linux-kvm (4.15.0-1099.101) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1099.101 -proposed tracker (LP: #1939825)

  [ Ubuntu: 4.15.0-156.163 ]

  * bionic/linux: 4.15.0-156.163 -proposed tracker (LP: #1940162)
  * linux (LP: #1940564)
    - SAUCE: Revert "scsi: core: Cap scsi_host cmd_per_lun at can_queue"
  * fails to launch linux L2 guests on AMD (LP: #1940134) // CVE-2021-3653
    - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl
      (CVE-2021-3653)
  * fails to launch linux L2 guests on AMD (LP: #1940134)
    - SAUCE: Revert "UBUNTU: SAUCE: KVM: nSVM: avoid picking up unsupported bits
      from L2 in int_ctl"

  [ Ubuntu: 4.15.0-155.162 ]

  * bionic/linux: 4.15.0-155.162 -proposed tracker (LP: #1939833)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.08.16)
  * CVE-2021-3656
    - SAUCE: KVM: nSVM: always intercept VMLOAD/VMSAVE when nested
  * CVE-2021-3653
    - SAUCE: KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl
  * dev_forward_skb: do not scrub skb mark within the same name space
    (LP: #1935040)
    - dev_forward_skb: do not scrub skb mark within the same name space
  * 'ptrace trace' needed to readlink() /proc/*/ns/* files on older kernels
    (LP: #1890848)
    - apparmor: fix ptrace read check
  * Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824)
    - ALSA: usb-audio: fix rate on Ozone Z90 USB headset
    - media: dvb-usb: fix wrong definition
    - Input: usbtouchscreen - fix control-request directions
    - net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
    - usb: gadget: eem: fix echo command packet response issue
    - USB: cdc-acm: blacklist Heimann USB Appset device
    - ntfs: fix validity check for file name attribute
    - iov_iter_fault_in_readable() should do nothing in xarray case
    - Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
    - ARM: dts: at91: sama5d4: fix pinctrl muxing
    - btrfs: send: fix invalid path for unlink operations after parent
      orphanization
    - btrfs: clear defrag status of a root if starting transaction fails
    - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a
      transaction handle
    - ext4: fix kernel infoleak via ext4_extent_header
    - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
    - ext4: remove check for zero nr_to_scan in ext4_es_scan()
    - ext4: fix avefreec in find_group_orlov
    - ext4: use ext4_grp_locked_error in mb_find_extent
    - can: gw: synchronize rcu operations before removing gw job entry
    - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in
      TX path
    - SUNRPC: Fix the batch tasks count wraparound.
    - SUNRPC: Should wake up the privileged task firstly.
    - s390/cio: dont call css_wait_for_slow_path() inside a lock
    - rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
    - iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA
      as volatile, too
    - iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
    - iio: ltr501: ltr501_read_ps(): add missing endianness conversion
    - serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
    - serial_cs: Add Option International GSM-Ready 56K/ISDN modem
    - serial_cs: remove wrong GLOBETROTTER.cis entry
    - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
    - ssb: sdio: Don't overwrite const buffer if block_write fails
    - rsi: Assign beacon rate settings to the correct rate_info descriptor field
    - seq_buf: Make trace_seq_putmem_hex() support data longer than 8
    - fuse: check connected before queueing on fpq->io
    - spi: Make of_register_spi_device also set the fwnode
    - spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
    - spi: spi-topcliff-pch: Fix potential double free in
      pch_spi_process_messages()
    - spi: omap-100k: Fix the length judgment problem
    - crypto: nx - add missing MODULE_DEVICE_TABLE
    - media: cpia2: fix memory leak in cpia2_usb_probe
    - media: cobalt: fix race condition in setting HPD
    - media: pvrusb2: fix warning in pvr2_i2c_core_done
    - crypto: qat - check return code of qat_hal_rd_rel_reg()
    - crypto: qat - remove unused macro in FW loader
    - media: em28xx: Fix possible memory leak of em28xx struct
    - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
    - media: bt8xx: Fix a missing check bug in bt878_probe
    - media: st-hva: Fix potential NULL pointer dereferences
    - media: dvd_usb: memory leak in cinergyt2_fe_attach
    - mmc: via-sdmmc: add a check against NULL pointer dereference
    - crypto: shash - avoid comparing pointers to exported functions under CFI
    - media: dvb_net: avoid speculation from net slot
    - media: siano: fix device register error path
    - btrfs: fix error handling in __btrfs_update_delayed_inode
    - btrfs: abort transaction if we fail to update the delayed inode
    - btrfs: disable build on platforms having page size 256K
    - regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
    - HID: do not use down_interruptible() when unbinding devices
    - ACPI: processor idle: Fix up C-state latency if not ordered
    - hv_utils: Fix passing zero to 'PTR_ERR' warning
    - lib: vsprintf: Fix handling of number field widths in vsscanf
    - ACPI: EC: Make more Asus laptops use ECDT _GPE
    - block_dump: remove block_dump feature in mark_inode_dirty()
    - fs: dlm: cancel work sync othercon
    - random32: Fix implicit truncation warning in prandom_seed_state()
    - fs: dlm: fix memory leak when fenced
    - ACPICA: Fix memory leak caused by _CID repair function
    - ACPI: bus: Call kobject_put() in acpi_init() error path
    - platform/x86: toshiba_acpi: Fix missing error code in
      toshiba_acpi_setup_keyboard()
    - ACPI: tables: Add custom DSDT file as makefile prerequisite
    - HID: wacom: Correct base usage for capacitive ExpressKey status bits
    - ia64: mca_drv: fix incorrect array size calculation
    - media: s5p_cec: decrement usage count if disabled
    - crypto: ixp4xx - dma_unmap the correct address
    - crypto: ux500 - Fix error return code in hash_hw_final()
    - sata_highbank: fix deferred probing
    - pata_rb532_cf: fix deferred probing
    - media: I2C: change 'RST' to "RSET" to fix multiple build errors
    - pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
    - crypto: ccp - Fix a resource leak in an error handling path
    - pata_ep93xx: fix deferred probing
    - media: exynos4-is: Fix a use after free in isp_video_release
    - media: tc358743: Fix error return code in tc358743_probe_of()
    - media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
    - mmc: usdhi6rol0: fix error return code in usdhi6_probe()
    - media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx
    - hwmon: (max31722) Remove non-standard ACPI device IDs
    - hwmon: (max31790) Fix fan speed reporting for fan7..12
    - btrfs: clear log tree recovering status if starting transaction fails
    - spi: spi-sun6i: Fix chipselect/clock bug
    - crypto: nx - Fix RCU warning in nx842_OF_upd_status
    - ACPI: sysfs: Fix a buffer overrun problem with description_show()
    - ocfs2: fix snprintf() checking
    - net: pch_gbe: Propagate error from devm_gpio_request_one()
    - drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in
      cdn_dp_grf_write()
    - ehea: fix error return code in ehea_restart_qps()
    - RDMA/rxe: Fix failure during driver load
    - drm: qxl: ensure surf.data is ininitialized
    - wireless: carl9170: fix LEDS build errors & warnings
    - brcmsmac: mac80211_if: Fix a resource leak in an error handling path
    - ath10k: Fix an error code in ath10k_add_interface()
    - netlabel: Fix memory leak in netlbl_mgmt_add_common
    - netfilter: nft_exthdr: check for IPv6 packet before further processing
    - samples/bpf: Fix the error return code of xdp_redirect's main()
    - net: ethernet: aeroflex: fix UAF in greth_of_remove
    - net: ethernet: ezchip: fix UAF in nps_enet_remove
    - net: ethernet: ezchip: fix error handling
    - pkt_sched: sch_qfq: fix qfq_change_class() error path
    - vxlan: add missing rcu_read_lock() in neigh_reduce()
    - net: bcmgenet: Fix attaching to PYH failed on RPi 4B
    - i40e: Fix error handling in i40e_vsi_open
    - Revert "ibmvnic: remove duplicate napi_schedule call in open function"
    - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
    - writeback: fix obtain a reference to a freeing memcg css
    - net: sched: fix warning in tcindex_alloc_perfect_hash
    - tty: nozomi: Fix a resource leak in an error handling function
    - mwifiex: re-fix for unaligned accesses
    - iio: adis_buffer: do not return ints in irq handlers
    - iio: accel: bma180: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: bma220: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: hid: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: kxcjk-1013: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: stk8312: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: stk8ba50: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: adc: ti-ads1015: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: adc: vf610: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: gyro: bmg160: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: humidity: am2315: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: srf08: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: pulsed-light: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: as3935: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: light: isl29125: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: light: tcs3414: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: potentiostat: lmp91000: Fix alignment of buffer in
      iio_push_to_buffers_with_timestamp()
    - ASoC: hisilicon: fix missing clk_disable_unprepare() on error in
      hi6210_i2s_startup()
    - Input: hil_kbd - fix error return code in hil_dev_connect()
    - char: pcmcia: error out if 'num_bytes_read' is greater than 4 in
      set_protocol()
    - tty: nozomi: Fix the error handling path of 'nozomi_card_init()'
    - scsi: FlashPoint: Rename si_flags field
    - s390: appldata depends on PROC_SYSCTL
    - eeprom: idt_89hpesx: Put fwnode in matching case during ->probe()
    - iio: adc: mxs-lradc: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
    - staging: gdm724x: check for overflow in gdm_lte_netif_rx()
    - ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK
    - of: Fix truncation of memory sizes on 32-bit platforms
    - scsi: mpt3sas: Fix error return value in _scsih_expander_add()
    - phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
    - extcon: sm5502: Drop invalid register write in sm5502_reg_data
    - extcon: max8997: Add missing modalias string
    - configfs: fix memleak in configfs_release_bin_file
    - leds: as3645a: Fix error return code in as3645a_parse_node()
    - leds: ktd2692: Fix an error handling path
    - mm/huge_memory.c: don't discard hugepage if other processes are mapping it
    - selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random
    - mmc: vub3000: fix control-request direction
    - scsi: core: Retry I/O for Notify (Enable Spinup) Required error
    - drm/mxsfb: Don't select DRM_KMS_FB_HELPER
    - drm/zte: Don't select DRM_KMS_FB_HELPER
    - drm/amd/amdgpu/sriov disable all ip hw status by default
    - net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
    - hugetlb: clear huge pte during flush function on mips platform
    - atm: iphase: fix possible use-after-free in ia_module_exit()
    - mISDN: fix possible use-after-free in HFC_cleanup()
    - atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
    - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
    - reiserfs: add check for invalid 1st journal block
    - drm/virtio: Fix double free on probe failure
    - udf: Fix NULL pointer dereference in udf_symlink function
    - e100: handle eeprom as little endian
    - clk: renesas: r8a77995: Add ZA2 clock
    - clk: tegra: Ensure that PLLU configuration is applied properly
    - ipv6: use prandom_u32() for ID generation
    - RDMA/cxgb4: Fix missing error code in create_qp()
    - dm space maps: don't reset space map allocation cursor when committing
    - virtio_net: Remove BUG() to avoid machine dead
    - net: bcmgenet: check return value after calling platform_get_resource()
    - net: micrel: check return value after calling platform_get_resource()
    - fjes: check return value after calling platform_get_resource()
    - selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
    - xfrm: Fix error reporting in xfrm_state_construct.
    - wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
    - wl1251: Fix possible buffer overflow in wl1251_cmd_scan
    - cw1200: add missing MODULE_DEVICE_TABLE
    - atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
    - atm: nicstar: register the interrupt handler in the right place
    - vsock: notify server to shutdown when client has pending signal
    - RDMA/rxe: Don't overwrite errno from ib_umem_get()
    - iwlwifi: mvm: don't change band on bound PHY contexts
    - sfc: avoid double pci_remove of VFs
    - sfc: error code if SRIOV cannot be disabled
    - wireless: wext-spy: Fix out-of-bounds warning
    - RDMA/cma: Fix rdma_resolve_route() memory leak
    - Bluetooth: Fix the HCI to MGMT status conversion table
    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
    - Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
    - sctp: validate from_addr_param return
    - sctp: add size validation when walking chunks
    - fscrypt: don't ignore minor_hash when hash is 0
    - bdi: Do not use freezable workqueue
    - fuse: reject internal errno
    - powerpc/barrier: Avoid collision with clang's __lwsync macro
    - usb: gadget: f_fs: Fix setting of device and driver data cross-references
    - drm/radeon: Add the missed drm_gem_object_put() in
      radeon_user_framebuffer_create()
    - pinctrl/amd: Add device HID for new AMD GPIO controller
    - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
    - mmc: core: clear flags before allowing to retune
    - mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
    - ata: ahci_sunxi: Disable DIPM
    - cpu/hotplug: Cure the cpusets trainwreck
    - ASoC: tegra: Set driver_name=tegra for all machine drivers
    - qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
    - ipmi/watchdog: Stop watchdog timer when the current action is 'none'
    - power: supply: ab8500: Fix an old bug
    - seq_buf: Fix overflow in seq_buf_putmem_hex()
    - tracing: Simplify & fix saved_tgids logic
    - ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
    - dm btree remove: assign new_root only when removal succeeds
    - media: dtv5100: fix control-request directions
    - media: zr364xx: fix memory leak in zr364xx_start_readpipe
    - media: gspca/sq905: fix control-request direction
    - media: gspca/sunplus: fix zero-length control requests
    - jfs: fix GPF in diFree
    - smackfs: restrict bytes count in smk_set_cipso()
    - KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is enabled
    - KVM: X86: Disable hardware breakpoints unconditionally before kvm_x86->run()
    - scsi: core: Fix bad pointer dereference when ehandler kthread is invalid
    - tracing: Do not reference char * as a string in histograms
    - PCI: aardvark: Don't rely on jiffies while holding spinlock
    - PCI: aardvark: Fix kernel panic during PIO transfer
    - tty: serial: fsl_lpuart: fix the potential risk of division or modulo by
      zero
    - misc/libmasm/module: Fix two use after free in ibmasm_init_one
    - Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro"
    - w1: ds2438: fixing bug that would always get page0
    - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology
    - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the
      SGLs
    - scsi: core: Cap scsi_host cmd_per_lun at can_queue
    - tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
    - fs/jfs: Fix missing error code in lmLogInit()
    - scsi: iscsi: Add iscsi_cls_conn refcount helpers
    - scsi: iscsi: Fix shost->max_id use
    - scsi: qedi: Fix null ref during abort handling
    - mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE
    - s390/sclp_vt220: fix console name to match device
    - ALSA: sb: Fix potential double-free of CSP mixer elements
    - powerpc/ps3: Add dma_mask to ps3_dma_region
    - gpio: zynq: Check return value of pm_runtime_get_sync
