linux-kvm (4.15.0-1110.113) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1110.113 -proposed tracker (LP: #1964232)

  [ Ubuntu: 4.15.0-172.181 ]

  * CVE-2022-0847
    - lib/iov_iter: initialize "flags" in new pipe_buffer
  * Bionic update: upstream stable patchset 2022-02-11 (LP: #1960681)
    - Bluetooth: bfusb: fix division by zero in send path
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - staging: wlan-ng: Avoid bitwise vs logical OR warning in
      hfa384x_usb_throttlefn()
    - drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
    - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
    - media: uvcvideo: fix division by zero at stream start
    - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with
      interrupts enabled
    - Bluetooth: schedule SCO timeouts with delayed_work
    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
    - HID: uhid: Fix worker destroying device without any protection
    - HID: wacom: Ignore the confidence flag when a touch is removed
    - HID: wacom: Avoid using stale array indicies to read contact count
    - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed
      bind()
    - rtc: cmos: take rtc_lock while reading from CMOS
    - media: flexcop-usb: fix control-message timeouts
    - media: mceusb: fix control-message timeouts
    - media: em28xx: fix control-message timeouts
    - media: cpia2: fix control-message timeouts
    - media: s2255: fix control-message timeouts
    - media: dib0700: fix undefined behavior in tuner shutdown
    - media: redrat3: fix control-message timeouts
    - media: pvrusb2: fix control-message timeouts
    - media: stk1160: fix control-message timeouts
    - can: softing_cs: softingcs_probe(): fix memleak on registration failure
    - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
    - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
    - clk: bcm-2835: Pick the closest clock rate
    - clk: bcm-2835: Remove rounding up the dividers
    - wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
    - media: em28xx: fix memory leak in em28xx_init_dev
    - Bluetooth: stop proccessing malicious adv data
    - media: dmxdev: fix UAF when dvb_register_device() fails
    - crypto: qce - fix uaf on qce_ahash_register_one
    - tty: serial: atmel: Check return code of dmaengine_submit()
    - tty: serial: atmel: Call dma_async_issue_pending()
    - media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
    - netfilter: bridge: add support for pppoe filtering
    - arm64: dts: qcom: msm8916: fix MMC controller aliases
    - drm/amdgpu: Fix a NULL pointer dereference in
      amdgpu_connector_lcd_native_mode()
    - drm/radeon/radeon_kms: Fix a NULL pointer dereference in
      radeon_driver_open_kms()
    - serial: amba-pl011: do not request memory region twice
    - floppy: Fix hang in watchdog when disk is ejected
    - media: dib8000: Fix a memleak in dib8000_init()
    - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
    - media: si2157: Fix "warm" tuner state detection
    - sched/rt: Try to restart rt period timer when rt runtime exceeded
    - media: dw2102: Fix use after free
    - media: msi001: fix possible null-ptr-deref in msi001_probe()
    - usb: ftdi-elan: fix memory leak on device disconnect
    - x86/mce/inject: Avoid out-of-bounds write when setting flags
    - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      __nonstatic_find_io_region()
    - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      nonstatic_find_mem_region()
    - ppp: ensure minimum packet size in ppp_write()
    - fsl/fman: Check for null pointer after calling devm_ioremap
    - spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
    - tpm: add request_locality before write TPM_INT_ENABLE
    - can: softing: softing_startstop(): fix set but not used variable warning
    - can: xilinx_can: xcan_probe(): check for error irq
    - pcmcia: fix setting of kthread task states
    - net: mcs7830: handle usb read errors properly
    - ext4: avoid trim error on fs with small groups
    - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
    - RDMA/hns: Validate the pkey index
    - powerpc/prom_init: Fix improper check of prom_getprop()
    - ALSA: oss: fix compile error when OSS_DEBUG is enabled
    - char/mwave: Adjust io port register size
    - scsi: ufs: Fix race conditions related to driver data
    - RDMA/core: Let ib_find_gid() continue search even after empty entry
    - dmaengine: pxa/mmp: stop referencing config->slave_id
    - iommu/iova: Fix race between FQ timeout and teardown
    - ASoC: samsung: idma: Check of ioremap return value
    - misc: lattice-ecp3-config: Fix task hung when firmware load failed
    - mips: lantiq: add support for clk_set_parent()
    - mips: bcm63xx: add support for clk_set_parent()
    - RDMA/cxgb4: Set queue pair state when being queried
    - Bluetooth: Fix debugfs entry leak in hci_register_dev()
    - fs: dlm: filter user dlm messages for kernel locks
    - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
    - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
    - usb: gadget: f_fs: Use stream_open() for endpoint files
    - HID: apple: Do not reset quirks when the Fn key is not found
    - media: b2c2: Add missing check in flexcop_pci_isr:
    - mlxsw: pci: Add shutdown method in PCI driver
    - drm/bridge: megachips: Ensure both bridges are probed before registration
    - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
    - HSI: core: Fix return freed object in hsi_new_client
    - mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
    - usb: uhci: add aspeed ast2600 uhci support
    - floppy: Add max size check for user space request
    - media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
    - media: saa7146: hexium_orion: Fix a NULL pointer dereference in
      hexium_attach()
    - media: m920x: don't use stack on USB reads
    - iwlwifi: mvm: synchronize with FW after multicast commands
    - ath10k: Fix tx hanging
    - net: bonding: debug: avoid printing debug logs when bond is not notifying
      peers
    - bpf: Do not WARN in bpf_warn_invalid_xdp_action()
    - media: igorplugusb: receiver overflow should be reported
    - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in
      hexium_attach()
    - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
    - arm64: tegra: Adjust length of CCPLEX cluster MMIO region
    - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
    - iwlwifi: fix leaks/bad data after failed firmware load
    - iwlwifi: remove module loading failure message
    - um: registers: Rename function names to avoid conflicts and build problems
    - jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
    - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
    - ACPICA: Utilities: Avoid deleting the same object twice in a row
    - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
    - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
    - btrfs: remove BUG_ON() in find_parent_nodes()
    - btrfs: remove BUG_ON(!eie) in find_parent_nodes
    - net: mdio: Demote probed message to debug print
    - mac80211: allow non-standard VHT MCS-10/11
    - dm btree: add a defensive bounds check to insert_at()
    - dm space map common: add bounds check to sm_ll_lookup_bitmap()
    - net: phy: marvell: configure RGMII delays for 88E1118
    - serial: pl010: Drop CR register reset on set_termios
    - serial: core: Keep mctrl register state and cached copy in sync
    - parisc: Avoid calling faulthandler_disabled() twice
    - powerpc/6xx: add missing of_node_put
    - powerpc/powernv: add missing of_node_put
    - powerpc/cell: add missing of_node_put
    - powerpc/btext: add missing of_node_put
    - powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
    - i2c: i801: Don't silently correct invalid transfer size
    - powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
    - i2c: mpc: Correct I2C reset procedure
    - w1: Misuse of get_user()/put_user() reported by sparse
    - ALSA: seq: Set upper limit of processed events
    - MIPS: OCTEON: add put_device() after of_find_device_by_node()
    - i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
    - MIPS: Octeon: Fix build errors using clang
    - scsi: sr: Don't use GFP_DMA
    - ASoC: mediatek: mt8173: fix device_node leak
    - power: bq25890: Enable continuous conversion for ADC at charging
    - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
    - serial: Fix incorrect rs485 polarity on uart open
    - cputime, cpuacct: Include guest time in user time in cpuacct.stat
    - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
    - ext4: make sure quota gets properly shutdown on error
    - ext4: set csum seed in tmp inode while migrating to extents
    - ext4: Fix BUG_ON in ext4_bread when write quota data
    - ext4: don't use the orphan list when migrating an inode
    - crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
    - drm/radeon: fix error handling in radeon_driver_open_kms
    - firmware: Update Kconfig help text for Google firmware
    - Documentation: refer to config RANDOMIZE_BASE for kernel address-space
      randomization
    - RDMA/hns: Modify the mapping attribute of doorbell to device
    - RDMA/rxe: Fix a typo in opcode name
    - powerpc/cell: Fix clang -Wimplicit-fallthrough warning
    - powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
    - net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
    - parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
    - net: axienet: Wait for PhyRstCmplt after core reset
    - net: axienet: fix number of TX ring slots for available check
    - netns: add schedule point in ops_exit_list()
    - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
    - dmaengine: at_xdmac: Don't start transactions at tx_submit level
    - dmaengine: at_xdmac: Print debug message after realeasing the lock
    - dmaengine: at_xdmac: Fix lld view setting
    - dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
    - net_sched: restore "mpu xxx" handling
    - bcmgenet: add WOL IRQ check
    - scripts/dtc: dtx_diff: remove broken example from help text
    - lib82596: Fix IRQ check in sni_82596_probe
    - mips,s390,sh,sparc: gup: Work around the "COW can break either way" issue
    - gianfar: simplify FCS handling and fix memory leak
    - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
    - firmware: qemu_fw_cfg: fix kobject leak in probe error path
    - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after
      reboot from Windows
    - wcn36xx: Release DMA channel descriptor allocations
    - tty: serial: uartlite: allow 64 bit address
    - xfrm: fix a small bug in xfrm_sa_len()
    - mmc: meson-mx-sdio: add IRQ check
    - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
    - staging: greybus: audio: Check null pointer
    - Bluetooth: hci_bcm: Check for error irq
    - ASoC: rt5663: Handle device_property_read_u32_array error codes
    - rpmsg: Only invoke announce_create for rpdev with endpoints
    - rpmsg: core: Clean up resources on announce_create failure.
    - dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
    - rtc: pxa: fix null pointer dereference
  * CVE-2022-0435
    - tipc: improve size validations for received domain records
  * CVE-2022-0492
    - cgroup-v1: Require capabilities to set release_agent
  * CVE-2021-3506
    - f2fs: fix to avoid out-of-bounds memory access
  * Bionic update: upstream stable patchset 2022-02-01 (LP: #1959709)
    - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
    - tracing: Tag trace_percpu_buffer as a percpu pointer
    - virtio_pci: Support surprise removal of virtio pci device
    - ieee802154: atusb: fix uninit value in atusb_set_extended_addr
    - RDMA/core: Don't infoleak GRH fields
    - mac80211: initialize variable have_higher_than_11mbit
    - i40e: fix use-after-free in i40e_sync_filters_subtask()
    - i40e: Fix incorrect netdev's real number of RX/TX queues
    - ipv6: Check attribute length for RTA_GATEWAY in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
    - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
    - power: reset: ltc2952: Fix use of floating point literals
    - rndis_host: support Hytera digital radios
    - phonet: refcount leak in pep_sock_accep
    - ipv6: Continue processing multipath route even if gateway attribute is
      invalid
    - ipv6: Do cleanup if attribute validation fails in multipath route
    - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
    - net: udp: fix alignment problem in udp4_seq_show()
    - mISDN: change function names to avoid conflicts
    - usb: mtu3: fix interval value for intr and isoc
  * Bionic update: upstream stable patchset 2022-01-27 (LP: #1959335)
    - tee: handle lookup of shm with reference count 0
    - platform/x86: apple-gmux: use resource_size() with res
    - selinux: initialize proto variable in selinux_ip_postroute_compat()
    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    - net: usb: pegasus: Do not drop long Ethernet frames
    - NFC: st21nfca: Fix memory leak in device probe and remove
    - fsl/fman: Fix missing put_device() call in fman_port_probe
    - nfc: uapi: use kernel size_t to fix user-space builds
    - uapi: fix linux/nfc.h userspace compilation errors
    - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
    - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
    - binder: fix async_free_space accounting for empty parcels
    - scsi: vmw_pvscsi: Set residual data length conditionally
    - Input: appletouch - initialize work before device registration
    - Input: spaceball - fix parsing of movement data packets
    - net: fix use-after-free in tw_timer_handler
    - sctp: use call_rcu to free endpoint
    - Input: i8042 - add deferred probe support
    - Input: i8042 - enable deferred probe quirk for ASUS UM325UA
    - i2c: validate user data in compat ioctl
    - usb: mtu3: set interval of FS intr and isoc endpoint
  * Bionic update: upstream stable patchset 2022-01-27 (LP: #1959335) //
    HID_ASUS should depend on USB_HID in stable v4.15 backports (LP: #1959762)
    - HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option
  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Thu, 10 Mar 2022 09:35:30 -0800

linux-kvm (4.15.0-1109.112) bionic; urgency=medium

  * Disable unprivileged BPF by default (LP: #1961338)
    - [Config] kvm: Enable CONFIG_BPF_UNPRIV_DEFAULT_OFF

