Ubuntu
linux-azure package

Azure: Update CIFS to v6.5

Bug #2036450 reported by Tim Gardner on 2023-09-18

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux-azure (Ubuntu)	Fix Released	Undecided	Unassigned
	Jammy	Fix Released	Medium	Tim Gardner

Bug Description

SRU Justification

[Impact]

Microsoft has requested this patch set to update CIFS and smbfs to the Linux kernel version 6.5.

[Test Plan]

Microsoft has tested with positive results.

[Regression Potential]

This is a huge patch set. The potential exists for corruption, connection instabilities, or other cifs related maladies.

[Other Info]

SF: #00365185

Tags:

CVE References

Tim Gardner (timg-tpi) on 2023-09-18

affects:	linux (Ubuntu) → linux-azure (Ubuntu)
Changed in linux-azure (Ubuntu):
status:	New → Fix Released
Changed in linux-azure (Ubuntu Jammy):
assignee:	nobody → Tim Gardner (timg-tpi)
importance:	Undecided → Medium
status:	New → In Progress

Tim Gardner (timg-tpi) on 2023-10-06

Changed in linux-azure (Ubuntu Jammy):
status:	In Progress → Fix Committed

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2023-10-19:

This bug is awaiting verification that the linux-azure/5.15.0-1051.59 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure' to 'verification-done-jammy-linux-azure'. If the problem still exists, change the tag 'verification-needed-jammy-linux-azure' to 'verification-failed-jammy-linux-azure'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: kernel-spammed-jammy-linux-azure-v2 verification-needed-jammy-linux-azure

Tim Gardner (timg-tpi) on 2023-10-23

tags:

added: verification-done-jammy-linux-azure
removed: verification-needed-jammy-linux-azure

Revision history for this message

Launchpad Janitor (janitor) wrote on 2023-10-30:

Download full text (66.9 KiB)

This bug was fixed in the package linux-azure - 5.15.0-1051.59

---------------
linux-azure (5.15.0-1051.59) jammy; urgency=medium

* jammy/linux-azure: 5.15.0-1051.59 -proposed tracker (LP: #2038019)

This bug was fixed in the package linux-azure - 5.15.0-1051.59

---------------
linux-azure (5.15.0-1051.59) jammy; urgency=medium

* jammy/linux-azure: 5.15.0-1051.59 -proposed tracker (LP: #2038019)

