This bug was fixed in the package linux - 5.4.0-81.91 --------------- linux (5.4.0-81.91) focal; urgency=medium * Packaging resync (LP: #1786013) - update dkms package versions * large_dir in ext4 broken (LP: #1933074) - SAUCE: ext4: fix directory index node split corruption * Some test in kselftest/net on focal source tree were not tested at all (LP: #1934282) - selftests/net: add missing tests to Makefile * curtin: install flash-kernel in arm64 UEFI unexpected (LP: #1918427) - [Packaging] Allow grub-efi-arm* to satisfy recommends on ARM * Add l2tp.sh in net from ubuntu_kernel_selftests back (LP: #1934293) - Revert "UBUNTU: SAUCE: selftests/net -- disable l2tp.sh test" * icmp_redirect.sh in net from ubuntu_kernel_selftests failed on F-OEM-5.6 / F-OEM-5.10 / F-OEM-5.13 / F / G / H (LP: #1880645) - selftests: icmp_redirect: support expected failures * Focal update: v5.4.128 upstream stable release (LP: #1934179) - dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM - dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM - dmaengine: stedma40: add missing iounmap() on error in d40_probe() - afs: Fix an IS_ERR() vs NULL check - mm/memory-failure: make sure wait for page writeback in memory_failure - kvm: LAPIC: Restore guard to prevent illegal APIC register access - batman-adv: Avoid WARN_ON timing related checks - net: ipv4: fix memory leak in netlbl_cipsov4_add_std - vrf: fix maximum MTU - net: rds: fix memory leak in rds_recvmsg - net: lantiq: disable interrupt before sheduling NAPI - udp: fix race between close() and udp_abort() - rtnetlink: Fix regression in bridge VLAN configuration - net/sched: act_ct: handle DNAT tuple collision - net/mlx5e: Remove dependency in IPsec initialization flows - net/mlx5e: Fix page reclaim for dead peer hairpin - net/mlx5: Consider RoCE cap before init RDMA resources - net/mlx5e: allow TSO on VXLAN over VLAN topologies - net/mlx5e: Block offload of outer header csum for UDP tunnels - netfilter: synproxy: Fix out of bounds when parsing TCP options - sch_cake: Fix out of bounds when parsing TCP options and header - alx: Fix an error handling path in 'alx_probe()' - net: stmmac: dwmac1000: Fix extended MAC address registers definition - net: make get_net_ns return error if NET_NS is disabled - qlcnic: Fix an error handling path in 'qlcnic_probe()' - netxen_nic: Fix an error handling path in 'netxen_nic_probe()' - net: qrtr: fix OOB Read in qrtr_endpoint_post - ptp: improve max_adj check against unreasonable values - net: cdc_ncm: switch to eth%d interface naming - lantiq: net: fix duplicated skb in rx descriptor ring - net: usb: fix possible use-after-free in smsc75xx_bind - net: fec_ptp: fix issue caused by refactor the fec_devtype - net: ipv4: fix memory leak in ip_mc_add1_src - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock - be2net: Fix an error handling path in 'be_probe()' - net: hamradio: fix memory leak in mkiss_close - net: cdc_eem: fix tx fixup skb leak - cxgb4: fix wrong shift. - bnxt_en: Rediscover PHY capabilities after firmware reset - bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path - icmp: don't send out ICMP messages with a source address of 0.0.0.0 - net: ethernet: fix potential use-after-free in ec_bhf_remove - regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting - ASoC: rt5659: Fix the lost powers for the HDA header - spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd() - pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled - radeon: use memcpy_to/fromio for UVD fw upload - hwmon: (scpi-hwmon) shows the negative temperature properly - can: bcm: fix infoleak in struct bcm_msg_head - can: bcm/raw/isotp: use per module netdevice notifier - can: j1939: fix Use-after-Free, hold skb ref while in use - can: mcba_usb: fix memory leak in mcba_usb - usb: core: hub: Disable autosuspend for Cypress CY7C65632 - tracing: Do not stop recording cmdlines when tracing is off - tracing: Do not stop recording comms if the trace file is being read - tracing: Do no increment trace_clock_global() by one - PCI: Mark TI C667X to avoid bus reset - PCI: Mark some NVIDIA GPUs to avoid bus reset - PCI: aardvark: Don't rely on