linux-oem-5.17 (5.17.0-1034.35) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1034.35 -proposed tracker (LP: #2023906)

  * CVE-2022-4842
    - fs/ntfs3: Fix attr_punch_hole() null pointer derenference

  * CVE-2023-0597
    - x86/kasan: Map shadow for percpu pages on demand
    - x86/mm: Randomize per-cpu entry area
    - x86/mm: Recompute physical address for every page of per-CPU CEA mapping
    - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
    - x86/mm: Do not shuffle CPU entry areas without KASLR

  * CVE-2023-2124
    - xfs: verify buffer contents when we skip log replay

  * Some INVLPG implementations can leave Global translations unflushed when
    PCIDs are enabled (LP: #2023220)
    - x86/mm: Avoid incomplete Global INVLPG flushes

  * cls_flower: off-by-one in fl_set_geneve_opt (LP: #2023577)
    - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Wed, 21 Jun 2023 17:37:58 +0300

linux-oem-5.17 (5.17.0-1033.34) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1033.34 -proposed tracker (LP: #2019421)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * CVE-2023-1073
    - HID: check empty report_list in hid_validate_values()

  * CVE-2023-0459
    - uaccess: Add speculation barrier to copy_from_user()

  * CVE-2023-26606
    - fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs

  *  selftest: fib_tests: Always cleanup before exit  (LP: #2015956)
    - selftest: fib_tests: Always cleanup before exit

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Fri, 02 Jun 2023 10:25:10 +0300

linux-oem-5.17 (5.17.0-1032.33) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1032.33 -proposed tracker (LP: #2019648)

  * CVE-2023-32233
    - netfilter: nf_tables: deactivate anonymous set from preparation phase

  * CVE-2023-2612
    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()

  * CVE-2023-1670
    - xirc2ps_cs: Fix use after free bug in xirc2ps_detach

  * CVE-2023-30456
    - KVM: nVMX: add missing consistency checks for CR0 and CR4

  * CVE-2022-4139
    - drm/i915/gt: Serialize TLB invalidates with GT resets
    - drm/i915: fix TLB invalidation for Gen12 video and compute engines

  * net: sched: Fix use after free in red_enqueue() (LP: #2017013)
    - net: sched: Fix use after free in red_enqueue()

  * CVE-2022-3586
    - sch_sfb: Also store skb len before calling child enqueue

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Thu, 18 May 2023 15:53:22 +0300

linux-oem-5.17 (5.17.0-1031.32) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1031.32 -proposed tracker (LP: #2016821)

  * CVE-2022-2590
    - SAUCE: Revert "mm/shmem: unconditionally set pte dirty in
      mfill_atomic_install_pte"

  * CVE-2023-23455
    - net: sched: atm: dont intepret cls results when asked to drop

  * CVE-2023-26545
    - net: mpls: fix stale pointer if allocation fails during device rename

  * CVE-2023-1829
    - net/sched: Retire tcindex classifier
    - [Config]: Make sure CONFIG_NET_CLS_TCINDEX is not available

  * CVE-2023-1859
    - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race
      condition

  * CVE-2022-3303
    - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC

  * CVE-2022-4095
    - staging: rtl8712: fix use after free bugs

  * CVE-2022-4662
    - USB: core: Prevent nested device-reset calls

  * CVE-2022-3586
    - sch_sfb: Don't assume the skb is still around after enqueueing to child

  * CVE-2022-40307
    - efi: capsule-loader: Fix use-after-free in efi_capsule_write

  * CVE-2023-0468
    - io_uring: update res mask in io_poll_check_events
    - io_uring: fix tw losing poll events
    - io_uring: cmpxchg for poll arm refs release
    - io_uring: make poll refs more robust
    - io_uring/poll: fix poll_refs race with cancelation

  * CVE-2023-0386
    - ovl: fail on invalid uid/gid mapping at copy up

  * Miscellaneous Ubuntu changes
    - [Config] Update gcc version

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 18 Apr 2023 15:16:33 +0300

linux-oem-5.17 (5.17.0-1030.31) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1030.31 -proposed tracker (LP: #2011919)

  * Packaging resync (LP: #1786013)
    - [Packaging] update update.conf
    - debian/dkms-versions -- update from kernel-versions (main/2023.03.20)

  * CVE-2022-4382
    - USB: gadgetfs: Fix race between mounting and unmounting

  * CVE-2023-23559
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid

  * CVE-2022-3903
    - media: mceusb: Use new usb_control_msg_*() routines

  * CVE-2023-1118
    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()