* Azure: Update CIFS to v6.5 (LP: #2036450)
    - Revert "UBUNTU: SAUCE: Fix cifs: fix mid leak during reconnection after
      timeout threshold"
    - Revert "smb3: lower default deferred close timeout to address perf
      regression"
    - Revert "smb3: allow deferred close timeout to be configurable"
    - Revert "cifs: remove minor build warning"
    - Revert "cifs: remove some camelCase and also some static build warnings"
    - Revert "cifs: remove unnecessary (void*) conversions."
    - Revert "cifs: remove unnecessary type castings"
    - Revert "cifs: remove redundant initialization to variable mnt_sign_enabled"
    - Revert "smb3: workaround negprot bug in some Samba servers"
    - Revert "cifs: remove unnecessary locking of chan_lock while freeing session"
    - Revert "cifs: fix race condition with delayed threads"
    - Revert "cifs: update cifs_ses::ip_addr after failover"
    - Revert "cifs: avoid deadlocks while updating iface"
    - Revert "cifs: periodically query network interfaces from server"
    - Revert "cifs: during reconnect, update interface if necessary"
    - Revert "cifs: change iface_list from array to sorted linked list"
    - Revert "smb3: use netname when available on secondary channels"
    - Revert "smb3: fix empty netname context on secondary channels"
    - Revert "cifs: when a channel is not found for server, log its connection id"
    - Revert "smb3: add trace point for SMB2_set_eof"
    - Revert "cifs: populate empty hostnames for extra channels"
    - Revert "cifs: fix uninitialized pointer in error case in
      dfs_cache_get_tgt_share"
    - Revert "cifs: skip trailing separators of prefix paths"
    - Revert "cifs: update internal module number"
    - Revert "cifs: do not build smb1ops if legacy support is disabled"
    - Revert "cifs: fix potential deadlock in direct reclaim"
    - Revert "cifs: remove repeated debug message on cifs_put_smb_ses()"
    - Revert "smb3: remove unneeded null check in cifs_readdir"
    - Revert "cifs: fix ntlmssp on old servers"
    - Revert "cifs: cache the dirents for entries in a cached directory"
    - Revert "cifs: avoid parallel session setups on same channel"
    - Revert "cifs: use new enum for ses_status"
    - Revert "cifs: do not use tcpStatus after negotiate completes"
    - Revert "smb3: add mount parm nosparse"
    - Revert "smb3: don't set rc when used and unneeded in query_info_compound"
    - Revert "cifs: fix minor compile warning"
    - Revert "Add various fsctl structs"
    - Revert "Add defines for various newer FSCTLs"
    - Revert "smb3: add trace point for oplock not found"
    - Revert "cifs: return the more nuanced writeback error on close()"
    - Revert "smb3: add trace point for lease not found issue"
    - Revert "cifs: smbd: fix typo in comment"
    - Revert "cifs: set the CREATE_NOT_FILE when opening the directory in
      use_cached_dir()"
    - Revert "cifs: check for smb1 in open_cached_dir()"
    - Revert "cifs: move definition of cifs_fattr earlier in cifsglob.h"
    - Revert "cifs: print TIDs as hex"
    - Revert "cifs: return ENOENT for DFS lookup_cache_entry()"
    - Revert "cifs: don't call cifs_dfs_query_info_nonascii_quirk() if nodfs was
      set"
    - Revert "cifs: fix signed integer overflow when fl_end is OFFSET_MAX"
    - Revert "cifs: use correct lock type in cifs_reconnect()"
    - Revert "cifs: fix NULL ptr dereference in refresh_mounts()"
    - Revert "cifs: Use kzalloc instead of kmalloc/memset"
    - Revert "cifs: Split the smb3_add_credits tracepoint"
    - Revert "cifs: update internal module number"
    - Revert "cifs: force new session setup and tcon for dfs"
    - Revert "cifs: remove check of list iterator against head past the loop body"
    - Revert "cifs: fix potential race with cifsd thread"
    - Revert "fs: Remove ->readpages address space operation"
    - Revert "smb3: fix ksmbd bigendian bug in oplock break, and move its struct
      to smbfs_common"
    - Revert "smb3: cleanup and clarify status of tree connections"
    - Revert "smb3: move defines for query info and query fsinfo to smbfs_common"
    - Revert "smb3: move defines for ioctl protocol header and SMB2 sizes to
      smbfs_common"
    - Revert "move more common protocol header definitions to smbfs_common"
    - Revert "cifs: fix incorrect use of list iterator after the loop"
    - Revert "cifs: fix bad fids sent over wire"
    - Revert "cifs: change smb2_query_info_compound to use a cached fid, if
      available"
    - Revert "cifs: convert the path to utf16 in smb2_query_info_compound"
    - Revert "cifs: do not skip link targets when an I/O fails"
    - Revert "cifs: use a different reconnect helper for non-cifsd threads"
    - Revert "cifs: truncate the inode and mapping when we simulate fcollapse"
    - Revert "smb3: fix incorrect session setup check for multiuser mounts"
    - Revert "treewide: Replace zero-length arrays with flexible-array members"
    - Revert "cifs: mark sessions for reconnection in helper function"
    - Revert "cifs: call helper functions for marking channels for reconnect"
    - Revert "cifs: call cifs_reconnect when a connection is marked"
    - Revert "improve error message when mount options conflict with posix"
    - Revert "cifs: fix workstation_name for multiuser mounts"
    - Revert "cifs: unlock chan_lock before calling cifs_put_tcp_session"
    - Revert "Fix a warning about a malformed kernel doc comment in cifs"
    - Revert "cifs: update internal module number"
    - Revert "smb3: send NTLMSSP version information"
    - Revert "cifs: cifs_ses_mark_for_reconnect should also update reconnect bits"
    - Revert "cifs: update tcpStatus during negotiate and sess setup"
    - Revert "cifs: make status checks in version independent callers"
    - Revert "cifs: remove repeated state change in dfs tree connect"
    - Revert "cifs: fix the cifs_reconnect path for DFS"
    - Revert "cifs: remove unused variable ses_selected"
    - Revert "cifs: protect all accesses to chan_* with chan_lock"
    - Revert "cifs: fix the connection state transitions with multichannel"
    - Revert "cifs: check reconnects for channels of active tcons too"
    - Revert "smb3: add new defines from protocol specification"
    - Revert "cifs: serialize all mount attempts"
    - Revert "cifs: quirk for STATUS_OBJECT_NAME_INVALID returned for non-ASCII
      dfs refs"
    - Revert "cifs: alloc_path_with_tree_prefix: do not append sep. if the path is
      empty"
    - Revert "cifs: clean up an inconsistent indenting"
    - Revert "cifs: free ntlmsspblob allocated in negotiate"
    - Revert "cifs: fix FILE_BOTH_DIRECTORY_INFO definition"
    - Revert "cifs: move superblock magic defitions to magic.h"
    - Revert "cifs: Fix smb311_update_preauth_hash() kernel-doc comment"
    - Revert "cifs: avoid race during socket reconnect between send and recv"
    - Revert "cifs: maintain a state machine for tcp/smb/tcon sessions"
    - Revert "cifs: fix hang on cifs_get_next_mid()"
    - Revert "cifs: take cifs_tcp_ses_lock for status checks"
    - Revert "cifs: reconnect only the connection and not smb session where
      possible"
    - Revert "cifs: add WARN_ON for when chan_count goes below minimum"
    - Revert "cifs: adjust DebugData to use chans_need_reconnect for conn status"
    - Revert "cifs: use the chans_need_reconnect bitmap for reconnect status"
    - Revert "cifs: track individual channel status using chans_need_reconnect"
    - Revert "cifs: remove redundant assignment to pointer p"
    - Revert "cifs: ignore resource_id while getting fscache super cookie"
    - Revert "cifs: fix ntlmssp auth when there is no key exchange"
    - Revert "cifs: avoid use of dstaddr as key for fscache client cookie"
    - Revert "cifs: add server conn_id to fscache client cookie"
    - Revert "cifs: wait for tcon resource_id before getting fscache super"
    - Revert "cifs: update internal version number"
    - Revert "smb2: clarify rc initialization in smb2_reconnect"
    - Revert "cifs: populate server_hostname for extra channels"
    - Revert "cifs: introduce cifs_ses_mark_for_reconnect() helper"
    - Revert "cifs: protect srv_count with cifs_tcp_ses_lock"
    - Revert "cifs: move debug print out of spinlock"
    - Revert "cifs: do not duplicate fscache cookie for secondary channels"
    - Revert "cifs: connect individual channel servers to primary channel server"
    - Revert "cifs: do not negotiate session if session already exists"
    - Revert "smb3: do not setup the fscache_super_cookie until fsinfo
      initialized"
    - Revert "cifs: fix potential use-after-free bugs"
    - Revert "smb3: add additional null check in SMB311_posix_mkdir"
    - Revert "cifs: release lock earlier in dequeue_mid error case"
    - Revert "smb3: add additional null check in SMB2_tcon"
    - Revert "smb3: add additional null check in SMB2_open"
    - Revert "smb3: add additional null check in SMB2_ioctl"
    - Revert "smb3: remove trivial dfs compile warning"
    - Revert "cifs: for compound requests, use open handle if possible"
    - Revert "cifs: convert list_for_each to entry variant"
    - Revert "cifs: fix print of hdr_flags in dfscache_proc_show()"
    - Revert "cifs: send workstation name during ntlmssp session setup"
    - Revert "smb3: add dynamic trace points for socket connection"
    - Revert "cifs: Move SMB2_Create definitions to the shared area"
    - Revert "cifs: Move more definitions into the shared area"
    - Revert "cifs: move NEGOTIATE_PROTOCOL definitions out into the common area"
    - Revert "cifs: Create a new shared file holding smb2 pdu definitions"
    - Revert "cifs: add mount parameter tcpnodelay"
    - Revert "cifs: if deferred close is disabled then close files immediately"
    - Revert "cifs: use fs_context for automounts"
    - Revert "SMB3: Do not send lease break acknowledgment if all file handles
      have been closed"
    - Revert "cifs: fix lease break oops in xfstest generic/098"
    - Revert "cifs: fix mid leak during reconnection after timeout threshold"
    - Revert "cifs: mapchars mount option ignored"
    - Revert "SMB3: drop reference to cfile before sending oplock break"
    - Revert "SMB3: Close all deferred handles of inode in case of handle lease
      break"
    - Revert "SMB3: force unmount was failing to close deferred close files"
    - Revert "smb3: fix problem remounting a share after shutdown"
    - Revert "cifs: release leases for deferred close handles when freezing"
    - Revert "cifs: fix pcchunk length type in smb2_copychunk_range"
    - Revert "SMB3: Close deferred file handles in case of handle lease break"
