Ubuntu
linux package

Eoan update: upstream stable patchset 2020-05-18

Bug #1879397 reported by Kamal Mostafa on 2020-05-18

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux (Ubuntu)	Invalid	Undecided	Unassigned
	Eoan	Fix Released	Undecided	Kamal Mostafa

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

upstream stable patchset 2020-05-18

Ported from the following upstream stable releases:
v4.19.121, v5.4.39

from git://git.kernel.org/

drm/edid: Fix off-by-one in DispID DTD pixel clock
drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
drm/qxl: qxl_release use after free
btrfs: fix block group leak when removing fails
ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
ALSA: hda/hdmi: fix without unlocked before return
ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
PM: ACPI: Output correct message on target power state
PM: hibernate: Freeze kernel threads in software_resume()
dm verity fec: fix hash block number in verity_fec_decode
dm writecache: fix data corruption when reloading the target
dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
scsi: qla2xxx: set UNLOADING before waiting for session deletion
scsi: qla2xxx: check UNLOADING before posting async work
RDMA/mlx5: Set GRH fields in query QP on RoCE
RDMA/mlx4: Initialize ib_spec on the stack
RDMA/core: Prevent mixed use of FDs between shared ufiles
RDMA/core: Fix race between destroy and release FD object
vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
iommu/qcom: Fix local_base status check
scsi: target/iblock: fix WRITE SAME zeroing
iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
ALSA: opti9xx: shut up gcc-10 range warning
nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
dmaengine: dmatest: Fix iteration non-stop logic
selinux: properly handle multiple messages in selinux_netlink_send()
btrfs: fix partial loss of prealloc extent past i_size after fsync
btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info
mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop
mmc: sdhci-xenon: fix annoying 1.8V regulator warning
mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
mmc: sdhci-msm: Enable host capabilities pertains to R1b response
mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
mmc: meson-mx-sdio: remove the broken ->card_busy() op
dma-buf: Fix SET_NAME ioctl uapi
drm/amd/display: Fix green screen issue after suspend
NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
btrfs: fix transaction leak in btrfs_recover_relocation
crypto: caam - fix the address of the last entry of S/G
ALSA: line6: Fix POD HD500 audio playback
i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling
dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info()
ARM: dts: imx6qdl-sr-som-ti: indicate powering off wifi is safe
RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr()
RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id()
RDMA/cm: Fix an error check in cm_alloc_id_priv()
i2c: iproc: generate stop event for slave writes
i2c: aspeed: Avoid i2c interrupt status clear race condition.
nvme: prevent double free in nvme_alloc_ns() error handling
dmaengine: dmatest: Fix process hang when reading 'wait' parameter
arm64: vdso: Add -fasynchronous-unwind-tables to cflags
UBUNTU: upstream stable to v4.19.121, v5.4.39

See original description

Tags:

CVE References

Kamal Mostafa (kamalmostafa) on 2020-05-18

Changed in linux (Ubuntu):
status:	New → Confirmed
tags:	added: kernel-stable-tracking-bug
Changed in linux (Ubuntu Eoan):
status:	New → In Progress
assignee:	nobody → Kamal Mostafa (kamalmostafa)

Kamal Mostafa (kamalmostafa) on 2020-05-18

description:

updated

Khaled El Mously (kmously) on 2020-06-05

Changed in linux (Ubuntu Eoan):
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2020-07-01:

Download full text (32.7 KiB)

This bug was fixed in the package linux - 5.3.0-62.56

---------------
linux (5.3.0-62.56) eoan; urgency=medium

  * CVE-2020-0543
    - UBUNTU/SAUCE: x86/speculation/srbds: do not try to turn mitigation off when
      not supported

* Packaging resync (LP: #1786013)
- [Packaging] update helper scripts

This bug was fixed in the package linux - 5.3.0-62.56

---------------
linux (5.3.0-62.56) eoan; urgency=medium

* CVE-2020-0543
    - UBUNTU/SAUCE: x86/speculation/srbds: do not try to turn mitigation off when
      not supported

* Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

* Eoan update: upstream stable patchset 2020-06-05 (LP: #1882303)
    - i2c: dev: Fix the race between the release of i2c_dev and cdev
    - KVM: SVM: Fix potential memory leak in svm_cpu_init()
    - ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
    - evm: Check also if *tfm is an error pointer in init_desc()
    - ima: Fix return value of ima_write_policy()
    - mtd: spinand: Propagate ECC information to the MTD structure
    - fix multiplication overflow in copy_fdtable()
    - ubifs: remove broken lazytime support
    - iommu/amd: Fix over-read of ACPI UID from IVRS table
    - i2c: mux: demux-pinctrl: Fix an error handling path in
      'i2c_demux_pinctrl_probe()'
    - ubi: Fix seq_file usage in detailed_erase_block_info debugfs file
    - gcc-common.h: Update for GCC 10
    - HID: multitouch: add eGalaxTouch P80H84 support
    - HID: alps: Add AUI1657 device ID
    - HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead
    - scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV
    - scsi: qla2xxx: Delete all sessions before unregister local nvme port
    - configfs: fix config_item refcnt leak in configfs_rmdir()
    - vhost/vsock: fix packet delivery order to monitoring devices
    - aquantia: Fix the media type of AQC100 ethernet controller in the driver
    - component: Silence bind error on -EPROBE_DEFER
    - scsi: ibmvscsi: Fix WARN_ON during event pool release
    - HID: i2c-hid: reset Synaptics SYNA2393 on resume
    - x86/apic: Move TSC deadline timer debug printk
    - gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
    - HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock
    - ceph: fix double unlock in handle_cap_export()
    - stmmac: fix pointer check after utilization in stmmac_interrupt
    - USB: core: Fix misleading driver bug report
    - platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
    - ARM: futex: Address build warning
    - padata: Replace delayed timer with immediate workqueue in padata_reorder
    - padata: initialize pd->cpu with effective cpumask
    - padata: purge get_cpu and reorder_via_wq from padata_do_serial
    - ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio
      option
    - ALSA: pcm: fix incorrect hw_base increase
    - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme
    - ALSA: hda/realtek - Add more fixup entries for Clevo machines
    - drm/etnaviv: fix perfmon domain interation
    - apparmor: fix potential label refcnt leak in aa_change_profile
    - apparmor: Fix aa_label refcnt leak in policy_update
    - dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
    - dmaengine: owl: Use correct lock in owl_dma_get_pchan()
    - drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance.
    - powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE
    - powerpc/64s: Disable STRICT_KERNEL_RWX
    - media: fdp1: Fix R-Car M3-N naming in debug message
    - Revert "net/ibmvnic: Fix EOI when running in XIVE mode"
    - Revert "gfs2: Don't demote a glock until its revokes are written"
    - staging: iio: ad2s1210: Fix SPI reading
    - staging: greybus: Fix uninitialized scalar variable
    - iio: sca3000: Remove an erroneous 'get_device()'
    - iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
    - misc: rtsx: Add short delay after exit from ASPM
    - mei: release me_cl object reference
    - ipack: tpci200: fix error return code in tpci200_register()
    - rapidio: fix an error in get_user_pages_fast() error handling
    - rxrpc: Fix a memory leak in rxkad_verify_response()
    - x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks
    - iio: adc: stm32-adc: Use dma_request_chan() instead
      dma_request_slave_channel()
    - iio: adc: stm32-adc: fix device used to request dma
    - iio: adc: stm32-dfsdm: Use dma_request_chan() instead
      dma_request_slave_channel()
    - iio: adc: stm32-dfsdm: fix device used to request dma
    - rxrpc: Trace discarded ACKs
    - rxrpc: Fix ack discard
    - ubifs: fix wrong use of crypto_shash_descsize()
    - i2c: fix missing pm_runtime_put_sync in i2c_device_probe
    - evm: Fix a small race in init_desc()
    - afs: Don't unlock fetched data pages until the op completes successfully
    - mtd: Fix mtd not registered due to nvmem name collision
    - net/ena: Fix build warning in ena_xdp_set()
    - x86/mm/cpa: Flush direct map alias during cpa
    - ibmvnic: Skip fatal error reset after passive init
    - iommu/amd: Call domain_flush_complete() in update_domain()
    - drm/amd/display: Prevent dpcd reads with passive dongles
    - KVM: selftests: Fix build for evmcs.h
    - scripts/gdb: repair rb_first() and rb_last()
    - ALSA: hda - constify and cleanup static NodeID tables
    - ALSA: hda: patch_realtek: fix empty macro usage in if block
    - ALSA: hda: Manage concurrent reg access more properly
    - ALSA: hda/realtek - Add supported new mute Led for HP
    - ALSA: hda/realtek - Add HP new mute led supported for ALC236
    - ALSA: hda/realtek: Add quirk for Samsung Notebook
    - ALSA: hda/realtek - Enable headset mic of ASUS GL503VM with ALC295
    - ALSA: hda/realtek - Enable headset mic of ASUS UX550GE with ALC295
    - ALSA: hda/realtek: Enable headset mic of ASUS UX581LV with ALC295
    - KVM: x86: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c
    - scsi: qla2xxx: Do not log message when reading port speed via sysfs
    - scsi: target: Put lun_ref at end of tmr processing
    - arm64: Fix PTRACE_SYSEMU semantics
    - dmaengine: dmatest: Restore default for channel
    - vsprintf: don't obfuscate NULL and error pointers
    - bpf: Avoid setting bpf insns pages read-only when prog is jited
    - staging: kpc2000: fix error return code in kp2000_pcie_probe()
    - iio: adc: ti-ads8344: Fix channel selection
    - tty: serial: add missing spin_lock_init for SiFive serial console
    - s390/pci: Fix s390_mmio_read/write with MIO
    - s390/kaslr: add support for R_390_JMP_SLOT relocation type
    - device-dax: don't leak kernel memory to user space after unloading kmem
    - kasan: disable branch tracing for core runtime
    - rxrpc: Fix the excessive initial retransmission timeout
    - s390/kexec_file: fix initrd location for kdump kernel
    - flow_dissector: Drop BPF flow dissector prog ref on netns cleanup
    - tpm: check event log version before reading final events
    - sched/fair: Reorder enqueue/dequeue_task_fair path
    - sched/fair: Fix reordering of enqueue/dequeue_task_fair()
    - sched/fair: Fix enqueue_task_fair() warning some more