jiffies while holding spinlock - PCI: aardvark: Fix kernel panic during PIO transfer - PCI: Add ACS quirk for Broadcom BCM57414 NIC - PCI: Work around Huawei Intelligent NIC VF FLR erratum - KVM: x86: Immediately reset the MMU context when the SMM flag is cleared - ARCv2: save ABI registers across signal handling - x86/process: Check PF_KTHREAD and not current->mm for kernel threads - x86/pkru: Write hardware init value to PKRU when xstate is init - x86/fpu: Reset state for all signal restore failures - dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc - cfg80211: make certificate generation more robust - cfg80211: avoid double free of PMSR request - net: ll_temac: Make sure to free skb when it is completely used - net: ll_temac: Fix TX BD buffer overwrite - net: bridge: fix vlan tunnel dst null pointer dereference - net: bridge: fix vlan tunnel dst refcnt when egressing - mm/slub: clarify verification reporting - mm/slub: fix redzoning for small allocations - mm/slub.c: include swab.h - net: stmmac: disable clocks in stmmac_remove_config_dt() - net: fec_ptp: add clock rate zero check - tools headers UAPI: Sync linux/in.h copy with the kernel sources - KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read - ARM: OMAP: replace setup_irq() by request_irq() - clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support - clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue - clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 - usb: dwc3: debugfs: Add and remove endpoint dirs dynamically - usb: dwc3: core: fix kernel panic when do reboot - Linux 5.4.128 * linux-azure CIFS DFS oops (LP: #1935833) - cifs: get rid of unused parameter in reconn_setup_dfs_targets() - cifs: handle empty list of targets in cifs_reconnect() * pmtu.sh from net in ubuntu_kernel_selftests failed with no error message (LP: #1887661) - selftests: pmtu.sh: improve the test result processing * cifs: On cifs_reconnect, resolve the hostname again (LP: #1929831) - cifs: rename reconn_inval_dfs_target() - cifs: Simplify reconnect code when dfs upcall is enabled - cifs: Avoid error pointer dereference - cifs: On cifs_reconnect, resolve the hostname again. * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367) - (upstream) media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K * Focal update: v5.4.127 upstream stable release (LP: #1933851) - net: ieee802154: fix null deref in parse dev addr - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 - HID: hid-input: add mapping for emoji picker key - HID: hid-sensor-hub: Return error for hid_set_field() failure - HID: quirks: Add quirk for Lenovo optical mouse - HID: multitouch: set Stylus suffix for Stylus-application devices, too - HID: Add BUS_VIRTUAL to hid_connect logging - HID: usbhid: fix info leak in hid_submit_ctrl - drm/tegra: sor: Do not leak runtime PM reference - ARM: OMAP2+: Fix build warning when mmc_omap is not built - gfs2: Prevent direct-I/O write fallback errors from getting lost - HID: gt683r: add missing MODULE_DEVICE_TABLE - riscv: Use -mno-relax when using lld linker - gfs2: Fix use-after-free in gfs2_glock_shrink_scan - scsi: target: core: Fix warning on realtime kernels - ethernet: myri10ge: Fix missing error code in myri10ge_probe() - scsi: qedf: Do not put host in qedf_vport_create() unconditionally - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V - nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues() - nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails - nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue() - net: ipconfig: Don't override command-line hostnames or domains - drm/amd/display: Allow bandwidth validation for 0 streams. - rtnetlink: Fix missing error code in rtnl_bridge_notify() - net/x25: Return the correct errno code - net: Return the correct errno code - fib: Return the correct errno code - Linux 5.4.127 * Focal update: v5.4.126 upstream stable release (LP: #1933369) - proc: Check /proc/$pid/attr/ writes against file opener - proc: Track /proc/$pid/attr/ opener mm_struct - ASoC: max98088: fix ni clock divider calculation - spi: Fix spi device unregister flow - net/nfc/rawsock.c: fix a permission