    - Revert "SMB3: Add missing locks to protect deferred close file list"
    - Revert "cifs: sanitize paths in cifs_update_super_prepath."
    - Revert "smb3: lower default deferred close timeout to address perf
      regression"
    - Revert "smb3: allow deferred close timeout to be configurable"
    - Revert "cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL"
    - Revert "cifs: prevent infinite recursion in CIFSGetDFSRefer()"
    - Revert "cifs: print session id while listing open files"
    - Revert "cifs: empty interface list when server doesn't support query
      interfaces"
    - Revert "cifs: Fix smb2_set_path_size()"
    - Revert "cifs: Move the in_send statistic to __smb_send_rqst()"
    - Revert "cifs: Fix uninitialized memory read in smb3_qfs_tcon()"
    - Revert "cifs: Fix warning and UAF when destroy the MR list"
    - Revert "cifs: Fix lost destroy smbd connection when MR allocate failed"
    - Revert "cifs: Fix use-after-free in rdata->read_into_pages()"
    - Revert "cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()"
    - Revert "cifs: Fix oops due to uncleared server->smbd_conn in reconnect"
    - Revert "cifs: fix potential deadlock in cache_refresh_path()"
    - Revert "cifs: do not include page data when checking signature"
    - Revert "cifs: Fix uninitialized memory read for smb311 posix symlink create"
    - Revert "cifs: fix missing display of three mount options"
    - Revert "cifs: fix confusing debug message"
    - Revert "cifs: fix oops during encryption"
    - Revert "cifs: fix use-after-free caused by invalid pointer `hostname`"
    - Revert "cifs: fix missed refcounting of ipc tcon"
    - Revert "cifs: Fix connections leak when tlink setup failed"
    - Revert "cifs: support nested dfs links over reconnect"
    - Revert "cifs: split out dfs code from cifs_reconnect()"
    - Revert "cifs: introduce new helper for cifs_reconnect()"
    - Revert "cifs: add check for returning value of SMB2_set_info_init"
    - Revert "cifs: Fix wrong return value checking when GETFLAGS"
    - Revert "cifs: add check for returning value of SMB2_close_init"
    - Revert "cifs: fix regression in very old smb1 mounts"
    - Revert "cifs: Fix xid leak in cifs_ses_add_channel()"
    - Revert "cifs: Fix xid leak in cifs_flock()"
    - Revert "cifs: Fix xid leak in cifs_copy_file_range()"
    - Revert "cifs: Fix xid leak in cifs_create()"
    - Revert "cifs: return correct error in ->calc_signature()"
    - Revert "smb3: must initialize two ACL struct fields to zero"
    - Revert "cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message"
    - Revert "cifs: destage dirty pages before re-reading them for cache=none"
    - Revert "cifs: always initialize struct msghdr smb_msg completely"
    - Revert "cifs: don't send down the destination address to sendmsg for a
      SOCK_STREAM"
    - Revert "cifs: revalidate mapping when doing direct writes"
    - Revert "cifs: fix small mempool leak in SMB2_negotiate()"
    - Revert "smb3: missing inode locks in punch hole"
    - Revert "smb3: check xattr value length earlier"
    - Revert "cifs: Fix memory leak on the deferred close"
    - Revert "SMB3: fix lease break timeout when multiple deferred close handles
      for the same file."
    - Revert "cifs: fix reconnect on smb3 mount types"
    - Revert "cifs: return errors during session setup during reconnects"
    - Revert "cifs: version operations for smb20 unneeded when legacy support
      disabled"
    - Revert "SMB3: EBADF/EIO errors in rename/open caused by race condition in
      smb2_compound_op"
    - Revert "smb3: check for null tcon"
    - Revert "cifs: when extending a file with falloc we should make files not-
      sparse"
    - Revert "cifs: fix potential double free during failed mount"
    - Revert "cifs: destage any unwritten data to the server before calling
      copychunk_write"
    - Revert "cifs: Check the IOCB_DIRECT flag, not O_DIRECT"
    - Revert "cifs: verify that tcon is valid before dereference in cifs_kill_sb"
    - Revert "cifs: potential buffer overflow in handling symlinks"
    - Revert "cifs: release cached dentries only if mount is complete"
    - Revert "Adjust cifssb maximum read size"
    - Revert "cifs: fix NULL ptr dereference in smb2_ioctl_query_info()"
    - Revert "cifs: prevent bad output lengths in smb2_ioctl_query_info()"
    - Revert "cifs: we do not need a spinlock around the tree access during
      umount"
    - Revert "cifs: fix handlecache and multiuser"
    - Revert "cifs: fix confusing unneeded warning message on smb2.1 and earlier"
    - Revert "cifs: protect session channel fields with chan_lock"
    - Revert "cifs: modefromsids must add an ACE for authenticated users"
    - Revert "cifs: fix double free race when mount fails in cifs_get_root()"
    - Revert "cifs: do not use uninitialized data in the owner/group sid"
    - Revert "smb3: fix snapshot mount option"
    - Revert "cifs: fix set of group SID via NTSD xattrs"
    - Revert "cifs: sanitize multiple delimiters in prepath"
    - Revert "cifs: Fix crash on unload of cifs_arc4.ko"
    - Revert "cifs: nosharesock should be set on new server"
    - Revert "cifs: nosharesock should not share socket with future sessions"
    - Revert "cifs: fix memory leak of smb3_fs_context_dup::server_hostname"
    - Revert "smb3: do not error on fsync when readonly"
    - Revert "cifs: set a minimum of 120s for next dns resolution"
    - Revert "cifs: To match file servers, make sure the server hostname matches"
    - cifs: To match file servers, make sure the server hostname matches
    - cifs: add mount parameter tcpnodelay
    - cifs: Create a new shared file holding smb2 pdu definitions
    - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area
    - cifs: Move more definitions into the shared area
    - cifs: Move SMB2_Create definitions to the shared area
    - smb3: add dynamic trace points for socket connection
    - cifs: nosharesock should not share socket with future sessions
    - cifs: send workstation name during ntlmssp session setup
    - cifs: fix print of hdr_flags in dfscache_proc_show()
    - cifs: introduce new helper for cifs_reconnect()
    - cifs: convert list_for_each to entry variant
    - cifs: split out dfs code from cifs_reconnect()
    - cifs: set a minimum of 120s for next dns resolution
    - cifs: for compound requests, use open handle if possible
    - smb3: do not error on fsync when readonly
    - cifs: support nested dfs links over reconnect
    - smb3: remove trivial dfs compile warning
    - smb3: add additional null check in SMB2_ioctl
    - smb3: add additional null check in SMB2_open
    - smb3: add additional null check in SMB2_tcon
    - cifs: release lock earlier in dequeue_mid error case
    - smb3: add additional null check in SMB311_posix_mkdir
    - cifs: fix memory leak of smb3_fs_context_dup::server_hostname
    - cifs: fix potential use-after-free bugs
    - smb3: do not setup the fscache_super_cookie until fsinfo initialized
    - cifs: do not negotiate session if session already exists
    - cifs: protect session channel fields with chan_lock
    - cifs: connect individual channel servers to primary channel server
    - cifs: do not duplicate fscache cookie for secondary channels
    - cifs: move debug print out of spinlock
    - cifs: protect srv_count with cifs_tcp_ses_lock
    - cifs: introduce cifs_ses_mark_for_reconnect() helper
    - cifs: nosharesock should be set on new server
    - cifs: populate server_hostname for extra channels
    - smb2: clarify rc initialization in smb2_reconnect
    - cifs: update internal version number
    - cifs: fix missed refcounting of ipc tcon
    - cifs: wait for tcon resource_id before getting fscache super
    - cifs: add server conn_id to fscache client cookie
    - cifs: avoid use of dstaddr as key for fscache client cookie
    - cifs: Fix crash on unload of cifs_arc4.ko
    - cifs: fix ntlmssp auth when there is no key exchange
    - cifs: ignore resource_id while getting fscache super cookie
    - cifs: sanitize multiple delimiters in prepath
    - cifs: remove redundant assignment to pointer p
    - cifs: track individual channel status using chans_need_reconnect
    - cifs: use the chans_need_reconnect bitmap for reconnect status
    - cifs: adjust DebugData to use chans_need_reconnect for conn status
    - cifs: add WARN_ON for when chan_count goes below minimum
    - cifs: reconnect only the connection and not smb session where possible
    - cifs: take cifs_tcp_ses_lock for status checks
    - cifs: fix hang on cifs_get_next_mid()
    - cifs: maintain a state machine for tcp/smb/tcon sessions
    - cifs: avoid race during socket reconnect between send and recv
    - cifs: Fix smb311_update_preauth_hash() kernel-doc comment
    - cifs: move superblock magic defitions to magic.h
    - cifs: fix FILE_BOTH_DIRECTORY_INFO definition
    - cifs: free ntlmsspblob allocated in negotiate
    - cifs: clean up an inconsistent indenting
    - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty
    - cifs: quirk for STATUS_OBJECT_NAME_INVALID returned for non-ASCII dfs refs
    - cifs: serialize all mount attempts
    - smb3: add new defines from protocol specification
    - cifs: check reconnects for channels of active tcons too
    - cifs: fix the connection state transitions with multichannel
    - cifs: protect all accesses to chan_* with chan_lock
    - cifs: remove unused variable ses_selected
    - cifs: fix the cifs_reconnect path for DFS
    - cifs: remove repeated state change in dfs tree connect
    - cifs: make status checks in version independent callers
    - cifs: update tcpStatus during negotiate and sess setup
    - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits
    - smb3: send NTLMSSP version information
    - cifs: update internal module number
    - Fix a warning about a malformed kernel doc comment in cifs
    - cifs: unlock chan_lock before calling cifs_put_tcp_session
    - cifs: fix workstation_name for multiuser mounts
    - improve error message when mount options conflict with posix
    - cifs: call cifs_reconnect when a connection is marked
    - cifs: call helper functions for marking channels for reconnect
    - cifs: mark sessions for reconnection in helper function
    - smb3: fix snapshot mount option
    - cifs: fix set of group SID via NTSD xattrs
    - cifs: do not use uninitialized data in the owner/group sid
    - cifs: fix double free race when mount fails in cifs_get_root()
    - cifs: modefromsids must add an ACE for authenticated users
    - cifs: fix confusing unneeded warning message on smb2.1 and earlier