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis

  [ Ubuntu: 4.15.0-171.180 ]

  * CVE-2022-0001
    - cpu/SMT: create and export cpu_smt_possible()
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
    - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
    - SAUCE: x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - SAUCE: x86/speculation: Add eIBRS + Retpoline options
    - SAUCE: Documentation/hw-vuln: Update spectre doc
  * Disable unprivileged BPF by default (LP: #1961338)
    - bpf: Add kconfig knob for disabling unpriv bpf by default
    - [Config] set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y

 -- Andrea Righi <andrea.righi@canonical.com>  Thu, 03 Mar 2022 08:42:11 +0100

linux-kvm (4.15.0-1107.109) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1107.109 -proposed tracker (LP: #1959300)

  * Packaging resync (LP: #1786013)
    - [Config] kvm: enable ARCH_USE_MEMREMAP_PROT
    - [Config] kvm: Remove a few HID driver configs

  [ Ubuntu: 4.15.0-169.177 ]

  * bionic/linux: 4.15.0-169.177 -proposed tracker (LP: #1959877)
  * ubuntu_kernel_selftests.ftrace:ftracetest fails with bionic:linux
    4.15.0-168.176 on s390x (LP: #1959752)
    - recordmcount.pl: fix typo in s390 mcount regex

  [ Ubuntu: 4.15.0-168.176 ]

  * bionic/linux: 4.15.0-168.176 -proposed tracker (LP: #1959308)
  * CVE-2022-22942
    - SAUCE: drm/vmwgfx: Fix stale file descriptors on failed usercopy
  * Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033)
    - IB/qib: Use struct_size() helper
    - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
    - can: kvaser_usb: get CAN clock frequency from device
    - HID: holtek: fix mouse probing
    - spi: change clk_disable_unprepare to clk_unprepare
    - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
    - qlcnic: potential dereference null pointer of rx_queue->page_ring
    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
    - net: skip virtio_net_hdr_set_proto if protocol already set
    - bonding: fix ad_actor_system option setting to default
    - fjes: Check for error irq
    - drivers: net: smc911x: Check for error irq
    - sfc: falcon: Check null pointer of rx_queue->page_ring
    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
    - ALSA: jack: Check the return value of kstrdup()
    - ALSA: drivers: opl3: Fix incorrect use of vp->state
    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
    - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
    - pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
    - ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
    - KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
    - hwmon: (lm90) Do not report 'busy' status bit as alarm
    - ax25: NPD bug when detaching AX25 device
    - hamradio: defer ax25 kfree after unregister_netdev
    - hamradio: improve the incomplete fix to avoid NPD
    - phonet/pep: refuse to enable an unbound pipe
    - parisc: Correct completer in lws start
  * Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957)
    - nfc: fix segfault in nfc_genl_dump_devices_done
    - drm/msm/dsi: set default num_data_lanes
    - net/mlx4_en: Update reported link modes for 1/10G
    - parisc/agp: Annotate parisc agp init functions with __init
    - i2c: rk3x: Handle a spurious start completion interrupt flag
    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
    - tracing: Fix a kmemleak false positive in tracing_map
    - bpf: fix panic due to oob in bpf_prog_test_run_skb
    - hwmon: (dell-smm) Fix warning on /proc/i8k creation error
    - mac80211: send ADDBA requests using the tid/queue of the aggregation session
    - recordmcount.pl: look for jgnop instruction as well as bcrl on s390
    - dm btree remove: fix use after free in rebalance_children()
    - audit: improve robustness of the audit queue handling
    - nfsd: fix use-after-free due to delegation race
    - x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol
    - x86/sme: Explicitly map new EFI memmap table as encrypted
    - ARM: socfpga: dts: fix qspi node compatible
    - dmaengine: st_fdma: fix MODULE_ALIAS
    - soc/tegra: fuse: Fix bitwise vs. logical OR warning
    - igbvf: fix double free in `igbvf_probe`
    - ixgbe: set X550 MDIO speed before talking to PHY
    - net/packet: rx_owner_map depends on pg_vec
    - sit: do not call ipip6_dev_free() from sit_init_net()
    - USB: gadget: bRequestType is a bitfield, not a enum
    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
    - PCI/MSI: Mask MSI-X vectors only on success
    - USB: serial: option: add Telit FN990 compositions
    - timekeeping: Really make sure wall_to_monotonic isn't positive
    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
    - net: systemport: Add global locking for descriptor lifecycle
    - firmware: arm_scpi: Fix string overflow in SCPI genpd driver
    - ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
    - fuse: annotate lock in fuse_reverse_inval_entry()
    - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
    - net: lan78xx: Avoid unnecessary self assignment
    - ARM: 8805/2: remove unneeded naked function usage
    - mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO
    - ARM: 8800/1: use choice for kernel unwinders
    - [Config] updateconfigs for UNWINDER_ARM
    - Input: touchscreen - avoid bitwise vs logical OR warning
    - xen/blkfront: harden blkfront against event channel storms
    - xen/netfront: harden netfront against event channel storms
    - xen/console: harden hvc_xen against event channel storms
    - xen/netback: fix rx queue stall detection
    - xen/netback: don't queue unlimited number of packages
    - mac80211: track only QoS data frames for admission control
  * Bionic update: upstream stable patchset 2022-01-11 (LP: #1957113)
    - HID: add hid_is_usb() function to make it simpler for USB detection
    - HID: add USB_HID dependancy to hid-prodikeys
    - HID: add USB_HID dependancy to hid-chicony
    - HID: add USB_HID dependancy on some USB HID drivers
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - can: sja1000: fix use after free in ems_pcmcia_add_card()
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - bpf: Fix the off-by-two error in range markings
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - IB/hfi1: Correct guard on eager buffer deallocation
    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
    - ALSA: ctl: Fix copy of updated id with element read/write
    - ALSA: pcm: oss: Fix negative period/buffer sizes
    - ALSA: pcm: oss: Limit the period size to 16MB
    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
    - tracefs: Have new files inherit the ownership of their parent
    - can: pch_can: pch_can_rx_normal: fix use after free
    - can: m_can: Disable and ignore ELO interrupt
    - libata: add horkage for ASMedia 1092
    - wait: add wake_up_pollfree()
    - binder: use wake_up_pollfree()
    - signalfd: use wake_up_pollfree()
    - tracefs: Set all files to the same group ownership as the mount option
    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
    - qede: validate non LSO skb length
    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
    - net: altera: set a couple error code in probe()
    - net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
    - net, neigh: clear whole pneigh_entry at alloc time
    - net/qla3xxx: fix an error code in ql_adapter_up()
    - USB: gadget: detect too-big endpoint 0 requests
    - USB: gadget: zero allocate endpoint 0 buffers
    - usb: core: config: fix validation of wMaxPacketValue entries
    - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
      suspending
    - usb: core: config: using bit mask instead of individual bits
    - iio: trigger: Fix reference counting
    - iio: trigger: stm32-timer: fix MODULE_ALIAS
    - iio: stk3310: Don't return error code in interrupt handler
    - iio: mma8452: Fix trigger reference couting
    - iio: ltr501: Don't return error code in trigger handler
    - iio: kxsd9: Don't return error code in trigger handler
    - iio: itg3200: Call iio_trigger_notify_done() on error
    - iio: dln2-adc: Fix lockdep complaint
    - iio: dln2: Check return value of devm_iio_trigger_register()
    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
    - irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
    - irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
    - irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
    - irqchip: nvic: Fix offset for Interrupt Priority Offsets
    - bonding: make tx_rebalance_counter an atomic
  * Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614)
    - USB: serial: option: add Telit LE910S1 0x9200 composition
    - USB: serial: option: add Fibocom FM101-GL variants
    - usb: hub: Fix usb enumeration issue due to address0 race
    - usb: hub: Fix locking issues with address0_mutex
    - binder: fix test regression due to sender_euid change
    - ALSA: ctxfi: Fix out-of-range access
    - media: cec: copy sequence field for the reply
    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
    - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
    - fuse: fix page stealing
    - xen: don't continue xenstore initialization in case of errors
    - xen: detect uninitialized xenbus in xenbus_init
    - tracing: Fix pid filtering when triggers are attached
    - netfilter: ipvs: Fix reuse connection if RS weight is 0
    - ARM: dts: BCM5301X: Fix I2C controller interrupt
    - ARM: dts: BCM5301X: Add interrupt properties to GPIO node
    - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
    - net: ieee802154: handle iftypes as u32
    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
    - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
    - drm/vc4: fix error code in vc4_create_object()
    - ipv6: fix typos in __ip6_finish_output()
    - net/smc: Ensure the active closing peer first closes clcsock
    - PM: hibernate: use correct mode for swsusp_close()
    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
      flows
    - MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
    - net/smc: Don't call clcsock shutdown twice when smc shutdown
    - vhost/vsock: fix incorrect used length reported to the guest
    - tracing: Check pid filtering when creating events
    - s390/mm: validate VMA in PGSTE manipulation functions
    - PCI: aardvark: Fix a leaked reference by adding missing of_node_put()
    - PCI: aardvark: Wait for endpoint to be ready before training link
    - PCI: aardvark: Train link immediately after enabling training
    - PCI: aardvark: Improve link training
    - PCI: aardvark: Issue PERST via GPIO
    - PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros
    - PCI: aardvark: Indicate error in 'val' when config read fails
    - PCI: aardvark: Introduce an advk_pcie_valid_device() helper
    - PCI: aardvark: Don't touch PCIe registers if no card connected
    - PCI: aardvark: Fix compilation on s390
    - PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link()
    - PCI: aardvark: Update comment about disabling link training
    - PCI: aardvark: Remove PCIe outbound window configuration
    - PCI: aardvark: Configure PCIe resources from 'ranges' DT property
    - PCI: aardvark: Fix PCIe Max Payload Size setting
    - PCI: Add PCI_EXP_LNKCTL2_TLS* macros
    - PCI: aardvark: Fix link training
    - PCI: aardvark: Fix checking for link up via LTSSM state
    - pinctrl: armada-37xx: Correct mpp definitions
    - pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup
    - pinctrl: armada-37xx: Correct PWM pins definitions
    - arm64: dts: marvell: armada-37xx: declare PCIe reset pin
    - arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function
    - proc/vmcore: fix clearing user buffer by properly using clear_user()
    - NFC: add NCI_UNREG flag to eliminate the race
    - fuse: release pipe buf after last use
    - xen: sync include/xen/interface/io/ring.h with Xen's newest version
    - xen/blkfront: read response from backend only once
    - xen/blkfront: don't take local copy of a request from the ring page
    - xen/blkfront: don't trust the backend response data blindly
    - xen/netfront: read response from backend only once
    - xen/netfront: don't read data from request on the ring page
    - xen/netfront: disentangle tx_skb_freelist
    - xen/netfront: don't trust the backend response data blindly
    - tty: hvc: replace BUG_ON() with negative return value
    - shm: extend forced shm destroy to support objects from several IPC nses
    - ipc: WARN if trying to remove ipc object which is absent
    - NFSv42: Fix pagecache invalidation after COPY/CLONE
    - hugetlb: take PMD sharing into account when flushing tlb/caches
    - net: return correct error code
    - platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
    - s390/setup: avoid using memblock_enforce_memory_limit
    - btrfs: check-integrity: fix a warning on write caching disabled disk
    - thermal: core: Reset previous low and high trip during thermal zone init
    - scsi: iscsi: Unblock session then wake up error handler
    - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in
      hns_dsaf_ge_srst_by_port()
    - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of
      bound
    - net: ethernet: dec: tulip: de4x5: fix possible array overflows in
      type3_infoblock()
    - perf hist: Fix memory leak of a perf_hpp_fmt
    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
    - kprobes: Limit max data_size of the kretprobe instances
    - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
    - sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
    - natsemi: xtensa: fix section mismatch warnings
    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
      qlcnic_83xx_add_rings()
    - net: mpls: Fix notifications when deleting a device
    - siphash: use _unaligned version by default
    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ
      is available
    - net/rds: correct socket tunable error in rds_tcp_tune()
    - net/smc: Keep smc_close_final rc during active close
    - parisc: Fix KBUILD_IMAGE for self-extracting kernel
    - parisc: Fix "make install" on newer debian releases
    - vgacon: Propagate console boot parameters before calling `vc_resize'
    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
    - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
    - x86/64/mm: Map all kernel memory into trampoline_pgd
    - tty: serial: msm_serial: Deactivate RX DMA for polling support
    - serial: pl011: Add ACPI SBSA UART match id
    - serial: core: fix transmit-buffer reset and memleak
    - parisc: Mark cr16 CPU clocksource unstable on all SMP machines
    - xtensa: use CONFIG_USE_OF instead of CONFIG_OF
    - net: hns3: fix VF RSS failed problem after PF enable multi-TCs
    - i2c: stm32f7: recover the bus on access timeout
    - net: annotate data-races on txq->xmit_lock_owner
  * CVE-2022-0330
    - drm/i915: Flush TLBs before releasing backing store
  * CVE-2021-4083
    - fs: add fget_many() and fput_many()
    - fget: check that the fd still exists after getting a ref to it
  * CVE-2021-4155
    - xfs: map unwritten blocks in XFS_IOC_{ALLOC, FREE}SP just like fallocate