    - ALSA: ppc: fix error return code in snd_pmac_probe()
    - selftests/powerpc: Fix "no_handler" EBB selftest
    - ASoC: soc-core: Fix the error return code in
      snd_soc_of_parse_audio_routing()
    - ALSA: bebob: add support for ToneWeal FW66
    - usb: gadget: f_hid: fix endianness issue with descriptors
    - usb: gadget: hid: fix error return code in hid_bind()
    - powerpc/boot: Fixup device-tree on little endian
    - backlight: lm3630a: Fix return code of .update_status() callback
    - ALSA: hda: Add IRQ check for platform_get_irq()
    - staging: rtl8723bs: fix macro value for 2.4Ghz only device
    - intel_th: Wait until port is in reset before programming it
    - i2c: core: Disable client irq on reboot/shutdown
    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
    - pwm: spear: Don't modify HW state in .remove callback
    - power: supply: ab8500: Avoid NULL pointers
    - power: supply: max17042: Do not enforce (incorrect) interrupt trigger type
    - power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE
    - ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1
    - watchdog: Fix possible use-after-free in wdt_startup()
    - watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
    - watchdog: Fix possible use-after-free by calling del_timer_sync()
    - watchdog: iTCO_wdt: Account for rebooting on second timeout
    - x86/fpu: Return proper error codes from user access functions
    - orangefs: fix orangefs df output.
    - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
    - NFS: nfs_find_open_context() may only select open files
    - power: supply: charger-manager: add missing MODULE_DEVICE_TABLE
    - power: supply: ab8500: add missing MODULE_DEVICE_TABLE
    - pwm: tegra: Don't modify HW state in .remove callback
    - ACPI: AMBA: Fix resource name in /proc/iomem
    - ACPI: video: Add quirk for the Dell Vostro 3350
    - virtio-blk: Fix memory leak among suspend/resume procedure
    - virtio_net: Fix error handling in virtnet_restore()
    - virtio_console: Assure used length from device is limited
    - f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs
    - PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun
    - power: supply: rt5033_battery: Fix device tree enumeration
    - um: fix error return code in slip_open()
    - um: fix error return code in winch_tramp()
    - watchdog: aspeed: fix hardware timeout calculation
    - nfs: fix acl memory leak of posix_acl_create()
    - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode
    - x86/fpu: Limit xstate copy size in xstateregs_set()
    - ALSA: isa: Fix error return code in snd_cmi8330_probe()
    - NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times
    - hexagon: use common DISCARDS macro
    - reset: a10sr: add missing of_match_table reference
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid XU/XU3
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4
    - memory: atmel-ebi: add missing of_node_put for loop iteration
    - rtc: fix snprintf() checking in is_rtc_hctosys()
    - ARM: dts: r8a7779, marzen: Fix DU clock names
    - ARM: dts: BCM5301X: Fixup SPI binding
    - reset: bail if try_module_get() fails
    - memory: fsl_ifc: fix leak of IO mapping on probe failure
    - memory: fsl_ifc: fix leak of private memory on probe failure
    - ARM: dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema
    - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
    - mips: always link byteswap helpers into decompressor
    - mips: disable branch profiling in boot/decompress.o
    - MIPS: vdso: Invalid GIC access through VDSO
    - net: bridge: multicast: fix PIM hello router port marking race
    - ALSA: usb-audio: Fix OOB access at proc output
    - iio: light: tcs3472: do not free unallocated IRQ
    - rsi: fix AP mode with WPA failure due to encrypted EAPOL
    - evm: Execute evm_inode_init_security() only when an HMAC key is loaded
    - evm: fix writing <securityfs>/evm overflow
    - wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
    - ssb: Fix error return code in ssb_bus_scan()
    - brcmfmac: fix setting of station info chains bitmask
    - ipv6: exthdrs: do not blindly use init_net
    - i40e: Fix autoneg disabling for non-10GBaseT links
    - ipv6: fix out-of-bound access in ip6_parse_tlv()
    - iio: light: tcs3472: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - ASoC: rsnd: tidyup loop on rsnd_adg_clk_query()
    - visorbus: fix error return code in visorchipset_init()
    - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
    - powerpc: Offline CPU in stop_this_cpu()
    - serial: mvebu-uart: correctly calculate minimal possible baudrate
    - arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
    - vfio/pci: Handle concurrent vma faults
    - clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
    - coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
    - PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
    - media: subdev: disallow ioctl for saa6588/davinci
    - PCI: iproc: Fix multi-MSI base vector number allocation
    - PCI: iproc: Support multi-MSI only on uniprocessor kernel
    - virtio_net: move tx vq operation under tx queue lock
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid HC1
    - ARM: dts: am437x: align ti,pindir-d0-out-d1-in property with dt-shema
  * Bionic update: upstream stable patchset 2021-07-20 (LP: #1936960)
    - include/linux/mmdebug.h: make VM_WARN* non-rvals
    - mm: add VM_WARN_ON_ONCE_PAGE() macro
    - mm/rmap: remove unneeded semicolon in page_not_mapped()
    - mm/rmap: use page_not_mapped in try_to_unmap()
    - mm/thp: try_to_unmap() use TTU_SYNC for safe splitting
    - mm/thp: fix vma_address() if virtual address below file offset
    - mm/thp: fix page_address_in_vma() on file THP tails
    - mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split
    - mm: page_vma_mapped_walk(): use page for pvmw->page
    - mm: page_vma_mapped_walk(): settle PageHuge on entry
    - mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd
    - mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block
    - mm: page_vma_mapped_walk(): crossing page table boundary
    - mm: page_vma_mapped_walk(): add a level of indentation
    - mm: page_vma_mapped_walk(): use goto instead of while (1)
    - mm: page_vma_mapped_walk(): get vma_address_end() earlier
    - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes
    - mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()
    - mm, futex: fix shared futex pgoff on shmem huge page
    - scsi: sr: Return appropriate error code when disk is ejected
    - drm/nouveau: fix dma_address check for CPU/GPU sync
    - kfifo: DECLARE_KIFO_PTR(fifo, u64) does not work on arm 32 bit
    - kthread_worker: split code for canceling the delayed work timer
    - kthread: prevent deadlock when kthread_mod_delayed_work() races with
      kthread_cancel_delayed_work_sync()
    - xen/events: reset active flag for lateeoi events later
    - ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment
    - ARM: OMAP: replace setup_irq() by request_irq()
    - clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support
    - clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue
  * Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231)
    - Revert "UBUNTU: SAUCE: Revert "proc: Check /proc/$pid/attr/ writes against
      file opener""
    - proc: Track /proc/$pid/attr/ opener mm_struct
    - net/nfc/rawsock.c: fix a permission check bug
    - ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
    - isdn: mISDN: netjet: Fix crash in nj_probe:
    - bonding: init notify_work earlier to avoid uninitialized use
    - netlink: disable IRQs for netlink_lock_table()
    - net: mdiobus: get rid of a BUG_ON()
    - cgroup: disable controllers at parse time
    - wq: handle VM suspension in stall detection
    - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
    - scsi: vmw_pvscsi: Set correct residual data length
    - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
    - net: macb: ensure the device is available before accessing GEMGXL control
      registers
    - net: appletalk: cops: Fix data race in cops_probe1
    - MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
    - bnx2x: Fix missing error code in bnx2x_iov_init_one()
    - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
    - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
    - i2c: mpc: Make use of i2c_recover_bus()
    - i2c: mpc: implement erratum A-004447 workaround
    - drm: Fix use-after-free read in drm_getunique()
    - drm: Lock pointer access in drm_master_release()
    - kvm: avoid speculation-based attacks from out-of-range memslot accesses
    - staging: rtl8723bs: Fix uninitialized variables
    - btrfs: return value from btrfs_mark_extent_written() in case of error
    - cgroup1: don't allow 'n' in renaming
    - USB: f_ncm: ncm_bitrate (speed) is unsigned
    - usb: dwc3: ep0: fix NULL pointer exception
    - usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
    - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
    - USB: serial: ftdi_sio: add NovaTech OrionMX product ID
    - USB: serial: omninet: add device id for Zyxel Omni 56K Plus
    - USB: serial: quatech2: fix control-request directions
    - usb: gadget: eem: fix wrong eem header operation
    - usb: fix various gadgets null ptr deref on 10gbps cabling.
    - usb: fix various gadget panics on 10gbps cabling
    - regulator: core: resolve supply for boot-on/always-on regulators
    - regulator: max77620: Use device_set_of_node_from_dev()
    - perf: Fix data race between pin_count increment/decrement
    - NFS: Fix a potential NULL dereference in nfs_get_client()
    - perf session: Correct buffer copying when peeking events
    - kvm: fix previous commit for 32-bit builds
    - NFS: Fix use-after-free in nfs4_init_client()
    - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
    - scsi: core: Fix error handling of scsi_host_alloc()
    - scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
    - scsi: core: Only put parent device if host state differs from SHOST_CREATED
    - ftrace: Do not blindly read the ip address in ftrace_bug()
    - tracing: Correct the length check which causes memory corruption
    - proc: only require mm_struct for writing
    - scsi: bnx2fc: Return failure if io_req is already in ABTS processing
    - ARM: dts: imx6qdl-sabresd: Assign corresponding power supply for LDOs
    - usb: f_ncm: only first packet of aggregate needs to start timer
    - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
    - RDMA/mlx4: Do not map the core_clock page to user space unless enabled
    - vmlinux.lds.h: Avoid orphan section with !SMP
    - sched/fair: Make sure to update tg contrib for blocked load
    - net: ieee802154: fix null deref in parse dev addr
    - HID: hid-sensor-hub: Return error for hid_set_field() failure
    - HID: Add BUS_VIRTUAL to hid_connect logging
    - HID: usbhid: fix info leak in hid_submit_ctrl
    - ARM: OMAP2+: Fix build warning when mmc_omap is not built
    - HID: gt683r: add missing MODULE_DEVICE_TABLE
    - gfs2: Fix use-after-free in gfs2_glock_shrink_scan
    - scsi: target: core: Fix warning on realtime kernels
    - ethernet: myri10ge: Fix missing error code in myri10ge_probe()
    - nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues()
    - nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue()
      fails
    - nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue()
    - net: ipconfig: Don't override command-line hostnames or domains
    - rtnetlink: Fix missing error code in rtnl_bridge_notify()
    - net/x25: Return the correct errno code
    - net: Return the correct errno code
    - fib: Return the correct errno code
    - dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM
    - dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
    - dmaengine: stedma40: add missing iounmap() on error in d40_probe()
    - mm/memory-failure: make sure wait for page writeback in memory_failure
    - batman-adv: Avoid WARN_ON timing related checks
    - net: ipv4: fix memory leak in netlbl_cipsov4_add_std
    - net: rds: fix memory leak in rds_recvmsg
    - udp: fix race between close() and udp_abort()
    - rtnetlink: Fix regression in bridge VLAN configuration
    - netfilter: synproxy: Fix out of bounds when parsing TCP options
    - alx: Fix an error handling path in 'alx_probe()'
    - net: stmmac: dwmac1000: Fix extended MAC address registers definition
    - qlcnic: Fix an error handling path in 'qlcnic_probe()'
    - netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
    - net: cdc_ncm: switch to eth%d interface naming
    - net: usb: fix possible use-after-free in smsc75xx_bind
    - net: ipv4: fix memory leak in ip_mc_add1_src
    - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
    - be2net: Fix an error handling path in 'be_probe()'
    - net: hamradio: fix memory leak in mkiss_close
    - net: cdc_eem: fix tx fixup skb leak
    - icmp: don't send out ICMP messages with a source address of 0.0.0.0
    - net: ethernet: fix potential use-after-free in ec_bhf_remove
    - radeon: use memcpy_to/fromio for UVD fw upload
    - hwmon: (scpi-hwmon) shows the negative temperature properly
    - can: bcm: fix infoleak in struct bcm_msg_head
    - can: mcba_usb: fix memory leak in mcba_usb
    - usb: core: hub: Disable autosuspend for Cypress CY7C65632
    - tracing: Do not stop recording cmdlines when tracing is off
    - tracing: Do not stop recording comms if the trace file is being read
    - tracing: Do no increment trace_clock_global() by one
    - PCI: Mark TI C667X to avoid bus reset
    - PCI: Mark some NVIDIA GPUs to avoid bus reset
    - PCI: Add ACS quirk for Broadcom BCM57414 NIC
    - PCI: Work around Huawei Intelligent NIC VF FLR erratum
    - ARCv2: save ABI registers across signal handling
    - dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
    - net: bridge: fix vlan tunnel dst null pointer dereference
    - net: bridge: fix vlan tunnel dst refcnt when egressing
    - mm/slub.c: include swab.h
    - net: fec_ptp: add clock rate zero check
    - can: bcm/raw/isotp: use per module netdevice notifier
    - inet: use bigger hash table for IP ID generation
    - usb: dwc3: core: fix kernel panic when do reboot
    - x86/fpu: Reset state for all signal restore failures
    - drm/nouveau: wait for moving fence after pinning v2
    - drm/radeon: wait for moving fence after pinning
    - ARM: 9081/1: fix gcc-10 thumb2-kernel regression
    - Makefile: Move -Wno-unused-but-set-variable out of GCC only block
    - MIPS: generic: Update node names to avoid unit addresses
    - Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
    - mac80211: remove warning in ieee80211_get_sband()
    - cfg80211: call cfg80211_leave_ocb when switching away from OCB
    - mac80211: drop multicast fragments
    - ping: Check return value of function 'ping_queue_rcv_skb'
    - inet: annotate date races around sk->sk_txhash
    - net: caif: fix memory leak in ldisc_open
    - net/packet: annotate accesses to po->bind
    - net/packet: annotate accesses to po->ifindex
    - r8152: Avoid memcpy() over-reading of ETH_SS_STATS
    - sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
    - r8169: Avoid memcpy() over-reading of ETH_SS_STATS
    - net: qed: Fix memcpy() overflow of qed_dcbx_params()
    - net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
    - pinctrl: stm32: fix the reported number of GPIO lines per bank
    - nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
    - i2c: robotfuzz-osif: fix control-request directions
    - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V
    - net/mlx5e: Remove dependency in IPsec initialization flows
    - net: add documentation to socket.c
    - net: make get_net_ns return error if NET_NS is disabled
    - net: qrtr: fix OOB Read in qrtr_endpoint_post
    - ptp: ptp_clock: Publish scaled_ppm_to_ppb
    - ptp: improve max_adj check against unreasonable values
    - net: fec_ptp: fix issue caused by refactor the fec_devtype
    - ASoC: rt5659: Fix the lost powers for the HDA header
    - cfg80211: make certificate generation more robust
    - mm/slub: clarify verification reporting
    - net: ethtool: clear heap allocations for ethtool function
    - PCI: Add AMD RS690 quirk to enable 64-bit DMA
    - upstream stable to v4.14.238, v4.19.196