* Eoan update: upstream stable patchset 2020-06-01 (LP: #1881657)
    - net: dsa: Do not make user port errors fatal
    - shmem: fix possible deadlocks on shmlock_user_lock
    - net/sonic: Fix a resource leak in an error handling path in
      'jazz_sonic_probe()'
    - net: moxa: Fix a potential double 'free_irq()'
    - drop_monitor: work around gcc-10 stringop-overflow warning
    - virtio-blk: handle block_device_operations callbacks after hot unplug
    - scsi: sg: add sg_remove_request in sg_write
    - mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040
    - net: fix a potential recursive NETDEV_FEAT_CHANGE
    - net: phy: fix aneg restart in phy_ethtool_set_eee
    - pppoe: only process PADT targeted at local interfaces
    - Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
    - tcp: fix error recovery in tcp_zerocopy_receive()
    - virtio_net: fix lockdep warning on 32 bit
    - hinic: fix a bug of ndo_stop
    - net: dsa: loop: Add module soft dependency
    - net: ipv4: really enforce backoff for redirects
    - netprio_cgroup: Fix unlimited memory leak of v2 cgroups
    - net: tcp: fix rx timestamp behavior for tcp_recvmsg
    - tcp: fix SO_RCVLOWAT hangs with fat skbs
    - riscv: fix vdso build with lld
    - dmaengine: pch_dma.c: Avoid data race between probe and irq handler
    - dmaengine: mmp_tdma: Reset channel error on release
    - cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once
    - ALSA: hda/hdmi: fix race in monitor detection during probe
    - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
    - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
    - gfs2: Another gfs2_walk_metadata fix
    - pinctrl: baytrail: Enable pin configuration setting for GPIO chip
    - pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
    - i40iw: Fix error handling in i40iw_manage_arp_cache()
    - mmc: core: Check request type before completing the request
    - mmc: block: Fix request completion in the CQE timeout path
    - NFS: Fix fscache super_cookie index_key from changing after umount
    - nfs: fscache: use timespec64 in inode auxdata
    - NFSv4: Fix fscache cookie aux_data to ensure change_attr is included
    - netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
    - arm64: fix the flush_icache_range arguments in machine_kexec
    - netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start()
    - IB/mlx4: Test return value of calls to ib_get_cached_pkey
    - hwmon: (da9052) Synchronize access with mfd
    - pnp: Use list_for_each_entry() instead of open coding
    - gcc-10 warnings: fix low-hanging fruit
    - Stop the ad-hoc games with -Wno-maybe-initialized
    - [Config] updateconfigs for CC_HAS_WARN_MAYBE_UNINITIALIZED
    - gcc-10: disable 'zero-length-bounds' warning for now
    - gcc-10: disable 'array-bounds' warning for now
    - gcc-10: disable 'stringop-overflow' warning for now
    - gcc-10: disable 'restrict' warning for now
    - gcc-10: avoid shadowing standard library 'free()' in crypto
    - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
    - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
    - ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
    - usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
    - usb: host: xhci-plat: keep runtime active when removing host
    - usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
    - ARM: dts: dra7: Fix bus_dma_limit for PCIe
    - ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
    - cifs: fix leaked reference on requeued write
    - x86: Fix early boot crash on gcc-10, third try
    - x86/unwind/orc: Fix error handling in __unwind_start()
    - exec: Move would_dump into flush_old_exec
    - clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks
    - dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg()
    - usb: gadget: net2272: Fix a memory leak in an error handling path in
      'net2272_plat_probe()'
    - usb: gadget: audio: Fix a missing error return value in audio_bind()
    - usb: gadget: legacy: fix error return code in gncm_bind()