 -- Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>  Wed, 09 Feb 2022 18:39:21 -0800

linux-kvm (4.15.0-1106.108) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1106.108 -proposed tracker (LP: #1955268)

  [ Ubuntu: 4.15.0-167.175 ]

  * bionic/linux: 4.15.0-167.175 -proposed tracker (LP: #1955276)
  * hisi_sas driver may oops in prep_ssp_v3_hw() (LP: #1953386)
    - scsi: hisi_sas: Fix to only call scsi_get_prot_op() for non-NULL scsi_cmnd
  * Bionic update: upstream stable patchset 2021-12-13 (LP: #1954703)
    - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good
      delay
    - binder: use euid from cred instead of using task
    - Input: elantench - fix misreporting trackpoint coordinates
    - Input: i8042 - Add quirk for Fujitsu Lifebook T725
    - libata: fix read log timeout value
    - ocfs2: fix data corruption on truncate
    - mmc: dw_mmc: Dont wait for DRTO on Write RSP error
    - parisc: Fix ptrace check on syscall return
    - tpm: Check for integer overflow in tpm2_map_response_body()
    - media: ite-cir: IR receiver stop working after receive overflow
    - ALSA: ua101: fix division by zero at probe
    - ALSA: 6fire: fix control and bulk message timeouts
    - ALSA: line6: fix control and interrupt message timeouts
    - ALSA: synth: missing check for possible NULL after the call to kstrdup
    - ALSA: timer: Fix use-after-free problem
    - ALSA: timer: Unconditionally unlink slave instances, too
    - x86/irq: Ensure PI wakeup handler is unregistered before module unload
    - cavium: Return negative value when pci_alloc_irq_vectors() fails
    - scsi: qla2xxx: Fix unmap of already freed sgl
    - cavium: Fix return values of the probe function
    - sfc: Don't use netif_info before net_device setup
    - hyperv/vmbus: include linux/bitops.h
    - mmc: winbond: don't build on M68K
    - bpf: Prevent increasing bpf_jit_limit above max
    - xen/netfront: stop tx queues during live migration
    - spi: spl022: fix Microwire full duplex mode
    - watchdog: Fix OMAP watchdog early handling
    - vmxnet3: do not stop tx queues after netif_device_detach()
    - btrfs: fix lost error handling when replaying directory deletes
    - hwmon: (pmbus/lm25066) Add offset coefficients
    - regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is
      disabled
    - regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-
      dvs-idx property
    - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
    - mwifiex: fix division by zero in fw download path
    - ath6kl: fix division by zero in send path
    - ath6kl: fix control-message timeout
    - ath10k: fix control-message timeout
    - ath10k: fix division by zero in send path
    - PCI: Mark Atheros QCA6174 to avoid bus reset
    - rtl8187: fix control-message timeouts
    - evm: mark evm_fixmode as __ro_after_init
    - wcn36xx: Fix HT40 capability for 2Ghz band
    - mwifiex: Read a PCI register after writing the TX ring write pointer
    - libata: fix checking of DMA state
    - wcn36xx: handle connection loss indication
    - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
    - signal: Remove the bogus sigkill_pending in ptrace_stop
    - signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
    - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
    - power: supply: max17042_battery: use VFSOC for capacity when no rsns
    - powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
    - serial: core: Fix initializing and restoring termios speed
    - ALSA: mixer: oss: Fix racy access to slots
    - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
    - xen/balloon: add late_initcall_sync() for initial ballooning done
    - PCI: aardvark: Do not clear status bits of masked interrupts
    - PCI: aardvark: Do not unmask unused interrupts
    - PCI: aardvark: Fix return value of MSI domain .alloc() method
    - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
    - quota: check block number when reading the block in quota file
    - quota: correct error number in free_dqentry()
    - pinctrl: core: fix possible memory leak in pinctrl_enable()
    - iio: dac: ad5446: Fix ad5622_write() return value
    - USB: serial: keyspan: fix memleak on probe errors
    - USB: iowarrior: fix control-message timeouts
    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
    - Bluetooth: fix use-after-free error in lock_sock_nested()
    - platform/x86: wmi: do not fail if disabling fails
    - MIPS: lantiq: dma: add small delay after reset
    - MIPS: lantiq: dma: reset correct number of channel
    - locking/lockdep: Avoid RCU-induced noinstr fail
    - smackfs: Fix use-after-free in netlbl_catmap_walk()
    - x86: Increase exception stack sizes
    - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
    - mwifiex: Properly initialize private structure on interface type changes
    - media: mt9p031: Fix corrupted frame after restarting stream
    - media: netup_unidvb: handle interrupt properly according to the firmware
    - media: uvcvideo: Set capability in s_param
    - media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
    - media: s5p-mfc: Add checking to s5p_mfc_probe().
    - media: mceusb: return without resubmitting URB in case of -EPROTO error.
    - ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
    - ACPICA: Avoid evaluating methods too early during system resume
    - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
    - tracefs: Have tracefs directories not set OTH permission bits by default
    - ath: dfs_pattern_detector: Fix possible null-pointer dereference in
      channel_detector_create()
    - ACPI: battery: Accept charges over the design capacity as full
    - leaking_addresses: Always print a trailing newline
    - memstick: r592: Fix a UAF bug when removing the driver
    - lib/xz: Avoid overlapping memcpy() with invalid input with in-place
      decompression
    - lib/xz: Validate the value before assigning it to an enum variable
    - tracing/cfi: Fix cmp_entries_* functions signature mismatch
    - mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
    - PM: hibernate: Get block device exclusively in swsusp_check()
    - iwlwifi: mvm: disable RX-diversity in powersave
    - smackfs: use __GFP_NOFAIL for smk_cipso_doi()
    - ARM: clang: Do not rely on lr register for stacktrace
    - gre/sit: Don't generate link-local addr if addr_gen_mode is
      IN6_ADDR_GEN_MODE_NONE
    - ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
    - spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in
      bcm_qspi_probe()
    - parisc: fix warning in flush_tlb_all
    - task_stack: Fix end_of_stack() for architectures with upwards-growing stack
    - parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
    - cgroup: Make rebind_subsystems() disable v2 controllers all at once
    - media: dvb-usb: fix ununit-value in az6027_rc_query
    - media: mtk-vpu: Fix a resource leak in the error handling path of
      'mtk_vpu_probe()'
    - media: si470x: Avoid card name truncation
    - media: cx23885: Fix snd_card_free call on null card pointer
    - cpuidle: Fix kobject memory leaks in error paths
    - ath9k: Fix potential interrupt storm on queue reset
    - crypto: qat - detect PFVF collision after ACK
    - crypto: qat - disregard spurious PFVF interrupts
    - hwrng: mtk - Force runtime pm ops for sleep ops
    - b43legacy: fix a lower bounds test
    - b43: fix a lower bounds test
    - memstick: avoid out-of-range warning
    - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
    - hwmon: Fix possible memleak in __hwmon_device_register()
    - ath10k: fix max antenna gain unit
    - drm/msm: uninitialized variable in msm_gem_import()
    - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
    - mmc: mxs-mmc: disable regulator on error and in the remove function
    - platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
    - mwifiex: Send DELBA requests according to spec
    - phy: micrel: ksz8041nl: do not use power down mode
    - PM: hibernate: fix sparse warnings
    - smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
    - s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
    - irq: mips: avoid nested irq_enter()
    - samples/kretprobes: Fix return value if register_kretprobe() failed
    - libertas_tf: Fix possible memory leak in probe and disconnect
    - libertas: Fix possible memory leak in probe and disconnect
    - net: amd-xgbe: Toggle PLL settings during rate change
    - net: phylink: avoid mvneta warning when setting pause parameters
    - crypto: pcrypt - Delay write to padata->info
    - ibmvnic: Process crqs after enabling interrupts
    - RDMA/rxe: Fix wrong port_cap_flags
    - ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
    - ARM: dts: at91: tse850: the emac<->phy interface is rmii
    - scsi: dc395: Fix error case unwinding
    - MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
    - JFS: fix memleak in jfs_mount
    - ALSA: hda: Reduce udelay() at SKL+ position reporting
    - arm: dts: omap3-gta04a4: accelerometer irq fix
    - soc/tegra: Fix an error handling path in tegra_powergate_power_up()
    - memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
    - video: fbdev: chipsfb: use memset_io() instead of memset()
    - serial: 8250_dw: Drop wrong use of ACPI_PTR()
    - usb: gadget: hid: fix error code in do_config()
    - power: supply: rt5033_battery: Change voltage values to µV
    - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
    - RDMA/mlx4: Return missed an error if device doesn't support steering
    - ASoC: cs42l42: Correct some register default values
    - ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
    - serial: xilinx_uartps: Fix race condition causing stuck TX
    - mips: cm: Convert to bitfield API to fix out-of-bounds access
    - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
    - apparmor: fix error check
    - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
    - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
    - drm/plane-helper: fix uninitialized variable reference
    - PCI: aardvark: Don't spam about PIO Response Status
    - NFS: Fix deadlocks in nfs_scan_commit_list()
    - fs: orangefs: fix error return code of orangefs_revalidate_lookup()
    - mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
    - dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
    - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
    - auxdisplay: ht16k33: Connect backlight to fbdev
    - auxdisplay: ht16k33: Fix frame buffer device blanking
    - netfilter: nfnetlink_queue: fix OOB when mac header was cleared
    - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
    - m68k: set a default value for MEMORY_RESERVE
    - watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
    - ar7: fix kernel builds for compiler test
    - scsi: qla2xxx: Turn off target reset during issue_lip
    - i2c: xlr: Fix a resource leak in the error handling path of
      'xlr_i2c_probe()'
    - xen-pciback: Fix return in pm_ctrl_init()
    - net: davinci_emac: Fix interrupt pacing disable
    - ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
    - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
    - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and
      zs_unregister_migration()
    - llc: fix out-of-bound array index in llc_sk_dev_hash()
    - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
    - vsock: prevent unnecessary refcnt inc for nonblocking connect
    - USB: chipidea: fix interrupt deadlock
    - ARM: 9155/1: fix early early_iounmap()
    - ARM: 9156/1: drop cc-option fallbacks for architecture selection
    - powerpc/lib: Add helper to check if offset is within conditional branch
      range
    - powerpc/bpf: Validate branch ranges
    - powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
    - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
    - mm, oom: do not trigger out_of_memory from the #PF
    - s390/cio: check the subchannel validity for dev_busid
    - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
    - ext4: fix lazy initialization next schedule time computation in more
      granular unit
    - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
    - parisc/entry: fix trace test in syscall exit path
    - PCI/MSI: Destroy sysfs before freeing entries
    - arm64: zynqmp: Fix serial compatible string
    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
    - usb: musb: tusb6010: check return value after calling
      platform_get_resource()
    - scsi: advansys: Fix kernel pointer leak
    - ARM: dts: omap: fix gpmc,mux-add-data type
    - usb: host: ohci-tmio: check return value after calling
      platform_get_resource()
    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
    - MIPS: sni: Fix the build
    - scsi: target: Fix ordered tag handling
    - scsi: target: Fix alua_tg_pt_gps_count tracking
    - powerpc/5200: dts: fix memory node unit name
    - ALSA: gus: fix null pointer dereference on pointer block
    - powerpc/dcr: Use cmplwi instead of 3-argument cmpli
    - sh: check return code of request_irq
    - maple: fix wrong return value of maple_bus_init().
    - sh: fix kconfig unmet dependency warning for FRAME_POINTER
    - sh: define __BIG_ENDIAN for math-emu
    - mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
    - net: bnx2x: fix variable dereferenced before check
    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
    - MIPS: generic/yamon-dt: fix uninitialized variable error
    - mips: bcm63xx: add support for clk_get_parent()
    - mips: lantiq: add support for clk_get_parent()
    - platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
    - net: virtio_net_hdr_to_skb: count transport header in UFO
    - i40e: Fix NULL ptr dereference on VSI filter sync
    - NFC: reorganize the functions in nci_request
    - NFC: reorder the logic in nfc_{un,}register_device
    - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
    - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
    - tun: fix bonding active backup with arp monitoring
    - hexagon: export raw I/O routines for modules
    - mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
    - btrfs: fix memory ordering between normal and ordered work functions
    - parisc/sticon: fix reverse colors
    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
    - drm/udl: fix control-message timeout
    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
      and dvi connectors
    - perf/core: Avoid put_page() when GUP fails
    - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
    - batman-adv: Consider fragmentation for needed_headroom
    - batman-adv: Reserve needed_*room for fragments
    - batman-adv: Don't always reallocate the fragmentation skb head
    - RDMA/netlink: Add __maybe_unused to static inline in C file
    - ASoC: DAPM: Cover regression by kctl change notification fix
    - usb: max-3421: Use driver data instead of maintaining a list of bound
      devices
    - soc/tegra: pmc: Fix imbalanced clock disabling in error code path
    - crypto: s5p-sss - Add error handling in s5p_aes_probe()
    - ia64: kprobes: Fix to pass correct trampoline address to the handler
    - rsi: fix key enabled check causing unwanted encryption for vap_id > 0
    - rsi: fix rate mask set leading to P2P failure
    - mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
    - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
    - wcn36xx: add proper DMA memory barriers in rx path
    - s390/tape: fix timer initialization in tape_std_assign()
    - fuse: truncate pagecache on atomic_o_trunc
    - f2fs: fix up f2fs_lookup tracepoints
    - iavf: check for null in iavf_fix_features
    - i40e: Fix correct max_pkt_size on VF RX queue
    - i40e: Fix changing previously set num_queue_pairs for PFs
    - i40e: Fix display error code in dmesg
  * Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202)
    - ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
    - ARM: 9134/1: remove duplicate memcpy() definition
    - ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
    - ARM: 8819/1: Remove '-p' from LDFLAGS
    - usbnet: sanity check for maxpacket
    - usbnet: fix error return code in usbnet_probe()
    - ata: sata_mv: Fix the error handling of mv_chip_id()
    - nfc: port100: fix using -ERRNO as command type mask
    - ipv4: use siphash instead of Jenkins in fnhe_hashfun()
    - mmc: vub300: fix control-message timeouts
    - mmc: dw_mmc: exynos: fix the finding clock sample value
    - mmc: sdhci: Map more voltage level to SDHCI_POWER_330
    - mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning
      circuit
    - net: lan78xx: fix division by zero in send path
    - regmap: Fix possible double-free in regcache_rbtree_exit()
    - net: batman-adv: fix error handling
    - nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
    - net: nxp: lpc_eth.c: avoid hang when bringing interface down
    - sctp: use init_tag from inithdr for ABORT chunk
    - sctp: fix the processing for COOKIE_ECHO chunk
    - sctp: add vtag check in sctp_sf_violation
    - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
    - sctp: add vtag check in sctp_sf_ootb
    - ARM: 9141/1: only warn about XIP address when not compile testing
    - arm64: Avoid premature usercopy failure
    - ipv6: use siphash in rt6_exception_hash()
    - ipv6: make exception cache less predictible
    - arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
    - scsi: core: Put LLD module refcnt after SCSI device is released
    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
    - sfc: Fix reading non-legacy supported link modes
    - ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
    - mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS
    - arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
    - block: introduce multi-page bvec helpers
    - Revert "x86/kvm: fix vcpu-id indexed array sizes"
    - usb: gadget: Mark USB_FSL_QE broken on 64-bit
    - usb: musb: Balance list entry in musb_gadget_queue
    - usb-storage: Add compatibility quirk flags for iODD 2531/2541
    - printk/console: Allow to disable console output by using console="" or
      console=null
    - isofs: Fix out of bound access for corrupted isofs image
    - comedi: dt9812: fix DMA buffers on stack
    - comedi: ni_usb6501: fix NULL-deref in command paths
    - comedi: vmk80xx: fix transfer-buffer overflows
    - comedi: vmk80xx: fix bulk-buffer overflow
    - comedi: vmk80xx: fix bulk and interrupt message timeouts
    - staging: r8712u: fix control-message timeout
    - staging: rtl8192u: fix control-message timeouts
    - rsi: fix control-message timeout
    - usb: ehci: handshake CMD_RUN instead of STS_HALT