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Fri, 20 Aug 2021 10:56:41 -0600

linux-kvm (4.15.0-1098.100) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1098.100 -proposed tracker (LP: #1936558)

  [ Ubuntu: 4.15.0-154.161 ]

  * bionic/linux: 4.15.0-154.161 -proposed tracker (LP: #1938411)
  * Potential reverts of 4.19.y stable changes in 18.04 (LP: #1938537)
    - SAUCE: Revert "locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to
      signal"
    - SAUCE: Revert "drm/amd/amdgpu: fix refcount leak"
  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
    - update dkms package versions
  * btrfs: Automatic balance returns -EUCLEAN and leads to forced readonly
    filesystem (LP: #1934709) // CVE-2019-19036
    - btrfs: Validate child tree block's level and first key
    - btrfs: Detect unbalanced tree with empty leaf before crashing btree
      operations
  * btrfs: Automatic balance returns -EUCLEAN and leads to forced readonly
    filesystem (LP: #1934709)
    - Revert "btrfs: Detect unbalanced tree with empty leaf before crashing btree
      operations"
    - Revert "btrfs: Validate child tree block's level and first key"
    - btrfs: Only check first key for committed tree blocks
    - btrfs: Fix wrong first_key parameter in replace_path
  * Enable fib-onlink-tests.sh and msg_zerocopy.sh in kselftests/net on Bionic
    (LP: #1934759)
    - selftests: Add fib-onlink-tests.sh to TEST_PROGS
    - selftests: net: use TEST_PROGS_EXTENDED
    - selftests/net: enable msg_zerocopy test
    - SAUCE: selftests: Make fib-onlink-tests.sh executable
  * Kernel oops due to uninitialized list on kernfs (kernfs_kill_sb)
    (LP: #1934175)
    - kernfs: deal with kernfs_fill_super() failures
    - unfuck sysfs_mount()
  * large_dir in ext4 broken (LP: #1933074)
    - SAUCE: ext4: fix directory index node split corruption
  * btrfs: Attempting to balance a nearly full filesystem with relocated root
    nodes fails (LP: #1933172) // CVE-2019-19036
    - btrfs: reloc: fix reloc root leak and NULL pointer dereference
  * btrfs: Attempting to balance a nearly full filesystem with relocated root
    nodes fails (LP: #1933172)
    - Revert "btrfs: reloc: fix reloc root leak and NULL pointer dereference"
  * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367)
    - (upstream) media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
  * Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375)
    - net: usb: cdc_ncm: don't spew notifications
    - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
    - efi: cper: fix snprintf() use in cper_dimm_err_location()
    - vfio/pci: Fix error return code in vfio_ecap_init()
    - vfio/pci: zap_vma_ptes() needs MMU
    - vfio/platform: fix module_put call in error flow
    - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
    - HID: pidff: fix error return code in hid_pidff_init()
    - HID: i2c-hid: fix format string mismatch
    - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
    - ieee802154: fix error return code in ieee802154_add_iface()
    - ieee802154: fix error return code in ieee802154_llsec_getparams()
    - Bluetooth: fix the erroneous flush_work() order
    - Bluetooth: use correct lock to prevent UAF of hdev object
    - net: caif: added cfserl_release function
    - net: caif: add proper error handling
    - net: caif: fix memory leak in caif_device_notify
    - net: caif: fix memory leak in cfusbl_device_notify
    - ALSA: timer: Fix master timer notification
    - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
    - pid: take a reference when initializing `cad_pid`
    - ocfs2: fix data corruption by fallocate
    - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
    - btrfs: fix error handling in btrfs_del_csums
    - btrfs: fixup error handling in fixup_inode_link_counts
    - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
    - selftests/bpf: make 'dubious pointer arithmetic' test useful
    - bnxt_en: Remove the setting of dev_port.
    - KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
    - sched/fair: Optimize select_idle_cpu
    - xen-pciback: redo VF placement in the virtual topology
    - ALSA: usb: update old-style static const declaration
    - nl80211: validate key indexes for cfg80211_registered_device
    - x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing
    - btrfs: return errors from btrfs_del_csums in cleanup_ref_head
    - KVM: arm64: Fix debug register indexing

  [ Ubuntu: 4.15.0-153.160 ]

  * bionic/linux: 4.15.0-153.160 -proposed tracker (LP: #1938319)
  * 4.15.0-151 is freezing various CPUs (LP: #1938013)
    - mac80211: fix memory corruption in EAPOL handling

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Mon, 02 Aug 2021 14:56:13 -0600

linux-kvm (4.15.0-1097.99) bionic; urgency=medium

  [ Ubuntu: 4.15.0-151.157 ]

  * CVE-2021-33909
    - SAUCE: seq_file: Disallow extremely large seq buffer allocations

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Wed, 14 Jul 2021 13:04:32 +0200

linux-kvm (4.15.0-1096.98) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1096.98 -proposed tracker (LP: #1934366)

  [ Ubuntu: 4.15.0-150.155 ]

  * bionic/linux: 4.15.0-150.155 -proposed tracker (LP: #1934374)
  * lxd exec fails (LP: #1934187)
    - SAUCE: Revert "proc: Check /proc/$pid/attr/ writes against file opener"

 -- Khalid Elmously <khalid.elmously@canonical.com>  Mon, 05 Jul 2021 03:52:05 -0400

linux-kvm (4.15.0-1095.97) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1095.97 -proposed tracker (LP: #1932507)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  [ Ubuntu: 4.15.0-149.153 ]

  * bionic/linux: 4.15.0-149.153 -proposed tracker (LP: #1933434)
  * selftests: bpf: test_verifier fixes (LP: #1933385)
    - bpf: Update selftests to reflect new error states
    - bpf, selftests: Adjust few selftest result_unpriv outcomes
  * CVE-2021-33200
    - bpf: Fix mask direction swap upon off reg sign change

  [ Ubuntu: 4.15.0-148.152 ]