    - usb: gadget: legacy: fix error return code in cdc_bind()
    - clk: Unlink clock if failed to prepare or enable
    - arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328
      boards
    - arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
    - ARM: dts: r8a73a4: Add missing CMT1 interrupts
    - arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes
    - ARM: dts: r8a7740: Add missing extal2 to CPG node
    - KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    - Makefile: disallow data races on gcc-10 as well
    - net: phy: remove calls to genphy_config_init
    - net: phy: microchip_t1: add lan87xx_phy_init to initialize the lan87xx phy.
    - KVM: arm: vgic: Synchronize the whole guest on GIC{D,R}_I{S,C}ACTIVER read
    - gpio: pca953x: Fix pca953x_gpio_set_config
    - SUNRPC: Add "@len" parameter to gss_unwrap()
    - SUNRPC: Fix GSS privacy computation of auth->au_ralign
    - ftrace/selftests: workaround cgroup RT scheduling issues
    - sun6i: dsi: fix gcc-4.8
    - net_sched: fix tcm_parent in tc filter dump
    - dpaa2-eth: properly handle buffer size restrictions
    - net: stmmac: fix num_por initialization
    - dpaa2-eth: prevent array underflow in update_cls_rule()
    - nfp: abm: fix error return code in nfp_abm_vnic_alloc()
    - r8169: re-establish support for RTL8401 chip version
    - umh: fix memory leak on execve failure
    - dmaengine: mmp_tdma: Do not ignore slave config validation errors
    - selftests/ftrace: Check the first record for kprobe_args_type.tc
    - drm/amd/powerplay: avoid using pm_en before it is initialized revised
    - drm/amdgpu: simplify padding calculations (v2)
    - drm/amdgpu: invalidate L2 before SDMA IBs (v2)
    - IB/hfi1: Fix another case where pq is left on waitlist
    - pinctrl: sunrisepoint: Fix PAD lock register offset for SPT-H
    - pinctrl: qcom: fix wrong write in update_dual_edge
    - bpf: Fix error return code in map_lookup_and_delete_elem()
    - ALSA: firewire-lib: fix 'function sizeof not defined' error of tracepoints
      format
    - drm/i915: Don't enable WaIncreaseLatencyIPCEnabled when IPC is disabled
    - bpf, sockmap: msg_pop_data can incorrecty set an sge length
    - bpf, sockmap: bpf_tcp_ingress needs to subtract bytes from sg.size
    - mmc: alcor: Fix a resource leak in the error path for ->probe()
    - mmc: core: Fix recursive locking issue in CQE recovery path
    - gfs2: More gfs2_find_jhead fixes
    - fork: prevent accidental access to clone3 features
    - drm/amdgpu: force fbdev into vram
    - drm/i915/gvt: Fix kernel oops for 3-level ppgtt guest
    - nfs: fix NULL deference in nfs4_get_valid_delegation
    - SUNRPC: Signalled ASYNC tasks need to exit
    - netfilter: nft_set_rbtree: Add missing expired checks
    - RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info()
    - IB/core: Fix potential NULL pointer dereference in pkey cache
    - RDMA/core: Fix double put of resource
    - RDMA/iw_cxgb4: Fix incorrect function parameters
    - s390/ism: fix error return code in ism_probe()
    - mm, memcg: fix inconsistent oom event behavior
    - NFSv3: fix rpc receive buffer size for MOUNT call
    - net/rds: Use ERR_PTR for rds_message_alloc_sgs()
    - gcc-10: mark more functions __init to avoid section mismatch warnings
    - usb: usbfs: correct kernel->user page attribute mismatch
    - USB: usbfs: fix mmap dma mismatch
    - ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA
    - Make the "Reducing compressed framebufer size" message be DRM_INFO_ONCE()
    - ARM: dts: imx6dl-yapp4: Fix Ursa board Ethernet connection
    - drm/amd/display: add basic atomic check for cursor plane
    - powerpc/32s: Fix build failure with CONFIG_PPC_KUAP_DEBUG
    - fanotify: fix merging marks masks with FAN_ONDIR
    - arm64: dts: meson-g12-common: fix dwc2 clock names
    - SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()")
    - bpf: Fix sk_psock refcnt leak when receiving message
    - libbpf: Extract and generalize CPU mask parsing logic

