focal/linux-intel-iotg-5.15: 5.15.0-1041.47~20.04.1 -proposed tracker

[Stefan Bader]

This bug will contain status and test results related to a kernel source (or snap) as stated in the title.

For an explanation of the tasks and the associated workflow see:
  https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

-- swm properties --
built:
  from: 53d068ebb8ac731b
  route-entry: 1
delta:
  promote-to-proposed: []
flag:
  boot-testing-requested: true
  proposed-announcement-sent: true
  proposed-testing-requested: true
  stream-from-cycle: true
issue: KSRU-9842
kernel-stable-master-bug: 2036562
packages:
  generate: linux-generate-intel-iotg-5.15
  lrg: linux-restricted-generate-intel-iotg-5.15
  lrm: linux-restricted-modules-intel-iotg-5.15
  lrs: linux-restricted-signatures-intel-iotg-5.15
  main: linux-intel-iotg-5.15
  meta: linux-meta-intel-iotg-5.15
  signed: linux-signed-intel-iotg-5.15
phase: Holding before Promote to Updates
phase-changed: Monday, 16. October 2023 10:52 UTC
reason:
  promote-to-updates: Holding -- parent tracker not ready for release
synthetic:
  :promote-to-as-proposed: Fix Released
trackers:
  focal/linux-uc20-intel-iotg: bug 2036560
variant: debs
versions:
  lrm: 5.15.0-1041.47~20.04.1+1
  main: 5.15.0-1041.47~20.04.1
  meta: 5.15.0.1041.47~20.04.32
  signed: 5.15.0-1041.47~20.04.1
versions-replace:
  lrm: [5.15.0-1041.47~20.04.1]
~~:
  announce:
    swm-transition-crankable: 2023-09-25 15:35:27.507346
  clamps:
    new-review: 53d068ebb8ac731b
    promote-to-proposed: 53d068ebb8ac731b
    self: 5.15.0-1041.47~20.04.1
    sru-review: 53d068ebb8ac731b

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Kevin Yeh (kevinyeh)]

Test result are available at http://10.102.156.15:8080/view/cert-stock-iotg-sru-focal/
No regression found.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-intel-iotg-5.15 - 5.15.0-1043.49~20.04.1

---------------
linux-intel-iotg-5.15 (5.15.0-1043.49~20.04.1) focal; urgency=medium

  * focal/linux-intel-iotg-5.15: 5.15.0-1043.49~20.04.1 -proposed tracker
    (LP: #2038195)

  * CVE-2023-42755
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6

  [ Ubuntu: 5.15.0-1043.49 ]

  * jammy/linux-intel-iotg: 5.15.0-1043.49 -proposed tracker (LP: #2038196)
  * CVE-2023-42755
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * jammy/linux: 5.15.0-87.97 -proposed tracker (LP: #2038209)
  * CVE-2023-4623
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  * CVE-2023-42755
    - net/sched: Retire rsvp classifier
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * CVE-2023-34319
    - xen/netback: Fix buffer overrun triggered by unusual packet
  * CVE-2023-4921
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  * CVE-2023-42752
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  * CVE-2023-4622
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  * CVE-2023-4244
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_dynset: disallow object maps
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * CVE-2023-42756
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  * CVE-2023-42753
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
  * CVE-2023-5197
    - netfilter: nf_tables: skip bound chain in netns release path
    - netfilter: nf_tables: disallow rule removal from chain binding
  * CVE-2023-4881
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write

  [ Ubuntu: 5.15.0-1042.48 ]

  * jammy/linux-intel-iotg: 5.15.0-1042.48 -proposed tracker (LP: #2036562)
  * jammy/linux: 5.15.0-86.96 -proposed tracker (LP: #2036575)
  * 5.15.0-85 live migration regression (LP: #2036675)
    - Revert "KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES"
    - Revert "x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0"
  * Regression for ubuntu_bpf test build on Jammy 5.15.0-85.95 (LP: #2035181)
    - selftests/bpf: fix static assert compilation issue for test_cls_*.c
  * `refcount_t: underflow; use-afte...