  * CVE-2023-26607
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - ntfs: fix out-of-bounds read in ntfs_attr_find()

  * CVE-2022-21505
    - lockdown: Fix kexec lockdown bypass with ima policy

  * CVE-2023-1095
    - netfilter: nf_tables: fix null deref due to zeroed list head

  * CVE-2023-1074
    - sctp: fail if no bound addresses can be used for a given scope

  * CVE-2022-41849
    - fbdev: smscufx: Fix use-after-free in ufx_ops_open()

  * CVE-2023-1281
    - net/sched: tcindex: update imperfect hash filters respecting rcu

 -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 31 Mar 2023 15:37:07 +0200

linux-oem-5.17 (5.17.0-1029.30) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1029.30 -proposed tracker (LP: #2008350)

  * CVE-2023-0461
    - SAUCE: Fix inet_csk_listen_start after CVE-2023-0461

  * CVE-2023-0394
    - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames

  * CVE-2022-36280
    - drm/vmwgfx: Validate the box size for the snooped cursor

  * CVE-2022-41850
    - HID: roccat: Fix use-after-free in roccat_read()

  * CVE-2022-3061
    - video: fbdev: i740fb: Error out if 'pixclock' equals zero

  * CVE-2022-3628
    - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()

  * CVE-2022-3646
    - nilfs2: fix leak of nilfs_root in case of writer thread creation failure

  * CVE-2022-3649
    - nilfs2: fix use-after-free bug of struct nilfs_root

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
    (LP: #1814234)
    - SAUCE: selftest: rtcpie: Force passing unreliable subtest

  * CVE-2022-2196
    - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Mon, 13 Mar 2023 16:14:19 +0200

linux-oem-5.17 (5.17.0-1028.29) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1028.29 -proposed tracker (LP: #2004346)

  * CVE-2023-0045
    - x86/bugs: Flush IBP in ib_prctl_set()

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2023.01.30)

  * Keeps rebooting with AMD W6400, W6600, and W6800 graphic cards
    (LP: #2000110)
    - drm/amdgpu: move nbio ih_doorbell_range() into ih code for vega
    - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
    - drm/amdgpu: make sure to init common IP before gmc
    - drm/amdgpu: fix sdma doorbell init ordering on APUs

  * CVE-2022-47520
    - wifi: wilc1000: validate pairwise and authentication suite offsets

  * Improve arp_ndisc_evict_nocarrier.sh test result processing (LP: #2006546)
    - selftests: net: return non-zero for failures reported in
      arp_ndisc_evict_nocarrier

  * CVE-2022-43750
    - usb: mon: make mmapped memory read only

  * CVE-2023-0461
    - net/ulp: prevent ULP without clone op from entering the LISTEN status
    - net/ulp: use consistent error code when blocking ULP

  * CVE-2022-3565
    - mISDN: fix use-after-free bugs in l1oip timer handlers

  * CVE-2022-36879
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup()

  * CVE-2022-20369
    - NFSD: fix use-after-free in __nfs42_ssc_open()

  * arp_ndisc_evict_nocarrier.sh in net from ubuntu_kernel_selftests failed on
    J-oem-5.17 / K (LP: #1968310)
    - selftests: net: fix cleanup_v6() for arp_ndisc_evict_nocarrier

  * CVE-2022-20566
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put

  * Expose built-in trusted and revoked certificates (LP: #1996892)
    - [Packaging] Expose built-in trusted and revoked certificates

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Fri, 10 Feb 2023 12:15:41 +0200

linux-oem-5.17 (5.17.0-1027.28) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1027.28 -proposed tracker (LP: #2003451)

  * CVE-2022-3545
    - nfp: fix use-after-free in area_cache_get()

  * CVE-2022-42895
    - Bluetooth: L2CAP: Fix attempting to access uninitialized memory

  * ThinkPad L14 Gen 3 blank laptop screen on bootup (LP: #2002467)
    - Revert "drm/amdgpu: make sure to init common IP before gmc"

  * CVE-2023-0179
    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits

  [ Ubuntu: 5.17.0-15.16~22.04.8 ]