    - treewide: Replace zero-length arrays with flexible-array members
    - smb3: fix incorrect session setup check for multiuser mounts
    - cifs: fix handlecache and multiuser
    - cifs: truncate the inode and mapping when we simulate fcollapse
    - Adjust cifssb maximum read size
    - cifs: we do not need a spinlock around the tree access during umount
    - cifs: use a different reconnect helper for non-cifsd threads
    - cifs: do not skip link targets when an I/O fails
    - cifs: convert the path to utf16 in smb2_query_info_compound
    - cifs: change smb2_query_info_compound to use a cached fid, if available
    - cifs: fix bad fids sent over wire
    - cifs: fix incorrect use of list iterator after the loop
    - move more common protocol header definitions to smbfs_common
    - smb3: move defines for ioctl protocol header and SMB2 sizes to smbfs_common
    - smb3: move defines for query info and query fsinfo to smbfs_common
    - smb3: cleanup and clarify status of tree connections
    - smb3: fix ksmbd bigendian bug in oplock break, and move its struct to
      smbfs_common
    - cifs: prevent bad output lengths in smb2_ioctl_query_info()
    - cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
    - cifs: fix potential race with cifsd thread
    - cifs: remove check of list iterator against head past the loop body
    - cifs: force new session setup and tcon for dfs
    - cifs: update internal module number
    - cifs: Check the IOCB_DIRECT flag, not O_DIRECT
    - cifs: release cached dentries only if mount is complete
    - cifs: Split the smb3_add_credits tracepoint
    - cifs: potential buffer overflow in handling symlinks
    - cifs: verify that tcon is valid before dereference in cifs_kill_sb
    - cifs: Use kzalloc instead of kmalloc/memset
    - cifs: fix NULL ptr dereference in refresh_mounts()
    - cifs: use correct lock type in cifs_reconnect()
    - cifs: destage any unwritten data to the server before calling
      copychunk_write
    - SMB3: EBADF/EIO errors in rename/open caused by race condition in
      smb2_compound_op
    - cifs: fix signed integer overflow when fl_end is OFFSET_MAX
    - cifs: don't call cifs_dfs_query_info_nonascii_quirk() if nodfs was set
    - cifs: return ENOENT for DFS lookup_cache_entry()
    - cifs: print TIDs as hex
    - cifs: move definition of cifs_fattr earlier in cifsglob.h
    - cifs: check for smb1 in open_cached_dir()
    - cifs: set the CREATE_NOT_FILE when opening the directory in use_cached_dir()
    - cifs: smbd: fix typo in comment
    - smb3: add trace point for lease not found issue
    - cifs: return the more nuanced writeback error on close()
    - smb3: add trace point for oplock not found
    - Add defines for various newer FSCTLs
    - Add various fsctl structs
    - cifs: fix minor compile warning
    - smb3: check for null tcon
    - smb3: don't set rc when used and unneeded in query_info_compound
    - smb3: add mount parm nosparse
    - cifs: do not use tcpStatus after negotiate completes
    - cifs: use new enum for ses_status
    - cifs: avoid parallel session setups on same channel
    - cifs: cache the dirents for entries in a cached directory
    - cifs: fix ntlmssp on old servers
    - smb3: remove unneeded null check in cifs_readdir
    - cifs: fix potential double free during failed mount
    - cifs: remove repeated debug message on cifs_put_smb_ses()
    - cifs: when extending a file with falloc we should make files not-sparse
    - cifs: fix potential deadlock in direct reclaim
    - cifs: do not build smb1ops if legacy support is disabled
    - cifs: version operations for smb20 unneeded when legacy support disabled
    - cifs: update internal module number
    - cifs: skip trailing separators of prefix paths
    - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share
    - cifs: fix reconnect on smb3 mount types
    - cifs: return errors during session setup during reconnects
    - cifs: populate empty hostnames for extra channels
    - smb3: add trace point for SMB2_set_eof
    - cifs: when a channel is not found for server, log its connection id
    - smb3: fix empty netname context on secondary channels
    - smb3: use netname when available on secondary channels
    - cifs: change iface_list from array to sorted linked list
    - cifs: during reconnect, update interface if necessary
    - cifs: periodically query network interfaces from server
    - cifs: avoid deadlocks while updating iface
    - cifs: update cifs_ses::ip_addr after failover
    - cifs: fix race condition with delayed threads
    - cifs: remove unnecessary locking of chan_lock while freeing session
    - smb3: workaround negprot bug in some Samba servers
    - smb3: check xattr value length earlier
    - cifs: remove redundant initialization to variable mnt_sign_enabled
    - cifs: remove unnecessary type castings
    - cifs: remove unnecessary (void*) conversions.
    - cifs: remove some camelCase and also some static build warnings
    - cifs: remove minor build warning
    - smb2: small refactor in smb2_check_message()
    - cifs: list_for_each() -> list_for_each_entry()
    - cifs: remove remaining build warnings
    - cifs: avoid use of global locks for high contention data
    - cifs: fix wrong unlock before return from cifs_tree_connect()
    - cifs: when insecure legacy is disabled shrink amount of SMB1 code
    - cifs: remove useless DeleteMidQEntry()
    - cifs: remove "cifs_" prefix from init/destroy mids functions
    - cifs: alloc_mid function should be marked as static
    - cifs: update internal module number
    - cifs: fix lock length calculation
    - cifs: Move cached-dir functions into a separate file
    - cifs: Do not use tcon->cfid directly, use the cfid we get from
      open_cached_dir
    - smb3: allow deferred close timeout to be configurable
    - SMB3: fix lease break timeout when multiple deferred close handles for the
      same file.
    - cifs: Add constructor/destructors for tcon->cfid
    - cifs: Do not access tcon->cfids->cfid directly from is_path_accessible
    - cifs: remove unused server parameter from calc_smb_size()
    - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
    - cifs: Fix memory leak on the deferred close
    - cifs: move from strlcpy with unused retval to strscpy
    - smb3: missing inode locks in zero range
    - smb3: missing inode locks in punch hole
    - cifs: skip extra NULL byte in filenames
    - cifs: Use help macro to get the header preamble size
    - cifs: Use help macro to get the mid header size
    - cifs: Add helper function to check smb1+ server
    - smb3: Move the flush out of smb2_copychunk_range() into its callers
    - smb3: fix temporary data corruption in collapse range
    - smb3: fix temporary data corruption in insert range
    - smb3: use filemap_write_and_wait_range instead of filemap_write_and_wait
    - cifs: fix small mempool leak in SMB2_negotiate()
    - cifs: revalidate mapping when doing direct writes
    - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
    - cifs: always initialize struct msghdr smb_msg completely
    - cifs: add missing spinlock around tcon refcount
    - cifs: update internal module number
    - cifs: misc: fix spelling typo in comment
    - cifs: return correct error in ->calc_signature()
    - cifs: destage dirty pages before re-reading them for cache=none
    - cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
    - Decrease the number of SMB3 smbdirect client SGEs
    - Reduce client smbdirect max receive segment size
    - Handle variable number of SGEs in client smbdirect send.
    - Fix formatting of client smbdirect RDMA logging
    - smb3: add dynamic trace points for tree disconnect
    - cifs: Make tcon contain a wrapper structure cached_fids instead of
      cached_fid
    - cifs: improve handlecaching
    - cifs: store a pointer to a fid in the cfid structure instead of the struct
    - smb3: define missing create contexts
    - smb3: do not log confusing message when server returns no network interfaces
    - cifs: Replace a couple of one-element arrays with flexible-array members
    - cifs: remove initialization value
    - cifs: replace kfree() with kfree_sensitive() for sensitive data
    - smb3: rename encryption/decryption TFMs
    - cifs: secmech: use shash_desc directly, remove sdesc
    - smb3: fix oops in calculating shash_setkey
    - cifs: fix skipping to incorrect offset in emit_cached_dirents
    - cifs: fix regression in very old smb1 mounts
    - smb3: clarify multichannel warning
    - cifs: improve symlink handling for smb2+
    - cifs: fix uninitialised var in smb2_compound_op()
    - cifs: prevent copying past input buffer boundaries
    - cifs: enable caching of directories for which a lease is held
    - cifs: find and use the dentry for cached non-root directories also
    - cifs: use ALIGN() and round_up() macros
    - cifs: fix static checker warning
    - cifs: fix double-fault crash during ntlmssp
    - smb3: must initialize two ACL struct fields to zero
    - cifs: lease key is uninitialized in smb1 paths
    - cifs: lease key is uninitialized in two additional functions when smb1
    - smb3: improve SMB3 change notification support
    - cifs: Fix xid leak in cifs_create()
    - cifs: Fix xid leak in cifs_copy_file_range()
    - cifs: Fix xid leak in cifs_flock()
    - cifs: Fix xid leak in cifs_ses_add_channel()
    - cifs: Fix xid leak in cifs_get_file_info_unix()
    - cifs: use LIST_HEAD() and list_move() to simplify code
    - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir
    - cifs: Fix memory leak when build ntlmssp negotiate blob failed
    - smb3: interface count displayed incorrectly
    - cifs: drop the lease for cached directories on rmdir or rename
    - cifs: fix memory leaks in session setup
    - cifs: update internal module number
    - cifs: Fix pages array leak when writedata alloc failed in
      cifs_writedata_alloc()
    - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
    - cifs: fix use-after-free caused by invalid pointer `hostname`
    - cred: Do not default to init_cred in prepare_kernel_cred()
    - cifs: always iterate smb sessions using primary channel
    - cifs: avoid unnecessary iteration of tcp sessions
    - cifs: fix use-after-free on the link name
    - cifs: Fix connections leak when tlink setup failed
    - cifs: add check for returning value of SMB2_close_init
    - cifs: Fix wrong return value checking when GETFLAGS
    - cifs: add check for returning value of SMB2_set_info_init
    - cifs: Use after free in debug code