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Wed, 19 Jan 2022 17:28:13 -0700

linux-kvm (4.15.0-1105.107) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1105.107 -proposed tracker (LP: #1953659)

  [ Ubuntu: 4.15.0-166.174 ]

  * bionic/linux: 4.15.0-166.174 -proposed tracker (LP: #1953667)
  * Ubuntu version macros overflow with high ABI numbers (LP: #1953522)
    - SAUCE: Revert "stable: clamp SUBLEVEL in 4.14"
  * test_bpf.sh test in net of ubuntu_kernel_selftests failed on B-4.15 and
    variants (LP: #1953287)
    - SAUCE: Revert "bpf: add also cbpf long jump test cases with heavy expansion"
  * test_bpf.sh test in net of ubuntu_kernel_selftests failed on B-4.15 and
    variants (LP: #1953287) // CVE-2018-25020
    - bpf: fix truncated jump targets on heavy expansions

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Thu, 09 Dec 2021 13:59:50 -0700

linux-kvm (4.15.0-1104.106) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1104.106 -proposed tracker (LP: #1952340)

  * Packaging resync (LP: #1786013)
    - [Packaging] update Ubuntu.md

  [ Ubuntu: 4.15.0-165.173 ]

  * bionic/linux: 4.15.0-165.173 -proposed tracker (LP: #1952780)
  * Support builtin revoked certificates (LP: #1932029)
    - certs: Add EFI_CERT_X509_GUID support for dbx entries
    - certs: Move load_system_certificate_list to a common function
    - integrity: Move import of MokListRT certs to a separate routine
    - integrity: Load certs from the EFI MOK config table
    - certs: Add ability to preload revocation certs
    - certs: add 'x509_revocation_list' to gitignore
    - SAUCE: Dump stack when X.509 certificates cannot be loaded
    - [Packaging] build canonical-revoked-certs.pem from branch/arch certs
    - [Packaging] Revoke 2012 UEFI signing certificate as built-in
    - [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys
  * Support importing mokx keys into revocation list from the mok table
    (LP: #1928679)
    - efi: Support for MOK variable config table
    - efi: mokvar-table: fix some issues in new code
    - efi: mokvar: add missing include of asm/early_ioremap.h
    - efi/mokvar: Reserve the table only if it is in boot services data
    - SAUCE: integrity: Load mokx certs from the EFI MOK config table
    - SAUCE: integrity: add informational messages when revoking certs
  * CVE-2021-4002
    - arm64: tlb: Provide forward declaration of tlb_flush() before including
      tlb.h
    - mm: mmu_notifier fix for tlb_end_vma
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare

  [ Ubuntu: 4.15.0-164.172 ]

