethernet: lpc_eth: Handle error for clk_enable
    - ax25: Fix NULL pointer dereference in ax25_kill_by_device
    - net/mlx5: Fix size field in bufferx_reg struct
    - NFC: port100: fix use-after-free in port100_send_complete
    - gpio: ts4900: Do not set DAT and OE together
    - sctp: fix kernel-infoleak for SCTP sockets
    - net-sysfs: add check for netdevice being present to speed_show
    - Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
    - Revert "xen-netback: Check for hotplug-status existence before watching"
    - tracing: Ensure trace buffer is at least 4096 bytes large
    - selftests/memfd: clean up mapping in mfd_fail_write
    - ARM: Spectre-BHB: provide empty stub for non-config
    - staging: gdm724x: fix use after free in gdm_lte_rx()
    - virtio: unexport virtio_finalize_features
    - virtio: acknowledge all features before access
    - ARM: fix Thumb2 regression with Spectre BHB
    - ext4: add check to prevent attempting to resize an fs with sparse_super2
    - btrfs: unlock newly allocated extent buffer after error
    - net: phy: DP83822: clear MISR2 register to disable interrupts
    - sctp: fix the processing for INIT chunk
    - sctp: fix the processing for INIT_ACK chunk
    - xfrm: Fix xfrm migrate issues when address family changes
    - arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity
    - ARM: dts: rockchip: fix a typo on rk3288 crypto-controller
    - MIPS: smp: fill in sibling and core maps earlier
    - ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
    - can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when
      fully ready
    - atm: firestream: check the return value of ioremap() in fs_init()
    - nl80211: Update bss channel on channel switch for P2P_CLIENT
    - tcp: make tcp_read_sock() more robust
    - sfc: extend the locking on mcdi->seqno
    - kselftest/vm: fix tests build with old libc
    - fs: sysfs_emit: Remove PAGE_SIZE alignment check
    - efi: fix return value of __setup handlers
    - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
    - atm: eni: Add check for dma_map_single
    - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
    - usb: gadget: rndis: prevent integer overflow in rndis_set_response()
    - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
    - Input: aiptek - properly check endpoint type
    - perf symbols: Fix symbol size calculation condition
    - net: dsa: Add missing of_node_put() in dsa_port_parse_of
    - net: ipv6: fix skb_over_panic in __ip6_append_data
    - staging: fbtft: fb_st7789v: reset display before initialization
    - thermal: int340x: fix memory leak in int3400_notify()
    - llc: fix netdevice reference leaks in llc_ui_bind()
    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
    - ALSA: cmipci: Restore aux vol on suspend/resume
    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
    - drivers: net: xgene: Fix regression in CRC stripping
    - netfilter: nf_tables: initialize registers in nft_do_chain()
    - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
    - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
    - crypto: qat - disable registration of algorithms
    - mac80211: fix potential double free on mesh join
    - llc: only change llc->dev when bind() succeeds

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Thu, 26 May 2022 18:22:16 -0300

linux-azure-4.15 (4.15.0-1139.152) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1139.152 -proposed tracker (LP: #1973993)

  [ Ubuntu: 4.15.0-180.189 ]

  * bionic/linux: 4.15.0-180.189 -proposed tracker (LP: #1974013)
  * CVE-2022-29581
    - net/sched: cls_u32: fix netns refcount changes in u32_change()
  * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP
    option (LP: #1972740)
    - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
  * ext4: limit length to bitmap_maxbytes (LP: #1972281)
    - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Mon, 23 May 2022 12:25:33 -0300

linux-azure-4.15 (4.15.0-1138.151) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1138.151 -proposed tracker (LP: #1969066)

  [ Ubuntu: 4.15.0-177.186 ]