  * jammy/linux-hwe-5.17: 5.17.0-15.16~22.04.8 -proposed tracker (LP: #2003452)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - debian/dkms-versions -- update from kernel-versions (main/2023.01.02)
  * Revoke & rotate to new signing key (LP: #2002812)
    - [Packaging] Revoke and rotate to new signing key
  * CVE-2022-45934
    - Bluetooth: L2CAP: Fix u8 overflow
  * CVE-2022-42896
    - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
  * CVE-2022-4378
    - proc: proc_skip_spaces() shouldn't think it is working on C strings
    - proc: avoid integer type confusion in get_proc_long

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Mon, 23 Jan 2023 12:37:39 +0200

linux-oem-5.17 (5.17.0-1026.27) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1026.27 -proposed tracker (LP: #2001046)

  * Keeps rebooting with AMD W6400, W6600, and W6800 graphic cards
    (LP: #2000110)
    - drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x
    - drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid
      cards
    - drm/amdgpu: disable BACO on special BEIGE_GOBY card
    - drm/amdgpu: disable BACO support on more cards
    - drm/amdgpu: make sure to init common IP before gmc

  * Fix SUT can't displayed after resume from WB/CB with dGFX
    installed(FR:6/10)[RX6300][RX6500]  (LP: #1999836)
    - drm/amd/display: No display after resume from WB/CB

  * CVE-2022-4378
    - proc: proc_skip_spaces() shouldn't think it is working on C strings
    - proc: avoid integer type confusion in get_proc_long

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Wed, 04 Jan 2023 11:37:57 +0200

linux-oem-5.17 (5.17.0-1025.26) jammy; urgency=medium

  * jammy/linux-oem-5.17: 5.17.0-1025.26 -proposed tracker (LP: #1997739)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2022.11.14)

  * Rear Audio port sometimes has no audio output after reboot(Cirrus Logic)
    (LP: #1998905)
    - SAUCE: ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock.

  * Micron NVME storage failure [1344,5407] (LP: #1998883)
    - nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH

  * CVE-2022-42896
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm

  * Fix AMD-PState driver for Genoa CPU (LP: #1998106)
    - Documentation: amd-pstate: add tracer tool introduction
    - Documentation: amd-pstate: grammar and sentence structure updates
    - Documentation: amd-pstate: Add unit test introduction
    - cpufreq: amd-pstate: cpufreq: amd-pstate: reset MSR_AMD_PERF_CTL register at
      init
    - cpufreq: amd-pstate: change amd-pstate driver to be built-in type
    - cpufreq: amd-pstate: add amd-pstate driver parameter for mode selection
    - Documentation: amd-pstate: add driver working mode introduction
    - Documentation: add amd-pstate kernel command line options

  * Mediatek WLAN RZ616(MT7922) SAR table control (LP: #1997200)
    - mt76: add 6 GHz band support in mt76_sar_freq_ranges
    - mt76: mt7921: introduce ACPI SAR support
    - mt76: mt7921: introduce ACPI SAR config in tx power
    - wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()