  * bionic/linux: 4.15.0-164.172 -proposed tracker (LP: #1952348)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync update-dkms-versions helper
    - debian/dkms-versions -- update from kernel-versions (main/2021.11.29)
  * Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997)
    - btrfs: always wait on ordered extents at fsync time
    - ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
    - xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
    - xtensa: xtfpga: Try software restart before simulating CPU reset
    - NFSD: Keep existing listeners on portlist error
    - netfilter: ipvs: make global sysctl readonly in non-init netns
    - NIOS2: irqflags: rename a redefined register name
    - can: rcar_can: fix suspend/resume
    - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state
      notification
    - can: peak_pci: peak_pci_remove(): fix UAF
    - ocfs2: fix data corruption after conversion from inline format
    - ocfs2: mount fails with buffer overflow in strlen
    - elfcore: correct reference to CONFIG_UML
    - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
    - ASoC: DAPM: Fix missing kctl change notifications
    - nfc: nci: fix the UAF of rf_conn_info object
    - isdn: cpai: check ctr->cnr to avoid array index out of bound
    - netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
    - btrfs: deal with errors when checking if a dir entry exists during log
      replay
    - net: stmmac: add support for dwmac 3.40a
    - ARM: dts: spear3xx: Fix gmac node
    - isdn: mISDN: Fix sleeping function called from invalid context
    - platform/x86: intel_scu_ipc: Update timeout value in comment
    - ALSA: hda: avoid write to STATESTS if controller is in reset
    - tracing: Have all levels of checks prevent recursion
    - ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
    - dma-debug: fix sg checks in debug_dma_map_sg()
    - ASoC: wm8960: Fix clock configuration on slave mode
    - lan78xx: select CRC32
    - net: hns3: add limit ets dwrr bandwidth cannot be 0
    - net: hns3: disable sriov before unload hclge layer
    - ALSA: hda/realtek: Add quirk for Clevo PC50HS
    - mm, slub: fix mismatch between reconstructed freelist depth and cnt
    - gcc-plugins/structleak: add makefile var for disabling structleak
  * creat09 from ubuntu_ltp_syscalls and cve-2018-13405 from ubuntu_ltp/cve
    failed with XFS (LP: #1950239)
    - xfs: ensure that the inode uid/gid match values match the icdinode ones
    - xfs: merge the projid fields in struct xfs_icdinode
    - xfs: remove the icdinode di_uid/di_gid members
    - xfs: fix up non-directory creation in SGID directories
  * ubuntu_ltp / finit_module02 fails on v4.15 and other kernels (LP: #1950644)
    - vfs: check fd has read access in kernel_read_file_from_fd()
  * reuseport_bpf_numa in net from ubuntu_kernel_selftests fails on ppc64le
    (LP: #1867570)
    - selftests/net: Fix reuseport_bpf_numa by skipping unavailable nodes
  * Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816)
    - net: mdio: introduce a shutdown method to mdio device drivers
    - xen-netback: correct success/error reporting for the SKB-with-fraglist case
    - sparc64: fix pci_iounmap() when CONFIG_PCI is not set
    - ext2: fix sleeping in atomic bugs on error
    - scsi: sd: Free scsi_disk device via put_device()
    - usb: testusb: Fix for showing the connection speed
    - usb: dwc2: check return value after calling platform_get_resource()
    - scsi: ses: Retry failed Send/Receive Diagnostic commands
    - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
    - lib/timerqueue: Rely on rbtree semantics for next timer
    - selftests: be sure to make khdr before other targets
    - Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
    - USB: cdc-acm: fix racy tty buffer accesses
    - USB: cdc-acm: fix break reporting
    - ovl: fix missing negative dentry check in ovl_rename()
    - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
    - xen/balloon: fix cancelled balloon action
    - ARM: dts: omap3430-sdp: Fix NAND device node
    - ARM: dts: qcom: apq8064: use compatible which contains chipid
    - bpf: add also cbpf long jump test cases with heavy expansion
    - bpf, mips: Validate conditional branch offsets
    - xtensa: call irqchip_init only when CONFIG_USE_OF is selected
    - bpf: Fix integer overflow in prealloc_elems_and_freelist()
    - phy: mdio: fix memory leak
    - net_sched: fix NULL deref in fifo_set_limit()
    - powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
    - ptp_pch: Load module automatically if ID matches
    - ARM: imx6: disable the GIC CPU interface before calling stby-poweroff
      sequence
    - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
    - netlink: annotate data races around nlk->bound
    - drm/nouveau/debugfs: fix file release memory leak
    - rtnetlink: fix if_nlmsg_stats_size() under estimation
    - i40e: fix endless loop under rtnl
    - i2c: acpi: fix resource leak in reconfiguration device addition
    - net: phy: bcm7xxx: Fixed indirect MMD operations
    - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
    - netfilter: ip6_tables: zero-initialize fragment offset
    - mac80211: Drop frames from invalid MAC address in ad-hoc mode
    - m68k: Handle arrivals of multiple signals correctly
    - net: sun: SUNVNET_COMMON should depend on INET
    - scsi: ses: Fix unsigned comparison with less than zero
    - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
    - perf/x86: Reset destroy callback on event init failure
    - sched: Always inline is_percpu_thread()
    - bpf, arm: Fix register clobbering in div/mod implementation
    - i40e: Fix freeing of uninitialized misc IRQ vector
    - mac80211: check return value of rhashtable_init
    - stable: clamp SUBLEVEL in 4.14
    - ALSA: seq: Fix a potential UAF by wrong private_free call order
    - s390: fix strrchr() implementation
    - btrfs: deal with errors when replaying dir entry during log replay
    - btrfs: deal with errors when adding inode reference during log replay
    - btrfs: check for error when looking up inode during dir entry replay
    - xhci: Fix command ring pointer corruption while aborting a command
    - xhci: Enable trust tx length quirk for Fresco FL11 USB controller
    - cb710: avoid NULL pointer subtraction
    - efi/cper: use stack buffer for error record decoding
    - efi: Change down_interruptible() in virt_efi_reset_system() to
      down_trylock()
    - usb: musb: dsps: Fix the probe error path
    - Input: xpad - add support for another USB ID of Nacon GC-100
    - USB: serial: qcserial: add EM9191 QDL support
    - USB: serial: option: add Quectel EC200S-CN module support
    - USB: serial: option: add Telit LE910Cx composition 0x1204
    - USB: serial: option: add prod. id for Quectel EG91
    - virtio: write back F_VERSION_1 before validate
    - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
    - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
    - iio: adc: aspeed: set driver data when adc probe.
    - iio: adc128s052: Fix the error handling path of 'adc128_probe()'
    - iio: light: opt3001: Fixed timeout error when 0 lux
    - iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
    - iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
    - sctp: account stream padding length for reconf chunk
    - net: arc: select CRC32
    - net: korina: select CRC32
    - net: encx24j600: check error in devm_regmap_init_encx24j600
    - ethernet: s2io: fix setting mac address during resume
    - nfc: fix error handling of nfc_proto_register()
    - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
    - NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
    - pata_legacy: fix a couple uninitialized variable bugs
    - drm/msm: Fix null pointer dereference on pointer edp
    - drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
    - acpi/arm64: fix next_platform_timer() section mismatch error
    - qed: Fix missing error code in qed_slowpath_start()
    - r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Thu, 02 Dec 2021 17:02:06 -0700

linux-kvm (4.15.0-1103.105) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1103.105 -proposed tracker (LP: #1949866)

  [ Ubuntu: 4.15.0-163.171 ]

  * bionic/linux: 4.15.0-163.171 -proposed tracker (LP: #1949874)
  * Packaging resync (LP: #1786013)
    - [Packaging] update Ubuntu.md
    - debian/dkms-versions -- update from kernel-versions (main/2021.11.08)
  * Unable to build net/reuseport_bpf and other tests in ubuntu_kernel_selftests
    on Bionic with make command (LP: #1949889)
    - selftests: Fix loss of test output in run_kselftests.sh
    - selftests: Makefile set KSFT_TAP_LEVEL to prevent nested TAP headers
    - selftests: fix headers_install circular dependency
    - selftests: fix bpf build/test workflow regression when KBUILD_OUTPUT is set
    - selftests: vm: Fix test build failure when built by itself
  * KVM emulation failure when booting into  VM crash kernel with multiple CPUs
    (LP: #1948862)
    - KVM: x86: Properly reset MMU context at vCPU RESET/INIT
  * aufs: kernel bug with apparmor and fuseblk (LP: #1948470)
    - SAUCE: aufs: bugfix, stop omitting path->mnt
  * ebpf:  bpf_redirect fails with ip6 gre interfaces (LP: #1947164)
    - net: handle ARPHRD_IP6GRE in dev_is_mac_header_xmit()
  * require CAP_NET_ADMIN to attach N_HCI ldisc (LP: #1949516)
    - Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc
  * ACL updates on OCFS2 are not revalidated (LP: #1947161)
    - ocfs2: fix remounting needed after setfacl command
  * ppc64 BPF JIT mod by 1 will not return 0 (LP: #1948351)
    - powerpc/bpf: Fix BPF_MOD when imm == 1
  * Drop "UBUNTU: SAUCE: cachefiles: Page leaking in
    cachefiles_read_backing_file while vmscan is active" (LP: #1947709)
    - Revert "UBUNTU: SAUCE: cachefiles: Page leaking in
      cachefiles_read_backing_file while vmscan is active"
    - cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is
      active
  * Some test in ubuntu_bpf test_verifier failed on i386 Bionic kernel
    (LP: #1788578)
    - bpf: fix context access in tracing progs on 32 bit archs
  * test_bpf.sh from ubuntu_kernel_selftests.net from linux ADT test failure
    with linux/4.15.0-149.153 i386 (Segmentation fault) (LP: #1934414)
    - selftests/bpf: make test_verifier run most programs
    - bpf: add couple of test cases for div/mod by zero
    - bpf: add further test cases around div/mod and others
  * Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512)
    - usb: gadget: r8a66597: fix a loop in set_feature()
    - usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
    - cifs: fix incorrect check for null pointer in header_assemble
    - xen/x86: fix PV trap handling on secondary processors
    - usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
    - USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
    - staging: greybus: uart: fix tty use after free
    - Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
    - USB: serial: mos7840: remove duplicated 0xac24 device ID
    - USB: serial: option: add Telit LN920 compositions
    - USB: serial: option: remove duplicate USB device ID
    - USB: serial: option: add device id for Foxconn T99W265
    - mcb: fix error handling in mcb_alloc_bus()
    - serial: mvebu-uart: fix driver's tx_empty callback
    - net: hso: fix muxed tty registration
    - bnxt_en: Fix TX timeout when TX ring size is set to the smallest
    - net/mlx4_en: Don't allow aRFS for encapsulated packets
    - scsi: iscsi: Adjust iface sysfs attr detection
    - thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
    - irqchip/gic-v3-its: Fix potential VPE leak on error
    - md: fix a lock order reversal in md_alloc
    - blktrace: Fix uaf in blk_trace access after removing by sysfs
    - net: macb: fix use after free on rmmod
    - net: stmmac: allow CSR clock of 300MHz
    - m68k: Double cast io functions to unsigned long
    - xen/balloon: use a kernel thread instead a workqueue
    - compiler.h: Introduce absolute_pointer macro
    - net: i825xx: Use absolute_pointer for memcpy from fixed memory location
    - sparc: avoid stringop-overread errors
    - qnx4: avoid stringop-overread errors
    - parisc: Use absolute_pointer() to define PAGE0
    - arm64: Mark __stack_chk_guard as __ro_after_init
    - alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
    - net: 6pack: Fix tx timeout and slot time
    - spi: Fix tegra20 build with CONFIG_PM=n
    - arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
    - PCI: aardvark: Fix checking for PIO Non-posted Request
    - PCI: aardvark: Fix checking for PIO status
    - xen/balloon: fix balloon kthread freezing
    - qnx4: work around gcc false positive warning bug
    - tty: Fix out-of-bound vmalloc access in imageblit
    - cpufreq: schedutil: Use kobject release() method to free sugov_tunables
    - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    - mac80211: fix use-after-free in CCMP/GCMP RX
    - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
    - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
    - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
    - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
    - hwmon: (tmp421) fix rounding for negative values
    - e100: fix length calculation in e100_get_regs_len
    - e100: fix buffer overrun in e100_get_regs
    - scsi: csiostor: Add module softdep on cxgb4
    - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
    - ipack: ipoctal: fix stack information leak
    - ipack: ipoctal: fix tty registration race
    - ipack: ipoctal: fix tty-registration error handling
    - ipack: ipoctal: fix missing allocation-failure check
    - ipack: ipoctal: fix module reference leak
    - ext4: fix potential infinite loop in ext4_dx_readdir()
    - net: udp: annotate data race around udp_sk(sk)->corkflag
    - EDAC/synopsys: Fix wrong value type assignment for edac_mode
    - ARM: 9077/1: PLT: Move struct plt_entries definition to header
    - ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()
    - ARM: 9079/1: ftrace: Add MODULE_PLTS support
    - ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE
    - arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55
    - hso: fix bailout in error case of probe
    - usb: hso: fix error handling code of hso_create_net_device
    - usb: hso: remove the bailout parameter
    - crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
    - HID: betop: fix slab-out-of-bounds Write in betop_probe
    - netfilter: ipset: Fix oversized kvmalloc() calls
    - HID: usbhid: free raw_report buffers in usbhid_stop
    - cred: allow get_cred() and put_cred() to be given NULL.
    - gpio: uniphier: Fix void functions to remove return value
    - tty: synclink_gt, drop unneeded forward declarations
    - tty: synclink_gt: rename a conflicting function name
    - drm/amd/display: Pass PCI deviceid into DC
    - hwmon: (tmp421) Replace S_<PERMS> with octal values
    - hwmon: (tmp421) report /PVLD condition as fault
  * ACL updates on OCFS2 are not revalidated (LP: #1947161) // Bionic update:
    upstream stable patchset 2021-11-02 (LP: #1949512)
    - ocfs2: drop acl cache for directories too