  * bionic/linux: 4.15.0-148.152 -proposed tracker (LP: #1932515)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * Upstream v5.9 introduced 'module' patches that removed exported symbols
    (LP: #1932065)
    - SAUCE: Revert "modules: inherit TAINT_PROPRIETARY_MODULE"
    - SAUCE: Revert "modules: return licensing information from find_symbol"
    - SAUCE: Revert "modules: rename the licence field in struct symsearch to
      license"
    - SAUCE: Revert "modules: unexport __module_address"
    - SAUCE: Revert "modules: unexport __module_text_address"
    - SAUCE: Revert "modules: mark each_symbol_section static"
    - SAUCE: Revert "modules: mark find_symbol static"
    - SAUCE: Revert "modules: mark ref_module static"
  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service
  * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740)
    - openrisc: Fix a memory leak
    - RDMA/rxe: Clear all QP fields if creation failed
    - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword()
    - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
    - cifs: fix memory leak in smb2_copychunk_range
    - ALSA: line6: Fix racy initialization of LINE6 MIDI
    - ALSA: usb-audio: Validate MS endpoint descriptors
    - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
    - Revert "ALSA: sb8: add a check for request_region"
    - Revert "rapidio: fix a NULL pointer dereference when create_workqueue()
      fails"
    - rapidio: handle create_workqueue() failure
    - xen-pciback: reconfigure also from backend watch handler
    - dm snapshot: fix crash with transient storage and zero chunk size
    - Revert "video: hgafb: fix potential NULL pointer dereference"
    - Revert "net: stmicro: fix a missing check of clk_prepare"
    - Revert "leds: lp5523: fix a missing check of return value of lp55xx_read"
    - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
    - Revert "video: imsttfb: fix potential NULL pointer dereferences"
    - Revert "ecryptfs: replace BUG_ON with error handling code"
    - Revert "gdrom: fix a memory leak bug"
    - cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom
    - cdrom: gdrom: initialize global variable at init time
    - Revert "media: rcar_drif: fix a memory disclosure"
    - Revert "rtlwifi: fix a potential NULL pointer dereference"
    - Revert "qlcnic: Avoid potential NULL pointer dereference"
    - Revert "niu: fix missing checks of niu_pci_eeprom_read"
    - ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read()
    - net: stmicro: handle clk_prepare() failure during init
    - net: rtlwifi: properly check for alloc_workqueue() failure
    - leds: lp5523: check return value of lp5xx_read and jump to cleanup code
    - qlcnic: Add null check after calling netdev_alloc_skb
    - video: hgafb: fix potential NULL pointer dereference
    - vgacon: Record video mode changes with VT_RESIZEX
    - vt: Fix character height handling with VT_RESIZEX
    - tty: vt: always invoke vc->vc_sw->con_resize callback
    - video: hgafb: correctly handle card detect failure during probe
    - Bluetooth: SMP: Fail if remote and local public keys are identical
    - firmware: arm_scpi: Prevent the ternary sign expansion bug
    - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
    - locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal
    - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293
    - Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer
      dereference"
    - mm, vmstat: drop zone->lock in /proc/pagetypeinfo
    - usb: dwc3: gadget: Enable suspend events
    - NFC: nci: fix memory leak in nci_allocate_device
    - NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
    - iommu/vt-d: Fix sysfs leak in alloc_iommu()
    - perf intel-pt: Fix sample instruction bytes
    - perf intel-pt: Fix transaction abort handling
    - proc: Check /proc/$pid/attr/ writes against file opener
    - net: hso: fix control-request directions
    - mac80211: assure all fragments are encrypted
    - mac80211: prevent mixed key and fragment cache attacks
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header
    - cfg80211: mitigate A-MSDU aggregation attacks
    - mac80211: drop A-MSDUs on old ciphers
    - mac80211: add fragment cache to sta_info
    - mac80211: check defrag PN against current frame
    - mac80211: prevent attacks on TKIP/WEP as well
    - mac80211: do not accept/forward invalid EAPOL frames
    - ath10k: Validate first subframe of A-MSDU before processing the list
    - dm snapshot: properly fix a crash when an origin has no snapshots
    - kgdb: fix gcc-11 warnings harder
    - misc/uss720: fix memory leak in uss720_probe
    - thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
    - mei: request autosuspend after sending rx flow control
    - staging: iio: cdc: ad7746: avoid overwrite of num_channels
    - iio: adc: ad7793: Add missing error code in ad7793_setup()
    - USB: trancevibrator: fix control-request direction
    - serial: sh-sci: Fix off-by-one error in FIFO threshold register setting
    - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
    - USB: serial: ti_usb_3410_5052: add startech.com device id
    - USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
    - USB: serial: ftdi_sio: add IDs for IDS GmbH Products
    - USB: serial: pl2303: add device id for ADLINK ND-6530 GC
    - usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
    - net: usb: fix memory leak in smsc75xx_bind
    - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
    - NFS: fix an incorrect limit in filelayout_decode_layout()
    - NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
    - NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
    - drm/meson: fix shutdown crash when component not probed
    - net/mlx4: Fix EEPROM dump support
    - Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
    - tipc: skb_linearize the head skb when reassembling msgs
    - i2c: s3c2410: fix possible NULL pointer deref on read message after write
    - i2c: i801: Don't generate an interrupt on bus reset
    - perf jevents: Fix getting maximum number of fds
    - platform/x86: hp_accel: Avoid invoking _INI to speed up resume
    - serial: max310x: unregister uart driver in case of failure and abort
    - net: fujitsu: fix potential null-ptr-deref
    - net: caif: remove BUG_ON(dev == NULL) in caif_xmit
    - char: hpet: add checks after calling ioremap
    - isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
    - dmaengine: qcom_hidma: comment platform_driver_register call
    - libertas: register sysfs groups properly
    - media: dvb: Add check on sp8870_readreg return
    - media: gspca: properly check for errors in po1030_probe()
    - scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
    - openrisc: Define memory barrier mb
    - btrfs: do not BUG_ON in link_to_fixup_dir
    - platform/x86: hp-wireless: add AMD's hardware id to the supported list
    - platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
    - SMB3: incorrect file id in requests compounded with open
    - drm/amdgpu: Fix a use-after-free
    - net: netcp: Fix an error message
    - net: mdio: thunder: Fix a double free issue in the .remove function
    - net: mdio: octeon: Fix some double free issues
    - net: bnx2: Fix error return code in bnx2_init_board()
    - mld: fix panic in mld_newpack()
    - staging: emxx_udc: fix loop in _nbu2ss_nuke()
    - ASoC: cs35l33: fix an error code in probe()
    - bpf: Set mac_len in bpf_skb_change_head
    - ixgbe: fix large MTU request from VF
    - scsi: libsas: Use _safe() loop in sas_resume_port()
    - ipv6: record frag_max_size in atomic fragments in input path
    - sch_dsmark: fix a NULL deref in qdisc_reset()
    - MIPS: alchemy: xxs1500: add gpio-au1000.h header file
    - MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
    - hugetlbfs: hugetlb_fault_mutex_hash() cleanup
    - drivers/net/ethernet: clean up unused assignments
    - usb: core: reduce power-on-good delay time of root hub
    - USB: usbfs: Don't WARN about excessively large memory allocations
    - bpf: extend is_branch_taken to registers
    - bpf: Move off_reg into sanitize_ptr_alu
    - bpf: Ensure off_reg has no mixed signed bounds for all types
    - bpf: Rework ptr_limit into alu_limit and add common error path
    - bpf: Improve verifier error messages for users
    - bpf: Refactor and streamline bounds check into helper
    - bpf: Move sanitize_val_alu out of op switch
    - bpf: Tighten speculative pointer arithmetic mask
    - bpf: Fix leakage of uninitialized bpf stack under speculation
    - bpf: Wrap aux data inside bpf_sanitize_info container
    - bpf: No need to simulate speculative domain for immediates
    - net: dsa: fix a crash if ->get_sset_count() fails
    - drm/amd/amdgpu: fix refcount leak
    - net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count
    - openvswitch: meter: fix race when getting now_ms.
    - net: hns3: check the return of skb_checksum_help()
  * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) //
    CVE-2020-24587 for such cases.
    - mac80211: extend protection against mixed key and fragment cache attacks
  * [82A1, Realtek ALC287, Speaker, Internal] Underruns, dropouts or crackling
    sound (LP: #1925057) // Bionic update: upstream stable patchset 2021-06-11
    (LP: #1931740)
    - ALSA: hda/realtek: reset eapd coeff to default value for alc287
  * test_map in ubuntu_bpf failed with "Allowed update sockmap '0:3' not in
    ESTABLISHED" (LP: #1839912)
    - SAUCE: Revert "bpf: test_maps, only support ESTABLISHED socks"
  * Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472)
    - MIPS: Introduce isa-rev.h to define MIPS_ISA_REV
    - MIPS: cpu-features.h: Replace __mips_isa_rev with MIPS_ISA_REV
    - s390/disassembler: increase ebpf disasm buffer size
    - ACPI: custom_method: fix potential use-after-free issue
    - ACPI: custom_method: fix a possible memory leak
    - arm64: dts: mt8173: fix property typo of 'phys' in dsi node
    - ecryptfs: fix kernel panic with null dev_name
    - spi: spi-ti-qspi: Free DMA resources
    - mmc: block: Update ext_csd.cache_ctrl if it was written
    - mmc: core: Do a power cycle when the CMD11 fails
    - mmc: core: Set read only for SD cards with permanent write protect bit
    - cifs: Return correct error code from smb2_get_enc_key
    - btrfs: fix metadata extent leak after failure to create subvolume
    - intel_th: pci: Add Rocket Lake CPU support
    - fbdev: zero-fill colormap in fbcmap.c
    - staging: wimax/i2400m: fix byte-order issue
    - crypto: api - check for ERR pointers in crypto_destroy_tfm()
    - usb: gadget: uvc: add bInterval checking for HS mode
    - usb: gadget: f_uac1: validate input parameters
    - usb: dwc3: gadget: Ignore EP queue requests during bus reset
    - usb: xhci: Fix port minor revision
    - PCI: PM: Do not read power state in pci_enable_device_flags()
    - x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)
    - tee: optee: do not check memref size on return from Secure World
    - perf/arm_pmu_platform: Fix error handling
    - spi: dln2: Fix reference leak to master
    - spi: omap-100k: Fix reference leak to master
    - intel_th: Consistency and off-by-one fix
    - phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
    - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s
    - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
    - scsi: lpfc: Fix pt2pt connection does not recover after LOGO
    - scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
    - media: ite-cir: check for receive overflow
    - power: supply: bq27xxx: fix power_avg for newer ICs
    - extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has
      been unplugged
    - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
    - media: gspca/sq905.c: fix uninitialized variable
    - power: supply: Use IRQF_ONESHOT
    - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
    - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
    - scsi: qla2xxx: Fix use after free in bsg
    - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
    - media: em28xx: fix memory leak
    - media: vivid: update EDID
    - clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
    - power: supply: generic-adc-battery: fix possible use-after-free in
      gab_remove()
    - power: supply: s3c_adc_battery: fix possible use-after-free in
      s3c_adc_bat_remove()
    - media: adv7604: fix possible use-after-free in adv76xx_remove()
    - media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
    - media: i2c: adv7842: fix possible use-after-free in adv7842_remove()
    - media: dvb-usb: fix memory leak in dvb_usb_adapter_init
    - media: gscpa/stv06xx: fix memory leak
    - drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
    - drm/amdgpu: fix NULL pointer dereference
    - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO
      response
    - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
    - scsi: libfc: Fix a format specifier
    - ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
    - ALSA: hda/conexant: Re-order CX5066 quirk table entries
    - ALSA: sb: Fix two use after free in snd_sb_qsound_build
    - btrfs: fix race when picking most recent mod log operation for an old root
    - arm64/vdso: Discard .note.gnu.property sections in vDSO
    - openvswitch: fix stack OOB read while fragmenting IPv4 packets
    - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
    - NFSv4: Don't discard segments marked for return in _pnfs_return_layout()
    - jffs2: Fix kasan slab-out-of-bounds problem
    - powerpc/eeh: Fix EEH handling for hugepages in ioremap space.
    - powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h
    - intel_th: pci: Add Alder Lake-M support
    - md/raid1: properly indicate failure when ending a failed write request
    - security: commoncap: fix -Wstringop-overread warning
    - Fix misc new gcc warnings
    - jffs2: check the validity of dstlen in jffs2_zlib_compress()
    - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op")
    - posix-timers: Preserve return value in clock_adjtime32()
    - ftrace: Handle commands when closing set_ftrace_filter file
    - ext4: fix check to prevent false positive report of incorrect used inodes
    - ext4: fix error code in ext4_commit_super
    - media: dvbdev: Fix memory leak in dvb_media_device_free()
    - usb: gadget: dummy_hcd: fix gpf in gadget_setup
    - usb: gadget: Fix double free of device descriptor pointers
    - usb: gadget/function/f_fs string table fix for multiple languages
    - usb: dwc3: gadget: Fix START_TRANSFER link state check
    - tracing: Map all PIDs to command lines
    - dm persistent data: packed struct should have an aligned() attribute too
    - dm space map common: fix division bug in sm_ll_find_free_block()
    - dm rq: fix double free of blk_mq_tag_set in dev remove after table load
      fails
    - modules: mark ref_module static
    - modules: mark find_symbol static
    - modules: mark each_symbol_section static
    - modules: unexport __module_text_address
    - modules: unexport __module_address
    - modules: rename the licence field in struct symsearch to license
    - modules: return licensing information from find_symbol
    - modules: inherit TAINT_PROPRIETARY_MODULE