  * bionic/linux: 4.15.0-177.186 -proposed tracker (LP: #1969083)
  * Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932)
    - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
    - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
    - parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel
    - parisc/unaligned: Fix ldw() and stw() unalignment handlers
    - sr9700: sanity check for packet length
    - USB: zaurus: support another broken Zaurus
    - ping: remove pr_err from ping_lookup
    - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
    - gso: do not skip outer ip header in case of ipip and net_failover
    - openvswitch: Fix setting ipv6 fields causing hw csum failure
    - drm/edid: Always set RGB444
    - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
    - configfs: fix a race in configfs_{,un}register_subsystem()
    - RDMA/ib_srp: Fix a deadlock
    - iio: adc: men_z188_adc: Fix a resource leak in an error handling path
    - ata: pata_hpt37x: disable primary channel on HPT371
    - Revert "USB: serial: ch341: add new Product ID for CH341A"
    - usb: gadget: rndis: add spinlock for rndis response list
    - tracefs: Set the group ownership in apply_options() not parse_options()
    - USB: serial: option: add support for DW5829e
    - USB: serial: option: add Telit LE910R1 compositions
    - usb: dwc3: gadget: Let the interrupt handler disable bottom halves.
    - xhci: re-initialize the HC during resume if HCE was set
    - xhci: Prevent futile URB re-submissions due to incorrect return value.
    - tty: n_gsm: fix encoding of control signal octet bit DV
    - tty: n_gsm: fix proper link termination after failed open
    - Revert "drm/nouveau/pmu/gm200-: avoid touching PMU outside of
      DEVINIT/PREOS/ACR"
    - memblock: use kfree() to release kmalloced memblock regions
    - fget: clarify and improve __fget_files() implementation
    - gpio: tegra186: Fix chip_data type confusion
    - tracing: Have traceon and traceoff trigger honor the instance
    - mac80211_hwsim: report NOACK frames in tx_status
    - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work
    - i2c: bcm2835: Avoid clock stretching timeouts
    - Input: clear BTN_RIGHT/MIDDLE on buttonpads
    - cifs: fix double free race when mount fails in cifs_get_root()
    - dmaengine: shdma: Fix runtime PM imbalance on error
    - i2c: cadence: allow COMPILE_TEST
    - i2c: qup: allow COMPILE_TEST
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990
    - usb: gadget: don't release an existing dev->buf
    - usb: gadget: clear related members when goto fail
    - ata: pata_hpt37x: fix PCI clock detection
    - ALSA: intel_hdmi: Fix reference to PCM buffer address
    - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
    - xfrm: fix MTU regression
    - netfilter: fix use-after-free in __nf_register_net_hook()
    - xfrm: enforce validity of offload input flags
    - netfilter: nf_queue: don't assume sk is full socket
    - netfilter: nf_queue: fix possible use-after-free
    - batman-adv: Request iflink once in batadv-on-batadv check
    - batman-adv: Request iflink once in batadv_get_real_netdevice
    - batman-adv: Don't expect inter-netns unique iflink indices
    - net: dcb: flush lingering app table entries for unregistered devices
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
    - mac80211: fix forwarded mesh frames AC & queue selection
    - net: stmmac: fix return value of __setup handler
    - net: sxgbe: fix return value of __setup handler
    - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
    - efivars: Respect "block" flag in efivar_entry_set_safe()
    - can: gs_usb: change active_channels's type from atomic_t to u8
    - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions
    - soc: fsl: qe: Check of ioremap return value
    - net: chelsio: cxgb3: check the return value of pci_find_capability()
    - nl80211: Handle nla_memdup failures in handle_nan_filter
    - Input: elan_i2c - move regulator_[en|dis]able() out of
      elan_[en|dis]able_power()
    - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume
    - HID: add mapping for KEY_ALL_APPLICATIONS
    - memfd: fix F_SEAL_WRITE after shmem huge page allocated
    - net: dcb: disable softirqs in dcbnl_flush_dev()
    - hamradio: fix macro redefine warning
    - arm/arm64: Provide a wrapper for SMCCC 1.1 calls
    - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit()
    - ARM: report Spectre v2 status through sysfs
    - ARM: early traps initialisation
    - ARM: use LOADADDR() to get load address of sections
    - [Config] updateconfigs for HARDEN_BRANCH_HISTORY
    - ARM: Spectre-BHB workaround
    - ARM: include unprivileged BPF status in Spectre V2 reporting
    - ARM: fix build error when BPF_SYSCALL is disabled
    - ARM: fix co-processor register typo
    - ARM: Do not use NOCROSSREFS directive with ld.lld
    - ARM: fix build warning in proc-v7-bugs.c
    - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
    - xen/grant-table: add gnttab_try_end_foreign_access()
    - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
    - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
    - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
    - xen/gntalloc: don't use gnttab_query_foreign_access()
    - xen: remove gnttab_query_foreign_access()
    - xen/9p: use alloc/free_pages_exact()
    - xen/gnttab: fix gnttab_end_foreign_access() without page specified
    - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
  * ip6gre driver does not hold device reference (LP: #1968340)
    - ip6_gre: proper dev_{hold|put} in ndo_[un]init methods
  * LRMv6: add multi-architecture support (LP: #1968774)
    - [Packaging] resync dkms-build{,--nvidia-N}
  * Use kernel-testing repo from launchpad for ADT tests (LP: #1968016)
    - [Debian] Use kernel-testing repo from launchpad
  * vmx_ldtr_test in ubuntu_kvm_unit_tests failed (FAIL: Expected 0 for L1 LDTR
    selector (got 50)) (LP: #1956315)