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 12 Nov 2021 12:05:35 +0100

linux-kvm (4.15.0-1102.104) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1102.104 -proposed tracker (LP: #1947285)

  * Packaging resync (LP: #1786013)
    - [Packaging] update Ubuntu.md

  [ Ubuntu: 4.15.0-162.170 ]

  * bionic/linux: 4.15.0-162.170 -proposed tracker (LP: #1947293)
  * Add final-checks to check certificates (LP: #1947174)
    - [Packaging] Add system trusted and revocation keys final check
  * CVE-2020-36385
    - RDMA/cma: Add missing locking to rdma_accept()
    - RDMA/ucma: Fix the locking of ctx->file
    - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy
  * CVE-2021-28950
    - fuse: fix live lock in fuse_iget()
  * CVE-2020-36322
    - fuse: fix bad inode
  * Bionic update: upstream stable patchset 2021-10-13 (LP: #1947011)
    - rcu: Fix missed wakeup of exp_wq waiters
    - apparmor: remove duplicate macro list_entry_is_head()
    - crypto: talitos - fix max key size for sha384 and sha512
    - sctp: validate chunk size in __rcv_asconf_lookup
    - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
    - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
    - thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
    - 9p/trans_virtio: Remove sysfs file on probe failure
    - prctl: allow to setup brk for et_dyn executables
    - profiling: fix shift-out-of-bounds bugs
    - pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was
      registered
    - Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH
    - parisc: Move pci_dev_is_behind_card_dino to where it is used
    - dmaengine: ioat: depends on !UML
    - dmaengine: xilinx_dma: Set DMA mask for coherent APIs
    - ceph: lockdep annotations for try_nonblocking_invalidate
    - nilfs2: fix memory leak in nilfs_sysfs_create_device_group
    - nilfs2: fix NULL pointer in nilfs_##name##_attr_release
    - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
    - pwm: rockchip: Don't modify HW state in .remove() callback
    - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
    - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
    - nilfs2: use refcount_dec_and_lock() to fix potential UAF
    - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
  * Invalid backport to v4.15: missing pgtable_l5_enabled (LP: #1946464)
    - SAUCE: Revert "x86/mm: Don't free P4D table when it is folded at runtime"
  * CVE-2021-38199
    - NFSv4: Initialise connection to the server in nfs4_alloc_client()
  * CVE-2019-19449
    - f2fs: fix wrong total_sections check and fsmeta check
    - f2fs: fix to do sanity check on segment/section count
  * vrf: fix refcnt leak with vxlan slaves (LP: #1945180)
    - ipv4: Fix device used for dst_alloc with local routes
  * Check for changes relevant for security certifications (LP: #1945989)
    - [Packaging] Add a new fips-checks script
    - [Packaging] Add fips-checks as part of finalchecks
  * CVE-2021-3759
    - memcg: enable accounting of ipc resources
  * Bionic update: upstream stable patchset 2021-09-27 (LP: #1945224)
    - ARC: Fix CONFIG_STACKDEPOT
    - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX
      and TX error counters
    - Revert "USB: serial: ch341: fix character loss at high transfer rates"
    - USB: serial: option: add new VID/PID to support Fibocom FG150
    - usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
    - usb: dwc3: gadget: Stop EP0 transfers during pullup disable
    - IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
    - e1000e: Fix the max snoop/no-snoop latency for 10M
    - ip_gre: add validation for csum_start
    - xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
    - net: marvell: fix MVNETA_TX_IN_PRGRS bit number
    - usb: gadget: u_audio: fix race condition on endpoint stop
    - opp: remove WARN when no valid OPPs remain
    - virtio: Improve vq->broken access to avoid any compiler optimization
    - vringh: Use wiov->used to check for read/write desc order
    - drm: Copy drm_wait_vblank to user before returning
    - drm/nouveau/disp: power down unused DP links during init
    - net/rds: dma_map_sg is entitled to merge entries
    - vt_kdsetmode: extend console locking
    - fbmem: add margin check to fb_check_caps()
    - KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
    - Revert "floppy: reintroduce O_NDELAY fix"
    - net: qrtr: fix another OOB Read in qrtr_endpoint_post
    - net: hns3: fix get wrong pfc_en when query PFC configuration
    - xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
    - qed: Fix the VF msix vectors flow
    - net: macb: Add a NULL check on desc_ptp
    - qede: Fix memset corruption
    - perf/x86/intel/pt: Fix mask of num_address_ranges
    - perf/x86/amd/ibs: Work around erratum #1197
    - cryptoloop: add a deprecation warning
    - ARM: 8918/2: only build return_address() if needed
    - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
    - clk: fix build warning for orphan_list
    - media: stkwebcam: fix memory leak in stk_camera_probe
    - igmp: Add ip_mc_list lock in ip_check_mc_rcu
    - USB: serial: mos7720: improve OOM-handling in read_mos_reg()
    - f2fs: fix potential overflow
    - ath10k: fix recent bandwidth conversion bug
    - ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing
      table (v2)
    - crypto: talitos - reduce max key size for SEC1
    - powerpc/module64: Fix comment in R_PPC64_ENTRY handling
    - powerpc/boot: Delete unneeded .globl _zimage_start
    - net: ll_temac: Remove left-over debug message
    - mm/page_alloc: speed up the iteration of max_order
    - Revert "btrfs: compression: don't try to compress if we don't have enough
      pages"
    - usb: host: xhci-rcar: Don't reload firmware after the completion
    - x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
    - PCI: Call Max Payload Size-related fixup quirks early
    - regmap: fix the offset of register error log
    - crypto: mxs-dcp - Check for DMA mapping errors
    - power: supply: axp288_fuel_gauge: Report register-address on readb / writeb
      errors
    - crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
    - udf: Check LVID earlier
    - isofs: joliet: Fix iocharset=utf8 mount option
    - nvme-rdma: don't update queue count when failing to set io queues
    - power: supply: max17042_battery: fix typo in MAx17042_TOFF
    - s390/cio: add dev_busid sysfs entry for each subchannel
    - libata: fix ata_host_start()
    - crypto: qat - do not ignore errors from enable_vf2pf_comms()
    - crypto: qat - handle both source of interrupt in VF ISR
    - crypto: qat - fix reuse of completion variable
    - crypto: qat - fix naming for init/shutdown VF to PF notifications
    - crypto: qat - do not export adf_iov_putmsg()
    - udf_get_extendedattr() had no boundary checks.
    - m68k: emu: Fix invalid free in nfeth_cleanup()
    - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
    - spi: spi-pic32: Fix issue with uninitialized dma_slave_config
    - clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock
      source channel
    - crypto: qat - use proper type for vf_mask
    - certs: Trigger creation of RSA module signing key if it's not an RSA key
    - soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
    - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
    - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
    - media: go7007: remove redundant initialization
    - Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
    - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
    - net: cipso: fix warnings in netlbl_cipsov4_add_std
    - i2c: highlander: add IRQ check
    - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
    - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
    - PCI: PM: Enable PME if it can be signaled from D3cold
    - soc: qcom: smsm: Fix missed interrupts if state changes while masked
    - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
    - arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
    - Bluetooth: fix repeated calls to sco_sock_kill
    - drm/msm/dsi: Fix some reference counted resource leaks
    - usb: gadget: udc: at91: add IRQ check
    - usb: phy: fsl-usb: add IRQ check
    - usb: phy: twl6030: add IRQ checks
    - Bluetooth: Move shutdown callback before flushing tx and rx queue
    - usb: host: ohci-tmio: add IRQ check
    - usb: phy: tahvo: add IRQ check
    - mac80211: Fix insufficient headroom issue for AMSDU
    - usb: gadget: mv_u3d: request_irq() after initializing UDC
    - Bluetooth: add timeout sanity check to hci_inquiry
    - i2c: iop3xx: fix deferred probing
    - i2c: s3c2410: fix IRQ check
    - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
    - mmc: moxart: Fix issue with uninitialized dma_slave_config
    - CIFS: Fix a potencially linear read overflow
    - i2c: mt65xx: fix IRQ check
    - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
    - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA
      config is available
    - tty: serial: fsl_lpuart: fix the wrong mapbase value
    - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
    - bcma: Fix memory leak for internally-handled cores
    - ipv4: make exception cache less predictible
    - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
    - net: qualcomm: fix QCA7000 checksum handling
    - netns: protect netns ID lookups with RCU
    - tty: Fix data race between tiocsti() and flush_to_ldisc()
    - x86/resctrl: Fix a maybe-uninitialized build warning treated as error
    - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is
      adjusted
    - IMA: remove -Wmissing-prototypes warning
    - backlight: pwm_bl: Improve bootloader/kernel device handover
    - clk: kirkwood: Fix a clocking boot regression
    - fbmem: don't allow too huge resolutions
    - rtc: tps65910: Correct driver module alias
    - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
    - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    - PCI/MSI: Skip masking MSI-X on Xen PV
    - powerpc/perf/hv-gpci: Fix counter value parsing
    - xen: fix setting of max_pfn in shared_info
    - include/linux/list.h: add a macro to test if entry is pointing to the head
    - 9p/xen: Fix end of loop tests for list_for_each_entry
    - soc: aspeed: lpc-ctrl: Fix boundary check for mmap
    - crypto: public_key: fix overflow during implicit conversion
    - block: bfq: fix bfq_set_next_ioprio_data()
    - power: supply: max17042: handle fails of reading status register
    - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
    - VMCI: fix NULL pointer dereference when unmapping queue pair
    - media: uvc: don't do DMA on stack
    - media: rc-loopback: return number of emitters rather than error
    - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
    - ARM: 9105/1: atags_to_fdt: don't warn about stack size
    - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
    - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
    - PCI: xilinx-nwl: Enable the clock through CCF
    - PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
    - PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
    - HID: input: do not report stylus battery state as "full"
    - RDMA/iwcm: Release resources if iw_cm module initialization fails
    - docs: Fix infiniband uverbs minor number
    - pinctrl: samsung: Fix pinctrl bank pin count
    - vfio: Use config not menuconfig for VFIO_NOIOMMU
    - openrisc: don't printk() unconditionally
    - pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
    - scsi: qedi: Fix error codes in qedi_alloc_global_queues()
    - MIPS: Malta: fix alignment of the devicetree buffer
    - media: dib8000: rewrite the init prbs logic
    - crypto: mxs-dcp - Use sg_mapping_iter to copy data
    - PCI: Use pci_update_current_state() in pci_enable_device_flags()
    - iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
    - ARM: dts: qcom: apq8064: correct clock names
    - video: fbdev: kyro: fix a DoS bug by restricting user input
    - netlink: Deal with ESRCH error in nlmsg_notify()
    - Smack: Fix wrong semantics in smk_access_entry()
    - usb: host: fotg210: fix the endpoint's transactional opportunities
      calculation
    - usb: host: fotg210: fix the actual_length of an iso packet
    - usb: gadget: u_ether: fix a potential null pointer dereference
    - usb: gadget: composite: Allow bMaxPower=0 if self-powered
    - staging: board: Fix uninitialized spinlock when attaching genpd
    - tty: serial: jsm: hold port lock when reporting modem line changes
    - bpf/tests: Fix copy-and-paste error in double word test
    - bpf/tests: Do not PASS tests without actually testing the result
    - video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
    - video: fbdev: kyro: Error out if 'pixclock' equals zero
    - video: fbdev: riva: Error out if 'pixclock' equals zero
    - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
    - flow_dissector: Fix out-of-bounds warnings
    - s390/jump_label: print real address in a case of a jump label bug
    - serial: 8250: Define RX trigger levels for OxSemi 950 devices
    - xtensa: ISS: don't panic in rs_init
    - hvsi: don't panic on tty_register_driver failure
    - serial: 8250_pci: make setup_port() parameters explicitly unsigned
    - staging: ks7010: Fix the initialization of the 'sleep_status' structure
    - ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
    - Bluetooth: skip invalid hci_sync_conn_complete_evt
    - ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the
      matching in-/output
    - media: v4l2-dv-timings.c: fix wrong condition in two for-loops
    - arm64: dts: qcom: sdm660: use reg value for memory node
    - net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
    - Bluetooth: avoid circular locks in sco_sock_connect
    - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable
      access in amdgpu_i2c_router_select_ddc_port()
    - ARM: tegra: tamonten: Fix UART pad setting
    - rpc: fix gss_svc_init cleanup on failure
    - staging: rts5208: Fix get_ms_information() heap buffer size
    - gfs2: Don't call dlm after protocol is unmounted
    - mmc: sdhci-of-arasan: Check return value of non-void funtions
    - mmc: rtsx_pci: Fix long reads when clock is prescaled
    - selftests/bpf: Enlarge select() timeout for test_maps
    - cifs: fix wrong release in sess_alloc_buffer() failed path
    - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST
      quirk set"
    - usb: musb: musb_dsps: request_irq() after initializing musb
    - usbip: give back URBs for unsent unlink requests during cleanup
    - usbip:vhci_hcd USB port can get stuck in the disabled state
    - ASoC: rockchip: i2s: Fix regmap_ops hang
    - ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
    - parport: remove non-zero check on count
    - ath9k: fix OOB read ar9300_eeprom_restore_internal
    - ath9k: fix sleeping in atomic context
    - net: fix NULL pointer reference in cipso_v4_doi_free
    - net: w5100: check return value after calling platform_get_resource()
    - parisc: fix crash with signals and alloca
    - scsi: BusLogic: Fix missing pr_cont() use
    - scsi: qla2xxx: Sync queue idx with queue_pair_map idx
    - cpufreq: powernv: Fix init_chip_info initialization in numa=off
    - mm/hugetlb: initialize hugetlb_usage in mm_init
    - memcg: enable accounting for pids in nested pid namespaces
    - platform/chrome: cros_ec_proto: Send command again when timeout occurs
    - xen: reset legacy rtc flag for PV domU
    - bnx2x: Fix enabling network interfaces without VFs
    - PM: base: power: don't try to use non-existing RTC for storing data
    - x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
    - net-caif: avoid user-triggerable WARN_ON(1)
    - ptp: dp83640: don't define PAGE0
    - net/l2tp: Fix reference count leak in l2tp_udp_recv_core
    - r6040: Restore MDIO clock frequency after MAC reset
    - tipc: increase timeout in tipc_sk_enqueue()
    - events: Reuse value read using READ_ONCE instead of re-reading it
    - net/af_unix: fix a data-race in unix_dgram_poll
    - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
    - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
    - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
    - mfd: Don't use irq_create_mapping() to resolve a mapping
    - PCI: Add ACS quirks for Cavium multi-function devices
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
    - ethtool: Fix an error code in cxgb2.c
    - PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
    - mtd: rawnand: cafe: Fix a resource leak in the error handling path of
      'cafe_nand_probe()'
    - ARC: export clear_user_page() for modules
    - net: dsa: b53: Fix calculating number of switch ports
    - netfilter: socket: icmp6: fix use-after-scope
    - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
    - net: renesas: sh_eth: Fix freeing wrong tx descriptor
    - SUNRPC/nfs: Fix return value for nfs4_callback_compound()
    - usb: mtu3: use @mult for HS isoc or intr
    - usb: mtu3: fix the wrong HS mult value
    - lib/mpi: use kcalloc in mpi_resize
    - media: venus: venc: Fix potential null pointer dereference on pointer fmt
    - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from
      run_smbios_call
    - f2fs: fix to unmap pages from userspace process in punch_hole()
    - userfaultfd: prevent concurrent API initialization
    - arm64/sve: Use correct size when reinitialising SVE state
    - perf machine: Initialize srcline string member in add_location struct
    - net/mlx5: Fix potential sleeping in atomic context
    - net: hns3: pad the short tunnel frame before sending to hardware
    - mfd: axp20x: Update AXP288 volatile ranges
    - KVM: arm64: Handle PSCI resets before userspace touches vCPU state
    - ip_gre: validate csum_start only on pull