* upgrading to 4.15.0-99-generic breaks the sound and the trackpad
    (LP: #1875916) // Eoan update: upstream stable patchset 2020-06-01
    (LP: #1881657)
    - Revert "ALSA: hda/realtek: Fix pop noise on ALC225"

* Pop sound from build-in speaker during cold boot and resume from S3
    (LP: #1866357) // Eoan update: upstream stable patchset 2020-06-01
    (LP: #1881657)
    - ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse

* Eoan update: upstream stable patchset 2020-05-26 (LP: #1880758)
    - USB: serial: qcserial: Add DW5816e support
    - tracing/kprobes: Fix a double initialization typo
    - vt: fix unicode console freeing with a common interface
    - dp83640: reverse arguments to list_add_tail
    - fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
    - net: macsec: preserve ingress frame ordering
    - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
    - net_sched: sch_skbprio: add message validation to skbprio_change()
    - net: usb: qmi_wwan: add support for DW5816e
    - sch_choke: avoid potential panic in choke_reset()
    - sch_sfq: validate silly quantum values
    - tipc: fix partial topology connection closure
    - bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
    - net/mlx5: Fix forced completion access non initialized command entry
    - net/mlx5: Fix command entry leak in Internal Error State
    - bnxt_en: Improve AER slot reset.
    - bnxt_en: Fix VF anti-spoof filter setup.
    - net: stricter validation of untrusted gso packets
    - HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
    - sctp: Fix bundling of SHUTDOWN with COOKIE-ACK
    - HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
    - USB: uas: add quirk for LaCie 2Big Quadra
    - USB: serial: garmin_gps: add sanity checking for data length
    - tracing: Add a vmalloc_sync_mappings() for safe measure
    - KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
    - KVM: arm64: Fix 32bit PC wrap-around
    - arm64: hugetlb: avoid potential NULL dereference
    - mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
    - staging: gasket: Check the return value of gasket_get_bar_index()
    - coredump: fix crash when umh is disabled
    - batman-adv: fix batadv_nc_random_weight_tq
    - batman-adv: Fix refcnt leak in batadv_show_throughput_override
    - batman-adv: Fix refcnt leak in batadv_store_throughput_override
    - batman-adv: Fix refcnt leak in batadv_v_ogm_process
    - x86/entry/64: Fix unwind hints in register clearing code
    - x86/entry/64: Fix unwind hints in kernel exit path
    - x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
    - x86/unwind/orc: Don't skip the first frame for inactive tasks
    - x86/unwind/orc: Prevent unwinding before ORC initialization
    - x86/unwind/orc: Fix error path for bad ORC entry type
    - x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
    - netfilter: nat: never update the UDP checksum when it's 0
    - netfilter: nf_osf: avoid passing pointer to local var
    - objtool: Fix stack offset tracking for indirect CFAs
    - scripts/decodecode: fix trapping instruction formatting
    - ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
    - net: macb: Fix runtime PM refcounting
    - drm/amdgpu: move kfd suspend after ip_suspend_phase1
    - drm/amdgpu: drop redundant cg/pg ungate on runpm enter
    - tty: xilinx_uartps: Fix missing id assignment to the console
    - devlink: fix return value after hitting end in region read
    - ipv6: Use global sernum for dst validation with nexthop objects
    - mlxsw: spectrum_acl_tcam: Position vchunk in a vregion list properly
    - neigh: send protocol value in neighbor create notification
    - net: dsa: Do not leave DSA master with NULL netdev_ops
    - net: macb: fix an issue about leak related system resources
    - net: tc35815: Fix phydev supported/advertising mask
    - net/tls: Fix sk_psock refcnt leak in bpf_exec_tx_verdict()
    - net/tls: Fix sk_psock refcnt leak when in tls_data_ready()
    - nfp: abm: fix a memory leak bug
    - tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040
    - bnxt_en: Reduce BNXT_MSIX_VEC_MAX value to supported CQs per PF.
    - bnxt_en: Return error when allocating zero size context memory.
    - net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()
    - net: mvpp2: cls: Prevent buffer overflow in mvpp2_ethtool_cls_rule_del()
    - Revert "HID: wacom: generic: read the number of expected touches on a per
      collection basis"
    - HID: wacom: Report 2nd-gen Intuos Pro S center button status over BT
    - crypto: arch/nhpoly1305 - process in explicit 4k chunks
    - KVM: s390: Remove false WARN_ON_ONCE for the PQAP instruction
    - KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path
    - drm: ingenic-drm: add MODULE_DEVICE_TABLE
    - epoll: atomically remove wait entry on wake up
    - eventpoll: fix missing wakeup for ovflist in ep_poll_callback
    - mm: limit boost_watermark on small zones
    - ceph: fix endianness bug when handling MDS session feature bits
    - ceph: demote quotarealm lookup warning to a debug message
    - riscv: set max_pfn to the PFN of the last page
    - KVM: x86: Fixes posted interrupt check for IRQs delivery modes
    - arch/x86/kvm/svm/sev.c: change flag passed to GUP fast in sev_pin_memory()
    - iommu/virtio: Reverse arguments to list_add
    - mm, memcg: fix error return value of mem_cgroup_css_alloc()
    - fsnotify: replace inode pointer with an object id
    - fanotify: merge duplicate events on parent and child