    - KVM: nVMX: Set LDTR to its architecturally defined value on nested VM-Exit
  * Bionic update: upstream stable patchset 2022-03-29 (LP: #1967013)
    - moxart: fix potential use-after-free on remove path
    - x86/mm, mm/hwpoison: Fix the unmap kernel 1:1 pages check condition
    - integrity: check the return value of audit_log_start()
    - ima: Remove ima_policy file before directory
    - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
    - mmc: sdhci-of-esdhc: Check for error num after setting mask
    - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs
    - NFS: Fix initialisation of nfs_client cl_flags field
    - NFSD: Clamp WRITE offsets
    - NFSv4 only print the label when its queried
    - nfs: nfs4clinet: check the return value of kstrdup()
    - NFSv4.1: Fix uninitialised variable in devicenotify
    - NFSv4 remove zero number of fs_locations entries error check
    - NFSv4 expose nfs_parse_server_name function
    - scsi: target: iscsi: Make sure the np under each tpg is unique
    - usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
    - net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout()
    - Revert "net: axienet: Wait for PhyRstCmplt after core reset"
    - ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
    - ARM: dts: meson: Fix the UART compatible strings
    - staging: fbtft: Fix error path in fbtft_driver_module_init()
    - ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
    - usb: f_fs: Fix use-after-free for epfile
    - bonding: pair enable_port with slave_arr_updates
    - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
    - net: do not keep the dst cache when uncloning an skb dst and its metadata
    - net: fix a memleak when uncloning an skb dst and its metadata
    - tipc: rate limit warning for received illegal binding update
    - net: amd-xgbe: disable interrupts during pci removal
    - vt_ioctl: fix array_index_nospec in vt_setactivate
    - vt_ioctl: add array_index_nospec to VT_ACTIVATE
    - n_tty: wake up poll(POLLRDNORM) on receiving data
    - usb: ulpi: Move of_node_put to ulpi_dev_release
    - usb: ulpi: Call of_node_put correctly
    - usb: dwc3: gadget: Prevent core from processing stale TRBs
    - USB: gadget: validate interface OS descriptor requests
    - usb: gadget: rndis: check size of RNDIS_MSG_SET command
    - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
    - USB: serial: option: add ZTE MF286D modem
    - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
    - USB: serial: cp210x: add NCR Retail IO box id
    - USB: serial: cp210x: add CPI Bulk Coin Recycler id
    - seccomp: Invalidate seccomp mode to catch death failures
    - hwmon: (dell-smm) Speed up setting of fan speed
    - perf: Fix list corruption in perf_cgroup_switch()
    - net: bridge: fix stale eth hdr pointer in br_dev_xmit
    - Makefile.extrawarn: Move -Wunaligned-access to W=1
    - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
    - serial: parisc: GSC: fix build when IOSAPIC is not set
    - parisc: Fix data TLB miss in sba_unmap_sg
    - parisc: Fix sglist access in ccio-dma.c
    - btrfs: send: in case of IO error log it
    - net: ieee802154: at86rf230: Stop leaking skb's
    - selftests/zram: Skip max_comp_streams interface on newer kernel
    - selftests/zram01.sh: Fix compression ratio calculation
    - selftests/zram: Adapt the situation that /dev/zram0 is being used
    - ax25: improve the incomplete fix to avoid UAF and NPD bugs
    - vfs: make freeze_super abort when sync_filesystem returns error
    - quota: make dquot_quota_sync return errors from ->sync_fs
    - Revert "module, async: async_synchronize_full() on module init iff async is
      used"
    - iwlwifi: fix use-after-free
    - drm/radeon: Fix backlight control on iMac 12,1
    - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
    - taskstats: Cleanup the use of task->exit_code
    - vsock: remove vsock from connected table when connect is interrupted by a
      signal
    - iwlwifi: pcie: fix locking when "HW not ready"
    - iwlwifi: pcie: gen2: fix locking when "HW not ready"
    - net: ieee802154: ca8210: Fix lifs/sifs periods
    - ping: fix the dif and sdif check in ping_lookup
    - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
    - bonding: fix data-races around agg_select_timer
    - libsubcmd: Fix use-after-free for realloc(..., 0)
    - ALSA: hda: Fix regression on forced probe mask option
    - ALSA: hda: Fix missing codec probe on Shenker Dock 15
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
    - powerpc/lib/sstep: fix 'ptesync' build error
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks
    - EDAC: Fix calculation of returned address and next offset in
      edac_align_ptr()
    - net: sched: limit TC_ACT_REPEAT loops
    - dmaengine: sh: rcar-dmac: Check for error num after setting mask
    - i2c: brcmstb: fix support for DSL and CM variants
    - mtd: rawnand: brcmnand: Refactored code to introduce helper functions
    - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
    - KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
    - NFS: Do not report writeback errors in nfs_getattr()
    - ARM: OMAP2+: hwmod: Add of_node_put() before break
    - ata: libata-core: Disable TRIM on M88V29
    - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
    - net: usb: qmi_wwan: Add support for Dell DW5829e
    - net: macb: Align the dma and coherent dma masks
    - net: dsa: lan9303: fix reset on probe
  * CVE-2022-27223
    - USB: gadget: validate endpoint index for xilinx udc
  * CVE-2022-26490
    - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
  * CVE-2021-26401
    - x86/speculation: Use generic retpoline by default on AMD
    - x86/speculation: Update link to AMD speculation whitepaper
    - x86/speculation: Warn about Spectre v2 LFENCE mitigation
    - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
  * CVE-2022-0001
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation
      reporting