    - cifs: fix missing unlock in cifs_file_copychunk_range()
    - cifs: Add "extbuf" and "extbuflen" args to smb2_compound_op()
    - cifs: Parse owner/group for stat in smb311 posix extensions
    - cifs: skip alloc when request has no pages
    - cifs: minor cleanup of some headers
    - cifs: fix various whitespace errors in headers
    - cifs: fix missing display of three mount options
    - cifs: print warning when conflicting soft vs. hard mount options specified
    - cifs: fix oops during encryption
    - cifs: Remove duplicated include in cifsglob.h
    - cifs: set correct tcon status after initial tree connect
    - cifs: set correct ipc status after initial tree connect
    - cifs: reduce roundtrips on create/qinfo requests
    - cifs: use fs_context for automounts
    - cifs: get rid of mount options string parsing
    - cifs: remove unused smb3_fs_context::mount_options
    - cifs: set resolved ip in sockaddr
    - cifs: split out ses and tcon retrieval from mount_get_conns()
    - cifs: share dfs connections and supers
    - cifs: don't refresh cached referrals from unactive mounts
    - cifs: fix refresh of cached referrals
    - cifs: refresh root referrals
    - cifs: don't block in dfs_cache_noreq_update_tgthint()
    - cifs: fix confusing debug message
    - cifs: fix source pathname comparison of dfs supers
    - cifs: optimize reconnect of nested links
    - cifs: set correct status of tcon ipc when reconnecting
    - cifs: use origin fullpath for automounts
    - cifs: don't leak -ENOMEM in smb2_open_file()
    - cifs: update internal module number
    - cifs: Fix kmap_local_page() unmapping
    - cifs: ignore ipc reconnect failures during dfs failover
    - cifs: fix race in assemble_neg_contexts()
    - cifs: protect access of TCP_Server_Info::{dstaddr,hostname}
    - cifs: refcount only the selected iface during interface update
    - cifs: fix interface count calculation during refresh
    - cifs: fix file info setting in cifs_query_path_info()
    - cifs: fix file info setting in cifs_open_file()
    - cifs: remove redundant assignment to the variable match
    - cifs: fix double free on failed kerberos auth
    - cifs: do not query ifaces on smb1 mounts
    - cifs: fix potential memory leaks in session setup
    - cifs: Fix uninitialized memory read for smb311 posix symlink create
    - cifs: fix potential deadlock in cache_refresh_path()
    - cifs: avoid re-lookups in dfs_cache_find()
    - cifs: don't take exclusive lock for updating target hints
    - cifs: remove duplicate code in __refresh_tcon()
    - cifs: handle cache lookup errors different than -ENOENT
    - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
    - cifs: do not include page data when checking signature
    - cifs: remove unused function
    - cifs: Fix oops due to uncleared server->smbd_conn in reconnect
    - cifs: Fix use-after-free in rdata->read_into_pages()
    - cifs: Use kstrtobool() instead of strtobool()
    - cifs: Replace zero-length arrays with flexible-array members
    - cifs: print last update time for interface list
    - cifs: Get rid of unneeded conditional in the smb2_get_aead_req()
    - cifs: update Kconfig description
    - cifs: fix indentation in make menuconfig options
    - cifs: prevent data race in smb2_reconnect()
    - cifs: get rid of unneeded conditional in cifs_get_num_sgs()
    - cifs: introduce cifs_io_parms in smb2_async_writev()
    - cifs: split out smb3_use_rdma_offload() helper
    - cifs: don't try to use rdma offload on encrypted connections
    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
    - cifs: remove unneeded 2bytes of padding from smb2 tree connect
    - cifs: Fix uninitialized memory reads for oparms.mode
    - cifs: fix mount on old smb servers
    - cifs: Convert struct fealist away from 1-element array
    - cifs: Replace remaining 1-element arrays
    - cifs: Check the lease context if we actually got a lease
    - cifs: return a single-use cfid if we did not get a lease
    - cifs: Fix lost destroy smbd connection when MR allocate failed
    - cifs: Fix warning and UAF when destroy the MR list
    - cifs: get rid of dns resolve worker
    - smb3: Replace smb2pdu 1-element arrays with flex-arrays
    - cifs: Add a function to read into an iter from a socket
    - cifs: use the least loaded channel for sending requests
    - cifs: use tcon allocation functions even for dummy tcon
    - cifs: update ip_addr for ses only for primary chan setup
    - update internal module version number for cifs.ko
    - cifs: match even the scope id for ipv6 addresses
    - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too
    - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
    - cifs: prevent data race in cifs_reconnect_tcon()
    - cifs: Move the in_send statistic to __smb_send_rqst()
    - cifs: Fix smb2_set_path_size()
    - cifs: generate signkey for the channel that's reconnecting
    - cifs: set DFS root session in cifs_get_smb_ses()
    - cifs: fix use-after-free bug in refresh_cache_worker()
    - cifs: return DFS root session id in DebugData
    - cifs: use DFS root session instead of tcon ses
    - cifs: check only tcon status on tcon related functions
    - cifs: lock chan_lock outside match_session
    - cifs: do not poll server interfaces too regularly
    - cifs: empty interface list when server doesn't support query interfaces
    - cifs: dump pending mids for all channels in DebugData
    - cifs: print session id while listing open files
    - cifs: append path to open_enter trace event
    - cifs: avoid race conditions with parallel reconnects
    - cifs: fix missing unload_nls() in smb2_reconnect()
    - smb3: lower default deferred close timeout to address perf regression
    - cifs: fix dentry lookups in directory handle cache
    - smb3: fix unusable share after force unmount failure
    - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
    - cifs: avoid races in parallel reconnects in smb1
    - cifs: prevent infinite recursion in CIFSGetDFSRefer()
    - cifs: get rid of dead check in smb2_reconnect()
    - cifs: sanitize paths in cifs_update_super_prepath.
    - cifs: double lock in cifs_reconnect_tcon()
    - cifs: fix negotiate context parsing
    - cifs: avoid dup prefix path in dfs_get_automount_devname()
    - cifs: Simplify SMB2_open_init()
    - cifs: Simplify SMB2_open_init()
    - cifs: Simplify SMB2_open_init()
    - cifs: Avoid a cast in add_lease_context()
    - SMB3: Add missing locks to protect deferred close file list
    - SMB3: Close deferred file handles in case of handle lease break
    - cifs: missing lock when updating session status
    - SMB3.1.1: add new tree connect ShareFlags
    - smb3: make query_on_disk_id open context consistent and move to common code
    - smb3: move some common open context structs to smbfs_common
    - cifs: update internal module version number for cifs.ko
    - SMB3.1.1: correct definition for app_instance_id create contexts
    - cifs: protect session status check in smb2_reconnect()
    - cifs: print smb3_fs_context::source when mounting
    - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
    - cifs: fix potential race when tree connecting ipc
    - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath
    - cifs: avoid potential races when handling multiple dfs tcons
    - cifs: fix sharing of DFS connections
    - cifs: fix pcchunk length type in smb2_copychunk_range
    - do not reuse connection if share marked as isolated
    - smb3: improve parallel reads of large files
    - SMB3: force unmount was failing to close deferred close files
    - smb3: fix problem remounting a share after shutdown
    - cifs: release leases for deferred close handles when freezing
    - SMB3: Close all deferred handles of inode in case of handle lease break
    - SMB3: drop reference to cfile before sending oplock break
    - cifs: fix smb1 mount regression
    - smb3: display debug information better for encryption
    - cifs: mapchars mount option ignored
    - smb3: missing null check in SMB2_change_notify
    - smb: delete an unnecessary statement
    - cifs: address unused variable warning
    - smb: remove obsolete comment
    - cifs: fix status checks in cifs_tree_connect
    - cifs: print all credit counters in DebugData
    - smb/client: print "Unknown" instead of bogus link speed value
    - cifs: fix sockaddr comparison in iface_cmp
    - cifs: fix max_credits implementation
    - cifs: fix lease break oops in xfstest generic/098
    - cifs: add a warning when the in-flight count goes negative
    - SMB3: Do not send lease break acknowledgment if all file handles have been
      closed
    - cifs: print nosharesock value while dumping mount options
    - smb: client: fix warning in cifs_match_super()
    - smb: client: fix warning in cifs_smb3_do_mount()
    - cifs: print more detail when invalidate_inode_mapping fails
    - smb3: do not reserve too many oplock credits
    - smb: client: fix warning in CIFSFindFirst()
    - smb: client: fix warning in CIFSFindNext()
    - smb: client: fix warning in generic_ip_connect()
    - cifs: prevent use-after-free by freeing the cfile later
    - cifs: do all necessary checks for credits within or before locking
    - cifs: fix session state check in reconnect to avoid use-after-free issue
    - cifs: fix session state check in smb2_find_smb_ses
    - cifs: print client_guid in DebugData
    - smb: client: fix broken file attrs with nodfs mounts
    - smb: client: fix parsing of source mount option
    - smb: client: fix shared DFS root mounts with different prefixes
    - smb: client: improve DFS mount check
    - cifs: log session id when a matching ses is not found
    - cifs: new dynamic tracepoint to track ses not found errors
    - cifs: fix session state transition to avoid use-after-free issue
    - smb: client: remove redundant pointer 'server'
    - cifs: if deferred close is disabled then close files immediately
    - smb: client: Fix -Wstringop-overflow issues
    - smb: client: fix missed ses refcounting
    - cifs: fix mid leak during reconnection after timeout threshold
    - cifs: update internal module version number for cifs.ko
    - cifs: allow dumping keys for directories too
    - smb3: do not set NTLMSSP_VERSION flag for negotiate not auth request
    - cifs: add missing return value check for cifs_sb_tlink
    - smb: client: fix dfs link mount against w2k8
    - cifs: fix potential oops in cifs_oplock_break
    - cifs: Release folio lock on fscache read hit.
    - smb3: display network namespace in debug information
    - smb: client: fix null auth