* Eoan update: upstream stable patchset 2020-05-21 (LP: #1879994)
    - vhost: vsock: kick send_pkt worker once device is started
    - ASoC: topology: Check return value of pcm_new_ver
    - selftests/ipc: Fix test failure seen after initial test run
    - ASoC: sgtl5000: Fix VAG power-on handling
    - usb: dwc3: gadget: Properly set maxpacket limit
    - ASoC: rsnd: Fix parent SSI start/stop in multi-SSI mode
    - ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode
    - ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry
    - drm/amdgpu: Correctly initialize thermal controller for GPUs with Powerplay
      table v0 (e.g Hawaii)
    - wimax/i2400m: Fix potential urb refcnt leak
    - net: stmmac: fix enabling socfpga's ptp_ref_clock
    - net: stmmac: Fix sub-second increment
    - ASoC: rsnd: Don't treat master SSI in multi SSI setup as parent
    - ASoC: rsnd: Fix "status check failed" spam for multi-SSI
    - cifs: protect updating server->dstaddr with a spinlock
    - scripts/config: allow colons in option strings for sed
    - lib/mpi: Fix building for powerpc with clang
    - net: bcmgenet: suppress warnings on failed Rx SKB allocations
    - net: systemport: suppress warnings on failed Rx SKB allocations
    - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
    - drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event
    - hexagon: clean up ioremap
    - hexagon: define ioremap_uc
    - ALSA: hda: Match both PCI ID and SSID for driver blacklist
    - platform/x86: GPD pocket fan: Fix error message when temp-limits are out of
      range
    - mac80211: add ieee80211_is_any_nullfunc()
    - cgroup, netclassid: remove double cond_resched
    - ASoC: topology: Check return value of soc_tplg_create_tlv
    - ASoC: topology: Check return value of soc_tplg_*_create
    - ASoC: topology: Check soc_tplg_add_route return value
    - ASoC: topology: Check return value of soc_tplg_dai_config
    - ASoC: topology: Fix endianness issue
    - remoteproc: qcom_q6v5_mss: fix a bug in q6v5_probe()
    - cifs: do not share tcons with DFS
    - tracing: Fix memory leaks in trace_events_hist.c
    - drm/i915: Extend WaDisableDARBFClkGating to icl,ehl,tgl
    - Revert "software node: Simplify software_node_release() function"
    - ACPI: PM: s2idle: Fix comment in acpi_s2idle_prepare_late()
    - Revert "drm/amd/display: setting the DIG_MODE to the correct value."
    - tools headers UAPI: Sync copy of arm64's asm/unistd.h with the kernel
      sources
    - udp: document udp_rcv_segment special case for looped packets
    - PM / devfreq: Add missing locking while setting suspend_freq