    - Bluetooth: verify AMP hci_chan before amp_destroy
    - hsr: use netdev_err() instead of WARN_ONCE()
    - bluetooth: eliminate the potential race condition when removing the HCI
      controller
    - net/nfc: fix use-after-free llcp_sock_bind/connect
    - MIPS: pci-rt2880: fix slot 0 configuration
    - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
    - misc: lis3lv02d: Fix false-positive WARN on various HP models
    - misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
    - misc: vmw_vmci: explicitly initialize vmci_datagram payload
    - tracing: Restructure trace_clock_global() to never block
    - md-cluster: fix use-after-free issue when removing rdev
    - md: split mddev_find
    - md: factor out a mddev_find_locked helper from mddev_find
    - md: md_open returns -EBUSY when entering racing area
    - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
    - cfg80211: scan: drop entry from hidden_list on overflow
    - drm/radeon: fix copy of uninitialized variable back to userspace
    - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
    - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
    - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
    - x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
    - KVM: s390: split kvm_s390_logical_to_effective
    - KVM: s390: fix guarded storage control register handling
    - KVM: s390: split kvm_s390_real_to_abs
    - usb: gadget: pch_udc: Revert d3cb25a12138 completely
    - memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
    - ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
    - serial: stm32: fix incorrect characters on console
    - serial: stm32: fix tx_empty condition
    - usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
    - x86/microcode: Check for offline CPUs before requesting new microcode
    - usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
    - usb: gadget: pch_udc: Check if driver is present before calling ->setup()
    - usb: gadget: pch_udc: Check for DMA mapping error
    - crypto: qat - don't release uninitialized resources
    - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
    - fotg210-udc: Fix DMA on EP0 for length > max packet size
    - fotg210-udc: Fix EP0 IN requests bigger than two packets
    - fotg210-udc: Remove a dubious condition leading to fotg210_done
    - fotg210-udc: Mask GRP2 interrupts we don't handle
    - fotg210-udc: Don't DMA more than the buffer can take
    - fotg210-udc: Complete OUT requests on short packets
    - mtd: require write permissions for locking and badblock ioctls
    - bus: qcom: Put child node before return
    - phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y,
      unconditionally
    - crypto: qat - fix error path in adf_isr_resource_alloc()
    - USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
    - mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
    - staging: rtl8192u: Fix potential infinite loop
    - staging: greybus: uart: fix unprivileged TIOCCSERIAL
    - spi: Fix use-after-free with devm_spi_alloc_*
    - soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
    - soc: qcom: mdt_loader: Detect truncated read of segments
    - ACPI: CPPC: Replace cppc_attr with kobj_attribute
    - crypto: qat - Fix a double free in adf_create_ring
    - usb: gadget: r8a66597: Add missing null check on return from
      platform_get_resource
    - USB: cdc-acm: fix unprivileged TIOCCSERIAL
    - tty: fix return value for unsupported ioctls
    - firmware: qcom-scm: Fix QCOM_SCM configuration
    - platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with
      critclk_systems DMI table
    - x86/platform/uv: Fix !KEXEC build failure
    - ttyprintk: Add TTY hangup callback.
    - media: vivid: fix assignment of dev->fbuf_out_flags
    - media: omap4iss: return error code when omap4iss_get() failed
    - media: m88rs6000t: avoid potential out-of-bounds reads on arrays
    - x86/kprobes: Fix to check non boostable prefixes correctly
    - pata_arasan_cf: fix IRQ check
    - pata_ipx4xx_cf: fix IRQ check
    - sata_mv: add IRQ checks
    - ata: libahci_platform: fix IRQ check
    - vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
    - clk: uniphier: Fix potential infinite loop
    - scsi: jazz_esp: Add IRQ check
    - scsi: sun3x_esp: Add IRQ check
    - scsi: sni_53c710: Add IRQ check
    - mfd: stm32-timers: Avoid clearing auto reload register
    - HSI: core: fix resource leaks in hsi_add_client_from_dt()
    - x86/events/amd/iommu: Fix sysfs type mismatch
    - HID: plantronics: Workaround for double volume key presses
    - perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of
      printed chars
    - net: lapbether: Prevent racing when checking whether the netif is running
    - powerpc/prom: Mark identical_pvr_fixup as __init
    - powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
    - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
    - bug: Remove redundant condition check in report_bug
    - nfc: pn533: prevent potential memory corruption
    - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
    - liquidio: Fix unintented sign extension of a left shift of a u16
    - powerpc/perf: Fix PMU constraint check for EBB events
    - powerpc: iommu: fix build when neither PCI or IBMVIO is set
    - mac80211: bail out if cipher schemes are invalid
    - mt7601u: fix always true expression
    - IB/hfi1: Fix error return code in parse_platform_config()
    - net: thunderx: Fix unintentional sign extension issue
    - i2c: cadence: add IRQ check
    - i2c: emev2: add IRQ check
    - i2c: jz4780: add IRQ check
    - i2c: sh7760: add IRQ check
    - MIPS: pci-legacy: stop using of_pci_range_to_resource
    - powerpc/pseries: extract host bridge from pci_bus prior to bus removal
    - rtlwifi: 8821ae: upgrade PHY and RF parameters
    - i2c: sh7760: fix IRQ error path
    - mwl8k: Fix a double Free in mwl8k_probe_hw
    - vsock/vmci: log once the failed queue pair allocation
    - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
    - net: davinci_emac: Fix incorrect masking of tx and rx error channel
    - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
    - powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
    - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
    - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
    - kfifo: fix ternary sign extension bugs
    - smp: Fix smp_call_function_single_async prototype
    - Revert "of/fdt: Make sure no-map does not remove already reserved regions"
    - Revert "fdt: Properly handle "no-map" field in the memory region"
    - tpm: fix error return code in tpm2_get_cc_attrs_tbl()
    - fs: dlm: fix debugfs dump
    - tipc: convert dest node's address to network order
    - net: stmmac: Set FIFO sizes for ipq806x
    - ALSA: hdsp: don't disable if not enabled
    - ALSA: hdspm: don't disable if not enabled
    - ALSA: rme9652: don't disable if not enabled
    - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
    - Bluetooth: initialize skb_queue_head at l2cap_chan_create()
    - Bluetooth: check for zapped sk before connecting
    - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
    - mac80211: clear the beacon's CRC after channel switch
    - pinctrl: samsung: use 'int' for register masks in Exynos
    - cuse: prevent clone
    - selftests: Set CC to clang in lib.mk if LLVM is set
    - kconfig: nconf: stop endless search loops
    - sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
    - powerpc/smp: Set numa node before updating mask
    - ASoC: rt286: Generalize support for ALC3263 codec
    - samples/bpf: Fix broken tracex1 due to kprobe argument change
    - powerpc/pseries: Stop calling printk in rtas_stop_self()
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
    - powerpc/iommu: Annotate nested lock for lockdep
    - net: ethernet: mtk_eth_soc: fix RX VLAN offload
    - ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
    - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
    - PCI: Release OF node in pci_scan_device()'s error path
    - ARM: 9064/1: hw_breakpoint: Do not directly check the event's
      overflow_handler hook
    - rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
    - NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
    - NFS: Deal correctly with attribute generation counter overflow
    - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
    - NFSv4.2 fix handling of sr_eof in SEEK's reply
    - rtc: ds1307: Fix wday settings for rx8130
    - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
    - drm/radeon: Fix off-by-one power_state index heap overwrite
    - khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()
    - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
    - ksm: fix potential missing rmap_item for stable_node
    - net: fix nla_strcmp to handle more then one trailing null character
    - kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
    - netfilter: nftables: avoid overflows in nft_hash_buckets()
    - ARC: entry: fix off-by-one error in syscall number validation
    - powerpc/64s: Fix crashes when toggling stf barrier
    - powerpc/64s: Fix crashes when toggling entry flush barrier
    - squashfs: fix divide error in calculate_skip()
    - userfaultfd: release page in error path to avoid BUG_ON
    - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors
      are connected
    - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
    - usb: fotg210-hcd: Fix an error message
    - ACPI: scan: Fix a memory leak in an error handling path
    - blk-mq: Swap two calls in blk_mq_exit_queue()
    - usb: dwc3: omap: improve extcon initialization
    - usb: xhci: Increase timeout for HC halt
    - usb: dwc2: Fix gadget DMA unmap direction
    - usb: core: hub: fix race condition about TRSMRCY of resume
    - iio: gyro: mpu3050: Fix reported temperature value
    - iio: tsl2583: Fix division by a zero lux_val
    - KVM: x86: Cancel pvclock_gtod_work on module removal
    - FDDI: defxx: Make MMIO the configuration default except for EISA
    - MIPS: Reinstate platform `__div64_32' handler
    - MIPS: Avoid DIVU in `__div64_32' is result would be zero
    - MIPS: Avoid handcoded DIVU in `__div64_32' altogether
    - thermal/core/fair share: Lock the thermal zone while looping over instances
    - RDMA/i40iw: Avoid panic when reading back the IRQ affinity hint
    - kobject_uevent: remove warning in init_uevent_argv()
    - netfilter: conntrack: Make global sysctls readonly in non-init netns
    - clk: exynos7: Mark aclk_fsys1_200 as critical
    - x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
    - kgdb: fix gcc-11 warning on indentation
    - usb: sl811-hcd: improve misleading indentation
    - cxgb4: Fix the -Wmisleading-indentation warning
    - isdn: capi: fix mismatched prototypes
    - PCI: thunder: Fix compile testing
    - ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend()
    - ACPI / hotplug / PCI: Fix reference count leak in enable_slot()
    - Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated
      devices
    - Input: silead - add workaround for x86 BIOS-es which bring the chip up in a
      stuck state
    - um: Mark all kernel symbols as local
    - ceph: fix fscache invalidation
    - gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055
    - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
    - block: reexpand iov_iter after read/write
    - lib: stackdepot: turn depot_lock spinlock to raw_spinlock
    - sit: proper dev_{hold|put} in ndo_[un]init methods
    - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
    - xhci: Do not use GFP_KERNEL in (potentially) atomic context
    - ipv6: remove extra dev_hold() for fallback tunnels
    - ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld
    - arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node
    - mtd: rawnand: atmel: Update ecc_stats.corrected counter
    - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based
      controllers
    - genirq/matrix: Prevent allocation counter corruption
    - usb: xhci-mtk: support quirk to disable usb2 lpm
    - media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB
    - media: tc358743: fix possible use-after-free in tc358743_remove()
    - amdgpu: avoid incorrect %hu format string
    - s390/archrandom: add parameter check for s390_arch_random_generate
    - ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset
      PC 8
    - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx
    - ubifs: Only check replay with inode type to judge if inode linked
    - mlxsw: spectrum_mr: Update egress RIF list before route's action
    - NFS: Don't discard pNFS layout segments that are marked for return
    - tpm: vtpm_proxy: Avoid reading host log when using a virtual device
    - dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload
      sequences
    - arm64: vdso: remove commas between macro name and arguments
    - ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()
    - tty: fix memory leak in vc_deallocate
    - rsi: Use resume_noirq for SDIO
    - MIPS: pci-mt7620: fix PLL lock check
    - md: Fix missing unused status line of /proc/mdstat
    - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
    - ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
    - ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
    - regmap: set debugfs_name to NULL after it is freed
    - mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
    - mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
    - mtd: rawnand: qcom: Return actual error code instead of -ENODEV
    - usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
    - clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
    - scsi: ibmvfc: Fix invalid state machine BUG_ON()
    - sched/debug: Fix cgroup_path[] serialization
    - net: hns3: Limiting the scope of vector_ring_chain variable
    - ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
    - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
    - RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
    - net: Only allow init netns to set default tcp cong to a restricted algo
    - i2c: bail out early when RDWR parameters are wrong
    - net: bridge: when suppression is enabled exclude RARP packets
    - i2c: Add I2C_AQ_NO_REP_START adapter quirk
    - ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user()
    - PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc()
    - PCI: endpoint: Fix missing destroy_workqueue()
    - net: hns3: disable phy loopback setting in hclge_mac_start_phy
    - sctp: do asoc update earlier in sctp_sf_do_dupcook_a
    - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
    - netfilter: xt_SECMARK: add new revision to fix structure layout
    - drm/radeon: Avoid power table parsing memory leaks
    - sched/fair: Fix unfairness caused by missing load decay
    - xhci: Add reset resume quirk for AMD xhci controller.
    - cdc-wdm: untangle a circular dependency between callback and softint
    - nvme: do not try to reconfigure APST when the controller is not live
    - pinctrl: ingenic: Improve unreachable code generation
    - ARM: 9075/1: kernel: Fix interrupted SMC calls
    - scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not
      found
    - tweewide: Fix most Shebang lines
    - scripts: switch explicitly to Python 3