[ Ubuntu: 5.15.0-88.98 ]

* jammy/linux: 5.15.0-88.98 -proposed tracker (LP: #2038055)
  * CVE-2023-4244
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_dynset: disallow object maps
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * CVE-2023-42756
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  * CVE-2023-4623
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  * PCI BARs larger than 128GB are disabled (LP: #2037403)
    - PCI: Support BAR sizes up to 8TB
  * Fix unstable audio at low levels on Thinkpad P1G4 (LP: #2037077)
    - ALSA: hda/realtek - ALC287 I2S speaker platform support
  * Check for changes relevant for security certifications (LP: #1945989)
    - [Packaging] Add a new fips-checks script
  * Jammy update: v5.15.126 upstream stable release (LP: #2037593)
    - io_uring: gate iowait schedule on having pending requests
    - perf: Fix function pointer case
    - net/mlx5: Free irqs only on shutdown callback
    - arm64: errata: Add workaround for TSB flush failures
    - arm64: errata: Add detection for TRBE write to out-of-range
    - [Config] updateconfigs for ARM64_ERRATUM_ and
      ARM64_WORKAROUND_TSB_FLUSH_FAILURE
    - iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982
    - iommu/arm-smmu-v3: Document MMU-700 erratum 2812531
    - iommu/arm-smmu-v3: Add explicit feature for nesting
    - iommu/arm-smmu-v3: Document nesting-related errata
    - arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
    - word-at-a-time: use the same return type for has_zero regardless of
      endianness
    - KVM: s390: fix sthyi error handling
    - wifi: cfg80211: Fix return value in scan logic
    - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
    - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
    - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
    - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
    - net: dsa: fix value check in bcm_sf2_sw_probe()
    - perf test uprobe_from_different_cu: Skip if there is no gcc
    - net: sched: cls_u32: Fix match key mis-addressing
    - mISDN: hfcpci: Fix potential deadlock on &hc->lock
    - qed: Fix kernel-doc warnings
    - qed: Fix scheduling in a tasklet while getting stats
    - net: annotate data-races around sk->sk_max_pacing_rate
    - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
    - net: add missing READ_ONCE(sk->sk_sndbuf) annotation
    - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
    - net: add missing data-race annotations around sk->sk_peek_off
    - net: add missing data-race annotation for sk_ll_usec
    - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
    - bpf, cpumap: Handle skb as well when clean up ptr_ring
    - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
    - net: ll_temac: Switch to use dev_err_probe() helper
    - net: ll_temac: fix error checking of irq_of_parse_and_map()
    - net: korina: handle clk prepare error in korina_probe()
    - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
    - net: dcb: choose correct policy to parse DCB_ATTR_BCN
    - s390/qeth: Don't call dev_close/dev_open (DOWN/UP)
    - ip6mr: Fix skb_under_panic in ip6mr_cache_report()
    - vxlan: Fix nexthop hash size
    - net/mlx5: fs_core: Make find_closest_ft more generic
    - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
    - prestera: fix fallback to previous version on same major version
    - tcp_metrics: fix addr_same() helper
    - tcp_metrics: annotate data-races around tm->tcpm_stamp
    - tcp_metrics: annotate data-races around tm->tcpm_lock
    - tcp_metrics: annotate data-races around tm->tcpm_vals[]
    - tcp_metrics: annotate data-races around tm->tcpm_net
    - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
    - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices
    - libceph: fix potential hang in ceph_osdc_notify()
    - USB: zaurus: Add ID for A-300/B-500/C-700
    - ceph: defer stopping mdsc delayed_work
    - firmware: arm_scmi: Drop OF node reference in the transport channel setup
    - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
    - exfat: release s_lock before calling dir_emit()
    - mtd: spinand: toshiba: Fix ecc_get_status
    - mtd: rawnand: meson: fix OOB available bytes for ECC
    - arm64: dts: stratix10: fix incorrect I2C property for SCL signal
    - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
    - rbd: prevent busy loop when requesting exclusive lock
    - bpf: Disable preemption in bpf_event_output
    - open: make RESOLVE_CACHED correctly test for O_TMPFILE
    - drm/ttm: check null pointer before accessing when swapping
    - bpf, cpumap: Make sure kthread is running before map update returns
    - file: reinstate f_pos locking optimization for regular files
    - fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list()
    - fs/sysv: Null check to prevent null-ptr-deref bug
    - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
    - fs: Protect reconfiguration of sb read-write from racing writes
    - ext2: Drop fragment support
    - mtd: rawnand: omap_elm: Fix incorrect type in assignment
    - mtd: rawnand: rockchip: fix oobfree offset and description
    - mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts
    - mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
    - powerpc/mm/altmap: Fix altmap boundary check
    - drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning
    - selftests/rseq: check if libc rseq support is registered
    - selftests/rseq: Play nice with binaries statically linked against glibc
      2.35+
    - soundwire: bus: pm_runtime_request_resume on peripheral attachment
    - soundwire: fix enumeration completion
    - PM / wakeirq: support enabling wake-up irq after runtime_suspend called
    - PM: sleep: wakeirq: fix wake irq arming
    - Linux 5.15.126
  * Jammy update: v5.15.125 upstream stable release (LP: #2036843)
    - ia64/cpu: Switch to arch_cpu_finalize_init()
    - m68k/cpu: Switch to arch_cpu_finalize_init()
    - mips/cpu: Switch to arch_cpu_finalize_init()
    - sh/cpu: Switch to arch_cpu_finalize_init()
    - Linux 5.15.125
    - Upstream stable to v5.15.125
  * CVE-2023-42755
    - net/sched: Retire rsvp classifier
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * CVE-2023-42753
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
  * CVE-2023-34319
    - xen/netback: Fix buffer overrun triggered by unusual packet
  * CVE-2023-5197
    - netfilter: nf_tables: disallow rule removal from chain binding
  * CVE-2023-4921
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  * CVE-2023-42752
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  * Avoid address overwrite in kernel_connect (LP: #2035163)
    - net: Avoid address overwrite in kernel_connect
  * NULL Pointer Dereference During KVM MMU Page Invalidation (LP: #2035166)
    - KVM: x86/mmu: Track the number of TDP MMU pages, but not the actual pages
  * Fix suspend hang on Lenovo workstation (LP: #2034479)
    - igb: Fix igb_down hung on surprise removal
  * [regression] Unable to initialize SGX enclaves with XFRM other than 3
    (LP: #2034745)
    - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
  * CVE-2023-4881
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  * CVE-2023-4622
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  * Jammy update: v5.15.124 upstream stable release (LP: #2035400)
    - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
    - KVM: s390: pv: fix index value of replaced ASCE
    - io_uring: don't audit the capability check in io_uring_create()
    - gpio: tps68470: Make tps68470_gpio_output() always set the initial value
    - pwm: Add a stub for devm_pwmchip_add()
    - gpio: mvebu: Make use of devm_pwmchip_add
    - gpio: mvebu: fix irq domain leak
    - btrfs: fix race between quota disable and relocation
    - i2c: Delete error messages for failed memory allocations
    - i2c: Improve size determinations
    - i2c: nomadik: Remove unnecessary goto label
    - i2c: nomadik: Use devm_clk_get_enabled()
    - i2c: nomadik: Remove a useless call in the remove function
    - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
    - PCI/ASPM: Factor out pcie_wait_for_retrain()
    - PCI/ASPM: Avoid link retraining race
    - PCI: rockchip: Remove writes to unused registers
    - PCI: rockchip: Fix window mapping and address translation for endpoint
    - PCI: rockchip: Don't advertise MSI-X in PCIe capabilities
    - dlm: cleanup plock_op vs plock_xop
    - dlm: rearrange async condition return
    - fs: dlm: interrupt posix locks only when process is killed
    - drm/ttm: Don't print error message if eviction was interrupted
    - drm/ttm: Don't leak a resource on eviction error
    - n_tty: Rename tail to old_tail in n_tty_read()
    - tty: fix hang on tty device with no_room set
    - drm/ttm: never consider pinned BOs for eviction&swap
    - cifs: missing directory in MAINTAINERS file
    - cifs: use fs_context for automounts
    - ksmbd: remove internal.h include
    - cifs: if deferred close is disabled then close files immediately
    - pwm: meson: Simplify duplicated per-channel tracking
    - pwm: meson: fix handling of period/duty if greater than UINT_MAX
    - tracing/probes: Add symstr type for dynamic events
    - tracing/probes: Fix to avoid double count of the string length on the array
    - tracing: Allow synthetic events to pass around stacktraces
    - Revert "tracing: Add "(fault)" name injection to kernel probes"
    - tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if
      fails
    - scsi: qla2xxx: Remove unused declarations for qla2xxx
    - scsi: qla2xxx: Multi-que support for TMF
    - scsi: qla2xxx: Fix task management cmd failure
    - scsi: qla2xxx: Fix task management cmd fail due to unavailable resource
    - scsi: qla2xxx: Add debug prints in the device remove path
    - scsi: qla2xxx: Fix hang in task management
    - drm/amdgpu: fix vkms crtc settings
    - drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
    - phy: qcom-snps: Use dev_err_probe() to simplify code
    - phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
    - phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
    - phy: qcom-snps-femto-v2: properly enable ref clock
    - soundwire: qcom: update status correctly with mask
    - media: staging: atomisp: select V4L2_FWNODE
    - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
    - iavf: fix potential deadlock on allocation failure
    - iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
    - net: phy: marvell10g: fix 88x3310 power up