* Eoan update: upstream stable patchset 2020-05-18 (LP: #1879397)
    - drm/edid: Fix off-by-one in DispID DTD pixel clock
    - drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
    - drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
    - drm/qxl: qxl_release use after free
    - btrfs: fix block group leak when removing fails
    - ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
    - ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
    - ALSA: hda/hdmi: fix without unlocked before return
    - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
    - PM: ACPI: Output correct message on target power state
    - PM: hibernate: Freeze kernel threads in software_resume()
    - dm verity fec: fix hash block number in verity_fec_decode
    - dm writecache: fix data corruption when reloading the target
    - dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
    - scsi: qla2xxx: set UNLOADING before waiting for session deletion
    - scsi: qla2xxx: check UNLOADING before posting async work
    - RDMA/mlx5: Set GRH fields in query QP on RoCE
    - RDMA/mlx4: Initialize ib_spec on the stack
    - RDMA/core: Prevent mixed use of FDs between shared ufiles
    - RDMA/core: Fix race between destroy and release FD object
    - vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
    - vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
    - iommu/qcom: Fix local_base status check
    - scsi: target/iblock: fix WRITE SAME zeroing
    - iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
    - ALSA: opti9xx: shut up gcc-10 range warning
    - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
    - dmaengine: dmatest: Fix iteration non-stop logic
    - selinux: properly handle multiple messages in selinux_netlink_send()
    - btrfs: fix partial loss of prealloc extent past i_size after fsync
    - btrfs: transaction: Avoid deadlock due to bad initialization timing of
      fs_info::journal_info
    - mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout
      loop
    - mmc: sdhci-xenon: fix annoying 1.8V regulator warning
    - mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
    - mmc: sdhci-msm: Enable host capabilities pertains to R1b response
    - mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
    - mmc: meson-mx-sdio: remove the broken ->card_busy() op
    - dma-buf: Fix SET_NAME ioctl uapi
    - drm/amd/display: Fix green screen issue after suspend
    - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
    - btrfs: fix transaction leak in btrfs_recover_relocation
    - crypto: caam - fix the address of the last entry of S/G
    - ALSA: line6: Fix POD HD500 audio playback
    - i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling
    - dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
    - IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info()
    - ARM: dts: imx6qdl-sr-som-ti: indicate powering off wifi is safe
    - RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr()
    - RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id()
    - RDMA/cm: Fix an error check in cm_alloc_id_priv()
    - i2c: iproc: generate stop event for slave writes
    - i2c: aspeed: Avoid i2c interrupt status clear race condition.
    - nvme: prevent double free in nvme_alloc_ns() error handling
    - dmaengine: dmatest: Fix process hang when reading 'wait' parameter
    - arm64: vdso: Add -fasynchronous-unwind-tables to cflags