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Tue, 29 Jun 2021 12:08:14 -0600

linux-kvm (4.15.0-1094.96) bionic; urgency=medium

  [ Ubuntu: 4.15.0-147.151 ]

  * CVE-2021-3444
    - bpf: Fix truncation handling for mod32 dst reg wrt zero
  * CVE-2021-3600
    - SAUCE: bpf: Do not use ax register in interpreter on div/mod
    - bpf: fix subprog verifier bypass by div/mod by 0 exception
    - SAUCE: bpf: Fix 32-bit register truncation on div/mod instruction

  [ Ubuntu: 4.15.0-146.150 ]

  * UAF on CAN BCM bcm_rx_handler (LP: #1931855)
    - SAUCE: can: bcm: delay release of struct bcm_op after synchronize_rcu

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 21 Jun 2021 10:07:33 -0300

linux-kvm (4.15.0-1093.95) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1093.95 -proposed tracker (LP: #1929959)

  [ Ubuntu: 4.15.0-145.149 ]

  * bionic/linux: 4.15.0-145.149 -proposed tracker (LP: #1929967)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for submitting discard bio
    - md/raid10: extend r10bio devs to raid disks
    - md/raid10: pull the code that wait for blocked dev into one function
    - md/raid10: improve raid10 discard request
    - md/raid10: improve discard request for far layout
  * CVE-2021-23133
    - sctp: delay auto_asconf init until binding the first addr
  * Bionic update: upstream stable patchset 2021-05-25 (LP: #1929603)
    - Input: nspire-keypad - enable interrupts only when opened
    - dmaengine: dw: Make it dependent to HAS_IOMEM
    - ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
    - arc: kernel: Return -EFAULT if copy_to_user() fails
    - neighbour: Disregard DEAD dst in neigh_update
    - ARM: keystone: fix integer overflow warning
    - ASoC: fsl_esai: Fix TDM slot setup for I2S mode
    - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
    - net: ieee802154: stop dump llsec keys for monitors
    - net: ieee802154: stop dump llsec devs for monitors
    - net: ieee802154: forbid monitor for add llsec dev
    - net: ieee802154: stop dump llsec devkeys for monitors
    - net: ieee802154: forbid monitor for add llsec devkey
    - net: ieee802154: stop dump llsec seclevels for monitors
    - net: ieee802154: forbid monitor for add llsec seclevel
    - pcnet32: Use pci_resource_len to validate PCI resource
    - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
    - Input: i8042 - fix Pegatron C15B ID entry
    - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
    - readdir: make sure to verify directory entry for legacy interfaces too
    - arm64: fix inline asm in load_unaligned_zeropad()
    - arm64: alternatives: Move length validation in alternative_{insn, endif}
    - scsi: libsas: Reset num_scatter if libata marks qc as NODATA
    - netfilter: conntrack: do not print icmpv6 as unknown via /proc
    - netfilter: nft_limit: avoid possible divide error in nft_limit_init
    - net: davicom: Fix regulator not turned off on failed probe
    - net: sit: Unregister catch-all devices
    - i40e: fix the panic when running bpf in xdpdrv mode
    - ibmvnic: avoid calling napi_disable() twice
    - ibmvnic: remove duplicate napi_schedule call in do_reset function
    - ibmvnic: remove duplicate napi_schedule call in open function
    - ARM: footbridge: fix PCI interrupt mapping
    - ARM: 9071/1: uprobes: Don't hook on thumb instructions
    - pinctrl: lewisburg: Update number of pins in community
    - HID: wacom: Assign boolean values to a bool variable
    - ARM: dts: Fix swapped mmc order for omap3
    - net: geneve: check skb is large enough for IPv4/IPv6 header
    - s390/entry: save the caller of psw_idle
    - xen-netback: Check for hotplug-status existence before watching
    - cavium/liquidio: Fix duplicate argument
    - ia64: fix discontig.c section mismatches
    - ia64: tools: remove duplicate definition of ia64_mf() on ia64
    - x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
    - net: hso: fix NULL-deref on disconnect regression
    - USB: CDC-ACM: fix poison/unpoison imbalance
    - lockdep: Add a missing initialization hint to the "INFO: Trying to register
      non-static key" message
    - drm/msm: Fix a5xx/a6xx timestamps
    - Input: s6sy761 - fix coordinate read bit shift
    - net: ip6_tunnel: Unregister catch-all devices
    - ACPI: tables: x86: Reserve memory occupied by ACPI tables
    - ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
    - net: usb: ax88179_178a: initialize local variables before use
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
    - mips: Do not include hi and lo in clobber list for R6
    - bpf: Fix masking negation logic upon negative dst register
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
    - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
    - USB: Add reset-resume quirk for WD19's Realtek Hub
    - platform/x86: thinkpad_acpi: Correct thermal sensor allocation
  * r8152 tx status -71 (LP: #1922651) // Bionic update: upstream stable
    patchset 2021-05-25 (LP: #1929603)
    - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
  * seccomp_bpf:syscall_faked from kselftests fail on s390x (LP: #1928522)
    - selftests/seccomp: s390 shares the syscall and return value register
  * Fix kdump failures (LP: #1927518)
    - video: hyperv_fb: Add ratelimit on error message
    - Drivers: hv: vmbus: Increase wait time for VMbus unload
    - Drivers: hv: vmbus: Initialize unload_event statically

 -- Tim Gardner <tim.gardner@canonical.com>  Tue, 01 Jun 2021 07:31:00 -0600

linux-kvm (4.15.0-1092.94) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1092.94 -proposed tracker (LP: #1927640)

  [ Ubuntu: 4.15.0-144.148 ]

  * bionic/linux: 4.15.0-144.148 -proposed tracker (LP: #1927648)
  * Introduce the 465 driver series, fabric-manager, and libnvidia-nscq
    (LP: #1925522)
    - debian/dkms-versions -- add NVIDIA 465 and migrate 450 to 460
  * xfrm_policy.sh / pmtu.sh / udpgso_bench.sh from net in
    ubuntu_kernel_selftests will fail if running the whole suite (LP: #1856010)
    - selftests/net: bump timeout to 5 minutes
  * locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (LP: #1926184)
    - locking/barriers: Introduce smp_cond_load_relaxed() and
      atomic_cond_read_relaxed()
    - locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
  * Bionic update: upstream stable patchset 2021-04-30 (LP: #1926808)
    - net: fec: ptp: avoid register access when ipg clock is disabled
    - powerpc/4xx: Fix build errors from mfdcr()
    - atm: eni: dont release is never initialized
    - atm: lanai: dont run lanai_dev_close if not open
    - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
    - ixgbe: Fix memleak in ixgbe_configure_clsu32
    - net: tehuti: fix error return code in bdx_probe()
    - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
    - gpiolib: acpi: Add missing IRQF_ONESHOT
    - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
    - NFS: Correct size calculation for create reply length
    - net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch()
    - net: wan: fix error return code of uhdlc_init()
    - atm: uPD98402: fix incorrect allocation
    - atm: idt77252: fix null-ptr-dereference
    - sparc64: Fix opcode filtering in handling of no fault loads
    - u64_stats,lockdep: Fix u64_stats_init() vs lockdep
    - drm/radeon: fix AGP dependency
    - nfs: we don't support removing system.nfs4_acl
    - ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
    - ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
    - squashfs: fix inode lookup sanity checks
    - squashfs: fix xattr id and id lookup sanity checks
    - arm64: dts: ls1046a: mark crypto engine dma coherent
    - arm64: dts: ls1012a: mark crypto engine dma coherent
    - arm64: dts: ls1043a: mark crypto engine dma coherent
    - ARM: dts: at91-sama5d27_som1: fix phy address to 7
    - dm ioctl: fix out of bounds array access when no devices
    - bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
    - libbpf: Fix INSTALL flag order
    - macvlan: macvlan_count_rx() needs to be aware of preemption
    - net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
    - e1000e: add rtnl_lock() to e1000_reset_task
    - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
    - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
    - ftgmac100: Restart MAC HW once
    - can: peak_usb: add forgotten supported devices
    - can: c_can_pci: c_can_pci_remove(): fix use-after-free
    - can: c_can: move runtime PM enable/disable to c_can_platform
    - can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
    - mac80211: fix rate mask reset
    - net: cdc-phonet: fix data-interface release on probe failure
    - net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
    - drm/msm: fix shutdown hook in case GPU components failed to bind
    - arm64: kdump: update ppos when reading elfcorehdr
    - net/mlx5e: Fix error path for ethtool set-priv-flag
    - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening
      server
    - ACPI: scan: Rearrange memory allocation in acpi_device_add()
    - ACPI: scan: Use unique number for instance_no
    - perf auxtrace: Fix auxtrace queue conflict
    - scsi: qedi: Fix error return code of qedi_alloc_global_queues()
    - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
    - locking/mutex: Fix non debug version of mutex_lock_io_nested()
    - can: dev: Move device back to init netns on owning netns delete
    - net: sched: validate stab values
    - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
    - mac80211: fix double free in ibss_leave
    - ext4: add reclaim checks to xattr code
    - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
    - block: Suppress uevent for hidden device when removed
    - netsec: restore phy power state after controller reset
    - can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
    - dm verity: add root hash pkcs#7 signature verification
    - x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
    - selinux: vsock: Set SID for socket returned by accept()
    - ipv6: weaken the v4mapped source check
    - ext4: fix bh ref count on error paths
    - rpc: fix NULL dereference on kmalloc failure
    - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
    - ASoC: es8316: Simplify adc_pga_gain_tlv table
    - ASoC: cs42l42: Fix mixer volume control
    - ASoC: cs42l42: Always wait at least 3ms after reset
    - vhost: Fix vhost_vq_reset()
    - scsi: st: Fix a use after free in st_open()
    - scsi: qla2xxx: Fix broken #endif placement
    - staging: comedi: cb_pcidas: fix request_irq() warn
    - staging: comedi: cb_pcidas64: fix request_irq() warn
    - ASoC: rt5659: Update MCLK rate in set_sysclk()
    - ext4: do not iput inode under running transaction in ext4_rename()
    - brcmfmac: clear EAP/association status bits on linkdown events
    - net: ethernet: aquantia: Handle error cleanup of start on open
    - appletalk: Fix skb allocation size in loopback case
    - net: wan/lmc: unregister device when no matching device is found
    - bpf: Remove MTU check in __bpf_skb_max_len
    - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
    - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
    - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
    - tracing: Fix stack trace event size
    - mm: fix race by making init_zero_pfn() early_initcall
    - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
    - drm/amdgpu: check alignment on CPU page for bo map
    - reiserfs: update reiserfs_xattrs_initialized() condition
    - mm: memcontrol: fix NR_WRITEBACK leak in memcg and system stats
    - mm: memcg: make sure memory.events is uptodate when waking pollers
    - mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the
      same cacheline
    - mm: fix oom_kill event handling
    - mm: writeback: use exact memcg dirty counts
    - pinctrl: rockchip: fix restore error in resume
    - extcon: Add stubs for extcon_register_notifier_all() functions
    - extcon: Fix error handling in extcon_dev_register
    - firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
    - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
    - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
    - usb: musb: Fix suspend with devices connected for a64
    - usb: xhci-mtk: fix broken streams issue on 0.96 xHCI
    - cdc-acm: fix BREAK rx code path adding necessary calls
    - USB: cdc-acm: untangle a circular dependency between callback and softint
    - USB: cdc-acm: downgrade message to debug
    - USB: cdc-acm: fix use-after-free after probe failure
    - usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
    - staging: rtl8192e: Fix incorrect source in memcpy()
    - staging: rtl8192e: Change state information from u16 to u8
    - drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
    - ARM: dts: am33xx: add aliases for mmc interfaces
    - net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
    - mISDN: fix crash in fritzpci
    - mac80211: choose first enabled channel for monitor
    - drm/msm: Ratelimit invalid-fence message
    - platform/x86: thinkpad_acpi: Allow the FnLock LED to change state
    - x86/build: Turn off -fcf-protection for realmode targets
    - scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
    - ia64: mca: allocate early mca with GFP_ATOMIC