  [ Ubuntu: 4.15.0-161.169 ]

  * bionic/linux: 4.15.0-161.169 -proposed tracker (LP: #1947358)
  * Bionic/linux-aws Boot failure downgrading from Bionic/linux-aws-5.4 on
    r5.metal (LP: #1946149)
    - SAUCE: Revert "PCI/MSI: Enforce MSI[X] entry updates to be visible"
    - SAUCE: Revert "PCI/MSI: Enforce that MSI-X table entry is masked for update"

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Mon, 25 Oct 2021 15:45:41 -0600

linux-kvm (4.15.0-1101.103) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1101.103 -proposed tracker (LP: #1944925)

  [ Ubuntu: 4.15.0-160.168 ]

  * bionic/linux: 4.15.0-160.168 -proposed tracker (LP: #1944933)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.09.27)
  * ext4 journal recovery fails w/ data=journal + mmap (LP: #1847340)
    - jbd2: introduce/export functions
      jbd2_journal_submit|finish_inode_data_buffers()
    - jbd2, ext4, ocfs2: introduce/use journal callbacks
      j_submit|finish_inode_data_buffers()
    - ext4: data=journal: fixes for ext4_page_mkwrite()
    - ext4: data=journal: write-protect pages on j_submit_inode_data_buffers()
    - ext4: fix mmap write protection for data=journal mode
  * CVE-2021-40490
    - ext4: fix race writing to an inline_data file while its xattrs are changing
  * Bionic update: upstream stable patchset 2021-09-22 (LP: #1944600)
    - iio: humidity: hdc100x: Add margin to the conversion time
    - iio: adc: Fix incorrect exit of for-loop
    - ASoC: intel: atom: Fix reference to PCM buffer address
    - i2c: dev: zero out array used for i2c reads from userspace
    - ACPI: NFIT: Fix support for virtual SPA ranges
    - ASoC: cs42l42: Correct definition of ADC Volume control
    - ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
    - ASoC: cs42l42: Fix inversion of ADC Notch Switch control
    - ASoC: cs42l42: Remove duplicate control for WNF filter frequency
    - net: dsa: mt7530: add the missing RxUnicast MIB counter
    - ppp: Fix generating ifname when empty IFLA_IFNAME is specified
    - psample: Add a fwd declaration for skbuff
    - net: Fix memory leak in ieee802154_raw_deliver
    - net: bridge: fix memleak in br_add_if()
    - tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B
      packets
    - xen/events: Fix race in set_evtchn_to_irq
    - vsock/virtio: avoid potential deadlock when vsock device remove
    - powerpc/kprobes: Fix kprobe Oops happens in booke
    - x86/tools: Fix objdump version check again
    - x86/resctrl: Fix default monitoring groups reporting
    - PCI/MSI: Enable and mask MSI-X early
    - PCI/MSI: Do not set invalid bits in MSI mask
    - PCI/MSI: Correct misleading comments
    - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
    - PCI/MSI: Protect msi_desc::masked for multi-MSI
    - PCI/MSI: Mask all unused MSI-X entries
    - PCI/MSI: Enforce that MSI-X table entry is masked for update
    - PCI/MSI: Enforce MSI[X] entry updates to be visible
    - vmlinux.lds.h: Handle clang's module.{c,d}tor sections
    - mac80211: drop data frames without key on encrypted links
    - x86/fpu: Make init_fpstate correct with optimized XSAVE
    - ath: Use safer key clearing with key cache entries
    - ath9k: Clear key cache explicitly on disabling hardware
    - ath: Export ath_hw_keysetmac()
    - ath: Modify ath_key_delete() to not need full key entry
    - ath9k: Postpone key cache entry deletion for TXQ frames reference it
    - dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
    - ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
    - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not
      yet available
    - scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
    - scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
    - scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
    - ARM: dts: nomadik: Fix up interrupt controller node names
    - net: usb: lan78xx: don't modify phy_device state concurrently
    - Bluetooth: hidp: use correct wait queue when removing ctrl_wait
    - dccp: add do-while-0 stubs for dccp_pr_debug macros
    - vhost: Fix the calculation in vhost_overflow()
    - bnxt: don't lock the tx queue from napi poll
    - net: 6pack: fix slab-out-of-bounds in decode_data
    - ptp_pch: Restore dependency on PCI
    - net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
    - net: mdio-mux: Don't ignore memory allocation errors
    - net: mdio-mux: Handle -EPROBE_DEFER correctly
    - mmc: dw_mmc: Fix hang on data CRC error
    - ALSA: hda - fix the 'Capture Switch' value change notifications
    - ipack: tpci200: fix many double free issues in tpci200_pci_probe
    - btrfs: prevent rename2 from exchanging a subvol with a directory from
      different parents
    - ASoC: intel: atom: Fix breakage for PCM buffer address setup
    - locks: print a warning when mount fails due to lack of "mand" support
    - fs: warn about impending deprecation of mandatory locks
    - netfilter: nft_exthdr: fix endianness of tcp option cast
    - KVM: X86: MMU: Use the correct inherited permissions to get shadow page
    - ASoC: cs42l42: Fix LRCLK frame start edge
    - net: igmp: fix data-race in igmp_ifc_timer_expire()
    - net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
    - genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
    - x86/msi: Force affinity setup before startup
    - x86/ioapic: Force affinity setup before startup
    - genirq/msi: Ensure deactivation on teardown

  [ Ubuntu: 4.15.0-158.166 ]