check bug - usb: cdns3: Fix runtime PM imbalance on error - ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet - ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet - vfio-ccw: Serialize FSM IDLE state with I/O completion - ASoC: sti-sas: add missing MODULE_DEVICE_TABLE - spi: sprd: Add missing MODULE_DEVICE_TABLE - isdn: mISDN: netjet: Fix crash in nj_probe: - bonding: init notify_work earlier to avoid uninitialized use - netlink: disable IRQs for netlink_lock_table() - net: mdiobus: get rid of a BUG_ON() - cgroup: disable controllers at parse time - wq: handle VM suspension in stall detection - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock - RDS tcp loopback connection can hang - scsi: bnx2fc: Return failure if io_req is already in ABTS processing - scsi: vmw_pvscsi: Set correct residual data length - scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal - net: macb: ensure the device is available before accessing GEMGXL control registers - net: appletalk: cops: Fix data race in cops_probe1 - net: dsa: microchip: enable phy errata workaround on 9567 - nvme-fabrics: decode host pathing error for connect - MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER - dm verity: fix require_signatures module_param permissions - bnx2x: Fix missing error code in bnx2x_iov_init_one() - nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers - spi: Don't have controller clean up spi device before driver unbind - spi: Cleanup on failure of initial setup - i2c: mpc: Make use of i2c_recover_bus() - i2c: mpc: implement erratum A-004447 workaround - x86/boot: Add .text.* to setup.ld - spi: bcm2835: Fix out-of-bounds access with more than 4 slaves - drm: Fix use-after-free read in drm_getunique() - drm: Lock pointer access in drm_master_release() - kvm: avoid speculation-based attacks from out-of-range memslot accesses - staging: rtl8723bs: Fix uninitialized variables - btrfs: return value from btrfs_mark_extent_written() in case of error - btrfs: promote debugging asserts to full-fledged checks in validate_super - cgroup1: don't allow '\n' in renaming - USB: f_ncm: ncm_bitrate (speed) is unsigned - usb: f_ncm: only first packet of aggregate needs to start timer - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms - usb: dwc3: ep0: fix NULL pointer exception - usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling - usb: typec: wcove: Use LE to CPU conversion when accessing msg->header - usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind - USB: serial: ftdi_sio: add NovaTech OrionMX product ID - USB: serial: omninet: add device id for Zyxel Omni 56K Plus - USB: serial: quatech2: fix control-request directions - USB: serial: cp210x: fix alternate function for CP2102N QFN20 - usb: gadget: eem: fix wrong eem header operation - usb: fix various gadgets null ptr deref on 10gbps cabling. - usb: fix various gadget panics on 10gbps cabling - regulator: core: resolve supply for boot-on/always-on regulators - regulator: max77620: Use device_set_of_node_from_dev() - usb: typec: mux: Fix copy-paste mistake in typec_mux_match - RDMA/ipoib: Fix warning caused by destroying non-initial netns - RDMA/mlx4: Do not map the core_clock page to user space unless enabled - vmlinux.lds.h: Avoid orphan section with !SMP - perf: Fix data race between pin_count increment/decrement - sched/fair: Make sure to update tg contrib for blocked load - KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message - IB/mlx5: Fix initializing CQ fragments buffer - NFS: Fix a potential NULL dereference in nfs_get_client() - NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() - perf session: Correct buffer copying when peeking events - kvm: fix previous commit for 32-bit builds - NFS: Fix use-after-free in nfs4_init_client() - NFSv4: Fix second deadlock in nfs4_evict_inode() - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error. - scsi: core: Fix error handling of scsi_host_alloc() - scsi: core: Fix failure handling of scsi_add_host_with_dma() - scsi: core: Put .shost_dev in failure path if host state changes to RUNNING - scsi: core: Only put parent device if host state differs from