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Thu, 28 Apr 2022 15:55:35 -0300

linux-azure-4.15 (4.15.0-1137.150) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1137.150 -proposed tracker (LP: #1967407)

  [ Ubuntu: 4.15.0-176.185 ]

  * bionic/linux: 4.15.0-176.185 -proposed tracker (LP: #1966771)
  * Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717)
    - can: bcm: fix UAF of bcm op
    - net: bridge: clear bridge's private skb space on xmit
    - s390/hypfs: include z/VM guests with access control group set
    - scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP
      devices
    - udf: Restore i_lenAlloc when inode expansion fails
    - udf: Fix NULL ptr deref when converting from inline format
    - PM: wakeup: simplify the output logic of pm_show_wakelocks()
    - netfilter: nft_payload: do not update layer 4 checksum when mangling
      fragments
    - serial: stm32: fix software flow control transfer
    - tty: n_gsm: fix SW flow control encoding/handling
    - tty: Add support for Brainboxes UC cards.
    - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
    - usb: common: ulpi: Fix crash in ulpi_match()
    - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
    - USB: core: Fix hang in usb_kill_urb by adding memory barriers
    - usb: typec: tcpm: Do not disconnect while receiving VBUS off
    - net: sfp: ignore disabled SFP node
    - powerpc/32: Fix boot failure with GCC latent entropy plugin
    - lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
    - i40e: Increase delay to 1 s after global EMP reset
    - i40e: fix unsigned stat widths
    - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
    - rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
    - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
    - ipv6_tunnel: Rate limit warning messages
    - net: fix information leakage in /proc/net/ptype
    - ping: fix the sk_bound_dev_if match in ping_lookup
    - ipv4: avoid using shared IP generator for connected sockets
    - hwmon: (lm90) Reduce maximum conversion rate for G781
    - NFSv4: Handle case where the lookup of a directory fails
    - NFSv4: nfs_atomic_open() can race when looking up a non-regular file
    - net-procfs: show net devices bound packet types
    - drm/msm: Fix wrong size calculation
    - drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
    - ibmvnic: don't spin in tasklet
    - yam: fix a memory leak in yam_siocdevprivate()
    - ipv4: raw: lock the socket in raw_bind()
    - ipv4: tcp: send zero IPID in SYNACK messages
    - netfilter: nat: remove l4 protocol port rovers
    - netfilter: nat: limit port clash resolution attempts
    - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
    - net: amd-xgbe: ensure to reset the tx_timer_active flag
    - net: amd-xgbe: Fix skb data length underflow
    - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
    - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
    - drm/nouveau: fix off by one in BIOS boundary checking
    - block: bio-integrity: Advance seed correctly for larger interval sizes
    - RDMA/mlx4: Don't continue event handler after memory allocation failure
    - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
    - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
    - spi: bcm-qspi: check for valid cs before applying chip select
    - spi: mediatek: Avoid NULL pointer crash in interrupt
    - spi: meson-spicc: add IRQ check in meson_spicc_probe
    - net: ieee802154: ca8210: Stop leaking skb's
    - net: ieee802154: Return meaningful error codes from the netlink helpers
    - net: macsec: Verify that send_sci is on when setting Tx sci explicitly
    - drm/i915/overlay: Prevent divide by zero bugs in scaling
    - ASoC: fsl: Add missing error handling in pcm030_fabric_probe
    - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
    - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
    - selftests: futex: Use variable MAKE instead of make
    - rtc: cmos: Evaluate century appropriate
    - EDAC/altera: Fix deferred probing
    - EDAC/xgene: Fix deferred probing
    - ext4: fix error handling in ext4_restore_inline_data()
    - serial: 8250: of: Fix mapped region size when using reg-offset property
    - i40e: Fix issue when maximum queues is exceeded
    - i40e: Fix queues reservation for XDP
    - ipv6: annotate accesses to fn->fn_sernum
    - ibmvnic: init ->running_cap_crqs early
  * Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // audit:
    improve audit queue handling when "audit=1" on cmdline (LP: #1965723)
    - audit: improve audit queue handling when "audit=1" on cmdline
  * CVE-2021-43975
    - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
  * Packaging resync (LP: #1786013)
    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Wed, 06 Apr 2022 16:49:17 -0300

# For older changelog entries, run 'apt-get changelog linux-azure-4.15-headers-4.15.0-1149'