  * s390x BPF JIT vulnerabilities (LP: #1943960)
    - SAUCE: s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant
    - SAUCE: s390/bpf: Fix optimizing out zero-extensions

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 29 Sep 2021 15:21:16 +0200

linux-kvm (4.15.0-1100.102) bionic; urgency=medium

  * bionic/linux-kvm: 4.15.0-1100.102 -proposed tracker (LP: #1942580)

  * Bionic update: upstream stable patchset 2021-08-17 (LP: #1940315)
    - [Config] kvm: updateconfigs for UNIX_SCM

  * dbgsym contains no debug symbols (LP: #1935855)
    - [config] kvm: CONFIG_DEBUG_INFO=y

  [ Ubuntu: 4.15.0-157.164 ]

  * bionic/linux: 4.15.0-157.164 -proposed tracker (LP: #1942588)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.09.06)
  * dell300x: rsi wifi and bluetooth crash after suspend and resume
    (LP: #1940488)
    - Revert "rsi: Use resume_noirq for SDIO"
  *  LRMv5: switch primary version handling to kernel-versions data set
    (LP: #1928921)
    - [Packaging] switch to kernel-versions
  * kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout
    (LP: #1932966)
    - kvm: Add emulation for movups/movupd
  * memory leaking when removing a profile (LP: #1939915)
    - security/apparmor/label.c: Clean code by removing redundant instructions
    - apparmor: Fix memory leak of profile proxy
  * ubunut_kernel_selftests: memory-hotplug: avoid spamming logs with
    dump_page() (LP: #1941829)
    - selftests: memory-hotplug: avoid spamming logs with dump_page(), ratio limit
      hot-remove error test
  * Bionic update: upstream stable patchset 2021-08-27 (LP: #1941916)
    - btrfs: mark compressed range uptodate only if all bio succeed
    - regulator: rt5033: Fix n_voltages settings for BUCK and LDO
    - r8152: Fix potential PM refcount imbalance
    - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
    - net: Fix zero-copy head len calculation.
    - Revert "Bluetooth: Shutdown controller after workqueues are flushed or
      cancelled"
    - KVM: do not allow mapping valid but non-reference-counted pages
    - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
    - spi: mediatek: Fix fifo transfer
    - padata: validate cpumask without removed CPU during offline
    - Revert "ACPICA: Fix memory leak caused by _CID repair function"
    - ALSA: seq: Fix racy deletion of subscriber
    - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
    - omap5-board-common: remove not physically existing vdds_1v8_main fixed-
      regulator
    - scsi: sr: Return correct event when media event code is 3
    - media: videobuf2-core: dequeue if start_streaming fails
    - net: natsemi: Fix missing pci_disable_device() in probe and remove
    - nfp: update ethtool reporting of pauseframe control
    - mips: Fix non-POSIX regexp
    - bnx2x: fix an error code in bnx2x_nic_load()
    - net: pegasus: fix uninit-value in get_interrupt_interval
    - net: fec: fix use-after-free in fec_drv_remove
    - net: vxge: fix use-after-free in vxge_device_unregister
    - Bluetooth: defer cleanup of resources in hci_unregister_dev()
    - USB: usbtmc: Fix RCU stall warning
    - USB: serial: option: add Telit FD980 composition 0x1056
    - USB: serial: ch341: fix character loss at high transfer rates
    - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
    - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
    - usb: gadget: f_hid: fixed NULL pointer dereference
    - usb: gadget: f_hid: idle uses the highest byte for duration
    - usb: otg-fsm: Fix hrtimer list corruption
    - scripts/tracing: fix the bug that can't parse raw_trace_func
    - staging: rtl8723bs: Fix a resource leak in sd_int_dpc
    - media: rtl28xxu: fix zero-length control request
    - pipe: increase minimum default pipe size to 2 pages
    - ext4: fix potential htree corruption when growing large_dir directories
    - serial: 8250: Mask out floating 16/32-bit bus bits
    - MIPS: Malta: Do not byte-swap accesses to the CBUS UART
    - pcmcia: i82092: fix a null pointer dereference bug
    - spi: meson-spicc: fix memory leak in meson_spicc_remove
    - perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
    - qmi_wwan: add network device usage statistics for qmimux devices
    - libata: fix ata_pio_sector for CONFIG_HIGHMEM
    - reiserfs: add check for root_inode in reiserfs_fill_super
    - reiserfs: check directory items on read from disk
    - alpha: Send stop IPI to send to online CPUs
    - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and
      ql_adapter_reset
    - USB:ehci:fix Kunpeng920 ehci hardware problem
    - ppp: Fix generating ppp unit id when ifname is not specified
    - ovl: prevent private clone if bind mount is not allowed
    - net: xilinx_emaclite: Do not print real IOMEM pointer
    - KVM: x86: accept userspace interrupt only if no event is injected
    - KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
  * Bionic update: upstream stable patchset 2021-08-17 (LP: #1940315)
    - selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
    - KVM: x86: determine if an exception has an error code only when injecting
      it.
    - net: split out functions related to registering inflight socket files
    - [Config] updateconfigs for UNIX_SCM
    - af_unix: fix garbage collect vs MSG_PEEK
    - net/802/mrp: fix memleak in mrp_request_join()
    - net/802/garp: fix memleak in garp_request_join()
    - net: annotate data race around sk_ll_usec
    - sctp: move 198 addresses from unusable to private scope
    - hfs: add missing clean-up in hfs_fill_super
    - hfs: fix high memory mapping in hfs_bnode_read
    - hfs: add lock nesting notation to hfs_find_init
    - ARM: dts: versatile: Fix up interrupt controller node names
    - virtio_net: Do not pull payload in skb->head
    - gro: ensure frag0 meets IP header alignment
    - x86/kvm: fix vcpu-id indexed array sizes
    - ocfs2: fix zero out valid data
    - ocfs2: issue zeroout to EOF blocks
    - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
    - can: mcba_usb_start(): add missing urb->transfer_dma initialization
    - can: usb_8dev: fix memory leak
    - can: ems_usb: fix memory leak
    - can: esd_usb2: fix memory leak
    - NIU: fix incorrect error return, missed in previous revert
    - nfc: nfcsim: fix use after free during module unload
    - x86/asm: Ensure asm/proto.h can be included stand-alone
    - cfg80211: Fix possible memory leak in function cfg80211_bss_update
    - netfilter: conntrack: adjust stop timestamp to real expiry value
    - netfilter: nft_nat: allow to specify layer 4 protocol NAT only
    - tipc: fix sleeping in tipc accept routine
    - mlx4: Fix missing error code in mlx4_load_one()
    - net: llc: fix skb_over_panic
    - net/mlx5: Fix flow table chaining
    - sctp: fix return value check in __sctp_rcv_asconf_lookup
    - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
    - sis900: Fix missing pci_disable_device() in probe and remove
    - can: hi311x: fix a signedness bug in hi3110_cmd()
    - i40e: Fix log TC creation failure when max num of queues is exceeded
    - i40e: Add additional info to PHY type error
  * Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913)
    - ARM: dts: gemini: add device_type on pci
    - ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
    - arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
    - ARM: dts: rockchip: Fix the timer clocks order
    - ARM: dts: rockchip: Fix power-controller node names for rk3288
    - arm64: dts: rockchip: Fix power-controller node names for rk3328
    - reset: ti-syscon: fix to_ti_syscon_reset_data macro
    - ARM: brcmstb: dts: fix NAND nodes names
    - ARM: Cygnus: dts: fix NAND nodes names
    - ARM: NSP: dts: fix NAND nodes names
    - ARM: dts: BCM63xx: Fix NAND nodes names
    - ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
    - ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
    - ARM: dts: stm32: fix RCC node name on stm32f429 MCU
    - arm64: dts: juno: Update SCPI nodes as per the YAML schema
    - arm64: dts: ls208xa: remove bus-num from dspi node
    - thermal/core: Correct function name thermal_zone_device_unregister()
    - kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
    - rtc: max77686: Do not enforce (incorrect) interrupt trigger type
    - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
    - scsi: libfc: Fix array index out of bound exception
    - sched/fair: Fix CFS bandwidth hrtimer expiry type
    - net: ipv6: fix return value of ip6_skb_dst_mtu
    - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
    - net: bridge: sync fdb to new unicast-filtering ports
    - net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
    - net: moxa: fix UAF in moxart_mac_probe
    - net: qcom/emac: fix UAF in emac_remove
    - net: ti: fix UAF in tlan_remove_one
    - net: send SYNACK packet with accepted fwmark
    - net: validate lwtstate->data before returning from skb_tunnel_info()
    - dma-buf/sync_file: Don't leak fences on merge failure
    - tcp: annotate data races around tp->mtu_info
    - ipv6: tcp: drop silly ICMPv6 packet too big messages
    - igb: Fix use-after-free error during reset
    - ixgbe: Fix an error handling path in 'ixgbe_probe()'
    - igb: Fix an error handling path in 'igb_probe()'
    - fm10k: Fix an error handling path in 'fm10k_probe()'
    - e1000e: Fix an error handling path in 'e1000_probe()'
    - iavf: Fix an error handling path in 'iavf_probe()'
    - igb: Check if num of q_vectors is smaller than max before array access
    - perf probe: Fix dso->nsinfo refcounting
    - perf lzma: Close lzma stream on exit
    - perf test bpf: Free obj_buf
    - perf probe-file: Delete namelist in del_events() on the error path
    - spi: mediatek: fix fifo rx mode
    - liquidio: Fix unintentional sign extension issue on left shift of u16
    - s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
    - net: fix uninit-value in caif_seqpkt_sendmsg
    - net: decnet: Fix sleeping inside in af_decnet
    - netrom: Decrease sock refcount when sock timers expire
    - scsi: iscsi: Fix iface sysfs attr detection
    - scsi: target: Fix protect handling in WRITE SAME(32)
    - spi: cadence: Correct initialisation of runtime PM again
    - Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
    - proc: Avoid mixing integer types in mem_rw()
    - s390/ftrace: fix ftrace_update_ftrace_func implementation
    - ALSA: sb: Fix potential ABBA deadlock in CSP driver
    - xhci: Fix lost USB 2 remote wake
    - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
    - usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
    - USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
    - usb: max-3421: Prevent corruption of freed memory
    - usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
    - USB: serial: option: add support for u-blox LARA-R6 family
    - USB: serial: cp210x: fix comments for GE CS1000
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
    - tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
    - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
    - ixgbe: Fix packet corruption due to missing DMA sync
    - selftest: use mmap instead of posix_memalign to allocate memory
    - drm: Return -ENOTTY for non-drm ioctls
    - net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
    - iio: accel: bma180: Use explicit member assignment
    - iio: accel: bma180: Fix BMA25x bandwidth register values
    - btrfs: compression: don't try to compress if we don't have enough pages
    - spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    - xhci: add xhci_get_virt_ep() helper
    - bpftool: Properly close va_list 'ap' by va_end() on error
    - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
    - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
    - perf dso: Fix memory leak in dso__new_map()
    - net/tcp_fastopen: fix data races around tfo_active_disable_stamp
    - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
    - drm/panel: raspberrypi-touchscreen: Prevent double-free
    - KVM: do not assume PTE is writable after follow_pfn
    - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
    - net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
    - workqueue: fix UAF in pwq_unbound_release_workfn()
    - upstream stable to v4.14.241, v4.19.200

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Mon, 20 Sep 2021 15:02:35 -0600

# For older changelog entries, run 'apt-get changelog linux-kvm-tools-4.15.0-1110'