  * Add cs35l41 firmware loading support (LP: #1995957)
    - ASoC: cs35l41: Remove unnecessary param
    - ALSA: cs35l41: Unify hardware configuration
    - ALSA: cs35l41: Check hw_config before using it
    - ALSA: cs35l41: Move cs35l41_gpio_config to shared lib
    - ALSA: hda: cs35l41: Fix I2S params comments
    - ALSA: hda: cs35l41: Always configure the DAI
    - ALSA: hda: cs35l41: Add Boost type flag
    - ALSA: hda: cs35l41: Put the device into safe mode for external boost
    - ALSA: hda: cs35l41: Mute the device before shutdown
    - ALSA: cs35l41: Enable Internal Boost in shared lib
    - ALSA: hda: cs35l41: Move boost config to initialization code
    - ALSA: hda: cs35l41: Remove cs35l41_hda_reg_sequence struct
    - ALSA: hda: cs35l41: Reorganize log for playback actions
    - ALSA: hda: cs35l41: Handle all external boost setups the same way
    - ALSA: hda: cs35l41: Move external boost handling to lib for ASoC use
    - ASoC: cs35l41: Document CS35l41 External Boost
    - ASoC: cs35l41: Support external boost
    - ALSA: hda: cs35l41: Fix error in spi cs35l41 hda driver name
    - ALSA: hda: cs35l41: Set Speaker Position for CLSA0100 Laptop
    - ALSA: hda: cs35l41: Remove Set Channel Map api from binding
    - ALSA: hda: cs35l41: Add Support for Interrupts
    - ALSA: hda: cs35l41: Enable GPIO2 Interrupt for CLSA0100 laptops
    - ASoC: cs35l41: Move cs35l41_set_cspl_mbox_cmd to shared code
    - ASoC: cs35l41: Move cs35l41 fs errata into shared code
    - ASoC: cs35l41: Move cs_dsp config struct into shared code
    - ALSA: hda: cs35l41: Add Amp Name based on channel and index
    - ASoC: cs35l41: Move cs35l41 exit hibernate function into shared code
    - ASoC: cs35l41: Add common cs35l41 enter hibernate function
    - ASoC: cs35l41: Do not print error when waking from hibernation
    - ALSA: hda: cs35l41: Don't dereference fwnode handle
    - ALSA: hda: cs35l41: Allow compilation test on non-ACPI configurations
    - ALSA: hda: cs35l41: Drop wrong use of ACPI_PTR()
    - ALSA: hda: cs35l41: Consolidate selections under SND_HDA_SCODEC_CS35L41
    - ALSA: hda: hda_cs_dsp_ctl: Add Library to support CS_DSP ALSA controls
    - ALSA: hda: hda_cs_dsp_ctl: Add apis to write the controls directly
    - ALSA: hda: cs35l41: Save codec object inside component struct
    - ALSA: hda: cs35l41: Add initial DSP support and firmware loading
    - ALSA: hda: cs35l41: Save Subsystem ID inside CS35L41 Driver
    - ALSA: hda: cs35l41: Support reading subsystem id from ACPI
    - ALSA: hda: cs35l41: Support multiple load paths for firmware
    - ALSA: hda: cs35l41: Support Speaker ID for laptops
    - ALSA: hda: cs35l41: Support Hibernation during Suspend
    - ALSA: hda: cs35l41: Read Speaker Calibration data from UEFI variables
    - ALSA: hda: hda_cs_dsp_ctl: Add fw id strings
    - ALSA: hda: cs35l41: Add defaulted values into dsp bypass config sequence
    - ALSA: hda: cs35l41: Support Firmware switching and reloading
    - ALSA: hda: cs35l41: Add module parameter to control firmware load
    - Revert "ALSA: hda: cs35l41: Allow compilation test on non-ACPI
      configurations"
    - [Config] updateconfigs for SND_HDA_CS_DSP_CONTROLS

  * Screen freeze after resuming from suspend (nvme0: I/O timeout)
    (LP: #1996048)
    - SAUCE: PCI: vmd: Disable MSI remapping after suspend

  * Screen cannot turn on after screen off with Matrox G200eW3 [102b:0536]
    (LP: #1995573)
    - drm: Add DRM-managed mutex_init()
    - drm/mgag200: Protect concurrent access to I/O registers with lock
    - drm/mgag200: Acquire I/O lock while reading EDID
    - drm/mgag200: Optimize damage clips
    - drm/mgag200: Add FB_DAMAGE_CLIPS support
    - drm/mgag200: Enable atomic gamma lut update

  * Fix ath11k deadlock on WCN6855 (LP: #1995041)
    - SAUCE: wifi: ath11k: avoid deadlock during regulatory update in
      ath11k_regd_update()

  * TEE Support for CCP driver (LP: #1991608)
    - SAUCE: crypto: ccp: Add support for TEE for PCI ID 0x14CA

  * [SRU][J/OEM-5.17][PATCH 0/1] Fix oled brightness set above frame-average
    luminance (LP: #1978986)
    - drm: New function to get luminance range based on static hdr metadata
    - drm/amdgpu_dm: Rely on split out luminance calculation function
    - drm/i915: Use luminance range calculated during edid parsing

  * Fix Thunderbolt device hotplug fail when connect via thunderbolt dock
    (LP: #1991366)
    - PCI: Fix used_buses calculation in pci_scan_child_bus_extend()
    - PCI: Pass available buses even if the bridge is already configured
    - PCI: Move pci_assign_unassigned_root_bus_resources()
    - PCI: Distribute available resources for root buses, too
    - PCI: Fix whitespace and indentation
    - PCI: Fix typo in pci_scan_child_bus_extend()

  * support for same series backports versioning numbers (LP: #1993563)
    - [Packaging] sameport -- add support for sameport versioning

  * Miscellaneous Ubuntu changes
    - Fix getabis to check for build2 ppa.

  * Miscellaneous upstream changes
    - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Wed, 07 Dec 2022 13:58:14 +0200

# For older changelog entries, run 'apt-get changelog linux-image-unsigned-5.17.0-1034-oem'