SHOST_CREATED - ftrace: Do not blindly read the ip address in ftrace_bug() - tracing: Correct the length check which causes memory corruption - proc: only require mm_struct for writing - Linux 5.4.126 * Focal update: v5.4.125 upstream stable release (LP: #1932957) - btrfs: tree-checker: do not error out if extent ref hash doesn't match - net: usb: cdc_ncm: don't spew notifications - ALSA: usb: update old-style static const declaration - nl80211: validate key indexes for cfg80211_registered_device - hwmon: (dell-smm-hwmon) Fix index values - netfilter: conntrack: unregister ipv4 sockopts on error unwind - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared - efi: cper: fix snprintf() use in cper_dimm_err_location() - vfio/pci: Fix error return code in vfio_ecap_init() - vfio/pci: zap_vma_ptes() needs MMU - samples: vfio-mdev: fix error handing in mdpy_fb_probe() - vfio/platform: fix module_put call in error flow - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service - HID: pidff: fix error return code in hid_pidff_init() - HID: i2c-hid: fix format string mismatch - net/sched: act_ct: Fix ct template allocation for zone 0 - ACPICA: Clean up context mutex during object deletion - netfilter: nft_ct: skip expectations for confirmed conntrack - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches - ieee802154: fix error return code in ieee802154_add_iface() - ieee802154: fix error return code in ieee802154_llsec_getparams() - ixgbevf: add correct exception tracing for XDP - ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions - ice: write register with correct offset - ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared - ice: Allow all LLDP packets from PF to Tx - i2c: qcom-geni: Add shutdown callback for i2c - i40e: optimize for XDP_REDIRECT in xsk path - i40e: add correct exception tracing for XDP - arm64: dts: ls1028a: fix memory node - arm64: dts: zii-ultra: fix 12V_MAIN voltage - ARM: dts: imx7d-meerkat96: Fix the 'tuning-step' property - ARM: dts: imx7d-pico: Fix the 'tuning-step' property - ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells - bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act - tipc: add extack messages for bearer/media failure - tipc: fix unique bearer names sanity check - Bluetooth: fix the erroneous flush_work() order - Bluetooth: use correct lock to prevent UAF of hdev object - net: caif: added cfserl_release function - net: caif: add proper error handling - net: caif: fix memory leak in caif_device_notify - net: caif: fix memory leak in cfusbl_device_notify - HID: i2c-hid: Skip ELAN power-on command after reset - HID: magicmouse: fix NULL-deref on disconnect - HID: multitouch: require Finger field to mark Win8 reports as MT - ALSA: timer: Fix master timer notification - ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx - ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch - ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed - usb: dwc2: Fix build in periphal-only mode - pid: take a reference when initializing `cad_pid` - ocfs2: fix data corruption by fallocate - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect - drm/amdgpu: Don't query CE and UE errors - drm/amdgpu: make sure we unpin the UVD BO - x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing - btrfs: mark ordered extent and inode with error if we fail to finish - btrfs: fix error handling in btrfs_del_csums - btrfs: return errors from btrfs_del_csums in cleanup_ref_head - btrfs: fixup error handling in fixup_inode_link_counts - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY - bnxt_en: Remove the setting of dev_port. - mm: add thp_order - XArray: add xa_get_order - XArray: add xas_split - mm/filemap: fix storing to a THP shadow entry - btrfs: fix unmountable seed device after fstrim - KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode - KVM: arm64: Fix debug register indexing - lib/lz4: explicitly support in-place decompression - xen-pciback: redo VF placement in the virtual topology - i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops - neighbour: allow NUD_NOARP entries to be forced GCed - Linux 5.4.125 -- Kleber Sacilotto de Souza