    - cifs: revalidate mapping when we open files for SMB1 POSIX
    - cifs: Silently ignore unknown oplock break handle
    - init/Kconfig: make COMPILE_TEST depend on !S390
    - init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM
    - ia64: fix format strings for err_inject
    - ALSA: aloop: Fix initialization of controls
    - ASoC: intel: atom: Stop advertising non working S24LE support
    - nfc: fix refcount leak in llcp_sock_bind()
    - nfc: fix refcount leak in llcp_sock_connect()
    - nfc: fix memory leak in llcp_sock_connect()
    - nfc: Avoid endless loops caused by repeated llcp_sock_connect()
    - xen/evtchn: Change irq_info lock to raw_spinlock_t
    - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
    - ia64: fix user_stack_pointer() for ptrace()
    - ocfs2: fix deadlock between setattr and dio_end_io_write
    - fs: direct-io: fix missing sdio->boundary
    - parisc: parisc-agp requires SBA IOMMU driver
    - parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers
    - ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
    - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
    - net: ensure mac header is set in virtio_net_hdr_to_skb()
    - net: sched: sch_teql: fix null-pointer dereference
    - usbip: add sysfs_lock to synchronize sysfs code paths
    - usbip: stub-dev synchronize sysfs code paths
    - usbip: synchronize event handler with sysfs code paths
    - i2c: turn recovery error on init to debug
    - regulator: bd9571mwv: Fix AVS and DVFS voltage range
    - ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips
    - amd-xgbe: Update DMA coherency values
    - sch_red: fix off-by-one checks in red_check_params()
    - gianfar: Handle error code at MAC address change
    - net:tipc: Fix a double free in tipc_sk_mcast_rcv
    - ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces
    - net/ncsi: Avoid channel_monitor hrtimer deadlock
    - ASoC: sunxi: sun4i-codec: fill ASoC card owner
    - soc/fsl: qbman: fix conflicting alignment attributes
    - clk: fix invalid usage of list cursor in register
    - clk: fix invalid usage of list cursor in unregister
    - workqueue: Move the position of debug_work_activate() in __queue_work()
    - s390/cpcmd: fix inline assembly register clobbering
    - net/mlx5: Fix placement of log_max_flow_counter
    - RDMA/cxgb4: check for ipv6 address properly while destroying listener
    - clk: socfpga: fix iomem pointer cast on 64-bit
    - net/ncsi: Add generic netlink family
    - net/ncsi: Refactor MAC, VLAN filters
    - net/ncsi: Avoid GFP_KERNEL in response handler
    - cfg80211: remove WARN_ON() in cfg80211_sme_connect
    - net: tun: set tun->dev->addr_len during TUNSETLINK processing
    - drivers: net: fix memory leak in atusb_probe
    - drivers: net: fix memory leak in peak_usb_create_dev
    - net: mac802154: Fix general protection fault
    - net: ieee802154: nl-mac: fix check on panid
    - net: ieee802154: fix nl802154 del llsec key
    - net: ieee802154: fix nl802154 del llsec dev
    - net: ieee802154: fix nl802154 add llsec key
    - net: ieee802154: fix nl802154 del llsec devkey
    - net: ieee802154: forbid monitor for set llsec params
    - net: ieee802154: forbid monitor for del llsec seclevel
    - net: ieee802154: stop dump llsec params for monitors
    - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting
      cifs_sb->prepath."
    - KVM: arm64: Hide system instruction access to Trace registers
    - KVM: arm64: Disable guest access to trace filter controls
    - drm/imx: imx-ldb: fix out of bounds array access warning
    - gfs2: report "already frozen/thawed" errors
    - block: only update parent bi_status when bio fail
    - net: phy: broadcom: Only advertise EEE for supported modes
    - netfilter: x_tables: fix compat match/target pad out-of-bound write
    - perf map: Tighten snprintf() string precision to pass gcc check on some
      32-bit arches
    - xen/events: fix setting irq affinity
    - net: hso: fix null-ptr-deref during tty device unregistration
    - usbip: vudc synchronize sysfs code paths
    - net: xfrm: Localize sequence counter per network namespace
    - i40e: Added Asym_Pause to supported link modes
    - i40e: Fix kernel oops when i40e driver removes VF's
    - drm/tegra: dc: Don't set PLL clock to 0Hz
    - riscv,entry: fix misaligned base for excp_vect_table
  * s390x broken with unknown syscall number on kernels < 5.8 (LP: #1895132)
    - s390/ptrace: return -ENOSYS when invalid syscall is supplied
    - s390/ptrace: pass invalid syscall numbers to tracing
  * Bionic update: upstream stable patchset 2021-04-14 (LP: #1923897)
    - uapi: nfnetlink_cthelper.h: fix userspace compilation error
    - ath9k: fix transmitting to stations in dynamic SMPS mode
    - net: Fix gro aggregation for udp encaps with zero csum
    - net: Introduce parse_protocol header_ops callback
    - net: check if protocol extracted by virtio_net_hdr_set_proto is correct
    - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
    - can: skb: can_skb_set_owner(): fix ref counting if socket was closed before
      setting skb ownership
    - can: flexcan: assert FRZ bit in flexcan_chip_freeze()
    - can: flexcan: enable RX FIFO after FRZ/HALT valid
    - netfilter: x_tables: gpf inside xt_find_revision()
    - cifs: return proper error code in statfs(2)
    - scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section
      names
    - Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
    - sh_eth: fix TRSCER mask for SH771x
    - net/mlx4_en: update moderation when config reset
    - net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10
    - net: sched: avoid duplicates in classes dump
    - net: usb: qmi_wwan: allow qmimux add/del with master up
    - cipso,calipso: resolve a number of problems with the DOI refcounts
    - net: lapbether: Remove netif_start_queue / netif_stop_queue
    - net: davicom: Fix regulator not turned off on failed probe
    - net: davicom: Fix regulator not turned off on driver removal
    - net: stmmac: stop each tx channel independently
    - perf traceevent: Ensure read cmdlines are null terminated.
    - s390/cio: return -EFAULT if copy_to_user() fails again
    - drm/compat: Clear bounce structures
    - drm: meson_drv add shutdown function
    - s390/cio: return -EFAULT if copy_to_user() fails
    - media: usbtv: Fix deadlock on suspend
    - net: phy: fix save wrong speed and duplex problem if autoneg is on
    - udf: fix silent AED tagLocation corruption
    - mmc: mxs-mmc: Fix a resource leak in an error handling path in
      'mxs_mmc_probe()'
    - mmc: mediatek: fix race condition between msdc_request_timeout and irq
    - powerpc: improve handling of unrecoverable system reset
    - powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
    - PCI: xgene-msi: Fix race in installing chained irq handler
    - PCI: mediatek: Add missing of_node_put() to fix reference leak
    - s390/smp: __smp_rescan_cpus() - move cpumask away from stack
    - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
    - ALSA: hda/hdmi: Cancel pending works before suspend
    - ALSA: hda: Drop the BATCH workaround for AMD controllers
    - ALSA: hda: Avoid spurious unsol event handling during S3/S4
    - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
    - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file
      capabilities")
    - s390/dasd: fix hanging DASD driver unbind
    - s390/dasd: fix hanging IO request during DASD driver unbind
    - mmc: core: Fix partition switch time for eMMC
    - Goodix Fingerprint device is not a modem
    - USB: gadget: u_ether: Fix a configfs return code
    - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio
      slot
    - usb: gadget: f_uac1: stop playback on function disable
    - usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
    - xhci: Improve detection of device initiated wake signal.
    - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing
    - USB: serial: io_edgeport: fix memory leak in edge_startup
    - USB: serial: ch341: add new Product ID
    - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
    - USB: serial: cp210x: add some more GE USB IDs
    - usbip: fix stub_dev to check for stream socket
    - usbip: fix vhci_hcd to check for stream socket
    - usbip: fix vudc to check for stream socket
    - usbip: fix vhci_hcd attach_store() races leading to gpf
    - staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
    - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
    - staging: rtl8712: unterminated string leads to read overflow
    - staging: rtl8188eu: fix potential memory corruption in
      rtw_check_beacon_data()
    - staging: ks7010: prevent buffer overflow in ks_wlan_set_scan()
    - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
    - staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan
    - staging: comedi: addi_apci_1032: Fix endian problem for COS sample
    - staging: comedi: addi_apci_1500: Fix endian problem for command sample
    - staging: comedi: adv_pci1710: Fix endian problem for AI command data
    - staging: comedi: das6402: Fix endian problem for AI command data
    - staging: comedi: das800: Fix endian problem for AI command data
    - staging: comedi: dmm32at: Fix endian problem for AI command data
    - staging: comedi: me4000: Fix endian problem for AI command data
    - staging: comedi: pcl711: Fix endian problem for AI command data
    - staging: comedi: pcl818: Fix endian problem for AI command data
    - sh_eth: fix TRSCER mask for R7S72100
    - NFSv4.2: fix return value of _nfs4_get_security_label()
    - block: rsxx: fix error return code of rsxx_pci_probe()
    - configfs: fix a use-after-free in __configfs_open_file
    - stop_machine: mark helpers __always_inline
    - include/linux/sched/mm.h: use rcu_dereference in in_vfork()
    - powerpc/64s: Fix instruction encoding for lis in ppc_function_entry()
    - binfmt_misc: fix possible deadlock in bm_register_write
    - hwmon: (lm90) Fix max6658 sporadic wrong temperature reading
    - KVM: arm64: Fix exclusive limit for IPA size
    - xen/events: reset affinity of 2-level event when tearing it down
    - xen/events: don't unmask an event channel when an eoi is pending
    - xen/events: avoid handling the same event on two cpus at the same time
    - tcp: add sanity tests to TCP_QUEUE_SEQ
    - net: qrtr: fix error return code of qrtr_sendmsg()
    - net: stmmac: fix watchdog timeout during suspend/resume stress test
    - i2c: rcar: optimize cacheline to minimize HW race condition
    - powerpc/pci: Add ppc_md.discover_phbs()
    - PCI: Fix pci_register_io_range() memory leak
    - i40e: Fix memory leak in i40e_probe
    - ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk
    - ALSA: usb-audio: Apply the control quirk to Plantronics headsets
    - mmc: cqhci: Fix random crash when remove mmc module/card
    - usbip: fix vudc usbip_sockfd_store races leading to gpf
    - net: dsa: b53: Support setting learning on port
    - ext4: check journal inode extents more carefully
    - perf tools: Use %define api.pure full instead of %pure-parser
    - tools build feature: Check if get_current_dir_name() is available
    - tools build feature: Check if eventfd() is available
    - tools build: Check if gettid() is available before providing helper
    - tools build feature: Check if pthread_barrier_t is available
    - btrfs: fix race when cloning extent buffer during rewind of an old root
    - nvmet: don't check iosqes,iocqes for discovery controllers
    - NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
    - svcrdma: disable timeouts on rdma backchannel
    - sunrpc: fix refcount leak for rpc auth modules
    - net/qrtr: fix __netdev_alloc_skb call
    - scsi: lpfc: Fix some error codes in debugfs
    - nvme-rdma: fix possible hang when failing to set io queues
    - usb-storage: Add quirk to defeat Kindle's automatic unload
    - USB: replace hardcode maximum usb string length by definition
    - usb: gadget: configfs: Fix KASAN use-after-free
    - iio:adc:stm32-adc: Add HAS_IOMEM dependency
    - iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel
    - iio: adis16400: Fix an error code in adis16400_initial_setup()
    - iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
    - iio: hid-sensor-humidity: Fix alignment issue of timestamp channel
    - iio: hid-sensor-prox: Fix scale not correct issue
    - iio: hid-sensor-temperature: Fix issues of timestamp channel
    - PCI: rpadlpar: Fix potential drc_name corruption in store functions
    - perf/x86/intel: Fix a crash caused by zero PEBS status
    - x86/ioapic: Ignore IRQ2 again
    - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
    - x86: Move TS_COMPAT back to asm/thread_info.h
    - x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
    - ext4: find old entry again if failed to rename whiteout
    - ext4: do not try to set xattr into ea_inode if value is empty
    - ext4: fix potential error in ext4_do_update_inode
    - genirq: Disable interrupts for force threaded handlers
    - btrfs: fix slab cache flags for free space tree bitmap
    - powerpc: Force inlining of cpu_has_feature() to avoid build failure
    - usbip: Fix incorrect double assignment to udc->ud.tcp_rx
    - x86/apic/of: Fix CPU devicetree-node lookups