    - net: hns3: fix wrong tc bandwidth weight data issue
    - net: hns3: fix wrong bw weight of disabled tc issue
    - vxlan: move to its own directory
    - vxlan: calculate correct header length for GPE
    - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
    - ethernet: atheros: fix return value check in atl1e_tso_csum()
    - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
      temporary address
    - ice: Fix memory management in ice_ethtool_fdir.c
    - bonding: reset bond's flags when down link is P2P device
    - team: reset team's flags when down link is P2P device
    - net: stmmac: Apply redundant write work around on 4.xx too
    - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
    - igc: Fix Kernel Panic during ndo_tx_timeout callback
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - net/sched: mqprio: refactor nlattr parsing to a separate function
    - net/sched: mqprio: add extack to mqprio_parse_nlattr()
    - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    - benet: fix return value check in be_lancer_xmit_workarounds()
    - tipc: check return value of pskb_trim()
    - tipc: stop tipc crypto on failure in tipc_node_create
    - RDMA/mlx4: Make check for invalid flags stricter
    - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
    - drm/msm/adreno: Fix snapshot BINDLESS_DATA size
    - RDMA/irdma: Add missing read barriers
    - RDMA/irdma: Fix data race on CQP completion stats
    - RDMA/irdma: Fix data race on CQP request done
    - RDMA/mthca: Fix crash when polling CQ for shared QPs
    - RDMA/bnxt_re: Prevent handling any completions after qp destroy
    - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
    - ASoC: fsl_spdif: Silence output on stop
    - block: Fix a source code comment in include/uapi/linux/blkzoned.h
    - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
    - dm raid: clean up four equivalent goto tags in raid_ctr()
    - dm raid: protect md_stop() with 'reconfig_mutex'
    - drm/amd: Fix an error handling mistake in psp_sw_init()
    - RDMA/irdma: Report correct WC error
    - ata: pata_ns87415: mark ns87560_tf_read static
    - ring-buffer: Fix wrong stat of cpu_buffer->read
    - tracing: Fix warning in trace_buffered_event_disable()
    - Revert "usb: gadget: tegra-xudc: Fix error check in
      tegra_xudc_powerdomain_init()"
    - usb: gadget: call usb_gadget_check_config() to verify UDC capability
    - USB: gadget: Fix the memory leak in raw_gadget driver
    - KVM: Grab a reference to KVM for VM and vCPU stats file descriptors
    - KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
    - serial: qcom-geni: drop bogus runtime pm state update
    - serial: 8250_dw: Preserve original value of DLF register
    - serial: sifive: Fix sifive_serial_console_setup() section
    - USB: serial: option: support Quectel EM060K_128
    - USB: serial: option: add Quectel EC200A module support
    - USB: serial: simple: add Kaufmann RKS+CAN VCP
    - USB: serial: simple: sort driver entries
    - can: gs_usb: gs_can_close(): add missing set of CAN state to
      CAN_STATE_STOPPED
    - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
    - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
    - usb: dwc3: don't reset device side if dwc3 was configured as host-only
    - usb: ohci-at91: Fix the unhandle interrupt when resume
    - USB: quirks: add quirk for Focusrite Scarlett
    - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one
      config
    - usb: xhci-mtk: set the dma max_seg_size
    - Revert "usb: xhci: tegra: Fix error check"
    - Documentation: security-bugs.rst: update preferences when dealing with the
      linux-distros group
    - Documentation: security-bugs.rst: clarify CVE handling
    - staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
    - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
    - tty: n_gsm: fix UAF in gsm_cleanup_mux
    - Revert "xhci: add quirk for host controllers that don't update endpoint DCS"
    - ALSA: hda/relatek: Enable Mute LED on HP 250 G8
    - hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature
    - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
    - btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
    - btrfs: check for commit error at btrfs_attach_transaction_barrier()
    - file: always lock position for FMODE_ATOMIC_POS
    - nfsd: Remove incorrect check in nfsd4_validate_stateid
    - tpm_tis: Explicitly check for error code
    - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
    - irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
    - locking/rtmutex: Fix task->pi_waiters integrity
    - KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid
    - virtio-net: fix race between set queues and probe
    - s390/dasd: fix hanging device after quiesce/resume
    - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
    - ceph: never send metrics if disable_send_metrics is set
    - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
    - rbd: make get_lock_owner_info() return a single locker or NULL
    - rbd: harden get_lock_owner_info() a bit
    - rbd: retrieve and check lock owner twice before blocklisting
    - tracing: Fix trace_event_raw_event_synth() if else statement
    - ACPI: processor: perflib: Use the "no limit" frequency QoS
    - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
    - cpufreq: intel_pstate: Drop ACPI _PSS states table patching
    - selftests: mptcp: sockopt: use 'iptables-legacy' if available
    - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
    - ASoC: cs42l51: fix driver to properly autoload with automatic module loading
    - selftests: mptcp: join: only check for ip6tables if needed
    - Linux 5.15.124
  * Jammy update: v5.15.123 upstream stable release (LP: #2034612)
    - ALSA: hda/realtek - remove 3k pull low procedure
    - ALSA: hda/realtek: Add quirk for Clevo NS70AU
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
    - keys: Fix linking a duplicate key to a keyring's assoc_array
    - perf probe: Add test for regression introduced by switch to
      die_get_decl_file()
    - btrfs: fix warning when putting transaction with qgroups enabled after abort
    - fuse: revalidate: don't invalidate if interrupted
    - btrfs: zoned: fix memory leak after finding block group with super blocks
    - fuse: ioctl: translate ENOSYS in outarg
    - selftests: tc: set timeout to 15 minutes
    - selftests: tc: add 'ct' action kconfig dep
    - regmap: Drop initial version of maximum transfer length fixes
    - regmap: Account for register length in SMBus I/O limits
    - can: bcm: Fix UAF in bcm_proc_show()
    - selftests: tc: add ConnTrack procfs kconfig
    - drm/client: Fix memory leak in drm_client_target_cloned
    - drm/client: Fix memory leak in drm_client_modeset_probe
    - drm/amd/display: Disable MPC split by default on special asic
    - drm/amd/display: Keep PHY active for DP displays on DCN31
    - ASoC: fsl_sai: Disable bit clock with transmitter
    - ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
    - ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix missing mbhc init error handling
    - ASoC: codecs: wcd934x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix codec initialisation race
    - ASoC: codecs: wcd938x: fix soundwire initialisation race
    - ext4: correct inline offset when handling xattrs in inode body
    - drm/radeon: Fix integer overflow in radeon_cs_parser_init
    - ALSA: emu10k1: roll up loops in DSP setup code for Audigy
    - quota: Properly disable quotas when add_dquot_ref() fails
    - quota: fix warning in dqgrab()
    - udf: Fix uninitialized array access for some pathnames
    - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
    - MIPS: dec: prom: Address -Warray-bounds warning
    - FS: JFS: Fix null-ptr-deref Read in txBegin
    - FS: JFS: Check for read-only mounted filesystem in txBegin
    - spi: bcm63xx: fix max prepend length
    - fbdev: imxfb: warn about invalid left/right margin
    - perf build: Fix library not found error when using CSLIBS
    - pinctrl: amd: Use amd_pinconf_set() for all config options
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
    - bridge: Add extack warning when enabling STP in netns.
    - ethernet: use eth_hw_addr_set() instead of ether_addr_copy()
    - of: net: add a helper for loading netdev->dev_addr
    - ethernet: use of_get_ethdev_address()
    - net: ethernet: mtk_eth_soc: handle probe deferral
    - net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
    - iavf: Fix use-after-free in free_netdev
    - iavf: Fix out-of-bounds when setting channels on remove
    - security: keys: Modify mismatched function name
    - octeontx2-pf: Dont allocate BPIDs for LBK interfaces
    - bpf: Fix subprog idx logic in check_max_stack_depth
    - igc: Prevent garbled TX queue with XDP ZEROCOPY
    - tcp: annotate data-races around tcp_rsk(req)->ts_recent
    - net: ipv4: Use kfree_sensitive instead of kfree
    - net:ipv6: check return value of pskb_trim()
    - Revert "tcp: avoid the lookup process failing to get sk in ehash table"
    - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
    - llc: Don't drop packet from non-root netns.
    - netfilter: nf_tables: fix spurious set element insertion failure
    - netfilter: nf_tables: skip bound chain in netns release path
    - tcp: annotate data-races around tp->tcp_tx_delay
    - tcp: annotate data-races around tp->keepalive_time
    - tcp: annotate data-races around tp->keepalive_intvl
    - tcp: annotate data-races around tp->keepalive_probes
    - tcp: annotate data-races around icsk->icsk_syn_retries
    - tcp: annotate data-races around tp->linger2
    - tcp: annotate data-races around rskq_defer_accept
    - tcp: annotate data-races around tp->notsent_lowat
    - tcp: annotate data-races around icsk->icsk_user_timeout
    - tcp: annotate data-races around fastopenq.max_qlen
    - net: phy: prevent stale pointer dereference in phy_init()
    - jbd2: recheck chechpointing non-dirty buffer
    - tracing/histograms: Return an error if we fail to add histogram to hist_vars
      list
    - nixge: fix mac address error handling again
    - Linux 5.15.123
  * allow io_uring to be disabled in runtime (LP: #2035116)
    - io_uring: add a sysctl to disable io_uring system-wide
  * CVE-2023-31083
    - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  * CVE-2023-3772
    - xfrm: add NULL check in xfrm_update_ae_params
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