* Eoan update: upstream stable patchset 2020-05-15 (LP: #1878990)
    - remoteproc: Fix wrong rvring index computation
    - usb: dwc3: gadget: Do link recovery for SS and SSP
    - usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
    - iio:ad7797: Use correct attribute_group
    - ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs
    - ASoC: tas571x: disable regulators on failed probe
    - ASoC: wm8960: Fix wrong clock after suspend & resume
    - nfsd: memory corruption in nfsd4_lock()
    - i2c: altera: use proper variable to hold errno
    - rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket
    - net/cxgb4: Check the return from t4_query_params properly
    - xfs: acquire superblock freeze protection on eofblocks scans
    - svcrdma: Fix trace point use-after-free race
    - svcrdma: Fix leak of svc_rdma_recv_ctxt objects
    - PCI: Move Apex Edge TPU class quirk to fix BAR assignment
    - ARM: dts: bcm283x: Disable dsi0 node
    - cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled
    - net/mlx5: Fix failing fw tracer allocation on s390
    - perf/core: fix parent pid/tid in task exit events
    - bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension
    - mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy
      path
    - xfs: clear PF_MEMALLOC before exiting xfsaild thread
    - bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
    - net: fec: set GPR bit on suspend by DT configuration.
    - x86: hyperv: report value of misc_features
    - xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
    - ALSA: hda: Keep the controller initialization even if no codecs found
    - ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported
    - scsi: target: fix PR IN / READ FULL STATUS for FC
    - scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN
    - objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
    - objtool: Support Clang non-section symbols in ORC dump
    - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    - ALSA: hda: call runtime_allow() for all hda controllers
    - arm64: Delete the space separator in __emit_inst
    - ext4: use matching invalidatepage in ext4_writepage
    - ext4: increase wait time needed before reuse of deleted inode numbers
    - ext4: convert BUG_ON's to WARN_ON's in mballoc.c
    - hwmon: (jc42) Fix name to have no illegal characters
    - bpf, x86_32: Fix clobbering of dst for BPF_JSET
    - qed: Fix use after free in qed_chain_free
    - ext4: check for non-zero journal inum in ext4_calculate_overhead
    - ubifs: Fix ubifs_tnc_lookup() usage in do_kill_orphans()
    - printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
    - ASoC: stm32: sai: fix sai probe
    - kbuild: fix DT binding schema rule again to avoid needless rebuilds
    - usb: gadget: udc: atmel: Fix vbus disconnect handling
    - afs: Make record checking use TASK_UNINTERRUPTIBLE when appropriate
    - afs: Fix to actually set AFS_SERVER_FL_HAVE_EPOCH
    - counter: 104-quad-8: Add lock guards - generic interface
    - s390/ftrace: fix potential crashes when switching tracers
    - drivers: soc: xilinx: fix firmware driver Kconfig dependency
    - bpf: Forbid XADD on spilled pointers for unprivileged users
    - net/mlx5e: Don't trigger IRQ multiple times on XSK wakeup to avoid WQ
      overruns
    - net/mlx5e: Get the latest values from counters in switchdev mode
    - PCI: Add ACS quirk for Zhaoxin multi-function devices
    - PCI: Make ACS quirk implementations more uniform
    - PCI: Unify ACS quirk desired vs provided checking
    - PCI: Add Zhaoxin Vendor ID
    - PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports
    - s390/pci: do not set affinity for floating irqs
    - sched/core: Fix reset-on-fork from RT with uclamp
    - netfilter: nat: fix error handling upon registering inet hook
    - PM: sleep: core: Switch back to async_schedule_dev()
    - um: ensure `make ARCH=um mrproper` removes
      arch/$(SUBARCH)/include/generated/
    - bpf, x86_32: Fix logic error in BPF_LDX zero-extension
    - libbpf: Initialize *nl_pid so gcc 10 is happy
    - signal: check sig before setting info in kill_pid_usb_asyncio
    - afs: Fix length of dump of bad YFSFetchStatus record
    - ALSA: hda: Release resources at error in delayed probe
    - net: stmmac: socfpga: Allow all RGMII modes
    - mac80211: fix channel switch trigger from unknown mesh peer
    - blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget
    - qed: Fix race condition between scheduling and destroying the slowpath
      workqueue
    - Crypto: chelsio - Fixes a hang issue during driver registration
    - net: use indirect call wrappers for skb_copy_datagram_iter()
    - ASoC: stm32: spdifrx: fix regmap status check

* Performing function level reset of AMD onboard USB and audio devices causes
    system lockup (LP: #1865988)
    - SAUCE: PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0
    - SAUCE: PCI: Avoid FLR for AMD Starship USB 3.0

* seccomp_benchmark times out on eoan (LP: #1881576)
    - SAUCE: selftests/seccomp: use 90s as timeout

* Slow send speed with Intel I219-V on Ubuntu 18.04.1 (LP: #1802691)
    - e1000e: Disable TSO for buffer overrun workaround

* CVE-2020-10711
    - netlabel: cope with NULL catmap

* CVE-2020-13143
    - USB: gadget: fix illegal array access in binding with UDC

* rtl8723bu wifi issue after being turned off (LP: #1878296)
    - rtl8xxxu: Improve TX performance of RTL8723BU on rtl8xxxu driver
    - rtl8xxxu: add bluetooth co-existence support for single antenna
    - rtl8xxxu: remove set but not used variable 'rate_mask'
    - rtl8xxxu: Remove set but not used variable 'vif', 'dev', 'len'

* shiftfs: fix btrfs snapshot deletion (LP: #1879688)
    - SAUCE: shiftfs: let userns root destroy subvolumes from other users

* Miscellaneous Ubuntu changes
    - SAUCE: kselftest: ftrace: check for existing probe

-- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Tue, 23 Jun 2020 12:01:33 +0200

Changed in linux (Ubuntu Eoan):
status:	Fix Committed → Fix Released

Po-Hsu Lin (cypressyew) on 2022-03-16

Changed in linux (Ubuntu):
status:	Confirmed → Invalid

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package