 -- Tim Gardner <tim.gardner@canonical.com>  Thu, 13 May 2021 09:29:12 -0700

linux-kvm (4.15.0-1091.93) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1091.93 -proposed tracker (LP: #1923802)

  [ Ubuntu: 4.15.0-143.147 ]

  * bionic/linux: 4.15.0-143.147 -proposed tracker (LP: #1923811)
  * CVE-2021-29650
    - netfilter: x_tables: Use correct memory barriers.
  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
    (LP: #1918134)
    - [Packaging] dkms-build{,--nvidia-N} sync back from LRMv4
  * Security-Fix Xen XSA 371 for Kernel 5.4.0-71 (LP: #1921902) //
    CVE-2021-28688
    - xen-blkback: don't leak persistent grants from xen_blkbk_map()
  * CVE-2021-20292
    - drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
  * CVE-2021-29264
    - gianfar: fix jumbo packets+napi+rx overrun crash
  * CVE-2021-29265
    - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
  * Bcache bypasse writeback on caching device with fragmentation (LP: #1900438)
    - bcache: consider the fragmentation when update the writeback rate
  * Bionic update: upstream stable patchset 2021-03-31 (LP: #1922124)
    - net: usb: qmi_wwan: support ZTE P685M modem
    - scripts: use pkg-config to locate libcrypto
    - scripts: set proper OpenSSL include dir also for sign-file
    - hugetlb: fix update_and_free_page contig page struct assumption
    - drm/virtio: use kvmalloc for large allocations
    - virtio/s390: implement virtio-ccw revision 2 correctly
    - arm64 module: set plt* section addresses to 0x0
    - arm64: Avoid redundant type conversions in xchg() and cmpxchg()
    - arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint
    - arm64: Use correct ll/sc atomic constraints
    - JFS: more checks for invalid superblock
    - media: mceusb: sanity check for prescaler value
    - xfs: Fix assert failure in xfs_setattr_size()
    - smackfs: restrict bytes count in smackfs write functions
    - net: fix up truesize of cloned skb in skb_prepare_for_shift()
    - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing
    - net: bridge: use switchdev for port flags set through sysfs too
    - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/
    - staging: fwserial: Fix error handling in fwserial_create
    - x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
    - vt/consolemap: do font sum unsigned
    - wlcore: Fix command execute failure 19 for wl12xx
    - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
    - ath10k: fix wmi mgmt tx queue full due to race condition
    - x86/build: Treat R_386_PLT32 relocation as R_386_PC32
    - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
    - staging: most: sound: add sanity check for function argument
    - media: uvcvideo: Allow entities with no pads
    - f2fs: handle unallocated section and zone on pinned/atgc
    - parisc: Bump 64-bit IRQ stack size to 64 KB
    - Xen/gnttab: handle p2m update errors on a per-slot basis
    - xen-netback: respect gnttab_map_refs()'s return value
    - zsmalloc: account the number of compacted pages correctly
    - swap: fix swapfile read/write offset
    - media: v4l: ioctl: Fix memory leak in video_usercopy
    - PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse
    - drm/amd/display: Guard against NULL pointer deref when get_i2c_info fails
    - f2fs: fix to set/clear I_LINKABLE under i_lock
    - btrfs: fix error handling in commit_fs_roots
    - ALSA: hda/realtek: Add quirk for Clevo NH55RZQ
    - ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board
    - btrfs: raid56: simplify tracking of Q stripe presence
    - btrfs: fix raid6 qstripe kmap
    - usbip: tools: fix build error for multiple definition
    - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
    - rsxx: Return -EFAULT if copy_to_user() fails
    - dm table: fix iterate_devices based device capability checks
    - dm table: fix DAX iterate_devices based device capability checks
    - dm table: fix zoned iterate_devices based device capability checks
    - iommu/amd: Fix sleeping in atomic in increase_address_space()
    - mwifiex: pcie: skip cancel_work_sync() on reset failure path
    - platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines
    - platform/x86: acer-wmi: Cleanup accelerometer device handling
    - platform/x86: acer-wmi: Add new force_caps module parameter
    - platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability flag
    - platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch devices
    - platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire Switch
      10E SW3-016
    - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
    - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
    - drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register
    - Revert "zram: close udev startup race condition as default groups"
    - HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter
  * Bionic update: upstream stable patchset 2021-03-16 (LP: #1919380)
    - fgraph: Initialize tracing_graph_pause at task creation
    - tracing: Do not count ftrace events in top level enable output
    - tracing: Check length before giving out the filter buffer
    - arm/xen: Don't probe xenbus as part of an early initcall
    - MIPS: BMIPS: Fix section mismatch warning
    - arm64: dts: rockchip: Fix PCIe DT properties on rk3399
    - platform/x86: hp-wmi: Disable tablet-mode reporting by default
    - ovl: perform vfs_getxattr() with mounter creds
    - cap: fix conversions on getxattr
    - ovl: skip getxattr of security labels
    - ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
    - ARM: ensure the signal page contains defined contents
    - bpf: Check for integer overflow when using roundup_pow_of_two()
    - netfilter: xt_recent: Fix attempt to update deleted entry
    - xen/netback: avoid race in xenvif_rx_ring_slots_available()
    - netfilter: conntrack: skip identical origin tuple in same zone only
    - usb: dwc3: ulpi: fix checkpatch warning
    - usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one
    - net/vmw_vsock: improve locking in vsock_connect_timeout()
    - net: watchdog: hold device global xmit lock during tx disable
    - vsock/virtio: update credit only if socket is not closed
    - vsock: fix locking in vsock_shutdown()
    - i2c: stm32f7: fix configuration of the digital filter
    - h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
    - x86/build: Disable CET instrumentation in the kernel for 32-bit too
    - trace: Use -mcount-record for dynamic ftrace
    - tracing: Fix SKIP_STACK_VALIDATION=1 build due to bad merge with -mrecord-
      mcount
    - tracing: Avoid calling cc-option -mrecord-mcount for every Makefile
    - Xen/x86: don't bail early from clear_foreign_p2m_mapping()
    - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping()
    - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()
    - Xen/gntdev: correct error checking in gntdev_map_grant_pages()
    - xen/arm: don't ignore return errors from set_phys_to_machine
    - xen-blkback: don't "handle" error by BUG()
    - xen-netback: don't "handle" error by BUG()
    - xen-scsiback: don't "handle" error by BUG()
    - xen-blkback: fix error handling in xen_blkbk_map()
    - scsi: qla2xxx: Fix crash during driver load on big endian machines
    - kvm: check tlbs_dirty directly
    - drm/amd/display: Free atomic state after drm_atomic_commit
    - riscv: virt_addr_valid must check the address belongs to linear mapping
    - ARM: kexec: fix oops after TLB are invalidated
    - net: hns3: add a check for queue_id in hclge_reset_vf_queue()
    - firmware_loader: align .builtin_fw to 8
    - net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
    - ovl: expand warning in ovl_d_real()
    - net: qrtr: Fix port ID for control messages
    - HID: make arrays usage and value to be the same
    - usb: quirks: add quirk to start video capture on ELMO L-12F document camera
      reliable
    - ntfs: check for valid standard information attribute
    - arm64: tegra: Add power-domain for Tegra210 HDA
    - NET: usb: qmi_wwan: Adding support for Cinterion MV31
    - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.
    - scripts/recordmcount.pl: support big endian for ARCH sh
    - vmlinux.lds.h: add DWARF v5 sections
    - kdb: Make memory allocations more robust
    - MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
    - random: fix the RNDRESEEDCRNG ioctl
    - Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the
      probe function
    - Bluetooth: Fix initializing response id after clearing struct
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Monk
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
    - arm64: dts: exynos: correct PMIC interrupt trigger level on TM2
    - arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
    - cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()
    - usb: gadget: u_audio: Free requests only after callback
    - Bluetooth: drop HCI device reference before return
    - Bluetooth: Put HCI device if inquiry procedure interrupts
    - ARM: dts: Configure missing thermal interrupt for 4430
    - usb: dwc2: Do not update data length if it is 0 on inbound transfers
    - usb: dwc2: Abort transaction after errors with unknown reason
    - usb: dwc2: Make "trimming xfer length" a debug message
    - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules
    - arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
    - ARM: s3c: fix fiq for clang IAS
    - bpf_lru_list: Read double-checked variable once without lock
    - ath9k: fix data bus crash when setting nf_override via debugfs
    - bnxt_en: reverse order of TX disable and carrier off
    - xen/netback: fix spurious event detection for common event case
    - mac80211: fix potential overflow when multiplying to u32 integers
    - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
    - ibmvnic: skip send_request_unmap for timeout reset
    - net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout
    - net: amd-xgbe: Reset link when the link never comes back
    - net: mvneta: Remove per-cpu queue mapping for Armada 3700
    - fbdev: aty: SPARC64 requires FB_ATY_CT
    - drm/gma500: Fix error return code in psb_driver_load()
    - gma500: clean up error handling in init
    - crypto: sun4i-ss - fix kmap usage
    - MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
    - MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
    - media: i2c: ov5670: Fix PIXEL_RATE minimum value
    - media: vsp1: Fix an error handling path in the probe function
    - media: media/pci: Fix memleak in empress_init
    - media: tm6000: Fix memleak in tm6000_start_stream
    - ASoC: cs42l56: fix up error handling in probe
    - crypto: bcm - Rename struct device_private to bcm_device_private
    - media: lmedm04: Fix misuse of comma
    - media: qm1d1c0042: fix error return code in qm1d1c0042_init()
    - media: cx25821: Fix a bug when reallocating some dma memory
    - media: pxa_camera: declare variable when DEBUG is defined
    - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
    - ata: ahci_brcm: Add back regulators management
    - Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()
    - btrfs: clarify error returns values in __load_free_space_cache
    - hwrng: timeriomem - Fix cooldown period calculation
    - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
    - ima: Free IMA measurement buffer on error
    - ima: Free IMA measurement buffer after kexec syscall
    - fs/jfs: fix potential integer overflow on shift of a int
    - jffs2: fix use after free in jffs2_sum_write_data()
    - capabilities: Don't allow writing ambiguous v3 file capabilities
    - clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
    - quota: Fix memory leak when handling corrupted quota file
    - spi: cadence-quadspi: Abort read if dummy cycles required are too many
    - HID: core: detect and skip invalid inputs to snto32()
    - dmaengine: fsldma: Fix a resource leak in the remove function
    - dmaengine: fsldma: Fix a resource leak in an error handling path of the
      probe function
    - dmaengine: hsu: disable spurious interrupt
    - mfd: bd9571mwv: Use devm_mfd_add_devices()
    - fdt: Properly handle "no-map" field in the memory region
    - of/fdt: Make sure no-map does not remove already reserved regions
    - power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
    - rtc: s5m: select REGMAP_I2C
    - clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
    - regulator: axp20x: Fix reference cout leak
    - certs: Fix blacklist flag type confusion
    - spi: atmel: Put allocated master before return
    - isofs: release buffer head before return
    - auxdisplay: ht16k33: Fix refresh rate handling
    - IB/umad: Return EIO in case of when device disassociated
    - powerpc/47x: Disable 256k page size
    - mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
    - ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
    - amba: Fix resource leak for drivers without .remove
    - tracepoint: Do not fail unregistering a probe due to memory failure
    - perf tools: Fix DSO filtering when not finding a map for a sampled address
    - RDMA/rxe: Fix coding error in rxe_recv.c
    - spi: stm32: properly handle 0 byte transfer
    - mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
    - powerpc/pseries/dlpar: handle ibm, configure-connector delay status
    - powerpc/8xx: Fix software emulation interrupt
    - spi: pxa2xx: Fix the controller numbering for Wildcat Point
    - perf intel-pt: Fix missing CYC processing in PSB
    - perf test: Fix unaligned access in sample parsing test
    - Input: elo - fix an error code in elo_connect()
    - sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
    - misc: eeprom_93xx46: Fix module alias to enable module autoprobe
    - misc: eeprom_93xx46: Add module alias to avoid breaking support for non
      device tree users
    - pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
    - VMCI: Use set_page_dirty_lock() when unregistering guest memory
    - PCI: Align checking of syscall user config accessors
    - drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
    - ext4: fix potential htree index checksum corruption
    - i40e: Fix flow for IPv6 next header (extension header)
    - i40e: Fix overwriting flow control settings during driver loading
    - net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
    - ocfs2: fix a use after free on error
    - mm/memory.c: fix potential pte_unmap_unlock pte error
    - mm/hugetlb: fix potential double free in hugetlb_register_node() error path
    - arm64: Add missing ISB after invalidating TLB in __primary_switch
    - i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
    - mm/rmap: fix potential pte_unmap on an not mapped pte
    - scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
    - blk-settings: align max_sectors on "logical_block_size" boundary
    - ACPI: property: Fix fwnode string properties matching
    - ACPI: configfs: add missing check after configfs_register_default_group()
    - HID: wacom: Ignore attempts to overwrite the touch_max value from HID
    - Input: raydium_ts_i2c - do not send zero length
    - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox
      Series X|S
    - Input: joydev - prevent potential read overflow in ioctl
    - Input: i8042 - add ASUS Zenbook Flip to noselftest list
    - USB: serial: option: update interface mapping for ZTE P685M
    - usb: musb: Fix runtime PM race in musb_queue_resume_work
    - USB: serial: mos7840: fix error code in mos7840_write()
    - USB: serial: mos7720: fix error code in mos7720_write()
    - usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
    - usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
    - ALSA: hda/realtek: modify EAPD in the ALC886
    - tpm_tis: Fix check_locality for correct locality acquisition
    - KEYS: trusted: Fix migratable=1 failing
    - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
    - btrfs: fix reloc root leak with 0 ref reloc roots on recovery
    - btrfs: fix extent buffer leak on failure to copy root
    - crypto: sun4i-ss - checking sg length is not sufficient
    - crypto: sun4i-ss - handle BigEndian for cipher
    - seccomp: Add missing return in non-void function
    - drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
    - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
    - x86/reboot: Force all cpus to exit VMX root if VMX is supported
    - floppy: reintroduce O_NDELAY fix
    - arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing
    - watchdog: mei_wdt: request stop on unregister
    - mtd: spi-nor: hisi-sfc: Put child node np on error path
    - fs/affs: release old buffer head on error path
    - hugetlb: fix copy_huge_page_from_user contig page struct assumption
    - mm: hugetlb: fix a race between freeing and dissolving the page
    - libnvdimm/dimm: Avoid race between probe and available_slots_show()
    - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
    - mmc: sdhci-esdhc-imx: fix kernel panic when remove module
    - gpio: pcf857x: Fix missing first interrupt
    - printk: fix deadlock when kernel panic
    - f2fs: fix out-of-repair __setattr_copy()
    - sparc32: fix a user-triggerable oops in clear_user()
    - gfs2: Don't skip dlm unlock if glock has an lvb
    - dm era: Recover committed writeset after crash
    - dm era: Verify the data block size hasn't changed
    - dm era: Fix bitset memory leaks
    - dm era: Use correct value size in equality function of writeset tree
    - dm era: Reinitialize bitset cache before digesting a new writeset
    - dm era: only resize metadata in preresume
    - icmp: introduce helper for nat'd source address in network device context
    - icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n
    - gtp: use icmp_ndo_send helper
    - sunvnet: use icmp_ndo_send helper
    - ipv6: icmp6: avoid indirect call for icmpv6_send()
    - ipv6: silence compilation warning for non-IPV6 builds
    - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
    - dm era: Update in-core bitset after committing the metadata
    - USB: quirks: sort quirk entries
    - jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked()
      operations
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5
    - ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family
    - arm64: dts: allwinner: A64: properly connect USB PHY to port 0
    - arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card
    - arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
    - memory: ti-aemif: Drop child node when jumping out loop
    - ibmvnic: add memory barrier to protect long term buffer
    - net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning
    - drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition
    - drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth reduction.
    - crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size error)
    - f2fs: fix to avoid inconsistent quota data
    - regulator: s5m8767: Drop regulators OF node reference
    - mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to
      128-bytes
    - RDMA/rxe: Correct skb on loopback path
    - i40e: Add zero-initialization of AQ command structures
    - i40e: Fix add TC filter for IPv6
    - r8169: fix jumbo packet handling on RTL8168e
    - USB: serial: ftdi_sio: fix FTX sub-integer prescaler
    - crypto: arm64/sha - add missing module aliases
    - misc: rtsx: init of rts522a add OCP power off when no card is present
    - seq_file: document how per-entry resources are managed.
    - x86: fix seq_file iteration for pat/memtype.c

 -- Tim Gardner <tim.gardner@canonical.com>  Mon, 19 Apr 2021 11:52:35 -0600

linux-kvm (4.15.0-1090.92) bionic; urgency=medium

  [ Ubuntu: 4.15.0-142.146 ]

  * overlayfs calls vfs_setxattr without cap_convert_nscap
    - vfs: move cap_convert_nscap() call into vfs_setxattr()
  * CVE-2021-29154
    - SAUCE: bpf, x86: Validate computation of branch displacements for x86-64

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 13 Apr 2021 12:52:22 +0200

# For older changelog entries, run 'apt-get changelog linux-headers-4.15.0-1099-kvm'