linux-azure (5.15.0-1050.57) jammy; urgency=medium

* jammy/linux-azure: 5.15.0-1050.57 -proposed tracker (LP: #2038173)

[ Ubuntu: 5.15.0-87.97 ]

* jammy/linux: 5.15.0-87.97 -proposed tracker (LP: #2038209)
  * CVE-2023-4623
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  * CVE-2023-42755
    - net/sched: Retire rsvp classifier
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * CVE-2023-34319
    - xen/netback: Fix buffer overrun triggered by unusual packet
  * CVE-2023-4921
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  * CVE-2023-42752
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  * CVE-2023-4622
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  * CVE-2023-4244
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_dynset: disallow object maps
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * CVE-2023-42756
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  * CVE-2023-42753
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
  * CVE-2023-5197
    - netfilter: nf_tables: skip bound chain in netns release path
    - netfilter: nf_tables: disallow rule removal from chain binding
  * CVE-2023-4881
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write

-- Tim Gardner <tim.gardner@canonical.com>  Wed, 11 Oct 2023 12:28:58 -0600

Changed in linux-azure (Ubuntu Jammy):
status:	Fix Committed → Fix Released

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2023-12-04:

This bug is awaiting verification that the linux-azure-fips/5.15.0-1053.61+fips1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure-fips' to 'verification-done-jammy-linux-azure-fips'. If the problem still exists, change the tag 'verification-needed-jammy-linux-azure-fips' to 'verification-failed-jammy-linux-azure-fips'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: kernel-spammed-jammy-linux-azure-fips-v2 verification-needed-jammy-linux-azure-fips

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux-azure package

Azure: Update CIFS to v6.5

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux-azure package